@10x-media/form-builder 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/consent/resolveConsentSourcesRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveConsentSourcesRequest.js","names":[],"sources":["../../src/consent/resolveConsentSourcesRequest.ts"],"sourcesContent":["import type { Payload, PayloadRequest } from 'payload'\nimport { FORMS_SLUG } from '../collections/forms'\nimport { resolveConsentEntries } from './resolveConsentEntries'\nimport type { ConsentSourcesResolver } from './types'\n\n/** One selectable consent source for the consent field's `source` select. */\nexport type ConsentSourceOption = { label: string; value: string }\n\nexport type ResolveConsentSourcesRequestArgs = {\n\tpayload: Payload\n\tformId: number | string | undefined\n\t/** Whether the caller is authenticated (an admin/user). */\n\tisAuthed: boolean\n\treq: PayloadRequest\n\tresolver: ConsentSourcesResolver\n}\n\nexport type ResolveConsentSourcesRequestResult = {\n\tstatus: number\n\tbody: { options: ConsentSourceOption[] } | { errors: { message: string }[] }\n}\n\n/**\n * Authorize and resolve the `GET /:id/consent-sources` request backing the consent `source` select:\n * authenticated callers get the host's sources for this request (a multi-tenant resolver scoping by\n * `req` therefore offers an author only their own tenant's), anonymous callers are always refused.\n * Statuses mirror the poll-options endpoint: 400 missing id, 403 unauthenticated, 404 unknown form,\n * 503 when the resolver throws (fail closed).\n */\nexport const resolveConsentSourcesRequest = async (\n\targs: ResolveConsentSourcesRequestArgs\n): Promise<ResolveConsentSourcesRequestResult> => {\n\tconst { payload, formId, isAuthed, req, resolver } = args\n\tif (!isAuthed) {\n\t\treturn { status: 403, body: { errors: [{ message: 'Forbidden' }] } }\n\t}\n\tif (formId == null) {\n\t\treturn { status: 400, body: { errors: [{ message: 'Missing form id' }] } }\n\t}\n\t// Load under the caller's own read access (no overrideAccess): a tenant-scoped `forms.access.read`\n\t// then refuses a cross-tenant form id (null -> 404), so an authed user can never enumerate another\n\t// tenant's consent source labels/ids.\n\tconst form = await payload\n\t\t.findByID({ collection: FORMS_SLUG, id: formId, depth: 0, req })\n\t\t.catch(() => null)\n\tif (!form) {\n\t\treturn { status: 404, body: { errors: [{ message: 'Not found' }] } }\n\t}\n\ttry {\n\t\tconst entries = await resolveConsentEntries({ payload, req, form, sources: resolver })\n\t\treturn {\n\t\t\tstatus: 200,\n\t\t\tbody: {\n\t\t\t\toptions: entries.map((entry) => ({ label: entry.name ?? entry.id, value: entry.id })),\n\t\t\t},\n\t\t}\n\t} catch {\n\t\treturn { status: 503, body: { errors: [{ message: 'Consent sources unavailable' }] } }\n\t}\n}\n"],"mappings":";;;;;;;;;;AA6BA,MAAa,+BAA+B,OAC3C,SACiD;CACjD,MAAM,EAAE,SAAS,QAAQ,UAAU,KAAK,aAAa;CACrD,IAAI,CAAC,UACJ,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,YAAY,CAAC,EAAE;CAAE;CAEpE,IAAI,UAAU,MACb,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,kBAAkB,CAAC,EAAE;CAAE;CAK1E,MAAM,OAAO,MAAM,QACjB,SAAS;EAAE,YAAY;EAAY,IAAI;EAAQ,OAAO;EAAG;CAAI,CAAC,EAC9D,YAAY,IAAI;CAClB,IAAI,CAAC,MACJ,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,YAAY,CAAC,EAAE;CAAE;CAEpE,IAAI;EAEH,OAAO;GACN,QAAQ;GACR,MAAM,EACL,UAAS,MAJW,sBAAsB;IAAE;IAAS;IAAK;IAAM,SAAS;GAAS,CAAC,GAIlE,KAAK,WAAW;IAAE,OAAO,MAAM,QAAQ,MAAM;IAAI,OAAO,MAAM;GAAG,EAAE,EACrF;EACD;CACD,QAAQ;EACP,OAAO;GAAE,QAAQ;GAAK,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,8BAA8B,CAAC,EAAE;EAAE;CACtF;AACD"}

package/dist/consent/resolveConsentStatements.d.ts

@@ -0,0 +1,45 @@
+import { ConsentSourcesResolver } from "./types.js";
+import { Payload, PayloadRequest } from "payload";
+
+//#region src/consent/resolveConsentStatements.d.ts
+/** What a consent field shows the visitor, resolved from its source at request time. */
+type ConsentStatement = {
+  /** Rich text state (or whatever the host's resolver returned), for the request's locale. */statement?: unknown; /** The policy link beside the statement, present only when the source carries both a `url` and a `label`. */
+  link?: {
+    label: string;
+    url: string;
+  };
+};
+/** Resolved statements keyed by consent field name, as `toFormDocument`'s `consentStatements` takes them. */
+type ConsentStatements = Record<string, ConsentStatement>;
+type ResolveConsentStatementsArgs = {
+  payload: Payload;
+  req: PayloadRequest; /** A loaded forms document; its consent fields' `source` ids drive resolution. The whole doc is forwarded to the resolver. */
+  form: {
+    id: number | string;
+    title?: string | null;
+    fields?: {
+      blockType: string;
+      name?: string;
+      [key: string]: unknown;
+    }[] | null;
+  }; /** Resolver override for plugin-internal callers; defaults to the one the plugin stashed on the config. */
+  sources?: ConsentSourcesResolver;
+};
+/**
+ * Resolve every consent field's statement for this request, ready to hand to
+ * `toFormDocument(doc, { consentStatements })`.
+ *
+ * The statement is a live reference, not a copy: a form stores only its source id, and the
+ * sentence the visitor reads is resolved here, in their locale, from whatever the source says
+ * right now. So correcting a policy sentence corrects every form referencing it, with nothing to
+ * re-save, and a form rendered without this step shows no statement at all rather than a stale one.
+ *
+ * Call it server-side (a Server Component, a route handler) before rendering `<Form>`. Throws
+ * whatever the host's resolver throws, so a page can decide between failing and rendering without
+ * consent; a submit resolves the source again regardless, and the proof is built from that.
+ */
+declare const resolveConsentStatements: (args: ResolveConsentStatementsArgs) => Promise<ConsentStatements>;
+//#endregion
+export { ConsentStatement, ConsentStatements, ResolveConsentStatementsArgs, resolveConsentStatements };
+//# sourceMappingURL=resolveConsentStatements.d.ts.map

package/dist/consent/resolveConsentStatements.js

@@ -0,0 +1,46 @@
+import { resolveConsentEntries } from "./resolveConsentEntries.js";
+import { consentDisplayOf, effectiveConsentStatement } from "./effectiveStatement.js";
+//#region src/consent/resolveConsentStatements.ts
+/**
+* Resolve every consent field's statement for this request, ready to hand to
+* `toFormDocument(doc, { consentStatements })`.
+*
+* The statement is a live reference, not a copy: a form stores only its source id, and the
+* sentence the visitor reads is resolved here, in their locale, from whatever the source says
+* right now. So correcting a policy sentence corrects every form referencing it, with nothing to
+* re-save, and a form rendered without this step shows no statement at all rather than a stale one.
+*
+* Call it server-side (a Server Component, a route handler) before rendering `<Form>`. Throws
+* whatever the host's resolver throws, so a page can decide between failing and rendering without
+* consent; a submit resolves the source again regardless, and the proof is built from that.
+*/
+const resolveConsentStatements = async (args) => {
+	const { payload, req, form, sources } = args;
+	const consentFields = (form.fields ?? []).filter((field) => field.blockType === "consent" && typeof field.name === "string" && field.name.length > 0);
+	if (consentFields.length === 0) return {};
+	const entries = await resolveConsentEntries({
+		payload,
+		req,
+		form,
+		sources
+	});
+	const statements = {};
+	for (const field of consentFields) {
+		const entry = entries.find((candidate) => candidate.id === field.source);
+		if (!entry) continue;
+		const label = typeof entry.name === "string" && entry.name.trim() !== "" ? entry.name : "";
+		const wording = effectiveConsentStatement(entry, consentDisplayOf(field));
+		statements[field.name] = {
+			...wording != null ? { statement: wording } : {},
+			...label && typeof entry.url === "string" && entry.url.length > 0 ? { link: {
+				label,
+				url: entry.url
+			} } : {}
+		};
+	}
+	return statements;
+};
+//#endregion
+export { resolveConsentStatements };
+
+//# sourceMappingURL=resolveConsentStatements.js.map

package/dist/consent/resolveConsentStatements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveConsentStatements.js","names":[],"sources":["../../src/consent/resolveConsentStatements.ts"],"sourcesContent":["import type { Payload, PayloadRequest } from 'payload'\nimport { consentDisplayOf, effectiveConsentStatement } from './effectiveStatement'\nimport { resolveConsentEntries } from './resolveConsentEntries'\nimport type { ConsentSourcesResolver } from './types'\n\n/** What a consent field shows the visitor, resolved from its source at request time. */\nexport type ConsentStatement = {\n\t/** Rich text state (or whatever the host's resolver returned), for the request's locale. */\n\tstatement?: unknown\n\t/** The policy link beside the statement, present only when the source carries both a `url` and a `label`. */\n\tlink?: { label: string; url: string }\n}\n\n/** Resolved statements keyed by consent field name, as `toFormDocument`'s `consentStatements` takes them. */\nexport type ConsentStatements = Record<string, ConsentStatement>\n\nexport type ResolveConsentStatementsArgs = {\n\tpayload: Payload\n\treq: PayloadRequest\n\t/** A loaded forms document; its consent fields' `source` ids drive resolution. The whole doc is forwarded to the resolver. */\n\tform: {\n\t\tid: number | string\n\t\ttitle?: string | null\n\t\tfields?: { blockType: string; name?: string; [key: string]: unknown }[] | null\n\t}\n\t/** Resolver override for plugin-internal callers; defaults to the one the plugin stashed on the config. */\n\tsources?: ConsentSourcesResolver\n}\n\n/**\n * Resolve every consent field's statement for this request, ready to hand to\n * `toFormDocument(doc, { consentStatements })`.\n *\n * The statement is a live reference, not a copy: a form stores only its source id, and the\n * sentence the visitor reads is resolved here, in their locale, from whatever the source says\n * right now. So correcting a policy sentence corrects every form referencing it, with nothing to\n * re-save, and a form rendered without this step shows no statement at all rather than a stale one.\n *\n * Call it server-side (a Server Component, a route handler) before rendering `<Form>`. Throws\n * whatever the host's resolver throws, so a page can decide between failing and rendering without\n * consent; a submit resolves the source again regardless, and the proof is built from that.\n */\nexport const resolveConsentStatements = async (\n\targs: ResolveConsentStatementsArgs\n): Promise<ConsentStatements> => {\n\tconst { payload, req, form, sources } = args\n\tconst consentFields = (form.fields ?? []).filter(\n\t\t(field): field is { blockType: string; name: string; source?: unknown; display?: unknown } =>\n\t\t\tfield.blockType === 'consent' && typeof field.name === 'string' && field.name.length > 0\n\t)\n\tif (consentFields.length === 0) {\n\t\treturn {}\n\t}\n\tconst entries = await resolveConsentEntries({ payload, req, form, sources })\n\tconst statements: ConsentStatements = {}\n\tfor (const field of consentFields) {\n\t\tconst entry = entries.find((candidate) => candidate.id === field.source)\n\t\tif (!entry) {\n\t\t\tcontinue\n\t\t}\n\t\t// The link needs a name of its own, so it takes the source's `name` and never falls back to\n\t\t// the `id`: the id is a machine identifier, and showing it as the words a visitor clicks is\n\t\t// worse than no link at all. A source with a url and no name simply has no link.\n\t\tconst label = typeof entry.name === 'string' && entry.name.trim() !== '' ? entry.name : ''\n\t\t// The wording is selected per the field's display through the same helper the proof path\n\t\t// uses, so what renders is what a submit snapshots. The client only ever sees `statement`.\n\t\tconst wording = effectiveConsentStatement(entry, consentDisplayOf(field))\n\t\tstatements[field.name] = {\n\t\t\t...(wording != null ? { statement: wording } : {}),\n\t\t\t...(label && typeof entry.url === 'string' && entry.url.length > 0\n\t\t\t\t? { link: { label, url: entry.url } }\n\t\t\t\t: {}),\n\t\t}\n\t}\n\treturn statements\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0CA,MAAa,2BAA2B,OACvC,SACgC;CAChC,MAAM,EAAE,SAAS,KAAK,MAAM,YAAY;CACxC,MAAM,iBAAiB,KAAK,UAAU,CAAC,GAAG,QACxC,UACA,MAAM,cAAc,aAAa,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,CACzF;CACA,IAAI,cAAc,WAAW,GAC5B,OAAO,CAAC;CAET,MAAM,UAAU,MAAM,sBAAsB;EAAE;EAAS;EAAK;EAAM;CAAQ,CAAC;CAC3E,MAAM,aAAgC,CAAC;CACvC,KAAK,MAAM,SAAS,eAAe;EAClC,MAAM,QAAQ,QAAQ,MAAM,cAAc,UAAU,OAAO,MAAM,MAAM;EACvE,IAAI,CAAC,OACJ;EAKD,MAAM,QAAQ,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,MAAM,KAAK,MAAM,OAAO;EAGxF,MAAM,UAAU,0BAA0B,OAAO,iBAAiB,KAAK,CAAC;EACxE,WAAW,MAAM,QAAQ;GACxB,GAAI,WAAW,OAAO,EAAE,WAAW,QAAQ,IAAI,CAAC;GAChD,GAAI,SAAS,OAAO,MAAM,QAAQ,YAAY,MAAM,IAAI,SAAS,IAC9D,EAAE,MAAM;IAAE;IAAO,KAAK,MAAM;GAAI,EAAE,IAClC,CAAC;EACL;CACD;CACA,OAAO;AACR"}

package/dist/consent/resolvePublishedVersionRef.d.ts

@@ -1,17 +1,23 @@
-import { Payload } from "payload";
+import { Payload, PayloadRequest } from "payload";
 
 //#region src/consent/resolvePublishedVersionRef.d.ts
+type ResolvePublishedVersionRefArgs = {
+  payload: Payload;
+  collection: string;
+  id: number | string; /** Threaded into `findVersions` so a version written earlier in the same transaction is visible. */
+  req?: PayloadRequest;
+};
 /**
- * Returns the latest published version of a doc, or null when versions/drafts are off or nothing
- * is published. Never throws.
+ * The id of a document's latest published version, or null when nothing is published.
+ *
+ * Drafts-only, and deliberately not a versions check: `_status` exists only where
+ * `versions.drafts` is on (Payload adds the base version fields inside that branch when
+ * sanitizing), so on a collection with plain versions and no drafts this query matches nothing and
+ * returns null, which is indistinguishable from having no versions at all. Callers must decide the
+ * difference themselves with `hasDraftsEnabled` rather than reading null as "no versions" (see
+ * `captureConsent`). Never throws.
  */
-declare const resolvePublishedVersionRef: (payload: Payload, args: {
-  collection: string;
-  id: string | number;
-}) => Promise<{
-  versionId: string;
-  updatedAt: string;
-} | null>;
+declare const resolvePublishedVersionRef: (args: ResolvePublishedVersionRefArgs) => Promise<string | null>;
 //#endregion
-export { resolvePublishedVersionRef };
+export { ResolvePublishedVersionRefArgs, resolvePublishedVersionRef };
 //# sourceMappingURL=resolvePublishedVersionRef.d.ts.map

package/dist/consent/resolvePublishedVersionRef.js

@@ -1,22 +1,25 @@
 //#region src/consent/resolvePublishedVersionRef.ts
 /**
-* Returns the latest published version of a doc, or null when versions/drafts are off or nothing
-* is published. Never throws.
+* The id of a document's latest published version, or null when nothing is published.
+*
+* Drafts-only, and deliberately not a versions check: `_status` exists only where
+* `versions.drafts` is on (Payload adds the base version fields inside that branch when
+* sanitizing), so on a collection with plain versions and no drafts this query matches nothing and
+* returns null, which is indistinguishable from having no versions at all. Callers must decide the
+* difference themselves with `hasDraftsEnabled` rather than reading null as "no versions" (see
+* `captureConsent`). Never throws.
 */
-const resolvePublishedVersionRef = async (payload, args) => {
+const resolvePublishedVersionRef = async (args) => {
 	try {
-		const doc = (await payload.findVersions({
+		const doc = (await args.payload.findVersions({
 			collection: args.collection,
 			where: { and: [{ parent: { equals: args.id } }, { "version._status": { equals: "published" } }] },
 			sort: "-updatedAt",
 			limit: 1,
-			depth: 0
+			depth: 0,
+			req: args.req
 		}))?.docs?.[0];
-		if (!doc) return null;
-		return {
-			versionId: String(doc.id),
-			updatedAt: String(doc.updatedAt)
-		};
+		return doc ? String(doc.id) : null;
 	} catch {
 		return null;
 	}

package/dist/consent/resolvePublishedVersionRef.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolvePublishedVersionRef.js","names":[],"sources":["../../src/consent/resolvePublishedVersionRef.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\n/**\n * Returns the latest published version of a doc, or null when versions/drafts are off or nothing\n * is published. Never throws.\n */\nexport const resolvePublishedVersionRef = async (\n\tpayload: Payload,\n\targs: { collection: string; id: string | number }\n): Promise<{ versionId: string; updatedAt: string } | null> => {\n\ttry {\n\t\tconst result = await payload.findVersions({\n\t\t\tcollection: args.collection as never,\n\t\t\twhere: {\n\t\t\t\tand: [{ parent: { equals: args.id } }, { 'version._status': { equals: 'published' } }],\n\t\t\t},\n\t\t\tsort: '-updatedAt',\n\t\t\tlimit: 1,\n\t\t\tdepth: 0,\n\t\t})\n\t\tconst doc = result?.docs?.[0]\n\t\tif (!doc) {\n\t\t\treturn null\n\t\t}\n\t\treturn { versionId: String(doc.id), updatedAt: String(doc.updatedAt) }\n\t} catch {\n\t\treturn null\n\t}\n}\n"],"mappings":";;;;;AAMA,MAAa,6BAA6B,OACzC,SACA,SAC8D;CAC9D,IAAI;EAUH,MAAM,OAAM,MATS,QAAQ,aAAa;GACzC,YAAY,KAAK;GACjB,OAAO,EACN,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,KAAK,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,YAAY,EAAE,CAAC,EACtF;GACA,MAAM;GACN,OAAO;GACP,OAAO;EACR,CAAC,IACmB,OAAO;EAC3B,IAAI,CAAC,KACJ,OAAO;EAER,OAAO;GAAE,WAAW,OAAO,IAAI,EAAE;GAAG,WAAW,OAAO,IAAI,SAAS;EAAE;CACtE,QAAQ;EACP,OAAO;CACR;AACD"}
+{"version":3,"file":"resolvePublishedVersionRef.js","names":[],"sources":["../../src/consent/resolvePublishedVersionRef.ts"],"sourcesContent":["import type { Payload, PayloadRequest } from 'payload'\n\nexport type ResolvePublishedVersionRefArgs = {\n\tpayload: Payload\n\tcollection: string\n\tid: number | string\n\t/** Threaded into `findVersions` so a version written earlier in the same transaction is visible. */\n\treq?: PayloadRequest\n}\n\n/**\n * The id of a document's latest published version, or null when nothing is published.\n *\n * Drafts-only, and deliberately not a versions check: `_status` exists only where\n * `versions.drafts` is on (Payload adds the base version fields inside that branch when\n * sanitizing), so on a collection with plain versions and no drafts this query matches nothing and\n * returns null, which is indistinguishable from having no versions at all. Callers must decide the\n * difference themselves with `hasDraftsEnabled` rather than reading null as \"no versions\" (see\n * `captureConsent`). Never throws.\n */\nexport const resolvePublishedVersionRef = async (\n\targs: ResolvePublishedVersionRefArgs\n): Promise<string | null> => {\n\ttry {\n\t\tconst result = await args.payload.findVersions({\n\t\t\tcollection: args.collection as never,\n\t\t\twhere: {\n\t\t\t\tand: [{ parent: { equals: args.id } }, { 'version._status': { equals: 'published' } }],\n\t\t\t},\n\t\t\tsort: '-updatedAt',\n\t\t\tlimit: 1,\n\t\t\tdepth: 0,\n\t\t\treq: args.req,\n\t\t})\n\t\tconst doc = result?.docs?.[0]\n\t\treturn doc ? String(doc.id) : null\n\t} catch {\n\t\treturn null\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAoBA,MAAa,6BAA6B,OACzC,SAC4B;CAC5B,IAAI;EAWH,MAAM,OAAM,MAVS,KAAK,QAAQ,aAAa;GAC9C,YAAY,KAAK;GACjB,OAAO,EACN,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,KAAK,GAAG,EAAE,GAAG,EAAE,mBAAmB,EAAE,QAAQ,YAAY,EAAE,CAAC,EACtF;GACA,MAAM;GACN,OAAO;GACP,OAAO;GACP,KAAK,KAAK;EACX,CAAC,IACmB,OAAO;EAC3B,OAAO,MAAM,OAAO,IAAI,EAAE,IAAI;CAC/B,QAAQ;EACP,OAAO;CACR;AACD"}

package/dist/consent/types.d.ts

@@ -0,0 +1,69 @@
+import { PayloadRequest } from "payload";
+
+//#region src/consent/types.d.ts
+/** A document reference, kept id-based so renaming or re-slugging the page never breaks it. */
+type ConsentSourcePage = {
+  relationTo: string;
+  id: number | string;
+};
+/**
+ * One consent source a form author can reference by `id`: the statement the visitor agrees to, and
+ * optionally the policy document that statement belongs to. Produced by the host's
+ * {@link ConsentSourcesResolver}, normally by mapping the rows of a placed `consentSourcesField()`.
+ *
+ * `id` is the array row's own auto-assigned identifier, so it survives name edits and reordering
+ * and is the stable reference stored on the consent field and in every proof. `statement` is rich
+ * text state (the visitor-facing sentence), already resolved for the request's locale by virtue of
+ * the resolver reading its own localized field under `req.locale`. `page` drives proof: an id and
+ * its collection, never a URL, so the document can be renamed, re-slugged, or re-routed without
+ * stranding past proofs. `url` is the visitor-facing link the renderer shows beside the statement;
+ * only the host knows how a document id maps to a public route, so the plugin never derives one.
+ */
+type ConsentSourceEntry = {
+  id: string;
+  name?: string;
+  statement?: unknown;
+  /**
+   * The wording a `display: 'notice'` consent field shows instead of `statement` ("By
+   * subscribing, you agree..." rather than "I accept..."). Same consent, same policy, same id in
+   * every proof; only the sentence differs. Absent or empty falls back to `statement`. A resolver
+   * mapping `consentSourcesField()` rows must forward the row's `noticeStatement` for notice
+   * displays to pick it up.
+   */
+  noticeStatement?: unknown;
+  page?: ConsentSourcePage;
+  url?: string;
+};
+/**
+ * Host seam resolving the consent sources a form's authors can reference (plugin option
+ * `consent.sources`). Without it there are no sources, so the `consent` field type is not
+ * registered at all.
+ *
+ * The intended shape: place `consentSourcesField()` on a collection or global you own, then read it
+ * back here. Multi-tenant hosts scope the read by the tenant derived from `req` (host header,
+ * cookie, or auth context) and return only that tenant's sources, so one tenant's statements are
+ * never selectable, resolvable, or provable under another's. Read under `req.locale` so the
+ * statement the visitor agrees to is the one they were shown.
+ *
+ * Do not thread the save's `req` into a `find({ locale: 'all' })` from within a form's save
+ * validation: it flips `req.locale` to `all` and corrupts the localized write of the document being
+ * saved. Read the settings document without the save's `req` (already-committed data, no transaction).
+ */
+type ConsentSourcesResolver = (args: {
+  req: PayloadRequest;
+  /**
+   * The form document being read: `id`, `title`, and (at runtime) every other field. Derive
+   * multi-tenant scoping from a field on it, casting for non-standard fields (e.g.
+   * `(form as { tenant?: string }).tenant`), rather than reading the form back: reading the same
+   * `forms` collection from within this resolver re-enters the form's afterRead hook. The type is
+   * kept index-signature-free so a generated `Form` interface assigns without a cast. Treat `form`
+   * as read-only.
+   */
+  form: {
+    id: number | string;
+    title?: string | null;
+  };
+}) => ConsentSourceEntry[] | Promise<ConsentSourceEntry[]>;
+//#endregion
+export { ConsentSourceEntry, ConsentSourcePage, ConsentSourcesResolver };
+//# sourceMappingURL=types.d.ts.map

package/dist/context/formContext.d.ts

@@ -0,0 +1,30 @@
+import { Payload } from "payload";
+
+//#region src/context/formContext.d.ts
+/** A verified reference to the document a form was rendered for. Never a secret: the id is already public. */
+type FormContextReference = {
+  relationTo: string;
+  value: string | number;
+};
+/**
+ * Sign a `{ relationTo, value }` reference into a compact `v1.<base64url(payload)>.<hmac>` token: a
+ * rendering surface mints one per document it renders a form for, the client carries it, and the plugin
+ * verifies it on submit. Signed (HMAC-SHA256 over the payload with `secret ?? payload.secret`), not
+ * encrypted: the reference is not a secret, the signature only stops rewriting. `expiresIn` (seconds,
+ * default one day) bounds replay.
+ */
+declare const signFormContext: (args: {
+  payload: Payload;
+  relationTo: string;
+  value: string | number;
+  expiresIn?: number;
+  secret?: string;
+}) => string;
+/**
+ * Verify a token minted by `signFormContext` and return its reference, or null on any failure (wrong
+ * version, malformed, bad signature, or expired). Never throws, and the signature check is constant-time.
+ */
+declare const verifyFormContext: (token: string, secret: string, nowMs?: number) => FormContextReference | null;
+//#endregion
+export { FormContextReference, signFormContext, verifyFormContext };
+//# sourceMappingURL=formContext.d.ts.map

package/dist/context/formContext.js

@@ -0,0 +1,54 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region src/context/formContext.ts
+const VERSION = "v1";
+const DEFAULT_EXPIRES_IN_SECONDS = 86400;
+const hmacHex = (body, secret) => createHmac("sha256", secret).update(body).digest("hex");
+/**
+* Sign a `{ relationTo, value }` reference into a compact `v1.<base64url(payload)>.<hmac>` token: a
+* rendering surface mints one per document it renders a form for, the client carries it, and the plugin
+* verifies it on submit. Signed (HMAC-SHA256 over the payload with `secret ?? payload.secret`), not
+* encrypted: the reference is not a secret, the signature only stops rewriting. `expiresIn` (seconds,
+* default one day) bounds replay.
+*/
+const signFormContext = (args) => {
+	const { payload, relationTo, value, expiresIn, secret } = args;
+	const exp = Math.floor(Date.now() / 1e3) + (expiresIn ?? DEFAULT_EXPIRES_IN_SECONDS);
+	const body = Buffer.from(JSON.stringify({
+		relationTo,
+		value,
+		exp
+	})).toString("base64url");
+	return `${VERSION}.${body}.${hmacHex(body, secret ?? payload.secret)}`;
+};
+/**
+* Verify a token minted by `signFormContext` and return its reference, or null on any failure (wrong
+* version, malformed, bad signature, or expired). Never throws, and the signature check is constant-time.
+*/
+const verifyFormContext = (token, secret, nowMs = Date.now()) => {
+	const parts = token.split(".");
+	if (parts.length !== 3 || parts[0] !== VERSION) return null;
+	const [, body, signature] = parts;
+	const expected = hmacHex(body ?? "", secret);
+	const given = Buffer.from(signature ?? "");
+	const want = Buffer.from(expected);
+	if (given.byteLength !== want.byteLength || !timingSafeEqual(given, want)) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(Buffer.from(body ?? "", "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+	if (!parsed || typeof parsed !== "object") return null;
+	const { relationTo, value, exp } = parsed;
+	if (typeof relationTo !== "string" || relationTo.length === 0) return null;
+	if (typeof value !== "string" && typeof value !== "number") return null;
+	if (typeof exp !== "number" || exp * 1e3 <= nowMs) return null;
+	return {
+		relationTo,
+		value
+	};
+};
+//#endregion
+export { signFormContext, verifyFormContext };
+
+//# sourceMappingURL=formContext.js.map

package/dist/context/formContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formContext.js","names":[],"sources":["../../src/context/formContext.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from 'node:crypto'\nimport type { Payload } from 'payload'\n\n/** A verified reference to the document a form was rendered for. Never a secret: the id is already public. */\nexport type FormContextReference = { relationTo: string; value: string | number }\n\nconst VERSION = 'v1'\nconst DEFAULT_EXPIRES_IN_SECONDS = 86_400\n\nconst hmacHex = (body: string, secret: string): string =>\n\tcreateHmac('sha256', secret).update(body).digest('hex')\n\n/**\n * Sign a `{ relationTo, value }` reference into a compact `v1.<base64url(payload)>.<hmac>` token: a\n * rendering surface mints one per document it renders a form for, the client carries it, and the plugin\n * verifies it on submit. Signed (HMAC-SHA256 over the payload with `secret ?? payload.secret`), not\n * encrypted: the reference is not a secret, the signature only stops rewriting. `expiresIn` (seconds,\n * default one day) bounds replay.\n */\nexport const signFormContext = (args: {\n\tpayload: Payload\n\trelationTo: string\n\tvalue: string | number\n\texpiresIn?: number\n\tsecret?: string\n}): string => {\n\tconst { payload, relationTo, value, expiresIn, secret } = args\n\tconst exp = Math.floor(Date.now() / 1000) + (expiresIn ?? DEFAULT_EXPIRES_IN_SECONDS)\n\tconst body = Buffer.from(JSON.stringify({ relationTo, value, exp })).toString('base64url')\n\treturn `${VERSION}.${body}.${hmacHex(body, secret ?? payload.secret)}`\n}\n\n/**\n * Verify a token minted by `signFormContext` and return its reference, or null on any failure (wrong\n * version, malformed, bad signature, or expired). Never throws, and the signature check is constant-time.\n */\nexport const verifyFormContext = (\n\ttoken: string,\n\tsecret: string,\n\tnowMs: number = Date.now()\n): FormContextReference | null => {\n\tconst parts = token.split('.')\n\tif (parts.length !== 3 || parts[0] !== VERSION) {\n\t\treturn null\n\t}\n\tconst [, body, signature] = parts\n\tconst expected = hmacHex(body ?? '', secret)\n\tconst given = Buffer.from(signature ?? '')\n\tconst want = Buffer.from(expected)\n\tif (given.byteLength !== want.byteLength || !timingSafeEqual(given, want)) {\n\t\treturn null\n\t}\n\tlet parsed: unknown\n\ttry {\n\t\tparsed = JSON.parse(Buffer.from(body ?? '', 'base64url').toString('utf8'))\n\t} catch {\n\t\treturn null\n\t}\n\tif (!parsed || typeof parsed !== 'object') {\n\t\treturn null\n\t}\n\tconst { relationTo, value, exp } = parsed as Record<string, unknown>\n\tif (typeof relationTo !== 'string' || relationTo.length === 0) {\n\t\treturn null\n\t}\n\tif (typeof value !== 'string' && typeof value !== 'number') {\n\t\treturn null\n\t}\n\tif (typeof exp !== 'number' || exp * 1000 <= nowMs) {\n\t\treturn null\n\t}\n\treturn { relationTo, value }\n}\n"],"mappings":";;AAMA,MAAM,UAAU;AAChB,MAAM,6BAA6B;AAEnC,MAAM,WAAW,MAAc,WAC9B,WAAW,UAAU,MAAM,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;;;;;;;;AASvD,MAAa,mBAAmB,SAMlB;CACb,MAAM,EAAE,SAAS,YAAY,OAAO,WAAW,WAAW;CAC1D,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,aAAa;CAC1D,MAAM,OAAO,OAAO,KAAK,KAAK,UAAU;EAAE;EAAY;EAAO;CAAI,CAAC,CAAC,EAAE,SAAS,WAAW;CACzF,OAAO,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,MAAM,UAAU,QAAQ,MAAM;AACpE;;;;;AAMA,MAAa,qBACZ,OACA,QACA,QAAgB,KAAK,IAAI,MACQ;CACjC,MAAM,QAAQ,MAAM,MAAM,GAAG;CAC7B,IAAI,MAAM,WAAW,KAAK,MAAM,OAAO,SACtC,OAAO;CAER,MAAM,GAAG,MAAM,aAAa;CAC5B,MAAM,WAAW,QAAQ,QAAQ,IAAI,MAAM;CAC3C,MAAM,QAAQ,OAAO,KAAK,aAAa,EAAE;CACzC,MAAM,OAAO,OAAO,KAAK,QAAQ;CACjC,IAAI,MAAM,eAAe,KAAK,cAAc,CAAC,gBAAgB,OAAO,IAAI,GACvE,OAAO;CAER,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,OAAO,KAAK,QAAQ,IAAI,WAAW,EAAE,SAAS,MAAM,CAAC;CAC1E,QAAQ;EACP,OAAO;CACR;CACA,IAAI,CAAC,UAAU,OAAO,WAAW,UAChC,OAAO;CAER,MAAM,EAAE,YAAY,OAAO,QAAQ;CACnC,IAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAC3D,OAAO;CAER,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UACjD,OAAO;CAER,IAAI,OAAO,QAAQ,YAAY,MAAM,OAAQ,OAC5C,OAAO;CAER,OAAO;EAAE;EAAY;CAAM;AAC5B"}

package/dist/email/departments.d.ts

@@ -0,0 +1,59 @@
+import { Payload, PayloadRequest } from "payload";
+
+//#region src/email/departments.d.ts
+/** One selectable department for the `emailTeam` recipients; `value` is the email address routed to. */
+type DepartmentOption = {
+  label: string;
+  value: string;
+};
+/**
+ * Host seam resolving the selectable departments for `emailTeam`'s recipient fields (plugin option
+ * `email.departments`). Req-scoped, so multi-tenant hosts derive tenant scoping from `req` (host
+ * header, cookie, or auth context) and return only that tenant's departments. `value` is the literal
+ * string `payload.sendEmail` accepts (an email address); `label` is how the department is named in the
+ * admin select. Mirrors {@link FromAddressesResolver}. {@link resolveDepartmentOptions} builds this
+ * from a `departmentsField()`-bearing document with the reusable locale fallback, so a host does not
+ * reimplement it.
+ *
+ * Do not thread the save's `req` into a `find({ locale: 'all' })` from within a form's save
+ * validation: it flips `req.locale` to `all` and corrupts the localized write of the document being
+ * saved. Read the settings document without the save's `req` (already-committed data, no transaction).
+ */
+type DepartmentEmailsResolver = (args: {
+  req: PayloadRequest;
+}) => Promise<DepartmentOption[]> | DepartmentOption[];
+type ResolveDepartmentsRequestArgs = {
+  /** Whether the caller is authenticated (an admin/user). */isAuthed: boolean;
+  req: PayloadRequest;
+  resolver: DepartmentEmailsResolver;
+};
+type ResolveDepartmentsRequestResult = {
+  status: number;
+  body: {
+    options: DepartmentOption[];
+  } | {
+    errors: {
+      message: string;
+    }[];
+  };
+};
+type ResolveDepartmentOptionsArgs = {
+  payload: Payload;
+  req: PayloadRequest; /** A document fetched at `locale: 'all'`, so each localized subfield is a `{ locale: value }` map. */
+  doc: Record<string, unknown>; /** The array field name the departments live under; defaults to `departmentEmails`. */
+  field?: string;
+};
+/**
+ * Build the `emailTeam` recipient options from a `departmentsField()`-bearing document (a settings
+ * global, a tenants row, wherever the host placed it), fetched at `locale: 'all'`. Each row's `label`
+ * and `email` are resolved for `req.locale` via the current -> default -> next-available chain (see
+ * {@link pickLocaleValue}), reading `defaultLocale`/`localeCodes` from `payload.config.localization`
+ * (a bare string is used as-is when localization is disabled). Rows with no resolvable email are
+ * dropped; a row's label is resolved independently of its email and falls back to the email when
+ * absent. This is the reusable seam a host's `email.departments` resolver returns, so tenant scoping
+ * (which document is read) stays the host's call while the locale fallback stays consistent.
+ */
+declare const resolveDepartmentOptions: (args: ResolveDepartmentOptionsArgs) => DepartmentOption[];
+//#endregion
+export { DepartmentEmailsResolver, DepartmentOption, ResolveDepartmentOptionsArgs, ResolveDepartmentsRequestArgs, ResolveDepartmentsRequestResult, resolveDepartmentOptions };
+//# sourceMappingURL=departments.d.ts.map

package/dist/email/departments.js

@@ -0,0 +1,87 @@
+//#region src/email/departments.ts
+/**
+* Authorize and resolve the `GET /:id/departments` request backing the recipient selects: authenticated
+* callers get the host resolver's current options for this request; anonymous callers are always
+* refused. The route id is unused (the option set is request-scoped, not per-form). Statuses mirror
+* `resolveFromAddressesRequest`: 403 unauthenticated, 503 when the resolver throws (fail closed).
+*/
+const resolveDepartmentsRequest = async (args) => {
+	const { isAuthed, req, resolver } = args;
+	if (!isAuthed) return {
+		status: 403,
+		body: { errors: [{ message: "Forbidden" }] }
+	};
+	try {
+		return {
+			status: 200,
+			body: { options: await resolver({ req }) }
+		};
+	} catch {
+		return {
+			status: 503,
+			body: { errors: [{ message: "Departments unavailable" }] }
+		};
+	}
+};
+/**
+* Resolve one localized subfield value for `reqLocale` with the current -> default -> next-available
+* chain. A non-localized subfield (fetched at `locale: 'all'` on a host without localization) is a
+* bare string, used as-is; a localized one is a `{ [locale]: value }` map, from which `reqLocale`,
+* then `defaultLocale`, then the first non-empty configured locale wins. Empty strings are skipped
+* (they fall through the chain), and undefined is returned when nothing resolves.
+*/
+const pickLocaleValue = (value, reqLocale, defaultLocale, localeCodes) => {
+	if (typeof value === "string") return value.length > 0 ? value : void 0;
+	if (value == null || typeof value !== "object") return;
+	const map = value;
+	const nonEmpty = (entry) => typeof entry === "string" && entry.length > 0 ? entry : void 0;
+	const ordered = [
+		reqLocale,
+		defaultLocale,
+		...localeCodes
+	].filter((code) => typeof code === "string" && code.length > 0);
+	for (const code of ordered) {
+		const hit = nonEmpty(map[code]);
+		if (hit !== void 0) return hit;
+	}
+	for (const key of Object.keys(map)) {
+		const hit = nonEmpty(map[key]);
+		if (hit !== void 0) return hit;
+	}
+};
+/**
+* Build the `emailTeam` recipient options from a `departmentsField()`-bearing document (a settings
+* global, a tenants row, wherever the host placed it), fetched at `locale: 'all'`. Each row's `label`
+* and `email` are resolved for `req.locale` via the current -> default -> next-available chain (see
+* {@link pickLocaleValue}), reading `defaultLocale`/`localeCodes` from `payload.config.localization`
+* (a bare string is used as-is when localization is disabled). Rows with no resolvable email are
+* dropped; a row's label is resolved independently of its email and falls back to the email when
+* absent. This is the reusable seam a host's `email.departments` resolver returns, so tenant scoping
+* (which document is read) stays the host's call while the locale fallback stays consistent.
+*/
+const resolveDepartmentOptions = (args) => {
+	const { payload, req, doc, field } = args;
+	const rows = doc[field ?? "departmentEmails"];
+	if (!Array.isArray(rows)) return [];
+	const localization = payload.config.localization;
+	const localeCodes = localization ? localization.localeCodes : [];
+	const defaultLocale = localization ? localization.defaultLocale : void 0;
+	const reqLocale = typeof req.locale === "string" ? req.locale : void 0;
+	const options = [];
+	for (const row of rows) {
+		if (row == null || typeof row !== "object") continue;
+		const entry = row;
+		const email = pickLocaleValue(entry.email, reqLocale, defaultLocale, localeCodes);
+		if (email === void 0) continue;
+		const label = pickLocaleValue(entry.label, reqLocale, defaultLocale, localeCodes) ?? email;
+		options.push({
+			label,
+			value: email
+		});
+	}
+	return options;
+};
+//#endregion
+export { resolveDepartmentOptions, resolveDepartmentsRequest };
+
+//# sourceMappingURL=departments.js.map

package/dist/email/departments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"departments.js","names":[],"sources":["../../src/email/departments.ts"],"sourcesContent":["import type { Payload, PayloadRequest } from 'payload'\n\n/** One selectable department for the `emailTeam` recipients; `value` is the email address routed to. */\nexport type DepartmentOption = { label: string; value: string }\n\n/**\n * Host seam resolving the selectable departments for `emailTeam`'s recipient fields (plugin option\n * `email.departments`). Req-scoped, so multi-tenant hosts derive tenant scoping from `req` (host\n * header, cookie, or auth context) and return only that tenant's departments. `value` is the literal\n * string `payload.sendEmail` accepts (an email address); `label` is how the department is named in the\n * admin select. Mirrors {@link FromAddressesResolver}. {@link resolveDepartmentOptions} builds this\n * from a `departmentsField()`-bearing document with the reusable locale fallback, so a host does not\n * reimplement it.\n *\n * Do not thread the save's `req` into a `find({ locale: 'all' })` from within a form's save\n * validation: it flips `req.locale` to `all` and corrupts the localized write of the document being\n * saved. Read the settings document without the save's `req` (already-committed data, no transaction).\n */\nexport type DepartmentEmailsResolver = (args: {\n\treq: PayloadRequest\n}) => Promise<DepartmentOption[]> | DepartmentOption[]\n\nexport type ResolveDepartmentsRequestArgs = {\n\t/** Whether the caller is authenticated (an admin/user). */\n\tisAuthed: boolean\n\treq: PayloadRequest\n\tresolver: DepartmentEmailsResolver\n}\n\nexport type ResolveDepartmentsRequestResult = {\n\tstatus: number\n\tbody: { options: DepartmentOption[] } | { errors: { message: string }[] }\n}\n\n/**\n * Authorize and resolve the `GET /:id/departments` request backing the recipient selects: authenticated\n * callers get the host resolver's current options for this request; anonymous callers are always\n * refused. The route id is unused (the option set is request-scoped, not per-form). Statuses mirror\n * `resolveFromAddressesRequest`: 403 unauthenticated, 503 when the resolver throws (fail closed).\n */\nexport const resolveDepartmentsRequest = async (\n\targs: ResolveDepartmentsRequestArgs\n): Promise<ResolveDepartmentsRequestResult> => {\n\tconst { isAuthed, req, resolver } = args\n\tif (!isAuthed) {\n\t\treturn { status: 403, body: { errors: [{ message: 'Forbidden' }] } }\n\t}\n\ttry {\n\t\tconst options = await resolver({ req })\n\t\treturn { status: 200, body: { options } }\n\t} catch {\n\t\treturn { status: 503, body: { errors: [{ message: 'Departments unavailable' }] } }\n\t}\n}\n\n/**\n * Resolve one localized subfield value for `reqLocale` with the current -> default -> next-available\n * chain. A non-localized subfield (fetched at `locale: 'all'` on a host without localization) is a\n * bare string, used as-is; a localized one is a `{ [locale]: value }` map, from which `reqLocale`,\n * then `defaultLocale`, then the first non-empty configured locale wins. Empty strings are skipped\n * (they fall through the chain), and undefined is returned when nothing resolves.\n */\n// biome-ignore lint/complexity/useMaxParams: the locale-fallback inputs are the minimal surface (value, reqLocale, defaultLocale, localeCodes)\nexport const pickLocaleValue = (\n\tvalue: unknown,\n\treqLocale: string | undefined,\n\tdefaultLocale: string | undefined,\n\tlocaleCodes: string[]\n): string | undefined => {\n\tif (typeof value === 'string') {\n\t\treturn value.length > 0 ? value : undefined\n\t}\n\tif (value == null || typeof value !== 'object') {\n\t\treturn undefined\n\t}\n\tconst map = value as Record<string, unknown>\n\tconst nonEmpty = (entry: unknown): string | undefined =>\n\t\ttypeof entry === 'string' && entry.length > 0 ? entry : undefined\n\tconst ordered = [reqLocale, defaultLocale, ...localeCodes].filter(\n\t\t(code): code is string => typeof code === 'string' && code.length > 0\n\t)\n\tfor (const code of ordered) {\n\t\tconst hit = nonEmpty(map[code])\n\t\tif (hit !== undefined) {\n\t\t\treturn hit\n\t\t}\n\t}\n\t// Defensive: a `locale: 'all'` fetch keys by configured locales, but a key outside them still\n\t// counts toward \"next available\" so a value is never silently dropped.\n\tfor (const key of Object.keys(map)) {\n\t\tconst hit = nonEmpty(map[key])\n\t\tif (hit !== undefined) {\n\t\t\treturn hit\n\t\t}\n\t}\n\treturn undefined\n}\n\nexport type ResolveDepartmentOptionsArgs = {\n\tpayload: Payload\n\treq: PayloadRequest\n\t/** A document fetched at `locale: 'all'`, so each localized subfield is a `{ locale: value }` map. */\n\tdoc: Record<string, unknown>\n\t/** The array field name the departments live under; defaults to `departmentEmails`. */\n\tfield?: string\n}\n\n/**\n * Build the `emailTeam` recipient options from a `departmentsField()`-bearing document (a settings\n * global, a tenants row, wherever the host placed it), fetched at `locale: 'all'`. Each row's `label`\n * and `email` are resolved for `req.locale` via the current -> default -> next-available chain (see\n * {@link pickLocaleValue}), reading `defaultLocale`/`localeCodes` from `payload.config.localization`\n * (a bare string is used as-is when localization is disabled). Rows with no resolvable email are\n * dropped; a row's label is resolved independently of its email and falls back to the email when\n * absent. This is the reusable seam a host's `email.departments` resolver returns, so tenant scoping\n * (which document is read) stays the host's call while the locale fallback stays consistent.\n */\nexport const resolveDepartmentOptions = (\n\targs: ResolveDepartmentOptionsArgs\n): DepartmentOption[] => {\n\tconst { payload, req, doc, field } = args\n\tconst rows = doc[field ?? 'departmentEmails']\n\tif (!Array.isArray(rows)) {\n\t\treturn []\n\t}\n\tconst localization = payload.config.localization\n\tconst localeCodes = localization ? localization.localeCodes : []\n\tconst defaultLocale = localization ? localization.defaultLocale : undefined\n\tconst reqLocale = typeof req.locale === 'string' ? req.locale : undefined\n\tconst options: DepartmentOption[] = []\n\tfor (const row of rows) {\n\t\tif (row == null || typeof row !== 'object') {\n\t\t\tcontinue\n\t\t}\n\t\tconst entry = row as Record<string, unknown>\n\t\tconst email = pickLocaleValue(entry.email, reqLocale, defaultLocale, localeCodes)\n\t\tif (email === undefined) {\n\t\t\tcontinue\n\t\t}\n\t\tconst label = pickLocaleValue(entry.label, reqLocale, defaultLocale, localeCodes) ?? email\n\t\toptions.push({ label, value: email })\n\t}\n\treturn options\n}\n"],"mappings":";;;;;;;AAwCA,MAAa,4BAA4B,OACxC,SAC8C;CAC9C,MAAM,EAAE,UAAU,KAAK,aAAa;CACpC,IAAI,CAAC,UACJ,OAAO;EAAE,QAAQ;EAAK,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,YAAY,CAAC,EAAE;CAAE;CAEpE,IAAI;EAEH,OAAO;GAAE,QAAQ;GAAK,MAAM,EAAE,SAAA,MADR,SAAS,EAAE,IAAI,CAAC,EACA;EAAE;CACzC,QAAQ;EACP,OAAO;GAAE,QAAQ;GAAK,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS,0BAA0B,CAAC,EAAE;EAAE;CAClF;AACD;;;;;;;;AAUA,MAAa,mBACZ,OACA,WACA,eACA,gBACwB;CACxB,IAAI,OAAO,UAAU,UACpB,OAAO,MAAM,SAAS,IAAI,QAAQ,KAAA;CAEnC,IAAI,SAAS,QAAQ,OAAO,UAAU,UACrC;CAED,MAAM,MAAM;CACZ,MAAM,YAAY,UACjB,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ,KAAA;CACzD,MAAM,UAAU;EAAC;EAAW;EAAe,GAAG;CAAW,EAAE,QACzD,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CACrE;CACA,KAAK,MAAM,QAAQ,SAAS;EAC3B,MAAM,MAAM,SAAS,IAAI,KAAK;EAC9B,IAAI,QAAQ,KAAA,GACX,OAAO;CAET;CAGA,KAAK,MAAM,OAAO,OAAO,KAAK,GAAG,GAAG;EACnC,MAAM,MAAM,SAAS,IAAI,IAAI;EAC7B,IAAI,QAAQ,KAAA,GACX,OAAO;CAET;AAED;;;;;;;;;;;AAqBA,MAAa,4BACZ,SACwB;CACxB,MAAM,EAAE,SAAS,KAAK,KAAK,UAAU;CACrC,MAAM,OAAO,IAAI,SAAS;CAC1B,IAAI,CAAC,MAAM,QAAQ,IAAI,GACtB,OAAO,CAAC;CAET,MAAM,eAAe,QAAQ,OAAO;CACpC,MAAM,cAAc,eAAe,aAAa,cAAc,CAAC;CAC/D,MAAM,gBAAgB,eAAe,aAAa,gBAAgB,KAAA;CAClE,MAAM,YAAY,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS,KAAA;CAChE,MAAM,UAA8B,CAAC;CACrC,KAAK,MAAM,OAAO,MAAM;EACvB,IAAI,OAAO,QAAQ,OAAO,QAAQ,UACjC;EAED,MAAM,QAAQ;EACd,MAAM,QAAQ,gBAAgB,MAAM,OAAO,WAAW,eAAe,WAAW;EAChF,IAAI,UAAU,KAAA,GACb;EAED,MAAM,QAAQ,gBAAgB,MAAM,OAAO,WAAW,eAAe,WAAW,KAAK;EACrF,QAAQ,KAAK;GAAE;GAAO,OAAO;EAAM,CAAC;CACrC;CACA,OAAO;AACR"}

package/dist/email/departmentsField.d.ts

@@ -0,0 +1,53 @@
+import { ArrayField } from "payload";
+
+//#region src/email/departmentsField.d.ts
+type DepartmentsFieldOptions = {
+  /** Field name, i.e. what the row array is stored under. Defaults to `departmentEmails`. */name?: string; /** Field label. Defaults to the plugin's translated one. */
+  label?: ArrayField['label'];
+  /**
+   * Whether each row's `email` (and its `label`) carry `localized: true`, so the same field can
+   * hold a different address per locale. Default `true`; Payload strips the flag on hosts without
+   * `localization`, so it is safe either way.
+   */
+  localized?: boolean;
+};
+/**
+ * The department-emails array, for the host to place on any collection or global they own: a
+ * settings global, a tenants collection, a departments parent, wherever the addresses belong. The
+ * plugin never registers it and never guesses where it lives; the `email.departments` resolver reads
+ * it back, which is also where multi-tenant scoping goes: place this on the tenant-scoped document
+ * and have the resolver return only that tenant's addresses, derived from `req`.
+ *
+ * A row is a `label` (how the address is named when routing a submission to it) and the `email` it
+ * resolves to. Because `email` is `localized` by default, a host can hold a different address per
+ * locale without changing the stored shape. The array itself is not localized, so per-locale edits
+ * must address existing rows by their own auto-assigned `id` rather than re-sending id-less rows.
+ *
+ * It renders condensed: `admin.components.Field` is {@link CondensedArray}, which lays each row out
+ * flat as `[label, email]` at 50% each with no per-row collapsible, while keeping Payload's native
+ * per-locale storage and row ids.
+ *
+ * ```ts
+ * // The host's own collection or global:
+ * fields: [departmentsField()]
+ *
+ * // The plugin, reading it back to route a submission. `resolveDepartmentOptions` reads the array
+ * // (fetched at `locale: 'all'`) and resolves each row's address for the requesting locale:
+ * formBuilder({
+ *   email: {
+ *     departments: async ({ req }) => {
+ *       const settings = await req.payload.findGlobal({ slug: 'settings', depth: 0, locale: 'all' })
+ *       return resolveDepartmentOptions({ payload: req.payload, req, doc: settings })
+ *     },
+ *   },
+ * })
+ * ```
+ *
+ * The read above omits the save's `req` on purpose: threading it into a `locale: 'all'` read from
+ * within a form's save validation flips `req.locale` to `all` and corrupts the localized write of the
+ * document being saved. It reads already-committed data, so no transaction (`req`) is needed.
+ */
+declare const departmentsField: (options?: DepartmentsFieldOptions) => ArrayField;
+//#endregion
+export { DepartmentsFieldOptions, departmentsField };
+//# sourceMappingURL=departmentsField.d.ts.map