@forumone/throughline-forms 0.0.1 → 0.2.1

package/dist/tools/update-form-destinations.js

@@ -0,0 +1,75 @@
+import { z } from 'zod';
+import { withMeta, getAuditWriter } from '@forumone/throughline-core';
+import { validateDestinationLabel } from '../destinations.js';
+import { deniedEnvelope, isFormsAuthor } from './access.js';
+const inputSchema = withMeta({
+    formId: z.string(),
+    destinationLabels: z.array(z.string()).min(1),
+});
+export function createUpdateFormDestinationsTool(deps) {
+    return {
+        name: 'update_form_destinations',
+        description: "Replaces a form's destinations with the given labels. Every label must be on the allowlist (use list_allowed_destinations to discover). The replace-all semantics are deliberate — incremental destination edits are too easy to misuse via prompt injection.",
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isFormsAuthor(ctx)) {
+                return deniedEnvelope('Only admins and editors can update form destinations.');
+            }
+            const seen = new Set();
+            for (const label of input.destinationLabels) {
+                if (seen.has(label))
+                    return deniedEnvelope(`Duplicate destination label "${label}".`);
+                seen.add(label);
+                const check = validateDestinationLabel(deps.resolved.options, label);
+                if (!check.ok)
+                    return deniedEnvelope(check.reason ?? 'Destination not on the allowlist.');
+            }
+            let existing = null;
+            try {
+                existing = (await deps.payload.findByID({
+                    collection: deps.resolved.formsCollectionSlug,
+                    id: input.formId,
+                }));
+            }
+            catch {
+                existing = null;
+            }
+            if (!existing)
+                return deniedEnvelope(`No form with id "${input.formId}".`);
+            const policy = (existing['policy'] ?? {});
+            const updatedPolicy = {
+                ...policy,
+                destinations: input.destinationLabels.map((label) => ({ label, enabled: true })),
+            };
+            await deps.payload.update({
+                collection: deps.resolved.formsCollectionSlug,
+                id: input.formId,
+                data: { policy: updatedPolicy },
+            });
+            const auditWriter = getAuditWriter(deps.payload);
+            await auditWriter({
+                actor: {
+                    type: 'user',
+                    ...(ctx.user?.id ? { userId: ctx.user.id } : {}),
+                    ...(ctx.user?.name ? { userName: ctx.user.name } : {}),
+                    ...(ctx.apiKeyName ? { apiKeyName: ctx.apiKeyName } : {}),
+                },
+                action: 'form.updated',
+                mcpServer: 'forms',
+                mcpTool: 'update_form_destinations',
+                targetCollection: deps.resolved.formsCollectionSlug,
+                targetId: input.formId,
+                targetTitle: typeof existing['title'] === 'string' ? existing['title'] : undefined,
+                ...(input._meta?.userPrompt ? { prompt: input._meta.userPrompt } : {}),
+                ...(input._meta?.reasoning ? { reasoning: input._meta.reasoning } : {}),
+                changesSummary: `Set destinations to: ${input.destinationLabels.join(', ')}.`,
+            });
+            return {
+                ok: true,
+                formId: input.formId,
+                destinations: input.destinationLabels,
+            };
+        },
+    };
+}
+//# sourceMappingURL=update-form-destinations.js.map

package/dist/tools/update-form-destinations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-form-destinations.js","sourceRoot":"","sources":["../../src/tools/update-form-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAErE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAA;AAOF,MAAM,UAAU,gCAAgC,CAC9C,IAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,+PAA+P;QACjQ,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,uDAAuD,CAAC,CAAA;YAChF,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO,cAAc,CAAC,gCAAgC,KAAK,IAAI,CAAC,CAAA;gBACrF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACf,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACpE,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,IAAI,mCAAmC,CAAC,CAAA;YAC3F,CAAC;YAED,IAAI,QAAQ,GAAmC,IAAI,CAAA;YACnD,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACtC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;oBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;iBACjB,CAAC,CAAmC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,cAAc,CAAC,oBAAoB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;YAE1E,MAAM,MAAM,GAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAA;YACtE,MAAM,aAAa,GAAG;gBACpB,GAAG,MAAM;gBACT,YAAY,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aACjF,CAAA;YAED,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;gBAChB,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;aAChC,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,IAAI,EAAE,MAAM;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D;gBACD,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,0BAA0B;gBACnC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC9F,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,cAAc,EAAE,wBAAwB,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC9E,CAAC,CAAA;YAEF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,iBAAiB;aACtC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools/update-form-fields.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+import type { ResolvedFormsConfig } from '../options.js';
+declare const inputSchema: z.ZodObject<{
+    formId: z.ZodString;
+    fields: z.ZodArray<z.ZodObject<{
+        blockType: z.ZodEnum<["text", "textarea", "email", "select", "checkbox", "number"]>;
+        name: z.ZodString;
+        label: z.ZodString;
+        required: z.ZodDefault<z.ZodBoolean>;
+        defaultValue: z.ZodOptional<z.ZodString>;
+        options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            value: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            label: string;
+            value: string;
+        }, {
+            label: string;
+            value: string;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        label: string;
+        name: string;
+        required: boolean;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }, {
+        label: string;
+        name: string;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        required?: boolean | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }>, "many">;
+} & {
+    _meta: z.ZodOptional<z.ZodObject<{
+        userPrompt: z.ZodOptional<z.ZodString>;
+        reasoning: z.ZodOptional<z.ZodString>;
+        changesSummary: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    }, {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    fields: {
+        label: string;
+        name: string;
+        required: boolean;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }[];
+    formId: string;
+    _meta?: {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    } | undefined;
+}, {
+    fields: {
+        label: string;
+        name: string;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        required?: boolean | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }[];
+    formId: string;
+    _meta?: {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    } | undefined;
+}>;
+export interface UpdateFormFieldsDeps {
+    payload: Payload;
+    resolved: ResolvedFormsConfig;
+}
+export declare function createUpdateFormFieldsTool(deps: UpdateFormFieldsDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=update-form-fields.d.ts.map

package/dist/tools/update-form-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-form-fields.d.ts","sourceRoot":"","sources":["../../src/tools/update-form-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AASxD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BsB,CAAC;sBAE1B,CAAC;kBACL,CAAJ;;iBAAgD,CAAC;sBAExC,CAAA;kBACN,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA7BR,CAAA;AAEF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,mBAAmB,CAAA;CAC9B;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAAC,OAAO,WAAW,CAAC,CA0DvC"}

package/dist/tools/update-form-fields.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+import { withMeta, getAuditWriter } from '@forumone/throughline-core';
+import { FieldSchema, validateFieldSet, validateSubmitterConfirmation, } from './_field-schema.js';
+import { deniedEnvelope, isFormsAuthor } from './access.js';
+const inputSchema = withMeta({
+    formId: z.string(),
+    fields: z.array(FieldSchema).min(1),
+});
+export function createUpdateFormFieldsTool(deps) {
+    return {
+        name: 'update_form_fields',
+        description: 'Replaces the fields on an existing form. Re-runs the same accessibility / submitter-confirmation checks `create_form` runs against the form\'s current submitterConfirmation config so existing email-field references stay valid.',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isFormsAuthor(ctx)) {
+                return deniedEnvelope('Only admins and editors can update form fields.');
+            }
+            const fieldCheck = validateFieldSet(input.fields);
+            if (!fieldCheck.ok)
+                return deniedEnvelope(fieldCheck.reason);
+            let existing = null;
+            try {
+                existing = (await deps.payload.findByID({
+                    collection: deps.resolved.formsCollectionSlug,
+                    id: input.formId,
+                }));
+            }
+            catch {
+                existing = null;
+            }
+            if (!existing)
+                return deniedEnvelope(`No form with id "${input.formId}".`);
+            const policy = (existing['policy'] ?? {});
+            const submitterConfirmation = (policy['submitterConfirmation'] ?? {});
+            const confirmationCheck = validateSubmitterConfirmation(submitterConfirmation, input.fields);
+            if (!confirmationCheck.ok)
+                return deniedEnvelope(confirmationCheck.reason);
+            await deps.payload.update({
+                collection: deps.resolved.formsCollectionSlug,
+                id: input.formId,
+                data: { fields: input.fields },
+            });
+            const auditWriter = getAuditWriter(deps.payload);
+            await auditWriter({
+                actor: {
+                    type: 'user',
+                    ...(ctx.user?.id ? { userId: ctx.user.id } : {}),
+                    ...(ctx.user?.name ? { userName: ctx.user.name } : {}),
+                    ...(ctx.apiKeyName ? { apiKeyName: ctx.apiKeyName } : {}),
+                },
+                action: 'form.updated',
+                mcpServer: 'forms',
+                mcpTool: 'update_form_fields',
+                targetCollection: deps.resolved.formsCollectionSlug,
+                targetId: input.formId,
+                targetTitle: typeof existing['title'] === 'string' ? existing['title'] : undefined,
+                ...(input._meta?.userPrompt ? { prompt: input._meta.userPrompt } : {}),
+                ...(input._meta?.reasoning ? { reasoning: input._meta.reasoning } : {}),
+                changesSummary: `Replaced form fields (${input.fields.length} fields).`,
+            });
+            return { ok: true, formId: input.formId, fieldCount: input.fields.length };
+        },
+    };
+}
+//# sourceMappingURL=update-form-fields.js.map

package/dist/tools/update-form-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-form-fields.js","sourceRoot":"","sources":["../../src/tools/update-form-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAErE,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,6BAA6B,GAE9B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAA;AAOF,MAAM,UAAU,0BAA0B,CACxC,IAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,oOAAoO;QACtO,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,iDAAiD,CAAC,CAAA;YAC1E,CAAC;YAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,cAAc,CAAC,UAAU,CAAC,MAAO,CAAC,CAAA;YAE7D,IAAI,QAAQ,GAAmC,IAAI,CAAA;YACnD,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACtC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;oBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;iBACjB,CAAC,CAAmC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,cAAc,CAAC,oBAAoB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;YAE1E,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;YACpE,MAAM,qBAAqB,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAgC,CAAA;YACpG,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC5F,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBAAE,OAAO,cAAc,CAAC,iBAAiB,CAAC,MAAO,CAAC,CAAA;YAE3E,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;gBAChB,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;aAC/B,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE;oBACL,IAAI,EAAE,MAAM;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D;gBACD,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,oBAAoB;gBAC7B,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC9F,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,cAAc,EAAE,yBAAyB,KAAK,CAAC,MAAM,CAAC,MAAM,WAAW;aACxE,CAAC,CAAA;YAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;QAC5E,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools/validate-form.d.ts

@@ -0,0 +1,127 @@
+import { z } from 'zod';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+import type { FormsPluginOptions } from '../options.js';
+declare const inputSchema: z.ZodObject<{
+    fields: z.ZodArray<z.ZodObject<{
+        blockType: z.ZodEnum<["text", "textarea", "email", "select", "checkbox", "number"]>;
+        name: z.ZodString;
+        label: z.ZodString;
+        required: z.ZodDefault<z.ZodBoolean>;
+        defaultValue: z.ZodOptional<z.ZodString>;
+        options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            value: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            label: string;
+            value: string;
+        }, {
+            label: string;
+            value: string;
+        }>, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        label: string;
+        name: string;
+        required: boolean;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }, {
+        label: string;
+        name: string;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        required?: boolean | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }>, "many">;
+    destinationLabels: z.ZodArray<z.ZodString, "many">;
+    submitterConfirmation: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        emailFieldName: z.ZodOptional<z.ZodString>;
+        subject: z.ZodOptional<z.ZodString>;
+        body: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled: boolean;
+        emailFieldName?: string | undefined;
+        subject?: string | undefined;
+        body?: string | undefined;
+    }, {
+        enabled: boolean;
+        emailFieldName?: string | undefined;
+        subject?: string | undefined;
+        body?: string | undefined;
+    }>>;
+} & {
+    _meta: z.ZodOptional<z.ZodObject<{
+        userPrompt: z.ZodOptional<z.ZodString>;
+        reasoning: z.ZodOptional<z.ZodString>;
+        changesSummary: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    }, {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    fields: {
+        label: string;
+        name: string;
+        required: boolean;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }[];
+    destinationLabels: string[];
+    submitterConfirmation?: {
+        enabled: boolean;
+        emailFieldName?: string | undefined;
+        subject?: string | undefined;
+        body?: string | undefined;
+    } | undefined;
+    _meta?: {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    } | undefined;
+}, {
+    fields: {
+        label: string;
+        name: string;
+        blockType: "number" | "email" | "checkbox" | "select" | "textarea" | "text";
+        defaultValue?: string | undefined;
+        required?: boolean | undefined;
+        options?: {
+            label: string;
+            value: string;
+        }[] | undefined;
+    }[];
+    destinationLabels: string[];
+    submitterConfirmation?: {
+        enabled: boolean;
+        emailFieldName?: string | undefined;
+        subject?: string | undefined;
+        body?: string | undefined;
+    } | undefined;
+    _meta?: {
+        reasoning?: string | undefined;
+        changesSummary?: string | undefined;
+        userPrompt?: string | undefined;
+    } | undefined;
+}>;
+export interface ValidateFormDeps {
+    options: FormsPluginOptions;
+}
+export declare function createValidateFormTool(deps: ValidateFormDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=validate-form.d.ts.map

package/dist/tools/validate-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-form.d.ts","sourceRoot":"","sources":["../../src/tools/validate-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AASvD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BI,CAAC;sBACU,CAAC;kBACb,CAAC;;iBACb,CAAN;sBAA4C,CAAC;kBAEjC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAxBb,CAAA;AAEF,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,kBAAkB,CAAA;CAC5B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,gBAAgB,GACrB,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAoCvC"}

package/dist/tools/validate-form.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import { withMeta } from '@forumone/throughline-core';
+import { validateDestinationLabel } from '../destinations.js';
+import { FieldSchema, validateFieldSet, validateSubmitterConfirmation, } from './_field-schema.js';
+import { deniedEnvelope, isFormsAuthor } from './access.js';
+const inputSchema = withMeta({
+    fields: z.array(FieldSchema).min(1),
+    destinationLabels: z.array(z.string()).min(1),
+    submitterConfirmation: z
+        .object({
+        enabled: z.boolean(),
+        emailFieldName: z.string().optional(),
+        subject: z.string().optional(),
+        body: z.string().optional(),
+    })
+        .optional(),
+});
+export function createValidateFormTool(deps) {
+    return {
+        name: 'validate_form',
+        description: 'Runs the same checks `create_form` runs (allowlist, accessibility, submitter-confirmation pointer) without writing anything. Use to confirm a form definition is shippable before persisting it.',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isFormsAuthor(ctx)) {
+                return deniedEnvelope('Only admins and editors can validate form definitions.');
+            }
+            const issues = [];
+            for (const label of input.destinationLabels) {
+                const check = validateDestinationLabel(deps.options, label);
+                if (!check.ok && check.reason)
+                    issues.push(check.reason);
+            }
+            const fieldCheck = validateFieldSet(input.fields);
+            if (!fieldCheck.ok && fieldCheck.reason)
+                issues.push(fieldCheck.reason);
+            const confirmationCheck = validateSubmitterConfirmation(input.submitterConfirmation, input.fields);
+            if (!confirmationCheck.ok && confirmationCheck.reason) {
+                issues.push(confirmationCheck.reason);
+            }
+            return {
+                ok: issues.length === 0,
+                issues,
+                summary: issues.length === 0
+                    ? 'Form definition passes all checks.'
+                    : `${issues.length} issue${issues.length === 1 ? '' : 's'} found.`,
+            };
+        },
+    };
+}
+//# sourceMappingURL=validate-form.js.map

package/dist/tools/validate-form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-form.js","sourceRoot":"","sources":["../../src/tools/validate-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAErD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,qBAAqB,EAAE,CAAC;SACrB,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAA;AAMF,MAAM,UAAU,sBAAsB,CACpC,IAAsB;IAEtB,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,kMAAkM;QACpM,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,wDAAwD,CAAC,CAAA;YACjF,CAAC;YAED,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC3D,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC1D,CAAC;YACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;YACvE,MAAM,iBAAiB,GAAG,6BAA6B,CACrD,KAAK,CAAC,qBAAqB,EAC3B,KAAK,CAAC,MAAM,CACb,CAAA;YACD,IAAI,CAAC,iBAAiB,CAAC,EAAE,IAAI,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;YACvC,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;gBACvB,MAAM;gBACN,OAAO,EACL,MAAM,CAAC,MAAM,KAAK,CAAC;oBACjB,CAAC,CAAC,oCAAoC;oBACtC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,SAAS;aACvE,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,10 +1,74 @@
 {
   "name": "@forumone/throughline-forms",
-  "version": "0.0.1",
-  "description": "OIDC trusted publishing setup package for @forumone/throughline-forms",
+  "version": "0.2.1",
+  "description": "Policy-aware forms layer for the Throughline framework. Wraps Payload's Form Builder with privacy notices, consent, honeypot spam protection, IP rate limiting, a destination allowlist, and submitter confirmation. Six MCP tools for Claude-driven form management; submissions fan out to email and webhook destinations via Inngest.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
-}
+    "throughline",
+    "payload",
+    "forms",
+    "form-builder",
+    "mcp"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/forumone/throughline.git",
+    "directory": "packages/forms"
+  },
+  "homepage": "https://github.com/forumone/throughline/tree/main/packages/forms#readme",
+  "bugs": {
+    "url": "https://github.com/forumone/throughline/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@payloadcms/plugin-form-builder": "^3.0.0",
+    "inngest": "^4.0.0",
+    "payload": "^3.0.0",
+    "react": "^18.0.0 || ^19.0.0"
+  },
+  "dependencies": {
+    "@react-email/components": "^0.5.4",
+    "@react-email/render": "^1.3.2",
+    "zod": "^3.23.0",
+    "@forumone/throughline-core": "0.2.2",
+    "@forumone/throughline-email": "0.2.2",
+    "@forumone/throughline-plugin-contract": "0.2.1"
+  },
+  "devDependencies": {
+    "@payloadcms/plugin-form-builder": "3.83.0",
+    "@types/node": "^20.17.0",
+    "@types/react": "^19.2.0",
+    "eslint": "^9.15.0",
+    "inngest": "^4.2.0",
+    "payload": "^3.83.0",
+    "react": "^19.2.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0",
+    "@forumone/throughline-eslint-config": "0.0.0",
+    "@forumone/throughline-tsconfig": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "tsc -b -w",
+    "clean": "rm -rf dist .turbo *.tsbuildinfo",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}