@bygghammar/cms-platform 0.37.0 → 0.38.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.38.0
+
+- Added `server/forms-submissions-core` — the whole submission lifecycle is now
+  shared: public form runtime, spam gates and server-side validation, storage,
+  all four delivery channels, drafts (partials), retention purge, delivery
+  diagnostics, retry/resolve, notification tests and the webhook ping. A site
+  keeps only zod validators plus its privileged client and request metadata.
+
 ## 0.37.0
 
 - Added `server/forms-delivery-core` — the full form submission delivery stack

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bygghammar/cms-platform",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Shared CMS platform: blocks, block types, i18n core, UI primitives and design-token contract used by every Bygghammar/Voyara site.",
   "type": "module",
   "sideEffects": false,
@@ -152,7 +152,8 @@
     "./server/provider-secrets": "./src/server/provider-secrets.ts",
     "./server/smtp": "./src/server/smtp.ts",
     "./server/email-send-core": "./src/server/email-send-core.ts",
-    "./server/forms-delivery-core": "./src/server/forms-delivery-core.ts"
+    "./server/forms-delivery-core": "./src/server/forms-delivery-core.ts",
+    "./server/forms-submissions-core": "./src/server/forms-submissions-core.ts"
   },
   "dependencies": {
     "fflate": "^0.8.3"

package/src/server/forms-submissions-core.ts

@@ -0,0 +1,1384 @@
+/**
+ * Host-agnostic forms *submission* server core.
+ *
+ * Everything that happens after a visitor presses "send" lives here: spam
+ * gates, server-side validation, storage, the four delivery channels, drafts
+ * (partials), retention purge, delivery diagnostics and the test/retry tools.
+ * Hosts supply a privileged database client (and, for staff reads, their auth
+ * context); nothing site-specific is referenced.
+ *
+ * Data-safety invariants preserved here:
+ *  - a stored submission is never deleted by a delivery failure
+ *  - drafts live in their own table and can never overwrite a submission
+ *  - retention purge always supports a dry run and never runs automatically
+ */
+import {
+  appendToSheetCore,
+  notifySubmissionCore,
+  postWebhookCore,
+  renderHeader,
+  renderTemplate,
+  sendAutoreplyCore,
+  templateTokens,
+} from "./forms-delivery-core";
+import {
+  effectiveSettings,
+  loadFormDefaultsCore,
+  logDeliveryCore,
+  notificationTemplate,
+  pickLocalized,
+  resolveRecipients,
+  sheetRow,
+  submitterEmail,
+  type FormsContext,
+  type FormsDb,
+} from "./forms-core";
+import {
+  evaluateRule,
+  isFieldVisible,
+  normalizeCheckbox,
+  normalizePolicyUrl,
+  validateAll,
+} from "../forms/conditions";
+import {
+  mergeFields,
+  type FormFieldDef,
+  type FormPrivateSettings,
+  type FormPublicSettings,
+  type PublicForm,
+} from "../forms/field-sets";
+import { assertStaff } from "./guards";
+
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+/** Request metadata used by the {{ip}}, {{user_agent}}, {{referrer}} tags. */
+export type RequestMeta = {
+  ip: string | null;
+  userAgent: string | null;
+  referrer: string | null;
+  siteUrl: string | null;
+};
+
+export const emptyMeta: RequestMeta = { ip: null, userAgent: null, referrer: null, siteUrl: null };
+
+const loadDefaults = (admin: FormsDb) => loadFormDefaultsCore(admin);
+const logDelivery = (admin: FormsDb, entry: Parameters<typeof logDeliveryCore>[1]) =>
+  logDeliveryCore(admin, entry);
+
+/* ------------------------- public: render + submit ------------------------- */
+
+export type PublicFormInput = { key: string };
+
+/** Render payload for a public form; private settings never leave the server. */
+export async function getPublicFormCore(
+  publicDb: any,
+  admin: FormsDb,
+  key: string,
+): Promise<PublicForm | null> {
+  const runtime = await publicDb.rpc("form_public_runtime", { _key: key });
+  if (runtime.error) {
+    console.error("[forms] form_public_runtime", runtime.error);
+    return null;
+  }
+  const payload = (runtime.data ?? null) as null | {
+    id: string;
+    key: string;
+    name?: unknown;
+    form_type: string;
+    fields?: unknown;
+    public_settings?: unknown;
+    spamMinSeconds?: unknown;
+    savePartials?: unknown;
+  };
+  if (!payload?.id) return null;
+
+  const row = {
+    id: payload.id,
+    key: payload.key,
+    name: (payload.name ?? "") as string,
+    form_type: payload.form_type,
+    fields: payload.fields ?? [],
+    public_settings: payload.public_settings ?? {},
+  };
+  const defaults = await loadDefaults(admin);
+  const eff = effectiveSettings(
+    {
+      ...row,
+      private_settings: {
+        spamMinSeconds: payload.spamMinSeconds,
+        savePartials: payload.savePartials,
+      },
+    },
+    defaults,
+  );
+  const pub = eff.pub;
+  const mode =
+    pub.thankyouMode ?? (defaults?.thankyou_mode as "inline" | "redirect" | undefined) ?? "inline";
+
+  return {
+    id: row.id,
+    key: row.key,
+    name: row.name,
+    form_type: row.form_type,
+    fields: mergeFields(row.form_type, row.fields as never),
+    title: pub.title,
+    intro: pub.intro,
+    submitLabel: pub.submitLabel ?? { sv: "Skicka", en: "Send" },
+    consentText: pub.consentText ?? defaults?.consent_text ?? {},
+    privacyPolicyUrl: normalizePolicyUrl(defaults?.privacy_policy_url),
+    requireConsent: eff.requireConsent,
+    thankyouMode: mode === "redirect" ? "redirect" : "inline",
+    thankyouMessage: pub.thankyouMessage ??
+      defaults?.thankyou_message ?? {
+        sv: "Tack! Vi hör av oss snart.",
+        en: "Thank you! We'll be in touch.",
+      },
+    thankyouRedirect: pub.thankyouRedirect ?? defaults?.thankyou_redirect ?? "",
+    honeypot: eff.honeypot,
+    minSeconds: eff.minSeconds,
+    savePartials: eff.savePartials,
+  } as PublicForm;
+}
+
+export type SubmitInput = {
+  key: string;
+  locale: string;
+  pagePath?: string;
+  consent?: boolean;
+  elapsedMs?: number;
+  hp?: string;
+  clientToken?: string;
+  values: Record<string, string>;
+};
+
+export async function submitFormCore(admin: FormsDb, data: SubmitInput, meta: RequestMeta) {
+  const { data: form } = await admin
+    .from("forms")
+    .select("*")
+    .eq("key", data.key)
+    .eq("is_active", true)
+    .is("deleted_at", null)
+    .maybeSingle();
+  if (!form) throw new Error("This form is not available.");
+
+  const defaults = await loadDefaults(admin);
+  const eff = effectiveSettings(form, defaults);
+  const { ip, userAgent } = meta;
+
+  // Honeypot: silently accept so bots do not learn anything.
+  if (eff.honeypot && (data.hp ?? "").trim() !== "") return { ok: true as const, skipped: true };
+  if (typeof data.elapsedMs === "number" && data.elapsedMs < eff.minSeconds * 1000) {
+    throw new Error("Please take a moment before submitting.");
+  }
+  if (eff.maxPerHour > 0 && ip) {
+    const since = new Date(Date.now() - 60 * 60 * 1000).toISOString();
+    const { count } = await admin
+      .from("form_submissions")
+      .select("id", { count: "exact", head: true })
+      .eq("form_key", form.key)
+      .eq("ip", ip)
+      .gte("created_at", since);
+    if ((count ?? 0) >= eff.maxPerHour) {
+      throw new Error("Too many submissions from this device. Please try again later.");
+    }
+  }
+
+  const fields = mergeFields(form.form_type, form.fields);
+
+  // Raw answers first — conditional logic must see every value.
+  const raw: Record<string, string> = {};
+  for (const f of fields) {
+    if (!f.enabled) continue;
+    const value = (data.values[f.key] ?? "").toString().slice(0, 5000);
+    raw[f.key] = f.type === "checkbox" ? normalizeCheckbox(value) : value.trim();
+  }
+
+  const fieldErrors = validateAll(fields, raw, data.locale);
+  const firstError = Object.values(fieldErrors)[0];
+  if (firstError) throw new Error(firstError);
+
+  // Only store answers for fields the visitor actually saw.
+  const payload: Record<string, string> = {};
+  for (const f of fields) {
+    if (!isFieldVisible(f, raw)) continue;
+    payload[f.key] = raw[f.key] ?? "";
+  }
+
+  if (eff.requireConsent && !data.consent) throw new Error("Consent is required.");
+
+  const { data: inserted, error } = await admin
+    .from("form_submissions")
+    .insert({
+      form_id: form.id,
+      form_key: form.key,
+      locale: data.locale,
+      payload,
+      consent_at: data.consent ? new Date().toISOString() : null,
+      page_path: data.pagePath ?? null,
+      ip,
+      user_agent: userAgent,
+    })
+    .select("id, created_at")
+    .single();
+  if (error) throw new Error(error.message);
+
+  // A completed submission closes any draft the visitor left behind.
+  if (data.clientToken) {
+    await admin
+      .from("form_partials")
+      .update({ completed_at: new Date().toISOString() })
+      .eq("form_key", form.key)
+      .eq("client_token", data.clientToken);
+  }
+
+  const patch: Record<string, unknown> = {};
+  const problems: string[] = [];
+
+  const recipients = eff.notifyEnabled ? resolveRecipients(eff, payload) : "";
+  if (recipients) {
+    const tpl = notificationTemplate(eff, defaults, data.locale);
+    const res = await notifySubmissionCore(admin, {
+      ...meta,
+      to: recipients,
+      formName: form.name,
+      formKey: form.key,
+      locale: data.locale,
+      pagePath: data.pagePath,
+      fields,
+      payload,
+      submissionId: inserted.id,
+      subject: tpl.subject,
+      body: tpl.body,
+      fromName: eff.notifyFromName,
+      fromEmail: eff.notifyFromEmail,
+      replyTo: eff.notifyReplyTo,
+    });
+    if (res.ok) patch.notified_at = new Date().toISOString();
+    else problems.push(`Notification: ${res.error}`);
+    await logDelivery(admin, {
+      submissionId: inserted.id,
+      formKey: form.key,
+      channel: "notification",
+      ok: res.ok,
+      target: recipients,
+      error: res.error,
+    });
+  }
+
+  if (eff.autoreplyEnabled) {
+    const subject = pickLocalized(
+      eff.priv.autoreplySubject as Record<string, string> | undefined,
+      defaults?.autoreply_subject as Record<string, string> | undefined,
+      data.locale,
+    );
+    const body = pickLocalized(
+      eff.priv.autoreplyBody as Record<string, string> | undefined,
+      defaults?.autoreply_body as Record<string, string> | undefined,
+      data.locale,
+    );
+    const to = submitterEmail(fields, payload);
+    if (subject && body && to) {
+      const res = await sendAutoreplyCore(admin, {
+        ...meta,
+        to,
+        subject,
+        body,
+        formKey: form.key,
+        formName: form.name,
+        payload,
+        fields,
+        locale: data.locale,
+        pagePath: data.pagePath,
+        submissionId: inserted.id,
+        fromName: eff.notifyFromName,
+        fromEmail: eff.notifyFromEmail,
+      });
+      if (res.ok) patch.autoreply_at = new Date().toISOString();
+      else problems.push(`Autoreply: ${res.error}`);
+      await logDelivery(admin, {
+        submissionId: inserted.id,
+        formKey: form.key,
+        channel: "autoreply",
+        ok: res.ok,
+        target: to,
+        error: res.error,
+      });
+    } else if (!to) {
+      problems.push("Autoreply: no email address in the submission.");
+      await logDelivery(admin, {
+        submissionId: inserted.id,
+        formKey: form.key,
+        channel: "autoreply",
+        ok: false,
+        error: "No email address in the submission.",
+      });
+    }
+  }
+
+  if (eff.sheetLive && eff.sheetId) {
+    const res = await appendToSheetCore({
+      sheetId: eff.sheetId,
+      tab: eff.sheetTab,
+      values: sheetRow(inserted.created_at, form.key, data.locale, fields, payload),
+    });
+    patch.sheet_synced_at = res.ok ? new Date().toISOString() : null;
+    patch.sheet_error = res.ok ? null : (res.error ?? "Unknown error");
+    await logDelivery(admin, {
+      submissionId: inserted.id,
+      formKey: form.key,
+      channel: "sheet",
+      ok: res.ok,
+      target: `${eff.sheetId} · ${eff.sheetTab}`,
+      error: res.error,
+    });
+  }
+
+  if (eff.webhookEnabled) {
+    const startedAt = Date.now();
+    const res = await postWebhookCore({
+      url: eff.webhookUrl,
+      secret: eff.webhookSecret,
+      formKey: form.key,
+      formName: form.name,
+      submissionId: inserted.id,
+      locale: data.locale,
+      pagePath: data.pagePath,
+      createdAt: inserted.created_at,
+      payload,
+    });
+    if (!res.ok) problems.push(`Webhook: ${res.error}`);
+    await logDelivery(admin, {
+      submissionId: inserted.id,
+      formKey: form.key,
+      channel: "webhook",
+      ok: res.ok,
+      target: eff.webhookUrl,
+      error: res.error,
+      durationMs: Date.now() - startedAt,
+      meta: { status: res.status ?? null },
+    });
+  }
+
+  if (problems.length) {
+    patch.delivery_error = problems.join(" · ").slice(0, 1000);
+    console.error(`[forms] delivery issues for ${form.key}:`, patch.delivery_error);
+  }
+  if (Object.keys(patch).length) {
+    await admin.from("form_submissions").update(patch).eq("id", inserted.id);
+  }
+
+  return { ok: true as const, skipped: false };
+}
+
+/* ------------------------------- submissions ------------------------------ */
+
+export type SubmissionRow = {
+  id: string;
+  form_key: string;
+  locale: string;
+  payload: Record<string, string>;
+  status: string;
+  consent_at: string | null;
+  sheet_synced_at: string | null;
+  sheet_error: string | null;
+  notified_at: string | null;
+  autoreply_at: string | null;
+  delivery_error: string | null;
+  page_path: string | null;
+  ip: string | null;
+  user_agent: string | null;
+  created_at: string;
+};
+
+export type SubmissionsPage = {
+  rows: SubmissionRow[];
+  total: number;
+  counts: Record<string, number>;
+};
+
+export type ListSubmissionsInput = {
+  formKey?: string;
+  status?: "new" | "read" | "handled" | "spam";
+  locale?: string;
+  search?: string;
+  from?: string;
+  to?: string;
+  page: number;
+  pageSize: number;
+  sort: "newest" | "oldest";
+};
+
+export async function listSubmissionsCore(
+  context: FormsContext,
+  data: ListSubmissionsInput,
+): Promise<SubmissionsPage> {
+  await assertStaff(context);
+
+  const applyFilters = (q: any) => {
+    if (data.formKey) q = q.eq("form_key", data.formKey);
+    if (data.status) q = q.eq("status", data.status);
+    if (data.locale) q = q.eq("locale", data.locale);
+    if (data.from) q = q.gte("created_at", new Date(data.from).toISOString());
+    if (data.to) {
+      const end = new Date(data.to);
+      end.setHours(23, 59, 59, 999);
+      q = q.lte("created_at", end.toISOString());
+    }
+    if (data.search) {
+      const term = data.search.replace(/[%,()]/g, " ").trim();
+      if (term) q = q.or(`payload::text.ilike.%${term}%,page_path.ilike.%${term}%`);
+    }
+    return q;
+  };
+
+  const from = data.page * data.pageSize;
+  const {
+    data: rows,
+    error,
+    count,
+  } = await applyFilters(context.supabase.from("form_submissions").select("*", { count: "exact" }))
+    .order("created_at", { ascending: data.sort === "oldest" })
+    .range(from, from + data.pageSize - 1);
+  if (error) throw new Error(error.message);
+
+  // Status tallies for the current form scope (ignoring the status filter).
+  let statusQ = context.supabase.from("form_submissions").select("status").limit(5000);
+  if (data.formKey) statusQ = statusQ.eq("form_key", data.formKey);
+  const { data: statusRows } = await statusQ;
+  const counts: Record<string, number> = { new: 0, read: 0, handled: 0, spam: 0 };
+  for (const s of statusRows ?? []) counts[s.status] = (counts[s.status] ?? 0) + 1;
+
+  return { rows: (rows ?? []) as SubmissionRow[], total: count ?? 0, counts };
+}
+
+export async function setSubmissionStatusCore(
+  context: FormsContext,
+  data: { ids: string[]; status: string },
+) {
+  await assertStaff(context);
+  const { error } = await context.supabase
+    .from("form_submissions")
+    .update({ status: data.status })
+    .in("id", data.ids);
+  if (error) throw new Error(error.message);
+  return { ok: true as const, updated: data.ids.length };
+}
+
+/** Re-send the admin notification (or the autoreply) for one submission. */
+export async function resendDeliveryCore(
+  context: FormsContext,
+  admin: FormsDb,
+  data: { id: string; what: "notification" | "autoreply"; to?: string },
+  siteUrl: string | null,
+) {
+  await assertStaff(context);
+
+  const { data: sub, error } = await admin
+    .from("form_submissions")
+    .select("*")
+    .eq("id", data.id)
+    .single();
+  if (error) throw new Error(error.message);
+
+  const { data: form } = await admin
+    .from("forms")
+    .select("*")
+    .eq("key", sub.form_key)
+    .maybeSingle();
+  if (!form) throw new Error("The form for this submission no longer exists.");
+
+  const defaults = await loadDefaults(admin);
+  const eff = effectiveSettings(form, defaults);
+  const fields = mergeFields(form.form_type, form.fields);
+  const payload = (sub.payload ?? {}) as Record<string, string>;
+  // Resends reuse the metadata stored with the submission, not the staff request.
+  const meta: RequestMeta = {
+    ip: sub.ip ?? null,
+    userAgent: sub.user_agent ?? null,
+    referrer: null,
+    siteUrl,
+  };
+
+  if (data.what === "notification") {
+    const to = data.to?.trim() || resolveRecipients(eff, payload);
+    if (!to) throw new Error("No notification recipients configured.");
+    const tpl = notificationTemplate(eff, defaults, sub.locale);
+    const res = await notifySubmissionCore(admin, {
+      ...meta,
+      to,
+      formName: form.name,
+      formKey: form.key,
+      locale: sub.locale,
+      pagePath: sub.page_path,
+      fields,
+      payload,
+      submissionId: sub.id,
+      subject: tpl.subject,
+      body: tpl.body,
+      fromName: eff.notifyFromName,
+      fromEmail: eff.notifyFromEmail,
+      replyTo: eff.notifyReplyTo,
+    });
+    if (!res.ok) throw new Error(res.error ?? "Could not send the notification.");
+    await admin
+      .from("form_submissions")
+      .update({ notified_at: new Date().toISOString(), delivery_error: null })
+      .eq("id", sub.id);
+    return { ok: true as const };
+  }
+
+  const subject = pickLocalized(
+    eff.priv.autoreplySubject as Record<string, string> | undefined,
+    defaults?.autoreply_subject as Record<string, string> | undefined,
+    sub.locale,
+  );
+  const body = pickLocalized(
+    eff.priv.autoreplyBody as Record<string, string> | undefined,
+    defaults?.autoreply_body as Record<string, string> | undefined,
+    sub.locale,
+  );
+  const to = data.to?.trim() || submitterEmail(fields, payload);
+  if (!to) throw new Error("This submission has no email address.");
+  if (!subject || !body) throw new Error("No autoreply subject or body configured.");
+  const res = await sendAutoreplyCore(admin, {
+    ...meta,
+    to,
+    subject,
+    body,
+    formKey: form.key,
+    formName: form.name,
+    payload,
+    fields,
+    locale: sub.locale,
+    pagePath: sub.page_path,
+    submissionId: sub.id,
+    fromName: eff.notifyFromName,
+    fromEmail: eff.notifyFromEmail,
+  });
+  if (!res.ok) throw new Error(res.error ?? "Could not send the autoreply.");
+  await admin
+    .from("form_submissions")
+    .update({ autoreply_at: new Date().toISOString(), delivery_error: null })
+    .eq("id", sub.id);
+  return { ok: true as const };
+}
+
+/** Push specific submissions to the sheet configured for their form. */
+export async function pushSubmissionsToSheetCore(
+  context: FormsContext,
+  admin: FormsDb,
+  ids: string[],
+) {
+  await assertStaff(context);
+  const { data: rows, error } = await admin
+    .from("form_submissions")
+    .select("*")
+    .in("id", ids)
+    .order("created_at", { ascending: true });
+  if (error) throw new Error(error.message);
+
+  const defaults = await loadDefaults(admin);
+  const formCache = new Map<string, any>();
+  let synced = 0;
+  let lastError: string | undefined;
+
+  for (const r of rows ?? []) {
+    let form = formCache.get(r.form_key);
+    if (!form) {
+      const { data: f } = await admin.from("forms").select("*").eq("key", r.form_key).maybeSingle();
+      form = f;
+      formCache.set(r.form_key, f);
+    }
+    if (!form) {
+      lastError = `Form "${r.form_key}" no longer exists.`;
+      continue;
+    }
+    const eff = effectiveSettings(form, defaults);
+    if (!eff.sheetId) {
+      lastError = `No Google Sheet configured for "${r.form_key}".`;
+      continue;
+    }
+    const fields = mergeFields(form.form_type, form.fields);
+    const res = await appendToSheetCore({
+      sheetId: eff.sheetId,
+      tab: eff.sheetTab,
+      values: sheetRow(
+        r.created_at,
+        r.form_key,
+        r.locale,
+        fields,
+        (r.payload ?? {}) as Record<string, string>,
+      ),
+    });
+    await admin
+      .from("form_submissions")
+      .update({
+        sheet_synced_at: res.ok ? new Date().toISOString() : null,
+        sheet_error: res.ok ? null : (res.error ?? "Unknown error"),
+      })
+      .eq("id", r.id);
+    if (res.ok) synced += 1;
+    else lastError = res.error;
+  }
+
+  if (synced === 0 && lastError) throw new Error(lastError);
+  return { synced, error: lastError ?? null };
+}
+
+/** Push every not-yet-synced submission of one form to its sheet. */
+export async function syncSubmissionsToSheetCore(
+  context: FormsContext,
+  admin: FormsDb,
+  formKey: string,
+) {
+  await assertStaff(context);
+  const { data: form } = await admin.from("forms").select("*").eq("key", formKey).maybeSingle();
+  if (!form) throw new Error("Form not found");
+  const defaults = await loadDefaults(admin);
+  const eff = effectiveSettings(form, defaults);
+  if (!eff.sheetId) throw new Error("No Google Sheet configured for this form.");
+
+  const fields = mergeFields(form.form_type, form.fields);
+  const { data: rows } = await admin
+    .from("form_submissions")
+    .select("*")
+    .eq("form_key", formKey)
+    .is("sheet_synced_at", null)
+    .order("created_at", { ascending: true })
+    .limit(200);
+
+  let synced = 0;
+  let lastError: string | undefined;
+  for (const r of rows ?? []) {
+    const res = await appendToSheetCore({
+      sheetId: eff.sheetId,
+      tab: eff.sheetTab,
+      values: sheetRow(
+        r.created_at,
+        r.form_key,
+        r.locale,
+        fields,
+        (r.payload ?? {}) as Record<string, string>,
+      ),
+    });
+    await admin
+      .from("form_submissions")
+      .update({
+        sheet_synced_at: res.ok ? new Date().toISOString() : null,
+        sheet_error: res.ok ? null : (res.error ?? "Unknown error"),
+      })
+      .eq("id", r.id);
+    if (res.ok) synced += 1;
+    else {
+      lastError = res.error;
+      break;
+    }
+  }
+  if (synced === 0 && lastError) throw new Error(lastError);
+  return { synced, error: lastError ?? null };
+}
+
+/**
+ * Retention purge. Always call with dryRun first; nothing is ever purged
+ * automatically and retention must be explicitly configured.
+ */
+export async function purgeOldSubmissionsCore(
+  context: FormsContext,
+  admin: FormsDb,
+  data: { dryRun: boolean; formKey?: string },
+) {
+  await assertStaff(context);
+  const defaults = await loadDefaults(admin);
+  const days = defaults?.retention_days ?? 0;
+  if (!days || days <= 0) {
+    throw new Error("Retention is turned off (0 days). Set a retention period first.");
+  }
+  const cutoff = new Date(Date.now() - days * 86_400_000).toISOString();
+
+  let q = admin
+    .from("form_submissions")
+    .select("id", { count: "exact", head: true })
+    .lt("created_at", cutoff);
+  if (data.formKey) q = q.eq("form_key", data.formKey);
+  const { count } = await q;
+  const matched = count ?? 0;
+
+  if (data.dryRun || matched === 0) return { matched, deleted: 0, cutoff };
+
+  let del = admin.from("form_submissions").delete().lt("created_at", cutoff);
+  if (data.formKey) del = del.eq("form_key", data.formKey);
+  const { error } = await del;
+  if (error) throw new Error(error.message);
+  return { matched, deleted: matched, cutoff };
+}
+
+/* --------------------------- incomplete (draft) forms --------------------- */
+
+export type PartialRow = {
+  id: string;
+  form_key: string;
+  locale: string;
+  payload: Record<string, string>;
+  page_path: string | null;
+  completed_at: string | null;
+  created_at: string;
+  updated_at: string;
+};
+
+/** Store what a visitor typed so far. Never blocks and never throws. */
+export async function savePartialSubmissionCore(
+  admin: FormsDb,
+  data: {
+    key: string;
+    clientToken: string;
+    locale: string;
+    pagePath?: string;
+    values: Record<string, string>;
+  },
+  meta: Pick<RequestMeta, "ip" | "userAgent">,
+) {
+  try {
+    const { data: form } = await admin
+      .from("forms")
+      .select("id, key, form_type, fields, public_settings, private_settings, is_active")
+      .eq("key", data.key)
+      .eq("is_active", true)
+      .maybeSingle();
+    if (!form) return { ok: false as const };
+
+    const defaults = await loadDefaults(admin);
+    const eff = effectiveSettings(form, defaults);
+    if (!eff.savePartials) return { ok: false as const };
+
+    const fields = mergeFields(form.form_type, form.fields);
+    const payload: Record<string, string> = {};
+    for (const f of fields) {
+      const v = (data.values[f.key] ?? "").toString().slice(0, 5000).trim();
+      if (v) payload[f.key] = v;
+    }
+    if (Object.keys(payload).length === 0) return { ok: false as const };
+
+    await admin.from("form_partials").upsert(
+      {
+        form_id: form.id,
+        form_key: form.key,
+        client_token: data.clientToken,
+        locale: data.locale,
+        payload,
+        page_path: data.pagePath ?? null,
+        ip: meta.ip,
+        user_agent: meta.userAgent,
+        updated_at: new Date().toISOString(),
+      },
+      { onConflict: "form_key,client_token" },
+    );
+    return { ok: true as const };
+  } catch (e) {
+    console.error("[forms] savePartialSubmission", e);
+    return { ok: false as const };
+  }
+}
+
+export async function listPartialsCore(
+  context: FormsContext,
+  data: { formKey?: string; includeCompleted: boolean; limit: number },
+): Promise<PartialRow[]> {
+  await assertStaff(context);
+  let q = context.supabase
+    .from("form_partials")
+    .select("*")
+    .order("updated_at", { ascending: false })
+    .limit(data.limit);
+  if (data.formKey) q = q.eq("form_key", data.formKey);
+  if (!data.includeCompleted) q = q.is("completed_at", null);
+  const { data: rows, error } = await q;
+  if (error) throw new Error(error.message);
+  return (rows ?? []) as PartialRow[];
+}
+
+export async function deletePartialsCore(context: FormsContext, ids: string[]) {
+  await assertStaff(context);
+  const { error } = await context.supabase.from("form_partials").delete().in("id", ids);
+  if (error) throw new Error(error.message);
+  return { ok: true as const, deleted: ids.length };
+}
+
+/* ------------------------------ test delivery ----------------------------- */
+
+export type TestNotificationResult = {
+  sent: boolean;
+  recipients: string[];
+  subject: string;
+  from: string;
+  replyTo: string;
+  matchedRules: { to: string; exclusive: boolean; label?: string }[];
+  sampleValues: Record<string, string>;
+  warnings: string[];
+  error?: string;
+};
+
+export type TestNotificationInput = {
+  formKey: string;
+  locale: string;
+  fields?: Record<string, unknown>[];
+  private_settings?: Record<string, unknown>;
+  values?: Record<string, string>;
+  to?: string;
+  send: boolean;
+  what: "notification" | "autoreply";
+};
+
+/**
+ * Verify a form's notification setup end to end without creating a submission:
+ * resolves templates, sender identity and conditional routing against sample
+ * answers, then optionally sends the real email.
+ */
+export async function sendTestNotificationCore(
+  context: FormsContext,
+  admin: FormsDb,
+  data: TestNotificationInput,
+  meta: RequestMeta,
+): Promise<TestNotificationResult> {
+  await assertStaff(context);
+
+  const { data: stored } = await admin
+    .from("forms")
+    .select("*")
+    .eq("key", data.formKey)
+    .maybeSingle();
+  if (!stored) throw new Error("Form not found");
+
+  const form = {
+    ...stored,
+    fields: data.fields ?? stored.fields,
+    private_settings: data.private_settings ?? stored.private_settings,
+  };
+  const defaults = await loadDefaults(admin);
+  const eff = effectiveSettings(form, defaults);
+  const fields = mergeFields(form.form_type, form.fields);
+
+  // Sample answers: what the editor typed, otherwise a plausible value.
+  const sample: Record<string, string> = {};
+  for (const f of fields) {
+    if (!f.enabled) continue;
+    const given = (data.values?.[f.key] ?? "").trim();
+    if (given) {
+      sample[f.key] = f.type === "checkbox" ? normalizeCheckbox(given) : given;
+      continue;
+    }
+    sample[f.key] =
+      f.type === "email"
+        ? "test@example.com"
+        : f.type === "tel"
+          ? "+46 70 123 45 67"
+          : f.type === "number"
+            ? "2"
+            : f.type === "date"
+              ? new Date().toISOString().slice(0, 10)
+              : f.type === "time"
+                ? "18:00"
+                : f.type === "checkbox"
+                  ? "true"
+                  : f.type === "select"
+                    ? (f.options?.[0]?.value ?? "")
+                    : `Test ${f.key}`;
+  }
+  const values: Record<string, string> = {};
+  for (const f of fields) {
+    if (isFieldVisible(f, sample)) values[f.key] = sample[f.key] ?? "";
+  }
+
+  const matchedRules = eff.notificationRules
+    .filter((r) => evaluateRule(r.when, values))
+    .map((r) => ({ to: r.to, exclusive: r.exclusive === true, label: r.label }));
+
+  const warnings: string[] = [];
+  if (!eff.notifyEnabled) warnings.push("Notifications are switched off for this form.");
+  if (!eff.notifyFromEmail) warnings.push("No sender address set — the provider default is used.");
+
+  const tokens = templateTokens({
+    ...meta,
+    formName: form.name,
+    formKey: form.key,
+    locale: data.locale,
+    pagePath: "/test",
+  });
+  // Show exactly what the visitor's answers resolve to.
+  const resolvedReplyTo = renderHeader(eff.notifyReplyTo, values, tokens) || eff.notifyReplyTo;
+  const resolvedFromName = renderHeader(eff.notifyFromName, values, tokens);
+
+  if (data.what === "autoreply") {
+    const subjectTpl = pickLocalized(
+      eff.priv.autoreplySubject as Record<string, string> | undefined,
+      defaults?.autoreply_subject as Record<string, string> | undefined,
+      data.locale,
+    );
+    const bodyTpl = pickLocalized(
+      eff.priv.autoreplyBody as Record<string, string> | undefined,
+      defaults?.autoreply_body as Record<string, string> | undefined,
+      data.locale,
+    );
+    const to = data.to?.trim() || submitterEmail(fields, values);
+    const subject = renderTemplate(subjectTpl, values, tokens);
+    if (!eff.autoreplyEnabled) warnings.push("Autoreply is switched off for this form.");
+    if (!subjectTpl || !bodyTpl) warnings.push("Autoreply subject or body is empty.");
+
+    const base: TestNotificationResult = {
+      sent: false,
+      recipients: to ? [to] : [],
+      subject,
+      from: [resolvedFromName, eff.notifyFromEmail].filter(Boolean).join(" "),
+      replyTo: resolvedReplyTo,
+      matchedRules,
+      sampleValues: values,
+      warnings,
+    };
+    if (!data.send) return base;
+    if (!to) return { ...base, error: "No recipient — add a test address." };
+    const res = await sendAutoreplyCore(admin, {
+      ...meta,
+      to,
+      subject: subjectTpl,
+      body: bodyTpl,
+      formKey: form.key,
+      formName: form.name,
+      payload: values,
+      fields,
+      locale: data.locale,
+      pagePath: "/test",
+      fromName: eff.notifyFromName,
+      fromEmail: eff.notifyFromEmail,
+    });
+    return { ...base, sent: res.ok, error: res.ok ? undefined : res.error };
+  }
+
+  const resolved = data.to?.trim() || resolveRecipients(eff, values);
+  const recipients = resolved
+    .split(/[,;\s]+/)
+    .map((s) => s.trim())
+    .filter((s) => s.includes("@"));
+  if (recipients.length === 0) warnings.push("No recipients resolved for these answers.");
+
+  const tpl = notificationTemplate(eff, defaults, data.locale);
+  const subject = tpl.subject
+    ? renderTemplate(tpl.subject, values, tokens)
+    : `${form.name}: new submission`;
+
+  const base: TestNotificationResult = {
+    sent: false,
+    recipients,
+    subject,
+    from: [resolvedFromName, eff.notifyFromEmail].filter(Boolean).join(" "),
+    replyTo: resolvedReplyTo,
+    matchedRules,
+    sampleValues: values,
+    warnings,
+  };
+  if (!data.send || recipients.length === 0) return base;
+
+  const res = await notifySubmissionCore(admin, {
+    ...meta,
+    to: recipients.join(","),
+    formName: `${form.name} (TEST)`,
+    formKey: form.key,
+    locale: data.locale,
+    pagePath: "/test",
+    fields,
+    payload: values,
+    subject: tpl.subject,
+    body: tpl.body,
+    fromName: eff.notifyFromName,
+    fromEmail: eff.notifyFromEmail,
+    replyTo: eff.notifyReplyTo,
+  });
+  return { ...base, sent: res.ok, error: res.ok ? undefined : res.error };
+}
+
+/* --------------------------- delivery diagnostics ------------------------- */
+
+export type DeliveryChannel = "notification" | "autoreply" | "sheet" | "webhook";
+
+export type DeliveryAttemptRow = {
+  id: string;
+  submission_id: string | null;
+  form_key: string;
+  channel: DeliveryChannel;
+  status: string;
+  target: string | null;
+  error: string | null;
+  attempt: number;
+  duration_ms: number | null;
+  meta: Record<string, string | number | boolean | null>;
+  resolved_at: string | null;
+  created_at: string;
+  /** Small excerpt of the submission so staff can see what failed. */
+  submission?: {
+    id: string;
+    locale: string;
+    created_at: string;
+    page_path: string | null;
+    payload: Record<string, string>;
+  } | null;
+};
+
+export type DeliveryOverview = {
+  rows: DeliveryAttemptRow[];
+  total: number;
+  perForm: {
+    form_key: string;
+    name: string;
+    open: number;
+    byChannel: Record<string, number>;
+    lastFailureAt: string | null;
+  }[];
+  totals: { open: number; resolved: number; last24h: number };
+};
+
+/**
+ * One shared place to (re)run a single delivery for a stored submission,
+ * so retries behave exactly like the original attempt.
+ */
+export async function deliverChannelCore(
+  admin: FormsDb,
+  submissionId: string,
+  channel: DeliveryChannel,
+  siteUrl: string | null,
+  toOverride?: string,
+  attempt = 1,
+): Promise<{ ok: boolean; error?: string; target: string }> {
+  const { data: sub, error } = await admin
+    .from("form_submissions")
+    .select("*")
+    .eq("id", submissionId)
+    .single();
+  if (error) throw new Error(error.message);
+
+  const { data: form } = await admin
+    .from("forms")
+    .select("*")
+    .eq("key", sub.form_key)
+    .maybeSingle();
+  if (!form) throw new Error(`The form "${sub.form_key}" no longer exists.`);
+
+  const defaults = await loadDefaults(admin);
+  const eff = effectiveSettings(form, defaults);
+  const fields = mergeFields(form.form_type, form.fields);
+  const payload = (sub.payload ?? {}) as Record<string, string>;
+  const startedAt = Date.now();
+  const meta: RequestMeta = {
+    ip: sub.ip ?? null,
+    userAgent: sub.user_agent ?? null,
+    referrer: null,
+    siteUrl,
+  };
+
+  let result: { ok: boolean; error?: string } = { ok: false, error: "Unknown channel" };
+  let target = "";
+
+  if (channel === "notification") {
+    target = toOverride?.trim() || resolveRecipients(eff, payload);
+    if (!target) throw new Error("No notification recipients configured.");
+    const tpl = notificationTemplate(eff, defaults, sub.locale);
+    result = await notifySubmissionCore(admin, {
+      ...meta,
+      to: target,
+      formName: form.name,
+      formKey: form.key,
+      locale: sub.locale,
+      pagePath: sub.page_path,
+      fields,
+      payload,
+      submissionId: sub.id,
+      subject: tpl.subject,
+      body: tpl.body,
+      fromName: eff.notifyFromName,
+      fromEmail: eff.notifyFromEmail,
+      replyTo: eff.notifyReplyTo,
+    });
+    if (result.ok) {
+      await admin
+        .from("form_submissions")
+        .update({ notified_at: new Date().toISOString(), delivery_error: null })
+        .eq("id", sub.id);
+    }
+  } else if (channel === "autoreply") {
+    const subject = pickLocalized(
+      eff.priv.autoreplySubject as Record<string, string> | undefined,
+      defaults?.autoreply_subject as Record<string, string> | undefined,
+      sub.locale,
+    );
+    const body = pickLocalized(
+      eff.priv.autoreplyBody as Record<string, string> | undefined,
+      defaults?.autoreply_body as Record<string, string> | undefined,
+      sub.locale,
+    );
+    target = toOverride?.trim() || submitterEmail(fields, payload);
+    if (!target) throw new Error("This submission has no email address.");
+    if (!subject || !body) throw new Error("No autoreply subject or body configured.");
+    result = await sendAutoreplyCore(admin, {
+      ...meta,
+      to: target,
+      subject,
+      body,
+      formKey: form.key,
+      formName: form.name,
+      payload,
+      fields,
+      locale: sub.locale,
+      pagePath: sub.page_path,
+      submissionId: sub.id,
+      fromName: eff.notifyFromName,
+      fromEmail: eff.notifyFromEmail,
+    });
+    if (result.ok) {
+      await admin
+        .from("form_submissions")
+        .update({ autoreply_at: new Date().toISOString(), delivery_error: null })
+        .eq("id", sub.id);
+    }
+  } else if (channel === "sheet") {
+    if (!eff.sheetId) throw new Error(`No Google Sheet configured for "${form.key}".`);
+    target = `${eff.sheetId} · ${eff.sheetTab}`;
+    result = await appendToSheetCore({
+      sheetId: eff.sheetId,
+      tab: eff.sheetTab,
+      values: sheetRow(sub.created_at, sub.form_key, sub.locale, fields, payload),
+    });
+    await admin
+      .from("form_submissions")
+      .update({
+        sheet_synced_at: result.ok ? new Date().toISOString() : null,
+        sheet_error: result.ok ? null : (result.error ?? "Unknown error"),
+      })
+      .eq("id", sub.id);
+  } else if (channel === "webhook") {
+    target = toOverride?.trim() || eff.webhookUrl;
+    if (!target) throw new Error(`No webhook URL configured for "${form.key}".`);
+    result = await postWebhookCore({
+      url: target,
+      secret: eff.webhookSecret,
+      formKey: form.key,
+      formName: form.name,
+      submissionId: sub.id,
+      locale: sub.locale,
+      pagePath: sub.page_path,
+      createdAt: sub.created_at,
+      payload,
+    });
+  }
+
+  await logDelivery(admin, {
+    submissionId: sub.id,
+    formKey: sub.form_key,
+    channel,
+    ok: result.ok,
+    target,
+    error: result.error,
+    attempt,
+    durationMs: Date.now() - startedAt,
+    meta: { retry: attempt > 1 },
+  });
+
+  return { ok: result.ok, error: result.error, target };
+}
+
+/** Failed (and optionally resolved) deliveries, newest first, with rollup. */
+export async function listDeliveryAttemptsCore(
+  context: FormsContext,
+  data: {
+    formKey?: string;
+    channel?: DeliveryChannel;
+    state: "open" | "resolved" | "all";
+    limit: number;
+  },
+): Promise<DeliveryOverview> {
+  await assertStaff(context);
+
+  const base = () => {
+    let q = context.supabase.from("form_delivery_attempts").select("*", { count: "exact" });
+    if (data.formKey) q = q.eq("form_key", data.formKey);
+    if (data.channel) q = q.eq("channel", data.channel);
+    if (data.state === "open") q = q.eq("status", "failed").is("resolved_at", null);
+    if (data.state === "resolved") q = q.not("resolved_at", "is", null);
+    return q;
+  };
+
+  const {
+    data: rows,
+    error,
+    count,
+  } = await base().order("created_at", { ascending: false }).limit(data.limit);
+  if (error) throw new Error(error.message);
+
+  // Attach a small excerpt of each failing submission for diagnostics.
+  const ids = Array.from(
+    new Set((rows ?? []).map((r: any) => r.submission_id).filter(Boolean)),
+  ) as string[];
+  const subs = new Map<string, any>();
+  if (ids.length) {
+    const { data: srows } = await context.supabase
+      .from("form_submissions")
+      .select("id, locale, created_at, page_path, payload")
+      .in("id", ids);
+    for (const s of srows ?? []) subs.set(s.id, s);
+  }
+
+  // Rollup across every open failure, not just the current page.
+  const { data: openRows } = await context.supabase
+    .from("form_delivery_attempts")
+    .select("form_key, channel, created_at")
+    .eq("status", "failed")
+    .is("resolved_at", null)
+    .order("created_at", { ascending: false })
+    .limit(2000);
+  const { data: forms } = await context.supabase.from("forms").select("key, name");
+  const names = new Map((forms ?? []).map((f: any) => [f.key, f.name as string]));
+
+  const perForm = new Map<
+    string,
+    { open: number; byChannel: Record<string, number>; last: string | null }
+  >();
+  for (const r of openRows ?? []) {
+    const e = perForm.get(r.form_key) ?? { open: 0, byChannel: {}, last: null };
+    e.open += 1;
+    e.byChannel[r.channel] = (e.byChannel[r.channel] ?? 0) + 1;
+    if (!e.last) e.last = r.created_at;
+    perForm.set(r.form_key, e);
+  }
+
+  const since = new Date(Date.now() - 86_400_000).toISOString();
+  const { count: last24h } = await context.supabase
+    .from("form_delivery_attempts")
+    .select("id", { count: "exact", head: true })
+    .eq("status", "failed")
+    .gte("created_at", since);
+  const { count: resolved } = await context.supabase
+    .from("form_delivery_attempts")
+    .select("id", { count: "exact", head: true })
+    .not("resolved_at", "is", null);
+
+  return {
+    rows: (rows ?? []).map((r: any) => ({
+      ...r,
+      meta: (r.meta ?? {}) as Record<string, string | number | boolean | null>,
+      submission: r.submission_id ? (subs.get(r.submission_id) ?? null) : null,
+    })) as DeliveryAttemptRow[],
+    total: count ?? 0,
+    perForm: Array.from(perForm.entries())
+      .map(([form_key, v]) => ({
+        form_key,
+        name: names.get(form_key) ?? form_key,
+        open: v.open,
+        byChannel: v.byChannel,
+        lastFailureAt: v.last,
+      }))
+      .sort((a, b) => b.open - a.open),
+    totals: { open: (openRows ?? []).length, resolved: resolved ?? 0, last24h: last24h ?? 0 },
+  };
+}
+
+/** Re-run the failed deliveries behind the given attempt rows. */
+export async function retryDeliveryAttemptsCore(
+  context: FormsContext,
+  admin: FormsDb,
+  ids: string[],
+  siteUrl: string | null,
+) {
+  await assertStaff(context);
+  const { data: attempts, error } = await context.supabase
+    .from("form_delivery_attempts")
+    .select("*")
+    .in("id", ids);
+  if (error) throw new Error(error.message);
+
+  let succeeded = 0;
+  const failures: string[] = [];
+  for (const a of attempts ?? []) {
+    if (!a.submission_id) {
+      failures.push(`${a.form_key}: the submission behind this attempt is gone.`);
+      continue;
+    }
+    try {
+      const res = await deliverChannelCore(
+        admin,
+        a.submission_id,
+        a.channel as DeliveryChannel,
+        siteUrl,
+        undefined,
+        (a.attempt ?? 1) + 1,
+      );
+      if (res.ok) succeeded += 1;
+      else failures.push(`${a.form_key}/${a.channel}: ${res.error ?? "failed"}`);
+    } catch (e) {
+      failures.push(`${a.form_key}/${a.channel}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  return { retried: (attempts ?? []).length, succeeded, failures };
+}
+
+/** Mark failures as handled without sending anything. */
+export async function resolveDeliveryAttemptsCore(context: FormsContext, ids: string[]) {
+  await assertStaff(context);
+  const { error } = await context.supabase
+    .from("form_delivery_attempts")
+    .update({ resolved_at: new Date().toISOString() })
+    .in("id", ids);
+  if (error) throw new Error(error.message);
+  return { ok: true as const, resolved: ids.length };
+}
+
+/** Fire a harmless ping at a form's webhook so staff can verify the endpoint. */
+export async function testWebhookCore(
+  context: FormsContext,
+  admin: FormsDb,
+  data: { formKey: string; url?: string; secret?: string },
+) {
+  await assertStaff(context);
+  const { data: form } = await admin
+    .from("forms")
+    .select("*")
+    .eq("key", data.formKey)
+    .maybeSingle();
+  if (!form) throw new Error("Form not found");
+  const eff = effectiveSettings(form, await loadDefaults(admin));
+  const url = data.url?.trim() || eff.webhookUrl;
+  if (!url) throw new Error("No webhook URL configured for this form.");
+
+  const startedAt = Date.now();
+  const res = await postWebhookCore({
+    url,
+    secret: data.secret ?? eff.webhookSecret,
+    formKey: form.key,
+    formName: form.name,
+    submissionId: "00000000-0000-0000-0000-000000000000",
+    locale: "sv",
+    createdAt: new Date().toISOString(),
+    payload: { test: "true" },
+  });
+  await logDelivery(admin, {
+    formKey: form.key,
+    channel: "webhook",
+    ok: res.ok,
+    target: url,
+    error: res.error,
+    durationMs: Date.now() - startedAt,
+    meta: { test: true, status: res.status ?? null },
+  });
+  return { ok: res.ok, status: res.status ?? null, error: res.error ?? null };
+}
+
+/* ------------------------------- versioning ------------------------------- */
+
+export type FormVersionRow = {
+  id: string;
+  form_key: string;
+  version_no: number;
+  name: string;
+  form_type: string;
+  fields: FormFieldDef[];
+  public_settings: FormPublicSettings;
+  private_settings: FormPrivateSettings;
+  note: string | null;
+  created_at: string;
+  created_by_email: string | null;
+};