attaform 0.17.1 → 0.18.0

package/dist/chunks/indexeddb.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"indexeddb.cjs","sources":["../../src/runtime/core/persistence/indexeddb.ts"],"sourcesContent":["import { __DEV__ } from '../dev'\nimport type { FormStorage } from '../../types/types-api'\n\n/**\n * Zero-dependency IndexedDB adapter. A single shared DB\n * (`attaform`) with a single object store (`kv`). Entries are\n * structured-cloned on write, so `Date` / `Map` / `Set` / typed\n * arrays / nested arrays round-trip without JSON flattening.\n *\n * Size budget: ≤1 KB gzip (verified via size-limit). Consumers who\n * want richer IDB features (indexes, cursors, transactions) should\n * roll their own `FormStorage`.\n *\n * Open failures (private mode, blocked DB, unsupported environment)\n * resolve `dbPromise` to `null`; subsequent reads/writes silently\n * no-op so the form stays usable. A one-shot dev warning surfaces\n * the degradation so the developer notices.\n */\n\nconst DB_NAME = 'attaform'\nconst STORE_NAME = 'kv'\nconst DB_VERSION = 1\n\nlet dbPromise: Promise<IDBDatabase | null> | null = null\n// One-shot dev-warn flags for adapter-level failures. Module-scoped\n// so the warning only fires once per process — re-opening the DB\n// after `__resetIndexedDbForTests` clears `dbPromise` but leaves\n// these flags alone (tests that want a fresh warn-state should\n// reset them via the test hook below).\nlet warnedOnOpenFailure = false\nlet warnedOnWriteFailure = false\n\nfunction openDb(): Promise<IDBDatabase | null> {\n  if (dbPromise !== null) return dbPromise\n  if (typeof indexedDB === 'undefined') {\n    dbPromise = Promise.resolve(null)\n    return dbPromise\n  }\n  dbPromise = new Promise<IDBDatabase | null>((resolve) => {\n    const request = indexedDB.open(DB_NAME, DB_VERSION)\n    request.onupgradeneeded = () => {\n      const db = request.result\n      if (!db.objectStoreNames.contains(STORE_NAME)) {\n        db.createObjectStore(STORE_NAME)\n      }\n    }\n    request.onsuccess = () => resolve(request.result)\n    request.onerror = () => {\n      // Drop to null so subsequent calls don't retry a broken open —\n      // the form just runs without persistence.\n      if (__DEV__ && !warnedOnOpenFailure) {\n        warnedOnOpenFailure = true\n        console.warn(\n          '[attaform] IndexedDB open failed; persistence disabled. ' +\n            'Common causes: private-mode disabled IDB, browser quota policy.',\n          request.error\n        )\n      }\n      resolve(null)\n    }\n    request.onblocked = () => {\n      if (__DEV__ && !warnedOnOpenFailure) {\n        warnedOnOpenFailure = true\n        console.warn(\n          '[attaform] IndexedDB open blocked (another tab holds an older version); persistence disabled until the conflict resolves.'\n        )\n      }\n      // `onblocked` is transient — the holding tab can close at any\n      // moment. Clear the cache so the next persistence call retries\n      // the open instead of permanently no-opping.\n      dbPromise = null\n      resolve(null)\n    }\n  })\n  return dbPromise\n}\n\n/**\n * Read path: resolve on `request.onsuccess` with the fetched value.\n * `readonly` transactions are atomic by nature — there's no commit\n * phase to worry about, so waiting for the transaction's\n * `oncomplete` would be redundant.\n */\nfunction runReadOp<T>(fn: (store: IDBObjectStore) => IDBRequest<T>): Promise<T | undefined> {\n  return openDb().then(\n    (db) =>\n      new Promise<T | undefined>((resolve) => {\n        if (db === null) return resolve(undefined)\n        let tx: IDBTransaction\n        try {\n          tx = db.transaction(STORE_NAME, 'readonly')\n        } catch {\n          return resolve(undefined)\n        }\n        const store = tx.objectStore(STORE_NAME)\n        const request = fn(store)\n        request.onsuccess = () => resolve(request.result)\n        request.onerror = () => resolve(undefined)\n        tx.onerror = () => resolve(undefined)\n      })\n  )\n}\n\n/**\n * Write path: resolve on `tx.oncomplete` (the spec-defined commit\n * signal), NOT on `request.onsuccess` (which fires per-request,\n * before the transaction commits).\n *\n * Resolving on `onsuccess` means a tab close, power loss, or\n * browser crash between the request succeeding and the transaction\n * committing silently loses the write — the Promise already\n * resolved successfully. Aborts (quota exceeded, version change,\n * constraint violation) likewise roll back after `onsuccess` fired.\n *\n * Resolving on `oncomplete` makes durability a precondition for\n * the Promise settlement; `onabort` catches the failure cases so\n * the Promise resolves to `undefined` instead of hanging.\n */\nfunction runWriteOp(fn: (store: IDBObjectStore) => void): Promise<void> {\n  return openDb().then(\n    (db) =>\n      new Promise<void>((resolve) => {\n        if (db === null) return resolve()\n        let tx: IDBTransaction\n        try {\n          tx = db.transaction(STORE_NAME, 'readwrite')\n        } catch {\n          return resolve()\n        }\n        fn(tx.objectStore(STORE_NAME))\n        tx.oncomplete = () => resolve()\n        tx.onabort = () => {\n          // QuotaExceededError, version-change, constraint violation\n          // — all surface as a transaction abort. One-shot dev warn so\n          // the developer notices instead of silently losing writes.\n          if (__DEV__ && !warnedOnWriteFailure) {\n            warnedOnWriteFailure = true\n            console.warn(\n              '[attaform] IndexedDB transaction aborted; subsequent writes will silently no-op. ' +\n                'Common cause: storage quota exceeded.',\n              tx.error\n            )\n          }\n          resolve()\n        }\n        tx.onerror = () => resolve()\n      })\n  )\n}\n\nexport function createIndexedDbAdapter(): FormStorage {\n  return {\n    async getItem(key) {\n      return await runReadOp<unknown>((store) => store.get(key) as IDBRequest<unknown>)\n    },\n    async setItem(key, value) {\n      await runWriteOp((store) => void store.put(value, key))\n    },\n    async removeItem(key) {\n      await runWriteOp((store) => void store.delete(key))\n    },\n    async listKeys(prefix) {\n      // `IDBKeyRange.bound(prefix, prefix + '￿')` would skip attaform\n      // keys that contain the U+FFFF code unit; safer to fetch all\n      // keys and filter in-process. The attaform-managed key namespace is\n      // tiny in practice, so the cost is negligible.\n      const all = await runReadOp<IDBValidKey[]>(\n        (store) => store.getAllKeys() as IDBRequest<IDBValidKey[]>\n      )\n      if (all === undefined) return []\n      const out: string[] = []\n      for (const k of all) {\n        if (typeof k === 'string' && k.startsWith(prefix)) out.push(k)\n      }\n      return out\n    },\n  }\n}\n\n/**\n * Test hook: reset the cached DB promise so a subsequent call re-\n * opens the database. Production code should never call this —\n * exposed for `fake-indexeddb`-backed tests that tear down the\n * in-memory DB between cases.\n */\nexport function __resetIndexedDbForTests(): void {\n  dbPromise = null\n  warnedOnOpenFailure = false\n  warnedOnWriteFailure = false\n}\n"],"names":["__DEV__"],"mappings":";;;;AAmBA,MAAM,OAAA,GAAU,UAAA;AAChB,MAAM,UAAA,GAAa,IAAA;AACnB,MAAM,UAAA,GAAa,CAAA;AAEnB,IAAI,SAAA,GAAgD,IAAA;AAMpD,IAAI,mBAAA,GAAsB,KAAA;AAC1B,IAAI,oBAAA,GAAuB,KAAA;AAE3B,SAAS,MAAA,GAAsC;AAC7C,EAAA,IAAI,SAAA,KAAc,MAAM,OAAO,SAAA;AAC/B,EAAA,IAAI,OAAO,cAAc,WAAA,EAAa;AACpC,IAAA,SAAA,GAAY,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAChC,IAAA,OAAO,SAAA;AAAA,EACT;AACA,EAAA,SAAA,GAAY,IAAI,OAAA,CAA4B,CAAC,OAAA,KAAY;AACvD,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAClD,IAAA,OAAA,CAAQ,kBAAkB,MAAM;AAC9B,MAAA,MAAM,KAAK,OAAA,CAAQ,MAAA;AACnB,MAAA,IAAI,CAAC,EAAA,CAAG,gBAAA,CAAiB,QAAA,CAAS,UAAU,CAAA,EAAG;AAC7C,QAAA,EAAA,CAAG,kBAAkB,UAAU,CAAA;AAAA,MACjC;AAAA,IACF,CAAA;AACA,IAAA,OAAA,CAAQ,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAChD,IAAA,OAAA,CAAQ,UAAU,MAAM;AAGtB,MAAA,IAAIA,cAAA,IAAW,CAAC,mBAAA,EAAqB;AACnC,QAAA,mBAAA,GAAsB,IAAA;AACtB,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,yHAAA;AAAA,UAEA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,IACd,CAAA;AACA,IAAA,OAAA,CAAQ,YAAY,MAAM;AACxB,MAAA,IAAIA,cAAA,IAAW,CAAC,mBAAA,EAAqB;AACnC,QAAA,mBAAA,GAAsB,IAAA;AACtB,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN;AAAA,SACF;AAAA,MACF;AAIA,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,SAAA;AACT;AAQA,SAAS,UAAa,EAAA,EAAsE;AAC1F,EAAA,OAAO,QAAO,CAAE,IAAA;AAAA,IACd,CAAC,EAAA,KACC,IAAI,OAAA,CAAuB,CAAC,OAAA,KAAY;AACtC,MAAA,IAAI,EAAA,KAAO,IAAA,EAAM,OAAO,OAAA,CAAQ,MAAS,CAAA;AACzC,MAAA,IAAI,EAAA;AACJ,MAAA,IAAI;AACF,QAAA,EAAA,GAAK,EAAA,CAAG,WAAA,CAAY,UAAA,EAAY,UAAU,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,QAAQ,MAAS,CAAA;AAAA,MAC1B;AACA,MAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,WAAA,CAAY,UAAU,CAAA;AACvC,MAAA,MAAM,OAAA,GAAU,GAAG,KAAK,CAAA;AACxB,MAAA,OAAA,CAAQ,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAS,CAAA;AACzC,MAAA,EAAA,CAAG,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAS,CAAA;AAAA,IACtC,CAAC;AAAA,GACL;AACF;AAiBA,SAAS,WAAW,EAAA,EAAoD;AACtE,EAAA,OAAO,QAAO,CAAE,IAAA;AAAA,IACd,CAAC,EAAA,KACC,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC7B,MAAA,IAAI,EAAA,KAAO,IAAA,EAAM,OAAO,OAAA,EAAQ;AAChC,MAAA,IAAI,EAAA;AACJ,MAAA,IAAI;AACF,QAAA,EAAA,GAAK,EAAA,CAAG,WAAA,CAAY,UAAA,EAAY,WAAW,CAAA;AAAA,MAC7C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,OAAA,EAAQ;AAAA,MACjB;AACA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAA,CAAY,UAAU,CAAC,CAAA;AAC7B,MAAA,EAAA,CAAG,UAAA,GAAa,MAAM,OAAA,EAAQ;AAC9B,MAAA,EAAA,CAAG,UAAU,MAAM;AAIjB,QAAA,IAAIA,cAAA,IAAW,CAAC,oBAAA,EAAsB;AACpC,UAAA,oBAAA,GAAuB,IAAA;AACvB,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,wHAAA;AAAA,YAEA,EAAA,CAAG;AAAA,WACL;AAAA,QACF;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,CAAA;AACA,MAAA,EAAA,CAAG,OAAA,GAAU,MAAM,OAAA,EAAQ;AAAA,IAC7B,CAAC;AAAA,GACL;AACF;AAEO,SAAS,sBAAA,GAAsC;AACpD,EAAA,OAAO;AAAA,IACL,MAAM,QAAQ,GAAA,EAAK;AACjB,MAAA,OAAO,MAAM,SAAA,CAAmB,CAAC,UAAU,KAAA,CAAM,GAAA,CAAI,GAAG,CAAwB,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAA,EAAO;AACxB,MAAA,MAAM,UAAA,CAAW,CAAC,KAAA,KAAU,KAAK,MAAM,GAAA,CAAI,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,IACxD,CAAA;AAAA,IACA,MAAM,WAAW,GAAA,EAAK;AACpB,MAAA,MAAM,WAAW,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACpD,CAAA;AAAA,IACA,MAAM,SAAS,MAAA,EAAQ;AAKrB,MAAA,MAAM,MAAM,MAAM,SAAA;AAAA,QAChB,CAAC,KAAA,KAAU,KAAA,CAAM,UAAA;AAAW,OAC9B;AACA,MAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,OAAO,EAAC;AAC/B,MAAA,MAAM,MAAgB,EAAC;AACvB,MAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,QAAA,IAAI,OAAO,MAAM,QAAA,IAAY,CAAA,CAAE,WAAW,MAAM,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,GACF;AACF;;;;"}
+{"version":3,"file":"indexeddb.cjs","sources":["../../src/runtime/core/persistence/indexeddb.ts"],"sourcesContent":["import { __DEV__ } from '../dev'\nimport type { FormStorage } from '../../types/types-api'\n\n/**\n * Zero-dependency IndexedDB adapter. A single shared DB\n * (`attaform`) with a single object store (`kv`). Entries are\n * structured-cloned on write, so `Date` / `Map` / `Set` / typed\n * arrays / nested arrays round-trip without JSON flattening.\n *\n * Size budget: ≤1 KB gzip (verified via size-limit). Consumers who\n * want richer IDB features (indexes, cursors, transactions) should\n * roll their own `FormStorage`.\n *\n * Open failures (private mode, blocked DB, unsupported environment)\n * resolve `dbPromise` to `null`; subsequent reads/writes silently\n * no-op so the form stays usable. A one-shot dev warning surfaces\n * the degradation so the developer notices.\n */\n\nconst DB_NAME = 'attaform'\nconst STORE_NAME = 'kv'\nconst DB_VERSION = 1\n\nlet dbPromise: Promise<IDBDatabase | null> | null = null\n// One-shot dev-warn flags for adapter-level failures. Module-scoped\n// so the warning only fires once per process — re-opening the DB\n// after `__resetIndexedDbForTests` clears `dbPromise` but leaves\n// these flags alone (tests that want a fresh warn-state should\n// reset them via the test hook below).\nlet warnedOnOpenFailure = false\nlet warnedOnWriteFailure = false\n\nfunction openDb(): Promise<IDBDatabase | null> {\n  if (dbPromise !== null) return dbPromise\n  if (typeof indexedDB === 'undefined') {\n    dbPromise = Promise.resolve(null)\n    return dbPromise\n  }\n  dbPromise = new Promise<IDBDatabase | null>((resolve) => {\n    const request = indexedDB.open(DB_NAME, DB_VERSION)\n    request.onupgradeneeded = () => {\n      const db = request.result\n      if (!db.objectStoreNames.contains(STORE_NAME)) {\n        db.createObjectStore(STORE_NAME)\n      }\n    }\n    request.onsuccess = () => resolve(request.result)\n    request.onerror = () => {\n      // Drop to null so subsequent calls don't retry a broken open —\n      // the form just runs without persistence.\n      if (__DEV__ && !warnedOnOpenFailure) {\n        warnedOnOpenFailure = true\n        console.warn(\n          '[attaform] IndexedDB open failed; persistence disabled. ' +\n            'Common causes: private-mode disabled IDB, browser quota policy.',\n          request.error\n        )\n      }\n      resolve(null)\n    }\n    request.onblocked = () => {\n      if (__DEV__ && !warnedOnOpenFailure) {\n        warnedOnOpenFailure = true\n        console.warn(\n          '[attaform] IndexedDB open blocked (another tab holds an older version); persistence disabled until the conflict resolves.'\n        )\n      }\n      // `onblocked` is transient — the holding tab can close at any\n      // moment. Clear the cache so the next persistence call retries\n      // the open instead of permanently no-opping.\n      dbPromise = null\n      resolve(null)\n    }\n  })\n  return dbPromise\n}\n\n/**\n * Read path: resolve on `request.onsuccess` with the fetched value.\n * `readonly` transactions are atomic by nature — there's no commit\n * phase to worry about, so waiting for the transaction's\n * `oncomplete` would be redundant.\n */\nfunction runReadOp<T>(fn: (store: IDBObjectStore) => IDBRequest<T>): Promise<T | undefined> {\n  return openDb().then(\n    (db) =>\n      new Promise<T | undefined>((resolve) => {\n        if (db === null) return resolve(undefined)\n        let tx: IDBTransaction\n        try {\n          tx = db.transaction(STORE_NAME, 'readonly')\n        } catch {\n          return resolve(undefined)\n        }\n        const store = tx.objectStore(STORE_NAME)\n        const request = fn(store)\n        request.onsuccess = () => resolve(request.result)\n        request.onerror = () => resolve(undefined)\n        tx.onerror = () => resolve(undefined)\n      })\n  )\n}\n\n/**\n * Write path: resolve on `tx.oncomplete` (the spec-defined commit\n * signal), NOT on `request.onsuccess` (which fires per-request,\n * before the transaction commits).\n *\n * Resolving on `onsuccess` means a tab close, power loss, or\n * browser crash between the request succeeding and the transaction\n * committing silently loses the write — the Promise already\n * resolved successfully. Aborts (quota exceeded, version change,\n * constraint violation) likewise roll back after `onsuccess` fired.\n *\n * Resolving on `oncomplete` makes durability a precondition for\n * the Promise settlement; `onabort` catches the failure cases so\n * the Promise resolves to `undefined` instead of hanging.\n */\nfunction runWriteOp(fn: (store: IDBObjectStore) => void): Promise<void> {\n  return openDb().then(\n    (db) =>\n      new Promise<void>((resolve) => {\n        if (db === null) return resolve()\n        let tx: IDBTransaction\n        try {\n          tx = db.transaction(STORE_NAME, 'readwrite')\n        } catch {\n          return resolve()\n        }\n        fn(tx.objectStore(STORE_NAME))\n        tx.oncomplete = () => resolve()\n        tx.onabort = () => {\n          // QuotaExceededError, version-change, constraint violation\n          // — all surface as a transaction abort. One-shot dev warn so\n          // the developer notices instead of silently losing writes.\n          if (__DEV__ && !warnedOnWriteFailure) {\n            warnedOnWriteFailure = true\n            console.warn(\n              '[attaform] IndexedDB transaction aborted; subsequent writes will silently no-op. ' +\n                'Common cause: storage quota exceeded.',\n              tx.error\n            )\n          }\n          resolve()\n        }\n        tx.onerror = () => resolve()\n      })\n  )\n}\n\nexport function createIndexedDbAdapter(): FormStorage {\n  return {\n    async getItem(key) {\n      return await runReadOp<unknown>((store) => store.get(key) as IDBRequest<unknown>)\n    },\n    async setItem(key, value) {\n      await runWriteOp((store) => void store.put(value, key))\n    },\n    async removeItem(key) {\n      await runWriteOp((store) => void store.delete(key))\n    },\n    async listKeys(prefix) {\n      // `IDBKeyRange.bound(prefix, prefix + '￿')` would skip attaform\n      // keys that contain the U+FFFF code unit; safer to fetch all\n      // keys and filter in-process. The attaform-managed key namespace is\n      // tiny in practice, so the cost is negligible.\n      const all = await runReadOp<IDBValidKey[]>(\n        (store) => store.getAllKeys() as IDBRequest<IDBValidKey[]>\n      )\n      if (all === undefined) return []\n      const out: string[] = []\n      for (const k of all) {\n        if (typeof k === 'string' && k.startsWith(prefix)) out.push(k)\n      }\n      return out\n    },\n  }\n}\n\n/**\n * Test hook: reset the cached DB promise so a subsequent call re-\n * opens the database. Production code should never call this —\n * exposed for `fake-indexeddb`-backed tests that tear down the\n * in-memory DB between cases.\n */\nexport function __resetIndexedDbForTests(): void {\n  dbPromise = null\n  warnedOnOpenFailure = false\n  warnedOnWriteFailure = false\n}\n"],"names":["__DEV__"],"mappings":";;;;AAmBA,MAAM,OAAA,GAAU,UAAA;AAChB,MAAM,UAAA,GAAa,IAAA;AACnB,MAAM,UAAA,GAAa,CAAA;AAEnB,IAAI,SAAA,GAAgD,IAAA;AAMpD,IAAI,mBAAA,GAAsB,KAAA;AAC1B,IAAI,oBAAA,GAAuB,KAAA;AAE3B,SAAS,MAAA,GAAsC;AAC7C,EAAA,IAAI,SAAA,KAAc,MAAM,OAAO,SAAA;AAC/B,EAAA,IAAI,OAAO,cAAc,WAAA,EAAa;AACpC,IAAA,SAAA,GAAY,OAAA,CAAQ,QAAQ,IAAI,CAAA;AAChC,IAAA,OAAO,SAAA;AAAA,EACT;AACA,EAAA,SAAA,GAAY,IAAI,OAAA,CAA4B,CAAC,OAAA,KAAY;AACvD,IAAA,MAAM,OAAA,GAAU,SAAA,CAAU,IAAA,CAAK,OAAA,EAAS,UAAU,CAAA;AAClD,IAAA,OAAA,CAAQ,kBAAkB,MAAM;AAC9B,MAAA,MAAM,KAAK,OAAA,CAAQ,MAAA;AACnB,MAAA,IAAI,CAAC,EAAA,CAAG,gBAAA,CAAiB,QAAA,CAAS,UAAU,CAAA,EAAG;AAC7C,QAAA,EAAA,CAAG,kBAAkB,UAAU,CAAA;AAAA,MACjC;AAAA,IACF,CAAA;AACA,IAAA,OAAA,CAAQ,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAChD,IAAA,OAAA,CAAQ,UAAU,MAAM;AAGtB,MAAA,IAAIA,aAAA,IAAW,CAAC,mBAAA,EAAqB;AACnC,QAAA,mBAAA,GAAsB,IAAA;AACtB,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN,yHAAA;AAAA,UAEA,OAAA,CAAQ;AAAA,SACV;AAAA,MACF;AACA,MAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,IACd,CAAA;AACA,IAAA,OAAA,CAAQ,YAAY,MAAM;AACxB,MAAA,IAAIA,aAAA,IAAW,CAAC,mBAAA,EAAqB;AACnC,QAAA,mBAAA,GAAsB,IAAA;AACtB,QAAA,OAAA,CAAQ,IAAA;AAAA,UACN;AAAA,SACF;AAAA,MACF;AAIA,MAAA,SAAA,GAAY,IAAA;AACZ,MAAA,OAAA,CAAQ,IAAI,CAAA;AAAA,IACd,CAAA;AAAA,EACF,CAAC,CAAA;AACD,EAAA,OAAO,SAAA;AACT;AAQA,SAAS,UAAa,EAAA,EAAsE;AAC1F,EAAA,OAAO,QAAO,CAAE,IAAA;AAAA,IACd,CAAC,EAAA,KACC,IAAI,OAAA,CAAuB,CAAC,OAAA,KAAY;AACtC,MAAA,IAAI,EAAA,KAAO,IAAA,EAAM,OAAO,OAAA,CAAQ,MAAS,CAAA;AACzC,MAAA,IAAI,EAAA;AACJ,MAAA,IAAI;AACF,QAAA,EAAA,GAAK,EAAA,CAAG,WAAA,CAAY,UAAA,EAAY,UAAU,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,QAAQ,MAAS,CAAA;AAAA,MAC1B;AACA,MAAA,MAAM,KAAA,GAAQ,EAAA,CAAG,WAAA,CAAY,UAAU,CAAA;AACvC,MAAA,MAAM,OAAA,GAAU,GAAG,KAAK,CAAA;AACxB,MAAA,OAAA,CAAQ,SAAA,GAAY,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAChD,MAAA,OAAA,CAAQ,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAS,CAAA;AACzC,MAAA,EAAA,CAAG,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAS,CAAA;AAAA,IACtC,CAAC;AAAA,GACL;AACF;AAiBA,SAAS,WAAW,EAAA,EAAoD;AACtE,EAAA,OAAO,QAAO,CAAE,IAAA;AAAA,IACd,CAAC,EAAA,KACC,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AAC7B,MAAA,IAAI,EAAA,KAAO,IAAA,EAAM,OAAO,OAAA,EAAQ;AAChC,MAAA,IAAI,EAAA;AACJ,MAAA,IAAI;AACF,QAAA,EAAA,GAAK,EAAA,CAAG,WAAA,CAAY,UAAA,EAAY,WAAW,CAAA;AAAA,MAC7C,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,OAAA,EAAQ;AAAA,MACjB;AACA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAA,CAAY,UAAU,CAAC,CAAA;AAC7B,MAAA,EAAA,CAAG,UAAA,GAAa,MAAM,OAAA,EAAQ;AAC9B,MAAA,EAAA,CAAG,UAAU,MAAM;AAIjB,QAAA,IAAIA,aAAA,IAAW,CAAC,oBAAA,EAAsB;AACpC,UAAA,oBAAA,GAAuB,IAAA;AACvB,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,wHAAA;AAAA,YAEA,EAAA,CAAG;AAAA,WACL;AAAA,QACF;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,CAAA;AACA,MAAA,EAAA,CAAG,OAAA,GAAU,MAAM,OAAA,EAAQ;AAAA,IAC7B,CAAC;AAAA,GACL;AACF;AAEO,SAAS,sBAAA,GAAsC;AACpD,EAAA,OAAO;AAAA,IACL,MAAM,QAAQ,GAAA,EAAK;AACjB,MAAA,OAAO,MAAM,SAAA,CAAmB,CAAC,UAAU,KAAA,CAAM,GAAA,CAAI,GAAG,CAAwB,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,MAAM,OAAA,CAAQ,GAAA,EAAK,KAAA,EAAO;AACxB,MAAA,MAAM,UAAA,CAAW,CAAC,KAAA,KAAU,KAAK,MAAM,GAAA,CAAI,KAAA,EAAO,GAAG,CAAC,CAAA;AAAA,IACxD,CAAA;AAAA,IACA,MAAM,WAAW,GAAA,EAAK;AACpB,MAAA,MAAM,WAAW,CAAC,KAAA,KAAU,KAAK,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,IACpD,CAAA;AAAA,IACA,MAAM,SAAS,MAAA,EAAQ;AAKrB,MAAA,MAAM,MAAM,MAAM,SAAA;AAAA,QAChB,CAAC,KAAA,KAAU,KAAA,CAAM,UAAA;AAAW,OAC9B;AACA,MAAA,IAAI,GAAA,KAAQ,MAAA,EAAW,OAAO,EAAC;AAC/B,MAAA,MAAM,MAAgB,EAAC;AACvB,MAAA,KAAA,MAAW,KAAK,GAAA,EAAK;AACnB,QAAA,IAAI,OAAO,MAAM,QAAA,IAAY,CAAA,CAAE,WAAW,MAAM,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,MAC/D;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,GACF;AACF;;;;"}

package/dist/chunks/indexeddb.mjs

@@ -1,4 +1,4 @@
-import { _ as __DEV__ } from '../shared/attaform.CIEQgJnM.mjs';
+import { _ as __DEV__ } from '../shared/attaform.Xhg0AYNa.mjs';
 
 const DB_NAME = "attaform";
 const STORE_NAME = "kv";

package/dist/chunks/local-storage.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-const plugin = require('../shared/attaform.Dee2rU1P.cjs');
+const paths = require('../shared/attaform.BqK_L4gK.cjs');
 
 function createLocalStorageAdapter() {
   const available = typeof localStorage !== "undefined";
@@ -21,7 +21,7 @@ function createLocalStorageAdapter() {
       try {
         localStorage.setItem(key, JSON.stringify(value));
       } catch (err) {
-        if (plugin.__DEV__ && !warnedOnFailure) {
+        if (paths.__DEV__ && !warnedOnFailure) {
           warnedOnFailure = true;
           console.warn(
             '[attaform] localStorage write failed; subsequent writes will silently no-op for this form. Common causes: quota exceeded, private-mode storage lock. Switch to `persist: "indexeddb"` for larger payloads.',

package/dist/chunks/local-storage.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"local-storage.cjs","sources":["../../src/runtime/core/persistence/local-storage.ts"],"sourcesContent":["import { __DEV__ } from '../dev'\nimport type { FormStorage } from '../../types/types-api'\n\n/**\n * `localStorage` adapter for `FormStorage`. Wraps the sync Web Storage\n * API in `async` functions — the extra microtask is negligible and the\n * uniform Promise contract means every caller handles backends the same\n * way.\n *\n * Serialises payloads with `JSON.stringify`. Callers pass plain data;\n * non-JSON values (`Date` / `Map` / `Set` / typed arrays) round-trip as\n * strings / objects. Switch to the `indexeddb` backend if you need\n * structured-clone fidelity.\n *\n * Missing / unavailable `localStorage` (Node, Safari private mode in\n * older versions, disabled by the user) is handled by a `typeof` gate;\n * every method becomes a no-op so the form stays usable.\n *\n * On the FIRST `setItem` failure (quota exceeded, security error in\n * private mode), the adapter logs a one-shot dev warning so the\n * developer notices instead of silently losing data. Subsequent\n * failures stay silent — bouncing a warning per keystroke would be\n * worse than the original silent-fail behavior.\n */\nexport function createLocalStorageAdapter(): FormStorage {\n  const available = typeof localStorage !== 'undefined'\n  // Per-adapter flag: trips on the first setItem failure and stays\n  // tripped for the lifetime of the adapter instance.\n  let warnedOnFailure = false\n  return {\n    getItem(key) {\n      if (!available) return Promise.resolve(undefined)\n      try {\n        const raw = localStorage.getItem(key)\n        if (raw === null) return Promise.resolve(undefined)\n        return Promise.resolve(JSON.parse(raw) as unknown)\n      } catch {\n        // JSON.parse failure or SecurityError — drop the stale entry so\n        // the next write can replace it. Caller handles undefined as\n        // \"no persisted state\".\n        return Promise.resolve(undefined)\n      }\n    },\n    setItem(key, value) {\n      if (!available) return Promise.resolve()\n      try {\n        localStorage.setItem(key, JSON.stringify(value))\n      } catch (err) {\n        // Quota-exceeded or SecurityError — swallow at runtime. In dev,\n        // surface the first failure so the developer knows persistence\n        // has degraded. Silent on subsequent failures (debounced writes\n        // would otherwise spam the console once per keystroke).\n        if (__DEV__ && !warnedOnFailure) {\n          warnedOnFailure = true\n          console.warn(\n            '[attaform] localStorage write failed; subsequent writes will silently no-op for this form. ' +\n              'Common causes: quota exceeded, private-mode storage lock. ' +\n              'Switch to `persist: \"indexeddb\"` for larger payloads.',\n            err\n          )\n        }\n      }\n      return Promise.resolve()\n    },\n    removeItem(key) {\n      if (!available) return Promise.resolve()\n      try {\n        localStorage.removeItem(key)\n      } catch {\n        // Private-mode write guards occasionally throw here too.\n      }\n      return Promise.resolve()\n    },\n    listKeys(prefix) {\n      if (!available) return Promise.resolve([])\n      const out: string[] = []\n      try {\n        for (let i = 0; i < localStorage.length; i++) {\n          const k = localStorage.key(i)\n          if (k !== null && k.startsWith(prefix) === true) out.push(k)\n        }\n      } catch {\n        // SecurityError under private-mode locks.\n      }\n      return Promise.resolve(out)\n    },\n  }\n}\n"],"names":["__DEV__"],"mappings":";;;;AAwBO,SAAS,yBAAA,GAAyC;AACvD,EAAA,MAAM,SAAA,GAAY,OAAO,YAAA,KAAiB,WAAA;AAG1C,EAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AACX,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAChD,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AACpC,QAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,OAAO,OAAA,CAAQ,QAAQ,KAAA,CAAS,CAAA;AAClD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAY,CAAA;AAAA,MACnD,CAAA,CAAA,MAAQ;AAIN,QAAA,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAAA,MAClC;AAAA,IACF,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,MACjD,SAAS,GAAA,EAAK;AAKZ,QAAA,IAAIA,cAAA,IAAW,CAAC,eAAA,EAAiB;AAC/B,UAAA,eAAA,GAAkB,IAAA;AAClB,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,4MAAA;AAAA,YAGA;AAAA,WACF;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,WAAW,GAAG,CAAA;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA;AACzC,MAAA,MAAM,MAAgB,EAAC;AACvB,MAAA,IAAI;AACF,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,UAAA,MAAM,CAAA,GAAI,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA;AAC5B,UAAA,IAAI,CAAA,KAAM,QAAQ,CAAA,CAAE,UAAA,CAAW,MAAM,CAAA,KAAM,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,QAC7D;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;;;;"}
+{"version":3,"file":"local-storage.cjs","sources":["../../src/runtime/core/persistence/local-storage.ts"],"sourcesContent":["import { __DEV__ } from '../dev'\nimport type { FormStorage } from '../../types/types-api'\n\n/**\n * `localStorage` adapter for `FormStorage`. Wraps the sync Web Storage\n * API in `async` functions — the extra microtask is negligible and the\n * uniform Promise contract means every caller handles backends the same\n * way.\n *\n * Serialises payloads with `JSON.stringify`. Callers pass plain data;\n * non-JSON values (`Date` / `Map` / `Set` / typed arrays) round-trip as\n * strings / objects. Switch to the `indexeddb` backend if you need\n * structured-clone fidelity.\n *\n * Missing / unavailable `localStorage` (Node, Safari private mode in\n * older versions, disabled by the user) is handled by a `typeof` gate;\n * every method becomes a no-op so the form stays usable.\n *\n * On the FIRST `setItem` failure (quota exceeded, security error in\n * private mode), the adapter logs a one-shot dev warning so the\n * developer notices instead of silently losing data. Subsequent\n * failures stay silent — bouncing a warning per keystroke would be\n * worse than the original silent-fail behavior.\n */\nexport function createLocalStorageAdapter(): FormStorage {\n  const available = typeof localStorage !== 'undefined'\n  // Per-adapter flag: trips on the first setItem failure and stays\n  // tripped for the lifetime of the adapter instance.\n  let warnedOnFailure = false\n  return {\n    getItem(key) {\n      if (!available) return Promise.resolve(undefined)\n      try {\n        const raw = localStorage.getItem(key)\n        if (raw === null) return Promise.resolve(undefined)\n        return Promise.resolve(JSON.parse(raw) as unknown)\n      } catch {\n        // JSON.parse failure or SecurityError — drop the stale entry so\n        // the next write can replace it. Caller handles undefined as\n        // \"no persisted state\".\n        return Promise.resolve(undefined)\n      }\n    },\n    setItem(key, value) {\n      if (!available) return Promise.resolve()\n      try {\n        localStorage.setItem(key, JSON.stringify(value))\n      } catch (err) {\n        // Quota-exceeded or SecurityError — swallow at runtime. In dev,\n        // surface the first failure so the developer knows persistence\n        // has degraded. Silent on subsequent failures (debounced writes\n        // would otherwise spam the console once per keystroke).\n        if (__DEV__ && !warnedOnFailure) {\n          warnedOnFailure = true\n          console.warn(\n            '[attaform] localStorage write failed; subsequent writes will silently no-op for this form. ' +\n              'Common causes: quota exceeded, private-mode storage lock. ' +\n              'Switch to `persist: \"indexeddb\"` for larger payloads.',\n            err\n          )\n        }\n      }\n      return Promise.resolve()\n    },\n    removeItem(key) {\n      if (!available) return Promise.resolve()\n      try {\n        localStorage.removeItem(key)\n      } catch {\n        // Private-mode write guards occasionally throw here too.\n      }\n      return Promise.resolve()\n    },\n    listKeys(prefix) {\n      if (!available) return Promise.resolve([])\n      const out: string[] = []\n      try {\n        for (let i = 0; i < localStorage.length; i++) {\n          const k = localStorage.key(i)\n          if (k !== null && k.startsWith(prefix) === true) out.push(k)\n        }\n      } catch {\n        // SecurityError under private-mode locks.\n      }\n      return Promise.resolve(out)\n    },\n  }\n}\n"],"names":["__DEV__"],"mappings":";;;;AAwBO,SAAS,yBAAA,GAAyC;AACvD,EAAA,MAAM,SAAA,GAAY,OAAO,YAAA,KAAiB,WAAA;AAG1C,EAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AACX,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAChD,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,GAAG,CAAA;AACpC,QAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,OAAO,OAAA,CAAQ,QAAQ,KAAA,CAAS,CAAA;AAClD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAY,CAAA;AAAA,MACnD,CAAA,CAAA,MAAQ;AAIN,QAAA,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAAA,MAClC;AAAA,IACF,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,MACjD,SAAS,GAAA,EAAK;AAKZ,QAAA,IAAIA,aAAA,IAAW,CAAC,eAAA,EAAiB;AAC/B,UAAA,eAAA,GAAkB,IAAA;AAClB,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,4MAAA;AAAA,YAGA;AAAA,WACF;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,YAAA,CAAa,WAAW,GAAG,CAAA;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA;AACzC,MAAA,MAAM,MAAgB,EAAC;AACvB,MAAA,IAAI;AACF,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,UAAA,MAAM,CAAA,GAAI,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA;AAC5B,UAAA,IAAI,CAAA,KAAM,QAAQ,CAAA,CAAE,UAAA,CAAW,MAAM,CAAA,KAAM,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,QAC7D;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;;;;"}

package/dist/chunks/local-storage.mjs

@@ -1,4 +1,4 @@
-import { _ as __DEV__ } from '../shared/attaform.CIEQgJnM.mjs';
+import { _ as __DEV__ } from '../shared/attaform.Xhg0AYNa.mjs';
 
 function createLocalStorageAdapter() {
   const available = typeof localStorage !== "undefined";

package/dist/chunks/session-storage.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-const plugin = require('../shared/attaform.Dee2rU1P.cjs');
+const paths = require('../shared/attaform.BqK_L4gK.cjs');
 
 function createSessionStorageAdapter() {
   const available = typeof sessionStorage !== "undefined";
@@ -21,7 +21,7 @@ function createSessionStorageAdapter() {
       try {
         sessionStorage.setItem(key, JSON.stringify(value));
       } catch (err) {
-        if (plugin.__DEV__ && !warnedOnFailure) {
+        if (paths.__DEV__ && !warnedOnFailure) {
           warnedOnFailure = true;
           console.warn(
             "[attaform] sessionStorage write failed; subsequent writes will silently no-op for this form. Common causes: quota exceeded, private-mode storage lock.",

package/dist/chunks/session-storage.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"session-storage.cjs","sources":["../../src/runtime/core/persistence/session-storage.ts"],"sourcesContent":["import { __DEV__ } from '../dev'\nimport type { FormStorage } from '../../types/types-api'\n\n/**\n * `sessionStorage` adapter — identical shape to the `localStorage`\n * adapter, different backing store. Tab-scoped: closing the tab\n * drops the entry. Useful for multi-step flows where the user\n * shouldn't see last-session state on a fresh open.\n *\n * Same one-shot dev-warn semantic on setItem failure as the\n * localStorage adapter — see that file's header for rationale.\n */\nexport function createSessionStorageAdapter(): FormStorage {\n  const available = typeof sessionStorage !== 'undefined'\n  let warnedOnFailure = false\n  return {\n    getItem(key) {\n      if (!available) return Promise.resolve(undefined)\n      try {\n        const raw = sessionStorage.getItem(key)\n        if (raw === null) return Promise.resolve(undefined)\n        return Promise.resolve(JSON.parse(raw) as unknown)\n      } catch {\n        return Promise.resolve(undefined)\n      }\n    },\n    setItem(key, value) {\n      if (!available) return Promise.resolve()\n      try {\n        sessionStorage.setItem(key, JSON.stringify(value))\n      } catch (err) {\n        if (__DEV__ && !warnedOnFailure) {\n          warnedOnFailure = true\n          console.warn(\n            '[attaform] sessionStorage write failed; subsequent writes will silently no-op for this form. ' +\n              'Common causes: quota exceeded, private-mode storage lock.',\n            err\n          )\n        }\n      }\n      return Promise.resolve()\n    },\n    removeItem(key) {\n      if (!available) return Promise.resolve()\n      try {\n        sessionStorage.removeItem(key)\n      } catch {\n        // SecurityError in private mode — swallow.\n      }\n      return Promise.resolve()\n    },\n    listKeys(prefix) {\n      if (!available) return Promise.resolve([])\n      const out: string[] = []\n      try {\n        for (let i = 0; i < sessionStorage.length; i++) {\n          const k = sessionStorage.key(i)\n          if (k !== null && k.startsWith(prefix) === true) out.push(k)\n        }\n      } catch {\n        // SecurityError under private-mode locks.\n      }\n      return Promise.resolve(out)\n    },\n  }\n}\n"],"names":["__DEV__"],"mappings":";;;;AAYO,SAAS,2BAAA,GAA2C;AACzD,EAAA,MAAM,SAAA,GAAY,OAAO,cAAA,KAAmB,WAAA;AAC5C,EAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AACX,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAChD,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA;AACtC,QAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,OAAO,OAAA,CAAQ,QAAQ,KAAA,CAAS,CAAA;AAClD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAY,CAAA;AAAA,MACnD,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAAA,MAClC;AAAA,IACF,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,IAAIA,cAAA,IAAW,CAAC,eAAA,EAAiB;AAC/B,UAAA,eAAA,GAAkB,IAAA;AAClB,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,wJAAA;AAAA,YAEA;AAAA,WACF;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,WAAW,GAAG,CAAA;AAAA,MAC/B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA;AACzC,MAAA,MAAM,MAAgB,EAAC;AACvB,MAAA,IAAI;AACF,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,cAAA,CAAe,QAAQ,CAAA,EAAA,EAAK;AAC9C,UAAA,MAAM,CAAA,GAAI,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA;AAC9B,UAAA,IAAI,CAAA,KAAM,QAAQ,CAAA,CAAE,UAAA,CAAW,MAAM,CAAA,KAAM,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,QAC7D;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;;;;"}
+{"version":3,"file":"session-storage.cjs","sources":["../../src/runtime/core/persistence/session-storage.ts"],"sourcesContent":["import { __DEV__ } from '../dev'\nimport type { FormStorage } from '../../types/types-api'\n\n/**\n * `sessionStorage` adapter — identical shape to the `localStorage`\n * adapter, different backing store. Tab-scoped: closing the tab\n * drops the entry. Useful for multi-step flows where the user\n * shouldn't see last-session state on a fresh open.\n *\n * Same one-shot dev-warn semantic on setItem failure as the\n * localStorage adapter — see that file's header for rationale.\n */\nexport function createSessionStorageAdapter(): FormStorage {\n  const available = typeof sessionStorage !== 'undefined'\n  let warnedOnFailure = false\n  return {\n    getItem(key) {\n      if (!available) return Promise.resolve(undefined)\n      try {\n        const raw = sessionStorage.getItem(key)\n        if (raw === null) return Promise.resolve(undefined)\n        return Promise.resolve(JSON.parse(raw) as unknown)\n      } catch {\n        return Promise.resolve(undefined)\n      }\n    },\n    setItem(key, value) {\n      if (!available) return Promise.resolve()\n      try {\n        sessionStorage.setItem(key, JSON.stringify(value))\n      } catch (err) {\n        if (__DEV__ && !warnedOnFailure) {\n          warnedOnFailure = true\n          console.warn(\n            '[attaform] sessionStorage write failed; subsequent writes will silently no-op for this form. ' +\n              'Common causes: quota exceeded, private-mode storage lock.',\n            err\n          )\n        }\n      }\n      return Promise.resolve()\n    },\n    removeItem(key) {\n      if (!available) return Promise.resolve()\n      try {\n        sessionStorage.removeItem(key)\n      } catch {\n        // SecurityError in private mode — swallow.\n      }\n      return Promise.resolve()\n    },\n    listKeys(prefix) {\n      if (!available) return Promise.resolve([])\n      const out: string[] = []\n      try {\n        for (let i = 0; i < sessionStorage.length; i++) {\n          const k = sessionStorage.key(i)\n          if (k !== null && k.startsWith(prefix) === true) out.push(k)\n        }\n      } catch {\n        // SecurityError under private-mode locks.\n      }\n      return Promise.resolve(out)\n    },\n  }\n}\n"],"names":["__DEV__"],"mappings":";;;;AAYO,SAAS,2BAAA,GAA2C;AACzD,EAAA,MAAM,SAAA,GAAY,OAAO,cAAA,KAAmB,WAAA;AAC5C,EAAA,IAAI,eAAA,GAAkB,KAAA;AACtB,EAAA,OAAO;AAAA,IACL,QAAQ,GAAA,EAAK;AACX,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAChD,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,GAAG,CAAA;AACtC,QAAA,IAAI,GAAA,KAAQ,IAAA,EAAM,OAAO,OAAA,CAAQ,QAAQ,KAAA,CAAS,CAAA;AAClD,QAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,GAAG,CAAY,CAAA;AAAA,MACnD,CAAA,CAAA,MAAQ;AACN,QAAA,OAAO,OAAA,CAAQ,QAAQ,MAAS,CAAA;AAAA,MAClC;AAAA,IACF,CAAA;AAAA,IACA,OAAA,CAAQ,KAAK,KAAA,EAAO;AAClB,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,OAAA,CAAQ,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,MACnD,SAAS,GAAA,EAAK;AACZ,QAAA,IAAIA,aAAA,IAAW,CAAC,eAAA,EAAiB;AAC/B,UAAA,eAAA,GAAkB,IAAA;AAClB,UAAA,OAAA,CAAQ,IAAA;AAAA,YACN,wJAAA;AAAA,YAEA;AAAA,WACF;AAAA,QACF;AAAA,MACF;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,WAAW,GAAA,EAAK;AACd,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,EAAQ;AACvC,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,WAAW,GAAG,CAAA;AAAA,MAC/B,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,QAAQ,OAAA,EAAQ;AAAA,IACzB,CAAA;AAAA,IACA,SAAS,MAAA,EAAQ;AACf,MAAA,IAAI,CAAC,SAAA,EAAW,OAAO,OAAA,CAAQ,OAAA,CAAQ,EAAE,CAAA;AACzC,MAAA,MAAM,MAAgB,EAAC;AACvB,MAAA,IAAI;AACF,QAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,cAAA,CAAe,QAAQ,CAAA,EAAA,EAAK;AAC9C,UAAA,MAAM,CAAA,GAAI,cAAA,CAAe,GAAA,CAAI,CAAC,CAAA;AAC9B,UAAA,IAAI,CAAA,KAAM,QAAQ,CAAA,CAAE,UAAA,CAAW,MAAM,CAAA,KAAM,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAAA,QAC7D;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,OAAO,OAAA,CAAQ,QAAQ,GAAG,CAAA;AAAA,IAC5B;AAAA,GACF;AACF;;;;"}

package/dist/chunks/session-storage.mjs

@@ -1,4 +1,4 @@
-import { _ as __DEV__ } from '../shared/attaform.CIEQgJnM.mjs';
+import { _ as __DEV__ } from '../shared/attaform.Xhg0AYNa.mjs';
 
 function createSessionStorageAdapter() {
   const available = typeof sessionStorage !== "undefined";

package/dist/index.cjs

@@ -1,9 +1,8 @@
 'use strict';
 
-const plugin = require('./shared/attaform.Dee2rU1P.cjs');
-const serialize = require('./shared/attaform.C8LVFVVe.cjs');
-const useFormContext = require('./shared/attaform.Cer8JO_P.cjs');
-const paths = require('./shared/attaform.BBM2muQ9.cjs');
+const paths = require('./shared/attaform.BqK_L4gK.cjs');
+const devtoolsShared = require('./shared/attaform.5UhpSVFI.cjs');
+const injectWizard = require('./shared/attaform.II89Pcf4.cjs');
 
 function escapeForInlineScript(json) {
   return json.replace(/[<>&\u2028\u2029]/g, (char) => {
@@ -31,21 +30,21 @@ const PARSE_API_ERRORS_DEFAULTS = {
   defaultCode: "api:unknown"
 };
 function parseApiErrors(payload, options) {
-  const maxEntries = useFormContext.normalizeNumericOption({
+  const maxEntries = injectWizard.normalizeNumericOption({
     value: options.maxEntries ?? PARSE_API_ERRORS_DEFAULTS.maxEntries,
     source: "parseApiErrors.maxEntries",
     allowInfinity: false,
     min: 0,
     defaultValue: PARSE_API_ERRORS_DEFAULTS.maxEntries
   });
-  const maxPathDepth = useFormContext.normalizeNumericOption({
+  const maxPathDepth = injectWizard.normalizeNumericOption({
     value: options.maxPathDepth ?? PARSE_API_ERRORS_DEFAULTS.maxPathDepth,
     source: "parseApiErrors.maxPathDepth",
     allowInfinity: false,
     min: 0,
     defaultValue: PARSE_API_ERRORS_DEFAULTS.maxPathDepth
   });
-  const maxTotalSegments = useFormContext.normalizeNumericOption({
+  const maxTotalSegments = injectWizard.normalizeNumericOption({
     value: options.maxTotalSegments ?? PARSE_API_ERRORS_DEFAULTS.maxTotalSegments,
     source: "parseApiErrors.maxTotalSegments",
     allowInfinity: false,
@@ -80,7 +79,7 @@ function parseApiErrors(payload, options) {
     try {
       segments = paths.canonicalizePath(key).segments;
     } catch (err) {
-      if (err instanceof plugin.InvalidPathError) continue;
+      if (err instanceof paths.InvalidPathError) continue;
       throw err;
     }
     if (segments.length > maxPathDepth) continue;
@@ -155,40 +154,46 @@ function isDetailsRecord(value) {
   return true;
 }
 
-exports.AnonPersistError = plugin.AnonPersistError;
-exports.AttaformError = plugin.AttaformError;
-exports.DEFAULT_SENSITIVE_NAMES = plugin.DEFAULT_SENSITIVE_NAMES;
-exports.InvalidPathError = plugin.InvalidPathError;
-exports.InvalidUseFormConfigError = plugin.InvalidUseFormConfigError;
-exports.OutsideSetupError = plugin.OutsideSetupError;
-exports.RegistryNotInstalledError = plugin.RegistryNotInstalledError;
-exports.ReservedFormKeyError = plugin.ReservedFormKeyError;
-exports.SensitivePersistFieldError = plugin.SensitivePersistFieldError;
-exports.SubmitErrorHandlerError = plugin.SubmitErrorHandlerError;
-exports.assignKey = plugin.assignKey;
-exports.createAttaform = plugin.createAttaform;
-exports.createRegistry = plugin.createRegistry;
-exports.getRegistryFromApp = plugin.getRegistryFromApp;
-exports.isRegisterValue = plugin.isRegisterValue;
-exports.kAttaformRegistry = plugin.kAttaformRegistry;
-exports.useRegister = plugin.useRegister;
-exports.useRegistry = plugin.useRegistry;
-exports.vRegister = plugin.vRegister;
-exports.hydrateAttaformState = serialize.hydrateAttaformState;
-exports.renderAttaformState = serialize.renderAttaformState;
-exports.AttaformErrorCode = useFormContext.AttaformErrorCode;
-exports.defaultCoercionRules = useFormContext.defaultCoercionRules;
-exports.defaultShouldShowErrors = useFormContext.defaultShouldShowErrors;
-exports.defineCoercion = useFormContext.defineCoercion;
-exports.injectForm = useFormContext.injectForm;
-exports.isUnset = useFormContext.isUnset;
-exports.unset = useFormContext.unset;
-exports.useForm = useFormContext.useAbstractForm;
+exports.AnonPersistError = paths.AnonPersistError;
+exports.AttaformError = paths.AttaformError;
+exports.DEFAULT_SENSITIVE_NAMES = paths.DEFAULT_SENSITIVE_NAMES;
+exports.InvalidPathError = paths.InvalidPathError;
+exports.InvalidUseFormConfigError = paths.InvalidUseFormConfigError;
+exports.OutsideSetupError = paths.OutsideSetupError;
 exports.ROOT_PATH = paths.ROOT_PATH;
 exports.ROOT_PATH_KEY = paths.ROOT_PATH_KEY;
+exports.RegistryNotInstalledError = paths.RegistryNotInstalledError;
+exports.ReservedFormKeyError = paths.ReservedFormKeyError;
+exports.SensitivePersistFieldError = paths.SensitivePersistFieldError;
+exports.SubmitErrorHandlerError = paths.SubmitErrorHandlerError;
+exports.assignKey = paths.assignKey;
 exports.canonicalizePath = paths.canonicalizePath;
+exports.createAttaform = paths.createAttaform;
+exports.createRegistry = paths.createRegistry;
+exports.getRegistryFromApp = paths.getRegistryFromApp;
 exports.isPathPrefix = paths.isPathPrefix;
+exports.isRegisterValue = paths.isRegisterValue;
+exports.kAttaformRegistry = paths.kAttaformRegistry;
 exports.parseDottedPath = paths.parseDottedPath;
+exports.useRegister = paths.useRegister;
+exports.useRegistry = paths.useRegistry;
+exports.vRegister = paths.vRegister;
+exports.DEVTOOLS_WINDOW_KEY = devtoolsShared.DEVTOOLS_WINDOW_KEY;
+exports.REDACTED = devtoolsShared.REDACTED;
+exports.hydrateAttaformState = devtoolsShared.hydrateAttaformState;
+exports.redactSensitiveLeaves = devtoolsShared.redactSensitiveLeaves;
+exports.renderAttaformState = devtoolsShared.renderAttaformState;
+exports.AttaformErrorCode = injectWizard.AttaformErrorCode;
+exports.defaultCoercionRules = injectWizard.defaultCoercionRules;
+exports.defaultShouldShowErrors = injectWizard.defaultShouldShowErrors;
+exports.defineCoercion = injectWizard.defineCoercion;
+exports.injectForm = injectWizard.injectForm;
+exports.injectWizard = injectWizard.injectWizard;
+exports.isUnset = injectWizard.isUnset;
+exports.lazy = injectWizard.lazy;
+exports.unset = injectWizard.unset;
+exports.useForm = injectWizard.useAbstractForm;
+exports.useWizard = injectWizard.useWizard;
 exports.PARSE_API_ERRORS_DEFAULTS = PARSE_API_ERRORS_DEFAULTS;
 exports.escapeForInlineScript = escapeForInlineScript;
 exports.parseApiErrors = parseApiErrors;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","sources":["../src/runtime/core/serialize-script.ts","../src/runtime/core/parse-api-errors.ts"],"sourcesContent":["/**\n * Escape a JSON string so it's safe to embed inside an inline\n * `<script>` tag during SSR. Plain `JSON.stringify` is not safe — a\n * form value containing the literal substring `</script>` would\n * break out of the script tag.\n *\n * ```ts\n * const payload = escapeForInlineScript(JSON.stringify(renderAttaformState(app)))\n * // `<script>window.__ATTAFORM_STATE__ = ${payload}</script>` is safe.\n * ```\n *\n * Output remains valid JSON — `JSON.parse` round-trips back to the\n * original value on the client.\n */\nexport function escapeForInlineScript(json: string): string {\n  return json.replace(/[<>&\\u2028\\u2029]/g, (char) => {\n    switch (char) {\n      case '<':\n        return '\\\\u003c'\n      case '>':\n        return '\\\\u003e'\n      case '&':\n        return '\\\\u0026'\n      case '\\u2028':\n        return '\\\\u2028'\n      case '\\u2029':\n        return '\\\\u2029'\n      default:\n        return char\n    }\n  })\n}\n","import type {\n  ApiErrorDetails,\n  ApiErrorEntry,\n  ApiErrorEnvelope,\n  FormKey,\n  ValidationError,\n} from '../types/types-api'\nimport { normalizeNumericOption } from './defaults'\nimport { InvalidPathError } from './errors'\nimport { canonicalizePath } from './paths'\n\n/**\n * Result of `parseApiErrors`. Branch on `ok` to handle the two cases:\n *\n * ```ts\n * const result = parseApiErrors(payload, { formKey: form.key })\n * if (result.ok) {\n *   form.setFieldErrors(result.errors)\n * } else {\n *   console.warn('Bad error payload:', result.rejected)\n * }\n * ```\n *\n * `ok: true` means the payload was recognised — `errors` may still be\n * empty if the payload was valid but had no actual errors.\n * `ok: false` means the payload didn't match a known shape; `rejected`\n * carries a one-line description of why.\n */\nexport type ParseApiErrorsResult = {\n  /** `true` when the payload was recognised; `false` when the shape was unfamiliar. */\n  readonly ok: boolean\n  /** Errors extracted from the payload. May be empty even when `ok: true`. */\n  readonly errors: ValidationError[]\n  /** When `ok: false`, a one-line description of why the payload was rejected. */\n  readonly rejected?: string\n}\n\n/**\n * Options for `parseApiErrors`. The size caps protect against\n * misbehaving or hostile servers — exceeding any cap causes the\n * parser to reject the payload wholesale rather than partially apply.\n */\nexport type ParseApiErrorsOptions = {\n  /**\n   * The form's identifier — pass `form.key`. Stamped on every\n   * produced `ValidationError` so errors route to the right form.\n   */\n  readonly formKey: FormKey\n  /**\n   * Code stamped on `ValidationError`s synthesized from bare-string\n   * entries (the Rails / DRF / Laravel `{ field: [\"msg\"] }` shape).\n   * Default `'api:unknown'`. Pick something more specific\n   * (`'api:server-validation'`, `'myapp:legacy'`, …) when you know\n   * the source.\n   *\n   * Structured `{ message, code }` entries forward their `code`\n   * verbatim and ignore this option.\n   */\n  readonly defaultCode?: string\n  /**\n   * Maximum number of distinct keys to accept. Default `1000`.\n   * Raise for trusted backends that legitimately produce more.\n   */\n  readonly maxEntries?: number\n  /**\n   * Maximum number of path segments per key. Default `32`. Keys\n   * deeper than this are dropped (the rest of the payload still\n   * applies if it stays under the other caps).\n   */\n  readonly maxPathDepth?: number\n  /**\n   * Maximum total path segments summed across every accepted key.\n   * Default `10000`. Bounds the worst-case traversal cost.\n   */\n  readonly maxTotalSegments?: number\n}\n\n/**\n * Default size caps + default fallback code used by `parseApiErrors`.\n * Conservative; pass larger values (or a more specific code) via the\n * options bag for trusted-backend integrations.\n */\nexport const PARSE_API_ERRORS_DEFAULTS = {\n  maxEntries: 1000,\n  maxPathDepth: 32,\n  maxTotalSegments: 10000,\n  defaultCode: 'api:unknown',\n} as const\n\n/**\n * Normalise a server-side validation error payload into\n * `ValidationError[]`. Pair with `form.setFieldErrors` /\n * `form.addFieldErrors` to surface server errors on the form:\n *\n * ```ts\n * const response = await fetch('/api/signup', { … })\n * if (!response.ok) {\n *   const payload = await response.json()\n *   const result = parseApiErrors(payload, { formKey: form.key })\n *   if (result.ok) form.setFieldErrors(result.errors)\n * }\n * ```\n *\n * Recognised payload shapes:\n *\n * - Wrapped envelope:\n *   `{ error: { details: { email: { message: 'taken', code: 'api:duplicate-email' } } } }`\n * - Unwrapped envelope:\n *   `{ details: { email: { message: 'taken', code: 'api:duplicate-email' } } }`\n * - Raw details record:\n *   `{ email: { message: 'taken', code: 'api:duplicate-email' } }`\n * - **Bare-string Rails / DRF / Laravel shape:**\n *   `{ email: ['Email already taken.'], username: 'too short' }`\n * - `null` / `undefined` — returns `{ ok: true, errors: [] }`\n *\n * Two entry shapes are accepted:\n *\n * 1. **Structured** — `{ message: string, code: string }`. The `code`\n *    is forwarded verbatim onto the produced `ValidationError`.\n * 2. **Bare-string** — a plain string. Synthesized into\n *    `{ message: <string>, code: <defaultCode> }` where `defaultCode`\n *    comes from `options.defaultCode` (default `'api:unknown'`).\n *    Useful for the Rails / Django REST Framework / FastAPI / Laravel\n *    JSON shape that doesn't carry a per-field code.\n *\n * Each detail key's value can be a single entry, an array, or a mix\n * of structured and bare-string entries; arrays expand into one\n * `ValidationError` per entry. Pick a prefix on the server (`api:`,\n * `auth:`, etc.) and stay consistent so error renderers can branch\n * on `code` — or rely on `defaultCode` when the wire shape is\n * message-only.\n *\n * Dotted keys (`\"address.line1\"`) are split into structured paths\n * automatically. Use a custom server response shape outside these\n * patterns? Build the `ValidationError[]` array yourself and pass\n * it to `setFieldErrors` directly — `parseApiErrors` is just a\n * convenience for the common shapes.\n */\nexport function parseApiErrors(\n  payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown,\n  options: ParseApiErrorsOptions\n): ParseApiErrorsResult {\n  // Sanitise the caps. Comparison gates (`>` against the count /\n  // depth) yield `false` for `NaN`, so without sanitisation a\n  // hostile or malformed `NaN` cap would let pathological payloads\n  // run unbounded. `Infinity` would do the same. Negatives and\n  // non-integers would discard legitimate entries. Falls back to\n  // the library default on garbage.\n  const maxEntries = normalizeNumericOption({\n    value: options.maxEntries ?? PARSE_API_ERRORS_DEFAULTS.maxEntries,\n    source: 'parseApiErrors.maxEntries',\n    allowInfinity: false,\n    min: 0,\n    defaultValue: PARSE_API_ERRORS_DEFAULTS.maxEntries,\n  })\n  const maxPathDepth = normalizeNumericOption({\n    value: options.maxPathDepth ?? PARSE_API_ERRORS_DEFAULTS.maxPathDepth,\n    source: 'parseApiErrors.maxPathDepth',\n    allowInfinity: false,\n    min: 0,\n    defaultValue: PARSE_API_ERRORS_DEFAULTS.maxPathDepth,\n  })\n  const maxTotalSegments = normalizeNumericOption({\n    value: options.maxTotalSegments ?? PARSE_API_ERRORS_DEFAULTS.maxTotalSegments,\n    source: 'parseApiErrors.maxTotalSegments',\n    allowInfinity: false,\n    min: 0,\n    defaultValue: PARSE_API_ERRORS_DEFAULTS.maxTotalSegments,\n  })\n  const defaultCode = options.defaultCode ?? PARSE_API_ERRORS_DEFAULTS.defaultCode\n\n  if (payload === null || payload === undefined) {\n    return { ok: true, errors: [] }\n  }\n  if (typeof payload !== 'object') {\n    return { ok: false, errors: [], rejected: `payload was ${typeof payload}, expected object` }\n  }\n\n  const extraction = extractDetails(payload as Record<string, unknown>)\n  if (!extraction.ok) {\n    return { ok: false, errors: [], rejected: extraction.reason }\n  }\n\n  const { details } = extraction\n  const entryCount = Object.keys(details).length\n  // Enforce the guardrails before we spend time walking the payload.\n  // Rejecting wholesale (not partial-applying) keeps the failure visible\n  // so consumers can tune the caps or investigate the server payload.\n  if (entryCount > maxEntries) {\n    return {\n      ok: false,\n      errors: [],\n      rejected: `payload has ${entryCount} entries, exceeds maxEntries=${maxEntries}`,\n    }\n  }\n\n  const errors: ValidationError[] = []\n  let totalSegments = 0\n  for (const [key, value] of Object.entries(details)) {\n    const entryList: ReadonlyArray<string | ApiErrorEntry> = Array.isArray(value) ? value : [value]\n    // `canonicalizePath` throws `InvalidPathError` for dotted strings with\n    // empty segments (e.g. `'. '`, `'a..b'`). A misbehaving server can\n    // genuinely emit such a key; the hydrator is a normaliser, not a\n    // validator, so we drop offending keys rather than let the exception\n    // escape. Well-formed keys continue as normal.\n    let segments: readonly (string | number)[]\n    try {\n      segments = canonicalizePath(key).segments\n    } catch (err) {\n      if (err instanceof InvalidPathError) continue\n      throw err\n    }\n    // Per-path depth cap. We drop the offending key (rather than\n    // rejecting the whole payload) because a single stray deep path\n    // in an otherwise legitimate error set is still worth surfacing\n    // the rest. Consumers who want strict rejection can post-filter\n    // on `result.errors.length < details entryCount`.\n    if (segments.length > maxPathDepth) continue\n    // Total-segment cap. Enforced wholesale (not per-key) so a payload\n    // that passes the per-key gate but stacks into a pathological\n    // total still fails visibly. Mirrors `maxEntries` strictness.\n    totalSegments += segments.length\n    if (totalSegments > maxTotalSegments) {\n      return {\n        ok: false,\n        errors: [],\n        rejected: `payload total path segments exceeds maxTotalSegments=${maxTotalSegments}`,\n      }\n    }\n    for (const entry of entryList) {\n      // Bare-string entries (Rails / DRF / Laravel shape) synthesize a\n      // `code` from `options.defaultCode`; structured `{ message, code }`\n      // entries forward `code` verbatim. Empty messages drop silently\n      // (`{ message: '' }` or `''`) — same recoverable-malformed-server\n      // policy as before.\n      const message = typeof entry === 'string' ? entry : entry.message\n      const code = typeof entry === 'string' ? defaultCode : entry.code\n      if (message.length === 0) continue\n      errors.push({\n        message,\n        path: Array.from(segments),\n        formKey: options.formKey,\n        code,\n      })\n    }\n  }\n  return { ok: true, errors }\n}\n\ntype ExtractResult = { ok: true; details: ApiErrorDetails } | { ok: false; reason: string }\n\nfunction extractDetails(payload: Record<string, unknown>): ExtractResult {\n  const wrappedError = payload['error']\n  if (wrappedError !== null && wrappedError !== undefined && typeof wrappedError === 'object') {\n    const inner = (wrappedError as { details?: unknown }).details\n    if (inner === undefined) {\n      // A wrapped envelope without details is considered \"no errors\" — valid shape.\n      return { ok: true, details: {} }\n    }\n    if (isDetailsRecord(inner)) return { ok: true, details: inner }\n    return {\n      ok: false,\n      reason: 'error.details entries must be strings or { message, code } objects',\n    }\n  }\n\n  // `{ error: 'oops' }` / `{ error: 42 }` is a malformed wrapped envelope —\n  // the server meant an error object but sent a scalar. Without this guard\n  // the payload would fall through to the raw-details branch below, where\n  // `{ error: 'oops' }` satisfies `isDetailsRecord` and silently produces\n  // a phantom `ValidationError` at path `['error']`.\n  if (wrappedError !== null && wrappedError !== undefined && typeof wrappedError !== 'object') {\n    return {\n      ok: false,\n      reason: `payload.error was ${typeof wrappedError}, expected an object with { details }`,\n    }\n  }\n\n  if ('details' in payload) {\n    const inner = payload['details']\n    if (inner === undefined) return { ok: true, details: {} }\n    if (isDetailsRecord(inner)) return { ok: true, details: inner }\n    return { ok: false, reason: 'details entries must be strings or { message, code } objects' }\n  }\n\n  if (isDetailsRecord(payload)) return { ok: true, details: payload }\n\n  // Heuristic: if the payload has keys but none of them look like details,\n  // it's probably a completely different shape. Reject.\n  if (Object.keys(payload).length === 0) return { ok: true, details: {} }\n  return { ok: false, reason: 'unrecognised payload shape' }\n}\n\nfunction isStructuredEntry(value: unknown): value is ApiErrorEntry {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false\n  const obj = value as { message?: unknown; code?: unknown }\n  return typeof obj.message === 'string' && typeof obj.code === 'string'\n}\n\n/**\n * Accepts either a structured `{ message, code }` entry OR a bare\n * string. Bare strings synthesize a `code` at parse time\n * (`options.defaultCode`) and are useful for the Rails / Django REST\n * Framework / Laravel JSON shape that doesn't carry a per-field code.\n */\nfunction isAcceptedEntry(value: unknown): value is string | ApiErrorEntry {\n  return typeof value === 'string' || isStructuredEntry(value)\n}\n\n/**\n * A record is a \"details\" record when every value is either an\n * accepted entry or an array of accepted entries (mixing structured +\n * bare-string in the same array is fine; the parser normalises per\n * entry). Half-structured objects (e.g. `{ message: 'x' }` missing\n * `code`) are still rejected so the bug surfaces — see the\n * `'rejects entries that are objects but missing required fields'`\n * test for the rationale.\n */\nfunction isDetailsRecord(value: unknown): value is ApiErrorDetails {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false\n  // Reject prototype-polluted keys — we don't use them here, but downstream\n  // spreads shouldn't have to worry about this input.\n  const record = value as Record<string, unknown>\n  for (const k of Object.keys(record)) {\n    const v = record[k]\n    if (isAcceptedEntry(v)) continue\n    if (Array.isArray(v) && v.every((entry) => isAcceptedEntry(entry))) continue\n    return false\n  }\n  return true\n}\n"],"names":["normalizeNumericOption","canonicalizePath","InvalidPathError"],"mappings":";;;;;;;AAcO,SAAS,sBAAsB,IAAA,EAAsB;AAC1D,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,oBAAA,EAAsB,CAAC,IAAA,KAAS;AAClD,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,GAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,QAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,QAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT;AACE,QAAA,OAAO,IAAA;AAAA;AACX,EACF,CAAC,CAAA;AACH;;ACmDO,MAAM,yBAAA,GAA4B;AAAA,EACvC,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,EAAA;AAAA,EACd,gBAAA,EAAkB,GAAA;AAAA,EAClB,WAAA,EAAa;AACf;AAmDO,SAAS,cAAA,CACd,SACA,OAAA,EACsB;AAOtB,EAAA,MAAM,aAAaA,qCAAA,CAAuB;AAAA,IACxC,KAAA,EAAO,OAAA,CAAQ,UAAA,IAAc,yBAAA,CAA0B,UAAA;AAAA,IACvD,MAAA,EAAQ,2BAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,GAAA,EAAK,CAAA;AAAA,IACL,cAAc,yBAAA,CAA0B;AAAA,GACzC,CAAA;AACD,EAAA,MAAM,eAAeA,qCAAA,CAAuB;AAAA,IAC1C,KAAA,EAAO,OAAA,CAAQ,YAAA,IAAgB,yBAAA,CAA0B,YAAA;AAAA,IACzD,MAAA,EAAQ,6BAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,GAAA,EAAK,CAAA;AAAA,IACL,cAAc,yBAAA,CAA0B;AAAA,GACzC,CAAA;AACD,EAAA,MAAM,mBAAmBA,qCAAA,CAAuB;AAAA,IAC9C,KAAA,EAAO,OAAA,CAAQ,gBAAA,IAAoB,yBAAA,CAA0B,gBAAA;AAAA,IAC7D,MAAA,EAAQ,iCAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,GAAA,EAAK,CAAA;AAAA,IACL,cAAc,yBAAA,CAA0B;AAAA,GACzC,CAAA;AACD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,yBAAA,CAA0B,WAAA;AAErE,EAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,MAAA,EAAW;AAC7C,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,EAAC,EAAE;AAAA,EAChC;AACA,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,IAAI,QAAA,EAAU,CAAA,YAAA,EAAe,OAAO,OAAO,CAAA,iBAAA,CAAA,EAAoB;AAAA,EAC7F;AAEA,EAAA,MAAM,UAAA,GAAa,eAAe,OAAkC,CAAA;AACpE,EAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,EAAC,EAAG,QAAA,EAAU,WAAW,MAAA,EAAO;AAAA,EAC9D;AAEA,EAAA,MAAM,EAAE,SAAQ,GAAI,UAAA;AACpB,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA;AAIxC,EAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,QAAQ,EAAC;AAAA,MACT,QAAA,EAAU,CAAA,YAAA,EAAe,UAAU,CAAA,6BAAA,EAAgC,UAAU,CAAA;AAAA,KAC/E;AAAA,EACF;AAEA,EAAA,MAAM,SAA4B,EAAC;AACnC,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,MAAM,YAAmD,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAM9F,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAWC,sBAAA,CAAiB,GAAG,CAAA,CAAE,QAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAeC,uBAAA,EAAkB;AACrC,MAAA,MAAM,GAAA;AAAA,IACR;AAMA,IAAA,IAAI,QAAA,CAAS,SAAS,YAAA,EAAc;AAIpC,IAAA,aAAA,IAAiB,QAAA,CAAS,MAAA;AAC1B,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,QAAQ,EAAC;AAAA,QACT,QAAA,EAAU,wDAAwD,gBAAgB,CAAA;AAAA,OACpF;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,SAAA,EAAW;AAM7B,MAAA,MAAM,OAAA,GAAU,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,KAAA,CAAM,OAAA;AAC1D,MAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,cAAc,KAAA,CAAM,IAAA;AAC7D,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,OAAA;AAAA,QACA,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AAAA,QACzB,SAAS,OAAA,CAAQ,OAAA;AAAA,QACjB;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAO;AAC5B;AAIA,SAAS,eAAe,OAAA,EAAiD;AACvE,EAAA,MAAM,YAAA,GAAe,QAAQ,OAAO,CAAA;AACpC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,YAAA,KAAiB,MAAA,IAAa,OAAO,iBAAiB,QAAA,EAAU;AAC3F,IAAA,MAAM,QAAS,YAAA,CAAuC,OAAA;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AAEvB,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AAAA,IACjC;AACA,IAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAS,KAAA,EAAM;AAC9D,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAOA,EAAA,IAAI,iBAAiB,IAAA,IAAQ,YAAA,KAAiB,MAAA,IAAa,OAAO,iBAAiB,QAAA,EAAU;AAC3F,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,CAAA,kBAAA,EAAqB,OAAO,YAAY,CAAA,qCAAA;AAAA,KAClD;AAAA,EACF;AAEA,EAAA,IAAI,aAAa,OAAA,EAAS;AACxB,IAAA,MAAM,KAAA,GAAQ,QAAQ,SAAS,CAAA;AAC/B,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AACxD,IAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAS,KAAA,EAAM;AAC9D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,8DAAA,EAA+D;AAAA,EAC7F;AAEA,EAAA,IAAI,eAAA,CAAgB,OAAO,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAS,OAAA,EAAQ;AAIlE,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AACtE,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,4BAAA,EAA6B;AAC3D;AAEA,SAAS,kBAAkB,KAAA,EAAwC;AACjE,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,KAAA;AAChF,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,OAAO,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,OAAO,IAAI,IAAA,KAAS,QAAA;AAChE;AAQA,SAAS,gBAAgB,KAAA,EAAiD;AACxE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,iBAAA,CAAkB,KAAK,CAAA;AAC7D;AAWA,SAAS,gBAAgB,KAAA,EAA0C;AACjE,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,KAAA;AAGhF,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACnC,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,eAAA,CAAgB,CAAC,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAU,eAAA,CAAgB,KAAK,CAAC,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.cjs","sources":["../src/runtime/core/serialize-script.ts","../src/runtime/core/parse-api-errors.ts"],"sourcesContent":["/**\n * Escape a JSON string so it's safe to embed inside an inline\n * `<script>` tag during SSR. Plain `JSON.stringify` is not safe — a\n * form value containing the literal substring `</script>` would\n * break out of the script tag.\n *\n * ```ts\n * const payload = escapeForInlineScript(JSON.stringify(renderAttaformState(app)))\n * // `<script>window.__ATTAFORM_STATE__ = ${payload}</script>` is safe.\n * ```\n *\n * Output remains valid JSON — `JSON.parse` round-trips back to the\n * original value on the client.\n */\nexport function escapeForInlineScript(json: string): string {\n  return json.replace(/[<>&\\u2028\\u2029]/g, (char) => {\n    switch (char) {\n      case '<':\n        return '\\\\u003c'\n      case '>':\n        return '\\\\u003e'\n      case '&':\n        return '\\\\u0026'\n      case '\\u2028':\n        return '\\\\u2028'\n      case '\\u2029':\n        return '\\\\u2029'\n      default:\n        return char\n    }\n  })\n}\n","import type {\n  ApiErrorDetails,\n  ApiErrorEntry,\n  ApiErrorEnvelope,\n  FormKey,\n  ValidationError,\n} from '../types/types-api'\nimport { normalizeNumericOption } from './defaults'\nimport { InvalidPathError } from './errors'\nimport { canonicalizePath } from './paths'\n\n/**\n * Result of `parseApiErrors`. Branch on `ok` to handle the two cases:\n *\n * ```ts\n * const result = parseApiErrors(payload, { formKey: form.key })\n * if (result.ok) {\n *   form.setFieldErrors(result.errors)\n * } else {\n *   console.warn('Bad error payload:', result.rejected)\n * }\n * ```\n *\n * `ok: true` means the payload was recognised — `errors` may still be\n * empty if the payload was valid but had no actual errors.\n * `ok: false` means the payload didn't match a known shape; `rejected`\n * carries a one-line description of why.\n */\nexport type ParseApiErrorsResult = {\n  /** `true` when the payload was recognised; `false` when the shape was unfamiliar. */\n  readonly ok: boolean\n  /** Errors extracted from the payload. May be empty even when `ok: true`. */\n  readonly errors: ValidationError[]\n  /** When `ok: false`, a one-line description of why the payload was rejected. */\n  readonly rejected?: string\n}\n\n/**\n * Options for `parseApiErrors`. The size caps protect against\n * misbehaving or hostile servers — exceeding any cap causes the\n * parser to reject the payload wholesale rather than partially apply.\n */\nexport type ParseApiErrorsOptions = {\n  /**\n   * The form's identifier — pass `form.key`. Stamped on every\n   * produced `ValidationError` so errors route to the right form.\n   */\n  readonly formKey: FormKey\n  /**\n   * Code stamped on `ValidationError`s synthesized from bare-string\n   * entries (the Rails / DRF / Laravel `{ field: [\"msg\"] }` shape).\n   * Default `'api:unknown'`. Pick something more specific\n   * (`'api:server-validation'`, `'myapp:legacy'`, …) when you know\n   * the source.\n   *\n   * Structured `{ message, code }` entries forward their `code`\n   * verbatim and ignore this option.\n   */\n  readonly defaultCode?: string\n  /**\n   * Maximum number of distinct keys to accept. Default `1000`.\n   * Raise for trusted backends that legitimately produce more.\n   */\n  readonly maxEntries?: number\n  /**\n   * Maximum number of path segments per key. Default `32`. Keys\n   * deeper than this are dropped (the rest of the payload still\n   * applies if it stays under the other caps).\n   */\n  readonly maxPathDepth?: number\n  /**\n   * Maximum total path segments summed across every accepted key.\n   * Default `10000`. Bounds the worst-case traversal cost.\n   */\n  readonly maxTotalSegments?: number\n}\n\n/**\n * Default size caps + default fallback code used by `parseApiErrors`.\n * Conservative; pass larger values (or a more specific code) via the\n * options bag for trusted-backend integrations.\n */\nexport const PARSE_API_ERRORS_DEFAULTS = {\n  maxEntries: 1000,\n  maxPathDepth: 32,\n  maxTotalSegments: 10000,\n  defaultCode: 'api:unknown',\n} as const\n\n/**\n * Normalise a server-side validation error payload into\n * `ValidationError[]`. Pair with `form.setFieldErrors` /\n * `form.addFieldErrors` to surface server errors on the form:\n *\n * ```ts\n * const response = await fetch('/api/signup', { … })\n * if (!response.ok) {\n *   const payload = await response.json()\n *   const result = parseApiErrors(payload, { formKey: form.key })\n *   if (result.ok) form.setFieldErrors(result.errors)\n * }\n * ```\n *\n * Recognised payload shapes:\n *\n * - Wrapped envelope:\n *   `{ error: { details: { email: { message: 'taken', code: 'api:duplicate-email' } } } }`\n * - Unwrapped envelope:\n *   `{ details: { email: { message: 'taken', code: 'api:duplicate-email' } } }`\n * - Raw details record:\n *   `{ email: { message: 'taken', code: 'api:duplicate-email' } }`\n * - **Bare-string Rails / DRF / Laravel shape:**\n *   `{ email: ['Email already taken.'], username: 'too short' }`\n * - `null` / `undefined` — returns `{ ok: true, errors: [] }`\n *\n * Two entry shapes are accepted:\n *\n * 1. **Structured** — `{ message: string, code: string }`. The `code`\n *    is forwarded verbatim onto the produced `ValidationError`.\n * 2. **Bare-string** — a plain string. Synthesized into\n *    `{ message: <string>, code: <defaultCode> }` where `defaultCode`\n *    comes from `options.defaultCode` (default `'api:unknown'`).\n *    Useful for the Rails / Django REST Framework / FastAPI / Laravel\n *    JSON shape that doesn't carry a per-field code.\n *\n * Each detail key's value can be a single entry, an array, or a mix\n * of structured and bare-string entries; arrays expand into one\n * `ValidationError` per entry. Pick a prefix on the server (`api:`,\n * `auth:`, etc.) and stay consistent so error renderers can branch\n * on `code` — or rely on `defaultCode` when the wire shape is\n * message-only.\n *\n * Dotted keys (`\"address.line1\"`) are split into structured paths\n * automatically. Use a custom server response shape outside these\n * patterns? Build the `ValidationError[]` array yourself and pass\n * it to `setFieldErrors` directly — `parseApiErrors` is just a\n * convenience for the common shapes.\n */\nexport function parseApiErrors(\n  payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown,\n  options: ParseApiErrorsOptions\n): ParseApiErrorsResult {\n  // Sanitise the caps. Comparison gates (`>` against the count /\n  // depth) yield `false` for `NaN`, so without sanitisation a\n  // hostile or malformed `NaN` cap would let pathological payloads\n  // run unbounded. `Infinity` would do the same. Negatives and\n  // non-integers would discard legitimate entries. Falls back to\n  // the library default on garbage.\n  const maxEntries = normalizeNumericOption({\n    value: options.maxEntries ?? PARSE_API_ERRORS_DEFAULTS.maxEntries,\n    source: 'parseApiErrors.maxEntries',\n    allowInfinity: false,\n    min: 0,\n    defaultValue: PARSE_API_ERRORS_DEFAULTS.maxEntries,\n  })\n  const maxPathDepth = normalizeNumericOption({\n    value: options.maxPathDepth ?? PARSE_API_ERRORS_DEFAULTS.maxPathDepth,\n    source: 'parseApiErrors.maxPathDepth',\n    allowInfinity: false,\n    min: 0,\n    defaultValue: PARSE_API_ERRORS_DEFAULTS.maxPathDepth,\n  })\n  const maxTotalSegments = normalizeNumericOption({\n    value: options.maxTotalSegments ?? PARSE_API_ERRORS_DEFAULTS.maxTotalSegments,\n    source: 'parseApiErrors.maxTotalSegments',\n    allowInfinity: false,\n    min: 0,\n    defaultValue: PARSE_API_ERRORS_DEFAULTS.maxTotalSegments,\n  })\n  const defaultCode = options.defaultCode ?? PARSE_API_ERRORS_DEFAULTS.defaultCode\n\n  if (payload === null || payload === undefined) {\n    return { ok: true, errors: [] }\n  }\n  if (typeof payload !== 'object') {\n    return { ok: false, errors: [], rejected: `payload was ${typeof payload}, expected object` }\n  }\n\n  const extraction = extractDetails(payload as Record<string, unknown>)\n  if (!extraction.ok) {\n    return { ok: false, errors: [], rejected: extraction.reason }\n  }\n\n  const { details } = extraction\n  const entryCount = Object.keys(details).length\n  // Enforce the guardrails before we spend time walking the payload.\n  // Rejecting wholesale (not partial-applying) keeps the failure visible\n  // so consumers can tune the caps or investigate the server payload.\n  if (entryCount > maxEntries) {\n    return {\n      ok: false,\n      errors: [],\n      rejected: `payload has ${entryCount} entries, exceeds maxEntries=${maxEntries}`,\n    }\n  }\n\n  const errors: ValidationError[] = []\n  let totalSegments = 0\n  for (const [key, value] of Object.entries(details)) {\n    const entryList: ReadonlyArray<string | ApiErrorEntry> = Array.isArray(value) ? value : [value]\n    // `canonicalizePath` throws `InvalidPathError` for dotted strings with\n    // empty segments (e.g. `'. '`, `'a..b'`). A misbehaving server can\n    // genuinely emit such a key; the hydrator is a normaliser, not a\n    // validator, so we drop offending keys rather than let the exception\n    // escape. Well-formed keys continue as normal.\n    let segments: readonly (string | number)[]\n    try {\n      segments = canonicalizePath(key).segments\n    } catch (err) {\n      if (err instanceof InvalidPathError) continue\n      throw err\n    }\n    // Per-path depth cap. We drop the offending key (rather than\n    // rejecting the whole payload) because a single stray deep path\n    // in an otherwise legitimate error set is still worth surfacing\n    // the rest. Consumers who want strict rejection can post-filter\n    // on `result.errors.length < details entryCount`.\n    if (segments.length > maxPathDepth) continue\n    // Total-segment cap. Enforced wholesale (not per-key) so a payload\n    // that passes the per-key gate but stacks into a pathological\n    // total still fails visibly. Mirrors `maxEntries` strictness.\n    totalSegments += segments.length\n    if (totalSegments > maxTotalSegments) {\n      return {\n        ok: false,\n        errors: [],\n        rejected: `payload total path segments exceeds maxTotalSegments=${maxTotalSegments}`,\n      }\n    }\n    for (const entry of entryList) {\n      // Bare-string entries (Rails / DRF / Laravel shape) synthesize a\n      // `code` from `options.defaultCode`; structured `{ message, code }`\n      // entries forward `code` verbatim. Empty messages drop silently\n      // (`{ message: '' }` or `''`) — same recoverable-malformed-server\n      // policy as before.\n      const message = typeof entry === 'string' ? entry : entry.message\n      const code = typeof entry === 'string' ? defaultCode : entry.code\n      if (message.length === 0) continue\n      errors.push({\n        message,\n        path: Array.from(segments),\n        formKey: options.formKey,\n        code,\n      })\n    }\n  }\n  return { ok: true, errors }\n}\n\ntype ExtractResult = { ok: true; details: ApiErrorDetails } | { ok: false; reason: string }\n\nfunction extractDetails(payload: Record<string, unknown>): ExtractResult {\n  const wrappedError = payload['error']\n  if (wrappedError !== null && wrappedError !== undefined && typeof wrappedError === 'object') {\n    const inner = (wrappedError as { details?: unknown }).details\n    if (inner === undefined) {\n      // A wrapped envelope without details is considered \"no errors\" — valid shape.\n      return { ok: true, details: {} }\n    }\n    if (isDetailsRecord(inner)) return { ok: true, details: inner }\n    return {\n      ok: false,\n      reason: 'error.details entries must be strings or { message, code } objects',\n    }\n  }\n\n  // `{ error: 'oops' }` / `{ error: 42 }` is a malformed wrapped envelope —\n  // the server meant an error object but sent a scalar. Without this guard\n  // the payload would fall through to the raw-details branch below, where\n  // `{ error: 'oops' }` satisfies `isDetailsRecord` and silently produces\n  // a phantom `ValidationError` at path `['error']`.\n  if (wrappedError !== null && wrappedError !== undefined && typeof wrappedError !== 'object') {\n    return {\n      ok: false,\n      reason: `payload.error was ${typeof wrappedError}, expected an object with { details }`,\n    }\n  }\n\n  if ('details' in payload) {\n    const inner = payload['details']\n    if (inner === undefined) return { ok: true, details: {} }\n    if (isDetailsRecord(inner)) return { ok: true, details: inner }\n    return { ok: false, reason: 'details entries must be strings or { message, code } objects' }\n  }\n\n  if (isDetailsRecord(payload)) return { ok: true, details: payload }\n\n  // Heuristic: if the payload has keys but none of them look like details,\n  // it's probably a completely different shape. Reject.\n  if (Object.keys(payload).length === 0) return { ok: true, details: {} }\n  return { ok: false, reason: 'unrecognised payload shape' }\n}\n\nfunction isStructuredEntry(value: unknown): value is ApiErrorEntry {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false\n  const obj = value as { message?: unknown; code?: unknown }\n  return typeof obj.message === 'string' && typeof obj.code === 'string'\n}\n\n/**\n * Accepts either a structured `{ message, code }` entry OR a bare\n * string. Bare strings synthesize a `code` at parse time\n * (`options.defaultCode`) and are useful for the Rails / Django REST\n * Framework / Laravel JSON shape that doesn't carry a per-field code.\n */\nfunction isAcceptedEntry(value: unknown): value is string | ApiErrorEntry {\n  return typeof value === 'string' || isStructuredEntry(value)\n}\n\n/**\n * A record is a \"details\" record when every value is either an\n * accepted entry or an array of accepted entries (mixing structured +\n * bare-string in the same array is fine; the parser normalises per\n * entry). Half-structured objects (e.g. `{ message: 'x' }` missing\n * `code`) are still rejected so the bug surfaces — see the\n * `'rejects entries that are objects but missing required fields'`\n * test for the rationale.\n */\nfunction isDetailsRecord(value: unknown): value is ApiErrorDetails {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false\n  // Reject prototype-polluted keys — we don't use them here, but downstream\n  // spreads shouldn't have to worry about this input.\n  const record = value as Record<string, unknown>\n  for (const k of Object.keys(record)) {\n    const v = record[k]\n    if (isAcceptedEntry(v)) continue\n    if (Array.isArray(v) && v.every((entry) => isAcceptedEntry(entry))) continue\n    return false\n  }\n  return true\n}\n"],"names":["normalizeNumericOption","canonicalizePath","InvalidPathError"],"mappings":";;;;;;AAcO,SAAS,sBAAsB,IAAA,EAAsB;AAC1D,EAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,oBAAA,EAAsB,CAAC,IAAA,KAAS;AAClD,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,GAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,GAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,QAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT,KAAK,QAAA;AACH,QAAA,OAAO,SAAA;AAAA,MACT;AACE,QAAA,OAAO,IAAA;AAAA;AACX,EACF,CAAC,CAAA;AACH;;ACmDO,MAAM,yBAAA,GAA4B;AAAA,EACvC,UAAA,EAAY,GAAA;AAAA,EACZ,YAAA,EAAc,EAAA;AAAA,EACd,gBAAA,EAAkB,GAAA;AAAA,EAClB,WAAA,EAAa;AACf;AAmDO,SAAS,cAAA,CACd,SACA,OAAA,EACsB;AAOtB,EAAA,MAAM,aAAaA,mCAAA,CAAuB;AAAA,IACxC,KAAA,EAAO,OAAA,CAAQ,UAAA,IAAc,yBAAA,CAA0B,UAAA;AAAA,IACvD,MAAA,EAAQ,2BAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,GAAA,EAAK,CAAA;AAAA,IACL,cAAc,yBAAA,CAA0B;AAAA,GACzC,CAAA;AACD,EAAA,MAAM,eAAeA,mCAAA,CAAuB;AAAA,IAC1C,KAAA,EAAO,OAAA,CAAQ,YAAA,IAAgB,yBAAA,CAA0B,YAAA;AAAA,IACzD,MAAA,EAAQ,6BAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,GAAA,EAAK,CAAA;AAAA,IACL,cAAc,yBAAA,CAA0B;AAAA,GACzC,CAAA;AACD,EAAA,MAAM,mBAAmBA,mCAAA,CAAuB;AAAA,IAC9C,KAAA,EAAO,OAAA,CAAQ,gBAAA,IAAoB,yBAAA,CAA0B,gBAAA;AAAA,IAC7D,MAAA,EAAQ,iCAAA;AAAA,IACR,aAAA,EAAe,KAAA;AAAA,IACf,GAAA,EAAK,CAAA;AAAA,IACL,cAAc,yBAAA,CAA0B;AAAA,GACzC,CAAA;AACD,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,yBAAA,CAA0B,WAAA;AAErE,EAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,MAAA,EAAW;AAC7C,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAQ,EAAC,EAAE;AAAA,EAChC;AACA,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,IAAI,QAAA,EAAU,CAAA,YAAA,EAAe,OAAO,OAAO,CAAA,iBAAA,CAAA,EAAoB;AAAA,EAC7F;AAEA,EAAA,MAAM,UAAA,GAAa,eAAe,OAAkC,CAAA;AACpE,EAAA,IAAI,CAAC,WAAW,EAAA,EAAI;AAClB,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,MAAA,EAAQ,EAAC,EAAG,QAAA,EAAU,WAAW,MAAA,EAAO;AAAA,EAC9D;AAEA,EAAA,MAAM,EAAE,SAAQ,GAAI,UAAA;AACpB,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA;AAIxC,EAAA,IAAI,aAAa,UAAA,EAAY;AAC3B,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,QAAQ,EAAC;AAAA,MACT,QAAA,EAAU,CAAA,YAAA,EAAe,UAAU,CAAA,6BAAA,EAAgC,UAAU,CAAA;AAAA,KAC/E;AAAA,EACF;AAEA,EAAA,MAAM,SAA4B,EAAC;AACnC,EAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClD,IAAA,MAAM,YAAmD,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAM9F,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAWC,sBAAA,CAAiB,GAAG,CAAA,CAAE,QAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAeC,sBAAA,EAAkB;AACrC,MAAA,MAAM,GAAA;AAAA,IACR;AAMA,IAAA,IAAI,QAAA,CAAS,SAAS,YAAA,EAAc;AAIpC,IAAA,aAAA,IAAiB,QAAA,CAAS,MAAA;AAC1B,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,QAAQ,EAAC;AAAA,QACT,QAAA,EAAU,wDAAwD,gBAAgB,CAAA;AAAA,OACpF;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,SAAA,EAAW;AAM7B,MAAA,MAAM,OAAA,GAAU,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,KAAA,CAAM,OAAA;AAC1D,MAAA,MAAM,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,cAAc,KAAA,CAAM,IAAA;AAC7D,MAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1B,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,OAAA;AAAA,QACA,IAAA,EAAM,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AAAA,QACzB,SAAS,OAAA,CAAQ,OAAA;AAAA,QACjB;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,MAAA,EAAO;AAC5B;AAIA,SAAS,eAAe,OAAA,EAAiD;AACvE,EAAA,MAAM,YAAA,GAAe,QAAQ,OAAO,CAAA;AACpC,EAAA,IAAI,iBAAiB,IAAA,IAAQ,YAAA,KAAiB,MAAA,IAAa,OAAO,iBAAiB,QAAA,EAAU;AAC3F,IAAA,MAAM,QAAS,YAAA,CAAuC,OAAA;AACtD,IAAA,IAAI,UAAU,MAAA,EAAW;AAEvB,MAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AAAA,IACjC;AACA,IAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAS,KAAA,EAAM;AAC9D,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ;AAAA,KACV;AAAA,EACF;AAOA,EAAA,IAAI,iBAAiB,IAAA,IAAQ,YAAA,KAAiB,MAAA,IAAa,OAAO,iBAAiB,QAAA,EAAU;AAC3F,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,MAAA,EAAQ,CAAA,kBAAA,EAAqB,OAAO,YAAY,CAAA,qCAAA;AAAA,KAClD;AAAA,EACF;AAEA,EAAA,IAAI,aAAa,OAAA,EAAS;AACxB,IAAA,MAAM,KAAA,GAAQ,QAAQ,SAAS,CAAA;AAC/B,IAAA,IAAI,KAAA,KAAU,QAAW,OAAO,EAAE,IAAI,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AACxD,IAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAS,KAAA,EAAM;AAC9D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,8DAAA,EAA+D;AAAA,EAC7F;AAEA,EAAA,IAAI,eAAA,CAAgB,OAAO,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,SAAS,OAAA,EAAQ;AAIlE,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAE,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AACtE,EAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,MAAA,EAAQ,4BAAA,EAA6B;AAC3D;AAEA,SAAS,kBAAkB,KAAA,EAAwC;AACjE,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,KAAA;AAChF,EAAA,MAAM,GAAA,GAAM,KAAA;AACZ,EAAA,OAAO,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,OAAO,IAAI,IAAA,KAAS,QAAA;AAChE;AAQA,SAAS,gBAAgB,KAAA,EAAiD;AACxE,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,iBAAA,CAAkB,KAAK,CAAA;AAC7D;AAWA,SAAS,gBAAgB,KAAA,EAA0C;AACjE,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG,OAAO,KAAA;AAGhF,EAAA,MAAM,MAAA,GAAS,KAAA;AACf,EAAA,KAAA,MAAW,CAAA,IAAK,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACnC,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,eAAA,CAAgB,CAAC,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,IAAK,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAU,eAAA,CAAgB,KAAK,CAAC,CAAA,EAAG;AACpE,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}