@frigear-nu/forms 0.0.6 → 0.0.8

package/dist/runtime/server/utils/render.js

@@ -1,26 +1 @@
-import { isInputField, resolveVisibility, translate } from "../../utils/index.js";
-const optionLabel = (field, value, locale) => translate(field.options?.find((option) => option.value === value)?.label, locale) || value;
-function formatValue(field, value, locale) {
-  if (value === void 0 || value === null || value === "") return "";
-  if (field.type === "checkbox") return value === true ? "Yes" : "No";
-  if (field.type === "file") return Array.isArray(value) ? value.map((file) => file.name).join(", ") : "";
-  if ((field.type === "select" || field.type === "radio") && typeof value === "string") return optionLabel(field, value, locale);
-  return String(value);
-}
-export function renderAnswers(definition, answers, locale) {
-  return resolveVisibility(definition, answers).flatMap(({ fields }) => fields).filter(isInputField).map((field) => ({
-    key: field.key,
-    label: translate(field.label, locale) || field.key,
-    value: formatValue(field, answers[field.key], locale)
-  }));
-}
-export const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-export function answersToText(rows) {
-  return rows.map((row) => `${row.label}: ${row.value || "-"}`).join("\n");
-}
-export function answersToHtml(rows) {
-  const body = rows.map(
-    (row) => `<tr><td style="padding:4px 12px 4px 0;vertical-align:top;font-weight:600">${escapeHtml(row.label)}</td><td style="padding:4px 0;white-space:pre-wrap">${escapeHtml(row.value) || "-"}</td></tr>`
-  ).join("");
-  return `<table style="border-collapse:collapse;font-family:sans-serif;font-size:14px">${body}</table>`;
-}
+export { renderAnswers, escapeHtml, answersToText, answersToHtml } from "../../utils/template.js";

package/dist/runtime/server/utils/secrets.d.ts

@@ -0,0 +1,28 @@
+import type { H3Event } from 'h3';
+import type { CaptchaProvider, FormSecretsDto, SecretSource } from '../../../types.js';
+/**
+ * Per-form secrets live in `form_secrets`, encrypted (AES-256-GCM). Values are write-only: nothing here
+ * is returned by an API, logged, or copied into definitions, snapshots, deliveries or exports.
+ */
+export declare const captchaSecretKey: (provider: CaptchaProvider) => string;
+/** Secret names that may be stored. Future integrations (webhook signing secrets, ...) add theirs here. */
+export declare const formSecretKeys: readonly string[];
+export declare const isFormSecretKey: (key: string) => boolean;
+/** The decrypted secrets of a form; `unreadable` when they were encrypted with another key. */
+export declare function readFormSecrets(formId: string): Promise<{
+    secrets: Record<string, string>;
+    unreadable: boolean;
+}>;
+export declare function getFormSecret(formId: string, key: string): Promise<string | undefined>;
+/** Stores one secret, replacing an existing value; unreadable old secrets are discarded. */
+export declare function setFormSecret(formId: string, key: string, value: string): Promise<void>;
+export declare function deleteFormSecret(formId: string, key: string): Promise<void>;
+/** Secret key for a provider from the environment / module options (`NUXT_FORMS_CAPTCHA_<PROVIDER>_SECRET_KEY`). */
+export declare function envCaptchaSecret(event: H3Event | undefined, provider: CaptchaProvider): string | undefined;
+/** The secret key a captcha check of this form uses: the form's own secret, else the environment one. */
+export declare function resolveCaptchaSecret(event: H3Event | undefined, provider: CaptchaProvider, formId?: string): Promise<{
+    secretKey?: string;
+    source: SecretSource;
+}>;
+/** What an admin may know: which secrets are set (never their values) and where each captcha key comes from. */
+export declare function describeFormSecrets(event: H3Event, formId: string): Promise<FormSecretsDto>;

package/dist/runtime/server/utils/secrets.js

@@ -0,0 +1,60 @@
+import { eq } from "drizzle-orm";
+import { db, schema } from "@nuxthub/db";
+import { captchaProviders } from "../../utils/index.js";
+export const captchaSecretKey = (provider) => `captcha.${provider}.secretKey`;
+export const formSecretKeys = captchaProviders.map(captchaSecretKey);
+export const isFormSecretKey = (key) => formSecretKeys.includes(key);
+export async function readFormSecrets(formId) {
+  try {
+    const [row] = await db.select({ secrets: schema.formSecrets.secrets }).from(schema.formSecrets).where(eq(schema.formSecrets.formId, formId)).limit(1);
+    return { secrets: row?.secrets ?? {}, unreadable: false };
+  } catch (error) {
+    if (!isDecryptionError(error)) throw error;
+    console.error(`[forms] the stored secrets of form ${formId} cannot be decrypted (changed encryption key?); they must be entered again.`);
+    return { secrets: {}, unreadable: true };
+  }
+}
+export async function getFormSecret(formId, key) {
+  return (await readFormSecrets(formId)).secrets[key] || void 0;
+}
+async function writeFormSecrets(formId, secrets) {
+  if (!Object.keys(secrets).length) {
+    await db.delete(schema.formSecrets).where(eq(schema.formSecrets.formId, formId));
+    return;
+  }
+  await db.insert(schema.formSecrets).values({ formId, secrets }).onConflictDoUpdate({
+    target: schema.formSecrets.formId,
+    set: { secrets, updatedAt: /* @__PURE__ */ new Date() }
+  });
+}
+export async function setFormSecret(formId, key, value) {
+  const { secrets } = await readFormSecrets(formId);
+  await writeFormSecrets(formId, { ...secrets, [key]: value });
+}
+export async function deleteFormSecret(formId, key) {
+  const { secrets, unreadable } = await readFormSecrets(formId);
+  if (unreadable) {
+    await writeFormSecrets(formId, {});
+    return;
+  }
+  if (!(key in secrets)) return;
+  const { [key]: _removed, ...rest } = secrets;
+  await writeFormSecrets(formId, rest);
+}
+export function envCaptchaSecret(event, provider) {
+  return useRuntimeConfig(event).forms.captcha?.[provider]?.secretKey || void 0;
+}
+export async function resolveCaptchaSecret(event, provider, formId) {
+  const own = formId ? await getFormSecret(formId, captchaSecretKey(provider)) : void 0;
+  if (own) return { secretKey: own, source: "form" };
+  const env = envCaptchaSecret(event, provider);
+  return env ? { secretKey: env, source: "env" } : { source: "unset" };
+}
+export async function describeFormSecrets(event, formId) {
+  const { secrets, unreadable } = await readFormSecrets(formId);
+  const captcha = Object.fromEntries(captchaProviders.map((provider) => [
+    provider,
+    { source: secrets[captchaSecretKey(provider)] ? "form" : envCaptchaSecret(event, provider) ? "env" : "unset" }
+  ]));
+  return { keys: Object.keys(secrets).filter((key) => secrets[key]).sort(), captcha, unreadable };
+}

package/dist/runtime/server/utils/submit.d.ts

@@ -1,8 +1,19 @@
 import type { H3Event } from 'h3';
 import { schema } from '@nuxthub/db';
+type Upload = {
+    filename: string;
+    type: string;
+    data: Uint8Array;
+};
 type FormRow = typeof schema.forms.$inferSelect;
+/** A submission body that is already parsed (MCP tools pass answers as arguments instead of a request body). */
+export type SubmissionBody = {
+    answers: Record<string, unknown>;
+    locale: string;
+    uploads: Map<string, Upload[]>;
+};
 /** Validates and processes one submission for a published form. */
-export declare function processSubmission(event: H3Event, form: FormRow, userId: number | null): Promise<{
+export declare function processSubmission(event: H3Event, form: FormRow, userId: number | null, body?: SubmissionBody): Promise<{
     ok: true;
     id: string | null;
 }>;

package/dist/runtime/server/utils/submit.js

@@ -1,7 +1,7 @@
 import { eq } from "drizzle-orm";
 import { db, schema } from "@nuxthub/db";
 import { blob } from "@nuxthub/blob";
-import { buildFormSchema, newId, validatedFields } from "../../utils/index.js";
+import { buildFormSchema, newId, resolveAccess, resolveCaptcha, validatedFields } from "../../utils/index.js";
 const safeFilename = (name) => name.replace(/[^\w.-]+/g, "_").replace(/^\.+/, "").slice(0, 120) || "file";
 async function readSubmission(event) {
   const uploads = /* @__PURE__ */ new Map();
@@ -29,16 +29,17 @@ async function readSubmission(event) {
   const body = await readBody(event);
   return { answers: body?.answers ?? {}, locale: String(body?.locale ?? "en").slice(0, 20), uploads };
 }
-export async function processSubmission(event, form, userId) {
+export async function processSubmission(event, form, userId, body) {
   const definition = form.definition;
-  const { answers: raw, locale, uploads } = await readSubmission(event);
+  const { answers: raw, locale, uploads } = body ?? await readSubmission(event);
   const answers = { ...raw };
   for (const field of validatedFields(definition, raw)) {
     if (field.type !== "file") continue;
     const files2 = uploads.get(field.key) ?? [];
     answers[field.key] = files2.map((file) => ({ name: file.filename, size: file.data.byteLength, type: file.type }));
   }
-  const parsed = buildFormSchema(definition, answers, { locale }).safeParse(answers);
+  const skipCaptcha = resolveAccess(definition).auth === "token";
+  const parsed = buildFormSchema(definition, answers, { locale, skipCaptcha }).safeParse(answers);
   if (!parsed.success) {
     throw createError({
       statusCode: 422,
@@ -47,6 +48,19 @@ export async function processSubmission(event, form, userId) {
     });
   }
   const validated = parsed.data;
+  for (const field of validatedFields(definition, raw).filter((f) => f.type === "captcha")) {
+    const token = validated[field.key];
+    Reflect.deleteProperty(validated, field.key);
+    Reflect.deleteProperty(answers, field.key);
+    if (skipCaptcha) continue;
+    if (!await verifyCaptcha(event, resolveCaptcha(field, useRuntimeConfig(event).public.forms?.captcha?.defaultProvider).provider, String(token), form.id)) {
+      throw createError({
+        statusCode: 422,
+        statusMessage: "Invalid submission.",
+        data: { issues: [{ path: [field.key], message: "Captcha verification failed. Please try again." }] }
+      });
+    }
+  }
   const stored = definition.storage !== "none";
   const submissionId = stored ? newId("fsb") : null;
   const files = [];

package/dist/runtime/utils/builder.d.ts

@@ -0,0 +1,73 @@
+import type { FieldType, FormAccess, FormDefinition, FormDelivery, FormStorage, FormField, FormStep } from '../../types.js';
+/** Where a field sits in a definition. */
+export type FieldPosition = {
+    step: number;
+    index: number;
+};
+/** Field types in the order the builder palette lists them. */
+export declare const fieldTypes: FieldType[];
+/** Moves an item inside an array (returns a new array). `to` is the index in the resulting array. */
+export declare function arrayMove<T>(items: readonly T[], from: number, to: number): T[];
+/**
+ * Moves a field to another position, possibly into another step. `to.index` is the index in the
+ * target step *after* the field was taken out of its old place, which is what a drop indicator
+ * "between two rows" naturally yields once adjusted by `dropIndex`.
+ */
+export declare function moveField(definition: FormDefinition, from: FieldPosition, to: FieldPosition): FormDefinition;
+/**
+ * The insertion index to hand to `moveField` for a drop "before the row at `slot`" (a gap number
+ * counted in the target step *before* removal): dragging downwards inside the same step shifts
+ * everything above the slot up by one.
+ */
+export declare function dropIndex(from: FieldPosition | undefined, to: FieldPosition): number;
+export declare function moveStep(definition: FormDefinition, from: number, to: number): FormDefinition;
+export declare function insertField(definition: FormDefinition, at: FieldPosition, field: FormField): FormDefinition;
+export declare function removeField(definition: FormDefinition, at: FieldPosition): FormDefinition;
+export declare function updateField(definition: FormDefinition, at: FieldPosition, patch: Partial<FormField>): FormDefinition;
+export declare function updateStep(definition: FormDefinition, index: number, patch: Partial<FormStep>): FormDefinition;
+/** Every field key of the definition (markdown blocks included). */
+export declare function allFieldKeys(definition: FormDefinition): Set<string>;
+/** A field key that is valid and not used yet, e.g. `text`, `text_2`, `text_3`. */
+export declare function uniqueFieldKey(definition: FormDefinition, base: string): string;
+export declare function uniqueStepId(definition: FormDefinition, base?: string): string;
+/** A new field of the given type with sensible defaults. */
+export declare function createField(definition: FormDefinition, type: FieldType): FormField;
+export declare function createStep(definition: FormDefinition): FormStep;
+/** Inserts a step before `index` (the end when out of range). */
+export declare function insertStep(definition: FormDefinition, index: number, step: FormStep): FormDefinition;
+export declare function duplicateField(definition: FormDefinition, at: FieldPosition): FormDefinition;
+/**
+ * Changes the key of a field and rewrites everything that points at the old key (`showIf` of fields and steps,
+ * the email route field, the reply-to field and `allowResubmit.keep`), so renaming never leaves a dangling reference.
+ */
+export declare function renameFieldKey(definition: FormDefinition, at: FieldPosition, key: string): FormDefinition;
+/** Removes `showIf`s, routes, reply-to and `keep` entries that point at a field that no longer exists. */
+export declare function pruneReferences(definition: FormDefinition): FormDefinition;
+/** Switching to `single` merges every step into one; switching to `stepped` keeps the steps as they are. */
+export declare function changeMode(definition: FormDefinition, mode: FormDefinition['mode']): FormDefinition;
+/** Deletes a step; its fields move to the previous step (or the next one) so no answer field is lost silently. */
+export declare function removeStep(definition: FormDefinition, index: number, { keepFields }?: {
+    keepFields?: boolean | undefined;
+}): FormDefinition;
+type EmailDelivery = NonNullable<FormDelivery['email']>;
+/** Sets the default recipients. An empty list switches email delivery off and drops its subject, body, reply-to and routes. */
+export declare function setEmailRecipients(definition: FormDefinition, to: readonly string[]): FormDefinition;
+/** Patches subject / reply-to of an existing email delivery (no-op without recipients); `undefined` values are removed. */
+export declare function patchEmailDelivery(definition: FormDefinition, patch: Partial<Pick<EmailDelivery, 'subject' | 'body' | 'replyToField'>>): FormDefinition;
+/** Chooses the field whose answer routes the email; `undefined` removes all routes. Switching the field starts with no routes. */
+export declare function setRouteField(definition: FormDefinition, field: string | undefined): FormDefinition;
+/** Sets the recipients for one answer value of the route field; an empty list removes that route. */
+export declare function setRoute(definition: FormDefinition, value: string, to: readonly string[]): FormDefinition;
+export declare function setStorage(definition: FormDefinition, storage: FormStorage): FormDefinition;
+/** Sets who may use the form. Token access forces API-only (a token cannot be typed into a page). */
+export declare function setAccess(definition: FormDefinition, patch: Partial<FormAccess>): FormDefinition;
+/** Problems of a storage choice: file fields cannot work without storage, and a form that neither stores nor emails loses its answers. */
+export declare function storageWarnings(definition: FormDefinition): {
+    files: boolean;
+    lost: boolean;
+};
+/** Email-type fields that can serve as the reply-to address. */
+export declare function emailFieldKeys(definition: FormDefinition): string[];
+/** Select / radio fields whose answer can route the email. */
+export declare function routableFields(definition: FormDefinition): FormField[];
+export {};

package/dist/runtime/utils/builder.js

@@ -0,0 +1,220 @@
+export const fieldTypes = ["text", "textarea", "email", "tel", "number", "date", "select", "radio", "checkbox", "file", "markdown", "captcha"];
+const clamp = (value, max) => Math.max(0, Math.min(value, max));
+export function arrayMove(items, from, to) {
+  const next = [...items];
+  if (from < 0 || from >= next.length) return next;
+  const [item] = next.splice(from, 1);
+  next.splice(clamp(to, next.length), 0, item);
+  return next;
+}
+export function moveField(definition, from, to) {
+  const source = definition.steps[from.step]?.fields[from.index];
+  if (!source || !definition.steps[to.step]) return definition;
+  const steps = definition.steps.map((step) => ({ ...step, fields: [...step.fields] }));
+  steps[from.step].fields.splice(from.index, 1);
+  steps[to.step].fields.splice(clamp(to.index, steps[to.step].fields.length), 0, source);
+  return { ...definition, steps };
+}
+export function dropIndex(from, to) {
+  return from && from.step === to.step && from.index < to.index ? to.index - 1 : to.index;
+}
+export function moveStep(definition, from, to) {
+  return { ...definition, steps: arrayMove(definition.steps, from, to) };
+}
+export function insertField(definition, at, field) {
+  if (!definition.steps[at.step]) return definition;
+  const steps = definition.steps.map((step) => ({ ...step, fields: [...step.fields] }));
+  steps[at.step].fields.splice(clamp(at.index, steps[at.step].fields.length), 0, field);
+  return { ...definition, steps };
+}
+export function removeField(definition, at) {
+  if (!definition.steps[at.step]?.fields[at.index]) return definition;
+  const steps = definition.steps.map((step) => ({ ...step, fields: [...step.fields] }));
+  steps[at.step].fields.splice(at.index, 1);
+  return pruneReferences({ ...definition, steps });
+}
+export function updateField(definition, at, patch) {
+  if (!definition.steps[at.step]?.fields[at.index]) return definition;
+  const steps = definition.steps.map((step, stepIndex) => stepIndex === at.step ? { ...step, fields: step.fields.map((field, index) => index === at.index ? { ...field, ...patch } : field) } : step);
+  return { ...definition, steps };
+}
+export function updateStep(definition, index, patch) {
+  if (!definition.steps[index]) return definition;
+  return { ...definition, steps: definition.steps.map((step, i) => i === index ? { ...step, ...patch } : step) };
+}
+export function allFieldKeys(definition) {
+  return new Set(definition.steps.flatMap((step) => step.fields.map((field) => field.key)));
+}
+function uniqueName(taken, base, separator) {
+  if (!taken.has(base)) return base;
+  let n = 2;
+  while (taken.has(`${base}${separator}${n}`)) n++;
+  return `${base}${separator}${n}`;
+}
+export function uniqueFieldKey(definition, base) {
+  const clean = base.replace(/\W+/g, "_").replace(/^[^a-z]+/i, "").replace(/_+$/, "") || "field";
+  return uniqueName(allFieldKeys(definition), clean, "_");
+}
+export function uniqueStepId(definition, base = "step") {
+  return uniqueName(new Set(definition.steps.map((step) => step.id)), base, "-");
+}
+export function createField(definition, type) {
+  const field = { key: uniqueFieldKey(definition, type), type };
+  if (type === "markdown") field.content = "Text";
+  else if (type !== "captcha") field.label = "Untitled";
+  if (type === "select" || type === "radio") {
+    field.options = [{ value: "option_1", label: "Option 1" }, { value: "option_2", label: "Option 2" }];
+  }
+  if (type === "email") field.autocomplete = "email";
+  if (type === "tel") field.autocomplete = "tel";
+  if (type === "captcha") field.captcha = { provider: "turnstile" };
+  return field;
+}
+export function createStep(definition) {
+  const id = uniqueStepId(definition);
+  return { id, title: `Step ${definition.steps.length + 1}`, fields: [] };
+}
+export function insertStep(definition, index, step) {
+  const steps = [...definition.steps];
+  steps.splice(clamp(index, steps.length), 0, step);
+  return { ...definition, steps };
+}
+export function duplicateField(definition, at) {
+  const field = definition.steps[at.step]?.fields[at.index];
+  if (!field) return definition;
+  const copy = structuredClone(field);
+  copy.key = uniqueFieldKey(definition, field.key);
+  delete copy.showIf;
+  return insertField(definition, { step: at.step, index: at.index + 1 }, copy);
+}
+export function renameFieldKey(definition, at, key) {
+  const current = definition.steps[at.step]?.fields[at.index];
+  if (!current || current.key === key) return definition;
+  const from = current.key;
+  const retarget = (item) => item.showIf?.field === from ? { ...item, showIf: { ...item.showIf, field: key } } : item;
+  const steps = definition.steps.map((step, stepIndex) => ({
+    ...retarget(step),
+    fields: step.fields.map((field, index) => stepIndex === at.step && index === at.index ? { ...retarget(field), key } : retarget(field))
+  }));
+  const next = { ...definition, steps };
+  const email = definition.delivery?.email;
+  if (email) {
+    next.delivery = {
+      ...definition.delivery,
+      email: {
+        ...email,
+        ...email.routes?.field === from ? { routes: { ...email.routes, field: key } } : {},
+        ...email.replyToField === from ? { replyToField: key } : {}
+      }
+    };
+  }
+  const resubmit = definition.submit?.allowResubmit;
+  if (resubmit?.keep.includes(from)) {
+    next.submit = { ...definition.submit, allowResubmit: { keep: resubmit.keep.map((entry) => entry === from ? key : entry) } };
+  }
+  return next;
+}
+export function pruneReferences(definition) {
+  const keys = allFieldKeys(definition);
+  const seen = /* @__PURE__ */ new Set();
+  const ok = (condition) => !condition || seen.has(condition.field);
+  const steps = definition.steps.map((step) => {
+    const stepOk = ok(step.showIf);
+    const fields = step.fields.map((field) => {
+      const keep = ok(field.showIf);
+      if (field.type !== "markdown" && field.type !== "captcha") seen.add(field.key);
+      if (keep) return field;
+      const { showIf: _dropped2, ...rest2 } = field;
+      return rest2;
+    });
+    if (stepOk) return { ...step, fields };
+    const { showIf: _dropped, ...rest } = step;
+    return { ...rest, fields };
+  });
+  const next = { ...definition, steps };
+  const email = definition.delivery?.email;
+  if (email) {
+    const { routes, replyToField, ...rest } = email;
+    next.delivery = {
+      ...definition.delivery,
+      email: {
+        ...rest,
+        ...routes && seen.has(routes.field) ? { routes } : {},
+        ...replyToField && keys.has(replyToField) ? { replyToField } : {}
+      }
+    };
+  }
+  const resubmit = definition.submit?.allowResubmit;
+  if (resubmit) next.submit = { ...definition.submit, allowResubmit: { keep: resubmit.keep.filter((key) => keys.has(key)) } };
+  return next;
+}
+export function changeMode(definition, mode) {
+  if (mode === definition.mode) return definition;
+  if (mode === "stepped") return { ...definition, mode };
+  const first = definition.steps[0] ?? { id: "main", fields: [] };
+  const { showIf: _dropped, ...rest } = first;
+  return pruneReferences({ ...definition, mode, steps: [{ ...rest, fields: definition.steps.flatMap((step) => step.fields) }] });
+}
+export function removeStep(definition, index, { keepFields = false } = {}) {
+  if (definition.steps.length <= 1 || !definition.steps[index]) return definition;
+  const removed = definition.steps[index];
+  const steps = definition.steps.filter((_, i) => i !== index).map((step) => ({ ...step, fields: [...step.fields] }));
+  if (keepFields) steps[Math.max(0, index - 1)].fields.push(...removed.fields);
+  return pruneReferences({ ...definition, steps });
+}
+const cleanAddresses = (to) => [...new Set(to.map((address) => address.trim()).filter(Boolean))];
+function withEmail(definition, email) {
+  const { delivery: _dropped, ...rest } = definition;
+  const delivery = { ...definition.delivery };
+  if (email) delivery.email = email;
+  else delete delivery.email;
+  return Object.keys(delivery).length ? { ...rest, delivery } : rest;
+}
+export function setEmailRecipients(definition, to) {
+  const addresses = cleanAddresses(to);
+  if (!addresses.length) return withEmail(definition, void 0);
+  return withEmail(definition, { ...definition.delivery?.email, to: addresses });
+}
+export function patchEmailDelivery(definition, patch) {
+  const email = definition.delivery?.email;
+  if (!email) return definition;
+  const merged = { ...email, ...patch };
+  const { subject, body, replyToField, ...rest } = merged;
+  return withEmail(definition, { ...rest, ...subject ? { subject } : {}, ...body ? { body } : {}, ...replyToField ? { replyToField } : {} });
+}
+export function setRouteField(definition, field) {
+  const email = definition.delivery?.email;
+  if (!email) return definition;
+  const { routes, ...rest } = email;
+  if (!field) return withEmail(definition, rest);
+  return withEmail(definition, { ...rest, routes: routes?.field === field ? routes : { field, to: {} } });
+}
+export function setRoute(definition, value, to) {
+  const email = definition.delivery?.email;
+  if (!email?.routes) return definition;
+  const addresses = cleanAddresses(to);
+  const routed = Object.fromEntries(Object.entries(email.routes.to).filter(([key]) => key !== value));
+  if (addresses.length) routed[value] = addresses;
+  return withEmail(definition, { ...email, routes: { field: email.routes.field, to: routed } });
+}
+export function setStorage(definition, storage) {
+  return definition.storage === storage ? definition : { ...definition, storage };
+}
+export function setAccess(definition, patch) {
+  const next = { availability: "web", auth: "none", ...definition.access, ...patch };
+  if (next.auth === "token") next.availability = "api";
+  return { ...definition, access: next };
+}
+export function storageWarnings(definition) {
+  if (definition.storage !== "none") return { files: false, lost: false };
+  return {
+    files: definition.steps.some((step) => step.fields.some((field) => field.type === "file")),
+    lost: !definition.delivery?.email
+  };
+}
+export function emailFieldKeys(definition) {
+  return definition.steps.flatMap((step) => step.fields.filter((field) => field.type === "email").map((field) => field.key));
+}
+export function routableFields(definition) {
+  return definition.steps.flatMap((step) => step.fields.filter((field) => (field.type === "select" || field.type === "radio") && field.options?.length));
+}

package/dist/runtime/utils/captcha.d.ts

@@ -0,0 +1,9 @@
+import type { CaptchaConfig, CaptchaProvider, FormField } from '../../types.js';
+export declare const captchaProviders: CaptchaProvider[];
+/** A configured provider name, or `turnstile` when it is missing or not a known provider. */
+export declare function normalizeCaptchaProvider(value: unknown): CaptchaProvider;
+/**
+ * Provider and (optional) site key override of a captcha field. A field without a provider uses
+ * `defaultProvider` (`runtimeConfig.public.forms.captcha.defaultProvider`), `turnstile` when omitted.
+ */
+export declare function resolveCaptcha(field: Pick<FormField, 'captcha'>, defaultProvider?: unknown): Required<Pick<CaptchaConfig, 'provider'>> & CaptchaConfig;

package/dist/runtime/utils/captcha.js

@@ -0,0 +1,7 @@
+export const captchaProviders = ["turnstile", "recaptcha", "hcaptcha"];
+export function normalizeCaptchaProvider(value) {
+  return captchaProviders.includes(value) ? value : "turnstile";
+}
+export function resolveCaptcha(field, defaultProvider) {
+  return { ...field.captcha, provider: field.captcha?.provider ?? normalizeCaptchaProvider(defaultProvider) };
+}

package/dist/runtime/utils/conditions.d.ts

@@ -15,5 +15,7 @@ export type VisibleStep = {
  */
 export declare function resolveVisibility(definition: FormDefinition, answers: Answers): VisibleStep[];
 export declare function isFieldVisible(definition: FormDefinition, key: string, answers: Answers): boolean;
-/** Fields that collect an answer (everything except static `markdown`). */
+/** Fields that take part in validation (everything except static `markdown`; includes `captcha`). */
 export declare const isInputField: (field: FormField) => boolean;
+/** Fields whose answer is stored, shown and delivered: input fields except `captcha` (its token is never kept). */
+export declare const isAnswerField: (field: FormField) => boolean;

package/dist/runtime/utils/conditions.js

@@ -3,6 +3,9 @@ export function evaluateCondition(condition, answers) {
   if (!condition) return true;
   const answer = answers[condition.field];
   switch (condition.op) {
+    case "empty":
+      return isEmpty(answer);
+    case "notEmpty":
     case "truthy":
       return !isEmpty(answer);
     case "eq":
@@ -34,3 +37,4 @@ export function isFieldVisible(definition, key, answers) {
   return resolveVisibility(definition, answers).some(({ fields }) => fields.some((field) => field.key === key));
 }
 export const isInputField = (field) => field.type !== "markdown";
+export const isAnswerField = (field) => field.type !== "markdown" && field.type !== "captcha";