@mccaskie-labs/workbench-config 0.1.25 → 0.1.27

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.27
+
+### Patch Changes
+
+- The forms manifest (`capabilities/forms.json`): five rules for `workbench-forms` (the endpoint decides, one verdict on the page and at the endpoint, codes turned into words by the strings catalogue, bounds from the limits register, no members on a form) and two no-cost probes, `forms.validate` and `forms.browser`. `forms` joins the component list.
+
+## 0.1.26
+
+### Patch Changes
+
+- The database manifest gains the sign-in bot check: Control's `cf_turnstile_widget_create` and `cf_turnstile_widget_delete`, the `TURNSTILE_SITE_KEY` and `TURNSTILE_SECRET_KEY` config (written by `cf_worker_secret_put` sources `turnstile_sitekey` and `turnstile_secret`), the rule `database.sign-in-checks-for-bots` and its drill probe `database.sign-in-bot-check`.
+
 ## 0.1.25
 
 ### Patch Changes

package/capabilities/database.json

@@ -24,7 +24,9 @@
       "sb_query",
       "sb_project_delete",
       "cf_worker_secret_put",
-      "vendor_settings_apply"
+      "vendor_settings_apply",
+      "cf_turnstile_widget_create",
+      "cf_turnstile_widget_delete"
     ]
   },
   "config": [
@@ -70,6 +72,28 @@
         "production"
       ],
       "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+    },
+    {
+      "name": "TURNSTILE_SITE_KEY",
+      "required": false,
+      "secret": false,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+    },
+    {
+      "name": "TURNSTILE_SECRET_KEY",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
     }
   ],
   "actions": [
@@ -104,7 +128,7 @@
     {
       "tool": "cf_worker_secret_put",
       "gate": "two_step_when",
-      "when": "source supabase_secret, or replacing a secret that exists",
+      "when": "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)",
       "ships": "4"
     },
     {
@@ -112,6 +136,16 @@
       "gate": "two_step_when",
       "when": "production, after the first successful apply on that database; staging and check_only are free",
       "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_create",
+      "gate": "free",
+      "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_delete",
+      "gate": "two_step",
+      "ships": "5"
     }
   ],
   "rules": [
@@ -170,6 +204,13 @@
       "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
       "enforced_by": "review",
       "probe": "database.session-cookie"
+    },
+    {
+      "id": "database.sign-in-checks-for-bots",
+      "kind": "must",
+      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+      "enforced_by": "review",
+      "probe": "database.sign-in-bot-check"
     }
   ],
   "examples": [
@@ -252,6 +293,13 @@
       "expect": "pass",
       "cost_hint_usd": 0,
       "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
+    },
+    {
+      "id": "database.sign-in-bot-check",
+      "half": "drill",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does"
     }
   ]
 }

package/capabilities/forms.json

@@ -0,0 +1,93 @@
+{
+  "$schema": "./schema.json",
+  "format": 1,
+  "component": "forms",
+  "title": "Form validation",
+  "summary": "workbench-forms checks what people type into a form with one validator that runs the same on the page and at the endpoint. It returns every problem at once as permanent codes, the tidied value to show back in each field and the value to store, with limits from the app's own register and country shapes from workbench-country. It runs in the app itself, with no Gateway call and no cost.",
+  "status": "built",
+  "surfaces": {
+    "package": [
+      "defineForm",
+      "text",
+      "longText",
+      "email",
+      "phone",
+      "money",
+      "whole",
+      "date",
+      "choice",
+      "validate",
+      "readForm",
+      "embedConfig",
+      "inputAttributes",
+      "messageKeys",
+      "tidyLine",
+      "tidyText",
+      "CODES",
+      "FormsSetupError"
+    ]
+  },
+  "rules": [
+    {
+      "id": "forms.endpoint-decides",
+      "kind": "must",
+      "text": "Validate every form at the endpoint with validate() and store only result.values; the page's copy of the validator (FORMS_SCRIPT) only helps the person, it never decides.",
+      "enforced_by": "review",
+      "probe": "forms.validate"
+    },
+    {
+      "id": "forms.same-verdict",
+      "kind": "must",
+      "text": "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.",
+      "enforced_by": "review",
+      "probe": "forms.browser"
+    },
+    {
+      "id": "forms.codes-not-sentences",
+      "kind": "must",
+      "text": "Turn problem codes into words through the strings catalogue (messageKeys: validation.<form>.<field>.<code>, then validation.<code>), never words written in code.",
+      "enforced_by": "review",
+      "probe": "forms.validate"
+    },
+    {
+      "id": "forms.limits-register",
+      "kind": "must",
+      "text": "Take every length, amount and date bound from the app's limits register (defineLimits, boundsFor), and keep it matched to the database with workbench-supabase check:limits.",
+      "enforced_by": "types",
+      "probe": "forms.validate"
+    },
+    {
+      "id": "forms.no-members-on-a-form",
+      "kind": "must_not",
+      "text": "List a choice field's members on the form: the vocabulary owns them, and the app passes them in context.choices.",
+      "enforced_by": "types",
+      "probe": "forms.validate"
+    }
+  ],
+  "examples": [
+    {
+      "id": "forms.example.endpoint",
+      "title": "Check a posted form at the endpoint",
+      "lang": "ts",
+      "probe": "forms.validate",
+      "code": "import { defineForm, email, money, readForm, text, validate } from '@mccaskie-labs/workbench-forms'\nimport { boundsFor } from '@mccaskie-labs/workbench-forms/limits'\nimport { COUNTRY_PACKS } from '@mccaskie-labs/workbench-country'\n\nconst lead = defineForm('lead', { name: text({ limit: 'lead.name', required: true }), email: email({ required: true }), budget: money({ limit: 'lead.budget' }) })\nconst result = validate(lead, readForm(lead, await request.formData()), { bounds: boundsFor(LIMITS, lead), country: COUNTRY_PACKS.PH! })\nif (!result.ok) return show(result.problems, result.shown)\nawait db.from('leads').insert(result.values)"
+    }
+  ],
+  "probes": [
+    {
+      "id": "forms.validate",
+      "half": "runtime",
+      "expect": "pass",
+      "smoke": true,
+      "cost_hint_usd": 0,
+      "note": "In the Worker itself: validates a fixed form (text, email, phone, money, date, choice) for PH with one good and one bad input, and compares the stored values (E.164 phone, decimal-string amount, ISO date) and the problem codes with the expected ones"
+    },
+    {
+      "id": "forms.browser",
+      "half": "runtime",
+      "expect": "pass",
+      "cost_hint_usd": 0,
+      "note": "The probe page loads FORMS_SCRIPT and the form's embedConfig block, runs the same inputs in the browser and checks the verdict matches the Worker's; no Gateway call"
+    }
+  ]
+}

package/capabilities/schema.json

@@ -33,7 +33,8 @@
         "kv",
         "github",
         "strings",
-        "ui"
+        "ui",
+        "forms"
       ]
     },
     "title": {

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "ecc54c728515";
+export declare const MANIFEST_VERSION: "c83a7c612319";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -421,7 +421,7 @@ export declare const capabilities: {
         readonly summary: "Each project has its own Supabase projects, <id>-staging and <id>-production. Apps use them natively through workbench-supabase; Control creates them, writes their URL and keys onto the Workers, and applies migrations read from the repo.";
         readonly status: "built";
         readonly surfaces: {
-            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
+            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
             readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
         };
         readonly config: readonly [{
@@ -448,6 +448,18 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["development", "staging", "production"];
             readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
+        }, {
+            readonly name: "TURNSTILE_SITE_KEY";
+            readonly required: false;
+            readonly secret: false;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
+        }, {
+            readonly name: "TURNSTILE_SECRET_KEY";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -475,13 +487,21 @@ export declare const capabilities: {
         }, {
             readonly tool: "cf_worker_secret_put";
             readonly gate: "two_step_when";
-            readonly when: "source supabase_secret, or replacing a secret that exists";
+            readonly when: "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)";
             readonly ships: "4";
         }, {
             readonly tool: "vendor_settings_apply";
             readonly gate: "two_step_when";
             readonly when: "production, after the first successful apply on that database; staging and check_only are free";
             readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_create";
+            readonly gate: "free";
+            readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_delete";
+            readonly gate: "two_step";
+            readonly ships: "5";
         }];
         readonly rules: readonly [{
             readonly id: "database.rls-isolates-users";
@@ -531,6 +551,12 @@ export declare const capabilities: {
             readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
             readonly enforced_by: "review";
             readonly probe: "database.session-cookie";
+        }, {
+            readonly id: "database.sign-in-checks-for-bots";
+            readonly kind: "must";
+            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in-bot-check";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -600,6 +626,12 @@ export declare const capabilities: {
             readonly expect: "pass";
             readonly cost_hint_usd: 0;
             readonly note: "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute";
+        }, {
+            readonly id: "database.sign-in-bot-check";
+            readonly half: "drill";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does";
         }];
     };
     readonly email: {
@@ -1052,6 +1084,69 @@ export declare const capabilities: {
             readonly note: "Another project's namespace";
         }];
     };
+    readonly forms: {
+        readonly $schema: "./schema.json";
+        readonly format: 1;
+        readonly component: "forms";
+        readonly title: "Form validation";
+        readonly summary: "workbench-forms checks what people type into a form with one validator that runs the same on the page and at the endpoint. It returns every problem at once as permanent codes, the tidied value to show back in each field and the value to store, with limits from the app's own register and country shapes from workbench-country. It runs in the app itself, with no Gateway call and no cost.";
+        readonly status: "built";
+        readonly surfaces: {
+            readonly package: readonly ["defineForm", "text", "longText", "email", "phone", "money", "whole", "date", "choice", "validate", "readForm", "embedConfig", "inputAttributes", "messageKeys", "tidyLine", "tidyText", "CODES", "FormsSetupError"];
+        };
+        readonly rules: readonly [{
+            readonly id: "forms.endpoint-decides";
+            readonly kind: "must";
+            readonly text: "Validate every form at the endpoint with validate() and store only result.values; the page's copy of the validator (FORMS_SCRIPT) only helps the person, it never decides.";
+            readonly enforced_by: "review";
+            readonly probe: "forms.validate";
+        }, {
+            readonly id: "forms.same-verdict";
+            readonly kind: "must";
+            readonly text: "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.";
+            readonly enforced_by: "review";
+            readonly probe: "forms.browser";
+        }, {
+            readonly id: "forms.codes-not-sentences";
+            readonly kind: "must";
+            readonly text: "Turn problem codes into words through the strings catalogue (messageKeys: validation.<form>.<field>.<code>, then validation.<code>), never words written in code.";
+            readonly enforced_by: "review";
+            readonly probe: "forms.validate";
+        }, {
+            readonly id: "forms.limits-register";
+            readonly kind: "must";
+            readonly text: "Take every length, amount and date bound from the app's limits register (defineLimits, boundsFor), and keep it matched to the database with workbench-supabase check:limits.";
+            readonly enforced_by: "types";
+            readonly probe: "forms.validate";
+        }, {
+            readonly id: "forms.no-members-on-a-form";
+            readonly kind: "must_not";
+            readonly text: "List a choice field's members on the form: the vocabulary owns them, and the app passes them in context.choices.";
+            readonly enforced_by: "types";
+            readonly probe: "forms.validate";
+        }];
+        readonly examples: readonly [{
+            readonly id: "forms.example.endpoint";
+            readonly title: "Check a posted form at the endpoint";
+            readonly lang: "ts";
+            readonly code: "import { defineForm, email, money, readForm, text, validate } from '@mccaskie-labs/workbench-forms'\nimport { boundsFor } from '@mccaskie-labs/workbench-forms/limits'\nimport { COUNTRY_PACKS } from '@mccaskie-labs/workbench-country'\n\nconst lead = defineForm('lead', { name: text({ limit: 'lead.name', required: true }), email: email({ required: true }), budget: money({ limit: 'lead.budget' }) })\nconst result = validate(lead, readForm(lead, await request.formData()), { bounds: boundsFor(LIMITS, lead), country: COUNTRY_PACKS.PH! })\nif (!result.ok) return show(result.problems, result.shown)\nawait db.from('leads').insert(result.values)";
+            readonly probe: "forms.validate";
+        }];
+        readonly probes: readonly [{
+            readonly id: "forms.validate";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly smoke: true;
+            readonly cost_hint_usd: 0;
+            readonly note: "In the Worker itself: validates a fixed form (text, email, phone, money, date, choice) for PH with one good and one bad input, and compares the stored values (E.164 phone, decimal-string amount, ISO date) and the problem codes with the expected ones";
+        }, {
+            readonly id: "forms.browser";
+            readonly half: "runtime";
+            readonly expect: "pass";
+            readonly cost_hint_usd: 0;
+            readonly note: "The probe page loads FORMS_SCRIPT and the form's embedConfig block, runs the same inputs in the browser and checks the verdict matches the Worker's; no Gateway call";
+        }];
+    };
     readonly gateway: {
         readonly $schema: "./schema.json";
         readonly format: 1;

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "ecc54c728515";
+export const MANIFEST_VERSION = "c83a7c612319";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -621,7 +621,9 @@ export const capabilities = {
                 "sb_query",
                 "sb_project_delete",
                 "cf_worker_secret_put",
-                "vendor_settings_apply"
+                "vendor_settings_apply",
+                "cf_turnstile_widget_create",
+                "cf_turnstile_widget_delete"
             ],
             "package": [
                 "supabaseConfig",
@@ -678,6 +680,28 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+            },
+            {
+                "name": "TURNSTILE_SITE_KEY",
+                "required": false,
+                "secret": false,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+            },
+            {
+                "name": "TURNSTILE_SECRET_KEY",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
             }
         ],
         "actions": [
@@ -712,7 +736,7 @@ export const capabilities = {
             {
                 "tool": "cf_worker_secret_put",
                 "gate": "two_step_when",
-                "when": "source supabase_secret, or replacing a secret that exists",
+                "when": "source supabase_secret, or replacing a secret that exists (not sources web_analytics, turnstile_sitekey or turnstile_secret, whose value comes from the recorded resource)",
                 "ships": "4"
             },
             {
@@ -720,6 +744,16 @@ export const capabilities = {
                 "gate": "two_step_when",
                 "when": "production, after the first successful apply on that database; staging and check_only are free",
                 "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_create",
+                "gate": "free",
+                "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_delete",
+                "gate": "two_step",
+                "ships": "5"
             }
         ],
         "rules": [
@@ -778,6 +812,13 @@ export const capabilities = {
                 "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
                 "enforced_by": "review",
                 "probe": "database.session-cookie"
+            },
+            {
+                "id": "database.sign-in-checks-for-bots",
+                "kind": "must",
+                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+                "enforced_by": "review",
+                "probe": "database.sign-in-bot-check"
             }
         ],
         "examples": [
@@ -860,6 +901,13 @@ export const capabilities = {
                 "expect": "pass",
                 "cost_hint_usd": 0,
                 "note": "The session cookie is __Host-, Secure, HttpOnly, SameSite=Lax and sealed; a cross-site write is refused; sign-out clears it with every attribute"
+            },
+            {
+                "id": "database.sign-in-bot-check",
+                "half": "drill",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "On a project's staging: cf_turnstile_widget_create and the turnstile_sitekey and turnstile_secret sources; the sign-in page shows the check, /auth/code without a passed token sends no code, and with one it does"
             }
         ]
     },
@@ -1427,6 +1475,99 @@ export const capabilities = {
             }
         ]
     },
+    "forms": {
+        "$schema": "./schema.json",
+        "format": 1,
+        "component": "forms",
+        "title": "Form validation",
+        "summary": "workbench-forms checks what people type into a form with one validator that runs the same on the page and at the endpoint. It returns every problem at once as permanent codes, the tidied value to show back in each field and the value to store, with limits from the app's own register and country shapes from workbench-country. It runs in the app itself, with no Gateway call and no cost.",
+        "status": "built",
+        "surfaces": {
+            "package": [
+                "defineForm",
+                "text",
+                "longText",
+                "email",
+                "phone",
+                "money",
+                "whole",
+                "date",
+                "choice",
+                "validate",
+                "readForm",
+                "embedConfig",
+                "inputAttributes",
+                "messageKeys",
+                "tidyLine",
+                "tidyText",
+                "CODES",
+                "FormsSetupError"
+            ]
+        },
+        "rules": [
+            {
+                "id": "forms.endpoint-decides",
+                "kind": "must",
+                "text": "Validate every form at the endpoint with validate() and store only result.values; the page's copy of the validator (FORMS_SCRIPT) only helps the person, it never decides.",
+                "enforced_by": "review",
+                "probe": "forms.validate"
+            },
+            {
+                "id": "forms.same-verdict",
+                "kind": "must",
+                "text": "Put the form on the page with embedConfig and FORMS_SCRIPT, never a second set of rules, so the page and the endpoint reach the same verdict.",
+                "enforced_by": "review",
+                "probe": "forms.browser"
+            },
+            {
+                "id": "forms.codes-not-sentences",
+                "kind": "must",
+                "text": "Turn problem codes into words through the strings catalogue (messageKeys: validation.<form>.<field>.<code>, then validation.<code>), never words written in code.",
+                "enforced_by": "review",
+                "probe": "forms.validate"
+            },
+            {
+                "id": "forms.limits-register",
+                "kind": "must",
+                "text": "Take every length, amount and date bound from the app's limits register (defineLimits, boundsFor), and keep it matched to the database with workbench-supabase check:limits.",
+                "enforced_by": "types",
+                "probe": "forms.validate"
+            },
+            {
+                "id": "forms.no-members-on-a-form",
+                "kind": "must_not",
+                "text": "List a choice field's members on the form: the vocabulary owns them, and the app passes them in context.choices.",
+                "enforced_by": "types",
+                "probe": "forms.validate"
+            }
+        ],
+        "examples": [
+            {
+                "id": "forms.example.endpoint",
+                "title": "Check a posted form at the endpoint",
+                "lang": "ts",
+                "code": "import { defineForm, email, money, readForm, text, validate } from '@mccaskie-labs/workbench-forms'\nimport { boundsFor } from '@mccaskie-labs/workbench-forms/limits'\nimport { COUNTRY_PACKS } from '@mccaskie-labs/workbench-country'\n\nconst lead = defineForm('lead', { name: text({ limit: 'lead.name', required: true }), email: email({ required: true }), budget: money({ limit: 'lead.budget' }) })\nconst result = validate(lead, readForm(lead, await request.formData()), { bounds: boundsFor(LIMITS, lead), country: COUNTRY_PACKS.PH! })\nif (!result.ok) return show(result.problems, result.shown)\nawait db.from('leads').insert(result.values)",
+                "probe": "forms.validate"
+            }
+        ],
+        "probes": [
+            {
+                "id": "forms.validate",
+                "half": "runtime",
+                "expect": "pass",
+                "smoke": true,
+                "cost_hint_usd": 0,
+                "note": "In the Worker itself: validates a fixed form (text, email, phone, money, date, choice) for PH with one good and one bad input, and compares the stored values (E.164 phone, decimal-string amount, ISO date) and the problem codes with the expected ones"
+            },
+            {
+                "id": "forms.browser",
+                "half": "runtime",
+                "expect": "pass",
+                "cost_hint_usd": 0,
+                "note": "The probe page loads FORMS_SCRIPT and the form's embedConfig block, runs the same inputs in the browser and checks the verdict matches the Worker's; no Gateway call"
+            }
+        ]
+    },
     "gateway": {
         "$schema": "./schema.json",
         "format": 1,

package/dist/capability-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui"];
+export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui", "forms"];
 export type Component = (typeof COMPONENTS)[number];
 export declare const allowedSchemas: {
     gateway: z.ZodObject<{
@@ -103,6 +103,7 @@ export declare const capabilitySchema: z.ZodObject<{
         email: "email";
         "email-inbound": "email-inbound";
         "email-sending": "email-sending";
+        forms: "forms";
         gateway: "gateway";
         github: "github";
         "image-search": "image-search";

package/dist/capability-schema.js

@@ -24,6 +24,7 @@ export const COMPONENTS = [
     "github",
     "strings",
     "ui",
+    "forms",
 ];
 const id = z.string().regex(/^[a-z0-9][a-z0-9.-]*$/, "lower case, digits, dots and hyphens");
 const code = z.string().regex(/^[a-z][a-z0-9_]*$/, "a snake_case error code");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",