@10x-media/form-builder 0.1.0-beta.0 → 0.1.0-beta.2

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @10x-media/form-builder
 
+## 0.1.0-beta.2
+
+### Minor Changes
+
+- Add `repeater` field type: a field that captures a dynamic list of rows, each containing a set of sub-fields defined once in the admin UI. Includes row-count validation (`minRows`/`maxRows`), a client-side renderer with add/remove row controls, per-row sub-field validation on the server, and a numbered row view in the submission answers panel.
+
+  Fix `minRows` zero-row bypass: a repeater submitted with no rows was silently accepted even when `minRows > 0`, because the empty-array coercion was immediately skipped by the field loop's empty guard. The guard now lets repeaters fall through to `validate()` so row-count constraints are enforced correctly.
+
+  Fix sub-field error display: server-side sub-field validation errors (reported with path `fieldName[rowIndex].subFieldName`) are now surfaced inline next to the offending input in the repeater renderer. Client-side sub-field validation also runs on submit so errors appear before the request is sent.
+
+  Replace `deepMerge`-based collection overrides with an explicit spread API. The `overrides` plugin option now accepts `CollectionOverrides` objects for `forms`, `formSubmissions`, and `uploads`. Fields are overridden via a `FieldsOverride` function (`({ defaultFields }) => Field[]`) that receives the plugin's defaults and returns the final array, making additions and removals intentional. Hooks are appended after the plugin's own hooks, guaranteeing that the spam guard and submission validator always run first. Spread order per key is documented and encodes who wins without relying on a merge library.
+
+  Add `renderSubmit`, `renderNext`, and `renderBack` render props to `<Form>` for replacing the default control buttons with custom components. Also add `submitButtonClassName`, `nextButtonClassName`, and `backButtonClassName` for styling the default buttons without replacing them.
+
+  Add `showSubmissionRawFields` plugin option. The submission admin view now renders a formatted `SubmissionAnswers` component (formatted values, repeater rows, consent proofs, metadata) as the primary view. The raw `values`, `descriptors`, and `consent` JSON fields are hidden by default because they are fully represented by this component; set `showSubmissionRawFields: true` to show them.
+
+## 0.1.0-beta.1
+
+### Minor Changes
+
+- `<Form>` and `<FormResults>` now default to bundled English strings when no `t` prop is provided, so users without a custom translation setup see real copy instead of raw translation keys. The `en` map and `makeTranslate` helper are exported from the `/react` subpath for building custom translators.
+
+- Consent field source config is now context-sensitive: the `source` select is generated dynamically from the live `consentRegistry` (so custom sources appear without code changes), and each source's config fields use `admin.condition` to show only the fields relevant to the currently selected source. Previously all source config fields were visible at once regardless of the selected source type.
+
+- Add a visual flow builder to the `forms` collection. The previously headless `flow` field now has an admin authoring UI: add, reorder, insert, and remove steps; assign fields per step; and set a default next step plus ordered conditional transitions built with the same condition builder used for field visibility. A flow that collapses to fewer than two valid steps is now rejected with a clear validation error on save instead of being silently discarded.
+
+- Add `className` prop to `<Form>`: additional CSS classes are merged onto the root `<form>` element (and the post-submit success node) via the new `cn` utility, which is also exported from the `/react` subpath for use in custom renderers and field components.
+
+- Improve TypeScript ergonomics when passing Payload-fetched forms to `<Form>`:
+
+  - Adds `toFormDocument(form)` helper (exported from `/react`) that bridges the structural mismatch between Payload's generated collection types and `FormDocument` without an unsafe cast
+  - Exports `FormFieldInstance` from both `/react` and `/types` subpaths
+  - Adds `typescriptSchema` to the `flow` JSON field so Payload generates a `FormFlow`-shaped type instead of opaque `unknown`
+
+- Add a typed `translations` option to every plugin factory and make translation keys a stable public API. Each plugin's `./i18n` subpath now exports the `keys` object, the `TranslationKey` union, and the `TranslationsOption` shape. Overrides are flat and per-locale: values win over the built-in locales key-by-key, locales a plugin does not ship are added whole, and app-level `i18n.translations` still wins over everything.
+
+  ```ts
+  import { analytics } from "@10x-media/analytics";
+  import { keys } from "@10x-media/analytics/i18n";
+
+  analytics({
+    adapters: [nativeAdapter()],
+    translations: {
+      de: { [keys.pluginName]: "Analytik" },
+    },
+  });
+  ```
+
+  A typo'd key inside `translations` is a compile error.
+
+### Patch Changes
+
+- Polish the condition builder admin UI: bare `<button>` elements are replaced with Payload's `Button` component, the OR/AND separators render as themed labels (`fb-condition-builder__or-label` / `fb-condition-builder__and-label`), and the row layout ships as class-based styles in the bundled `@10x-media/form-builder/styles.css` (using Payload CSS variables for light/dark theming). Import that stylesheet in your admin layout to pick up the builder styling.
+
+- Prevent action secrets from leaking to anonymous callers: the `actions` blocks field (which can contain webhook secrets and email recipients) is now restricted to authenticated reads only. The `forms` collection remains publicly readable so forms can be rendered without authentication. Also introduces a shared `isLoggedIn` access helper used across all form-builder collections.
+
+- Fix honeypot false positives caused by Chrome autofill: `DEFAULT_HONEYPOT_FIELD` is renamed from `'confirm_email'` to `'website'` (names containing "email" trigger Chrome's email-address heuristic), and the hidden input now uses `autoComplete="new-password"` which Chrome reliably respects over the commonly ignored `"off"`.
+
+- Prevent anonymous clients from bypassing post-submit actions via a client-supplied `status: 'partial'`: `validateSubmission` now forces `status` to `'complete'` on every unauthenticated create, and field-level access prevents anonymous REST callers from setting the status field at all. Authenticated callers (admin draft-save flows) may still set `partial`.
+
+- Move `@standard-schema/spec` from devDependencies to dependencies. Its types are part of the public validation API surface, and as a devDependency its declaration file was inlined under `dist/node_modules` instead of resolving from the consumer's install.
+
+- Restructure README: features, quick start, and links into the documentation site at https://docs.10xmedia.de. Long-form documentation moved out of the package README.
+
+- Update README documentation links: the docs site now serves from the domain root, so `docs.10xmedia.de/docs/<plugin>` links became `docs.10xmedia.de/<plugin>`.
+
+- Ship per-file dist output instead of bundled chunks. Bundling merged client components into shared chunks and dropped their 'use client' directives, so Next.js lost the RSC boundary and the admin panel crashed with "useRef only works in Client Components" when rendering components imported through such a chunk (for analytics: every chart-based dashboard widget). Dist now mirrors src one file at a time, directives stay exactly where they were authored, and file names are stable across releases. A repo-level `check:dist` verification (directive parity, no inlined dependencies, exports resolution, publint) now runs in CI so this class of regression cannot ship again.
+
 ## 0.1.0-beta.0
 
 ### Minor Changes