@10x-media/form-builder 0.1.0-beta.5 → 0.1.0-beta.7

package/dist/uploads/captureFileRef.js.map

@@ -1 +1 @@
-{"version":3,"file":"captureFileRef.js","names":[],"sources":["../../src/uploads/captureFileRef.ts"],"sourcesContent":["import type { CollectionSlug, Payload, PayloadRequest } from 'payload'\nimport { type ResolveFileRefResult, resolveFileRef } from './resolveFileRef'\nimport type { FileFieldConfig } from './types'\n\nexport type CaptureFileRefArgs = {\n\tpayload: Payload\n\tcollectionSlug: string\n\tuploadId: string | number\n\tconfig: FileFieldConfig\n\treq?: PayloadRequest\n\t/** Resolved submitter identity; must match the upload's `owner` stamp when both are present. */\n\texpectedOwner?: string\n}\n\n/**\n * Load the referenced upload doc and run the pure trust-boundary check. The client sends only the id; the\n * filename/mimeType/filesize are read authoritatively from the stored doc, never from the client. When the\n * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous\n * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable\n * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not\n * enforced (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies every\n * request, so this only relaxes scoping where it could not be applied fairly anyway. Unstamped uploads\n * (no identity at upload time, or a BYO collection without the field) pass unchanged.\n */\nexport const captureFileRef = async (args: CaptureFileRefArgs): Promise<ResolveFileRefResult> => {\n\tconst { payload, collectionSlug, uploadId, config, req, expectedOwner } = args\n\tconst doc = await payload\n\t\t.findByID({\n\t\t\tcollection: collectionSlug as CollectionSlug,\n\t\t\tid: uploadId,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\t.catch(() => null)\n\tif (doc && expectedOwner != null) {\n\t\tconst owner = (doc as { owner?: unknown }).owner\n\t\tif (typeof owner === 'string' && owner.length > 0 && owner !== expectedOwner) {\n\t\t\treturn { ok: false, code: 'missing' }\n\t\t}\n\t}\n\treturn resolveFileRef(doc, config)\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAa,iBAAiB,OAAO,SAA4D;CAChG,MAAM,EAAE,SAAS,gBAAgB,UAAU,QAAQ,KAAK,kBAAkB;CAC1E,MAAM,MAAM,MAAM,QAChB,SAAS;EACT,YAAY;EACZ,IAAI;EACJ,OAAO;EACP,gBAAgB;EAChB;CACD,CAAC,EACA,YAAY,IAAI;CAClB,IAAI,OAAO,iBAAiB,MAAM;EACjC,MAAM,QAAS,IAA4B;EAC3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,UAAU,eAC9D,OAAO;GAAE,IAAI;GAAO,MAAM;EAAU;CAEtC;CACA,OAAO,eAAe,KAAK,MAAM;AAClC"}
+{"version":3,"file":"captureFileRef.js","names":[],"sources":["../../src/uploads/captureFileRef.ts"],"sourcesContent":["import type { CollectionSlug, Payload, PayloadRequest } from 'payload'\nimport { type ResolveFileRefResult, resolveFileRef } from './resolveFileRef'\nimport type { FileFieldConfig } from './types'\n\nexport type CaptureFileRefArgs = {\n\tpayload: Payload\n\tcollectionSlug: string\n\tuploadId: string | number\n\tconfig: FileFieldConfig\n\treq?: PayloadRequest\n\t/** Resolved submitter identity; must match the upload's `owner` stamp when both are present. */\n\texpectedOwner?: string\n\t/**\n\t * Fail closed when a stamped upload's submitter cannot be identified (plugin `spam.uploadOwnership:\n\t * 'strict'`). Default lenient: an unidentifiable submitter passes an owned upload through.\n\t */\n\tstrict?: boolean\n}\n\n/**\n * Load the referenced upload doc and run the pure trust-boundary check. The client sends only the id; the\n * filename/mimeType/filesize are read authoritatively from the stored doc, never from the client. When the\n * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous\n * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable\n * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not\n * enforced by default (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies\n * every request, so this only relaxes scoping where it could not be applied fairly anyway. Under `strict`\n * (plugin `spam.uploadOwnership: 'strict'`) a stamped upload is rejected even then, so an unverifiable\n * claim can never capture an owned upload. Unstamped uploads (no identity at upload time, or a BYO\n * collection without the field) pass unchanged in either mode.\n */\nexport const captureFileRef = async (args: CaptureFileRefArgs): Promise<ResolveFileRefResult> => {\n\tconst { payload, collectionSlug, uploadId, config, req, expectedOwner, strict } = args\n\tconst doc = await payload\n\t\t.findByID({\n\t\t\tcollection: collectionSlug as CollectionSlug,\n\t\t\tid: uploadId,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\t.catch(() => null)\n\tif (doc) {\n\t\tconst owner = (doc as { owner?: unknown }).owner\n\t\tconst stamped = typeof owner === 'string' && owner.length > 0\n\t\tif (stamped) {\n\t\t\tif (expectedOwner == null) {\n\t\t\t\tif (strict) {\n\t\t\t\t\treturn { ok: false, code: 'missing' }\n\t\t\t\t}\n\t\t\t} else if (owner !== expectedOwner) {\n\t\t\t\treturn { ok: false, code: 'missing' }\n\t\t\t}\n\t\t}\n\t}\n\treturn resolveFileRef(doc, config)\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,MAAa,iBAAiB,OAAO,SAA4D;CAChG,MAAM,EAAE,SAAS,gBAAgB,UAAU,QAAQ,KAAK,eAAe,WAAW;CAClF,MAAM,MAAM,MAAM,QAChB,SAAS;EACT,YAAY;EACZ,IAAI;EACJ,OAAO;EACP,gBAAgB;EAChB;CACD,CAAC,EACA,YAAY,IAAI;CAClB,IAAI,KAAK;EACR,MAAM,QAAS,IAA4B;EAE3C,IADgB,OAAO,UAAU,YAAY,MAAM,SAAS;OAEvD,iBAAiB;QAChB,QACH,OAAO;KAAE,IAAI;KAAO,MAAM;IAAU;GAAA,OAE/B,IAAI,UAAU,eACpB,OAAO;IAAE,IAAI;IAAO,MAAM;GAAU;EAAA;CAGvC;CACA,OAAO,eAAe,KAAK,MAAM;AAClC"}

package/dist/uploads/resolveFileRef.js

@@ -1,4 +1,5 @@
 //#region src/uploads/resolveFileRef.ts
+/** Whether `mimeType` matches an `allow` list of exact strings or trailing-`*` prefix wildcards; empty allows all. */
 const mimeAllowed = (mimeType, allow) => {
 	if (!allow || allow.length === 0) return true;
 	return allow.some((pattern) => {
@@ -39,6 +40,6 @@ const resolveFileRef = (doc, config) => {
 	};
 };
 //#endregion
-export { resolveFileRef };
+export { mimeAllowed, resolveFileRef };
 
 //# sourceMappingURL=resolveFileRef.js.map

package/dist/uploads/resolveFileRef.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveFileRef.js","names":[],"sources":["../../src/uploads/resolveFileRef.ts"],"sourcesContent":["import type { FileFieldConfig, FileRef, FileRefError } from './types'\n\ntype UploadDoc = {\n\tid?: string | number\n\tfilename?: unknown\n\tmimeType?: unknown\n\tfilesize?: unknown\n\turl?: unknown\n}\n\nexport type ResolveFileRefResult = { ok: true; ref: FileRef } | { ok: false; code: FileRefError }\n\nconst mimeAllowed = (mimeType: string, allow: string[] | undefined): boolean => {\n\tif (!allow || allow.length === 0) {\n\t\treturn true\n\t}\n\treturn allow.some((pattern) => {\n\t\tif (pattern.endsWith('*')) {\n\t\t\treturn mimeType.startsWith(pattern.slice(0, -1))\n\t\t}\n\t\treturn mimeType === pattern\n\t})\n}\n\n/**\n * Pure server trust-boundary check for an uploaded file: given the loaded upload doc (or null) and the\n * field's constraints, either return an authoritative `FileRef` snapshot or a rejection code. Never trusts\n * client metadata; the caller passes the doc it loaded from the upload collection.\n */\nexport const resolveFileRef = (\n\tdoc: UploadDoc | null | undefined,\n\tconfig: FileFieldConfig\n): ResolveFileRefResult => {\n\tif (doc == null || doc.id == null) {\n\t\treturn { ok: false, code: 'missing' }\n\t}\n\tconst mimeType = typeof doc.mimeType === 'string' ? doc.mimeType : ''\n\tconst filesize = typeof doc.filesize === 'number' ? doc.filesize : 0\n\tif (!mimeAllowed(mimeType, config.mimeTypes)) {\n\t\treturn { ok: false, code: 'mimeType' }\n\t}\n\tif (typeof config.maxSize === 'number' && filesize > config.maxSize) {\n\t\treturn { ok: false, code: 'tooLarge' }\n\t}\n\tconst ref: FileRef = {\n\t\tid: doc.id,\n\t\tfilename: typeof doc.filename === 'string' ? doc.filename : '',\n\t\tmimeType,\n\t\tfilesize,\n\t}\n\tif (typeof doc.url === 'string' && doc.url.length > 0) {\n\t\tref.url = doc.url\n\t}\n\treturn { ok: true, ref }\n}\n"],"mappings":";AAYA,MAAM,eAAe,UAAkB,UAAyC;CAC/E,IAAI,CAAC,SAAS,MAAM,WAAW,GAC9B,OAAO;CAER,OAAO,MAAM,MAAM,YAAY;EAC9B,IAAI,QAAQ,SAAS,GAAG,GACvB,OAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAEhD,OAAO,aAAa;CACrB,CAAC;AACF;;;;;;AAOA,MAAa,kBACZ,KACA,WAC0B;CAC1B,IAAI,OAAO,QAAQ,IAAI,MAAM,MAC5B,OAAO;EAAE,IAAI;EAAO,MAAM;CAAU;CAErC,MAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;CACnE,MAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;CACnE,IAAI,CAAC,YAAY,UAAU,OAAO,SAAS,GAC1C,OAAO;EAAE,IAAI;EAAO,MAAM;CAAW;CAEtC,IAAI,OAAO,OAAO,YAAY,YAAY,WAAW,OAAO,SAC3D,OAAO;EAAE,IAAI;EAAO,MAAM;CAAW;CAEtC,MAAM,MAAe;EACpB,IAAI,IAAI;EACR,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;EAC5D;EACA;CACD;CACA,IAAI,OAAO,IAAI,QAAQ,YAAY,IAAI,IAAI,SAAS,GACnD,IAAI,MAAM,IAAI;CAEf,OAAO;EAAE,IAAI;EAAM;CAAI;AACxB"}
+{"version":3,"file":"resolveFileRef.js","names":[],"sources":["../../src/uploads/resolveFileRef.ts"],"sourcesContent":["import type { FileFieldConfig, FileRef, FileRefError } from './types'\n\ntype UploadDoc = {\n\tid?: string | number\n\tfilename?: unknown\n\tmimeType?: unknown\n\tfilesize?: unknown\n\turl?: unknown\n}\n\nexport type ResolveFileRefResult = { ok: true; ref: FileRef } | { ok: false; code: FileRefError }\n\n/** Whether `mimeType` matches an `allow` list of exact strings or trailing-`*` prefix wildcards; empty allows all. */\nexport const mimeAllowed = (mimeType: string, allow: string[] | undefined): boolean => {\n\tif (!allow || allow.length === 0) {\n\t\treturn true\n\t}\n\treturn allow.some((pattern) => {\n\t\tif (pattern.endsWith('*')) {\n\t\t\treturn mimeType.startsWith(pattern.slice(0, -1))\n\t\t}\n\t\treturn mimeType === pattern\n\t})\n}\n\n/**\n * Pure server trust-boundary check for an uploaded file: given the loaded upload doc (or null) and the\n * field's constraints, either return an authoritative `FileRef` snapshot or a rejection code. Never trusts\n * client metadata; the caller passes the doc it loaded from the upload collection.\n */\nexport const resolveFileRef = (\n\tdoc: UploadDoc | null | undefined,\n\tconfig: FileFieldConfig\n): ResolveFileRefResult => {\n\tif (doc == null || doc.id == null) {\n\t\treturn { ok: false, code: 'missing' }\n\t}\n\tconst mimeType = typeof doc.mimeType === 'string' ? doc.mimeType : ''\n\tconst filesize = typeof doc.filesize === 'number' ? doc.filesize : 0\n\tif (!mimeAllowed(mimeType, config.mimeTypes)) {\n\t\treturn { ok: false, code: 'mimeType' }\n\t}\n\tif (typeof config.maxSize === 'number' && filesize > config.maxSize) {\n\t\treturn { ok: false, code: 'tooLarge' }\n\t}\n\tconst ref: FileRef = {\n\t\tid: doc.id,\n\t\tfilename: typeof doc.filename === 'string' ? doc.filename : '',\n\t\tmimeType,\n\t\tfilesize,\n\t}\n\tif (typeof doc.url === 'string' && doc.url.length > 0) {\n\t\tref.url = doc.url\n\t}\n\treturn { ok: true, ref }\n}\n"],"mappings":";;AAaA,MAAa,eAAe,UAAkB,UAAyC;CACtF,IAAI,CAAC,SAAS,MAAM,WAAW,GAC9B,OAAO;CAER,OAAO,MAAM,MAAM,YAAY;EAC9B,IAAI,QAAQ,SAAS,GAAG,GACvB,OAAO,SAAS,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAEhD,OAAO,aAAa;CACrB,CAAC;AACF;;;;;;AAOA,MAAa,kBACZ,KACA,WAC0B;CAC1B,IAAI,OAAO,QAAQ,IAAI,MAAM,MAC5B,OAAO;EAAE,IAAI;EAAO,MAAM;CAAU;CAErC,MAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;CACnE,MAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;CACnE,IAAI,CAAC,YAAY,UAAU,OAAO,SAAS,GAC1C,OAAO;EAAE,IAAI;EAAO,MAAM;CAAW;CAEtC,IAAI,OAAO,OAAO,YAAY,YAAY,WAAW,OAAO,SAC3D,OAAO;EAAE,IAAI;EAAO,MAAM;CAAW;CAEtC,MAAM,MAAe;EACpB,IAAI,IAAI;EACR,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;EAC5D;EACA;CACD;CACA,IAAI,OAAO,IAAI,QAAQ,YAAY,IAAI,IAAI,SAAS,GACnD,IAAI,MAAM,IAAI;CAEf,OAAO;EAAE,IAAI;EAAM;CAAI;AACxB"}

package/dist/validation/builtin/email.js

@@ -1,7 +1,7 @@
 import { keys } from "../../translations/keys.js";
+import { EMAIL_PATTERN } from "../emailPattern.js";
 import { defineValidationRule } from "../defineValidationRule.js";
 //#region src/validation/builtin/email.ts
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const emailRule = defineValidationRule({
 	type: "email",
 	label: keys.ruleEmail,

package/dist/validation/builtin/email.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.js","names":[],"sources":["../../../src/validation/builtin/email.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nexport const emailRule = defineValidationRule<Record<string, never>, string>({\n\ttype: 'email',\n\tlabel: keys.ruleEmail,\n\tdescription: keys.ruleEmailDescription,\n\tappliesTo: ['text', 'textarea', 'email'],\n\tdefaultMessage: keys.ruleEmailMessage,\n\tvalidate: ({ value, message }) =>\n\t\tvalue == null || value === '' || EMAIL_PATTERN.test(value) ? true : message(),\n})\n"],"mappings":";;;AAGA,MAAM,gBAAgB;AAEtB,MAAa,YAAY,qBAAoD;CAC5E,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,WAAW;EAAC;EAAQ;EAAY;CAAO;CACvC,gBAAgB,KAAK;CACrB,WAAW,EAAE,OAAO,cACnB,SAAS,QAAQ,UAAU,MAAM,cAAc,KAAK,KAAK,IAAI,OAAO,QAAQ;AAC9E,CAAC"}
+{"version":3,"file":"email.js","names":[],"sources":["../../../src/validation/builtin/email.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\nimport { EMAIL_PATTERN } from '../emailPattern'\n\nexport const emailRule = defineValidationRule<Record<string, never>, string>({\n\ttype: 'email',\n\tlabel: keys.ruleEmail,\n\tdescription: keys.ruleEmailDescription,\n\tappliesTo: ['text', 'textarea', 'email'],\n\tdefaultMessage: keys.ruleEmailMessage,\n\tvalidate: ({ value, message }) =>\n\t\tvalue == null || value === '' || EMAIL_PATTERN.test(value) ? true : message(),\n})\n"],"mappings":";;;;AAIA,MAAa,YAAY,qBAAoD;CAC5E,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,WAAW;EAAC;EAAQ;EAAY;CAAO;CACvC,gBAAgB,KAAK;CACrB,WAAW,EAAE,OAAO,cACnB,SAAS,QAAQ,UAAU,MAAM,cAAc,KAAK,KAAK,IAAI,OAAO,QAAQ;AAC9E,CAAC"}

package/dist/validation/builtin/notAlreadySubmitted.js

@@ -21,6 +21,7 @@ const notAlreadySubmittedRule = defineValidationRule({
 			where: { form: { equals: formId } },
 			limit: SCAN_LIMIT,
 			depth: 0,
+			overrideAccess: true,
 			req
 		})).docs.some((doc) => {
 			return (doc.values ?? []).some((entry) => entry.field === field.name && entry.value === value);

package/dist/validation/builtin/notAlreadySubmitted.js.map

@@ -1 +1 @@
-{"version":3,"file":"notAlreadySubmitted.js","names":[],"sources":["../../../src/validation/builtin/notAlreadySubmitted.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\n\nconst FORM_SUBMISSIONS_SLUG = 'form-submissions'\nconst SCAN_LIMIT = 500\n\n/**\n * Server-only async exemplar: rejects a value already present for the same form. Scans up to\n * `SCAN_LIMIT` recent submissions in JS (the values live in a json column, so a portable DB query is\n * not available); a future phase can add an indexed dedup column for scale.\n */\nexport const notAlreadySubmittedRule = defineValidationRule<Record<string, never>, unknown>({\n\ttype: 'notAlreadySubmitted',\n\tlabel: keys.ruleNotAlreadySubmitted,\n\tdescription: keys.ruleNotAlreadySubmittedDescription,\n\tclient: false,\n\tdefaultMessage: keys.ruleNotAlreadySubmittedMessage,\n\tvalidate: async ({ value, field, payload, req, formId, message }) => {\n\t\tif (value == null || value === '' || !payload || formId == null) {\n\t\t\treturn true\n\t\t}\n\t\tconst result = await payload.find({\n\t\t\tcollection: FORM_SUBMISSIONS_SLUG,\n\t\t\twhere: { form: { equals: formId } },\n\t\t\tlimit: SCAN_LIMIT,\n\t\t\tdepth: 0,\n\t\t\treq,\n\t\t})\n\t\tconst clash = result.docs.some((doc) => {\n\t\t\tconst values = (doc as { values?: { field: string; value: unknown }[] }).values ?? []\n\t\t\treturn values.some((entry) => entry.field === field.name && entry.value === value)\n\t\t})\n\t\treturn clash ? message() : true\n\t},\n})\n"],"mappings":";;;AAGA,MAAM,wBAAwB;AAC9B,MAAM,aAAa;;;;;;AAOnB,MAAa,0BAA0B,qBAAqD;CAC3F,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,QAAQ;CACR,gBAAgB,KAAK;CACrB,UAAU,OAAO,EAAE,OAAO,OAAO,SAAS,KAAK,QAAQ,cAAc;EACpE,IAAI,SAAS,QAAQ,UAAU,MAAM,CAAC,WAAW,UAAU,MAC1D,OAAO;EAaR,QAJc,MAPO,QAAQ,KAAK;GACjC,YAAY;GACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE;GAClC,OAAO;GACP,OAAO;GACP;EACD,CAAC,GACoB,KAAK,MAAM,QAAQ;GAEvC,QADgB,IAAyD,UAAU,CAAC,GACtE,MAAM,UAAU,MAAM,UAAU,MAAM,QAAQ,MAAM,UAAU,KAAK;EAClF,CACW,IAAI,QAAQ,IAAI;CAC5B;AACD,CAAC"}
+{"version":3,"file":"notAlreadySubmitted.js","names":[],"sources":["../../../src/validation/builtin/notAlreadySubmitted.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\n\nconst FORM_SUBMISSIONS_SLUG = 'form-submissions'\nconst SCAN_LIMIT = 500\n\n/**\n * Server-only async exemplar: rejects a value already present for the same form. Scans up to\n * `SCAN_LIMIT` recent submissions in JS (the values live in a json column, so a portable DB query is\n * not available); a future phase can add an indexed dedup column for scale.\n */\nexport const notAlreadySubmittedRule = defineValidationRule<Record<string, never>, unknown>({\n\ttype: 'notAlreadySubmitted',\n\tlabel: keys.ruleNotAlreadySubmitted,\n\tdescription: keys.ruleNotAlreadySubmittedDescription,\n\tclient: false,\n\tdefaultMessage: keys.ruleNotAlreadySubmittedMessage,\n\tvalidate: async ({ value, field, payload, req, formId, message }) => {\n\t\tif (value == null || value === '' || !payload || formId == null) {\n\t\t\treturn true\n\t\t}\n\t\tconst result = await payload.find({\n\t\t\tcollection: FORM_SUBMISSIONS_SLUG,\n\t\t\twhere: { form: { equals: formId } },\n\t\t\tlimit: SCAN_LIMIT,\n\t\t\tdepth: 0,\n\t\t\t// Trusted internal dedup read: scan every prior submission of this form regardless of the\n\t\t\t// submitter's own access. This is the local-API default made explicit, matching the sibling\n\t\t\t// resolvePollOutcome/aggregateResponses reads; the `form` filter keeps it single-tenant.\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\tconst clash = result.docs.some((doc) => {\n\t\t\tconst values = (doc as { values?: { field: string; value: unknown }[] }).values ?? []\n\t\t\treturn values.some((entry) => entry.field === field.name && entry.value === value)\n\t\t})\n\t\treturn clash ? message() : true\n\t},\n})\n"],"mappings":";;;AAGA,MAAM,wBAAwB;AAC9B,MAAM,aAAa;;;;;;AAOnB,MAAa,0BAA0B,qBAAqD;CAC3F,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,QAAQ;CACR,gBAAgB,KAAK;CACrB,UAAU,OAAO,EAAE,OAAO,OAAO,SAAS,KAAK,QAAQ,cAAc;EACpE,IAAI,SAAS,QAAQ,UAAU,MAAM,CAAC,WAAW,UAAU,MAC1D,OAAO;EAiBR,QAJc,MAXO,QAAQ,KAAK;GACjC,YAAY;GACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE;GAClC,OAAO;GACP,OAAO;GAIP,gBAAgB;GAChB;EACD,CAAC,GACoB,KAAK,MAAM,QAAQ;GAEvC,QADgB,IAAyD,UAAU,CAAC,GACtE,MAAM,UAAU,MAAM,UAAU,MAAM,QAAQ,MAAM,UAAU,KAAK;EAClF,CACW,IAAI,QAAQ,IAAI;CAC5B;AACD,CAAC"}

package/dist/validation/emailPattern.js

@@ -0,0 +1,10 @@
+//#region src/validation/emailPattern.ts
+/**
+* The email-format check shared by the `email` field type and the `email` validation rule, so the
+* two never drift. A pragmatic "one @, one dot, no spaces" test, not a full RFC 5322 grammar.
+*/
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+//#endregion
+export { EMAIL_PATTERN };
+
+//# sourceMappingURL=emailPattern.js.map

package/dist/validation/emailPattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailPattern.js","names":[],"sources":["../../src/validation/emailPattern.ts"],"sourcesContent":["/**\n * The email-format check shared by the `email` field type and the `email` validation rule, so the\n * two never drift. A pragmatic \"one @, one dot, no spaces\" test, not a full RFC 5322 grammar.\n */\nexport const EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n"],"mappings":";;;;;AAIA,MAAa,gBAAgB"}

package/dist/validation/registry.d.ts

@@ -1,10 +1,11 @@
+import { RegistryConfig } from "../plugin/applyRegistryConfig.js";
 import { AnyValidationRuleDefinition } from "./types.js";
 
 //#region src/validation/registry.d.ts
 type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>;
 /** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */
 type ValidationRuleOption = boolean | AnyValidationRuleDefinition;
-type ValidationRulesConfig = Record<string, ValidationRuleOption>;
+type ValidationRulesConfig = RegistryConfig<AnyValidationRuleDefinition>;
 //#endregion
 export { ValidationRuleOption, ValidationRuleRegistry, ValidationRulesConfig };
 //# sourceMappingURL=registry.d.ts.map

package/dist/validation/registry.js

@@ -1,3 +1,4 @@
+import { applyRegistryConfig } from "../plugin/applyRegistryConfig.js";
 //#region src/validation/registry.ts
 const buildRuleRegistry = (rules) => {
 	const registry = /* @__PURE__ */ new Map();
@@ -5,15 +6,7 @@ const buildRuleRegistry = (rules) => {
 	return registry;
 };
 /** Resolve the active rule registry from the built-in defaults and the plugin `rules` option. */
-const resolveValidationRules = (defaults, config = {}) => {
-	const registry = buildRuleRegistry(defaults);
-	for (const [type, option] of Object.entries(config)) if (option === false) registry.delete(type);
-	else if (option === true) {} else registry.set(type, {
-		...option,
-		type
-	});
-	return registry;
-};
+const resolveValidationRules = (defaults, config = {}) => applyRegistryConfig(buildRuleRegistry(defaults), config);
 //#endregion
 export { buildRuleRegistry, resolveValidationRules };
 

package/dist/validation/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","names":[],"sources":["../../src/validation/registry.ts"],"sourcesContent":["import type { AnyValidationRuleDefinition } from './types'\n\nexport type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>\n\n/** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */\nexport type ValidationRuleOption = boolean | AnyValidationRuleDefinition\n\nexport type ValidationRulesConfig = Record<string, ValidationRuleOption>\n\nexport const buildRuleRegistry = (rules: AnyValidationRuleDefinition[]): ValidationRuleRegistry => {\n\tconst registry: ValidationRuleRegistry = new Map()\n\tfor (const rule of rules) {\n\t\tregistry.set(rule.type, rule)\n\t}\n\treturn registry\n}\n\n/** Resolve the active rule registry from the built-in defaults and the plugin `rules` option. */\nexport const resolveValidationRules = (\n\tdefaults: AnyValidationRuleDefinition[],\n\tconfig: ValidationRulesConfig = {}\n): ValidationRuleRegistry => {\n\tconst registry = buildRuleRegistry(defaults)\n\tfor (const [type, option] of Object.entries(config)) {\n\t\tif (option === false) {\n\t\t\tregistry.delete(type)\n\t\t} else if (option === true) {\n\t\t\t// keep the default; a no-op when no default exists for this key\n\t\t} else {\n\t\t\tregistry.set(type, { ...option, type })\n\t\t}\n\t}\n\treturn registry\n}\n"],"mappings":";AASA,MAAa,qBAAqB,UAAiE;CAClG,MAAM,2BAAmC,IAAI,IAAI;CACjD,KAAK,MAAM,QAAQ,OAClB,SAAS,IAAI,KAAK,MAAM,IAAI;CAE7B,OAAO;AACR;;AAGA,MAAa,0BACZ,UACA,SAAgC,CAAC,MACL;CAC5B,MAAM,WAAW,kBAAkB,QAAQ;CAC3C,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,MAAM,GACjD,IAAI,WAAW,OACd,SAAS,OAAO,IAAI;MACd,IAAI,WAAW,MAAM,CAE5B,OACC,SAAS,IAAI,MAAM;EAAE,GAAG;EAAQ;CAAK,CAAC;CAGxC,OAAO;AACR"}
+{"version":3,"file":"registry.js","names":[],"sources":["../../src/validation/registry.ts"],"sourcesContent":["import { applyRegistryConfig, type RegistryConfig } from '../plugin/applyRegistryConfig'\nimport type { AnyValidationRuleDefinition } from './types'\n\nexport type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>\n\n/** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */\nexport type ValidationRuleOption = boolean | AnyValidationRuleDefinition\n\nexport type ValidationRulesConfig = RegistryConfig<AnyValidationRuleDefinition>\n\nexport const buildRuleRegistry = (rules: AnyValidationRuleDefinition[]): ValidationRuleRegistry => {\n\tconst registry: ValidationRuleRegistry = new Map()\n\tfor (const rule of rules) {\n\t\tregistry.set(rule.type, rule)\n\t}\n\treturn registry\n}\n\n/** Resolve the active rule registry from the built-in defaults and the plugin `rules` option. */\nexport const resolveValidationRules = (\n\tdefaults: AnyValidationRuleDefinition[],\n\tconfig: ValidationRulesConfig = {}\n): ValidationRuleRegistry => applyRegistryConfig(buildRuleRegistry(defaults), config)\n"],"mappings":";;AAUA,MAAa,qBAAqB,UAAiE;CAClG,MAAM,2BAAmC,IAAI,IAAI;CACjD,KAAK,MAAM,QAAQ,OAClB,SAAS,IAAI,KAAK,MAAM,IAAI;CAE7B,OAAO;AACR;;AAGA,MAAa,0BACZ,UACA,SAAgC,CAAC,MACL,oBAAoB,kBAAkB,QAAQ,GAAG,MAAM"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@10x-media/form-builder",
-  "version": "0.1.0-beta.5",
+  "version": "0.1.0-beta.7",
   "description": "End-to-end forms platform for Payload: author, validate, render, collect, aggregate, and act.",
   "license": "MIT",
   "repository": {
@@ -94,8 +94,8 @@
     "typescript": "5.9.3",
     "vitest": "4.1.7",
     "@10x-media/payload-test-harness": "0.0.0",
-    "@10x-media/tsconfig": "0.0.0",
     "@10x-media/tsdown-config": "0.0.0",
+    "@10x-media/tsconfig": "0.0.0",
     "@10x-media/vitest-config": "0.0.0"
   },
   "publishConfig": {