@unboundcx/sdk 4.13.90 → 4.13.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unboundcx/sdk",
-  "version": "4.13.90",
+  "version": "4.13.92",
   "description": "Official JavaScript SDK for the Unbound API - A comprehensive toolkit for integrating with Unbound's communication, AI, and data management services",
   "main": "index.js",
   "type": "module",

package/services/forms/PublicService.js

@@ -11,8 +11,8 @@ import { internalRequest } from '../../base.js';
 // forms-v2-precheck.md §4.1): plain form fields go at the top level of the
 // body (fieldKey -> value, arrays allowed), and everything the server
 // treats as a *control* field (not a form value) is sent with a leading
-// underscore -- the same convention formSubmit.js/formSubmitPublicKey.js
-// already split on for the legacy `_token` field. `context` is NOT a
+// underscore, e.g. `_idempotencyKey`/`_captchaToken` below --
+// formSubmitPublicKey.js splits on that same convention. `context` is NOT a
 // control field: app1-api's captureContext.js builds the submission's
 // context column by scanning the body's TOP-LEVEL keys against an
 // allowlist (utm_*, gclid, fbclid, referrer, landingUrl, pageUrl,
@@ -26,9 +26,8 @@ export class FormsPublicService {
 
   /**
    * Submit a public form by its publicKey (D1 -- every form has its own
-   * publicKey; no tracking-code/_token needed for this path). Legacy
-   * hosted-fields forms keep using the `/webhooks/form/:formId` +
-   * `_token` path (unchanged, not exposed here).
+   * publicKey; no tracking-code/_token needed -- publicKey + origin/
+   * domainAllowlist is the only auth for a public form submit).
    * @param {string} publicKey
    * @param {Object} fields - fieldKey -> value (arrays kept as arrays).
    * @param {Object} [options]

package/services/forms.js

@@ -1,3 +1,4 @@
+import { internalRequest } from '../base.js';
 import { FormsPublicService } from './forms/PublicService.js';
 import { FormsSubmissionsService } from './forms/SubmissionsService.js';
 import { FormsSettingsService } from './forms/SettingsService.js';
@@ -14,4 +15,50 @@ export class FormsService {
     this.settings = new FormsSettingsService(sdk);
     this.health = new FormsHealthService(sdk);
   }
+
+  /**
+   * Gap closure (task item 2, D1/D20). Mints a brand new `forms.publicKey`
+   * and overwrites the old one -- every embed snippet/HTML still carrying
+   * the old key stops resolving immediately (see the server route's doc
+   * comment). A destructive action; callers should confirm with the user
+   * before invoking (FormIdentitySettingsCard.svelte's "Regenerate" flow).
+   * Server route: `POST /forms/:id/regenerate-key`
+   * (app1-api/src/services/forms/controllers/regenerateFormPublicKey.js).
+   * @param {string} formId
+   * @returns {Promise<{publicKey:string}>}
+   */
+  async regeneratePublicKey(formId) {
+    this.sdk.validateParams(
+      { formId },
+      { formId: { type: 'string', required: true } },
+    );
+    return internalRequest(
+      this.sdk,
+      `/forms/${encodeURIComponent(formId)}/regenerate-key`,
+      'POST',
+    );
+  }
+
+  /**
+   * Gap closure (task item 3, D19). Mints a signed, 15-min-TTL token
+   * scoped to this exact formId so a `draft`/non-`active` form's real
+   * embed script can be requested via
+   * `GET /f/:publicKey.js?preview=<token>` without making the form
+   * publicly live. Server route: `POST /forms/:id/preview-token`
+   * (app1-api/src/services/forms/controllers/mintFormPreviewToken.js);
+   * verify side has been live since P2 (formEmbedPublicKey.js).
+   * @param {string} formId
+   * @returns {Promise<{token:string, expiresIn:number}>}
+   */
+  async previewToken(formId) {
+    this.sdk.validateParams(
+      { formId },
+      { formId: { type: 'string', required: true } },
+    );
+    return internalRequest(
+      this.sdk,
+      `/forms/${encodeURIComponent(formId)}/preview-token`,
+      'POST',
+    );
+  }
 }