@actuate-media/cms-core 0.31.0 → 0.33.0

package/dist/forms/submission.js

@@ -0,0 +1,336 @@
+/**
+ * Public submission pipeline.
+ *
+ * Orchestrates the full lifecycle for an incoming public submission:
+ *   resolve schema → validate + normalize → sanitize → score spam →
+ *   derive sender/preview → assign entry number (transaction) → persist →
+ *   attach files → fire plugin hooks → audit log → build confirmation.
+ *
+ * The HTTP layer (`api/handlers.ts`) is responsible only for parsing the
+ * request (JSON or multipart), resolving the form, rate-limiting, CORS, and
+ * optional CAPTCHA verification. All trust decisions live here so the same
+ * pipeline backs every entry point (public slug route, legacy id route, and
+ * the future page-builder block).
+ */
+import { getDB } from '../db.js';
+import { logEvent } from '../security/audit.js';
+import { hashClientIp } from '../security/client-ip.js';
+import { getActuateConfig } from '../config/runtime.js';
+import { getSchemaVersion } from './service.js';
+import { validateAndNormalizeSubmission } from './validation.js';
+import { scoreSubmissionSpam } from './spam.js';
+import { persistSubmissionFiles } from './files.js';
+import { sendFormNotifications } from './notify.js';
+import { dispatchFormWebhooks } from './webhooks.js';
+/** Thrown when field validation fails; mapped to HTTP 422 by the API layer. */
+export class SubmissionValidationError extends Error {
+    fieldErrors;
+    constructor(fieldErrors) {
+        super('Submission validation failed');
+        this.name = 'SubmissionValidationError';
+        this.fieldErrors = fieldErrors;
+    }
+}
+const DEFAULT_SUCCESS_MESSAGE = 'Thank you! Your submission has been received.';
+function asString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return '';
+}
+/** Resolve the field schema the submission should be validated against. */
+async function resolveFields(form) {
+    if (form.activeSchemaVersionId) {
+        const version = await getSchemaVersion(form.activeSchemaVersionId);
+        if (version && version.fields.length > 0) {
+            return { fields: version.fields, versionId: version.id };
+        }
+    }
+    return { fields: form.fields ?? [], versionId: form.activeSchemaVersionId ?? null };
+}
+function deriveSender(fields, data) {
+    let name = null;
+    let email = null;
+    let phone = null;
+    for (const field of fields) {
+        const v = asString(data[field.key]).trim();
+        if (!v)
+            continue;
+        if (!email && field.type === 'email')
+            email = v;
+        if (!phone && field.type === 'phone')
+            phone = v;
+        if (!name && /name/i.test(field.key))
+            name = v;
+    }
+    // Fallbacks by common key naming when the schema didn't use typed fields.
+    if (!email)
+        email = firstByKeys(data, ['email', 'emailaddress', 'email_address']);
+    if (!name)
+        name = firstByKeys(data, ['name', 'fullname', 'full_name', 'firstname', 'first_name']);
+    if (!phone)
+        phone = firstByKeys(data, ['phone', 'phonenumber', 'phone_number', 'tel']);
+    return { name, email, phone };
+}
+function firstByKeys(data, candidates) {
+    const lower = new Map(Object.entries(data).map(([k, v]) => [k.toLowerCase(), v]));
+    for (const c of candidates) {
+        const v = asString(lower.get(c)).trim();
+        if (v)
+            return v;
+    }
+    return null;
+}
+function derivePreview(fields, data) {
+    // Prefer long-form fields, then any non-empty string value.
+    for (const field of fields) {
+        if (field.type === 'textarea') {
+            const v = asString(data[field.key]).trim();
+            if (v)
+                return v.slice(0, 200);
+        }
+    }
+    const messageKeys = ['message', 'body', 'comments', 'notes', 'description'];
+    const byKey = firstByKeys(data, messageKeys);
+    if (byKey)
+        return byKey.slice(0, 200);
+    for (const v of Object.values(data)) {
+        const s = asString(v).trim();
+        if (s)
+            return s.slice(0, 200);
+    }
+    return null;
+}
+/** Site-wide default spam strategies; per-form strategies are merged in `scoreSubmissionSpam`. */
+function defaultSpamStrategies() {
+    return (getActuateConfig()?.forms?.defaultSpamProtection ?? []);
+}
+async function assignAndCreate(db, row, formId) {
+    // Sequential per-form entry number assigned inside a transaction so two
+    // concurrent submissions don't read the same max. Not globally unique by DB
+    // constraint, but the transaction makes collisions vanishingly unlikely.
+    if (typeof db.$transaction === 'function') {
+        return db.$transaction(async (tx) => {
+            const agg = await tx.formSubmission.aggregate({
+                where: { formId },
+                _max: { entryNumber: true },
+            });
+            const entryNumber = (agg?._max?.entryNumber ?? 0) + 1;
+            const created = await tx.formSubmission.create({
+                data: { ...row, entryNumber },
+                select: { id: true, entryNumber: true },
+            });
+            return { id: String(created.id), entryNumber: created.entryNumber ?? entryNumber };
+        });
+    }
+    const created = await db.formSubmission.create({
+        data: row,
+        select: { id: true, entryNumber: true },
+    });
+    return { id: String(created.id), entryNumber: created.entryNumber ?? null };
+}
+function buildConfirmation(form) {
+    if (form.redirectUrl && form.redirectUrl.trim()) {
+        return { type: 'redirect', redirectUrl: form.redirectUrl.trim() };
+    }
+    const message = form.successMessage?.trim() ||
+        getActuateConfig()?.forms?.defaultSuccessMessage ||
+        DEFAULT_SUCCESS_MESSAGE;
+    return { type: 'message', message };
+}
+async function fireSubmissionHooks(formId, data) {
+    try {
+        const config = getActuateConfig();
+        const hooks = (config?._pluginHooks ?? []);
+        for (const hook of hooks.filter((h) => h?.event === 'afterCreate:form-submissions')) {
+            await hook.handler({ formId, data });
+        }
+    }
+    catch (err) {
+        if (process.env.NODE_ENV !== 'test') {
+            console.error('[Actuate CMS] Form submission hook error:', err);
+        }
+    }
+}
+/**
+ * Best-effort notification + webhook fan-out after a submission is persisted.
+ * Exported so the API layer (or tests) can await it deterministically; the
+ * pipeline itself fires it without blocking the public response. Every branch
+ * is wrapped so a single failing channel can't take down the others.
+ */
+export async function runSubmissionSideEffects(input) {
+    const { form, fields, data, spamStatus } = input;
+    const webhookEvent = spamStatus === 'spam' ? 'form.spam_detected' : 'form.submitted';
+    // Plugin hooks + admin email + autoresponder: clean submissions only.
+    if (spamStatus !== 'spam') {
+        await fireSubmissionHooks(form.id, data).catch(() => { });
+        const emailCtx = {
+            formId: form.id,
+            formName: form.name,
+            entryNumber: input.entryNumber,
+            submittedAt: input.submittedAt,
+            fields,
+            data,
+            senderName: input.sender.name,
+            senderEmail: input.sender.email,
+        };
+        await sendFormNotifications(form.notificationSettings, emailCtx).catch((err) => {
+            if (process.env.NODE_ENV !== 'test') {
+                console.error('[Actuate CMS] Form notification error:', err);
+            }
+        });
+    }
+    // Webhooks fire for both clean and spam submissions (subscribers opt in per event).
+    await dispatchFormWebhooks(form.id, {
+        event: webhookEvent,
+        formId: form.id,
+        formSlug: input.formSlug,
+        submissionId: input.submissionId,
+        entryNumber: input.entryNumber,
+        data,
+    }).catch((err) => {
+        if (process.env.NODE_ENV !== 'test') {
+            console.error('[Actuate CMS] Form webhook dispatch error:', err);
+        }
+    });
+}
+/**
+ * Process a validated request into a persisted submission. Throws
+ * `SubmissionValidationError` when field validation fails so the caller can
+ * return a structured 422.
+ */
+export async function processSubmission(form, ctx) {
+    const db = getDB();
+    const { fields, versionId } = await resolveFields(form);
+    const fileKeys = new Set((ctx.files ?? []).map((f) => f.fieldKey));
+    const validation = validateAndNormalizeSubmission(fields, ctx.values, { fileKeys });
+    if (!validation.ok) {
+        throw new SubmissionValidationError(validation.errors);
+    }
+    const sender = deriveSender(fields, validation.data);
+    const spam = scoreSubmissionSpam({
+        fields,
+        rawValues: ctx.values,
+        settings: form.spamSettings,
+        defaultStrategies: defaultSpamStrategies(),
+        senderEmail: sender.email,
+        elapsedMs: ctx.elapsedMs ?? null,
+        origin: ctx.origin ?? null,
+        referrer: ctx.referrer ?? null,
+    });
+    const attribution = ctx.attribution && typeof ctx.attribution === 'object' ? ctx.attribution : null;
+    const row = {
+        formId: form.id,
+        schemaVersionId: versionId,
+        data: validation.data,
+        normalizedData: validation.normalized,
+        attribution,
+        senderName: sender.name,
+        senderEmail: sender.email,
+        senderPhone: sender.phone,
+        preview: derivePreview(fields, validation.data),
+        spamStatus: spam.status,
+        unread: true,
+        ipAddressHash: hashClientIp(ctx.ip ?? 'unknown'),
+        userAgent: ctx.userAgent ?? null,
+        referrer: ctx.referrer ?? null,
+        pageUrl: ctx.pageUrl ?? null,
+        utmSource: asString(attribution?.source) || null,
+        utmMedium: asString(attribution?.medium) || null,
+        utmCampaign: asString(attribution?.campaign) || null,
+        submittedAt: new Date(),
+    };
+    const { id, entryNumber } = await assignAndCreate(db, row, form.id);
+    if ((ctx.files?.length ?? 0) > 0) {
+        try {
+            await persistSubmissionFiles(form.id, id, ctx.files ?? []);
+        }
+        catch (err) {
+            if (process.env.NODE_ENV !== 'test') {
+                console.error('[Actuate CMS] Failed to persist submission files:', err);
+            }
+        }
+    }
+    // Notification + webhook fan-out (admin email, autoresponder, signed
+    // webhooks). Fire-and-forget so a slow/failing channel never blocks or
+    // breaks the public response. Spam suppresses email but still fires
+    // `form.spam_detected` webhooks for subscribers.
+    void runSubmissionSideEffects({
+        form,
+        fields,
+        data: validation.data,
+        submissionId: id,
+        entryNumber,
+        spamStatus: spam.status,
+        sender: { name: sender.name, email: sender.email },
+        submittedAt: new Date().toISOString(),
+        formSlug: form.slug,
+    });
+    await logEvent({
+        event: spam.status === 'spam' ? 'form.spam_detected' : 'form.submitted',
+        details: {
+            formId: form.id,
+            submissionId: id,
+            entryNumber,
+            spamStatus: spam.status,
+            ...(spam.reasons.length > 0 ? { spamReasons: spam.reasons } : {}),
+        },
+    });
+    return {
+        submissionId: id,
+        entryNumber,
+        spamStatus: spam.status,
+        confirmation: buildConfirmation(form),
+    };
+}
+/**
+ * Project a form definition into the public, embeddable schema. Strips every
+ * server-only concern (access rules, notification recipients, webhook secrets,
+ * blocklists, encryption flags) so nothing sensitive leaks to the browser.
+ */
+export function buildPublicForm(form, fields, schemaVersionId, options = {}) {
+    const publicFields = fields
+        .filter((f) => f.type !== 'honeypot')
+        .map((f) => ({
+        id: f.id,
+        key: f.key,
+        label: f.label,
+        type: f.type,
+        required: Boolean(f.required),
+        placeholder: f.placeholder,
+        helpText: f.helpText,
+        defaultValue: f.defaultValue ?? undefined,
+        options: f.options,
+        width: f.width,
+        sortOrder: f.sortOrder,
+        validationRules: f.validationRules
+            ? sanitizePublicRules(f.validationRules)
+            : undefined,
+        conditionalLogic: f.conditionalLogic,
+    }));
+    const basePath = getActuateConfig()?.forms?.publicSubmissionPath ?? '/api/cms/public/forms';
+    return {
+        id: form.id,
+        name: form.name,
+        slug: form.slug,
+        description: form.description || undefined,
+        fields: publicFields,
+        submitPath: `${basePath.replace(/\/$/, '')}/${form.slug}/submit`,
+        successMessage: form.successMessage,
+        redirectUrl: form.redirectUrl,
+        spam: {
+            honeypotFieldKey: form.spamSettings?.honeypotFieldKey ?? fields.find((f) => f.type === 'honeypot')?.key,
+            minSubmitSeconds: form.spamSettings?.minSubmitSeconds,
+        },
+        captcha: options.captcha && options.captcha.provider !== 'none' ? options.captcha : undefined,
+        schemaVersionId,
+    };
+}
+/** Strip server-side-only validation hints (custom validator names) before exposing rules. */
+function sanitizePublicRules(rules) {
+    const { customValidator: _drop, ...rest } = rules;
+    return rest;
+}
+export { resolveFields as resolveSubmissionFields };
+//# sourceMappingURL=submission.js.map

package/dist/forms/submission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission.js","sourceRoot":"","sources":["../../src/forms/submission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,8BAA8B,EAAmB,MAAM,iBAAiB,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAqB,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,qBAAqB,EAA+B,MAAM,aAAa,CAAA;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AAwCpD,+EAA+E;AAC/E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,WAAW,CAAc;IACzB,YAAY,WAAyB;QACnC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;CACF;AAED,MAAM,uBAAuB,GAAG,+CAA+C,CAAA;AAE/E,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,EAAE,CAAA;AACX,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,aAAa,CAC1B,IAAoB;IAEpB,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAClE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAA;AACrF,CAAC;AAED,SAAS,YAAY,CACnB,MAAmB,EACnB,IAA6B;IAE7B,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,IAAI,KAAK,GAAkB,IAAI,CAAA;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,CAAC;YAAE,SAAQ;QAChB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,KAAK,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,KAAK,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;IACjF,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;IACjG,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAA;IAEtF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,UAAoB;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAA6B;IACvE,4DAA4D;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAC5C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,qBAAqB;IAC5B,OAAO,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,qBAAqB,IAAI,EAAE,CAA6B,CAAA;AAC7F,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAM,EACN,GAA4B,EAC5B,MAAc;IAEd,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,EAAE,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;gBAC5C,KAAK,EAAE,EAAE,MAAM,EAAE;gBACjB,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;aAC5B,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;YACrD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;gBAC7C,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE;gBAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;aACxC,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,WAAW,EAAE,CAAA;QACpF,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;KACxC,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAA;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAoB;IAC7C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;IACnE,CAAC;IACD,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE;QAC3B,gBAAgB,EAAE,EAAE,KAAK,EAAE,qBAAqB;QAChD,uBAAuB,CAAA;IACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAA6B;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAGvC,CAAA;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK,8BAA8B,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAgC;IAC7E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,KAAK,CAAA;IAEhD,MAAM,YAAY,GAChB,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,CAAA;IAEjE,sEAAsE;IACtE,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAExD,MAAM,QAAQ,GAA2B;YACvC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM;YACN,IAAI;YACJ,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;SAChC,CAAA;QACD,MAAM,qBAAqB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7E,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAA;YAC9D,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,oFAAoF;IACpF,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE;QAClC,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI;KACL,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAA;QAClE,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAoB,EACpB,GAAsB;IAEtB,MAAM,EAAE,GAAG,KAAK,EAAM,CAAA;IACtB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,iBAAiB,EAAE,qBAAqB,EAAE;QAC1C,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;KAC/B,CAAC,CAAA;IAEF,MAAM,WAAW,GACf,GAAG,CAAC,WAAW,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;IAEjF,MAAM,GAAG,GAA4B;QACnC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,eAAe,EAAE,SAAS;QAC1B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,cAAc,EAAE,UAAU,CAAC,UAAU;QACrC,WAAW;QACX,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,MAAM,EAAE,IAAI;QACZ,aAAa,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAChD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,SAAS,EAAE,QAAQ,CAAE,WAA8C,EAAE,MAAM,CAAC,IAAI,IAAI;QACpF,SAAS,EAAE,QAAQ,CAAE,WAA8C,EAAE,MAAM,CAAC,IAAI,IAAI;QACpF,WAAW,EAAE,QAAQ,CAAE,WAA8C,EAAE,QAAQ,CAAC,IAAI,IAAI;QACxF,WAAW,EAAE,IAAI,IAAI,EAAE;KACxB,CAAA;IAED,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAEnE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,iDAAiD;IACjD,KAAK,wBAAwB,CAAC;QAC5B,IAAI;QACJ,MAAM;QACN,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,YAAY,EAAE,EAAE;QAChB,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;QAClD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,QAAQ,EAAE,IAAI,CAAC,IAAI;KACpB,CAAC,CAAA;IAEF,MAAM,QAAQ,CAAC;QACb,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB;QACvE,OAAO,EAAE;YACP,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,YAAY,EAAE,EAAE;YAChB,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;KACF,CAAC,CAAA;IAEF,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC;KACtC,CAAA;AACH,CAAC;AAqCD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAoB,EACpB,MAAmB,EACnB,eAA8B,EAC9B,UAA+D,EAAE;IAEjE,MAAM,YAAY,GAAsB,MAAM;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACzC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,eAAe,EAAE,CAAC,CAAC,eAAe;YAChC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAA0C,CAAC;YACnE,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;KACrC,CAAC,CAAC,CAAA;IAEL,MAAM,QAAQ,GAAG,gBAAgB,EAAE,EAAE,KAAK,EAAE,oBAAoB,IAAI,uBAAuB,CAAA;IAE3F,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;QAC1C,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,SAAS;QAChE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE;YACJ,gBAAgB,EACd,IAAI,CAAC,YAAY,EAAE,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,GAAG;YACvF,gBAAgB,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB;SACtD;QACD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC7F,eAAe;KAChB,CAAA;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,mBAAmB,CAAC,KAA8B;IACzD,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,CAAA"}

package/dist/forms/validation.d.ts

@@ -0,0 +1,19 @@
+import type { FormField } from './types.js';
+export interface FieldError {
+    key: string;
+    message: string;
+}
+export interface SubmissionValidationResult {
+    ok: boolean;
+    errors: FieldError[];
+    /** Sanitized raw values keyed by field key (HTML stripped from strings). */
+    data: Record<string, unknown>;
+    /** Type-coerced values for export/search. */
+    normalized: Record<string, unknown>;
+}
+export interface ValidateOptions {
+    /** Field keys that have an accompanying uploaded file (for required-file checks). */
+    fileKeys?: ReadonlySet<string>;
+}
+export declare function validateAndNormalizeSubmission(fields: FormField[], rawValues: Record<string, unknown>, options?: ValidateOptions): SubmissionValidationResult;
+//# sourceMappingURL=validation.d.ts.map

package/dist/forms/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/forms/validation.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,UAAU,EAAE,CAAA;IACpB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;CAC/B;AAmED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,EAAE,EACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,GAAE,eAAoB,GAC5B,0BAA0B,CAuJ5B"}

package/dist/forms/validation.js

@@ -0,0 +1,235 @@
+/**
+ * Server-side submission validation + normalization.
+ *
+ * This is the authoritative gate for incoming public form submissions: the
+ * client-side form is convenience only and is assumed hostile. Every value is
+ * validated against the field's declared type and `validationRules`, then split
+ * into two views:
+ *
+ *   - `data`        — the sanitized *raw* values (HTML-stripped strings) that we
+ *                     persist and render back in the admin inbox.
+ *   - `normalized`  — type-coerced values (numbers as numbers, checkboxes as
+ *                     booleans, dates as ISO strings) used for export/search.
+ *
+ * Keys that are not part of the schema are dropped entirely — a submitter
+ * cannot smuggle arbitrary columns into the stored payload. Fields hidden by
+ * conditional logic are skipped (not required, not stored).
+ */
+import { stripHtml } from '../security/sanitize.js';
+// Conservative hard caps so a single field can't be used to balloon the row /
+// exhaust memory even when the schema omits explicit length rules.
+const MAX_TEXT_LEN = 5_000;
+const MAX_TEXTAREA_LEN = 50_000;
+const MAX_MULTISELECT_ITEMS = 200;
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const PHONE_RE = /^[+]?[0-9\s().-]{6,20}$/;
+const NON_INPUT = new Set(['richtext', 'divider', 'honeypot']);
+const TRUTHY = new Set(['true', 'on', '1', 'yes', 'checked']);
+function asString(value) {
+    if (value == null)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return '';
+}
+function coerceBoolean(value) {
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return value === 1;
+    return TRUTHY.has(asString(value).trim().toLowerCase());
+}
+function evalRule(rule, values) {
+    const current = asString(values[rule.fieldKey]).toLowerCase().trim();
+    const target = asString(rule.value).toLowerCase().trim();
+    switch (rule.operator) {
+        case 'equals':
+            return current === target;
+        case 'notEquals':
+            return current !== target;
+        case 'contains':
+            return current.includes(target);
+        case 'isEmpty':
+            return current === '';
+        case 'isNotEmpty':
+            return current !== '';
+        default:
+            return true;
+    }
+}
+/** A field is visible unless its `show` rules exist and not all of them pass. */
+function isVisible(field, values) {
+    const show = field.conditionalLogic?.show;
+    if (!show || show.length === 0)
+        return true;
+    return show.every((rule) => evalRule(rule, values));
+}
+/** A field is conditionally required when its `require` rules all pass. */
+function isConditionallyRequired(field, values) {
+    const require = field.conditionalLogic?.require;
+    if (!require || require.length === 0)
+        return false;
+    return require.every((rule) => evalRule(rule, values));
+}
+function isPresent(raw) {
+    if (raw === undefined || raw === null)
+        return false;
+    if (typeof raw === 'string')
+        return raw.trim() !== '';
+    if (Array.isArray(raw))
+        return raw.length > 0;
+    return true;
+}
+export function validateAndNormalizeSubmission(fields, rawValues, options = {}) {
+    const errors = [];
+    const data = {};
+    const normalized = {};
+    const fileKeys = options.fileKeys ?? new Set();
+    for (const field of fields) {
+        if (NON_INPUT.has(field.type))
+            continue;
+        if (!isVisible(field, rawValues))
+            continue;
+        const key = field.key;
+        const label = field.label || key;
+        const rules = field.validationRules ?? {};
+        const required = Boolean(field.required) ||
+            Boolean(rules.required) ||
+            isConditionallyRequired(field, rawValues);
+        if (field.type === 'file') {
+            if (required && !fileKeys.has(key)) {
+                errors.push({ key, message: `${label} is required.` });
+            }
+            continue;
+        }
+        const raw = rawValues[key];
+        if (!isPresent(raw)) {
+            if (required)
+                errors.push({ key, message: `${label} is required.` });
+            continue;
+        }
+        switch (field.type) {
+            case 'checkbox':
+            case 'consent': {
+                const bool = coerceBoolean(raw);
+                if ((field.type === 'consent' || required) && !bool) {
+                    errors.push({ key, message: `${label} must be accepted.` });
+                }
+                data[key] = bool;
+                normalized[key] = bool;
+                break;
+            }
+            case 'number': {
+                const num = typeof raw === 'number' ? raw : Number(asString(raw).trim());
+                if (!Number.isFinite(num)) {
+                    errors.push({ key, message: `${label} must be a number.` });
+                    break;
+                }
+                if (rules.min != null && num < rules.min) {
+                    errors.push({ key, message: `${label} must be at least ${rules.min}.` });
+                }
+                if (rules.max != null && num > rules.max) {
+                    errors.push({ key, message: `${label} must be at most ${rules.max}.` });
+                }
+                data[key] = num;
+                normalized[key] = num;
+                break;
+            }
+            case 'multiselect': {
+                const list = Array.isArray(raw) ? raw : [raw];
+                if (list.length > MAX_MULTISELECT_ITEMS) {
+                    errors.push({ key, message: `${label} has too many selections.` });
+                    break;
+                }
+                const cleaned = list.map((v) => stripHtml(asString(v)).trim()).filter((v) => v !== '');
+                const allowed = new Set((field.options ?? []).map((o) => o.value));
+                if (allowed.size > 0 && cleaned.some((v) => !allowed.has(v))) {
+                    errors.push({ key, message: `${label} contains an invalid selection.` });
+                }
+                data[key] = cleaned;
+                normalized[key] = cleaned;
+                break;
+            }
+            case 'select':
+            case 'radio': {
+                const val = stripHtml(asString(raw)).trim();
+                const allowed = new Set((field.options ?? []).map((o) => o.value));
+                if (allowed.size > 0 && !allowed.has(val)) {
+                    errors.push({ key, message: `${label} contains an invalid selection.` });
+                }
+                data[key] = val;
+                normalized[key] = val;
+                break;
+            }
+            case 'date': {
+                const s = asString(raw).trim();
+                const d = new Date(s);
+                if (Number.isNaN(d.getTime())) {
+                    errors.push({ key, message: `${label} is not a valid date.` });
+                    data[key] = s;
+                }
+                else {
+                    data[key] = s;
+                    normalized[key] = d.toISOString();
+                }
+                break;
+            }
+            default: {
+                // text, email, phone, url, textarea, hidden
+                const s = stripHtml(asString(raw)).trim();
+                const maxLen = rules.maxLength ?? (field.type === 'textarea' ? MAX_TEXTAREA_LEN : MAX_TEXT_LEN);
+                if (s.length > maxLen) {
+                    errors.push({ key, message: `${label} must be at most ${maxLen} characters.` });
+                }
+                if (rules.minLength != null && s.length < rules.minLength) {
+                    errors.push({ key, message: `${label} must be at least ${rules.minLength} characters.` });
+                }
+                const format = rules.format ??
+                    (field.type === 'email'
+                        ? 'email'
+                        : field.type === 'url'
+                            ? 'url'
+                            : field.type === 'phone'
+                                ? 'phone'
+                                : undefined);
+                if (format === 'email' && !EMAIL_RE.test(s)) {
+                    errors.push({ key, message: `${label} must be a valid email address.` });
+                }
+                else if (format === 'phone' && !PHONE_RE.test(s)) {
+                    errors.push({ key, message: `${label} must be a valid phone number.` });
+                }
+                else if (format === 'url') {
+                    if (!isHttpUrl(s)) {
+                        errors.push({ key, message: `${label} must be a valid URL.` });
+                    }
+                }
+                if (rules.pattern) {
+                    try {
+                        if (!new RegExp(rules.pattern).test(s)) {
+                            errors.push({ key, message: `${label} is not in the expected format.` });
+                        }
+                    }
+                    catch {
+                        // An invalid pattern in the schema must never block a submission;
+                        // schema validation already surfaces bad patterns to the editor.
+                    }
+                }
+                data[key] = s;
+                normalized[key] = s;
+            }
+        }
+    }
+    return { ok: errors.length === 0, errors, data, normalized };
+}
+function isHttpUrl(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/forms/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/forms/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAsBnD,8EAA8E;AAC9E,mEAAmE;AACnE,MAAM,YAAY,GAAG,KAAK,CAAA;AAC1B,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,qBAAqB,GAAG,GAAG,CAAA;AAEjC,MAAM,QAAQ,GAAG,4BAA4B,CAAA;AAC7C,MAAM,QAAQ,GAAG,yBAAyB,CAAA;AAE1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAA;AAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;AAE7D,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAqB,EAAE,MAA+B;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IACxD,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,MAAM,CAAA;QAC3B,KAAK,WAAW;YACd,OAAO,OAAO,KAAK,MAAM,CAAA;QAC3B,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,EAAE,CAAA;QACvB,KAAK,YAAY;YACf,OAAO,OAAO,KAAK,EAAE,CAAA;QACvB;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAgB,EAAE,MAA+B;IAClE,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAA;IACzC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AACrD,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,KAAgB,EAAE,MAA+B;IAChF,MAAM,OAAO,GAAG,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAA;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAmB,EACnB,SAAkC,EAClC,UAA2B,EAAE;IAE7B,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,MAAM,UAAU,GAA4B,EAAE,CAAA;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAA;IAEtD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAQ;QACvC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,SAAQ;QAE1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;QACrB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAA;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAA;QACzC,MAAM,QAAQ,GACZ,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvB,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAE3C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,eAAe,EAAE,CAAC,CAAA;YACxD,CAAC;YACD,SAAQ;QACV,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;QAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,eAAe,EAAE,CAAC,CAAA;YACpE,SAAQ;QACV,CAAC;QAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,UAAU,CAAC;YAChB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;gBAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACpD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,oBAAoB,EAAE,CAAC,CAAA;gBAC7D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;gBAChB,UAAU,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;gBACtB,MAAK;YACP,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;gBACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,oBAAoB,EAAE,CAAC,CAAA;oBAC3D,MAAK;gBACP,CAAC;gBACD,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;oBACzC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,qBAAqB,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;gBAC1E,CAAC;gBACD,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;oBACzC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,oBAAoB,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,CAAA;gBACzE,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;gBACf,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;gBACrB,MAAK;YACP,CAAC;YAED,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;gBAC7C,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;oBACxC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,2BAA2B,EAAE,CAAC,CAAA;oBAClE,MAAK;gBACP,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;gBACtF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;gBAClE,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC,CAAA;gBAC1E,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;gBACnB,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;gBACzB,MAAK;YACP,CAAC;YAED,KAAK,QAAQ,CAAC;YACd,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;gBAClE,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC,CAAA;gBAC1E,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;gBACf,UAAU,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;gBACrB,MAAK;YACP,CAAC;YAED,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;gBAC9B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBACrB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,uBAAuB,EAAE,CAAC,CAAA;oBAC9D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACf,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;oBACb,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;gBACnC,CAAC;gBACD,MAAK;YACP,CAAC;YAED,OAAO,CAAC,CAAC,CAAC;gBACR,4CAA4C;gBAC5C,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;gBACzC,MAAM,MAAM,GACV,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;gBAClF,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,oBAAoB,MAAM,cAAc,EAAE,CAAC,CAAA;gBACjF,CAAC;gBACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;oBAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,qBAAqB,KAAK,CAAC,SAAS,cAAc,EAAE,CAAC,CAAA;gBAC3F,CAAC;gBAED,MAAM,MAAM,GACV,KAAK,CAAC,MAAM;oBACZ,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;wBACrB,CAAC,CAAC,OAAO;wBACT,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK;4BACpB,CAAC,CAAC,KAAK;4BACP,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;gCACtB,CAAC,CAAC,OAAO;gCACT,CAAC,CAAC,SAAS,CAAC,CAAA;gBAEpB,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC,CAAA;gBAC1E,CAAC;qBAAM,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,gCAAgC,EAAE,CAAC,CAAA;gBACzE,CAAC;qBAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBAC5B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;wBAClB,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,uBAAuB,EAAE,CAAC,CAAA;oBAChE,CAAC;gBACH,CAAC;gBAED,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,iCAAiC,EAAE,CAAC,CAAA;wBAC1E,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,kEAAkE;wBAClE,iEAAiE;oBACnE,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACb,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}