@stacksjs/forms 0.72.98 → 0.72.99

package/dist/definition.d.ts

@@ -1,4 +1,4 @@
-import type { FormDefinition } from './types';
+import type { FormDefinition, PublicFormDefinition } from './types';
 /**
  * Load a form + its fields by uuid. `siteId` is REQUIRED and matched against
  * the row (null site allowed for single-site apps passing null): a form uuid
@@ -11,4 +11,4 @@ export declare function loadFormByUuid(uuid: string, siteId: number | null): Pro
  * attacker wants (notify addresses, payment internals beyond what the UI
  * must show).
  */
-export declare function publicDefinition(form: FormDefinition): Record<string, unknown>;
+export declare function publicDefinition(form: FormDefinition): PublicFormDefinition;

package/dist/index.d.ts

@@ -8,6 +8,8 @@ export type {
   FormFieldDefinition,
   FormFieldType,
   FormSettings,
+  PublicFormDefinition,
+  PublicFormField,
   SubmissionErrors,
   ValidateSubmissionResult,
 } from './types';

package/dist/types.d.ts

@@ -55,10 +55,42 @@ export declare interface FormDefinition {
   settings: FormSettings
   fields: FormFieldDefinition[]
 }
+/**
+ * What `GET /api/forms/:uuid` returns: everything a renderer needs, nothing an
+ * attacker wants.
+ *
+ * `publicDefinition` used to be typed `Record<string, unknown>`, so the one
+ * contract between the server projection and the CMS form block was described
+ * nowhere. The block rendered a `state(null)` it then indexed freely, and the
+ * server could have dropped a key without anything noticing.
+ */
+export declare interface PublicFormDefinition {
+  uuid: string
+  name: string
+  status: FormDefinition['status']
+  submitLabel: string
+  confirmation: string | null
+  payment: {
+    mode: NonNullable<FormSettings['payment']>['mode']
+    amountCents?: number
+    currency: string
+    minAmountCents?: number
+  } | null
+  fields: PublicFormField[]
+}
 export declare interface SubmissionErrors {
   [fieldName: string]: string
 }
 export type FormFieldType = | 'text' | 'textarea' | 'email' | 'phone' | 'select' | 'checkbox'
     | 'radio' | 'date' | 'file' | 'currency' | 'section_break';
+/**
+ * A field as the public renderer receives it.
+ *
+ * The same field minus what only the server needs. Derived from
+ * `FormFieldDefinition` rather than restated, so adding a field property
+ * cannot leave the two out of step.
+ */
+export type PublicFormField = Pick<FormFieldDefinition, 'name' | 'label' | 'type' | 'required' | 'width' | 'conditions'>
+    & { options: Pick<FieldOptions, 'placeholder' | 'choices' | 'min' | 'max' | 'accept'> }
 export type ValidateSubmissionResult = | { ok: true, values: Record<string, unknown>, email: string | null, name: string | null, amountCents: number | null }
     | { ok: false, errors: SubmissionErrors }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/forms",
   "type": "module",
-  "version": "0.72.98",
+  "version": "0.72.99",
   "description": "The Stacks form-builder functionality.",
   "author": "Chris Breuer",
   "contributors": [
@@ -56,11 +56,11 @@
     "prepublishOnly": "bun run build"
   },
   "devDependencies": {
-    "@stacksjs/config": "0.72.98",
-    "@stacksjs/database": "0.72.98",
-    "@stacksjs/notifications": "0.72.98",
-    "@stacksjs/storage": "0.72.98",
-    "@stacksjs/validation": "0.72.98",
+    "@stacksjs/config": "0.72.99",
+    "@stacksjs/database": "0.72.99",
+    "@stacksjs/notifications": "0.72.99",
+    "@stacksjs/storage": "0.72.99",
+    "@stacksjs/validation": "0.72.99",
     "better-dx": "^0.2.24"
   },
   "sideEffects": false