@jini-ai/cms 0.5.2 → 0.5.4

package/dist/forms/sql/repo.js

@@ -0,0 +1,175 @@
+import { FormSlugConflictError } from "../errors.js";
+import { toDefinitionRecord, toDefinitionRow, toSubmissionRecord, toSubmissionRow, updatableDefinitionColumns, } from "./repo.rows.js";
+/**
+ * @file THE forms repositories: one Kysely query body for every database the storage kernel drives
+ * (SQLite, PGlite, Postgres). Every statement goes through `kernel.run` and is awaited.
+ *
+ * `create`'s slug uniqueness is enforced by the real unique index
+ * (`form_definitions_workspace_slug_unique`) — the tie-break of behavior.spec.md §6.1 — but the
+ * conflict is detected by a check inside a transaction holding the workspace's forms lock, not by
+ * catching the violation: on Postgres a failed statement aborts the surrounding transaction, so a
+ * follow-up "is it in the Trash?" query could not run. The index stays as the backstop against a
+ * writer outside this process.
+ */
+export class SqlFormDefinitionRepo {
+    kernel;
+    tables;
+    constructor({ kernel, tables }, _optional = {}) { this.kernel = kernel; this.tables = tables; }
+    /** Trash-aware: `deleted_at IS NULL` excludes a trashed row (`ports.ts`'s fail-closed-reads doc). */
+    async findById(required) {
+        const row = await this.kernel.run((db) => db
+            .selectFrom(this.tables.definitions)
+            .selectAll()
+            .where("workspace_id", "=", required.workspaceId)
+            .where("id", "=", required.id)
+            .where("deleted_at", "is", null)
+            .limit(1)
+            .executeTakeFirst());
+        return row ? toDefinitionRecord(row) : null;
+    }
+    /** Trash-aware, as {@link findById}. */
+    async findBySlug(required) {
+        const row = await this.kernel.run((db) => db
+            .selectFrom(this.tables.definitions)
+            .selectAll()
+            .where("workspace_id", "=", required.workspaceId)
+            .where("slug", "=", required.slug)
+            .where("deleted_at", "is", null)
+            .limit(1)
+            .executeTakeFirst());
+        return row ? toDefinitionRecord(row) : null;
+    }
+    /** Trash-aware, as {@link findById}. */
+    async list(required) {
+        const rows = await this.kernel.run((db) => db
+            .selectFrom(this.tables.definitions)
+            .selectAll()
+            .where("workspace_id", "=", required.workspaceId)
+            .where("deleted_at", "is", null)
+            .execute());
+        return rows.map((row) => toDefinitionRecord(row));
+    }
+    async create(record) {
+        await this.kernel.transaction(async () => {
+            await this.kernel.lockKey(`forms:${record.workspaceId}`);
+            // Trash-blind, deliberately: the unique index has no `WHERE deleted_at IS NULL` clause, so a
+            // trashed row's slug is still "taken" — the conflict is real either way, only the remedy
+            // differs, which is why the message names it.
+            const conflicting = await this.kernel.run((db) => db
+                .selectFrom(this.tables.definitions)
+                .select("deleted_at")
+                .where("workspace_id", "=", record.workspaceId)
+                .where("slug", "=", record.slug)
+                .limit(1)
+                .executeTakeFirst());
+            if (conflicting) {
+                throw new FormSlugConflictError({
+                    message: conflicting.deleted_at !== null
+                        ? `a form with slug '${record.slug}' is in the Trash — restore it, or delete it permanently from the Trash, to reuse the slug`
+                        : `a form with slug '${record.slug}' already exists`,
+                    slug: record.slug,
+                });
+            }
+            await this.kernel.run((db) => db.insertInto(this.tables.definitions).values(toDefinitionRow(record)).execute());
+        });
+    }
+    /**
+     * Update-only path for a LIVE row. `version`/`deleted_at` are deliberately excluded from the SET
+     * list (only the Trash's compare-and-set may move `version`), and `deleted_at IS NULL` in the
+     * WHERE means the UPDATE simply matches zero rows if the record has since been trashed — a stale
+     * in-hand copy can never clear a marker it never knew was set.
+     */
+    async update(record) {
+        const set = updatableDefinitionColumns(toDefinitionRow(record));
+        await this.kernel.run((db) => db
+            .updateTable(this.tables.definitions)
+            .set(set)
+            .where("workspace_id", "=", record.workspaceId)
+            .where("id", "=", record.id)
+            .where("deleted_at", "is", null)
+            .execute());
+    }
+    /** Trash-BLIND — see `ports.ts`'s doc for why this is the one deliberate exception. */
+    async isSlugTaken(required) {
+        const row = await this.kernel.run((db) => db
+            .selectFrom(this.tables.definitions)
+            .select("id")
+            .where("workspace_id", "=", required.workspaceId)
+            .where("slug", "=", required.slug)
+            .limit(1)
+            .executeTakeFirst());
+        return row !== undefined;
+    }
+}
+export class SqlFormSubmissionRepo {
+    kernel;
+    tables;
+    constructor({ kernel, tables }, _optional = {}) { this.kernel = kernel; this.tables = tables; }
+    async findById(required) {
+        const row = await this.kernel.run((db) => db
+            .selectFrom(this.tables.submissions)
+            .selectAll()
+            .where("workspace_id", "=", required.workspaceId)
+            .where("id", "=", required.id)
+            .where("deleted_at", "is", null)
+            .limit(1)
+            .executeTakeFirst());
+        return row ? toSubmissionRecord(row) : null;
+    }
+    async create(record) {
+        await this.kernel.run((db) => db.insertInto(this.tables.submissions).values(toSubmissionRow(record)).execute());
+    }
+    /** The content kernel's transaction; a nested call joins the open one.
+     *  @complexity O(1) beyond `work`. */
+    transaction(work) {
+        return this.kernel.transaction(work);
+    }
+    /**
+     * Newest-first (`submitted_at` desc, `id` desc tie-break, behavior.spec.md §2.1). The cursor
+     * resumes strictly after the previously returned page's last row on that same ordering; an unknown
+     * cursor id is ignored (first page), as before.
+     *
+     * @complexity O(limit) rows read via the definition index; two statements when a cursor is given.
+     */
+    async listByDefinition(required, optional = {}) {
+        const cursorRow = optional.cursor
+            ? await this.kernel.run((db) => db
+                .selectFrom(this.tables.submissions)
+                .select(["submitted_at", "id"])
+                .where("workspace_id", "=", required.workspaceId)
+                .where("id", "=", optional.cursor)
+                .limit(1)
+                .executeTakeFirst())
+            : undefined;
+        const rows = await this.kernel.run((db) => {
+            let query = db
+                .selectFrom(this.tables.submissions)
+                .selectAll()
+                .where("workspace_id", "=", required.workspaceId)
+                .where("form_definition_id", "=", required.formDefinitionId)
+                .where("deleted_at", "is", null);
+            if (cursorRow) {
+                query = query.where((eb) => eb.or([
+                    eb("submitted_at", "<", cursorRow.submitted_at),
+                    eb.and([eb("submitted_at", "=", cursorRow.submitted_at), eb("id", "<", cursorRow.id)]),
+                ]));
+            }
+            return query.orderBy("submitted_at", "desc").orderBy("id", "desc").limit(required.limit + 1).execute();
+        });
+        const hasMore = rows.length > required.limit;
+        const page = hasMore ? rows.slice(0, required.limit) : rows;
+        const nextCursor = hasMore ? page[page.length - 1]?.id ?? null : null;
+        return { items: page.map((row) => toSubmissionRecord(row)), nextCursor };
+    }
+}
+/** The form-definition repo for the injected kernel and required host table names.
+ * @complexity O(1); no connection or schema work. */
+export function formDefinitionRepoFor({ kernel, tables }, _optional = {}) {
+    return new SqlFormDefinitionRepo({ kernel: kernel, tables });
+}
+/** The form-submission repo for the injected kernel and required host table names.
+ * @complexity O(1); no connection or schema work. */
+export function formSubmissionRepoFor({ kernel, tables }, _optional = {}) {
+    return new SqlFormSubmissionRepo({ kernel: kernel, tables });
+}
+//# sourceMappingURL=repo.js.map

package/dist/forms/sql/repo.rows.d.ts

@@ -0,0 +1,33 @@
+import type { Insertable, Selectable } from "kysely";
+import type { FormDefinitionTable, FormSubmissionTable } from "./tables.js";
+import type { FormDefinitionRecord, FormSubmissionRecord } from "../types.js";
+/**
+ * @file Row mapping for `form_definitions` / `form_submissions`, shared by every dialect: the columns
+ * are the generated `ContentDatabase` types (snake_case, JSON as compact text). Neutral on purpose —
+ * no repo, no driver.
+ */
+export type FormDefinitionRow = Selectable<FormDefinitionTable>;
+export type FormSubmissionRow = Selectable<FormSubmissionTable>;
+/** One `form_definitions` row as a {@link FormDefinitionRecord}. */
+export declare function toDefinitionRecord(row: FormDefinitionRow, _optional?: Record<string, never>): FormDefinitionRecord;
+/**
+ * The `form_definitions` row an INSERT writes. `version` is included for `create`; `update()` strips
+ * it (see {@link updatableDefinitionColumns}) because only the Trash's compare-and-set may move it.
+ */
+export declare function toDefinitionRow(record: FormDefinitionRecord, _optional?: Record<string, never>): Insertable<FormDefinitionTable>;
+/** The columns `update()` writes: everything but the key and `version`. */
+export declare function updatableDefinitionColumns(row: ReturnType<typeof toDefinitionRow>, _optional?: Record<string, never>): {
+    name: string;
+    slug: string;
+    created_at: string;
+    updated_at: string;
+    fields_json: string;
+    notify_json: string;
+    status?: string | undefined;
+    deleted_at?: string | null;
+};
+/** One `form_submissions` row as a {@link FormSubmissionRecord}. */
+export declare function toSubmissionRecord(row: FormSubmissionRow, _optional?: Record<string, never>): FormSubmissionRecord;
+/** The `form_submissions` row a submit writes (compact JSON data). */
+export declare function toSubmissionRow(record: FormSubmissionRecord, _optional?: Record<string, never>): Insertable<FormSubmissionTable>;
+//# sourceMappingURL=repo.rows.d.ts.map

package/dist/forms/sql/repo.rows.js

@@ -0,0 +1,64 @@
+import { decodeFormFields, encodeFormFields } from "../fields-json.js";
+/** One `form_definitions` row as a {@link FormDefinitionRecord}. */
+export function toDefinitionRecord(row, _optional = {}) {
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        name: row.name,
+        slug: row.slug,
+        ...decodeFormFields({ json: row.fields_json }),
+        notify: JSON.parse(row.notify_json),
+        status: row.status,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        version: row.version,
+    };
+}
+/**
+ * The `form_definitions` row an INSERT writes. `version` is included for `create`; `update()` strips
+ * it (see {@link updatableDefinitionColumns}) because only the Trash's compare-and-set may move it.
+ */
+export function toDefinitionRow(record, _optional = {}) {
+    return {
+        id: record.id,
+        workspace_id: record.workspaceId,
+        name: record.name,
+        slug: record.slug,
+        fields_json: encodeFormFields({ definition: record }),
+        notify_json: JSON.stringify(record.notify),
+        status: record.status,
+        created_at: record.createdAt,
+        updated_at: record.updatedAt,
+        version: record.version,
+    };
+}
+/** The columns `update()` writes: everything but the key and `version`. */
+export function updatableDefinitionColumns(row, _optional = {}) {
+    const { id: _id, workspace_id: _workspaceId, version: _version, ...rest } = row;
+    return rest;
+}
+/** One `form_submissions` row as a {@link FormSubmissionRecord}. */
+export function toSubmissionRecord(row, _optional = {}) {
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        formDefinitionId: row.form_definition_id,
+        data: JSON.parse(row.data_json),
+        // cms-forms <0.2.2 required a string (0.2.2 allows null). Since nullable migration 0006, an
+        // expired IP has an empty display value until the host adopts the nullable package DTO.
+        sourceIp: row.source_ip ?? "",
+        submittedAt: row.submitted_at,
+    };
+}
+/** The `form_submissions` row a submit writes (compact JSON data). */
+export function toSubmissionRow(record, _optional = {}) {
+    return {
+        id: record.id,
+        workspace_id: record.workspaceId,
+        form_definition_id: record.formDefinitionId,
+        data_json: JSON.stringify(record.data),
+        source_ip: record.sourceIp,
+        submitted_at: record.submittedAt,
+    };
+}
+//# sourceMappingURL=repo.rows.js.map

package/dist/forms/sql/submission-ip-retention-repo.d.ts

@@ -0,0 +1,9 @@
+import { type StorageKernel } from "@jini-ai/db/kernel";
+import type { FormsTables } from "./tables.js";
+import type { SubmissionIpRetentionPort } from "../submission-ip-retention.js";
+/** Site-owned schema adapter; no retention policy or timer lives here. */
+export declare function createSubmissionIpRetentionRepo<DB>({ kernel: suppliedKernel, tables }: {
+    kernel: StorageKernel<DB>;
+    tables: FormsTables;
+}, _optional?: Record<string, never>): SubmissionIpRetentionPort;
+//# sourceMappingURL=submission-ip-retention-repo.d.ts.map

package/dist/forms/sql/submission-ip-retention-repo.js

@@ -0,0 +1,40 @@
+import { sql } from "kysely";
+import { listColumns } from "@jini-ai/db/kernel";
+/** Site-owned schema adapter; no retention policy or timer lives here. */
+export function createSubmissionIpRetentionRepo({ kernel: suppliedKernel, tables }, _optional = {}) {
+    const kernel = suppliedKernel;
+    let nullableConfirmed = false;
+    return {
+        async clearExpiredIps({ submittedBeforeOrAt }, { limit = 500 } = {}) {
+            if (!Number.isSafeInteger(limit) || limit <= 0)
+                throw new RangeError("submission IP batch limit must be positive");
+            if (!nullableConfirmed) {
+                // A database not yet at migration 0006 still has NOT NULL source_ip. Fail before
+                // writing while that old schema is present; a failed probe is retried on the next pass.
+                // The kernel's catalog helper spells the dialect-specific lookup (SQLite table_info,
+                // Postgres information_schema), so this adapter stays dialect-neutral.
+                const columns = await listColumns(kernel, tables.submissions);
+                nullableConfirmed = columns.some(column => column.name === "source_ip" && !column.notNull);
+                if (!nullableConfirmed)
+                    throw new Error("submission IP retention requires the nullable source_ip migration (0006)");
+            }
+            // Single statement, with the predicate repeated on the write: another process may have
+            // cleared a selected row already. NULL→NULL is excluded from the count. No read/modify/
+            // save of data_json, no Trash filter, and no lease/outbox event to race or retain the IP.
+            // The raw NULL expression bridges the still-published NOT NULL generated table type;
+            // the readiness probe above verifies the real schema before issuing it.
+            const result = await kernel.run(db => db.updateTable(tables.submissions)
+                .set({ source_ip: sql `NULL` })
+                .where("source_ip", "is not", null)
+                .where("submitted_at", "<=", submittedBeforeOrAt)
+                .where("id", "in", db.selectFrom(tables.submissions)
+                .select("id")
+                .where("source_ip", "is not", null)
+                .where("submitted_at", "<=", submittedBeforeOrAt)
+                .orderBy("submitted_at").orderBy("id").limit(limit))
+                .executeTakeFirst());
+            return Number(result.numUpdatedRows);
+        },
+    };
+}
+//# sourceMappingURL=submission-ip-retention-repo.js.map

package/dist/forms/sql/tables.d.ts

@@ -0,0 +1,32 @@
+import type { Generated } from "kysely";
+/** Names belong to the host; both repositories borrow their narrow view of its kernel. */
+export interface FormsTables {
+    definitions: string;
+    submissions: string;
+}
+export interface FormDefinitionTable {
+    id: string;
+    workspace_id: string;
+    name: string;
+    slug: string;
+    fields_json: string;
+    notify_json: string;
+    status: Generated<string>;
+    created_at: string;
+    updated_at: string;
+    deleted_at: string | null;
+    version: Generated<number>;
+}
+export interface FormSubmissionTable {
+    id: string;
+    workspace_id: string;
+    form_definition_id: string;
+    data_json: string;
+    source_ip: string | null;
+    submitted_at: string;
+    deleted_at: string | null;
+    version: Generated<number>;
+}
+export type FormDefinitionDatabase = Record<string, FormDefinitionTable>;
+export type FormSubmissionDatabase = Record<string, FormSubmissionTable>;
+//# sourceMappingURL=tables.d.ts.map

package/dist/forms/sql/tables.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tables.js.map

package/dist/forms/submission-attempts.d.ts

@@ -0,0 +1,70 @@
+/**
+ * @file `submission-attempts.ts` — remembers, in this process only and for a short window, which
+ * public form submissions were just accepted, so a double-clicked Send stores ONE row.
+ *
+ * Why an attempt token, not the body (2026-10-05, replacing the 2026-10-04 derived-id dedupe): an
+ * IP + body key cannot tell a double click from two people behind one office NAT giving the same
+ * answer, and deriving the permanent submission id from it left an unsalted IP hash in every row
+ * after the 90-day IP sweep. The page now carries a fresh `_attempt` token per response
+ * (`injectFormAttemptTokens`, `http/site/form-render.ts`), so a double click repeats one token while
+ * two visitors, or the same visitor after a reload, send different ones. Ids are random again.
+ *
+ * What still shares a token: a static export (the server cannot vary a file per visitor, so it
+ * ships none) and a page a shared HTTP cache served to several visitors. Those, and API callers that
+ * send no token, fall back to the old IP + body comparison for the same window. Only identical
+ * answers from one IP within the window collapse, as before.
+ *
+ * Why process memory, not a table: the claim must be atomic, short-lived and never persisted (it is
+ * an IP-derived hash). One Node process makes check-then-claim atomic with no await between them;
+ * a restart or a second machine only forgets recent claims, which stores a duplicate rather than
+ * dropping a submission. Same one-process-lifetime shape as the forms rate limiter.
+ */
+import type { SubmitFormInput } from "./index.js";
+/** The hidden field carrying a form's per-response attempt token. Never stored, never validated. */
+export declare const FORM_ATTEMPT_FIELD = "_attempt";
+/** How long after a submission is accepted an identical attempt is answered without a second row. */
+export declare const DUPLICATE_SUBMISSION_WINDOW_MS = 60000;
+/** Returned by {@link SubmissionAttempts.once} when `submit` was skipped as a duplicate. */
+export declare const DUPLICATE_ATTEMPT: unique symbol;
+export interface SubmissionAttempts {
+    /** Hash one attempt with the host-supplied hash, without retaining the source IP or body. */
+    key(required: {
+        input: SubmitFormInput;
+        attemptToken: unknown;
+    }, optional?: Record<string, never>): string;
+    /**
+     * Runs `submit` unless the same attempt was accepted within the window. A copy that arrives while
+     * the first is still being stored waits for it: answered as a duplicate when the first is
+     * accepted, run itself when the first failed (so a failed first copy never swallows its retry).
+     * `submit`'s rejection propagates and frees the claim.
+     * @complexity O(1) amortized: expired claims are pruned from the oldest end.
+     */
+    once<T>(required: {
+        key: string;
+        nowMs: () => number;
+        submit: () => Promise<T>;
+    }, optional?: Record<string, never>): Promise<T | typeof DUPLICATE_ATTEMPT>;
+}
+/**
+ * The key one attempt is remembered under: a SHA-256 of workspace, slug, source IP, attempt token
+ * (null when the request carried none) and the body. Body keys are sorted so their order cannot
+ * change the key. Held only in memory, only for the window.
+ * @complexity O(b log b) for b body keys.
+ */
+export declare function submissionAttemptKey({ input, attemptToken, hash }: {
+    input: SubmitFormInput;
+    attemptToken: unknown;
+    hash: (input: string) => string;
+}, _optional?: Record<string, never>): string;
+/**
+ * Builds one in-memory attempt store. Entries sit in claim/acceptance order (an accepted entry is
+ * re-inserted at the end), so expired ones are always at the front.
+ * @returns The store; see {@link SubmissionAttempts.once}.
+ */
+export declare function createSubmissionAttempts({ hash }: {
+    hash: (input: string) => string;
+}, { windowMs, maxEntries }?: {
+    windowMs?: number;
+    maxEntries?: number;
+}): SubmissionAttempts;
+//# sourceMappingURL=submission-attempts.d.ts.map

package/dist/forms/submission-attempts.js

@@ -0,0 +1,70 @@
+/** The hidden field carrying a form's per-response attempt token. Never stored, never validated. */
+export const FORM_ATTEMPT_FIELD = "_attempt";
+/** How long after a submission is accepted an identical attempt is answered without a second row. */
+export const DUPLICATE_SUBMISSION_WINDOW_MS = 60_000;
+/** Upper bound on remembered attempts; past it the oldest is forgotten (a duplicate, never a drop). */
+const MAX_REMEMBERED_ATTEMPTS = 10_000;
+/** Returned by {@link SubmissionAttempts.once} when `submit` was skipped as a duplicate. */
+export const DUPLICATE_ATTEMPT = Symbol("duplicate form submission attempt");
+/**
+ * The key one attempt is remembered under: a SHA-256 of workspace, slug, source IP, attempt token
+ * (null when the request carried none) and the body. Body keys are sorted so their order cannot
+ * change the key. Held only in memory, only for the window.
+ * @complexity O(b log b) for b body keys.
+ */
+export function submissionAttemptKey({ input, attemptToken, hash }, _optional = {}) {
+    // Object keys are unique, so the comparator never sees a tie.
+    const body = Object.entries(input.body).sort(([a], [b]) => (a < b ? -1 : 1));
+    return hash(JSON.stringify([input.workspaceId, input.slug, input.sourceIp, attemptToken ?? null, body]));
+}
+/**
+ * Builds one in-memory attempt store. Entries sit in claim/acceptance order (an accepted entry is
+ * re-inserted at the end), so expired ones are always at the front.
+ * @returns The store; see {@link SubmissionAttempts.once}.
+ */
+export function createSubmissionAttempts({ hash }, { windowMs = DUPLICATE_SUBMISSION_WINDOW_MS, maxEntries = MAX_REMEMBERED_ATTEMPTS } = {}) {
+    const attempts = new Map();
+    const prune = (nowMs) => {
+        for (const [key, attempt] of attempts) {
+            if (attempt.kind === "pending" || nowMs - attempt.atMs < windowMs)
+                break;
+            attempts.delete(key);
+        }
+        while (attempts.size >= maxEntries)
+            attempts.delete(attempts.keys().next().value);
+    };
+    return {
+        key: (required, optional = {}) => submissionAttemptKey({ ...required, hash }, optional),
+        async once({ key, nowMs, submit }, _optional = {}) {
+            for (;;) {
+                const seen = attempts.get(key);
+                if (seen?.kind === "accepted" && nowMs() - seen.atMs < windowMs)
+                    return DUPLICATE_ATTEMPT;
+                if (seen?.kind !== "pending")
+                    break;
+                if (await seen.accepted)
+                    return DUPLICATE_ATTEMPT;
+            }
+            // No await between the check above and this claim: one process cannot interleave them.
+            prune(nowMs());
+            let settle;
+            const mine = { kind: "pending", accepted: new Promise((resolve) => { settle = resolve; }) };
+            attempts.set(key, mine);
+            try {
+                const result = await submit();
+                if (attempts.get(key) === mine)
+                    attempts.delete(key);
+                attempts.set(key, { kind: "accepted", atMs: nowMs() });
+                settle(true);
+                return result;
+            }
+            catch (error) {
+                if (attempts.get(key) === mine)
+                    attempts.delete(key);
+                settle(false);
+                throw error;
+            }
+        },
+    };
+}
+//# sourceMappingURL=submission-attempts.js.map

package/dist/forms/submission-email-validation.d.ts

@@ -0,0 +1,8 @@
+import type { FormDefinitionRecord } from "./types.js";
+/** Compatibility guard until Jini validates email fields itself. Lookup remains the first step;
+ * disabled forms and honeypots retain the package's response before any validation or writes. */
+export declare function assertSubmissionEmails({ definition, body }: {
+    definition: FormDefinitionRecord;
+    body: Record<string, unknown>;
+}, _optional?: {}): void;
+//# sourceMappingURL=submission-email-validation.d.ts.map

package/dist/forms/submission-email-validation.js

@@ -0,0 +1,34 @@
+import { FormSubmissionValidationError } from "./errors.js";
+import { isHoneypotTripped, validateSubmissionPayload } from "./forms.js";
+// Match native type=email syntax (WHATWG HTML email state), including single-label domains.
+// Do not trim or rewrite answers: Jini's payload contract preserves submitted strings.
+const EMAIL_PATTERN = /^[a-zA-Z0-9.!#$%&'*+\/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
+/** Compatibility guard until Jini validates email fields itself. Lookup remains the first step;
+ * disabled forms and honeypots retain the package's response before any validation or writes. */
+export function assertSubmissionEmails({ definition, body }, _optional = {}) {
+    if (definition.status !== "active" || isHoneypotTripped({ hp: body._hp }))
+        return;
+    const validation = validateSubmissionPayload({ definition, body });
+    const existing = validation.valid ? [] : validation.fieldErrors;
+    const invalid = new Set(definition.fields.filter((field) => {
+        const value = body[field.id];
+        if (field.type !== "email" || typeof value !== "string" || value === "")
+            return false;
+        if (existing.some((error) => error.field === field.id))
+            return false;
+        // JS's $ can match before a final newline; comparing the full match refuses that bypass.
+        return EMAIL_PATTERN.exec(value)?.[0] !== value;
+    }).map((field) => field.id));
+    if (invalid.size === 0)
+        return;
+    const declared = new Set(definition.fields.map((field) => field.id));
+    const fieldErrors = existing.filter((error) => !declared.has(error.field));
+    for (const field of definition.fields) {
+        fieldErrors.push(...existing.filter((error) => error.field === field.id));
+        if (invalid.has(field.id))
+            fieldErrors.push({ field: field.id, reason: "invalid_email" });
+    }
+    // The existing localized renderer maps invalid_email to "Please check {label}." in every locale.
+    throw new FormSubmissionValidationError({ message: "submission failed field validation", fieldErrors });
+}
+//# sourceMappingURL=submission-email-validation.js.map

package/dist/forms/submission-ip-retention.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Submission metadata retention, independent of databases and host scheduling.
+ * Answers and submission identity are never deleted by this maintenance operation.
+ */
+/**
+ * Owner decision 2026-10-04: retain form submitter IPs for 90 days for abuse investigation,
+ * then remove them automatically. Matches the privacy wording: "IP addresses on form
+ * submissions are deleted after 90 days"; this is not expiry of the submission itself.
+ */
+export declare const SUBMISSION_IP_RETENTION_DAYS = 90;
+export interface SubmissionIpRetentionPort {
+    /**
+     * Clear only sourceIp to NULL for at most limit rows submitted at/before the ISO UTC cutoff.
+     * Include all workspaces and Trash rows. Perform one atomic guarded update; return actual
+     * affected rows, excluding already-NULL values. Concurrent passes must be idempotent.
+     */
+    clearExpiredIps(required: {
+        submittedBeforeOrAt: string;
+    }, optional?: {
+        limit?: number;
+    }): Promise<number>;
+}
+/** A complete pass, using bounded updates and one fixed cutoff even across multiple batches. */
+export declare function sweepExpiredSubmissionIps({ now, repo }: {
+    now: number;
+    repo: SubmissionIpRetentionPort;
+}, { batchSize }?: {
+    batchSize?: number;
+}): Promise<number>;
+//# sourceMappingURL=submission-ip-retention.d.ts.map

package/dist/forms/submission-ip-retention.js

@@ -0,0 +1,27 @@
+/**
+ * Submission metadata retention, independent of databases and host scheduling.
+ * Answers and submission identity are never deleted by this maintenance operation.
+ */
+/**
+ * Owner decision 2026-10-04: retain form submitter IPs for 90 days for abuse investigation,
+ * then remove them automatically. Matches the privacy wording: "IP addresses on form
+ * submissions are deleted after 90 days"; this is not expiry of the submission itself.
+ */
+export const SUBMISSION_IP_RETENTION_DAYS = 90;
+/** A complete pass, using bounded updates and one fixed cutoff even across multiple batches. */
+export async function sweepExpiredSubmissionIps({ now, repo }, { batchSize = 500 } = {}) {
+    const cutoff = now - SUBMISSION_IP_RETENTION_DAYS * 24 * 60 * 60 * 1000;
+    if (!Number.isFinite(now) || !Number.isFinite(new Date(cutoff).getTime()))
+        throw new RangeError("submission IP sweep needs a valid timestamp");
+    if (!Number.isSafeInteger(batchSize) || batchSize <= 0)
+        throw new RangeError("submission IP sweep batchSize must be a positive integer");
+    const submittedBeforeOrAt = new Date(cutoff).toISOString();
+    let total = 0;
+    let cleared;
+    do {
+        cleared = await repo.clearExpiredIps({ submittedBeforeOrAt }, { limit: batchSize });
+        total += cleared;
+    } while (cleared === batchSize);
+    return total;
+}
+//# sourceMappingURL=submission-ip-retention.js.map