@forumone/throughline-forms 0.0.1 → 0.2.1

package/dist/policy-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-fields.d.ts","sourceRoot":"","sources":["../src/policy-fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC,MAAM,WAAW,mBAAmB;IAClC,0BAA0B,EAAE,MAAM,EAAE,CAAA;IACpC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,uBAAuB,EAAE,OAAO,CAAA;IAChC,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,KAAK,EAAE,EACnB,OAAO,EAAE,mBAAmB,GAC3B,KAAK,EAAE,CAkHT"}

package/dist/policy-fields.js

@@ -0,0 +1,115 @@
+/**
+ * Augments the Form Builder collection's fields with the Throughline policy
+ * group: privacy notice, consent toggle and label, spam protection (honeypot
+ * + per-form rate limit), allowlist-bound destinations, and an optional
+ * submitter-confirmation block.
+ *
+ * Returns a *new* array; never mutates the input. Form Builder's
+ * `formOverrides.fields` callback hands us the default field list.
+ */
+export function addFormPolicyFields(baseFields, options) {
+    const destinationOptions = options.availableDestinationLabels.map((label) => ({
+        label,
+        value: label,
+    }));
+    return [
+        ...baseFields,
+        {
+            name: 'policy',
+            type: 'group',
+            admin: {
+                description: 'Privacy notice, consent, spam protection, destinations, and submitter confirmation. Edited in the admin only — Claude cannot modify these directly except through the forms MCP tools.',
+            },
+            fields: [
+                {
+                    name: 'privacyNoticeText',
+                    type: 'textarea',
+                    required: true,
+                    defaultValue: options.defaultPrivacyNotice,
+                    admin: {
+                        description: 'Required. Shown above the submit button on rendered forms. Legal review recommended.',
+                    },
+                },
+                {
+                    name: 'requiresExplicitConsent',
+                    type: 'checkbox',
+                    defaultValue: options.requireConsentByDefault,
+                    admin: {
+                        description: 'When true, the form renders a required consent checkbox above submit. Server-side enforcement: submissions without `consent: true` are rejected at the endpoint.',
+                    },
+                },
+                {
+                    name: 'consentLabel',
+                    type: 'text',
+                    defaultValue: 'I agree to the processing of my data as described above.',
+                },
+                {
+                    name: 'spamProtection',
+                    type: 'group',
+                    fields: [
+                        {
+                            name: 'honeypot',
+                            type: 'checkbox',
+                            defaultValue: true,
+                            admin: {
+                                description: 'When enabled, the rendered form includes a visually hidden field. Bots that fill every input get silently dropped.',
+                            },
+                        },
+                        {
+                            name: 'rateLimit',
+                            type: 'number',
+                            defaultValue: options.defaultRateLimit,
+                            admin: {
+                                description: 'Maximum submissions per submitter IP-hash per hour. Falls back to the plugin-wide default.',
+                            },
+                        },
+                    ],
+                },
+                {
+                    name: 'destinations',
+                    type: 'array',
+                    minRows: 1,
+                    admin: {
+                        description: 'Where submissions are routed. Each entry must reference a label from the plugin\'s allowedDestinations.',
+                    },
+                    fields: [
+                        {
+                            name: 'label',
+                            type: 'select',
+                            required: true,
+                            options: destinationOptions,
+                            admin: {
+                                description: 'Pre-approved destination from the allowlist. Adding a new option requires editing plugin config + redeploying.',
+                            },
+                        },
+                        { name: 'enabled', type: 'checkbox', defaultValue: true },
+                    ],
+                },
+                {
+                    name: 'submitterConfirmation',
+                    type: 'group',
+                    admin: {
+                        description: 'Auto-reply to the submitter. When enabled, set emailFieldName to the form field that captures the submitter\'s email address.',
+                    },
+                    fields: [
+                        { name: 'enabled', type: 'checkbox', defaultValue: false },
+                        {
+                            name: 'emailFieldName',
+                            type: 'text',
+                            admin: {
+                                description: 'Name of the field on the form that holds the submitter\'s email. Required when enabled.',
+                            },
+                        },
+                        {
+                            name: 'subject',
+                            type: 'text',
+                            defaultValue: 'Thank you for your submission',
+                        },
+                        { name: 'body', type: 'textarea' },
+                    ],
+                },
+            ],
+        },
+    ];
+}
+//# sourceMappingURL=policy-fields.js.map

package/dist/policy-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-fields.js","sourceRoot":"","sources":["../src/policy-fields.ts"],"names":[],"mappings":"AASA;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAmB,EACnB,OAA4B;IAE5B,MAAM,kBAAkB,GAAG,OAAO,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5E,KAAK;QACL,KAAK,EAAE,KAAK;KACb,CAAC,CAAC,CAAA;IAEH,OAAO;QACL,GAAG,UAAU;QACb;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,WAAW,EACT,wLAAwL;aAC3L;YACD,MAAM,EAAE;gBACN;oBACE,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,IAAI;oBACd,YAAY,EAAE,OAAO,CAAC,oBAAoB;oBAC1C,KAAK,EAAE;wBACL,WAAW,EACT,sFAAsF;qBACzF;iBACF;gBACD;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,UAAU;oBAChB,YAAY,EAAE,OAAO,CAAC,uBAAuB;oBAC7C,KAAK,EAAE;wBACL,WAAW,EACT,kKAAkK;qBACrK;iBACF;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,MAAM;oBACZ,YAAY,EAAE,0DAA0D;iBACzE;gBACD;oBACE,IAAI,EAAE,gBAAgB;oBACtB,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,UAAU;4BAChB,IAAI,EAAE,UAAU;4BAChB,YAAY,EAAE,IAAI;4BAClB,KAAK,EAAE;gCACL,WAAW,EACT,oHAAoH;6BACvH;yBACF;wBACD;4BACE,IAAI,EAAE,WAAW;4BACjB,IAAI,EAAE,QAAQ;4BACd,YAAY,EAAE,OAAO,CAAC,gBAAgB;4BACtC,KAAK,EAAE;gCACL,WAAW,EACT,4FAA4F;6BAC/F;yBACF;qBACF;iBACF;gBACD;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,CAAC;oBACV,KAAK,EAAE;wBACL,WAAW,EACT,yGAAyG;qBAC5G;oBACD,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,OAAO;4BACb,IAAI,EAAE,QAAQ;4BACd,QAAQ,EAAE,IAAI;4BACd,OAAO,EAAE,kBAAkB;4BAC3B,KAAK,EAAE;gCACL,WAAW,EACT,gHAAgH;6BACnH;yBACF;wBACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;qBAC1D;iBACF;gBACD;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE;wBACL,WAAW,EACT,+HAA+H;qBAClI;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE;wBAC1D;4BACE,IAAI,EAAE,gBAAgB;4BACtB,IAAI,EAAE,MAAM;4BACZ,KAAK,EAAE;gCACL,WAAW,EACT,yFAAyF;6BAC5F;yBACF;wBACD;4BACE,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,MAAM;4BACZ,YAAY,EAAE,+BAA+B;yBAC9C;wBACD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;qBACnC;iBACF;aACF;SACF;KACF,CAAA;AACH,CAAC"}

package/dist/submit/endpoint.d.ts

@@ -0,0 +1,16 @@
+import type { Endpoint, PayloadRequest } from 'payload';
+import type { ResolvedFormsConfig } from '../options.js';
+/**
+ * Builds the public submit endpoint. Performs (in order):
+ * 1. Honeypot check — silently 200 if filled (so bots don't learn the trick).
+ * 2. Form lookup — 404 if missing.
+ * 3. Consent enforcement — server-side; client bypass doesn't work.
+ * 4. Rate limit per (form, IP-hash) per hour.
+ * 5. Persist a sanitized submission row.
+ * 6. Fire `form/submission.received` for the fan-out worker.
+ */
+export declare function createSubmitEndpoint(resolved: ResolvedFormsConfig): Endpoint;
+export type SubmitRequest = PayloadRequest & {
+    json?: () => Promise<unknown>;
+};
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/submit/endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../src/submit/endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAA2B,cAAc,EAAE,MAAM,SAAS,CAAA;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAaxD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,CAqF5E;AA8BD,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAA"}

package/dist/submit/endpoint.js

@@ -0,0 +1,116 @@
+import { checkHoneypot } from './spam.js';
+import { extractClientIp, hashIp } from './ip.js';
+import { checkRateLimit } from './rate-limit.js';
+/**
+ * Builds the public submit endpoint. Performs (in order):
+ * 1. Honeypot check — silently 200 if filled (so bots don't learn the trick).
+ * 2. Form lookup — 404 if missing.
+ * 3. Consent enforcement — server-side; client bypass doesn't work.
+ * 4. Rate limit per (form, IP-hash) per hour.
+ * 5. Persist a sanitized submission row.
+ * 6. Fire `form/submission.received` for the fan-out worker.
+ */
+export function createSubmitEndpoint(resolved) {
+    const submitPath = `${resolved.routePrefix}/submit`;
+    const handler = async (req) => {
+        let body;
+        try {
+            body = (await req.json?.());
+        }
+        catch {
+            return jsonResponse({ error: 'Invalid JSON body.' }, 400);
+        }
+        const { formId, data, consent, _hp } = body;
+        if (typeof formId !== 'string' || formId.length === 0) {
+            return jsonResponse({ error: 'formId is required.' }, 400);
+        }
+        // Honeypot: silently accept so bots don't pivot when they detect a 4xx.
+        if (!checkHoneypot(_hp)) {
+            return jsonResponse({ ok: true }, 200);
+        }
+        const payload = req.payload;
+        let form = null;
+        try {
+            form = (await payload.findByID({
+                collection: resolved.formsCollectionSlug,
+                id: formId,
+            }));
+        }
+        catch {
+            form = null;
+        }
+        if (!form)
+            return jsonResponse({ error: 'Form not found.' }, 404);
+        const policy = (form['policy'] ?? {});
+        const requiresConsent = policy['requiresExplicitConsent'] === true;
+        if (requiresConsent && consent !== true) {
+            return jsonResponse({ error: 'Consent is required.' }, 400);
+        }
+        const headers = req.headers;
+        const ip = extractClientIp(headers);
+        const ipHash = await hashIp(ip, resolved.ipHashSecret);
+        const formRateLimit = readNumber((policy['spamProtection'] ?? {})['rateLimit']);
+        const limit = formRateLimit ?? resolved.rateLimit;
+        const rate = await checkRateLimit({
+            payload,
+            formId,
+            ipHash,
+            limit,
+            collectionSlug: resolved.submissionsCollectionSlug,
+        });
+        if (!rate.ok) {
+            return jsonResponse({ error: 'Too many submissions. Try again later.' }, 429);
+        }
+        const submission = await payload.create({
+            collection: resolved.submissionsCollectionSlug,
+            data: {
+                form: formId,
+                submissionData: serializeSubmissionData(data ?? {}),
+                consentGivenAt: requiresConsent ? new Date().toISOString() : null,
+                ipHash,
+            },
+        });
+        await resolved.options.inngest.send({
+            name: 'form/submission.received',
+            data: {
+                formId,
+                submissionId: String(submission.id),
+                formTitle: typeof form['title'] === 'string' ? form['title'] : '(untitled)',
+            },
+        });
+        return jsonResponse({ ok: true, submissionId: String(submission.id) });
+    };
+    return {
+        path: submitPath,
+        method: 'post',
+        handler,
+    };
+}
+function jsonResponse(body, status = 200) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'content-type': 'application/json' },
+    });
+}
+function readNumber(value) {
+    if (typeof value !== 'number' || !Number.isFinite(value) || value <= 0)
+        return null;
+    return value;
+}
+/** Form Builder stores submission data as `[{ field, value }]` rows. */
+function serializeSubmissionData(data) {
+    return Object.entries(data).map(([field, value]) => ({
+        field,
+        value: stringify(value),
+    }));
+}
+function stringify(value) {
+    if (value === null || value === undefined)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/submit/endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/submit/endpoint.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAUhD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA6B;IAChE,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,WAAW,SAAS,CAAA;IAEnD,MAAM,OAAO,GAAmB,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1C,IAAI,IAAgB,CAAA;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAe,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC5D,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAA;QACxC,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAkB,CAAA;QACtC,IAAI,IAAI,GAAmC,IAAI,CAAA;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC;gBAC7B,UAAU,EAAE,QAAQ,CAAC,mBAAmB;gBACxC,EAAE,EAAE,MAAM;aACX,CAAC,CAAmC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAA;QAEjE,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;QAChE,MAAM,eAAe,GAAG,MAAM,CAAC,yBAAyB,CAAC,KAAK,IAAI,CAAA;QAClE,IAAI,eAAe,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAkB,CAAA;QACtC,MAAM,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAA;QAEtD,MAAM,aAAa,GAAG,UAAU,CAC7B,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAA6B,CAAC,WAAW,CAAC,CAC3E,CAAA;QACD,MAAM,KAAK,GAAG,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAA;QACjD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC;YAChC,OAAO;YACP,MAAM;YACN,MAAM;YACN,KAAK;YACL,cAAc,EAAE,QAAQ,CAAC,yBAAyB;SACnD,CAAC,CAAA;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACtC,UAAU,EAAE,QAAQ,CAAC,yBAAyB;YAC9C,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM;gBACZ,cAAc,EAAE,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC;gBACnD,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBACjE,MAAM;aACP;SACF,CAAC,CAAA;QAEF,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAClC,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE;gBACJ,MAAM;gBACN,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,SAAS,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,YAAY;aACxF;SACF,CAAC,CAAA;QAEF,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAA;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,MAAM;QACd,OAAO;KACR,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG;IAC/C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACnF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,wEAAwE;AACxE,SAAS,uBAAuB,CAAC,IAA6B;IAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACnD,KAAK;QACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;KACxB,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC"}

package/dist/submit/ip.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Hashes a submitter IP with HMAC-SHA256 and the deployment's secret. The
+ * raw IP is never persisted; the hash is what rate-limit and audit need.
+ * Using a per-deployment secret means two deployments produce different
+ * hashes for the same IP — an attacker who exfiltrated the hash table from
+ * one site cannot pivot to another.
+ *
+ * Implemented via Web Crypto so the same code runs in Node 20+, edge
+ * runtimes, and browser test environments.
+ */
+export declare function hashIp(ip: string, secret: string): Promise<string>;
+/**
+ * Best-effort client-IP extraction. Honors the standard proxy headers
+ * Vercel/Cloudflare/most reverse proxies set; falls back to '0.0.0.0' so
+ * upstream code can still hash without branching. Two requests with no
+ * headers will share a hash and rate-limit bucket — that is the intended
+ * "no-IP" fail-safe.
+ */
+export declare function extractClientIp(headers: Headers): string;
+//# sourceMappingURL=ip.d.ts.map

package/dist/submit/ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip.d.ts","sourceRoot":"","sources":["../../src/submit/ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWxE;AAaD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAWxD"}

package/dist/submit/ip.js

@@ -0,0 +1,48 @@
+/**
+ * Hashes a submitter IP with HMAC-SHA256 and the deployment's secret. The
+ * raw IP is never persisted; the hash is what rate-limit and audit need.
+ * Using a per-deployment secret means two deployments produce different
+ * hashes for the same IP — an attacker who exfiltrated the hash table from
+ * one site cannot pivot to another.
+ *
+ * Implemented via Web Crypto so the same code runs in Node 20+, edge
+ * runtimes, and browser test environments.
+ */
+export async function hashIp(ip, secret) {
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const sig = await crypto.subtle.sign('HMAC', key, encoder.encode(ip));
+    return bytesToHex(new Uint8Array(sig));
+}
+const HEX_CHARS = '0123456789abcdef';
+function bytesToHex(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i += 1) {
+        const byte = bytes[i];
+        out += HEX_CHARS[byte >> 4] + HEX_CHARS[byte & 0xf];
+    }
+    return out;
+}
+/**
+ * Best-effort client-IP extraction. Honors the standard proxy headers
+ * Vercel/Cloudflare/most reverse proxies set; falls back to '0.0.0.0' so
+ * upstream code can still hash without branching. Two requests with no
+ * headers will share a hash and rate-limit bucket — that is the intended
+ * "no-IP" fail-safe.
+ */
+export function extractClientIp(headers) {
+    const forwarded = headers.get('x-forwarded-for');
+    if (forwarded) {
+        const first = forwarded.split(',')[0];
+        if (first)
+            return first.trim();
+    }
+    const real = headers.get('x-real-ip');
+    if (real)
+        return real;
+    const cf = headers.get('cf-connecting-ip');
+    if (cf)
+        return cf;
+    return '0.0.0.0';
+}
+//# sourceMappingURL=ip.js.map

package/dist/submit/ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip.js","sourceRoot":"","sources":["../../src/submit/ip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,EAAU,EAAE,MAAc;IACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACrE,OAAO,UAAU,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,SAAS,GAAG,kBAAkB,CAAA;AAEpC,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACtB,GAAG,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,CAAE,GAAG,SAAS,CAAC,IAAI,GAAG,GAAG,CAAE,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgB;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAChD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACrC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IACrC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC1C,IAAI,EAAE;QAAE,OAAO,EAAE,CAAA;IACjB,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/submit/rate-limit.d.ts

@@ -0,0 +1,23 @@
+import type { Payload } from 'payload';
+export interface RateLimitArgs {
+    payload: Payload;
+    formId: string;
+    ipHash: string;
+    limit: number;
+    /** Override the form-submissions slug; defaults to 'form-submissions'. */
+    collectionSlug?: string;
+}
+export interface RateLimitResult {
+    ok: boolean;
+    remaining: number;
+    total: number;
+}
+/**
+ * Postgres-backed rate limiter. Counts form-submissions for a given
+ * (form, ipHash) tuple in the past hour. Sufficient for Phase 1 traffic;
+ * deployments with high-volume forms should swap in a Redis-backed
+ * limiter via plugin options later (the public submit endpoint already
+ * abstracts this behind a single function call).
+ */
+export declare function checkRateLimit(args: RateLimitArgs): Promise<RateLimitResult>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/submit/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/submit/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAmBlF"}

package/dist/submit/rate-limit.js

@@ -0,0 +1,27 @@
+/**
+ * Postgres-backed rate limiter. Counts form-submissions for a given
+ * (form, ipHash) tuple in the past hour. Sufficient for Phase 1 traffic;
+ * deployments with high-volume forms should swap in a Redis-backed
+ * limiter via plugin options later (the public submit endpoint already
+ * abstracts this behind a single function call).
+ */
+export async function checkRateLimit(args) {
+    const oneHourAgo = new Date(Date.now() - 60 * 60 * 1000).toISOString();
+    const result = await args.payload.find({
+        collection: args.collectionSlug ?? 'form-submissions',
+        where: {
+            and: [
+                { form: { equals: args.formId } },
+                { ipHash: { equals: args.ipHash } },
+                { createdAt: { greater_than_equal: oneHourAgo } },
+            ],
+        },
+        limit: args.limit + 1,
+    });
+    return {
+        ok: result.totalDocs < args.limit,
+        remaining: Math.max(0, args.limit - result.totalDocs),
+        total: result.totalDocs,
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/submit/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/submit/rate-limit.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAmB;IACtD,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QACrC,UAAU,EAAE,IAAI,CAAC,cAAc,IAAI,kBAAkB;QACrD,KAAK,EAAE;YACL,GAAG,EAAE;gBACH,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;gBACjC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;gBACnC,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE;aAClD;SACF;QACD,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC;KACtB,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK;QACjC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;QACrD,KAAK,EAAE,MAAM,CAAC,SAAS;KACxB,CAAA;AACH,CAAC"}

package/dist/submit/spam.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Returns true when the honeypot field is empty (i.e. the submitter is
+ * probably a real human; bots fill every input). Designed for use with a
+ * visually hidden honeypot input — accessible CSS like
+ * `position: absolute; left: -10000px` rather than `display: none` so
+ * screen readers still see it but humans don't fill it. `display: none`
+ * tells naive crawlers "skip this field"; offscreen positioning does not.
+ */
+export declare function checkHoneypot(value: unknown): boolean;
+//# sourceMappingURL=spam.d.ts.map

package/dist/submit/spam.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spam.d.ts","sourceRoot":"","sources":["../../src/submit/spam.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIrD"}

package/dist/submit/spam.js

@@ -0,0 +1,16 @@
+/**
+ * Returns true when the honeypot field is empty (i.e. the submitter is
+ * probably a real human; bots fill every input). Designed for use with a
+ * visually hidden honeypot input — accessible CSS like
+ * `position: absolute; left: -10000px` rather than `display: none` so
+ * screen readers still see it but humans don't fill it. `display: none`
+ * tells naive crawlers "skip this field"; offscreen positioning does not.
+ */
+export function checkHoneypot(value) {
+    if (value === undefined || value === null)
+        return true;
+    if (typeof value !== 'string')
+        return false;
+    return value.trim() === '';
+}
+//# sourceMappingURL=spam.js.map

package/dist/submit/spam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spam.js","sourceRoot":"","sources":["../../src/submit/spam.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AAC5B,CAAC"}

package/dist/templates/FormSubmission.d.ts

@@ -0,0 +1,21 @@
+export interface FormSubmissionField {
+    field: string;
+    label?: string;
+    value: string;
+}
+export interface FormSubmissionEmailProps {
+    formTitle: string;
+    brandName: string;
+    receivedAt: string;
+    fields: FormSubmissionField[];
+    /** Optional admin URL where the submission can be viewed in Payload. */
+    adminUrl?: string;
+}
+/**
+ * Admin-facing notification sent to email destinations. Lays out submitted
+ * fields in a labeled list rather than a table — tables have more cross-
+ * client compatibility hazards than they're worth for a transactional
+ * notification.
+ */
+export declare function FormSubmissionEmail(props: FormSubmissionEmailProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=FormSubmission.d.ts.map

package/dist/templates/FormSubmission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FormSubmission.d.ts","sourceRoot":"","sources":["../../src/templates/FormSubmission.tsx"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,2CA0DlE"}

package/dist/templates/FormSubmission.js

@@ -0,0 +1,32 @@
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { Heading, Section, Text } from '@react-email/components';
+import { FormsLayout } from './_layout.js';
+/**
+ * Admin-facing notification sent to email destinations. Lays out submitted
+ * fields in a labeled list rather than a table — tables have more cross-
+ * client compatibility hazards than they're worth for a transactional
+ * notification.
+ */
+export function FormSubmissionEmail(props) {
+    const labelStyle = {
+        color: '#52525B',
+        fontSize: 12,
+        fontWeight: 600,
+        margin: '16px 0 4px',
+        textTransform: 'uppercase',
+        letterSpacing: '0.05em',
+    };
+    const valueStyle = {
+        color: '#18181B',
+        fontSize: 14,
+        margin: 0,
+        whiteSpace: 'pre-wrap',
+    };
+    const linkStyle = {
+        color: '#2563EB',
+        fontSize: 14,
+        textDecoration: 'underline',
+    };
+    return (_jsxs(FormsLayout, { preview: `New submission for ${props.formTitle}`, brandName: props.brandName, children: [_jsxs(Heading, { style: { color: '#18181B', fontSize: 22, margin: 0 }, children: ["New submission for ", props.formTitle] }), _jsxs(Text, { style: { color: '#52525B', fontSize: 14, marginTop: 8 }, children: ["Received ", props.receivedAt, "."] }), _jsx(Section, { children: props.fields.length === 0 ? (_jsx(Text, { style: { color: '#52525B', fontSize: 14, marginTop: 16 }, children: "(No data submitted.)" })) : (props.fields.map((field) => (_jsxs(Section, { children: [_jsx(Text, { style: labelStyle, children: field.label ?? field.field }), _jsx(Text, { style: valueStyle, children: field.value || '(empty)' })] }, field.field)))) }), props.adminUrl ? (_jsx(Section, { style: { marginTop: 24 }, children: _jsx("a", { href: props.adminUrl, style: linkStyle, children: "View in admin" }) })) : null] }));
+}
+//# sourceMappingURL=FormSubmission.js.map

package/dist/templates/FormSubmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FormSubmission.js","sourceRoot":"","sources":["../../src/templates/FormSubmission.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAiB1C;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,UAAU,GAAkB;QAChC,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,GAAG;QACf,MAAM,EAAE,YAAY;QACpB,aAAa,EAAE,WAAW;QAC1B,aAAa,EAAE,QAAQ;KACxB,CAAA;IACD,MAAM,UAAU,GAAkB;QAChC,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,CAAC;QACT,UAAU,EAAE,UAAU;KACvB,CAAA;IACD,MAAM,SAAS,GAAkB;QAC/B,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,WAAW;KAC5B,CAAA;IAED,OAAO,CACL,MAAC,WAAW,IACV,OAAO,EAAE,sBAAsB,KAAK,CAAC,SAAS,EAAE,EAChD,SAAS,EAAE,KAAK,CAAC,SAAS,aAE1B,MAAC,OAAO,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,oCACvC,KAAK,CAAC,SAAS,IAC3B,EAEV,MAAC,IAAI,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,0BACjD,KAAK,CAAC,UAAU,SACrB,EAEP,KAAC,OAAO,cACL,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC3B,KAAC,IAAI,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,qCAEvD,CACR,CAAC,CAAC,CAAC,CACF,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAC1B,MAAC,OAAO,eACN,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,YAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,GAAQ,EAC5D,KAAC,IAAI,IAAC,KAAK,EAAE,UAAU,YAAG,KAAK,CAAC,KAAK,IAAI,SAAS,GAAQ,KAF9C,KAAK,CAAC,KAAK,CAGf,CACX,CAAC,CACH,GACO,EAET,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChB,KAAC,OAAO,IAAC,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,YAC/B,YAAG,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,8BAErC,GACI,CACX,CAAC,CAAC,CAAC,IAAI,IACI,CACf,CAAA;AACH,CAAC"}

package/dist/templates/SubmitterConfirmation.d.ts

@@ -0,0 +1,18 @@
+export interface SubmitterConfirmationEmailProps {
+    /** Free-form recipient name (or `"there"` if unknown). */
+    recipientName: string;
+    brandName: string;
+    /** Per-form subject line; the configured fallback is "Thank you for your submission". */
+    subject: string;
+    /** Per-form body. Multi-paragraph; rendered as plain prose preserving line breaks. */
+    body: string;
+}
+/**
+ * Submitter-facing auto-reply. Intentionally minimal: a greeting, the
+ * configured body, and a brand-named footer. The `body` is operator-
+ * authored copy from the form admin; this template treats it as trusted
+ * (admin-edited) content but renders it as plaintext — `body` strings
+ * containing HTML render literally rather than as markup.
+ */
+export declare function SubmitterConfirmationEmail(props: SubmitterConfirmationEmailProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=SubmitterConfirmation.d.ts.map

package/dist/templates/SubmitterConfirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubmitterConfirmation.d.ts","sourceRoot":"","sources":["../../src/templates/SubmitterConfirmation.tsx"],"names":[],"mappings":"AAGA,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAA;IACf,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,+BAA+B,2CAqBhF"}

package/dist/templates/SubmitterConfirmation.js

@@ -0,0 +1,14 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Heading, Text } from '@react-email/components';
+import { FormsLayout } from './_layout.js';
+/**
+ * Submitter-facing auto-reply. Intentionally minimal: a greeting, the
+ * configured body, and a brand-named footer. The `body` is operator-
+ * authored copy from the form admin; this template treats it as trusted
+ * (admin-edited) content but renders it as plaintext — `body` strings
+ * containing HTML render literally rather than as markup.
+ */
+export function SubmitterConfirmationEmail(props) {
+    return (_jsxs(FormsLayout, { preview: props.subject, brandName: props.brandName, children: [_jsx(Heading, { style: { color: '#18181B', fontSize: 22, margin: 0 }, children: props.subject }), _jsxs(Text, { style: { color: '#18181B', fontSize: 16, marginTop: 16 }, children: ["Hi ", props.recipientName, ","] }), (props.body || '').split(/\n{2,}/).map((paragraph, idx) => (_jsx(Text, { style: { color: '#18181B', fontSize: 14, lineHeight: 1.5, whiteSpace: 'pre-wrap' }, children: paragraph }, idx)))] }));
+}
+//# sourceMappingURL=SubmitterConfirmation.js.map

package/dist/templates/SubmitterConfirmation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubmitterConfirmation.js","sourceRoot":"","sources":["../../src/templates/SubmitterConfirmation.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAY1C;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAsC;IAC/E,OAAO,CACL,MAAC,WAAW,IAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,aAC7D,KAAC,OAAO,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,YAC1D,KAAK,CAAC,OAAO,GACN,EAEV,MAAC,IAAI,IAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,oBACxD,KAAK,CAAC,aAAa,SAClB,EAEN,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAC1D,KAAC,IAAI,IAEH,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,YAEjF,SAAS,IAHL,GAAG,CAIH,CACR,CAAC,IACU,CACf,CAAA;AACH,CAAC"}

package/dist/templates/_layout.d.ts

@@ -0,0 +1,14 @@
+import type { ReactNode } from 'react';
+export interface FormsLayoutProps {
+    preview: string;
+    brandName: string;
+    children: ReactNode;
+}
+/**
+ * Lightweight chrome shared across the two forms-package templates. Modeled
+ * on the email package's EmailLayout but uses neutral defaults rather than
+ * pulling the full token surface — these emails are short, transactional,
+ * and benefit from minimal branding.
+ */
+export declare function FormsLayout({ preview, brandName, children }: FormsLayoutProps): import("react/jsx-runtime").JSX.Element;
+//# sourceMappingURL=_layout.d.ts.map

package/dist/templates/_layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_layout.d.ts","sourceRoot":"","sources":["../../src/templates/_layout.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,SAAS,EAAE,MAAM,OAAO,CAAA;AAErD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,SAAS,CAAA;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,gBAAgB,2CA2C7E"}

package/dist/templates/_layout.js

@@ -0,0 +1,34 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Body, Container, Head, Hr, Html, Preview, Section, Text } from '@react-email/components';
+/**
+ * Lightweight chrome shared across the two forms-package templates. Modeled
+ * on the email package's EmailLayout but uses neutral defaults rather than
+ * pulling the full token surface — these emails are short, transactional,
+ * and benefit from minimal branding.
+ */
+export function FormsLayout({ preview, brandName, children }) {
+    const bodyStyle = {
+        backgroundColor: '#F5F5F5',
+        fontFamily: 'system-ui, -apple-system, BlinkMacSystemFont, sans-serif',
+        margin: 0,
+        padding: '24px 0',
+    };
+    const containerStyle = {
+        backgroundColor: '#FFFFFF',
+        maxWidth: 600,
+        margin: '0 auto',
+        padding: 32,
+        borderRadius: 8,
+    };
+    const headerStyle = {
+        color: '#18181B',
+        fontWeight: 700,
+        fontSize: 18,
+        margin: 0,
+    };
+    const dividerStyle = { borderColor: '#E4E4E7', margin: '24px 0' };
+    const footerDividerStyle = { borderColor: '#E4E4E7', margin: '32px 0 16px' };
+    const footerStyle = { color: '#52525B', fontSize: 12, margin: 0 };
+    return (_jsxs(Html, { lang: "en", children: [_jsx(Head, {}), _jsx(Preview, { children: preview }), _jsx(Body, { style: bodyStyle, children: _jsxs(Container, { style: containerStyle, children: [_jsx(Section, { children: _jsx(Text, { style: headerStyle, children: brandName }) }), _jsx(Hr, { style: dividerStyle }), children, _jsx(Hr, { style: footerDividerStyle }), _jsxs(Text, { style: footerStyle, children: ["This is an automated message from ", brandName, ". Replies to this address are not monitored."] })] }) })] }));
+}
+//# sourceMappingURL=_layout.js.map

package/dist/templates/_layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_layout.js","sourceRoot":"","sources":["../../src/templates/_layout.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AASjG;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAoB;IAC5E,MAAM,SAAS,GAAkB;QAC/B,eAAe,EAAE,SAAS;QAC1B,UAAU,EAAE,0DAA0D;QACtE,MAAM,EAAE,CAAC;QACT,OAAO,EAAE,QAAQ;KAClB,CAAA;IACD,MAAM,cAAc,GAAkB;QACpC,eAAe,EAAE,SAAS;QAC1B,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,CAAC;KAChB,CAAA;IACD,MAAM,WAAW,GAAkB;QACjC,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,GAAG;QACf,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,CAAC;KACV,CAAA;IACD,MAAM,YAAY,GAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAChF,MAAM,kBAAkB,GAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAC3F,MAAM,WAAW,GAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IAEhF,OAAO,CACL,MAAC,IAAI,IAAC,IAAI,EAAC,IAAI,aACb,KAAC,IAAI,KAAG,EACR,KAAC,OAAO,cAAE,OAAO,GAAW,EAC5B,KAAC,IAAI,IAAC,KAAK,EAAE,SAAS,YACpB,MAAC,SAAS,IAAC,KAAK,EAAE,cAAc,aAC9B,KAAC,OAAO,cACN,KAAC,IAAI,IAAC,KAAK,EAAE,WAAW,YAAG,SAAS,GAAQ,GACpC,EACV,KAAC,EAAE,IAAC,KAAK,EAAE,YAAY,GAAI,EAC1B,QAAQ,EACT,KAAC,EAAE,IAAC,KAAK,EAAE,kBAAkB,GAAI,EACjC,MAAC,IAAI,IAAC,KAAK,EAAE,WAAW,mDACa,SAAS,oDACvC,IACG,GACP,IACF,CACR,CAAA;AACH,CAAC"}

package/dist/templates/index.d.ts

@@ -0,0 +1,7 @@
+export { FormsLayout } from './_layout.js';
+export type { FormsLayoutProps } from './_layout.js';
+export { FormSubmissionEmail } from './FormSubmission.js';
+export type { FormSubmissionEmailProps, FormSubmissionField } from './FormSubmission.js';
+export { SubmitterConfirmationEmail } from './SubmitterConfirmation.js';
+export type { SubmitterConfirmationEmailProps } from './SubmitterConfirmation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/templates/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/templates/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,YAAY,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAExF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,YAAY,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAA"}