attaform 0.18.2 → 0.20.0

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { Plugin, App } from 'vue';
-import { S as SSRDetectOptions, d as SerializedFormData, c as AttaformRegistry } from './shared/attaform.D1gzu2GL.mjs';
-export { A as AggregateError, a as AnyForm, b as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, e as StepSlot, U as UseRegisterReturn, f as UseWizardReturnType, W as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.D1gzu2GL.mjs';
-import { f as AttaformDefaults, s as FormKey, G as GenericForm, ai as UseFormConfiguration, A as AbstractSchema, j as DefaultValuesInput, aj as UseFormReturnType, a6 as RegisterValue, a1 as RegisterModelDynamicCustomDirective, a8 as Segment, ac as ShouldShowErrors, am as ValidationError, c as ApiErrorEnvelope, a as ApiErrorDetails } from './shared/attaform.Ca5_6Ky-.mjs';
-export { b as ApiErrorEntry, d as ArrayItem, e as ArrayPath, C as CoercionEntry, g as CoercionRegistry, h as CoercionResult, i as CustomDirectiveRegisterAssignerFn, D as DeepPartial, k as DefaultValuesResponse, l as DefaultValuesShape, E as ErrorsProxyShape, F as FieldMetaPayload, m as FieldState, n as FieldStateMap, o as FieldStateMapEntry, p as FlatPath, q as FormErrorRecord, r as FormErrorsSurface, t as FormMeta, u as FormStorage, v as FormStorageKind, H as HandleSubmit, w as HistoryConfig, I as IsTuple, x as IsUnion, J as JoinSegments, K as KeyofUnion, L as LiftedValueShape, M as MetaTrackerValue, N as NestedReadType, y as NestedType, O as OnError, z as OnInvalidSubmitPolicy, B as OnSubmit, P as PartialFlatPath, Q as Path, R as PathKey, S as PendingValidationStatus, T as PersistConfig, U as PersistConfigOptions, V as PersistIncludeMode, X as Primitive, Y as ROOT_PATH, Z as ROOT_PATH_KEY, _ as ReactiveValidationStatus, $ as RegisterDirective, a0 as RegisterFlatPath, a2 as RegisterOptions, a3 as RegisterSelectModifier, a4 as RegisterTextModifier, a5 as RegisterTransform, a9 as SetValueCallback, aa as SetValuePayload, ab as SettledValidationStatus, ad as ShouldShowErrorsConfig, ae as SlimPrimitiveKind, af as SlimRuntimeOf, ag as SubmitHandler, ah as Unset, ak as ValidateOn, al as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.Ca5_6Ky-.mjs';
-export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SensitivePersistFieldError, d as SubmitErrorHandlerError } from './shared/attaform.B7rzpK1U.mjs';
+import { S as SSRDetectOptions, c as SerializedFormData, b as AttaformRegistry } from './shared/attaform.EMzJcQci.mjs';
+export { A as AnyForm, a as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.EMzJcQci.mjs';
+import { f as AttaformDefaults, t as FormKey, G as GenericForm, ai as UseFormConfiguration, A as AbstractSchema, j as DefaultValuesInput, aj as UseFormReturnType, a8 as RegisterValue, a3 as RegisterModelDynamicCustomDirective, x as GetDisplayState, am as ValidationError, c as ApiErrorEnvelope, a as ApiErrorDetails } from './shared/attaform.SfhU0OEY.mjs';
+export { b as ApiErrorEntry, d as ArrayItem, e as ArrayPath, C as CoercionEntry, g as CoercionRegistry, h as CoercionResult, i as CustomDirectiveRegisterAssignerFn, D as DeepPartial, k as DefaultValuesResponse, l as DefaultValuesShape, m as DisplayState, E as ErrorsProxyShape, F as FieldMetaPayload, n as FieldState, o as FieldStateMap, p as FieldStateMapEntry, q as FlatPath, r as FormErrorRecord, s as FormErrorsSurface, u as FormMeta, v as FormStorage, w as FormStorageKind, H as HandleSubmit, y as HistoryConfig, I as IsTuple, z as IsUnion, J as JoinSegments, K as KeyofUnion, L as LiftedValueShape, M as MetaTrackerValue, N as NestedReadType, B as NestedType, O as OnError, P as OnInvalidSubmitPolicy, Q as OnSubmit, R as PartialFlatPath, S as Path, T as PathKey, U as PendingValidationStatus, V as PersistConfig, W as PersistConfigOptions, X as PersistIncludeMode, Z as Primitive, _ as ROOT_PATH, $ as ROOT_PATH_KEY, a0 as ReactiveValidationStatus, a1 as RegisterDirective, a2 as RegisterFlatPath, a4 as RegisterOptions, a5 as RegisterSelectModifier, a6 as RegisterTextModifier, a7 as RegisterTransform, aa as Segment, ab as SetValueCallback, ac as SetValuePayload, ad as SettledValidationStatus, ae as SlimPrimitiveKind, af as SlimRuntimeOf, ag as SubmitHandler, ah as Unset, ak as ValidateOn, al as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.SfhU0OEY.mjs';
+export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.DkA5J8NW.mjs';
 
 /**
  * Options for `createAttaform()`.
@@ -217,39 +217,13 @@ declare const vRegister: RegisterModelDynamicCustomDirective;
  * the Nuxt DevTools (overlay) panel wired up via `../../nuxt.ts` +
  * `../pages/_attaform_devtools.vue`.
  *
- * Centralizing the redaction policy and the window-bridge contract here
- * keeps both surfaces aligned: a future tightening of the sensitive-name
- * heuristic, or a new field added to the bridge, lands in one file.
+ * Houses the window-bridge contract both surfaces consume so a new
+ * bridge field lands in one file. Both surfaces render RAW form values
+ * by design — DevTools is a dev-only surface, and redaction across every
+ * place a value surfaces is impractical security theater rather than a
+ * real safeguard.
  */
 
-declare const REDACTED = "[redacted]";
-/**
- * Walk `value` and replace any leaf whose enclosing path matches the
- * sensitive-name heuristic with the string `'[redacted]'`. Returns a
- * new tree (no mutation of the input). Object keys + array indices are
- * preserved; only the leaf payloads change.
- *
- * Applied to BOTH devtools surfaces' Form-value rendering AND every
- * timeline event payload — leaks via either surface are treatable as
- * "any developer with the panel open during user testing can read a
- * customer's password," which is exactly the failure mode the
- * sensitive-name guard exists to prevent on the storage side.
- *
- * Leaves whose path doesn't match a pattern pass through untouched.
- * `acknowledgeSensitive: true` on persistence does NOT bypass this — if
- * the consumer opted into persisting the value, they still shouldn't
- * see it in DevTools timelines that grow unbounded.
- *
- * Implementation note: tracks an `inSensitiveSubtree` flag through the
- * recursion instead of allocating a fresh path array per node + calling
- * `isSensitivePath` per leaf. Once any ancestor segment matches the
- * heuristic, the flag stays set for every descendant — the leaf simply
- * returns `REDACTED` without re-scanning the path. For a 100-leaf form:
- * ~100 path allocations + ~100 full-path regex sweeps → 0 path
- * allocations + ~100 single-segment regex sweeps, with whole-subtree
- * short-circuit when sensitive ancestors are found early.
- */
-declare function redactSensitiveLeaves(value: unknown, matchSensitive: (segment: Segment) => boolean): unknown;
 /**
  * Property key on `window` that the Nuxt-side dev plugin attaches the
  * bridge object to. The iframe-mounted overlay panel reads
@@ -287,86 +261,79 @@ declare global {
 }
 
 /**
- * Library-default heuristic for `shouldShowErrors`. Drives
- * `field.showErrors` and `form.meta.showErrors` whenever the consumer
- * has not configured an override at either the plugin or per-form
- * level.
- *
- * Four clauses: the first two are hard gates; clause 3 is an
- * aggressive override after the first submit attempt; clause 4 is
- * the pre-submit timing gate.
- *
- * 1. **Own-path filter.** The field must have at least one error whose
- *    path equals the field's own path. Leaves always satisfy this when
- *    they have errors. Containers (intermediate or root) only satisfy
- *    it for errors that point directly at them, so a UI rendering
- *    `field.showErrors` at a container never duplicates errors that a
- *    more-specific descendant will already render. Aggregate banners
- *    that want "any error anywhere passed the gate" should bind to
- *    `form.meta.errorCount > 0` (paired with whatever timing signal
- *    fits), not to `form.meta.showErrors`.
- *
- * 2. **Not currently validating.** While the field is mid-revalidation
- *    (`field.validating === true`) the verdict in `field.errors` is
- *    stale by definition. The error itself stays in the store under
- *    the stale-while-revalidate contract so the surface doesn't
- *    flicker to empty, but the UX gate hides it: the application is
- *    actively re-checking, so the message would mis-narrate the
- *    state of the world. Containers roll up `validating` as a
- *    disjunction, so any descendant under revalidation hides the
- *    container's `showErrors` too. The error returns the moment the
- *    new verdict lands and `validating` flips back to false.
- *
- * 3. **Post-submit override.** Once `formMeta.submissionAttempts > 0`
- *    the heuristic surfaces every own-path error unconditionally on
- *    the field axis (subject only to the two gates above). The
- *    counter covers two distinct gestures:
- *
- *    - `form.handleSubmit` directly, or `wizard.handleSubmit` at an
- *      intermediate step. The user asked this specific form to
- *      commit; transient mid-edit hiding is no longer appropriate.
- *
- *    - `wizard.handleSubmit` at the final step. The wizard validates
- *      every form in parallel and bumps each one's `submissionAttempts`,
- *      so a `Finish`-button submission reveals errors across the
- *      whole multistep flow at once. That's the review-surface UX:
- *      by the time the user tries to commit the wizard, every
- *      blocking error lights up regardless of which step it lives on.
- *
- *    The arm deliberately covers focused, pristine, and untouched
- *    fields, so the next paint after the user tried to progress lights
- *    up every problem the validator found.
- *
- * 4. **Pre-submit timing gate.** Before the first submit attempt,
- *    show once the user has touched the field (sticky-true after the
- *    first blur) AND is not currently focused on it. The not-focused
- *    half hides transient errors while the user is actively editing
- *    the field; they reappear when the user blurs (or focuses a
- *    sibling). This deliberately includes blur-without-typing on a
- *    required field (touched flips on blur regardless of `dirty`), so
- *    a user who visits an empty required field and moves on sees the
- *    error.
- *
- * The framework already gates on `errors.length > 0` before invoking
- * the predicate, so the body only decides *when* to surface existing
- * errors, not whether errors exist.
+ * Library-default `getDisplayState` heuristic. Resolves every path's
+ * `field.displayState` — and thus `field.show*` and the `form.meta`
+ * rollups — whenever the consumer has not configured an override at the
+ * per-form or plugin level.
+ *
+ * One timing gate, then precedence:
+ *
+ * 1. **Timing gate.** `gateOpen` once the form has been submitted
+ *    (`submissionAttempts > 0`) OR the field has been edited and then
+ *    left (`blurredAfterInteraction === true`). Before the gate opens
+ *    the verdict is `'idle'` regardless of errors. This is the "reward
+ *    early, punish late" rule:
+ *      - A clean tab-through never engages. `blurredAfterInteraction`
+ *        only flips on a blur that follows an edit, so visiting a field
+ *        and moving on without editing it stays quiet until a submit
+ *        forces the issue, even if the field was tabbed through before.
+ *      - The first pass stays quiet. Editing alone (`interacted`) does
+ *        not open the gate; the error reveals only once the user
+ *        finishes that pass and leaves the field, never mid-entry.
+ *      - Recovery is live. The bit is sticky and carries no not-focused
+ *        term, so once a field has been revealed it stays open through a
+ *        re-focus: a shown error clears (or greens) the instant the
+ *        value becomes valid, without forcing another blur.
+ *
+ *    The submit arm covers `form.handleSubmit` directly and
+ *    `wizard.handleSubmit` (which bumps `submissionAttempts` on the
+ *    active form at intermediate steps and on every form at the final
+ *    step, lighting up the whole flow at once).
+ *
+ * 2. **Pending.** With the gate open, a per-field run in flight
+ *    (`validating === true`) wins: the verdict in `errors` is stale by
+ *    definition, so surface `'pending'` (a spinner) rather than a
+ *    possibly-wrong error or success. Containers roll `validating` up as
+ *    a disjunction, so any descendant under revalidation reads
+ *    `'pending'` at the container too.
+ *
+ * 3. **Error.** An own-path error (one whose path equals the field's own
+ *    path) resolves to `'error'`. The own-path filter means a container
+ *    never duplicates an error a more-specific descendant already
+ *    renders; aggregate banners bind to `form.meta.errorCount` instead.
+ *
+ * 4. **Success.** No error, `valid === true`, and the green check is
+ *    earned: the field is non-blank and `dirty` (its value diverges from
+ *    the hydration original). Gating success on `dirty && !blank` keeps
+ *    the check meaningful — an empty field that happens to pass, a
+ *    pre-filled field merely tabbed through, and the post-submit flood of
+ *    every valid field all stay `'idle'` rather than greening for free.
+ *    `valid` already gates async schemas on the form-wide first
+ *    validation pass, so success never fires before the first verdict
+ *    lands.
+ *
+ * 5. **Idle.** Anything else — gate open but not validating, no own-path
+ *    error, and either not yet `valid` or valid-but-unearned (blank or
+ *    unchanged) — stays `'idle'`.
  *
  * Public re-export so adopters can compose with this without
- * copy-pasting the rule body. A layered predicate that adds a special
- * case but otherwise defers to the library default picks up future
- * heuristic refinements automatically:
+ * copy-pasting the rule body — a layered predicate that special-cases a
+ * subtree but otherwise defers picks up future refinements
+ * automatically:
  *
  * ```ts
- * import { defaultShouldShowErrors } from 'attaform'
+ * import { defaultDisplayState } from 'attaform'
  *
  * useForm({
  *   schema,
- *   shouldShowErrors: (field, formMeta) =>
- *     field.path[0] === 'urgent' || defaultShouldShowErrors(field, formMeta),
+ *   getDisplayState: (field, formMeta) => {
+ *     const state = defaultDisplayState(field, formMeta)
+ *     return field.path[0] === 'username' && state === 'success' ? 'idle' : state
+ *   },
  * })
  * ```
  */
-declare const defaultShouldShowErrors: ShouldShowErrors;
+declare const defaultDisplayState: GetDisplayState;
 
 /**
  * The library's built-in conservative set of identifier name stems that
@@ -391,9 +358,9 @@ declare const defaultShouldShowErrors: ShouldShowErrors;
  * })
  * ```
  *
- * The same resolved predicate gates persistence writes, multi-tab sync
- * broadcasts, AND the DevTools redact walk — one source of truth for
- * "what counts as sensitive" across every surface.
+ * The same resolved predicate gates persistence writes and multi-tab
+ * sync broadcasts — one source of truth for "what counts as sensitive"
+ * across those surfaces. (DevTools renders raw values by design.)
  *
  * **Non-goals.** This is not a soundness guarantee. Adversarial paths
  * (`'sensitive_data'`, `'CCV'` instead of `'CVV'`) can slip through.
@@ -529,5 +496,5 @@ declare const PARSE_API_ERRORS_DEFAULTS: {
  */
 declare function parseApiErrors(payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown, options: ParseApiErrorsOptions): ParseApiErrorsResult;
 
-export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, PARSE_API_ERRORS_DEFAULTS, REDACTED, RegisterValue, Segment, SerializedFormData, ShouldShowErrors, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultShouldShowErrors, escapeForInlineScript, hydrateAttaformState, isRegisterValue, parseApiErrors, redactSensitiveLeaves, renderAttaformState, useAbstractForm as useForm, vRegister };
+export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
 export type { AttaformDevtoolsBridge, AttaformPluginOptions, ParseApiErrorsOptions, ParseApiErrorsResult, SerializedAttaformState };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 import { Plugin, App } from 'vue';
-import { S as SSRDetectOptions, d as SerializedFormData, c as AttaformRegistry } from './shared/attaform.CGX1CNpz.js';
-export { A as AggregateError, a as AnyForm, b as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, e as StepSlot, U as UseRegisterReturn, f as UseWizardReturnType, W as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.CGX1CNpz.js';
-import { f as AttaformDefaults, s as FormKey, G as GenericForm, ai as UseFormConfiguration, A as AbstractSchema, j as DefaultValuesInput, aj as UseFormReturnType, a6 as RegisterValue, a1 as RegisterModelDynamicCustomDirective, a8 as Segment, ac as ShouldShowErrors, am as ValidationError, c as ApiErrorEnvelope, a as ApiErrorDetails } from './shared/attaform.Ca5_6Ky-.js';
-export { b as ApiErrorEntry, d as ArrayItem, e as ArrayPath, C as CoercionEntry, g as CoercionRegistry, h as CoercionResult, i as CustomDirectiveRegisterAssignerFn, D as DeepPartial, k as DefaultValuesResponse, l as DefaultValuesShape, E as ErrorsProxyShape, F as FieldMetaPayload, m as FieldState, n as FieldStateMap, o as FieldStateMapEntry, p as FlatPath, q as FormErrorRecord, r as FormErrorsSurface, t as FormMeta, u as FormStorage, v as FormStorageKind, H as HandleSubmit, w as HistoryConfig, I as IsTuple, x as IsUnion, J as JoinSegments, K as KeyofUnion, L as LiftedValueShape, M as MetaTrackerValue, N as NestedReadType, y as NestedType, O as OnError, z as OnInvalidSubmitPolicy, B as OnSubmit, P as PartialFlatPath, Q as Path, R as PathKey, S as PendingValidationStatus, T as PersistConfig, U as PersistConfigOptions, V as PersistIncludeMode, X as Primitive, Y as ROOT_PATH, Z as ROOT_PATH_KEY, _ as ReactiveValidationStatus, $ as RegisterDirective, a0 as RegisterFlatPath, a2 as RegisterOptions, a3 as RegisterSelectModifier, a4 as RegisterTextModifier, a5 as RegisterTransform, a9 as SetValueCallback, aa as SetValuePayload, ab as SettledValidationStatus, ad as ShouldShowErrorsConfig, ae as SlimPrimitiveKind, af as SlimRuntimeOf, ag as SubmitHandler, ah as Unset, ak as ValidateOn, al as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.Ca5_6Ky-.js';
-export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SensitivePersistFieldError, d as SubmitErrorHandlerError } from './shared/attaform.B7rzpK1U.js';
+import { S as SSRDetectOptions, c as SerializedFormData, b as AttaformRegistry } from './shared/attaform.Bh3ACtts.js';
+export { A as AnyForm, a as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.Bh3ACtts.js';
+import { f as AttaformDefaults, t as FormKey, G as GenericForm, ai as UseFormConfiguration, A as AbstractSchema, j as DefaultValuesInput, aj as UseFormReturnType, a8 as RegisterValue, a3 as RegisterModelDynamicCustomDirective, x as GetDisplayState, am as ValidationError, c as ApiErrorEnvelope, a as ApiErrorDetails } from './shared/attaform.SfhU0OEY.js';
+export { b as ApiErrorEntry, d as ArrayItem, e as ArrayPath, C as CoercionEntry, g as CoercionRegistry, h as CoercionResult, i as CustomDirectiveRegisterAssignerFn, D as DeepPartial, k as DefaultValuesResponse, l as DefaultValuesShape, m as DisplayState, E as ErrorsProxyShape, F as FieldMetaPayload, n as FieldState, o as FieldStateMap, p as FieldStateMapEntry, q as FlatPath, r as FormErrorRecord, s as FormErrorsSurface, u as FormMeta, v as FormStorage, w as FormStorageKind, H as HandleSubmit, y as HistoryConfig, I as IsTuple, z as IsUnion, J as JoinSegments, K as KeyofUnion, L as LiftedValueShape, M as MetaTrackerValue, N as NestedReadType, B as NestedType, O as OnError, P as OnInvalidSubmitPolicy, Q as OnSubmit, R as PartialFlatPath, S as Path, T as PathKey, U as PendingValidationStatus, V as PersistConfig, W as PersistConfigOptions, X as PersistIncludeMode, Z as Primitive, _ as ROOT_PATH, $ as ROOT_PATH_KEY, a0 as ReactiveValidationStatus, a1 as RegisterDirective, a2 as RegisterFlatPath, a4 as RegisterOptions, a5 as RegisterSelectModifier, a6 as RegisterTextModifier, a7 as RegisterTransform, aa as Segment, ab as SetValueCallback, ac as SetValuePayload, ad as SettledValidationStatus, ae as SlimPrimitiveKind, af as SlimRuntimeOf, ag as SubmitHandler, ah as Unset, ak as ValidateOn, al as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.SfhU0OEY.js';
+export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.DkA5J8NW.js';
 
 /**
  * Options for `createAttaform()`.
@@ -217,39 +217,13 @@ declare const vRegister: RegisterModelDynamicCustomDirective;
  * the Nuxt DevTools (overlay) panel wired up via `../../nuxt.ts` +
  * `../pages/_attaform_devtools.vue`.
  *
- * Centralizing the redaction policy and the window-bridge contract here
- * keeps both surfaces aligned: a future tightening of the sensitive-name
- * heuristic, or a new field added to the bridge, lands in one file.
+ * Houses the window-bridge contract both surfaces consume so a new
+ * bridge field lands in one file. Both surfaces render RAW form values
+ * by design — DevTools is a dev-only surface, and redaction across every
+ * place a value surfaces is impractical security theater rather than a
+ * real safeguard.
  */
 
-declare const REDACTED = "[redacted]";
-/**
- * Walk `value` and replace any leaf whose enclosing path matches the
- * sensitive-name heuristic with the string `'[redacted]'`. Returns a
- * new tree (no mutation of the input). Object keys + array indices are
- * preserved; only the leaf payloads change.
- *
- * Applied to BOTH devtools surfaces' Form-value rendering AND every
- * timeline event payload — leaks via either surface are treatable as
- * "any developer with the panel open during user testing can read a
- * customer's password," which is exactly the failure mode the
- * sensitive-name guard exists to prevent on the storage side.
- *
- * Leaves whose path doesn't match a pattern pass through untouched.
- * `acknowledgeSensitive: true` on persistence does NOT bypass this — if
- * the consumer opted into persisting the value, they still shouldn't
- * see it in DevTools timelines that grow unbounded.
- *
- * Implementation note: tracks an `inSensitiveSubtree` flag through the
- * recursion instead of allocating a fresh path array per node + calling
- * `isSensitivePath` per leaf. Once any ancestor segment matches the
- * heuristic, the flag stays set for every descendant — the leaf simply
- * returns `REDACTED` without re-scanning the path. For a 100-leaf form:
- * ~100 path allocations + ~100 full-path regex sweeps → 0 path
- * allocations + ~100 single-segment regex sweeps, with whole-subtree
- * short-circuit when sensitive ancestors are found early.
- */
-declare function redactSensitiveLeaves(value: unknown, matchSensitive: (segment: Segment) => boolean): unknown;
 /**
  * Property key on `window` that the Nuxt-side dev plugin attaches the
  * bridge object to. The iframe-mounted overlay panel reads
@@ -287,86 +261,79 @@ declare global {
 }
 
 /**
- * Library-default heuristic for `shouldShowErrors`. Drives
- * `field.showErrors` and `form.meta.showErrors` whenever the consumer
- * has not configured an override at either the plugin or per-form
- * level.
- *
- * Four clauses: the first two are hard gates; clause 3 is an
- * aggressive override after the first submit attempt; clause 4 is
- * the pre-submit timing gate.
- *
- * 1. **Own-path filter.** The field must have at least one error whose
- *    path equals the field's own path. Leaves always satisfy this when
- *    they have errors. Containers (intermediate or root) only satisfy
- *    it for errors that point directly at them, so a UI rendering
- *    `field.showErrors` at a container never duplicates errors that a
- *    more-specific descendant will already render. Aggregate banners
- *    that want "any error anywhere passed the gate" should bind to
- *    `form.meta.errorCount > 0` (paired with whatever timing signal
- *    fits), not to `form.meta.showErrors`.
- *
- * 2. **Not currently validating.** While the field is mid-revalidation
- *    (`field.validating === true`) the verdict in `field.errors` is
- *    stale by definition. The error itself stays in the store under
- *    the stale-while-revalidate contract so the surface doesn't
- *    flicker to empty, but the UX gate hides it: the application is
- *    actively re-checking, so the message would mis-narrate the
- *    state of the world. Containers roll up `validating` as a
- *    disjunction, so any descendant under revalidation hides the
- *    container's `showErrors` too. The error returns the moment the
- *    new verdict lands and `validating` flips back to false.
- *
- * 3. **Post-submit override.** Once `formMeta.submissionAttempts > 0`
- *    the heuristic surfaces every own-path error unconditionally on
- *    the field axis (subject only to the two gates above). The
- *    counter covers two distinct gestures:
- *
- *    - `form.handleSubmit` directly, or `wizard.handleSubmit` at an
- *      intermediate step. The user asked this specific form to
- *      commit; transient mid-edit hiding is no longer appropriate.
- *
- *    - `wizard.handleSubmit` at the final step. The wizard validates
- *      every form in parallel and bumps each one's `submissionAttempts`,
- *      so a `Finish`-button submission reveals errors across the
- *      whole multistep flow at once. That's the review-surface UX:
- *      by the time the user tries to commit the wizard, every
- *      blocking error lights up regardless of which step it lives on.
- *
- *    The arm deliberately covers focused, pristine, and untouched
- *    fields, so the next paint after the user tried to progress lights
- *    up every problem the validator found.
- *
- * 4. **Pre-submit timing gate.** Before the first submit attempt,
- *    show once the user has touched the field (sticky-true after the
- *    first blur) AND is not currently focused on it. The not-focused
- *    half hides transient errors while the user is actively editing
- *    the field; they reappear when the user blurs (or focuses a
- *    sibling). This deliberately includes blur-without-typing on a
- *    required field (touched flips on blur regardless of `dirty`), so
- *    a user who visits an empty required field and moves on sees the
- *    error.
- *
- * The framework already gates on `errors.length > 0` before invoking
- * the predicate, so the body only decides *when* to surface existing
- * errors, not whether errors exist.
+ * Library-default `getDisplayState` heuristic. Resolves every path's
+ * `field.displayState` — and thus `field.show*` and the `form.meta`
+ * rollups — whenever the consumer has not configured an override at the
+ * per-form or plugin level.
+ *
+ * One timing gate, then precedence:
+ *
+ * 1. **Timing gate.** `gateOpen` once the form has been submitted
+ *    (`submissionAttempts > 0`) OR the field has been edited and then
+ *    left (`blurredAfterInteraction === true`). Before the gate opens
+ *    the verdict is `'idle'` regardless of errors. This is the "reward
+ *    early, punish late" rule:
+ *      - A clean tab-through never engages. `blurredAfterInteraction`
+ *        only flips on a blur that follows an edit, so visiting a field
+ *        and moving on without editing it stays quiet until a submit
+ *        forces the issue, even if the field was tabbed through before.
+ *      - The first pass stays quiet. Editing alone (`interacted`) does
+ *        not open the gate; the error reveals only once the user
+ *        finishes that pass and leaves the field, never mid-entry.
+ *      - Recovery is live. The bit is sticky and carries no not-focused
+ *        term, so once a field has been revealed it stays open through a
+ *        re-focus: a shown error clears (or greens) the instant the
+ *        value becomes valid, without forcing another blur.
+ *
+ *    The submit arm covers `form.handleSubmit` directly and
+ *    `wizard.handleSubmit` (which bumps `submissionAttempts` on the
+ *    active form at intermediate steps and on every form at the final
+ *    step, lighting up the whole flow at once).
+ *
+ * 2. **Pending.** With the gate open, a per-field run in flight
+ *    (`validating === true`) wins: the verdict in `errors` is stale by
+ *    definition, so surface `'pending'` (a spinner) rather than a
+ *    possibly-wrong error or success. Containers roll `validating` up as
+ *    a disjunction, so any descendant under revalidation reads
+ *    `'pending'` at the container too.
+ *
+ * 3. **Error.** An own-path error (one whose path equals the field's own
+ *    path) resolves to `'error'`. The own-path filter means a container
+ *    never duplicates an error a more-specific descendant already
+ *    renders; aggregate banners bind to `form.meta.errorCount` instead.
+ *
+ * 4. **Success.** No error, `valid === true`, and the green check is
+ *    earned: the field is non-blank and `dirty` (its value diverges from
+ *    the hydration original). Gating success on `dirty && !blank` keeps
+ *    the check meaningful — an empty field that happens to pass, a
+ *    pre-filled field merely tabbed through, and the post-submit flood of
+ *    every valid field all stay `'idle'` rather than greening for free.
+ *    `valid` already gates async schemas on the form-wide first
+ *    validation pass, so success never fires before the first verdict
+ *    lands.
+ *
+ * 5. **Idle.** Anything else — gate open but not validating, no own-path
+ *    error, and either not yet `valid` or valid-but-unearned (blank or
+ *    unchanged) — stays `'idle'`.
  *
  * Public re-export so adopters can compose with this without
- * copy-pasting the rule body. A layered predicate that adds a special
- * case but otherwise defers to the library default picks up future
- * heuristic refinements automatically:
+ * copy-pasting the rule body — a layered predicate that special-cases a
+ * subtree but otherwise defers picks up future refinements
+ * automatically:
  *
  * ```ts
- * import { defaultShouldShowErrors } from 'attaform'
+ * import { defaultDisplayState } from 'attaform'
  *
  * useForm({
  *   schema,
- *   shouldShowErrors: (field, formMeta) =>
- *     field.path[0] === 'urgent' || defaultShouldShowErrors(field, formMeta),
+ *   getDisplayState: (field, formMeta) => {
+ *     const state = defaultDisplayState(field, formMeta)
+ *     return field.path[0] === 'username' && state === 'success' ? 'idle' : state
+ *   },
  * })
  * ```
  */
-declare const defaultShouldShowErrors: ShouldShowErrors;
+declare const defaultDisplayState: GetDisplayState;
 
 /**
  * The library's built-in conservative set of identifier name stems that
@@ -391,9 +358,9 @@ declare const defaultShouldShowErrors: ShouldShowErrors;
  * })
  * ```
  *
- * The same resolved predicate gates persistence writes, multi-tab sync
- * broadcasts, AND the DevTools redact walk — one source of truth for
- * "what counts as sensitive" across every surface.
+ * The same resolved predicate gates persistence writes and multi-tab
+ * sync broadcasts — one source of truth for "what counts as sensitive"
+ * across those surfaces. (DevTools renders raw values by design.)
  *
  * **Non-goals.** This is not a soundness guarantee. Adversarial paths
  * (`'sensitive_data'`, `'CCV'` instead of `'CVV'`) can slip through.
@@ -529,5 +496,5 @@ declare const PARSE_API_ERRORS_DEFAULTS: {
  */
 declare function parseApiErrors(payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown, options: ParseApiErrorsOptions): ParseApiErrorsResult;
 
-export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, PARSE_API_ERRORS_DEFAULTS, REDACTED, RegisterValue, Segment, SerializedFormData, ShouldShowErrors, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultShouldShowErrors, escapeForInlineScript, hydrateAttaformState, isRegisterValue, parseApiErrors, redactSensitiveLeaves, renderAttaformState, useAbstractForm as useForm, vRegister };
+export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
 export type { AttaformDevtoolsBridge, AttaformPluginOptions, ParseApiErrorsOptions, ParseApiErrorsResult, SerializedAttaformState };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { i as canonicalizePath, I as InvalidPathError } from './shared/attaform.CDmaxrt2.mjs';
-export { A as AnonPersistError, a as AttaformError, D as DEFAULT_SENSITIVE_NAMES, c as InvalidUseFormConfigError, O as OutsideSetupError, R as ROOT_PATH, d as ROOT_PATH_KEY, e as RegistryNotInstalledError, f as ReservedFormKeyError, S as SensitivePersistFieldError, g as SubmitErrorHandlerError, h as assignKey, l as createAttaform, o as createRegistry, s as getRegistryFromApp, t as isPathPrefix, u as isRegisterValue, x as kAttaformRegistry, C as parseDottedPath, J as useRegister, K as useRegistry, L as vRegister } from './shared/attaform.CDmaxrt2.mjs';
-export { D as DEVTOOLS_WINDOW_KEY, R as REDACTED, h as hydrateAttaformState, r as redactSensitiveLeaves, a as renderAttaformState } from './shared/attaform.Dl161U6E.mjs';
-import { n as normalizeNumericOption } from './shared/attaform.CZ-XtZt_.mjs';
-export { A as AttaformErrorCode, d as defaultCoercionRules, a as defaultShouldShowErrors, b as defineCoercion, i as injectForm, c as injectWizard, f as isUnset, l as lazy, u as unset, k as useForm, m as useWizard } from './shared/attaform.CZ-XtZt_.mjs';
+import { j as canonicalizePath, c as InvalidPathError } from './shared/attaform.BKozEdTr.mjs';
+export { A as AnonPersistError, a as AttaformError, D as DEFAULT_SENSITIVE_NAMES, d as InvalidUseFormConfigError, O as OutsideSetupError, R as ROOT_PATH, e as ROOT_PATH_KEY, f as RegistryNotInstalledError, g as ReservedFormKeyError, S as SubmitErrorHandlerError, i as assignKey, m as createAttaform, p as createRegistry, r as getRegistryFromApp, s as isPathPrefix, t as isRegisterValue, w as kAttaformRegistry, B as parseDottedPath, G as useRegister, H as useRegistry, J as vRegister } from './shared/attaform.BKozEdTr.mjs';
+export { D as DEVTOOLS_WINDOW_KEY, h as hydrateAttaformState, r as renderAttaformState } from './shared/attaform.EZG6fOFb.mjs';
+import { n as normalizeNumericOption } from './shared/attaform.CKFbKFb6.mjs';
+export { A as AttaformErrorCode, d as defaultCoercionRules, a as defaultDisplayState, b as defineCoercion, i as injectForm, c as injectWizard, f as isUnset, l as lazy, u as unset, k as useForm, m as useWizard } from './shared/attaform.CKFbKFb6.mjs';
 
 function escapeForInlineScript(json) {
   return json.replace(/[<>&\u2028\u2029]/g, (char) => {

package/dist/nuxt.d.cts

@@ -1,5 +1,5 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { f as AttaformDefaults } from './shared/attaform.Ca5_6Ky-.cjs';
+import { f as AttaformDefaults } from './shared/attaform.SfhU0OEY.cjs';
 import 'vue';
 
 /**

package/dist/nuxt.d.mts

@@ -1,5 +1,5 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { f as AttaformDefaults } from './shared/attaform.Ca5_6Ky-.mjs';
+import { f as AttaformDefaults } from './shared/attaform.SfhU0OEY.mjs';
 import 'vue';
 
 /**

package/dist/nuxt.d.ts

@@ -1,5 +1,5 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { f as AttaformDefaults } from './shared/attaform.Ca5_6Ky-.js';
+import { f as AttaformDefaults } from './shared/attaform.SfhU0OEY.js';
 import 'vue';
 
 /**

package/dist/runtime/components/AttaformDevtoolsPanel.vue

@@ -58,7 +58,7 @@ function humanizePathKey(key) {
   try {
     const parsed = JSON.parse(key);
     if (Array.isArray(parsed)) {
-      return parsed.map((seg) => typeof seg === "number" ? String(seg) : String(seg)).join(".");
+      return parsed.map((seg) => String(seg)).join(".");
     }
   } catch {
   }
@@ -449,5 +449,5 @@ onUnmounted(() => {
 </template>
 
 <style scoped>
-.atf-panel{--atf-bg:#0f172a;--atf-bg-elev:#111c33;--atf-fg:#e2e8f0;--atf-fg-muted:#94a3b8;--atf-border:rgba(148,163,184,.12);--atf-border-strong:rgba(148,163,184,.2);--atf-accent:#5b8def;--atf-key:#93c5fd;--atf-string:#86efac;--atf-number:#fbbf24;--atf-boolean:#f472b6;--atf-redacted:#f87171;--atf-muted:#64748b;--atf-row-hover:hsla(0,0%,100%,.04);--atf-error-bg:rgba(248,113,113,.1);--atf-warn-bg:rgba(251,191,36,.1);background:var(--atf-bg);color:var(--atf-fg);display:flex;flex-direction:column;font-family:system-ui,-apple-system,Segoe UI,sans-serif;font-size:13px;height:100vh;line-height:1.5}@media (prefers-color-scheme:light){.atf-panel{--atf-bg:#fff;--atf-bg-elev:#f8fafc;--atf-fg:#0f172a;--atf-fg-muted:#64748b;--atf-border:rgba(15,23,42,.08);--atf-border-strong:rgba(15,23,42,.16);--atf-key:#2563eb;--atf-string:#16a34a;--atf-number:#d97706;--atf-boolean:#db2777;--atf-redacted:#dc2626;--atf-muted:#94a3b8;--atf-row-hover:rgba(15,23,42,.04);--atf-error-bg:rgba(220,38,38,.08);--atf-warn-bg:rgba(217,119,6,.08)}}.atf-header{background:var(--atf-bg-elev);border-bottom:1px solid var(--atf-border);flex:0 0 auto;padding:.75rem 1rem}.atf-brand{align-items:center;display:flex;gap:.5rem}.atf-logo{display:block;height:22px;width:22px}.atf-title{font-size:14px;font-weight:600}.atf-version{color:var(--atf-fg-muted);font-family:ui-monospace,monospace;font-size:11px}.atf-body{display:grid;flex:1 1 auto;grid-template-columns:200px 1fr;min-height:0}.atf-sidebar{border-right:1px solid var(--atf-border);overflow-y:auto;padding:.75rem 0}.atf-sidebar-title{align-items:center;color:var(--atf-fg-muted);display:flex;font-size:11px;gap:.4em;letter-spacing:.05em;padding:0 1rem .5rem;text-transform:uppercase}.atf-count{background:var(--atf-border-strong);border-radius:999px;color:var(--atf-fg);font-size:10px;padding:0 .4em}.atf-empty{color:var(--atf-fg-muted);list-style:none;margin:0;padding:0 1rem}.atf-empty small{display:block;font-size:11px;margin-top:.4rem}.atf-empty code{background:var(--atf-border);border-radius:3px;font-size:11px;padding:.05em .35em}.atf-form-list{list-style:none;margin:0;padding:0}.atf-form-item{cursor:pointer;font-family:ui-monospace,monospace;font-size:12px;padding:.4rem 1rem;-webkit-user-select:none;-moz-user-select:none;user-select:none}.atf-form-item:hover{background:var(--atf-row-hover)}.atf-form-item.active{background:rgba(91,141,239,.12);border-left:2px solid var(--atf-accent);color:var(--atf-key);padding-left:calc(1rem - 2px)}.atf-detail{overflow-y:auto;padding:1rem 1.25rem}.atf-empty-detail{color:var(--atf-fg-muted);padding:3rem 0;text-align:center}.atf-section{margin-bottom:1.25rem}.atf-section-title{align-items:center;color:var(--atf-fg-muted);display:flex;font-size:11px;font-weight:600;gap:.5em;letter-spacing:.06em;margin:0 0 .5rem;text-transform:uppercase}.atf-section-body{background:var(--atf-bg-elev);border:1px solid var(--atf-border);border-radius:6px;padding:.6rem .8rem}.atf-badge{border-radius:999px;font-size:10px;font-weight:600;letter-spacing:.04em;padding:0 .45em}.atf-badge-error{background:var(--atf-error-bg);color:var(--atf-redacted)}.atf-badge-warn{background:var(--atf-warn-bg);color:var(--atf-number)}.atf-empty-list{color:var(--atf-fg-muted);font-size:12px;margin:0}.atf-error-list{list-style:none;margin:0;padding:0}.atf-error-list>li+li{border-top:1px solid var(--atf-border);margin-top:.6rem;padding-top:.6rem}.atf-path{color:var(--atf-key);display:block;font-family:ui-monospace,monospace;font-size:12px;margin-bottom:.25rem}.atf-error-messages{color:var(--atf-redacted);font-size:12px;list-style:none;margin:0;padding:0}.atf-error-messages>li+li{margin-top:.2rem}.atf-aggregates{display:grid;font-family:ui-monospace,monospace;font-size:12px;gap:.35rem .75rem;grid-template-columns:max-content 1fr;margin:0}.atf-aggregates dt{color:var(--atf-key)}.atf-aggregates dd{color:var(--atf-fg);margin:0}.atf-badge-neutral{background:var(--atf-border-strong);color:var(--atf-fg)}.atf-clear-btn{background:transparent;border:1px solid var(--atf-border);border-radius:4px;cursor:pointer;font:inherit;font-size:11px;padding:.1rem .5rem}.atf-clear-btn,.atf-section-hint{color:var(--atf-fg-muted);margin-left:auto}.atf-section-hint{font-size:10px;font-weight:400;letter-spacing:0;text-transform:none}.atf-fg-muted{color:var(--atf-fg-muted)}.atf-clear-btn:hover{border-color:var(--atf-border-strong);color:var(--atf-fg)}.atf-timeline{list-style:none;margin:0;max-height:18rem;overflow-y:auto;padding:0}.atf-timeline-entry{border-top:1px solid var(--atf-border)}.atf-timeline-entry:first-child{border-top:0}.atf-timeline-row{align-items:baseline;cursor:pointer;display:grid;font-family:ui-monospace,monospace;font-size:11px;gap:.6rem;grid-template-columns:7.5rem 8rem 1fr auto;padding:.4rem 0}.atf-timeline-row:hover{background:var(--atf-row-hover)}.atf-timeline-time{color:var(--atf-fg-muted)}.atf-timeline-type{color:var(--atf-key);font-weight:600}.atf-timeline-form{color:var(--atf-fg);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.atf-timeline-caret{color:var(--atf-fg-muted);text-align:center;width:1em}.atf-timeline-entry.atf-timeline-submit .atf-timeline-type{color:var(--atf-string)}.atf-timeline-entry.atf-timeline-reset .atf-timeline-type{color:var(--atf-redacted)}.atf-timeline-detail{border-top:1px dashed var(--atf-border);margin-top:-1px;padding:.4rem 0 .6rem 7.5rem}
+.atf-panel{--atf-bg:#0f172a;--atf-bg-elev:#111c33;--atf-fg:#e2e8f0;--atf-fg-muted:#94a3b8;--atf-border:rgba(148,163,184,.12);--atf-border-strong:rgba(148,163,184,.2);--atf-accent:#5b8def;--atf-key:#93c5fd;--atf-string:#86efac;--atf-number:#fbbf24;--atf-boolean:#f472b6;--atf-danger:#f87171;--atf-muted:#64748b;--atf-row-hover:hsla(0,0%,100%,.04);--atf-error-bg:rgba(248,113,113,.1);--atf-warn-bg:rgba(251,191,36,.1);background:var(--atf-bg);color:var(--atf-fg);display:flex;flex-direction:column;font-family:system-ui,-apple-system,Segoe UI,sans-serif;font-size:13px;height:100vh;line-height:1.5}@media (prefers-color-scheme:light){.atf-panel{--atf-bg:#fff;--atf-bg-elev:#f8fafc;--atf-fg:#0f172a;--atf-fg-muted:#64748b;--atf-border:rgba(15,23,42,.08);--atf-border-strong:rgba(15,23,42,.16);--atf-key:#2563eb;--atf-string:#16a34a;--atf-number:#d97706;--atf-boolean:#db2777;--atf-danger:#dc2626;--atf-muted:#94a3b8;--atf-row-hover:rgba(15,23,42,.04);--atf-error-bg:rgba(220,38,38,.08);--atf-warn-bg:rgba(217,119,6,.08)}}.atf-header{background:var(--atf-bg-elev);border-bottom:1px solid var(--atf-border);flex:0 0 auto;padding:.75rem 1rem}.atf-brand{align-items:center;display:flex;gap:.5rem}.atf-logo{display:block;height:22px;width:22px}.atf-title{font-size:14px;font-weight:600}.atf-version{color:var(--atf-fg-muted);font-family:ui-monospace,monospace;font-size:11px}.atf-body{display:grid;flex:1 1 auto;grid-template-columns:200px 1fr;min-height:0}.atf-sidebar{border-right:1px solid var(--atf-border);overflow-y:auto;padding:.75rem 0}.atf-sidebar-title{align-items:center;color:var(--atf-fg-muted);display:flex;font-size:11px;gap:.4em;letter-spacing:.05em;padding:0 1rem .5rem;text-transform:uppercase}.atf-count{background:var(--atf-border-strong);border-radius:999px;color:var(--atf-fg);font-size:10px;padding:0 .4em}.atf-empty{color:var(--atf-fg-muted);list-style:none;margin:0;padding:0 1rem}.atf-empty small{display:block;font-size:11px;margin-top:.4rem}.atf-empty code{background:var(--atf-border);border-radius:3px;font-size:11px;padding:.05em .35em}.atf-form-list{list-style:none;margin:0;padding:0}.atf-form-item{cursor:pointer;font-family:ui-monospace,monospace;font-size:12px;padding:.4rem 1rem;-webkit-user-select:none;-moz-user-select:none;user-select:none}.atf-form-item:hover{background:var(--atf-row-hover)}.atf-form-item.active{background:rgba(91,141,239,.12);border-left:2px solid var(--atf-accent);color:var(--atf-key);padding-left:calc(1rem - 2px)}.atf-detail{overflow-y:auto;padding:1rem 1.25rem}.atf-empty-detail{color:var(--atf-fg-muted);padding:3rem 0;text-align:center}.atf-section{margin-bottom:1.25rem}.atf-section-title{align-items:center;color:var(--atf-fg-muted);display:flex;font-size:11px;font-weight:600;gap:.5em;letter-spacing:.06em;margin:0 0 .5rem;text-transform:uppercase}.atf-section-body{background:var(--atf-bg-elev);border:1px solid var(--atf-border);border-radius:6px;padding:.6rem .8rem}.atf-badge{border-radius:999px;font-size:10px;font-weight:600;letter-spacing:.04em;padding:0 .45em}.atf-badge-error{background:var(--atf-error-bg);color:var(--atf-danger)}.atf-badge-warn{background:var(--atf-warn-bg);color:var(--atf-number)}.atf-empty-list{color:var(--atf-fg-muted);font-size:12px;margin:0}.atf-error-list{list-style:none;margin:0;padding:0}.atf-error-list>li+li{border-top:1px solid var(--atf-border);margin-top:.6rem;padding-top:.6rem}.atf-path{color:var(--atf-key);display:block;font-family:ui-monospace,monospace;font-size:12px;margin-bottom:.25rem}.atf-error-messages{color:var(--atf-danger);font-size:12px;list-style:none;margin:0;padding:0}.atf-error-messages>li+li{margin-top:.2rem}.atf-aggregates{display:grid;font-family:ui-monospace,monospace;font-size:12px;gap:.35rem .75rem;grid-template-columns:max-content 1fr;margin:0}.atf-aggregates dt{color:var(--atf-key)}.atf-aggregates dd{color:var(--atf-fg);margin:0}.atf-badge-neutral{background:var(--atf-border-strong);color:var(--atf-fg)}.atf-clear-btn{background:transparent;border:1px solid var(--atf-border);border-radius:4px;cursor:pointer;font:inherit;font-size:11px;padding:.1rem .5rem}.atf-clear-btn,.atf-section-hint{color:var(--atf-fg-muted);margin-left:auto}.atf-section-hint{font-size:10px;font-weight:400;letter-spacing:0;text-transform:none}.atf-fg-muted{color:var(--atf-fg-muted)}.atf-clear-btn:hover{border-color:var(--atf-border-strong);color:var(--atf-fg)}.atf-timeline{list-style:none;margin:0;max-height:18rem;overflow-y:auto;padding:0}.atf-timeline-entry{border-top:1px solid var(--atf-border)}.atf-timeline-entry:first-child{border-top:0}.atf-timeline-row{align-items:baseline;cursor:pointer;display:grid;font-family:ui-monospace,monospace;font-size:11px;gap:.6rem;grid-template-columns:7.5rem 8rem 1fr auto;padding:.4rem 0}.atf-timeline-row:hover{background:var(--atf-row-hover)}.atf-timeline-time{color:var(--atf-fg-muted)}.atf-timeline-type{color:var(--atf-key);font-weight:600}.atf-timeline-form{color:var(--atf-fg);overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.atf-timeline-caret{color:var(--atf-fg-muted);text-align:center;width:1em}.atf-timeline-entry.atf-timeline-submit .atf-timeline-type{color:var(--atf-string)}.atf-timeline-entry.atf-timeline-reset .atf-timeline-type{color:var(--atf-danger)}.atf-timeline-detail{border-top:1px dashed var(--atf-border);margin-top:-1px;padding:.4rem 0 .6rem 7.5rem}
 </style>

package/dist/runtime/components/DevtoolsValueTree.d.vue.ts

@@ -11,9 +11,7 @@ type __VLS_Props = {
     path?: ReadonlyArray<string | number>;
     /**
      * Edit-mode toggle. When `true` and `onEdit` is wired, leaf cells
-     * become click-to-edit. Sensitive (redacted) leaves stay read-only
-     * regardless — overwriting with the literal `[redacted]` string
-     * would destroy the real value.
+     * become click-to-edit. Values render raw (DevTools does not redact).
      */
     editable?: boolean | undefined;
     onEdit?: ((path: ReadonlyArray<string | number>, next: unknown) => void) | undefined;

package/dist/runtime/components/DevtoolsValueTree.vue.d.ts

@@ -11,9 +11,7 @@ type __VLS_Props = {
     path?: ReadonlyArray<string | number>;
     /**
      * Edit-mode toggle. When `true` and `onEdit` is wired, leaf cells
-     * become click-to-edit. Sensitive (redacted) leaves stay read-only
-     * regardless — overwriting with the literal `[redacted]` string
-     * would destroy the real value.
+     * become click-to-edit. Values render raw (DevTools does not redact).
      */
     editable?: boolean | undefined;
     onEdit?: ((path: ReadonlyArray<string | number>, next: unknown) => void) | undefined;