v0.3.0

Forms from schemas: load forms from arrays or JSON written by developers or admins, with a
restricted policy by default, option providers, admin checks and export. No breaking changes.

Added

• Schema loading: Form::fromSchema(), Form::fromJson() and $form->loadSchema() build
  forms from arrays or JSON (schema version 1): every built-in field type and option, rows and
  fieldsets, form settings, and registered custom types. Loading is all or nothing: the
  schema is first built on a scratch form and every error is collected with its location
  (fields[2].children[0].max_size: ...), including typo suggestions and hints for HTML
  habits such as maxlength. Keys are applied in schema order.
• Schema\SchemaException with getErrors() and getMessages(); Schema\SchemaLoader::errors()
  checks a schema without loading it.
• Contracts\SchemaConfigurableInterface lets custom field types accept extra schema keys.
• Schema\SchemaPolicy: every schema is checked against a policy, restricted by default
  (Form::fromSchema(), fromJson() and loadSchema() all take an optional policy).
  SchemaPolicy::restricted(), for schemas written by admins or clients, blocks event-handler
  and behaviour attributes (on*, formaction, style, data-*), rules outside an
  allow-list with checked parameters (no is_unique, regex_match or custom rules), a
  schema-set form action, uploads without max_size (capped at 10 MB) or without an
  explicit mimes list from safe types (no SVG or HTML), protected field names such as
  role and is_admin, password and hidden fields, unlisted custom types, and oversized
  schemas. SchemaPolicy::trusted() is for developer-written schemas. Policies are immutable
  and can be customised (allowTypes(), allowRules(), allowAttributes(), allowMimes(),
  forbidNames(), allowNames(), withLimits(), withMaxUploadSize(), allowAction());
  unsafe allowances such as on* attributes or SVG uploads are refused.
• Option providers: named sources of options registered in $optionProviders
  ([ClassName::class, 'method'] for static methods, CodeIgniter models or plain classes,
  'ClassName::method', or a Closure). Schemas use "options_from": "services"; code uses
  ->optionsFrom('services'). Providers run lazily, once per field, and never while a schema
  is loaded or checked; strict option checking uses their options. SchemaPolicy can narrow
  which providers admin schemas may use (onlyProviders(), disallowProviders()).
  Support\OptionProviders checks registrations; getOptionProvider() on choice fields.
• Form::toSchema() and Form::toJson() export any form, including form classes, as a
  version 1 schema that loads back into an identical form (same schema, same HTML, same
  validation). Provider options are exported as options_from; attributes with their own key
  (autocomplete, rows, step, min, ...) are exported under it. Closure rules and
  unregistered custom field classes make the export fail with their location.
• Schema\FormSchema::check() for admin screens: checks array or JSON input without throwing
  and returns a SchemaCheck (isValid(), getErrors(), getMessages(), getErrorsFor(),
  getSchema(), toArray() for JSON responses); restricted by default.
  FormSchema::load() and FormSchema::export() shortcuts.
• php spark forms:schema check <file> [--trusted] and
  php spark forms:schema export <FormClass> [--output <file>].
• SchemaConfigurableInterface::schemaValues() so custom fields can export their extra keys;
  Field::getExplicitId(), Field::getOwnAttributes(), Form::getExplicitId(),
  File::isUploadRequired(), File::getExtraRules().

Fixed

• Forms could not be created on the command line (spark commands, queue workers, seeders):
  checking reserved field names called csrf_token(), which starts the Security service and
  needs a web request. The CSRF token name is now read from the Security config.
• A source-integrity test that fails when a docblock missing its closing */ hides class
  members.