Plans

What’s shipped, what’s actively planned, and what’s explicitly deferred. See CHANGELOG.md for the full release history.

Shipped

  • Input validation — required fields, per-type constraints (min_length/ max_length, min/max/step, pattern, one_of, min_selected/ max_selected, matches_field/differs_from) and per-constraint custom messages, enforced server-side before relay.
  • Enriched field model — text, email, url, tel, number, date, select, radios, checkboxes, checkbox, hidden, textarea, with labels, help/hint text, placeholders, defaults, and normalized options. See the Field Model reference.
  • Multi-value submissions — repeated keys from checkboxes/multi-select are preserved end to end (validation, mapping, and every relay output).
  • Restricted server-side templating — {{ ... }} expressions in output subject/to/static/headers/username/password, with a locked function whitelist and {{ env.NAME }} as the canonical secrets mechanism.
  • Accessible HTML rendering — form html / form.RenderHTML renders the full field model as semantic, ARIA-wired markup.
  • Config JSON Schema — form schema / task generate:schema emits a JSON Schema for editor completion against the config file.
  • Strict config parsing — unknown/misspelled keys fail at parse time instead of being silently ignored (config validate catches this).
  • Relay targets — email (Amazon SES), smtp (external SMTP server), http_post (generic webhook), and salesforce_web2lead.
  • Multi-destination fan-out — one submission relays to every configured output simultaneously.
  • Captcha / spam prevention — reCAPTCHA v2/v3, hCaptcha, and Cloudflare Turnstile, verified server-side per form.

Full details on this body of work are in the Form Config v1 plan. That work shipped as the 0.2.x line.

Next — 0.3.x: Public Endpoint MVP

The active milestone: the smallest set of changes that make the endpoint safe to expose publicly, chosen so the whole milestone adds no ongoing or fixed infrastructure cost (all within AWS’s perpetual free tier). Four items:

  • CORS configuration — a SAM origin allowlist so fetch embeds work and only known sites may POST.
  • Stage throttling — a global request cap on the HTTP API, capping total Lambda/SES/downstream cost.
  • Per-output on_error — one failing optional output no longer 500s the whole submission.
  • Honeypot — silently drop obvious bot submissions.

Full plan: Public Endpoint MVP (0.3.x).

0.4.x and later — Production Hardening backlog

The remainder of the hardening work, deferred so 0.3.x stays lean:

  • Submission durability (highest priority) — async relay via SQS + a worker Lambda (retries + DLQ), or an S3 spool + retrier, so a hard-failed required output never drops user data. SQS is SAM-native and effectively free at low volume; the A-vs-B decision is captured in the hardening plan.
  • AWS WAF per-IP rate rule — stops single-IP floods (carries WAF’s own ongoing cost, so gated on need).
  • Min-fill signed token and success redirect — anti-automation provenance and a sane post-POST landing for full-page forms.
  • Operational should-fix — secrets in SSM/Secrets Manager, SES production access, gating gosec/govulncheck in CI, and deploy-time config validation.

Full backlog: Production Hardening (0.4.x+).

Later — nice-to-haves

  • S3 archival — write each submission to an S3 bucket for audit purposes (today this requires an intermediate http_post target; see the fan-out how-to).
  • Custom domain — SAM parameter and Route 53 record for a custom API URL.
  • Dashboard — lightweight admin page showing recent submissions.
  • SDKs — a small JavaScript helper for sending form data as JSON.
  • Terraform module — alternative IaC path alongside SAM.

Deferred — explicit non-goals for Form Config v1

These were scoped out of the Form Config v1 plan and remain un-implemented, each a candidate for its own future plan: conditions, container elements (group/columns/details/page), composites/parts, repeat, computed fields, file/signature uploads, multi-page forms, i18n, grouped options/options_from, and the expanded handler execution model (on_error, retry, per-handler conditions.run). The config format also stays application/x-www-form-urlencoded only — no multipart, no file uploads.

Open an issue on GitLab to discuss or prioritize any of these.