@10x-media/form-builder 0.1.0-beta.2 → 0.1.0-beta.21

package/CHANGELOG.md

@@ -1,5 +1,365 @@
 # @10x-media/form-builder
 
+## 0.1.0-beta.21
+
+### Minor Changes
+
+- Two submit/validate fixes. Actions can declare `essential: true` on `defineAction`: an essential action runs inline before the response (never queued, bounded by the dispatch deadline), its failure or timeout turns the submit into an error the visitor sees with a translated plugin message, the remaining actions are skipped, and the submission is kept even on a `persistSubmissions: false` form so a failed provider handoff never loses what the visitor sent. Fire-and-forget actions are unchanged. And blurring a pristine field no longer reveals its required error: reveal now needs the field to be dirty (changed since mount or the last reset) or its step submitted, which also stops a freshly reset form from showing errors when clicked.
+
+## 0.1.0-beta.20
+
+### Minor Changes
+
+- Consent fields gain a Display setting: `checkbox` (the default, unchanged) or `notice`, which renders the statement as passive prose with no control, for flows where submitting is the opt-in ("By subscribing, you agree to our privacy policy"). The server records `agreed: true` on a notice proof regardless of the client payload, `required` is ignored for notices, and the proof carries `display: 'notice'` so audits distinguish the two. `consentSourcesField` rows gain a `noticeStatement` rich text beside `statement`, so one source phrases each presentation naturally while keeping one policy, one version, and one id in every proof; a notice field falls back to `statement` when it is empty. Whichever wording renders is exactly what the proof snapshots, selected through one shared function on both paths.
+
+## 0.1.0-beta.19
+
+### Minor Changes
+
+- The from-address and department selects now load their options while a form is still being created, instead of sitting empty until the first save. Both option sets are request-scoped (they depend on who is asking, not on the form document), so their endpoints now live at id-less paths (`GET /api/forms/from-addresses`, `GET /api/forms/departments`); the old `/:id/`-prefixed routes still answer on the same handlers for anything that hardcoded them. `EndpointOptionsSelect` and `RecipientsSelect` gain a `scope: 'document' | 'request'` clientProp (default `'document'`, unchanged behaviour) so a host field backed by its own request-scoped endpoint can opt into the same create-mode loading. Document-scoped selects (poll options, consent sources) are unaffected.
+
+## 0.1.0-beta.18
+
+### Minor Changes
+
+- Add `email.fromSources`: senders resolved at send time, for hosts where the from-address is tenant identity rather than per-form configuration. A source stores a stable namespaced value (e.g. `tenant:default`) on the action and re-resolves the actual address on every send with the same run-time arguments a recipient source gets, so a tenant that changes its from-address changes it for every saved form at once. Sources appear in the existing From select ahead of the `fromAddresses` literals; literals keep today's behaviour exactly, including never touching a source at send.
+
+## 0.1.0-beta.17
+
+### Minor Changes
+
+- Add `renderResults` to `<Poll>`: a render prop that replaces the built-in `<FormResults>` wherever the poll shows results (after voting, when closed, and for a recorded outcome). It receives the exact `FormResultsProps` the default rendering gets, so hosts can draw result rows from their own data, keyed by each bucket's option value, or wrap `<FormResults>` in their own layout. Omitting the prop changes nothing.
+
+## 0.1.0-beta.16
+
+### Patch Changes
+
+- Fix every REST submission returning 500 on beta.15. The vote-change endpoint delegates ordinary creates to Payload's stock create handler, which re-parses the request body the endpoint had already consumed; a consumed fetch body stays non-null, so the second read threw "Body is unusable". The endpoint now hides the spent stream before delegating (the parsed `data`/`file` are already on the request), and finds the stock handler by its own endpoint tag instead of handler identity, so a host-wrapped handler can no longer recurse. Local API submissions were never affected.
+
+## 0.1.0-beta.15
+
+### Minor Changes
+
+- Changeable votes for polls via a new `poll.allowChange` checkbox (default off; existing polls are unaffected). With it on, the voted cookie carries the voter's signed submission id, a repeat submit from the same browser updates that submission in place instead of creating another, and the vote tally moves with the changed answer (old value decrements, new one increments, respondents unchanged). Changes run the full create pipeline (validation, spam controls, consent recapture) and are rejected once the poll closes. New `resolveVotedSubmission` (root and `/rsc`) resolves the voter's current pick server-side from the httpOnly cookie; `<Poll currentVote>` highlights it in results ("Your vote" badge, also via `<FormResults currentValues>`) and offers a "Change vote" button that reopens the form prefilled. `onSuccess` now also receives the submitted answer values on its result object.
+
+## 0.1.0-beta.14
+
+### Minor Changes
+
+- Add an `adapters` prop for host-owned effects on `<Form>`, `<Poll>`, and the captcha widgets. `adapters.navigate` replaces the post-submit `window.location` redirect so router-based hosts (Next.js App Router, TanStack Router, React Router) can transition in place; the plugin passes its intent (`{ replace: false }`) and never falls back to a hard navigation when the adapter is set. `adapters.voteStorage` overrides the poll voted-flag persistence (or disables it with `false` for hosts on the server-side `poll.votedCookie`). `adapters.loadScript` replaces the captcha vendor script injection for consent-gated or CSP-nonced loading, keeping the per-src cache and evict-on-failure retry. Every member is optional and defaults to the current behavior, so existing consumers are unaffected.
+
+## 0.1.0-beta.13
+
+### Patch Changes
+
+- Make the poll tally writer's Postgres import opaque to bundlers.
+
+  The optional `@payloadcms/db-postgres` peer was loaded via a literal dynamic import, which bundlers resolve at build time: a Mongo host on Turbopack failed `next build` with "Module not found" even though the Postgres branch never runs there (and `serverExternalPackages` does not help, since it governs bundling, not resolution). The specifier is now built at runtime, so no bundler resolves it and the package is only touched when the adapter is actually Postgres. Mongo hosts that worked around this with a resolve alias or stub can remove it.
+
+  Two upgrade notes from the same integrator round: hosts that had extended the select field block with their own `display` field must remove it on the beta.12 bump (the plugin ships one with identical values, and Payload refuses to boot with two same-name fields); and custom renderers replace the built-ins wholesale, so per-instance settings added in minor releases (`display` variants, `autocomplete`, calculation formatting) must be read by your renderer or an author's choice is silently ignored, now documented in the rendering guide.
+
+## 0.1.0-beta.12
+
+### Minor Changes
+
+- Authoring UX round: a visual calculation builder, display variants, an optional-by-default field config surface, and a poll vote tally store.
+
+  - **Visual calculation builder.** The calculation field's expression is authored in a native left-to-right chain editor: start with a value (Field, Number, Weighted field, Function, or a registered source), add operation steps, optionally finish with a function, with a live readable preview and honest remove affordances throughout. The stored expression tree is unchanged and any API-written expression loads as the equivalent chain; read-only and error states are wired, and field pickers only offer numeric fields (calculations restricted to earlier ones, matching evaluation order).
+  - **Calculation extensibility.** A new `calc` option opens the expression engine to host data: `calc.sources` registers named value resolvers (`resolve` returns one number per render/submission, e.g. a tax rate or member discount; `resolveWeights` returns per-option numbers for a chosen field, e.g. each selectable product's live price) that resolve server-side, ride the form document for the client preview, and re-resolve authoritatively at submit; `calc.functions` registers custom calculation functions (client previews additionally accept the same map via `<Form calcFunctions>`). The calculation field also gains display formatting (`decimals`, localized `prefix`/`suffix`) applied in the renderer, admin answers, and email output. New utilities: `defineCalcSource`, `defineCalcFunction`, `resolveCalcContext`, `formatCalc`, `formatCalcValue`, and a `useCalcValues()` hook for composed frontends reading live computed values.
+  - **Display variants.** Select fields gain an optional `display` setting (`dropdown` default, `radio`, `buttons`) rendered as an accessible radio group with the invalid-state focus routing intact; checkbox fields gain `checkbox` or `switch`. The `ChoiceGroup` primitive is exported for custom renderers.
+  - **Optional field settings.** Field width and select option labels are no longer required: width defaults to full (the renderer already falls back), and a missing or blank option label falls back to the value everywhere (renderer, admin answers, aggregation, recall). Width option labels are localized.
+  - **Sidebar form flags with a compose seam.** `multistep`, `pollEnabled`, and `persistSubmissions` are stacked sidebar checkboxes, composed through the new `settings.fields` option so a host can relocate, wrap, extend, or drop them. Forms now registers before form-submissions in the admin nav.
+  - **Advanced tab seam.** Field types can append settings to the Advanced tab via `advancedConfig`; text and email use it for an `autocomplete` autofill hint. The `hidden` flag documents that hidden fields are still validated. New `integer` validation rule for number fields; flow validation messages are localized.
+  - **Poll vote store (default on).** Votes are counted into a hidden append-only tally collection (`form-poll-votes`) when a submission completes: results reads and `mostVoted` resolution become one indexed find (no scan, no 10k truncation), tallies survive `persistSubmissions: false` and admin deletions (votes are permanent), rows are pure aggregate so a persist-off poll retains zero per-visitor data, and writes are atomic, transaction-joined, and sharded against concurrent write conflicts. `poll.votes: false` restores scan-based results and rejects persist-off polls at save. Exported: `recountPollVotes`, `aggregateFromVotes`, `POLL_VOTES_SLUG`, `RESPONDENTS_VALUE`, `VOTE_SHARDS`. Postgres hosts create the new `form_poll_votes` table with their next migration; `@10x-media/form-builder` declares `@payloadcms/db-postgres` as an optional peer for the tally write path.
+
+## 0.1.0-beta.11
+
+### Minor Changes
+
+- Server-resolved recipients with a signed form context, opt-out submission storage, and an action-block collision guard.
+
+  - **Recipient sources.** A new `email.recipientSources` option registers recipients the plugin resolves server-side at send time, offered in every recipient field (**To**/**Cc**/**Bcc**/**Reply-To**) as their own option group. A source's namespaced `value` cannot collide with an address, its `resolve` returns zero or more addresses (each sanitized to one, so a source cannot inject headers), an empty resolve is dropped, and a send with every recipient empty is skipped rather than sent with an empty **To**. This lets one reusable form email "the person this page is about" without an address ever reaching the browser.
+  - **Signed form context.** `signFormContext({ payload, relationTo, value })` (exported from `/rsc` and root) mints a signed, expiring reference to the document a form was rendered for; `<Form context={token} />` carries it, the plugin verifies it on submit (rejecting a tampered or expired one rather than dropping it), stores the verified `{ relationTo, value }` on the submission, and hands it to each source's `resolve`. The reference is signed, not encrypted (the id is already public); it never appears in the answers, the admin answers view, or `{{*}}` body output.
+  - **`persistSubmissions`.** A per-form "Store submissions" flag (default on). Unchecked, the plugin deletes the submission after its actions run, for a pure signup form that only POSTs to a provider. Deletion is once, after the whole action pass, regardless of individual action success; pruning does not cascade to uploaded files (documented).
+  - **Action-block collision guard.** The plugin now throws a clear error at boot if a registered action `type` collides with a host Payload block slug (which Payload would otherwise silently merge), instead of corrupting the stored action shape. Action block slugs are unchanged, so existing actions keep working.
+
+## 0.1.0-beta.10
+
+### Minor Changes
+
+- Locale-correct i18n bundles for host fallbacks, and repeater error re-indexing on row removal.
+
+  - **Locale bundles are exported for host translators.** `@10x-media/form-builder/react` and `/i18n` now export `de`, `bundles` (`Record<string, TranslationBundle>`), the `TranslationBundle` type, and `clientRuntimeKeys`. `makeTranslate` also accepts a locale code (`makeTranslate('de')`) in addition to a map, so a host bridging its own translator can fall back with `makeTranslate(locale)` (or `makeTranslate(bundles[locale] ?? en)`) and a visitor's locale no longer silently resolves to English for a key the host did not mirror. `clientRuntimeKeys` lists the keys the visitor runtime resolves, for asserting mirror coverage in a test.
+  - **Removing a repeater row re-indexes its sub-field errors.** Deleting a row now clears that row's composite validation errors and shifts the surviving rows' errors down, so a server-side error (for example `crew[2].paddlerName`) no longer mis-attributes to a shifted row or lingers unreachably after a delete.
+
+## 0.1.0-beta.9
+
+### Minor Changes
+
+- Multi-step keyboard, per-step validation reveal, and focus/accessibility fixes for the `<Form>` runtime.
+
+  - **Enter advances a multi-step form.** On a non-terminal step, Enter in a single-line field now validates and advances the step (exactly like the Next control), or keeps the visitor on the step and reveals its errors when a field is invalid, instead of doing nothing. On the terminal step Enter submits once (native submit, still behind the existing re-entrancy guard). Textareas (newline), selects (confirm), and buttons stay exempt, and single-step forms keep native Enter-to-submit.
+  - **Validation errors reveal per step, not globally.** A field's error now shows only once it is touched or a submit/advance attempt was made for the step it belongs to. Previously any submit attempt flipped one global flag, so navigating forward to a later step surfaced errors on fields the visitor had never reached. Internally `FormState.submitAttempted` becomes `attemptedSteps`, and reveal is keyed to each field's step.
+  - **A terminal Submit routes to the first invalid step.** When an earlier step is invalid at submit time (for example a field that becomes required only after a later answer), the form navigates back to the first step that owns an invalid field and focuses it, rather than failing in place on the terminal step.
+  - **Focus moves with the step.** Every step change (forward or back) moves focus into the new step, and a blocked advance or submit moves focus to the first invalid field, so keyboard and screen-reader users travel with the form.
+  - **Step changes and validation failures are announced.** A polite `aria-live` region announces "Step X of Y" on each change, and a `role="alert"` summary appears when an advance or submit is blocked. New translation keys `form.stepStatus` and `form.stepInvalid` (English and German), overridable through the `translations` option.
+
+## 0.1.0-beta.8
+
+### Minor Changes
+
+- Second feedback round: submit control, step field order, response editor, and host-rendered success.
+
+  - **Implicit Enter-submit is suppressed on multi-step forms.** A form-level key handler prevents a lone text input from submitting the whole form on Enter; only the explicit Submit control submits. Textareas (newline), selects (confirm), and buttons are exempt, and single-step forms keep native Enter-to-submit. The `<form>` is the plugin's even in `children` mode, so this is the only place a host could apply the guard.
+  - **Step fields render in `form.fields` order.** A step's `fields` list is treated as membership only; the render order follows the form's field order rather than the flow-builder entry order.
+  - **`richText.responseEditor`.** The success response message field's editor can now be set independently via `richText.responseEditor` (falling back to `richText.editor`), mirroring `bodyEditor` for action bodies. The message block stays on the plugin-wide `editor`.
+  - **Host-rendered success.** `onSuccess` gains a second argument, `{ response }`, carrying the recall-resolved success response (a redirect url, or the message serialized with the form's converters), so a host can toast or render it; `<Poll>` forwards the same payload to its host. A new `converters` prop on `<Form>` threads custom block converters (e.g. host `icon`/`badge` blocks) into the client serializer, so those blocks survive in the success message, the resolved response, and inline `message` blocks. `successBehavior: 'reset'` clears the form in place after a successful submit instead of swapping in the success screen (returning a multi-step form to its first step), so a host can keep the form usable and give feedback via `onSuccess`. Defaults (`onSuccess`'s first argument, `successBehavior: 'replace'`) are unchanged. New exported types: `FormSuccessResponse`, `FormSuccessResult`.
+
+## 0.1.0-beta.7
+
+### Minor Changes
+
+- Composition seam, consent re-entrance safety, and server-side recipient enforcement.
+
+  - **`<FormFields>` + `<Form header>`.** The standard field loop is now an exported `<FormFields>`
+    component, so a custom `children` layout can compose `<Form><FormSteps /><FormFields />
+<FormControls /></Form>` without reimplementing visibility, calc, recall, and step filtering. For
+    the common case, `<Form header={<FormSteps />} />` places chrome above the fields while keeping all
+    default behavior. `recall` is now available on the form context.
+  - **Consent resolver receives the whole form document.** A multi-tenant `consent.sources` resolver
+    derives its tenant from a field on the provided doc instead of reading the form back. The consent
+    `afterRead` hook now guards against resolver re-entrance (a per-id `Set` on `req.context`), so a
+    resolver that does read the form back can no longer recurse.
+  - **`email.recipients.allowCustom: false` is enforced on the server.** When set, a non-token
+    recipient must be one of the resolved department options, validated at save and fail-closed
+    (mirroring the `from` field). The default (`allowCustom` true) is unchanged.
+
+- Two new controls for consent reads and upload ownership.
+
+  - **`consent.resolveOnRead`** (default `true`) gates the afterRead hook that resolves each form's consent statements on every read. Set it `false` to skip that per-read source lookup (N queries on a list view) and resolve statements yourself with the exported `resolveConsentStatements` when you render a form. Submit-time proof capture is unaffected either way, since it always re-resolves from the source.
+  - **`spam.uploadOwnership`** (default `'lenient'`) controls how strictly a submitted file's upload ownership is enforced. `'strict'` additionally rejects a stamped upload whenever the submitter cannot be identified, so a deployment that always identifies requests (a trusted proxy header, or a custom `identify`) never lets an unverifiable claim capture an owned upload. `'lenient'` keeps the current fail-open behavior for unidentifiable submitters.
+
+### Patch Changes
+
+- Consolidate the built-in email actions. `emailTeam` and `confirmation` were ~80% identical (the same recipient fields, subject/body config, from-field insertion, and send logic) duplicated across two files, each built through a five-positional-argument builder that needed a `useMaxParams` lint suppression. Both now share one `buildEmailAction` skeleton and one `EmailActionOptions` object; each action supplies only what differs (its `to` target and whether a missing recipient throws or is skipped). Behavior is unchanged, verified by both actions' full existing test suites passing against the shared implementation.
+
+- Condition and flow correctness.
+
+  - `file` and `repeater` fields now offer a presence-only condition (exists / does not exist) in the builder, instead of the text/select operators they cannot actually satisfy (a `FileRef` object or a row array only stringifies). A presence check also treats an empty repeater as absent.
+  - Flow transition `when` clauses are laundered the same way field conditions are: a transition referencing a field that was later deleted is dropped, rather than persisting as an always-true route that force-navigates the visitor. Valid transition conditions are canonicalized to the same OR-of-ANDs shape as field conditions.
+
+- Correctness and security hardening from an internal audit.
+
+  - **Registry key forced** on custom `actions` and `poll.sources`: a definition registered under a key that differs from its `type` no longer silently never runs.
+  - **Recipient injection closed**: a resolved `{{field}}` recipient is sanitized to a single address, dropping CR/LF header injection and any extra addresses a crafted submission value could smuggle in.
+  - **`email.recipients.fieldTokens: false`** is now enforced on the server, not just the client.
+  - **Consent integrity**: prefill and submit-time boolean coercion share one truthy allow-list, so a stray string value (e.g. from a non-React client) is never read as consent.
+  - **Cross-tenant leak closed**: the consent-sources and poll-options endpoints load the form under the caller's own read access (no `overrideAccess`), so an authenticated user cannot enumerate another tenant's form.
+  - **Rate-limit skip surfaced**: when the request identity is null the limiter still fails open, but the skip is recorded on `meta.spam.rateLimit` and warned once instead of being silent.
+  - **Honeypot collision fixed**: the decoy is submitted under a fixed reserved key, so a real field sharing the decoy's DOM input name (e.g. `website`) is never stripped or mistaken for the honeypot.
+  - **Action failures logged**: a failed post-submit email or webhook is logged per action instead of being swallowed while the submission looks fully successful.
+
+- DX and robustness cleanup from the package audit.
+
+  - **Renderers honor the passed `id` prop.** Eleven built-in field renderers minted their own `useId()` and ignored the `id` the render host already generates and passes, so each field ran two id hooks and the documented contract prop was dead. They now use the passed `id` (the host stays the single source; a custom host can control it). `repeater` and `message` already conformed.
+  - **The overlay backdrop no longer fires `onClose` twice.** A backdrop click was handled both by the backdrop's own `onClick` and by the surface's outside-pointerdown dismiss, so it closed twice; the backdrop's handler also ignored `closeOnOutsideClick: false`. The backdrop is now purely presentational and dismissal is owned solely by the dismiss hook, which respects the flag.
+  - **Polls surface a results-load failure.** A failed results fetch was stored as an empty array and rendered as a zero-count "no votes yet" table. It now shows a localized error instead of masking the failure.
+  - **`captureFileRef` gains unit coverage** for its ownership match/mismatch, unidentified-submitter fail-open, unstamped-upload passthrough, and failed-load cases.
+  - **The consent proof documents its time-of-check/time-of-use window** (wording is read at form load but re-resolved at submit) so the intended behavior is not mistaken for a bug.
+
+- Split the two largest source files for maintainability, with no behavior change.
+
+  - The `FormBuilderPluginOptions` type (nearly 200 lines of the plugin's public option surface, with its doc comments) moves out of `index.ts` into a dedicated `src/options.ts`, leaving `index.ts` focused on the plugin factory and the public barrel. The type is still exported under the same name (and its `PluginOptions` alias).
+  - The forms collection's built-in endpoints (poll results/options/close, plus the optional consent-sources, from-addresses, and departments endpoints) move out of `buildFormsCollection` into `buildFormsEndpoints`, so the collection builder stays focused on field and hook composition.
+
+  `index.ts` drops from ~558 to ~346 lines and `forms.ts` from ~845 to ~743; the moved code is unchanged and every existing unit, integration, and cross-DB test passes against it.
+
+- Localize the last hard-coded English strings in the public form renderer. The file field's attached-file indicator, in-flight "Uploading" status, upload-failure fallback, and remove control, plus the form's close-control label, success message, and submit-failure fallback, now resolve through the same `t` the rest of the renderer already uses (bundled `en`/`de`, host-overridable per locale) instead of baked-in English. A German (or any) `t` now localizes them; behavior under the default English `t` is unchanged.
+
+- Consolidate the registry and constant plumbing.
+
+  - The field-type, validation-rule, action, poll-source, and poll-type registries all resolved their opt-in override map (`false` removes, `true` keeps, a definition adds/replaces with `type` forced to the key) with their own copy of the same loop. That loop now lives in one shared `applyRegistryConfig` helper, so the merge semantics are defined once instead of five times.
+  - Definition `label` contracts are aligned: actions and poll option sources now accept a per-locale `Record<string, string>` label in addition to a string key/literal, matching poll types. All three resolve through one shared `resolveDefinitionLabel` helper. Widening only, so existing string labels are unaffected.
+  - The email-format regex (duplicated between the `email` field type and the `email` validation rule) and the calc recursion-depth guard (duplicated between the calc parser and evaluator) are each a single shared constant now, so the pair can no longer drift.
+
+- Repeater correctness fixes.
+
+  - Multi-step forms now validate a step's repeater sub-fields on **Next**, so an invalid required sub-field can no longer be skipped past; it surfaces inline, mirroring submit and the server. `goNext` also gains a re-entrancy guard so a double-click cannot push the same step onto history twice.
+  - Editing a repeater sub-field clears its stale server-side error immediately, instead of leaving it shown until the next submit.
+  - Repeater rows carry a stable React key, so removing a middle row no longer strands a stateful sub-renderer's local state (e.g. the file renderer's filename) onto the wrong row.
+
+## 0.1.0-beta.6
+
+### Minor Changes
+
+- Email actions and consent polish, plus paddle-worldwide handoff asks.
+
+  - **New creatable multi-recipient email field.** To, Reply-to, CC, and BCC on the Email Team and
+    Confirmation actions accept multiple recipients as native badges, mixing picked department
+    addresses, free-typed emails, and `{{field}}` recipient tokens (drag-reorderable, `admin.width`
+    aware). Configurable via `email.recipients` (`allowCustom`, `fieldTokens`, `tokenFieldTypes`).
+  - **Half-width pairing** of the email address fields (To/Reply-to, CC/BCC).
+  - **Consent field polish:** no more redundant description (the source statement is the content); the
+    field block title and the source array rows now show the consent source's name; the condensed
+    department-emails array centers its remove control on the input.
+  - **Consent statements on every read.** An `afterRead` hook resolves statements onto the form doc, so
+    consent renders wherever the form is fetched (modal/client, not only RSC); `toFormDocument` falls
+    back to the doc-carried statements.
+  - **`toFormDocument`** accepts a populated redirect `reference` (`value: string | number | object |
+null`) and an optional `resolveRedirect` seam that fills `redirect.url`.
+  - **Versioned consent proof.** Submissions snapshot the agreed wording via `consent.snapshot`
+    (default `both`: a statement hash, the plain text, and the source name), for an audit trail
+    independent of later source edits.
+  - **File MIME picker** constrained to the host upload collection's `mimeTypes` (with an optional
+    `uploads.mimeTypes` override).
+
+  **BREAKING:** `emailTeam`/`confirmation` `to`, `cc`, `bcc`, and `replyTo` are now `string[]` (`text`
+  `hasMany`). A legacy single-string value reads as one recipient; Postgres consumers regenerate a
+  migration.
+
+## 0.1.0-beta.5
+
+### Minor Changes
+
+- Finish localizing the flow builder: the remaining transition, hint, empty-state, and fallback-title strings now go through the translation system (en and de).
+
+  Ship shadcn `country` and `state` field renderers so the shadcn registry covers every built-in field type, and export `COUNTRIES` and `US_STATES` from `@10x-media/form-builder/react` for them. A parity test now asserts the registry renderer set matches the package's `defaultRenderers`, so a new field type cannot ship without its shadcn renderer. The country and state option labels are intentionally left unlocalized (the stored value is the stable code).
+
+- Feedback round: host-owned consent sources with live statements, bare message blocks, form-level button labels, sequential step flow, poll field eligibility and outcome selection, and per-request sender addresses, plus a field-config cleanup pass (drop dead shared fields, source poll options from a field, admin polish). Also: consent sources identified by their own row id, a two-checkbox form header driving conditional Flow/Poll tabs, poll outcomes that support ties with extensible auto-close strategies, fully localized and department-routable email, concise list-view columns, and response messages with the same recall fidelity as action emails. This pass also redesigns the submission answers view around native Payload fields, adds a manual poll-close action with self-managing `mostVoted` outcomes, clarifies field labels in the flow builder, and adds a server-side `createSubmission` helper alongside a documented submit contract. Validation is simplified to a binary pass-or-fail (severities and warnings are gone), every rule now opens with a plain-language description, `matchesField` and custom rules target another field through a validated picker, `country` and `state` become opt-in field types, and the redirect response gains a field-composition seam.
+
+  **Breaking:**
+
+  - **Display settings are gone; the form's title is exposed instead.** The `display` group (`showTitle`/`title`/`intro`), its Display tab, `FormDocument.display`, and `FormDisplaySettings` are all removed, and `<Form>` no longer renders a heading or intro above the fields. Whether a form's title appears is the host's call: `FormDocument.title` carries the document title (the collection's existing required `useAsTitle` field) for a page to render, or not. Authored `display` data is orphaned on next save.
+  - **`message` is a bare, nameless block.** The block is its `content` rich text alone: no name, label, width, required, placeholder, description, validation, or `visibleWhen`. `FormFieldDefinition` gains `bare`, `FormFieldInstance.name` becomes optional, and instances are addressed by key (a name, else Payload's hidden block row id), so flow step assignment, render keys, and the builder's picker all keep working. Stored named message rows keep rendering, but resaving a form through the admin drops the name, so a flow referencing a legacy message by name needs that message re-assigned to its step. Bare blocks are excluded from repeater `subFields`, whose row plumbing is name-keyed. A bare definition must declare `value: 'none'`; the plugin throws at boot otherwise.
+  - **`response.submitLabel` is removed in favour of a `buttons` group.** Every form now carries `buttons` at the bottom of its Fields tab: `submitLabel` at full width, then `prevLabel` and `nextLabel` side by side in a row (previous first). Store the label at `buttons.submitLabel`; `FormResponseSettings` no longer carries `submitLabel` and `<Form>` ignores legacy stored values. The `<Form>`/`<FormControls>` label prop and the `buttons.fields` seam key are `prevLabel`/`defaultFields.prev` (the `renderBack` prop, `backButtonClassName`, `BackButtonRenderProps`, and the `fb-form__back` class keep the `back` name; only the label concept moved to `prev`).
+  - **A flow step's unset `next` falls through instead of ending the form.** `next` now has three states: absent falls through to the next step in array order (the last step ends the form), `null` is an explicit end of form regardless of position, and a step id is a jump. Matching transitions still win over all three. Flows relying on an unset `next` to end the form mid-array must set that step's next to "End of form" (`next: null`). Newly added steps previously carried no `next` and were silently terminal, so a fresh two-step flow showed Submit on step one and never reached step two. `__end__` is reserved as the builder's sentinel and rejected as a step id.
+  - **Consent references sources you own, not fields on the form.** A consent field now stores one thing, a source `key`. The statement, its policy page, and its link live on a `consentSourcesField()` you place on any collection or global you own, read back through a `consent.sources` resolver. The old machinery is removed wholesale: `defineConsentSource`, the consent-source registry, the `static` and `pageReference` built-ins, `resolveConsentLinks`, `buildConsentSourceConfig`, the per-source `sourceConfig` group, the `consentSources` plugin option, and the consent block's own `statement` and `optional` fields. Without a `consent.sources` resolver the `consent` field type is not registered at all, mirroring `uploads: false` removing `file`. The statement is a live reference resolved per request in the visitor's locale via `resolveConsentStatements()` (root + `/rsc`) and injected by `toFormDocument(doc, { consentStatements })`, so correcting a sentence corrects every form pointing at it, with nothing to re-save. Proof is id-based: `ConsentProof` is now `{ agreed, source, page?: { relationTo, id }, versionRef?, at }` (the old `ref` slug is gone); `versionRef` is the published version document's own id, captured only when the page's collection has drafts enabled (a collection with versions but no drafts, or none at all, records no `versionRef` rather than a misleading null). `required` now actually enforces (the field gained an intrinsic validator, since a missing consent coerces to `false`, a present value the shared required guard skipped), and `label`/`placeholder` drop off the block via `omitShared` because the statement is the visible text and the accessible name. Authored statements and source config from the previous shape are orphaned. New exports: `consentSourcesField`, `resolveConsentStatements`, the `ConsentSourceEntry`/`ConsentSourcePage`/`ConsentSourcesResolver` types, and `sanitizeUrl` (now also from `./react`).
+  - **`poll.resultsField` is a select over eligible fields.** It was free text. It now lists the form's named instances of field types declaring `pollEligible` (built-in: `select`), and server validation enforces the same rule on save, so a free-text or PII field can never be stored while the poll is enabled.
+  - **Some field types no longer store shared basics they never read.** `FormFieldDefinition.omitShared` lets a type leave chosen shared config fields (`label`, `placeholder`, `description`, `width`, `required`) unauthored while keeping the rest of the chrome; `name` is never omittable. Applied where the renderer proves the field dead: `checkbox`, `file`, `repeater`, and `date` no longer store a `placeholder` (browsers ignore one on a date input), and `calculation`, being server-derived and read-only, stores neither `placeholder` nor `required`. Those columns are dropped, orphaning any authored values. `OmittableSharedField` is exported.
+  - **`richText.editor` is now plugin-wide.** It previously overrode the action body fields only; it is now the default editor for every plugin rich text field (message content, response message, action bodies). The new `richText.bodyEditor` is the action-body-specific override and falls back to `editor`. A host that set `editor` to give email authors a different toolbar should rename it to `bodyEditor` to keep that scope. Consent statements are unaffected: they live on your `consentSourcesField()`, which carries its own `editor` option.
+  - **A consent source is identified by its own row id, not a hand-authored `key`.** `consentSourcesField()`'s rows no longer have a `key`; the array row's own auto-assigned id is the stable reference a consent field stores and a proof records, so renaming or reordering a row can never orphan either. The row's name, shown when picking a source and used as the policy-link text, is now called `name` (was `label`). Row-level descriptions were trimmed to the array itself and the page field, relabeled "Statement source" and described as: set it if you want a submission to save a reference to your policy. A `consent.sources` resolver returning the previous `{ key, label, ... }` shape must return `{ id, name, ... }` instead; existing consent field values referencing an old `key` no longer resolve to a source.
+  - **The form header gained two independent checkboxes, and the `buttons` group is gone.** `multistep` and `pollEnabled` are new top-level checkboxes: `multistep` reveals a **Flow** tab (previously always visible) and drives the client's step navigation, `pollEnabled` reveals a new **Poll** tab and replaces the previous nested `poll.enabled` (the poll group's own fields are otherwise unchanged). The **Buttons** group is gone: `submitLabel` now sits directly at the bottom of the Fields tab, and `nextLabel`/`prevLabel` sit in a row at the bottom of the Flow tab (shown once the flow has a step); all three are still reassembled into `FormDocument.buttons` the same way for `<Form>`. The `buttons.fields` composition seam now receives and returns a `{ submit, prev, next }` map keyed by slot instead of a single field array. A field a host adds alongside a default label no longer rides along automatically into `FormDocument.buttons`: `buttons`, like `poll`, is now a fixed allowlist on `toFormDocument` (previously it, like `response` still is, passed the whole group through), so surfacing a custom button field to the client now needs merging it into `toFormDocument`'s output by hand. `FormDocument` gains `multistep: boolean` and `pollEnabled: boolean`.
+  - **A poll outcome records a set of winners, not one.** `poll.outcome.winningValue` is `poll.outcome.winningValues`, an array: the admin winner picker is a multi-select, and a tie records every tied value instead of forcing a single pick. `resolvePollOutcome`'s `winningValue` argument is `winningValues`, also an array. `definePollOptionSource.resolveOutcome` may now return a single value, an array (a tie), or `undefined`.
+  - **The form title is localized.** `title` (the collection's `useAsTitle` field) now follows `localizeContent` like the rest of a form's visitor-facing text, required only in the default locale so other locales fall back to it instead of forcing a translation everywhere.
+  - **A poll's outcome type defaults to `mostVoted`, not `manual`, and the winner picker is hidden for every auto-resolving type, not just `mostVoted`.** A freshly enabled poll now resolves itself at close with no admin action required; picking `manual` still opts back into a hand-set winner. `poll.outcome.winningValues` shows only for `manual` now; it used to show for anything except `mostVoted`, so a `source` poll (or a host `definePollType` strategy) that previously let an editor hand-override its winner no longer offers that picker at all. A poll that already has an explicit `type` stored is unaffected; only one whose `type` was never saved picks up the new default.
+  - **Enabling a poll now requires a vote field.** With `pollEnabled` on and no `poll.resultsField` set, saving auto-picks the form's one eligible field (a named `select`, an opted-in `country`/`state`, or a custom `pollEligible` instance), asks you to choose when there are several, and refuses the save when there are none, unless the poll is driven by an option source or the `source` outcome type, which need no on-form field. Previously an enabled poll with no vote field saved without complaint and simply had nothing to aggregate.
+  - **Validation is binary; `severity` and `warnings` are gone.** A rule either blocks or passes, so the per-rule `severity` select, the `{ message, severity }` result form, `ValidationSeverity`, and the entire non-blocking `warnings` pathway are removed: the `FieldRendererProps.warnings` prop, the form state's `warnings`, `FieldShell`'s warning region, and `ValidateFieldResult.warnings`. A rule's `validate` now returns `true` (pass) or a `string` (a blocking error); every failure blocks submission. A custom renderer that read `warnings` should drop it, and a rule returning `{ message, severity: 'warning' }` now blocks like any other error.
+  - **`matchesField`'s target is a picker validated on save.** Its `field` param is authored by choosing from the form's own fields instead of typing a name (the value is still a stored field name, so no data migration), and it is checked on save: a target that no longer resolves to a field is a save error rather than a rule that silently never fires. The same picker and check are available to custom rules through the exported `fieldTargetParam`.
+
+  **Features:**
+
+  - Host-owned consent sources: `consentSourcesField()` is an array (`name`, rich text `statement`, optional polymorphic `page`) you place wherever your policies live, and `consent.sources` is the async `req`-scoped resolver that reads it back. The statement is authored rich text serialized through the same escaping and URL-sanitizing pipeline as action bodies; the policy link (a source's `name` plus a resolver-provided `url`) renders beside it, and the checkbox takes its accessible name from the statement flattened to its visible words. That flattener, `textOfBody`, is exported (root and `./react`) and handles rich text, legacy Slate, or a plain string. Multi-tenancy needs no plugin support: place the field on a tenant-scoped document and scope the resolver by `req`.
+  - Form-level button labels: `submitLabel`/`nextLabel`/`prevLabel`, localized following `localizeContent`, each resolved as `<Form>` prop, then the stored value, then the translated default. `buildSubmitLabelField`, `buildNextLabelField`, `buildPrevLabelField`, and `buildDefaultButtonFields` (keyed `submit`/`next`/`prev`) are exported, and `useFormContext()` now exposes the `form` document so custom chrome can read them.
+  - Sequential step fall-through: the flow builder's Default next select gains "Next step in order" as the default for an unset `next`, "End of form" maps to an explicit `null`, `normalizeFlow` preserves `null` as distinct from absent, and deleting a step cascades, clearing every `next` and transition aimed at it.
+  - Poll field eligibility: `pollEligible` on a field definition marks a type choosable as a poll's results field. The results endpoint gates anonymous reads on the same rule, serves option-source polls anonymously (buckets seeded in resolved order with the source's labels), fails closed with a 503 when a source throws, and refuses with a 403 while resolution is empty.
+  - A field type can source its own poll options: `FormFieldDefinition.resolveOptions` lets a `pollEligible` type produce its poll choices from the configured instance itself (for example a `hasMany` relationship to the voteable records) rather than from authored options or a shared source. The one resolution backs submission validation, the admin winner select, and results labeling alike; it is consulted after an `optionSource` and before the instance's authored `options`. `resolveEffectivePollOptions` (root and `/rsc`) and `ResolveFieldOptionsArgs` are exported.
+  - Poll outcome selection: `poll.outcome.winningValues` is admin-editable through a multi-select backed by an authenticated `GET /api/forms/:id/poll-options`, with `resolvedAt` server-stamped and access-locked (set, changed, or cleared by a hook; direct writes dropped). The group is composable through the `poll.outcomeFields` option, which receives the two default fields (`winningValues`, `resolvedAt`) and returns the group's fields verbatim, so a host can swap the winner picker for its own component; membership validation runs server-side regardless, so a swap cannot bypass it. `definePollOptionSource` gains a `resolveOutcome` seam, so `resolvePollOutcome` runs in auto mode with `winningValues` omitted and returns the recorded set either way. `resolveEffectivePollOptions` is the single option set backing the admin select, the endpoint, outcome validation, and a field type's `resolveOptions`, so what the admin offers and what the server accepts cannot drift. `buildWinningValuesField`, `buildResolvedAtField`, `buildDefaultOutcomeFields`, and `OutcomeFieldsOverride` are exported.
+  - Per-request sender addresses: `email.fromAddresses`, an async `req`-scoped resolver, gives both email actions a From select backed by an authenticated `GET /api/forms/:id/from-addresses`, validated for membership on save and passed through to `payload.sendEmail`. Intended for multi-tenant hosts scoping senders to the tenant derived from `req`. Absent (the default) adds no field and keeps the adapter's default sender.
+  - Admin polish: select option rows label their two fields `Label`/`Value` (were `Option label`/`Option value`) beneath an array already titled Option/Options; the flow step title's hardcoded, untranslatable placeholder is gone and the remaining English strings in the flow builder are translated; and `poll.outcome` and `response.redirect`, the two groups nested inside another group, render flush via `admin.hideGutter`.
+  - Extensible poll outcome types: `definePollType` registers a named outcome strategy (`resolveOutcome`), chosen per form via the poll's `type` select and configured plugin-wide via `poll.types`. Three ship and are always available: `manual` (default; an admin always sets the winner), `mostVoted` (auto-resolves to the top-voted value(s) once there are responses, a tie recording every co-winner, declining to decide on a truncated sample), and `source` (delegates to the poll's option source's own `resolveOutcome`). A poll with a `closesAt` and a non-`manual` type schedules its own resolution as a native Payload job (`waitUntil: closesAt`, re-enqueued on every save so the newest close date always wins); this needs a wired job runner (`config.jobs.autoRun`, a worker, or a serverless cron) to actually run. As a safety net with no runner, a closed, unresolved, non-manual poll also resolves the next time its results are read, by an admin or through the public endpoint alike.
+  - Department-routed email: the new `email.departments` plugin option turns `emailTeam`'s **To** into a select over host-managed addresses (an authenticated endpoint, validated on save, fails closed like `email.fromAddresses`). `departmentsField()` is the array a host places anywhere (a settings global, a tenant document) to hold the addresses, rendered as condensed flat rows with no per-row collapsible, and `resolveDepartmentOptions` builds the resolver's return value from it with a reusable current-locale -> default-locale -> next-available fallback. Independent of departments, **To** is now always localized like the subject and body, so a submission routes to the address stored for its own locale; the queued (job) dispatch path loads the form at the submission's own stored locale for the same reason.
+  - Concise, localized list columns: the `forms` list shows a field count ("6 Fields") and a step count ("2 steps", or none with no flow) instead of Payload's raw block/JSON summaries, plus a curated default column set (title, fields, flow, poll, updated at); `form-submissions` gets a curated default set too (form, status, locale, created at).
+  - Response messages interpolate recall tokens: a form's success message (`response.message`) now supports the same `{{field}}` / `{{field|fallback}}` / `{{field||fallback}}` tokens as an action body, resolved against the submission's own formatted answers (option labels, Yes/No, localized dates) and field descriptors, matching what `emailTeam`'s body already gave an admin.
+  - The submission answers view now renders with native Payload field components (the same `TextInput`/`FieldLabel`/`Pill` building blocks Payload's own fields use) instead of bespoke markup, and honors each field's authored width so the admin layout matches the widths editors set on the form. Consent renders as an Agreed/Declined `Pill` beside its source link and capture timestamp; `locale` and the submission `meta` (received-at time, IP/user agent when captured, spam signal) are folded into a single Submission-details section instead of separate top-level fields. `showSubmissionRawFields` now also gates `locale` and `meta`, alongside the existing `values`/`descriptors`/`consent`. `SubmissionDescriptor` gains `width`, and `SubmissionWidth` (`full`/`half`/`third`/`twoThirds`) is exported.
+  - A poll with no scheduled `closesAt` gets a manual **Close poll now** button in the admin, backed by an authenticated `POST /api/forms/:id/close`: it stamps `closesAt` to now and, for the `mostVoted`/`source` outcome types, resolves the winner the same way a scheduled auto-close would. A `manual` poll must already have a winner recorded, closing refuses (400) otherwise, and closing an already-closed poll is refused the same way. A `mostVoted` poll now manages its own outcome end to end: its `winningValues` field is hidden from the outcome group entirely (the strategy decides the winner, so there is nothing to hand-pick), whether it resolves on schedule or via this new button. The outcome `type` select reads more plainly, now with a description of what it does ("How the winning option is decided when the poll closes."): its options are `Set the winner manually`, `Most-voted option wins`, and `Winner from the option source` (the last hidden from the select until an option source is registered).
+  - The flow builder's field picker and unassigned-fields list now label each field with its authored `label` (falling back to the machine name) instead of the raw name, and label a bare message block with a short snippet of its authored content (falling back to its translated type label, numbered when the form has more than one) instead of a generic placeholder.
+  - A server-side `createSubmission(payload, { form, values, req? })` (root export) wraps `payload.create` for the `form-submissions` collection, giving server code (a script, a queued job, another collection's hook) a typed, documented entry point instead of hand-rolling the collection slug and body shape. It runs the exact pipeline the browser and REST paths run: server-authoritative validation, spam metadata when `req` is threaded through, descriptor snapshotting, consent capture, and post-submit action dispatch are all `form-submissions` collection hooks, not a route handler. Access is unchanged (`create: () => true`; `read` logged-in only; `update` disabled), so a raw REST `POST` and `createSubmission` reach the identical pipeline `submitForm` does.
+  - Admin and docs polish: a new Options API conventions section documents the plugin's few configuration shapes (opt-in flags, resolver-gated features, composition seams, registry seams), so which pattern a given option follows is no longer a guess. A field block's collapsed row header now shows the field's own label once set, falling back to its translated type name, instead of Payload's default block-name placeholder that reads "Untitled" until filled in (`FieldBlockLabel`, exported from `./client`). Two field descriptions duplicating their own field's obvious purpose are gone: the previous/next button-label fields' "Shown on multi-step forms only" and the department-routed **To** field's "The department this submission is routed to. Each locale keeps its own address."
+  - Save-through poll close and reopen: the Poll tab's button now saves the whole document through the admin's own submit instead of posting to a dedicated endpoint, so a `manual` poll's winner, even one picked in the same sitting, persists together with the close in one request rather than needing a prior save. The same button now also reopens: once closed, clicking it clears `closesAt` and the recorded `winningValues` together, for every outcome type. The `POST /:id/close` endpoint keeps its previous behavior unchanged for programmatic callers; only the admin button stopped using it.
+  - Email actions gain **Cc**, **Bcc**, and **Reply-to**: `emailTeam` and `confirmation` both carry all three, localized like `subject` and interpolated with the same recall tokens, each accepting a comma-separated address list forwarded to `payload.sendEmail` as-is.
+  - Internal-reference redirects: the new `redirectRelationships` plugin option (a `CollectionSlug[]`, named after `@payloadcms/plugin-form-builder`'s option of the same purpose) adds a polymorphic `reference` field to `response.redirect`, so an author can point a successful submit at an internal document instead of, or alongside, a URL. `toFormDocument` passes the raw `{ relationTo, value }` pair through unresolved; resolving it to a URL is the host's job, since the plugin has no notion of your routing.
+  - Two opt-in field types, `country` and `state`: fixed-option pickers (every ISO 3166-1 country; the 50 US states plus DC) that store the code and `format` it to the English name, poll-eligible like `select`. They are not registered by default; a host enables them with `fields: { country: countryField, state: stateField }` (both exported). Their renderers are always registered, so opting in needs no frontend wiring.
+  - Every validation rule opens with a plain-language description. Each rule's config block leads with a short, localized sentence explaining what makes it fail, so an editor never has to infer a rule's mechanics from its name (`matchesField`, for instance, states that it fails when the two answers differ). `ValidationRuleDefinition.description` carries it as a localizable key; the built-ins ship English and German.
+  - `fieldTargetParam(name, opts?)` is a reusable rule/action param that targets another field on the same form: a text value authored by the field-name picker, with a save-time existence check so a removed target is caught. `matchesField` uses it, and it is exported for custom rules that need to point at another field.
+  - A composition seam for the redirect response, `response.redirect.fields`: it hands you the group's default fields (the `url` text field, plus the `reference` relationship when `redirectRelationships` is set) and takes your array back, so you can drop in a custom link field, swap `url` for your own picker, reorder, or filter, mirroring `buttons.fields` and `poll.outcomeFields`. `RedirectFieldsOverride`, `ResponseOption`, and `RedirectOption` are exported. The plugin's built-in redirect still reads `redirect.url` / `redirect.reference`, so a host that replaces `url` owns resolving its own field to a destination.
+
+  **Fixes:**
+
+  - **A required checkbox accepted an explicit "unchecked".** The engine's required guard fires on `isEmpty(value)`, and `false` is a present value, so an untouched box (never sent) was rejected while a checked-then-unchecked one (sent as `false`) passed. `checkbox` (and `consent`) gained the intrinsic validator they lacked rather than widening the global `isEmpty`, which would ripple to every boolean. The one `runValidation` engine backs both client and server, so the fix binds them alike.
+  - **Admins saw raw stored values for sourced polls.** The authenticated results endpoint now injects the results field's effective options (source-resolved, `resolveOptions`-backed, or authored) too, so a sourced or resolver-backed poll renders labels in the admin instead of raw values, best-effort: a resolve failure there degrades to raw values rather than blocking the trusted read (the anonymous path still fails closed).
+  - The `pattern` rule's params are validated at authoring time, so an uncompilable expression or flag set is a save error instead of a rule that silently never fires. `pattern` compiles against its sibling `flags`, since flags decide validity, and an invalid flag is left to the `flags` field so one typo reports once. The submit-time fail-open stays as the safety net for rules stored before the guard existed.
+  - The unused-translation-key guard could never fail. It listed key-enumerating files by name and so missed `de.ts`, which then entered the usage corpus and, keying every entry as `keys.<name>`, matched all keys on its own, leaving `unused` permanently empty and the guard passing unconditionally. The corpus now excludes `src/translations/` by directory rather than by naming the files inside it, so no future locale can rejoin it and re-blind the scan however it happens to be written; nothing in that directory consumes a `keys.X` reference, so a key used only from there was never a used key anyway. Unreferenced keys are now reported, and no orphans exist once the scan works.
+  - A defaulted admin select was clearable with a silent consequence: a cleared submission `status` (which defaults to `complete`, and aggregation counts `complete`) dropped the submission out of every poll result with nothing in the UI saying so. It is now `isClearable: false`, matching the precedent on `width`, `response.type`, and `poll.resultsVisibility`.
+  - The shadcn registry's consent field rendered no required marker, making a required consent the only labelled field in the registry giving the visitor no sign it was mandatory until submit failed.
+  - Three fields with a custom select component silently rendered no description. A custom `Field` replaces Payload's whole default render, and a function `admin.description` is dropped from the client field before it ever gets there, so the text was configured but unreachable: the confirmation action's recipient field ("The email field on this form the confirmation is sent to.") and the file field's maximum size both lost theirs in earlier releases, and the poll's results field lost the sentence naming the rule it exists to enforce ("Use a choice field, never a free-text or PII field."). All three now pass a translated description key to their component, which renders it.
+  - The condition builder's value input for a `select` or `date` operand threw and broke the builder. Payload's native `Select`/`Date` leaf field components read `field.admin.placeholder` unconditionally, and the client field the builder synthesizes for a leaf condition carried no `admin` object at all; every synthesized leaf (`text` and `number` too, for consistency) now carries an empty `admin: {}`.
+  - Closing a `manual` poll with no winner recorded used to round-trip to the server and fail with a toast error after the click. The Close button now disables itself first, with an inline hint ("Select a winning value first."), so the invalid click is prevented rather than attempted and rejected.
+  - The poll's vote-field select was labelled "Results field," easy to misread as a display setting rather than the question being voted on. It is now "Vote field," with its description explaining the new auto-fill behavior.
+  - The email actions' **Cc** and **Bcc** labels are now cased **CC** and **BCC** (both locales), matching how the headers are conventionally written.
+  - The shadcn `form-results` registry snapshot was rebuilt. It still shipped the single-winner `winningValue?: string` component after the source moved to `winningValues?: string[]` for tie support, so a project pulling the registry got a component that could not highlight a tie; `registry:build` now matches the source.
+
+  **Notes:**
+
+  - No migrations, as ever pre-1.0: the removed `display` group, `response.submitLabel`, the consent `statement`/`optional` fields, the per-source `sourceConfig`, the dropped `placeholder`/`required` columns, and the form title's move to localized storage are orphaned rather than dropped. Write your own if you carry data.
+  - The From select and the poll winner select are both document-scoped, so each stays empty until the form's first save: their endpoints need a document id to resolve against. Save the form, then pick. The consent-sources select is the same.
+  - `email.fromAddresses` fails closed, and Payload runs the validate on every save rather than only when `from` changed, so while the resolver is throwing, no form whose email action has a From set can be saved at all, including edits that never touch the address. Failing open would persist a sender the host can no longer vouch for; a resolver reaching a flaky upstream should cache or fall back internally instead of throwing.
+  - Internal, no changeset of its own: the shared test harness gained `warmVersionCollections`, initializing drafts-enabled collections so consent version-capture is exercisable in integration tests. It is tooling (`@10x-media/test-harness`), not published.
+  - The plugin now registers `form-submissions` before `forms` (Payload lists collections in registration order within a nav group), so the shared "Forms" sidebar group reads alphabetically. Ordering the rest of a host's own sidebar against it stays the host's config concern; Payload has no global nav-sort option.
+
+### Patch Changes
+
+- Correct `payload` and `@payloadcms/ui` peer ranges to `^3.83.0`. The plugin uses `definePlugin`, which shipped in Payload 3.83.0, so 3.82.x installs satisfied the old range but failed at import.
+
+## 0.1.0-beta.4
+
+### Minor Changes
+
+- Feedback round: flow authoring, localized content, response/display settings, bring-your-own uploads, poll lifecycle, composable form chrome, and a German locale.
+
+  **Breaking:**
+
+  - **Uploads are bring-your-own and off by default.** The plugin no longer registers a `form-uploads` collection. `uploads` is now `false` (default; the `file` field type is removed from the registry entirely) or `{ collection: 'slug' }` pointing at an upload-enabled collection the app owns; the plugin validates it at boot, appends a hidden `owner` field, and prepends the spam upload hooks. The file field's `relationTo` config is gone (the server stamps the configured slug onto each `file` block as a hidden `uploadsCollection`), and `overrides.uploads` no longer exists.
+  - **Stored presentation is gone.** The `defaultPresentation` field on `forms` and the plugin-level `presentations` option are removed. Presentation is decided at render time via the `presentation`/`presentations` props on `<Form>`; the React presentation system (page/inline/modal/drawer, custom `FormPresentation`) is unchanged.
+  - **Poll config moved into a `poll` group.** The top-level `showResults`/`resultsField` fields on `forms` are replaced by `poll.enabled`, `poll.resultsField`, plus the new `poll.resultsVisibility` and `poll.closesAt`. The results endpoint now gates on `poll.enabled` and visibility.
+  - **Content fields are localized by default.** Author-facing content (field labels, placeholders, descriptions, option labels, consent statements, action subjects/bodies, response/display content) carries `localized: true`; on hosts with Payload `localization` configured the stored data shape changes to per-locale objects. Hosts without localization are unaffected (Payload strips the flag). Opt out with `localizeContent: false`; when opting out, derive registry overrides from `buildDefaultFieldDefinitions(false)` / `buildDefaultActionDefinitions(false)` / `buildDefaultConsentSources(false)` instead of spreading the prebuilt defaults, which carry the localized flags.
+  - **`<Poll hasVoted>` ORs with the localStorage guard.** `hasVoted: true` marks the visitor as voted regardless of localStorage; it previously could suppress the localStorage read. `false`/omitted falls back to localStorage as before.
+  - **Form chrome markup changed.** The default buttons now carry stable classes (`fb-form__back`, `fb-form__next`, `fb-form__submit`) and always render inside a `.fb-form__controls` wrapper (previously classless buttons, wrapped only on multi-step forms). CSS or tests targeting the old bare buttons need the new hooks.
+
+  **Features:**
+
+  - Flow authoring without ids: steps are named by title (ids auto-generated, never shown), field assignment is exclusive with an unassigned-fields list, and save-time normalization dedupes fields across steps.
+  - `message` field type: display-only rich text between fields, never validated or stored, condition-targetable, recall-token aware.
+  - Response settings (`response` group + tab): success `message` rich text, `redirect` URL (fires on the custom-`children` path too), and `submitLabel` with prop-over-document-over-default precedence.
+  - Display settings (`display` group + tab): opt-in form title (`showTitle`/`title`) and rich text `intro` rendered above the fields, recall-token aware.
+  - Field config layout: the Field tab lays basics out in rows (name/label, width/placeholder), `width` is required with a `full` default, and `required` sits last.
+  - Poll lifecycle: `closesAt` close date enforced at submission time, `resultsVisibility` (`afterVote`/`afterClose`) gating for anonymous results, a `results.access` seam for multi-tenant scoping, and `poll: { votedCookie: true }` for an httpOnly SSR voted marker read via `hasVotedCookie`.
+  - Poll option sources: `definePollOptionSource` + the `poll.sources` registry resolve a poll's choices from host domain data at render (`resolvePollOptions` + `toFormDocument(doc, { pollOptions })`) and at submission (resolved values are the only accepted answers, fail closed).
+  - Poll outcome: `resolvePollOutcome` records a final `winningValue` (admin read-only, server-only write path); `<Poll>` renders the final state and `<FormResults winningValue>` highlights the winner.
+  - `richText.editor` overrides the editor on both action body fields (e.g. a minimal toolbar for email authors); a custom `richText.serialize` now receives the submitted `form` and `req` for per-tenant lookups or handing off to react-email.
+  - Composable chrome: `<FormControls>` (the default buttons with all `render*`/className overrides) and `<FormSteps>` (step progress with `aria-current`) are exported for custom `children` layouts, and `useFormContext` exposes the controller context including resolved `labels`, the active `t`, and `effectiveValues`.
+  - Server-safe `toFormDocument`: no `'use client'` directive, exported from the root and the `/rsc` subpath (which also gains `resolvePollOptions`, `resolvePollOutcome`, `hasVotedCookie`, `votedCookieName`, and `isPollClosed`), so Server Components narrow the document without pulling in the React client layer.
+  - German (`de`) admin and renderer strings ship built in alongside English.
+  - The shadcn registry now covers every built-in field type (adds date, consent, calculation, and repeater renderers); the default `textarea` type label is now "Textarea".
+  - Repeaters with `minRows` start pre-seeded with that many empty rows instead of appearing blank until validation; an explicit `initialValues` entry for the field (including `[]`) still wins over the seed.
+
+  **Fixes:**
+
+  - File fields nested inside a repeater row now get the same server-side upload enforcement as top-level file fields: each captured value is re-derived into a `FileRef` from the stored upload doc (owner, MIME type, and size checked against the sub-field config) instead of storing the raw client-submitted id, and the submission fails closed on a forged id or a missing uploads collection.
+  - Upload enforcement is now driven by a field's value kind rather than its block type, so a custom field type registered with `value: 'file'` is captured and enforced (owner/MIME/size) at both the top level and inside repeaters, not just the built-in `file` type.
+
+  **Notes:**
+
+  - The voted cookie is deliberately not `Secure`: it is a UX-only marker (skip re-showing an answered form), never an integrity or auth signal, and staying non-Secure keeps plain-HTTP local development working.
+  - No migrations are shipped for the removed/moved `forms` columns (`defaultPresentation`, `showResults`, top-level `resultsField`); pre-1.0 with no known production consumers, write your own if you carry data.
+
+## 0.1.0-beta.3
+
+### Minor Changes
+
+- Bundled captcha adapters and widget components. `turnstileProvider`, `recaptchaProvider` (v2 + v3 with `minScore`), and `hcaptchaProvider` verify tokens server-side with fail-closed semantics (network errors, timeouts, and non-2xx responses reject the submission). Matching headless `TurnstileCaptcha`, `RecaptchaCaptcha`, and `HcaptchaCaptcha` components on the `/react` export load each vendor script once, report tokens through `onToken` for `<Form captchaToken>`, clear on expiry or error, and expose `reset` (plus on-demand `execute` refresh for reCAPTCHA v3) via a ref handle.
+
+- Feedback round: `date` field type (native date input, real-calendar validation) with `minDate`/`maxDate` rules; rich text notification bodies for `emailTeam`/`confirmation` using the project's configured editor, serialized with escaping, sanitized links, `{{ name|fallback }}`/`{{*}}`/`{{*:table}}` tokens, a plugin `richText { converters, serialize }` option for custom nodes and non-HTML channels, and `renderBody` on action run args; the confirmation recipient is a select over the form's email fields, validated server-side on save; `signedWebhook` validates its URL as absolute http(s) and describes its config fields; calculation expressions get an admin description, Monaco JSON-schema autocomplete, and save-time validation of the expression tree; the file field's `mimeTypes` is a curated select and `maxSize` live-previews as a human-readable size, with a client-side size pre-check and hint line on the renderer; flow transitions resolve against effective values so calculation fields can drive branching; the forms document (Fields/Flow/Actions) and every field block (Field/Validation/Advanced) use tabbed admin layouts, and admin components ship their own CSS (no `styles.css` import needed for the admin). New exports: `serializeBody`, `defaultBodyConverters`, `sanitizeUrl`, `escapeHtml`, `renderAllValues`, `renderAllValuesTable`, `fileMimeTypeOptions`, `formatBytes`, `defaultFieldDefinitionsByType`, `defaultValidationRulesByType`, and the `ByteSizeField`/`FieldNameSelect` client components.
+
+  **Soft compat:** existing plain-string action bodies keep working through the send path (interpolated exactly as before), though the admin editor shows them as empty rich text until re-entered. File fields keep enforcing stored free-text MIME values, but values outside the curated list need re-selecting the next time that field is edited; submitted data is untouched.
+
+  **Postgres migration note:** on `@payloadcms/db-postgres`, two `forms` column types change: action `body` goes `varchar` to `jsonb` (pre-existing string bodies are not valid JSON, so cast with `USING to_jsonb(body)` when writing the migration), and `mimeTypes` moves from a text array to an enum-backed select. Mongo needs no migration. The project config must also set an `editor` (rich text bodies inherit it; Payload throws `MissingEditorProp` without one).
+
+### Patch Changes
+
+- The registry (shadcn-style) file field now matches the built-in file renderer: a client-side max-size pre-check rejects oversized files before uploading, and an accepted-types/max-size hint line renders under the input.
+
+  `minDate`/`maxDate` rule bounds are now validated as real `YYYY-MM-DD` calendar dates in the admin UI, so a malformed bound (e.g. `abc` or `2024-02-30`) is rejected at config time instead of silently breaking the rule's comparisons.
+
 ## 0.1.0-beta.2
 
 ### Minor Changes

package/README.md

@@ -1,3 +1,5 @@
+![Banner](./assets/banner.jpg)
+
 # @10x-media/form-builder
 
 An end-to-end forms platform for Payload v3: author forms in the admin, validate server-side, render headless on your frontend, collect typed submissions, aggregate results, and act on them. Simple by default for editors, with a definition seam (`defineFormField`, `defineValidationRule`, `defineAction`, and friends) wherever developers need depth, and 100% native to Payload.
@@ -8,8 +10,8 @@ Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-pl
 
 ## Features
 
-- **Fields**: text, textarea, email, number, select, checkbox, file, consent, calculation, and repeater (dynamic row lists with per-row sub-field validation), authored as Payload blocks; custom types via `defineFormField` are never second-class.
-- **Validation**: declarative per-field rules, custom messages and severities, cross-field and async server-only rules, a Standard Schema escape hatch (zod, valibot, ...), one server-authoritative engine.
+- **Fields**: text, textarea, email, number, date, select, checkbox, file, consent, calculation, repeater (dynamic row lists with per-row sub-field validation), and message, authored as Payload blocks; `country` and `state` are opt-in, and custom types via `defineFormField` are never second-class.
+- **Validation**: declarative per-field rules with plain-language descriptions, custom messages, cross-field and async server-only rules, a Standard Schema escape hatch (zod, valibot, ...), one server-authoritative engine.
 - **Conditional logic**: `visibleWhen` / `validateWhen` in Payload's `Where` shape, one isomorphic engine on client and server.
 - **Multi-step flows** with conditional branching, authored in the admin flow builder.
 - **Headless rendering**: `<Form>` with progressive validation and lifecycle events, accessible primitives, an optional layout grid; style via CSS hooks, a shadcn registry, or your own renderers.
@@ -17,10 +19,10 @@ Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-pl
 - **Recall and prefill**: pipe answers into labels and messages; URL prefill; hidden context fields.
 - **Calculations**: a safe no-eval expression engine for totals and quiz scores, recomputed on the server.
 - **Post-submit actions**: email, confirmation, signed webhook, and custom actions, queued via Payload jobs with a bounded inline fallback.
-- **Consent** with proof by reference and policy-version capture; **file uploads** with server-enforced MIME/size; **polls** with a gated public results endpoint.
-- **Spam protection** on by default: honeypot, per-identity rate limiting, a captcha seam, upload-ownership scoping, privacy-first metadata.
+- **Consent** referencing statements you own, resolved live per request, with proof stored as document ids and published versions; **file uploads** into your own upload collection with server-enforced MIME/size; **polls** with a gated public results endpoint.
+- **Spam protection** on by default: honeypot, per-identity rate limiting, bundled captcha adapters (Turnstile, reCAPTCHA, hCaptcha), upload-ownership scoping, privacy-first metadata.
 - **Accessibility** verified by automated axe checks; **typed translations** via `@10x-media/form-builder/i18n`.
-- **Collection overrides**: extend `forms`, `form-submissions`, and `form-uploads` with extra fields, hooks, and access rules using an explicit spread API that guarantees plugin-critical hooks always run.
+- **Collection overrides**: extend `forms` and `form-submissions` with extra fields, hooks, and access rules using an explicit spread API that guarantees plugin-critical hooks always run.
 
 ## Quick start
 

package/dist/actions/assertNoBlockCollision.js

@@ -0,0 +1,18 @@
+//#region src/actions/assertNoBlockCollision.ts
+/**
+* Fail fast at boot when a registered action type collides with a host block slug. Payload resolves
+* blocks globally by slug, so a shared slug makes a saved action document read back with the content
+* block's fields merged in, silently polluting the stored shape and admin tabs. Rather than let that
+* happen quietly, throw a clear error naming the collision so the author renames one side. Action block
+* slugs stay the raw type (renaming them would break every already-stored action), so this detection is
+* the non-breaking guard.
+*/
+const assertNoActionBlockCollision = (config, registry) => {
+	const hostSlugs = /* @__PURE__ */ new Set();
+	for (const block of Array.isArray(config.blocks) ? config.blocks : []) if (block && typeof block === "object" && typeof block.slug === "string") hostSlugs.add(block.slug);
+	for (const type of registry.keys()) if (hostSlugs.has(type)) throw new Error(`@10x-media/form-builder: action type "${type}" collides with an existing Payload block slug "${type}". Rename the action type or the block.`);
+};
+//#endregion
+export { assertNoActionBlockCollision };
+
+//# sourceMappingURL=assertNoBlockCollision.js.map

package/dist/actions/assertNoBlockCollision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertNoBlockCollision.js","names":[],"sources":["../../src/actions/assertNoBlockCollision.ts"],"sourcesContent":["import type { Config } from 'payload'\nimport type { ActionRegistry } from './registry'\n\n/**\n * Fail fast at boot when a registered action type collides with a host block slug. Payload resolves\n * blocks globally by slug, so a shared slug makes a saved action document read back with the content\n * block's fields merged in, silently polluting the stored shape and admin tabs. Rather than let that\n * happen quietly, throw a clear error naming the collision so the author renames one side. Action block\n * slugs stay the raw type (renaming them would break every already-stored action), so this detection is\n * the non-breaking guard.\n */\nexport const assertNoActionBlockCollision = (config: Config, registry: ActionRegistry): void => {\n\tconst hostSlugs = new Set<string>()\n\tfor (const block of Array.isArray(config.blocks) ? config.blocks : []) {\n\t\tif (block && typeof block === 'object' && typeof block.slug === 'string') {\n\t\t\thostSlugs.add(block.slug)\n\t\t}\n\t}\n\tfor (const type of registry.keys()) {\n\t\tif (hostSlugs.has(type)) {\n\t\t\tthrow new Error(\n\t\t\t\t`@10x-media/form-builder: action type \"${type}\" collides with an existing Payload block slug \"${type}\". Rename the action type or the block.`\n\t\t\t)\n\t\t}\n\t}\n}\n"],"mappings":";;;;;;;;;AAWA,MAAa,gCAAgC,QAAgB,aAAmC;CAC/F,MAAM,4BAAY,IAAI,IAAY;CAClC,KAAK,MAAM,SAAS,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,SAAS,CAAC,GACnE,IAAI,SAAS,OAAO,UAAU,YAAY,OAAO,MAAM,SAAS,UAC/D,UAAU,IAAI,MAAM,IAAI;CAG1B,KAAK,MAAM,QAAQ,SAAS,KAAK,GAChC,IAAI,UAAU,IAAI,IAAI,GACrB,MAAM,IAAI,MACT,yCAAyC,KAAK,kDAAkD,KAAK,wCACtG;AAGH"}

package/dist/actions/body/converters.d.ts

@@ -0,0 +1,20 @@
+//#region src/actions/body/converters.d.ts
+/** Text pipelines a converter can apply to author-typed content. */
+type BodyRender = {
+  /** Full text pipeline: HTML-escape, then expand `{{*}}`/`{{*:table}}` and recall tokens with escaped values. */text: (raw: string) => string; /** Recall-token interpolation only, unescaped; for URL-like values that get escaped separately. */
+  interpolate: (raw: string) => string;
+};
+type BodyConverterArgs = {
+  node: Record<string, unknown>; /** The node's already-serialized children. */
+  children: string;
+  render: BodyRender;
+};
+/** Serializes one Lexical node type to an HTML string. Keyed by `node.type` in the registry. */
+type BodyConverter = (args: BodyConverterArgs) => string;
+/** Allow http(s)/mailto/tel and scheme-less (relative) URLs; anything else becomes `#`. */
+declare const sanitizeUrl: (url: string) => string;
+/** Default Lexical-to-HTML converter registry; consumers spread overrides per node type. */
+declare const defaultBodyConverters: Record<string, BodyConverter>;
+//#endregion
+export { BodyConverter, BodyConverterArgs, BodyRender, defaultBodyConverters, sanitizeUrl };
+//# sourceMappingURL=converters.d.ts.map

package/dist/actions/body/converters.js

@@ -0,0 +1,57 @@
+import { escapeHtml } from "./escapeHtml.js";
+//#region src/actions/body/converters.ts
+const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+const SAFE_SCHEME = /^(https?|mailto|tel):/i;
+/** Allow http(s)/mailto/tel and scheme-less (relative) URLs; anything else becomes `#`. */
+const sanitizeUrl = (url) => {
+	const probe = url.replace(/\s/g, "");
+	if (probe === "") return "#";
+	if (SCHEME.test(probe)) return SAFE_SCHEME.test(probe) ? url.trim() : "#";
+	return url.trim();
+};
+const BOLD = 1;
+const ITALIC = 2;
+const STRIKETHROUGH = 4;
+const UNDERLINE = 8;
+const CODE = 16;
+const text = ({ node, render }) => {
+	let html = render.text(typeof node.text === "string" ? node.text : "");
+	const format = typeof node.format === "number" ? node.format : 0;
+	if (format & CODE) html = `<code>${html}</code>`;
+	if (format & BOLD) html = `<strong>${html}</strong>`;
+	if (format & ITALIC) html = `<em>${html}</em>`;
+	if (format & STRIKETHROUGH) html = `<s>${html}</s>`;
+	if (format & UNDERLINE) html = `<u>${html}</u>`;
+	return html;
+};
+const link = ({ node, children, render }) => {
+	const fields = node.fields ?? {};
+	const raw = typeof fields.url === "string" ? fields.url : typeof node.url === "string" ? node.url : "";
+	return `<a href="${escapeHtml(sanitizeUrl(render.interpolate(raw)))}"${fields.newTab === true ? " rel=\"noopener noreferrer\" target=\"_blank\"" : ""}>${children}</a>`;
+};
+const HEADING_TAG = /^h[1-6]$/;
+const heading = ({ node, children }) => {
+	const tag = typeof node.tag === "string" && HEADING_TAG.test(node.tag) ? node.tag : "h2";
+	return `<${tag}>${children}</${tag}>`;
+};
+const list = ({ node, children }) => {
+	const tag = node.tag === "ol" || node.listType === "number" ? "ol" : "ul";
+	return `<${tag}>${children}</${tag}>`;
+};
+/** Default Lexical-to-HTML converter registry; consumers spread overrides per node type. */
+const defaultBodyConverters = {
+	autolink: link,
+	heading,
+	horizontalrule: () => "<hr />",
+	linebreak: () => "<br />",
+	link,
+	list,
+	listitem: ({ children }) => `<li>${children}</li>`,
+	paragraph: ({ children }) => `<p>${children}</p>`,
+	quote: ({ children }) => `<blockquote>${children}</blockquote>`,
+	text
+};
+//#endregion
+export { defaultBodyConverters, sanitizeUrl };
+
+//# sourceMappingURL=converters.js.map

package/dist/actions/body/converters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converters.js","names":[],"sources":["../../../src/actions/body/converters.ts"],"sourcesContent":["import { escapeHtml } from './escapeHtml'\n\n/** Text pipelines a converter can apply to author-typed content. */\nexport type BodyRender = {\n\t/** Full text pipeline: HTML-escape, then expand `{{*}}`/`{{*:table}}` and recall tokens with escaped values. */\n\ttext: (raw: string) => string\n\t/** Recall-token interpolation only, unescaped; for URL-like values that get escaped separately. */\n\tinterpolate: (raw: string) => string\n}\n\nexport type BodyConverterArgs = {\n\tnode: Record<string, unknown>\n\t/** The node's already-serialized children. */\n\tchildren: string\n\trender: BodyRender\n}\n\n/** Serializes one Lexical node type to an HTML string. Keyed by `node.type` in the registry. */\nexport type BodyConverter = (args: BodyConverterArgs) => string\n\nconst SCHEME = /^[a-z][a-z0-9+.-]*:/i\nconst SAFE_SCHEME = /^(https?|mailto|tel):/i\n\n/** Allow http(s)/mailto/tel and scheme-less (relative) URLs; anything else becomes `#`. */\nexport const sanitizeUrl = (url: string): string => {\n\tconst probe = url.replace(/\\s/g, '')\n\tif (probe === '') {\n\t\treturn '#'\n\t}\n\tif (SCHEME.test(probe)) {\n\t\treturn SAFE_SCHEME.test(probe) ? url.trim() : '#'\n\t}\n\treturn url.trim()\n}\n\nconst BOLD = 1\nconst ITALIC = 2\nconst STRIKETHROUGH = 4\nconst UNDERLINE = 8\nconst CODE = 16\n\nconst text: BodyConverter = ({ node, render }) => {\n\tlet html = render.text(typeof node.text === 'string' ? node.text : '')\n\tconst format = typeof node.format === 'number' ? node.format : 0\n\tif (format & CODE) {\n\t\thtml = `<code>${html}</code>`\n\t}\n\tif (format & BOLD) {\n\t\thtml = `<strong>${html}</strong>`\n\t}\n\tif (format & ITALIC) {\n\t\thtml = `<em>${html}</em>`\n\t}\n\tif (format & STRIKETHROUGH) {\n\t\thtml = `<s>${html}</s>`\n\t}\n\tif (format & UNDERLINE) {\n\t\thtml = `<u>${html}</u>`\n\t}\n\treturn html\n}\n\nconst link: BodyConverter = ({ node, children, render }) => {\n\tconst fields = (node.fields ?? {}) as Record<string, unknown>\n\tconst raw =\n\t\ttypeof fields.url === 'string' ? fields.url : typeof node.url === 'string' ? node.url : ''\n\tconst href = escapeHtml(sanitizeUrl(render.interpolate(raw)))\n\tconst newTab = fields.newTab === true\n\treturn `<a href=\"${href}\"${newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n}\n\nconst HEADING_TAG = /^h[1-6]$/\n\nconst heading: BodyConverter = ({ node, children }) => {\n\tconst tag = typeof node.tag === 'string' && HEADING_TAG.test(node.tag) ? node.tag : 'h2'\n\treturn `<${tag}>${children}</${tag}>`\n}\n\nconst list: BodyConverter = ({ node, children }) => {\n\tconst tag = node.tag === 'ol' || node.listType === 'number' ? 'ol' : 'ul'\n\treturn `<${tag}>${children}</${tag}>`\n}\n\n/** Default Lexical-to-HTML converter registry; consumers spread overrides per node type. */\nexport const defaultBodyConverters: Record<string, BodyConverter> = {\n\tautolink: link,\n\theading,\n\thorizontalrule: () => '<hr />',\n\tlinebreak: () => '<br />',\n\tlink,\n\tlist,\n\tlistitem: ({ children }) => `<li>${children}</li>`,\n\tparagraph: ({ children }) => `<p>${children}</p>`,\n\tquote: ({ children }) => `<blockquote>${children}</blockquote>`,\n\ttext,\n}\n"],"mappings":";;AAoBA,MAAM,SAAS;AACf,MAAM,cAAc;;AAGpB,MAAa,eAAe,QAAwB;CACnD,MAAM,QAAQ,IAAI,QAAQ,OAAO,EAAE;CACnC,IAAI,UAAU,IACb,OAAO;CAER,IAAI,OAAO,KAAK,KAAK,GACpB,OAAO,YAAY,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;CAE/C,OAAO,IAAI,KAAK;AACjB;AAEA,MAAM,OAAO;AACb,MAAM,SAAS;AACf,MAAM,gBAAgB;AACtB,MAAM,YAAY;AAClB,MAAM,OAAO;AAEb,MAAM,QAAuB,EAAE,MAAM,aAAa;CACjD,IAAI,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,EAAE;CACrE,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;CAC/D,IAAI,SAAS,MACZ,OAAO,SAAS,KAAK;CAEtB,IAAI,SAAS,MACZ,OAAO,WAAW,KAAK;CAExB,IAAI,SAAS,QACZ,OAAO,OAAO,KAAK;CAEpB,IAAI,SAAS,eACZ,OAAO,MAAM,KAAK;CAEnB,IAAI,SAAS,WACZ,OAAO,MAAM,KAAK;CAEnB,OAAO;AACR;AAEA,MAAM,QAAuB,EAAE,MAAM,UAAU,aAAa;CAC3D,MAAM,SAAU,KAAK,UAAU,CAAC;CAChC,MAAM,MACL,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;CAGzF,OAAO,YAFM,WAAW,YAAY,OAAO,YAAY,GAAG,CAAC,CAErC,EAAE,GADT,OAAO,WAAW,OACG,mDAA+C,GAAG,GAAG,SAAS;AACnG;AAEA,MAAM,cAAc;AAEpB,MAAM,WAA0B,EAAE,MAAM,eAAe;CACtD,MAAM,MAAM,OAAO,KAAK,QAAQ,YAAY,YAAY,KAAK,KAAK,GAAG,IAAI,KAAK,MAAM;CACpF,OAAO,IAAI,IAAI,GAAG,SAAS,IAAI,IAAI;AACpC;AAEA,MAAM,QAAuB,EAAE,MAAM,eAAe;CACnD,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,aAAa,WAAW,OAAO;CACrE,OAAO,IAAI,IAAI,GAAG,SAAS,IAAI,IAAI;AACpC;;AAGA,MAAa,wBAAuD;CACnE,UAAU;CACV;CACA,sBAAsB;CACtB,iBAAiB;CACjB;CACA;CACA,WAAW,EAAE,eAAe,OAAO,SAAS;CAC5C,YAAY,EAAE,eAAe,MAAM,SAAS;CAC5C,QAAQ,EAAE,eAAe,eAAe,SAAS;CACjD;AACD"}