formstand 0.22.0 → 0.22.1

package/CHANGELOG.md

@@ -1,5 +1,176 @@
 # Changelog
 
+## 0.22.1 — 2026-10-22
+
+### Fixed
+
+- Nested `useFieldArray` row ids survive an outer reorder. Inner ids are
+  stored per path (`teams.0.members`), so an outer `move`, `swap`, `remove`,
+  `insert`, or whole-array write left the entry at `teams.2.members` meeting
+  team A's members with team C's history: the same-index fallback handed the
+  first rows the other team's ids, the rest reminted, and React remounted
+  inputs a user may have been typing in. The outer hook now re-seats every
+  descendant path's id entry to follow its row (by id, so an exact op
+  mapping and a by-value reconciliation re-seat the same way), and drops the
+  entries of a removed row's slot. Inner-only trees that reorder the outer
+  array imperatively keep the value fallback.
+
+### Docs
+
+- Field arrays: the array-op revalidation sentence now matches the gate.
+  Ops run under the change trigger, so in the default `onBlur` mode (and
+  `onSubmit`) they stay silent until the first failed submit switches to
+  `reValidateMode`; `onTouched` needs the array path itself touched;
+  `onChange` and `all` revalidate at once. A "Render cost" note says the
+  hook re-renders its caller on every keystroke in any row and how to
+  keep rows cheap.
+- Persistence: a loaded draft is adopted without validation, so a draft
+  that fails the schema reads valid until something validates;
+  `validateOnMount` runs before `persistForm` applies the draft and does
+  not cover it, so call `form.validate()` after the load.
+- `useFormValues` re-renders on every keystroke anywhere in the form; keep
+  it out of per-row components.
+- A `"use server"` action must parse `data` with the schema on the server
+  on every path, not only the no-JS one.
+- Masked inputs: `"empty"` writes `emptyValue` for clearable and non-string
+  fields and `""` for a required string, as the 0.22.0 binding does.
+- Components: the `SelectField` props row names the real option type, and
+  the guide states the by-value `path` rule (`TextField` on a `z.number()`
+  is a compile error) that the API page already had.
+- CLI: the schema module and `formstand.config.ts` are executed through
+  jiti, so point the CLI only at files you would run with `node`; the
+  overview names all three inputs.
+- Snippets import every name they use (`Form`, `FormStateApi`,
+  `createForm`, `textInputProps`); the `onSubmit` snippet is in a tsx
+  fence; `fillFields` is documented as typed per key.
+- A "Security notes" section on validation.md collects server
+  re-validation, untrusted drafts, and the CLI executing modules, with
+  links to the sections that hold the detail.
+- Roadmap: `--path-depth` moves to the shipped list. The remaining em
+  dashes in the roadmap and the VitePress theme comments are reworded.
+- Playground: every demo is a lazy chunk. The main bundle drops from
+  2.95 MB (779 kB gzip) to 381 kB (116 kB gzip) and the main stylesheet
+  from 601 kB to 34 kB; each tab's component, kit and stylesheet load on
+  first visit, and the View code panel fetches source text on demand
+  behind a static file tree. Mantine's sheet loads as its `@layer` variant
+  so the shell's unlayered rules keep winning regardless of load order.
+- Playground: the Conditional demo is a `z.discriminatedUnion` bound with
+  `useField` for the discriminant and `useVariantField` for the branch
+  fields, and the payload carries only the active branch (the flat version
+  submitted the hidden card number alongside the bank fields).
+- Playground: the hand-rolled demos wire each error line to its input
+  (`aria-describedby`, `aria-invalid`, `aria-live`) through one shared
+  helper and focus the first errored control after a failed submit; the
+  View state / View code toggles expose `aria-pressed`; the MUI Invoice,
+  shadcn Team and shadcn Onboarding contact rows label their
+  placeholder-only cells.
+- Playground: the Autosave status reads "Draft restored" after a restore
+  instead of "Unsaved changes"; the Schema builder's Zod paste tab says
+  that pasted code runs in the page and its View code list includes
+  `ImportModal.tsx` and `parseZod.ts`; the Perf demo's inputs follow the
+  theme; the light theme's eyebrow (6.76:1) and muted text (4.88:1) clear
+  the AA floor; the theme preference is written only when the user
+  toggles, so a docs visitor's "auto" survives opening the playground.
+- Playground: the Onboarding module's field files, its emergency-contact
+  rows, and the CLI command builder wire each error line to its control
+  through the shared `fieldA11y` helper, like the other hand-rolled
+  demos since 0.22.0; the contacts array's own error line is a live
+  region. The command builder's file set ships the helper, so it opens
+  in StackBlitz.
+- Playground: the generated kitchen sink's input schema carries human
+  messages on every check, so an empty submit no longer shows zod's raw
+  messages, and the regenerated plain output carries the CLI's new aria
+  wiring. `examples/src` is now linted with the library's rule set.
+
+## formstand-cli 0.24.0 — 2026-10-20
+
+### Added
+
+- `--no-live` and `--no-form-prop`: an explicit flag turns the mode off for
+  one run when the config file sets `live: true` / `formProp: true`. Before,
+  nothing could override a configured mode (`--no-live` was an unknown
+  flag).
+- JSON Schema mode carries `pattern` and `multipleOf` into the generated
+  validator, as `.regex(new RegExp("..."))` and `.multipleOf(n)`. A pattern
+  JavaScript's `RegExp` refuses degrades to a TODO instead of a module that
+  throws on load. Both, and any `format` outside email/uri/uuid/date, are
+  recorded as unmodeled checks, so the generated spec skips its blind round
+  trip over them and `--tests` warns on stderr; they were dropped silently
+  before. The IR gains `StringChecks.regex` and `NumberChecks.multipleOf`.
+- Type mode walks intersections (`A & B`, the merged member set, later wins
+  on a collision, a TODO where two members disagree on a key) and
+  discriminated unions of object types sharing a string-literal key, to
+  the same IR union the zod and JSON Schema walks produce. A union of
+  numeric literals names the string-only enum as its reason instead of
+  "unsupported union type".
+
+### Fixed
+
+- Type mode had no recursion guard: `type Tree = { value: string; left?:
+  Tree; right?: Tree }` expanded to the depth budget (6142 IR nodes, a
+  188 KB file, 518 module files). The walk tracks the declared types on the
+  current path and cuts a repeat with a "recursive type" TODO, the way the
+  zod walker treats its getter idiom. A member typed as the global
+  `Function` (no call signature of its own) walked Function.prototype to
+  the budget; it now degrades like a method.
+- `--type someConst` (a value, not a type) generated an "any" TODO form; it
+  is now an error naming the symbol kind. An index signature beside named
+  members (`{ a: string; [k: string]: string }`) was dropped without a
+  trace; the members bind and a TODO sits on the section, mirrored on
+  stderr and above the generated schema.
+- OpenAPI 3.0 idioms in JSON Schema mode: `{ $ref, nullable: true }` was
+  not nullable (the ref walk returned before the flag applied);
+  `{ allOf: [{ $ref }], nullable: true }` lost the outer keywords in the
+  merge; `allOf: [{ $ref: StringEnum }]` (the 3.0 way to annotate a ref)
+  was "allOf with non-object branches"; `enum: ["a", "b", null]` with
+  `nullable: true` (3.0) or `type: ["string", "null"]` (3.1) was a
+  "non-string enum" TODO; an `allOf` branch that is itself an `allOf`, and
+  `$ref` chains, degraded; `#/$defs/My%20Type` was not percent-decoded.
+  All six now walk to the expected IR, and a self-referring `allOf` branch
+  is named in its TODO.
+- Draft-04 `exclusiveMinimum: true` / `exclusiveMaximum: true` beside
+  `minimum` / `maximum` silently read as an inclusive bound; the flag now
+  makes the bound exclusive.
+- An empty enum list (`enum: []` in a document, `z.enum([])` in a schema,
+  which zod constructs and then rejects every value for) emitted a select
+  with no option; it degrades to a TODO in both walkers.
+- `--out some/dir/` (a trailing separator, or an existing directory) in the
+  single-file layout wrote a file literally named after the folder, or
+  refused to "overwrite" it. It is refused with an error that says to name
+  a `.tsx` file or use `--layout module`.
+- `--name profileForm` passed validation and the generated spec rendered
+  `<profileForm />`, which JSX reads as a DOM tag; the name must now start
+  with an uppercase letter.
+- `--force` over a module folder left the previous run's files in place
+  silently (a removed section's `sections/GoneSection.tsx` survived and
+  still compiled). Files that carry the generator header on their first
+  line and are not in the new set are now named on stderr as
+  `warning: stale: <path>`, so the leftover is visible. They are not
+  deleted: the header says the file is yours to edit, and a folder can hold
+  a single-file component from another run under the same header, so
+  removal is left to you.
+- `--schema constructor` (or `toString`, `__proto__`) resolved a prototype
+  member of the component store and generated a degraded form named after
+  it; lookups and pointer segments use own keys only, so it reports "no
+  schema named".
+- A string-literal export name (`export { inner as "my schema" }`) emitted
+  `import { my schema } from ...`; it is refused with the rule, for an
+  explicit `--export` and for the sole-export fallback.
+- The generated spec's blank-submit case picked its control among the
+  blank-invalid fields only, so a required "Age" beside an optional "Age"
+  in another section made `getByLabelText` throw. Uniqueness is now judged
+  against every label the blank render shows, for the label fills too.
+- **The plain backend's error lines are described to their controls.** The
+  in-file `AutocompleteField`, `TextareaField`, `PlaceholderField` and
+  `EnumSelectField`, the union variant leaves, and the module layout's field
+  files and array rows emitted a bare `<p role="alert">` with no id and a
+  control with no `aria-describedby`, so assistive tech heard the field but
+  never its message. The error line now owns `${field.path}-error` and the
+  control points at it while the error shows (the same runtime derivation
+  the autocomplete datalist id already used, unique per array row with no
+  `useId`); `aria-invalid` keeps coming from the prop builders. The kit
+  backends were already wired through their own components.
+
 ## 0.22.0 — 2026-10-19
 
 ### Fixed

package/dist/index.cjs

@@ -1937,10 +1937,13 @@ var mappedIdState = (prev, mapping, liveItems) => {
 };
 var MAX_ID_PATHS = 4096;
 var sharedIdEntries = /* @__PURE__ */ new WeakMap();
-var sharedIdEntry = (store, path) => {
-  const existingStore = sharedIdEntries.get(store);
-  const forStore = existingStore ?? { byPath: /* @__PURE__ */ new Map(), seq: 1 };
-  if (existingStore === void 0) sharedIdEntries.set(store, forStore);
+var storeIdEntries = (store) => {
+  const existing = sharedIdEntries.get(store);
+  const forStore = existing ?? { byPath: /* @__PURE__ */ new Map(), seq: 1 };
+  if (existing === void 0) sharedIdEntries.set(store, forStore);
+  return forStore;
+};
+var sharedIdEntry = (forStore, path) => {
   const existing = forStore.byPath.get(path);
   if (existing !== void 0) {
     forStore.byPath.delete(path);
@@ -1970,12 +1973,40 @@ var walkOps = (start, items, ops) => {
   }, start);
   return walked.items === items ? walked : reconcileIds(walked, items);
 };
+var reseatDescendants = (forStore, path, prev, next) => {
+  if (prev.ids.length === 0) return;
+  const newIndexById = new Map(next.ids.map((id, i) => [id, i]));
+  const moves = prev.ids.map((id) => newIndexById.get(id));
+  if (moves.every((to, from) => to === from)) return;
+  const prefix = `${path}.`;
+  const descendants = [...forStore.byPath.keys()].filter(
+    (key) => key.startsWith(prefix)
+  );
+  const relocations = descendants.flatMap((key) => {
+    const rest = key.slice(prefix.length);
+    const dot = rest.indexOf(".");
+    const segment = dot === -1 ? rest : rest.slice(0, dot);
+    const from = Number(segment);
+    if (!/^\d+$/.test(segment) || from >= prev.ids.length) return [];
+    const entry = forStore.byPath.get(key);
+    if (entry === void 0) return [];
+    const to = moves[from];
+    const target = to === void 0 ? void 0 : `${prefix}${to}${dot === -1 ? "" : rest.slice(dot)}`;
+    return [{ key, target, entry }];
+  });
+  relocations.forEach(({ key }) => forStore.byPath.delete(key));
+  relocations.forEach(({ target, entry }) => {
+    if (target !== void 0) forStore.byPath.set(target, entry);
+  });
+};
 var deriveIds = (store, path, items) => {
-  const entry = sharedIdEntry(store, path);
+  const forStore = storeIdEntries(store);
+  const entry = sharedIdEntry(forStore, path);
   if (entry.state.items === items) return entry.state;
   const ops = arrayOpsFor(store, path);
   if (ops.length > 0) clearArrayOps(store, path);
   const next = walkOps(entry.state, items, ops);
+  reseatDescendants(forStore, path, entry.state, next);
   entry.state = next;
   return next;
 };