@10x-media/form-builder 0.1.0-beta.6 → 0.1.0-beta.7

package/dist/uploads/captureFileRef.d.ts

@@ -10,6 +10,11 @@ type CaptureFileRefArgs = {
   config: FileFieldConfig;
   req?: PayloadRequest; /** Resolved submitter identity; must match the upload's `owner` stamp when both are present. */
   expectedOwner?: string;
+  /**
+   * Fail closed when a stamped upload's submitter cannot be identified (plugin `spam.uploadOwnership:
+   * 'strict'`). Default lenient: an unidentifiable submitter passes an owned upload through.
+   */
+  strict?: boolean;
 };
 /**
  * Load the referenced upload doc and run the pure trust-boundary check. The client sends only the id; the
@@ -17,9 +22,11 @@ type CaptureFileRefArgs = {
  * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous
  * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable
  * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not
- * enforced (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies every
- * request, so this only relaxes scoping where it could not be applied fairly anyway. Unstamped uploads
- * (no identity at upload time, or a BYO collection without the field) pass unchanged.
+ * enforced by default (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies
+ * every request, so this only relaxes scoping where it could not be applied fairly anyway. Under `strict`
+ * (plugin `spam.uploadOwnership: 'strict'`) a stamped upload is rejected even then, so an unverifiable
+ * claim can never capture an owned upload. Unstamped uploads (no identity at upload time, or a BYO
+ * collection without the field) pass unchanged in either mode.
  */
 declare const captureFileRef: (args: CaptureFileRefArgs) => Promise<ResolveFileRefResult>;
 //#endregion

package/dist/uploads/captureFileRef.js

@@ -6,12 +6,14 @@ import { resolveFileRef } from "./resolveFileRef.js";
 * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous
 * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable
 * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not
-* enforced (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies every
-* request, so this only relaxes scoping where it could not be applied fairly anyway. Unstamped uploads
-* (no identity at upload time, or a BYO collection without the field) pass unchanged.
+* enforced by default (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies
+* every request, so this only relaxes scoping where it could not be applied fairly anyway. Under `strict`
+* (plugin `spam.uploadOwnership: 'strict'`) a stamped upload is rejected even then, so an unverifiable
+* claim can never capture an owned upload. Unstamped uploads (no identity at upload time, or a BYO
+* collection without the field) pass unchanged in either mode.
 */
 const captureFileRef = async (args) => {
-	const { payload, collectionSlug, uploadId, config, req, expectedOwner } = args;
+	const { payload, collectionSlug, uploadId, config, req, expectedOwner, strict } = args;
 	const doc = await payload.findByID({
 		collection: collectionSlug,
 		id: uploadId,
@@ -19,12 +21,19 @@ const captureFileRef = async (args) => {
 		overrideAccess: true,
 		req
 	}).catch(() => null);
-	if (doc && expectedOwner != null) {
+	if (doc) {
 		const owner = doc.owner;
-		if (typeof owner === "string" && owner.length > 0 && owner !== expectedOwner) return {
-			ok: false,
-			code: "missing"
-		};
+		if (typeof owner === "string" && owner.length > 0) {
+			if (expectedOwner == null) {
+				if (strict) return {
+					ok: false,
+					code: "missing"
+				};
+			} else if (owner !== expectedOwner) return {
+				ok: false,
+				code: "missing"
+			};
+		}
 	}
 	return resolveFileRef(doc, config);
 };

package/dist/uploads/captureFileRef.js.map

@@ -1 +1 @@
-{"version":3,"file":"captureFileRef.js","names":[],"sources":["../../src/uploads/captureFileRef.ts"],"sourcesContent":["import type { CollectionSlug, Payload, PayloadRequest } from 'payload'\nimport { type ResolveFileRefResult, resolveFileRef } from './resolveFileRef'\nimport type { FileFieldConfig } from './types'\n\nexport type CaptureFileRefArgs = {\n\tpayload: Payload\n\tcollectionSlug: string\n\tuploadId: string | number\n\tconfig: FileFieldConfig\n\treq?: PayloadRequest\n\t/** Resolved submitter identity; must match the upload's `owner` stamp when both are present. */\n\texpectedOwner?: string\n}\n\n/**\n * Load the referenced upload doc and run the pure trust-boundary check. The client sends only the id; the\n * filename/mimeType/filesize are read authoritatively from the stored doc, never from the client. When the\n * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous\n * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable\n * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not\n * enforced (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies every\n * request, so this only relaxes scoping where it could not be applied fairly anyway. Unstamped uploads\n * (no identity at upload time, or a BYO collection without the field) pass unchanged.\n */\nexport const captureFileRef = async (args: CaptureFileRefArgs): Promise<ResolveFileRefResult> => {\n\tconst { payload, collectionSlug, uploadId, config, req, expectedOwner } = args\n\tconst doc = await payload\n\t\t.findByID({\n\t\t\tcollection: collectionSlug as CollectionSlug,\n\t\t\tid: uploadId,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\t.catch(() => null)\n\tif (doc && expectedOwner != null) {\n\t\tconst owner = (doc as { owner?: unknown }).owner\n\t\tif (typeof owner === 'string' && owner.length > 0 && owner !== expectedOwner) {\n\t\t\treturn { ok: false, code: 'missing' }\n\t\t}\n\t}\n\treturn resolveFileRef(doc, config)\n}\n"],"mappings":";;;;;;;;;;;;AAwBA,MAAa,iBAAiB,OAAO,SAA4D;CAChG,MAAM,EAAE,SAAS,gBAAgB,UAAU,QAAQ,KAAK,kBAAkB;CAC1E,MAAM,MAAM,MAAM,QAChB,SAAS;EACT,YAAY;EACZ,IAAI;EACJ,OAAO;EACP,gBAAgB;EAChB;CACD,CAAC,EACA,YAAY,IAAI;CAClB,IAAI,OAAO,iBAAiB,MAAM;EACjC,MAAM,QAAS,IAA4B;EAC3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,UAAU,eAC9D,OAAO;GAAE,IAAI;GAAO,MAAM;EAAU;CAEtC;CACA,OAAO,eAAe,KAAK,MAAM;AAClC"}
+{"version":3,"file":"captureFileRef.js","names":[],"sources":["../../src/uploads/captureFileRef.ts"],"sourcesContent":["import type { CollectionSlug, Payload, PayloadRequest } from 'payload'\nimport { type ResolveFileRefResult, resolveFileRef } from './resolveFileRef'\nimport type { FileFieldConfig } from './types'\n\nexport type CaptureFileRefArgs = {\n\tpayload: Payload\n\tcollectionSlug: string\n\tuploadId: string | number\n\tconfig: FileFieldConfig\n\treq?: PayloadRequest\n\t/** Resolved submitter identity; must match the upload's `owner` stamp when both are present. */\n\texpectedOwner?: string\n\t/**\n\t * Fail closed when a stamped upload's submitter cannot be identified (plugin `spam.uploadOwnership:\n\t * 'strict'`). Default lenient: an unidentifiable submitter passes an owned upload through.\n\t */\n\tstrict?: boolean\n}\n\n/**\n * Load the referenced upload doc and run the pure trust-boundary check. The client sends only the id; the\n * filename/mimeType/filesize are read authoritatively from the stored doc, never from the client. When the\n * upload carries an `owner` stamp AND the submitter is identifiable, the two must match, so an anonymous\n * submitter cannot capture another identity's upload; a mismatch collapses to `missing`, indistinguishable\n * from a deleted upload. When the submitter cannot be identified (no `expectedOwner`), ownership is not\n * enforced by default (fail-open, consistent with rate-limiting): a proxy-configured deployment identifies\n * every request, so this only relaxes scoping where it could not be applied fairly anyway. Under `strict`\n * (plugin `spam.uploadOwnership: 'strict'`) a stamped upload is rejected even then, so an unverifiable\n * claim can never capture an owned upload. Unstamped uploads (no identity at upload time, or a BYO\n * collection without the field) pass unchanged in either mode.\n */\nexport const captureFileRef = async (args: CaptureFileRefArgs): Promise<ResolveFileRefResult> => {\n\tconst { payload, collectionSlug, uploadId, config, req, expectedOwner, strict } = args\n\tconst doc = await payload\n\t\t.findByID({\n\t\t\tcollection: collectionSlug as CollectionSlug,\n\t\t\tid: uploadId,\n\t\t\tdepth: 0,\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\t.catch(() => null)\n\tif (doc) {\n\t\tconst owner = (doc as { owner?: unknown }).owner\n\t\tconst stamped = typeof owner === 'string' && owner.length > 0\n\t\tif (stamped) {\n\t\t\tif (expectedOwner == null) {\n\t\t\t\tif (strict) {\n\t\t\t\t\treturn { ok: false, code: 'missing' }\n\t\t\t\t}\n\t\t\t} else if (owner !== expectedOwner) {\n\t\t\t\treturn { ok: false, code: 'missing' }\n\t\t\t}\n\t\t}\n\t}\n\treturn resolveFileRef(doc, config)\n}\n"],"mappings":";;;;;;;;;;;;;;AA+BA,MAAa,iBAAiB,OAAO,SAA4D;CAChG,MAAM,EAAE,SAAS,gBAAgB,UAAU,QAAQ,KAAK,eAAe,WAAW;CAClF,MAAM,MAAM,MAAM,QAChB,SAAS;EACT,YAAY;EACZ,IAAI;EACJ,OAAO;EACP,gBAAgB;EAChB;CACD,CAAC,EACA,YAAY,IAAI;CAClB,IAAI,KAAK;EACR,MAAM,QAAS,IAA4B;EAE3C,IADgB,OAAO,UAAU,YAAY,MAAM,SAAS;OAEvD,iBAAiB;QAChB,QACH,OAAO;KAAE,IAAI;KAAO,MAAM;IAAU;GAAA,OAE/B,IAAI,UAAU,eACpB,OAAO;IAAE,IAAI;IAAO,MAAM;GAAU;EAAA;CAGvC;CACA,OAAO,eAAe,KAAK,MAAM;AAClC"}

package/dist/validation/builtin/email.js

@@ -1,7 +1,7 @@
 import { keys } from "../../translations/keys.js";
+import { EMAIL_PATTERN } from "../emailPattern.js";
 import { defineValidationRule } from "../defineValidationRule.js";
 //#region src/validation/builtin/email.ts
-const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const emailRule = defineValidationRule({
 	type: "email",
 	label: keys.ruleEmail,

package/dist/validation/builtin/email.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.js","names":[],"sources":["../../../src/validation/builtin/email.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nexport const emailRule = defineValidationRule<Record<string, never>, string>({\n\ttype: 'email',\n\tlabel: keys.ruleEmail,\n\tdescription: keys.ruleEmailDescription,\n\tappliesTo: ['text', 'textarea', 'email'],\n\tdefaultMessage: keys.ruleEmailMessage,\n\tvalidate: ({ value, message }) =>\n\t\tvalue == null || value === '' || EMAIL_PATTERN.test(value) ? true : message(),\n})\n"],"mappings":";;;AAGA,MAAM,gBAAgB;AAEtB,MAAa,YAAY,qBAAoD;CAC5E,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,WAAW;EAAC;EAAQ;EAAY;CAAO;CACvC,gBAAgB,KAAK;CACrB,WAAW,EAAE,OAAO,cACnB,SAAS,QAAQ,UAAU,MAAM,cAAc,KAAK,KAAK,IAAI,OAAO,QAAQ;AAC9E,CAAC"}
+{"version":3,"file":"email.js","names":[],"sources":["../../../src/validation/builtin/email.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\nimport { EMAIL_PATTERN } from '../emailPattern'\n\nexport const emailRule = defineValidationRule<Record<string, never>, string>({\n\ttype: 'email',\n\tlabel: keys.ruleEmail,\n\tdescription: keys.ruleEmailDescription,\n\tappliesTo: ['text', 'textarea', 'email'],\n\tdefaultMessage: keys.ruleEmailMessage,\n\tvalidate: ({ value, message }) =>\n\t\tvalue == null || value === '' || EMAIL_PATTERN.test(value) ? true : message(),\n})\n"],"mappings":";;;;AAIA,MAAa,YAAY,qBAAoD;CAC5E,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,WAAW;EAAC;EAAQ;EAAY;CAAO;CACvC,gBAAgB,KAAK;CACrB,WAAW,EAAE,OAAO,cACnB,SAAS,QAAQ,UAAU,MAAM,cAAc,KAAK,KAAK,IAAI,OAAO,QAAQ;AAC9E,CAAC"}

package/dist/validation/builtin/notAlreadySubmitted.js

@@ -21,6 +21,7 @@ const notAlreadySubmittedRule = defineValidationRule({
 			where: { form: { equals: formId } },
 			limit: SCAN_LIMIT,
 			depth: 0,
+			overrideAccess: true,
 			req
 		})).docs.some((doc) => {
 			return (doc.values ?? []).some((entry) => entry.field === field.name && entry.value === value);

package/dist/validation/builtin/notAlreadySubmitted.js.map

@@ -1 +1 @@
-{"version":3,"file":"notAlreadySubmitted.js","names":[],"sources":["../../../src/validation/builtin/notAlreadySubmitted.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\n\nconst FORM_SUBMISSIONS_SLUG = 'form-submissions'\nconst SCAN_LIMIT = 500\n\n/**\n * Server-only async exemplar: rejects a value already present for the same form. Scans up to\n * `SCAN_LIMIT` recent submissions in JS (the values live in a json column, so a portable DB query is\n * not available); a future phase can add an indexed dedup column for scale.\n */\nexport const notAlreadySubmittedRule = defineValidationRule<Record<string, never>, unknown>({\n\ttype: 'notAlreadySubmitted',\n\tlabel: keys.ruleNotAlreadySubmitted,\n\tdescription: keys.ruleNotAlreadySubmittedDescription,\n\tclient: false,\n\tdefaultMessage: keys.ruleNotAlreadySubmittedMessage,\n\tvalidate: async ({ value, field, payload, req, formId, message }) => {\n\t\tif (value == null || value === '' || !payload || formId == null) {\n\t\t\treturn true\n\t\t}\n\t\tconst result = await payload.find({\n\t\t\tcollection: FORM_SUBMISSIONS_SLUG,\n\t\t\twhere: { form: { equals: formId } },\n\t\t\tlimit: SCAN_LIMIT,\n\t\t\tdepth: 0,\n\t\t\treq,\n\t\t})\n\t\tconst clash = result.docs.some((doc) => {\n\t\t\tconst values = (doc as { values?: { field: string; value: unknown }[] }).values ?? []\n\t\t\treturn values.some((entry) => entry.field === field.name && entry.value === value)\n\t\t})\n\t\treturn clash ? message() : true\n\t},\n})\n"],"mappings":";;;AAGA,MAAM,wBAAwB;AAC9B,MAAM,aAAa;;;;;;AAOnB,MAAa,0BAA0B,qBAAqD;CAC3F,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,QAAQ;CACR,gBAAgB,KAAK;CACrB,UAAU,OAAO,EAAE,OAAO,OAAO,SAAS,KAAK,QAAQ,cAAc;EACpE,IAAI,SAAS,QAAQ,UAAU,MAAM,CAAC,WAAW,UAAU,MAC1D,OAAO;EAaR,QAJc,MAPO,QAAQ,KAAK;GACjC,YAAY;GACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE;GAClC,OAAO;GACP,OAAO;GACP;EACD,CAAC,GACoB,KAAK,MAAM,QAAQ;GAEvC,QADgB,IAAyD,UAAU,CAAC,GACtE,MAAM,UAAU,MAAM,UAAU,MAAM,QAAQ,MAAM,UAAU,KAAK;EAClF,CACW,IAAI,QAAQ,IAAI;CAC5B;AACD,CAAC"}
+{"version":3,"file":"notAlreadySubmitted.js","names":[],"sources":["../../../src/validation/builtin/notAlreadySubmitted.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { defineValidationRule } from '../defineValidationRule'\n\nconst FORM_SUBMISSIONS_SLUG = 'form-submissions'\nconst SCAN_LIMIT = 500\n\n/**\n * Server-only async exemplar: rejects a value already present for the same form. Scans up to\n * `SCAN_LIMIT` recent submissions in JS (the values live in a json column, so a portable DB query is\n * not available); a future phase can add an indexed dedup column for scale.\n */\nexport const notAlreadySubmittedRule = defineValidationRule<Record<string, never>, unknown>({\n\ttype: 'notAlreadySubmitted',\n\tlabel: keys.ruleNotAlreadySubmitted,\n\tdescription: keys.ruleNotAlreadySubmittedDescription,\n\tclient: false,\n\tdefaultMessage: keys.ruleNotAlreadySubmittedMessage,\n\tvalidate: async ({ value, field, payload, req, formId, message }) => {\n\t\tif (value == null || value === '' || !payload || formId == null) {\n\t\t\treturn true\n\t\t}\n\t\tconst result = await payload.find({\n\t\t\tcollection: FORM_SUBMISSIONS_SLUG,\n\t\t\twhere: { form: { equals: formId } },\n\t\t\tlimit: SCAN_LIMIT,\n\t\t\tdepth: 0,\n\t\t\t// Trusted internal dedup read: scan every prior submission of this form regardless of the\n\t\t\t// submitter's own access. This is the local-API default made explicit, matching the sibling\n\t\t\t// resolvePollOutcome/aggregateResponses reads; the `form` filter keeps it single-tenant.\n\t\t\toverrideAccess: true,\n\t\t\treq,\n\t\t})\n\t\tconst clash = result.docs.some((doc) => {\n\t\t\tconst values = (doc as { values?: { field: string; value: unknown }[] }).values ?? []\n\t\t\treturn values.some((entry) => entry.field === field.name && entry.value === value)\n\t\t})\n\t\treturn clash ? message() : true\n\t},\n})\n"],"mappings":";;;AAGA,MAAM,wBAAwB;AAC9B,MAAM,aAAa;;;;;;AAOnB,MAAa,0BAA0B,qBAAqD;CAC3F,MAAM;CACN,OAAO,KAAK;CACZ,aAAa,KAAK;CAClB,QAAQ;CACR,gBAAgB,KAAK;CACrB,UAAU,OAAO,EAAE,OAAO,OAAO,SAAS,KAAK,QAAQ,cAAc;EACpE,IAAI,SAAS,QAAQ,UAAU,MAAM,CAAC,WAAW,UAAU,MAC1D,OAAO;EAiBR,QAJc,MAXO,QAAQ,KAAK;GACjC,YAAY;GACZ,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE;GAClC,OAAO;GACP,OAAO;GAIP,gBAAgB;GAChB;EACD,CAAC,GACoB,KAAK,MAAM,QAAQ;GAEvC,QADgB,IAAyD,UAAU,CAAC,GACtE,MAAM,UAAU,MAAM,UAAU,MAAM,QAAQ,MAAM,UAAU,KAAK;EAClF,CACW,IAAI,QAAQ,IAAI;CAC5B;AACD,CAAC"}

package/dist/validation/emailPattern.js

@@ -0,0 +1,10 @@
+//#region src/validation/emailPattern.ts
+/**
+* The email-format check shared by the `email` field type and the `email` validation rule, so the
+* two never drift. A pragmatic "one @, one dot, no spaces" test, not a full RFC 5322 grammar.
+*/
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+//#endregion
+export { EMAIL_PATTERN };
+
+//# sourceMappingURL=emailPattern.js.map

package/dist/validation/emailPattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailPattern.js","names":[],"sources":["../../src/validation/emailPattern.ts"],"sourcesContent":["/**\n * The email-format check shared by the `email` field type and the `email` validation rule, so the\n * two never drift. A pragmatic \"one @, one dot, no spaces\" test, not a full RFC 5322 grammar.\n */\nexport const EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n"],"mappings":";;;;;AAIA,MAAa,gBAAgB"}

package/dist/validation/registry.d.ts

@@ -1,10 +1,11 @@
+import { RegistryConfig } from "../plugin/applyRegistryConfig.js";
 import { AnyValidationRuleDefinition } from "./types.js";
 
 //#region src/validation/registry.d.ts
 type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>;
 /** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */
 type ValidationRuleOption = boolean | AnyValidationRuleDefinition;
-type ValidationRulesConfig = Record<string, ValidationRuleOption>;
+type ValidationRulesConfig = RegistryConfig<AnyValidationRuleDefinition>;
 //#endregion
 export { ValidationRuleOption, ValidationRuleRegistry, ValidationRulesConfig };
 //# sourceMappingURL=registry.d.ts.map

package/dist/validation/registry.js

@@ -1,3 +1,4 @@
+import { applyRegistryConfig } from "../plugin/applyRegistryConfig.js";
 //#region src/validation/registry.ts
 const buildRuleRegistry = (rules) => {
 	const registry = /* @__PURE__ */ new Map();
@@ -5,15 +6,7 @@ const buildRuleRegistry = (rules) => {
 	return registry;
 };
 /** Resolve the active rule registry from the built-in defaults and the plugin `rules` option. */
-const resolveValidationRules = (defaults, config = {}) => {
-	const registry = buildRuleRegistry(defaults);
-	for (const [type, option] of Object.entries(config)) if (option === false) registry.delete(type);
-	else if (option === true) {} else registry.set(type, {
-		...option,
-		type
-	});
-	return registry;
-};
+const resolveValidationRules = (defaults, config = {}) => applyRegistryConfig(buildRuleRegistry(defaults), config);
 //#endregion
 export { buildRuleRegistry, resolveValidationRules };
 

package/dist/validation/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","names":[],"sources":["../../src/validation/registry.ts"],"sourcesContent":["import type { AnyValidationRuleDefinition } from './types'\n\nexport type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>\n\n/** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */\nexport type ValidationRuleOption = boolean | AnyValidationRuleDefinition\n\nexport type ValidationRulesConfig = Record<string, ValidationRuleOption>\n\nexport const buildRuleRegistry = (rules: AnyValidationRuleDefinition[]): ValidationRuleRegistry => {\n\tconst registry: ValidationRuleRegistry = new Map()\n\tfor (const rule of rules) {\n\t\tregistry.set(rule.type, rule)\n\t}\n\treturn registry\n}\n\n/** Resolve the active rule registry from the built-in defaults and the plugin `rules` option. */\nexport const resolveValidationRules = (\n\tdefaults: AnyValidationRuleDefinition[],\n\tconfig: ValidationRulesConfig = {}\n): ValidationRuleRegistry => {\n\tconst registry = buildRuleRegistry(defaults)\n\tfor (const [type, option] of Object.entries(config)) {\n\t\tif (option === false) {\n\t\t\tregistry.delete(type)\n\t\t} else if (option === true) {\n\t\t\t// keep the default; a no-op when no default exists for this key\n\t\t} else {\n\t\t\tregistry.set(type, { ...option, type })\n\t\t}\n\t}\n\treturn registry\n}\n"],"mappings":";AASA,MAAa,qBAAqB,UAAiE;CAClG,MAAM,2BAAmC,IAAI,IAAI;CACjD,KAAK,MAAM,QAAQ,OAClB,SAAS,IAAI,KAAK,MAAM,IAAI;CAE7B,OAAO;AACR;;AAGA,MAAa,0BACZ,UACA,SAAgC,CAAC,MACL;CAC5B,MAAM,WAAW,kBAAkB,QAAQ;CAC3C,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,MAAM,GACjD,IAAI,WAAW,OACd,SAAS,OAAO,IAAI;MACd,IAAI,WAAW,MAAM,CAE5B,OACC,SAAS,IAAI,MAAM;EAAE,GAAG;EAAQ;CAAK,CAAC;CAGxC,OAAO;AACR"}
+{"version":3,"file":"registry.js","names":[],"sources":["../../src/validation/registry.ts"],"sourcesContent":["import { applyRegistryConfig, type RegistryConfig } from '../plugin/applyRegistryConfig'\nimport type { AnyValidationRuleDefinition } from './types'\n\nexport type ValidationRuleRegistry = Map<string, AnyValidationRuleDefinition>\n\n/** Per-rule opt-in: `false` removes a built-in, `true` keeps it, an object adds a new rule or replaces one. */\nexport type ValidationRuleOption = boolean | AnyValidationRuleDefinition\n\nexport type ValidationRulesConfig = RegistryConfig<AnyValidationRuleDefinition>\n\nexport const buildRuleRegistry = (rules: AnyValidationRuleDefinition[]): ValidationRuleRegistry => {\n\tconst registry: ValidationRuleRegistry = new Map()\n\tfor (const rule of rules) {\n\t\tregistry.set(rule.type, rule)\n\t}\n\treturn registry\n}\n\n/** Resolve the active rule registry from the built-in defaults and the plugin `rules` option. */\nexport const resolveValidationRules = (\n\tdefaults: AnyValidationRuleDefinition[],\n\tconfig: ValidationRulesConfig = {}\n): ValidationRuleRegistry => applyRegistryConfig(buildRuleRegistry(defaults), config)\n"],"mappings":";;AAUA,MAAa,qBAAqB,UAAiE;CAClG,MAAM,2BAAmC,IAAI,IAAI;CACjD,KAAK,MAAM,QAAQ,OAClB,SAAS,IAAI,KAAK,MAAM,IAAI;CAE7B,OAAO;AACR;;AAGA,MAAa,0BACZ,UACA,SAAgC,CAAC,MACL,oBAAoB,kBAAkB,QAAQ,GAAG,MAAM"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@10x-media/form-builder",
-  "version": "0.1.0-beta.6",
+  "version": "0.1.0-beta.7",
   "description": "End-to-end forms platform for Payload: author, validate, render, collect, aggregate, and act.",
   "license": "MIT",
   "repository": {
@@ -93,10 +93,10 @@
     "tsdown": "0.22.1",
     "typescript": "5.9.3",
     "vitest": "4.1.7",
-    "@10x-media/tsconfig": "0.0.0",
     "@10x-media/payload-test-harness": "0.0.0",
-    "@10x-media/vitest-config": "0.0.0",
-    "@10x-media/tsdown-config": "0.0.0"
+    "@10x-media/tsdown-config": "0.0.0",
+    "@10x-media/tsconfig": "0.0.0",
+    "@10x-media/vitest-config": "0.0.0"
   },
   "publishConfig": {
     "access": "public"