feat(validation): cancellable, status-aware async validation on Angular 21

[vannt-dev]

Three commits, meant to be read in order.

1. chore(deps): upgrade to Angular 21 and TypeScript 5.9

Angular 19 → 21 across the package, the demo app and the root, plus TypeScript 5.9.3, zone.js 0.16, jest-dom 7 and @types/node 26. Three things blocked the bump:

• Angular 21 exposes every entry point through exports alone, and tsconfig.base.json asks for node10 resolution, which cannot read an exports map. tsc -p packages/angular reported 16 × TS2307 and all 11 spec files died in test/setup.ts. The Angular tsconfig now uses moduleResolution: "Bundler".
• ng-packagr 21 emits dist/types/<name>.d.ts, not dist/index.d.ts, so the manifest's types pointed at a file the build no longer produces — the package would have published with types resolving to nothing. Fixed, and scripts/verify-package-entrypoints.js now fails the build on any manifest path the build does not emit (wired into the quality-gates verify job).
• The lockfile was unusable: ten entries under packages/angular/node_modules had no resolved/integrity, and there was no entry for injection-js, which ng-packagr 21 requires. npm ci refused it and the Angular build died on the missing module. Regenerated with npm 10 (npm 11 prunes other platforms' optional binaries on Windows); every platform binary the Linux runners need is still present.

The two vitest.config.ts files Vite warned about are renamed to .mts, contents unchanged.

2. feat(validation): make async validation cancellable and status-aware

• ValidationResult gains complete and status ('valid' | 'invalid' | 'pending'). valid alongside pending read as a green light while remote rules were still in flight.
• FieldDescription.validationMode: 'async' declares a Promise-returning validator that detection cannot see, keeps the sync pass from invoking it, and silences the dev warning (which exists for the accidental case).
• validateFieldsAsync forwards an AbortSignal to validators, runs independent ones in parallel, skips them once aborted, and reports an aborted run as incomplete. A validator that honours the signal by rejecting with AbortError no longer rejects the caller's handleSubmit; other errors still propagate.
• Every adapter exposes isValidating / isValidationComplete / validationStatus with latest-run-wins. A submit now survives typing: previously, editing a field mid-submit cancelled it outright — no onValid, no onInvalid, no isSubmitted, just a button that re-enabled itself.
• touchAll() expands to real leaf paths (contacts[0].email) via collectFieldPaths, skipping what validation skips. Group items receive touched and report blur with their full path. An item with no touched keys still receives a map — handing it undefined flipped the nested input into tracking touched itself, which survived the owner clearing the map.
• React isValid is seeded from the initial data, not an effect. Effects do not run on the server, so a server-rendered form shipped isValid: true for an empty required field and never corrected it.
• React stops handing the touched map to every field (each blur re-rendered the whole form); Angular's per-item maps return a shared frozen object instead of a fresh literal on every change-detection pass.

Changeset included: minor on all four packages.

3. docs: bring the READMEs in line with the validation API

The docs still described ValidationResult as { valid, errors } and said nothing about what the adapters now expose, so a reader had no way to know that valid alone is not the answer.

• core: the full result shape, why status is the member to read, validationMode: 'async', and the ValidationContext / AbortSignal argument with a fetch example. Export list gains collectFieldPaths, indexGroupPathMap, ValidationContext.
• react / vue / angular: state tables gain isValidating, isValidationComplete, validationStatus; the live-validation paragraph now states latest-run-wins and that a submit is not cancelled by typing.
• root README: validate signature includes the context argument, a validationMode row sits beside it, the example reads status, and the touched section explains full-path keying inside repeatable groups.
• ui-kit recipes: a table of which member to bind for what.
• angular README: the (Angular 19+) heading is replaced by the range the package declares (>=14 <22) and the version CI exercises (21).

Verification

Gate	Result
npm ci	clean (was: out of sync, refused)
lint / format-check	pass / pass
typecheck + core test:types	pass, 9 tests, no type errors
core / react / vue / angular	151 / 143 / 134 / 110 (angular ran 0 before)
smoke / test:scripts	2 / 44
build, all four packages	pass (angular failed to build before)
verify scripts	5/5, including the new entry-point check
example apps (react / vue / angular)	all three build (angular-app needed the same moduleResolution fix)

Every behaviour fix landed test-first; the Vue and Angular submit fixes were re-verified by temporarily reverting the guard to confirm the new tests fail without it.