@10x-media/form-builder 0.1.0-beta.2 → 0.1.0-beta.4

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # @10x-media/form-builder
 
+## 0.1.0-beta.4
+
+### Minor Changes
+
+- Feedback round: flow authoring, localized content, response/display settings, bring-your-own uploads, poll lifecycle, composable form chrome, and a German locale.
+
+  **Breaking:**
+
+  - **Uploads are bring-your-own and off by default.** The plugin no longer registers a `form-uploads` collection. `uploads` is now `false` (default; the `file` field type is removed from the registry entirely) or `{ collection: 'slug' }` pointing at an upload-enabled collection the app owns; the plugin validates it at boot, appends a hidden `owner` field, and prepends the spam upload hooks. The file field's `relationTo` config is gone (the server stamps the configured slug onto each `file` block as a hidden `uploadsCollection`), and `overrides.uploads` no longer exists.
+  - **Stored presentation is gone.** The `defaultPresentation` field on `forms` and the plugin-level `presentations` option are removed. Presentation is decided at render time via the `presentation`/`presentations` props on `<Form>`; the React presentation system (page/inline/modal/drawer, custom `FormPresentation`) is unchanged.
+  - **Poll config moved into a `poll` group.** The top-level `showResults`/`resultsField` fields on `forms` are replaced by `poll.enabled`, `poll.resultsField`, plus the new `poll.resultsVisibility` and `poll.closesAt`. The results endpoint now gates on `poll.enabled` and visibility.
+  - **Content fields are localized by default.** Author-facing content (field labels, placeholders, descriptions, option labels, consent statements, action subjects/bodies, response/display content) carries `localized: true`; on hosts with Payload `localization` configured the stored data shape changes to per-locale objects. Hosts without localization are unaffected (Payload strips the flag). Opt out with `localizeContent: false`; when opting out, derive registry overrides from `buildDefaultFieldDefinitions(false)` / `buildDefaultActionDefinitions(false)` / `buildDefaultConsentSources(false)` instead of spreading the prebuilt defaults, which carry the localized flags.
+  - **`<Poll hasVoted>` ORs with the localStorage guard.** `hasVoted: true` marks the visitor as voted regardless of localStorage; it previously could suppress the localStorage read. `false`/omitted falls back to localStorage as before.
+  - **Form chrome markup changed.** The default buttons now carry stable classes (`fb-form__back`, `fb-form__next`, `fb-form__submit`) and always render inside a `.fb-form__controls` wrapper (previously classless buttons, wrapped only on multi-step forms). CSS or tests targeting the old bare buttons need the new hooks.
+
+  **Features:**
+
+  - Flow authoring without ids: steps are named by title (ids auto-generated, never shown), field assignment is exclusive with an unassigned-fields list, and save-time normalization dedupes fields across steps.
+  - `message` field type: display-only rich text between fields, never validated or stored, condition-targetable, recall-token aware.
+  - Response settings (`response` group + tab): success `message` rich text, `redirect` URL (fires on the custom-`children` path too), and `submitLabel` with prop-over-document-over-default precedence.
+  - Display settings (`display` group + tab): opt-in form title (`showTitle`/`title`) and rich text `intro` rendered above the fields, recall-token aware.
+  - Field config layout: the Field tab lays basics out in rows (name/label, width/placeholder), `width` is required with a `full` default, and `required` sits last.
+  - Poll lifecycle: `closesAt` close date enforced at submission time, `resultsVisibility` (`afterVote`/`afterClose`) gating for anonymous results, a `results.access` seam for multi-tenant scoping, and `poll: { votedCookie: true }` for an httpOnly SSR voted marker read via `hasVotedCookie`.
+  - Poll option sources: `definePollOptionSource` + the `poll.sources` registry resolve a poll's choices from host domain data at render (`resolvePollOptions` + `toFormDocument(doc, { pollOptions })`) and at submission (resolved values are the only accepted answers, fail closed).
+  - Poll outcome: `resolvePollOutcome` records a final `winningValue` (admin read-only, server-only write path); `<Poll>` renders the final state and `<FormResults winningValue>` highlights the winner.
+  - `richText.editor` overrides the editor on both action body fields (e.g. a minimal toolbar for email authors); a custom `richText.serialize` now receives the submitted `form` and `req` for per-tenant lookups or handing off to react-email.
+  - Composable chrome: `<FormControls>` (the default buttons with all `render*`/className overrides) and `<FormSteps>` (step progress with `aria-current`) are exported for custom `children` layouts, and `useFormContext` exposes the controller context including resolved `labels`, the active `t`, and `effectiveValues`.
+  - Server-safe `toFormDocument`: no `'use client'` directive, exported from the root and the `/rsc` subpath (which also gains `resolvePollOptions`, `resolvePollOutcome`, `hasVotedCookie`, `votedCookieName`, and `isPollClosed`), so Server Components narrow the document without pulling in the React client layer.
+  - German (`de`) admin and renderer strings ship built in alongside English.
+  - The shadcn registry now covers every built-in field type (adds date, consent, calculation, and repeater renderers); the default `textarea` type label is now "Textarea".
+  - Repeaters with `minRows` start pre-seeded with that many empty rows instead of appearing blank until validation; an explicit `initialValues` entry for the field (including `[]`) still wins over the seed.
+
+  **Fixes:**
+
+  - File fields nested inside a repeater row now get the same server-side upload enforcement as top-level file fields: each captured value is re-derived into a `FileRef` from the stored upload doc (owner, MIME type, and size checked against the sub-field config) instead of storing the raw client-submitted id, and the submission fails closed on a forged id or a missing uploads collection.
+  - Upload enforcement is now driven by a field's value kind rather than its block type, so a custom field type registered with `value: 'file'` is captured and enforced (owner/MIME/size) at both the top level and inside repeaters, not just the built-in `file` type.
+
+  **Notes:**
+
+  - The voted cookie is deliberately not `Secure`: it is a UX-only marker (skip re-showing an answered form), never an integrity or auth signal, and staying non-Secure keeps plain-HTTP local development working.
+  - No migrations are shipped for the removed/moved `forms` columns (`defaultPresentation`, `showResults`, top-level `resultsField`); pre-1.0 with no known production consumers, write your own if you carry data.
+
+## 0.1.0-beta.3
+
+### Minor Changes
+
+- Bundled captcha adapters and widget components. `turnstileProvider`, `recaptchaProvider` (v2 + v3 with `minScore`), and `hcaptchaProvider` verify tokens server-side with fail-closed semantics (network errors, timeouts, and non-2xx responses reject the submission). Matching headless `TurnstileCaptcha`, `RecaptchaCaptcha`, and `HcaptchaCaptcha` components on the `/react` export load each vendor script once, report tokens through `onToken` for `<Form captchaToken>`, clear on expiry or error, and expose `reset` (plus on-demand `execute` refresh for reCAPTCHA v3) via a ref handle.
+
+- Feedback round: `date` field type (native date input, real-calendar validation) with `minDate`/`maxDate` rules; rich text notification bodies for `emailTeam`/`confirmation` using the project's configured editor, serialized with escaping, sanitized links, `{{ name|fallback }}`/`{{*}}`/`{{*:table}}` tokens, a plugin `richText { converters, serialize }` option for custom nodes and non-HTML channels, and `renderBody` on action run args; the confirmation recipient is a select over the form's email fields, validated server-side on save; `signedWebhook` validates its URL as absolute http(s) and describes its config fields; calculation expressions get an admin description, Monaco JSON-schema autocomplete, and save-time validation of the expression tree; the file field's `mimeTypes` is a curated select and `maxSize` live-previews as a human-readable size, with a client-side size pre-check and hint line on the renderer; flow transitions resolve against effective values so calculation fields can drive branching; the forms document (Fields/Flow/Actions) and every field block (Field/Validation/Advanced) use tabbed admin layouts, and admin components ship their own CSS (no `styles.css` import needed for the admin). New exports: `serializeBody`, `defaultBodyConverters`, `sanitizeUrl`, `escapeHtml`, `renderAllValues`, `renderAllValuesTable`, `fileMimeTypeOptions`, `formatBytes`, `defaultFieldDefinitionsByType`, `defaultValidationRulesByType`, and the `ByteSizeField`/`FieldNameSelect` client components.
+
+  **Soft compat:** existing plain-string action bodies keep working through the send path (interpolated exactly as before), though the admin editor shows them as empty rich text until re-entered. File fields keep enforcing stored free-text MIME values, but values outside the curated list need re-selecting the next time that field is edited; submitted data is untouched.
+
+  **Postgres migration note:** on `@payloadcms/db-postgres`, two `forms` column types change: action `body` goes `varchar` to `jsonb` (pre-existing string bodies are not valid JSON, so cast with `USING to_jsonb(body)` when writing the migration), and `mimeTypes` moves from a text array to an enum-backed select. Mongo needs no migration. The project config must also set an `editor` (rich text bodies inherit it; Payload throws `MissingEditorProp` without one).
+
+### Patch Changes
+
+- The registry (shadcn-style) file field now matches the built-in file renderer: a client-side max-size pre-check rejects oversized files before uploading, and an accepted-types/max-size hint line renders under the input.
+
+  `minDate`/`maxDate` rule bounds are now validated as real `YYYY-MM-DD` calendar dates in the admin UI, so a malformed bound (e.g. `abc` or `2024-02-30`) is rejected at config time instead of silently breaking the rule's comparisons.
+
 ## 0.1.0-beta.2
 
 ### Minor Changes

package/README.md

@@ -8,7 +8,7 @@ Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-pl
 
 ## Features
 
-- **Fields**: text, textarea, email, number, select, checkbox, file, consent, calculation, and repeater (dynamic row lists with per-row sub-field validation), authored as Payload blocks; custom types via `defineFormField` are never second-class.
+- **Fields**: text, textarea, email, number, date, select, checkbox, file, consent, calculation, and repeater (dynamic row lists with per-row sub-field validation), authored as Payload blocks; custom types via `defineFormField` are never second-class.
 - **Validation**: declarative per-field rules, custom messages and severities, cross-field and async server-only rules, a Standard Schema escape hatch (zod, valibot, ...), one server-authoritative engine.
 - **Conditional logic**: `visibleWhen` / `validateWhen` in Payload's `Where` shape, one isomorphic engine on client and server.
 - **Multi-step flows** with conditional branching, authored in the admin flow builder.
@@ -17,10 +17,10 @@ Part of the [@10x-media Payload plugins](https://github.com/10x-media/payload-pl
 - **Recall and prefill**: pipe answers into labels and messages; URL prefill; hidden context fields.
 - **Calculations**: a safe no-eval expression engine for totals and quiz scores, recomputed on the server.
 - **Post-submit actions**: email, confirmation, signed webhook, and custom actions, queued via Payload jobs with a bounded inline fallback.
-- **Consent** with proof by reference and policy-version capture; **file uploads** with server-enforced MIME/size; **polls** with a gated public results endpoint.
-- **Spam protection** on by default: honeypot, per-identity rate limiting, a captcha seam, upload-ownership scoping, privacy-first metadata.
+- **Consent** with proof by reference and policy-version capture; **file uploads** into your own upload collection with server-enforced MIME/size; **polls** with a gated public results endpoint.
+- **Spam protection** on by default: honeypot, per-identity rate limiting, bundled captcha adapters (Turnstile, reCAPTCHA, hCaptcha), upload-ownership scoping, privacy-first metadata.
 - **Accessibility** verified by automated axe checks; **typed translations** via `@10x-media/form-builder/i18n`.
-- **Collection overrides**: extend `forms`, `form-submissions`, and `form-uploads` with extra fields, hooks, and access rules using an explicit spread API that guarantees plugin-critical hooks always run.
+- **Collection overrides**: extend `forms` and `form-submissions` with extra fields, hooks, and access rules using an explicit spread API that guarantees plugin-critical hooks always run.
 
 ## Quick start
 

package/dist/actions/body/converters.d.ts

@@ -0,0 +1,20 @@
+//#region src/actions/body/converters.d.ts
+/** Text pipelines a converter can apply to author-typed content. */
+type BodyRender = {
+  /** Full text pipeline: HTML-escape, then expand `{{*}}`/`{{*:table}}` and recall tokens with escaped values. */text: (raw: string) => string; /** Recall-token interpolation only, unescaped; for URL-like values that get escaped separately. */
+  interpolate: (raw: string) => string;
+};
+type BodyConverterArgs = {
+  node: Record<string, unknown>; /** The node's already-serialized children. */
+  children: string;
+  render: BodyRender;
+};
+/** Serializes one Lexical node type to an HTML string. Keyed by `node.type` in the registry. */
+type BodyConverter = (args: BodyConverterArgs) => string;
+/** Allow http(s)/mailto/tel and scheme-less (relative) URLs; anything else becomes `#`. */
+declare const sanitizeUrl: (url: string) => string;
+/** Default Lexical-to-HTML converter registry; consumers spread overrides per node type. */
+declare const defaultBodyConverters: Record<string, BodyConverter>;
+//#endregion
+export { BodyConverter, BodyConverterArgs, BodyRender, defaultBodyConverters, sanitizeUrl };
+//# sourceMappingURL=converters.d.ts.map

package/dist/actions/body/converters.js

@@ -0,0 +1,57 @@
+import { escapeHtml } from "./escapeHtml.js";
+//#region src/actions/body/converters.ts
+const SCHEME = /^[a-z][a-z0-9+.-]*:/i;
+const SAFE_SCHEME = /^(https?|mailto|tel):/i;
+/** Allow http(s)/mailto/tel and scheme-less (relative) URLs; anything else becomes `#`. */
+const sanitizeUrl = (url) => {
+	const probe = url.replace(/\s/g, "");
+	if (probe === "") return "#";
+	if (SCHEME.test(probe)) return SAFE_SCHEME.test(probe) ? url.trim() : "#";
+	return url.trim();
+};
+const BOLD = 1;
+const ITALIC = 2;
+const STRIKETHROUGH = 4;
+const UNDERLINE = 8;
+const CODE = 16;
+const text = ({ node, render }) => {
+	let html = render.text(typeof node.text === "string" ? node.text : "");
+	const format = typeof node.format === "number" ? node.format : 0;
+	if (format & CODE) html = `<code>${html}</code>`;
+	if (format & BOLD) html = `<strong>${html}</strong>`;
+	if (format & ITALIC) html = `<em>${html}</em>`;
+	if (format & STRIKETHROUGH) html = `<s>${html}</s>`;
+	if (format & UNDERLINE) html = `<u>${html}</u>`;
+	return html;
+};
+const link = ({ node, children, render }) => {
+	const fields = node.fields ?? {};
+	const raw = typeof fields.url === "string" ? fields.url : typeof node.url === "string" ? node.url : "";
+	return `<a href="${escapeHtml(sanitizeUrl(render.interpolate(raw)))}"${fields.newTab === true ? " rel=\"noopener noreferrer\" target=\"_blank\"" : ""}>${children}</a>`;
+};
+const HEADING_TAG = /^h[1-6]$/;
+const heading = ({ node, children }) => {
+	const tag = typeof node.tag === "string" && HEADING_TAG.test(node.tag) ? node.tag : "h2";
+	return `<${tag}>${children}</${tag}>`;
+};
+const list = ({ node, children }) => {
+	const tag = node.tag === "ol" || node.listType === "number" ? "ol" : "ul";
+	return `<${tag}>${children}</${tag}>`;
+};
+/** Default Lexical-to-HTML converter registry; consumers spread overrides per node type. */
+const defaultBodyConverters = {
+	autolink: link,
+	heading,
+	horizontalrule: () => "<hr />",
+	linebreak: () => "<br />",
+	link,
+	list,
+	listitem: ({ children }) => `<li>${children}</li>`,
+	paragraph: ({ children }) => `<p>${children}</p>`,
+	quote: ({ children }) => `<blockquote>${children}</blockquote>`,
+	text
+};
+//#endregion
+export { defaultBodyConverters, sanitizeUrl };
+
+//# sourceMappingURL=converters.js.map

package/dist/actions/body/converters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converters.js","names":[],"sources":["../../../src/actions/body/converters.ts"],"sourcesContent":["import { escapeHtml } from './escapeHtml'\n\n/** Text pipelines a converter can apply to author-typed content. */\nexport type BodyRender = {\n\t/** Full text pipeline: HTML-escape, then expand `{{*}}`/`{{*:table}}` and recall tokens with escaped values. */\n\ttext: (raw: string) => string\n\t/** Recall-token interpolation only, unescaped; for URL-like values that get escaped separately. */\n\tinterpolate: (raw: string) => string\n}\n\nexport type BodyConverterArgs = {\n\tnode: Record<string, unknown>\n\t/** The node's already-serialized children. */\n\tchildren: string\n\trender: BodyRender\n}\n\n/** Serializes one Lexical node type to an HTML string. Keyed by `node.type` in the registry. */\nexport type BodyConverter = (args: BodyConverterArgs) => string\n\nconst SCHEME = /^[a-z][a-z0-9+.-]*:/i\nconst SAFE_SCHEME = /^(https?|mailto|tel):/i\n\n/** Allow http(s)/mailto/tel and scheme-less (relative) URLs; anything else becomes `#`. */\nexport const sanitizeUrl = (url: string): string => {\n\tconst probe = url.replace(/\\s/g, '')\n\tif (probe === '') {\n\t\treturn '#'\n\t}\n\tif (SCHEME.test(probe)) {\n\t\treturn SAFE_SCHEME.test(probe) ? url.trim() : '#'\n\t}\n\treturn url.trim()\n}\n\nconst BOLD = 1\nconst ITALIC = 2\nconst STRIKETHROUGH = 4\nconst UNDERLINE = 8\nconst CODE = 16\n\nconst text: BodyConverter = ({ node, render }) => {\n\tlet html = render.text(typeof node.text === 'string' ? node.text : '')\n\tconst format = typeof node.format === 'number' ? node.format : 0\n\tif (format & CODE) {\n\t\thtml = `<code>${html}</code>`\n\t}\n\tif (format & BOLD) {\n\t\thtml = `<strong>${html}</strong>`\n\t}\n\tif (format & ITALIC) {\n\t\thtml = `<em>${html}</em>`\n\t}\n\tif (format & STRIKETHROUGH) {\n\t\thtml = `<s>${html}</s>`\n\t}\n\tif (format & UNDERLINE) {\n\t\thtml = `<u>${html}</u>`\n\t}\n\treturn html\n}\n\nconst link: BodyConverter = ({ node, children, render }) => {\n\tconst fields = (node.fields ?? {}) as Record<string, unknown>\n\tconst raw =\n\t\ttypeof fields.url === 'string' ? fields.url : typeof node.url === 'string' ? node.url : ''\n\tconst href = escapeHtml(sanitizeUrl(render.interpolate(raw)))\n\tconst newTab = fields.newTab === true\n\treturn `<a href=\"${href}\"${newTab ? ' rel=\"noopener noreferrer\" target=\"_blank\"' : ''}>${children}</a>`\n}\n\nconst HEADING_TAG = /^h[1-6]$/\n\nconst heading: BodyConverter = ({ node, children }) => {\n\tconst tag = typeof node.tag === 'string' && HEADING_TAG.test(node.tag) ? node.tag : 'h2'\n\treturn `<${tag}>${children}</${tag}>`\n}\n\nconst list: BodyConverter = ({ node, children }) => {\n\tconst tag = node.tag === 'ol' || node.listType === 'number' ? 'ol' : 'ul'\n\treturn `<${tag}>${children}</${tag}>`\n}\n\n/** Default Lexical-to-HTML converter registry; consumers spread overrides per node type. */\nexport const defaultBodyConverters: Record<string, BodyConverter> = {\n\tautolink: link,\n\theading,\n\thorizontalrule: () => '<hr />',\n\tlinebreak: () => '<br />',\n\tlink,\n\tlist,\n\tlistitem: ({ children }) => `<li>${children}</li>`,\n\tparagraph: ({ children }) => `<p>${children}</p>`,\n\tquote: ({ children }) => `<blockquote>${children}</blockquote>`,\n\ttext,\n}\n"],"mappings":";;AAoBA,MAAM,SAAS;AACf,MAAM,cAAc;;AAGpB,MAAa,eAAe,QAAwB;CACnD,MAAM,QAAQ,IAAI,QAAQ,OAAO,EAAE;CACnC,IAAI,UAAU,IACb,OAAO;CAER,IAAI,OAAO,KAAK,KAAK,GACpB,OAAO,YAAY,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;CAE/C,OAAO,IAAI,KAAK;AACjB;AAEA,MAAM,OAAO;AACb,MAAM,SAAS;AACf,MAAM,gBAAgB;AACtB,MAAM,YAAY;AAClB,MAAM,OAAO;AAEb,MAAM,QAAuB,EAAE,MAAM,aAAa;CACjD,IAAI,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,EAAE;CACrE,MAAM,SAAS,OAAO,KAAK,WAAW,WAAW,KAAK,SAAS;CAC/D,IAAI,SAAS,MACZ,OAAO,SAAS,KAAK;CAEtB,IAAI,SAAS,MACZ,OAAO,WAAW,KAAK;CAExB,IAAI,SAAS,QACZ,OAAO,OAAO,KAAK;CAEpB,IAAI,SAAS,eACZ,OAAO,MAAM,KAAK;CAEnB,IAAI,SAAS,WACZ,OAAO,MAAM,KAAK;CAEnB,OAAO;AACR;AAEA,MAAM,QAAuB,EAAE,MAAM,UAAU,aAAa;CAC3D,MAAM,SAAU,KAAK,UAAU,CAAC;CAChC,MAAM,MACL,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;CAGzF,OAAO,YAFM,WAAW,YAAY,OAAO,YAAY,GAAG,CAAC,CAErC,EAAE,GADT,OAAO,WAAW,OACG,mDAA+C,GAAG,GAAG,SAAS;AACnG;AAEA,MAAM,cAAc;AAEpB,MAAM,WAA0B,EAAE,MAAM,eAAe;CACtD,MAAM,MAAM,OAAO,KAAK,QAAQ,YAAY,YAAY,KAAK,KAAK,GAAG,IAAI,KAAK,MAAM;CACpF,OAAO,IAAI,IAAI,GAAG,SAAS,IAAI,IAAI;AACpC;AAEA,MAAM,QAAuB,EAAE,MAAM,eAAe;CACnD,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK,aAAa,WAAW,OAAO;CACrE,OAAO,IAAI,IAAI,GAAG,SAAS,IAAI,IAAI;AACpC;;AAGA,MAAa,wBAAuD;CACnE,UAAU;CACV;CACA,sBAAsB;CACtB,iBAAiB;CACjB;CACA;CACA,WAAW,EAAE,eAAe,OAAO,SAAS;CAC5C,YAAY,EAAE,eAAe,MAAM,SAAS;CAC5C,QAAQ,EAAE,eAAe,eAAe,SAAS;CACjD;AACD"}

package/dist/actions/body/escapeHtml.d.ts

@@ -0,0 +1,6 @@
+//#region src/actions/body/escapeHtml.d.ts
+/** Escape `&`, `<`, `>`, `"`, `'` for safe embedding in HTML text or attribute values. */
+declare const escapeHtml: (value: string) => string;
+//#endregion
+export { escapeHtml };
+//# sourceMappingURL=escapeHtml.d.ts.map

package/dist/actions/body/escapeHtml.js

@@ -0,0 +1,14 @@
+//#region src/actions/body/escapeHtml.ts
+const REPLACEMENTS = {
+	"&": "&",
+	"<": "&lt;",
+	">": "&gt;",
+	"\"": "&quot;",
+	"'": "&#39;"
+};
+/** Escape `&`, `<`, `>`, `"`, `'` for safe embedding in HTML text or attribute values. */
+const escapeHtml = (value) => value.replace(/[&<>"']/g, (char) => REPLACEMENTS[char] ?? char);
+//#endregion
+export { escapeHtml };
+
+//# sourceMappingURL=escapeHtml.js.map

package/dist/actions/body/escapeHtml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"escapeHtml.js","names":[],"sources":["../../../src/actions/body/escapeHtml.ts"],"sourcesContent":["const REPLACEMENTS: Record<string, string> = {\n\t'&': '&amp;',\n\t'<': '&lt;',\n\t'>': '&gt;',\n\t'\"': '&quot;',\n\t\"'\": '&#39;',\n}\n\n/** Escape `&`, `<`, `>`, `\"`, `'` for safe embedding in HTML text or attribute values. */\nexport const escapeHtml = (value: string): string =>\n\tvalue.replace(/[&<>\"']/g, (char) => REPLACEMENTS[char] ?? char)\n"],"mappings":";AAAA,MAAM,eAAuC;CAC5C,KAAK;CACL,KAAK;CACL,KAAK;CACL,MAAK;CACL,KAAK;AACN;;AAGA,MAAa,cAAc,UAC1B,MAAM,QAAQ,aAAa,SAAS,aAAa,SAAS,IAAI"}

package/dist/actions/body/serializeBody.d.ts

@@ -0,0 +1,50 @@
+import { SubmissionDescriptor, SubmissionValue } from "../../submissions/types.js";
+import { BodyConverter } from "./converters.js";
+import { PayloadRequest, RichTextField } from "payload";
+
+//#region src/actions/body/serializeBody.d.ts
+/** Minimal form identity threaded alongside a rendered body (e.g. per-tenant template lookups). */
+type SerializeBodyForm = {
+  id: number | string;
+  title?: string;
+};
+/** Submission data plus optional converter overrides available while serializing a body. */
+type BodyContext = {
+  values: SubmissionValue[];
+  descriptors: SubmissionDescriptor[];
+  converters?: Record<string, BodyConverter>;
+};
+/**
+ * Args a custom `richText.serialize` replacement receives per rendered body. Always populated by
+ * `makeRenderBody` (the action-body pipeline): `form` and `req` enable per-tenant template
+ * lookups or handing the body off to a renderer like react-email.
+ */
+type SerializeBodyArgs = {
+  body: unknown;
+  values: SubmissionValue[];
+  descriptors: SubmissionDescriptor[];
+  form: SerializeBodyForm;
+  req?: PayloadRequest;
+};
+/**
+ * Customizes how action bodies are authored and rendered. `converters` spread over the default
+ * Lexical node converters; `serialize` replaces the whole pipeline (for non-HTML channels like
+ * chat or plain text, or to hand the body plus the submitted `form`/`req` off to a renderer like
+ * react-email). `editor` overrides the Lexical/richText editor on both the emailTeam and
+ * confirmation action body fields (see `buildDefaultActionDefinitions`).
+ */
+type RichTextBodyOption = {
+  converters?: Record<string, BodyConverter>;
+  serialize?: (args: SerializeBodyArgs) => Promise<string> | string;
+  editor?: RichTextField['editor'];
+};
+/**
+ * Serialize an action's `body` config into HTML. A legacy string body is interpolated as-is
+ * (pre-richText behavior, no escaping); a Lexical state walks the converter registry; a Slate
+ * array uses the minimal legacy serializer; anything else yields `''`. Rendered text is
+ * HTML-escaped and supports `{{ name|fallback }}`, `{{*}}`, and `{{*:table}}` tokens.
+ */
+declare const serializeBody: (body: unknown, ctx: BodyContext) => string;
+//#endregion
+export { BodyContext, RichTextBodyOption, SerializeBodyArgs, serializeBody };
+//# sourceMappingURL=serializeBody.d.ts.map

package/dist/actions/body/serializeBody.js

@@ -0,0 +1,78 @@
+import { interpolate } from "../../recall/interpolate.js";
+import { escapeHtml } from "./escapeHtml.js";
+import { defaultBodyConverters } from "./converters.js";
+import { serializeSlate } from "./serializeSlate.js";
+import { renderAllValues, renderAllValuesTable } from "./wildcards.js";
+//#region src/actions/body/serializeBody.ts
+/** Recall resolver over submission values: field name to stringified value, `''` when absent. */
+const resolverFor = (values) => (name) => {
+	const entry = values.find((value) => value.field === name);
+	return entry == null ? "" : String(entry.value ?? "");
+};
+const renderFor = (ctx) => {
+	const resolve = resolverFor(ctx.values);
+	const htmlResolve = (name) => {
+		if (name === "*") return renderAllValues(ctx.values, ctx.descriptors);
+		if (name === "*:table") return renderAllValuesTable(ctx.values, ctx.descriptors);
+		return escapeHtml(resolve(name));
+	};
+	return {
+		text: (raw) => interpolate(escapeHtml(raw), htmlResolve),
+		interpolate: (raw) => interpolate(raw, resolve)
+	};
+};
+const serializeNodes = (nodes, converters, render) => nodes.map((node) => {
+	if (node == null || typeof node !== "object") return "";
+	const lexicalNode = node;
+	const children = Array.isArray(lexicalNode.children) ? serializeNodes(lexicalNode.children, converters, render) : "";
+	const converter = typeof lexicalNode.type === "string" ? converters[lexicalNode.type] : void 0;
+	return converter ? converter({
+		node: lexicalNode,
+		children,
+		render
+	}) : children;
+}).join("");
+const lexicalRootOf = (body) => {
+	if (body == null || typeof body !== "object" || Array.isArray(body)) return null;
+	const root = body.root;
+	return root != null && typeof root === "object" ? root : null;
+};
+/**
+* Serialize an action's `body` config into HTML. A legacy string body is interpolated as-is
+* (pre-richText behavior, no escaping); a Lexical state walks the converter registry; a Slate
+* array uses the minimal legacy serializer; anything else yields `''`. Rendered text is
+* HTML-escaped and supports `{{ name|fallback }}`, `{{*}}`, and `{{*:table}}` tokens.
+*/
+const serializeBody = (body, ctx) => {
+	if (typeof body === "string") return interpolate(body, resolverFor(ctx.values));
+	const render = renderFor(ctx);
+	if (Array.isArray(body)) return serializeSlate(body, render);
+	const root = lexicalRootOf(body);
+	if (root) {
+		const converters = {
+			...defaultBodyConverters,
+			...ctx.converters ?? {}
+		};
+		return serializeNodes(Array.isArray(root.children) ? root.children : [], converters, render);
+	}
+	return "";
+};
+/** Build the `renderBody` passed to actions, honoring a plugin-level `richText` customization. */
+const makeRenderBody = (args) => async (body) => {
+	if (args.richText?.serialize) return await args.richText.serialize({
+		body,
+		values: args.values,
+		descriptors: args.descriptors,
+		form: args.form,
+		req: args.req
+	});
+	return serializeBody(body, {
+		values: args.values,
+		descriptors: args.descriptors,
+		converters: args.richText?.converters
+	});
+};
+//#endregion
+export { makeRenderBody, resolverFor, serializeBody };
+
+//# sourceMappingURL=serializeBody.js.map

package/dist/actions/body/serializeBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializeBody.js","names":[],"sources":["../../../src/actions/body/serializeBody.ts"],"sourcesContent":["import type { PayloadRequest, RichTextField } from 'payload'\nimport { interpolate } from '../../recall/interpolate'\nimport type { SubmissionDescriptor, SubmissionValue } from '../../submissions/types'\nimport type { BodyConverter, BodyRender } from './converters'\nimport { defaultBodyConverters } from './converters'\nimport { escapeHtml } from './escapeHtml'\nimport { serializeSlate } from './serializeSlate'\nimport { renderAllValues, renderAllValuesTable } from './wildcards'\n\n/** Minimal form identity threaded alongside a rendered body (e.g. per-tenant template lookups). */\ntype SerializeBodyForm = { id: number | string; title?: string }\n\n/** Submission data plus optional converter overrides available while serializing a body. */\nexport type BodyContext = {\n\tvalues: SubmissionValue[]\n\tdescriptors: SubmissionDescriptor[]\n\tconverters?: Record<string, BodyConverter>\n}\n\n/**\n * Args a custom `richText.serialize` replacement receives per rendered body. Always populated by\n * `makeRenderBody` (the action-body pipeline): `form` and `req` enable per-tenant template\n * lookups or handing the body off to a renderer like react-email.\n */\nexport type SerializeBodyArgs = {\n\tbody: unknown\n\tvalues: SubmissionValue[]\n\tdescriptors: SubmissionDescriptor[]\n\tform: SerializeBodyForm\n\treq?: PayloadRequest\n}\n\n/**\n * Customizes how action bodies are authored and rendered. `converters` spread over the default\n * Lexical node converters; `serialize` replaces the whole pipeline (for non-HTML channels like\n * chat or plain text, or to hand the body plus the submitted `form`/`req` off to a renderer like\n * react-email). `editor` overrides the Lexical/richText editor on both the emailTeam and\n * confirmation action body fields (see `buildDefaultActionDefinitions`).\n */\nexport type RichTextBodyOption = {\n\tconverters?: Record<string, BodyConverter>\n\tserialize?: (args: SerializeBodyArgs) => Promise<string> | string\n\teditor?: RichTextField['editor']\n}\n\n/** Recall resolver over submission values: field name to stringified value, `''` when absent. */\nexport const resolverFor =\n\t(values: SubmissionValue[]) =>\n\t(name: string): string => {\n\t\tconst entry = values.find((value) => value.field === name)\n\t\treturn entry == null ? '' : String(entry.value ?? '')\n\t}\n\nconst renderFor = (ctx: BodyContext): BodyRender => {\n\tconst resolve = resolverFor(ctx.values)\n\tconst htmlResolve = (name: string): string => {\n\t\tif (name === '*') {\n\t\t\treturn renderAllValues(ctx.values, ctx.descriptors)\n\t\t}\n\t\tif (name === '*:table') {\n\t\t\treturn renderAllValuesTable(ctx.values, ctx.descriptors)\n\t\t}\n\t\treturn escapeHtml(resolve(name))\n\t}\n\treturn {\n\t\ttext: (raw) => interpolate(escapeHtml(raw), htmlResolve),\n\t\tinterpolate: (raw) => interpolate(raw, resolve),\n\t}\n}\n\nconst serializeNodes = (\n\tnodes: unknown[],\n\tconverters: Record<string, BodyConverter>,\n\trender: BodyRender\n): string =>\n\tnodes\n\t\t.map((node) => {\n\t\t\tif (node == null || typeof node !== 'object') {\n\t\t\t\treturn ''\n\t\t\t}\n\t\t\tconst lexicalNode = node as Record<string, unknown>\n\t\t\tconst children = Array.isArray(lexicalNode.children)\n\t\t\t\t? serializeNodes(lexicalNode.children, converters, render)\n\t\t\t\t: ''\n\t\t\tconst converter =\n\t\t\t\ttypeof lexicalNode.type === 'string' ? converters[lexicalNode.type] : undefined\n\t\t\treturn converter ? converter({ node: lexicalNode, children, render }) : children\n\t\t})\n\t\t.join('')\n\nconst lexicalRootOf = (body: unknown): Record<string, unknown> | null => {\n\tif (body == null || typeof body !== 'object' || Array.isArray(body)) {\n\t\treturn null\n\t}\n\tconst root = (body as { root?: unknown }).root\n\treturn root != null && typeof root === 'object' ? (root as Record<string, unknown>) : null\n}\n\n/**\n * Serialize an action's `body` config into HTML. A legacy string body is interpolated as-is\n * (pre-richText behavior, no escaping); a Lexical state walks the converter registry; a Slate\n * array uses the minimal legacy serializer; anything else yields `''`. Rendered text is\n * HTML-escaped and supports `{{ name|fallback }}`, `{{*}}`, and `{{*:table}}` tokens.\n */\nexport const serializeBody = (body: unknown, ctx: BodyContext): string => {\n\tif (typeof body === 'string') {\n\t\treturn interpolate(body, resolverFor(ctx.values))\n\t}\n\tconst render = renderFor(ctx)\n\tif (Array.isArray(body)) {\n\t\treturn serializeSlate(body, render)\n\t}\n\tconst root = lexicalRootOf(body)\n\tif (root) {\n\t\tconst converters = { ...defaultBodyConverters, ...(ctx.converters ?? {}) }\n\t\treturn serializeNodes(Array.isArray(root.children) ? root.children : [], converters, render)\n\t}\n\treturn ''\n}\n\n/** Build the `renderBody` passed to actions, honoring a plugin-level `richText` customization. */\nexport const makeRenderBody =\n\t(args: {\n\t\tvalues: SubmissionValue[]\n\t\tdescriptors: SubmissionDescriptor[]\n\t\tform: SerializeBodyForm\n\t\treq?: PayloadRequest\n\t\trichText?: RichTextBodyOption\n\t}) =>\n\tasync (body: unknown): Promise<string> => {\n\t\tif (args.richText?.serialize) {\n\t\t\treturn await args.richText.serialize({\n\t\t\t\tbody,\n\t\t\t\tvalues: args.values,\n\t\t\t\tdescriptors: args.descriptors,\n\t\t\t\tform: args.form,\n\t\t\t\treq: args.req,\n\t\t\t})\n\t\t}\n\t\treturn serializeBody(body, {\n\t\t\tvalues: args.values,\n\t\t\tdescriptors: args.descriptors,\n\t\t\tconverters: args.richText?.converters,\n\t\t})\n\t}\n"],"mappings":";;;;;;;AA8CA,MAAa,eACX,YACA,SAAyB;CACzB,MAAM,QAAQ,OAAO,MAAM,UAAU,MAAM,UAAU,IAAI;CACzD,OAAO,SAAS,OAAO,KAAK,OAAO,MAAM,SAAS,EAAE;AACrD;AAED,MAAM,aAAa,QAAiC;CACnD,MAAM,UAAU,YAAY,IAAI,MAAM;CACtC,MAAM,eAAe,SAAyB;EAC7C,IAAI,SAAS,KACZ,OAAO,gBAAgB,IAAI,QAAQ,IAAI,WAAW;EAEnD,IAAI,SAAS,WACZ,OAAO,qBAAqB,IAAI,QAAQ,IAAI,WAAW;EAExD,OAAO,WAAW,QAAQ,IAAI,CAAC;CAChC;CACA,OAAO;EACN,OAAO,QAAQ,YAAY,WAAW,GAAG,GAAG,WAAW;EACvD,cAAc,QAAQ,YAAY,KAAK,OAAO;CAC/C;AACD;AAEA,MAAM,kBACL,OACA,YACA,WAEA,MACE,KAAK,SAAS;CACd,IAAI,QAAQ,QAAQ,OAAO,SAAS,UACnC,OAAO;CAER,MAAM,cAAc;CACpB,MAAM,WAAW,MAAM,QAAQ,YAAY,QAAQ,IAChD,eAAe,YAAY,UAAU,YAAY,MAAM,IACvD;CACH,MAAM,YACL,OAAO,YAAY,SAAS,WAAW,WAAW,YAAY,QAAQ,KAAA;CACvE,OAAO,YAAY,UAAU;EAAE,MAAM;EAAa;EAAU;CAAO,CAAC,IAAI;AACzE,CAAC,EACA,KAAK,EAAE;AAEV,MAAM,iBAAiB,SAAkD;CACxE,IAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GACjE,OAAO;CAER,MAAM,OAAQ,KAA4B;CAC1C,OAAO,QAAQ,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACvF;;;;;;;AAQA,MAAa,iBAAiB,MAAe,QAA6B;CACzE,IAAI,OAAO,SAAS,UACnB,OAAO,YAAY,MAAM,YAAY,IAAI,MAAM,CAAC;CAEjD,MAAM,SAAS,UAAU,GAAG;CAC5B,IAAI,MAAM,QAAQ,IAAI,GACrB,OAAO,eAAe,MAAM,MAAM;CAEnC,MAAM,OAAO,cAAc,IAAI;CAC/B,IAAI,MAAM;EACT,MAAM,aAAa;GAAE,GAAG;GAAuB,GAAI,IAAI,cAAc,CAAC;EAAG;EACzE,OAAO,eAAe,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK,WAAW,CAAC,GAAG,YAAY,MAAM;CAC5F;CACA,OAAO;AACR;;AAGA,MAAa,kBACX,SAOD,OAAO,SAAmC;CACzC,IAAI,KAAK,UAAU,WAClB,OAAO,MAAM,KAAK,SAAS,UAAU;EACpC;EACA,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,MAAM,KAAK;EACX,KAAK,KAAK;CACX,CAAC;CAEF,OAAO,cAAc,MAAM;EAC1B,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,YAAY,KAAK,UAAU;CAC5B,CAAC;AACF"}

package/dist/actions/body/serializeSlate.js

@@ -0,0 +1,31 @@
+import { escapeHtml } from "./escapeHtml.js";
+import { sanitizeUrl } from "./converters.js";
+//#region src/actions/body/serializeSlate.ts
+const leaf = (node, render) => {
+	let html = render.text(typeof node.text === "string" ? node.text : "");
+	if (node.code === true) html = `<code>${html}</code>`;
+	if (node.bold === true) html = `<strong>${html}</strong>`;
+	if (node.italic === true) html = `<em>${html}</em>`;
+	if (node.underline === true) html = `<u>${html}</u>`;
+	return html;
+};
+const serializeNode = (node, render) => {
+	if (node == null || typeof node !== "object") return "";
+	const slateNode = node;
+	if (typeof slateNode.text === "string") return leaf(slateNode, render);
+	const children = Array.isArray(slateNode.children) ? slateNode.children.map((child) => serializeNode(child, render)).join("") : "";
+	if (slateNode.type === "link") {
+		const raw = typeof slateNode.url === "string" ? slateNode.url : "";
+		return `<a href="${escapeHtml(sanitizeUrl(render.interpolate(raw)))}">${children}</a>`;
+	}
+	return `<p>${children}</p>`;
+};
+/**
+* Minimal legacy Slate serializer: paragraph-ish elements, bold/italic/underline/code marks, links.
+* Strikethrough is intentionally unsupported for legacy Slate bodies.
+*/
+const serializeSlate = (nodes, render) => nodes.map((node) => serializeNode(node, render)).join("");
+//#endregion
+export { serializeSlate };
+
+//# sourceMappingURL=serializeSlate.js.map

package/dist/actions/body/serializeSlate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serializeSlate.js","names":[],"sources":["../../../src/actions/body/serializeSlate.ts"],"sourcesContent":["import type { BodyRender } from './converters'\nimport { sanitizeUrl } from './converters'\nimport { escapeHtml } from './escapeHtml'\n\ntype SlateNode = Record<string, unknown>\n\nconst leaf = (node: SlateNode, render: BodyRender): string => {\n\tlet html = render.text(typeof node.text === 'string' ? node.text : '')\n\tif (node.code === true) {\n\t\thtml = `<code>${html}</code>`\n\t}\n\tif (node.bold === true) {\n\t\thtml = `<strong>${html}</strong>`\n\t}\n\tif (node.italic === true) {\n\t\thtml = `<em>${html}</em>`\n\t}\n\tif (node.underline === true) {\n\t\thtml = `<u>${html}</u>`\n\t}\n\treturn html\n}\n\nconst serializeNode = (node: unknown, render: BodyRender): string => {\n\tif (node == null || typeof node !== 'object') {\n\t\treturn ''\n\t}\n\tconst slateNode = node as SlateNode\n\tif (typeof slateNode.text === 'string') {\n\t\treturn leaf(slateNode, render)\n\t}\n\tconst children = Array.isArray(slateNode.children)\n\t\t? slateNode.children.map((child) => serializeNode(child, render)).join('')\n\t\t: ''\n\tif (slateNode.type === 'link') {\n\t\tconst raw = typeof slateNode.url === 'string' ? slateNode.url : ''\n\t\tconst href = escapeHtml(sanitizeUrl(render.interpolate(raw)))\n\t\treturn `<a href=\"${href}\">${children}</a>`\n\t}\n\treturn `<p>${children}</p>`\n}\n\n/**\n * Minimal legacy Slate serializer: paragraph-ish elements, bold/italic/underline/code marks, links.\n * Strikethrough is intentionally unsupported for legacy Slate bodies.\n */\nexport const serializeSlate = (nodes: unknown[], render: BodyRender): string =>\n\tnodes.map((node) => serializeNode(node, render)).join('')\n"],"mappings":";;;AAMA,MAAM,QAAQ,MAAiB,WAA+B;CAC7D,IAAI,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,EAAE;CACrE,IAAI,KAAK,SAAS,MACjB,OAAO,SAAS,KAAK;CAEtB,IAAI,KAAK,SAAS,MACjB,OAAO,WAAW,KAAK;CAExB,IAAI,KAAK,WAAW,MACnB,OAAO,OAAO,KAAK;CAEpB,IAAI,KAAK,cAAc,MACtB,OAAO,MAAM,KAAK;CAEnB,OAAO;AACR;AAEA,MAAM,iBAAiB,MAAe,WAA+B;CACpE,IAAI,QAAQ,QAAQ,OAAO,SAAS,UACnC,OAAO;CAER,MAAM,YAAY;CAClB,IAAI,OAAO,UAAU,SAAS,UAC7B,OAAO,KAAK,WAAW,MAAM;CAE9B,MAAM,WAAW,MAAM,QAAQ,UAAU,QAAQ,IAC9C,UAAU,SAAS,KAAK,UAAU,cAAc,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,IACvE;CACH,IAAI,UAAU,SAAS,QAAQ;EAC9B,MAAM,MAAM,OAAO,UAAU,QAAQ,WAAW,UAAU,MAAM;EAEhE,OAAO,YADM,WAAW,YAAY,OAAO,YAAY,GAAG,CAAC,CACrC,EAAE,IAAI,SAAS;CACtC;CACA,OAAO,MAAM,SAAS;AACvB;;;;;AAMA,MAAa,kBAAkB,OAAkB,WAChD,MAAM,KAAK,SAAS,cAAc,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE"}

package/dist/actions/body/wildcards.d.ts

@@ -0,0 +1,10 @@
+import { SubmissionDescriptor, SubmissionValue } from "../../submissions/types.js";
+
+//#region src/actions/body/wildcards.d.ts
+/** All answers as HTML-escaped `Label: value` lines joined with `<br />`. */
+declare const renderAllValues: (values: SubmissionValue[], descriptors: SubmissionDescriptor[]) => string;
+/** All answers as a simple HTML-escaped two-column table. */
+declare const renderAllValuesTable: (values: SubmissionValue[], descriptors: SubmissionDescriptor[]) => string;
+//#endregion
+export { renderAllValues, renderAllValuesTable };
+//# sourceMappingURL=wildcards.d.ts.map

package/dist/actions/body/wildcards.js

@@ -0,0 +1,33 @@
+import { escapeHtml } from "./escapeHtml.js";
+//#region src/actions/body/wildcards.ts
+const displayValue = (value, descriptor) => {
+	if (value == null) return "";
+	if (Array.isArray(value)) return value.map((entry) => displayValue(entry, descriptor)).join(", ");
+	const raw = typeof value === "object" ? JSON.stringify(value) : String(value);
+	return descriptor?.optionLabels?.[raw] ?? raw;
+};
+/**
+* Descriptors are the submit-time snapshot of real form fields, so when present they gate which
+* values render (internal keys like the honeypot never get a descriptor). Legacy rows without
+* descriptors fall back to rendering every value under its field name.
+*/
+const rowsOf = (values, descriptors) => {
+	const byField = new Map(descriptors.map((descriptor) => [descriptor.field, descriptor]));
+	return (byField.size > 0 ? values.filter((value) => byField.has(value.field)) : values).map((entry) => {
+		const descriptor = byField.get(entry.field);
+		return {
+			label: descriptor?.label ?? entry.field,
+			value: displayValue(entry.value, descriptor)
+		};
+	});
+};
+/** All answers as HTML-escaped `Label: value` lines joined with `<br />`. */
+const renderAllValues = (values, descriptors) => rowsOf(values, descriptors).map((row) => `${escapeHtml(row.label)}: ${escapeHtml(row.value)}`).join("<br />");
+/** All answers as a simple HTML-escaped two-column table. */
+const renderAllValuesTable = (values, descriptors) => {
+	return `<table><tbody>${rowsOf(values, descriptors).map((row) => `<tr><td>${escapeHtml(row.label)}</td><td>${escapeHtml(row.value)}</td></tr>`).join("")}</tbody></table>`;
+};
+//#endregion
+export { renderAllValues, renderAllValuesTable };
+
+//# sourceMappingURL=wildcards.js.map

package/dist/actions/body/wildcards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wildcards.js","names":[],"sources":["../../../src/actions/body/wildcards.ts"],"sourcesContent":["import type { SubmissionDescriptor, SubmissionValue } from '../../submissions/types'\nimport { escapeHtml } from './escapeHtml'\n\ntype Row = { label: string; value: string }\n\nconst displayValue = (value: unknown, descriptor?: SubmissionDescriptor): string => {\n\tif (value == null) {\n\t\treturn ''\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((entry) => displayValue(entry, descriptor)).join(', ')\n\t}\n\tconst raw = typeof value === 'object' ? JSON.stringify(value) : String(value)\n\treturn descriptor?.optionLabels?.[raw] ?? raw\n}\n\n/**\n * Descriptors are the submit-time snapshot of real form fields, so when present they gate which\n * values render (internal keys like the honeypot never get a descriptor). Legacy rows without\n * descriptors fall back to rendering every value under its field name.\n */\nconst rowsOf = (values: SubmissionValue[], descriptors: SubmissionDescriptor[]): Row[] => {\n\tconst byField = new Map(descriptors.map((descriptor) => [descriptor.field, descriptor]))\n\tconst included = byField.size > 0 ? values.filter((value) => byField.has(value.field)) : values\n\treturn included.map((entry) => {\n\t\tconst descriptor = byField.get(entry.field)\n\t\treturn { label: descriptor?.label ?? entry.field, value: displayValue(entry.value, descriptor) }\n\t})\n}\n\n/** All answers as HTML-escaped `Label: value` lines joined with `<br />`. */\nexport const renderAllValues = (\n\tvalues: SubmissionValue[],\n\tdescriptors: SubmissionDescriptor[]\n): string =>\n\trowsOf(values, descriptors)\n\t\t.map((row) => `${escapeHtml(row.label)}: ${escapeHtml(row.value)}`)\n\t\t.join('<br />')\n\n/** All answers as a simple HTML-escaped two-column table. */\nexport const renderAllValuesTable = (\n\tvalues: SubmissionValue[],\n\tdescriptors: SubmissionDescriptor[]\n): string => {\n\tconst rows = rowsOf(values, descriptors)\n\t\t.map((row) => `<tr><td>${escapeHtml(row.label)}</td><td>${escapeHtml(row.value)}</td></tr>`)\n\t\t.join('')\n\treturn `<table><tbody>${rows}</tbody></table>`\n}\n"],"mappings":";;AAKA,MAAM,gBAAgB,OAAgB,eAA8C;CACnF,IAAI,SAAS,MACZ,OAAO;CAER,IAAI,MAAM,QAAQ,KAAK,GACtB,OAAO,MAAM,KAAK,UAAU,aAAa,OAAO,UAAU,CAAC,EAAE,KAAK,IAAI;CAEvE,MAAM,MAAM,OAAO,UAAU,WAAW,KAAK,UAAU,KAAK,IAAI,OAAO,KAAK;CAC5E,OAAO,YAAY,eAAe,QAAQ;AAC3C;;;;;;AAOA,MAAM,UAAU,QAA2B,gBAA+C;CACzF,MAAM,UAAU,IAAI,IAAI,YAAY,KAAK,eAAe,CAAC,WAAW,OAAO,UAAU,CAAC,CAAC;CAEvF,QADiB,QAAQ,OAAO,IAAI,OAAO,QAAQ,UAAU,QAAQ,IAAI,MAAM,KAAK,CAAC,IAAI,QACzE,KAAK,UAAU;EAC9B,MAAM,aAAa,QAAQ,IAAI,MAAM,KAAK;EAC1C,OAAO;GAAE,OAAO,YAAY,SAAS,MAAM;GAAO,OAAO,aAAa,MAAM,OAAO,UAAU;EAAE;CAChG,CAAC;AACF;;AAGA,MAAa,mBACZ,QACA,gBAEA,OAAO,QAAQ,WAAW,EACxB,KAAK,QAAQ,GAAG,WAAW,IAAI,KAAK,EAAE,IAAI,WAAW,IAAI,KAAK,GAAG,EACjE,KAAK,QAAQ;;AAGhB,MAAa,wBACZ,QACA,gBACY;CAIZ,OAAO,iBAHM,OAAO,QAAQ,WAAW,EACrC,KAAK,QAAQ,WAAW,WAAW,IAAI,KAAK,EAAE,WAAW,WAAW,IAAI,KAAK,EAAE,WAAW,EAC1F,KAAK,EACoB,EAAE;AAC9B"}

package/dist/actions/builtin/confirmation.js

@@ -1,41 +1,65 @@
+import { fieldNamesOfType } from "../../fields/fieldNamesOfType.js";
+import { localizedIf } from "../../fields/localizedIf.js";
 import { interpolate } from "../../recall/interpolate.js";
 import { keys } from "../../translations/keys.js";
-import { labelFor } from "../../translations/server.js";
+import { asTranslate, labelFor } from "../../translations/server.js";
+import { resolverFor } from "../body/serializeBody.js";
 import { defineAction } from "../defineAction.js";
 //#region src/actions/builtin/confirmation.ts
-const confirmation = defineAction({
+const TO_FIELD_REF = "@10x-media/form-builder/client#FieldNameSelect";
+/**
+* Validates the confirmation action's `toField`: unset is fine, otherwise it must name an
+* existing `email`-type field on the form. Exported for unit testing.
+*/
+const validateToField = (value, { data, req }) => {
+	if (typeof value !== "string" || value.length === 0) return true;
+	return fieldNamesOfType(data && typeof data === "object" ? data.fields : void 0, ["email"]).includes(value) ? true : asTranslate(req.t)(keys.validationEmailFieldUnknown);
+};
+/**
+* `subject` and `body` are email content and follow `localize`; `toField` is an identifier and never does.
+* `editor` overrides the body field's Lexical/richText editor (from the plugin's `richText.editor` option).
+*/
+const buildConfirmation = (localize, editor) => defineAction({
 	type: "confirmation",
 	label: keys.actionConfirmation,
 	config: [
 		{
 			name: "toField",
 			type: "text",
-			label: labelFor(keys.actionConfigToField)
+			label: labelFor(keys.actionConfigToField),
+			admin: {
+				description: labelFor(keys.actionConfigToFieldDescription),
+				components: { Field: {
+					path: TO_FIELD_REF,
+					clientProps: { types: ["email"] }
+				} }
+			},
+			validate: validateToField
 		},
 		{
 			name: "subject",
 			type: "text",
-			label: labelFor(keys.actionConfigSubject)
+			label: labelFor(keys.actionConfigSubject),
+			...localizedIf(localize)
 		},
 		{
 			name: "body",
-			type: "textarea",
-			label: labelFor(keys.actionConfigBody)
+			type: "richText",
+			label: labelFor(keys.actionConfigBody),
+			admin: { description: labelFor(keys.actionConfigBodyDescription) },
+			...localizedIf(localize),
+			...editor ? { editor } : {}
 		}
 	],
 	run: async (args) => {
-		const { config, values, payload } = args;
+		const { config, values, payload, renderBody } = args;
 		if (!config.toField) return;
-		const entry = values.find((v) => v.field === config.toField);
-		const to = entry == null ? "" : String(entry.value ?? "");
+		const resolve = resolverFor(values);
+		const to = resolve(config.toField);
 		if (!to) return;
 		if (typeof payload.sendEmail !== "function") throw new Error("confirmation: no email adapter configured");
-		const resolve = (name) => {
-			const found = values.find((v) => v.field === name);
-			return found == null ? "" : String(found.value ?? "");
-		};
 		const subject = interpolate(config.subject ?? "", resolve);
-		const html = interpolate(config.body ?? "", resolve);
+		const html = await renderBody(config.body);
 		await payload.sendEmail({
 			to,
 			subject,
@@ -43,7 +67,8 @@ const confirmation = defineAction({
 		});
 	}
 });
+buildConfirmation(true);
 //#endregion
-export { confirmation };
+export { buildConfirmation };
 
 //# sourceMappingURL=confirmation.js.map

package/dist/actions/builtin/confirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirmation.js","names":[],"sources":["../../../src/actions/builtin/confirmation.ts"],"sourcesContent":["import { interpolate } from '../../recall/interpolate'\nimport { keys } from '../../translations/keys'\nimport { labelFor } from '../../translations/server'\nimport { defineAction } from '../defineAction'\n\ntype ConfirmationConfig = { toField?: string; subject?: string; body?: string }\n\nexport const confirmation = defineAction<ConfirmationConfig>({\n\ttype: 'confirmation',\n\tlabel: keys.actionConfirmation,\n\tconfig: [\n\t\t{ name: 'toField', type: 'text', label: labelFor(keys.actionConfigToField) },\n\t\t{ name: 'subject', type: 'text', label: labelFor(keys.actionConfigSubject) },\n\t\t{ name: 'body', type: 'textarea', label: labelFor(keys.actionConfigBody) },\n\t],\n\trun: async (args) => {\n\t\tconst { config, values, payload } = args\n\n\t\tif (!config.toField) {\n\t\t\treturn\n\t\t}\n\n\t\tconst entry = values.find((v) => v.field === config.toField)\n\t\tconst to = entry == null ? '' : String(entry.value ?? '')\n\n\t\tif (!to) {\n\t\t\treturn\n\t\t}\n\n\t\tif (typeof payload.sendEmail !== 'function') {\n\t\t\tthrow new Error('confirmation: no email adapter configured')\n\t\t}\n\n\t\tconst resolve = (name: string) => {\n\t\t\tconst found = values.find((v) => v.field === name)\n\t\t\treturn found == null ? '' : String(found.value ?? '')\n\t\t}\n\n\t\tconst subject = interpolate(config.subject ?? '', resolve)\n\t\tconst html = interpolate(config.body ?? '', resolve)\n\n\t\tawait payload.sendEmail({ to, subject, html })\n\t},\n})\n"],"mappings":";;;;;AAOA,MAAa,eAAe,aAAiC;CAC5D,MAAM;CACN,OAAO,KAAK;CACZ,QAAQ;EACP;GAAE,MAAM;GAAW,MAAM;GAAQ,OAAO,SAAS,KAAK,mBAAmB;EAAE;EAC3E;GAAE,MAAM;GAAW,MAAM;GAAQ,OAAO,SAAS,KAAK,mBAAmB;EAAE;EAC3E;GAAE,MAAM;GAAQ,MAAM;GAAY,OAAO,SAAS,KAAK,gBAAgB;EAAE;CAC1E;CACA,KAAK,OAAO,SAAS;EACpB,MAAM,EAAE,QAAQ,QAAQ,YAAY;EAEpC,IAAI,CAAC,OAAO,SACX;EAGD,MAAM,QAAQ,OAAO,MAAM,MAAM,EAAE,UAAU,OAAO,OAAO;EAC3D,MAAM,KAAK,SAAS,OAAO,KAAK,OAAO,MAAM,SAAS,EAAE;EAExD,IAAI,CAAC,IACJ;EAGD,IAAI,OAAO,QAAQ,cAAc,YAChC,MAAM,IAAI,MAAM,2CAA2C;EAG5D,MAAM,WAAW,SAAiB;GACjC,MAAM,QAAQ,OAAO,MAAM,MAAM,EAAE,UAAU,IAAI;GACjD,OAAO,SAAS,OAAO,KAAK,OAAO,MAAM,SAAS,EAAE;EACrD;EAEA,MAAM,UAAU,YAAY,OAAO,WAAW,IAAI,OAAO;EACzD,MAAM,OAAO,YAAY,OAAO,QAAQ,IAAI,OAAO;EAEnD,MAAM,QAAQ,UAAU;GAAE;GAAI;GAAS;EAAK,CAAC;CAC9C;AACD,CAAC"}
+{"version":3,"file":"confirmation.js","names":[],"sources":["../../../src/actions/builtin/confirmation.ts"],"sourcesContent":["import type { PayloadRequest, RichTextField } from 'payload'\nimport { fieldNamesOfType } from '../../fields/fieldNamesOfType'\nimport { localizedIf } from '../../fields/localizedIf'\nimport { interpolate } from '../../recall/interpolate'\nimport { keys } from '../../translations/keys'\nimport { asTranslate, labelFor } from '../../translations/server'\nimport { resolverFor } from '../body/serializeBody'\nimport { defineAction } from '../defineAction'\n\ntype ConfirmationConfig = { toField?: string; subject?: string; body?: unknown }\n\nconst TO_FIELD_REF = '@10x-media/form-builder/client#FieldNameSelect'\n\n/**\n * Validates the confirmation action's `toField`: unset is fine, otherwise it must name an\n * existing `email`-type field on the form. Exported for unit testing.\n */\nexport const validateToField = (\n\tvalue: unknown,\n\t{ data, req }: { data?: unknown; req: PayloadRequest }\n): string | true => {\n\tif (typeof value !== 'string' || value.length === 0) {\n\t\treturn true\n\t}\n\tconst fields =\n\t\tdata && typeof data === 'object' ? (data as Record<string, unknown>).fields : undefined\n\treturn fieldNamesOfType(fields, ['email']).includes(value)\n\t\t? true\n\t\t: asTranslate(req.t)(keys.validationEmailFieldUnknown)\n}\n\n/**\n * `subject` and `body` are email content and follow `localize`; `toField` is an identifier and never does.\n * `editor` overrides the body field's Lexical/richText editor (from the plugin's `richText.editor` option).\n */\nexport const buildConfirmation = (localize: boolean, editor?: RichTextField['editor']) =>\n\tdefineAction<ConfirmationConfig>({\n\t\ttype: 'confirmation',\n\t\tlabel: keys.actionConfirmation,\n\t\tconfig: [\n\t\t\t{\n\t\t\t\tname: 'toField',\n\t\t\t\ttype: 'text',\n\t\t\t\tlabel: labelFor(keys.actionConfigToField),\n\t\t\t\tadmin: {\n\t\t\t\t\tdescription: labelFor(keys.actionConfigToFieldDescription),\n\t\t\t\t\tcomponents: { Field: { path: TO_FIELD_REF, clientProps: { types: ['email'] } } },\n\t\t\t\t},\n\t\t\t\tvalidate: validateToField,\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'subject',\n\t\t\t\ttype: 'text',\n\t\t\t\tlabel: labelFor(keys.actionConfigSubject),\n\t\t\t\t...localizedIf(localize),\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'body',\n\t\t\t\ttype: 'richText',\n\t\t\t\tlabel: labelFor(keys.actionConfigBody),\n\t\t\t\tadmin: { description: labelFor(keys.actionConfigBodyDescription) },\n\t\t\t\t...localizedIf(localize),\n\t\t\t\t...(editor ? { editor } : {}),\n\t\t\t},\n\t\t],\n\t\trun: async (args) => {\n\t\t\tconst { config, values, payload, renderBody } = args\n\n\t\t\tif (!config.toField) {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tconst resolve = resolverFor(values)\n\t\t\tconst to = resolve(config.toField)\n\n\t\t\tif (!to) {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tif (typeof payload.sendEmail !== 'function') {\n\t\t\t\tthrow new Error('confirmation: no email adapter configured')\n\t\t\t}\n\n\t\t\tconst subject = interpolate(config.subject ?? '', resolve)\n\t\t\tconst html = await renderBody(config.body)\n\n\t\t\tawait payload.sendEmail({ to, subject, html })\n\t\t},\n\t})\n\nexport const confirmation = buildConfirmation(true)\n"],"mappings":";;;;;;;;AAWA,MAAM,eAAe;;;;;AAMrB,MAAa,mBACZ,OACA,EAAE,MAAM,UACW;CACnB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GACjD,OAAO;CAIR,OAAO,iBADN,QAAQ,OAAO,SAAS,WAAY,KAAiC,SAAS,KAAA,GAC/C,CAAC,OAAO,CAAC,EAAE,SAAS,KAAK,IACtD,OACA,YAAY,IAAI,CAAC,EAAE,KAAK,2BAA2B;AACvD;;;;;AAMA,MAAa,qBAAqB,UAAmB,WACpD,aAAiC;CAChC,MAAM;CACN,OAAO,KAAK;CACZ,QAAQ;EACP;GACC,MAAM;GACN,MAAM;GACN,OAAO,SAAS,KAAK,mBAAmB;GACxC,OAAO;IACN,aAAa,SAAS,KAAK,8BAA8B;IACzD,YAAY,EAAE,OAAO;KAAE,MAAM;KAAc,aAAa,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,EAAE;GAChF;GACA,UAAU;EACX;EACA;GACC,MAAM;GACN,MAAM;GACN,OAAO,SAAS,KAAK,mBAAmB;GACxC,GAAG,YAAY,QAAQ;EACxB;EACA;GACC,MAAM;GACN,MAAM;GACN,OAAO,SAAS,KAAK,gBAAgB;GACrC,OAAO,EAAE,aAAa,SAAS,KAAK,2BAA2B,EAAE;GACjE,GAAG,YAAY,QAAQ;GACvB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC5B;CACD;CACA,KAAK,OAAO,SAAS;EACpB,MAAM,EAAE,QAAQ,QAAQ,SAAS,eAAe;EAEhD,IAAI,CAAC,OAAO,SACX;EAGD,MAAM,UAAU,YAAY,MAAM;EAClC,MAAM,KAAK,QAAQ,OAAO,OAAO;EAEjC,IAAI,CAAC,IACJ;EAGD,IAAI,OAAO,QAAQ,cAAc,YAChC,MAAM,IAAI,MAAM,2CAA2C;EAG5D,MAAM,UAAU,YAAY,OAAO,WAAW,IAAI,OAAO;EACzD,MAAM,OAAO,MAAM,WAAW,OAAO,IAAI;EAEzC,MAAM,QAAQ,UAAU;GAAE;GAAI;GAAS;EAAK,CAAC;CAC9C;AACD,CAAC;AAE0B,kBAAkB,IAAI"}