strapi-plugin-hubspot 0.11.0 → 0.13.0

package/dist/_chunks/{index-DA31TY2n.mjs → index-BE2ribUL.mjs}

@@ -25,7 +25,7 @@ const index = {
       icon: PaperPlane,
       intlLabel: { id: `${PLUGIN_ID}.menu.label`, defaultMessage: "HubSpot Forms" },
       permissions: [{ action: `plugin::${PLUGIN_ID}.forms`, subject: null }],
-      Component: async () => (await import("./Forms-DadTbe9Q.mjs")).default
+      Component: async () => (await import("./Forms-CHB-sKem.mjs")).default
     });
     app.customFields.register({
       name: "property",
@@ -40,7 +40,7 @@ const index = {
         defaultMessage: "Picked from the portal's real properties"
       },
       components: {
-        Input: async () => import("./HubspotPropertyInput-KX1Bhcsl.mjs")
+        Input: async () => import("./HubspotPropertyInput-DicskLcN.mjs")
       },
       // Exposed in the Content-Type Builder. Without this, `objectField` could
       // only be set by hand-editing schema.json — which is not how anyone
@@ -103,7 +103,7 @@ const index = {
         defaultMessage: "Picked from the portal's configured objects"
       },
       components: {
-        Input: async () => import("./HubspotObjectInput-DAo3FAMz.mjs")
+        Input: async () => import("./HubspotObjectInput-CzLKT9oj.mjs")
       }
     });
     app.customFields.register({
@@ -119,7 +119,7 @@ const index = {
         defaultMessage: "A form built in the HubSpot form builder, stored by slug"
       },
       components: {
-        Input: async () => import("./HubspotFormInput-NO59AtM_.mjs")
+        Input: async () => import("./HubspotFormInput-YI09keTC.mjs")
       }
     });
     app.createSettingSection(
@@ -135,7 +135,7 @@ const index = {
           // Mirrors the RBAC action registered server-side: a role without it
           // doesn't see the link at all — the routes refuse it anyway.
           permissions: [{ action: `plugin::${PLUGIN_ID}.settings`, subject: null }],
-          Component: async () => (await import("./Settings-Dz0PEFOv.mjs")).default
+          Component: async () => (await import("./Settings-4CbX3SPK.mjs")).default
         }
       ]
     );
@@ -145,7 +145,7 @@ const index = {
     return Promise.all(
       locales.map(async (locale) => {
         try {
-          const { default: data } = await __variableDynamicImportRuntimeHelper(/* @__PURE__ */ Object.assign({ "./translations/en.json": () => import("./en-CH5LSPkL.mjs"), "./translations/fr.json": () => import("./fr-65-RaB3w.mjs") }), `./translations/${locale}.json`, 3);
+          const { default: data } = await __variableDynamicImportRuntimeHelper(/* @__PURE__ */ Object.assign({ "./translations/en.json": () => import("./en-D8DJiSxd.mjs"), "./translations/fr.json": () => import("./fr-BMjixfXn.mjs") }), `./translations/${locale}.json`, 3);
           return { data: prefixPluginTranslations(data), locale };
         } catch {
           return { data: {}, locale };

package/dist/_chunks/{objectLabels-FTh984_h.js → objectLabels-CycoU0zY.js}

@@ -1,5 +1,5 @@
 "use strict";
-const index = require("./index-B7Ru1fu5.js");
+const index = require("./index-BAvedd2m.js");
 const STANDARD = /* @__PURE__ */ new Set([
   "contact",
   "company",

package/dist/_chunks/{objectLabels-Bl7sO5pb.mjs → objectLabels-DGJxYjKz.mjs}

@@ -1,4 +1,4 @@
-import { g as getTranslation } from "./index-DA31TY2n.mjs";
+import { g as getTranslation } from "./index-BE2ribUL.mjs";
 const STANDARD = /* @__PURE__ */ new Set([
   "contact",
   "company",

package/dist/_chunks/{useHubspotSchema-C2_PuXEm.js → useHubspotSchema-DRfaI6mF.js}

@@ -1,7 +1,7 @@
 "use strict";
 const React = require("react");
 const admin = require("@strapi/strapi/admin");
-const index = require("./index-B7Ru1fu5.js");
+const index = require("./index-BAvedd2m.js");
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
   const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });

package/dist/_chunks/{useHubspotSchema-BlDilCHc.mjs → useHubspotSchema-e31UsYb2.mjs}

@@ -1,6 +1,6 @@
 import * as React from "react";
 import { useFetchClient } from "@strapi/strapi/admin";
-import { P as PLUGIN_ID } from "./index-DA31TY2n.mjs";
+import { P as PLUGIN_ID } from "./index-BE2ribUL.mjs";
 let cached = null;
 let inFlight = null;
 const listeners = /* @__PURE__ */ new Set();

package/dist/admin/index.js

@@ -1,4 +1,4 @@
 "use strict";
-const index = require("../_chunks/index-B7Ru1fu5.js");
+const index = require("../_chunks/index-BAvedd2m.js");
 require("@strapi/icons");
 module.exports = index.index;

package/dist/admin/index.mjs

@@ -1,4 +1,4 @@
-import { i } from "../_chunks/index-DA31TY2n.mjs";
+import { i } from "../_chunks/index-BE2ribUL.mjs";
 import "@strapi/icons";
 export {
   i as default

package/dist/admin/src/builder/Sortable.d.ts

@@ -0,0 +1,25 @@
+import * as React from "react";
+import { arrayMove } from "@dnd-kit/sortable";
+export { arrayMove };
+/** The drag-handle props to spread on the grip element. */
+export interface HandleProps {
+    attributes: React.HTMLAttributes<HTMLElement>;
+    listeners: Record<string, unknown> | undefined;
+}
+/**
+ * One vertical sortable list. Each list gets its OWN DndContext: steps sort
+ * among steps, a step's fields sort among themselves — no cross-container
+ * ambiguity, and the arrow buttons keep covering cross-step moves (they also
+ * stay the accessible path).
+ */
+export declare function SortableList({ ids, onReorder, children, }: {
+    ids: string[];
+    /** Called with the reordered ids after a completed drag. */
+    onReorder: (ids: string[]) => void;
+    children: React.ReactNode;
+}): React.JSX.Element;
+/** A sortable row: wraps the card, hands the grip props to its children. */
+export declare function SortableItem({ id, children, }: {
+    id: string;
+    children: (handle: HandleProps) => React.ReactNode;
+}): React.JSX.Element;

package/dist/admin/src/builder/__tests__/CompanyMapEditor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/admin/src/builder/__tests__/ConditionEditor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/admin/src/builder/__tests__/testUtils.d.ts

@@ -0,0 +1,4 @@
+import * as React from "react";
+import { type RenderResult } from "@testing-library/react";
+/** Render under the providers every builder component assumes. */
+export declare function render(ui: React.ReactElement): RenderResult;

package/dist/server/index.js

@@ -1179,13 +1179,20 @@ async function query(params) {
     return null;
   }
 }
+function normalizeQuery(q) {
+  const trimmed = q.trim();
+  const digits = trimmed.replace(/[\s.-]/g, "");
+  return /^\d{9}$/.test(digits) || /^\d{14}$/.test(digits) ? digits : trimmed;
+}
 async function searchCompanies(q) {
-  const trimmed = q.trim().slice(0, 60);
+  const trimmed = normalizeQuery(q).slice(0, 60);
   if (trimmed.length < 3) return [];
   const key = trimmed.toLowerCase();
   const cached = cache.get(key);
   if (cached && Date.now() - cached.at < CACHE_TTL_MS) return cached.hits;
-  const payload = await query(`q=${encodeURIComponent(trimmed)}&per_page=8`);
+  const payload = await query(
+    `q=${encodeURIComponent(trimmed)}&per_page=8&etat_administratif=A&limite_matching_etablissements=5`
+  );
   const hits = payload ? normalizeCompanyHits(payload) : [];
   if (payload) cache.set(key, { at: Date.now(), hits });
   return hits;
@@ -1746,6 +1753,10 @@ function createFormsService(strapi, _opts = {}) {
     });
   }
   async function submit(form, rawValues, meta = {}) {
+    const hp = rawValues.__hp;
+    if (typeof hp === "string" && hp.trim() !== "") {
+      return { ok: true, hubspotSynced: false };
+    }
     const resolution = resolveSubmission(form.definition, rawValues);
     if (resolution.missingRequired.length) {
       return { ok: false, missingRequired: resolution.missingRequired };
@@ -2503,6 +2514,36 @@ function createFormsAdminController(strapi) {
     }
   };
 }
+function createLimiter({
+  windowMs,
+  max,
+  now = Date.now
+}) {
+  const hits = /* @__PURE__ */ new Map();
+  let lastSweep = 0;
+  return {
+    allow(key) {
+      if (max <= 0) return true;
+      const at = now();
+      const floor = at - windowMs;
+      if (at - lastSweep >= windowMs) {
+        lastSweep = at;
+        for (const [k, stamps] of hits) {
+          if (!stamps.some((t) => t > floor)) hits.delete(k);
+        }
+      }
+      const recent = (hits.get(key) ?? []).filter((t) => t > floor);
+      if (recent.length >= max) {
+        hits.set(key, recent);
+        return false;
+      }
+      recent.push(at);
+      hits.set(key, recent);
+      return true;
+    },
+    size: () => hits.size
+  };
+}
 function fieldOrder(definition) {
   if (!definition) return [];
   return definition.steps.flatMap((step) => step.fields.map((field) => field.name));
@@ -2690,7 +2731,12 @@ const config = {
     //  - companyFromDomain: a corporate email upserts the Company (deduped by
     //    domain) and associates it to the contact;
     //  - timelineNote: a note recaps the submission on the contact's timeline.
-    forms: { companyFromDomain: true, timelineNote: true }
+    forms: {
+      companyFromDomain: true,
+      timelineNote: true,
+      // Per-IP brakes on the public routes; 0 disables one.
+      rateLimit: { submitPerMinute: 6, searchPerMinute: 30 }
+    }
   },
   validator(cfg) {
     if (cfg.validate && !Array.isArray(cfg.validate)) {
@@ -2752,13 +2798,23 @@ const controllers = {
     }
   }),
   formsAdmin: ({ strapi }) => createFormsAdminController(strapi),
-  company: () => ({
-    /** SIRENE autocomplete for the company field — bounded, cached upstream. */
-    async search(ctx) {
-      const q = typeof ctx.query.q === "string" ? ctx.query.q : "";
-      ctx.body = { companies: await searchCompanies(q) };
-    }
-  }),
+  company: ({ strapi }) => {
+    const limits = strapi.plugin("hubspot").config("forms", {});
+    const limiter = createLimiter({
+      windowMs: 6e4,
+      max: limits.rateLimit?.searchPerMinute ?? 30
+    });
+    return {
+      /** SIRENE autocomplete for the company field — bounded, cached upstream. */
+      async search(ctx) {
+        if (!limiter.allow(ctx.request.ip ?? "unknown")) {
+          ctx.throw(429, "Too many searches — slow down.");
+        }
+        const q = typeof ctx.query.q === "string" ? ctx.query.q : "";
+        ctx.body = { companies: await searchCompanies(q) };
+      }
+    };
+  },
   submissions: ({ strapi }) => ({
     /** Paged submissions, newest first, optionally narrowed to one form. */
     async list(ctx) {
@@ -2802,41 +2858,51 @@ const controllers = {
       };
     }
   }),
-  forms: ({ strapi }) => ({
-    /** Published form for the host frontend — CRM mapping stripped. */
-    async findOne(ctx) {
-      const entry = await strapi.documents(FORM_UID).findFirst({
-        filters: { slug: ctx.params.slug },
-        status: "published",
-        locale: ctx.query.locale
-      });
-      if (!entry?.definition) ctx.throw(404, "Form not found");
-      ctx.body = publicForm(entry);
-    },
-    async submit(ctx) {
-      const entry = await strapi.documents(FORM_UID).findFirst({
-        filters: { slug: ctx.params.slug },
-        status: "published",
-        locale: ctx.query.locale
-      });
-      if (!entry?.definition) ctx.throw(404, "Form not found");
-      const values = sanitizeRawValues(ctx.request.body?.values);
-      if (!values || !Object.keys(values).length) ctx.throw(422, "Invalid submission");
-      const rawMeta = ctx.request.body?.meta ?? {};
-      const meta = {};
-      for (const key of ["pagePath", "pageUrl", "originPath", "originLabel", "source"]) {
-        const v = rawMeta[key];
-        if (typeof v === "string" && v) meta[key] = v.slice(0, 500);
-      }
-      const outcome = await strapi.plugin("hubspot").service("forms").submit(entry, values, meta);
-      if (!outcome.ok) {
-        ctx.status = 422;
-        ctx.body = { ok: false, missingRequired: outcome.missingRequired ?? [] };
-        return;
+  forms: ({ strapi }) => {
+    const limits = strapi.plugin("hubspot").config("forms", {});
+    const submitLimiter = createLimiter({
+      windowMs: 6e4,
+      max: limits.rateLimit?.submitPerMinute ?? 6
+    });
+    return {
+      /** Published form for the host frontend — CRM mapping stripped. */
+      async findOne(ctx) {
+        const entry = await strapi.documents(FORM_UID).findFirst({
+          filters: { slug: ctx.params.slug },
+          status: "published",
+          locale: ctx.query.locale
+        });
+        if (!entry?.definition) ctx.throw(404, "Form not found");
+        ctx.body = publicForm(entry);
+      },
+      async submit(ctx) {
+        const entry = await strapi.documents(FORM_UID).findFirst({
+          filters: { slug: ctx.params.slug },
+          status: "published",
+          locale: ctx.query.locale
+        });
+        if (!entry?.definition) ctx.throw(404, "Form not found");
+        if (!submitLimiter.allow(ctx.request.ip ?? "unknown")) {
+          ctx.throw(429, "Too many submissions — try again in a minute.");
+        }
+        const values = sanitizeRawValues(ctx.request.body?.values);
+        if (!values || !Object.keys(values).length) ctx.throw(422, "Invalid submission");
+        const rawMeta = ctx.request.body?.meta ?? {};
+        const meta = {};
+        for (const key of ["pagePath", "pageUrl", "originPath", "originLabel", "source"]) {
+          const v = rawMeta[key];
+          if (typeof v === "string" && v) meta[key] = v.slice(0, 500);
+        }
+        const outcome = await strapi.plugin("hubspot").service("forms").submit(entry, values, meta);
+        if (!outcome.ok) {
+          ctx.status = 422;
+          ctx.body = { ok: false, missingRequired: outcome.missingRequired ?? [] };
+          return;
+        }
+        ctx.body = { ok: true, hubspotSynced: outcome.hubspotSynced };
       }
-      ctx.body = { ok: true, hubspotSynced: outcome.hubspotSynced };
-    }
-  }),
+    };
+  },
   settings: ({ strapi }) => ({
     async get(ctx) {
       ctx.body = await publicSettings(strapi);

package/dist/server/index.mjs

@@ -1178,13 +1178,20 @@ async function query(params) {
     return null;
   }
 }
+function normalizeQuery(q) {
+  const trimmed = q.trim();
+  const digits = trimmed.replace(/[\s.-]/g, "");
+  return /^\d{9}$/.test(digits) || /^\d{14}$/.test(digits) ? digits : trimmed;
+}
 async function searchCompanies(q) {
-  const trimmed = q.trim().slice(0, 60);
+  const trimmed = normalizeQuery(q).slice(0, 60);
   if (trimmed.length < 3) return [];
   const key = trimmed.toLowerCase();
   const cached = cache.get(key);
   if (cached && Date.now() - cached.at < CACHE_TTL_MS) return cached.hits;
-  const payload = await query(`q=${encodeURIComponent(trimmed)}&per_page=8`);
+  const payload = await query(
+    `q=${encodeURIComponent(trimmed)}&per_page=8&etat_administratif=A&limite_matching_etablissements=5`
+  );
   const hits = payload ? normalizeCompanyHits(payload) : [];
   if (payload) cache.set(key, { at: Date.now(), hits });
   return hits;
@@ -1745,6 +1752,10 @@ function createFormsService(strapi, _opts = {}) {
     });
   }
   async function submit(form, rawValues, meta = {}) {
+    const hp = rawValues.__hp;
+    if (typeof hp === "string" && hp.trim() !== "") {
+      return { ok: true, hubspotSynced: false };
+    }
     const resolution = resolveSubmission(form.definition, rawValues);
     if (resolution.missingRequired.length) {
       return { ok: false, missingRequired: resolution.missingRequired };
@@ -2502,6 +2513,36 @@ function createFormsAdminController(strapi) {
     }
   };
 }
+function createLimiter({
+  windowMs,
+  max,
+  now = Date.now
+}) {
+  const hits = /* @__PURE__ */ new Map();
+  let lastSweep = 0;
+  return {
+    allow(key) {
+      if (max <= 0) return true;
+      const at = now();
+      const floor = at - windowMs;
+      if (at - lastSweep >= windowMs) {
+        lastSweep = at;
+        for (const [k, stamps] of hits) {
+          if (!stamps.some((t) => t > floor)) hits.delete(k);
+        }
+      }
+      const recent = (hits.get(key) ?? []).filter((t) => t > floor);
+      if (recent.length >= max) {
+        hits.set(key, recent);
+        return false;
+      }
+      recent.push(at);
+      hits.set(key, recent);
+      return true;
+    },
+    size: () => hits.size
+  };
+}
 function fieldOrder(definition) {
   if (!definition) return [];
   return definition.steps.flatMap((step) => step.fields.map((field) => field.name));
@@ -2689,7 +2730,12 @@ const config = {
     //  - companyFromDomain: a corporate email upserts the Company (deduped by
     //    domain) and associates it to the contact;
     //  - timelineNote: a note recaps the submission on the contact's timeline.
-    forms: { companyFromDomain: true, timelineNote: true }
+    forms: {
+      companyFromDomain: true,
+      timelineNote: true,
+      // Per-IP brakes on the public routes; 0 disables one.
+      rateLimit: { submitPerMinute: 6, searchPerMinute: 30 }
+    }
   },
   validator(cfg) {
     if (cfg.validate && !Array.isArray(cfg.validate)) {
@@ -2751,13 +2797,23 @@ const controllers = {
     }
   }),
   formsAdmin: ({ strapi }) => createFormsAdminController(strapi),
-  company: () => ({
-    /** SIRENE autocomplete for the company field — bounded, cached upstream. */
-    async search(ctx) {
-      const q = typeof ctx.query.q === "string" ? ctx.query.q : "";
-      ctx.body = { companies: await searchCompanies(q) };
-    }
-  }),
+  company: ({ strapi }) => {
+    const limits = strapi.plugin("hubspot").config("forms", {});
+    const limiter = createLimiter({
+      windowMs: 6e4,
+      max: limits.rateLimit?.searchPerMinute ?? 30
+    });
+    return {
+      /** SIRENE autocomplete for the company field — bounded, cached upstream. */
+      async search(ctx) {
+        if (!limiter.allow(ctx.request.ip ?? "unknown")) {
+          ctx.throw(429, "Too many searches — slow down.");
+        }
+        const q = typeof ctx.query.q === "string" ? ctx.query.q : "";
+        ctx.body = { companies: await searchCompanies(q) };
+      }
+    };
+  },
   submissions: ({ strapi }) => ({
     /** Paged submissions, newest first, optionally narrowed to one form. */
     async list(ctx) {
@@ -2801,41 +2857,51 @@ const controllers = {
       };
     }
   }),
-  forms: ({ strapi }) => ({
-    /** Published form for the host frontend — CRM mapping stripped. */
-    async findOne(ctx) {
-      const entry = await strapi.documents(FORM_UID).findFirst({
-        filters: { slug: ctx.params.slug },
-        status: "published",
-        locale: ctx.query.locale
-      });
-      if (!entry?.definition) ctx.throw(404, "Form not found");
-      ctx.body = publicForm(entry);
-    },
-    async submit(ctx) {
-      const entry = await strapi.documents(FORM_UID).findFirst({
-        filters: { slug: ctx.params.slug },
-        status: "published",
-        locale: ctx.query.locale
-      });
-      if (!entry?.definition) ctx.throw(404, "Form not found");
-      const values = sanitizeRawValues(ctx.request.body?.values);
-      if (!values || !Object.keys(values).length) ctx.throw(422, "Invalid submission");
-      const rawMeta = ctx.request.body?.meta ?? {};
-      const meta = {};
-      for (const key of ["pagePath", "pageUrl", "originPath", "originLabel", "source"]) {
-        const v = rawMeta[key];
-        if (typeof v === "string" && v) meta[key] = v.slice(0, 500);
-      }
-      const outcome = await strapi.plugin("hubspot").service("forms").submit(entry, values, meta);
-      if (!outcome.ok) {
-        ctx.status = 422;
-        ctx.body = { ok: false, missingRequired: outcome.missingRequired ?? [] };
-        return;
+  forms: ({ strapi }) => {
+    const limits = strapi.plugin("hubspot").config("forms", {});
+    const submitLimiter = createLimiter({
+      windowMs: 6e4,
+      max: limits.rateLimit?.submitPerMinute ?? 6
+    });
+    return {
+      /** Published form for the host frontend — CRM mapping stripped. */
+      async findOne(ctx) {
+        const entry = await strapi.documents(FORM_UID).findFirst({
+          filters: { slug: ctx.params.slug },
+          status: "published",
+          locale: ctx.query.locale
+        });
+        if (!entry?.definition) ctx.throw(404, "Form not found");
+        ctx.body = publicForm(entry);
+      },
+      async submit(ctx) {
+        const entry = await strapi.documents(FORM_UID).findFirst({
+          filters: { slug: ctx.params.slug },
+          status: "published",
+          locale: ctx.query.locale
+        });
+        if (!entry?.definition) ctx.throw(404, "Form not found");
+        if (!submitLimiter.allow(ctx.request.ip ?? "unknown")) {
+          ctx.throw(429, "Too many submissions — try again in a minute.");
+        }
+        const values = sanitizeRawValues(ctx.request.body?.values);
+        if (!values || !Object.keys(values).length) ctx.throw(422, "Invalid submission");
+        const rawMeta = ctx.request.body?.meta ?? {};
+        const meta = {};
+        for (const key of ["pagePath", "pageUrl", "originPath", "originLabel", "source"]) {
+          const v = rawMeta[key];
+          if (typeof v === "string" && v) meta[key] = v.slice(0, 500);
+        }
+        const outcome = await strapi.plugin("hubspot").service("forms").submit(entry, values, meta);
+        if (!outcome.ok) {
+          ctx.status = 422;
+          ctx.body = { ok: false, missingRequired: outcome.missingRequired ?? [] };
+          return;
+        }
+        ctx.body = { ok: true, hubspotSynced: outcome.hubspotSynced };
       }
-      ctx.body = { ok: true, hubspotSynced: outcome.hubspotSynced };
-    }
-  }),
+    };
+  },
   settings: ({ strapi }) => ({
     async get(ctx) {
       ctx.body = await publicSettings(strapi);

package/dist/server/src/__tests__/contract.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/src/__tests__/rateLimit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/src/company.d.ts

@@ -70,6 +70,11 @@ export declare function pickSiret(payload: SearchPayload, siret: string): Compan
  * `companyMap`. Only complete mappings with an actual value produce a write.
  */
 export declare function companyProperties(map: CompanyMap, hit: CompanyHit): Record<string, Record<string, Primitive>>;
+/**
+ * A pasted identifier survives its formatting: "798 841 284 00010" queries as
+ * a SIRET, "798.841.284" as a SIREN. Anything else is a plain text query.
+ */
+export declare function normalizeQuery(q: string): string;
 /** Autocomplete search. Bounded, cached; empty on any failure. */
 export declare function searchCompanies(q: string): Promise<CompanyHit[]>;
 /** Authoritative re-resolution of a selected SIRET; null when unreachable. */

package/dist/server/src/index.d.ts

@@ -10,6 +10,10 @@ declare const _default: {
             forms: {
                 companyFromDomain: boolean;
                 timelineNote: boolean;
+                rateLimit: {
+                    submitPerMinute: number;
+                    searchPerMinute: number;
+                };
             };
         };
         validator(cfg: {
@@ -27,7 +31,6 @@ declare const _default: {
                     displayName: string;
                     description: string;
                 };
-                /** RBAC action gating the settings screen and its routes. */
                 options: {
                     draftAndPublish: boolean;
                 };
@@ -36,7 +39,7 @@ declare const _default: {
                         visible: boolean;
                     };
                     "content-type-builder": {
-                        visible: boolean;
+                        visible: boolean; /** RBAC action gating the form builder and its routes. */
                     };
                     i18n: {
                         localized: boolean;
@@ -265,13 +268,19 @@ declare const _default: {
             duplicate(ctx: import("./formsAdmin").Ctx): Promise<void>;
             remove(ctx: import("./formsAdmin").Ctx): Promise<void>;
         };
-        company: () => {
+        company: ({ strapi }: {
+            strapi: Core.Strapi;
+        }) => {
             /** SIRENE autocomplete for the company field — bounded, cached upstream. */
             search(ctx: {
                 query: {
                     q?: string;
                 };
+                request: {
+                    ip?: string;
+                };
                 body: unknown;
+                throw: (s: number, m: string) => never;
             }): Promise<void>;
         };
         submissions: ({ strapi }: {

package/dist/server/src/rateLimit.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory sliding-window rate limiter for the public routes. Per-process on
+ * purpose: a form submission endpoint needs a cheap brake against a single
+ * abusive IP, not distributed accounting — and a multi-instance deployment
+ * simply multiplies the budget by the instance count, which is fine.
+ */
+export interface Limiter {
+    /** True when the call fits the window; false = refuse (429). */
+    allow(key: string): boolean;
+    /** Number of tracked keys — a test hook for the sweep. */
+    size(): number;
+}
+export declare function createLimiter({ windowMs, max, now, }: {
+    windowMs: number;
+    /** 0 disables the limiter entirely. */
+    max: number;
+    now?: () => number;
+}): Limiter;