@10x-media/form-builder 0.1.0-beta.0 → 0.1.0-beta.10

package/dist/react/uploadFile.js

@@ -0,0 +1,39 @@
+//#region src/react/uploadFile.ts
+/**
+* Upload one file to a Payload upload collection (`POST {apiRoute}/{collection}`, multipart) and return its
+* id, which the file field stores as its value. The server re-derives the file metadata from the stored doc
+* at submit, so the client is never trusted for it. Pure: inject `fetchImpl` in tests.
+*/
+const uploadFile = async (input) => {
+	const { file, collection, apiRoute = "/api", fetchImpl = fetch } = input;
+	const body = new FormData();
+	body.append("file", file);
+	let response;
+	try {
+		response = await fetchImpl(`${apiRoute}/${collection}`, {
+			method: "POST",
+			body
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			message: error instanceof Error ? error.message : "Network error"
+		};
+	}
+	if (!response.ok) return {
+		ok: false,
+		message: `Upload failed (${response.status})`
+	};
+	const id = (await response.json().catch(() => ({}))).doc?.id;
+	return id == null ? {
+		ok: false,
+		message: "No id returned"
+	} : {
+		ok: true,
+		id
+	};
+};
+//#endregion
+export { uploadFile };
+
+//# sourceMappingURL=uploadFile.js.map

package/dist/react/uploadFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadFile.js","names":[],"sources":["../../src/react/uploadFile.ts"],"sourcesContent":["export type UploadFileInput = {\n\tfile: File\n\t/** Upload collection slug. File fields carry it as the server-stamped `collection` block config. */\n\tcollection: string\n\tapiRoute?: string\n\tfetchImpl?: typeof fetch\n}\n\nexport type UploadFileResult = { ok: true; id: string | number } | { ok: false; message?: string }\n\n/**\n * Upload one file to a Payload upload collection (`POST {apiRoute}/{collection}`, multipart) and return its\n * id, which the file field stores as its value. The server re-derives the file metadata from the stored doc\n * at submit, so the client is never trusted for it. Pure: inject `fetchImpl` in tests.\n */\nexport const uploadFile = async (input: UploadFileInput): Promise<UploadFileResult> => {\n\tconst { file, collection, apiRoute = '/api', fetchImpl = fetch } = input\n\tconst body = new FormData()\n\tbody.append('file', file)\n\tlet response: Response\n\ttry {\n\t\tresponse = await fetchImpl(`${apiRoute}/${collection}`, { method: 'POST', body })\n\t} catch (error) {\n\t\treturn { ok: false, message: error instanceof Error ? error.message : 'Network error' }\n\t}\n\tif (!response.ok) {\n\t\treturn { ok: false, message: `Upload failed (${response.status})` }\n\t}\n\tconst data = (await response.json().catch(() => ({}))) as { doc?: { id?: string | number } }\n\tconst id = data.doc?.id\n\treturn id == null ? { ok: false, message: 'No id returned' } : { ok: true, id }\n}\n"],"mappings":";;;;;;AAeA,MAAa,aAAa,OAAO,UAAsD;CACtF,MAAM,EAAE,MAAM,YAAY,WAAW,QAAQ,YAAY,UAAU;CACnE,MAAM,OAAO,IAAI,SAAS;CAC1B,KAAK,OAAO,QAAQ,IAAI;CACxB,IAAI;CACJ,IAAI;EACH,WAAW,MAAM,UAAU,GAAG,SAAS,GAAG,cAAc;GAAE,QAAQ;GAAQ;EAAK,CAAC;CACjF,SAAS,OAAO;EACf,OAAO;GAAE,IAAI;GAAO,SAAS,iBAAiB,QAAQ,MAAM,UAAU;EAAgB;CACvF;CACA,IAAI,CAAC,SAAS,IACb,OAAO;EAAE,IAAI;EAAO,SAAS,kBAAkB,SAAS,OAAO;CAAG;CAGnE,MAAM,MAAK,MADS,SAAS,KAAK,EAAE,aAAa,CAAC,EAAE,GACpC,KAAK;CACrB,OAAO,MAAM,OAAO;EAAE,IAAI;EAAO,SAAS;CAAiB,IAAI;EAAE,IAAI;EAAM;CAAG;AAC/E"}

package/dist/react/useField.d.ts

@@ -0,0 +1,13 @@
+//#region src/react/useField.d.ts
+type UseFieldResult<TValue = unknown> = {
+  value: TValue | undefined;
+  errors: string[];
+  touched: boolean;
+  setValue: (value: TValue) => void; /** Mark touched and validate now (call on blur). */
+  onBlur: () => void;
+};
+/** Bind one field by name to the form controller: its value, issues, and change/blur handlers. */
+declare const useField: <TValue = unknown>(name: string) => UseFieldResult<TValue>;
+//#endregion
+export { UseFieldResult, useField };
+//# sourceMappingURL=useField.d.ts.map

package/dist/react/useField.js

@@ -0,0 +1,49 @@
+"use client";
+import { useFormContext } from "./FormContext.js";
+import "./state.js";
+import { useCallback } from "react";
+//#region src/react/useField.ts
+/** Bind one field by name to the form controller: its value, issues, and change/blur handlers. */
+const useField = (name) => {
+	const { state, dispatch, validateField, stepIdOfField } = useFormContext();
+	const touched = state.touched[name] ?? false;
+	const stepAttempted = state.attemptedSteps.has(stepIdOfField?.(name) ?? "__form__");
+	const showIssues = touched || stepAttempted;
+	const value = state.values[name];
+	const setValue = useCallback((next) => {
+		dispatch({
+			type: "SET_VALUE",
+			name,
+			value: next
+		});
+		if (showIssues) validateField(name, next);
+	}, [
+		dispatch,
+		name,
+		showIssues,
+		validateField
+	]);
+	const onBlur = useCallback(() => {
+		dispatch({
+			type: "TOUCH",
+			name
+		});
+		validateField(name, value);
+	}, [
+		dispatch,
+		name,
+		validateField,
+		value
+	]);
+	return {
+		value,
+		errors: showIssues ? state.errors[name] ?? [] : [],
+		touched,
+		setValue,
+		onBlur
+	};
+};
+//#endregion
+export { useField };
+
+//# sourceMappingURL=useField.js.map

package/dist/react/useField.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useField.js","names":[],"sources":["../../src/react/useField.ts"],"sourcesContent":["'use client'\n\nimport { useCallback } from 'react'\nimport { useFormContext } from './FormContext'\nimport { DEFAULT_STEP_ID } from './state'\n\nexport type UseFieldResult<TValue = unknown> = {\n\tvalue: TValue | undefined\n\terrors: string[]\n\ttouched: boolean\n\tsetValue: (value: TValue) => void\n\t/** Mark touched and validate now (call on blur). */\n\tonBlur: () => void\n}\n\n/** Bind one field by name to the form controller: its value, issues, and change/blur handlers. */\nexport const useField = <TValue = unknown>(name: string): UseFieldResult<TValue> => {\n\tconst { state, dispatch, validateField, stepIdOfField } = useFormContext()\n\tconst touched = state.touched[name] ?? false\n\t// Reveal is a function of this field's own step, never a single global flag: the field's error shows\n\t// once it is touched, or once the step it belongs to has been attempted (a blocked advance or submit).\n\tconst stepAttempted = state.attemptedSteps.has(stepIdOfField?.(name) ?? DEFAULT_STEP_ID)\n\tconst showIssues = touched || stepAttempted\n\tconst value = state.values[name] as TValue | undefined\n\n\tconst setValue = useCallback(\n\t\t(next: TValue) => {\n\t\t\tdispatch({ type: 'SET_VALUE', name, value: next })\n\t\t\t// Re-validate on change only once the error is already revealed; never reveal an untouched field mid-typing.\n\t\t\tif (showIssues) {\n\t\t\t\tvalidateField(name, next)\n\t\t\t}\n\t\t},\n\t\t[dispatch, name, showIssues, validateField]\n\t)\n\n\tconst onBlur = useCallback(() => {\n\t\tdispatch({ type: 'TOUCH', name })\n\t\tvalidateField(name, value)\n\t}, [dispatch, name, validateField, value])\n\n\treturn {\n\t\tvalue,\n\t\terrors: showIssues ? (state.errors[name] ?? []) : [],\n\t\ttouched,\n\t\tsetValue,\n\t\tonBlur,\n\t}\n}\n"],"mappings":";;;;;;AAgBA,MAAa,YAA8B,SAAyC;CACnF,MAAM,EAAE,OAAO,UAAU,eAAe,kBAAkB,eAAe;CACzE,MAAM,UAAU,MAAM,QAAQ,SAAS;CAGvC,MAAM,gBAAgB,MAAM,eAAe,IAAI,gBAAgB,IAAI,KAAA,UAAoB;CACvF,MAAM,aAAa,WAAW;CAC9B,MAAM,QAAQ,MAAM,OAAO;CAE3B,MAAM,WAAW,aACf,SAAiB;EACjB,SAAS;GAAE,MAAM;GAAa;GAAM,OAAO;EAAK,CAAC;EAEjD,IAAI,YACH,cAAc,MAAM,IAAI;CAE1B,GACA;EAAC;EAAU;EAAM;EAAY;CAAa,CAC3C;CAEA,MAAM,SAAS,kBAAkB;EAChC,SAAS;GAAE,MAAM;GAAS;EAAK,CAAC;EAChC,cAAc,MAAM,KAAK;CAC1B,GAAG;EAAC;EAAU;EAAM;EAAe;CAAK,CAAC;CAEzC,OAAO;EACN;EACA,QAAQ,aAAc,MAAM,OAAO,SAAS,CAAC,IAAK,CAAC;EACnD;EACA;EACA;CACD;AACD"}

package/dist/react/useFormState.d.ts

@@ -0,0 +1,8 @@
+import { FormState } from "./state.js";
+
+//#region src/react/useFormState.d.ts
+/** The whole form state (values, errors, touched, submitting, submitted, submitError). */
+declare const useFormState: () => FormState;
+//#endregion
+export { useFormState };
+//# sourceMappingURL=useFormState.d.ts.map

package/dist/react/useFormState.js

@@ -0,0 +1,9 @@
+"use client";
+import { useFormContext } from "./FormContext.js";
+//#region src/react/useFormState.ts
+/** The whole form state (values, errors, touched, submitting, submitted, submitError). */
+const useFormState = () => useFormContext().state;
+//#endregion
+export { useFormState };
+
+//# sourceMappingURL=useFormState.js.map

package/dist/react/useFormState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFormState.js","names":[],"sources":["../../src/react/useFormState.ts"],"sourcesContent":["'use client'\n\nimport { useFormContext } from './FormContext'\nimport type { FormState } from './state'\n\n/** The whole form state (values, errors, touched, submitting, submitted, submitError). */\nexport const useFormState = (): FormState => useFormContext().state\n"],"mappings":";;;;AAMA,MAAa,qBAAgC,eAAe,EAAE"}

package/dist/react/useFormStep.d.ts

@@ -0,0 +1,8 @@
+import { FormStepInfo } from "./FormContext.js";
+
+//#region src/react/useFormStep.d.ts
+/** Multi-step navigation state for the current form (single-step default when the form has no flow). */
+declare const useFormStep: () => FormStepInfo;
+//#endregion
+export { useFormStep };
+//# sourceMappingURL=useFormStep.d.ts.map

package/dist/react/useFormStep.js

@@ -0,0 +1,9 @@
+"use client";
+import { useFormContext } from "./FormContext.js";
+//#region src/react/useFormStep.ts
+/** Multi-step navigation state for the current form (single-step default when the form has no flow). */
+const useFormStep = () => useFormContext().step;
+//#endregion
+export { useFormStep };
+
+//# sourceMappingURL=useFormStep.js.map

package/dist/react/useFormStep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useFormStep.js","names":[],"sources":["../../src/react/useFormStep.ts"],"sourcesContent":["'use client'\n\nimport type { FormStepInfo } from './FormContext'\nimport { useFormContext } from './FormContext'\n\n/** Multi-step navigation state for the current form (single-step default when the form has no flow). */\nexport const useFormStep = (): FormStepInfo => useFormContext().step\n"],"mappings":";;;;AAMA,MAAa,oBAAkC,eAAe,EAAE"}

package/dist/react/validateField.js

@@ -0,0 +1,27 @@
+import { runValidation } from "../validation/runValidation.js";
+//#region src/react/validateField.ts
+/**
+* Run client-side validation for one field, reusing the shared engine in `mode: 'client'` (server-only
+* rules are skipped, no `req`/`payload`). Every returned message is a blocking error.
+*/
+const validateFieldValue = async (input) => {
+	const { field, value, registry, ruleRegistry, answers, locale, t } = input;
+	const { errors } = await runValidation({
+		field,
+		fieldDefinition: registry.get(field.blockType),
+		value,
+		fieldType: field.blockType,
+		ruleRegistry,
+		answers,
+		locale,
+		t,
+		operation: "create",
+		event: "onChange",
+		mode: "client"
+	});
+	return { errors };
+};
+//#endregion
+export { validateFieldValue };
+
+//# sourceMappingURL=validateField.js.map

package/dist/react/validateField.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateField.js","names":[],"sources":["../../src/react/validateField.ts"],"sourcesContent":["import type { FieldTypeRegistry } from '../fields/registry'\nimport type { Translate } from '../fields/types'\nimport type { FormFieldInstance } from '../submissions/types'\nimport type { ValidationRuleRegistry } from '../validation/registry'\nimport { runValidation } from '../validation/runValidation'\n\nexport type ValidateFieldInput = {\n\tfield: FormFieldInstance\n\tvalue: unknown\n\tregistry: FieldTypeRegistry\n\truleRegistry: ValidationRuleRegistry\n\tanswers: Record<string, unknown>\n\tlocale: string\n\tt: Translate\n}\n\nexport type ValidateFieldResult = { errors: string[] }\n\n/**\n * Run client-side validation for one field, reusing the shared engine in `mode: 'client'` (server-only\n * rules are skipped, no `req`/`payload`). Every returned message is a blocking error.\n */\nexport const validateFieldValue = async (\n\tinput: ValidateFieldInput\n): Promise<ValidateFieldResult> => {\n\tconst { field, value, registry, ruleRegistry, answers, locale, t } = input\n\tconst { errors } = await runValidation({\n\t\tfield,\n\t\tfieldDefinition: registry.get(field.blockType),\n\t\tvalue,\n\t\tfieldType: field.blockType,\n\t\truleRegistry,\n\t\tanswers,\n\t\tlocale,\n\t\tt,\n\t\toperation: 'create',\n\t\tevent: 'onChange',\n\t\tmode: 'client',\n\t})\n\treturn { errors }\n}\n"],"mappings":";;;;;;AAsBA,MAAa,qBAAqB,OACjC,UACkC;CAClC,MAAM,EAAE,OAAO,OAAO,UAAU,cAAc,SAAS,QAAQ,MAAM;CACrE,MAAM,EAAE,WAAW,MAAM,cAAc;EACtC;EACA,iBAAiB,SAAS,IAAI,MAAM,SAAS;EAC7C;EACA,WAAW,MAAM;EACjB;EACA;EACA;EACA;EACA,WAAW;EACX,OAAO;EACP,MAAM;CACP,CAAC;CACD,OAAO,EAAE,OAAO;AACjB"}

package/dist/recall/interpolate.d.ts

@@ -0,0 +1,11 @@
+//#region src/recall/interpolate.d.ts
+/**
+ * Replace `{{ name }}`, `{{ name|fallback }}`, and `{{ name||fallback }}` tokens (single and
+ * double pipe are equivalent; the second pipe is just consumed, not part of the fallback text).
+ * `resolve` returns the recalled value ('' when absent); the fallback (or '') is substituted when
+ * `resolve` yields ''. Token-free input is returned unchanged, so this is a no-op for ordinary text.
+ */
+declare const interpolate: (template: string, resolve: (name: string) => string) => string;
+//#endregion
+export { interpolate };
+//# sourceMappingURL=interpolate.d.ts.map

package/dist/recall/interpolate.js

@@ -0,0 +1,17 @@
+//#region src/recall/interpolate.ts
+const TOKEN = /\{\{\s*([^{}|]+?)\s*(?:\|\|?([^{}]*?))?\}\}/g;
+/**
+* Replace `{{ name }}`, `{{ name|fallback }}`, and `{{ name||fallback }}` tokens (single and
+* double pipe are equivalent; the second pipe is just consumed, not part of the fallback text).
+* `resolve` returns the recalled value ('' when absent); the fallback (or '') is substituted when
+* `resolve` yields ''. Token-free input is returned unchanged, so this is a no-op for ordinary text.
+*/
+const interpolate = (template, resolve) => template.replace(TOKEN, (_match, rawName, rawFallback) => {
+	const value = resolve(rawName.trim());
+	if (value !== "") return value;
+	return rawFallback === void 0 ? "" : rawFallback.trim();
+});
+//#endregion
+export { interpolate };
+
+//# sourceMappingURL=interpolate.js.map

package/dist/recall/interpolate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interpolate.js","names":[],"sources":["../../src/recall/interpolate.ts"],"sourcesContent":["const TOKEN = /\\{\\{\\s*([^{}|]+?)\\s*(?:\\|\\|?([^{}]*?))?\\}\\}/g\n\n/**\n * Replace `{{ name }}`, `{{ name|fallback }}`, and `{{ name||fallback }}` tokens (single and\n * double pipe are equivalent; the second pipe is just consumed, not part of the fallback text).\n * `resolve` returns the recalled value ('' when absent); the fallback (or '') is substituted when\n * `resolve` yields ''. Token-free input is returned unchanged, so this is a no-op for ordinary text.\n */\nexport const interpolate = (template: string, resolve: (name: string) => string): string =>\n\ttemplate.replace(TOKEN, (_match, rawName: string, rawFallback?: string) => {\n\t\tconst value = resolve(rawName.trim())\n\t\tif (value !== '') {\n\t\t\treturn value\n\t\t}\n\t\treturn rawFallback === undefined ? '' : rawFallback.trim()\n\t})\n"],"mappings":";AAAA,MAAM,QAAQ;;;;;;;AAQd,MAAa,eAAe,UAAkB,YAC7C,SAAS,QAAQ,QAAQ,QAAQ,SAAiB,gBAAyB;CAC1E,MAAM,QAAQ,QAAQ,QAAQ,KAAK,CAAC;CACpC,IAAI,UAAU,IACb,OAAO;CAER,OAAO,gBAAgB,KAAA,IAAY,KAAK,YAAY,KAAK;AAC1D,CAAC"}

package/dist/recall/resolver.d.ts

@@ -0,0 +1,22 @@
+import { FormFieldInstance } from "../submissions/types.js";
+import { AnyFormFieldDefinition } from "../fields/types.js";
+
+//#region src/recall/resolver.d.ts
+type RecallResolver = (name: string) => string;
+/** Derive a value->label map from a select-like field instance's `options`. */
+declare const optionLabelsFor: (field: FormFieldInstance) => Record<string, string> | undefined;
+/**
+ * Build a recall resolver: `{{name}}` -> the field's current value, formatted via its type's `format`
+ * (so a select shows its option label, a checkbox Yes/No, a date localized). Missing field or empty
+ * value -> ''. Pure and isomorphic; the renderer and server templates share it.
+ */
+declare const buildRecallResolver: (args: {
+  fields: FormFieldInstance[];
+  values: Record<string, unknown>;
+  registry: Map<string, AnyFormFieldDefinition>;
+  locale: string;
+  t: (key: string) => string;
+}) => RecallResolver;
+//#endregion
+export { RecallResolver, buildRecallResolver, optionLabelsFor };
+//# sourceMappingURL=resolver.d.ts.map

package/dist/recall/resolver.js

@@ -0,0 +1,48 @@
+import { isNamedField } from "../fields/fieldKey.js";
+//#region src/recall/resolver.ts
+/** Derive a value->label map from a select-like field instance's `options`. */
+const optionLabelsFor = (field) => {
+	const options = field.options;
+	if (!Array.isArray(options)) return;
+	const map = {};
+	for (const option of options) if (option && typeof option.value === "string") map[option.value] = option.label ?? option.value;
+	return Object.keys(map).length > 0 ? map : void 0;
+};
+/**
+* Build a recall resolver: `{{name}}` -> the field's current value, formatted via its type's `format`
+* (so a select shows its option label, a checkbox Yes/No, a date localized). Missing field or empty
+* value -> ''. Pure and isomorphic; the renderer and server templates share it.
+*/
+const buildRecallResolver = (args) => {
+	const byName = new Map(args.fields.filter(isNamedField).map((field) => [field.name, field]));
+	return (name) => {
+		const field = byName.get(name);
+		if (!field) return "";
+		const value = args.values[name];
+		if (value == null || value === "" || Array.isArray(value) && value.length === 0) return "";
+		const definition = args.registry.get(field.blockType);
+		if (definition?.format) return definition.format({
+			value,
+			config: {},
+			optionLabels: optionLabelsFor(field),
+			locale: args.locale,
+			t: args.t
+		});
+		return Array.isArray(value) ? value.join(", ") : String(value);
+	};
+};
+/**
+* Build a submission-shaped descriptor per named field: the client-side counterpart to the
+* per-field descriptors `runSubmission` snapshots server-side. Lets client-rendered templates
+* (the response message) label rows the same way server-rendered ones (email-team) do. `optionLabels`
+* is omitted: pair with values already formatted via `buildRecallResolver`, not raw stored values.
+*/
+const descriptorsFor = (fields) => fields.filter(isNamedField).map((field) => ({
+	field: field.name,
+	label: field.label ?? field.name,
+	fieldType: field.blockType
+}));
+//#endregion
+export { buildRecallResolver, descriptorsFor, optionLabelsFor };
+
+//# sourceMappingURL=resolver.js.map

package/dist/recall/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","names":[],"sources":["../../src/recall/resolver.ts"],"sourcesContent":["import { isNamedField } from '../fields/fieldKey'\nimport type { AnyFormFieldDefinition } from '../fields/types'\nimport type { FormFieldInstance, SubmissionDescriptor } from '../submissions/types'\n\nexport type RecallResolver = (name: string) => string\n\ntype Option = { label?: string; value?: string }\n\n/** Derive a value->label map from a select-like field instance's `options`. */\nexport const optionLabelsFor = (field: FormFieldInstance): Record<string, string> | undefined => {\n\tconst options = field.options\n\tif (!Array.isArray(options)) {\n\t\treturn undefined\n\t}\n\tconst map: Record<string, string> = {}\n\tfor (const option of options as Option[]) {\n\t\tif (option && typeof option.value === 'string') {\n\t\t\tmap[option.value] = option.label ?? option.value\n\t\t}\n\t}\n\treturn Object.keys(map).length > 0 ? map : undefined\n}\n\n/**\n * Build a recall resolver: `{{name}}` -> the field's current value, formatted via its type's `format`\n * (so a select shows its option label, a checkbox Yes/No, a date localized). Missing field or empty\n * value -> ''. Pure and isomorphic; the renderer and server templates share it.\n */\nexport const buildRecallResolver = (args: {\n\tfields: FormFieldInstance[]\n\tvalues: Record<string, unknown>\n\tregistry: Map<string, AnyFormFieldDefinition>\n\tlocale: string\n\tt: (key: string) => string\n}): RecallResolver => {\n\tconst byName = new Map(args.fields.filter(isNamedField).map((field) => [field.name, field]))\n\treturn (name) => {\n\t\tconst field = byName.get(name)\n\t\tif (!field) {\n\t\t\treturn ''\n\t\t}\n\t\tconst value = args.values[name]\n\t\tif (value == null || value === '' || (Array.isArray(value) && value.length === 0)) {\n\t\t\treturn ''\n\t\t}\n\t\tconst definition = args.registry.get(field.blockType)\n\t\tif (definition?.format) {\n\t\t\treturn definition.format({\n\t\t\t\tvalue,\n\t\t\t\tconfig: {},\n\t\t\t\toptionLabels: optionLabelsFor(field),\n\t\t\t\tlocale: args.locale,\n\t\t\t\tt: args.t,\n\t\t\t})\n\t\t}\n\t\treturn Array.isArray(value) ? value.join(', ') : String(value)\n\t}\n}\n\n/**\n * Build a submission-shaped descriptor per named field: the client-side counterpart to the\n * per-field descriptors `runSubmission` snapshots server-side. Lets client-rendered templates\n * (the response message) label rows the same way server-rendered ones (email-team) do. `optionLabels`\n * is omitted: pair with values already formatted via `buildRecallResolver`, not raw stored values.\n */\nexport const descriptorsFor = (fields: FormFieldInstance[]): SubmissionDescriptor[] =>\n\tfields.filter(isNamedField).map((field) => ({\n\t\tfield: field.name,\n\t\tlabel: field.label ?? field.name,\n\t\tfieldType: field.blockType,\n\t}))\n"],"mappings":";;;AASA,MAAa,mBAAmB,UAAiE;CAChG,MAAM,UAAU,MAAM;CACtB,IAAI,CAAC,MAAM,QAAQ,OAAO,GACzB;CAED,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,UAAU,SACpB,IAAI,UAAU,OAAO,OAAO,UAAU,UACrC,IAAI,OAAO,SAAS,OAAO,SAAS,OAAO;CAG7C,OAAO,OAAO,KAAK,GAAG,EAAE,SAAS,IAAI,MAAM,KAAA;AAC5C;;;;;;AAOA,MAAa,uBAAuB,SAMd;CACrB,MAAM,SAAS,IAAI,IAAI,KAAK,OAAO,OAAO,YAAY,EAAE,KAAK,UAAU,CAAC,MAAM,MAAM,KAAK,CAAC,CAAC;CAC3F,QAAQ,SAAS;EAChB,MAAM,QAAQ,OAAO,IAAI,IAAI;EAC7B,IAAI,CAAC,OACJ,OAAO;EAER,MAAM,QAAQ,KAAK,OAAO;EAC1B,IAAI,SAAS,QAAQ,UAAU,MAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAC9E,OAAO;EAER,MAAM,aAAa,KAAK,SAAS,IAAI,MAAM,SAAS;EACpD,IAAI,YAAY,QACf,OAAO,WAAW,OAAO;GACxB;GACA,QAAQ,CAAC;GACT,cAAc,gBAAgB,KAAK;GACnC,QAAQ,KAAK;GACb,GAAG,KAAK;EACT,CAAC;EAEF,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK;CAC9D;AACD;;;;;;;AAQA,MAAa,kBAAkB,WAC9B,OAAO,OAAO,YAAY,EAAE,KAAK,WAAW;CAC3C,OAAO,MAAM;CACb,OAAO,MAAM,SAAS,MAAM;CAC5B,WAAW,MAAM;AAClB,EAAE"}

package/dist/spam/captcha.d.ts

@@ -0,0 +1,13 @@
+import { CaptchaProvider } from "./types.js";
+
+//#region src/spam/captcha.d.ts
+/**
+ * Identity helper for authoring a captcha provider (mirrors `defineAction`/`definePollOptionSource`).
+ * Bundled adapters (`turnstileProvider`, `recaptchaProvider`, `hcaptchaProvider`) are built with it;
+ * use it directly for any other verification service. The submit path verifies a token carried on
+ * the submission.
+ */
+declare const defineCaptchaProvider: (provider: CaptchaProvider) => CaptchaProvider;
+//#endregion
+export { defineCaptchaProvider };
+//# sourceMappingURL=captcha.d.ts.map

package/dist/spam/captcha.js

@@ -0,0 +1,12 @@
+//#region src/spam/captcha.ts
+/**
+* Identity helper for authoring a captcha provider (mirrors `defineAction`/`definePollOptionSource`).
+* Bundled adapters (`turnstileProvider`, `recaptchaProvider`, `hcaptchaProvider`) are built with it;
+* use it directly for any other verification service. The submit path verifies a token carried on
+* the submission.
+*/
+const defineCaptchaProvider = (provider) => provider;
+//#endregion
+export { defineCaptchaProvider };
+
+//# sourceMappingURL=captcha.js.map

package/dist/spam/captcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"captcha.js","names":[],"sources":["../../src/spam/captcha.ts"],"sourcesContent":["import type { CaptchaProvider } from './types'\n\n/**\n * Identity helper for authoring a captcha provider (mirrors `defineAction`/`definePollOptionSource`).\n * Bundled adapters (`turnstileProvider`, `recaptchaProvider`, `hcaptchaProvider`) are built with it;\n * use it directly for any other verification service. The submit path verifies a token carried on\n * the submission.\n */\nexport const defineCaptchaProvider = (provider: CaptchaProvider): CaptchaProvider => provider\n"],"mappings":";;;;;;;AAQA,MAAa,yBAAyB,aAA+C"}

package/dist/spam/clientIp.js

@@ -0,0 +1,9 @@
+//#region src/spam/clientIp.ts
+/** First hop of a comma-separated proxy header (the client, per X-Forwarded-For convention), or undefined. */
+const firstHop = (headers, header) => {
+	return headers?.get(header)?.split(",")[0]?.trim() || void 0;
+};
+//#endregion
+export { firstHop };
+
+//# sourceMappingURL=clientIp.js.map

package/dist/spam/clientIp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientIp.js","names":[],"sources":["../../src/spam/clientIp.ts"],"sourcesContent":["/** First hop of a comma-separated proxy header (the client, per X-Forwarded-For convention), or undefined. */\nexport const firstHop = (headers: Headers | undefined, header: string): string | undefined => {\n\tconst first = headers?.get(header)?.split(',')[0]?.trim()\n\treturn first || undefined\n}\n"],"mappings":";;AACA,MAAa,YAAY,SAA8B,WAAuC;CAE7F,OADc,SAAS,IAAI,MAAM,GAAG,MAAM,GAAG,EAAE,IAAI,KAAK,KACxC,KAAA;AACjB"}

package/dist/spam/constants.d.ts

@@ -0,0 +1,12 @@
+//#region src/spam/constants.d.ts
+/**
+ * Default honeypot decoy field name. "website" is plausible to bots but doesn't trigger Chrome's
+ * email-address autofill (unlike names containing "email"). Bots fill every input; real users
+ * never see the hidden field.
+ */
+declare const DEFAULT_HONEYPOT_FIELD = "website";
+/** Reserved `values` entry carrying a captcha token from the client. */
+declare const CAPTCHA_TOKEN_KEY = "__fb_captcha";
+//#endregion
+export { CAPTCHA_TOKEN_KEY, DEFAULT_HONEYPOT_FIELD };
+//# sourceMappingURL=constants.d.ts.map

package/dist/spam/constants.js

@@ -0,0 +1,21 @@
+//#region src/spam/constants.ts
+/**
+* Default honeypot decoy field name. "website" is plausible to bots but doesn't trigger Chrome's
+* email-address autofill (unlike names containing "email"). Bots fill every input; real users
+* never see the hidden field.
+*/
+const DEFAULT_HONEYPOT_FIELD = "website";
+/** Reserved `values` entry carrying a captcha token from the client. */
+const CAPTCHA_TOKEN_KEY = "__fb_captcha";
+/**
+* Reserved `values` entry the honeypot decoy is submitted under. The decoy's DOM input keeps a
+* plausible cosmetic name (e.g. `website`), but the submitted value rides this fixed key so a real
+* field sharing that name is never stripped or mistaken for the decoy.
+*/
+const HONEYPOT_VALUE_KEY = "__fb_hp";
+/** `req.context` key under which the spam guard stashes the resolved identity for upload-ownership verification. */
+const IDENTITY_CONTEXT_KEY = "formBuilderSpamIdentity";
+//#endregion
+export { CAPTCHA_TOKEN_KEY, DEFAULT_HONEYPOT_FIELD, HONEYPOT_VALUE_KEY, IDENTITY_CONTEXT_KEY };
+
+//# sourceMappingURL=constants.js.map

package/dist/spam/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","names":[],"sources":["../../src/spam/constants.ts"],"sourcesContent":["/**\n * Default honeypot decoy field name. \"website\" is plausible to bots but doesn't trigger Chrome's\n * email-address autofill (unlike names containing \"email\"). Bots fill every input; real users\n * never see the hidden field.\n */\nexport const DEFAULT_HONEYPOT_FIELD = 'website'\n\n/** Reserved `values` entry carrying a captcha token from the client. */\nexport const CAPTCHA_TOKEN_KEY = '__fb_captcha'\n\n/**\n * Reserved `values` entry the honeypot decoy is submitted under. The decoy's DOM input keeps a\n * plausible cosmetic name (e.g. `website`), but the submitted value rides this fixed key so a real\n * field sharing that name is never stripped or mistaken for the decoy.\n */\nexport const HONEYPOT_VALUE_KEY = '__fb_hp'\n\n/** `req.context` key under which the spam guard stashes the resolved identity for upload-ownership verification. */\nexport const IDENTITY_CONTEXT_KEY = 'formBuilderSpamIdentity'\n"],"mappings":";;;;;;AAKA,MAAa,yBAAyB;;AAGtC,MAAa,oBAAoB;;;;;;AAOjC,MAAa,qBAAqB;;AAGlC,MAAa,uBAAuB"}

package/dist/spam/identify.d.ts

@@ -0,0 +1,12 @@
+import { IdentifyFn } from "./types.js";
+
+//#region src/spam/identify.d.ts
+/**
+ * Default identity resolution for rate-limiting + upload ownership. Prefers an authenticated user id
+ * (trustworthy); else the first hop of the configured trusted IP header (best-effort, proxy-dependent);
+ * else null, in which case the caller fails open (cannot fairly rate-limit an unidentifiable client).
+ */
+declare const defaultIdentify: (ipHeader: string) => IdentifyFn;
+//#endregion
+export { defaultIdentify };
+//# sourceMappingURL=identify.d.ts.map

package/dist/spam/identify.js

@@ -0,0 +1,17 @@
+import { firstHop } from "./clientIp.js";
+//#region src/spam/identify.ts
+/**
+* Default identity resolution for rate-limiting + upload ownership. Prefers an authenticated user id
+* (trustworthy); else the first hop of the configured trusted IP header (best-effort, proxy-dependent);
+* else null, in which case the caller fails open (cannot fairly rate-limit an unidentifiable client).
+*/
+const defaultIdentify = (ipHeader) => (req) => {
+	const userId = req.user?.id;
+	if (userId != null) return `user:${String(userId)}`;
+	const ip = firstHop(req.headers, ipHeader);
+	return ip ? `ip:${ip}` : null;
+};
+//#endregion
+export { defaultIdentify };
+
+//# sourceMappingURL=identify.js.map

package/dist/spam/identify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identify.js","names":[],"sources":["../../src/spam/identify.ts"],"sourcesContent":["import { firstHop } from './clientIp'\nimport type { IdentifyFn } from './types'\n\n/**\n * Default identity resolution for rate-limiting + upload ownership. Prefers an authenticated user id\n * (trustworthy); else the first hop of the configured trusted IP header (best-effort, proxy-dependent);\n * else null, in which case the caller fails open (cannot fairly rate-limit an unidentifiable client).\n */\nexport const defaultIdentify =\n\t(ipHeader: string): IdentifyFn =>\n\t(req) => {\n\t\tconst userId = req.user?.id\n\t\tif (userId != null) {\n\t\t\treturn `user:${String(userId)}`\n\t\t}\n\t\tconst ip = firstHop(req.headers, ipHeader)\n\t\treturn ip ? `ip:${ip}` : null\n\t}\n"],"mappings":";;;;;;;AAQA,MAAa,mBACX,cACA,QAAQ;CACR,MAAM,SAAS,IAAI,MAAM;CACzB,IAAI,UAAU,MACb,OAAO,QAAQ,OAAO,MAAM;CAE7B,MAAM,KAAK,SAAS,IAAI,SAAS,QAAQ;CACzC,OAAO,KAAK,MAAM,OAAO;AAC1B"}

package/dist/spam/providers/hcaptcha.d.ts

@@ -0,0 +1,17 @@
+import { CaptchaProvider } from "../types.js";
+
+//#region src/spam/providers/hcaptcha.d.ts
+type HcaptchaProviderOptions = {
+  /** hCaptcha secret key (server-side, never the site key). */secretKey: string; /** Override the siteverify endpoint. */
+  verifyUrl?: string; /** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */
+  ipHeader?: string; /** Verification request timeout in ms. Default 5000. */
+  timeoutMs?: number;
+};
+/**
+ * hCaptcha verification adapter. Network errors, timeouts, and non-2xx responses fail closed
+ * (the submission is rejected).
+ */
+declare const hcaptchaProvider: (options: HcaptchaProviderOptions) => CaptchaProvider;
+//#endregion
+export { HcaptchaProviderOptions, hcaptchaProvider };
+//# sourceMappingURL=hcaptcha.d.ts.map

package/dist/spam/providers/hcaptcha.js

@@ -0,0 +1,18 @@
+import { defineCaptchaProvider } from "../captcha.js";
+import { postSiteverify, siteverifyParams } from "./siteverify.js";
+//#region src/spam/providers/hcaptcha.ts
+const HCAPTCHA_VERIFY_URL = "https://api.hcaptcha.com/siteverify";
+/**
+* hCaptcha verification adapter. Network errors, timeouts, and non-2xx responses fail closed
+* (the submission is rejected).
+*/
+const hcaptchaProvider = (options) => defineCaptchaProvider({
+	type: "hcaptcha",
+	verify: async ({ token, req }) => {
+		return (await postSiteverify(options.verifyUrl ?? HCAPTCHA_VERIFY_URL, siteverifyParams(options, token, req), options.timeoutMs ?? 5e3))?.success === true;
+	}
+});
+//#endregion
+export { hcaptchaProvider };
+
+//# sourceMappingURL=hcaptcha.js.map

package/dist/spam/providers/hcaptcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hcaptcha.js","names":[],"sources":["../../../src/spam/providers/hcaptcha.ts"],"sourcesContent":["import { defineCaptchaProvider } from '../captcha'\nimport type { CaptchaProvider } from '../types'\nimport { DEFAULT_SITEVERIFY_TIMEOUT, postSiteverify, siteverifyParams } from './siteverify'\n\nconst HCAPTCHA_VERIFY_URL = 'https://api.hcaptcha.com/siteverify'\n\nexport type HcaptchaProviderOptions = {\n\t/** hCaptcha secret key (server-side, never the site key). */\n\tsecretKey: string\n\t/** Override the siteverify endpoint. */\n\tverifyUrl?: string\n\t/** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */\n\tipHeader?: string\n\t/** Verification request timeout in ms. Default 5000. */\n\ttimeoutMs?: number\n}\n\n/**\n * hCaptcha verification adapter. Network errors, timeouts, and non-2xx responses fail closed\n * (the submission is rejected).\n */\nexport const hcaptchaProvider = (options: HcaptchaProviderOptions): CaptchaProvider =>\n\tdefineCaptchaProvider({\n\t\ttype: 'hcaptcha',\n\t\tverify: async ({ token, req }) => {\n\t\t\tconst result = await postSiteverify(\n\t\t\t\toptions.verifyUrl ?? HCAPTCHA_VERIFY_URL,\n\t\t\t\tsiteverifyParams(options, token, req),\n\t\t\t\toptions.timeoutMs ?? DEFAULT_SITEVERIFY_TIMEOUT\n\t\t\t)\n\t\t\treturn result?.success === true\n\t\t},\n\t})\n"],"mappings":";;;AAIA,MAAM,sBAAsB;;;;;AAiB5B,MAAa,oBAAoB,YAChC,sBAAsB;CACrB,MAAM;CACN,QAAQ,OAAO,EAAE,OAAO,UAAU;EAMjC,QAAO,MALc,eACpB,QAAQ,aAAa,qBACrB,iBAAiB,SAAS,OAAO,GAAG,GACpC,QAAQ,aAAA,GACT,IACe,YAAY;CAC5B;AACD,CAAC"}

package/dist/spam/providers/recaptcha.d.ts

@@ -0,0 +1,23 @@
+import { CaptchaProvider } from "../types.js";
+
+//#region src/spam/providers/recaptcha.d.ts
+type RecaptchaProviderOptions = {
+  /** reCAPTCHA secret key (server-side, never the site key). */secretKey: string;
+  /**
+   * Minimum acceptable v3 score (0 to 1). Applied only when the response carries a score,
+   * defaulting to 0.5; v2 responses have no score and pass on `success` alone.
+   */
+  minScore?: number; /** Override the siteverify endpoint. */
+  verifyUrl?: string; /** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */
+  ipHeader?: string; /** Verification request timeout in ms. Default 5000. */
+  timeoutMs?: number;
+};
+/**
+ * Google reCAPTCHA verification adapter for both v2 (checkbox) and v3 (score) tokens. A v3
+ * response must also meet `minScore`. Network errors, timeouts, and non-2xx responses fail
+ * closed (the submission is rejected).
+ */
+declare const recaptchaProvider: (options: RecaptchaProviderOptions) => CaptchaProvider;
+//#endregion
+export { RecaptchaProviderOptions, recaptchaProvider };
+//# sourceMappingURL=recaptcha.d.ts.map

package/dist/spam/providers/recaptcha.js

@@ -0,0 +1,23 @@
+import { defineCaptchaProvider } from "../captcha.js";
+import { postSiteverify, siteverifyParams } from "./siteverify.js";
+//#region src/spam/providers/recaptcha.ts
+const RECAPTCHA_VERIFY_URL = "https://www.google.com/recaptcha/api/siteverify";
+const DEFAULT_MIN_SCORE = .5;
+/**
+* Google reCAPTCHA verification adapter for both v2 (checkbox) and v3 (score) tokens. A v3
+* response must also meet `minScore`. Network errors, timeouts, and non-2xx responses fail
+* closed (the submission is rejected).
+*/
+const recaptchaProvider = (options) => defineCaptchaProvider({
+	type: "recaptcha",
+	verify: async ({ token, req }) => {
+		const result = await postSiteverify(options.verifyUrl ?? RECAPTCHA_VERIFY_URL, siteverifyParams(options, token, req), options.timeoutMs ?? 5e3);
+		if (result?.success !== true) return false;
+		if (typeof result.score === "number") return result.score >= (options.minScore ?? DEFAULT_MIN_SCORE);
+		return true;
+	}
+});
+//#endregion
+export { recaptchaProvider };
+
+//# sourceMappingURL=recaptcha.js.map

package/dist/spam/providers/recaptcha.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recaptcha.js","names":[],"sources":["../../../src/spam/providers/recaptcha.ts"],"sourcesContent":["import { defineCaptchaProvider } from '../captcha'\nimport type { CaptchaProvider } from '../types'\nimport { DEFAULT_SITEVERIFY_TIMEOUT, postSiteverify, siteverifyParams } from './siteverify'\n\nconst RECAPTCHA_VERIFY_URL = 'https://www.google.com/recaptcha/api/siteverify'\nconst DEFAULT_MIN_SCORE = 0.5\n\nexport type RecaptchaProviderOptions = {\n\t/** reCAPTCHA secret key (server-side, never the site key). */\n\tsecretKey: string\n\t/**\n\t * Minimum acceptable v3 score (0 to 1). Applied only when the response carries a score,\n\t * defaulting to 0.5; v2 responses have no score and pass on `success` alone.\n\t */\n\tminScore?: number\n\t/** Override the siteverify endpoint. */\n\tverifyUrl?: string\n\t/** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */\n\tipHeader?: string\n\t/** Verification request timeout in ms. Default 5000. */\n\ttimeoutMs?: number\n}\n\n/**\n * Google reCAPTCHA verification adapter for both v2 (checkbox) and v3 (score) tokens. A v3\n * response must also meet `minScore`. Network errors, timeouts, and non-2xx responses fail\n * closed (the submission is rejected).\n */\nexport const recaptchaProvider = (options: RecaptchaProviderOptions): CaptchaProvider =>\n\tdefineCaptchaProvider({\n\t\ttype: 'recaptcha',\n\t\tverify: async ({ token, req }) => {\n\t\t\tconst result = await postSiteverify(\n\t\t\t\toptions.verifyUrl ?? RECAPTCHA_VERIFY_URL,\n\t\t\t\tsiteverifyParams(options, token, req),\n\t\t\t\toptions.timeoutMs ?? DEFAULT_SITEVERIFY_TIMEOUT\n\t\t\t)\n\t\t\tif (result?.success !== true) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (typeof result.score === 'number') {\n\t\t\t\treturn result.score >= (options.minScore ?? DEFAULT_MIN_SCORE)\n\t\t\t}\n\t\t\treturn true\n\t\t},\n\t})\n"],"mappings":";;;AAIA,MAAM,uBAAuB;AAC7B,MAAM,oBAAoB;;;;;;AAuB1B,MAAa,qBAAqB,YACjC,sBAAsB;CACrB,MAAM;CACN,QAAQ,OAAO,EAAE,OAAO,UAAU;EACjC,MAAM,SAAS,MAAM,eACpB,QAAQ,aAAa,sBACrB,iBAAiB,SAAS,OAAO,GAAG,GACpC,QAAQ,aAAA,GACT;EACA,IAAI,QAAQ,YAAY,MACvB,OAAO;EAER,IAAI,OAAO,OAAO,UAAU,UAC3B,OAAO,OAAO,UAAU,QAAQ,YAAY;EAE7C,OAAO;CACR;AACD,CAAC"}

package/dist/spam/providers/siteverify.js

@@ -0,0 +1,34 @@
+import { firstHop } from "../clientIp.js";
+//#region src/spam/providers/siteverify.ts
+const DEFAULT_SITEVERIFY_TIMEOUT = 5e3;
+/** Form params for a siteverify POST: secret + response, plus `remoteip` when the IP header resolves. */
+const siteverifyParams = (args, token, req) => {
+	const params = new URLSearchParams({
+		secret: args.secretKey,
+		response: token
+	});
+	const remoteip = firstHop(req.headers, args.ipHeader ?? "x-forwarded-for");
+	if (remoteip) params.set("remoteip", remoteip);
+	return params;
+};
+/**
+* POST a form-encoded siteverify request. Network errors, timeouts, and non-2xx responses all
+* resolve to null so adapters fail closed instead of throwing into the submission path.
+*/
+const postSiteverify = async (url, params, timeoutMs) => {
+	try {
+		const res = await fetch(url, {
+			method: "POST",
+			body: params,
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (!res.ok) return null;
+		return await res.json();
+	} catch {
+		return null;
+	}
+};
+//#endregion
+export { DEFAULT_SITEVERIFY_TIMEOUT, postSiteverify, siteverifyParams };
+
+//# sourceMappingURL=siteverify.js.map

package/dist/spam/providers/siteverify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"siteverify.js","names":[],"sources":["../../../src/spam/providers/siteverify.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\nimport { firstHop } from '../clientIp'\n\n/** The response shape shared by the Turnstile, reCAPTCHA, and hCaptcha siteverify endpoints. */\nexport type SiteverifyResult = {\n\tsuccess?: boolean\n\tscore?: number\n\t'error-codes'?: string[]\n}\n\nexport const DEFAULT_SITEVERIFY_TIMEOUT = 5_000\n\nexport type SiteverifyParamsArgs = {\n\tsecretKey: string\n\t/** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */\n\tipHeader?: string\n}\n\n/** Form params for a siteverify POST: secret + response, plus `remoteip` when the IP header resolves. */\nexport const siteverifyParams = (\n\targs: SiteverifyParamsArgs,\n\ttoken: string,\n\treq: PayloadRequest\n): URLSearchParams => {\n\tconst params = new URLSearchParams({ secret: args.secretKey, response: token })\n\tconst remoteip = firstHop(req.headers, args.ipHeader ?? 'x-forwarded-for')\n\tif (remoteip) {\n\t\tparams.set('remoteip', remoteip)\n\t}\n\treturn params\n}\n\n/**\n * POST a form-encoded siteverify request. Network errors, timeouts, and non-2xx responses all\n * resolve to null so adapters fail closed instead of throwing into the submission path.\n */\nexport const postSiteverify = async (\n\turl: string,\n\tparams: URLSearchParams,\n\ttimeoutMs: number\n): Promise<SiteverifyResult | null> => {\n\ttry {\n\t\tconst res = await fetch(url, {\n\t\t\tmethod: 'POST',\n\t\t\tbody: params,\n\t\t\tsignal: AbortSignal.timeout(timeoutMs),\n\t\t})\n\t\tif (!res.ok) {\n\t\t\treturn null\n\t\t}\n\t\treturn (await res.json()) as SiteverifyResult\n\t} catch {\n\t\treturn null\n\t}\n}\n"],"mappings":";;AAUA,MAAa,6BAA6B;;AAS1C,MAAa,oBACZ,MACA,OACA,QACqB;CACrB,MAAM,SAAS,IAAI,gBAAgB;EAAE,QAAQ,KAAK;EAAW,UAAU;CAAM,CAAC;CAC9E,MAAM,WAAW,SAAS,IAAI,SAAS,KAAK,YAAY,iBAAiB;CACzE,IAAI,UACH,OAAO,IAAI,YAAY,QAAQ;CAEhC,OAAO;AACR;;;;;AAMA,MAAa,iBAAiB,OAC7B,KACA,QACA,cACsC;CACtC,IAAI;EACH,MAAM,MAAM,MAAM,MAAM,KAAK;GAC5B,QAAQ;GACR,MAAM;GACN,QAAQ,YAAY,QAAQ,SAAS;EACtC,CAAC;EACD,IAAI,CAAC,IAAI,IACR,OAAO;EAER,OAAQ,MAAM,IAAI,KAAK;CACxB,QAAQ;EACP,OAAO;CACR;AACD"}

package/dist/spam/providers/turnstile.d.ts

@@ -0,0 +1,17 @@
+import { CaptchaProvider } from "../types.js";
+
+//#region src/spam/providers/turnstile.d.ts
+type TurnstileProviderOptions = {
+  /** Turnstile secret key (server-side, never the site key). */secretKey: string; /** Override the siteverify endpoint. */
+  verifyUrl?: string; /** Header read for the client IP forwarded as `remoteip`. Default 'x-forwarded-for'. */
+  ipHeader?: string; /** Verification request timeout in ms. Default 5000. */
+  timeoutMs?: number;
+};
+/**
+ * Cloudflare Turnstile verification adapter. Network errors, timeouts, and non-2xx responses
+ * fail closed (the submission is rejected).
+ */
+declare const turnstileProvider: (options: TurnstileProviderOptions) => CaptchaProvider;
+//#endregion
+export { TurnstileProviderOptions, turnstileProvider };
+//# sourceMappingURL=turnstile.d.ts.map