attaform 0.21.2 → 0.23.0

package/dist/index.d.cts

@@ -1,9 +1,9 @@
 import { Plugin, App } from 'vue';
-import { S as SSRDetectOptions, a as SerializedFormData, A as AttaformRegistry } from './shared/attaform.BkjJfMvJ.cjs';
-export { b as AnyForm, c as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.BkjJfMvJ.cjs';
-import { A as AttaformDefaults, F as FormKey, G as GenericForm, U as UseFormConfiguration, a as AbstractSchema, D as DefaultValuesInput, b as UseFormReturnType, R as RegisterModelDynamicCustomDirective, c as RegisterValue, d as GetDisplayState, V as ValidationError, e as ApiErrorEnvelope, f as ApiErrorDetails } from './shared/attaform.ory-3WhV.cjs';
-export { g as ApiErrorEntry, h as ArrayItem, i as ArrayPath, C as CoercionEntry, j as CoercionRegistry, k as CoercionResult, l as CustomDirectiveRegisterAssignerFn, m as DeepPartial, n as DefaultValuesResponse, o as DefaultValuesShape, p as DisplayCtx, q as DisplayMachine, r as DisplayState, E as ErrorsProxyShape, s as FieldMetaPayload, t as FieldState, u as FieldStateMap, v as FieldStateMapEntry, w as FlatPath, x as FormErrorRecord, y as FormErrorsSurface, z as FormMeta, B as FormStorage, H as FormStorageKind, I as HandleSubmit, J as HistoryConfig, K as IsTuple, L as IsUnion, M as JoinSegments, N as KeyofUnion, O as LiftedValueShape, P as MetaTrackerValue, Q as NestedReadType, S as NestedType, T as OnError, W as OnInvalidSubmitPolicy, X as OnSubmit, Y as PartialFlatPath, Z as Path, _ as PathKey, $ as PendingValidationStatus, a0 as PersistConfig, a1 as PersistConfigOptions, a2 as PersistIncludeMode, a3 as Primitive, a4 as ROOT_PATH, a5 as ROOT_PATH_KEY, a6 as ReactiveValidationStatus, a7 as RegisterDirective, a8 as RegisterFlatPath, a9 as RegisterOptions, aa as RegisterSelectModifier, ab as RegisterTextModifier, ac as RegisterTransform, ad as Segment, ae as SetValueCallback, af as SetValuePayload, ag as SettledValidationStatus, ah as SlimPrimitiveKind, ai as SlimRuntimeOf, aj as SubmitHandler, ak as Unset, al as ValidateOn, am as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.ory-3WhV.cjs';
-export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.DkA5J8NW.cjs';
+import { S as SSRDetectOptions, a as SerializedFormData, A as AttaformRegistry } from './shared/attaform.DuPneYR0.cjs';
+export { b as AnyForm, c as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.DuPneYR0.cjs';
+import { A as AttaformDefaults, F as FormKey, G as GenericForm, U as UseFormConfiguration, a as AbstractSchema, D as DefaultValuesInput, b as UseFormReturnType, R as RegisterModelDynamicCustomDirective, c as RegisterValue, d as GetDisplayState, V as ValidationError, e as ApiErrorEnvelope, f as ApiErrorDetails } from './shared/attaform.BJnNK75Y.cjs';
+export { g as ApiErrorEntry, h as ArrayItem, i as ArrayPath, C as CoercionEntry, j as CoercionRegistry, k as CoercionResult, l as CustomDirectiveRegisterAssignerFn, m as DeepPartial, n as DefaultValuesResponse, o as DefaultValuesShape, p as DisplayCtx, q as DisplayMachine, r as DisplayState, E as ErrorsProxyShape, s as FieldMetaPayload, t as FieldState, u as FieldStateMap, v as FieldStateMapEntry, w as FlatPath, x as FormErrorRecord, y as FormErrorsSurface, z as FormMeta, H as HandleSubmit, B as HistoryConfig, I as IsTuple, J as IsUnion, K as JoinSegments, L as KeyofUnion, M as LiftedValueShape, N as MetaTrackerValue, O as NestedReadType, P as NestedType, Q as OnError, S as OnInvalidSubmitPolicy, T as OnSubmit, W as PartialFlatPath, X as Path, Y as PathKey, Z as PendingValidationStatus, _ as Primitive, $ as ROOT_PATH, a0 as ROOT_PATH_KEY, a1 as ReactiveValidationStatus, a2 as RegisterDirective, a3 as RegisterFlatPath, a4 as RegisterOptions, a5 as RegisterSelectModifier, a6 as RegisterTextModifier, a7 as RegisterTransform, a8 as Segment, a9 as SetValueCallback, aa as SetValuePayload, ab as SettledValidationStatus, ac as SlimPrimitiveKind, ad as SlimRuntimeOf, ae as SubmitHandler, af as Unset, ag as ValidateOn, ah as ValidateOnConfig, ai as ValidationResponse, aj as ValidationResponseWithoutValue, ak as ValueOfUnion, al as WriteMeta, am as WriteShape, an as canonicalizePath, ao as isPathPrefix, ap as isUnset, aq as parseDottedPath, ar as unset } from './shared/attaform.BJnNK75Y.cjs';
+export { A as AttaformError, I as InvalidPathError, a as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, b as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.CO0e7YVY.cjs';
 
 /**
  * Options for `createAttaform()`.
@@ -333,41 +333,6 @@ declare function makeDefaultDisplayState({ showDelay, minVisible, }: DisplayTimi
  */
 declare const defaultDisplayState: GetDisplayState;
 
-/**
- * The library's built-in conservative set of identifier name stems that
- * flag a path segment as "this looks like data the consumer almost
- * certainly does not want serialised to client-side storage or
- * broadcast across tabs."
- *
- * Each entry is a NAME STEM, not a regex. Matching is case-insensitive
- * and tolerant of separator variants — `'card_number'` matches the
- * segments `'card_number'`, `'card-number'`, `'cardNumber'`, and
- * `'cardnumber'`. Short stems (compact length ≤ 5) get word-boundary
- * anchors to avoid common false positives — `'pin'` matches `'pin'`
- * and `'user_pin'` but not `'pinned'`; `'token'` matches `'token'` but
- * not `'tokenizer'`. Longer stems match anywhere (`'password'` matches
- * `'password'`, `'passwords'`, `'userPassword'`).
- *
- * Consumers extend or replace via per-form or global config:
- *
- * ```ts
- * createAttaform({
- *   defaults: { sensitiveNames: [...DEFAULT_SENSITIVE_NAMES, 'mrn', 'tax_id'] }
- * })
- * ```
- *
- * The same resolved predicate gates persistence writes and multi-tab
- * sync broadcasts — one source of truth for "what counts as sensitive"
- * across those surfaces. (DevTools renders raw values by design.)
- *
- * **Non-goals.** This is not a soundness guarantee. Adversarial paths
- * (`'sensitive_data'`, `'CCV'` instead of `'CVV'`) can slip through.
- * The intent is a code-review trigger for the common-case footgun
- * plus a defense-in-depth filter on the cross-tab and DevTools
- * surfaces.
- */
-declare const DEFAULT_SENSITIVE_NAMES: readonly string[];
-
 /**
  * Result of `parseApiErrors`. Branch on `ok` to handle the two cases:
  *
@@ -494,5 +459,5 @@ declare const PARSE_API_ERRORS_DEFAULTS: {
  */
 declare function parseApiErrors(payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown, options: ParseApiErrorsOptions): ParseApiErrorsResult;
 
-export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEFAULT_TIMINGS, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, makeDefaultDisplayState, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
+export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_TIMINGS, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, makeDefaultDisplayState, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
 export type { AttaformDevtoolsBridge, AttaformPluginOptions, DisplayTimings, ParseApiErrorsOptions, ParseApiErrorsResult, SerializedAttaformState };

package/dist/index.d.mts

@@ -1,9 +1,9 @@
 import { Plugin, App } from 'vue';
-import { S as SSRDetectOptions, a as SerializedFormData, A as AttaformRegistry } from './shared/attaform.BCcrLApm.mjs';
-export { b as AnyForm, c as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.BCcrLApm.mjs';
-import { A as AttaformDefaults, F as FormKey, G as GenericForm, U as UseFormConfiguration, a as AbstractSchema, D as DefaultValuesInput, b as UseFormReturnType, R as RegisterModelDynamicCustomDirective, c as RegisterValue, d as GetDisplayState, V as ValidationError, e as ApiErrorEnvelope, f as ApiErrorDetails } from './shared/attaform.ory-3WhV.mjs';
-export { g as ApiErrorEntry, h as ArrayItem, i as ArrayPath, C as CoercionEntry, j as CoercionRegistry, k as CoercionResult, l as CustomDirectiveRegisterAssignerFn, m as DeepPartial, n as DefaultValuesResponse, o as DefaultValuesShape, p as DisplayCtx, q as DisplayMachine, r as DisplayState, E as ErrorsProxyShape, s as FieldMetaPayload, t as FieldState, u as FieldStateMap, v as FieldStateMapEntry, w as FlatPath, x as FormErrorRecord, y as FormErrorsSurface, z as FormMeta, B as FormStorage, H as FormStorageKind, I as HandleSubmit, J as HistoryConfig, K as IsTuple, L as IsUnion, M as JoinSegments, N as KeyofUnion, O as LiftedValueShape, P as MetaTrackerValue, Q as NestedReadType, S as NestedType, T as OnError, W as OnInvalidSubmitPolicy, X as OnSubmit, Y as PartialFlatPath, Z as Path, _ as PathKey, $ as PendingValidationStatus, a0 as PersistConfig, a1 as PersistConfigOptions, a2 as PersistIncludeMode, a3 as Primitive, a4 as ROOT_PATH, a5 as ROOT_PATH_KEY, a6 as ReactiveValidationStatus, a7 as RegisterDirective, a8 as RegisterFlatPath, a9 as RegisterOptions, aa as RegisterSelectModifier, ab as RegisterTextModifier, ac as RegisterTransform, ad as Segment, ae as SetValueCallback, af as SetValuePayload, ag as SettledValidationStatus, ah as SlimPrimitiveKind, ai as SlimRuntimeOf, aj as SubmitHandler, ak as Unset, al as ValidateOn, am as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.ory-3WhV.mjs';
-export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.DkA5J8NW.mjs';
+import { S as SSRDetectOptions, a as SerializedFormData, A as AttaformRegistry } from './shared/attaform.DrY8srOp.mjs';
+export { b as AnyForm, c as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.DrY8srOp.mjs';
+import { A as AttaformDefaults, F as FormKey, G as GenericForm, U as UseFormConfiguration, a as AbstractSchema, D as DefaultValuesInput, b as UseFormReturnType, R as RegisterModelDynamicCustomDirective, c as RegisterValue, d as GetDisplayState, V as ValidationError, e as ApiErrorEnvelope, f as ApiErrorDetails } from './shared/attaform.BJnNK75Y.mjs';
+export { g as ApiErrorEntry, h as ArrayItem, i as ArrayPath, C as CoercionEntry, j as CoercionRegistry, k as CoercionResult, l as CustomDirectiveRegisterAssignerFn, m as DeepPartial, n as DefaultValuesResponse, o as DefaultValuesShape, p as DisplayCtx, q as DisplayMachine, r as DisplayState, E as ErrorsProxyShape, s as FieldMetaPayload, t as FieldState, u as FieldStateMap, v as FieldStateMapEntry, w as FlatPath, x as FormErrorRecord, y as FormErrorsSurface, z as FormMeta, H as HandleSubmit, B as HistoryConfig, I as IsTuple, J as IsUnion, K as JoinSegments, L as KeyofUnion, M as LiftedValueShape, N as MetaTrackerValue, O as NestedReadType, P as NestedType, Q as OnError, S as OnInvalidSubmitPolicy, T as OnSubmit, W as PartialFlatPath, X as Path, Y as PathKey, Z as PendingValidationStatus, _ as Primitive, $ as ROOT_PATH, a0 as ROOT_PATH_KEY, a1 as ReactiveValidationStatus, a2 as RegisterDirective, a3 as RegisterFlatPath, a4 as RegisterOptions, a5 as RegisterSelectModifier, a6 as RegisterTextModifier, a7 as RegisterTransform, a8 as Segment, a9 as SetValueCallback, aa as SetValuePayload, ab as SettledValidationStatus, ac as SlimPrimitiveKind, ad as SlimRuntimeOf, ae as SubmitHandler, af as Unset, ag as ValidateOn, ah as ValidateOnConfig, ai as ValidationResponse, aj as ValidationResponseWithoutValue, ak as ValueOfUnion, al as WriteMeta, am as WriteShape, an as canonicalizePath, ao as isPathPrefix, ap as isUnset, aq as parseDottedPath, ar as unset } from './shared/attaform.BJnNK75Y.mjs';
+export { A as AttaformError, I as InvalidPathError, a as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, b as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.CO0e7YVY.mjs';
 
 /**
  * Options for `createAttaform()`.
@@ -333,41 +333,6 @@ declare function makeDefaultDisplayState({ showDelay, minVisible, }: DisplayTimi
  */
 declare const defaultDisplayState: GetDisplayState;
 
-/**
- * The library's built-in conservative set of identifier name stems that
- * flag a path segment as "this looks like data the consumer almost
- * certainly does not want serialised to client-side storage or
- * broadcast across tabs."
- *
- * Each entry is a NAME STEM, not a regex. Matching is case-insensitive
- * and tolerant of separator variants — `'card_number'` matches the
- * segments `'card_number'`, `'card-number'`, `'cardNumber'`, and
- * `'cardnumber'`. Short stems (compact length ≤ 5) get word-boundary
- * anchors to avoid common false positives — `'pin'` matches `'pin'`
- * and `'user_pin'` but not `'pinned'`; `'token'` matches `'token'` but
- * not `'tokenizer'`. Longer stems match anywhere (`'password'` matches
- * `'password'`, `'passwords'`, `'userPassword'`).
- *
- * Consumers extend or replace via per-form or global config:
- *
- * ```ts
- * createAttaform({
- *   defaults: { sensitiveNames: [...DEFAULT_SENSITIVE_NAMES, 'mrn', 'tax_id'] }
- * })
- * ```
- *
- * The same resolved predicate gates persistence writes and multi-tab
- * sync broadcasts — one source of truth for "what counts as sensitive"
- * across those surfaces. (DevTools renders raw values by design.)
- *
- * **Non-goals.** This is not a soundness guarantee. Adversarial paths
- * (`'sensitive_data'`, `'CCV'` instead of `'CVV'`) can slip through.
- * The intent is a code-review trigger for the common-case footgun
- * plus a defense-in-depth filter on the cross-tab and DevTools
- * surfaces.
- */
-declare const DEFAULT_SENSITIVE_NAMES: readonly string[];
-
 /**
  * Result of `parseApiErrors`. Branch on `ok` to handle the two cases:
  *
@@ -494,5 +459,5 @@ declare const PARSE_API_ERRORS_DEFAULTS: {
  */
 declare function parseApiErrors(payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown, options: ParseApiErrorsOptions): ParseApiErrorsResult;
 
-export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEFAULT_TIMINGS, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, makeDefaultDisplayState, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
+export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_TIMINGS, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, makeDefaultDisplayState, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
 export type { AttaformDevtoolsBridge, AttaformPluginOptions, DisplayTimings, ParseApiErrorsOptions, ParseApiErrorsResult, SerializedAttaformState };

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 import { Plugin, App } from 'vue';
-import { S as SSRDetectOptions, a as SerializedFormData, A as AttaformRegistry } from './shared/attaform.BGf_J22U.js';
-export { b as AnyForm, c as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.BGf_J22U.js';
-import { A as AttaformDefaults, F as FormKey, G as GenericForm, U as UseFormConfiguration, a as AbstractSchema, D as DefaultValuesInput, b as UseFormReturnType, R as RegisterModelDynamicCustomDirective, c as RegisterValue, d as GetDisplayState, V as ValidationError, e as ApiErrorEnvelope, f as ApiErrorDetails } from './shared/attaform.ory-3WhV.js';
-export { g as ApiErrorEntry, h as ArrayItem, i as ArrayPath, C as CoercionEntry, j as CoercionRegistry, k as CoercionResult, l as CustomDirectiveRegisterAssignerFn, m as DeepPartial, n as DefaultValuesResponse, o as DefaultValuesShape, p as DisplayCtx, q as DisplayMachine, r as DisplayState, E as ErrorsProxyShape, s as FieldMetaPayload, t as FieldState, u as FieldStateMap, v as FieldStateMapEntry, w as FlatPath, x as FormErrorRecord, y as FormErrorsSurface, z as FormMeta, B as FormStorage, H as FormStorageKind, I as HandleSubmit, J as HistoryConfig, K as IsTuple, L as IsUnion, M as JoinSegments, N as KeyofUnion, O as LiftedValueShape, P as MetaTrackerValue, Q as NestedReadType, S as NestedType, T as OnError, W as OnInvalidSubmitPolicy, X as OnSubmit, Y as PartialFlatPath, Z as Path, _ as PathKey, $ as PendingValidationStatus, a0 as PersistConfig, a1 as PersistConfigOptions, a2 as PersistIncludeMode, a3 as Primitive, a4 as ROOT_PATH, a5 as ROOT_PATH_KEY, a6 as ReactiveValidationStatus, a7 as RegisterDirective, a8 as RegisterFlatPath, a9 as RegisterOptions, aa as RegisterSelectModifier, ab as RegisterTextModifier, ac as RegisterTransform, ad as Segment, ae as SetValueCallback, af as SetValuePayload, ag as SettledValidationStatus, ah as SlimPrimitiveKind, ai as SlimRuntimeOf, aj as SubmitHandler, ak as Unset, al as ValidateOn, am as ValidateOnConfig, an as ValidationResponse, ao as ValidationResponseWithoutValue, ap as ValueOfUnion, aq as WriteMeta, ar as WriteShape, as as canonicalizePath, at as isPathPrefix, au as isUnset, av as parseDottedPath, aw as unset } from './shared/attaform.ory-3WhV.js';
-export { A as AnonPersistError, a as AttaformError, I as InvalidPathError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, c as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.DkA5J8NW.js';
+import { S as SSRDetectOptions, a as SerializedFormData, A as AttaformRegistry } from './shared/attaform.BGMRvckW.js';
+export { b as AnyForm, c as AttaformErrorCode, C as CompiledStep, F as FormStatus, I as InjectWizardInput, L as LazyMarker, d as StepSlot, U as UseRegisterReturn, e as UseWizardReturnType, W as WizardAggregateError, f as WizardCtx, g as WizardCtxForm, h as WizardOnError, i as WizardOnSubmit, j as WizardOptions, k as WizardPersistFn, l as WizardRestoreFn, m as WizardRestoreState, n as WizardStatusesProxy, o as WizardSubmitContext, p as createRegistry, q as defaultCoercionRules, r as defineCoercion, s as getRegistryFromApp, t as injectForm, u as injectWizard, v as kAttaformRegistry, w as lazy, x as useRegister, y as useRegistry, z as useWizard } from './shared/attaform.BGMRvckW.js';
+import { A as AttaformDefaults, F as FormKey, G as GenericForm, U as UseFormConfiguration, a as AbstractSchema, D as DefaultValuesInput, b as UseFormReturnType, R as RegisterModelDynamicCustomDirective, c as RegisterValue, d as GetDisplayState, V as ValidationError, e as ApiErrorEnvelope, f as ApiErrorDetails } from './shared/attaform.BJnNK75Y.js';
+export { g as ApiErrorEntry, h as ArrayItem, i as ArrayPath, C as CoercionEntry, j as CoercionRegistry, k as CoercionResult, l as CustomDirectiveRegisterAssignerFn, m as DeepPartial, n as DefaultValuesResponse, o as DefaultValuesShape, p as DisplayCtx, q as DisplayMachine, r as DisplayState, E as ErrorsProxyShape, s as FieldMetaPayload, t as FieldState, u as FieldStateMap, v as FieldStateMapEntry, w as FlatPath, x as FormErrorRecord, y as FormErrorsSurface, z as FormMeta, H as HandleSubmit, B as HistoryConfig, I as IsTuple, J as IsUnion, K as JoinSegments, L as KeyofUnion, M as LiftedValueShape, N as MetaTrackerValue, O as NestedReadType, P as NestedType, Q as OnError, S as OnInvalidSubmitPolicy, T as OnSubmit, W as PartialFlatPath, X as Path, Y as PathKey, Z as PendingValidationStatus, _ as Primitive, $ as ROOT_PATH, a0 as ROOT_PATH_KEY, a1 as ReactiveValidationStatus, a2 as RegisterDirective, a3 as RegisterFlatPath, a4 as RegisterOptions, a5 as RegisterSelectModifier, a6 as RegisterTextModifier, a7 as RegisterTransform, a8 as Segment, a9 as SetValueCallback, aa as SetValuePayload, ab as SettledValidationStatus, ac as SlimPrimitiveKind, ad as SlimRuntimeOf, ae as SubmitHandler, af as Unset, ag as ValidateOn, ah as ValidateOnConfig, ai as ValidationResponse, aj as ValidationResponseWithoutValue, ak as ValueOfUnion, al as WriteMeta, am as WriteShape, an as canonicalizePath, ao as isPathPrefix, ap as isUnset, aq as parseDottedPath, ar as unset } from './shared/attaform.BJnNK75Y.js';
+export { A as AttaformError, I as InvalidPathError, a as InvalidUseFormConfigError, O as OutsideSetupError, R as RegistryNotInstalledError, b as ReservedFormKeyError, S as SubmitErrorHandlerError } from './shared/attaform.CO0e7YVY.js';
 
 /**
  * Options for `createAttaform()`.
@@ -333,41 +333,6 @@ declare function makeDefaultDisplayState({ showDelay, minVisible, }: DisplayTimi
  */
 declare const defaultDisplayState: GetDisplayState;
 
-/**
- * The library's built-in conservative set of identifier name stems that
- * flag a path segment as "this looks like data the consumer almost
- * certainly does not want serialised to client-side storage or
- * broadcast across tabs."
- *
- * Each entry is a NAME STEM, not a regex. Matching is case-insensitive
- * and tolerant of separator variants — `'card_number'` matches the
- * segments `'card_number'`, `'card-number'`, `'cardNumber'`, and
- * `'cardnumber'`. Short stems (compact length ≤ 5) get word-boundary
- * anchors to avoid common false positives — `'pin'` matches `'pin'`
- * and `'user_pin'` but not `'pinned'`; `'token'` matches `'token'` but
- * not `'tokenizer'`. Longer stems match anywhere (`'password'` matches
- * `'password'`, `'passwords'`, `'userPassword'`).
- *
- * Consumers extend or replace via per-form or global config:
- *
- * ```ts
- * createAttaform({
- *   defaults: { sensitiveNames: [...DEFAULT_SENSITIVE_NAMES, 'mrn', 'tax_id'] }
- * })
- * ```
- *
- * The same resolved predicate gates persistence writes and multi-tab
- * sync broadcasts — one source of truth for "what counts as sensitive"
- * across those surfaces. (DevTools renders raw values by design.)
- *
- * **Non-goals.** This is not a soundness guarantee. Adversarial paths
- * (`'sensitive_data'`, `'CCV'` instead of `'CVV'`) can slip through.
- * The intent is a code-review trigger for the common-case footgun
- * plus a defense-in-depth filter on the cross-tab and DevTools
- * surfaces.
- */
-declare const DEFAULT_SENSITIVE_NAMES: readonly string[];
-
 /**
  * Result of `parseApiErrors`. Branch on `ok` to handle the two cases:
  *
@@ -494,5 +459,5 @@ declare const PARSE_API_ERRORS_DEFAULTS: {
  */
 declare function parseApiErrors(payload: ApiErrorEnvelope | ApiErrorDetails | null | undefined | unknown, options: ParseApiErrorsOptions): ParseApiErrorsResult;
 
-export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_SENSITIVE_NAMES, DEFAULT_TIMINGS, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, makeDefaultDisplayState, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
+export { AbstractSchema, ApiErrorDetails, ApiErrorEnvelope, AttaformDefaults, AttaformRegistry, DEFAULT_TIMINGS, DEVTOOLS_WINDOW_KEY, DefaultValuesInput, FormKey, GenericForm, GetDisplayState, PARSE_API_ERRORS_DEFAULTS, RegisterValue, SerializedFormData, UseFormConfiguration, UseFormReturnType, ValidationError, assignKey, createAttaform, defaultDisplayState, escapeForInlineScript, hydrateAttaformState, isRegisterValue, makeDefaultDisplayState, parseApiErrors, renderAttaformState, useAbstractForm as useForm, vRegister };
 export type { AttaformDevtoolsBridge, AttaformPluginOptions, DisplayTimings, ParseApiErrorsOptions, ParseApiErrorsResult, SerializedAttaformState };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { a as canonicalizePath, I as InvalidPathError } from './shared/attaform.DP-u7_tk.mjs';
-export { A as AnonPersistError, b as AttaformError, D as DEFAULT_SENSITIVE_NAMES, d as InvalidUseFormConfigError, O as OutsideSetupError, R as ROOT_PATH, e as ROOT_PATH_KEY, f as RegistryNotInstalledError, h as ReservedFormKeyError, S as SubmitErrorHandlerError, i as assignKey, c as createAttaform, j as createRegistry, g as getRegistryFromApp, l as isPathPrefix, m as isRegisterValue, n as kAttaformRegistry, p as parseDottedPath, u as useRegistry, v as vRegister } from './shared/attaform.DP-u7_tk.mjs';
-export { D as DEVTOOLS_WINDOW_KEY, h as hydrateAttaformState, r as renderAttaformState } from './shared/attaform.C41gjp-a.mjs';
-import { k as normalizeNumericOption } from './shared/attaform.CTheKoTc.mjs';
-export { A as AttaformErrorCode, D as DEFAULT_TIMINGS, m as defaultCoercionRules, o as defaultDisplayState, p as defineCoercion, i as injectForm, a as injectWizard, b as isUnset, l as lazy, q as makeDefaultDisplayState, u as unset, r as useForm, c as useRegister, d as useWizard } from './shared/attaform.CTheKoTc.mjs';
+import { a as canonicalizePath, I as InvalidPathError } from './shared/attaform.BhI9Icek.mjs';
+export { A as AttaformError, b as InvalidUseFormConfigError, O as OutsideSetupError, R as ROOT_PATH, d as ROOT_PATH_KEY, e as RegistryNotInstalledError, f as ReservedFormKeyError, S as SubmitErrorHandlerError, h as assignKey, c as createAttaform, i as createRegistry, g as getRegistryFromApp, j as isPathPrefix, l as isRegisterValue, m as kAttaformRegistry, p as parseDottedPath, u as useRegistry, v as vRegister } from './shared/attaform.BhI9Icek.mjs';
+export { D as DEVTOOLS_WINDOW_KEY, h as hydrateAttaformState, r as renderAttaformState } from './shared/attaform.Dx9-QQE2.mjs';
+import { n as normalizeNumericOption } from './shared/attaform.CtJOd7ox.mjs';
+export { A as AttaformErrorCode, D as DEFAULT_TIMINGS, e as defaultCoercionRules, f as defaultDisplayState, g as defineCoercion, i as injectForm, a as injectWizard, b as isUnset, l as lazy, m as makeDefaultDisplayState, u as unset, h as useForm, c as useRegister, d as useWizard } from './shared/attaform.CtJOd7ox.mjs';
 
 function escapeForInlineScript(json) {
   return json.replace(/[<>&\u2028\u2029]/g, (char) => {

package/dist/nuxt.d.cts

@@ -1,5 +1,5 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { A as AttaformDefaults } from './shared/attaform.ory-3WhV.cjs';
+import { A as AttaformDefaults } from './shared/attaform.BJnNK75Y.cjs';
 import 'vue';
 
 /**

package/dist/nuxt.d.mts

@@ -1,5 +1,5 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { A as AttaformDefaults } from './shared/attaform.ory-3WhV.mjs';
+import { A as AttaformDefaults } from './shared/attaform.BJnNK75Y.mjs';
 import 'vue';
 
 /**

package/dist/nuxt.d.ts

@@ -1,5 +1,5 @@
 import * as _nuxt_schema from '@nuxt/schema';
-import { A as AttaformDefaults } from './shared/attaform.ory-3WhV.js';
+import { A as AttaformDefaults } from './shared/attaform.BJnNK75Y.js';
 import 'vue';
 
 /**

package/dist/runtime/components/AttaformDevtoolsPanel.vue

@@ -143,11 +143,7 @@ import { computed, onUnmounted, ref, watch } from 'vue'
    * `src/runtime/core/devtools.ts` so both surfaces have identical
    * semantics:
    *   1. canonicalize the structured path
-   *   2. refuse sensitive-name paths (the tree already gates the UI,
-   *      but a defensive check here keeps the contract honest)
-   *   3. derive the persist flag from the path's element opt-ins
-   *   4. call setValueAtPath with the same write-meta the bound input
-   *      would have produced
+   *   2. call setValueAtPath with that path
    */
   // Field-state inspector. Click any key in the Form value tree to
   // "select" that path; the Field state section below resolves
@@ -259,12 +255,8 @@ import { computed, onUnmounted, ref, watch } from 'vue'
     const form = activeForm.value
     if (form === null) return
     try {
-      const { segments: canonicalPath, key: canonicalKey } = canonicalizePath(
-        rawPath as readonly Segment[]
-      )
-      form.setValueAtPath(canonicalPath, next, {
-        persist: form.persistOptIns.hasAnyOptInForPath(canonicalKey),
-      })
+      const { segments: canonicalPath } = canonicalizePath(rawPath as readonly Segment[])
+      form.setValueAtPath(canonicalPath, next)
       // The host's setValueAtPath fires `onFormChange` listeners, which
       // bumps our updateTick (see subscribeForm) — that refreshes the
       // panel's view of the new value on the next microtask.

package/dist/runtime/plugins/attaform.cjs

@@ -1,8 +1,8 @@
 'use strict';
 
 const app = require('nuxt/app');
-const devtoolsShared = require('../../shared/attaform.BwLp9KM7.cjs');
-const paths = require('../../shared/attaform.B5LNzqQh.cjs');
+const devtoolsShared = require('../../shared/attaform.BibT5AS_.cjs');
+const paths = require('../../shared/attaform.Db4E4IW6.cjs');
 
 var attaform_default = app.defineNuxtPlugin({
   // `enforce: 'pre'` makes the "we run before any component's setup" claim

package/dist/runtime/plugins/attaform.mjs

@@ -1,6 +1,6 @@
 import { defineNuxtPlugin, useRuntimeConfig, useRoute } from 'nuxt/app';
-import { r as renderAttaformState, h as hydrateAttaformState, D as DEVTOOLS_WINDOW_KEY } from '../../shared/attaform.C41gjp-a.mjs';
-import { c as createAttaform, k as kAttaformWizardActiveStepResolver, g as getRegistryFromApp } from '../../shared/attaform.DP-u7_tk.mjs';
+import { r as renderAttaformState, h as hydrateAttaformState, D as DEVTOOLS_WINDOW_KEY } from '../../shared/attaform.Dx9-QQE2.mjs';
+import { c as createAttaform, k as kAttaformWizardActiveStepResolver, g as getRegistryFromApp } from '../../shared/attaform.BhI9Icek.mjs';
 
 var attaform_default = defineNuxtPlugin({
   // `enforce: 'pre'` makes the "we run before any component's setup" claim

package/dist/shared/{attaform.BGf_J22U.d.ts → attaform.BGMRvckW.d.ts}

@@ -1,4 +1,4 @@
-import { F as FormKey, _ as PathKey, p as DisplayCtx, d as GetDisplayState, q as DisplayMachine, Z as Path, ah as SlimPrimitiveKind, C as CoercionEntry, j as CoercionRegistry, G as GenericForm, V as ValidationError, a as AbstractSchema, aq as WriteMeta, m as DeepPartial, ar as WriteShape, ay as TransformAbortHolder, al as ValidateOn, az as PersistOptInRegistry, A as AttaformDefaults, b as UseFormReturnType, c as RegisterValue } from './attaform.ory-3WhV.js';
+import { F as FormKey, Y as PathKey, p as DisplayCtx, d as GetDisplayState, q as DisplayMachine, X as Path, ac as SlimPrimitiveKind, C as CoercionEntry, j as CoercionRegistry, G as GenericForm, V as ValidationError, a as AbstractSchema, al as WriteMeta, m as DeepPartial, am as WriteShape, at as TransformAbortHolder, ag as ValidateOn, A as AttaformDefaults, b as UseFormReturnType, c as RegisterValue } from './attaform.BJnNK75Y.js';
 import { Ref, ComputedRef, App, InjectionKey } from 'vue';
 
 /**
@@ -967,17 +967,13 @@ type FormStore<F extends GenericForm, G extends GenericForm = F> = {
     /**
      * Replace the form value wholesale. Optional `meta` is forwarded to
      * every `onFormChange` listener so they can decide whether THIS write
-     * is one they care about — most importantly, the persistence layer
-     * only writes when `meta?.persist === true`. Internal callers that
-     * don't pass meta default to no-persist.
+     * is one they care about (e.g. history tagging a hydration replay).
      */
     applyFormReplacement(next: F, meta?: WriteMeta): void;
     /**
      * Set a single path's value. `meta` is forwarded to listeners via
-     * `applyFormReplacement` (see above). The directive's input handler
-     * computes `meta.persist` from the per-element opt-in registry; other
-     * internal call sites pass `meta.persist = hasAnyOptInForPath(path)`.
-     * Public `form.setValue` passes no meta.
+     * `applyFormReplacement` (see above). Public `form.setValue` passes no
+     * meta.
      *
      * Returns `false` when the slim-primitive gate rejects the write
      * (the value's primitive shape doesn't match the schema's slim
@@ -1126,7 +1122,7 @@ type FormStore<F extends GenericForm, G extends GenericForm = F> = {
     } | null;
     /**
      * Cancel every in-flight field-level validation run — clears timers
-     * for debounced 'change' runs that haven't fired, aborts controllers
+     * for debounced 'change' runs that haven't fired, latches `aborted`
      * for runs whose async parse is in flight. Called by `handleSubmit`
      * at entry (submit validation is authoritative) and by `reset()`.
      */
@@ -1191,20 +1187,17 @@ type FormStore<F extends GenericForm, G extends GenericForm = F> = {
     /**
      * Subscribe to every `applyFormReplacement`. Fires synchronously
      * after `form.value` has been swapped to `next` and all field /
-     * originals bookkeeping has run. Used by persistence + undo/redo
-     * to hook the single mutation funnel. The optional `meta` carries
-     * the originating call site's intent — the persistence subscription
-     * filters on `meta?.persist === true`; subscribers that don't care
-     * about meta can ignore the parameter. Returns an unsubscribe
-     * function.
+     * originals bookkeeping has run. Used by undo/redo to hook the single
+     * mutation funnel. The optional `meta` carries the originating call
+     * site's intent; subscribers that don't care about meta can ignore the
+     * parameter. Returns an unsubscribe function.
      */
     onFormChange(listener: (next: F, meta?: WriteMeta) => void): () => void;
     /**
      * Subscribe to successful submissions. Fires after the consumer's
      * `onSubmit` callback has resolved — not on validation failure,
-     * not on callback throw. Used by persistence's `clearOnSubmitSuccess`
-     * to drop the stored payload once the form is safely through the
-     * server round-trip. Returns an unsubscribe function.
+     * not on callback throw. The DevTools panel rides this to surface a
+     * submit event. Returns an unsubscribe function.
      */
     onSubmitSuccess(listener: () => void): () => void;
     /**
@@ -1250,58 +1243,6 @@ type FormStore<F extends GenericForm, G extends GenericForm = F> = {
      * owned by the caller (e.g. `'history'`).
      */
     readonly modules: Map<string, unknown>;
-    /**
-     * Per-element persistence opt-in tracker. Empty by default; the
-     * `v-register` directive populates entries on `mount` for each binding
-     * that passed `register('foo', { persist: true })` and clears them on
-     * `beforeUnmount`. Two SFCs sharing a key share this registry — opt-ins
-     * are per-DOM-element, not per-component. Internal to the persistence
-     * subsystem; not part of the consumer API surface.
-     */
-    readonly persistOptIns: PersistOptInRegistry;
-    /**
-     * Resolved sensitive-path predicate for THIS form. Honors the
-     * cascade (`useForm({ sensitiveNames })` > global default >
-     * library `DEFAULT_SENSITIVE_NAMES`). Used by:
-     *  - the persistence opt-in gate (`allowSensitivePersist`);
-     *  - the multi-tab sync module (outbound strip + inbound reject);
-     *  - DevTools edit rejection;
-     *  - any future surface that needs to flag "this path holds
-     *    sensitive data."
-     *
-     * Frozen at FormStore construction. Two callsites sharing a key
-     * share the predicate — consistent with the rest of the per-form
-     * resolved-config surface.
-     */
-    readonly isSensitivePath: (path: Path | PathKey | string) => boolean;
-    /**
-     * Canonical path keys explicitly opted OUT of multi-tab sync by
-     * `register(path, { multiTab: false })`. The sync module's outbound
-     * broadcaster strips patches at these paths AND the inbound listener
-     * rejects them — symmetric tab-local behaviour for selected fields.
-     *
-     * Read-only Set view; mutate via `incrementNoSyncOptOut` /
-     * `decrementNoSyncOptOut` which maintain a per-path ref count so
-     * multiple bindings on the same path balance correctly across
-     * dynamic conditional renders. Empty by default.
-     */
-    readonly noSyncPaths: ReadonlySet<PathKey>;
-    /**
-     * Ref-counted "this path is tab-local" registration. Called by
-     * `v-register`'s `created` hook for any binding that declared
-     * `register('x', { multiTab: false })`. The first call for a given
-     * path adds it to `noSyncPaths`; subsequent calls just bump the
-     * ref count. Pair with `decrementNoSyncOptOut`.
-     */
-    incrementNoSyncOptOut(path: PathKey): void;
-    /**
-     * Symmetric companion to `incrementNoSyncOptOut`. Called by
-     * `v-register`'s `beforeUnmount` hook. When the ref count for a
-     * path drops to zero, the path is removed from `noSyncPaths` —
-     * dynamic toggling (the binding rendered conditionally) restores
-     * full sync to the path when the last opt-out unmounts.
-     */
-    decrementNoSyncOptOut(path: PathKey): void;
     /**
      * Resolved schema-coercion index — the merged config from
      * `createAttaform({ defaults: { coerce } })` ∪ `useForm({ coerce })`,