@10x-media/form-builder 0.1.0-beta.0

package/dist/fieldTypes-CzhhJXjg.js

@@ -0,0 +1,88 @@
+//#region src/conditions/fieldTypes.ts
+const EQUALITY = ["equals", "not_equals"];
+const MEMBERSHIP = ["in", "not_in"];
+const ORDER = [
+	"greater_than",
+	"greater_than_equal",
+	"less_than",
+	"less_than_equal"
+];
+const TEXT_MATCH = [
+	"like",
+	"not_like",
+	"contains"
+];
+const EXISTS = ["exists"];
+/** Operators offered per condition type. Each is implemented by `evaluateCondition`. */
+const conditionOperators = {
+	text: [
+		...EQUALITY,
+		...MEMBERSHIP,
+		...TEXT_MATCH,
+		...EXISTS
+	],
+	number: [
+		...EQUALITY,
+		...MEMBERSHIP,
+		...ORDER,
+		...EXISTS
+	],
+	select: [
+		...EQUALITY,
+		...MEMBERSHIP,
+		...EXISTS
+	],
+	checkbox: [...EQUALITY, ...EXISTS],
+	date: [
+		...EQUALITY,
+		...ORDER,
+		...EXISTS
+	]
+};
+/** Default condition input for a stored value kind; a field type may override via its `conditionType`. */
+const defaultConditionType = (value) => {
+	switch (value) {
+		case "number": return "number";
+		case "boolean": return "checkbox";
+		case "date": return "date";
+		case "text[]": return "select";
+		default: return "text";
+	}
+};
+const OPERATOR_LABEL_KEYS = {
+	equals: "operators:equals",
+	not_equals: "operators:isNotEqualTo",
+	in: "operators:isIn",
+	not_in: "operators:isNotIn",
+	exists: "operators:exists",
+	greater_than: "operators:isGreaterThan",
+	greater_than_equal: "operators:isGreaterThanOrEqualTo",
+	less_than: "operators:isLessThan",
+	less_than_equal: "operators:isLessThanOrEqualTo",
+	like: "operators:isLike",
+	not_like: "operators:isNotLike",
+	contains: "operators:contains"
+};
+/**
+* The i18n key for an operator's label, in Payload's own `operators:*` namespace (always present in the
+* admin), so the builder reads native, localized operator labels without duplicating them in our i18n.
+* Keys mirror Payload's `WhereBuilder/field-types.tsx` operator labels. Every operator surfaced by
+* `conditionOperators` is mapped; the `operators:equals` fallback is unreachable for the offered
+* catalogs (no geo/`all` operator is ever presented) and exists only to keep the return type total.
+*/
+const operatorLabelKey = (operator) => OPERATOR_LABEL_KEYS[operator] ?? "operators:equals";
+/**
+* The first (default) operator a condition type offers. Every catalog leads with `equals`, so the
+* fallback is unreachable; it exists only to keep the return non-optional under `noUncheckedIndexedAccess`.
+*/
+const firstOperatorFor = (type) => conditionOperators[type][0] ?? "equals";
+/** The value control an operator needs: a boolean toggle (`exists`), a list (`in`/`not_in`), or a scalar. */
+const operatorValueShape = (operator) => {
+	if (operator === "exists") return "boolean";
+	if (operator === "in" || operator === "not_in") return "array";
+	return "scalar";
+};
+//#endregion
+export { operatorValueShape as a, operatorLabelKey as i, defaultConditionType as n, firstOperatorFor as r, conditionOperators as t };
+
+//# sourceMappingURL=fieldTypes-CzhhJXjg.js.map

package/dist/fieldTypes-CzhhJXjg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fieldTypes-CzhhJXjg.js","names":[],"sources":["../src/conditions/fieldTypes.ts"],"sourcesContent":["import type { Operator } from 'payload'\nimport type { FormFieldValueKind } from '../fields/types'\n\n/**\n * The condition input families the builder supports. A deliberate subset of Payload's field-condition\n * types, restricted to the operators `evaluateCondition` implements (no geo/relationship in v1).\n */\nexport type ConditionFieldType = 'text' | 'number' | 'select' | 'checkbox' | 'date'\n\nconst EQUALITY: Operator[] = ['equals', 'not_equals']\nconst MEMBERSHIP: Operator[] = ['in', 'not_in']\nconst ORDER: Operator[] = ['greater_than', 'greater_than_equal', 'less_than', 'less_than_equal']\nconst TEXT_MATCH: Operator[] = ['like', 'not_like', 'contains']\nconst EXISTS: Operator[] = ['exists']\n\n/** Operators offered per condition type. Each is implemented by `evaluateCondition`. */\nexport const conditionOperators: Record<ConditionFieldType, Operator[]> = {\n\ttext: [...EQUALITY, ...MEMBERSHIP, ...TEXT_MATCH, ...EXISTS],\n\tnumber: [...EQUALITY, ...MEMBERSHIP, ...ORDER, ...EXISTS],\n\tselect: [...EQUALITY, ...MEMBERSHIP, ...EXISTS],\n\tcheckbox: [...EQUALITY, ...EXISTS],\n\tdate: [...EQUALITY, ...ORDER, ...EXISTS],\n}\n\n/** Default condition input for a stored value kind; a field type may override via its `conditionType`. */\nexport const defaultConditionType = (value: FormFieldValueKind): ConditionFieldType => {\n\tswitch (value) {\n\t\tcase 'number':\n\t\t\treturn 'number'\n\t\tcase 'boolean':\n\t\t\treturn 'checkbox'\n\t\tcase 'date':\n\t\t\treturn 'date'\n\t\tcase 'text[]':\n\t\t\treturn 'select'\n\t\tdefault:\n\t\t\treturn 'text'\n\t}\n}\n\n/**\n * The Payload `operators:*` i18n keys the builder uses for operator labels. A local literal union (not\n * imported from `@payloadcms/translations`, which this package never depends on); each member is a real\n * client translation key, so a value of this type is accepted by Payload's `i18n.t`.\n */\nexport type OperatorLabelKey =\n\t| 'operators:contains'\n\t| 'operators:equals'\n\t| 'operators:exists'\n\t| 'operators:isGreaterThan'\n\t| 'operators:isGreaterThanOrEqualTo'\n\t| 'operators:isIn'\n\t| 'operators:isLessThan'\n\t| 'operators:isLessThanOrEqualTo'\n\t| 'operators:isLike'\n\t| 'operators:isNotEqualTo'\n\t| 'operators:isNotIn'\n\t| 'operators:isNotLike'\n\nconst OPERATOR_LABEL_KEYS: Partial<Record<Operator, OperatorLabelKey>> = {\n\tequals: 'operators:equals',\n\tnot_equals: 'operators:isNotEqualTo',\n\tin: 'operators:isIn',\n\tnot_in: 'operators:isNotIn',\n\texists: 'operators:exists',\n\tgreater_than: 'operators:isGreaterThan',\n\tgreater_than_equal: 'operators:isGreaterThanOrEqualTo',\n\tless_than: 'operators:isLessThan',\n\tless_than_equal: 'operators:isLessThanOrEqualTo',\n\tlike: 'operators:isLike',\n\tnot_like: 'operators:isNotLike',\n\tcontains: 'operators:contains',\n}\n\n/**\n * The i18n key for an operator's label, in Payload's own `operators:*` namespace (always present in the\n * admin), so the builder reads native, localized operator labels without duplicating them in our i18n.\n * Keys mirror Payload's `WhereBuilder/field-types.tsx` operator labels. Every operator surfaced by\n * `conditionOperators` is mapped; the `operators:equals` fallback is unreachable for the offered\n * catalogs (no geo/`all` operator is ever presented) and exists only to keep the return type total.\n */\nexport const operatorLabelKey = (operator: Operator): OperatorLabelKey =>\n\tOPERATOR_LABEL_KEYS[operator] ?? 'operators:equals'\n\n/**\n * The first (default) operator a condition type offers. Every catalog leads with `equals`, so the\n * fallback is unreachable; it exists only to keep the return non-optional under `noUncheckedIndexedAccess`.\n */\nexport const firstOperatorFor = (type: ConditionFieldType): Operator =>\n\tconditionOperators[type][0] ?? 'equals'\n\n/** The value control an operator needs: a boolean toggle (`exists`), a list (`in`/`not_in`), or a scalar. */\nexport const operatorValueShape = (operator: Operator): 'boolean' | 'array' | 'scalar' => {\n\tif (operator === 'exists') {\n\t\treturn 'boolean'\n\t}\n\tif (operator === 'in' || operator === 'not_in') {\n\t\treturn 'array'\n\t}\n\treturn 'scalar'\n}\n"],"mappings":";AASA,MAAM,WAAuB,CAAC,UAAU,YAAY;AACpD,MAAM,aAAyB,CAAC,MAAM,QAAQ;AAC9C,MAAM,QAAoB;CAAC;CAAgB;CAAsB;CAAa;AAAiB;AAC/F,MAAM,aAAyB;CAAC;CAAQ;CAAY;AAAU;AAC9D,MAAM,SAAqB,CAAC,QAAQ;;AAGpC,MAAa,qBAA6D;CACzE,MAAM;EAAC,GAAG;EAAU,GAAG;EAAY,GAAG;EAAY,GAAG;CAAM;CAC3D,QAAQ;EAAC,GAAG;EAAU,GAAG;EAAY,GAAG;EAAO,GAAG;CAAM;CACxD,QAAQ;EAAC,GAAG;EAAU,GAAG;EAAY,GAAG;CAAM;CAC9C,UAAU,CAAC,GAAG,UAAU,GAAG,MAAM;CACjC,MAAM;EAAC,GAAG;EAAU,GAAG;EAAO,GAAG;CAAM;AACxC;;AAGA,MAAa,wBAAwB,UAAkD;CACtF,QAAQ,OAAR;EACC,KAAK,UACJ,OAAO;EACR,KAAK,WACJ,OAAO;EACR,KAAK,QACJ,OAAO;EACR,KAAK,UACJ,OAAO;EACR,SACC,OAAO;CACT;AACD;AAqBA,MAAM,sBAAmE;CACxE,QAAQ;CACR,YAAY;CACZ,IAAI;CACJ,QAAQ;CACR,QAAQ;CACR,cAAc;CACd,oBAAoB;CACpB,WAAW;CACX,iBAAiB;CACjB,MAAM;CACN,UAAU;CACV,UAAU;AACX;;;;;;;;AASA,MAAa,oBAAoB,aAChC,oBAAoB,aAAa;;;;;AAMlC,MAAa,oBAAoB,SAChC,mBAAmB,MAAM,MAAM;;AAGhC,MAAa,sBAAsB,aAAuD;CACzF,IAAI,aAAa,UAChB,OAAO;CAER,IAAI,aAAa,QAAQ,aAAa,UACrC,OAAO;CAER,OAAO;AACR"}

package/dist/index-DfFYGbVF.d.ts

@@ -0,0 +1,481 @@
+import { c as Translate, d as FileRefError, i as FormFieldDefinition, l as FileFieldConfig, r as FormFieldConfigValues, s as FormFieldValueKind, u as FileRef } from "./fieldTypes-B8jkNRob.js";
+import { A as FieldMeta, E as CalcExpression, F as SubmissionValue, M as FormFieldInstance, N as SubmissionDescriptor, O as AggregationRow, c as PresentationDescriptor, d as ValidationParams, f as ValidationRuleDefinition, g as FormEventSink, j as SubmissionStatusFilter, k as FieldAggregation, u as AnyValidationRuleDefinition, x as FieldTypesConfig } from "./constants-B-BUfetP.js";
+import { CollectionConfig, Field, Payload, PayloadRequest, Where as Where$1 } from "payload";
+
+//#region src/actions/defineAction.d.ts
+/** Context passed to an action's `run` when a submission completes. */
+type ActionRunArgs<TConfig extends Record<string, unknown> = Record<string, unknown>> = {
+  form: {
+    id: number | string;
+    title?: string;
+  };
+  submissionId: number | string;
+  values: SubmissionValue[];
+  descriptors: SubmissionDescriptor[];
+  config: TConfig;
+  payload: Payload;
+  req?: PayloadRequest;
+  locale: string;
+  t: Translate;
+};
+/**
+ * A post-submit action type, authored once: `config` is the admin `Field[]` for authoring;
+ * `run` executes when a submission completes. Built-ins use this same primitive.
+ */
+type ActionDefinition<TConfig extends Record<string, unknown> = Record<string, unknown>> = {
+  type: string;
+  label: string;
+  config?: Field[];
+  run: (args: ActionRunArgs<TConfig>) => Promise<void> | void;
+};
+/** Erased shape stored in the registry; config re-narrows per matched type at execution. */
+type AnyActionDefinition = ActionDefinition<Record<string, unknown>>;
+declare const defineAction: <TConfig extends Record<string, unknown> = Record<string, unknown>>(definition: ActionDefinition<TConfig>) => ActionDefinition<TConfig>;
+//#endregion
+//#region src/actions/registry.d.ts
+type ActionRegistry = Map<string, AnyActionDefinition>;
+/** `false` removes a built-in, `true` keeps it, a definition adds or replaces one. */
+type ActionOption = boolean | AnyActionDefinition;
+type ActionsConfig = Record<string, ActionOption>;
+/**
+ * Resolve the active action registry from built-in defaults and a consumer override map. `false`
+ * removes a type, `true` keeps the default (no-op when none exists), a definition adds or replaces.
+ * Mirrors the field-type and validation-rule registry convention.
+ */
+declare const resolveActions: (defaults: Record<string, AnyActionDefinition>, config?: ActionsConfig) => ActionRegistry;
+//#endregion
+//#region src/actions/runActions.d.ts
+type ActionResult = {
+  type: string;
+  ok: boolean;
+  error?: string;
+};
+//#endregion
+//#region src/aggregation/aggregateResponses.d.ts
+type AggregateFormResponsesArgs = {
+  payload: Payload;
+  formId: number | string; /** Field machine names to aggregate. Defaults to every field that declares options (enumerable). */
+  fields?: string[]; /** Submission status to count. Defaults to `complete`. */
+  status?: SubmissionStatusFilter;
+  req?: PayloadRequest; /** Safety cap on submissions scanned; beyond it the result is flagged `truncated`. Default 10000. */
+  maxSubmissions?: number; /** Page size for the submission scan. Default 500. */
+  pageSize?: number;
+};
+/** True when a field declares non-empty options (a choice field safe to aggregate publicly). */
+declare const fieldHasOptions: (field: FormFieldInstance) => boolean;
+/**
+ * Aggregate submission responses for a form. Loads the form for current labels + option order, then pages
+ * `payload.find` over its submissions (JSON `values` cannot be GROUP BY'd portably across Mongo + Postgres,
+ * so we scan + reduce in JS, cross-DB-identically). Bounded by `maxSubmissions`; beyond it the result is
+ * `truncated`. Returns one `FieldAggregation` per requested field (or per enumerable field by default).
+ */
+declare const aggregateFormResponses: (args: AggregateFormResponsesArgs) => Promise<FieldAggregation[]>;
+type AggregateFieldResponsesArgs = Omit<AggregateFormResponsesArgs, 'fields'> & {
+  field: string;
+};
+/** Single-field convenience over `aggregateFormResponses`. Returns the field's aggregation, or null if absent. */
+declare const aggregateFieldResponses: (args: AggregateFieldResponsesArgs) => Promise<FieldAggregation | null>;
+//#endregion
+//#region src/aggregation/resolveResultsRequest.d.ts
+type ResolveResultsRequestArgs = {
+  payload: Payload;
+  formId: number | string | undefined; /** The requested field (query param). */
+  field?: string; /** Whether the caller is authenticated (an admin/user). */
+  isAuthed: boolean;
+  req?: PayloadRequest;
+};
+type ResolveResultsRequestResult = {
+  status: number;
+  body: {
+    results: FieldAggregation[];
+  } | {
+    errors: {
+      message: string;
+    }[];
+  };
+};
+/**
+ * Authorize and resolve a poll/survey results request. Authed callers may aggregate any field (or all
+ * enumerable fields). Anonymous callers are allowed only when the form opted in (`showResults`), and then
+ * only for the configured `resultsField`, and only if that field is enumerable (has options) so a
+ * misconfigured `resultsField` pointing at a free-text or PII field can never be dumped publicly. Returns
+ * only aggregate counts, never raw submissions.
+ */
+declare const resolveFormResultsRequest: (args: ResolveResultsRequestArgs) => Promise<ResolveResultsRequestResult>;
+//#endregion
+//#region src/collections/uploads.d.ts
+declare const FORM_UPLOADS_SLUG = "form-uploads";
+/** Override surface for the built-in upload collection. */
+type UploadsCollectionConfig = {
+  slug?: string; /** Merged onto the collection's `upload` config (e.g. `staticDir`, `mimeTypes`). `true` uses Payload defaults. */
+  upload?: NonNullable<CollectionConfig['upload']> | true; /** Replace access (defaults: anonymous create, authed read/update/delete). */
+  access?: CollectionConfig['access']; /** Append extra fields. */
+  fields?: CollectionConfig['fields'];
+};
+type UploadsOption = boolean | UploadsCollectionConfig;
+/**
+ * The built-in upload collection backing the `file` field. Anonymous create (public forms upload here),
+ * authed read/update/delete (only admins read stored files; submitters cannot enumerate others' uploads).
+ * Per-field MIME/size is re-enforced at submit, so the collection stays permissive by default. No
+ * `imageSizes`, so it needs no `sharp`. Projects with their own upload collection set `uploads: false` and
+ * point the file field's `relationTo` at theirs.
+ */
+declare const buildUploadsCollection: (config?: UploadsCollectionConfig) => CollectionConfig;
+/** Resolve the `uploads` plugin option: `false` disables, `true`/object enables the built-in collection. */
+declare const resolveUploads: (option: UploadsOption | undefined) => {
+  enabled: boolean;
+  slug: string;
+  collection?: CollectionConfig;
+};
+//#endregion
+//#region src/conditions/types.d.ts
+/** A serializable field-visibility/validation condition, stored in Payload's canonical `Where` shape. */
+type FieldCondition = Where$1;
+//#endregion
+//#region src/consent/defineConsentSource.d.ts
+type ConsentLink = {
+  label: string;
+  url: string;
+};
+type ConsentResolved = {
+  links: ConsentLink[];
+  versionRef?: string;
+  versionLabel?: string;
+};
+type ConsentResolveArgs<TConfig extends Record<string, unknown> = Record<string, unknown>> = {
+  config: TConfig;
+  payload: Payload;
+  req?: PayloadRequest;
+  locale: string;
+};
+/**
+ * A consent source type, authored once: `config` is the admin `Field[]` for authoring;
+ * `resolve` returns localized policy links and an optional version reference at capture time.
+ * Built-ins use this same primitive.
+ */
+type ConsentSource<TConfig extends Record<string, unknown> = Record<string, unknown>> = {
+  type: string;
+  label: string;
+  config?: Field[];
+  resolve: (args: ConsentResolveArgs<TConfig>) => Promise<ConsentResolved> | ConsentResolved;
+};
+/** Erased shape stored in the registry; config re-narrows per matched type at resolution. */
+type AnyConsentSource = ConsentSource<Record<string, unknown>>;
+declare const defineConsentSource: <TConfig extends Record<string, unknown> = Record<string, unknown>>(source: ConsentSource<TConfig>) => ConsentSource<TConfig>;
+//#endregion
+//#region src/consent/registry.d.ts
+type ConsentSourceRegistry = Map<string, AnyConsentSource>;
+/** `false` removes a built-in, `true` keeps it, a definition adds or replaces one. */
+type ConsentSourceOption = boolean | AnyConsentSource;
+type ConsentSourcesConfig = Record<string, ConsentSourceOption>;
+/**
+ * Resolve the active consent-source registry from built-in defaults and a consumer override map.
+ * `false` removes a type, `true` keeps the default (no-op when none exists), a definition adds or
+ * replaces. Mirrors the action and field-type registry convention.
+ */
+declare const resolveConsentSources: (defaults: Record<string, AnyConsentSource>, config?: ConsentSourcesConfig) => ConsentSourceRegistry;
+//#endregion
+//#region src/consent/captureConsent.d.ts
+type ConsentProof = {
+  agreed: boolean;
+  ref?: string;
+  versionRef?: string;
+  at: string;
+};
+/**
+ * Build the authoritative consent proof at submit time: re-resolve the source server-side
+ * (ignores any client ref), capturing a reference url -- never the policy text.
+ * `now` is injected by the caller (`new Date().toISOString()`) for testability.
+ */
+declare const captureConsent: (args: {
+  field: FormFieldInstance;
+  agreed: boolean;
+  registry: ConsentSourceRegistry;
+  payload: Payload;
+  req?: PayloadRequest;
+  locale: string;
+  now: string;
+}) => Promise<ConsentProof>;
+//#endregion
+//#region src/presentations/registry.d.ts
+type PresentationDescriptorRegistry = Map<string, PresentationDescriptor>;
+/** Per-name override: `false` removes, `true` keeps the default, a descriptor adds or replaces one. */
+type PresentationDescriptorOption = boolean | PresentationDescriptor;
+type PresentationsDescriptorConfig = Record<string, PresentationDescriptorOption>;
+/**
+ * Resolve the active presentation descriptors from the defaults and a consumer override map.
+ * Mirrors the field-type, validation-rule, and renderer registry convention.
+ */
+declare const resolvePresentationDescriptors: (defaults: Record<string, PresentationDescriptor>, config?: PresentationsDescriptorConfig) => PresentationDescriptorRegistry;
+//#endregion
+//#region src/spam/types.d.ts
+/** Stable identity key for a request, or null/undefined when the client cannot be identified (rate-limiting then skips: fail-open). */
+type IdentifyFn = (req: PayloadRequest) => null | string | undefined | Promise<null | string | undefined>;
+type RateLimitResult = {
+  ok: boolean; /** Remaining requests in the current window (>= 0). */
+  remaining: number; /** Epoch ms when the current window resets. */
+  resetAt: number;
+};
+type RateLimitCheckArgs = {
+  key: string; /** Max requests per window. */
+  max: number; /** Window length in ms. */
+  window: number;
+  req: PayloadRequest;
+};
+/** Pluggable limiter. The default is a window counter over `payload.kv`; swap for Redis/etc. */
+type RateLimiter = {
+  check(args: RateLimitCheckArgs): Promise<RateLimitResult>;
+};
+type CaptchaVerifyArgs = {
+  token: string;
+  req: PayloadRequest;
+};
+/** A captcha adapter. v1 ships the seam only (no built-in provider). Build with `defineCaptchaProvider`. */
+type CaptchaProvider = {
+  type: string;
+  verify(args: CaptchaVerifyArgs): Promise<boolean>;
+};
+type RateLimitConfig = {
+  /** Window length in ms. Default 60000. */window?: number; /** Max creates per identity per window. */
+  max?: number; /** Override the limiter (default: KV window counter). */
+  limiter?: RateLimiter;
+};
+type SpamMetadataConfig = {
+  /** Persist the client IP (from the trusted header) onto the submission `meta`. Default false (privacy). */ip?: boolean; /** Persist the user-agent onto the submission `meta`. Default false. */
+  ua?: boolean;
+};
+type SpamConfig = {
+  /** Honeypot decoy. Default on. `false` disables. */honeypot?: false | {
+    fieldName?: string;
+  }; /** Per-identity rate limit on submission create. Default on (60s window, max 5). `false` disables. */
+  rateLimit?: false | RateLimitConfig; /** Per-identity rate limit on upload create. Default on (60s window, max 20). `false` disables. */
+  uploadRateLimit?: false | RateLimitConfig; /** A captcha provider (none by default; seam only in v1). */
+  captcha?: CaptchaProvider; /** Identity resolution for rate-limiting, upload ownership, and (future) poll dedup. Default: user id, else trusted IP header. */
+  identify?: IdentifyFn; /** Header read for the client IP (proxy-dependent, best-effort). Default 'x-forwarded-for'. */
+  ipHeader?: string; /** Opt-in capture of client metadata onto the submission `meta`. Off by default. */
+  metadata?: SpamMetadataConfig;
+};
+/** `false` disables the whole subsystem; an object configures it (all controls default on except captcha + metadata). */
+type SpamOption = false | SpamConfig;
+type ResolvedRateLimit = {
+  window: number;
+  max: number;
+  limiter: RateLimiter;
+};
+type ResolvedSpamConfig = {
+  honeypot: false | {
+    fieldName: string;
+  };
+  rateLimit: false | ResolvedRateLimit;
+  uploadRateLimit: false | ResolvedRateLimit;
+  captcha?: CaptchaProvider;
+  identify: IdentifyFn;
+  ipHeader: string;
+  metadata: {
+    ip: boolean;
+    ua: boolean;
+  };
+};
+//#endregion
+//#region src/validation/registry.d.ts
+type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>;
+/** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */
+type ValidationRuleOption = boolean | AnyValidationRuleDefinition;
+type ValidationRulesConfig = Record<string, ValidationRuleOption>;
+//#endregion
+//#region src/actions/builtin/index.d.ts
+declare const defaultActionDefinitions: Record<string, AnyActionDefinition>;
+//#endregion
+//#region src/actions/sign.d.ts
+declare const SIGNATURE_HEADER = "X-Form-Signature";
+/** HMAC-SHA256 over `body`, hex-encoded, wrapped in the versioned header value (`v1=<hex>`). */
+declare const signPayload: (body: string, secret: string) => string;
+//#endregion
+//#region src/aggregation/aggregateRows.d.ts
+/** Aggregate one field across rows: respondent-denominated counts + percentages, option-ordered. */
+declare const aggregateRowForField: (rows: AggregationRow[], meta: FieldMeta, truncated: boolean) => FieldAggregation;
+/** Aggregate several fields across the same set of rows. */
+declare const aggregateRowsForFields: (rows: AggregationRow[], metas: FieldMeta[], truncated: boolean) => FieldAggregation[];
+//#endregion
+//#region src/calc/normalizeCalc.d.ts
+/** Structural guard: returns a valid CalcExpression if `value` is structurally sound (depth-guarded at 64), otherwise undefined. Never throws. */
+declare const normalizeCalc: (value: unknown) => CalcExpression | undefined;
+//#endregion
+//#region src/consent/builtin/index.d.ts
+declare const defaultConsentSources: Record<string, AnyConsentSource>;
+//#endregion
+//#region src/consent/resolveConsentLinks.d.ts
+/**
+ * Resolve a consent field's policy links via its configured source (for display).
+ * Unknown/missing source returns empty links. Never throws.
+ */
+declare const resolveConsentLinks: (field: FormFieldInstance, ctx: {
+  registry: ConsentSourceRegistry;
+  payload: Payload;
+  req?: PayloadRequest;
+  locale: string;
+}) => Promise<ConsentResolved>;
+//#endregion
+//#region src/consent/resolvePublishedVersionRef.d.ts
+/**
+ * Returns the latest published version of a doc, or null when versions/drafts are off or nothing
+ * is published. Never throws.
+ */
+declare const resolvePublishedVersionRef: (payload: Payload, args: {
+  collection: string;
+  id: string | number;
+}) => Promise<{
+  versionId: string;
+  updatedAt: string;
+} | null>;
+//#endregion
+//#region src/fields/defineFormField.d.ts
+/**
+ * Define a form field type once and get every facet from one object: a Payload `Field[]` for
+ * authoring, an isomorphic `validate`, a localized `format`, and a renderer ref. Built-ins use
+ * this same primitive, so custom field types are never second-class. The `value` kind drives the
+ * typed value threaded into `validate`/`format`; the optional second generic types the config.
+ */
+declare const defineFormField: <K extends FormFieldValueKind, TConfig extends FormFieldConfigValues = FormFieldConfigValues>(definition: FormFieldDefinition<K, TConfig>) => FormFieldDefinition<K, TConfig>;
+//#endregion
+//#region src/presentations/defaults.d.ts
+declare const DEFAULT_PRESENTATION_NAME = "page";
+declare const defaultPresentationDescriptors: {
+  page: {
+    name: string;
+    label: "formBuilder:presentation.page";
+    surface: "page";
+    density: "comfortable";
+  };
+  inline: {
+    name: string;
+    label: "formBuilder:presentation.inline";
+    surface: "inline";
+    density: "comfortable";
+  };
+  modal: {
+    name: string;
+    label: "formBuilder:presentation.modal";
+    surface: "overlay";
+    density: "comfortable";
+    dismissOnSuccess: true;
+  };
+  drawer: {
+    name: string;
+    label: "formBuilder:presentation.drawer";
+    surface: "overlay";
+    density: "comfortable";
+    dismissOnSuccess: true;
+  };
+};
+//#endregion
+//#region src/spam/captcha.d.ts
+/**
+ * Identity helper for authoring a captcha provider (mirrors `defineAction`/`defineConsentSource`).
+ * v1 ships no built-in provider; a project supplies one (Turnstile/reCAPTCHA/hCaptcha) and the submit
+ * path verifies a token carried on the submission. Prebuilt providers are a v1.x addition.
+ */
+declare const defineCaptchaProvider: (provider: CaptchaProvider) => CaptchaProvider;
+//#endregion
+//#region src/spam/identify.d.ts
+/**
+ * Default identity resolution for rate-limiting + upload ownership. Prefers an authenticated user id
+ * (trustworthy); else the first hop of the configured trusted IP header (best-effort, proxy-dependent);
+ * else null, in which case the caller fails open (cannot fairly rate-limit an unidentifiable client).
+ */
+declare const defaultIdentify: (ipHeader: string) => IdentifyFn;
+//#endregion
+//#region src/spam/rateLimiter.d.ts
+/**
+ * The default rate limiter: a read-modify-write window counter over Payload's `payload.kv`
+ * (always present; default `DatabaseKVAdapter`, durable + cross-instance). Because the KV interface
+ * has no atomic increment, the get-then-set is NON-ATOMIC, so a concurrent burst can slightly undercount.
+ * This is a SOFT limit, acceptable for spam basics and complemented by edge/WAF limiting. The window
+ * expires lazily on read; stale keys for one-time identities linger (minor; the count self-resets).
+ * `now` is injectable for tests.
+ */
+declare const createKvRateLimiter: (options?: {
+  now?: () => number;
+  namespace?: string;
+}) => RateLimiter;
+//#endregion
+//#region src/spam/resolveSpam.d.ts
+/**
+ * Resolve the `spam` plugin option into a concrete config. `false` disables the whole subsystem.
+ * Otherwise honeypot + both rate limits default on, captcha + metadata capture default off, and the
+ * identity seam defaults to user id / trusted IP header.
+ */
+declare const resolveSpamConfig: (option: SpamOption | undefined) => ResolvedSpamConfig | false;
+//#endregion
+//#region src/uploads/resolveFileRef.d.ts
+type UploadDoc = {
+  id?: string | number;
+  filename?: unknown;
+  mimeType?: unknown;
+  filesize?: unknown;
+  url?: unknown;
+};
+type ResolveFileRefResult = {
+  ok: true;
+  ref: FileRef;
+} | {
+  ok: false;
+  code: FileRefError;
+};
+/**
+ * Pure server trust-boundary check for an uploaded file: given the loaded upload doc (or null) and the
+ * field's constraints, either return an authoritative `FileRef` snapshot or a rejection code. Never trusts
+ * client metadata; the caller passes the doc it loaded from the upload collection.
+ */
+declare const resolveFileRef: (doc: UploadDoc | null | undefined, config: FileFieldConfig) => ResolveFileRefResult;
+//#endregion
+//#region src/uploads/captureFileRef.d.ts
+type CaptureFileRefArgs = {
+  payload: Payload;
+  collectionSlug: string;
+  uploadId: string | number;
+  config: FileFieldConfig;
+  req?: PayloadRequest; /** Resolved submitter identity; must match the upload's `owner` stamp when both are present. */
+  expectedOwner?: string;
+};
+/**
+ * Load the referenced upload doc and run the pure trust-boundary check. The client sends only the id; the
+ * filename/mimeType/filesize are read authoritatively from the stored doc, never from the client. When the
+ * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous
+ * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable
+ * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not
+ * enforced (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies every
+ * request, so this only relaxes scoping where it could not be applied fairly anyway. Unstamped uploads
+ * (no identity at upload time, or a BYO collection without the field) pass unchanged.
+ */
+declare const captureFileRef: (args: CaptureFileRefArgs) => Promise<ResolveFileRefResult>;
+//#endregion
+//#region src/validation/defineValidationRule.d.ts
+/**
+ * Define a validation rule type once: its `params` become a Payload `Field[]` in the per-field
+ * constraint list, its typed `validate` runs in the one engine on client and server. Built-in rules
+ * use this same primitive, so custom rules are never second-class.
+ */
+declare const defineValidationRule: <TParams extends ValidationParams, TValue = unknown, TData extends Record<string, unknown> = Record<string, unknown>>(rule: ValidationRuleDefinition<TParams, TValue, TData>) => ValidationRuleDefinition<TParams, TValue, TData>;
+//#endregion
+//#region src/index.d.ts
+type FormBuilderPluginOptions = {
+  disabled?: boolean; /** Pluggable sink for form lifecycle events. Defaults to a no-op; analytics adapters or a future analytics plugin subscribe here. */
+  events?: FormEventSink; /** Add, override, or remove field types. `false` removes a built-in, `true` keeps it, an object adds or replaces one. */
+  fields?: FieldTypesConfig; /** Add, override, or remove presentations. `false` removes a built-in, `true` keeps it, an object adds or replaces one. */
+  presentations?: PresentationsDescriptorConfig; /** Add, override, or remove validation rule types. `false` removes a built-in, `true` keeps it, an object adds or replaces one. */
+  rules?: ValidationRulesConfig; /** Add, override, or remove post-submit action types. `false` removes a built-in, `true` keeps it, an object adds or replaces one. */
+  actions?: ActionsConfig; /** Add, override, or remove consent source types. `false` removes a built-in, `true` keeps it, an object adds or replaces one. */
+  consentSources?: ConsentSourcesConfig; /** The built-in `form-uploads` collection backing file fields. `false` disables it (bring your own); an object overrides slug/upload/access/fields. */
+  uploads?: UploadsOption; /** Honeypot + rate-limiting (on by default) + a captcha adapter seam + upload-ownership scoping. `false` disables the whole subsystem. */
+  spam?: SpamOption;
+};
+declare module 'payload' {
+  interface RegisteredPlugins {
+    '@10x-media/form-builder': FormBuilderPluginOptions;
+  }
+}
+declare const formBuilder: (options: FormBuilderPluginOptions) => import("payload").Plugin;
+//#endregion
+export { UploadsCollectionConfig as $, RateLimitResult as A, captureConsent as B, ValidationRuleRegistry as C, IdentifyFn as D, CaptchaVerifyArgs as E, PresentationDescriptorOption as F, AnyConsentSource as G, ConsentSourceRegistry as H, PresentationDescriptorRegistry as I, ConsentResolved as J, ConsentLink as K, PresentationsDescriptorConfig as L, SpamConfig as M, SpamMetadataConfig as N, RateLimitCheckArgs as O, SpamOption as P, FORM_UPLOADS_SLUG as Q, resolvePresentationDescriptors as R, ValidationRuleOption as S, CaptchaProvider as T, ConsentSourcesConfig as U, ConsentSourceOption as V, resolveConsentSources as W, defineConsentSource as X, ConsentSource as Y, FieldCondition as Z, aggregateRowForField as _, ActionRunArgs as _t, resolveFileRef as a, resolveFormResultsRequest as at, signPayload as b, defaultIdentify as c, aggregateFieldResponses as ct, defaultPresentationDescriptors as d, ActionResult as dt, UploadsOption as et, defineFormField as f, ActionOption as ft, normalizeCalc as g, ActionDefinition as gt, defaultConsentSources as h, resolveActions as ht, captureFileRef as i, ResolveResultsRequestResult as it, RateLimiter as j, RateLimitConfig as k, defineCaptchaProvider as l, aggregateFormResponses as lt, resolveConsentLinks as m, ActionsConfig as mt, formBuilder as n, resolveUploads as nt, resolveSpamConfig as o, AggregateFieldResponsesArgs as ot, resolvePublishedVersionRef as p, ActionRegistry as pt, ConsentResolveArgs as q, defineValidationRule as r, ResolveResultsRequestArgs as rt, createKvRateLimiter as s, AggregateFormResponsesArgs as st, FormBuilderPluginOptions as t, buildUploadsCollection as tt, DEFAULT_PRESENTATION_NAME as u, fieldHasOptions as ut, aggregateRowsForFields as v, AnyActionDefinition as vt, ValidationRulesConfig as w, defaultActionDefinitions as x, SIGNATURE_HEADER as y, defineAction as yt, ConsentProof as z };
+//# sourceMappingURL=index-DfFYGbVF.d.ts.map

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+import { a as FormFieldFormat, d as FileRefError, i as FormFieldDefinition, l as FileFieldConfig, n as AnyFormFieldDefinition, o as FormFieldValidate, s as FormFieldValueKind, u as FileRef } from "./fieldTypes-B8jkNRob.js";
+import { A as FieldMeta, C as evaluateCalc, D as AggregationBucket, E as CalcExpression, O as AggregationRow, S as evaluateCondition, T as computeCalcFields, _ as PrefillOptions, a as optionLabelsFor, b as FieldTypeRegistry, c as PresentationDescriptor, f as ValidationRuleDefinition, i as buildRecallResolver, j as SubmissionStatusFilter, k as FieldAggregation, l as PresentationSurface, m as ValidationSeverity, n as DEFAULT_HONEYPOT_FIELD, o as interpolate, p as ValidationRuleResult, r as RecallResolver, s as PresentationDensity, t as CAPTCHA_TOKEN_KEY, u as AnyValidationRuleDefinition, v as valuesFromSearchParams, w as calcExpressionOf, x as FieldTypesConfig, y as FieldTypeOption } from "./constants-B-BUfetP.js";
+import { $ as UploadsCollectionConfig, A as RateLimitResult, B as captureConsent, C as ValidationRuleRegistry, D as IdentifyFn, E as CaptchaVerifyArgs, F as PresentationDescriptorOption, G as AnyConsentSource, H as ConsentSourceRegistry, I as PresentationDescriptorRegistry, J as ConsentResolved, K as ConsentLink, L as PresentationsDescriptorConfig, M as SpamConfig, N as SpamMetadataConfig, O as RateLimitCheckArgs, P as SpamOption, Q as FORM_UPLOADS_SLUG, R as resolvePresentationDescriptors, S as ValidationRuleOption, T as CaptchaProvider, U as ConsentSourcesConfig, V as ConsentSourceOption, W as resolveConsentSources, X as defineConsentSource, Y as ConsentSource, Z as FieldCondition, _ as aggregateRowForField, _t as ActionRunArgs, a as resolveFileRef, at as resolveFormResultsRequest, b as signPayload, c as defaultIdentify, ct as aggregateFieldResponses, d as defaultPresentationDescriptors, dt as ActionResult, et as UploadsOption, f as defineFormField, ft as ActionOption, g as normalizeCalc, gt as ActionDefinition, h as defaultConsentSources, ht as resolveActions, i as captureFileRef, it as ResolveResultsRequestResult, j as RateLimiter, k as RateLimitConfig, l as defineCaptchaProvider, lt as aggregateFormResponses, m as resolveConsentLinks, mt as ActionsConfig, n as formBuilder, nt as resolveUploads, o as resolveSpamConfig, ot as AggregateFieldResponsesArgs, p as resolvePublishedVersionRef, pt as ActionRegistry, q as ConsentResolveArgs, r as defineValidationRule, rt as ResolveResultsRequestArgs, s as createKvRateLimiter, st as AggregateFormResponsesArgs, t as FormBuilderPluginOptions, tt as buildUploadsCollection, u as DEFAULT_PRESENTATION_NAME, ut as fieldHasOptions, v as aggregateRowsForFields, vt as AnyActionDefinition, w as ValidationRulesConfig, x as defaultActionDefinitions, y as SIGNATURE_HEADER, yt as defineAction, z as ConsentProof } from "./index-DfFYGbVF.js";
+export { type ActionDefinition, type ActionOption, type ActionRegistry, type ActionResult, type ActionRunArgs, type ActionsConfig, type AggregateFieldResponsesArgs, type AggregateFormResponsesArgs, type AggregationBucket, type AggregationRow, type AnyActionDefinition, type AnyConsentSource, type AnyFormFieldDefinition, type AnyValidationRuleDefinition, CAPTCHA_TOKEN_KEY, type CalcExpression, type CaptchaProvider, type CaptchaVerifyArgs, type ConsentLink, type ConsentProof, type ConsentResolveArgs, type ConsentResolved, type ConsentSource, type ConsentSourceOption, type ConsentSourceRegistry, type ConsentSourcesConfig, DEFAULT_HONEYPOT_FIELD, DEFAULT_PRESENTATION_NAME, FORM_UPLOADS_SLUG, type FieldAggregation, type FieldCondition, type FieldMeta, type FieldTypeOption, type FieldTypeRegistry, type FieldTypesConfig, type FileFieldConfig, type FileRef, type FileRefError, FormBuilderPluginOptions, type FormBuilderPluginOptions as PluginOptions, type FormFieldDefinition, type FormFieldFormat, type FormFieldValidate, type FormFieldValueKind, type IdentifyFn, type PrefillOptions, type PresentationDensity, type PresentationDescriptor, type PresentationDescriptorOption, type PresentationDescriptorRegistry, type PresentationSurface, type PresentationsDescriptorConfig, type RateLimitCheckArgs, type RateLimitConfig, type RateLimitResult, type RateLimiter, type RecallResolver, type ResolveResultsRequestArgs, type ResolveResultsRequestResult, SIGNATURE_HEADER, type SpamConfig, type SpamMetadataConfig, type SpamOption, type SubmissionStatusFilter, type UploadsCollectionConfig, type UploadsOption, type ValidationRuleDefinition, type ValidationRuleOption, type ValidationRuleRegistry, type ValidationRuleResult, type ValidationRulesConfig, type ValidationSeverity, aggregateFieldResponses, aggregateFormResponses, aggregateRowForField, aggregateRowsForFields, buildRecallResolver, buildUploadsCollection, calcExpressionOf, captureConsent, captureFileRef, computeCalcFields, createKvRateLimiter, defaultActionDefinitions, defaultConsentSources, defaultIdentify, defaultPresentationDescriptors, defineAction, defineCaptchaProvider, defineConsentSource, defineFormField, defineValidationRule, evaluateCalc, evaluateCondition, fieldHasOptions, formBuilder, interpolate, normalizeCalc, optionLabelsFor, resolveActions, resolveConsentLinks, resolveConsentSources, resolveFileRef, resolveFormResultsRequest, resolvePresentationDescriptors, resolvePublishedVersionRef, resolveSpamConfig, resolveUploads, signPayload, valuesFromSearchParams };