bank20baht-validator 0.0.1 → 0.0.3

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { approvalFields, defaultValue, evaluate, validateField, type FormDefinition, type NestedData, type Registry, type WorkflowDefinition, type WorkflowForm } from 'bank20baht-ui/engine';
+import { approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, validateField, type FormDefinition, type NestedData, type Registry, type WorkflowDefinition, type WorkflowForm } from 'bank20baht-ui/engine';
 export type SchemaDefinition = FormDefinition | WorkflowDefinition;
 /** One violation. `ref` is the field key for forms, `formName.key` for workflows. */
 export interface ValidationIssue {
@@ -20,7 +20,9 @@ export declare function isFormDefinition(schema: unknown): schema is FormDefinit
 /**
  * Validate a standalone form submission — mirrors `<baht-form>.validate()`
  * with no derived field states: every non-label field, missing values fall
- * back to the field default before checking.
+ * back to the field default before checking. `form.views` are ignored here:
+ * views are client-side display only, the server always validates the full
+ * form (a view can never weaken a validation rule).
  */
 export declare function validateFormData(form: FormDefinition, input: unknown, registry?: Registry): ValidationResult;
 /**
@@ -44,5 +46,6 @@ export declare function validateSubmission(schema: SchemaDefinition, data: unkno
  * render. Throws with a human-readable message on bad input.
  */
 export declare function parseSchema(json: unknown): SchemaDefinition;
-export { approvalFields, defaultValue, evaluate, validateField };
+export { approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, validateField };
 export type { FormDefinition, NestedData, Registry, WorkflowDefinition, WorkflowForm };
+export type { FormViewSpec, Locale, MessageCatalog } from 'bank20baht-ui/engine';

package/dist/index.js

@@ -7,7 +7,7 @@
 // request that bypasses the frontend hits the exact same rules — no codegen,
 // no recompile: swap the stored JSON and validation follows.
 // ---------------------------------------------------------------------------
-import { approvalFields, defaultValue, evaluate, validateField, } from 'bank20baht-ui/engine';
+import { approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, t, validateField, } from 'bank20baht-ui/engine';
 export function isWorkflowDefinition(schema) {
     return (isRecord(schema) &&
         typeof schema['workflowId'] === 'string' &&
@@ -30,20 +30,23 @@ function sorted(fields) {
 /**
  * Validate a standalone form submission — mirrors `<baht-form>.validate()`
  * with no derived field states: every non-label field, missing values fall
- * back to the field default before checking.
+ * back to the field default before checking. `form.views` are ignored here:
+ * views are client-side display only, the server always validates the full
+ * form (a view can never weaken a validation rule).
  */
 export function validateFormData(form, input, registry) {
     if (!isRecord(input)) {
         return { valid: false, issues: [{ ref: '$', message: 'data must be an object' }], data: {} };
     }
     const issues = [];
+    const fields = sorted(form.field_data).filter((f) => f.type !== 'label');
+    // canonical data first, so compare validators see every sibling
     const data = {};
-    for (const field of sorted(form.field_data)) {
-        if (field.type === 'label')
-            continue;
-        const value = field.key in input ? input[field.key] : defaultValue(field);
-        data[field.key] = value;
-        for (const err of validateField(field, value, registry)) {
+    for (const field of fields) {
+        data[field.key] = field.key in input ? input[field.key] : defaultValue(field);
+    }
+    for (const field of fields) {
+        for (const err of validateField(field, data[field.key], registry, data)) {
             issues.push({ ref: err.key, message: err.message });
         }
     }
@@ -87,8 +90,8 @@ export function validateWorkflowData(workflow, input, registry) {
                 continue; // hidden fields excluded (spec 02 §5)
             const required = state ? state.required : !!field.required;
             const descriptor = required === !!field.required ? field : { ...field, required };
-            const value = derived.data[form.formName]?.[field.key];
-            for (const err of validateField(descriptor, value, registry)) {
+            const formData = derived.data[form.formName] ?? {};
+            for (const err of validateField(descriptor, formData[field.key], registry, formData)) {
                 issues.push({ ref, message: err.message });
             }
         }
@@ -101,12 +104,12 @@ function approvalIssues(form, data) {
     const values = data[form.formName] ?? {};
     const decision = values['decision'];
     if (decision !== 'approved' && decision !== 'rejected') {
-        issues.push({ ref: `${form.formName}.decision`, message: 'A decision is required.' });
+        issues.push({ ref: `${form.formName}.decision`, message: t('decisionRequired') });
     }
     const mode = form.approval?.comment ?? 'optional';
     const commentRequired = mode === 'required' || (mode === 'requireOnReject' && decision === 'rejected');
     if (commentRequired && String(values['comment'] ?? '').trim() === '') {
-        issues.push({ ref: `${form.formName}.comment`, message: 'A comment is required.' });
+        issues.push({ ref: `${form.formName}.comment`, message: t('commentRequired') });
     }
     return issues;
 }
@@ -145,6 +148,11 @@ export function parseSchema(json) {
             if (f.kind !== undefined && f.kind !== 'form' && f.kind !== 'approval') {
                 throw new Error(`invalid form kind ${JSON.stringify(f.kind)} on ${f.formName}`);
             }
+            assertValidViews(f);
+            assertValidRepeaters(f);
+            if (f.view !== undefined && !f.views?.some((v) => v.name === f.view)) {
+                throw new Error(`step view ${JSON.stringify(f.view)} on ${f.formName} matches no view`);
+            }
         }
         const names = parsed.forms.map((f) => f.formName);
         if (new Set(names).size !== names.length) {
@@ -152,10 +160,62 @@ export function parseSchema(json) {
         }
         return parsed;
     }
-    if (isFormDefinition(parsed))
+    if (isFormDefinition(parsed)) {
+        assertValidViews(parsed);
+        assertValidRepeaters(parsed);
         return parsed;
+    }
     throw new Error('missing workflowId/forms/rules (workflow) or formId/formName/field_data (form)');
 }
+/**
+ * View integrity — views are client-side display projections, but a stored
+ * one must always resolve on the client: names unique and shaped right, every
+ * listed key present in field_data. Catches builder typos at store time
+ * instead of as a silently empty form.
+ */
+/**
+ * Repeater integrity (spec 01 §10): a repeater must carry sub-fields with
+ * unique keys, and repeaters never nest.
+ */
+function assertValidRepeaters(form) {
+    for (const field of form.field_data) {
+        if (field.type !== 'repeater')
+            continue;
+        if (!Array.isArray(field.fields) || field.fields.length === 0) {
+            throw new Error(`repeater ${JSON.stringify(field.key)} on ${form.formName} needs fields[]`);
+        }
+        const keys = field.fields.map((f) => f.key);
+        if (new Set(keys).size !== keys.length) {
+            throw new Error(`repeater ${JSON.stringify(field.key)} on ${form.formName} has duplicate sub-keys`);
+        }
+        if (field.fields.some((f) => f.type === 'repeater')) {
+            throw new Error(`repeater ${JSON.stringify(field.key)} on ${form.formName} nests a repeater`);
+        }
+    }
+}
+function assertValidViews(form) {
+    if (form.views === undefined)
+        return;
+    if (!Array.isArray(form.views))
+        throw new Error(`views must be an array on ${form.formName}`);
+    const keys = new Set(form.field_data.map((f) => f.key));
+    const names = new Set();
+    for (const view of form.views) {
+        if (!isRecord(view) || typeof view.name !== 'string' || !Array.isArray(view.fields)) {
+            throw new Error(`invalid view on ${form.formName}: expected { name, fields[] }`);
+        }
+        if (names.has(view.name)) {
+            throw new Error(`view names must be unique on ${form.formName}: ${JSON.stringify(view.name)}`);
+        }
+        names.add(view.name);
+        for (const key of view.fields) {
+            if (typeof key !== 'string' || !keys.has(key)) {
+                throw new Error(`view ${JSON.stringify(view.name)} on ${form.formName} references unknown field ${JSON.stringify(key)}`);
+            }
+        }
+    }
+}
 // Re-exported so servers can type stores and registries without a direct
-// dependency on bank20baht-ui.
-export { approvalFields, defaultValue, evaluate, validateField };
+// dependency on bank20baht-ui. `setLocale` localizes the issues this package
+// emits (same catalog the client renders).
+export { approvalFields, defaultValue, evaluate, resolveViewFields, setLocale, validateField };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-validator",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "type": "module",
   "description": "Runtime validation for bahtui form/workflow JSON — the exact engine rules the client runs, on the server.",
   "license": "MIT",
@@ -39,7 +39,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "bank20baht-ui": "^0.0.6"
+    "bank20baht-ui": "^0.0.8"
   },
   "devDependencies": {
     "typescript": "^5.8.3",