bank20baht-ui 0.12.1 → 0.12.2

package/dist/components/primitives/baht-datepicker.js

@@ -2,7 +2,7 @@ import { html as y } from "lit";
 import { customElement as g } from "lit/decorators.js";
 import { ifDefined as D } from "lit/directives/if-defined.js";
 import { BahtFieldBase as w } from "../field-base.js";
-import { formatIsoDateTime as u, formatIsoDate as c, dateModeOf as h, parseIsoDate as l, isoDaysOf as k, parseIsoDateTime as C, parseDisabledEntry as v } from "../../core/dates.js";
+import { formatIsoDateTime as u, formatIsoDate as h, dateModeOf as c, parseIsoDate as l, isoDaysOf as k, parseIsoDateTime as v, parseDisabledEntry as C } from "../../core/dates.js";
 import { t as p } from "../../core/i18n.js";
 import { renderIcon as _ } from "./icons.js";
 var I = Object.getOwnPropertyDescriptor, B = (t, e, a, s) => {
@@ -12,7 +12,12 @@ var I = Object.getOwnPropertyDescriptor, B = (t, e, a, s) => {
 };
 let f, O;
 function x() {
-  return O ?? (O = import("flatpickr").then((t) => f = t.default));
+  return O ?? (O = import("flatpickr").then(
+    (t) => f = t.default,
+    (t) => {
+      console.warn("[bahtui] <baht-datepicker> needs the `flatpickr` peer dependency", t);
+    }
+  ));
 }
 let m = class extends w {
   constructor() {
@@ -56,10 +61,8 @@ let m = class extends w {
     }
     if (((s = this.fp) == null ? void 0 : s.input) !== e || t.has("field") || t.has("disabled") || t.has("readonly")) {
       if (this.teardown(), !f) {
-        this.pendingLoad ?? (this.pendingLoad = x().catch((i) => {
-          console.warn("[bahtui] <baht-datepicker> needs the `flatpickr` peer dependency", i);
-        }).then(() => {
-          this.pendingLoad = void 0, this.isConnected && this.requestUpdate();
+        this.pendingLoad ?? (this.pendingLoad = x().then((i) => {
+          this.pendingLoad = void 0, i && this.isConnected && this.requestUpdate();
         }));
         return;
       }
@@ -81,11 +84,11 @@ let m = class extends w {
   /** Value-equality for the picker's own selection (minute-precise with `enable_time`). */
   sameInstants(t, e) {
     if (t.length !== e.length) return !1;
-    const a = this.field.enable_time ? u : c;
+    const a = this.field.enable_time ? u : h;
     return t.every((s, i) => a(s) === a(e[i]));
   }
   options() {
-    const t = this.field, e = h(t), a = l(t.min), s = l(t.max), i = b(t);
+    const t = this.field, e = c(t), a = l(t.min), s = l(t.max), i = b(t);
     return {
       static: !0,
       disableMobile: !0,
@@ -142,7 +145,7 @@ let m = class extends w {
     const t = this.fp;
     if (!t || !this.todayAllowed()) return;
     const e = this.field.enable_time ? E(/* @__PURE__ */ new Date()) : o(/* @__PURE__ */ new Date());
-    switch (h(this.field)) {
+    switch (c(this.field)) {
       case "range":
         t.setDate([e, e], !0);
         break;
@@ -164,13 +167,13 @@ let m = class extends w {
    *  a host may not always have a time to feed back (an edited record that
    *  predates this field, for one). */
   datesOf(t) {
-    const e = (a) => (this.field.enable_time ? C(a) : null) ?? l(a);
+    const e = (a) => (this.field.enable_time ? v(a) : null) ?? l(a);
     return k(t).map(e).filter((a) => a !== null);
   }
   /** flatpickr's selection -> the value shape of the field's mode. */
   toValue(t) {
-    const e = this.field.enable_time ? u : c, a = t.map(e);
-    switch (h(this.field)) {
+    const e = this.field.enable_time ? u : h, a = t.map(e);
+    switch (c(this.field)) {
       case "range":
         return a.length === 2 ? [a[0], a[1]] : null;
       case "multiple":
@@ -190,7 +193,7 @@ function E(t) {
   return new Date(t.getFullYear(), t.getMonth(), t.getDate(), t.getHours(), t.getMinutes());
 }
 function F(t, e) {
-  return c(t) === c(e);
+  return h(t) === h(e);
 }
 function L(t, e) {
   if (t instanceof Date) return F(t, e);
@@ -204,7 +207,7 @@ function L(t, e) {
 function b(t) {
   const e = [];
   for (const s of t.disabled_dates ?? []) {
-    const i = v(s);
+    const i = C(s);
     i && e.push(i[0].getTime() === i[1].getTime() ? i[0] : { from: i[0], to: i[1] });
   }
   const a = t.disabled_weekdays;

package/dist/components/primitives/baht-modal.js

@@ -1,6 +1,6 @@
 import { nothing as r, html as h } from "lit";
 import { property as c, query as m, state as f, customElement as b } from "lit/decorators.js";
-import { boolOff as y, BahtElement as v, hasDom as p, adoptLightChildren as u } from "../base.js";
+import { boolOff as v, BahtElement as y, hasDom as p, adoptLightChildren as u } from "../base.js";
 import { afterExit as g } from "../motion.js";
 import { t as $ } from "../../core/i18n.js";
 import { renderIllustration as k } from "./illustrations.js";
@@ -13,10 +13,10 @@ const E = {
   fromAttribute: (t) => t !== null && t !== "false",
   toAttribute: (t) => t ? "" : null
 };
-let s = class extends v {
+let s = class extends y {
   constructor() {
     super(...arguments), this.open = !1, this.heading = "", this.description = "", this.showClose = !0, this.placement = "center", this.closeOnScrim = !1, this.closing = !1, this.closeToken = 0, this.previousFocus = null, this.onKeydown = (t) => {
-      !this.open || s.openStack.at(-1) !== this || (t.key === "Escape" ? this.requestClose("escape") : t.key === "Tab" && this.trapFocus(t));
+      !this.open || s.openStack.at(-1) !== this || (t.key === "Escape" ? t.defaultPrevented || this.requestClose("escape") : t.key === "Tab" && this.trapFocus(t));
     };
   }
   get titleId() {
@@ -126,7 +126,7 @@ l([
   c()
 ], s.prototype, "description", 2);
 l([
-  c({ attribute: "show-close", converter: y })
+  c({ attribute: "show-close", converter: v })
 ], s.prototype, "showClose", 2);
 l([
   c()

package/dist/components/primitives/baht-swipe-row.js

@@ -31,7 +31,7 @@ let a = class extends g {
     return c() ? ((t = this.querySelector(".baht-swipe-row-actions")) == null ? void 0 : t.offsetWidth) ?? 0 : 0;
   }
   onPointerdown(t) {
-    !this.hasActions || t.button !== 0 || (this.start = {
+    !this.hasActions || t.button !== 0 || (this.swallowClick = !1, this.start = {
       id: t.pointerId,
       x: t.clientX,
       y: t.clientY,

package/dist/core/index.d.ts

@@ -2,6 +2,7 @@ export * from './types.js';
 export { defaultValue } from './defaults.js';
 export { approvalFields } from './approval.js';
 export { validateField, normalizeTagsValue } from './validators.js';
+export { isUnsafePattern } from './pattern-safety.js';
 export { resolveViewFields } from './views.js';
 export { applyFlags, flagEnabled } from './flags.js';
 export { getCatalog, setCatalog, setLocale, t } from './i18n.js';

package/dist/core/pattern-safety.d.ts

@@ -0,0 +1,24 @@
+/**
+ * ReDoS guard for `pattern` validators (CLAUDE.md engine invariant: patterns
+ * nesting unbounded quantifiers are rejected). A small tokenizer turns the
+ * source into groups/alternatives/quantified items, then flags any group
+ * repeated more than twice whose body can be split between iterations in
+ * more than one way — the shape that makes a backtracking engine go
+ * exponential (or high-degree polynomial for a large bounded repeat):
+ *
+ * - every mandatory item of an alternative is itself unbounded:
+ *   `(a+)+`, `((a+))+`, `(?<n>a+)+`, `(\w+\s?)+`, `(x+x+)+`, `(a*)*`
+ * - one alternative is unbounded on its own: `(a+|b)+`
+ * - two alternatives are spelled the same: `(a|a)+`
+ *
+ * A mandatory bounded atom (`(-[a-z]+)*`, `(abc+)+`) anchors each iteration
+ * and is accepted. Overlap between *different* alternatives (`(a|ab)+`) is
+ * not detected; patterns are builder-authored, so the goal is catching the
+ * classic authoring mistakes at save time and before the client compiles.
+ */
+/**
+ * True when `source` backtracks catastrophically on hostile input (see module
+ * doc). Sources that do not compile return false — callers report those as
+ * invalid separately.
+ */
+export declare function isUnsafePattern(source: string): boolean;

package/dist/core/pattern-safety.js

@@ -0,0 +1,78 @@
+class o {
+  constructor(s) {
+    this.src = s, this.i = 0;
+  }
+  parseAlts() {
+    const s = [];
+    let e = this.i, i = [];
+    for (; this.i < this.src.length && this.src[this.i] !== ")"; ) {
+      if (this.src[this.i] === "|") {
+        s.push({ items: i, source: this.src.slice(e, this.i) }), this.i++, e = this.i, i = [];
+        continue;
+      }
+      i.push(this.quantify(this.atom()));
+    }
+    return s.push({ items: i, source: this.src.slice(e, this.i) }), s;
+  }
+  atom() {
+    const s = this.src[this.i++];
+    if (s === "\\") {
+      const e = this.src[this.i++];
+      return { min: 1, max: 1, zeroWidth: e === "b" || e === "B" };
+    }
+    return s === "[" ? (this.skipClass(), { min: 1, max: 1, zeroWidth: !1 }) : s === "(" ? this.group() : { min: 1, max: 1, zeroWidth: s === "^" || s === "$" };
+  }
+  skipClass() {
+    for (this.src[this.i] === "^" && this.i++, this.src[this.i] === "]" && this.i++; this.i < this.src.length && this.src[this.i] !== "]"; )
+      this.i += this.src[this.i] === "\\" ? 2 : 1;
+    this.i++;
+  }
+  group() {
+    let s = !1;
+    if (this.src[this.i] === "?") {
+      const i = this.src.slice(this.i + 1);
+      /^(?:[=!]|<[=!])/.test(i) ? (s = !0, this.i += i.startsWith("<") ? 3 : 2) : i.startsWith(":") ? this.i += 2 : i.startsWith("<") && (this.i = this.src.indexOf(">", this.i) + 1);
+    }
+    const e = this.parseAlts();
+    return this.i++, { min: 1, max: 1, zeroWidth: s, alts: e };
+  }
+  quantify(s) {
+    const e = this.src[this.i];
+    let i;
+    if (e === "*" ? i = [0, 1 / 0] : e === "+" ? i = [1, 1 / 0] : e === "?" && (i = [0, 1]), i)
+      this.i++;
+    else {
+      const r = /^\{(\d+)(,(\d*))?\}/.exec(this.src.slice(this.i));
+      if (!r) return s;
+      this.i += r[0].length;
+      const h = Number(r[1]);
+      i = [h, r[2] === void 0 ? h : r[3] === "" ? 1 / 0 : Number(r[3])];
+    }
+    return this.src[this.i] === "?" && this.i++, { ...s, min: s.min * i[0], max: s.max * i[1] };
+  }
+}
+function n(t) {
+  var s;
+  return t.zeroWidth ? !1 : t.max === 1 / 0 ? !0 : ((s = t.alts) == null ? void 0 : s.some(c)) ?? !1;
+}
+function c(t) {
+  const s = t.items.filter((i) => !i.zeroWidth), e = s.filter((i) => i.min > 0);
+  return e.length === 0 ? s.some(n) : e.every(n);
+}
+function l(t) {
+  return new Set(t.map((s) => s.source)).size < t.length;
+}
+function a(t) {
+  return t.alts ? t.max > 2 && (t.alts.some(c) || l(t.alts)) ? !0 : t.alts.some((s) => s.items.some(a)) : !1;
+}
+function u(t) {
+  try {
+    new RegExp(t);
+  } catch {
+    return !1;
+  }
+  return new o(t).parseAlts().some((i) => i.items.some(a));
+}
+export {
+  u as isUnsafePattern
+};

package/dist/core/validators.js

@@ -1,6 +1,7 @@
-import { defaultValue as w } from "./defaults.js";
+import { defaultValue as x } from "./defaults.js";
 import { compareValues as k } from "./engine/conditions.js";
-import { isoDaysOf as _, dateModeOf as L, rangeInteriorDays as A, isDateDisabled as b } from "./dates.js";
+import { isUnsafePattern as _ } from "./pattern-safety.js";
+import { isoDaysOf as L, dateModeOf as b, rangeInteriorDays as A, isDateDisabled as d } from "./dates.js";
 import { t as u } from "./i18n.js";
 const E = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function y(e) {
@@ -10,8 +11,8 @@ function C(e) {
   const t = [...e.validators ?? []], n = (o) => t.some((r) => r.type === o);
   return e.required && !n("required") && t.push({ type: "required" }), e.max_length !== void 0 && !n("maxLength") && t.push({ type: "maxLength", value: e.max_length }), e.min_length !== void 0 && !n("minLength") && t.push({ type: "minLength", value: e.min_length }), e.min !== void 0 && !n("min") && t.push({ type: "min", value: e.min }), e.max !== void 0 && !n("max") && t.push({ type: "max", value: e.max }), e.type === "email" && !n("email") && t.push({ type: "email" }), t;
 }
-const d = (e) => Array.isArray(e) ? e : [e];
-function l(e, t) {
+const $ = (e) => Array.isArray(e) ? e : [e];
+function f(e, t) {
   return (n, o) => {
     const r = Number(n.value);
     return Number.isNaN(r) ? (console.warn(
@@ -19,33 +20,33 @@ function l(e, t) {
     ), null) : typeof o != "string" ? null : (e === "minLength" ? o.length < r : o.length > r) ? n.message ?? u(e, { n: n.value }) : null;
   };
 }
-function f(e) {
-  return (t, n) => d(n).some((r) => {
+function h(e) {
+  return (t, n) => $(n).some((r) => {
     const s = k(r, t.value);
     return s !== null && (e === "min" ? s < 0 : s > 0);
   }) ? t.message ?? u(e, { n: t.value }) : null;
 }
-const $ = {
+const q = {
   eq: (e) => e === 0,
   ne: (e) => e !== 0,
   gt: (e) => e > 0,
   gte: (e) => e >= 0,
   lt: (e) => e < 0,
   lte: (e) => e <= 0
-}, q = (e, t, n, o) => {
+}, O = (e, t, n, o) => {
   const r = o == null ? void 0 : o[e.field ?? ""];
   if (r === void 0 || y(r)) return null;
   const s = k(t, r);
   if (s === null) return null;
   const i = e.op ?? "eq";
-  if ($[i](s)) return null;
+  if (q[i](s)) return null;
   const a = `compare${i[0].toUpperCase()}${i.slice(1)}`;
   return e.message ?? u(a, { other: e.field });
 }, R = (e, t) => {
   if (typeof t != "string") return null;
-  const n = D(String(e.value));
+  const n = M(String(e.value));
   return n ? n.test(t) ? null : e.message ?? u("pattern") : null;
-}, O = (e, t, n) => {
+}, N = (e, t, n) => {
   var s;
   const o = (s = n == null ? void 0 : n.validators) == null ? void 0 : s[e.fn ?? ""];
   if (!o)
@@ -54,20 +55,20 @@ const $ = {
   return r === null ? null : e.message ?? r;
 }, v = {
   required: (e, t) => y(t) ? e.message ?? u("required") : null,
-  minLength: l("minLength", "min_length"),
-  maxLength: l("maxLength", "max_length"),
-  min: f("min"),
-  max: f("max"),
+  minLength: f("minLength", "min_length"),
+  maxLength: f("maxLength", "max_length"),
+  min: h("min"),
+  max: h("max"),
   pattern: R,
   email: (e, t) => typeof t == "string" && !E.test(t) ? e.message ?? u("email") : null,
-  compare: q,
-  custom: O
+  compare: O,
+  custom: N
 };
-function N(e, t, n, o) {
+function D(e, t, n, o) {
   return v[e.type](e, t, n, o);
 }
 const g = /* @__PURE__ */ new Map();
-function D(e) {
+function M(e) {
   let t = g.get(e);
   if (t === void 0) {
     try {
@@ -75,11 +76,13 @@ function D(e) {
     } catch {
       console.warn(`[bahtui] invalid pattern ${JSON.stringify(e)} — skipped`), t = null;
     }
-    g.set(e, t);
+    t && _(e) && (console.warn(
+      `[bahtui] unsafe pattern ${JSON.stringify(e)} (nested unbounded quantifiers) — skipped`
+    ), t = null), g.set(e, t);
   }
   return t;
 }
-function M(e, t) {
+function P(e, t) {
   if (!Array.isArray(e)) return [];
   const n = T(t), o = /* @__PURE__ */ new Set(), r = [];
   for (const s of e) {
@@ -106,19 +109,19 @@ function V(e, t) {
   return t.some((r) => r.length > o) && n.push({ key: e.key, message: u("tagTooLong", { n: o }) }), n;
 }
 function z(e, t, n, o, r) {
-  const s = [], i = e.type === "tags" ? M(t) : t, a = C(e), c = y(i);
+  const s = [], i = e.type === "tags" ? P(t) : t, a = C(e), c = y(i);
   for (const m of a) {
     if (m.type !== "required" && c) continue;
-    const p = N(m, i, n, o);
+    const p = D(m, i, n, o);
     p !== null && s.push({ key: e.key, message: p });
   }
-  return e.type === "repeater" && s.push(...S(e, i, n, r)), e.type === "file" && s.push(...I(e, i)), e.type === "date" && !c && s.push(...P(e, i)), e.type === "tags" && s.push(...V(e, i)), s;
+  return e.type === "repeater" && s.push(...J(e, i, n, r)), e.type === "file" && s.push(...I(e, i)), e.type === "date" && !c && s.push(...S(e, i)), e.type === "tags" && s.push(...V(e, i)), s;
 }
-function P(e, t) {
+function S(e, t) {
   var o, r;
   if (!((o = e.disabled_dates) != null && o.length) && !((r = e.disabled_weekdays) != null && r.length)) return [];
-  const n = _(t);
-  return L(e) === "range" && n.length === 2 && n.push(...A(n[0], n[1])), n.some((s) => b(e, s)) ? [{ key: e.key, message: u("dateDisabled") }] : [];
+  const n = L(t);
+  return b(e) === "range" && n.length === 2 && n.push(...A(n[0], n[1])), n.some((s) => d(e, s)) ? [{ key: e.key, message: u("dateDisabled") }] : [];
 }
 function W(e) {
   return e !== null && typeof e == "object" && typeof e.url == "string" && typeof e.size == "number" && typeof e.name == "string";
@@ -135,7 +138,7 @@ function I(e, t) {
     e.max_size !== void 0 && r.size > e.max_size && o.push({ key: e.key, message: u("fileTooLarge") }), e.accept && !j(e.accept, r.name, r.type ?? "") && o.push({ key: e.key, message: u("fileTypeNotAllowed") });
   return o;
 }
-function S(e, t, n, o) {
+function J(e, t, n, o) {
   if (t != null && !Array.isArray(t))
     return [{ key: e.key, message: u("pattern") }];
   const r = Array.isArray(t) ? t : [], s = [];
@@ -149,25 +152,25 @@ function S(e, t, n, o) {
   }
   const i = [...e.fields ?? []].sort((a, c) => a.order - c.order).filter((a) => a.type !== "label" && a.type !== "section" && a.type !== "repeater");
   return r.forEach((a, c) => {
-    s.push(...F(e, i, a, c, n, o));
+    s.push(...U(e, i, a, c, n, o));
   }), s;
 }
-function F(e, t, n, o, r, s) {
+function U(e, t, n, o, r, s) {
   const i = n !== null && typeof n == "object" && !Array.isArray(n) ? n : {}, a = {};
   for (const m of t)
-    a[m.key] = Object.hasOwn(i, m.key) ? i[m.key] : w(m);
+    a[m.key] = Object.hasOwn(i, m.key) ? i[m.key] : x(m);
   const c = [];
   for (const m of t) {
     const p = s == null ? void 0 : s[`${e.key}[${o}].${m.key}`];
     if (p && !p.visible) continue;
-    const x = p && p.required !== !!m.required ? { ...m, required: p.required } : m;
-    for (const h of z(x, a[m.key], r, a))
-      c.push({ key: `${e.key}[${o}].${h.key}`, message: h.message });
+    const w = p && p.required !== !!m.required ? { ...m, required: p.required } : m;
+    for (const l of z(w, a[m.key], r, a))
+      c.push({ key: `${e.key}[${o}].${l.key}`, message: l.message });
   }
   return c;
 }
 export {
-  M as normalizeTagsValue,
+  P as normalizeTagsValue,
   T as optionKeyLookup,
   z as validateField
 };

package/dist/engine.js

@@ -1,48 +1,50 @@
 import { defaultValue as r } from "./core/defaults.js";
 import { approvalFields as t } from "./core/approval.js";
 import { normalizeTagsValue as p, validateField as s } from "./core/validators.js";
-import { resolveViewFields as m } from "./core/views.js";
-import { applyFlags as x, flagEnabled as d } from "./core/flags.js";
-import { getCatalog as c, setCatalog as D, setLocale as g, t as u } from "./core/i18n.js";
-import { evaluate as C } from "./core/engine/evaluate.js";
-import { resolveNext as R, walkPath as I } from "./core/engine/graph.js";
-import { conditionRowRefs as T, evalCondition as V, parseRowRef as w, readRef as y } from "./core/engine/conditions.js";
-import { evalValueExpr as P } from "./core/engine/expressions.js";
-import { MAX_SCRIPT_DEPTH as b, createScriptContext as h, hasScripts as A, runScripts as L } from "./core/engine/scripts.js";
-import { displayValue as M } from "./core/display.js";
-import { LEGACY_KEY_MAP as k, normalizeLegacySchema as G } from "./core/legacy.js";
-import { formatIsoDate as K, formatIsoDateTime as N, isDateDisabled as X, parseDisabledEntry as j, parseIsoDate as q, parseIsoDateTime as B } from "./core/dates.js";
+import { isUnsafePattern as m } from "./core/pattern-safety.js";
+import { resolveViewFields as x } from "./core/views.js";
+import { applyFlags as n, flagEnabled as c } from "./core/flags.js";
+import { getCatalog as g, setCatalog as u, setLocale as v, t as C } from "./core/i18n.js";
+import { evaluate as R } from "./core/engine/evaluate.js";
+import { resolveNext as P, walkPath as S } from "./core/engine/graph.js";
+import { conditionRowRefs as V, evalCondition as w, parseRowRef as y, readRef as F } from "./core/engine/conditions.js";
+import { evalValueExpr as b } from "./core/engine/expressions.js";
+import { MAX_SCRIPT_DEPTH as A, createScriptContext as L, hasScripts as z, runScripts as M } from "./core/engine/scripts.js";
+import { displayValue as k } from "./core/display.js";
+import { LEGACY_KEY_MAP as H, normalizeLegacySchema as K } from "./core/legacy.js";
+import { formatIsoDate as U, formatIsoDateTime as X, isDateDisabled as j, parseDisabledEntry as q, parseIsoDate as B, parseIsoDateTime as J } from "./core/dates.js";
 export {
-  k as LEGACY_KEY_MAP,
-  b as MAX_SCRIPT_DEPTH,
-  x as applyFlags,
+  H as LEGACY_KEY_MAP,
+  A as MAX_SCRIPT_DEPTH,
+  n as applyFlags,
   t as approvalFields,
-  T as conditionRowRefs,
-  h as createScriptContext,
+  V as conditionRowRefs,
+  L as createScriptContext,
   r as defaultValue,
-  M as displayValue,
-  V as evalCondition,
-  P as evalValueExpr,
-  C as evaluate,
-  d as flagEnabled,
-  K as formatIsoDate,
-  N as formatIsoDateTime,
-  c as getCatalog,
-  A as hasScripts,
-  X as isDateDisabled,
-  G as normalizeLegacySchema,
+  k as displayValue,
+  w as evalCondition,
+  b as evalValueExpr,
+  R as evaluate,
+  c as flagEnabled,
+  U as formatIsoDate,
+  X as formatIsoDateTime,
+  g as getCatalog,
+  z as hasScripts,
+  j as isDateDisabled,
+  m as isUnsafePattern,
+  K as normalizeLegacySchema,
   p as normalizeTagsValue,
-  j as parseDisabledEntry,
-  q as parseIsoDate,
-  B as parseIsoDateTime,
-  w as parseRowRef,
-  y as readRef,
-  R as resolveNext,
-  m as resolveViewFields,
-  L as runScripts,
-  D as setCatalog,
-  g as setLocale,
-  u as t,
+  q as parseDisabledEntry,
+  B as parseIsoDate,
+  J as parseIsoDateTime,
+  y as parseRowRef,
+  F as readRef,
+  P as resolveNext,
+  x as resolveViewFields,
+  M as runScripts,
+  u as setCatalog,
+  v as setLocale,
+  C as t,
   s as validateField,
-  I as walkPath
+  S as walkPath
 };

package/dist/index.js

@@ -1,191 +1,193 @@
 import { defaultValue as o } from "./core/defaults.js";
 import { approvalFields as a } from "./core/approval.js";
 import { normalizeTagsValue as m, validateField as f } from "./core/validators.js";
-import { resolveViewFields as h } from "./core/views.js";
-import { applyFlags as l, flagEnabled as i } from "./core/flags.js";
-import { getCatalog as n, setCatalog as d, setLocale as c, t as S } from "./core/i18n.js";
-import { evaluate as g } from "./core/engine/evaluate.js";
-import { resolveNext as C, walkPath as R } from "./core/engine/graph.js";
-import { conditionRowRefs as E, evalCondition as k, parseRowRef as v, readRef as F } from "./core/engine/conditions.js";
-import { evalValueExpr as y } from "./core/engine/expressions.js";
-import { MAX_SCRIPT_DEPTH as b, createScriptContext as w, hasScripts as A, runScripts as L } from "./core/engine/scripts.js";
-import { displayValue as M } from "./core/display.js";
-import { LEGACY_KEY_MAP as N, normalizeLegacySchema as O } from "./core/legacy.js";
-import { formatIsoDate as Y, formatIsoDateTime as z, isDateDisabled as G, parseDisabledEntry as K, parseIsoDate as q, parseIsoDateTime as U } from "./core/dates.js";
-import { BahtButton as X } from "./components/primitives/baht-button.js";
-import { isIconName as J, renderIcon as Q } from "./components/primitives/icons.js";
-import { BahtBadge as $ } from "./components/primitives/baht-badge.js";
-import { BahtAvatar as tr } from "./components/primitives/baht-avatar.js";
-import { BahtCode as er } from "./components/primitives/baht-code.js";
-import { BahtTable as pr } from "./components/primitives/baht-table.js";
-import { BahtList as fr } from "./components/primitives/baht-list.js";
-import { BahtPagination as hr } from "./components/primitives/baht-pagination.js";
-import { BahtModal as lr } from "./components/primitives/baht-modal.js";
-import { BahtToast as sr } from "./components/primitives/baht-toast.js";
-import { BahtTooltip as dr } from "./components/primitives/baht-tooltip.js";
-import { BahtAlert as Sr } from "./components/primitives/baht-alert.js";
-import { BahtRating as gr } from "./components/primitives/baht-rating.js";
-import { BahtRange as Cr } from "./components/primitives/baht-range.js";
-import { BahtOtp as Dr } from "./components/primitives/baht-otp.js";
-import { BahtFilter as kr } from "./components/primitives/baht-filter.js";
-import { BahtSwipeRow as Fr } from "./components/primitives/baht-swipe-row.js";
-import { BahtSkeleton as yr } from "./components/primitives/baht-skeleton.js";
-import { BahtProgress as br } from "./components/primitives/baht-progress.js";
-import { BahtProgressRing as Ar } from "./components/primitives/baht-progress-ring.js";
-import { BahtSpinner as _r } from "./components/primitives/baht-spinner.js";
-import { BahtLoadingOverlay as Vr } from "./components/primitives/baht-loading-overlay.js";
-import { BahtCard as Or } from "./components/primitives/baht-card.js";
-import { BahtFieldset as Yr } from "./components/primitives/baht-fieldset.js";
-import { BahtTimeline as Gr } from "./components/primitives/baht-timeline.js";
-import { BahtAccordion as qr } from "./components/primitives/baht-accordion.js";
-import { BahtLink as Wr } from "./components/primitives/baht-link.js";
-import { BahtBreadcrumbs as jr } from "./components/primitives/baht-breadcrumbs.js";
-import { BahtInput as Qr } from "./components/primitives/baht-input.js";
-import { BahtTextarea as $r } from "./components/primitives/baht-textarea.js";
-import { BahtNumber as tt } from "./components/primitives/baht-number.js";
-import { BahtCurrency as et } from "./components/primitives/baht-currency.js";
-import { BahtSelect as pt } from "./components/primitives/baht-select.js";
-import { BahtMultiselect as ft } from "./components/primitives/baht-multiselect.js";
-import { BahtTags as ht } from "./components/primitives/baht-tags.js";
-import { BahtCheckbox as lt } from "./components/primitives/baht-checkbox.js";
-import { BahtRadio as st } from "./components/primitives/baht-radio.js";
-import { BahtToggle as dt } from "./components/primitives/baht-toggle.js";
-import { BahtDatepicker as St } from "./components/primitives/baht-datepicker.js";
-import { BahtFile as gt } from "./components/primitives/baht-file.js";
-import { BahtUpload as Ct } from "./components/primitives/baht-upload.js";
-import { BahtText as Dt } from "./components/primitives/baht-text.js";
-import { BahtSection as kt } from "./components/primitives/baht-section.js";
-import { BahtStatChart as Ft } from "./components/primitives/baht-stat-chart.js";
-import { BahtStat as yt } from "./components/primitives/baht-stat.js";
-import { BahtSparkline as bt } from "./components/primitives/baht-sparkline.js";
-import { BahtDonutChart as At } from "./components/primitives/baht-donut-chart.js";
-import { BahtBarChart as _t } from "./components/primitives/baht-bar-chart.js";
-import { BahtLineChart as Vt } from "./components/primitives/baht-line-chart.js";
-import { BahtHeatmap as Ot } from "./components/primitives/baht-heatmap.js";
-import { BahtMeter as Yt } from "./components/primitives/baht-meter.js";
-import { BahtChartBase as Gt, chartColor as Kt, chartSeqColor as qt, foldOther as Ut, formatValue as Wt, linearScale as Xt, niceTicks as jt, renderTableTwin as Jt } from "./components/primitives/charts.js";
-import { BahtEmptyState as Zt } from "./components/primitives/baht-empty-state.js";
-import { BahtErrorState as ro } from "./components/primitives/baht-error-state.js";
-import { BahtKeyvalueEditor as oo } from "./components/primitives/baht-keyvalue-editor.js";
-import { BahtReferencePicker as ao } from "./components/primitives/baht-reference-picker.js";
-import { BahtTypeahead as mo } from "./components/primitives/baht-typeahead.js";
-import { BahtRepeater as xo } from "./components/primitives/baht-repeater.js";
-import { BahtSteps as Bo } from "./components/primitives/baht-steps.js";
-import { TAG_FOR_TYPE as io } from "./components/primitives/tag-map.js";
-import { isIllustrationName as no, renderIllustration as co } from "./components/primitives/illustrations.js";
-import { BahtFieldBase as To } from "./components/field-base.js";
-import { BahtElement as uo, SSR_STASH as Co, adoptLightChildren as Ro, hasDom as Do, hasSsrMarkup as Eo } from "./components/base.js";
-import { BahtForm as vo } from "./components/baht-form.js";
-import { BahtWorkflow as Io } from "./components/baht-workflow.js";
+import { isUnsafePattern as h } from "./core/pattern-safety.js";
+import { resolveViewFields as l } from "./core/views.js";
+import { applyFlags as s, flagEnabled as n } from "./core/flags.js";
+import { getCatalog as c, setCatalog as S, setLocale as T, t as g } from "./core/i18n.js";
+import { evaluate as C } from "./core/engine/evaluate.js";
+import { resolveNext as D, walkPath as E } from "./core/engine/graph.js";
+import { conditionRowRefs as v, evalCondition as F, parseRowRef as I, readRef as P } from "./core/engine/conditions.js";
+import { evalValueExpr as b } from "./core/engine/expressions.js";
+import { MAX_SCRIPT_DEPTH as A, createScriptContext as L, hasScripts as _, runScripts as M } from "./core/engine/scripts.js";
+import { displayValue as N } from "./core/display.js";
+import { LEGACY_KEY_MAP as H, normalizeLegacySchema as Y } from "./core/legacy.js";
+import { formatIsoDate as G, formatIsoDateTime as K, isDateDisabled as U, parseDisabledEntry as q, parseIsoDate as W, parseIsoDateTime as X } from "./core/dates.js";
+import { BahtButton as J } from "./components/primitives/baht-button.js";
+import { isIconName as Z, renderIcon as $ } from "./components/primitives/icons.js";
+import { BahtBadge as tr } from "./components/primitives/baht-badge.js";
+import { BahtAvatar as er } from "./components/primitives/baht-avatar.js";
+import { BahtCode as pr } from "./components/primitives/baht-code.js";
+import { BahtTable as fr } from "./components/primitives/baht-table.js";
+import { BahtList as hr } from "./components/primitives/baht-list.js";
+import { BahtPagination as lr } from "./components/primitives/baht-pagination.js";
+import { BahtModal as sr } from "./components/primitives/baht-modal.js";
+import { BahtToast as dr } from "./components/primitives/baht-toast.js";
+import { BahtTooltip as Sr } from "./components/primitives/baht-tooltip.js";
+import { BahtAlert as gr } from "./components/primitives/baht-alert.js";
+import { BahtRating as Cr } from "./components/primitives/baht-rating.js";
+import { BahtRange as Dr } from "./components/primitives/baht-range.js";
+import { BahtOtp as kr } from "./components/primitives/baht-otp.js";
+import { BahtFilter as Fr } from "./components/primitives/baht-filter.js";
+import { BahtSwipeRow as Pr } from "./components/primitives/baht-swipe-row.js";
+import { BahtSkeleton as br } from "./components/primitives/baht-skeleton.js";
+import { BahtProgress as Ar } from "./components/primitives/baht-progress.js";
+import { BahtProgressRing as _r } from "./components/primitives/baht-progress-ring.js";
+import { BahtSpinner as Vr } from "./components/primitives/baht-spinner.js";
+import { BahtLoadingOverlay as Or } from "./components/primitives/baht-loading-overlay.js";
+import { BahtCard as Yr } from "./components/primitives/baht-card.js";
+import { BahtFieldset as Gr } from "./components/primitives/baht-fieldset.js";
+import { BahtTimeline as Ur } from "./components/primitives/baht-timeline.js";
+import { BahtAccordion as Wr } from "./components/primitives/baht-accordion.js";
+import { BahtLink as jr } from "./components/primitives/baht-link.js";
+import { BahtBreadcrumbs as Qr } from "./components/primitives/baht-breadcrumbs.js";
+import { BahtInput as $r } from "./components/primitives/baht-input.js";
+import { BahtTextarea as tt } from "./components/primitives/baht-textarea.js";
+import { BahtNumber as et } from "./components/primitives/baht-number.js";
+import { BahtCurrency as pt } from "./components/primitives/baht-currency.js";
+import { BahtSelect as ft } from "./components/primitives/baht-select.js";
+import { BahtMultiselect as ht } from "./components/primitives/baht-multiselect.js";
+import { BahtTags as lt } from "./components/primitives/baht-tags.js";
+import { BahtCheckbox as st } from "./components/primitives/baht-checkbox.js";
+import { BahtRadio as dt } from "./components/primitives/baht-radio.js";
+import { BahtToggle as St } from "./components/primitives/baht-toggle.js";
+import { BahtDatepicker as gt } from "./components/primitives/baht-datepicker.js";
+import { BahtFile as Ct } from "./components/primitives/baht-file.js";
+import { BahtUpload as Dt } from "./components/primitives/baht-upload.js";
+import { BahtText as kt } from "./components/primitives/baht-text.js";
+import { BahtSection as Ft } from "./components/primitives/baht-section.js";
+import { BahtStatChart as Pt } from "./components/primitives/baht-stat-chart.js";
+import { BahtStat as bt } from "./components/primitives/baht-stat.js";
+import { BahtSparkline as At } from "./components/primitives/baht-sparkline.js";
+import { BahtDonutChart as _t } from "./components/primitives/baht-donut-chart.js";
+import { BahtBarChart as Vt } from "./components/primitives/baht-bar-chart.js";
+import { BahtLineChart as Ot } from "./components/primitives/baht-line-chart.js";
+import { BahtHeatmap as Yt } from "./components/primitives/baht-heatmap.js";
+import { BahtMeter as Gt } from "./components/primitives/baht-meter.js";
+import { BahtChartBase as Ut, chartColor as qt, chartSeqColor as Wt, foldOther as Xt, formatValue as jt, linearScale as Jt, niceTicks as Qt, renderTableTwin as Zt } from "./components/primitives/charts.js";
+import { BahtEmptyState as ro } from "./components/primitives/baht-empty-state.js";
+import { BahtErrorState as oo } from "./components/primitives/baht-error-state.js";
+import { BahtKeyvalueEditor as ao } from "./components/primitives/baht-keyvalue-editor.js";
+import { BahtReferencePicker as mo } from "./components/primitives/baht-reference-picker.js";
+import { BahtTypeahead as xo } from "./components/primitives/baht-typeahead.js";
+import { BahtRepeater as Bo } from "./components/primitives/baht-repeater.js";
+import { BahtSteps as io } from "./components/primitives/baht-steps.js";
+import { TAG_FOR_TYPE as no } from "./components/primitives/tag-map.js";
+import { isIllustrationName as So, renderIllustration as To } from "./components/primitives/illustrations.js";
+import { BahtFieldBase as uo } from "./components/field-base.js";
+import { BahtElement as Ro, SSR_STASH as Do, adoptLightChildren as Eo, hasDom as ko, hasSsrMarkup as vo } from "./components/base.js";
+import { BahtForm as Io } from "./components/baht-form.js";
+import { BahtWorkflow as yo } from "./components/baht-workflow.js";
 export {
-  qr as BahtAccordion,
-  Sr as BahtAlert,
-  tr as BahtAvatar,
-  $ as BahtBadge,
-  _t as BahtBarChart,
-  jr as BahtBreadcrumbs,
-  X as BahtButton,
-  Or as BahtCard,
-  Gt as BahtChartBase,
-  lt as BahtCheckbox,
-  er as BahtCode,
-  et as BahtCurrency,
-  St as BahtDatepicker,
-  At as BahtDonutChart,
-  uo as BahtElement,
-  Zt as BahtEmptyState,
-  ro as BahtErrorState,
-  To as BahtFieldBase,
-  Yr as BahtFieldset,
-  gt as BahtFile,
-  kr as BahtFilter,
-  vo as BahtForm,
-  Ot as BahtHeatmap,
-  Qr as BahtInput,
-  oo as BahtKeyvalueEditor,
-  Vt as BahtLineChart,
-  Wr as BahtLink,
-  fr as BahtList,
-  Vr as BahtLoadingOverlay,
-  Yt as BahtMeter,
-  lr as BahtModal,
-  ft as BahtMultiselect,
-  tt as BahtNumber,
-  Dr as BahtOtp,
-  hr as BahtPagination,
-  br as BahtProgress,
-  Ar as BahtProgressRing,
-  st as BahtRadio,
-  Cr as BahtRange,
-  gr as BahtRating,
-  ao as BahtReferencePicker,
-  xo as BahtRepeater,
-  kt as BahtSection,
-  pt as BahtSelect,
-  yr as BahtSkeleton,
-  bt as BahtSparkline,
-  _r as BahtSpinner,
-  yt as BahtStat,
-  Ft as BahtStatChart,
-  Bo as BahtSteps,
-  Fr as BahtSwipeRow,
-  pr as BahtTable,
-  ht as BahtTags,
-  Dt as BahtText,
-  $r as BahtTextarea,
-  Gr as BahtTimeline,
-  sr as BahtToast,
-  dt as BahtToggle,
-  dr as BahtTooltip,
-  mo as BahtTypeahead,
-  Ct as BahtUpload,
-  Io as BahtWorkflow,
-  N as LEGACY_KEY_MAP,
-  b as MAX_SCRIPT_DEPTH,
-  Co as SSR_STASH,
-  io as TAG_FOR_TYPE,
-  Ro as adoptLightChildren,
-  l as applyFlags,
+  Wr as BahtAccordion,
+  gr as BahtAlert,
+  er as BahtAvatar,
+  tr as BahtBadge,
+  Vt as BahtBarChart,
+  Qr as BahtBreadcrumbs,
+  J as BahtButton,
+  Yr as BahtCard,
+  Ut as BahtChartBase,
+  st as BahtCheckbox,
+  pr as BahtCode,
+  pt as BahtCurrency,
+  gt as BahtDatepicker,
+  _t as BahtDonutChart,
+  Ro as BahtElement,
+  ro as BahtEmptyState,
+  oo as BahtErrorState,
+  uo as BahtFieldBase,
+  Gr as BahtFieldset,
+  Ct as BahtFile,
+  Fr as BahtFilter,
+  Io as BahtForm,
+  Yt as BahtHeatmap,
+  $r as BahtInput,
+  ao as BahtKeyvalueEditor,
+  Ot as BahtLineChart,
+  jr as BahtLink,
+  hr as BahtList,
+  Or as BahtLoadingOverlay,
+  Gt as BahtMeter,
+  sr as BahtModal,
+  ht as BahtMultiselect,
+  et as BahtNumber,
+  kr as BahtOtp,
+  lr as BahtPagination,
+  Ar as BahtProgress,
+  _r as BahtProgressRing,
+  dt as BahtRadio,
+  Dr as BahtRange,
+  Cr as BahtRating,
+  mo as BahtReferencePicker,
+  Bo as BahtRepeater,
+  Ft as BahtSection,
+  ft as BahtSelect,
+  br as BahtSkeleton,
+  At as BahtSparkline,
+  Vr as BahtSpinner,
+  bt as BahtStat,
+  Pt as BahtStatChart,
+  io as BahtSteps,
+  Pr as BahtSwipeRow,
+  fr as BahtTable,
+  lt as BahtTags,
+  kt as BahtText,
+  tt as BahtTextarea,
+  Ur as BahtTimeline,
+  dr as BahtToast,
+  St as BahtToggle,
+  Sr as BahtTooltip,
+  xo as BahtTypeahead,
+  Dt as BahtUpload,
+  yo as BahtWorkflow,
+  H as LEGACY_KEY_MAP,
+  A as MAX_SCRIPT_DEPTH,
+  Do as SSR_STASH,
+  no as TAG_FOR_TYPE,
+  Eo as adoptLightChildren,
+  s as applyFlags,
   a as approvalFields,
-  Kt as chartColor,
-  qt as chartSeqColor,
-  E as conditionRowRefs,
-  w as createScriptContext,
+  qt as chartColor,
+  Wt as chartSeqColor,
+  v as conditionRowRefs,
+  L as createScriptContext,
   o as defaultValue,
-  M as displayValue,
-  k as evalCondition,
-  y as evalValueExpr,
-  g as evaluate,
-  i as flagEnabled,
-  Ut as foldOther,
-  Y as formatIsoDate,
-  z as formatIsoDateTime,
-  Wt as formatValue,
-  n as getCatalog,
-  Do as hasDom,
-  A as hasScripts,
-  Eo as hasSsrMarkup,
-  G as isDateDisabled,
-  J as isIconName,
-  no as isIllustrationName,
-  Xt as linearScale,
-  jt as niceTicks,
-  O as normalizeLegacySchema,
+  N as displayValue,
+  F as evalCondition,
+  b as evalValueExpr,
+  C as evaluate,
+  n as flagEnabled,
+  Xt as foldOther,
+  G as formatIsoDate,
+  K as formatIsoDateTime,
+  jt as formatValue,
+  c as getCatalog,
+  ko as hasDom,
+  _ as hasScripts,
+  vo as hasSsrMarkup,
+  U as isDateDisabled,
+  Z as isIconName,
+  So as isIllustrationName,
+  h as isUnsafePattern,
+  Jt as linearScale,
+  Qt as niceTicks,
+  Y as normalizeLegacySchema,
   m as normalizeTagsValue,
-  K as parseDisabledEntry,
-  q as parseIsoDate,
-  U as parseIsoDateTime,
-  v as parseRowRef,
-  F as readRef,
-  Q as renderIcon,
-  co as renderIllustration,
-  Jt as renderTableTwin,
-  C as resolveNext,
-  h as resolveViewFields,
-  L as runScripts,
-  d as setCatalog,
-  c as setLocale,
-  S as t,
+  q as parseDisabledEntry,
+  W as parseIsoDate,
+  X as parseIsoDateTime,
+  I as parseRowRef,
+  P as readRef,
+  $ as renderIcon,
+  To as renderIllustration,
+  Zt as renderTableTwin,
+  D as resolveNext,
+  l as resolveViewFields,
+  M as runScripts,
+  S as setCatalog,
+  T as setLocale,
+  g as t,
   f as validateField,
-  R as walkPath
+  E as walkPath
 };

package/dist/web-types.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/JetBrains/web-types/master/schema/web-types.json",
   "name": "bank20baht-ui",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description-markup": "markdown",
   "contributions": {
     "html": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-ui",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "type": "module",
   "description": "JSON-driven form + workflow engine. Send JSON in, get an interactive form out.",
   "license": "MIT",