@unboundcx/sdk 4.13.87 → 4.13.89

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unboundcx/sdk",
-  "version": "4.13.87",
+  "version": "4.13.89",
   "description": "Official JavaScript SDK for the Unbound API - A comprehensive toolkit for integrating with Unbound's communication, AI, and data management services",
   "main": "index.js",
   "type": "module",

package/services/forms/PublicService.js

@@ -12,7 +12,13 @@ import { internalRequest } from '../../base.js';
 // body (fieldKey -> value, arrays allowed), and everything the server
 // treats as a *control* field (not a form value) is sent with a leading
 // underscore -- the same convention formSubmit.js/formSubmitPublicKey.js
-// already split on for the legacy `_token` field.
+// already split on for the legacy `_token` field. `context` is NOT a
+// control field: app1-api's captureContext.js builds the submission's
+// context column by scanning the body's TOP-LEVEL keys against an
+// allowlist (utm_*, gclid, fbclid, referrer, landingUrl, pageUrl,
+// userAgent) and explicitly skips any `_`-prefixed key as a control
+// field -- so `context` values are spread onto the top level alongside
+// `fields`, never nested, or the server drops them silently.
 export class FormsPublicService {
   constructor(sdk) {
     this.sdk = sdk;
@@ -28,7 +34,9 @@ export class FormsPublicService {
    * @param {Object} [options]
    * @param {Object} [options.context] - Client-observed context (utm/referrer/
    *   landingUrl/etc, D12) to merge with what the server infers from the
-   *   request itself -- sent as the `_context` control field.
+   *   request itself -- spread onto the top-level body (never nested);
+   *   the server's captureContext.js allowlist only reads top-level keys.
+   *   A key here that collides with a `fields` key loses to `fields`.
    * @param {string} [options.captchaToken] - Turnstile/etc response token
    *   (D10); sent as `_captchaToken`. Ignored server-side until a captcha
    *   provider is configured for the form/account.
@@ -41,10 +49,9 @@ export class FormsPublicService {
       { publicKey },
       { publicKey: { type: 'string', required: true } },
     );
-    const body = { ...(fields || {}) };
+    const body = { ...(context || {}), ...(fields || {}) };
     if (idempotencyKey) body._idempotencyKey = idempotencyKey;
     if (captchaToken) body._captchaToken = captchaToken;
-    if (context) body._context = context;
 
     return internalRequest(
       this.sdk,

package/services/forms/SettingsService.js

@@ -43,4 +43,31 @@ export class FormsSettingsService {
       body: { ...(patch || {}) },
     });
   }
+
+  /**
+   * Review fix -- per-form Turnstile override (Settings tab's "Secret key
+   * (override)" field). Mirrors `set()`: the raw secret goes under
+   * `turnstileSecret`, never the stored `turnstileSecretRef` column name.
+   * Server route: `PUT /forms/:id/settings`
+   * (app1-api/src/services/forms/controllers/putFormSettings.js).
+   * @param {string} formId
+   * @param {Object} patch
+   * @param {string|null} [patch.captchaProvider]
+   * @param {string|null} [patch.turnstileSiteKey]
+   * @param {string} [patch.turnstileSecret] - Plaintext; omit (or send '')
+   *   to leave the currently stored secret untouched.
+   * @returns {Promise<Object>}
+   */
+  async setForm(formId, patch) {
+    this.sdk.validateParams(
+      { formId },
+      { formId: { type: 'string', required: true } },
+    );
+    return internalRequest(
+      this.sdk,
+      `/forms/${encodeURIComponent(formId)}/settings`,
+      'PUT',
+      { body: { ...(patch || {}) } },
+    );
+  }
 }