@bygghammar/cms-platform 0.19.2 → 0.21.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.19.2",
+  "version": "0.21.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": false,
@@ -107,7 +107,9 @@
     "./server/guards": "./src/server/guards.ts",
     "./server/redirects-core": "./src/server/redirects-core.ts",
     "./server/page-seo-core": "./src/server/page-seo-core.ts",
-    "./server/media-cleanup-core": "./src/server/media-cleanup-core.ts"
+    "./server/media-cleanup-core": "./src/server/media-cleanup-core.ts",
+    "./server/media-usage-core": "./src/server/media-usage-core.ts",
+    "./server/forms-core": "./src/server/forms-core.ts"
   },
   "dependencies": {
     "fflate": "^0.8.3"
@@ -180,4 +182,4 @@
       "optional": true
     }
   }
-}
+}

package/src/server/forms-core.ts

@@ -0,0 +1,820 @@
+/**
+ * Host-agnostic forms server core.
+ *
+ * Every rule that governs form definitions — settings resolution, notification
+ * routing, snapshots, the audit trail and the definition CRUD/version flow —
+ * lives here so that every site behaves identically. Hosts supply a Supabase
+ * compatible client plus the acting user; nothing site-specific is referenced.
+ *
+ * Data-safety invariants preserved here:
+ *  - submissions are never touched by definition changes
+ *  - a field key that already has stored answers can never be removed
+ *  - snapshots and audit entries never block the write they describe
+ */
+import {
+  defaultFieldsFor,
+  mergeFields,
+  type FormDefaults,
+  type FormFieldDef,
+  type FormPrivateSettings,
+  type FormPublicSettings,
+} from "../forms/field-sets";
+import { EMAIL_RE, evaluateRule, normalizePolicyUrl } from "../forms/conditions";
+import { diffForms, summarizeChanges, type FormAuditChange } from "../forms/form-audit";
+import { actorEmail, assertStaff, type PlatformAuthContext } from "./guards";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+export type FormsDb = any;
+
+export type FormsContext = PlatformAuthContext & { supabase: FormsDb };
+
+/* ------------------------------ pure helpers ------------------------------ */
+
+export const pickText = (a: string | undefined | null, b: string | undefined | null) =>
+  (a ?? "").trim() || (b ?? "").trim();
+
+export const pickLocalized = (
+  a: Record<string, string> | undefined,
+  b: Record<string, string> | undefined,
+  locale: string,
+) => {
+  const from = (m?: Record<string, string>) =>
+    (m?.[locale] ?? m?.["sv"] ?? m?.["en"] ?? "").toString().trim();
+  return from(a) || from(b);
+};
+
+/** Everything the submit path needs, with per-form overrides applied. */
+export function effectiveSettings(
+  form: { public_settings: unknown; private_settings: unknown },
+  defaults: FormDefaults | null,
+) {
+  const pub = (form.public_settings ?? {}) as FormPublicSettings;
+  const priv = (form.private_settings ?? {}) as FormPrivateSettings;
+  return {
+    pub,
+    priv,
+    requireConsent: pub.requireConsent !== false,
+    honeypot: defaults?.spam_honeypot !== false,
+    minSeconds: priv.spamMinSeconds ?? defaults?.spam_min_seconds ?? 3,
+    maxPerHour: priv.spamMaxPerHour ?? defaults?.spam_max_per_hour ?? 0,
+    notifyEnabled: priv.notifyEnabled ?? defaults?.notify_enabled ?? true,
+    notifyTo: pickText(priv.notifyTo, defaults?.notify_to),
+    notifyFromName: pickText(priv.notifyFromName, defaults?.notify_from_name),
+    notifyFromEmail: pickText(priv.notifyFromEmail, defaults?.notify_from_email),
+    notifyReplyTo: pickText(priv.notifyReplyTo, defaults?.notify_reply_to),
+    notificationRules: (priv.notificationRules ?? []).filter((r) => r && r.enabled !== false),
+    autoreplyEnabled: priv.autoreplyEnabled ?? defaults?.autoreply_enabled ?? false,
+    sheetId: pickText(priv.sheetId, defaults?.sheet_id),
+    sheetTab: pickText(priv.sheetTab, defaults?.sheet_tab) || "Sheet1",
+    sheetLive: priv.sheetLiveAppend ?? defaults?.sheet_live_append ?? false,
+    savePartials: priv.savePartials ?? defaults?.save_partials ?? true,
+    retentionDays: defaults?.retention_days ?? 0,
+    webhookUrl: (priv.webhookUrl ?? "").trim(),
+    webhookSecret: (priv.webhookSecret ?? "").trim(),
+    webhookEnabled: priv.webhookEnabled !== false && !!(priv.webhookUrl ?? "").trim(),
+  };
+}
+
+export type EffectiveSettings = ReturnType<typeof effectiveSettings>;
+
+/**
+ * Resolve who gets the admin notification for one submission.
+ * Conditional rules add recipients; an "exclusive" match replaces the
+ * standard recipient list entirely (routing instead of copying).
+ */
+export function resolveRecipients(
+  eff: EffectiveSettings,
+  values: Record<string, string>,
+): string {
+  const matched = eff.notificationRules.filter((r) => evaluateRule(r.when, values));
+  const exclusive = matched.filter((r) => r.exclusive);
+  const list = exclusive.length
+    ? exclusive.map((r) => r.to)
+    : [eff.notifyTo, ...matched.map((r) => r.to)];
+  return list.filter(Boolean).join(",");
+}
+
+/** Localized notification subject/body with per-form override then defaults. */
+export function notificationTemplate(
+  eff: EffectiveSettings,
+  defaults: FormDefaults | null,
+  locale: string,
+) {
+  return {
+    subject: pickLocalized(
+      eff.priv.notifySubject as Record<string, string> | undefined,
+      defaults?.notify_subject as Record<string, string> | undefined,
+      locale,
+    ),
+    body: pickLocalized(
+      eff.priv.notifyBody as Record<string, string> | undefined,
+      defaults?.notify_body as Record<string, string> | undefined,
+      locale,
+    ),
+  };
+}
+
+/** Best guess at the submitter's own address: typed email field, then any value. */
+export function submitterEmail(
+  fields: FormFieldDef[],
+  payload: Record<string, string>,
+): string {
+  const emailField = fields.find((f) => f.enabled && f.type === "email");
+  const direct = emailField ? payload[emailField.key] : "";
+  if (direct) return direct;
+  return Object.values(payload).find((v) => EMAIL_RE.test(v)) ?? "";
+}
+
+/** One spreadsheet row for a submission, column order fixed by the field list. */
+export function sheetRow(
+  createdAt: string,
+  formKey: string,
+  locale: string,
+  fields: FormFieldDef[],
+  payload: Record<string, string>,
+) {
+  return [
+    createdAt,
+    formKey,
+    locale,
+    ...fields.filter((f) => f.enabled).map((f) => payload[f.key] ?? ""),
+  ];
+}
+
+/** Collect every `formKey` referenced anywhere inside a block tree. */
+export function collectFormKeys(value: unknown, out: Set<string>) {
+  if (!value || typeof value !== "object") return;
+  if (Array.isArray(value)) {
+    for (const v of value) collectFormKeys(v, out);
+    return;
+  }
+  const obj = value as Record<string, unknown>;
+  if (typeof obj["formKey"] === "string" && obj["formKey"]) out.add(obj["formKey"] as string);
+  for (const v of Object.values(obj)) collectFormKeys(v, out);
+}
+
+/** Field keys that already carry stored answers, from a set of payloads. */
+export function usedFieldKeys(payloads: Array<Record<string, unknown> | null | undefined>) {
+  const used = new Set<string>();
+  for (const payload of payloads) {
+    for (const [k, v] of Object.entries((payload ?? {}) as Record<string, unknown>)) {
+      if (v !== "" && v != null) used.add(k);
+    }
+  }
+  return used;
+}
+
+/* ------------------------- audit + delivery logging ------------------------ */
+
+/**
+ * Append one entry to the shared audit trail. Auditing must never block the
+ * write it describes, so failures are logged and swallowed.
+ */
+export async function logFormAuditCore(
+  context: FormsContext,
+  action: string,
+  entityId: string | null,
+  meta: Record<string, unknown>,
+) {
+  try {
+    await context.supabase.from("audit_logs").insert({
+      actor_id: context.userId,
+      actor_email: actorEmail(context),
+      action,
+      entity: "forms",
+      entity_id: entityId,
+      meta: meta as never,
+    });
+  } catch (e) {
+    console.error("[forms] audit", e);
+  }
+}
+
+export type DeliveryLogEntry = {
+  submissionId?: string | null;
+  formKey: string;
+  channel: "notification" | "autoreply" | "sheet" | "webhook";
+  ok: boolean;
+  target?: string | null;
+  error?: string | null;
+  attempt?: number;
+  durationMs?: number | null;
+  meta?: Record<string, unknown>;
+};
+
+/**
+ * Append-only diagnostics for one delivery attempt. Failures here must never
+ * affect the submission itself, so everything is swallowed.
+ */
+export async function logDeliveryCore(db: FormsDb, entry: DeliveryLogEntry) {
+  try {
+    await db.from("form_delivery_attempts").insert({
+      submission_id: entry.submissionId ?? null,
+      form_key: entry.formKey,
+      channel: entry.channel,
+      status: entry.ok ? "ok" : "failed",
+      target: (entry.target ?? "").slice(0, 400) || null,
+      error: entry.error ? entry.error.slice(0, 1000) : null,
+      attempt: entry.attempt ?? 1,
+      duration_ms: entry.durationMs ?? null,
+      meta: (entry.meta ?? {}) as never,
+      resolved_at: entry.ok ? new Date().toISOString() : null,
+    } as never);
+    // A successful attempt closes every earlier failure on the same channel.
+    if (entry.ok && entry.submissionId) {
+      await db
+        .from("form_delivery_attempts")
+        .update({ resolved_at: new Date().toISOString() } as never)
+        .eq("submission_id", entry.submissionId)
+        .eq("channel", entry.channel)
+        .eq("status", "failed")
+        .is("resolved_at", null);
+    }
+  } catch (e) {
+    console.error("[forms] logDelivery", e);
+  }
+}
+
+/* ------------------------------- definitions ------------------------------ */
+
+export type FormRowCore = {
+  id: string;
+  key: string;
+  name: string;
+  form_type: string;
+  is_active: boolean;
+  fields: FormFieldDef[];
+  public_settings: FormPublicSettings;
+  private_settings: FormPrivateSettings;
+  updated_at: string;
+  submissions: number;
+  newSubmissions: number;
+  lastSubmissionAt: string | null;
+  /** Field keys that already have stored answers — never deletable. */
+  usedFieldKeys: string[];
+};
+
+export async function listFormsCore(context: FormsContext): Promise<FormRowCore[]> {
+  await assertStaff(context);
+  const { data, error } = await context.supabase
+    .from("forms")
+    .select("*")
+    .is("deleted_at", null)
+    .order("name", { ascending: true });
+  if (error) throw new Error(error.message);
+
+  const { data: subs } = await context.supabase
+    .from("form_submissions")
+    .select("form_key, status, created_at, payload")
+    .order("created_at", { ascending: false })
+    .limit(5000);
+
+  const counts = new Map<string, number>();
+  const news = new Map<string, number>();
+  const last = new Map<string, string>();
+  const used = new Map<string, Set<string>>();
+  for (const s of subs ?? []) {
+    counts.set(s.form_key, (counts.get(s.form_key) ?? 0) + 1);
+    if (s.status === "new") news.set(s.form_key, (news.get(s.form_key) ?? 0) + 1);
+    if (!last.has(s.form_key)) last.set(s.form_key, s.created_at);
+    const set = used.get(s.form_key) ?? new Set<string>();
+    for (const k of usedFieldKeys([s.payload as Record<string, unknown>])) set.add(k);
+    used.set(s.form_key, set);
+  }
+
+  return (data ?? []).map((r: any) => ({
+    id: r.id,
+    key: r.key,
+    name: r.name,
+    form_type: r.form_type,
+    is_active: r.is_active,
+    fields: mergeFields(r.form_type, r.fields),
+    public_settings: (r.public_settings ?? {}) as FormPublicSettings,
+    private_settings: (r.private_settings ?? {}) as FormPrivateSettings,
+    updated_at: r.updated_at,
+    submissions: counts.get(r.key) ?? 0,
+    newSubmissions: news.get(r.key) ?? 0,
+    lastSubmissionAt: last.get(r.key) ?? null,
+    usedFieldKeys: Array.from(used.get(r.key) ?? []),
+  }));
+}
+
+/**
+ * Store an immutable snapshot of a form definition. Snapshots are the
+ * rollback surface: they never contain submissions, only the definition.
+ */
+export async function snapshotFormCore(
+  context: FormsContext,
+  form: {
+    id?: string;
+    key: string;
+    name: string;
+    form_type: string;
+    fields: unknown;
+    public_settings: unknown;
+    private_settings: unknown;
+  },
+  note: string,
+) {
+  try {
+    const { data: last } = await context.supabase
+      .from("form_versions")
+      .select("version_no, fields, public_settings, private_settings, name")
+      .eq("form_key", form.key)
+      .order("version_no", { ascending: false })
+      .limit(1)
+      .maybeSingle();
+
+    // Skip no-op saves so history stays readable.
+    if (last) {
+      const same =
+        JSON.stringify(last.fields) === JSON.stringify(form.fields) &&
+        JSON.stringify(last.public_settings) === JSON.stringify(form.public_settings) &&
+        JSON.stringify(last.private_settings) === JSON.stringify(form.private_settings) &&
+        last.name === form.name;
+      if (same) return;
+    }
+
+    await context.supabase.from("form_versions").insert({
+      form_id: form.id ?? null,
+      form_key: form.key,
+      version_no: (last?.version_no ?? 0) + 1,
+      name: form.name,
+      form_type: form.form_type,
+      fields: form.fields as never,
+      public_settings: form.public_settings as never,
+      private_settings: form.private_settings as never,
+      note,
+      created_by: context.userId,
+      created_by_email: actorEmail(context),
+    });
+  } catch (e) {
+    // History must never block saving the form itself.
+    console.error("[forms] snapshotForm", e);
+  }
+}
+
+export type SaveFormInput = {
+  id?: string;
+  key: string;
+  name: string;
+  form_type: string;
+  is_active: boolean;
+  fields: Array<Record<string, unknown>>;
+  public_settings: Record<string, unknown>;
+  private_settings: Record<string, unknown>;
+};
+
+export async function saveFormCore(
+  context: FormsContext,
+  data: SaveFormInput,
+): Promise<{ id: string }> {
+  await assertStaff(context);
+
+  // Never allow a field key that already has answers to disappear.
+  let before: Record<string, unknown> | null = null;
+  if (data.id) {
+    const { data: existing } = await context.supabase
+      .from("forms")
+      .select("*")
+      .eq("id", data.id)
+      .maybeSingle();
+    before = (existing as Record<string, unknown> | null) ?? null;
+    if (existing?.key) {
+      const { data: subs } = await context.supabase
+        .from("form_submissions")
+        .select("payload")
+        .eq("form_key", existing.key)
+        .limit(2000);
+      const used = usedFieldKeys((subs ?? []).map((s: any) => s.payload));
+      const kept = new Set(data.fields.map((f) => String((f as { key?: unknown }).key ?? "")));
+      const dropped = Array.from(used).filter((k) => !kept.has(k));
+      if (dropped.length) {
+        throw new Error(
+          `These fields already have submissions and cannot be removed: ${dropped.join(", ")}. Disable them instead.`,
+        );
+      }
+    }
+  }
+
+  const row = {
+    key: data.key,
+    name: data.name,
+    form_type: data.form_type,
+    is_active: data.is_active,
+    fields: data.fields as never,
+    public_settings: data.public_settings as never,
+    private_settings: data.private_settings as never,
+  };
+  const q = data.id
+    ? context.supabase.from("forms").update(row).eq("id", data.id).select("*").single()
+    : context.supabase.from("forms").insert(row).select("*").single();
+  const { data: saved, error } = await q;
+  if (error) throw new Error(error.message);
+
+  await snapshotFormCore(context, saved, data.id ? "Saved" : "Created");
+  const changes = diffForms(before as never, {
+    key: data.key,
+    name: data.name,
+    form_type: data.form_type,
+    is_active: data.is_active,
+    fields: data.fields,
+    public_settings: data.public_settings,
+    private_settings: data.private_settings,
+  } as never);
+  await logFormAuditCore(context, data.id ? "form.update" : "form.create", saved.id as string, {
+    key: data.key,
+    name: data.name,
+    changes,
+    summary: summarizeChanges(changes),
+    fieldKeys: changes.filter((c) => c.scope === "field" && c.key).map((c) => c.key),
+  });
+  return { id: saved.id as string };
+}
+
+export type FormUsageCore = { pages: string[]; globalSections: string[] };
+
+/** Where a form is referenced on the site (pages + global sections). */
+export async function getFormUsageCore(
+  context: FormsContext,
+  key: string,
+): Promise<FormUsageCore> {
+  await assertStaff(context);
+  const pages: string[] = [];
+  const globalSections: string[] = [];
+
+  const { data: pageRows } = await context.supabase
+    .from("pages")
+    .select("name, key, current_version_id")
+    .is("deleted_at", null);
+  const versionIds = (pageRows ?? [])
+    .map((p: any) => p.current_version_id)
+    .filter(Boolean) as string[];
+  if (versionIds.length) {
+    const { data: versions } = await context.supabase
+      .from("page_versions")
+      .select("id, blocks")
+      .in("id", versionIds);
+    const byId = new Map((versions ?? []).map((v: any) => [v.id, v.blocks]));
+    for (const p of pageRows ?? []) {
+      const keys = new Set<string>();
+      collectFormKeys(byId.get(p.current_version_id), keys);
+      if (keys.has(key)) pages.push(p.name ?? p.key);
+    }
+  }
+
+  const { data: sections } = await context.supabase
+    .from("global_sections")
+    .select("name, key, current_version_id");
+  const gIds = (sections ?? []).map((s: any) => s.current_version_id).filter(Boolean) as string[];
+  if (gIds.length) {
+    const { data: gVersions } = await context.supabase
+      .from("global_section_versions")
+      .select("id, blocks")
+      .in("id", gIds);
+    const byId = new Map((gVersions ?? []).map((v: any) => [v.id, v.blocks]));
+    for (const s of sections ?? []) {
+      const keys = new Set<string>();
+      collectFormKeys(byId.get(s.current_version_id), keys);
+      if (keys.has(key)) globalSections.push(s.name ?? s.key);
+    }
+  }
+
+  return { pages, globalSections };
+}
+
+/** Soft delete: moves the form to the bin. Submissions are never touched. */
+export async function deleteFormCore(context: FormsContext, id: string) {
+  await assertStaff(context);
+  const email = actorEmail(context);
+  const { data: form } = await context.supabase
+    .from("forms")
+    .select("key, name")
+    .eq("id", id)
+    .maybeSingle();
+  const { error } = await context.supabase
+    .from("forms")
+    .update({
+      deleted_at: new Date().toISOString(),
+      deleted_by: context.userId,
+      deleted_by_email: email,
+      is_active: false,
+    })
+    .eq("id", id)
+    .is("deleted_at", null);
+  if (error) throw new Error(error.message);
+  await logFormAuditCore(context, "form.soft_delete", id, {
+    key: form?.key ?? null,
+    name: form?.name ?? null,
+  });
+  return { ok: true as const };
+}
+
+export type DeletedFormRowCore = {
+  id: string;
+  key: string;
+  name: string;
+  form_type: string;
+  deleted_at: string;
+  deleted_by_email: string | null;
+};
+
+export async function listDeletedFormsCore(
+  context: FormsContext,
+): Promise<{ rows: DeletedFormRowCore[]; canPurge: boolean }> {
+  await assertStaff(context);
+  const { data, error } = await context.supabase
+    .from("forms")
+    .select("id, key, name, form_type, deleted_at, deleted_by_email")
+    .not("deleted_at", "is", null)
+    .order("deleted_at", { ascending: false });
+  if (error) throw new Error(error.message);
+  const { data: isSuper } = await context.supabase.rpc("has_role", {
+    _user_id: context.userId,
+    _role: "superadmin",
+  });
+  return { rows: (data ?? []) as DeletedFormRowCore[], canPurge: !!isSuper };
+}
+
+export async function restoreFormCore(context: FormsContext, id: string) {
+  await assertStaff(context);
+  const { data: form } = await context.supabase
+    .from("forms")
+    .select("key, name")
+    .eq("id", id)
+    .maybeSingle();
+  const { error } = await context.supabase
+    .from("forms")
+    .update({ deleted_at: null, deleted_by: null, deleted_by_email: null })
+    .eq("id", id);
+  if (error) throw new Error(error.message);
+  await logFormAuditCore(context, "form.restore", id, {
+    key: form?.key ?? null,
+    name: form?.name ?? null,
+  });
+  return { ok: true as const };
+}
+
+/** Permanent delete from the bin — superadmin only. Submissions are kept. */
+export async function purgeFormCore(context: FormsContext, id: string) {
+  await assertStaff(context);
+  const { data: isSuper, error: roleErr } = await context.supabase.rpc("has_role", {
+    _user_id: context.userId,
+    _role: "superadmin",
+  });
+  if (roleErr) throw new Error(roleErr.message);
+  if (!isSuper) throw new Error("Only a superadmin can permanently delete forms");
+  const { data: form } = await context.supabase
+    .from("forms")
+    .select("key, name, deleted_at")
+    .eq("id", id)
+    .maybeSingle();
+  if (!form?.deleted_at) throw new Error("Move the form to the bin first");
+  // Submissions keep their form_key; the FK is ON DELETE SET NULL so
+  // customer data is never removed with the form definition.
+  const { error } = await context.supabase.from("forms").delete().eq("id", id);
+  if (error) throw new Error(error.message);
+  await logFormAuditCore(context, "form.purge", id, { key: form.key, name: form.name });
+  return { ok: true as const };
+}
+
+export async function createFormFromTypeCore(
+  context: FormsContext,
+  data: { key: string; name: string; form_type: string },
+): Promise<{ id: string }> {
+  await assertStaff(context);
+  const { data: saved, error } = await context.supabase
+    .from("forms")
+    .insert({
+      key: data.key,
+      name: data.name,
+      form_type: data.form_type,
+      fields: defaultFieldsFor(data.form_type) as never,
+      public_settings: {} as never,
+      private_settings: {} as never,
+    })
+    .select("id")
+    .single();
+  if (error) throw new Error(error.message);
+  await logFormAuditCore(context, "form.create", saved.id as string, {
+    key: data.key,
+    name: data.name,
+    summary: `Created ${data.form_type} form “${data.name}”`,
+  });
+  return { id: saved.id as string };
+}
+
+/** Copy a form definition (settings + fields) under a new key. */
+export async function duplicateFormCore(
+  context: FormsContext,
+  data: { id: string; key: string; name: string },
+): Promise<{ id: string; key: string }> {
+  await assertStaff(context);
+  const { data: src, error: e1 } = await context.supabase
+    .from("forms")
+    .select("*")
+    .eq("id", data.id)
+    .single();
+  if (e1) throw new Error(e1.message);
+  const { data: saved, error } = await context.supabase
+    .from("forms")
+    .insert({
+      key: data.key,
+      name: data.name,
+      form_type: src.form_type,
+      is_active: false,
+      fields: src.fields,
+      public_settings: src.public_settings,
+      private_settings: src.private_settings,
+    })
+    .select("id")
+    .single();
+  if (error) throw new Error(error.message);
+  await logFormAuditCore(context, "form.duplicate", saved.id as string, {
+    key: data.key,
+    name: data.name,
+    from: src.key,
+    summary: `Duplicated “${src.name}” (${src.key}) as “${data.name}” (${data.key})`,
+  });
+  return { id: saved.id as string, key: data.key };
+}
+
+/* --------------------------------- defaults ------------------------------- */
+
+export async function getFormDefaultsCore(context: FormsContext): Promise<FormDefaults> {
+  await assertStaff(context);
+  const { data, error } = await context.supabase
+    .from("form_settings")
+    .select("*")
+    .eq("id", true)
+    .maybeSingle();
+  if (error) throw new Error(error.message);
+  return data as unknown as FormDefaults;
+}
+
+/** Read the site-wide defaults with no guard — used by the public submit path. */
+export async function loadFormDefaultsCore(db: FormsDb): Promise<FormDefaults | null> {
+  const { data } = await db.from("form_settings").select("*").eq("id", true).maybeSingle();
+  return (data as unknown as FormDefaults) ?? null;
+}
+
+export async function saveFormDefaultsCore(
+  context: FormsContext,
+  data: Record<string, unknown>,
+) {
+  await assertStaff(context);
+  const patch = { ...data };
+  if (typeof patch["privacy_policy_url"] === "string") {
+    patch["privacy_policy_url"] = normalizePolicyUrl(patch["privacy_policy_url"] as string);
+  }
+  const { data: before } = await context.supabase
+    .from("form_settings")
+    .select("*")
+    .eq("id", true)
+    .maybeSingle();
+  const { error } = await context.supabase
+    .from("form_settings")
+    .update(patch as never)
+    .eq("id", true);
+  if (error) throw new Error(error.message);
+  const prev = (before ?? {}) as Record<string, unknown>;
+  const changes: FormAuditChange[] = Object.keys(patch)
+    .filter((k) => JSON.stringify(prev[k] ?? null) !== JSON.stringify(patch[k] ?? null))
+    .map((k) => ({
+      scope: "settings" as const,
+      label: k,
+      from: JSON.stringify(prev[k] ?? null).slice(0, 160),
+      to: JSON.stringify(patch[k] ?? null).slice(0, 160),
+    }));
+  if (changes.length) {
+    await logFormAuditCore(context, "form.defaults.update", null, {
+      changes,
+      summary: summarizeChanges(changes),
+    });
+  }
+  return { ok: true as const };
+}
+
+/* --------------------------------- activity ------------------------------- */
+
+export type FormActivityRowCore = {
+  id: string;
+  action: string;
+  actor_email: string | null;
+  actor_id: string | null;
+  entity_id: string | null;
+  meta: any;
+  created_at: string;
+};
+
+/**
+ * Activity trail for forms. Without a key it returns every form-related event,
+ * which powers the module-level activity view.
+ */
+export async function listFormActivityCore(
+  context: FormsContext,
+  data: { formKey?: string; limit: number },
+): Promise<FormActivityRowCore[]> {
+  await assertStaff(context);
+  let q = context.supabase
+    .from("audit_logs")
+    .select("id, action, actor_email, actor_id, entity_id, meta, created_at")
+    .like("action", "form.%")
+    .order("created_at", { ascending: false })
+    .limit(data.limit);
+  if (data.formKey) q = q.eq("meta->>key", data.formKey);
+  const { data: rows, error } = await q;
+  if (error) throw new Error(error.message);
+  return (rows ?? []) as FormActivityRowCore[];
+}
+
+/* --------------------------------- versions ------------------------------- */
+
+export async function listFormVersionsCore(
+  context: FormsContext,
+  data: { formKey: string; limit: number },
+) {
+  await assertStaff(context);
+  const { data: rows, error } = await context.supabase
+    .from("form_versions")
+    .select("*")
+    .eq("form_key", data.formKey)
+    .order("version_no", { ascending: false })
+    .limit(data.limit);
+  if (error) throw new Error(error.message);
+  return (rows ?? []).map((r: any) => ({
+    ...r,
+    fields: mergeFields(r.form_type, r.fields),
+    public_settings: (r.public_settings ?? {}) as FormPublicSettings,
+    private_settings: (r.private_settings ?? {}) as FormPrivateSettings,
+  }));
+}
+
+/**
+ * Roll the live form back to an earlier snapshot. The current state is
+ * snapshotted first, so a rollback can itself always be undone, and field
+ * keys that already have answers are never dropped.
+ */
+export async function restoreFormVersionCore(
+  context: FormsContext,
+  versionId: string,
+): Promise<{ ok: true; carriedFields: string[] }> {
+  await assertStaff(context);
+  const { data: v, error } = await context.supabase
+    .from("form_versions")
+    .select("*")
+    .eq("id", versionId)
+    .single();
+  if (error) throw new Error(error.message);
+
+  const { data: form, error: e2 } = await context.supabase
+    .from("forms")
+    .select("*")
+    .eq("key", v.form_key)
+    .maybeSingle();
+  if (e2) throw new Error(e2.message);
+  if (!form) throw new Error("This form no longer exists.");
+
+  // Data safety: keep any field key that already has stored answers.
+  const { data: subs } = await context.supabase
+    .from("form_submissions")
+    .select("payload")
+    .eq("form_key", v.form_key)
+    .limit(2000);
+  const used = usedFieldKeys((subs ?? []).map((s: any) => s.payload));
+
+  const restored = mergeFields(v.form_type, v.fields);
+  const current = mergeFields(form.form_type, form.fields);
+  const keys = new Set(restored.map((f) => f.key));
+  const carried = current
+    .filter((f) => used.has(f.key) && !keys.has(f.key))
+    .map((f) => ({ ...f, enabled: false }));
+
+  await snapshotFormCore(context, form, `Auto-saved before rollback to v${v.version_no}`);
+
+  const { error: e3 } = await context.supabase
+    .from("forms")
+    .update({
+      name: v.name,
+      fields: [...restored, ...carried] as never,
+      public_settings: v.public_settings,
+      private_settings: v.private_settings,
+    })
+    .eq("id", form.id);
+  if (e3) throw new Error(e3.message);
+
+  await snapshotFormCore(
+    context,
+    {
+      ...form,
+      name: v.name,
+      fields: [...restored, ...carried],
+      public_settings: v.public_settings,
+      private_settings: v.private_settings,
+    },
+    `Rolled back to v${v.version_no}`,
+  );
+
+  return { ok: true as const, carriedFields: carried.map((f) => f.key) };
+}

package/src/server/media-usage-core.ts

@@ -0,0 +1,478 @@
+/**
+ * Host-agnostic media usage scanning, external-media import and reference
+ * rewriting.
+ *
+ * The scan walks every CMS-owned JSON column, matches the URLs it finds against
+ * the media library listing, and reports both library usage and importable
+ * external media. The host injects its clients, its storage provider and the
+ * facts only a site knows: the backoffice route prefix and the public path of a
+ * page key.
+ */
+import { variantSiblings } from "../media/srcset";
+import { cleanFileName, splitExt, uniqueFileName } from "../media/filename";
+import type { MediaImportResult, MediaUsage, MediaUsageReport } from "../media/usage-types";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/** Storage surface the usage tools need — satisfied by `getMediaStorage()`. */
+export type UsageStorage = {
+  list: () => Promise<Array<{ name: string; size?: number }>>;
+  download: (path: string) => Promise<Uint8Array>;
+  upload: (
+    path: string,
+    body: Uint8Array,
+    contentType: string,
+    options?: { upsert?: boolean },
+  ) => Promise<unknown>;
+  publicUrl: (path: string) => string;
+};
+
+export type MediaUsageHost = {
+  /** Reader client; RLS applies as the signed-in user. */
+  db: any;
+  storage: UsageStorage;
+  /** Backoffice route prefix, e.g. `/kontoret`. */
+  backofficePrefix?: string;
+  /** Public URL path for a CMS page key, when the site has one. */
+  pagePublicPath?: (pageKey: string) => string | undefined;
+};
+
+export type MediaImportHost = MediaUsageHost & {
+  /** Privileged client used to rewrite references across CMS content. */
+  admin: any;
+  /** User-Agent sent when fetching remote media. */
+  userAgent?: string;
+};
+
+const URL_RE = /https?:\/\/[^\s"'<>)]+/gi;
+const MEDIA_EXT_RE =
+  /\.(png|jpe?g|gif|webp|avif|svg|mp4|webm|mov|m4v|mp3|wav|ogg|pdf)(\?[^\s"'<>)]*)?$/i;
+
+function walk(value: unknown, onString: (s: string, path: string) => void, path = "") {
+  if (!value) return;
+  if (typeof value === "string") {
+    if (
+      value.length > 4 &&
+      (value.startsWith("http") || value.startsWith("/") || MEDIA_EXT_RE.test(value))
+    ) {
+      onString(value, path);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((v, i) => walk(v, onString, `${path}[${i}]`));
+    return;
+  }
+  if (typeof value === "object") {
+    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+      walk(v, onString, path ? `${path}.${k}` : k);
+    }
+  }
+}
+
+function extractUrlsFromString(s: string): string[] {
+  if (s.startsWith("/") && !s.startsWith("//")) return [s];
+  const matches = s.match(URL_RE);
+  return matches ?? (MEDIA_EXT_RE.test(s) ? [s] : []);
+}
+
+function safeDecodeURIComponent(value: string) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+function normalizeUrlPath(rawUrl: string, form: "NFC" | "NFD") {
+  try {
+    const url = new URL(rawUrl);
+    const pathname = url.pathname
+      .split("/")
+      .map((part) => encodeURIComponent(safeDecodeURIComponent(part).normalize(form)))
+      .join("/");
+    return `${url.origin}${pathname}${url.search}${url.hash}`;
+  } catch {
+    return null;
+  }
+}
+
+function encodeUrlPath(rawUrl: string) {
+  try {
+    const url = new URL(rawUrl);
+    const pathname = url.pathname
+      .split("/")
+      .map((part) => encodeURIComponent(safeDecodeURIComponent(part)))
+      .join("/");
+    return `${url.origin}${pathname}${url.search}${url.hash}`;
+  } catch {
+    return null;
+  }
+}
+
+/** WordPress exports link resized copies; the original is the same name without `-WxH`. */
+function removeWordPressSizeSuffix(rawUrl: string) {
+  try {
+    const url = new URL(rawUrl);
+    const decodedPath = url.pathname
+      .split("/")
+      .map((part) => safeDecodeURIComponent(part))
+      .join("/");
+    const originalPath = decodedPath.replace(/-\d+x\d+(\.[a-z0-9]+)$/i, "$1");
+    if (originalPath === decodedPath) return null;
+    const encodedPath = originalPath
+      .split("/")
+      .map((part) => encodeURIComponent(part))
+      .join("/");
+    return `${url.origin}${encodedPath}${url.search}${url.hash}`;
+  } catch {
+    return null;
+  }
+}
+
+/** Every spelling of a remote URL worth trying: encoding, unicode form, original size. */
+export function remoteUrlCandidates(rawUrl: string): string[] {
+  const candidates = new Set<string>();
+  const add = (candidate: string | null) => {
+    if (candidate) candidates.add(candidate);
+  };
+
+  const trimmed = rawUrl.trim();
+  add(trimmed);
+  add(encodeUrlPath(trimmed));
+  add(normalizeUrlPath(trimmed, "NFD"));
+  add(normalizeUrlPath(trimmed, "NFC"));
+
+  const original = removeWordPressSizeSuffix(trimmed);
+  add(original);
+  if (original) {
+    add(encodeUrlPath(original));
+    add(normalizeUrlPath(original, "NFD"));
+    add(normalizeUrlPath(original, "NFC"));
+  }
+
+  return Array.from(candidates);
+}
+
+async function fetchRemoteMedia(rawUrl: string, userAgent: string) {
+  let lastStatus: number | null = null;
+  let lastError: string | null = null;
+
+  const headers = {
+    "User-Agent": userAgent,
+    Accept:
+      "image/avif,image/webp,image/apng,image/svg+xml,image/*,video/*,application/pdf,*/*;q=0.8",
+  };
+
+  for (const url of remoteUrlCandidates(rawUrl)) {
+    try {
+      const response = await fetch(url, { headers, redirect: "follow" });
+      if (response.ok) return { response, resolvedUrl: url };
+      lastStatus = response.status;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : "Network error";
+    }
+  }
+
+  const reason = lastStatus ? `Fetch failed: ${lastStatus}` : (lastError ?? "Fetch failed");
+  return { error: `${reason} for ${rawUrl}` };
+}
+
+/** Scan every CMS content column and report which library files are used where. */
+export async function scanMediaUsageCore(host: MediaUsageHost): Promise<MediaUsageReport> {
+  const sb = host.db;
+  const prefix = host.backofficePrefix ?? "/kontoret";
+  const publicPathOf = host.pagePublicPath ?? (() => undefined);
+
+  const libPaths = new Set<string>();
+  for (const file of await host.storage.list()) libPaths.add(file.name);
+
+  const [sectionsR, pagesR, versionsR, gSectionsR, gVersionsR, seoR, templatesR] =
+    await Promise.all([
+      sb.from("content_sections").select("key, data"),
+      sb.from("pages").select("id, key, name, current_version_id"),
+      sb.from("page_versions").select("id, page_id, blocks"),
+      sb.from("global_sections").select("id, key, name, current_version_id"),
+      sb.from("global_section_versions").select("id, section_id, blocks"),
+      sb.from("page_seo").select("page_key, slugs, seo"),
+      sb.from("block_templates").select("id, name, block"),
+    ]);
+
+  const pageById = new Map<string, { key: string; name: string; current: string | null }>();
+  for (const page of pagesR.data ?? []) {
+    pageById.set(page.id, { key: page.key, name: page.name, current: page.current_version_id });
+  }
+
+  const globalSectionById = new Map<
+    string,
+    { key: string; name: string; current: string | null }
+  >();
+  for (const section of gSectionsR.data ?? []) {
+    globalSectionById.set(section.id, {
+      key: section.key,
+      name: section.name,
+      current: section.current_version_id,
+    });
+  }
+
+  const byPath: Record<string, MediaUsage[]> = {};
+  const externalMap = new Map<string, MediaUsage[]>();
+  const seen = new Set<string>();
+
+  /**
+   * The library only lists the primary variant of a responsive bundle, so a
+   * reference to any sibling width (`…-1200.webp`) must count on that primary.
+   */
+  const canonicalPath = (path: string) => {
+    const siblings = variantSiblings(path);
+    if (!siblings.length) return path;
+    const suffix = path.match(/-(\d+)\.webp$/i);
+    if (!suffix) return path;
+    const base = path.slice(0, path.length - suffix[0].length);
+    for (const width of [2560, 1920]) {
+      const candidate = `${base}-${width}.webp`;
+      if (libPaths.has(candidate)) return candidate;
+    }
+    return path;
+  };
+
+  const record = (rawUrl: string, jsonPath: string, usage: Omit<MediaUsage, "jsonPath">) => {
+    const url = rawUrl.trim();
+    if (!url) return;
+
+    let matched: string | null = null;
+    for (const path of libPaths) {
+      if (url.endsWith(`/${path}`) || url === path || url.endsWith(`/media/${path}`)) {
+        matched = path;
+        break;
+      }
+    }
+
+    const rec: MediaUsage = { ...usage, jsonPath };
+    if (matched) {
+      const target = canonicalPath(matched);
+      // One srcSet string references every width — count that as a single use.
+      const dedupeKey = `${target}|${usage.entity}|${usage.entityKey}|${jsonPath}`;
+      if (seen.has(dedupeKey)) return;
+      seen.add(dedupeKey);
+      (byPath[target] ||= []).push(rec);
+    } else if (MEDIA_EXT_RE.test(url.split("?")[0]!) || MEDIA_EXT_RE.test(url)) {
+      // Only real media files are importable — never link URLs (booking, pages…).
+      const usages = externalMap.get(url) ?? [];
+      usages.push(rec);
+      externalMap.set(url, usages);
+    }
+  };
+
+  for (const row of sectionsR.data ?? []) {
+    walk(row.data, (s, path) => {
+      for (const url of extractUrlsFromString(s)) {
+        record(url, path, {
+          entity: "section",
+          entityKey: row.key,
+          label: `Section: ${row.key}`,
+          editPath: `${prefix}/sections/${row.key}`,
+          publicPath: "/",
+        });
+      }
+    });
+  }
+
+  for (const version of versionsR.data ?? []) {
+    const page = pageById.get(version.page_id);
+    if (!page || page.current !== version.id) continue;
+    walk(version.blocks, (s, path) => {
+      for (const url of extractUrlsFromString(s)) {
+        record(url, path, {
+          entity: "page",
+          entityKey: page.key,
+          label: `Page: ${page.name}`,
+          editPath: `${prefix}/pages-builder/${page.key}`,
+          publicPath: publicPathOf(page.key),
+        });
+      }
+    });
+  }
+
+  for (const version of gVersionsR.data ?? []) {
+    const section = globalSectionById.get(version.section_id);
+    if (!section || section.current !== version.id) continue;
+    walk(version.blocks, (s, path) => {
+      for (const url of extractUrlsFromString(s)) {
+        record(url, path, {
+          entity: "global_section",
+          entityKey: section.key,
+          label: `Global block: ${section.name}`,
+          editPath: `${prefix}/global-sections/${section.key}`,
+        });
+      }
+    });
+  }
+
+  for (const row of seoR.data ?? []) {
+    walk(row.seo, (s, path) => {
+      for (const url of extractUrlsFromString(s)) {
+        record(url, `seo.${path}`, {
+          entity: "page_seo",
+          entityKey: row.page_key,
+          label: `SEO: ${row.page_key}`,
+          editPath: `${prefix}/seo/${row.page_key}`,
+          publicPath: publicPathOf(row.page_key),
+        });
+      }
+    });
+  }
+
+  for (const template of templatesR.data ?? []) {
+    walk(template.block, (s, path) => {
+      for (const url of extractUrlsFromString(s)) {
+        record(url, path, {
+          entity: "block_template",
+          entityKey: template.id,
+          label: `Template: ${template.name}`,
+          editPath: `${prefix}/pages-builder`,
+        });
+      }
+    });
+  }
+
+  const external = Array.from(externalMap.entries())
+    .map(([url, usages]) => ({ url, usages }))
+    .sort((a, b) => b.usages.length - a.usages.length);
+
+  return { byPath, external };
+}
+
+/** Replace every stored reference to `oldUrls` with `newUrl` across CMS content. */
+export async function rewriteMediaReferencesCore(
+  sb: any,
+  oldUrls: string[],
+  newUrl: string,
+): Promise<number> {
+  const targets = Array.from(new Set(oldUrls.map((u) => u.trim()).filter(Boolean)));
+  if (!targets.length) return 0;
+
+  let changes = 0;
+  const replaceDeep = (value: any): any => {
+    if (typeof value === "string") {
+      let out = value;
+      for (const t of targets) {
+        if (out.includes(t)) {
+          out = out.split(t).join(newUrl);
+          changes++;
+        }
+      }
+      return out;
+    }
+    if (Array.isArray(value)) return value.map(replaceDeep);
+    if (value && typeof value === "object") {
+      const next: Record<string, any> = {};
+      for (const [k, v] of Object.entries(value)) next[k] = replaceDeep(v);
+      return next;
+    }
+    return value;
+  };
+
+  const tables: Array<{ table: string; column: string; idColumn: string }> = [
+    { table: "content_sections", column: "data", idColumn: "key" },
+    { table: "page_versions", column: "blocks", idColumn: "id" },
+    { table: "global_section_versions", column: "blocks", idColumn: "id" },
+    { table: "page_seo", column: "seo", idColumn: "page_key" },
+    { table: "block_templates", column: "block", idColumn: "id" },
+  ];
+
+  for (const { table, column, idColumn } of tables) {
+    const { data: rows } = await sb.from(table).select(`${idColumn}, ${column}`);
+    for (const row of rows ?? []) {
+      const before = JSON.stringify(row[column] ?? null);
+      const updated = replaceDeep(row[column]);
+      const after = JSON.stringify(updated ?? null);
+      if (before === after) continue;
+      await sb
+        .from(table)
+        .update({ [column]: updated })
+        .eq(idColumn, row[idColumn]);
+    }
+  }
+
+  return changes;
+}
+
+async function sha256Hex(bytes: Uint8Array) {
+  const hash = await crypto.subtle.digest("SHA-256", bytes.slice().buffer as ArrayBuffer);
+  return Array.from(new Uint8Array(hash))
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/**
+ * Download a remote media file into the library under `imported/`, keeping its
+ * original filename for SEO, then repoint CMS references at the local copy.
+ * Identical bytes are never stored twice.
+ */
+export async function importRemoteUrlCore(
+  data: { url: string; filename?: string },
+  host: MediaImportHost,
+): Promise<MediaImportResult> {
+  const remote = await fetchRemoteMedia(
+    data.url,
+    host.userAgent ?? "Mozilla/5.0 (compatible; CmsMediaImporter/1.0)",
+  );
+  if ("error" in remote) {
+    return { path: "", url: "", skipped: true, error: remote.error ?? "Fetch failed" };
+  }
+
+  const contentType = remote.response.headers.get("content-type") ?? "application/octet-stream";
+  const buffer = new Uint8Array(await remote.response.arrayBuffer());
+  const urlObj = new URL(remote.resolvedUrl);
+  const rawName =
+    data.filename ||
+    urlObj.pathname.split("/").filter(Boolean).map(safeDecodeURIComponent).pop() ||
+    "imported-file";
+  const clean = cleanFileName(rawName, "imported-file");
+
+  const all = await host.storage.list();
+  const existing = all
+    .filter((f) => f.name.startsWith("imported/"))
+    .map((f) => ({ name: f.name.slice("imported/".length), size: f.size }));
+  const taken = new Set<string>(existing.map((f) => f.name));
+
+  const incomingHash = await sha256Hex(buffer);
+  const { base, ext } = splitExt(clean);
+  const family = new RegExp(
+    `^${base.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(-\\d+)?${ext.replace(/\./g, "\\.")}$`,
+  );
+  let duplicateOf: string | null = null;
+  for (const file of existing) {
+    if (!family.test(file.name)) continue;
+    if (typeof file.size === "number" && file.size > 0 && file.size !== buffer.byteLength) continue;
+    let bytes: Uint8Array;
+    try {
+      bytes = await host.storage.download(`imported/${file.name}`);
+    } catch {
+      continue;
+    }
+    if ((await sha256Hex(bytes)) === incomingHash) {
+      duplicateOf = `imported/${file.name}`;
+      break;
+    }
+  }
+
+  if (duplicateOf) {
+    const existingUrl = host.storage.publicUrl(duplicateOf);
+    const rewrittenDup = existingUrl
+      ? await rewriteMediaReferencesCore(host.admin, remoteUrlCandidates(data.url), existingUrl)
+      : 0;
+    return { path: duplicateOf, url: existingUrl, rewritten: rewrittenDup, deduped: true };
+  }
+
+  const path = `imported/${uniqueFileName(clean, taken)}`;
+  await host.storage.upload(path, buffer, contentType, { upsert: false });
+
+  const newUrl = host.storage.publicUrl(path);
+  const rewritten = newUrl
+    ? await rewriteMediaReferencesCore(host.admin, remoteUrlCandidates(data.url), newUrl)
+    : 0;
+
+  return { path, url: newUrl, rewritten };
+}