payload-dynamic-forms 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,130 @@
+import { attachmentLinkFields, attachmentsCollection } from './collections/attachments.js';
+import { buildFieldBlocks } from './collections/blocks.js';
+import { formsCollection } from './collections/forms.js';
+import { applyOverrides } from './collections/overrides.js';
+import { submissionsCollection } from './collections/submissions.js';
+import { publicFormEndpoint } from './endpoints/public.js';
+import { resendEndpoint } from './endpoints/resend.js';
+import { submitEndpoint } from './endpoints/submit.js';
+import { DEFAULT_FILE_LIMITS } from './shared/answers.js';
+import { DEFAULT_WORDS } from './shared/words.js';
+export const DEFAULT_SLUGS = {
+    attachments: 'custom-form-attachments',
+    forms: 'custom-forms',
+    submissions: 'custom-form-submissions'
+};
+export function resolveOptions(options = {}) {
+    const slugs = {
+        ...DEFAULT_SLUGS,
+        ...options.slugs
+    };
+    const attachments = options.attachments === false ? null : {
+        collection: options.attachments?.collection ? String(options.attachments.collection) : slugs.attachments,
+        createCollection: !options.attachments?.collection,
+        maxFileSize: options.attachments?.maxFileSize ?? DEFAULT_FILE_LIMITS.maxFileSize,
+        maxTotalSize: options.attachments?.maxTotalSize ?? DEFAULT_FILE_LIMITS.maxTotalSize,
+        mimeTypes: [
+            ...options.attachments?.mimeTypes ?? DEFAULT_FILE_LIMITS.mimeTypes
+        ]
+    };
+    if (attachments && !attachments.createCollection) {
+        slugs.attachments = attachments.collection;
+    }
+    return {
+        attachments,
+        beforeEmail: options.beforeEmail,
+        delivery: options.delivery,
+        fieldTypes: {},
+        honeypotField: options.honeypotField || '_hp',
+        isAdmin: options.access?.isAdmin || ((req)=>Boolean(req.user)),
+        metadata: {
+            ip: options.metadata?.ip === true,
+            userAgent: options.metadata?.userAgent !== false
+        },
+        optionSources: options.optionSources,
+        rateLimit: options.rateLimit === false ? null : {
+            max: options.rateLimit?.max ?? 5,
+            windowSeconds: options.rateLimit?.windowSeconds ?? 600
+        },
+        slugs,
+        turnstile: {
+            enabled: options.turnstile ? options.turnstile.enabled !== false : false,
+            fieldName: options.turnstile?.fieldName || 'cf-turnstile-response',
+            secretKey: options.turnstile?.secretKey || ''
+        },
+        webhooks: {
+            headers: options.webhooks?.headers,
+            requireSignature: options.webhooks?.requireSignature === true,
+            secretsInAdmin: options.webhooks?.secretsInAdmin !== false,
+            signingSecret: options.webhooks?.signingSecret
+        },
+        whatsapp: options.whatsapp,
+        words: {
+            ...DEFAULT_WORDS,
+            ...options.words
+        }
+    };
+}
+/**
+ * Adds forms, submissions and private attachments, with their endpoints, to a Payload config.
+ * `formsPlugin({ enabled: false })` returns the config untouched.
+ */ export const formsPlugin = (pluginOptions = {})=>(config)=>{
+        if (pluginOptions.enabled === false) {
+            return config;
+        }
+        const options = resolveOptions(pluginOptions);
+        const collections = [
+            ...config.collections || []
+        ];
+        if (options.attachments && !options.attachments.createCollection) {
+            const index = collections.findIndex((c)=>c.slug === options.attachments.collection);
+            const target = collections[index];
+            if (!target || !target.upload) {
+                throw new Error(`formsPlugin: attachments.collection "${options.attachments.collection}" must be an upload collection in this config.`);
+            }
+            const names = new Set(target.fields.map((f)=>'name' in f ? f.name : ''));
+            collections[index] = {
+                ...target,
+                fields: [
+                    ...target.fields,
+                    ...attachmentLinkFields(options).filter((f)=>!('name' in f) || !names.has(f.name))
+                ]
+            };
+        }
+        const { blocks, fieldTypes } = buildFieldBlocks(pluginOptions.fields, {
+            attachmentsOn: Boolean(options.attachments),
+            mimeTypes: options.attachments?.mimeTypes || [
+                ...DEFAULT_FILE_LIMITS.mimeTypes
+            ],
+            sources: options.optionSources || {}
+        });
+        options.fieldTypes = fieldTypes;
+        const added = [
+            applyOverrides(formsCollection(options, blocks, [
+                submitEndpoint(options),
+                publicFormEndpoint(options)
+            ]), pluginOptions.formOverrides),
+            applyOverrides(submissionsCollection(options, [
+                resendEndpoint(options)
+            ]), pluginOptions.submissionOverrides)
+        ];
+        if (options.attachments?.createCollection) {
+            added.push(applyOverrides(attachmentsCollection(options), pluginOptions.attachmentOverrides));
+        }
+        return {
+            ...config,
+            collections: [
+                ...collections,
+                ...added
+            ],
+            custom: {
+                ...config.custom,
+                payloadForms: options
+            }
+        };
+    };
+export { signWebhookBody } from './delivery/webhook.js';
+export { formBlock } from './formBlock.js';
+export { getPublicForm, loadPublishedForm } from './server/forms.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { CollectionConfig, Config, PayloadRequest } from 'payload'\n\nimport type { FormsPluginOptions, ResolvedOptions } from './types.js'\n\nimport { attachmentLinkFields, attachmentsCollection } from './collections/attachments.js'\nimport { buildFieldBlocks } from './collections/blocks.js'\nimport { formsCollection } from './collections/forms.js'\nimport { applyOverrides } from './collections/overrides.js'\nimport { submissionsCollection } from './collections/submissions.js'\nimport { publicFormEndpoint } from './endpoints/public.js'\nimport { resendEndpoint } from './endpoints/resend.js'\nimport { submitEndpoint } from './endpoints/submit.js'\nimport { DEFAULT_FILE_LIMITS } from './shared/answers.js'\nimport { DEFAULT_WORDS } from './shared/words.js'\n\nexport const DEFAULT_SLUGS = {\n  attachments: 'custom-form-attachments',\n  forms: 'custom-forms',\n  submissions: 'custom-form-submissions',\n} as const\n\nexport function resolveOptions(options: FormsPluginOptions = {}): ResolvedOptions {\n  const slugs = { ...DEFAULT_SLUGS, ...options.slugs }\n  const attachments =\n    options.attachments === false\n      ? null\n      : {\n          collection: options.attachments?.collection ? String(options.attachments.collection) : slugs.attachments,\n          createCollection: !options.attachments?.collection,\n          maxFileSize: options.attachments?.maxFileSize ?? DEFAULT_FILE_LIMITS.maxFileSize,\n          maxTotalSize: options.attachments?.maxTotalSize ?? DEFAULT_FILE_LIMITS.maxTotalSize,\n          mimeTypes: [...(options.attachments?.mimeTypes ?? DEFAULT_FILE_LIMITS.mimeTypes)],\n        }\n  if (attachments && !attachments.createCollection) {\n    slugs.attachments = attachments.collection\n  }\n  return {\n    attachments,\n    beforeEmail: options.beforeEmail,\n    delivery: options.delivery,\n    fieldTypes: {},\n    honeypotField: options.honeypotField || '_hp',\n    isAdmin: options.access?.isAdmin || ((req: PayloadRequest) => Boolean(req.user)),\n    metadata: { ip: options.metadata?.ip === true, userAgent: options.metadata?.userAgent !== false },\n    optionSources: options.optionSources,\n    rateLimit:\n      options.rateLimit === false\n        ? null\n        : { max: options.rateLimit?.max ?? 5, windowSeconds: options.rateLimit?.windowSeconds ?? 600 },\n    slugs,\n    turnstile: {\n      enabled: options.turnstile ? options.turnstile.enabled !== false : false,\n      fieldName: options.turnstile?.fieldName || 'cf-turnstile-response',\n      secretKey: options.turnstile?.secretKey || '',\n    },\n    webhooks: {\n      headers: options.webhooks?.headers,\n      requireSignature: options.webhooks?.requireSignature === true,\n      secretsInAdmin: options.webhooks?.secretsInAdmin !== false,\n      signingSecret: options.webhooks?.signingSecret,\n    },\n    whatsapp: options.whatsapp,\n    words: { ...DEFAULT_WORDS, ...options.words },\n  }\n}\n\n/**\n * Adds forms, submissions and private attachments, with their endpoints, to a Payload config.\n * `formsPlugin({ enabled: false })` returns the config untouched.\n */\nexport const formsPlugin =\n  (pluginOptions: FormsPluginOptions = {}) =>\n  (config: Config): Config => {\n    if (pluginOptions.enabled === false) {\n      return config\n    }\n    const options = resolveOptions(pluginOptions)\n    const collections = [...(config.collections || [])]\n\n    if (options.attachments && !options.attachments.createCollection) {\n      const index = collections.findIndex((c) => c.slug === options.attachments!.collection)\n      const target = collections[index]\n      if (!target || !target.upload) {\n        throw new Error(\n          `formsPlugin: attachments.collection \"${options.attachments.collection}\" must be an upload collection in this config.`,\n        )\n      }\n      const names = new Set(target.fields.map((f) => ('name' in f ? f.name : '')))\n      collections[index] = {\n        ...target,\n        fields: [...target.fields, ...attachmentLinkFields(options).filter((f) => !('name' in f) || !names.has(f.name))],\n      }\n    }\n\n    const { blocks, fieldTypes } = buildFieldBlocks(pluginOptions.fields, {\n      attachmentsOn: Boolean(options.attachments),\n      mimeTypes: options.attachments?.mimeTypes || [...DEFAULT_FILE_LIMITS.mimeTypes],\n      sources: options.optionSources || {},\n    })\n    options.fieldTypes = fieldTypes\n\n    const added: CollectionConfig[] = [\n      applyOverrides(formsCollection(options, blocks, [submitEndpoint(options), publicFormEndpoint(options)]), pluginOptions.formOverrides),\n      applyOverrides(submissionsCollection(options, [resendEndpoint(options)]), pluginOptions.submissionOverrides),\n    ]\n    if (options.attachments?.createCollection) {\n      added.push(applyOverrides(attachmentsCollection(options), pluginOptions.attachmentOverrides))\n    }\n\n    return {\n      ...config,\n      collections: [...collections, ...added],\n      custom: { ...config.custom, payloadForms: options },\n    }\n  }\n\nexport { signWebhookBody } from './delivery/webhook.js'\nexport { formBlock, type FormBlockOptions } from './formBlock.js'\nexport { getPublicForm, loadPublishedForm } from './server/forms.js'\nexport type {\n  Answers,\n  AnswerValue,\n  ChoiceOption,\n  FieldBlock,\n  FieldTypeChecks,\n  FieldWords,\n  FormSection,\n  FormWords,\n  InputBlock,\n  PublicForm,\n  RuleGroup,\n  RuleRow,\n  SnapshotRow,\n  SubmissionStatus,\n  SubmitResult,\n} from './shared/types.js'\nexport type { CollectionOverride, FieldTypeDefinition, FormsPluginOptions, OptionSource, ResolvedOptions } from './types.js'\n"],"names":["attachmentLinkFields","attachmentsCollection","buildFieldBlocks","formsCollection","applyOverrides","submissionsCollection","publicFormEndpoint","resendEndpoint","submitEndpoint","DEFAULT_FILE_LIMITS","DEFAULT_WORDS","DEFAULT_SLUGS","attachments","forms","submissions","resolveOptions","options","slugs","collection","String","createCollection","maxFileSize","maxTotalSize","mimeTypes","beforeEmail","delivery","fieldTypes","honeypotField","isAdmin","access","req","Boolean","user","metadata","ip","userAgent","optionSources","rateLimit","max","windowSeconds","turnstile","enabled","fieldName","secretKey","webhooks","headers","requireSignature","secretsInAdmin","signingSecret","whatsapp","words","formsPlugin","pluginOptions","config","collections","index","findIndex","c","slug","target","upload","Error","names","Set","fields","map","f","name","filter","has","blocks","attachmentsOn","sources","added","formOverrides","submissionOverrides","push","attachmentOverrides","custom","payloadForms","signWebhookBody","formBlock","getPublicForm","loadPublishedForm"],"mappings":"AAIA,SAASA,oBAAoB,EAAEC,qBAAqB,QAAQ,+BAA8B;AAC1F,SAASC,gBAAgB,QAAQ,0BAAyB;AAC1D,SAASC,eAAe,QAAQ,yBAAwB;AACxD,SAASC,cAAc,QAAQ,6BAA4B;AAC3D,SAASC,qBAAqB,QAAQ,+BAA8B;AACpE,SAASC,kBAAkB,QAAQ,wBAAuB;AAC1D,SAASC,cAAc,QAAQ,wBAAuB;AACtD,SAASC,cAAc,QAAQ,wBAAuB;AACtD,SAASC,mBAAmB,QAAQ,sBAAqB;AACzD,SAASC,aAAa,QAAQ,oBAAmB;AAEjD,OAAO,MAAMC,gBAAgB;IAC3BC,aAAa;IACbC,OAAO;IACPC,aAAa;AACf,EAAU;AAEV,OAAO,SAASC,eAAeC,UAA8B,CAAC,CAAC;IAC7D,MAAMC,QAAQ;QAAE,GAAGN,aAAa;QAAE,GAAGK,QAAQC,KAAK;IAAC;IACnD,MAAML,cACJI,QAAQJ,WAAW,KAAK,QACpB,OACA;QACEM,YAAYF,QAAQJ,WAAW,EAAEM,aAAaC,OAAOH,QAAQJ,WAAW,CAACM,UAAU,IAAID,MAAML,WAAW;QACxGQ,kBAAkB,CAACJ,QAAQJ,WAAW,EAAEM;QACxCG,aAAaL,QAAQJ,WAAW,EAAES,eAAeZ,oBAAoBY,WAAW;QAChFC,cAAcN,QAAQJ,WAAW,EAAEU,gBAAgBb,oBAAoBa,YAAY;QACnFC,WAAW;eAAKP,QAAQJ,WAAW,EAAEW,aAAad,oBAAoBc,SAAS;SAAE;IACnF;IACN,IAAIX,eAAe,CAACA,YAAYQ,gBAAgB,EAAE;QAChDH,MAAML,WAAW,GAAGA,YAAYM,UAAU;IAC5C;IACA,OAAO;QACLN;QACAY,aAAaR,QAAQQ,WAAW;QAChCC,UAAUT,QAAQS,QAAQ;QAC1BC,YAAY,CAAC;QACbC,eAAeX,QAAQW,aAAa,IAAI;QACxCC,SAASZ,QAAQa,MAAM,EAAED,WAAY,CAAA,CAACE,MAAwBC,QAAQD,IAAIE,IAAI,CAAA;QAC9EC,UAAU;YAAEC,IAAIlB,QAAQiB,QAAQ,EAAEC,OAAO;YAAMC,WAAWnB,QAAQiB,QAAQ,EAAEE,cAAc;QAAM;QAChGC,eAAepB,QAAQoB,aAAa;QACpCC,WACErB,QAAQqB,SAAS,KAAK,QAClB,OACA;YAAEC,KAAKtB,QAAQqB,SAAS,EAAEC,OAAO;YAAGC,eAAevB,QAAQqB,SAAS,EAAEE,iBAAiB;QAAI;QACjGtB;QACAuB,WAAW;YACTC,SAASzB,QAAQwB,SAAS,GAAGxB,QAAQwB,SAAS,CAACC,OAAO,KAAK,QAAQ;YACnEC,WAAW1B,QAAQwB,SAAS,EAAEE,aAAa;YAC3CC,WAAW3B,QAAQwB,SAAS,EAAEG,aAAa;QAC7C;QACAC,UAAU;YACRC,SAAS7B,QAAQ4B,QAAQ,EAAEC;YAC3BC,kBAAkB9B,QAAQ4B,QAAQ,EAAEE,qBAAqB;YACzDC,gBAAgB/B,QAAQ4B,QAAQ,EAAEG,mBAAmB;YACrDC,eAAehC,QAAQ4B,QAAQ,EAAEI;QACnC;QACAC,UAAUjC,QAAQiC,QAAQ;QAC1BC,OAAO;YAAE,GAAGxC,aAAa;YAAE,GAAGM,QAAQkC,KAAK;QAAC;IAC9C;AACF;AAEA;;;CAGC,GACD,OAAO,MAAMC,cACX,CAACC,gBAAoC,CAAC,CAAC,GACvC,CAACC;QACC,IAAID,cAAcX,OAAO,KAAK,OAAO;YACnC,OAAOY;QACT;QACA,MAAMrC,UAAUD,eAAeqC;QAC/B,MAAME,cAAc;eAAKD,OAAOC,WAAW,IAAI,EAAE;SAAE;QAEnD,IAAItC,QAAQJ,WAAW,IAAI,CAACI,QAAQJ,WAAW,CAACQ,gBAAgB,EAAE;YAChE,MAAMmC,QAAQD,YAAYE,SAAS,CAAC,CAACC,IAAMA,EAAEC,IAAI,KAAK1C,QAAQJ,WAAW,CAAEM,UAAU;YACrF,MAAMyC,SAASL,WAAW,CAACC,MAAM;YACjC,IAAI,CAACI,UAAU,CAACA,OAAOC,MAAM,EAAE;gBAC7B,MAAM,IAAIC,MACR,CAAC,qCAAqC,EAAE7C,QAAQJ,WAAW,CAACM,UAAU,CAAC,8CAA8C,CAAC;YAE1H;YACA,MAAM4C,QAAQ,IAAIC,IAAIJ,OAAOK,MAAM,CAACC,GAAG,CAAC,CAACC,IAAO,UAAUA,IAAIA,EAAEC,IAAI,GAAG;YACvEb,WAAW,CAACC,MAAM,GAAG;gBACnB,GAAGI,MAAM;gBACTK,QAAQ;uBAAIL,OAAOK,MAAM;uBAAKhE,qBAAqBgB,SAASoD,MAAM,CAAC,CAACF,IAAM,CAAE,CAAA,UAAUA,CAAAA,KAAM,CAACJ,MAAMO,GAAG,CAACH,EAAEC,IAAI;iBAAG;YAClH;QACF;QAEA,MAAM,EAAEG,MAAM,EAAE5C,UAAU,EAAE,GAAGxB,iBAAiBkD,cAAcY,MAAM,EAAE;YACpEO,eAAexC,QAAQf,QAAQJ,WAAW;YAC1CW,WAAWP,QAAQJ,WAAW,EAAEW,aAAa;mBAAId,oBAAoBc,SAAS;aAAC;YAC/EiD,SAASxD,QAAQoB,aAAa,IAAI,CAAC;QACrC;QACApB,QAAQU,UAAU,GAAGA;QAErB,MAAM+C,QAA4B;YAChCrE,eAAeD,gBAAgBa,SAASsD,QAAQ;gBAAC9D,eAAeQ;gBAAUV,mBAAmBU;aAAS,GAAGoC,cAAcsB,aAAa;YACpItE,eAAeC,sBAAsBW,SAAS;gBAACT,eAAeS;aAAS,GAAGoC,cAAcuB,mBAAmB;SAC5G;QACD,IAAI3D,QAAQJ,WAAW,EAAEQ,kBAAkB;YACzCqD,MAAMG,IAAI,CAACxE,eAAeH,sBAAsBe,UAAUoC,cAAcyB,mBAAmB;QAC7F;QAEA,OAAO;YACL,GAAGxB,MAAM;YACTC,aAAa;mBAAIA;mBAAgBmB;aAAM;YACvCK,QAAQ;gBAAE,GAAGzB,OAAOyB,MAAM;gBAAEC,cAAc/D;YAAQ;QACpD;IACF,EAAC;AAEH,SAASgE,eAAe,QAAQ,wBAAuB;AACvD,SAASC,SAAS,QAA+B,iBAAgB;AACjE,SAASC,aAAa,EAAEC,iBAAiB,QAAQ,oBAAmB"}

package/dist/security/crypto.d.ts

@@ -0,0 +1,9 @@
+export declare function sha256Hex(text: string): Promise<string>;
+export declare function hmacSha256Hex(secret: string, text: string): Promise<string>;
+/** Base64 HMAC-SHA256 of `text` keyed by raw bytes. */
+export declare function hmacSha256Base64(key: Uint8Array, text: string): Promise<string>;
+/**
+ * The Standard Webhooks HMAC key: the base64-decoded bytes after the prefix of a `whsec_` secret,
+ * else the secret's UTF-8 bytes.
+ */
+export declare function standardWebhooksKey(secret: string): Uint8Array;

package/dist/security/crypto.js

@@ -0,0 +1,54 @@
+/** Web Crypto only (works on Workers and Node); never node:crypto. */ function toHex(buffer) {
+    return Array.from(new Uint8Array(buffer)).map((b)=>b.toString(16).padStart(2, '0')).join('');
+}
+export async function sha256Hex(text) {
+    return toHex(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)));
+}
+export async function hmacSha256Hex(secret, text) {
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), {
+        name: 'HMAC',
+        hash: 'SHA-256'
+    }, false, [
+        'sign'
+    ]);
+    return toHex(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(text)));
+}
+function bytesToBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes){
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary);
+}
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for(let i = 0; i < binary.length; i += 1){
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/** Base64 HMAC-SHA256 of `text` keyed by raw bytes. */ export async function hmacSha256Base64(key, text) {
+    const cryptoKey = await crypto.subtle.importKey('raw', key, {
+        name: 'HMAC',
+        hash: 'SHA-256'
+    }, false, [
+        'sign'
+    ]);
+    return bytesToBase64(new Uint8Array(await crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(text))));
+}
+/**
+ * The Standard Webhooks HMAC key: the base64-decoded bytes after the prefix of a `whsec_` secret,
+ * else the secret's UTF-8 bytes.
+ */ export function standardWebhooksKey(secret) {
+    if (secret.startsWith('whsec_')) {
+        try {
+            return base64ToBytes(secret.slice('whsec_'.length));
+        } catch  {
+            throw new Error('The signing secret starts with whsec_ but the rest is not valid base64.');
+        }
+    }
+    return new TextEncoder().encode(secret);
+}
+
+//# sourceMappingURL=crypto.js.map

package/dist/security/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/security/crypto.ts"],"sourcesContent":["/** Web Crypto only (works on Workers and Node); never node:crypto. */\nfunction toHex(buffer: ArrayBuffer): string {\n  return Array.from(new Uint8Array(buffer))\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('')\n}\n\nexport async function sha256Hex(text: string): Promise<string> {\n  return toHex(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text)))\n}\n\nexport async function hmacSha256Hex(secret: string, text: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return toHex(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(text)))\n}\n\nfunction bytesToBase64(bytes: Uint8Array): string {\n  let binary = ''\n  for (const byte of bytes) {\n    binary += String.fromCharCode(byte)\n  }\n  return btoa(binary)\n}\n\nfunction base64ToBytes(base64: string): Uint8Array {\n  const binary = atob(base64)\n  const bytes = new Uint8Array(binary.length)\n  for (let i = 0; i < binary.length; i += 1) {\n    bytes[i] = binary.charCodeAt(i)\n  }\n  return bytes\n}\n\n/** Base64 HMAC-SHA256 of `text` keyed by raw bytes. */\nexport async function hmacSha256Base64(key: Uint8Array, text: string): Promise<string> {\n  const cryptoKey = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  return bytesToBase64(new Uint8Array(await crypto.subtle.sign('HMAC', cryptoKey, new TextEncoder().encode(text))))\n}\n\n/**\n * The Standard Webhooks HMAC key: the base64-decoded bytes after the prefix of a `whsec_` secret,\n * else the secret's UTF-8 bytes.\n */\nexport function standardWebhooksKey(secret: string): Uint8Array {\n  if (secret.startsWith('whsec_')) {\n    try {\n      return base64ToBytes(secret.slice('whsec_'.length))\n    } catch {\n      throw new Error('The signing secret starts with whsec_ but the rest is not valid base64.')\n    }\n  }\n  return new TextEncoder().encode(secret)\n}\n"],"names":["toHex","buffer","Array","from","Uint8Array","map","b","toString","padStart","join","sha256Hex","text","crypto","subtle","digest","TextEncoder","encode","hmacSha256Hex","secret","key","importKey","name","hash","sign","bytesToBase64","bytes","binary","byte","String","fromCharCode","btoa","base64ToBytes","base64","atob","length","i","charCodeAt","hmacSha256Base64","cryptoKey","standardWebhooksKey","startsWith","slice","Error"],"mappings":"AAAA,oEAAoE,GACpE,SAASA,MAAMC,MAAmB;IAChC,OAAOC,MAAMC,IAAI,CAAC,IAAIC,WAAWH,SAC9BI,GAAG,CAAC,CAACC,IAAMA,EAAEC,QAAQ,CAAC,IAAIC,QAAQ,CAAC,GAAG,MACtCC,IAAI,CAAC;AACV;AAEA,OAAO,eAAeC,UAAUC,IAAY;IAC1C,OAAOX,MAAM,MAAMY,OAAOC,MAAM,CAACC,MAAM,CAAC,WAAW,IAAIC,cAAcC,MAAM,CAACL;AAC9E;AAEA,OAAO,eAAeM,cAAcC,MAAc,EAAEP,IAAY;IAC9D,MAAMQ,MAAM,MAAMP,OAAOC,MAAM,CAACO,SAAS,CACvC,OACA,IAAIL,cAAcC,MAAM,CAACE,SACzB;QAAEG,MAAM;QAAQC,MAAM;IAAU,GAChC,OACA;QAAC;KAAO;IAEV,OAAOtB,MAAM,MAAMY,OAAOC,MAAM,CAACU,IAAI,CAAC,QAAQJ,KAAK,IAAIJ,cAAcC,MAAM,CAACL;AAC9E;AAEA,SAASa,cAAcC,KAAiB;IACtC,IAAIC,SAAS;IACb,KAAK,MAAMC,QAAQF,MAAO;QACxBC,UAAUE,OAAOC,YAAY,CAACF;IAChC;IACA,OAAOG,KAAKJ;AACd;AAEA,SAASK,cAAcC,MAAc;IACnC,MAAMN,SAASO,KAAKD;IACpB,MAAMP,QAAQ,IAAIrB,WAAWsB,OAAOQ,MAAM;IAC1C,IAAK,IAAIC,IAAI,GAAGA,IAAIT,OAAOQ,MAAM,EAAEC,KAAK,EAAG;QACzCV,KAAK,CAACU,EAAE,GAAGT,OAAOU,UAAU,CAACD;IAC/B;IACA,OAAOV;AACT;AAEA,qDAAqD,GACrD,OAAO,eAAeY,iBAAiBlB,GAAe,EAAER,IAAY;IAClE,MAAM2B,YAAY,MAAM1B,OAAOC,MAAM,CAACO,SAAS,CAAC,OAAOD,KAAK;QAAEE,MAAM;QAAQC,MAAM;IAAU,GAAG,OAAO;QAAC;KAAO;IAC9G,OAAOE,cAAc,IAAIpB,WAAW,MAAMQ,OAAOC,MAAM,CAACU,IAAI,CAAC,QAAQe,WAAW,IAAIvB,cAAcC,MAAM,CAACL;AAC3G;AAEA;;;CAGC,GACD,OAAO,SAAS4B,oBAAoBrB,MAAc;IAChD,IAAIA,OAAOsB,UAAU,CAAC,WAAW;QAC/B,IAAI;YACF,OAAOT,cAAcb,OAAOuB,KAAK,CAAC,SAASP,MAAM;QACnD,EAAE,OAAM;YACN,MAAM,IAAIQ,MAAM;QAClB;IACF;IACA,OAAO,IAAI3B,cAAcC,MAAM,CAACE;AAClC"}

package/dist/security/rateLimit.d.ts

@@ -0,0 +1,13 @@
+import type { Payload } from 'payload';
+/**
+ * Soft per-form, per-visitor limit in Payload's KV store. The key holds a hash of the IP and the
+ * app secret, never the IP. Returns false when the visitor is over the limit.
+ */
+export declare function checkRateLimit(args: {
+    formId: number | string;
+    ip: string;
+    max: number;
+    now?: number;
+    payload: Payload;
+    windowSeconds: number;
+}): Promise<boolean>;

package/dist/security/rateLimit.js

@@ -0,0 +1,28 @@
+import { sha256Hex } from './crypto.js';
+/**
+ * Soft per-form, per-visitor limit in Payload's KV store. The key holds a hash of the IP and the
+ * app secret, never the IP. Returns false when the visitor is over the limit.
+ */ export async function checkRateLimit(args) {
+    const { payload } = args;
+    const now = args.now ?? Date.now();
+    const hash = await sha256Hex(`${args.ip || 'unknown'}${payload.secret}`);
+    const key = `forms:rl:${args.formId}:${hash}`;
+    const entry = await payload.kv.get(key);
+    if (!entry || typeof entry.start !== 'number' || now - entry.start >= args.windowSeconds * 1000) {
+        await payload.kv.set(key, {
+            count: 1,
+            start: now
+        });
+        return true;
+    }
+    if (entry.count >= args.max) {
+        return false;
+    }
+    await payload.kv.set(key, {
+        count: entry.count + 1,
+        start: entry.start
+    });
+    return true;
+}
+
+//# sourceMappingURL=rateLimit.js.map

package/dist/security/rateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/security/rateLimit.ts"],"sourcesContent":["import type { Payload } from 'payload'\n\nimport { sha256Hex } from './crypto.js'\n\ntype Entry = { count: number; start: number }\n\n/**\n * Soft per-form, per-visitor limit in Payload's KV store. The key holds a hash of the IP and the\n * app secret, never the IP. Returns false when the visitor is over the limit.\n */\nexport async function checkRateLimit(args: {\n  formId: number | string\n  ip: string\n  max: number\n  now?: number\n  payload: Payload\n  windowSeconds: number\n}): Promise<boolean> {\n  const { payload } = args\n  const now = args.now ?? Date.now()\n  const hash = await sha256Hex(`${args.ip || 'unknown'}${payload.secret}`)\n  const key = `forms:rl:${args.formId}:${hash}`\n  const entry = await payload.kv.get<Entry>(key)\n  if (!entry || typeof entry.start !== 'number' || now - entry.start >= args.windowSeconds * 1000) {\n    await payload.kv.set(key, { count: 1, start: now })\n    return true\n  }\n  if (entry.count >= args.max) {\n    return false\n  }\n  await payload.kv.set(key, { count: entry.count + 1, start: entry.start })\n  return true\n}\n"],"names":["sha256Hex","checkRateLimit","args","payload","now","Date","hash","ip","secret","key","formId","entry","kv","get","start","windowSeconds","set","count","max"],"mappings":"AAEA,SAASA,SAAS,QAAQ,cAAa;AAIvC;;;CAGC,GACD,OAAO,eAAeC,eAAeC,IAOpC;IACC,MAAM,EAAEC,OAAO,EAAE,GAAGD;IACpB,MAAME,MAAMF,KAAKE,GAAG,IAAIC,KAAKD,GAAG;IAChC,MAAME,OAAO,MAAMN,UAAU,GAAGE,KAAKK,EAAE,IAAI,YAAYJ,QAAQK,MAAM,EAAE;IACvE,MAAMC,MAAM,CAAC,SAAS,EAAEP,KAAKQ,MAAM,CAAC,CAAC,EAAEJ,MAAM;IAC7C,MAAMK,QAAQ,MAAMR,QAAQS,EAAE,CAACC,GAAG,CAAQJ;IAC1C,IAAI,CAACE,SAAS,OAAOA,MAAMG,KAAK,KAAK,YAAYV,MAAMO,MAAMG,KAAK,IAAIZ,KAAKa,aAAa,GAAG,MAAM;QAC/F,MAAMZ,QAAQS,EAAE,CAACI,GAAG,CAACP,KAAK;YAAEQ,OAAO;YAAGH,OAAOV;QAAI;QACjD,OAAO;IACT;IACA,IAAIO,MAAMM,KAAK,IAAIf,KAAKgB,GAAG,EAAE;QAC3B,OAAO;IACT;IACA,MAAMf,QAAQS,EAAE,CAACI,GAAG,CAACP,KAAK;QAAEQ,OAAON,MAAMM,KAAK,GAAG;QAAGH,OAAOH,MAAMG,KAAK;IAAC;IACvE,OAAO;AACT"}

package/dist/security/request.d.ts

@@ -0,0 +1,3 @@
+/** The visitor IP: `cf-connecting-ip`, else the first `x-forwarded-for`, else `x-real-ip`. */
+export declare function getRequestIP(headers: Headers): string;
+export declare function isHoneypotFilled(raw: Record<string, unknown>, fieldName: string): boolean;

package/dist/security/request.js

@@ -0,0 +1,13 @@
+/** The visitor IP: `cf-connecting-ip`, else the first `x-forwarded-for`, else `x-real-ip`. */ export function getRequestIP(headers) {
+    const value = headers.get('cf-connecting-ip') || headers.get('x-forwarded-for') || headers.get('x-real-ip') || '';
+    return value.split(',')[0]?.trim() || '';
+}
+export function isHoneypotFilled(raw, fieldName) {
+    const value = raw[fieldName];
+    const list = Array.isArray(value) ? value : [
+        value
+    ];
+    return list.some((v)=>typeof v === 'string' && v.trim() !== '');
+}
+
+//# sourceMappingURL=request.js.map

package/dist/security/request.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/security/request.ts"],"sourcesContent":["/** The visitor IP: `cf-connecting-ip`, else the first `x-forwarded-for`, else `x-real-ip`. */\nexport function getRequestIP(headers: Headers): string {\n  const value =\n    headers.get('cf-connecting-ip') || headers.get('x-forwarded-for') || headers.get('x-real-ip') || ''\n  return value.split(',')[0]?.trim() || ''\n}\n\nexport function isHoneypotFilled(raw: Record<string, unknown>, fieldName: string): boolean {\n  const value = raw[fieldName]\n  const list = Array.isArray(value) ? value : [value]\n  return list.some((v) => typeof v === 'string' && v.trim() !== '')\n}\n"],"names":["getRequestIP","headers","value","get","split","trim","isHoneypotFilled","raw","fieldName","list","Array","isArray","some","v"],"mappings":"AAAA,4FAA4F,GAC5F,OAAO,SAASA,aAAaC,OAAgB;IAC3C,MAAMC,QACJD,QAAQE,GAAG,CAAC,uBAAuBF,QAAQE,GAAG,CAAC,sBAAsBF,QAAQE,GAAG,CAAC,gBAAgB;IACnG,OAAOD,MAAME,KAAK,CAAC,IAAI,CAAC,EAAE,EAAEC,UAAU;AACxC;AAEA,OAAO,SAASC,iBAAiBC,GAA4B,EAAEC,SAAiB;IAC9E,MAAMN,QAAQK,GAAG,CAACC,UAAU;IAC5B,MAAMC,OAAOC,MAAMC,OAAO,CAACT,SAASA,QAAQ;QAACA;KAAM;IACnD,OAAOO,KAAKG,IAAI,CAAC,CAACC,IAAM,OAAOA,MAAM,YAAYA,EAAER,IAAI,OAAO;AAChE"}

package/dist/security/turnstile.d.ts

@@ -0,0 +1,28 @@
+export declare const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+type Logger = {
+    error: (msg: unknown, ...rest: unknown[]) => void;
+};
+/**
+ * Verifies a Turnstile token with Cloudflare's siteverify: secret, token, visitor IP and an
+ * idempotency key (safe retries). Any error counts as a failed check.
+ */
+export declare function verifyTurnstile(args: {
+    idempotencyKey?: string;
+    ip?: string;
+    secret: string;
+    token: string;
+}): Promise<boolean>;
+/**
+ * The Turnstile check for one plugin setup. Off: passes. On without a secret: refuses every
+ * submission and logs one error line. On: the token must verify.
+ */
+export declare function checkTurnstile(args: {
+    ip: string;
+    logger: Logger;
+    settings: {
+        enabled: boolean;
+        secretKey: string;
+    };
+    token: unknown;
+}): Promise<boolean>;
+export {};

package/dist/security/turnstile.js

@@ -0,0 +1,56 @@
+export const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+/**
+ * Verifies a Turnstile token with Cloudflare's siteverify: secret, token, visitor IP and an
+ * idempotency key (safe retries). Any error counts as a failed check.
+ */ export async function verifyTurnstile(args) {
+    try {
+        const response = await fetch(SITEVERIFY_URL, {
+            body: JSON.stringify({
+                idempotency_key: args.idempotencyKey || crypto.randomUUID(),
+                remoteip: args.ip || undefined,
+                response: args.token,
+                secret: args.secret
+            }),
+            headers: {
+                'Content-Type': 'application/json'
+            },
+            method: 'POST'
+        });
+        if (!response.ok) {
+            return false;
+        }
+        const data = await response.json();
+        return data.success === true;
+    } catch  {
+        return false;
+    }
+}
+const warned = new WeakSet();
+/**
+ * The Turnstile check for one plugin setup. Off: passes. On without a secret: refuses every
+ * submission and logs one error line. On: the token must verify.
+ */ export async function checkTurnstile(args) {
+    const { settings } = args;
+    if (!settings.enabled) {
+        return true;
+    }
+    if (!settings.secretKey) {
+        if (!warned.has(settings)) {
+            warned.add(settings);
+            args.logger.error('payload-dynamic-forms: Turnstile is on but has no secret key; every submission is refused.');
+        }
+        return false;
+    }
+    const token = Array.isArray(args.token) ? args.token[0] : args.token;
+    if (typeof token !== 'string' || !token.trim()) {
+        return false;
+    }
+    return verifyTurnstile({
+        idempotencyKey: crypto.randomUUID(),
+        ip: args.ip,
+        secret: settings.secretKey,
+        token: token.trim()
+    });
+}
+
+//# sourceMappingURL=turnstile.js.map

package/dist/security/turnstile.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/security/turnstile.ts"],"sourcesContent":["export const SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify'\n\ntype Logger = { error: (msg: unknown, ...rest: unknown[]) => void }\n\n/**\n * Verifies a Turnstile token with Cloudflare's siteverify: secret, token, visitor IP and an\n * idempotency key (safe retries). Any error counts as a failed check.\n */\nexport async function verifyTurnstile(args: {\n  idempotencyKey?: string\n  ip?: string\n  secret: string\n  token: string\n}): Promise<boolean> {\n  try {\n    const response = await fetch(SITEVERIFY_URL, {\n      body: JSON.stringify({\n        idempotency_key: args.idempotencyKey || crypto.randomUUID(),\n        remoteip: args.ip || undefined,\n        response: args.token,\n        secret: args.secret,\n      }),\n      headers: { 'Content-Type': 'application/json' },\n      method: 'POST',\n    })\n    if (!response.ok) {\n      return false\n    }\n    const data = (await response.json()) as { success?: boolean }\n    return data.success === true\n  } catch {\n    return false\n  }\n}\n\nconst warned = new WeakSet<object>()\n\n/**\n * The Turnstile check for one plugin setup. Off: passes. On without a secret: refuses every\n * submission and logs one error line. On: the token must verify.\n */\nexport async function checkTurnstile(args: {\n  ip: string\n  logger: Logger\n  settings: { enabled: boolean; secretKey: string }\n  token: unknown\n}): Promise<boolean> {\n  const { settings } = args\n  if (!settings.enabled) {\n    return true\n  }\n  if (!settings.secretKey) {\n    if (!warned.has(settings)) {\n      warned.add(settings)\n      args.logger.error('payload-dynamic-forms: Turnstile is on but has no secret key; every submission is refused.')\n    }\n    return false\n  }\n  const token = Array.isArray(args.token) ? args.token[0] : args.token\n  if (typeof token !== 'string' || !token.trim()) {\n    return false\n  }\n  return verifyTurnstile({ idempotencyKey: crypto.randomUUID(), ip: args.ip, secret: settings.secretKey, token: token.trim() })\n}\n"],"names":["SITEVERIFY_URL","verifyTurnstile","args","response","fetch","body","JSON","stringify","idempotency_key","idempotencyKey","crypto","randomUUID","remoteip","ip","undefined","token","secret","headers","method","ok","data","json","success","warned","WeakSet","checkTurnstile","settings","enabled","secretKey","has","add","logger","error","Array","isArray","trim"],"mappings":"AAAA,OAAO,MAAMA,iBAAiB,4DAA2D;AAIzF;;;CAGC,GACD,OAAO,eAAeC,gBAAgBC,IAKrC;IACC,IAAI;QACF,MAAMC,WAAW,MAAMC,MAAMJ,gBAAgB;YAC3CK,MAAMC,KAAKC,SAAS,CAAC;gBACnBC,iBAAiBN,KAAKO,cAAc,IAAIC,OAAOC,UAAU;gBACzDC,UAAUV,KAAKW,EAAE,IAAIC;gBACrBX,UAAUD,KAAKa,KAAK;gBACpBC,QAAQd,KAAKc,MAAM;YACrB;YACAC,SAAS;gBAAE,gBAAgB;YAAmB;YAC9CC,QAAQ;QACV;QACA,IAAI,CAACf,SAASgB,EAAE,EAAE;YAChB,OAAO;QACT;QACA,MAAMC,OAAQ,MAAMjB,SAASkB,IAAI;QACjC,OAAOD,KAAKE,OAAO,KAAK;IAC1B,EAAE,OAAM;QACN,OAAO;IACT;AACF;AAEA,MAAMC,SAAS,IAAIC;AAEnB;;;CAGC,GACD,OAAO,eAAeC,eAAevB,IAKpC;IACC,MAAM,EAAEwB,QAAQ,EAAE,GAAGxB;IACrB,IAAI,CAACwB,SAASC,OAAO,EAAE;QACrB,OAAO;IACT;IACA,IAAI,CAACD,SAASE,SAAS,EAAE;QACvB,IAAI,CAACL,OAAOM,GAAG,CAACH,WAAW;YACzBH,OAAOO,GAAG,CAACJ;YACXxB,KAAK6B,MAAM,CAACC,KAAK,CAAC;QACpB;QACA,OAAO;IACT;IACA,MAAMjB,QAAQkB,MAAMC,OAAO,CAAChC,KAAKa,KAAK,IAAIb,KAAKa,KAAK,CAAC,EAAE,GAAGb,KAAKa,KAAK;IACpE,IAAI,OAAOA,UAAU,YAAY,CAACA,MAAMoB,IAAI,IAAI;QAC9C,OAAO;IACT;IACA,OAAOlC,gBAAgB;QAAEQ,gBAAgBC,OAAOC,UAAU;QAAIE,IAAIX,KAAKW,EAAE;QAAEG,QAAQU,SAASE,SAAS;QAAEb,OAAOA,MAAMoB,IAAI;IAAG;AAC7H"}

package/dist/server/forms.d.ts

@@ -0,0 +1,73 @@
+import type { Payload, PayloadRequest, TypedLocale } from 'payload';
+import type { PublicForm } from '../shared/types.js';
+import type { ResolvedOptions } from '../types.js';
+export type EmailOutput = {
+    bcc?: null | string;
+    body?: null | string;
+    cc?: null | string;
+    enabled?: boolean | null;
+    from?: null | string;
+    id?: null | string;
+    kind?: 'team' | 'visitor' | null;
+    label?: null | string;
+    replyToField?: null | string;
+    subject?: null | string;
+    to?: null | string;
+    visitorField?: null | string;
+};
+export type WebhookOutput = {
+    enabled?: boolean | null;
+    headers?: Array<{
+        key?: null | string;
+        value?: null | string;
+    }> | null;
+    id?: null | string;
+    label?: null | string;
+    method?: 'PATCH' | 'POST' | 'PUT' | null;
+    payloadMode?: 'answersOnly' | 'full' | null;
+    retries?: null | number;
+    signingSecret?: null | string;
+    timeoutMs?: null | number;
+    url?: null | string;
+};
+export type FormDelivery = {
+    emails: EmailOutput[];
+    store: boolean;
+    webhooks: WebhookOutput[];
+    whatsapp: {
+        enabled: boolean;
+        messageTemplate?: null | string;
+        number?: null | string;
+        rowTemplate?: null | string;
+    };
+};
+export type LoadedForm = {
+    delivery: FormDelivery;
+    form: PublicForm;
+};
+type Locale = 'all' | TypedLocale | undefined;
+/** The plugin options of an app, kept on its config by `formsPlugin`. */
+export declare function getPluginOptions(payload: Payload): ResolvedOptions;
+/**
+ * Loads a published form by slug, as a visitor would see it, plus its delivery settings for the
+ * server. Null when the slug is unknown or the form is not published.
+ */
+export declare function loadPublishedForm(payload: Payload, slug: string, args?: {
+    locale?: Locale;
+    req?: PayloadRequest;
+}): Promise<LoadedForm | null>;
+/** Loads a form by id with its delivery settings (trusted server use: resend). */
+export declare function loadFormById(payload: Payload, id: number | string, args?: {
+    locale?: Locale;
+    req?: PayloadRequest;
+}): Promise<LoadedForm | null>;
+/**
+ * A published form ready to render: sections, choices from sources resolved with their
+ * attributes, words filled from the defaults, the WhatsApp number when WhatsApp is on, and none of
+ * its other delivery settings. Null for unknown or unpublished slugs.
+ */
+export declare function getPublicForm(payload: Payload, slug: string, args?: {
+    locale?: Locale;
+    req?: PayloadRequest;
+}): Promise<null | PublicForm>;
+export {};