@frigear-nu/forms 0.0.0-stage → 0.0.1

package/dist/runtime/server/routes/admin/import.post.js

@@ -0,0 +1,6 @@
+import { importInput } from "../../utils/admin-schemas.js";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const { forms } = await readValidatedBody(event, importInput.parse);
+  return seedForms(forms.map((form) => ({ ...form, definition: form.definition })));
+});

package/dist/runtime/server/routes/admin/submission-file.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/submission-file.get.js

@@ -0,0 +1,17 @@
+import { and, eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { blob } from "@nuxthub/blob";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const [file] = await db.select().from(schema.formSubmissionFiles).where(and(
+    eq(schema.formSubmissionFiles.submissionId, getRouterParam(event, "id")),
+    eq(schema.formSubmissionFiles.id, getRouterParam(event, "fileId"))
+  )).limit(1);
+  if (!file) throw createError({ statusCode: 404, statusMessage: "File not found." });
+  const stored = await blob.get(file.pathname);
+  if (!stored) throw createError({ statusCode: 404, statusMessage: "File not found." });
+  setResponseHeader(event, "content-type", file.contentType);
+  setResponseHeader(event, "content-disposition", `attachment; filename="${encodeURIComponent(file.filename)}"`);
+  setResponseHeader(event, "x-content-type-options", "nosniff");
+  return stored;
+});

package/dist/runtime/server/routes/admin/submission-redeliver.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/submission-redeliver.post.js

@@ -0,0 +1,29 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const [row] = await db.select().from(schema.formSubmissions).where(eq(schema.formSubmissions.id, getRouterParam(event, "id"))).limit(1);
+  if (!row) throw createError({ statusCode: 404, statusMessage: "Submission not found." });
+  const files = await db.select().from(schema.formSubmissionFiles).where(eq(schema.formSubmissionFiles.submissionId, row.id));
+  const [form] = await db.select().from(schema.forms).where(eq(schema.forms.id, row.formId)).limit(1);
+  const ctx = {
+    event,
+    form: { id: row.formId, slug: row.formSlug, name: form?.name ?? row.formSlug, version: row.formVersion, definition: row.definitionSnapshot },
+    answers: row.answers,
+    files: files.map((file) => ({ fieldKey: file.fieldKey, filename: file.filename, contentType: file.contentType, size: file.size, pathname: file.pathname })),
+    locale: row.locale,
+    userId: row.userId,
+    submissionId: row.id,
+    stored: true,
+    delivered: false
+  };
+  let error;
+  try {
+    await useNitroApp().hooks.callHook("forms:submitted", ctx);
+  } catch (cause) {
+    error = cause instanceof Error ? cause.message : String(cause);
+  }
+  const deliveryStatus = error ? "failed" : ctx.delivered ? "delivered" : "none";
+  await db.update(schema.formSubmissions).set({ deliveryStatus, deliveryError: error ?? null }).where(eq(schema.formSubmissions.id, row.id));
+  return { deliveryStatus, deliveryError: error ?? null };
+});

package/dist/runtime/server/routes/admin/submission.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/submission.get.js

@@ -0,0 +1,22 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const [row] = await db.select().from(schema.formSubmissions).where(eq(schema.formSubmissions.id, getRouterParam(event, "id"))).limit(1);
+  if (!row) throw createError({ statusCode: 404, statusMessage: "Submission not found." });
+  const files = await db.select().from(schema.formSubmissionFiles).where(eq(schema.formSubmissionFiles.submissionId, row.id));
+  return {
+    id: row.id,
+    formId: row.formId,
+    formSlug: row.formSlug,
+    formVersion: row.formVersion,
+    definition: row.definitionSnapshot,
+    answers: row.answers,
+    files: files.map(({ id, fieldKey, filename, contentType, size }) => ({ id, fieldKey, filename, contentType, size })),
+    locale: row.locale,
+    userId: row.userId,
+    deliveryStatus: row.deliveryStatus,
+    deliveryError: row.deliveryError,
+    createdAt: row.createdAt.toISOString()
+  };
+});

package/dist/runtime/server/routes/admin/submissions.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/admin/submissions.get.js

@@ -0,0 +1,16 @@
+import { desc, eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { renderAnswers } from "../../utils/render.js";
+export default defineEventHandler(async (event) => {
+  await requireFormsManager(event);
+  const form = await findFormById(getRouterParam(event, "id"));
+  const rows = await db.select().from(schema.formSubmissions).where(eq(schema.formSubmissions.formId, form.id)).orderBy(desc(schema.formSubmissions.createdAt)).limit(500);
+  return rows.map((row) => ({
+    id: row.id,
+    createdAt: row.createdAt.toISOString(),
+    locale: row.locale,
+    userId: row.userId,
+    deliveryStatus: row.deliveryStatus,
+    preview: renderAnswers(row.definitionSnapshot, row.answers, row.locale).filter((answer) => answer.value).slice(0, 3).map(({ label, value }) => ({ label, value: value.slice(0, 120) }))
+  }));
+});

package/dist/runtime/server/routes/public/form.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/public/form.get.js

@@ -0,0 +1,3 @@
+export default defineEventHandler(async (event) => {
+  return toPublicForm(await findPublishedForm(getRouterParam(event, "slug")));
+});

package/dist/runtime/server/routes/public/submit.post.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/routes/public/submit.post.js

@@ -0,0 +1,7 @@
+export default defineEventHandler(async (event) => {
+  const slug = getRouterParam(event, "slug");
+  await enforceRateLimit(event, slug);
+  const form = await findPublishedForm(slug);
+  const session = await getUserSession(event);
+  return processSubmission(event, form, session.user?.id ?? null);
+});

package/dist/runtime/server/utils/admin-schemas.d.ts

@@ -0,0 +1,291 @@
+import { z } from 'zod';
+export declare const formInput: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    status: z.ZodDefault<z.ZodEnum<{
+        draft: "draft";
+        published: "published";
+        archived: "archived";
+    }>>;
+    definition: z.ZodObject<{
+        mode: z.ZodEnum<{
+            single: "single";
+            stepped: "stepped";
+        }>;
+        storage: z.ZodDefault<z.ZodEnum<{
+            db: "db";
+            none: "none";
+        }>>;
+        steps: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            description: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            showIf: z.ZodOptional<z.ZodObject<{
+                field: z.ZodString;
+                op: z.ZodEnum<{
+                    eq: "eq";
+                    neq: "neq";
+                    in: "in";
+                    truthy: "truthy";
+                }>;
+                value: z.ZodOptional<z.ZodUnknown>;
+            }, z.core.$strip>>;
+            fields: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                type: z.ZodEnum<{
+                    number: "number";
+                    text: "text";
+                    email: "email";
+                    tel: "tel";
+                    textarea: "textarea";
+                    select: "select";
+                    radio: "radio";
+                    checkbox: "checkbox";
+                    date: "date";
+                    file: "file";
+                    markdown: "markdown";
+                }>;
+                content: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                description: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                placeholder: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                required: z.ZodOptional<z.ZodBoolean>;
+                options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    value: z.ZodString;
+                    label: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>;
+                }, z.core.$strip>>>;
+                multiple: z.ZodOptional<z.ZodBoolean>;
+                autocomplete: z.ZodOptional<z.ZodString>;
+                validation: z.ZodOptional<z.ZodObject<{
+                    min: z.ZodOptional<z.ZodNumber>;
+                    max: z.ZodOptional<z.ZodNumber>;
+                    minLength: z.ZodOptional<z.ZodNumber>;
+                    maxLength: z.ZodOptional<z.ZodNumber>;
+                    pattern: z.ZodOptional<z.ZodString>;
+                    maxFiles: z.ZodOptional<z.ZodNumber>;
+                    maxSize: z.ZodOptional<z.ZodNumber>;
+                    accept: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    message: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                }, z.core.$strip>>;
+                showIf: z.ZodOptional<z.ZodObject<{
+                    field: z.ZodString;
+                    op: z.ZodEnum<{
+                        eq: "eq";
+                        neq: "neq";
+                        in: "in";
+                        truthy: "truthy";
+                    }>;
+                    value: z.ZodOptional<z.ZodUnknown>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        submit: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            successMessage: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            redirect: z.ZodOptional<z.ZodString>;
+            allowResubmit: z.ZodOptional<z.ZodObject<{
+                keep: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        delivery: z.ZodOptional<z.ZodObject<{
+            email: z.ZodOptional<z.ZodObject<{
+                to: z.ZodArray<z.ZodString>;
+                subject: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const formPatch: z.ZodObject<{
+    slug: z.ZodOptional<z.ZodString>;
+    name: z.ZodOptional<z.ZodString>;
+    definition: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            single: "single";
+            stepped: "stepped";
+        }>;
+        storage: z.ZodDefault<z.ZodEnum<{
+            db: "db";
+            none: "none";
+        }>>;
+        steps: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            title: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            description: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            showIf: z.ZodOptional<z.ZodObject<{
+                field: z.ZodString;
+                op: z.ZodEnum<{
+                    eq: "eq";
+                    neq: "neq";
+                    in: "in";
+                    truthy: "truthy";
+                }>;
+                value: z.ZodOptional<z.ZodUnknown>;
+            }, z.core.$strip>>;
+            fields: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                type: z.ZodEnum<{
+                    number: "number";
+                    text: "text";
+                    email: "email";
+                    tel: "tel";
+                    textarea: "textarea";
+                    select: "select";
+                    radio: "radio";
+                    checkbox: "checkbox";
+                    date: "date";
+                    file: "file";
+                    markdown: "markdown";
+                }>;
+                content: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                description: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                placeholder: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                required: z.ZodOptional<z.ZodBoolean>;
+                options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    value: z.ZodString;
+                    label: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>;
+                }, z.core.$strip>>>;
+                multiple: z.ZodOptional<z.ZodBoolean>;
+                autocomplete: z.ZodOptional<z.ZodString>;
+                validation: z.ZodOptional<z.ZodObject<{
+                    min: z.ZodOptional<z.ZodNumber>;
+                    max: z.ZodOptional<z.ZodNumber>;
+                    minLength: z.ZodOptional<z.ZodNumber>;
+                    maxLength: z.ZodOptional<z.ZodNumber>;
+                    pattern: z.ZodOptional<z.ZodString>;
+                    maxFiles: z.ZodOptional<z.ZodNumber>;
+                    maxSize: z.ZodOptional<z.ZodNumber>;
+                    accept: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    message: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                }, z.core.$strip>>;
+                showIf: z.ZodOptional<z.ZodObject<{
+                    field: z.ZodString;
+                    op: z.ZodEnum<{
+                        eq: "eq";
+                        neq: "neq";
+                        in: "in";
+                        truthy: "truthy";
+                    }>;
+                    value: z.ZodOptional<z.ZodUnknown>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        submit: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            successMessage: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            redirect: z.ZodOptional<z.ZodString>;
+            allowResubmit: z.ZodOptional<z.ZodObject<{
+                keep: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        delivery: z.ZodOptional<z.ZodObject<{
+            email: z.ZodOptional<z.ZodObject<{
+                to: z.ZodArray<z.ZodString>;
+                subject: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    status: z.ZodOptional<z.ZodEnum<{
+        draft: "draft";
+        published: "published";
+        archived: "archived";
+    }>>;
+}, z.core.$strip>;
+export declare const importInput: z.ZodObject<{
+    forms: z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        name: z.ZodString;
+        definition: z.ZodObject<{
+            mode: z.ZodEnum<{
+                single: "single";
+                stepped: "stepped";
+            }>;
+            storage: z.ZodDefault<z.ZodEnum<{
+                db: "db";
+                none: "none";
+            }>>;
+            steps: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                title: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                description: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                showIf: z.ZodOptional<z.ZodObject<{
+                    field: z.ZodString;
+                    op: z.ZodEnum<{
+                        eq: "eq";
+                        neq: "neq";
+                        in: "in";
+                        truthy: "truthy";
+                    }>;
+                    value: z.ZodOptional<z.ZodUnknown>;
+                }, z.core.$strip>>;
+                fields: z.ZodArray<z.ZodObject<{
+                    key: z.ZodString;
+                    type: z.ZodEnum<{
+                        number: "number";
+                        text: "text";
+                        email: "email";
+                        tel: "tel";
+                        textarea: "textarea";
+                        select: "select";
+                        radio: "radio";
+                        checkbox: "checkbox";
+                        date: "date";
+                        file: "file";
+                        markdown: "markdown";
+                    }>;
+                    content: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                    label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                    description: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                    placeholder: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                    required: z.ZodOptional<z.ZodBoolean>;
+                    options: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        value: z.ZodString;
+                        label: z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>;
+                    }, z.core.$strip>>>;
+                    multiple: z.ZodOptional<z.ZodBoolean>;
+                    autocomplete: z.ZodOptional<z.ZodString>;
+                    validation: z.ZodOptional<z.ZodObject<{
+                        min: z.ZodOptional<z.ZodNumber>;
+                        max: z.ZodOptional<z.ZodNumber>;
+                        minLength: z.ZodOptional<z.ZodNumber>;
+                        maxLength: z.ZodOptional<z.ZodNumber>;
+                        pattern: z.ZodOptional<z.ZodString>;
+                        maxFiles: z.ZodOptional<z.ZodNumber>;
+                        maxSize: z.ZodOptional<z.ZodNumber>;
+                        accept: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        message: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                    }, z.core.$strip>>;
+                    showIf: z.ZodOptional<z.ZodObject<{
+                        field: z.ZodString;
+                        op: z.ZodEnum<{
+                            eq: "eq";
+                            neq: "neq";
+                            in: "in";
+                            truthy: "truthy";
+                        }>;
+                        value: z.ZodOptional<z.ZodUnknown>;
+                    }, z.core.$strip>>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            submit: z.ZodOptional<z.ZodObject<{
+                label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                successMessage: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                redirect: z.ZodOptional<z.ZodString>;
+                allowResubmit: z.ZodOptional<z.ZodObject<{
+                    keep: z.ZodArray<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            delivery: z.ZodOptional<z.ZodObject<{
+                email: z.ZodOptional<z.ZodObject<{
+                    to: z.ZodArray<z.ZodString>;
+                    subject: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>]>>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        status: z.ZodOptional<z.ZodEnum<{
+            draft: "draft";
+            published: "published";
+            archived: "archived";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;

package/dist/runtime/server/utils/admin-schemas.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+import { formDefinitionSchema } from "../../utils/index.js";
+const slug = z.string().min(1).max(100).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "Use lowercase letters, digits and dashes.").refine((value) => value !== "admin", "This slug is reserved.");
+const statusSchema = z.enum(["draft", "published", "archived"]);
+export const formInput = z.object({
+  slug,
+  name: z.string().min(1).max(200),
+  status: statusSchema.default("draft"),
+  definition: formDefinitionSchema
+});
+export const formPatch = formInput.partial().extend({ status: statusSchema.optional() });
+export const importInput = z.object({
+  forms: z.array(formInput.extend({ status: statusSchema.optional() })).min(1).max(50)
+});

package/dist/runtime/server/utils/auth.d.ts

@@ -0,0 +1,11 @@
+import type { H3Event } from 'h3';
+/**
+ * Gate for the admin routes (form definitions, submissions, files). This repo has no shared
+ * permission system, so the host app decides through the `forms:authorize` Nitro hook.
+ * Denied by default:
+ *
+ *     nitroApp.hooks.hook('forms:authorize', (ctx) => { ctx.allowed = isStaff(ctx.userId) })
+ */
+export declare function requireFormsManager(event: H3Event): Promise<{
+    userId: number;
+}>;

package/dist/runtime/server/utils/auth.js

@@ -0,0 +1,7 @@
+export async function requireFormsManager(event) {
+  const { user } = await requireUserSession(event);
+  const ctx = { event, userId: user.id, allowed: false };
+  await useNitroApp().hooks.callHook("forms:authorize", ctx);
+  if (!ctx.allowed) throw createError({ statusCode: 403, statusMessage: "You are not allowed to manage forms." });
+  return { userId: user.id };
+}

package/dist/runtime/server/utils/forms.d.ts

@@ -0,0 +1,9 @@
+import { schema } from '@nuxthub/db';
+import type { FormAdminDto, PublicFormDto } from '../../../types.js';
+type FormRow = typeof schema.forms.$inferSelect;
+export declare const toPublicForm: (row: FormRow) => PublicFormDto;
+export declare const toAdminForm: (row: FormRow) => FormAdminDto;
+export declare function findFormById(id: string): Promise<FormRow>;
+export declare function findFormBySlug(slug: string): Promise<FormRow | undefined>;
+export declare function findPublishedForm(slug: string): Promise<FormRow>;
+export {};

package/dist/runtime/server/utils/forms.js

@@ -0,0 +1,30 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+export const toPublicForm = (row) => {
+  const { delivery: _delivery, ...definition } = row.definition;
+  return { id: row.id, slug: row.slug, name: row.name, version: row.version, definition };
+};
+export const toAdminForm = (row) => ({
+  id: row.id,
+  slug: row.slug,
+  name: row.name,
+  status: row.status,
+  version: row.version,
+  definition: row.definition,
+  createdAt: row.createdAt.toISOString(),
+  updatedAt: row.updatedAt.toISOString()
+});
+export async function findFormById(id) {
+  const [row] = await db.select().from(schema.forms).where(eq(schema.forms.id, id)).limit(1);
+  if (!row) throw createError({ statusCode: 404, statusMessage: "Form not found." });
+  return row;
+}
+export async function findFormBySlug(slug) {
+  const [row] = await db.select().from(schema.forms).where(eq(schema.forms.slug, slug)).limit(1);
+  return row;
+}
+export async function findPublishedForm(slug) {
+  const row = await findFormBySlug(slug);
+  if (!row || row.status !== "published") throw createError({ statusCode: 404, statusMessage: "Form not found." });
+  return row;
+}

package/dist/runtime/server/utils/rate-limit.d.ts

@@ -0,0 +1,6 @@
+import type { H3Event } from 'h3';
+/**
+ * Fixed-window counter per client and form, kept in KV. Not exact under concurrency (read then
+ * write), which is fine for throttling casual abuse. `rateLimit: 0` disables it.
+ */
+export declare function enforceRateLimit(event: H3Event, slug: string): Promise<void>;

package/dist/runtime/server/utils/rate-limit.js

@@ -0,0 +1,14 @@
+import { kv } from "@nuxthub/kv";
+export async function enforceRateLimit(event, slug) {
+  const { rateLimit, rateLimitWindowSeconds } = useRuntimeConfig().forms;
+  if (!rateLimit) return;
+  const ip = getRequestIP(event, { xForwardedFor: true }) ?? "unknown";
+  const window = Math.floor(Date.now() / (rateLimitWindowSeconds * 1e3));
+  const key = `forms:rate:${slug}:${ip}:${window}`;
+  const used = Number(await kv.get(key) ?? 0);
+  if (used >= rateLimit) {
+    setResponseHeader(event, "retry-after", rateLimitWindowSeconds);
+    throw createError({ statusCode: 429, statusMessage: "Too many submissions, try again later." });
+  }
+  await kv.set(key, used + 1, { ttl: rateLimitWindowSeconds });
+}

package/dist/runtime/server/utils/render.d.ts

@@ -0,0 +1,11 @@
+import type { FormDefinition } from '../../../types.js';
+export type RenderedAnswer = {
+    key: string;
+    label: string;
+    value: string;
+};
+/** Answers as label/value rows in form order, using the definition the answers were given against. */
+export declare function renderAnswers(definition: FormDefinition, answers: Record<string, unknown>, locale: string): RenderedAnswer[];
+export declare const escapeHtml: (value: string) => string;
+export declare function answersToText(rows: RenderedAnswer[]): string;
+export declare function answersToHtml(rows: RenderedAnswer[]): string;

package/dist/runtime/server/utils/render.js

@@ -0,0 +1,26 @@
+import { isInputField, resolveVisibility, translate } from "../../utils/index.js";
+const optionLabel = (field, value, locale) => translate(field.options?.find((option) => option.value === value)?.label, locale) || value;
+function formatValue(field, value, locale) {
+  if (value === void 0 || value === null || value === "") return "";
+  if (field.type === "checkbox") return value === true ? "Yes" : "No";
+  if (field.type === "file") return Array.isArray(value) ? value.map((file) => file.name).join(", ") : "";
+  if ((field.type === "select" || field.type === "radio") && typeof value === "string") return optionLabel(field, value, locale);
+  return String(value);
+}
+export function renderAnswers(definition, answers, locale) {
+  return resolveVisibility(definition, answers).flatMap(({ fields }) => fields).filter(isInputField).map((field) => ({
+    key: field.key,
+    label: translate(field.label, locale) || field.key,
+    value: formatValue(field, answers[field.key], locale)
+  }));
+}
+export const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+export function answersToText(rows) {
+  return rows.map((row) => `${row.label}: ${row.value || "-"}`).join("\n");
+}
+export function answersToHtml(rows) {
+  const body = rows.map(
+    (row) => `<tr><td style="padding:4px 12px 4px 0;vertical-align:top;font-weight:600">${escapeHtml(row.label)}</td><td style="padding:4px 0;white-space:pre-wrap">${escapeHtml(row.value) || "-"}</td></tr>`
+  ).join("");
+  return `<table style="border-collapse:collapse;font-family:sans-serif;font-size:14px">${body}</table>`;
+}

package/dist/runtime/server/utils/seed.d.ts

@@ -0,0 +1,9 @@
+import type { SeedForm } from '../../../types.js';
+/**
+ * Inserts the given forms, skipping every slug that already exists. Never updates anything, so
+ * edits made in the admin are safe. Returns what was inserted and what was skipped.
+ */
+export declare function seedForms(forms: SeedForm[]): Promise<{
+    inserted: string[];
+    skipped: string[];
+}>;

package/dist/runtime/server/utils/seed.js

@@ -0,0 +1,22 @@
+import { inArray } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { newId, parseFormDefinition } from "../../utils/index.js";
+export async function seedForms(forms) {
+  if (!forms.length) return { inserted: [], skipped: [] };
+  const existing = await db.select({ slug: schema.forms.slug }).from(schema.forms).where(inArray(schema.forms.slug, forms.map((form) => form.slug)));
+  const taken = new Set(existing.map((row) => row.slug));
+  const inserted = [];
+  for (const form of forms) {
+    if (taken.has(form.slug)) continue;
+    await db.insert(schema.forms).values({
+      id: newId("frm"),
+      slug: form.slug,
+      name: form.name,
+      status: form.status ?? "draft",
+      definition: parseFormDefinition(form.definition)
+    });
+    inserted.push(form.slug);
+    taken.add(form.slug);
+  }
+  return { inserted, skipped: forms.map((form) => form.slug).filter((slug) => !inserted.includes(slug)) };
+}

package/dist/runtime/server/utils/submit.d.ts

@@ -0,0 +1,9 @@
+import type { H3Event } from 'h3';
+import { schema } from '@nuxthub/db';
+type FormRow = typeof schema.forms.$inferSelect;
+/** Validates and processes one submission for a published form. */
+export declare function processSubmission(event: H3Event, form: FormRow, userId: number | null): Promise<{
+    ok: true;
+    id: string | null;
+}>;
+export {};