tempest-react-sdk 0.78.0 → 0.80.0

package/README.md

@@ -172,7 +172,7 @@ Everything else (`zod`, `zustand`, `dexie`, `react-hook-form`, `@tanstack/react-
 | `react`, `react-dom` (`^18 \|\| ^19`) | **Peer (required)** | Everything                                                              |
 | `react-router` (`^7 \|\| ^8`)         | **Peer (required)** | `AppRouter`, `defineRoutes`, `RouteGuard`, routing re-exports           |
 | `@tanstack/react-query` (`^5`)        | Direct dep (auto)   | `QueryProvider`, `createQueryKeys`, `AppProviders`                      |
-| `zod` (`^3.23 \|\| ^4`)               | Direct dep (auto)   | `parseResponse`, `validateForm`, `zodResolver`, `useZodForm`            |
+| `zod` (`^4.6.6`)                      | Direct dep (auto)   | `parseResponse`, `validateForm`, `zodResolver`, `useZodForm`            |
 | `zustand` (`^4 \|\| ^5`)              | Direct dep (auto)   | `createAuthStore`, `createStore`, `createSelectors`                     |
 | `dexie` (`^4.4`)                      | Direct dep (auto)   | `createOfflineStore`                                                    |
 | `react-hook-form` (`^7.76`)           | Direct dep (auto)   | `zodResolver`, `useZodForm`, masked inputs                              |
@@ -189,7 +189,7 @@ npm install tempest-react-sdk react react-dom react-router
 
 **Bundle impact**: every bundled dep is externalised in the SDK's Rollup config, and `dist/` ships with the module graph preserved (one file per source module), so your bundler drops what you don't import instead of inheriting one opaque blob — importing `cn` alone costs **153 B** brotli, a full app shell around **6.8 KB**. Your app's bundler (Vite / webpack / Rspack) resolves the deps from `node_modules` and tree-shakes them the same way — if you never call `createOfflineStore`, Dexie never enters your final bundle.
 
-**Version conflicts**: if your app already pins (say) `zod@3.20`, npm dedupes when the range is compatible. If ranges diverge you get two copies — pin a single version in your own `package.json` to force one, or open an issue if the SDK's range is too tight.
+**Version conflicts**: if your app already pins (say) `zod@4.6.6`, npm dedupes when the range is compatible. If ranges diverge you get two copies — pin a single version in your own `package.json` to force one, or open an issue if the SDK's range is too tight.
 
 Adapters for external SDKs (`@sentry/browser`, `posthog-js`, `@growthbook/growthbook`, `launchdarkly-js-client-sdk`) are **not** bundled — install those only when you opt into the adapter. The caller passes the SDK instance to the factory.
 
@@ -273,7 +273,7 @@ Every module is re-exported from the package root — `import { Button, useDebou
 | `auth` _(peer: `zustand`)_                                                                        | `createAuthStore`, `AuthGuard`, `decodeJWT`, `isJWTExpired`, `lazyWithRetry`, `createRefreshQueue`, **passkeys/WebAuthn**: `createPasskeyClient`, `usePasskeyRegistration`, `usePasskeySignIn`, `usePasskeyCapabilities`, `isPasskeySupported`, `isPlatformAuthenticatorAvailable`, `isConditionalMediationAvailable`, `classifyPasskeyError`, `PasskeyError`, `base64UrlToBytes`, `bytesToBase64Url`, types: `AuthState`, `CreateAuthStoreOptions`, `AuthGuardProps`, `DecodedJWT`, `LazyWithRetryOptions`                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `oauth` _(caller injects `@react-oauth/google`)_                                                  | `GoogleSignIn` (normalises Google's credential/error payload), `useOAuthCallback` (runs the callback exchange once, StrictMode-proof), types: `GoogleSignInProps`, `OAuthCredential`, `OAuthError`, `UseOAuthCallbackOptions`, `UseOAuthCallbackResult`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `query` _(peer: `@tanstack/react-query`)_                                                         | `QueryProvider`, `createQueryKeys`, `STALE_TIME`, `CACHE_TIME`, `REFETCH_TIME`, `usePaginatedQuery`, `useCursorQuery`, `useOfflineMutation` (optimistic offline mutation + cache rollback), `upsertById`/`removeById` (optimistic list-cache helpers), `persistQueryClientOffline` (IndexedDB cache persistence for offline reads)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `router` _(dep: `react-router`)_                                                                  | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports (`Link`, `NavLink`, `Outlet`, `Navigate`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`, `useMatch`, `useRouteError`, `redirect`, `BrowserRouter`/`HashRouter`/`MemoryRouter`/`Routes`/`Route`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `router` _(dep: `react-router`)_                                                                  | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports of React Router's whole client-side surface (`Link`, `NavLink`, `Outlet`, `useNavigate`, `useParams`, `useSearchParams`, `matchPath`, `generatePath`, `createBrowserRouter`, `useLoaderData`, …; its `Form` as `RouterForm`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `store` _(dep: `zustand`)_                                                                        | `createStore`, `createSelectors`, types: `CreateStoreOptions`, `CreateStorePersistOptions`, `WithSelectors`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `app`                                                                                             | `AppProviders` (composes `ErrorBoundary` → `QueryProvider` → `ThemeProvider` → `I18nProvider`), type: `AppProvidersProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `vite` _(subpath `tempest-react-sdk/vite`)_                                                       | `createViteConfig`, `tempestPwaManifest` (emits `precache-manifest.json` for offline precache), `tempestPwaIcons` (generates the PNG icon set from one SVG via `sharp`), `tempestPwaDevSw` (serves the SW under `npm run dev`), `tempestCsp` (writes a Content-Security-Policy whose `connect-src` is derived from the app's `VITE_*` URLs, enforced in dev too), `tempestPwaIcons({ appleSplash })` (Apple splash screens), types: `CreateViteConfigOptions`, `ProxyEntry`, `TempestViteConfig`, `TempestPwaManifestOptions`, `TempestPwaIconsOptions`, `TempestPwaDevSwOptions`, `TempestCspOptions`, `TempestCspPolicy`, `TempestCspSource`, `AppleSplashSpec`, `TempestVitePlugin`                                                                                                                                                                                                                                                                  |
@@ -309,7 +309,7 @@ Every module is re-exported from the package root — `import { Button, useDebou
 | `auth` _(peer: `zustand`)_                                                                        | `createAuthStore`, `AuthGuard`, `decodeJWT`, `isJWTExpired`, `lazyWithRetry`, `createRefreshQueue`, types: `AuthState`, `CreateAuthStoreOptions`, `AuthGuardProps`, `DecodedJWT`, `LazyWithRetryOptions`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
 | `oauth` _(caller injects `@react-oauth/google`)_                                                  | `GoogleSignIn` (normalises Google's credential/error payload), `useOAuthCallback` (runs the callback exchange once, StrictMode-proof), types: `GoogleSignInProps`, `OAuthCredential`, `OAuthError`, `UseOAuthCallbackOptions`, `UseOAuthCallbackResult`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | `query` _(peer: `@tanstack/react-query`)_                                                         | `QueryProvider`, `createQueryKeys`, `STALE_TIME`, `CACHE_TIME`, `REFETCH_TIME`, `usePaginatedQuery`, `useCursorQuery`, `useOfflineMutation` (optimistic offline mutation + cache rollback), `upsertById`/`removeById` (optimistic list-cache helpers), `persistQueryClientOffline` (IndexedDB cache persistence for offline reads)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `router` _(dep: `react-router`)_                                                                  | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports (`Link`, `NavLink`, `Outlet`, `Navigate`, `useNavigate`, `useParams`, `useSearchParams`, `useLocation`, `useMatch`, `useRouteError`, `redirect`, `BrowserRouter`/`HashRouter`/`MemoryRouter`/`Routes`/`Route`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `router` _(dep: `react-router`)_                                                                  | `defineRoutes`, `AppRouter`, `RouteGuard`, + re-exports of React Router's whole client-side surface (`Link`, `NavLink`, `Outlet`, `useNavigate`, `useParams`, `useSearchParams`, `matchPath`, `generatePath`, `createBrowserRouter`, `useLoaderData`, …; its `Form` as `RouterForm`), types: `TempestRouteObject`, `RouterKind`, `AppRouterProps`, `RouteGuardProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | `store` _(dep: `zustand`)_                                                                        | `createStore`, `createSelectors`, types: `CreateStoreOptions`, `CreateStorePersistOptions`, `WithSelectors`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | `app`                                                                                             | `AppProviders` (composes `ErrorBoundary` → `QueryProvider` → `ThemeProvider` → `I18nProvider`), type: `AppProvidersProps`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | `vite` _(subpath `tempest-react-sdk/vite`)_                                                       | `createViteConfig`, `tempestPwaManifest` (emits `precache-manifest.json` for offline precache), `tempestPwaIcons` (generates the PNG icon set from one SVG via `sharp`), `tempestPwaDevSw` (serves the SW under `npm run dev`), `tempestPwaIcons({ appleSplash })` (Apple splash screens), types: `CreateViteConfigOptions`, `ProxyEntry`, `TempestViteConfig`, `TempestPwaManifestOptions`, `TempestPwaIconsOptions`, `TempestPwaDevSwOptions`, `AppleSplashSpec`, `TempestVitePlugin`                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
@@ -647,7 +647,7 @@ Every method throws `ApiError` (`status`, `body`, `url`, `code`) on non-2xx resp
 The HTTP client returns untyped JSON (`unknown`). `parseResponse` validates against a zod schema and gives you a `ZodError`-aware failure message tied to the request.
 
 ```ts
-import { createApiClient, parseResponse } from "tempest-react-sdk";
+import { encodeIdSegment, createApiClient, parseResponse } from "tempest-react-sdk";
 import { z } from "zod";
 
 const userSchema = z.object({
@@ -657,7 +657,7 @@ const userSchema = z.object({
 });
 
 export async function getUser(id: string) {
-  const raw = await api.get<unknown>(`/users/${id}`);
+  const raw = await api.get<unknown>(`/users/${encodeIdSegment(id)}`);
   return parseResponse(userSchema, raw, `GET /users/${id}`);
 }
 ```

package/bin/lib/openapi/generate.hostile.test.mjs

@@ -84,6 +84,8 @@ function spec(paths, schemas = {}) {
 }
 
 const OK = { 200: { description: "ok" } };
+const schemaRef = (name) => ({ $ref: `#/components/schemas/${name}` });
+const json = (schema) => ({ content: { "application/json": { schema } } });
 
 describe("generate — hostile spec text never becomes code (#434)", () => {
     it("a tag that closes the class doc comment stays inside it", async () => {
@@ -233,12 +235,45 @@ describe("generate — hostile spec text never becomes code (#434)", () => {
         await runGroup(files, "t");
     });
 
+    /**
+     * Rewritten for #516: this used to pass with `spec({}, …)`, two schemas no
+     * route reaches. The check now runs over the schemas a group emits, so the
+     * pair has to be referenced to collide — and still is refused, naming both.
+     */
     it("two schema names that map to the same identifier are refused, naming both", () => {
+        const both = {
+            200: json({ anyOf: [schemaRef("User-Out"), schemaRef("user.Out")] }),
+        };
         expect(() =>
-            generate(spec({}, { "User-Out": { type: "object" }, "user.Out": { type: "object" } })),
+            generate(
+                spec(
+                    { "/a": { get: { tags: ["t"], responses: both } } },
+                    { "User-Out": { type: "object" }, "user.Out": { type: "object" } },
+                ),
+            ),
         ).toThrow(/"User-Out" and "user\.Out" both map to the TypeScript identifier "UserOut"/);
     });
 
+    it("schema names no route reaches are neither emitted nor checked, so an orphan cannot abort the run (#516)", () => {
+        const { files } = generate(
+            spec(
+                {
+                    "/a": {
+                        get: { tags: ["t"], responses: { 200: json(schemaRef("MediaType")) } },
+                    },
+                },
+                {
+                    MediaType: { type: "string", enum: ["image/png"] },
+                    "Media-Type": { type: "string", enum: ["image/png", "image/webp"] },
+                    "***": { type: "object" },
+                },
+            ),
+        );
+        expect(files["t/types.ts"]).toContain("export type MediaType = ");
+        expect(files["t/schemas.ts"]).not.toContain("image/webp");
+        expect(files["t/types.ts"].match(/export type/g)).toHaveLength(1);
+    });
+
     it("a path parameter that maps onto another method argument is refused", () => {
         expect(() =>
             generate(
@@ -258,10 +293,16 @@ describe("generate — hostile spec text never becomes code (#434)", () => {
         ).toThrow(/"user-id" and "userId" both map to the TypeScript identifier "userId"/);
     });
 
+    /** Rewritten for #516 like the collision above: the schema is now referenced. */
     it("a name with nothing to build an identifier from is refused", () => {
-        expect(() => generate(spec({}, { "***": { type: "object" } }))).toThrow(
-            /schema name "\*\*\*" has no letter or digit/,
-        );
+        expect(() =>
+            generate(
+                spec(
+                    { "/a": { get: { tags: ["t"], responses: { 200: json(schemaRef("***")) } } } },
+                    { "***": { type: "object" } },
+                ),
+            ),
+        ).toThrow(/schema name "\*\*\*" has no letter or digit/);
     });
 
     it("a regex pattern with an escaped slash or a line break compiles to the same regex", () => {