bank20baht-validator 0.2.0 → 0.3.0

package/README.md

@@ -56,6 +56,7 @@ step with the core version or the validator's `tsc` build resolves a stale copy
 - Value **shape** per field type before any validator runs — a `password`/`text` must be a string, a `number` a finite number, a `dropdown` one of its option keys — so `{"$gt":""}` from a raw API call is rejected, not treated as "non-empty".
 - **Workflow rules first** (`evaluate` from `bank20baht-ui/engine`): fields hidden by rules are excluded and smuggled values are cleared; `required` derived from rules is enforced; `setValue` results are computed.
 - Approval steps: a `decision` must be present, and the comment policy (`required` / `requireOnReject`) is honored.
+- **Client `submit` scripts** (spec 01 §14): re-run headlessly with the same `registry.scripts` — `g.setValue()` lands in canonical data, `g.addErrorMessage()` becomes an issue on `$` (`form_name.$` in a workflow), returning `false` blocks. `load` / `change` scripts are UI-only and never run here, so a field a client script hides is still validated: keep submit-relevant logic in rules or validators. `parseSchema` rejects a `scripts[]` entry with an unknown `on`, no `handler`, or a `change` hook on a field that does not exist.
 
 ## API
 

package/dist/index.js

@@ -13,7 +13,7 @@
 // every value must have the shape the UI control could actually emit before
 // the authored validators run.
 // ---------------------------------------------------------------------------
-import { applyFlags, approvalFields, defaultValue, evaluate, getCatalog, parseDisabledEntry, parseIsoDate, resolveViewFields, setCatalog, setLocale, t, validateField, walkPath, normalizeLegacySchema, } from 'bank20baht-ui/engine';
+import { applyFlags, approvalFields, createScriptContext, defaultValue, evaluate, hasScripts, runScripts, getCatalog, parseDisabledEntry, parseIsoDate, resolveViewFields, setCatalog, setLocale, t, validateField, walkPath, normalizeLegacySchema, } from 'bank20baht-ui/engine';
 /**
  * Run `fn` with the catalog switched to `locale`, restoring the previous
  * catalog after. The engine catalog is module-global; validation is fully
@@ -204,8 +204,51 @@ function formDataResult(form, input, registry) {
             issues.push({ ref: err.key, message: err.message });
         }
     }
+    issues.push(...submitScriptIssues(form, data, registry));
     return { valid: issues.length === 0, issues, data };
 }
+/**
+ * Re-run the form's `submit` client scripts (spec 01 §14) headlessly — the
+ * same gate `<baht-form>.validate()` applies after its validators. `load` and
+ * `change` scripts are UI-only and never run here. `g.setValue()` writes into
+ * canonical `data`; UI state/message calls are accepted and discarded, except
+ * `addErrorMessage()`, which becomes an issue on `$` (prefixed by the form name
+ * inside a workflow). A handler returning `false` with no message falls back to
+ * the catalog's `scriptBlocked`.
+ */
+function submitScriptIssues(form, data, registry, refPrefix = '') {
+    if (!hasScripts(form, 'submit'))
+        return [];
+    const messages = [];
+    const g = createScriptContext(form, {
+        getData: () => data,
+        setValue: (key, value) => {
+            data[key] = value;
+        },
+        setState: () => { },
+        resetState: () => { },
+        setFieldMessage: () => { },
+        addFormMessage: (m) => {
+            messages.push(m);
+        },
+        clearFormMessages: () => {
+            messages.length = 0;
+        },
+    });
+    const ok = runScripts({
+        form,
+        registry: registry ?? {},
+        g,
+        on: 'submit',
+        detail: { isLoading: false, data: { ...data } },
+    });
+    const issues = messages
+        .filter((m) => m.type === 'error')
+        .map((m) => ({ ref: `${refPrefix}$`, message: m.message }));
+    if (!ok && issues.length === 0)
+        issues.push({ ref: `${refPrefix}$`, message: t('scriptBlocked') });
+    return issues;
+}
 /**
  * Validate a whole workflow submission — mirrors what `<baht-workflow>`
  * enforces across its steps: rules are evaluated first (`evaluate`), invisible
@@ -297,6 +340,10 @@ function workflowDataResult(workflow, input, registry) {
                 issues.push({ ref, message: err.message });
             }
         }
+        if (hasScripts(form, 'submit')) {
+            const formData = (derived.data[form.form_name] ??= {});
+            issues.push(...submitScriptIssues(form, formData, registry, `${form.form_name}.`));
+        }
     }
     return { valid: issues.length === 0, issues, data: derived.data };
 }
@@ -372,6 +419,7 @@ export function parseSchema(json) {
             assertValidFields(f);
             assertValidViews(f);
             assertValidRepeaters(f);
+            assertValidScripts(f);
             if (f.view !== undefined && !f.views?.some((v) => v.name === f.view)) {
                 throw new Error(`step view ${JSON.stringify(f.view)} on ${f.form_name} matches no view`);
             }
@@ -422,6 +470,7 @@ export function parseSchema(json) {
         assertValidFields(parsed);
         assertValidViews(parsed);
         assertValidRepeaters(parsed);
+        assertValidScripts(parsed);
         return parsed;
     }
     throw new Error('missing workflow_id/forms/rules (workflow) or form_id/form_name/fields (form)');
@@ -683,6 +732,34 @@ function assertValidRepeaters(form) {
         }
     }
 }
+const SCRIPT_EVENTS = new Set(['load', 'change', 'submit']);
+/** `scripts[]` (spec 01 §14): known `on`, a handler name, and a real field for `change`. */
+function assertValidScripts(form) {
+    if (form.scripts === undefined)
+        return;
+    if (!Array.isArray(form.scripts)) {
+        throw new Error(`scripts must be an array on ${form.form_name}`);
+    }
+    const keys = new Set(form.fields.map((f) => f.key));
+    for (const s of form.scripts) {
+        if (!isRecord(s))
+            throw new Error(`invalid script on ${form.form_name}: expected an object`);
+        if (typeof s.on !== 'string' || !SCRIPT_EVENTS.has(s.on)) {
+            throw new Error(`invalid script on=${JSON.stringify(s.on)} on ${form.form_name}`);
+        }
+        if (typeof s.handler !== 'string' || s.handler === '') {
+            throw new Error(`script on ${form.form_name} needs a handler name`);
+        }
+        if (s.on === 'change') {
+            if (typeof s.field !== 'string' || s.field === '') {
+                throw new Error(`change script "${s.handler}" on ${form.form_name} needs a field`);
+            }
+            if (!keys.has(s.field)) {
+                throw new Error(`change script "${s.handler}" on ${form.form_name} targets unknown field ${JSON.stringify(s.field)}`);
+            }
+        }
+    }
+}
 function assertValidViews(form) {
     if (form.views === undefined)
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bank20baht-validator",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "description": "Runtime validation for bahtui form/workflow JSON — the exact engine rules the client runs, on the server.",
   "license": "MIT",
@@ -40,12 +40,12 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "bank20baht-ui": "^0.3.0",
+    "bank20baht-ui": "^0.5.0",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4"
   },
   "peerDependencies": {
-    "bank20baht-ui": ">=0.3.0 <0.4.0"
+    "bank20baht-ui": ">=0.5.0 <0.6.0"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",