@actuate-media/cms-core 0.31.0 → 0.32.0

package/dist/__tests__/api/public-forms.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=public-forms.test.d.ts.map

package/dist/__tests__/api/public-forms.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-forms.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/api/public-forms.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/api/public-forms.test.js

@@ -0,0 +1,125 @@
+import { beforeEach, afterAll, describe, expect, it } from 'vitest';
+import { handleActuateAPI } from '../../api/index.js';
+import { initDB } from '../../db.js';
+const SECRET = 'test-secret-for-public-forms-1234567890';
+const FORM_ROW = {
+    id: 'form-1',
+    title: 'Contact Us',
+    slug: 'contact-us',
+    collection: 'forms',
+    createdById: 'admin-1',
+    createdAt: new Date('2026-01-01T00:00:00.000Z'),
+    updatedAt: new Date('2026-01-02T00:00:00.000Z'),
+    data: {
+        name: 'Contact Us',
+        slug: 'contact-us',
+        status: 'active',
+        activeSchemaVersionId: null,
+        successMessage: 'Got it!',
+        fields: [
+            { id: '1', key: 'name', label: 'Name', type: 'text', required: true, sortOrder: 0 },
+            { id: '2', key: 'email', label: 'Email', type: 'email', required: true, sortOrder: 1 },
+            { id: '3', key: 'hp', label: 'Leave blank', type: 'honeypot', required: false, sortOrder: 2 },
+        ],
+    },
+};
+function createMockDB() {
+    const created = [];
+    const db = {
+        created,
+        session: { findUnique: async () => ({ revokedAt: null }) },
+        user: {},
+        media: {},
+        document: {
+            findFirst: async (args) => {
+                const where = args?.where ?? {};
+                if (where.collection !== 'forms')
+                    return null;
+                if (where.slug && where.slug !== 'contact-us')
+                    return null;
+                if (where.id && where.id !== 'form-1')
+                    return null;
+                return FORM_ROW;
+            },
+        },
+        formSubmission: {
+            aggregate: async () => ({ _max: { entryNumber: 7 } }),
+            create: async ({ data }) => {
+                created.push(data);
+                return { id: 'sub_1', entryNumber: data.entryNumber };
+            },
+            groupBy: async () => [],
+            count: async () => 0,
+        },
+    };
+    db.$transaction = async (fn) => fn(db);
+    return db;
+}
+describe('public form endpoints', () => {
+    beforeEach(() => {
+        process.env.CMS_SECRET = SECRET;
+        process.env.ACTUATE_DISABLE_RATE_LIMIT = '1';
+        initDB(createMockDB());
+    });
+    afterAll(() => {
+        delete process.env.ACTUATE_DISABLE_RATE_LIMIT;
+    });
+    it('serves a public, embeddable schema with the honeypot stripped', async () => {
+        const handler = handleActuateAPI({ prismaClient: createMockDB() });
+        const res = await handler(new Request('https://example.com/api/cms/public/forms/contact-us', {
+            headers: { origin: 'https://embed.site' },
+        }));
+        expect(res.status).toBe(200);
+        expect(res.headers.get('access-control-allow-origin')).toBe('https://embed.site');
+        const body = (await res.json());
+        expect(body.data.slug).toBe('contact-us');
+        expect(body.data.submitPath).toBe('/api/cms/public/forms/contact-us/submit');
+        expect(body.data.fields.map((f) => f.key)).toEqual(['name', 'email']);
+        expect(body.data.spam.honeypotFieldKey).toBe('hp');
+    });
+    it('returns 404 for an unknown form', async () => {
+        const handler = handleActuateAPI({ prismaClient: createMockDB() });
+        const res = await handler(new Request('https://example.com/api/cms/public/forms/missing'));
+        expect(res.status).toBe(404);
+    });
+    it('answers a CORS preflight with 204', async () => {
+        const handler = handleActuateAPI({ prismaClient: createMockDB() });
+        const res = await handler(new Request('https://example.com/api/cms/public/forms/contact-us/submit', {
+            method: 'OPTIONS',
+            headers: { origin: 'https://embed.site' },
+        }));
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-methods')).toContain('POST');
+    });
+    it('accepts a valid JSON submission and returns a confirmation', async () => {
+        const db = createMockDB();
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db });
+        const res = await handler(new Request('https://example.com/api/cms/public/forms/contact-us/submit', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ fields: { name: 'Ada', email: 'ada@calc.io' } }),
+        }));
+        expect(res.status).toBe(201);
+        const body = (await res.json());
+        expect(body.data.success).toBe(true);
+        expect(body.data.entryNumber).toBe(8);
+        expect(body.data.confirmation).toEqual({ type: 'message', message: 'Got it!' });
+        expect(db.created[0].senderEmail).toBe('ada@calc.io');
+    });
+    it('rejects an invalid submission with a 422 and field errors', async () => {
+        const db = createMockDB();
+        initDB(db);
+        const handler = handleActuateAPI({ prismaClient: db });
+        const res = await handler(new Request('https://example.com/api/cms/public/forms/contact-us/submit', {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ fields: { name: '', email: 'bad' } }),
+        }));
+        expect(res.status).toBe(422);
+        const body = (await res.json());
+        expect(body.code).toBe('VALIDATION_ERROR');
+        expect(body.details.length).toBeGreaterThan(0);
+    });
+});
+//# sourceMappingURL=public-forms.test.js.map

package/dist/__tests__/api/public-forms.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-forms.test.js","sourceRoot":"","sources":["../../../src/__tests__/api/public-forms.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,MAAM,MAAM,GAAG,yCAAyC,CAAA;AAExD,MAAM,QAAQ,GAAG;IACf,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,YAAY;IAClB,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,SAAS;IACtB,SAAS,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC;IAC/C,SAAS,EAAE,IAAI,IAAI,CAAC,0BAA0B,CAAC;IAC/C,IAAI,EAAE;QACJ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,QAAQ;QAChB,qBAAqB,EAAE,IAAI;QAC3B,cAAc,EAAE,SAAS;QACzB,MAAM,EAAE;YACN,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;YACnF,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;YACtF,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE;SAC9F;KACF;CACF,CAAA;AAED,SAAS,YAAY;IACnB,MAAM,OAAO,GAAU,EAAE,CAAA;IACzB,MAAM,EAAE,GAAQ;QACd,OAAO;QACP,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE;QAC1D,IAAI,EAAE,EAAE;QACR,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE;YACR,SAAS,EAAE,KAAK,EAAE,IAAsE,EAAE,EAAE;gBAC1F,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;gBAC/B,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO;oBAAE,OAAO,IAAI,CAAA;gBAC7C,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;oBAAE,OAAO,IAAI,CAAA;gBAC1D,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ;oBAAE,OAAO,IAAI,CAAA;gBAClD,OAAO,QAAQ,CAAA;YACjB,CAAC;SACF;QACD,cAAc,EAAE;YACd,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;gBAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAClB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;YACvD,CAAC;YACD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;YACvB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;SACrB;KACF,CAAA;IACD,EAAE,CAAC,YAAY,GAAG,KAAK,EAAE,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC3C,OAAO,EAAE,CAAA;AACX,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,MAAM,CAAA;QAC/B,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,GAAG,CAAA;QAC5C,MAAM,CAAC,YAAY,EAAE,CAAC,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,GAAG,EAAE;QACZ,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,qDAAqD,EAAE;YACjE,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;SAC1C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAEjF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;QAC1E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,OAAO,CAAC,kDAAkD,CAAC,CAAC,CAAA;QAC1F,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4DAA4D,EAAE;YACxE,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE;SAC1C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4DAA4D,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC;SACxE,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QAC/E,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAA;QACzB,MAAM,CAAC,EAAE,CAAC,CAAA;QACV,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;QACtD,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,IAAI,OAAO,CAAC,4DAA4D,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;SAC7D,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsD,CAAA;QACpF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/spam.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=spam.test.d.ts.map

package/dist/__tests__/forms/spam.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spam.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/spam.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/spam.test.js

@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest';
+import { scoreSubmissionSpam } from '../../forms/spam.js';
+function field(overrides) {
+    return {
+        id: 'f',
+        label: 'Label',
+        key: 'key',
+        type: 'text',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+describe('scoreSubmissionSpam', () => {
+    it('returns clean when no strategies trigger', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'name' })],
+            rawValues: { name: 'Ada' },
+        });
+        expect(result.status).toBe('clean');
+        expect(result.reasons).toHaveLength(0);
+    });
+    it('flags a populated honeypot regardless of enabled strategies', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'name' }), field({ key: 'website', type: 'honeypot' })],
+            rawValues: { name: 'Ada', website: 'http://spam.example' },
+        });
+        expect(result.status).toBe('spam');
+        expect(result.reasons).toContain('honeypot');
+    });
+    it('ignores an empty honeypot', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'hp', type: 'honeypot' })],
+            rawValues: { hp: '' },
+        });
+        expect(result.status).toBe('clean');
+    });
+    it('flags submissions faster than the minimum submit time', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'name' })],
+            rawValues: { name: 'Ada' },
+            settings: { strategies: ['timeToSubmit'], minSubmitSeconds: 3 },
+            elapsedMs: 500,
+        });
+        expect(result.status).toBe('spam');
+        expect(result.reasons).toContain('too_fast');
+    });
+    it('does not flag a normal-speed submission', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'name' })],
+            rawValues: { name: 'Ada' },
+            settings: { strategies: ['timeToSubmit'], minSubmitSeconds: 3 },
+            elapsedMs: 8000,
+        });
+        expect(result.status).toBe('clean');
+    });
+    it('blocks emails and domains on the blocklist', () => {
+        const byEmail = scoreSubmissionSpam({
+            fields: [field({ key: 'email', type: 'email' })],
+            rawValues: { email: 'bad@evil.com' },
+            settings: { strategies: ['blocklist'], blockedEmails: ['bad@evil.com'] },
+            senderEmail: 'bad@evil.com',
+        });
+        expect(byEmail.reasons).toContain('blocked_email');
+        const byDomain = scoreSubmissionSpam({
+            fields: [field({ key: 'email', type: 'email' })],
+            rawValues: { email: 'x@evil.com' },
+            settings: { strategies: ['blocklist'], blockedDomains: ['evil.com'] },
+            senderEmail: 'x@evil.com',
+        });
+        expect(byDomain.reasons).toContain('blocked_domain');
+    });
+    it('flags blocked keywords in any text value', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'message', type: 'textarea' })],
+            rawValues: { message: 'Cheap V1AGRA available now' },
+            settings: { strategies: ['keyword'], blockedKeywords: ['viagra'] },
+        });
+        // case-insensitive substring; 'viagra' won't match 'v1agra', so this stays clean
+        expect(result.status).toBe('clean');
+        const hit = scoreSubmissionSpam({
+            fields: [field({ key: 'message', type: 'textarea' })],
+            rawValues: { message: 'Buy cheap loans today' },
+            settings: { strategies: ['keyword'], blockedKeywords: ['cheap loans'] },
+        });
+        expect(hit.reasons).toContain('blocked_keyword');
+    });
+    it('enforces a domain allowlist against the origin', () => {
+        const blocked = scoreSubmissionSpam({
+            fields: [field({ key: 'name' })],
+            rawValues: { name: 'Ada' },
+            settings: { strategies: ['domainAllowlist'], allowedDomains: ['mysite.com'] },
+            origin: 'https://evil.example',
+        });
+        expect(blocked.reasons).toContain('origin_not_allowed');
+        const allowed = scoreSubmissionSpam({
+            fields: [field({ key: 'name' })],
+            rawValues: { name: 'Ada' },
+            settings: { strategies: ['domainAllowlist'], allowedDomains: ['mysite.com'] },
+            origin: 'https://www.mysite.com',
+        });
+        expect(allowed.status).toBe('clean');
+    });
+    it('merges site-wide default strategies with per-form ones', () => {
+        const result = scoreSubmissionSpam({
+            fields: [field({ key: 'email', type: 'email' })],
+            rawValues: { email: 'x@evil.com' },
+            defaultStrategies: ['blocklist'],
+            settings: { blockedDomains: ['evil.com'] },
+            senderEmail: 'x@evil.com',
+        });
+        expect(result.status).toBe('spam');
+    });
+});
+//# sourceMappingURL=spam.test.js.map

package/dist/__tests__/forms/spam.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spam.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/spam.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAGzD,SAAS,KAAK,CAAC,SAA6B;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SAC3B,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7E,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;SAC3D,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAChD,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1B,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE;YAC/D,SAAS,EAAE,GAAG;SACf,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1B,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE;YAC/D,SAAS,EAAE,IAAI;SAChB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC;YAClC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,SAAS,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;YACpC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,cAAc,CAAC,EAAE;YACxE,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAElD,MAAM,QAAQ,GAAG,mBAAmB,CAAC;YACnC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAClC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE;YACrE,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACrD,SAAS,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE;YACpD,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC,QAAQ,CAAC,EAAE;SACnE,CAAC,CAAA;QACF,iFAAiF;QACjF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEnC,MAAM,GAAG,GAAG,mBAAmB,CAAC;YAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YACrD,SAAS,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE;YAC/C,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC,aAAa,CAAC,EAAE;SACxE,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,OAAO,GAAG,mBAAmB,CAAC;YAClC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1B,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE;YAC7E,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAG,mBAAmB,CAAC;YAClC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YAChC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YAC1B,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,CAAC,YAAY,CAAC,EAAE;YAC7E,MAAM,EAAE,wBAAwB;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,MAAM,GAAG,mBAAmB,CAAC;YACjC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAChD,SAAS,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;YAClC,iBAAiB,EAAE,CAAC,WAAW,CAAC;YAChC,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC,UAAU,CAAC,EAAE;YAC1C,WAAW,EAAE,YAAY;SAC1B,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/submission-files.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=submission-files.test.d.ts.map

package/dist/__tests__/forms/submission-files.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-files.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-files.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/submission-files.test.js

@@ -0,0 +1,65 @@
+import { describe, expect, it } from 'vitest';
+import { validateSubmissionFiles } from '../../forms/files.js';
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0x00, 0x00, 0x0d]);
+const PDF = Buffer.from('%PDF-1.4\n%âãÏÓ\n', 'latin1');
+function fileField(overrides) {
+    return {
+        id: 'f',
+        label: 'Attachment',
+        key: 'attachment',
+        type: 'file',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+function incoming(overrides) {
+    return {
+        fieldKey: 'attachment',
+        fileName: 'photo.png',
+        mimeType: 'image/png',
+        size: PNG.byteLength,
+        buffer: PNG,
+        ...overrides,
+    };
+}
+describe('validateSubmissionFiles', () => {
+    it('accepts a valid PNG against a file field', () => {
+        const result = validateSubmissionFiles([fileField({})], [incoming({})]);
+        expect(result.ok).toBe(true);
+        expect(result.errors).toHaveLength(0);
+    });
+    it('rejects files larger than the size cap', () => {
+        const result = validateSubmissionFiles([fileField({})], [incoming({ size: 999_999_999 })], {
+            maxSizeBytes: 1024,
+        });
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.fieldKey).toBe('attachment');
+    });
+    it('rejects disallowed MIME types', () => {
+        const result = validateSubmissionFiles([fileField({})], [incoming({ mimeType: 'application/zip', fileName: 'x.zip', buffer: PNG })]);
+        expect(result.ok).toBe(false);
+    });
+    it('rejects content that does not match the declared MIME (magic-byte sniff)', () => {
+        const result = validateSubmissionFiles([fileField({})], [
+            incoming({
+                mimeType: 'image/png',
+                fileName: 'fake.png',
+                buffer: PDF,
+                size: PDF.byteLength,
+            }),
+        ]);
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.message).toMatch(/do not match/i);
+    });
+    it('rejects a file uploaded to a non-file field', () => {
+        const result = validateSubmissionFiles([{ id: 't', label: 'Name', key: 'name', type: 'text', required: false, sortOrder: 0 }], [incoming({ fieldKey: 'name' })]);
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.message).toMatch(/unexpected/i);
+    });
+    it('honours per-field fileTypes to narrow the allowlist', () => {
+        const result = validateSubmissionFiles([fileField({ validationRules: { fileTypes: ['application/pdf'] } })], [incoming({})]);
+        expect(result.ok).toBe(false);
+    });
+});
+//# sourceMappingURL=submission-files.test.js.map

package/dist/__tests__/forms/submission-files.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-files.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-files.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,uBAAuB,EAAqB,MAAM,sBAAsB,CAAA;AAGjF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACjG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAA;AAEtD,SAAS,SAAS,CAAC,SAA6B;IAC9C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,YAAY;QACnB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,SAAgC;IAChD,OAAO;QACL,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,WAAW;QACrB,IAAI,EAAE,GAAG,CAAC,UAAU;QACpB,MAAM,EAAE,GAAG;QACX,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE;YACzF,YAAY,EAAE,IAAI;SACnB,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EACf,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAC5E,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EACf;YACE,QAAQ,CAAC;gBACP,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,GAAG,CAAC,UAAU;aACrB,CAAC;SACH,CACF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EACtF,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CACjC,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,uBAAuB,CACpC,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,CAAC,CAAC,EACpE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CACf,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/submission-pipeline.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=submission-pipeline.test.d.ts.map

package/dist/__tests__/forms/submission-pipeline.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-pipeline.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-pipeline.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/submission-pipeline.test.js

@@ -0,0 +1,131 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+const dbHolder = { current: {} };
+vi.mock('../../db.js', () => ({ getDB: () => dbHolder.current }));
+vi.mock('../../security/audit.js', () => ({ logEvent: vi.fn(async () => { }) }));
+vi.mock('../../config/runtime.js', () => ({
+    getActuateConfig: () => ({ forms: { defaultSuccessMessage: 'Thanks!' } }),
+}));
+import { processSubmission, buildPublicForm, SubmissionValidationError, } from '../../forms/submission.js';
+function field(overrides) {
+    return {
+        id: 'f',
+        label: 'Label',
+        key: 'key',
+        type: 'text',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+function form(overrides = {}) {
+    return {
+        id: 'form_1',
+        name: 'Contact Us',
+        slug: 'contact-us',
+        status: 'active',
+        activeSchemaVersionId: null,
+        fields: [
+            field({ key: 'name', type: 'text', required: true }),
+            field({ key: 'email', type: 'email', required: true }),
+            field({ key: 'message', type: 'textarea' }),
+        ],
+        successMessage: 'Got it!',
+        ...overrides,
+    };
+}
+function fakeDb() {
+    const created = [];
+    return {
+        created,
+        $transaction: async (fn) => fn({
+            formSubmission: {
+                aggregate: async () => ({ _max: { entryNumber: 4 } }),
+                create: async ({ data }) => {
+                    created.push(data);
+                    return { id: 'sub_1', entryNumber: data.entryNumber };
+                },
+            },
+        }),
+    };
+}
+describe('processSubmission', () => {
+    beforeEach(() => {
+        dbHolder.current = fakeDb();
+    });
+    it('persists a clean submission with the next entry number and derived sender', async () => {
+        const result = await processSubmission(form(), {
+            values: { name: 'Ada Lovelace', email: 'ada@calc.io', message: 'Hello there' },
+            ip: '203.0.113.5',
+            userAgent: 'jest',
+            attribution: { source: 'google', medium: 'cpc', campaign: 'spring' },
+        });
+        expect(result.spamStatus).toBe('clean');
+        expect(result.entryNumber).toBe(5);
+        expect(result.confirmation).toEqual({ type: 'message', message: 'Got it!' });
+        const row = dbHolder.current.created[0];
+        expect(row.senderName).toBe('Ada Lovelace');
+        expect(row.senderEmail).toBe('ada@calc.io');
+        expect(row.spamStatus).toBe('clean');
+        expect(row.utmSource).toBe('google');
+        expect(row.utmCampaign).toBe('spring');
+        // IP is hashed, never stored raw.
+        expect(row.ipAddressHash).toBeTruthy();
+        expect(row.ipAddressHash).not.toContain('203.0.113.5');
+    });
+    it('marks a honeypot-tripped submission as spam but still persists it', async () => {
+        const result = await processSubmission(form({ fields: [...form().fields, field({ key: 'company', type: 'honeypot' })] }), {
+            values: { name: 'Bot', email: 'bot@spam.io', company: 'filled-by-bot' },
+        });
+        expect(result.spamStatus).toBe('spam');
+        expect(dbHolder.current.created[0].spamStatus).toBe('spam');
+    });
+    it('throws SubmissionValidationError on invalid input', async () => {
+        await expect(processSubmission(form(), { values: { name: '', email: 'nope' } })).rejects.toBeInstanceOf(SubmissionValidationError);
+    });
+    it('builds a redirect confirmation when the form has a redirect URL', async () => {
+        const result = await processSubmission(form({ redirectUrl: 'https://site.com/thanks' }), {
+            values: { name: 'Ada', email: 'ada@calc.io' },
+        });
+        expect(result.confirmation).toEqual({
+            type: 'redirect',
+            redirectUrl: 'https://site.com/thanks',
+        });
+    });
+});
+describe('buildPublicForm', () => {
+    it('projects a safe, embeddable schema', () => {
+        const f = form({
+            fields: [
+                field({
+                    key: 'name',
+                    type: 'text',
+                    validationRules: { required: true, customValidator: 'secretHook' },
+                }),
+                field({ key: 'hp', type: 'honeypot' }),
+            ],
+            spamSettings: { honeypotFieldKey: 'hp', minSubmitSeconds: 3, blockedEmails: ['x@y.com'] },
+        });
+        const publicForm = buildPublicForm(f, f.fields, null, {
+            captcha: { provider: 'turnstile', siteKey: 'site-123' },
+        });
+        // Honeypot field is never exposed.
+        expect(publicForm.fields.find((field) => field.key === 'hp')).toBeUndefined();
+        // Server-only validator name is stripped.
+        expect(publicForm.fields[0]?.validationRules).not.toHaveProperty('customValidator');
+        // Spam internals limited to render-time hints; blocklist never leaks.
+        expect(publicForm.spam.honeypotFieldKey).toBe('hp');
+        expect(publicForm.spam.minSubmitSeconds).toBe(3);
+        expect(JSON.stringify(publicForm)).not.toContain('x@y.com');
+        // Submit path + captcha hint exposed.
+        expect(publicForm.submitPath).toBe('/api/cms/public/forms/contact-us/submit');
+        expect(publicForm.captcha).toEqual({ provider: 'turnstile', siteKey: 'site-123' });
+    });
+    it('omits the captcha hint when no provider is configured', () => {
+        const f = form();
+        const publicForm = buildPublicForm(f, f.fields, null, {
+            captcha: { provider: 'none', siteKey: '' },
+        });
+        expect(publicForm.captcha).toBeUndefined();
+    });
+});
+//# sourceMappingURL=submission-pipeline.test.js.map

package/dist/__tests__/forms/submission-pipeline.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-pipeline.test.js","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-pipeline.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAE7D,MAAM,QAAQ,GAAqB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAClD,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;AACjE,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC/E,EAAE,CAAC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,CAAC;IACxC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,qBAAqB,EAAE,SAAS,EAAE,EAAE,CAAC;CAC1E,CAAC,CAAC,CAAA;AAEH,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,yBAAyB,GAC1B,MAAM,2BAA2B,CAAA;AAGlC,SAAS,KAAK,CAAC,SAA6B;IAC1C,OAAO;QACL,EAAE,EAAE,GAAG;QACP,KAAK,EAAE,OAAO;QACd,GAAG,EAAE,KAAK;QACV,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,CAAC;QACZ,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,SAAS,IAAI,CAAC,YAAqC,EAAE;IACnD,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,QAAQ;QAChB,qBAAqB,EAAE,IAAI;QAC3B,MAAM,EAAE;YACN,KAAK,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpD,KAAK,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACtD,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SAC5C;QACD,cAAc,EAAE,SAAS;QACzB,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,SAAS,MAAM;IACb,MAAM,OAAO,GAAU,EAAE,CAAA;IACzB,OAAO;QACL,OAAO;QACP,YAAY,EAAE,KAAK,EAAE,EAAO,EAAE,EAAE,CAC9B,EAAE,CAAC;YACD,cAAc,EAAE;gBACd,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;gBACrD,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAO,EAAE,EAAE;oBAC9B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAClB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAA;gBACvD,CAAC;aACF;SACF,CAAC;KACL,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,UAAU,CAAC,GAAG,EAAE;QACd,QAAQ,CAAC,OAAO,GAAG,MAAM,EAAE,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE;YAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE;YAC9E,EAAE,EAAE,aAAa;YACjB,SAAS,EAAE,MAAM;YACjB,WAAW,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE;SACrE,CAAC,CAAA;QAEF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QAE5E,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,kCAAkC;QAClC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAA;QACtC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,EACjF;YACE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,EAAE;SACxE,CACF,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACtC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,MAAM,CACV,iBAAiB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,EAAE;YACvF,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YAClC,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,yBAAyB;SACvC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC;YACb,MAAM,EAAE;gBACN,KAAK,CAAC;oBACJ,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,MAAM;oBACZ,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE;iBACnE,CAAC;gBACF,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;aACvC;YACD,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE;SAC1F,CAAC,CAAA;QAEF,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE;YACpD,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE;SACxD,CAAC,CAAA;QAEF,mCAAmC;QACnC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAC7E,0CAA0C;QAC1C,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAA;QACnF,sEAAsE;QACtE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QAC3D,sCAAsC;QACtC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QAC7E,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,GAAG,IAAI,EAAE,CAAA;QAChB,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE;YACpD,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;SAC3C,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/__tests__/forms/submission-validation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=submission-validation.test.d.ts.map

package/dist/__tests__/forms/submission-validation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission-validation.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/forms/submission-validation.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/forms/submission-validation.test.js

@@ -0,0 +1,108 @@
+import { describe, expect, it } from 'vitest';
+import { validateAndNormalizeSubmission } from '../../forms/validation.js';
+function field(overrides) {
+    return {
+        id: 'f',
+        label: 'Label',
+        key: 'key',
+        type: 'text',
+        required: false,
+        sortOrder: 0,
+        ...overrides,
+    };
+}
+describe('validateAndNormalizeSubmission', () => {
+    it('accepts a valid payload and coerces types', () => {
+        const result = validateAndNormalizeSubmission([
+            field({ key: 'name', type: 'text' }),
+            field({ key: 'age', type: 'number' }),
+            field({ key: 'subscribe', type: 'checkbox' }),
+            field({
+                key: 'topics',
+                type: 'multiselect',
+                options: [
+                    { label: 'A', value: 'a' },
+                    { label: 'B', value: 'b' },
+                ],
+            }),
+        ], { name: 'Ada', age: '42', subscribe: 'on', topics: ['a', 'b'] });
+        expect(result.ok).toBe(true);
+        expect(result.normalized.age).toBe(42);
+        expect(result.normalized.subscribe).toBe(true);
+        expect(result.normalized.topics).toEqual(['a', 'b']);
+        expect(result.data.name).toBe('Ada');
+    });
+    it('flags required fields that are missing or blank', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'name', required: true }), field({ key: 'note', required: false })], { name: '   ' });
+        expect(result.ok).toBe(false);
+        expect(result.errors.some((e) => e.key === 'name')).toBe(true);
+    });
+    it('validates email format for email-typed fields', () => {
+        const ok = validateAndNormalizeSubmission([field({ key: 'email', type: 'email' })], {
+            email: 'a@b.co',
+        });
+        expect(ok.ok).toBe(true);
+        const bad = validateAndNormalizeSubmission([field({ key: 'email', type: 'email' })], {
+            email: 'not-an-email',
+        });
+        expect(bad.ok).toBe(false);
+        expect(bad.errors[0]?.key).toBe('email');
+    });
+    it('strips HTML from string values to prevent stored XSS', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'msg', type: 'textarea' })], {
+            msg: '<script>alert(1)</script>Hello <b>there</b>',
+        });
+        expect(result.ok).toBe(true);
+        const stored = String(result.data.msg);
+        expect(stored).not.toContain('<script');
+        expect(stored).not.toContain('alert(1)');
+        expect(stored).toContain('Hello');
+    });
+    it('drops keys that are not part of the schema', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'name' })], {
+            name: 'Ada',
+            injected: 'evil',
+        });
+        expect(result.data).toHaveProperty('name');
+        expect(result.data).not.toHaveProperty('injected');
+    });
+    it('rejects select values outside the option set', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'plan', type: 'select', options: [{ label: 'Pro', value: 'pro' }] })], { plan: 'enterprise' });
+        expect(result.ok).toBe(false);
+        expect(result.errors[0]?.key).toBe('plan');
+    });
+    it('enforces number min/max', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'qty', type: 'number', validationRules: { min: 1, max: 10 } })], { qty: '20' });
+        expect(result.ok).toBe(false);
+    });
+    it('requires consent fields to be accepted', () => {
+        const result = validateAndNormalizeSubmission([field({ key: 'terms', type: 'consent', required: true })], { terms: 'false' });
+        expect(result.ok).toBe(false);
+    });
+    it('skips fields hidden by conditional logic (not required, not stored)', () => {
+        const fields = [
+            field({ key: 'hasCompany', type: 'select', options: [{ label: 'Yes', value: 'yes' }] }),
+            field({
+                key: 'companyName',
+                required: true,
+                conditionalLogic: { show: [{ fieldKey: 'hasCompany', operator: 'equals', value: 'yes' }] },
+            }),
+        ];
+        const hidden = validateAndNormalizeSubmission(fields, {
+            hasCompany: 'yes' /* companyName not visible */,
+        });
+        // hasCompany=yes makes companyName visible -> required error
+        expect(hidden.ok).toBe(false);
+        const notShown = validateAndNormalizeSubmission(fields, { hasCompany: '' });
+        expect(notShown.ok).toBe(true);
+        expect(notShown.data).not.toHaveProperty('companyName');
+    });
+    it('requires a file field only when no file is attached', () => {
+        const fields = [field({ key: 'resume', type: 'file', required: true })];
+        const missing = validateAndNormalizeSubmission(fields, {});
+        expect(missing.ok).toBe(false);
+        const present = validateAndNormalizeSubmission(fields, {}, { fileKeys: new Set(['resume']) });
+        expect(present.ok).toBe(true);
+    });
+});
+//# sourceMappingURL=submission-validation.test.js.map