@10x-media/form-builder 0.1.0-beta.6 → 0.1.0-beta.8

package/CHANGELOG.md

@@ -1,5 +1,89 @@
 # @10x-media/form-builder
 
+## 0.1.0-beta.8
+
+### Minor Changes
+
+- Second feedback round: submit control, step field order, response editor, and host-rendered success.
+
+  - **Implicit Enter-submit is suppressed on multi-step forms.** A form-level key handler prevents a lone text input from submitting the whole form on Enter; only the explicit Submit control submits. Textareas (newline), selects (confirm), and buttons are exempt, and single-step forms keep native Enter-to-submit. The `<form>` is the plugin's even in `children` mode, so this is the only place a host could apply the guard.
+  - **Step fields render in `form.fields` order.** A step's `fields` list is treated as membership only; the render order follows the form's field order rather than the flow-builder entry order.
+  - **`richText.responseEditor`.** The success response message field's editor can now be set independently via `richText.responseEditor` (falling back to `richText.editor`), mirroring `bodyEditor` for action bodies. The message block stays on the plugin-wide `editor`.
+  - **Host-rendered success.** `onSuccess` gains a second argument, `{ response }`, carrying the recall-resolved success response (a redirect url, or the message serialized with the form's converters), so a host can toast or render it; `<Poll>` forwards the same payload to its host. A new `converters` prop on `<Form>` threads custom block converters (e.g. host `icon`/`badge` blocks) into the client serializer, so those blocks survive in the success message, the resolved response, and inline `message` blocks. `successBehavior: 'reset'` clears the form in place after a successful submit instead of swapping in the success screen (returning a multi-step form to its first step), so a host can keep the form usable and give feedback via `onSuccess`. Defaults (`onSuccess`'s first argument, `successBehavior: 'replace'`) are unchanged. New exported types: `FormSuccessResponse`, `FormSuccessResult`.
+
+## 0.1.0-beta.7
+
+### Minor Changes
+
+- Composition seam, consent re-entrance safety, and server-side recipient enforcement.
+
+  - **`<FormFields>` + `<Form header>`.** The standard field loop is now an exported `<FormFields>`
+    component, so a custom `children` layout can compose `<Form><FormSteps /><FormFields />
+<FormControls /></Form>` without reimplementing visibility, calc, recall, and step filtering. For
+    the common case, `<Form header={<FormSteps />} />` places chrome above the fields while keeping all
+    default behavior. `recall` is now available on the form context.
+  - **Consent resolver receives the whole form document.** A multi-tenant `consent.sources` resolver
+    derives its tenant from a field on the provided doc instead of reading the form back. The consent
+    `afterRead` hook now guards against resolver re-entrance (a per-id `Set` on `req.context`), so a
+    resolver that does read the form back can no longer recurse.
+  - **`email.recipients.allowCustom: false` is enforced on the server.** When set, a non-token
+    recipient must be one of the resolved department options, validated at save and fail-closed
+    (mirroring the `from` field). The default (`allowCustom` true) is unchanged.
+
+- Two new controls for consent reads and upload ownership.
+
+  - **`consent.resolveOnRead`** (default `true`) gates the afterRead hook that resolves each form's consent statements on every read. Set it `false` to skip that per-read source lookup (N queries on a list view) and resolve statements yourself with the exported `resolveConsentStatements` when you render a form. Submit-time proof capture is unaffected either way, since it always re-resolves from the source.
+  - **`spam.uploadOwnership`** (default `'lenient'`) controls how strictly a submitted file's upload ownership is enforced. `'strict'` additionally rejects a stamped upload whenever the submitter cannot be identified, so a deployment that always identifies requests (a trusted proxy header, or a custom `identify`) never lets an unverifiable claim capture an owned upload. `'lenient'` keeps the current fail-open behavior for unidentifiable submitters.
+
+### Patch Changes
+
+- Consolidate the built-in email actions. `emailTeam` and `confirmation` were ~80% identical (the same recipient fields, subject/body config, from-field insertion, and send logic) duplicated across two files, each built through a five-positional-argument builder that needed a `useMaxParams` lint suppression. Both now share one `buildEmailAction` skeleton and one `EmailActionOptions` object; each action supplies only what differs (its `to` target and whether a missing recipient throws or is skipped). Behavior is unchanged, verified by both actions' full existing test suites passing against the shared implementation.
+
+- Condition and flow correctness.
+
+  - `file` and `repeater` fields now offer a presence-only condition (exists / does not exist) in the builder, instead of the text/select operators they cannot actually satisfy (a `FileRef` object or a row array only stringifies). A presence check also treats an empty repeater as absent.
+  - Flow transition `when` clauses are laundered the same way field conditions are: a transition referencing a field that was later deleted is dropped, rather than persisting as an always-true route that force-navigates the visitor. Valid transition conditions are canonicalized to the same OR-of-ANDs shape as field conditions.
+
+- Correctness and security hardening from an internal audit.
+
+  - **Registry key forced** on custom `actions` and `poll.sources`: a definition registered under a key that differs from its `type` no longer silently never runs.
+  - **Recipient injection closed**: a resolved `{{field}}` recipient is sanitized to a single address, dropping CR/LF header injection and any extra addresses a crafted submission value could smuggle in.
+  - **`email.recipients.fieldTokens: false`** is now enforced on the server, not just the client.
+  - **Consent integrity**: prefill and submit-time boolean coercion share one truthy allow-list, so a stray string value (e.g. from a non-React client) is never read as consent.
+  - **Cross-tenant leak closed**: the consent-sources and poll-options endpoints load the form under the caller's own read access (no `overrideAccess`), so an authenticated user cannot enumerate another tenant's form.
+  - **Rate-limit skip surfaced**: when the request identity is null the limiter still fails open, but the skip is recorded on `meta.spam.rateLimit` and warned once instead of being silent.
+  - **Honeypot collision fixed**: the decoy is submitted under a fixed reserved key, so a real field sharing the decoy's DOM input name (e.g. `website`) is never stripped or mistaken for the honeypot.
+  - **Action failures logged**: a failed post-submit email or webhook is logged per action instead of being swallowed while the submission looks fully successful.
+
+- DX and robustness cleanup from the package audit.
+
+  - **Renderers honor the passed `id` prop.** Eleven built-in field renderers minted their own `useId()` and ignored the `id` the render host already generates and passes, so each field ran two id hooks and the documented contract prop was dead. They now use the passed `id` (the host stays the single source; a custom host can control it). `repeater` and `message` already conformed.
+  - **The overlay backdrop no longer fires `onClose` twice.** A backdrop click was handled both by the backdrop's own `onClick` and by the surface's outside-pointerdown dismiss, so it closed twice; the backdrop's handler also ignored `closeOnOutsideClick: false`. The backdrop is now purely presentational and dismissal is owned solely by the dismiss hook, which respects the flag.
+  - **Polls surface a results-load failure.** A failed results fetch was stored as an empty array and rendered as a zero-count "no votes yet" table. It now shows a localized error instead of masking the failure.
+  - **`captureFileRef` gains unit coverage** for its ownership match/mismatch, unidentified-submitter fail-open, unstamped-upload passthrough, and failed-load cases.
+  - **The consent proof documents its time-of-check/time-of-use window** (wording is read at form load but re-resolved at submit) so the intended behavior is not mistaken for a bug.
+
+- Split the two largest source files for maintainability, with no behavior change.
+
+  - The `FormBuilderPluginOptions` type (nearly 200 lines of the plugin's public option surface, with its doc comments) moves out of `index.ts` into a dedicated `src/options.ts`, leaving `index.ts` focused on the plugin factory and the public barrel. The type is still exported under the same name (and its `PluginOptions` alias).
+  - The forms collection's built-in endpoints (poll results/options/close, plus the optional consent-sources, from-addresses, and departments endpoints) move out of `buildFormsCollection` into `buildFormsEndpoints`, so the collection builder stays focused on field and hook composition.
+
+  `index.ts` drops from ~558 to ~346 lines and `forms.ts` from ~845 to ~743; the moved code is unchanged and every existing unit, integration, and cross-DB test passes against it.
+
+- Localize the last hard-coded English strings in the public form renderer. The file field's attached-file indicator, in-flight "Uploading" status, upload-failure fallback, and remove control, plus the form's close-control label, success message, and submit-failure fallback, now resolve through the same `t` the rest of the renderer already uses (bundled `en`/`de`, host-overridable per locale) instead of baked-in English. A German (or any) `t` now localizes them; behavior under the default English `t` is unchanged.
+
+- Consolidate the registry and constant plumbing.
+
+  - The field-type, validation-rule, action, poll-source, and poll-type registries all resolved their opt-in override map (`false` removes, `true` keeps, a definition adds/replaces with `type` forced to the key) with their own copy of the same loop. That loop now lives in one shared `applyRegistryConfig` helper, so the merge semantics are defined once instead of five times.
+  - Definition `label` contracts are aligned: actions and poll option sources now accept a per-locale `Record<string, string>` label in addition to a string key/literal, matching poll types. All three resolve through one shared `resolveDefinitionLabel` helper. Widening only, so existing string labels are unaffected.
+  - The email-format regex (duplicated between the `email` field type and the `email` validation rule) and the calc recursion-depth guard (duplicated between the calc parser and evaluator) are each a single shared constant now, so the pair can no longer drift.
+
+- Repeater correctness fixes.
+
+  - Multi-step forms now validate a step's repeater sub-fields on **Next**, so an invalid required sub-field can no longer be skipped past; it surfaces inline, mirroring submit and the server. `goNext` also gains a re-entrancy guard so a double-click cannot push the same step onto history twice.
+  - Editing a repeater sub-field clears its stale server-side error immediately, instead of leaving it shown until the next submit.
+  - Repeater rows carry a stable React key, so removing a middle row no longer strands a stateful sub-renderer's local state (e.g. the file renderer's filename) onto the wrong row.
+
 ## 0.1.0-beta.6
 
 ### Minor Changes

package/dist/actions/body/serializeBody.d.ts

@@ -33,13 +33,15 @@ type SerializeBodyArgs = {
  * off to a renderer like react-email). `editor` is the default Lexical/richText editor for every
  * plugin-authored richText field: message content, consent statement, the response message, and
  * the action body fields. `bodyEditor` overrides the action body fields specifically (emailTeam
- * and confirmation), falling back to `editor` when absent.
+ * and confirmation), and `responseEditor` overrides the success `response` message field; both fall
+ * back to `editor` when absent.
  */
 type RichTextBodyOption = {
   converters?: Record<string, BodyConverter>;
   serialize?: (args: SerializeBodyArgs) => Promise<string> | string;
   editor?: RichTextField['editor'];
   bodyEditor?: RichTextField['editor'];
+  responseEditor?: RichTextField['editor'];
 };
 /**
  * Serialize an action's `body` config into HTML. A legacy string body is interpolated as-is

package/dist/actions/body/serializeBody.js.map

@@ -1 +1 @@
-{"version":3,"file":"serializeBody.js","names":[],"sources":["../../../src/actions/body/serializeBody.ts"],"sourcesContent":["import type { PayloadRequest, RichTextField } from 'payload'\nimport { interpolate } from '../../recall/interpolate'\nimport type { SubmissionDescriptor, SubmissionValue } from '../../submissions/types'\nimport type { BodyConverter, BodyRender } from './converters'\nimport { defaultBodyConverters } from './converters'\nimport { escapeHtml } from './escapeHtml'\nimport { serializeSlate } from './serializeSlate'\nimport { renderAllValues, renderAllValuesTable } from './wildcards'\n\n/** Minimal form identity threaded alongside a rendered body (e.g. per-tenant template lookups). */\ntype SerializeBodyForm = { id: number | string; title?: string }\n\n/** Submission data plus optional converter overrides available while serializing a body. */\nexport type BodyContext = {\n\tvalues: SubmissionValue[]\n\tdescriptors: SubmissionDescriptor[]\n\tconverters?: Record<string, BodyConverter>\n}\n\n/**\n * Args a custom `richText.serialize` replacement receives per rendered body. Always populated by\n * `makeRenderBody` (the action-body pipeline): `form` and `req` enable per-tenant template\n * lookups or handing the body off to a renderer like react-email.\n */\nexport type SerializeBodyArgs = {\n\tbody: unknown\n\tvalues: SubmissionValue[]\n\tdescriptors: SubmissionDescriptor[]\n\tform: SerializeBodyForm\n\treq?: PayloadRequest\n}\n\n/**\n * Customizes how the plugin's rich text is authored and rendered. `converters` spread over the\n * default Lexical node converters; `serialize` replaces the whole action-body pipeline (for\n * non-HTML channels like chat or plain text, or to hand the body plus the submitted `form`/`req`\n * off to a renderer like react-email). `editor` is the default Lexical/richText editor for every\n * plugin-authored richText field: message content, consent statement, the response message, and\n * the action body fields. `bodyEditor` overrides the action body fields specifically (emailTeam\n * and confirmation), falling back to `editor` when absent.\n */\nexport type RichTextBodyOption = {\n\tconverters?: Record<string, BodyConverter>\n\tserialize?: (args: SerializeBodyArgs) => Promise<string> | string\n\teditor?: RichTextField['editor']\n\tbodyEditor?: RichTextField['editor']\n}\n\n/** Recall resolver over submission values: field name to stringified value, `''` when absent. */\nexport const resolverFor =\n\t(values: SubmissionValue[]) =>\n\t(name: string): string => {\n\t\tconst entry = values.find((value) => value.field === name)\n\t\treturn entry == null ? '' : String(entry.value ?? '')\n\t}\n\nconst renderFor = (ctx: BodyContext): BodyRender => {\n\tconst resolve = resolverFor(ctx.values)\n\tconst htmlResolve = (name: string): string => {\n\t\tif (name === '*') {\n\t\t\treturn renderAllValues(ctx.values, ctx.descriptors)\n\t\t}\n\t\tif (name === '*:table') {\n\t\t\treturn renderAllValuesTable(ctx.values, ctx.descriptors)\n\t\t}\n\t\treturn escapeHtml(resolve(name))\n\t}\n\treturn {\n\t\ttext: (raw) => interpolate(escapeHtml(raw), htmlResolve),\n\t\tinterpolate: (raw) => interpolate(raw, resolve),\n\t}\n}\n\nconst serializeNodes = (\n\tnodes: unknown[],\n\tconverters: Record<string, BodyConverter>,\n\trender: BodyRender\n): string =>\n\tnodes\n\t\t.map((node) => {\n\t\t\tif (node == null || typeof node !== 'object') {\n\t\t\t\treturn ''\n\t\t\t}\n\t\t\tconst lexicalNode = node as Record<string, unknown>\n\t\t\tconst children = Array.isArray(lexicalNode.children)\n\t\t\t\t? serializeNodes(lexicalNode.children, converters, render)\n\t\t\t\t: ''\n\t\t\tconst converter =\n\t\t\t\ttypeof lexicalNode.type === 'string' ? converters[lexicalNode.type] : undefined\n\t\t\treturn converter ? converter({ node: lexicalNode, children, render }) : children\n\t\t})\n\t\t.join('')\n\nconst lexicalRootOf = (body: unknown): Record<string, unknown> | null => {\n\tif (body == null || typeof body !== 'object' || Array.isArray(body)) {\n\t\treturn null\n\t}\n\tconst root = (body as { root?: unknown }).root\n\treturn root != null && typeof root === 'object' ? (root as Record<string, unknown>) : null\n}\n\n/**\n * Serialize an action's `body` config into HTML. A legacy string body is interpolated as-is\n * (pre-richText behavior, no escaping); a Lexical state walks the converter registry; a Slate\n * array uses the minimal legacy serializer; anything else yields `''`. Rendered text is\n * HTML-escaped and supports `{{ name|fallback }}`, `{{*}}`, and `{{*:table}}` tokens.\n */\nexport const serializeBody = (body: unknown, ctx: BodyContext): string => {\n\tif (typeof body === 'string') {\n\t\treturn interpolate(body, resolverFor(ctx.values))\n\t}\n\tconst render = renderFor(ctx)\n\tif (Array.isArray(body)) {\n\t\treturn serializeSlate(body, render)\n\t}\n\tconst root = lexicalRootOf(body)\n\tif (root) {\n\t\tconst converters = { ...defaultBodyConverters, ...(ctx.converters ?? {}) }\n\t\treturn serializeNodes(Array.isArray(root.children) ? root.children : [], converters, render)\n\t}\n\treturn ''\n}\n\n/** Build the `renderBody` passed to actions, honoring a plugin-level `richText` customization. */\nexport const makeRenderBody =\n\t(args: {\n\t\tvalues: SubmissionValue[]\n\t\tdescriptors: SubmissionDescriptor[]\n\t\tform: SerializeBodyForm\n\t\treq?: PayloadRequest\n\t\trichText?: RichTextBodyOption\n\t}) =>\n\tasync (body: unknown): Promise<string> => {\n\t\tif (args.richText?.serialize) {\n\t\t\treturn await args.richText.serialize({\n\t\t\t\tbody,\n\t\t\t\tvalues: args.values,\n\t\t\t\tdescriptors: args.descriptors,\n\t\t\t\tform: args.form,\n\t\t\t\treq: args.req,\n\t\t\t})\n\t\t}\n\t\treturn serializeBody(body, {\n\t\t\tvalues: args.values,\n\t\t\tdescriptors: args.descriptors,\n\t\t\tconverters: args.richText?.converters,\n\t\t})\n\t}\n"],"mappings":";;;;;;;AAiDA,MAAa,eACX,YACA,SAAyB;CACzB,MAAM,QAAQ,OAAO,MAAM,UAAU,MAAM,UAAU,IAAI;CACzD,OAAO,SAAS,OAAO,KAAK,OAAO,MAAM,SAAS,EAAE;AACrD;AAED,MAAM,aAAa,QAAiC;CACnD,MAAM,UAAU,YAAY,IAAI,MAAM;CACtC,MAAM,eAAe,SAAyB;EAC7C,IAAI,SAAS,KACZ,OAAO,gBAAgB,IAAI,QAAQ,IAAI,WAAW;EAEnD,IAAI,SAAS,WACZ,OAAO,qBAAqB,IAAI,QAAQ,IAAI,WAAW;EAExD,OAAO,WAAW,QAAQ,IAAI,CAAC;CAChC;CACA,OAAO;EACN,OAAO,QAAQ,YAAY,WAAW,GAAG,GAAG,WAAW;EACvD,cAAc,QAAQ,YAAY,KAAK,OAAO;CAC/C;AACD;AAEA,MAAM,kBACL,OACA,YACA,WAEA,MACE,KAAK,SAAS;CACd,IAAI,QAAQ,QAAQ,OAAO,SAAS,UACnC,OAAO;CAER,MAAM,cAAc;CACpB,MAAM,WAAW,MAAM,QAAQ,YAAY,QAAQ,IAChD,eAAe,YAAY,UAAU,YAAY,MAAM,IACvD;CACH,MAAM,YACL,OAAO,YAAY,SAAS,WAAW,WAAW,YAAY,QAAQ,KAAA;CACvE,OAAO,YAAY,UAAU;EAAE,MAAM;EAAa;EAAU;CAAO,CAAC,IAAI;AACzE,CAAC,EACA,KAAK,EAAE;AAEV,MAAM,iBAAiB,SAAkD;CACxE,IAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GACjE,OAAO;CAER,MAAM,OAAQ,KAA4B;CAC1C,OAAO,QAAQ,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACvF;;;;;;;AAQA,MAAa,iBAAiB,MAAe,QAA6B;CACzE,IAAI,OAAO,SAAS,UACnB,OAAO,YAAY,MAAM,YAAY,IAAI,MAAM,CAAC;CAEjD,MAAM,SAAS,UAAU,GAAG;CAC5B,IAAI,MAAM,QAAQ,IAAI,GACrB,OAAO,eAAe,MAAM,MAAM;CAEnC,MAAM,OAAO,cAAc,IAAI;CAC/B,IAAI,MAAM;EACT,MAAM,aAAa;GAAE,GAAG;GAAuB,GAAI,IAAI,cAAc,CAAC;EAAG;EACzE,OAAO,eAAe,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK,WAAW,CAAC,GAAG,YAAY,MAAM;CAC5F;CACA,OAAO;AACR;;AAGA,MAAa,kBACX,SAOD,OAAO,SAAmC;CACzC,IAAI,KAAK,UAAU,WAClB,OAAO,MAAM,KAAK,SAAS,UAAU;EACpC;EACA,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,MAAM,KAAK;EACX,KAAK,KAAK;CACX,CAAC;CAEF,OAAO,cAAc,MAAM;EAC1B,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,YAAY,KAAK,UAAU;CAC5B,CAAC;AACF"}
+{"version":3,"file":"serializeBody.js","names":[],"sources":["../../../src/actions/body/serializeBody.ts"],"sourcesContent":["import type { PayloadRequest, RichTextField } from 'payload'\nimport { interpolate } from '../../recall/interpolate'\nimport type { SubmissionDescriptor, SubmissionValue } from '../../submissions/types'\nimport type { BodyConverter, BodyRender } from './converters'\nimport { defaultBodyConverters } from './converters'\nimport { escapeHtml } from './escapeHtml'\nimport { serializeSlate } from './serializeSlate'\nimport { renderAllValues, renderAllValuesTable } from './wildcards'\n\n/** Minimal form identity threaded alongside a rendered body (e.g. per-tenant template lookups). */\ntype SerializeBodyForm = { id: number | string; title?: string }\n\n/** Submission data plus optional converter overrides available while serializing a body. */\nexport type BodyContext = {\n\tvalues: SubmissionValue[]\n\tdescriptors: SubmissionDescriptor[]\n\tconverters?: Record<string, BodyConverter>\n}\n\n/**\n * Args a custom `richText.serialize` replacement receives per rendered body. Always populated by\n * `makeRenderBody` (the action-body pipeline): `form` and `req` enable per-tenant template\n * lookups or handing the body off to a renderer like react-email.\n */\nexport type SerializeBodyArgs = {\n\tbody: unknown\n\tvalues: SubmissionValue[]\n\tdescriptors: SubmissionDescriptor[]\n\tform: SerializeBodyForm\n\treq?: PayloadRequest\n}\n\n/**\n * Customizes how the plugin's rich text is authored and rendered. `converters` spread over the\n * default Lexical node converters; `serialize` replaces the whole action-body pipeline (for\n * non-HTML channels like chat or plain text, or to hand the body plus the submitted `form`/`req`\n * off to a renderer like react-email). `editor` is the default Lexical/richText editor for every\n * plugin-authored richText field: message content, consent statement, the response message, and\n * the action body fields. `bodyEditor` overrides the action body fields specifically (emailTeam\n * and confirmation), and `responseEditor` overrides the success `response` message field; both fall\n * back to `editor` when absent.\n */\nexport type RichTextBodyOption = {\n\tconverters?: Record<string, BodyConverter>\n\tserialize?: (args: SerializeBodyArgs) => Promise<string> | string\n\teditor?: RichTextField['editor']\n\tbodyEditor?: RichTextField['editor']\n\tresponseEditor?: RichTextField['editor']\n}\n\n/** Recall resolver over submission values: field name to stringified value, `''` when absent. */\nexport const resolverFor =\n\t(values: SubmissionValue[]) =>\n\t(name: string): string => {\n\t\tconst entry = values.find((value) => value.field === name)\n\t\treturn entry == null ? '' : String(entry.value ?? '')\n\t}\n\nconst renderFor = (ctx: BodyContext): BodyRender => {\n\tconst resolve = resolverFor(ctx.values)\n\tconst htmlResolve = (name: string): string => {\n\t\tif (name === '*') {\n\t\t\treturn renderAllValues(ctx.values, ctx.descriptors)\n\t\t}\n\t\tif (name === '*:table') {\n\t\t\treturn renderAllValuesTable(ctx.values, ctx.descriptors)\n\t\t}\n\t\treturn escapeHtml(resolve(name))\n\t}\n\treturn {\n\t\ttext: (raw) => interpolate(escapeHtml(raw), htmlResolve),\n\t\tinterpolate: (raw) => interpolate(raw, resolve),\n\t}\n}\n\nconst serializeNodes = (\n\tnodes: unknown[],\n\tconverters: Record<string, BodyConverter>,\n\trender: BodyRender\n): string =>\n\tnodes\n\t\t.map((node) => {\n\t\t\tif (node == null || typeof node !== 'object') {\n\t\t\t\treturn ''\n\t\t\t}\n\t\t\tconst lexicalNode = node as Record<string, unknown>\n\t\t\tconst children = Array.isArray(lexicalNode.children)\n\t\t\t\t? serializeNodes(lexicalNode.children, converters, render)\n\t\t\t\t: ''\n\t\t\tconst converter =\n\t\t\t\ttypeof lexicalNode.type === 'string' ? converters[lexicalNode.type] : undefined\n\t\t\treturn converter ? converter({ node: lexicalNode, children, render }) : children\n\t\t})\n\t\t.join('')\n\nconst lexicalRootOf = (body: unknown): Record<string, unknown> | null => {\n\tif (body == null || typeof body !== 'object' || Array.isArray(body)) {\n\t\treturn null\n\t}\n\tconst root = (body as { root?: unknown }).root\n\treturn root != null && typeof root === 'object' ? (root as Record<string, unknown>) : null\n}\n\n/**\n * Serialize an action's `body` config into HTML. A legacy string body is interpolated as-is\n * (pre-richText behavior, no escaping); a Lexical state walks the converter registry; a Slate\n * array uses the minimal legacy serializer; anything else yields `''`. Rendered text is\n * HTML-escaped and supports `{{ name|fallback }}`, `{{*}}`, and `{{*:table}}` tokens.\n */\nexport const serializeBody = (body: unknown, ctx: BodyContext): string => {\n\tif (typeof body === 'string') {\n\t\treturn interpolate(body, resolverFor(ctx.values))\n\t}\n\tconst render = renderFor(ctx)\n\tif (Array.isArray(body)) {\n\t\treturn serializeSlate(body, render)\n\t}\n\tconst root = lexicalRootOf(body)\n\tif (root) {\n\t\tconst converters = { ...defaultBodyConverters, ...(ctx.converters ?? {}) }\n\t\treturn serializeNodes(Array.isArray(root.children) ? root.children : [], converters, render)\n\t}\n\treturn ''\n}\n\n/** Build the `renderBody` passed to actions, honoring a plugin-level `richText` customization. */\nexport const makeRenderBody =\n\t(args: {\n\t\tvalues: SubmissionValue[]\n\t\tdescriptors: SubmissionDescriptor[]\n\t\tform: SerializeBodyForm\n\t\treq?: PayloadRequest\n\t\trichText?: RichTextBodyOption\n\t}) =>\n\tasync (body: unknown): Promise<string> => {\n\t\tif (args.richText?.serialize) {\n\t\t\treturn await args.richText.serialize({\n\t\t\t\tbody,\n\t\t\t\tvalues: args.values,\n\t\t\t\tdescriptors: args.descriptors,\n\t\t\t\tform: args.form,\n\t\t\t\treq: args.req,\n\t\t\t})\n\t\t}\n\t\treturn serializeBody(body, {\n\t\t\tvalues: args.values,\n\t\t\tdescriptors: args.descriptors,\n\t\t\tconverters: args.richText?.converters,\n\t\t})\n\t}\n"],"mappings":";;;;;;;AAmDA,MAAa,eACX,YACA,SAAyB;CACzB,MAAM,QAAQ,OAAO,MAAM,UAAU,MAAM,UAAU,IAAI;CACzD,OAAO,SAAS,OAAO,KAAK,OAAO,MAAM,SAAS,EAAE;AACrD;AAED,MAAM,aAAa,QAAiC;CACnD,MAAM,UAAU,YAAY,IAAI,MAAM;CACtC,MAAM,eAAe,SAAyB;EAC7C,IAAI,SAAS,KACZ,OAAO,gBAAgB,IAAI,QAAQ,IAAI,WAAW;EAEnD,IAAI,SAAS,WACZ,OAAO,qBAAqB,IAAI,QAAQ,IAAI,WAAW;EAExD,OAAO,WAAW,QAAQ,IAAI,CAAC;CAChC;CACA,OAAO;EACN,OAAO,QAAQ,YAAY,WAAW,GAAG,GAAG,WAAW;EACvD,cAAc,QAAQ,YAAY,KAAK,OAAO;CAC/C;AACD;AAEA,MAAM,kBACL,OACA,YACA,WAEA,MACE,KAAK,SAAS;CACd,IAAI,QAAQ,QAAQ,OAAO,SAAS,UACnC,OAAO;CAER,MAAM,cAAc;CACpB,MAAM,WAAW,MAAM,QAAQ,YAAY,QAAQ,IAChD,eAAe,YAAY,UAAU,YAAY,MAAM,IACvD;CACH,MAAM,YACL,OAAO,YAAY,SAAS,WAAW,WAAW,YAAY,QAAQ,KAAA;CACvE,OAAO,YAAY,UAAU;EAAE,MAAM;EAAa;EAAU;CAAO,CAAC,IAAI;AACzE,CAAC,EACA,KAAK,EAAE;AAEV,MAAM,iBAAiB,SAAkD;CACxE,IAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GACjE,OAAO;CAER,MAAM,OAAQ,KAA4B;CAC1C,OAAO,QAAQ,QAAQ,OAAO,SAAS,WAAY,OAAmC;AACvF;;;;;;;AAQA,MAAa,iBAAiB,MAAe,QAA6B;CACzE,IAAI,OAAO,SAAS,UACnB,OAAO,YAAY,MAAM,YAAY,IAAI,MAAM,CAAC;CAEjD,MAAM,SAAS,UAAU,GAAG;CAC5B,IAAI,MAAM,QAAQ,IAAI,GACrB,OAAO,eAAe,MAAM,MAAM;CAEnC,MAAM,OAAO,cAAc,IAAI;CAC/B,IAAI,MAAM;EACT,MAAM,aAAa;GAAE,GAAG;GAAuB,GAAI,IAAI,cAAc,CAAC;EAAG;EACzE,OAAO,eAAe,MAAM,QAAQ,KAAK,QAAQ,IAAI,KAAK,WAAW,CAAC,GAAG,YAAY,MAAM;CAC5F;CACA,OAAO;AACR;;AAGA,MAAa,kBACX,SAOD,OAAO,SAAmC;CACzC,IAAI,KAAK,UAAU,WAClB,OAAO,MAAM,KAAK,SAAS,UAAU;EACpC;EACA,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,MAAM,KAAK;EACX,KAAK,KAAK;CACX,CAAC;CAEF,OAAO,cAAc,MAAM;EAC1B,QAAQ,KAAK;EACb,aAAa,KAAK;EAClB,YAAY,KAAK,UAAU;CAC5B,CAAC;AACF"}

package/dist/actions/buildActionBlocks.js

@@ -1,16 +1,19 @@
-import { labelFor } from "../translations/server.js";
+import { resolveDefinitionLabel } from "../translations/server.js";
 //#region src/actions/buildActionBlocks.ts
 /** One authoring block per registered action type: the action's own config fields. */
 const buildActionBlocks = (registry) => {
 	const blocks = [];
-	for (const definition of registry.values()) blocks.push({
-		slug: definition.type,
-		labels: {
-			singular: labelFor(definition.label),
-			plural: labelFor(definition.label)
-		},
-		fields: definition.config ?? []
-	});
+	for (const definition of registry.values()) {
+		const label = resolveDefinitionLabel(definition.label);
+		blocks.push({
+			slug: definition.type,
+			labels: {
+				singular: label,
+				plural: label
+			},
+			fields: definition.config ?? []
+		});
+	}
 	return blocks;
 };
 //#endregion

package/dist/actions/buildActionBlocks.js.map

@@ -1 +1 @@
-{"version":3,"file":"buildActionBlocks.js","names":[],"sources":["../../src/actions/buildActionBlocks.ts"],"sourcesContent":["import type { Block } from 'payload'\nimport { labelFor } from '../translations/server'\nimport type { ActionRegistry } from './registry'\n\n/** One authoring block per registered action type: the action's own config fields. */\nexport const buildActionBlocks = (registry: ActionRegistry): Block[] => {\n\tconst blocks: Block[] = []\n\tfor (const definition of registry.values()) {\n\t\tblocks.push({\n\t\t\tslug: definition.type,\n\t\t\tlabels: { singular: labelFor(definition.label), plural: labelFor(definition.label) },\n\t\t\tfields: definition.config ?? [],\n\t\t})\n\t}\n\treturn blocks\n}\n"],"mappings":";;;AAKA,MAAa,qBAAqB,aAAsC;CACvE,MAAM,SAAkB,CAAC;CACzB,KAAK,MAAM,cAAc,SAAS,OAAO,GACxC,OAAO,KAAK;EACX,MAAM,WAAW;EACjB,QAAQ;GAAE,UAAU,SAAS,WAAW,KAAK;GAAG,QAAQ,SAAS,WAAW,KAAK;EAAE;EACnF,QAAQ,WAAW,UAAU,CAAC;CAC/B,CAAC;CAEF,OAAO;AACR"}
+{"version":3,"file":"buildActionBlocks.js","names":[],"sources":["../../src/actions/buildActionBlocks.ts"],"sourcesContent":["import type { Block } from 'payload'\nimport { resolveDefinitionLabel } from '../translations/server'\nimport type { ActionRegistry } from './registry'\n\n/** One authoring block per registered action type: the action's own config fields. */\nexport const buildActionBlocks = (registry: ActionRegistry): Block[] => {\n\tconst blocks: Block[] = []\n\tfor (const definition of registry.values()) {\n\t\tconst label = resolveDefinitionLabel(definition.label)\n\t\tblocks.push({\n\t\t\tslug: definition.type,\n\t\t\tlabels: { singular: label, plural: label },\n\t\t\tfields: definition.config ?? [],\n\t\t})\n\t}\n\treturn blocks\n}\n"],"mappings":";;;AAKA,MAAa,qBAAqB,aAAsC;CACvE,MAAM,SAAkB,CAAC;CACzB,KAAK,MAAM,cAAc,SAAS,OAAO,GAAG;EAC3C,MAAM,QAAQ,uBAAuB,WAAW,KAAK;EACrD,OAAO,KAAK;GACX,MAAM,WAAW;GACjB,QAAQ;IAAE,UAAU;IAAO,QAAQ;GAAM;GACzC,QAAQ,WAAW,UAAU,CAAC;EAC/B,CAAC;CACF;CACA,OAAO;AACR"}

package/dist/actions/builtin/confirmation.js

@@ -1,12 +1,8 @@
 import { fieldNamesOfType } from "../../fields/fieldNamesOfType.js";
-import { localizedIf } from "../../fields/localizedIf.js";
-import { interpolate } from "../../recall/interpolate.js";
 import { keys } from "../../translations/keys.js";
 import { asTranslate, labelFor } from "../../translations/server.js";
-import { resolverFor } from "../body/serializeBody.js";
-import { defineAction } from "../defineAction.js";
-import { buildRecipientField, resolveRecipients } from "../emailRecipients.js";
-import { buildFromField } from "../fromAddresses.js";
+import { firstAddress } from "../emailRecipients.js";
+import { buildEmailAction } from "./emailAction.js";
 //#region src/actions/builtin/confirmation.ts
 const TO_FIELD_REF = "@10x-media/form-builder/client#FieldNameSelect";
 /**
@@ -18,20 +14,13 @@ const validateToField = (value, { data, req }) => {
 	return fieldNamesOfType(data && typeof data === "object" ? data.fields : void 0, ["email"]).includes(value) ? true : asTranslate(req.t)(keys.validationEmailFieldUnknown);
 };
 /**
-* `toField` names the form's own email field the confirmation is sent to (a `FieldNameSelect`, not a
-* recipient list). `replyTo`, `cc`, and `bcc` are recipient lists (`RecipientsSelect`, `string[]`):
-* literal emails, picked department addresses (when `departments` is set), or `{{field}}` tokens
-* resolved from the submission at send. `from` is a single address, added only when `fromAddresses`
-* is set. `subject`/`body` are content; `editor` overrides the body editor; `recipients` narrows the
-* recipient fields' behavior. Content and recipient fields carry `localized: true` when `localize`.
+* The `confirmation` action: its target is `toField`, naming the form's own email field the
+* confirmation is sent to (a `FieldNameSelect`, not a recipient list). The resolved address is
+* sanitized to a single one (dropping CR/LF header injection and any smuggled extra addresses); an
+* unset field or an unresolvable value is a silent skip. Everything else (from/cc/bcc/replyTo,
+* subject, body, localization) is the shared email-action skeleton.
 */
-const buildConfirmation = (localize, editor, fromAddresses, departments, recipients) => {
-	const endpoint = departments ? "departments" : void 0;
-	const recip = (name, labelKey) => buildRecipientField(name, labelKey, localize, {
-		endpoint,
-		recipients,
-		width: "50%"
-	});
+const buildConfirmation = (options) => {
 	const toField = {
 		name: "toField",
 		type: "text",
@@ -48,59 +37,15 @@ const buildConfirmation = (localize, editor, fromAddresses, departments, recipie
 		},
 		validate: validateToField
 	};
-	return defineAction({
+	return buildEmailAction(options, {
 		type: "confirmation",
 		label: keys.actionConfirmation,
-		config: [
-			{
-				type: "row",
-				fields: [toField, recip("replyTo", keys.actionConfigReplyTo)]
-			},
-			...fromAddresses ? [buildFromField(fromAddresses)] : [],
-			{
-				type: "row",
-				fields: [recip("cc", keys.actionConfigCc), recip("bcc", keys.actionConfigBcc)]
-			},
-			{
-				name: "subject",
-				type: "text",
-				label: labelFor(keys.actionConfigSubject),
-				...localizedIf(localize)
-			},
-			{
-				name: "body",
-				type: "richText",
-				label: labelFor(keys.actionConfigBody),
-				admin: { description: labelFor(keys.actionConfigBodyDescription) },
-				...localizedIf(localize),
-				...editor ? { editor } : {}
-			}
-		],
-		run: async (args) => {
-			const { config, values, payload, renderBody } = args;
-			if (!config.toField) return;
-			const resolve = resolverFor(values);
-			const to = resolve(config.toField);
-			if (!to) return;
-			if (typeof payload.sendEmail !== "function") throw new Error("confirmation: no email adapter configured");
-			const subject = interpolate(config.subject ?? "", resolve);
-			const html = await renderBody(config.body);
-			const cc = resolveRecipients(config.cc, resolve);
-			const bcc = resolveRecipients(config.bcc, resolve);
-			const replyTo = resolveRecipients(config.replyTo, resolve);
-			await payload.sendEmail({
-				to,
-				subject,
-				html,
-				...config.from ? { from: config.from } : {},
-				...cc ? { cc } : {},
-				...bcc ? { bcc } : {},
-				...replyTo ? { replyTo } : {}
-			});
-		}
+		target: () => toField,
+		resolveTo: (config, resolve) => config.toField ? firstAddress(resolve(config.toField)) : void 0,
+		onMissingTo: "skip"
 	});
 };
-buildConfirmation(true);
+buildConfirmation({ localize: true });
 //#endregion
 export { buildConfirmation };
 

package/dist/actions/builtin/confirmation.js.map

@@ -1 +1 @@
-{"version":3,"file":"confirmation.js","names":[],"sources":["../../../src/actions/builtin/confirmation.ts"],"sourcesContent":["import type { Field, PayloadRequest, RichTextField } from 'payload'\nimport type { DepartmentEmailsResolver } from '../../email/departments'\nimport { fieldNamesOfType } from '../../fields/fieldNamesOfType'\nimport { localizedIf } from '../../fields/localizedIf'\nimport { interpolate } from '../../recall/interpolate'\nimport { keys } from '../../translations/keys'\nimport { asTranslate, labelFor } from '../../translations/server'\nimport { resolverFor } from '../body/serializeBody'\nimport { defineAction } from '../defineAction'\nimport { buildRecipientField, type RecipientsConfig, resolveRecipients } from '../emailRecipients'\nimport { buildFromField, type FromAddressesResolver } from '../fromAddresses'\n\ntype ConfirmationConfig = {\n\ttoField?: string\n\tfrom?: string\n\tcc?: string[]\n\tbcc?: string[]\n\treplyTo?: string[]\n\tsubject?: string\n\tbody?: unknown\n}\n\nconst TO_FIELD_REF = '@10x-media/form-builder/client#FieldNameSelect'\n\n/**\n * Validates the confirmation action's `toField`: unset is fine, otherwise it must name an\n * existing `email`-type field on the form. Exported for unit testing.\n */\nexport const validateToField = (\n\tvalue: unknown,\n\t{ data, req }: { data?: unknown; req: PayloadRequest }\n): string | true => {\n\tif (typeof value !== 'string' || value.length === 0) {\n\t\treturn true\n\t}\n\tconst fields =\n\t\tdata && typeof data === 'object' ? (data as Record<string, unknown>).fields : undefined\n\treturn fieldNamesOfType(fields, ['email']).includes(value)\n\t\t? true\n\t\t: asTranslate(req.t)(keys.validationEmailFieldUnknown)\n}\n\n/**\n * `toField` names the form's own email field the confirmation is sent to (a `FieldNameSelect`, not a\n * recipient list). `replyTo`, `cc`, and `bcc` are recipient lists (`RecipientsSelect`, `string[]`):\n * literal emails, picked department addresses (when `departments` is set), or `{{field}}` tokens\n * resolved from the submission at send. `from` is a single address, added only when `fromAddresses`\n * is set. `subject`/`body` are content; `editor` overrides the body editor; `recipients` narrows the\n * recipient fields' behavior. Content and recipient fields carry `localized: true` when `localize`.\n */\n// biome-ignore lint/complexity/useMaxParams: positional args thread plugin options (localize, editor, fromAddresses, departments, recipients)\nexport const buildConfirmation = (\n\tlocalize: boolean,\n\teditor?: RichTextField['editor'],\n\tfromAddresses?: FromAddressesResolver,\n\tdepartments?: DepartmentEmailsResolver,\n\trecipients?: RecipientsConfig\n) => {\n\tconst endpoint = departments ? 'departments' : undefined\n\tconst recip = (name: string, labelKey: string) =>\n\t\tbuildRecipientField(name, labelKey, localize, { endpoint, recipients, width: '50%' })\n\tconst toField: Field = {\n\t\tname: 'toField',\n\t\ttype: 'text',\n\t\tlabel: labelFor(keys.actionConfigToField),\n\t\tadmin: {\n\t\t\twidth: '50%',\n\t\t\tcomponents: {\n\t\t\t\tField: {\n\t\t\t\t\tpath: TO_FIELD_REF,\n\t\t\t\t\tclientProps: { types: ['email'], descriptionKey: keys.actionConfigToFieldDescription },\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t\tvalidate: validateToField,\n\t}\n\treturn defineAction<ConfirmationConfig>({\n\t\ttype: 'confirmation',\n\t\tlabel: keys.actionConfirmation,\n\t\tconfig: [\n\t\t\t{ type: 'row', fields: [toField, recip('replyTo', keys.actionConfigReplyTo)] },\n\t\t\t...(fromAddresses ? [buildFromField(fromAddresses)] : []),\n\t\t\t{\n\t\t\t\ttype: 'row',\n\t\t\t\tfields: [recip('cc', keys.actionConfigCc), recip('bcc', keys.actionConfigBcc)],\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'subject',\n\t\t\t\ttype: 'text',\n\t\t\t\tlabel: labelFor(keys.actionConfigSubject),\n\t\t\t\t...localizedIf(localize),\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'body',\n\t\t\t\ttype: 'richText',\n\t\t\t\tlabel: labelFor(keys.actionConfigBody),\n\t\t\t\tadmin: { description: labelFor(keys.actionConfigBodyDescription) },\n\t\t\t\t...localizedIf(localize),\n\t\t\t\t...(editor ? { editor } : {}),\n\t\t\t},\n\t\t],\n\t\trun: async (args) => {\n\t\t\tconst { config, values, payload, renderBody } = args\n\n\t\t\tif (!config.toField) {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tconst resolve = resolverFor(values)\n\t\t\tconst to = resolve(config.toField)\n\n\t\t\tif (!to) {\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tif (typeof payload.sendEmail !== 'function') {\n\t\t\t\tthrow new Error('confirmation: no email adapter configured')\n\t\t\t}\n\n\t\t\tconst subject = interpolate(config.subject ?? '', resolve)\n\t\t\tconst html = await renderBody(config.body)\n\t\t\tconst cc = resolveRecipients(config.cc, resolve)\n\t\t\tconst bcc = resolveRecipients(config.bcc, resolve)\n\t\t\tconst replyTo = resolveRecipients(config.replyTo, resolve)\n\n\t\t\t// `from` was validated at save time against `fromAddresses(req)`; not re-checked here\n\t\t\t// (the job's `req` may differ from the authoring admin's, and the config is\n\t\t\t// admin-authored, not visitor-controlled), so the stored value is forwarded verbatim.\n\t\t\tawait payload.sendEmail({\n\t\t\t\tto,\n\t\t\t\tsubject,\n\t\t\t\thtml,\n\t\t\t\t...(config.from ? { from: config.from } : {}),\n\t\t\t\t...(cc ? { cc } : {}),\n\t\t\t\t...(bcc ? { bcc } : {}),\n\t\t\t\t...(replyTo ? { replyTo } : {}),\n\t\t\t})\n\t\t},\n\t})\n}\n\nexport const confirmation = buildConfirmation(true)\n"],"mappings":";;;;;;;;;;AAsBA,MAAM,eAAe;;;;;AAMrB,MAAa,mBACZ,OACA,EAAE,MAAM,UACW;CACnB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GACjD,OAAO;CAIR,OAAO,iBADN,QAAQ,OAAO,SAAS,WAAY,KAAiC,SAAS,KAAA,GAC/C,CAAC,OAAO,CAAC,EAAE,SAAS,KAAK,IACtD,OACA,YAAY,IAAI,CAAC,EAAE,KAAK,2BAA2B;AACvD;;;;;;;;;AAWA,MAAa,qBACZ,UACA,QACA,eACA,aACA,eACI;CACJ,MAAM,WAAW,cAAc,gBAAgB,KAAA;CAC/C,MAAM,SAAS,MAAc,aAC5B,oBAAoB,MAAM,UAAU,UAAU;EAAE;EAAU;EAAY,OAAO;CAAM,CAAC;CACrF,MAAM,UAAiB;EACtB,MAAM;EACN,MAAM;EACN,OAAO,SAAS,KAAK,mBAAmB;EACxC,OAAO;GACN,OAAO;GACP,YAAY,EACX,OAAO;IACN,MAAM;IACN,aAAa;KAAE,OAAO,CAAC,OAAO;KAAG,gBAAgB,KAAK;IAA+B;GACtF,EACD;EACD;EACA,UAAU;CACX;CACA,OAAO,aAAiC;EACvC,MAAM;EACN,OAAO,KAAK;EACZ,QAAQ;GACP;IAAE,MAAM;IAAO,QAAQ,CAAC,SAAS,MAAM,WAAW,KAAK,mBAAmB,CAAC;GAAE;GAC7E,GAAI,gBAAgB,CAAC,eAAe,aAAa,CAAC,IAAI,CAAC;GACvD;IACC,MAAM;IACN,QAAQ,CAAC,MAAM,MAAM,KAAK,cAAc,GAAG,MAAM,OAAO,KAAK,eAAe,CAAC;GAC9E;GACA;IACC,MAAM;IACN,MAAM;IACN,OAAO,SAAS,KAAK,mBAAmB;IACxC,GAAG,YAAY,QAAQ;GACxB;GACA;IACC,MAAM;IACN,MAAM;IACN,OAAO,SAAS,KAAK,gBAAgB;IACrC,OAAO,EAAE,aAAa,SAAS,KAAK,2BAA2B,EAAE;IACjE,GAAG,YAAY,QAAQ;IACvB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC5B;EACD;EACA,KAAK,OAAO,SAAS;GACpB,MAAM,EAAE,QAAQ,QAAQ,SAAS,eAAe;GAEhD,IAAI,CAAC,OAAO,SACX;GAGD,MAAM,UAAU,YAAY,MAAM;GAClC,MAAM,KAAK,QAAQ,OAAO,OAAO;GAEjC,IAAI,CAAC,IACJ;GAGD,IAAI,OAAO,QAAQ,cAAc,YAChC,MAAM,IAAI,MAAM,2CAA2C;GAG5D,MAAM,UAAU,YAAY,OAAO,WAAW,IAAI,OAAO;GACzD,MAAM,OAAO,MAAM,WAAW,OAAO,IAAI;GACzC,MAAM,KAAK,kBAAkB,OAAO,IAAI,OAAO;GAC/C,MAAM,MAAM,kBAAkB,OAAO,KAAK,OAAO;GACjD,MAAM,UAAU,kBAAkB,OAAO,SAAS,OAAO;GAKzD,MAAM,QAAQ,UAAU;IACvB;IACA;IACA;IACA,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;IAC3C,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;IACnB,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;IACrB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC9B,CAAC;EACF;CACD,CAAC;AACF;AAE4B,kBAAkB,IAAI"}
+{"version":3,"file":"confirmation.js","names":[],"sources":["../../../src/actions/builtin/confirmation.ts"],"sourcesContent":["import type { Field, PayloadRequest } from 'payload'\nimport { fieldNamesOfType } from '../../fields/fieldNamesOfType'\nimport { keys } from '../../translations/keys'\nimport { asTranslate, labelFor } from '../../translations/server'\nimport { firstAddress } from '../emailRecipients'\nimport { buildEmailAction, type EmailActionConfig, type EmailActionOptions } from './emailAction'\n\ntype ConfirmationConfig = EmailActionConfig & { toField?: string }\n\nconst TO_FIELD_REF = '@10x-media/form-builder/client#FieldNameSelect'\n\n/**\n * Validates the confirmation action's `toField`: unset is fine, otherwise it must name an\n * existing `email`-type field on the form. Exported for unit testing.\n */\nexport const validateToField = (\n\tvalue: unknown,\n\t{ data, req }: { data?: unknown; req: PayloadRequest }\n): string | true => {\n\tif (typeof value !== 'string' || value.length === 0) {\n\t\treturn true\n\t}\n\tconst fields =\n\t\tdata && typeof data === 'object' ? (data as Record<string, unknown>).fields : undefined\n\treturn fieldNamesOfType(fields, ['email']).includes(value)\n\t\t? true\n\t\t: asTranslate(req.t)(keys.validationEmailFieldUnknown)\n}\n\n/**\n * The `confirmation` action: its target is `toField`, naming the form's own email field the\n * confirmation is sent to (a `FieldNameSelect`, not a recipient list). The resolved address is\n * sanitized to a single one (dropping CR/LF header injection and any smuggled extra addresses); an\n * unset field or an unresolvable value is a silent skip. Everything else (from/cc/bcc/replyTo,\n * subject, body, localization) is the shared email-action skeleton.\n */\nexport const buildConfirmation = (options: EmailActionOptions) => {\n\tconst toField: Field = {\n\t\tname: 'toField',\n\t\ttype: 'text',\n\t\tlabel: labelFor(keys.actionConfigToField),\n\t\tadmin: {\n\t\t\twidth: '50%',\n\t\t\tcomponents: {\n\t\t\t\tField: {\n\t\t\t\t\tpath: TO_FIELD_REF,\n\t\t\t\t\tclientProps: { types: ['email'], descriptionKey: keys.actionConfigToFieldDescription },\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t\tvalidate: validateToField,\n\t}\n\treturn buildEmailAction<ConfirmationConfig>(options, {\n\t\ttype: 'confirmation',\n\t\tlabel: keys.actionConfirmation,\n\t\ttarget: () => toField,\n\t\tresolveTo: (config, resolve) =>\n\t\t\tconfig.toField ? firstAddress(resolve(config.toField)) : undefined,\n\t\tonMissingTo: 'skip',\n\t})\n}\n\nexport const confirmation = buildConfirmation({ localize: true })\n"],"mappings":";;;;;;AASA,MAAM,eAAe;;;;;AAMrB,MAAa,mBACZ,OACA,EAAE,MAAM,UACW;CACnB,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GACjD,OAAO;CAIR,OAAO,iBADN,QAAQ,OAAO,SAAS,WAAY,KAAiC,SAAS,KAAA,GAC/C,CAAC,OAAO,CAAC,EAAE,SAAS,KAAK,IACtD,OACA,YAAY,IAAI,CAAC,EAAE,KAAK,2BAA2B;AACvD;;;;;;;;AASA,MAAa,qBAAqB,YAAgC;CACjE,MAAM,UAAiB;EACtB,MAAM;EACN,MAAM;EACN,OAAO,SAAS,KAAK,mBAAmB;EACxC,OAAO;GACN,OAAO;GACP,YAAY,EACX,OAAO;IACN,MAAM;IACN,aAAa;KAAE,OAAO,CAAC,OAAO;KAAG,gBAAgB,KAAK;IAA+B;GACtF,EACD;EACD;EACA,UAAU;CACX;CACA,OAAO,iBAAqC,SAAS;EACpD,MAAM;EACN,OAAO,KAAK;EACZ,cAAc;EACd,YAAY,QAAQ,YACnB,OAAO,UAAU,aAAa,QAAQ,OAAO,OAAO,CAAC,IAAI,KAAA;EAC1D,aAAa;CACd,CAAC;AACF;AAE4B,kBAAkB,EAAE,UAAU,KAAK,CAAC"}

package/dist/actions/builtin/emailAction.d.ts

@@ -0,0 +1,17 @@
+import { FromAddressesResolver } from "../fromAddresses.js";
+import { DepartmentEmailsResolver } from "../../email/departments.js";
+import { RecipientsConfig } from "../emailRecipients.js";
+import { Field, RichTextField } from "payload";
+
+//#region src/actions/builtin/emailAction.d.ts
+/** The plugin-derived options every built-in email action is built from (was five positional args). */
+type EmailActionOptions = {
+  localize: boolean;
+  editor?: RichTextField['editor'];
+  fromAddresses?: FromAddressesResolver;
+  departments?: DepartmentEmailsResolver;
+  recipients?: RecipientsConfig;
+};
+//#endregion
+export { EmailActionOptions };
+//# sourceMappingURL=emailAction.d.ts.map

package/dist/actions/builtin/emailAction.js

@@ -0,0 +1,83 @@
+import { keys } from "../../translations/keys.js";
+import { labelFor } from "../../translations/server.js";
+import { localizedIf } from "../../fields/localizedIf.js";
+import { interpolate } from "../../recall/interpolate.js";
+import { buildRecipientField, resolveRecipients } from "../emailRecipients.js";
+import { resolverFor } from "../body/serializeBody.js";
+import { defineAction } from "../defineAction.js";
+import { buildFromField } from "../fromAddresses.js";
+//#region src/actions/builtin/emailAction.ts
+/**
+* The shared skeleton of the built-in email actions (`emailTeam`, `confirmation`): an identical
+* config (a first row pairing the action's target with `replyTo`, an optional `from` select, a
+* cc/bcc row, a subject, and a rich text body, content and recipient fields carrying `localized`
+* when `localize`) and an identical send (interpolate the subject, render the body, resolve
+* cc/bcc/replyTo, and hand a single comma-joined string per list to `payload.sendEmail`). Only the
+* primary `to` target and its missing-value behavior differ, threaded through `spec`.
+*/
+const buildEmailAction = (options, spec) => {
+	const { localize, editor, fromAddresses, departments, recipients } = options;
+	const endpoint = departments ? "departments" : void 0;
+	const recip = (name, labelKey) => buildRecipientField(name, labelKey, localize, {
+		endpoint,
+		recipients,
+		width: "50%",
+		departments
+	});
+	return defineAction({
+		type: spec.type,
+		label: spec.label,
+		config: [
+			{
+				type: "row",
+				fields: [spec.target(recip), recip("replyTo", keys.actionConfigReplyTo)]
+			},
+			...fromAddresses ? [buildFromField(fromAddresses)] : [],
+			{
+				type: "row",
+				fields: [recip("cc", keys.actionConfigCc), recip("bcc", keys.actionConfigBcc)]
+			},
+			{
+				name: "subject",
+				type: "text",
+				label: labelFor(keys.actionConfigSubject),
+				...localizedIf(localize)
+			},
+			{
+				name: "body",
+				type: "richText",
+				label: labelFor(keys.actionConfigBody),
+				admin: { description: labelFor(keys.actionConfigBodyDescription) },
+				...localizedIf(localize),
+				...editor ? { editor } : {}
+			}
+		],
+		run: async ({ config, values, payload, renderBody }) => {
+			const resolve = resolverFor(values);
+			const to = spec.resolveTo(config, resolve);
+			if (!to) {
+				if (spec.onMissingTo === "throw") throw new Error(`${spec.type}: missing "to" address`);
+				return;
+			}
+			if (typeof payload.sendEmail !== "function") throw new Error(`${spec.type}: no email adapter configured`);
+			const subject = interpolate(config.subject ?? "", resolve);
+			const html = await renderBody(config.body);
+			const cc = resolveRecipients(config.cc, resolve);
+			const bcc = resolveRecipients(config.bcc, resolve);
+			const replyTo = resolveRecipients(config.replyTo, resolve);
+			await payload.sendEmail({
+				to,
+				subject,
+				html,
+				...config.from ? { from: config.from } : {},
+				...cc ? { cc } : {},
+				...bcc ? { bcc } : {},
+				...replyTo ? { replyTo } : {}
+			});
+		}
+	});
+};
+//#endregion
+export { buildEmailAction };
+
+//# sourceMappingURL=emailAction.js.map

package/dist/actions/builtin/emailAction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailAction.js","names":[],"sources":["../../../src/actions/builtin/emailAction.ts"],"sourcesContent":["import type { Field, RichTextField } from 'payload'\nimport type { DepartmentEmailsResolver } from '../../email/departments'\nimport { localizedIf } from '../../fields/localizedIf'\nimport { interpolate } from '../../recall/interpolate'\nimport { keys } from '../../translations/keys'\nimport { labelFor } from '../../translations/server'\nimport { resolverFor } from '../body/serializeBody'\nimport { type ActionDefinition, defineAction } from '../defineAction'\nimport { buildRecipientField, type RecipientsConfig, resolveRecipients } from '../emailRecipients'\nimport { buildFromField, type FromAddressesResolver } from '../fromAddresses'\n\n/** The plugin-derived options every built-in email action is built from (was five positional args). */\nexport type EmailActionOptions = {\n\tlocalize: boolean\n\teditor?: RichTextField['editor']\n\tfromAddresses?: FromAddressesResolver\n\tdepartments?: DepartmentEmailsResolver\n\trecipients?: RecipientsConfig\n}\n\n/** The config fields shared by every built-in email action (each action adds its own `to` target). */\nexport type EmailActionConfig = {\n\tfrom?: string\n\tcc?: string[]\n\tbcc?: string[]\n\treplyTo?: string[]\n\tsubject?: string\n\tbody?: unknown\n}\n\n/** Builds a recipient-list field (`to`/`cc`/`bcc`/`replyTo`) with the shared width, endpoint, and options. */\ntype RecipientFieldBuilder = (name: string, labelKey: string) => Field\n\ntype Resolver = ReturnType<typeof resolverFor>\n\n/** What distinguishes one email action from another: identity, its primary target, and how it resolves/guards that target. */\ntype EmailActionSpec<TConfig extends EmailActionConfig> = {\n\ttype: string\n\tlabel: string\n\t/** The first cell of the opening row (paired with `replyTo`): a recipient list, or an email-field select. */\n\ttarget: (recip: RecipientFieldBuilder) => Field\n\t/** Resolve the primary `to` from the stored config, or `undefined` when there is no recipient. */\n\tresolveTo: (config: TConfig, resolve: Resolver) => string | undefined\n\t/** With no resolved `to`, `emailTeam` treats it as a misconfiguration (`throw`), `confirmation` as a silent skip. */\n\tonMissingTo: 'throw' | 'skip'\n}\n\n/**\n * The shared skeleton of the built-in email actions (`emailTeam`, `confirmation`): an identical\n * config (a first row pairing the action's target with `replyTo`, an optional `from` select, a\n * cc/bcc row, a subject, and a rich text body, content and recipient fields carrying `localized`\n * when `localize`) and an identical send (interpolate the subject, render the body, resolve\n * cc/bcc/replyTo, and hand a single comma-joined string per list to `payload.sendEmail`). Only the\n * primary `to` target and its missing-value behavior differ, threaded through `spec`.\n */\nexport const buildEmailAction = <TConfig extends EmailActionConfig>(\n\toptions: EmailActionOptions,\n\tspec: EmailActionSpec<TConfig>\n): ActionDefinition<TConfig> => {\n\tconst { localize, editor, fromAddresses, departments, recipients } = options\n\tconst endpoint = departments ? 'departments' : undefined\n\tconst recip: RecipientFieldBuilder = (name, labelKey) =>\n\t\tbuildRecipientField(name, labelKey, localize, {\n\t\t\tendpoint,\n\t\t\trecipients,\n\t\t\twidth: '50%',\n\t\t\tdepartments,\n\t\t})\n\treturn defineAction<TConfig>({\n\t\ttype: spec.type,\n\t\tlabel: spec.label,\n\t\tconfig: [\n\t\t\t{\n\t\t\t\ttype: 'row',\n\t\t\t\tfields: [spec.target(recip), recip('replyTo', keys.actionConfigReplyTo)],\n\t\t\t},\n\t\t\t...(fromAddresses ? [buildFromField(fromAddresses)] : []),\n\t\t\t{\n\t\t\t\ttype: 'row',\n\t\t\t\tfields: [recip('cc', keys.actionConfigCc), recip('bcc', keys.actionConfigBcc)],\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'subject',\n\t\t\t\ttype: 'text',\n\t\t\t\tlabel: labelFor(keys.actionConfigSubject),\n\t\t\t\t...localizedIf(localize),\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'body',\n\t\t\t\ttype: 'richText',\n\t\t\t\tlabel: labelFor(keys.actionConfigBody),\n\t\t\t\tadmin: { description: labelFor(keys.actionConfigBodyDescription) },\n\t\t\t\t...localizedIf(localize),\n\t\t\t\t...(editor ? { editor } : {}),\n\t\t\t},\n\t\t],\n\t\trun: async ({ config, values, payload, renderBody }) => {\n\t\t\tconst resolve = resolverFor(values)\n\t\t\tconst to = spec.resolveTo(config, resolve)\n\t\t\tif (!to) {\n\t\t\t\tif (spec.onMissingTo === 'throw') {\n\t\t\t\t\tthrow new Error(`${spec.type}: missing \"to\" address`)\n\t\t\t\t}\n\t\t\t\treturn\n\t\t\t}\n\t\t\tif (typeof payload.sendEmail !== 'function') {\n\t\t\t\tthrow new Error(`${spec.type}: no email adapter configured`)\n\t\t\t}\n\n\t\t\tconst subject = interpolate(config.subject ?? '', resolve)\n\t\t\tconst html = await renderBody(config.body)\n\t\t\tconst cc = resolveRecipients(config.cc, resolve)\n\t\t\tconst bcc = resolveRecipients(config.bcc, resolve)\n\t\t\tconst replyTo = resolveRecipients(config.replyTo, resolve)\n\n\t\t\t// `from` was validated at save time against `fromAddresses(req)`; not re-checked here\n\t\t\t// (the job's `req` may differ from the authoring admin's, and the config is admin-authored,\n\t\t\t// not visitor-controlled), so the stored value is forwarded verbatim.\n\t\t\tawait payload.sendEmail({\n\t\t\t\tto,\n\t\t\t\tsubject,\n\t\t\t\thtml,\n\t\t\t\t...(config.from ? { from: config.from } : {}),\n\t\t\t\t...(cc ? { cc } : {}),\n\t\t\t\t...(bcc ? { bcc } : {}),\n\t\t\t\t...(replyTo ? { replyTo } : {}),\n\t\t\t})\n\t\t},\n\t})\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAuDA,MAAa,oBACZ,SACA,SAC+B;CAC/B,MAAM,EAAE,UAAU,QAAQ,eAAe,aAAa,eAAe;CACrE,MAAM,WAAW,cAAc,gBAAgB,KAAA;CAC/C,MAAM,SAAgC,MAAM,aAC3C,oBAAoB,MAAM,UAAU,UAAU;EAC7C;EACA;EACA,OAAO;EACP;CACD,CAAC;CACF,OAAO,aAAsB;EAC5B,MAAM,KAAK;EACX,OAAO,KAAK;EACZ,QAAQ;GACP;IACC,MAAM;IACN,QAAQ,CAAC,KAAK,OAAO,KAAK,GAAG,MAAM,WAAW,KAAK,mBAAmB,CAAC;GACxE;GACA,GAAI,gBAAgB,CAAC,eAAe,aAAa,CAAC,IAAI,CAAC;GACvD;IACC,MAAM;IACN,QAAQ,CAAC,MAAM,MAAM,KAAK,cAAc,GAAG,MAAM,OAAO,KAAK,eAAe,CAAC;GAC9E;GACA;IACC,MAAM;IACN,MAAM;IACN,OAAO,SAAS,KAAK,mBAAmB;IACxC,GAAG,YAAY,QAAQ;GACxB;GACA;IACC,MAAM;IACN,MAAM;IACN,OAAO,SAAS,KAAK,gBAAgB;IACrC,OAAO,EAAE,aAAa,SAAS,KAAK,2BAA2B,EAAE;IACjE,GAAG,YAAY,QAAQ;IACvB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC5B;EACD;EACA,KAAK,OAAO,EAAE,QAAQ,QAAQ,SAAS,iBAAiB;GACvD,MAAM,UAAU,YAAY,MAAM;GAClC,MAAM,KAAK,KAAK,UAAU,QAAQ,OAAO;GACzC,IAAI,CAAC,IAAI;IACR,IAAI,KAAK,gBAAgB,SACxB,MAAM,IAAI,MAAM,GAAG,KAAK,KAAK,uBAAuB;IAErD;GACD;GACA,IAAI,OAAO,QAAQ,cAAc,YAChC,MAAM,IAAI,MAAM,GAAG,KAAK,KAAK,8BAA8B;GAG5D,MAAM,UAAU,YAAY,OAAO,WAAW,IAAI,OAAO;GACzD,MAAM,OAAO,MAAM,WAAW,OAAO,IAAI;GACzC,MAAM,KAAK,kBAAkB,OAAO,IAAI,OAAO;GAC/C,MAAM,MAAM,kBAAkB,OAAO,KAAK,OAAO;GACjD,MAAM,UAAU,kBAAkB,OAAO,SAAS,OAAO;GAKzD,MAAM,QAAQ,UAAU;IACvB;IACA;IACA;IACA,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;IAC3C,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;IACnB,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;IACrB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC9B,CAAC;EACF;CACD,CAAC;AACF"}

package/dist/actions/builtin/emailTeam.js

@@ -1,81 +1,21 @@
-import { localizedIf } from "../../fields/localizedIf.js";
-import { interpolate } from "../../recall/interpolate.js";
 import { keys } from "../../translations/keys.js";
-import { labelFor } from "../../translations/server.js";
-import { resolverFor } from "../body/serializeBody.js";
-import { defineAction } from "../defineAction.js";
-import { buildRecipientField, resolveRecipients } from "../emailRecipients.js";
-import { buildFromField } from "../fromAddresses.js";
+import { resolveRecipients } from "../emailRecipients.js";
+import { buildEmailAction } from "./emailAction.js";
 //#region src/actions/builtin/emailTeam.ts
 /**
-* `to`, `replyTo`, `cc`, and `bcc` are recipient lists (`RecipientsSelect`, stored as `string[]`):
-* each entry is a literal email, a picked department address (when `departments` is set its options
-* back the select), or a `{{field}}` token resolved from the submission at send. `from` is a single
-* address that never localizes, added only when `fromAddresses` is set. `subject` and `body` are email
-* content; `editor` overrides the body's richText editor. `recipients` narrows the recipient fields'
-* behavior (free-typed emails, field tokens). Content and recipient fields carry `localized: true`
-* when `localize` is true. At send, every recipient list is interpolated, empties dropped, and joined
-* into the comma-separated string `payload.sendEmail` (nodemailer) accepts.
+* The `emailTeam` action: its target is a `to` recipient list (`RecipientsSelect`, `string[]`) of
+* literal emails, picked department addresses, or `{{field}}` tokens resolved from the submission at
+* send. An empty `to` is a misconfiguration and throws. Everything else (from/cc/bcc/replyTo, subject,
+* body, localization) is the shared email-action skeleton.
 */
-const buildEmailTeam = (localize, editor, fromAddresses, departments, recipients) => {
-	const endpoint = departments ? "departments" : void 0;
-	const recip = (name, labelKey) => buildRecipientField(name, labelKey, localize, {
-		endpoint,
-		recipients,
-		width: "50%"
-	});
-	return defineAction({
-		type: "emailTeam",
-		label: keys.actionEmailTeam,
-		config: [
-			{
-				type: "row",
-				fields: [recip("to", keys.actionConfigTo), recip("replyTo", keys.actionConfigReplyTo)]
-			},
-			...fromAddresses ? [buildFromField(fromAddresses)] : [],
-			{
-				type: "row",
-				fields: [recip("cc", keys.actionConfigCc), recip("bcc", keys.actionConfigBcc)]
-			},
-			{
-				name: "subject",
-				type: "text",
-				label: labelFor(keys.actionConfigSubject),
-				...localizedIf(localize)
-			},
-			{
-				name: "body",
-				type: "richText",
-				label: labelFor(keys.actionConfigBody),
-				admin: { description: labelFor(keys.actionConfigBodyDescription) },
-				...localizedIf(localize),
-				...editor ? { editor } : {}
-			}
-		],
-		run: async (args) => {
-			const { config, values, payload, renderBody } = args;
-			const resolve = resolverFor(values);
-			const to = resolveRecipients(config.to, resolve);
-			if (!to) throw new Error("emailTeam: missing \"to\" address");
-			if (typeof payload.sendEmail !== "function") throw new Error("emailTeam: no email adapter configured");
-			const subject = interpolate(config.subject ?? "", resolve);
-			const html = await renderBody(config.body);
-			const cc = resolveRecipients(config.cc, resolve);
-			const bcc = resolveRecipients(config.bcc, resolve);
-			const replyTo = resolveRecipients(config.replyTo, resolve);
-			await payload.sendEmail({
-				to,
-				subject,
-				html,
-				...config.from ? { from: config.from } : {},
-				...cc ? { cc } : {},
-				...bcc ? { bcc } : {},
-				...replyTo ? { replyTo } : {}
-			});
-		}
-	});
-};
-buildEmailTeam(true);
+const buildEmailTeam = (options) => buildEmailAction(options, {
+	type: "emailTeam",
+	label: keys.actionEmailTeam,
+	target: (recip) => recip("to", keys.actionConfigTo),
+	resolveTo: (config, resolve) => resolveRecipients(config.to, resolve),
+	onMissingTo: "throw"
+});
+buildEmailTeam({ localize: true });
 //#endregion
 export { buildEmailTeam };
 

package/dist/actions/builtin/emailTeam.js.map

@@ -1 +1 @@
-{"version":3,"file":"emailTeam.js","names":[],"sources":["../../../src/actions/builtin/emailTeam.ts"],"sourcesContent":["import type { RichTextField } from 'payload'\nimport type { DepartmentEmailsResolver } from '../../email/departments'\nimport { localizedIf } from '../../fields/localizedIf'\nimport { interpolate } from '../../recall/interpolate'\nimport { keys } from '../../translations/keys'\nimport { labelFor } from '../../translations/server'\nimport { resolverFor } from '../body/serializeBody'\nimport { defineAction } from '../defineAction'\nimport { buildRecipientField, type RecipientsConfig, resolveRecipients } from '../emailRecipients'\nimport { buildFromField, type FromAddressesResolver } from '../fromAddresses'\n\ntype EmailTeamConfig = {\n\tto?: string[]\n\tfrom?: string\n\tcc?: string[]\n\tbcc?: string[]\n\treplyTo?: string[]\n\tsubject?: string\n\tbody?: unknown\n}\n\n/**\n * `to`, `replyTo`, `cc`, and `bcc` are recipient lists (`RecipientsSelect`, stored as `string[]`):\n * each entry is a literal email, a picked department address (when `departments` is set its options\n * back the select), or a `{{field}}` token resolved from the submission at send. `from` is a single\n * address that never localizes, added only when `fromAddresses` is set. `subject` and `body` are email\n * content; `editor` overrides the body's richText editor. `recipients` narrows the recipient fields'\n * behavior (free-typed emails, field tokens). Content and recipient fields carry `localized: true`\n * when `localize` is true. At send, every recipient list is interpolated, empties dropped, and joined\n * into the comma-separated string `payload.sendEmail` (nodemailer) accepts.\n */\n// biome-ignore lint/complexity/useMaxParams: positional args thread plugin options (localize, editor, fromAddresses, departments, recipients)\nexport const buildEmailTeam = (\n\tlocalize: boolean,\n\teditor?: RichTextField['editor'],\n\tfromAddresses?: FromAddressesResolver,\n\tdepartments?: DepartmentEmailsResolver,\n\trecipients?: RecipientsConfig\n) => {\n\tconst endpoint = departments ? 'departments' : undefined\n\tconst recip = (name: string, labelKey: string) =>\n\t\tbuildRecipientField(name, labelKey, localize, { endpoint, recipients, width: '50%' })\n\treturn defineAction<EmailTeamConfig>({\n\t\ttype: 'emailTeam',\n\t\tlabel: keys.actionEmailTeam,\n\t\tconfig: [\n\t\t\t{\n\t\t\t\ttype: 'row',\n\t\t\t\tfields: [recip('to', keys.actionConfigTo), recip('replyTo', keys.actionConfigReplyTo)],\n\t\t\t},\n\t\t\t...(fromAddresses ? [buildFromField(fromAddresses)] : []),\n\t\t\t{\n\t\t\t\ttype: 'row',\n\t\t\t\tfields: [recip('cc', keys.actionConfigCc), recip('bcc', keys.actionConfigBcc)],\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'subject',\n\t\t\t\ttype: 'text',\n\t\t\t\tlabel: labelFor(keys.actionConfigSubject),\n\t\t\t\t...localizedIf(localize),\n\t\t\t},\n\t\t\t{\n\t\t\t\tname: 'body',\n\t\t\t\ttype: 'richText',\n\t\t\t\tlabel: labelFor(keys.actionConfigBody),\n\t\t\t\tadmin: { description: labelFor(keys.actionConfigBodyDescription) },\n\t\t\t\t...localizedIf(localize),\n\t\t\t\t...(editor ? { editor } : {}),\n\t\t\t},\n\t\t],\n\t\trun: async (args) => {\n\t\t\tconst { config, values, payload, renderBody } = args\n\n\t\t\tconst resolve = resolverFor(values)\n\t\t\tconst to = resolveRecipients(config.to, resolve)\n\t\t\tif (!to) {\n\t\t\t\tthrow new Error('emailTeam: missing \"to\" address')\n\t\t\t}\n\t\t\tif (typeof payload.sendEmail !== 'function') {\n\t\t\t\tthrow new Error('emailTeam: no email adapter configured')\n\t\t\t}\n\n\t\t\tconst subject = interpolate(config.subject ?? '', resolve)\n\t\t\tconst html = await renderBody(config.body)\n\t\t\tconst cc = resolveRecipients(config.cc, resolve)\n\t\t\tconst bcc = resolveRecipients(config.bcc, resolve)\n\t\t\tconst replyTo = resolveRecipients(config.replyTo, resolve)\n\n\t\t\t// `from` was validated at save time against `fromAddresses(req)`; not re-checked here\n\t\t\t// (the job's `req` may differ from the authoring admin's, and the config is\n\t\t\t// admin-authored, not visitor-controlled), so the stored value is forwarded verbatim.\n\t\t\tawait payload.sendEmail({\n\t\t\t\tto,\n\t\t\t\tsubject,\n\t\t\t\thtml,\n\t\t\t\t...(config.from ? { from: config.from } : {}),\n\t\t\t\t...(cc ? { cc } : {}),\n\t\t\t\t...(bcc ? { bcc } : {}),\n\t\t\t\t...(replyTo ? { replyTo } : {}),\n\t\t\t})\n\t\t},\n\t})\n}\n\nexport const emailTeam = buildEmailTeam(true)\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgCA,MAAa,kBACZ,UACA,QACA,eACA,aACA,eACI;CACJ,MAAM,WAAW,cAAc,gBAAgB,KAAA;CAC/C,MAAM,SAAS,MAAc,aAC5B,oBAAoB,MAAM,UAAU,UAAU;EAAE;EAAU;EAAY,OAAO;CAAM,CAAC;CACrF,OAAO,aAA8B;EACpC,MAAM;EACN,OAAO,KAAK;EACZ,QAAQ;GACP;IACC,MAAM;IACN,QAAQ,CAAC,MAAM,MAAM,KAAK,cAAc,GAAG,MAAM,WAAW,KAAK,mBAAmB,CAAC;GACtF;GACA,GAAI,gBAAgB,CAAC,eAAe,aAAa,CAAC,IAAI,CAAC;GACvD;IACC,MAAM;IACN,QAAQ,CAAC,MAAM,MAAM,KAAK,cAAc,GAAG,MAAM,OAAO,KAAK,eAAe,CAAC;GAC9E;GACA;IACC,MAAM;IACN,MAAM;IACN,OAAO,SAAS,KAAK,mBAAmB;IACxC,GAAG,YAAY,QAAQ;GACxB;GACA;IACC,MAAM;IACN,MAAM;IACN,OAAO,SAAS,KAAK,gBAAgB;IACrC,OAAO,EAAE,aAAa,SAAS,KAAK,2BAA2B,EAAE;IACjE,GAAG,YAAY,QAAQ;IACvB,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;GAC5B;EACD;EACA,KAAK,OAAO,SAAS;GACpB,MAAM,EAAE,QAAQ,QAAQ,SAAS,eAAe;GAEhD,MAAM,UAAU,YAAY,MAAM;GAClC,MAAM,KAAK,kBAAkB,OAAO,IAAI,OAAO;GAC/C,IAAI,CAAC,IACJ,MAAM,IAAI,MAAM,mCAAiC;GAElD,IAAI,OAAO,QAAQ,cAAc,YAChC,MAAM,IAAI,MAAM,wCAAwC;GAGzD,MAAM,UAAU,YAAY,OAAO,WAAW,IAAI,OAAO;GACzD,MAAM,OAAO,MAAM,WAAW,OAAO,IAAI;GACzC,MAAM,KAAK,kBAAkB,OAAO,IAAI,OAAO;GAC/C,MAAM,MAAM,kBAAkB,OAAO,KAAK,OAAO;GACjD,MAAM,UAAU,kBAAkB,OAAO,SAAS,OAAO;GAKzD,MAAM,QAAQ,UAAU;IACvB;IACA;IACA;IACA,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;IAC3C,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;IACnB,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;IACrB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC9B,CAAC;EACF;CACD,CAAC;AACF;AAEyB,eAAe,IAAI"}
+{"version":3,"file":"emailTeam.js","names":[],"sources":["../../../src/actions/builtin/emailTeam.ts"],"sourcesContent":["import { keys } from '../../translations/keys'\nimport { resolveRecipients } from '../emailRecipients'\nimport { buildEmailAction, type EmailActionConfig, type EmailActionOptions } from './emailAction'\n\ntype EmailTeamConfig = EmailActionConfig & { to?: string[] }\n\n/**\n * The `emailTeam` action: its target is a `to` recipient list (`RecipientsSelect`, `string[]`) of\n * literal emails, picked department addresses, or `{{field}}` tokens resolved from the submission at\n * send. An empty `to` is a misconfiguration and throws. Everything else (from/cc/bcc/replyTo, subject,\n * body, localization) is the shared email-action skeleton.\n */\nexport const buildEmailTeam = (options: EmailActionOptions) =>\n\tbuildEmailAction<EmailTeamConfig>(options, {\n\t\ttype: 'emailTeam',\n\t\tlabel: keys.actionEmailTeam,\n\t\ttarget: (recip) => recip('to', keys.actionConfigTo),\n\t\tresolveTo: (config, resolve) => resolveRecipients(config.to, resolve),\n\t\tonMissingTo: 'throw',\n\t})\n\nexport const emailTeam = buildEmailTeam({ localize: true })\n"],"mappings":";;;;;;;;;;AAYA,MAAa,kBAAkB,YAC9B,iBAAkC,SAAS;CAC1C,MAAM;CACN,OAAO,KAAK;CACZ,SAAS,UAAU,MAAM,MAAM,KAAK,cAAc;CAClD,YAAY,QAAQ,YAAY,kBAAkB,OAAO,IAAI,OAAO;CACpE,aAAa;AACd,CAAC;AAEuB,eAAe,EAAE,UAAU,KAAK,CAAC"}

package/dist/actions/builtin/index.d.ts

@@ -1,23 +1,20 @@
 import { AnyActionDefinition } from "../defineAction.js";
-import { FromAddressesResolver } from "../fromAddresses.js";
-import { RecipientsConfig } from "../emailRecipients.js";
-import { DepartmentEmailsResolver } from "../../email/departments.js";
-import { RichTextField } from "payload";
+import { EmailActionOptions } from "./emailAction.js";
 
 //#region src/actions/builtin/index.d.ts
 /**
  * Built-in action definitions with content-bearing config fields (email subjects and rich text
- * bodies) carrying `localized: true` when `localize` is true. `editor`, when given, overrides
- * the Lexical/richText editor on both action bodies (the plugin passes
- * `richText.bodyEditor ?? richText.editor`). `fromAddresses`, when given (the plugin's
- * `email.fromAddresses` option), adds a `from` select to both email actions. `departments`, when
- * given (the plugin's `email.departments` option), turns the `emailTeam` `to` into a select over the
- * host's resolved departments. `signedWebhook` has no content fields and is shared static.
+ * bodies) carrying `localized: true` when `options.localize` is true. `options.editor`, when given,
+ * overrides the Lexical/richText editor on both action bodies (the plugin passes
+ * `richText.bodyEditor ?? richText.editor`). `options.fromAddresses` (the plugin's
+ * `email.fromAddresses` option) adds a `from` select to both email actions. `options.departments`
+ * (the plugin's `email.departments` option) turns the recipient selects into pickers over the host's
+ * resolved departments. `signedWebhook` has no content fields and is shared static.
  */
-declare const buildDefaultActionDefinitions: (localize: boolean, editor?: RichTextField["editor"], fromAddresses?: FromAddressesResolver, departments?: DepartmentEmailsResolver, recipients?: RecipientsConfig) => Record<string, AnyActionDefinition>;
+declare const buildDefaultActionDefinitions: (options: EmailActionOptions) => Record<string, AnyActionDefinition>;
 /**
  * Prebuilt with content localization on; with `localizeContent: false`, derive overrides from
- * `buildDefaultActionDefinitions(false)` instead so a spread does not reintroduce `localized`.
+ * `buildDefaultActionDefinitions({ localize: false })` instead so a spread does not reintroduce `localized`.
  */
 declare const defaultActionDefinitions: Record<string, AnyActionDefinition>;
 //#endregion