react-intl-number-input 0.8.5 → 0.9.0

package/CHANGELOG.md

@@ -1,131 +1,183 @@
-# Changelog
-
-All notable changes to this project are documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [0.8.5] - 2026-09-03
-
-### Fixed
-
-- Finalized demo and build scripts migration to TypeScript.
-- Corrected package entry points for better ESM compatibility.
-
-## [0.8.4] - 2026-09-03
-
-### Fixed
-
-- Attempted publish (version skipped due to registry timeout).
-
-## [0.8.3] - 2026-09-03
-
-### Added
-
-- Dual build support: the package now ships both CommonJS (`dist/index.js`) and ESM (`dist/esm/index.js`) versions.
-- Sourcemaps with inline sources included in the package for better debugging experience.
-- `CHANGELOG.md` and `CONTRIBUTING.md` are now included in the npm package.
-- `engines` field added to `package.json` specifying Node.js >= 20.
-- Proper accessibility support: the input now has `role="spinbutton"` and relevant `aria-valuenow`, `aria-valuemin`, and `aria-valuemax` attributes.
-- Full `forwardRef` support: `ref` now correctly points to the underlying `<input>` element and supports imperative methods via `useImperativeHandle`.
-- Demo and build scripts migrated to TypeScript and modern ES modules.
-
-### Changed
-
-- Improved cursor management: typing within the masked input now correctly preserves the cursor position instead of jumping to the end.
-- Enhanced synthetic events: `onChange` events triggered by step buttons or `setValue` now include more standard event properties (`currentTarget`, `persist`, etc.) for better compatibility.
-- Build process updated to use multiple `tsc` configurations for CJS and ESM.
-- `package.json` `exports` updated to support modern ESM resolution while maintaining CJS compatibility.
-
-## [0.8.2] - 2026-08-15
-
-This is a maintainer/toolchain release. The published component API, peer dependency (`react >=16.8.0 <20`), and CommonJS entry are unchanged.
-
-### Security
-
-- Pinned transitive `js-yaml` to `4.3.1` ([GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj))
-
-### Changed
-
-- Replaced the Babel + Webpack toolchain with TypeScript (`tsc`) for the library and esbuild for the demo
-- Dropped the `fast-uri` override (it only existed for webpack-dev-server)
-- Contributor Node.js requirement is now 20+ (no longer tied to Babel 8)
-
-## [0.8.1] - 2026-08-13
-
-### Changed
-
-- Updated development dependencies: React `19.2.8`, webpack `5.109.2`, webpack-cli `7.2.2`, html-webpack-plugin `5.6.8`, `@types/react` `19.2.18`
-- Upgraded `@testing-library/jest-dom` from `6.9.1` to `7.0.1`
-
-## [0.8.0] - 2026-07-27
-
-### Added
-
-- `renderControls` render prop with exported `ControlsRenderProps` for custom stepper UI (`increment`, `decrement`, `setValue`, bounds, and formatted value)
-
-### Changed
-
-- Step increments now use display units: `step={1}` with `precision={2}` adds `0.01` (previously added `100` to the numeric value)
-- `renderControls` renders the input and controls as siblings without an opinionated wrapper — layout is controlled by the consumer
-- When both `renderControls` and `showStepButtons` are set, `renderControls` takes precedence
-- Development toolchain upgraded: Babel 8, TypeScript 7, Webpack 5.108, webpack-cli 7.2, webpack-dev-server 6
-- Babel config updated for Babel 8 defaults (`modules: "commonjs"`, classic JSX runtime) so the published CJS build remains compatible with React 16.8+
-- Contributor Node.js requirement updated to `^22.18.0 || >=24.11.0` (Babel 8)
-
-### Fixed
-
-- Step buttons and custom controls now read the numeric value from an internal ref instead of re-parsing the masked string (fixes incorrect steps with prefix/suffix or locale formatting)
-- Controlled `value` prop updates now apply `minValue`/`maxValue` clamping before formatting
-- Resolved transitive security advisories in the dev dependency tree (`npm audit` clean)
-
-## [0.7.0] - 2026-06-20
-
-### Added
-
-- TypeScript source and published type declarations (`IntlNumberInputProps`)
-- `forwardRef` support for the underlying `<input>`
-- Standard HTML input attribute passthrough (`onFocus`, `aria-*`, `data-*`, `autoComplete`, etc.)
-- Step buttons (`showStepButtons`, `step`)
-- `minValue` / `maxValue` constraints
-- `onBlur` callback
-- `inputMode` prop
-- Prefix/suffix HTML sanitization
-- Redesigned interactive demo page with labeled examples and independent state
-- `CONTRIBUTING.md` and `CHANGELOG.md` documentation
-
-### Changed
-
-- Migrated from JSX to TypeScript
-- Removed runtime `prop-types` dependency (TypeScript types are the source of truth)
-- `onBlur` now returns clamped numeric values consistent with `onChange`
-- Prefix/suffix sanitization is SSR-safe (no `document` access)
-- `peerDependencies` now require only `react` (not `react-dom`)
-- Split consumer and maintainer documentation (`README.md`, `CONTRIBUTING.md`)
-
-### Fixed
-
-- SSR crash when rendering on the server
-- `onBlur` returning unclamped values while display was clamped
-
-## [0.6.0] - 2025
-
-### Changed
-
-- Updated build toolchain to Babel 7 and Webpack 5
-- Added Jest test suite
-- Updated demo to React 19
-- Security updates for vulnerable dependencies
-
-## [0.5.0] and earlier
-
-See [git history](https://github.com/nandorip/react-intl-number-input/commits/master) for changes prior to 0.6.0.
-
-[Unreleased]: https://github.com/nandorip/react-intl-number-input/compare/v0.8.2...HEAD
-[0.8.2]: https://github.com/nandorip/react-intl-number-input/compare/v0.8.1...v0.8.2
-[0.8.1]: https://github.com/nandorip/react-intl-number-input/compare/v0.8.0...v0.8.1
-[0.8.0]: https://github.com/nandorip/react-intl-number-input/compare/v0.7.0...v0.8.0
-[0.7.0]: https://github.com/nandorip/react-intl-number-input/compare/v0.6.0...v0.7.0
-[0.6.0]: https://github.com/nandorip/react-intl-number-input/releases/tag/v0.6.0
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.9.0] - 2026-10-13
+
+### Added
+
+- Opt-in `controlled` mode that keeps the parent's `value` authoritative when edits are rejected. The default preserves historical optimistic editing.
+- Optional `readOnly` information for custom controls and formatted `aria-valuetext`.
+- Regression tests, library/demo type checking, installed npm tarball checks for CJS, ESM, types, SSR and DOM interactions, and a React 16.8–19 CI compatibility matrix.
+
+### Fixed
+
+- Keep numeric state, formatted text, custom controls and accessibility attributes synchronized when values, bounds, locale or precision change.
+- Avoid rescaling existing numeric state on blur after a precision change.
+- Parse Han decimal and supplementary-plane digits and preserve localized caret positions.
+- Preserve amounts when editing numeric prefixes or suffixes.
+- Enforce `readOnly` for built-in and custom controls.
+- Avoid decimal stepping accumulation within JavaScript's safe integer range.
+- Supply actual input elements and consistent event methods in programmatic change callbacks.
+- Build artifacts during `prepack` and validate the package before publication.
+- Correct README examples, Node.js requirements and the demo's currency hint and accessible input names.
+
+### Changed
+
+- Extract pure numeric helpers while retaining public callback signatures, scaled step units, implied-decimal string values, zero-on-clear behavior and existing element layout.
+- Use `gh-pages` 6.1.1 to avoid the development-only `braces` vulnerability in the newer dependency chain; the demo deployment command is unchanged.
+- Add `npm run release` and a GitHub Actions workflow that publishes with provenance.
+
+## [0.8.7] - 2026-10-01
+
+### Fixed
+
+- Initialize the internal numeric value within `minValue` and `maxValue` bounds so the displayed value, accessibility attributes, and custom controls agree on the first render.
+- Ignore digits in configured prefixes and suffixes when parsing edits.
+- Parse locale-specific digits such as Arabic-Indic numerals.
+- Prevent custom `setValue` controls from changing disabled inputs or accepting non-finite values.
+
+### Added
+
+- Keyboard stepping with Arrow Up and Arrow Down; hold Shift to adjust by ten steps.
+
+## [0.8.6] - 2026-09-23
+
+This is a maintainer/toolchain release. The published component API is unchanged.
+
+### Security
+
+- Bumped transitive `js-yaml` override to `4.3.2` ([GHSA-2883-xcg3-v3hh](https://github.com/advisories/GHSA-2883-xcg3-v3hh))
+
+### Changed
+
+- Updated development dependencies: React `19.3.0`, Jest `30.5.2`, `@testing-library/react` `16.3.3`, `@types/react` `19.3.0`
+- Allowed install scripts for `esbuild` and `unrs-resolver` via `allowScripts`
+
+## [0.8.5] - 2026-09-03
+
+### Fixed
+
+- Finalized demo and build scripts migration to TypeScript.
+- Corrected package entry points for better ESM compatibility.
+
+## [0.8.4] - 2026-09-03
+
+### Fixed
+
+- Attempted publish (version skipped due to registry timeout).
+
+## [0.8.3] - 2026-09-03
+
+### Added
+
+- Dual build support: the package now ships both CommonJS (`dist/index.js`) and ESM (`dist/esm/index.js`) versions.
+- Sourcemaps with inline sources included in the package for better debugging experience.
+- `CHANGELOG.md` and `CONTRIBUTING.md` are now included in the npm package.
+- `engines` field added to `package.json` specifying Node.js >= 20.
+- Proper accessibility support: the input now has `role="spinbutton"` and relevant `aria-valuenow`, `aria-valuemin`, and `aria-valuemax` attributes.
+- Full `forwardRef` support: `ref` now correctly points to the underlying `<input>` element and supports imperative methods via `useImperativeHandle`.
+- Demo and build scripts migrated to TypeScript and modern ES modules.
+
+### Changed
+
+- Improved cursor management: typing within the masked input now correctly preserves the cursor position instead of jumping to the end.
+- Enhanced synthetic events: `onChange` events triggered by step buttons or `setValue` now include more standard event properties (`currentTarget`, `persist`, etc.) for better compatibility.
+- Build process updated to use multiple `tsc` configurations for CJS and ESM.
+- `package.json` `exports` updated to support modern ESM resolution while maintaining CJS compatibility.
+
+## [0.8.2] - 2026-08-15
+
+This is a maintainer/toolchain release. The published component API, peer dependency (`react >=16.8.0 <20`), and CommonJS entry are unchanged.
+
+### Security
+
+- Pinned transitive `js-yaml` to `4.3.1` ([GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj))
+
+### Changed
+
+- Replaced the Babel + Webpack toolchain with TypeScript (`tsc`) for the library and esbuild for the demo
+- Dropped the `fast-uri` override (it only existed for webpack-dev-server)
+- Contributor Node.js requirement is now 20+ (no longer tied to Babel 8)
+
+## [0.8.1] - 2026-08-13
+
+### Changed
+
+- Updated development dependencies: React `19.2.8`, webpack `5.109.2`, webpack-cli `7.2.2`, html-webpack-plugin `5.6.8`, `@types/react` `19.2.18`
+- Upgraded `@testing-library/jest-dom` from `6.9.1` to `7.0.1`
+
+## [0.8.0] - 2026-07-27
+
+### Added
+
+- `renderControls` render prop with exported `ControlsRenderProps` for custom stepper UI (`increment`, `decrement`, `setValue`, bounds, and formatted value)
+
+### Changed
+
+- Step increments now use display units: `step={1}` with `precision={2}` adds `0.01` (previously added `100` to the numeric value)
+- `renderControls` renders the input and controls as siblings without an opinionated wrapper — layout is controlled by the consumer
+- When both `renderControls` and `showStepButtons` are set, `renderControls` takes precedence
+- Development toolchain upgraded: Babel 8, TypeScript 7, Webpack 5.108, webpack-cli 7.2, webpack-dev-server 6
+- Babel config updated for Babel 8 defaults (`modules: "commonjs"`, classic JSX runtime) so the published CJS build remains compatible with React 16.8+
+- Contributor Node.js requirement updated to `^22.18.0 || >=24.11.0` (Babel 8)
+
+### Fixed
+
+- Step buttons and custom controls now read the numeric value from an internal ref instead of re-parsing the masked string (fixes incorrect steps with prefix/suffix or locale formatting)
+- Controlled `value` prop updates now apply `minValue`/`maxValue` clamping before formatting
+- Resolved transitive security advisories in the dev dependency tree (`npm audit` clean)
+
+## [0.7.0] - 2026-06-20
+
+### Added
+
+- TypeScript source and published type declarations (`IntlNumberInputProps`)
+- `forwardRef` support for the underlying `<input>`
+- Standard HTML input attribute passthrough (`onFocus`, `aria-*`, `data-*`, `autoComplete`, etc.)
+- Step buttons (`showStepButtons`, `step`)
+- `minValue` / `maxValue` constraints
+- `onBlur` callback
+- `inputMode` prop
+- Prefix/suffix HTML sanitization
+- Redesigned interactive demo page with labeled examples and independent state
+- `CONTRIBUTING.md` and `CHANGELOG.md` documentation
+
+### Changed
+
+- Migrated from JSX to TypeScript
+- Removed runtime `prop-types` dependency (TypeScript types are the source of truth)
+- `onBlur` now returns clamped numeric values consistent with `onChange`
+- Prefix/suffix sanitization is SSR-safe (no `document` access)
+- `peerDependencies` now require only `react` (not `react-dom`)
+- Split consumer and maintainer documentation (`README.md`, `CONTRIBUTING.md`)
+
+### Fixed
+
+- SSR crash when rendering on the server
+- `onBlur` returning unclamped values while display was clamped
+
+## [0.6.0] - 2025
+
+### Changed
+
+- Updated build toolchain to Babel 7 and Webpack 5
+- Added Jest test suite
+- Updated demo to React 19
+- Security updates for vulnerable dependencies
+
+## [0.5.0] and earlier
+
+See [git history](https://github.com/nandorip/react-intl-number-input/commits/master) for changes prior to 0.6.0.
+
+[Unreleased]: https://github.com/nandorip/react-intl-number-input/compare/v0.8.2...HEAD
+[0.8.2]: https://github.com/nandorip/react-intl-number-input/compare/v0.8.1...v0.8.2
+[0.8.1]: https://github.com/nandorip/react-intl-number-input/compare/v0.8.0...v0.8.1
+[0.8.0]: https://github.com/nandorip/react-intl-number-input/compare/v0.7.0...v0.8.0
+[0.7.0]: https://github.com/nandorip/react-intl-number-input/compare/v0.6.0...v0.7.0
+[0.6.0]: https://github.com/nandorip/react-intl-number-input/releases/tag/v0.6.0

package/CONTRIBUTING.md

@@ -1,120 +1,145 @@
-# Contributing
-
-Thank you for your interest in contributing to `react-intl-number-input`.
-
-## Requirements
-
-- Node.js 20+ (recommended: current Active LTS)
-- npm 10+
-
-These versions are required to build and test the library. Consumers of the published npm package are not constrained by this.
-
-## Getting started
-
-```bash
-git clone https://github.com/nandorip/react-intl-number-input.git
-cd react-intl-number-input
-npm install
-```
-
-## Local development
-
-Start the demo app with live rebuild:
-
-```bash
-npm start
-```
-
-Open [http://localhost:3001](http://localhost:3001). The demo lives in `example/` and imports the component from `src/`.
-
-## Scripts
-
-| Command | Description |
-| --- | --- |
-| `npm start` | esbuild dev server for the demo |
-| `npm test` | Run unit tests with Jest |
-| `npm run build:lib` | Compile `src/` to CommonJS, ESM, and types in `dist/` |
-| `npm run build` | Build the demo bundle in `example/dist` |
-| `npm run publish-demo` | Build and deploy the demo to GitHub Pages |
-
-## Project structure
-
-```
-src/           Library source (TypeScript)
-dist/          Published build output (generated, not committed)
-example/       Demo app and GitHub Pages bundle
-```
-
-The npm package ships `dist/`, `README.md`, `LICENSE`, `CHANGELOG.md`, and `CONTRIBUTING.md` (see `files` in `package.json`).
-
-## Testing
-
-Run the full test suite before opening a pull request:
-
-```bash
-npm test
-```
-
-Tests live alongside the source in `src/index.test.tsx`.
-
-## Building the library
-
-To produce the publishable artifacts locally:
-
-```bash
-npm run build:lib
-```
-
-This generates:
-
-- `dist/index.js` — CommonJS build (`tsc`)
-- `dist/esm/index.js` — ESM build (`tsc`)
-- `dist/index.d.ts` — TypeScript declarations
-
-## Publishing to npm
-
-### Prerequisites
-
-- npm account with publish access to `react-intl-number-input`
-- logged in: `npm login`
-
-### Release checklist
-
-1. Update `CHANGELOG.md` with the new version and changes.
-2. Bump the version in `package.json` following [semver](https://semver.org/):
-   ```bash
-   npm version patch   # 0.7.0 → 0.7.1
-   npm version minor   # 0.7.0 → 0.8.0
-   npm version major   # 0.7.0 → 1.0.0
-   ```
-3. Publish:
-   ```bash
-   npm publish
-   ```
-
-The `prepublishOnly` script runs automatically before publish:
-
-```
-npm test → npm run build:lib
-```
-
-Do not commit `dist/` — it is built during publish and excluded via `.gitignore`.
-
-### Deploying the demo
-
-To update the live demo on GitHub Pages:
-
-```bash
-npm run publish-demo
-```
-
-## Pull requests
-
-1. Fork the repository and create a feature branch.
-2. Make your changes with tests where applicable.
-3. Run `npm test` and ensure it passes.
-4. Open a pull request with a clear description of the change.
-
-## Reporting issues
-
-Open an issue at [github.com/nandorip/react-intl-number-input/issues](https://github.com/nandorip/react-intl-number-input/issues).
+# Contributing
+
+Thank you for your interest in contributing to `react-intl-number-input`.
+
+## Requirements
+
+- Node.js 20+ (recommended: current Active LTS)
+- npm 10+
+
+The package declares Node.js 20+ in `engines`. The runtime component executes in browsers; Node.js is used for installation, builds, tests and publication.
+
+## Getting started
+
+```bash
+git clone https://github.com/nandorip/react-intl-number-input.git
+cd react-intl-number-input
+npm install
+```
+
+## Local development
+
+Start the demo app with live rebuild:
+
+```bash
+npm start
+```
+
+Open [http://localhost:3001](http://localhost:3001). The demo lives in `example/` and imports the component from `src/`.
+
+## Scripts
+
+| Command | Description |
+| --- | --- |
+| `npm start` | esbuild dev server for the demo |
+| `npm test` | Run unit tests with Jest |
+| `npm run typecheck` | Check library and demo types |
+| `npm run check` | Tests, type checking, library builds and installed-tarball validation |
+| `npm run check:package` | Validate the built npm tarball: CJS, ESM, types, SSR and DOM interactions |
+| `npm run build:lib` | Compile `src/` to CommonJS, ESM, and types in `dist/` |
+| `npm run build` | Build the demo bundle in `example/dist` |
+| `npm run publish-demo` | Build and deploy the demo to GitHub Pages |
+
+## Project structure
+
+```
+src/           Library source (TypeScript)
+dist/          Published build output (generated, not committed)
+example/       Demo app and GitHub Pages bundle
+```
+
+The npm package ships `dist/`, `README.md`, `LICENSE`, `CHANGELOG.md`, and `CONTRIBUTING.md` (see `files` in `package.json`).
+
+## Testing
+
+Run the full test suite before opening a pull request:
+
+```bash
+npm run check
+```
+
+Tests live alongside the source in `src/index.test.tsx` and `src/regressions.test.tsx`. CI also checks the installed package with React 16.8, 17, 18 and 19, and runs the full checks on Node.js 20 and 24.
+
+## Building the library
+
+To produce the publishable artifacts locally:
+
+```bash
+npm run build:lib
+```
+
+This generates:
+
+- `dist/index.js` — CommonJS build (`tsc`)
+- `dist/esm/index.js` — ESM build (`tsc`)
+- `dist/index.d.ts` — TypeScript declarations
+
+## Publishing to npm
+
+### Ownership & Accounts
+
+The package is published under the npm account **`wipmob`** (`nandorip@live.com`).
+
+> **Tip (Co-Maintainer):** To allow publishing from the `nandorip` account as well, add it via npm CLI or web interface:
+> ```bash
+> npm owner add nandorip react-intl-number-input
+> ```
+> Or manage collaborators at [npmjs.com/package/react-intl-number-input/access](https://www.npmjs.com/package/react-intl-number-input/access).
+
+### Method 1: Automated Release via GitHub Actions (Recommended)
+
+This repository includes an automated workflow ([`.github/workflows/publish.yml`](.github/workflows/publish.yml)) with npm provenance attestations. This avoids local 2FA prompts and terminal issues.
+
+1. **One-time setup:**
+   - In your npm account (**`wipmob`**), generate an **Automation Token** or **Granular Access Token** with *Read and write* permissions for `react-intl-number-input`.
+   - In GitHub, go to **Settings > Secrets and variables > Actions** and add `NPM_TOKEN` with your token.
+2. **Publishing a release:**
+   - Create a new Release on GitHub (e.g. `v0.9.0`), or trigger the workflow manually under **Actions > Publish to npm > Run workflow**.
+   - GitHub Actions will run all checks, build, verify the tarball, and publish with `--provenance` automatically.
+
+### Method 2: Local CLI Release (`npm run release`)
+
+A release helper script is available to validate requirements, run the test suite, and publish:
+
+1. **Verify login:**
+   ```bash
+   npm whoami   # Should return 'wipmob' (or 'nandorip' if added as owner)
+   ```
+   If not logged in: `npm login`.
+2. **Bump version (if not already done):**
+   ```bash
+   npm version patch   # or minor / major
+   ```
+3. **Execute release:**
+   ```bash
+   npm run release
+   ```
+   If your account requires 2FA and you are in a non-interactive shell, pass the OTP directly:
+   ```bash
+   npm run release -- --otp=123456
+   ```
+
+The script automatically:
+- Confirms the active npm user.
+- Runs `npm run check` (Jest tests, TypeScript, library builds, tarball verification).
+- Runs `npm publish`.
+- Creates and pushes the git tag `v<version>`.
+
+### Deploying the demo
+
+To update the live demo on GitHub Pages independently:
+
+```bash
+npm run publish-demo
+```
+
+## Pull requests
+
+1. Fork the repository and create a feature branch.
+2. Make your changes with tests where applicable.
+3. Run `npm run check` and ensure it passes.
+4. Open a pull request with a clear description of the change.
+
+## Reporting issues
+
+Open an issue at [github.com/nandorip/react-intl-number-input/issues](https://github.com/nandorip/react-intl-number-input/issues).