@forumone/throughline-forms 0.0.1 → 0.2.1

package/dist/functions/submitter-confirmation.d.ts

@@ -0,0 +1,25 @@
+import type { Inngest, InngestFunction } from 'inngest';
+import type { Payload } from 'payload';
+import type { EmailClient } from '@forumone/throughline-email';
+import type { ResolvedFormsConfig } from '../options.js';
+export interface SubmitterConfirmationDeps {
+    inngest: Inngest;
+    payload: Payload;
+    resolved: ResolvedFormsConfig;
+    getEmailClient: () => EmailClient | undefined;
+    brandName?: string;
+    /** Override the function id. Default: `form-submitter-confirmation`. */
+    id?: string;
+}
+/**
+ * Subscribes to `form/submitter-confirmation` (dispatched by the fan-out
+ * when the form has confirmation enabled). Reads the submission, finds
+ * the email-typed field referenced by `submitterConfirmation.emailFieldName`,
+ * and sends a SubmitterConfirmationEmail to that address.
+ *
+ * Skips silently and logs if anything is missing — a misconfigured
+ * confirmation should never block the rest of the fan-out, and the
+ * configuration error is admin-fixable.
+ */
+export declare function createSubmitterConfirmationFunction(deps: SubmitterConfirmationDeps): InngestFunction.Any;
+//# sourceMappingURL=submitter-confirmation.d.ts.map

package/dist/functions/submitter-confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitter-confirmation.d.ts","sourceRoot":"","sources":["../../src/functions/submitter-confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAE9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGxD,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,cAAc,EAAE,MAAM,WAAW,GAAG,SAAS,CAAA;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wEAAwE;IACxE,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,yBAAyB,GAC9B,eAAe,CAAC,GAAG,CAiFrB"}

package/dist/functions/submitter-confirmation.js

@@ -0,0 +1,76 @@
+import { SubmitterConfirmationEmail } from '../templates/index.js';
+import { findFieldValue, readSubmissionRows } from './_shared.js';
+/**
+ * Subscribes to `form/submitter-confirmation` (dispatched by the fan-out
+ * when the form has confirmation enabled). Reads the submission, finds
+ * the email-typed field referenced by `submitterConfirmation.emailFieldName`,
+ * and sends a SubmitterConfirmationEmail to that address.
+ *
+ * Skips silently and logs if anything is missing — a misconfigured
+ * confirmation should never block the rest of the fan-out, and the
+ * configuration error is admin-fixable.
+ */
+export function createSubmitterConfirmationFunction(deps) {
+    return deps.inngest.createFunction({
+        id: deps.id ?? 'form-submitter-confirmation',
+        retries: 3,
+        triggers: [{ event: 'form/submitter-confirmation' }],
+    }, async ({ event, step, logger }) => {
+        const data = (event.data ?? {});
+        const submissionId = data.submissionId;
+        const formId = data.formId;
+        if (!submissionId || !formId)
+            return { skipped: true };
+        const form = (await step.run('load-form', async () => deps.payload.findByID({ collection: deps.resolved.formsCollectionSlug, id: formId })));
+        if (!form)
+            return { skipped: true, reason: 'form-not-found' };
+        const policy = (form['policy'] ?? {});
+        const confirmation = (policy['submitterConfirmation'] ?? {});
+        if (confirmation.enabled !== true)
+            return { skipped: true, reason: 'confirmation-disabled' };
+        if (!confirmation.emailFieldName) {
+            logger.warn('submitterConfirmation enabled but no emailFieldName set', { formId });
+            return { skipped: true, reason: 'no-email-field' };
+        }
+        const submission = (await step.run('load-submission', async () => deps.payload.findByID({
+            collection: deps.resolved.submissionsCollectionSlug,
+            id: submissionId,
+        })));
+        if (!submission)
+            return { skipped: true, reason: 'submission-not-found' };
+        const rows = readSubmissionRows(submission['submissionData']);
+        const recipient = findFieldValue(rows, confirmation.emailFieldName);
+        if (!recipient || !recipient.includes('@')) {
+            logger.warn('Submitter email missing or invalid; skipping confirmation', {
+                formId,
+                field: confirmation.emailFieldName,
+            });
+            return { skipped: true, reason: 'recipient-invalid' };
+        }
+        const client = deps.getEmailClient();
+        if (!client) {
+            throw new Error('Email client not available. Register `emailPlugin` before confirmations can send.');
+        }
+        const subject = confirmation.subject?.trim() || 'Thank you for your submission';
+        const bodyText = confirmation.body?.trim() || 'We received your submission and will be in touch.';
+        const recipientName = findFieldValue(rows, 'name') ?? findFieldValue(rows, 'first_name') ?? 'there';
+        await step.run(`send-${recipient}`, async () => {
+            await client.send({
+                to: recipient,
+                subject,
+                template: SubmitterConfirmationEmail({
+                    recipientName,
+                    brandName: deps.brandName ?? 'Forms',
+                    subject,
+                    body: bodyText,
+                }),
+                tags: [
+                    { name: 'type', value: 'form-submitter-confirmation' },
+                    { name: 'form-id', value: formId },
+                ],
+            });
+        });
+        return { ok: true, recipient };
+    });
+}
+//# sourceMappingURL=submitter-confirmation.js.map

package/dist/functions/submitter-confirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submitter-confirmation.js","sourceRoot":"","sources":["../../src/functions/submitter-confirmation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAElE,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAYjE;;;;;;;;;GASG;AACH,MAAM,UAAU,mCAAmC,CACjD,IAA+B;IAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAChC;QACE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,6BAA6B;QAC5C,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;KACrD,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAA+C,CAAA;QAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAEtD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CACrF,CAAmC,CAAA;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QAE7D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;QAChE,MAAM,YAAY,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAK1D,CAAA;QACD,IAAI,YAAY,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAA;QAC5F,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,yDAAyD,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;YAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;QACpD,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB;YACnD,EAAE,EAAE,YAAY;SACjB,CAAC,CACH,CAAmC,CAAA;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;QAEzE,MAAM,IAAI,GAAG,kBAAkB,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAC7D,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,cAAc,CAAC,CAAA;QACnE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;gBACvE,MAAM;gBACN,KAAK,EAAE,YAAY,CAAC,cAAc;aACnC,CAAC,CAAA;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAA;QACvD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;QACpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAA;QACH,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,+BAA+B,CAAA;QAC/E,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,mDAAmD,CAAA;QACjG,MAAM,aAAa,GACjB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,OAAO,CAAA;QAE/E,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,SAAS,EAAE,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,MAAM,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,SAAS;gBACb,OAAO;gBACP,QAAQ,EAAE,0BAA0B,CAAC;oBACnC,aAAa;oBACb,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO;oBACpC,OAAO;oBACP,IAAI,EAAE,QAAQ;iBACf,CAAC;gBACF,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,6BAA6B,EAAE;oBACtD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;iBACnC;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAChC,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/functions/webhook-destination.d.ts

@@ -0,0 +1,20 @@
+import type { Inngest, InngestFunction } from 'inngest';
+import type { Payload } from 'payload';
+import type { ResolvedFormsConfig } from '../options.js';
+export interface WebhookDestinationDeps {
+    inngest: Inngest;
+    payload: Payload;
+    resolved: ResolvedFormsConfig;
+    /** Override the function id. Default: `form-webhook-destination`. */
+    id?: string;
+    /** Per-call timeout. Default: 10s. */
+    timeoutMs?: number;
+}
+/**
+ * Subscribes to `form/destination.webhook`. POSTs the submission to the
+ * allowlist URL with an HMAC-SHA256 signature in `x-throughline-signature`.
+ * Reuses the IP-hash secret as the HMAC key so the receiver can verify
+ * with a single shared secret regardless of which form fired the event.
+ */
+export declare function createWebhookDestinationFunction(deps: WebhookDestinationDeps): InngestFunction.Any;
+//# sourceMappingURL=webhook-destination.d.ts.map

package/dist/functions/webhook-destination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-destination.d.ts","sourceRoot":"","sources":["../../src/functions/webhook-destination.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAIxD,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,qEAAqE;IACrE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,sBAAsB,GAC3B,eAAe,CAAC,GAAG,CAmErB"}

package/dist/functions/webhook-destination.js

@@ -0,0 +1,74 @@
+import { hashIp } from '../submit/ip.js';
+import { readSubmissionRows } from './_shared.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+/**
+ * Subscribes to `form/destination.webhook`. POSTs the submission to the
+ * allowlist URL with an HMAC-SHA256 signature in `x-throughline-signature`.
+ * Reuses the IP-hash secret as the HMAC key so the receiver can verify
+ * with a single shared secret regardless of which form fired the event.
+ */
+export function createWebhookDestinationFunction(deps) {
+    return deps.inngest.createFunction({
+        id: deps.id ?? 'form-webhook-destination',
+        retries: 5,
+        triggers: [{ event: 'form/destination.webhook' }],
+    }, async ({ event, step, logger }) => {
+        const data = (event.data ?? {});
+        if (!data.submissionId || !data.destinationLabel)
+            return { skipped: true };
+        const dest = deps.resolved.options.allowedDestinations.find((d) => d.label === data.destinationLabel && d.type === 'webhook');
+        if (!dest) {
+            logger.warn('Webhook destination no longer on allowlist', { label: data.destinationLabel });
+            return { skipped: true, reason: 'destination-removed' };
+        }
+        const submission = (await step.run('load-submission', async () => deps.payload.findByID({
+            collection: deps.resolved.submissionsCollectionSlug,
+            id: data.submissionId,
+        })));
+        if (!submission)
+            return { skipped: true, reason: 'submission-not-found' };
+        const fields = readSubmissionRows(submission['submissionData']);
+        const formId = unwrapId(submission['form']);
+        const body = JSON.stringify({
+            event: 'form/submission',
+            timestamp: Date.now(),
+            formId,
+            submissionId: data.submissionId,
+            destinationLabel: dest.label,
+            fields,
+        });
+        const signature = await hashIp(body, deps.resolved.ipHashSecret);
+        const timeout = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeout);
+        try {
+            const response = await fetch(dest.value, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    'x-throughline-event': 'form/submission',
+                    'x-throughline-signature': `sha256=${signature}`,
+                    'x-throughline-timestamp': String(Date.now()),
+                },
+                body,
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                throw new Error(`Webhook delivery failed: HTTP ${response.status}`);
+            }
+            return { ok: true, destinationLabel: dest.label, status: response.status };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    });
+}
+function unwrapId(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object' && 'id' in value) {
+        return String(value.id);
+    }
+    return null;
+}
+//# sourceMappingURL=webhook-destination.js.map

package/dist/functions/webhook-destination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-destination.js","sourceRoot":"","sources":["../../src/functions/webhook-destination.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAYjD,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,gCAAgC,CAC9C,IAA4B;IAE5B,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAChC;QACE,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,0BAA0B;QACzC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;KAClD,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAG7B,CAAA;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAE1E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CACjE,CAAA;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;YAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;QACzD,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACpB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,yBAAyB;YACnD,EAAE,EAAE,IAAI,CAAC,YAAa;SACvB,CAAC,CACH,CAAmC,CAAA;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;QAEzE,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,iBAAiB;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM;YACN,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,gBAAgB,EAAE,IAAI,CAAC,KAAK;YAC5B,MAAM;SACP,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAEhE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAA;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAA;QAE3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,qBAAqB,EAAE,iBAAiB;oBACxC,yBAAyB,EAAE,UAAU,SAAS,EAAE;oBAChD,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;iBAC9C;gBACD,IAAI;gBACJ,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YACrE,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;QAC5E,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxD,OAAO,MAAM,CAAE,KAAyB,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { formsPlugin, getFormsFunctions } from './plugin.js';
+export { DEFAULT_FORMS_SLUG, DEFAULT_FORM_SUBMISSIONS_SLUG, DEFAULT_PRIVACY_NOTICE, DEFAULT_RATE_LIMIT, MIN_IP_HASH_SECRET_LENGTH, validateOptions, } from './options.js';
+export type { AllowedDestination, DestinationType, FormsPluginOptions, ResolvedFormsConfig, } from './options.js';
+export { listDestinations, validateDestinationLabel } from './destinations.js';
+export type { DestinationLookupResult } from './destinations.js';
+export { addFormPolicyFields } from './policy-fields.js';
+export type { PolicyFieldsOptions } from './policy-fields.js';
+export { createCreateFormTool, createUpdateFormFieldsTool, createUpdateFormDestinationsTool, createGetFormSubmissionsTool, createValidateFormTool, createListAllowedDestinationsTool, } from './tools/index.js';
+export { createFormFanOutFunction, createEmailDestinationFunction, createWebhookDestinationFunction, createSubmitterConfirmationFunction, } from './functions/index.js';
+export { FormsLayout, FormSubmissionEmail, SubmitterConfirmationEmail, } from './templates/index.js';
+export type { FormsLayoutProps, FormSubmissionEmailProps, SubmitterConfirmationEmailProps, FormSubmissionField, } from './templates/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE5D,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC9E,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,YAAY,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,gCAAgC,EAChC,4BAA4B,EAC5B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,gBAAgB,EAChB,wBAAwB,EACxB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { formsPlugin, getFormsFunctions } from './plugin.js';
+export { DEFAULT_FORMS_SLUG, DEFAULT_FORM_SUBMISSIONS_SLUG, DEFAULT_PRIVACY_NOTICE, DEFAULT_RATE_LIMIT, MIN_IP_HASH_SECRET_LENGTH, validateOptions, } from './options.js';
+export { listDestinations, validateDestinationLabel } from './destinations.js';
+export { addFormPolicyFields } from './policy-fields.js';
+export { createCreateFormTool, createUpdateFormFieldsTool, createUpdateFormDestinationsTool, createGetFormSubmissionsTool, createValidateFormTool, createListAllowedDestinationsTool, } from './tools/index.js';
+export { createFormFanOutFunction, createEmailDestinationFunction, createWebhookDestinationFunction, createSubmitterConfirmationFunction, } from './functions/index.js';
+export { FormsLayout, FormSubmissionEmail, SubmitterConfirmationEmail, } from './templates/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE5D,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,sBAAsB,EACtB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,GAChB,MAAM,cAAc,CAAA;AAQrB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAG9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAGxD,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,gCAAgC,EAChC,4BAA4B,EAC5B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EAChC,mCAAmC,GACpC,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAA"}

package/dist/options.d.ts

@@ -0,0 +1,74 @@
+import type { Inngest } from 'inngest';
+import type { BaseCorePluginOptions } from '@forumone/throughline-plugin-contract';
+export type DestinationType = 'email' | 'webhook';
+export interface AllowedDestination {
+    type: DestinationType;
+    /** For email: recipient address. For webhook: full HTTPS URL. */
+    value: string;
+    /** Admin-facing description. Surfaces in the destinations admin UI. */
+    description: string;
+    /**
+     * Label Claude sees when listing destinations and references when
+     * creating / updating forms. Must be unique across the allowlist.
+     */
+    label: string;
+}
+export interface FormsPluginOptions extends BaseCorePluginOptions {
+    /** Inngest client used to fire `form/submission.received` and friends. */
+    inngest: Inngest;
+    /**
+     * Pre-authorized destinations. Forms can only route submissions to one
+     * of these. Adding a destination requires editing the plugin config and
+     * redeploying — that friction is the security model. See README.
+     */
+    allowedDestinations: AllowedDestination[];
+    /**
+     * Default privacy notice shown above the submit button. Customize for
+     * the deployment's jurisdiction (GDPR, CCPA, etc.). Legal review
+     * recommended before shipping forms publicly.
+     */
+    defaultPrivacyNotice?: string;
+    /** Default for the per-form `requiresExplicitConsent` field. Default: `true`. */
+    requireConsentByDefault?: boolean;
+    /** Max submissions per IP per hour per form. Default: `5`. */
+    rateLimit?: number;
+    /**
+     * Secret used to HMAC-hash submitter IPs. Falls back to
+     * `process.env.FORMS_IP_HASH_SECRET`. Must be at least 32 characters so
+     * two deployments don't collide on the same IP → hash mapping.
+     */
+    ipHashSecret?: string;
+    /**
+     * Override the Forms collection slug. Default: `'forms'`. Match the
+     * default Form Builder plugin uses unless you intentionally renamed it.
+     */
+    formsCollectionSlug?: string;
+    /**
+     * Override the Form Submissions collection slug. Default: `'form-submissions'`.
+     */
+    submissionsCollectionSlug?: string;
+    /**
+     * Route prefix for the public submit endpoint and the MCP endpoint.
+     * Payload prepends `/api`, so the defaults land at `/api/forms/submit`
+     * and `/api/forms/mcp`.
+     */
+    routePrefix?: string;
+}
+export declare const DEFAULT_FORMS_SLUG = "forms";
+export declare const DEFAULT_FORM_SUBMISSIONS_SLUG = "form-submissions";
+export declare const DEFAULT_RATE_LIMIT = 5;
+export declare const MIN_IP_HASH_SECRET_LENGTH = 32;
+export declare const DEFAULT_PRIVACY_NOTICE: string;
+export interface ResolvedFormsConfig {
+    options: FormsPluginOptions;
+    ipHashSecret: string;
+    formsCollectionSlug: string;
+    submissionsCollectionSlug: string;
+    routePrefix: string;
+    rateLimit: number;
+    requireConsentByDefault: boolean;
+    defaultPrivacyNotice: string;
+    destinationLabels: string[];
+}
+export declare function validateOptions(options: FormsPluginOptions): ResolvedFormsConfig;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAElF,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,CAAA;AAEjD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,eAAe,CAAA;IACrB,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,0EAA0E;IAC1E,OAAO,EAAE,OAAO,CAAA;IAChB;;;;OAIG;IACH,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;IACzC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;OAEG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,eAAO,MAAM,kBAAkB,UAAU,CAAA;AACzC,eAAO,MAAM,6BAA6B,qBAAqB,CAAA;AAC/D,eAAO,MAAM,kBAAkB,IAAI,CAAA;AACnC,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAE3C,eAAO,MAAM,sBAAsB,QAEiE,CAAA;AAEpG,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,kBAAkB,CAAA;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,yBAAyB,EAAE,MAAM,CAAA;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,uBAAuB,EAAE,OAAO,CAAA;IAChC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,iBAAiB,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CA+DhF"}

package/dist/options.js

@@ -0,0 +1,61 @@
+export const DEFAULT_FORMS_SLUG = 'forms';
+export const DEFAULT_FORM_SUBMISSIONS_SLUG = 'form-submissions';
+export const DEFAULT_RATE_LIMIT = 5;
+export const MIN_IP_HASH_SECRET_LENGTH = 32;
+export const DEFAULT_PRIVACY_NOTICE = 'By submitting this form, the information you provide will be used to respond to your inquiry. ' +
+    'We do not sell or share your information with third parties. See our privacy policy for details.';
+export function validateOptions(options) {
+    if (!options.inngest) {
+        throw new Error('formsPlugin requires an Inngest client (`options.inngest`).');
+    }
+    if (!Array.isArray(options.allowedDestinations) || options.allowedDestinations.length === 0) {
+        throw new Error('formsPlugin requires at least one entry in `options.allowedDestinations`. The allowlist is the security perimeter — Claude can only route submissions to destinations on this list.');
+    }
+    const labels = new Set();
+    for (const dest of options.allowedDestinations) {
+        if (!dest.label || typeof dest.label !== 'string') {
+            throw new Error(`Allowed destination is missing a label: ${JSON.stringify(dest)}`);
+        }
+        if (labels.has(dest.label)) {
+            throw new Error(`Duplicate destination label "${dest.label}" — labels must be unique.`);
+        }
+        labels.add(dest.label);
+        if (dest.type === 'email') {
+            if (!dest.value || !dest.value.includes('@')) {
+                throw new Error(`Allowed destination "${dest.label}" is type "email" but value is not a valid address.`);
+            }
+        }
+        else if (dest.type === 'webhook') {
+            let url;
+            try {
+                url = new URL(dest.value);
+            }
+            catch {
+                throw new Error(`Allowed webhook destination "${dest.label}" is not a valid URL.`);
+            }
+            if (url.protocol !== 'https:') {
+                throw new Error(`Allowed webhook destination "${dest.label}" must use https://.`);
+            }
+        }
+        else {
+            throw new Error(`Allowed destination "${dest.label}" has unknown type "${dest.type}".`);
+        }
+    }
+    const ipHashSecret = options.ipHashSecret ?? process.env['FORMS_IP_HASH_SECRET'];
+    if (!ipHashSecret || ipHashSecret.length < MIN_IP_HASH_SECRET_LENGTH) {
+        throw new Error(`formsPlugin requires \`options.ipHashSecret\` or \`FORMS_IP_HASH_SECRET\` env var (>=${MIN_IP_HASH_SECRET_LENGTH} characters).`);
+    }
+    const routePrefix = options.routePrefix ?? '/forms';
+    return {
+        options,
+        ipHashSecret,
+        formsCollectionSlug: options.formsCollectionSlug ?? DEFAULT_FORMS_SLUG,
+        submissionsCollectionSlug: options.submissionsCollectionSlug ?? DEFAULT_FORM_SUBMISSIONS_SLUG,
+        routePrefix,
+        rateLimit: options.rateLimit ?? DEFAULT_RATE_LIMIT,
+        requireConsentByDefault: options.requireConsentByDefault ?? true,
+        defaultPrivacyNotice: options.defaultPrivacyNotice ?? DEFAULT_PRIVACY_NOTICE,
+        destinationLabels: options.allowedDestinations.map((d) => d.label),
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AA4DA,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAA;AACzC,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAA;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAA;AACnC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAE3C,MAAM,CAAC,MAAM,sBAAsB,GACjC,gGAAgG;IAChG,kGAAkG,CAAA;AAcpG,MAAM,UAAU,eAAe,CAAC,OAA2B;IACzD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,OAAO,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CACb,qLAAqL,CACtL,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,KAAK,4BAA4B,CAAC,CAAA;QACzF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAEtB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,KAAK,qDAAqD,CACxF,CAAA;YACH,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,GAAQ,CAAA;YACZ,IAAI,CAAC;gBACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,KAAK,uBAAuB,CAAC,CAAA;YACpF,CAAC;YACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,KAAK,sBAAsB,CAAC,CAAA;YACnF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,CAAC,KAAK,uBAAwB,IAA0B,CAAC,IAAI,IAAI,CAC9F,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;IAChF,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,wFAAwF,yBAAyB,eAAe,CACjI,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAA;IACnD,OAAO;QACL,OAAO;QACP,YAAY;QACZ,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,IAAI,kBAAkB;QACtE,yBAAyB,EACvB,OAAO,CAAC,yBAAyB,IAAI,6BAA6B;QACpE,WAAW;QACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;QAClD,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,IAAI,IAAI;QAChE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,sBAAsB;QAC5E,iBAAiB,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;KACnE,CAAA;AACH,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,19 @@
+import type { CorePlugin } from '@forumone/throughline-plugin-contract';
+import type { InngestFunction } from 'inngest';
+import { type FormsPluginOptions } from './options.js';
+/**
+ * Forms plugin. Composes the official Form Builder plugin with the
+ * Throughline policy layer:
+ *
+ * 1. Form Builder runs first to create the `forms` and `form-submissions`
+ *    collections and the field overrides slot.
+ * 2. We layer the policy group onto the forms collection's fields and
+ *    add the access-control + extra fields onto submissions.
+ * 3. We add the public submit endpoint and the MCP endpoint.
+ * 4. At init we register tools, register Inngest functions via Symbol so
+ *    the client app's Inngest endpoint can compose them, and require
+ *    the audit-log + email capabilities.
+ */
+export declare const formsPlugin: CorePlugin<FormsPluginOptions>;
+export declare function getFormsFunctions(payload: unknown): InngestFunction.Any[];
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,uCAAuC,CAAA;AAI1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,OAAO,EAAE,KAAK,kBAAkB,EAAmB,MAAM,cAAc,CAAA;AAgCvE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,WAAW,EAAE,UAAU,CAAC,kBAAkB,CAiKpD,CAAA;AAEH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,CAKzE"}

package/dist/plugin.js

@@ -0,0 +1,180 @@
+import { getPluginRegistry } from '@forumone/throughline-plugin-contract';
+import { createMcpHandler, createNamedLogger, defaultLogger } from '@forumone/throughline-core';
+import { getEmailClient as readEmailClient } from '@forumone/throughline-email';
+import { formBuilderPlugin } from '@payloadcms/plugin-form-builder';
+import { validateOptions } from './options.js';
+import { addFormPolicyFields } from './policy-fields.js';
+import { validateDestinationLabel } from './destinations.js';
+import { createSubmitEndpoint } from './submit/endpoint.js';
+import { createCreateFormTool, createGetFormSubmissionsTool, createListAllowedDestinationsTool, createUpdateFormDestinationsTool, createUpdateFormFieldsTool, createValidateFormTool, } from './tools/index.js';
+import { createEmailDestinationFunction, createFormFanOutFunction, createSubmitterConfirmationFunction, createWebhookDestinationFunction, } from './functions/index.js';
+const PLUGIN_ID = '@forumone/throughline-forms';
+const PLUGIN_VERSION = '0.1.0';
+const MCP_HANDLER_SYMBOL = Symbol.for('@forumone/throughline/forms-mcp-handler');
+const FUNCTIONS_SYMBOL = Symbol.for('@forumone/throughline/forms-functions');
+/**
+ * Forms plugin. Composes the official Form Builder plugin with the
+ * Throughline policy layer:
+ *
+ * 1. Form Builder runs first to create the `forms` and `form-submissions`
+ *    collections and the field overrides slot.
+ * 2. We layer the policy group onto the forms collection's fields and
+ *    add the access-control + extra fields onto submissions.
+ * 3. We add the public submit endpoint and the MCP endpoint.
+ * 4. At init we register tools, register Inngest functions via Symbol so
+ *    the client app's Inngest endpoint can compose them, and require
+ *    the audit-log + email capabilities.
+ */
+export const formsPlugin = (rawOptions) => (incomingConfig) => {
+    if (rawOptions.enabled === false)
+        return incomingConfig;
+    const resolved = validateOptions(rawOptions);
+    const logger = createNamedLogger('forms', rawOptions.logger ?? defaultLogger);
+    const policyFieldsOptions = {
+        availableDestinationLabels: resolved.destinationLabels,
+        defaultPrivacyNotice: resolved.defaultPrivacyNotice,
+        requireConsentByDefault: resolved.requireConsentByDefault,
+        defaultRateLimit: resolved.rateLimit,
+    };
+    const formBuilderConfig = formBuilderPlugin({
+        fields: {
+            text: true,
+            textarea: true,
+            email: true,
+            select: true,
+            checkbox: true,
+            number: true,
+            message: true,
+        },
+        formOverrides: {
+            fields: ({ defaultFields }) => addFormPolicyFields(defaultFields, policyFieldsOptions),
+            hooks: {
+                beforeChange: [
+                    async ({ data, operation }) => {
+                        if (operation !== 'create' && operation !== 'update')
+                            return data;
+                        const policy = (data?.['policy'] ?? {});
+                        const destinations = Array.isArray(policy['destinations'])
+                            ? policy['destinations']
+                            : [];
+                        for (const dest of destinations) {
+                            if (!dest.label)
+                                continue;
+                            const check = validateDestinationLabel(resolved.options, dest.label);
+                            if (!check.ok) {
+                                throw new Error(`Destination "${dest.label}" is not on the allowlist. Adding it requires editing the plugin config and redeploying.`);
+                            }
+                        }
+                        return data;
+                    },
+                ],
+            },
+        },
+        formSubmissionOverrides: {
+            access: {
+                read: ({ req }) => {
+                    const roles = req.user?.['roles'] ?? [];
+                    return roles.includes('admin') || roles.includes('form-admin');
+                },
+                create: () => true,
+                update: () => false,
+                delete: ({ req }) => {
+                    const roles = req.user?.['roles'] ?? [];
+                    return roles.includes('admin');
+                },
+            },
+            fields: ({ defaultFields }) => [
+                ...defaultFields,
+                {
+                    name: 'ipHash',
+                    type: 'text',
+                    admin: { readOnly: true },
+                },
+                {
+                    name: 'consentGivenAt',
+                    type: 'date',
+                    admin: { readOnly: true },
+                },
+            ],
+        },
+    });
+    const withFormBuilder = formBuilderConfig(incomingConfig);
+    const submitEndpoint = createSubmitEndpoint(resolved);
+    const mcpEndpoint = {
+        path: `${resolved.routePrefix}/mcp`,
+        method: 'post',
+        handler: async (req) => {
+            const handler = req.payload[MCP_HANDLER_SYMBOL];
+            if (!handler) {
+                return new Response(JSON.stringify({ error: 'Forms MCP not initialized' }), {
+                    status: 503,
+                    headers: { 'content-type': 'application/json' },
+                });
+            }
+            return handler(req);
+        },
+    };
+    return {
+        ...withFormBuilder,
+        endpoints: [
+            ...(withFormBuilder.endpoints ?? []),
+            submitEndpoint,
+            mcpEndpoint,
+        ],
+        onInit: async (payload) => {
+            if (withFormBuilder.onInit)
+                await withFormBuilder.onInit(payload);
+            const registry = getPluginRegistry(payload);
+            registry.requireCapability('audit-log', PLUGIN_ID);
+            registry.requireCapability('email', PLUGIN_ID);
+            const tools = [
+                createListAllowedDestinationsTool({ options: resolved.options }),
+                createValidateFormTool({ options: resolved.options }),
+                createCreateFormTool({ payload, resolved }),
+                createUpdateFormFieldsTool({ payload, resolved }),
+                createUpdateFormDestinationsTool({ payload, resolved }),
+                createGetFormSubmissionsTool({ payload, resolved }),
+            ];
+            const handler = createMcpHandler({
+                payload,
+                serverName: 'forms',
+                tools,
+                logger,
+            });
+            Object.defineProperty(payload, MCP_HANDLER_SYMBOL, {
+                value: handler,
+                enumerable: false,
+                writable: false,
+                configurable: false,
+            });
+            const fanOutDeps = { inngest: resolved.options.inngest, payload, resolved };
+            const getEmailClient = () => readEmailClient(payload);
+            const functions = [
+                createFormFanOutFunction(fanOutDeps),
+                createEmailDestinationFunction({ ...fanOutDeps, getEmailClient }),
+                createWebhookDestinationFunction(fanOutDeps),
+                createSubmitterConfirmationFunction({ ...fanOutDeps, getEmailClient }),
+            ];
+            Object.defineProperty(payload, FUNCTIONS_SYMBOL, {
+                value: functions,
+                enumerable: false,
+                writable: false,
+                configurable: false,
+            });
+            registry.register({
+                id: PLUGIN_ID,
+                version: PLUGIN_VERSION,
+                capabilities: ['forms', 'form-submission-ingest'],
+            });
+            logger.info('Forms server ready', {
+                allowedDestinations: resolved.options.allowedDestinations.length,
+                routePrefix: resolved.routePrefix,
+            });
+        },
+    };
+};
+export function getFormsFunctions(payload) {
+    return (payload[FUNCTIONS_SYMBOL] ??
+        []);
+}
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/F,OAAO,EAAE,cAAc,IAAI,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AACnE,OAAO,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAA;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,iCAAiC,EACjC,gCAAgC,EAChC,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,mCAAmC,EACnC,gCAAgC,GACjC,MAAM,sBAAsB,CAAA;AAE7B,MAAM,SAAS,GAAG,6BAA6B,CAAA;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAA;AAE9B,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;AAChF,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAA;AAS5E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GACtB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE;IACjC,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAEvD,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,IAAI,aAAa,CAAC,CAAA;IAE7E,MAAM,mBAAmB,GAAG;QAC1B,0BAA0B,EAAE,QAAQ,CAAC,iBAAiB;QACtD,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;QACzD,gBAAgB,EAAE,QAAQ,CAAC,SAAS;KACrC,CAAA;IAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;QAC1C,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,IAAI;SACd;QACD,aAAa,EAAE;YACb,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,aAAa,EAAE,mBAAmB,CAAC;YACtF,KAAK,EAAE;gBACL,YAAY,EAAE;oBACZ,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;wBAC5B,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ;4BAAE,OAAO,IAAI,CAAA;wBACjE,MAAM,MAAM,GAAG,CAAE,IAA4C,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;wBAC3G,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;4BACxD,CAAC,CAAE,MAAM,CAAC,cAAc,CAA4B;4BACpD,CAAC,CAAC,EAAE,CAAA;wBACN,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;4BAChC,IAAI,CAAC,IAAI,CAAC,KAAK;gCAAE,SAAQ;4BACzB,MAAM,KAAK,GAAG,wBAAwB,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;4BACpE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,CAAC,KAAK,0FAA0F,CACrH,CAAA;4BACH,CAAC;wBACH,CAAC;wBACD,OAAO,IAAI,CAAA;oBACb,CAAC;iBACF;aACF;SACF;QACD,uBAAuB,EAAE;YACvB,MAAM,EAAE;gBACN,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;oBAChB,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;oBACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;gBAChE,CAAC;gBACD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI;gBAClB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;gBACnB,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;oBAClB,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;oBACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAChC,CAAC;aACF;YACD,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;gBAC7B,GAAG,aAAa;gBAChB;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC1B;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC1B;aACF;SACF;KACF,CAAC,CAAA;IAEF,MAAM,eAAe,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACrD,MAAM,WAAW,GAAG;QAClB,IAAI,EAAE,GAAG,QAAQ,CAAC,WAAW,MAAM;QACnC,MAAM,EAAE,MAAe;QACvB,OAAO,EAAE,KAAK,EAAE,GAAwB,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAI,GAAG,CAAC,OAAmC,CAAC,kBAAkB,CAE9D,CAAA;YACb,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,EAAE;oBAC1E,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;iBAChD,CAAC,CAAA;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,GAAyB,CAAC,CAAA;QAC3C,CAAC;KACF,CAAA;IAED,OAAO;QACL,GAAG,eAAe;QAClB,SAAS,EAAE;YACT,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC;YACpC,cAAc;YACd,WAAW;SACqC;QAClD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,eAAe,CAAC,MAAM;gBAAE,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAEjE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;YAC3C,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;YAClD,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAE9C,MAAM,KAAK,GAAG;gBACZ,iCAAiC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAChE,sBAAsB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrD,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;gBAC3C,0BAA0B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACjD,gCAAgC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;gBACvD,4BAA4B,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;aAClB,CAAA;YAEnC,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAC/B,OAAO;gBACP,UAAU,EAAE,OAAO;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC,CAAA;YAEF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE;gBACjD,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;YAC3E,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,SAAS,GAA0B;gBACvC,wBAAwB,CAAC,UAAU,CAAC;gBACpC,8BAA8B,CAAC,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,CAAC;gBACjE,gCAAgC,CAAC,UAAU,CAAC;gBAC5C,mCAAmC,CAAC,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,CAAC;aACvE,CAAA;YAED,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,gBAAgB,EAAE;gBAC/C,KAAK,EAAE,SAAS;gBAChB,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,QAAQ,CAAC,QAAQ,CAAC;gBAChB,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;aAClD,CAAC,CAAA;YAEF,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;gBAChC,mBAAmB,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM;gBAChE,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAEH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,CACH,OAAmC,CAAC,gBAAgB,CAAuC;QAC7F,EAAE,CACH,CAAA;AACH,CAAC"}

package/dist/policy-fields.d.ts

@@ -0,0 +1,18 @@
+import type { Field } from 'payload';
+export interface PolicyFieldsOptions {
+    availableDestinationLabels: string[];
+    defaultPrivacyNotice: string;
+    requireConsentByDefault: boolean;
+    defaultRateLimit: number;
+}
+/**
+ * Augments the Form Builder collection's fields with the Throughline policy
+ * group: privacy notice, consent toggle and label, spam protection (honeypot
+ * + per-form rate limit), allowlist-bound destinations, and an optional
+ * submitter-confirmation block.
+ *
+ * Returns a *new* array; never mutates the input. Form Builder's
+ * `formOverrides.fields` callback hands us the default field list.
+ */
+export declare function addFormPolicyFields(baseFields: Field[], options: PolicyFieldsOptions): Field[];
+//# sourceMappingURL=policy-fields.d.ts.map