@nextlyhq/plugin-form-builder 0.0.1

package/dist/index.js

@@ -0,0 +1,2470 @@
+// src/plugin.ts
+import { getCollectionsHandler } from "nextly/runtime";
+
+// src/collections/forms.ts
+import {
+  text,
+  textarea,
+  select,
+  checkbox,
+  group,
+  json,
+  relationship
+} from "nextly";
+function formsCollection(pluginConfig) {
+  const {
+    slug,
+    labels,
+    fields: additionalFields,
+    access: accessOverrides,
+    ...overrides
+  } = pluginConfig.formOverrides;
+  const settingsFields = [
+    text({
+      name: "submitButtonText",
+      label: "Submit Button Text",
+      defaultValue: "Submit",
+      admin: {
+        description: "Text displayed on the form submit button"
+      }
+    }),
+    select({
+      name: "confirmationType",
+      label: "After Submission",
+      defaultValue: "message",
+      options: [
+        { label: "Show Message", value: "message" },
+        { label: "Redirect to URL", value: "redirect" },
+        ...pluginConfig.redirectRelationships.length > 0 ? [{ label: "Redirect to Page", value: "relationship" }] : []
+      ],
+      admin: {
+        description: "What happens after a successful form submission"
+      }
+    }),
+    textarea({
+      name: "successMessage",
+      label: "Success Message",
+      defaultValue: "Thank you for your submission!",
+      admin: {
+        description: "Message shown after successful submission",
+        condition: {
+          field: "settings.confirmationType",
+          equals: "message"
+        }
+      }
+    }),
+    text({
+      name: "redirectUrl",
+      label: "Redirect URL",
+      admin: {
+        description: "URL to redirect to after submission",
+        condition: {
+          field: "settings.confirmationType",
+          equals: "redirect"
+        }
+      }
+    })
+  ];
+  if (pluginConfig.redirectRelationships.length > 0) {
+    settingsFields.push(
+      relationship({
+        name: "redirectPage",
+        label: "Redirect Page",
+        relationTo: pluginConfig.redirectRelationships,
+        admin: {
+          description: "Select a page to redirect to after submission",
+          condition: {
+            field: "settings.confirmationType",
+            equals: "relationship"
+          }
+        }
+      })
+    );
+  }
+  settingsFields.push(
+    checkbox({
+      name: "allowMultipleSubmissions",
+      label: "Allow Multiple Submissions",
+      defaultValue: true,
+      admin: {
+        description: "Allow the same user/IP to submit this form multiple times"
+      }
+    }),
+    checkbox({
+      name: "captchaEnabled",
+      label: "Enable reCAPTCHA",
+      defaultValue: false,
+      admin: {
+        description: "Protect this form with Google reCAPTCHA v3"
+      }
+    }),
+    text({
+      name: "captchaSiteKey",
+      label: "reCAPTCHA Site Key",
+      admin: {
+        description: "Override the default reCAPTCHA site key for this form",
+        condition: {
+          field: "settings.captchaEnabled",
+          equals: true
+        }
+      }
+    })
+  );
+  const defaultFields = [
+    // ============================================================
+    // Basic Information
+    // ============================================================
+    text({
+      name: "name",
+      label: "Form Name",
+      required: true,
+      admin: {
+        description: "Internal name for this form (not shown to users)"
+      }
+    }),
+    text({
+      name: "slug",
+      label: "Slug",
+      required: true,
+      unique: true,
+      admin: {
+        description: "URL-friendly identifier. Used in API: /api/forms/{slug}"
+      }
+    }),
+    textarea({
+      name: "description",
+      label: "Description",
+      admin: {
+        description: "Internal notes about this form's purpose"
+      }
+    }),
+    // ============================================================
+    // Form Fields (JSON schema managed by Form Builder UI)
+    // ============================================================
+    json({
+      name: "fields",
+      label: "Form Fields",
+      required: true,
+      defaultValue: [],
+      admin: {
+        description: "Form field configuration. Managed by the Form Builder UI."
+      }
+    }),
+    // ============================================================
+    // Form Settings
+    // ============================================================
+    group({
+      name: "settings",
+      label: "Form Settings",
+      fields: settingsFields
+    }),
+    // ============================================================
+    // Email Notifications
+    // ============================================================
+    json({
+      name: "notifications",
+      label: "Email Integrations",
+      defaultValue: [],
+      admin: {
+        description: "Email notification integrations. Managed by the Form Builder UI."
+      }
+    }),
+    // ============================================================
+    // Status
+    // ============================================================
+    select({
+      name: "status",
+      label: "Status",
+      required: true,
+      defaultValue: "draft",
+      options: [
+        { label: "Draft", value: "draft" },
+        { label: "Published", value: "published" },
+        { label: "Closed", value: "closed" }
+      ],
+      admin: {
+        description: "Only published forms can receive submissions. Closed forms display a message instead."
+      }
+    }),
+    textarea({
+      name: "closedMessage",
+      label: "Closed Form Message",
+      defaultValue: "This form is no longer accepting submissions.",
+      admin: {
+        description: "Message shown when form status is 'closed'",
+        condition: {
+          field: "status",
+          equals: "closed"
+        }
+      }
+    })
+  ];
+  let finalFields;
+  if (Array.isArray(additionalFields) && additionalFields.length > 0) {
+    finalFields = [...defaultFields, ...additionalFields];
+  } else {
+    finalFields = defaultFields;
+  }
+  const dbName = slug.replace(/-/g, "_");
+  return {
+    slug,
+    dbName,
+    labels,
+    fields: finalFields,
+    timestamps: true,
+    admin: {
+      isPlugin: true,
+      group: "Forms",
+      order: 50,
+      useAsTitle: "name",
+      description: "Create and manage your form templates using the visual form builder. Create and manage forms for collecting user submissions",
+      // Custom components for visual form builder
+      components: {
+        views: {
+          // Replace default edit view with visual Form Builder
+          Edit: {
+            Component: "@nextlyhq/plugin-form-builder/admin#FormBuilderView"
+          }
+        }
+      },
+      ...overrides.admin
+    },
+    // Access control with sensible defaults
+    access: {
+      // Anyone can read forms (needed for frontend rendering)
+      read: accessOverrides?.read ?? true,
+      // Only authenticated users can create/update forms
+      create: accessOverrides?.create ?? (({ user }) => !!user),
+      update: accessOverrides?.update ?? (({ user }) => !!user),
+      // Only admins can delete forms (falls back to DB permissions)
+      delete: accessOverrides?.delete ?? (({ roles }) => roles.includes("admin") || roles.includes("super-admin"))
+    },
+    hooks: {
+      // Auto-generate slug from name if not provided
+      beforeValidate: [
+        (context) => {
+          const { data, operation } = context;
+          if (operation === "create" && data && !data.slug && data.name) {
+            data.slug = String(data.name).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+          }
+          if (data && (data.fields === void 0 || Array.isArray(data.fields) && data.fields.length === 0)) {
+            throw new Error("Form must have at least one field.");
+          }
+          return data;
+        }
+      ],
+      // Add virtual submission count field
+      afterRead: [
+        (context) => {
+          const { data } = context;
+          if (data) {
+            data.submissionCount = 0;
+          }
+          return data;
+        }
+      ]
+    },
+    // Spread any additional overrides (excluding already used properties)
+    ...overrides
+  };
+}
+
+// src/collections/submissions.ts
+import { text as text2, textarea as textarea2, select as select2, json as json2, date, relationship as relationship2 } from "nextly";
+function submissionsCollection(pluginConfig) {
+  const {
+    slug,
+    labels,
+    fields: additionalFields,
+    access: accessOverrides,
+    ...overrides
+  } = pluginConfig.formSubmissionOverrides;
+  const formSlug = pluginConfig.formOverrides.slug;
+  const defaultFields = [
+    // ============================================================
+    // Form Relationship
+    // ============================================================
+    relationship2({
+      name: "form",
+      label: "Form",
+      relationTo: formSlug,
+      required: true,
+      admin: {
+        readOnly: true,
+        description: "The form this submission belongs to"
+      }
+    }),
+    // ============================================================
+    // Submission Data (JSON)
+    // ============================================================
+    json2({
+      name: "data",
+      label: "Submission Data",
+      required: true,
+      admin: {
+        readOnly: true,
+        description: "The submitted form data as JSON"
+      }
+    }),
+    // ============================================================
+    // Status
+    // ============================================================
+    select2({
+      name: "status",
+      label: "Status",
+      required: true,
+      defaultValue: "new",
+      options: [
+        { label: "New", value: "new" },
+        { label: "Read", value: "read" },
+        { label: "Archived", value: "archived" }
+      ],
+      admin: {
+        description: "Track whether this submission has been reviewed"
+      }
+    }),
+    // ============================================================
+    // Internal Notes
+    // ============================================================
+    textarea2({
+      name: "notes",
+      label: "Internal Notes",
+      admin: {
+        description: "Notes visible only to admins (not shown to submitter)"
+      }
+    }),
+    // ============================================================
+    // Metadata
+    // ============================================================
+    text2({
+      name: "ipAddress",
+      label: "IP Address",
+      admin: {
+        readOnly: true,
+        description: "IP address of the submitter"
+      }
+    }),
+    text2({
+      name: "userAgent",
+      label: "User Agent",
+      admin: {
+        readOnly: true,
+        description: "Browser/device information of the submitter"
+      }
+    }),
+    date({
+      name: "submittedAt",
+      label: "Submitted At",
+      required: true,
+      admin: {
+        readOnly: true,
+        description: "When the form was submitted"
+      }
+    })
+  ];
+  let finalFields;
+  if (Array.isArray(additionalFields) && additionalFields.length > 0) {
+    finalFields = [...defaultFields, ...additionalFields];
+  } else {
+    finalFields = defaultFields;
+  }
+  const dbName = slug.replace(/-/g, "_");
+  return {
+    slug,
+    dbName,
+    labels,
+    fields: finalFields,
+    timestamps: true,
+    admin: {
+      isPlugin: true,
+      group: "Forms",
+      order: 51,
+      useAsTitle: "id",
+      description: "View and manage form submissions",
+      // Custom components for submissions list
+      components: {
+        // Filter dropdown to filter submissions by form
+        BeforeListTable: "@nextlyhq/plugin-form-builder/admin#SubmissionsFilter"
+      },
+      ...overrides.admin
+    },
+    // Access control with sensible defaults
+    // Public can create (submit forms), but only authenticated users can read/update/delete
+    access: {
+      // Anyone can submit forms (public access)
+      create: accessOverrides?.create ?? true,
+      // Only authenticated users can view submissions
+      read: accessOverrides?.read ?? (({ user }) => !!user),
+      // Only authenticated users can update submissions (e.g., change status, add notes)
+      update: accessOverrides?.update ?? (({ user }) => !!user),
+      // Only admins can delete submissions (falls back to DB permissions)
+      delete: accessOverrides?.delete ?? (({ roles }) => roles.includes("admin") || roles.includes("super-admin"))
+    },
+    hooks: {
+      // Auto-set submittedAt timestamp on creation
+      beforeValidate: [
+        (context) => {
+          const { data, operation } = context;
+          if (operation === "create" && data && !data.submittedAt) {
+            data.submittedAt = /* @__PURE__ */ new Date();
+          }
+          return data;
+        }
+      ],
+      afterChange: [
+        (context) => {
+          const { data } = context;
+          return data;
+        }
+      ]
+    },
+    // Spread any additional overrides (excluding already used properties)
+    ...overrides
+  };
+}
+
+// src/plugin.ts
+function resolveConfig(options) {
+  const formOverrides = options.formOverrides || options.collections?.forms || {};
+  const submissionOverrides = options.formSubmissionOverrides || options.collections?.submissions || {};
+  return {
+    formOverrides: {
+      ...formOverrides,
+      slug: formOverrides.slug || "forms",
+      labels: {
+        singular: formOverrides.labels?.singular || "Form",
+        plural: formOverrides.labels?.plural || "Forms"
+      }
+    },
+    formSubmissionOverrides: {
+      ...submissionOverrides,
+      slug: submissionOverrides.slug || "form-submissions",
+      labels: {
+        singular: submissionOverrides.labels?.singular || "Submission",
+        plural: submissionOverrides.labels?.plural || "Submissions"
+      }
+    },
+    fields: {
+      text: options.fields?.text ?? true,
+      email: options.fields?.email ?? true,
+      number: options.fields?.number ?? true,
+      phone: options.fields?.phone ?? true,
+      url: options.fields?.url ?? true,
+      textarea: options.fields?.textarea ?? true,
+      select: options.fields?.select ?? true,
+      checkbox: options.fields?.checkbox ?? true,
+      radio: options.fields?.radio ?? true,
+      file: options.fields?.file ?? true,
+      date: options.fields?.date ?? true,
+      time: options.fields?.time ?? true,
+      hidden: options.fields?.hidden ?? true
+    },
+    redirectRelationships: options.redirectRelationships || [],
+    beforeEmail: options.beforeEmail,
+    notifications: {
+      defaultFrom: options.notifications?.defaultFrom,
+      defaultToEmail: options.notifications?.defaultToEmail,
+      enabled: options.notifications?.enabled ?? true
+    },
+    spamProtection: {
+      honeypot: options.spamProtection?.honeypot ?? true,
+      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
+      rateLimit: {
+        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
+        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
+      }
+    },
+    uploads: {
+      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
+      // 10 MB
+      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
+        "image/*",
+        "application/pdf",
+        "text/*"
+      ],
+      uploadCollection: options.uploads?.uploadCollection ?? "media"
+    },
+    features: {
+      builder: options.features?.builder ?? true,
+      conditionalLogic: options.features?.conditionalLogic ?? true,
+      fileUploads: options.features?.fileUploads ?? true
+    }
+  };
+}
+function formBuilder(options = {}) {
+  const resolvedConfig = resolveConfig(options);
+  const formsCol = formsCollection(resolvedConfig);
+  const submissionsCol = submissionsCollection(resolvedConfig);
+  const plugin = {
+    name: "@nextlyhq/plugin-form-builder",
+    version: "0.0.8",
+    collections: [formsCol, submissionsCol],
+    admin: {
+      order: 50,
+      description: "Create and manage forms with submission tracking"
+    },
+    // -- Config transformer --------------------------------------------------
+    // Automatically adds plugin collections so users don't have to spread them.
+    config(config) {
+      const existing = config.collections || [];
+      const formsSlug = resolvedConfig.formOverrides.slug;
+      const submissionsSlug = resolvedConfig.formSubmissionOverrides.slug;
+      const toAdd = [];
+      if (!existing.some((c) => c.slug === formsSlug))
+        toAdd.push(formsCol);
+      if (!existing.some((c) => c.slug === submissionsSlug))
+        toAdd.push(submissionsCol);
+      return { ...config, collections: [...existing, ...toAdd] };
+    },
+    // -- Init ----------------------------------------------------------------
+    // Registers an afterCreate hook on submissions to send email notifications.
+    init(nextly) {
+      const submissionSlug = resolvedConfig.formSubmissionOverrides.slug;
+      const guardKey = `__formBuilder_afterCreate_${submissionSlug}`;
+      const g = globalThis;
+      if (g[guardKey]) return;
+      g[guardKey] = true;
+      nextly.infra.logger.info("Form Builder plugin initialized", {
+        formsCollection: resolvedConfig.formOverrides.slug,
+        submissionsCollection: submissionSlug,
+        enabledFields: Object.entries(resolvedConfig.fields).filter(([, on]) => on).map(([name]) => name)
+      });
+      nextly.__formBuilderConfig = resolvedConfig;
+      nextly.hooks.on(
+        "afterCreate",
+        submissionSlug,
+        async (context) => {
+          await handleSubmissionCreated(context, resolvedConfig, nextly);
+        }
+      );
+    }
+  };
+  return {
+    plugin,
+    collections: [formsCol, submissionsCol],
+    config: resolvedConfig
+  };
+}
+function getFormBuilderConfig(nextly) {
+  if (!nextly || typeof nextly !== "object") return void 0;
+  return nextly.__formBuilderConfig;
+}
+function resolveFieldRef(ref, data) {
+  const match = ref.match(/^\{\{(\w+)\}\}$/);
+  if (!match) return ref;
+  const value = data[match[1]];
+  return typeof value === "string" ? value : "";
+}
+function collectAttachmentInputs(fields, submittedData) {
+  const attachments = [];
+  for (const field of fields) {
+    if (field.type !== "file" || !field.attachToEmail) continue;
+    const name = field.name;
+    const value = submittedData[name];
+    if (value == null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (typeof item === "string" && item) {
+          attachments.push({ mediaId: item });
+        }
+      }
+    } else if (typeof value === "string" && value) {
+      attachments.push({ mediaId: value });
+    }
+  }
+  return attachments;
+}
+async function handleSubmissionCreated(context, config, nextly) {
+  const submission = context.data;
+  if (!submission) return;
+  const rawFormId = submission.form;
+  let formId = null;
+  if (typeof rawFormId === "string") {
+    formId = rawFormId;
+  } else if (rawFormId && typeof rawFormId === "object") {
+    const maybeId = rawFormId.id;
+    if (typeof maybeId === "string") formId = maybeId;
+  }
+  if (!formId) return;
+  const form = await fetchParentForm(config, formId, nextly);
+  if (!form) return;
+  const notifications = Array.isArray(form.notifications) ? form.notifications : [];
+  if (notifications.length === 0) return;
+  const emailService = nextly.services.email;
+  if (!emailService) return;
+  const submittedData = submission.data ?? {};
+  const formFields = Array.isArray(form.fields) ? form.fields : [];
+  const fileAttachments = collectAttachmentInputs(formFields, submittedData);
+  const seen = /* @__PURE__ */ new Set();
+  for (const notification of notifications) {
+    if (!notification.enabled || !notification.templateSlug) continue;
+    const key = notification.id || `${notification.to}::${notification.templateSlug}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    try {
+      const to = notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to;
+      if (!to) {
+        nextly.infra.logger.warn?.(
+          "Form Builder: empty recipient, skipping notification",
+          { notificationId: notification.id, formSlug: form.slug }
+        );
+        continue;
+      }
+      const cc = Array.isArray(notification.cc) && notification.cc.length ? notification.cc : void 0;
+      const bcc = Array.isArray(notification.bcc) && notification.bcc.length ? notification.bcc : void 0;
+      await emailService.sendWithTemplate(
+        notification.templateSlug,
+        to,
+        { ...submittedData, formName: form.name, submissionId: submission.id },
+        {
+          providerId: notification.providerId,
+          cc,
+          bcc,
+          attachments: fileAttachments.length > 0 ? fileAttachments : void 0
+        }
+      );
+      nextly.infra.logger.info?.("Form Builder: notification sent", {
+        formSlug: form.slug,
+        to,
+        templateSlug: notification.templateSlug,
+        attachmentCount: fileAttachments.length
+      });
+    } catch (err) {
+      nextly.infra.logger.error?.("Form Builder: notification failed", {
+        notificationId: notification.id,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+}
+async function fetchParentForm(config, formId, nextly) {
+  try {
+    const handler = getCollectionsHandler();
+    if (!handler) {
+      nextly.infra.logger.warn?.(
+        "Form Builder: CollectionsHandler unavailable, skipping notifications"
+      );
+      return null;
+    }
+    const result = await handler.getEntry({
+      collectionName: config.formOverrides.slug,
+      entryId: formId,
+      overrideAccess: true
+    });
+    const fromData = result?.data;
+    if (fromData) return fromData;
+    const fromDoc = result?.doc;
+    if (fromDoc && typeof fromDoc === "object") {
+      return fromDoc;
+    }
+    return null;
+  } catch (err) {
+    nextly.infra.logger.error?.("Form Builder: failed to fetch form", {
+      formId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return null;
+  }
+}
+
+// src/types.ts
+function isFormField(value) {
+  return typeof value === "object" && value !== null && "type" in value && "name" in value && "label" in value;
+}
+function isFormFieldType(field, type) {
+  return field.type === type;
+}
+function isTextFormField(field) {
+  return field.type === "text";
+}
+function isEmailFormField(field) {
+  return field.type === "email";
+}
+function isSelectFormField(field) {
+  return field.type === "select";
+}
+function isCheckboxFormField(field) {
+  return field.type === "checkbox";
+}
+function isFileFormField(field) {
+  return field.type === "file";
+}
+
+// src/config/validate-form.ts
+var RESERVED_FORM_SLUGS = [
+  // API routes
+  "api",
+  "submit",
+  "submissions",
+  "export",
+  // System slugs
+  "admin",
+  "new",
+  "create",
+  "edit",
+  "delete"
+];
+var RESERVED_SLUGS_SET = new Set(RESERVED_FORM_SLUGS);
+var SLUG_PATTERN = /^[a-z][a-z0-9_-]*$/;
+var FIELD_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+var VALID_FIELD_TYPES = [
+  "text",
+  "email",
+  "number",
+  "phone",
+  "url",
+  "textarea",
+  "select",
+  "checkbox",
+  "radio",
+  "file",
+  "date",
+  "time",
+  "hidden"
+];
+var VALID_FIELD_TYPES_SET = new Set(VALID_FIELD_TYPES);
+function isReservedSlug(slug) {
+  return RESERVED_SLUGS_SET.has(slug.toLowerCase());
+}
+function validateSlug(slug, errors) {
+  const path = "slug";
+  if (!slug) {
+    errors.push({
+      path,
+      message: "Form slug is required",
+      code: "SLUG_REQUIRED"
+    });
+    return;
+  }
+  if (typeof slug !== "string") {
+    errors.push({
+      path,
+      message: "Form slug must be a string",
+      code: "SLUG_INVALID_TYPE"
+    });
+    return;
+  }
+  if (slug.length < 1) {
+    errors.push({
+      path,
+      message: "Form slug must be at least 1 character",
+      code: "SLUG_TOO_SHORT"
+    });
+  }
+  if (slug.length > 50) {
+    errors.push({
+      path,
+      message: "Form slug must be at most 50 characters",
+      code: "SLUG_TOO_LONG"
+    });
+  }
+  if (!SLUG_PATTERN.test(slug)) {
+    errors.push({
+      path,
+      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
+      code: "SLUG_INVALID_FORMAT"
+    });
+  }
+  if (isReservedSlug(slug)) {
+    errors.push({
+      path,
+      message: `Form slug '${slug}' is reserved and cannot be used`,
+      code: "SLUG_RESERVED"
+    });
+  }
+}
+function validateFieldName(name, path, errors, seenNames) {
+  if (!name) {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name is required",
+      code: "FIELD_NAME_REQUIRED"
+    });
+    return;
+  }
+  if (typeof name !== "string") {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name must be a string",
+      code: "FIELD_NAME_REQUIRED"
+    });
+    return;
+  }
+  if (!FIELD_NAME_PATTERN.test(name)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
+      code: "FIELD_NAME_INVALID_FORMAT"
+    });
+  }
+  const nameLower = name.toLowerCase();
+  if (seenNames.has(nameLower)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Duplicate field name '${name}'`,
+      code: "FIELD_NAME_DUPLICATE"
+    });
+  } else {
+    seenNames.add(nameLower);
+  }
+}
+function validateFieldLabel(label, path, errors) {
+  if (!label || typeof label === "string" && label.trim() === "") {
+    errors.push({
+      path: `${path}.label`,
+      message: "Field label is required",
+      code: "FIELD_LABEL_REQUIRED"
+    });
+  }
+}
+function validateOptions(field, path, errors) {
+  const fieldWithOptions = field;
+  const options = fieldWithOptions.options;
+  if (!options) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have an 'options' array`,
+      code: "OPTIONS_REQUIRED"
+    });
+    return;
+  }
+  if (!Array.isArray(options)) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field 'options' must be an array`,
+      code: "OPTIONS_REQUIRED"
+    });
+    return;
+  }
+  if (options.length === 0) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have at least one option`,
+      code: "OPTIONS_EMPTY"
+    });
+  }
+}
+function validateConditionalLogic(field, path, errors) {
+  const { conditionalLogic } = field;
+  if (!conditionalLogic || !conditionalLogic.enabled) {
+    return;
+  }
+  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
+    errors.push({
+      path: `${path}.conditionalLogic.conditions`,
+      message: "Conditional logic must have at least one condition",
+      code: "CONDITIONS_REQUIRED"
+    });
+    return;
+  }
+  conditionalLogic.conditions.forEach((condition, index) => {
+    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
+    if (!condition.field) {
+      errors.push({
+        path: `${conditionPath}.field`,
+        message: "Condition must specify a field name",
+        code: "CONDITION_FIELD_REQUIRED"
+      });
+    }
+    if (!condition.comparison) {
+      errors.push({
+        path: `${conditionPath}.comparison`,
+        message: "Condition must specify a comparison operator",
+        code: "CONDITION_COMPARISON_REQUIRED"
+      });
+    }
+  });
+}
+function validateFieldByType(field, path, errors) {
+  switch (field.type) {
+    case "select":
+    case "radio":
+      validateOptions(field, path, errors);
+      break;
+    case "number": {
+      const numberField = field;
+      if (numberField.validation) {
+        const { min, max } = numberField.validation;
+        if (min !== void 0 && max !== void 0 && min > max) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min value cannot be greater than max value",
+            code: "MIN_GREATER_THAN_MAX"
+          });
+        }
+      }
+      break;
+    }
+    case "text":
+    case "textarea": {
+      const textField = field;
+      if (textField.validation) {
+        const { minLength, maxLength } = textField.validation;
+        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min length cannot be greater than max length",
+            code: "MIN_LENGTH_GREATER_THAN_MAX"
+          });
+        }
+      }
+      break;
+    }
+    case "file": {
+      const fileField = field;
+      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
+        errors.push({
+          path: `${path}.maxFileSize`,
+          message: "File maxFileSize must be a positive number",
+          code: "FILE_MAX_SIZE_INVALID"
+        });
+      }
+      break;
+    }
+  }
+}
+function validateField(field, path, errors, seenNames) {
+  if (!field || typeof field !== "object") {
+    return;
+  }
+  const f = field;
+  const fieldType = f.type;
+  if (!fieldType) {
+    errors.push({
+      path: `${path}.type`,
+      message: "Field type is required",
+      code: "FIELD_TYPE_REQUIRED"
+    });
+    return;
+  }
+  if (typeof fieldType !== "string" || !VALID_FIELD_TYPES_SET.has(fieldType)) {
+    let fieldTypeRepr;
+    if (typeof fieldType === "object" && fieldType !== null) {
+      fieldTypeRepr = JSON.stringify(fieldType);
+    } else {
+      fieldTypeRepr = String(fieldType);
+    }
+    errors.push({
+      path: `${path}.type`,
+      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
+      code: "FIELD_TYPE_INVALID"
+    });
+    return;
+  }
+  validateFieldName(f.name, path, errors, seenNames);
+  if (fieldType !== "hidden") {
+    validateFieldLabel(f.label, path, errors);
+  }
+  validateFieldByType(field, path, errors);
+  if (f.conditionalLogic) {
+    validateConditionalLogic(field, path, errors);
+  }
+}
+function validateFieldsArray(fields, basePath, errors) {
+  const seenNames = /* @__PURE__ */ new Set();
+  fields.forEach((field, index) => {
+    const fieldPath = `${basePath}[${index}]`;
+    validateField(field, fieldPath, errors, seenNames);
+  });
+}
+function validateFields(fields, errors) {
+  const path = "fields";
+  if (!fields) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_REQUIRED"
+    });
+    return;
+  }
+  if (!Array.isArray(fields)) {
+    errors.push({
+      path,
+      message: "Form fields must be an array",
+      code: "FIELDS_INVALID_TYPE"
+    });
+    return;
+  }
+  if (fields.length === 0) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_EMPTY"
+    });
+    return;
+  }
+  validateFieldsArray(fields, path, errors);
+}
+function validateSettings(settings, errors) {
+  if (!settings) {
+    return;
+  }
+  if (typeof settings !== "object" || Array.isArray(settings)) {
+    errors.push({
+      path: "settings",
+      message: "Form settings must be an object",
+      code: "SETTINGS_INVALID_TYPE"
+    });
+    return;
+  }
+  const s = settings;
+  if (s.confirmationType === "redirect") {
+    if (!s.redirectUrl && !s.redirectRelation) {
+      errors.push({
+        path: "settings.redirectUrl",
+        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
+        code: "REDIRECT_URL_REQUIRED"
+      });
+    }
+  }
+}
+function validateAccess(access, errors) {
+  if (!access) {
+    return;
+  }
+  if (typeof access !== "object" || Array.isArray(access)) {
+    errors.push({
+      path: "access",
+      message: "Access control must be an object",
+      code: "ACCESS_INVALID_TYPE"
+    });
+    return;
+  }
+  const accessObj = access;
+  const validAccessKeys = ["submit", "read"];
+  for (const key of validAccessKeys) {
+    const fn = accessObj[key];
+    if (fn !== void 0 && typeof fn !== "function") {
+      errors.push({
+        path: `access.${key}`,
+        message: `Access control '${key}' must be a function`,
+        code: "ACCESS_FUNCTION_INVALID"
+      });
+    }
+  }
+}
+function validateFormConfig(config) {
+  const errors = [];
+  validateSlug(config.slug, errors);
+  validateFields(config.fields, errors);
+  validateSettings(config.settings, errors);
+  validateAccess(config.access, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertValidFormConfig(config) {
+  const result = validateFormConfig(config);
+  if (!result.valid) {
+    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
+    throw new Error(
+      `Invalid form config for '${config.slug || "unknown"}':
+${errorMessages}`
+    );
+  }
+}
+
+// src/config/defaults.ts
+var DEFAULT_FORM_SETTINGS = {
+  submitButtonText: "Submit",
+  confirmationType: "message",
+  successMessage: "Thank you for your submission!",
+  allowMultipleSubmissions: true
+};
+var DEFAULT_NOTIFICATION_SETTINGS = {
+  enabled: true,
+  replyTo: true
+};
+function toTitleCase(str) {
+  return str.replace(/[-_]/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
+}
+function pluralize(singular) {
+  if (singular.endsWith("y") && !/[aeiou]y$/i.test(singular)) {
+    return singular.slice(0, -1) + "ies";
+  }
+  if (singular.endsWith("s") || singular.endsWith("x") || singular.endsWith("z") || singular.endsWith("ch") || singular.endsWith("sh")) {
+    return singular + "es";
+  }
+  return singular + "s";
+}
+function applyFormDefaults(config) {
+  const singularLabel = config.labels?.singular || toTitleCase(config.slug);
+  return {
+    ...config,
+    // Generate labels from slug if not provided
+    labels: {
+      singular: singularLabel,
+      plural: config.labels?.plural || pluralize(singularLabel)
+    },
+    // Apply settings defaults
+    settings: {
+      submitButtonText: config.settings?.submitButtonText || DEFAULT_FORM_SETTINGS.submitButtonText,
+      confirmationType: config.settings?.confirmationType || DEFAULT_FORM_SETTINGS.confirmationType,
+      successMessage: config.settings?.successMessage || DEFAULT_FORM_SETTINGS.successMessage,
+      allowMultipleSubmissions: config.settings?.allowMultipleSubmissions ?? DEFAULT_FORM_SETTINGS.allowMultipleSubmissions,
+      // Preserve other settings that don't have defaults
+      redirectUrl: config.settings?.redirectUrl,
+      redirectRelation: config.settings?.redirectRelation,
+      captcha: config.settings?.captcha
+    },
+    // Apply notification defaults if notifications are configured
+    notifications: config.notifications ? {
+      enabled: config.notifications.enabled ?? DEFAULT_NOTIFICATION_SETTINGS.enabled,
+      recipients: config.notifications.recipients || [],
+      subject: config.notifications.subject || `New submission for ${singularLabel}`,
+      replyTo: config.notifications.replyTo ?? DEFAULT_NOTIFICATION_SETTINGS.replyTo,
+      template: config.notifications.template
+    } : void 0,
+    // Apply access defaults
+    access: {
+      // Default: anyone can submit the form
+      submit: config.access?.submit || (() => true),
+      // Default: only authenticated users can view submissions
+      read: config.access?.read || (({ req }) => !!req.user)
+    }
+  };
+}
+function applyFieldDefaults(field) {
+  const label = field.label || (field.name ? toTitleCase(field.name.replace(/([A-Z])/g, " $1").trim()) : "");
+  return {
+    ...field,
+    label,
+    required: field.required ?? false
+  };
+}
+function createFormConfig(slug, fields, options) {
+  return applyFormDefaults({
+    slug,
+    fields,
+    ...options
+  });
+}
+
+// src/config/field-helpers.ts
+var option = (label, value) => ({
+  label,
+  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
+});
+var text3 = (config) => ({
+  ...config,
+  type: "text"
+});
+var email = (config) => ({
+  ...config,
+  type: "email"
+});
+var phone = (config) => ({
+  ...config,
+  type: "phone"
+});
+var url = (config) => ({
+  ...config,
+  type: "url"
+});
+var textarea3 = (config) => ({
+  ...config,
+  type: "textarea"
+});
+var number = (config) => ({
+  ...config,
+  type: "number"
+});
+var select3 = (config) => ({
+  ...config,
+  type: "select"
+});
+var checkbox2 = (config) => ({
+  ...config,
+  type: "checkbox"
+});
+var radio = (config) => ({
+  ...config,
+  type: "radio"
+});
+var file = (config) => ({
+  ...config,
+  type: "file"
+});
+var date2 = (config) => ({
+  ...config,
+  type: "date"
+});
+var time = (config) => ({
+  ...config,
+  type: "time"
+});
+var hidden = (config) => ({
+  ...config,
+  type: "hidden"
+});
+
+// src/utils/evaluate-conditions.ts
+function isEmptyValue(value) {
+  if (value === void 0 || value === null) {
+    return true;
+  }
+  if (typeof value === "string" && value.trim() === "") {
+    return true;
+  }
+  if (Array.isArray(value) && value.length === 0) {
+    return true;
+  }
+  return false;
+}
+function toNumber(value) {
+  if (typeof value === "number") {
+    return value;
+  }
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (trimmed === "") {
+      return NaN;
+    }
+    return Number(trimmed);
+  }
+  return NaN;
+}
+function toString(value) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.join(", ");
+  }
+  if (typeof value === "object") {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+function compareValues(operator, fieldValue, conditionValue) {
+  switch (operator) {
+    case "equals": {
+      if (Array.isArray(fieldValue)) {
+        if (Array.isArray(conditionValue)) {
+          if (fieldValue.length !== conditionValue.length) {
+            return false;
+          }
+          return fieldValue.every((v, i) => v === conditionValue[i]);
+        }
+        return fieldValue.includes(conditionValue);
+      }
+      return toString(fieldValue) === toString(conditionValue);
+    }
+    case "notEquals": {
+      if (Array.isArray(fieldValue)) {
+        if (Array.isArray(conditionValue)) {
+          if (fieldValue.length !== conditionValue.length) {
+            return true;
+          }
+          return !fieldValue.every((v, i) => v === conditionValue[i]);
+        }
+        return !fieldValue.includes(conditionValue);
+      }
+      return toString(fieldValue) !== toString(conditionValue);
+    }
+    case "contains": {
+      const fieldStr = toString(fieldValue).toLowerCase();
+      const conditionStr = toString(conditionValue).toLowerCase();
+      if (Array.isArray(fieldValue)) {
+        return fieldValue.some(
+          (v) => toString(v).toLowerCase().includes(conditionStr)
+        );
+      }
+      return fieldStr.includes(conditionStr);
+    }
+    case "isEmpty": {
+      return isEmptyValue(fieldValue);
+    }
+    case "isNotEmpty": {
+      return !isEmptyValue(fieldValue);
+    }
+    case "greaterThan": {
+      const fieldNum = toNumber(fieldValue);
+      const conditionNum = toNumber(conditionValue);
+      if (!Number.isNaN(fieldNum) && !Number.isNaN(conditionNum)) {
+        return fieldNum > conditionNum;
+      }
+      return toString(fieldValue) > toString(conditionValue);
+    }
+    case "lessThan": {
+      const fieldNum = toNumber(fieldValue);
+      const conditionNum = toNumber(conditionValue);
+      if (!Number.isNaN(fieldNum) && !Number.isNaN(conditionNum)) {
+        return fieldNum < conditionNum;
+      }
+      return toString(fieldValue) < toString(conditionValue);
+    }
+    default: {
+      console.warn(
+        `[evaluateConditions] Unknown comparison operator: ${String(operator)}`
+      );
+      return false;
+    }
+  }
+}
+function evaluateSingleCondition(condition, formData) {
+  const { field, comparison, value: conditionValue } = condition;
+  const fieldValue = getNestedValue(formData, field);
+  return compareValues(comparison, fieldValue, conditionValue);
+}
+function getNestedValue(obj, path) {
+  if (!path) {
+    return void 0;
+  }
+  if (!path.includes(".")) {
+    return obj[path];
+  }
+  const parts = path.split(".");
+  let current = obj;
+  for (const part of parts) {
+    if (current === void 0 || current === null) {
+      return void 0;
+    }
+    if (typeof current !== "object") {
+      return void 0;
+    }
+    current = current[part];
+  }
+  return current;
+}
+function evaluateConditions(logic, formData) {
+  if (!logic || !logic.enabled) {
+    return true;
+  }
+  const { action, operator, conditions } = logic;
+  if (!conditions || conditions.length === 0) {
+    return true;
+  }
+  const results = conditions.map(
+    (condition) => evaluateSingleCondition(condition, formData)
+  );
+  let conditionsMet;
+  if (operator === "OR") {
+    conditionsMet = results.some((result) => result);
+  } else {
+    conditionsMet = results.every((result) => result);
+  }
+  if (action === "hide") {
+    return !conditionsMet;
+  }
+  return conditionsMet;
+}
+function isValidComparisonOperator(operator) {
+  const validOperators = [
+    "equals",
+    "notEquals",
+    "contains",
+    "isEmpty",
+    "isNotEmpty",
+    "greaterThan",
+    "lessThan"
+  ];
+  return validOperators.includes(operator);
+}
+function getSupportedComparisonOperators() {
+  return [
+    "equals",
+    "notEquals",
+    "contains",
+    "isEmpty",
+    "isNotEmpty",
+    "greaterThan",
+    "lessThan"
+  ];
+}
+
+// src/utils/generate-schema.ts
+import { z } from "zod";
+function generateZodSchema(fields) {
+  const schemaShape = {};
+  for (const field of fields) {
+    if (field.type === "hidden" && !field.required) {
+      schemaShape[field.name] = z.string().optional();
+      continue;
+    }
+    const fieldSchema = generateFieldSchema(field);
+    if (fieldSchema) {
+      schemaShape[field.name] = fieldSchema;
+    }
+  }
+  return z.object(schemaShape);
+}
+function generateFieldSchema(field) {
+  switch (field.type) {
+    case "text":
+      return generateTextSchema(field);
+    case "email":
+      return generateEmailSchema(field);
+    case "number":
+      return generateNumberSchema(field);
+    case "phone":
+      return generatePhoneSchema(field);
+    case "url":
+      return generateUrlSchema(field);
+    case "textarea":
+      return generateTextareaSchema(field);
+    case "select":
+      return generateSelectSchema(field);
+    case "checkbox":
+      return generateCheckboxSchema(field);
+    case "radio":
+      return generateRadioSchema(field);
+    case "file":
+      return generateFileSchema(field);
+    case "date":
+      return generateDateSchema(field);
+    case "time":
+      return generateTimeSchema(field);
+    case "hidden":
+      return generateHiddenSchema(field);
+    default:
+      return z.unknown();
+  }
+}
+function generateTextSchema(field) {
+  let schema = z.string();
+  if (field.validation?.minLength !== void 0) {
+    schema = schema.min(
+      field.validation.minLength,
+      field.validation.errorMessage || `Minimum ${field.validation.minLength} characters required`
+    );
+  }
+  if (field.validation?.maxLength !== void 0) {
+    schema = schema.max(
+      field.validation.maxLength,
+      field.validation.errorMessage || `Maximum ${field.validation.maxLength} characters allowed`
+    );
+  }
+  if (field.validation?.pattern) {
+    schema = schema.regex(
+      new RegExp(field.validation.pattern),
+      field.validation.errorMessage || "Invalid format"
+    );
+  }
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateEmailSchema(field) {
+  let schema = z.string().email(field.validation?.errorMessage || "Invalid email address");
+  if (field.validation?.pattern) {
+    schema = schema.regex(
+      new RegExp(field.validation.pattern),
+      field.validation.errorMessage || "Invalid email format"
+    );
+  }
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateNumberSchema(field) {
+  let schema = z.number({
+    required_error: field.validation?.errorMessage || "This field is required",
+    invalid_type_error: "Must be a number"
+  });
+  if (field.validation?.min !== void 0) {
+    schema = schema.min(
+      field.validation.min,
+      field.validation.errorMessage || `Minimum value is ${field.validation.min}`
+    );
+  }
+  if (field.validation?.max !== void 0) {
+    schema = schema.max(
+      field.validation.max,
+      field.validation.errorMessage || `Maximum value is ${field.validation.max}`
+    );
+  }
+  if (field.required) {
+    return schema;
+  }
+  return schema.optional().nullable();
+}
+function generatePhoneSchema(field) {
+  let schema = z.string();
+  if (field.validation?.pattern) {
+    schema = schema.regex(
+      new RegExp(field.validation.pattern),
+      field.validation.errorMessage || "Invalid phone number format"
+    );
+  } else {
+    schema = schema.regex(
+      /^[\d\s\-+()]+$/,
+      field.validation?.errorMessage || "Invalid phone number"
+    );
+  }
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateUrlSchema(field) {
+  let schema = z.string().url(field.validation?.errorMessage || "Invalid URL");
+  if (field.validation?.pattern) {
+    schema = schema.regex(
+      new RegExp(field.validation.pattern),
+      field.validation.errorMessage || "Invalid URL format"
+    );
+  }
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateTextareaSchema(field) {
+  let schema = z.string();
+  if (field.validation?.minLength !== void 0) {
+    schema = schema.min(
+      field.validation.minLength,
+      field.validation.errorMessage || `Minimum ${field.validation.minLength} characters required`
+    );
+  }
+  if (field.validation?.maxLength !== void 0) {
+    schema = schema.max(
+      field.validation.maxLength,
+      field.validation.errorMessage || `Maximum ${field.validation.maxLength} characters allowed`
+    );
+  }
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateSelectSchema(field) {
+  const validValues = field.options.map((opt) => opt.value);
+  if (field.allowMultiple) {
+    const schema2 = z.array(z.enum(validValues));
+    if (field.required) {
+      return schema2.min(
+        1,
+        field.validation?.errorMessage || "Please select at least one option"
+      );
+    }
+    return schema2.optional();
+  }
+  const schema = z.enum(validValues, {
+    errorMap: () => ({
+      message: field.validation?.errorMessage || "Please select a valid option"
+    })
+  });
+  if (field.required) {
+    return schema;
+  }
+  return schema.optional();
+}
+function generateCheckboxSchema(field) {
+  const schema = z.boolean();
+  if (field.required) {
+    return schema.refine((val) => val === true, {
+      message: field.validation?.errorMessage || "This field is required"
+    });
+  }
+  return schema.optional();
+}
+function generateRadioSchema(field) {
+  const validValues = field.options.map((opt) => opt.value);
+  const schema = z.enum(validValues, {
+    errorMap: () => ({
+      message: field.validation?.errorMessage || "Please select an option"
+    })
+  });
+  if (field.required) {
+    return schema;
+  }
+  return schema.optional();
+}
+function generateFileSchema(field) {
+  if (field.multiple) {
+    const schema2 = z.array(z.string());
+    if (field.required) {
+      return schema2.min(
+        1,
+        field.validation?.errorMessage || "Please upload at least one file"
+      );
+    }
+    return schema2.optional();
+  }
+  const schema = z.string();
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateDateSchema(field) {
+  let schema = z.string();
+  schema = schema.refine(
+    (val) => {
+      if (!val) return true;
+      const date3 = new Date(val);
+      return !isNaN(date3.getTime());
+    },
+    { message: field.validation?.errorMessage || "Invalid date" }
+  );
+  if (field.min || field.max) {
+    schema = schema.refine(
+      (val) => {
+        if (!val) return true;
+        const date3 = new Date(val);
+        if (field.min && date3 < new Date(field.min)) return false;
+        if (field.max && date3 > new Date(field.max)) return false;
+        return true;
+      },
+      {
+        message: field.validation?.errorMessage || `Date must be between ${field.min || "any"} and ${field.max || "any"}`
+      }
+    );
+  }
+  if (field.required) {
+    return schema.refine(
+      (val) => val !== void 0 && val !== null && val !== "",
+      { message: field.validation?.errorMessage || "This field is required" }
+    );
+  }
+  return schema.optional().or(z.literal(""));
+}
+function generateTimeSchema(field) {
+  const schema = z.string().regex(
+    /^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/,
+    field.validation?.errorMessage || "Invalid time format (HH:mm)"
+  );
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function generateHiddenSchema(field) {
+  const schema = z.string();
+  return applyRequired(schema, field.required, field.validation?.errorMessage);
+}
+function applyRequired(schema, required, errorMessage) {
+  if (required) {
+    return schema.min(1, errorMessage || "This field is required");
+  }
+  return schema.optional().or(z.literal(""));
+}
+function transformFormData(data, fields) {
+  const transformed = {};
+  for (const field of fields) {
+    const value = data[field.name];
+    if (value === void 0) {
+      continue;
+    }
+    transformed[field.name] = transformFieldValue(value, field);
+  }
+  return transformed;
+}
+function transformFieldValue(value, field) {
+  if (value === null || value === void 0) {
+    return value;
+  }
+  switch (field.type) {
+    case "number":
+      if (typeof value === "string") {
+        const num = parseFloat(value);
+        return isNaN(num) ? value : num;
+      }
+      return value;
+    case "checkbox":
+      if (typeof value === "string") {
+        return value === "true" || value === "1" || value === "on";
+      }
+      return Boolean(value);
+    case "text":
+    case "email":
+    case "phone":
+    case "url":
+    case "textarea":
+    case "hidden":
+      if (typeof value === "string") {
+        return value.trim();
+      }
+      return value;
+    case "select":
+      if (field.allowMultiple) {
+        if (!Array.isArray(value)) {
+          return value ? [value] : [];
+        }
+      }
+      return value;
+    default:
+      return value;
+  }
+}
+function validateFormData(data, fields) {
+  const transformed = transformFormData(data, fields);
+  const schema = generateZodSchema(fields);
+  return schema.safeParse(transformed);
+}
+function getValidationErrors(result) {
+  if (result.success) {
+    return {};
+  }
+  const errors = {};
+  for (const error of result.error.errors) {
+    const path = error.path.join(".");
+    if (!errors[path]) {
+      errors[path] = error.message;
+    }
+  }
+  return errors;
+}
+
+// src/utils/export-formats.ts
+var UTF8_BOM = "\uFEFF";
+function safeString(value) {
+  if (typeof value === "object" && value !== null) {
+    return JSON.stringify(value);
+  }
+  return String(value);
+}
+function formatExportValue(value, field) {
+  if (value === null || value === void 0) {
+    return "";
+  }
+  if (field) {
+    switch (field.type) {
+      case "checkbox":
+        return value ? "Yes" : "No";
+      case "select":
+        if (Array.isArray(value)) {
+          return value.join(", ");
+        }
+        return safeString(value);
+      case "file":
+        if (Array.isArray(value)) {
+          return value.map((v) => safeString(v)).join(", ");
+        }
+        return safeString(value);
+      case "date":
+        if (value instanceof Date) {
+          return value.toISOString().split("T")[0];
+        }
+        if (typeof value === "string") {
+          const parsed = new Date(value);
+          if (!isNaN(parsed.getTime())) {
+            return parsed.toISOString().split("T")[0];
+          }
+        }
+        return safeString(value);
+      case "time":
+        return safeString(value);
+      case "hidden":
+        return safeString(value);
+      default:
+        break;
+    }
+  }
+  if (Array.isArray(value)) {
+    return value.join(", ");
+  }
+  if (typeof value === "boolean") {
+    return value ? "Yes" : "No";
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  return safeString(value);
+}
+function formatDate(date3, format = "iso") {
+  if (!date3) return "";
+  const d = typeof date3 === "string" ? new Date(date3) : date3;
+  if (isNaN(d.getTime())) {
+    return "";
+  }
+  return format === "iso" ? d.toISOString() : d.toLocaleString();
+}
+function escapeCSVValue(value, delimiter = ",") {
+  const needsQuoting = value.includes(delimiter) || value.includes('"') || value.includes("\n") || value.includes("\r");
+  if (!needsQuoting) {
+    return value;
+  }
+  const escaped = value.replace(/"/g, '""');
+  return `"${escaped}"`;
+}
+function exportToCSV(submissions, form, options = {}) {
+  const {
+    includeMetadata = true,
+    delimiter = ",",
+    includeBOM = true,
+    dateFormat = "iso"
+  } = options;
+  const exportableFields = form.fields;
+  const headers = [];
+  for (const field of exportableFields) {
+    headers.push(field.label);
+  }
+  if (includeMetadata) {
+    headers.push("ID", "Status", "Submitted At", "IP Address", "User Agent");
+  }
+  const rows = [];
+  for (const submission of submissions) {
+    const row = [];
+    const data = submission.data;
+    for (const field of exportableFields) {
+      const value = data[field.name];
+      const formatted = formatExportValue(value, field);
+      row.push(escapeCSVValue(formatted, delimiter));
+    }
+    if (includeMetadata) {
+      row.push(escapeCSVValue(submission.id, delimiter));
+      row.push(escapeCSVValue(submission.status, delimiter));
+      row.push(
+        escapeCSVValue(
+          formatDate(submission.submittedAt, dateFormat),
+          delimiter
+        )
+      );
+      row.push(escapeCSVValue(submission.ipAddress || "", delimiter));
+      row.push(escapeCSVValue(submission.userAgent || "", delimiter));
+    }
+    rows.push(row);
+  }
+  const escapedHeaders = headers.map((h) => escapeCSVValue(h, delimiter));
+  const lines = [
+    escapedHeaders.join(delimiter),
+    ...rows.map((row) => row.join(delimiter))
+  ];
+  const csvContent = lines.join("\r\n");
+  return includeBOM ? UTF8_BOM + csvContent : csvContent;
+}
+function exportToJSON(submissions, form, options = {}) {
+  const {
+    includeMetadata = true,
+    includeFormDefinition = true,
+    indent = 2
+  } = options;
+  const exportableFields = form.fields;
+  const formDefinition = includeFormDefinition ? {
+    id: form.id,
+    name: form.name,
+    slug: form.slug,
+    fields: exportableFields.map((f) => ({
+      name: f.name,
+      label: f.label,
+      type: f.type
+    }))
+  } : void 0;
+  const exportedSubmissions = submissions.map((submission) => {
+    const data = submission.data;
+    const fieldData = {};
+    for (const field of exportableFields) {
+      const value = data[field.name];
+      fieldData[field.name] = value;
+    }
+    if (includeMetadata) {
+      return {
+        ...fieldData,
+        _metadata: {
+          id: submission.id,
+          status: submission.status,
+          submittedAt: submission.submittedAt,
+          ipAddress: submission.ipAddress || null,
+          userAgent: submission.userAgent || null,
+          createdAt: submission.createdAt,
+          updatedAt: submission.updatedAt
+        }
+      };
+    }
+    return fieldData;
+  });
+  const exportData = {
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    totalSubmissions: submissions.length,
+    submissions: exportedSubmissions
+  };
+  if (formDefinition) {
+    exportData.form = formDefinition;
+  }
+  return JSON.stringify(exportData, null, indent);
+}
+function downloadFile(content, filename, mimeType) {
+  if (typeof window === "undefined" || typeof document === "undefined") {
+    throw new Error("downloadFile is only available in browser environments");
+  }
+  const blob = new Blob([content], { type: mimeType });
+  const url2 = URL.createObjectURL(blob);
+  const link = document.createElement("a");
+  link.href = url2;
+  link.download = filename;
+  document.body.appendChild(link);
+  link.click();
+  document.body.removeChild(link);
+  URL.revokeObjectURL(url2);
+}
+function generateExportFilename(formSlug, format) {
+  const date3 = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  return `${formSlug}-submissions-${date3}.${format}`;
+}
+function exportAndDownload(submissions, form, format, options) {
+  const filename = generateExportFilename(form.slug, format);
+  if (format === "csv") {
+    const content = exportToCSV(submissions, form, options);
+    downloadFile(content, filename, "text/csv;charset=utf-8");
+  } else {
+    const content = exportToJSON(submissions, form, options);
+    downloadFile(content, filename, "application/json");
+  }
+}
+
+// src/handlers/spam-detection.ts
+var rateLimitStore = /* @__PURE__ */ new Map();
+async function checkSpam(options) {
+  const { data, ipAddress, formSlug, config } = options;
+  if (config.honeypot) {
+    const honeypotResult = checkHoneypot(data);
+    if (honeypotResult.isSpam) {
+      return honeypotResult;
+    }
+  }
+  if (config.rateLimit && ipAddress) {
+    const rateLimitResult = checkRateLimit(
+      ipAddress,
+      formSlug,
+      config.rateLimit
+    );
+    if (rateLimitResult.isSpam) {
+      return rateLimitResult;
+    }
+  }
+  return { isSpam: false };
+}
+var HONEYPOT_FIELDS = [
+  "__honeypot",
+  "_honeypot",
+  "honeypot",
+  "__hp",
+  "_hp",
+  "website",
+  // Common honeypot field name
+  "url_field",
+  // Another common honeypot
+  "fax_number"
+  // Rarely used by humans
+];
+function checkHoneypot(data) {
+  for (const fieldName of HONEYPOT_FIELDS) {
+    const value = data[fieldName];
+    if (value !== void 0 && value !== null && value !== "") {
+      let raw;
+      if (typeof value === "object") {
+        raw = JSON.stringify(value);
+      } else {
+        raw = String(value);
+      }
+      const stringValue = raw.trim();
+      if (stringValue.length > 0) {
+        return {
+          isSpam: true,
+          reason: "honeypot",
+          details: `Honeypot field "${fieldName}" was filled`
+        };
+      }
+    }
+  }
+  return { isSpam: false };
+}
+function checkRateLimit(ipAddress, formSlug, config) {
+  const key = `${formSlug}:${ipAddress}`;
+  const now = Date.now();
+  const entry = rateLimitStore.get(key);
+  if (entry) {
+    if (now - entry.timestamp > config.windowMs) {
+      rateLimitStore.set(key, { count: 1, timestamp: now });
+      return { isSpam: false };
+    }
+    if (entry.count >= config.maxSubmissions) {
+      return {
+        isSpam: true,
+        reason: "rate_limit",
+        details: `Rate limit exceeded: ${entry.count}/${config.maxSubmissions} in ${config.windowMs}ms`
+      };
+    }
+    rateLimitStore.set(key, {
+      count: entry.count + 1,
+      timestamp: entry.timestamp
+    });
+  } else {
+    rateLimitStore.set(key, { count: 1, timestamp: now });
+  }
+  return { isSpam: false };
+}
+function cleanupRateLimitStore(maxAgeMs = 5 * 60 * 1e3) {
+  const now = Date.now();
+  let removed = 0;
+  for (const [key, entry] of rateLimitStore.entries()) {
+    if (now - entry.timestamp > maxAgeMs) {
+      rateLimitStore.delete(key);
+      removed++;
+    }
+  }
+  return removed;
+}
+function getRateLimitStoreSize() {
+  return rateLimitStore.size;
+}
+function clearRateLimitStore() {
+  rateLimitStore.clear();
+}
+function isRateLimited(ipAddress, formSlug, config) {
+  const key = `${formSlug}:${ipAddress}`;
+  const now = Date.now();
+  const entry = rateLimitStore.get(key);
+  if (!entry) {
+    return false;
+  }
+  if (now - entry.timestamp > config.windowMs) {
+    return false;
+  }
+  return entry.count >= config.maxSubmissions;
+}
+
+// src/handlers/submit-form.ts
+async function submitForm(options, context) {
+  const { formSlug, data, metadata } = options;
+  const { pluginContext, pluginConfig } = context;
+  const { collections } = pluginContext.services;
+  const { logger } = pluginContext.infra;
+  try {
+    const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+    if (!form) {
+      logger.warn?.("Form submission attempted for non-existent form", {
+        formSlug
+      });
+      return {
+        success: false,
+        error: "Form not found"
+      };
+    }
+    if (form.status !== "published") {
+      logger.info?.("Form submission rejected - form not published", {
+        formSlug,
+        status: form.status
+      });
+      return {
+        success: false,
+        error: "This form is not currently accepting submissions"
+      };
+    }
+    const transformedData = transformFormData(data, form.fields);
+    const schema = generateZodSchema(form.fields);
+    const validationResult = schema.safeParse(transformedData);
+    if (!validationResult.success) {
+      const validationErrors = getValidationErrors(validationResult);
+      logger.debug?.("Form validation failed", {
+        formSlug,
+        errors: validationErrors
+      });
+      return {
+        success: false,
+        error: "Validation failed",
+        validationErrors
+      };
+    }
+    sanitizeSubmissionData(validationResult.data, form.fields);
+    const spamResult = await checkSpam({
+      data: transformedData,
+      ipAddress: metadata?.ipAddress,
+      formSlug,
+      config: {
+        honeypot: pluginConfig.spamProtection.honeypot,
+        rateLimit: pluginConfig.spamProtection.rateLimit,
+        recaptcha: pluginConfig.spamProtection.recaptcha
+      }
+    });
+    if (spamResult.isSpam) {
+      logger.info?.("Spam submission detected and rejected", {
+        formSlug,
+        reason: spamResult.reason,
+        ipAddress: metadata?.ipAddress
+      });
+      return {
+        success: true
+      };
+    }
+    const submissionData = {
+      form: form.id,
+      data: validationResult.data,
+      status: "new",
+      ipAddress: metadata?.ipAddress || null,
+      userAgent: metadata?.userAgent || null,
+      submittedAt: /* @__PURE__ */ new Date()
+    };
+    const submission = await collections.createEntry(
+      pluginConfig.formSubmissionOverrides.slug,
+      submissionData,
+      {}
+      // Empty context - submission creation is public
+    );
+    logger.info?.("Form submission created successfully", {
+      formSlug,
+      submissionId: submission.id
+    });
+    const redirect = determineRedirectUrl(form);
+    return {
+      success: true,
+      submission,
+      redirect
+    };
+  } catch (error) {
+    logger.error?.("Form submission error", {
+      formSlug,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return {
+      success: false,
+      error: "An error occurred processing your submission. Please try again."
+    };
+  }
+}
+async function fetchFormBySlug(slug, pluginConfig, pluginContext) {
+  try {
+    const { collections } = pluginContext.services;
+    const result = await collections.listEntries(
+      pluginConfig.formOverrides.slug,
+      {
+        pagination: { limit: 100 }
+        // Fetch enough to find the form
+      },
+      {}
+      // Empty context for public access
+    );
+    if (!result.data || result.data.length === 0) {
+      return null;
+    }
+    const form = result.data.find(
+      (entry) => entry.slug === slug
+    );
+    return form ? form : null;
+  } catch {
+    return null;
+  }
+}
+function determineRedirectUrl(form) {
+  if (!form.settings) {
+    return void 0;
+  }
+  if (form.settings.confirmationType !== "redirect") {
+    return void 0;
+  }
+  if (form.settings.redirectUrl) {
+    return form.settings.redirectUrl;
+  }
+  if (form.settings.redirectRelation) {
+    const { relationTo, value } = form.settings.redirectRelation;
+    return `relationship://${relationTo}/${value}`;
+  }
+  return void 0;
+}
+async function validateSubmission(formSlug, data, context) {
+  const { pluginContext, pluginConfig } = context;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return { valid: false, errors: { _form: "Form not found" } };
+  }
+  const transformedData = transformFormData(data, form.fields);
+  const schema = generateZodSchema(form.fields);
+  const result = schema.safeParse(transformedData);
+  if (result.success) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    errors: getValidationErrors(result)
+  };
+}
+async function isFormAcceptingSubmissions(formSlug, context) {
+  const { pluginContext, pluginConfig } = context;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return false;
+  }
+  return form.status === "published";
+}
+var TEXT_FORM_FIELDS = /* @__PURE__ */ new Set([
+  "text",
+  "email",
+  "textarea",
+  "phone",
+  "url",
+  "hidden"
+]);
+function stripHtmlTags(input) {
+  return input.replace(/<[^>]*(?:>|$)/g, "").replace(/\s+/g, " ").trim();
+}
+function sanitizeSubmissionData(data, fields) {
+  for (const field of fields) {
+    if (!TEXT_FORM_FIELDS.has(field.type)) continue;
+    const value = data[field.name];
+    if (typeof value !== "string") continue;
+    data[field.name] = stripHtmlTags(value);
+  }
+}
+async function getFormSubmissionStats(formSlug, context) {
+  const { pluginContext, pluginConfig } = context;
+  const { collections } = pluginContext.services;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return null;
+  }
+  try {
+    const result = await collections.listEntries(
+      pluginConfig.formSubmissionOverrides.slug,
+      {
+        pagination: { limit: 1e3 }
+        // Reasonable limit for stats
+      },
+      {}
+    );
+    if (!result.data) {
+      return { total: 0, new: 0, read: 0, archived: 0 };
+    }
+    const submissions = result.data.filter(
+      (entry) => entry.form === form.id
+    );
+    const stats = {
+      total: submissions.length,
+      new: 0,
+      read: 0,
+      archived: 0
+    };
+    for (const sub of submissions) {
+      const status = sub.status;
+      if (status === "new") stats.new++;
+      else if (status === "read") stats.read++;
+      else if (status === "archived") stats.archived++;
+    }
+    return stats;
+  } catch {
+    return null;
+  }
+}
+
+// src/handlers/webhooks.ts
+import { safeFetch, ExternalUrlError } from "nextly";
+var WEBHOOK_TIMEOUT_MS = 1e4;
+var SIGNATURE_HEADER = "X-Webhook-Signature";
+var EVENT_HEADER = "X-Webhook-Event";
+var DELIVERY_ID_HEADER = "X-Webhook-Delivery-ID";
+async function generateSignature(payload, secret) {
+  const encoder = new TextEncoder();
+  const keyData = encoder.encode(secret);
+  const messageData = encoder.encode(payload);
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    keyData,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
+  const hashArray = Array.from(new Uint8Array(signature));
+  const hashHex = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `sha256=${hashHex}`;
+}
+async function sendWebhook(webhook, payload) {
+  const startTime = Date.now();
+  const payloadString = JSON.stringify(payload);
+  try {
+    const headers = {
+      "Content-Type": "application/json",
+      [EVENT_HEADER]: payload.event,
+      [DELIVERY_ID_HEADER]: payload.submission.id,
+      ...webhook.headers
+    };
+    if (webhook.secret) {
+      headers[SIGNATURE_HEADER] = await generateSignature(
+        payloadString,
+        webhook.secret
+      );
+    }
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), WEBHOOK_TIMEOUT_MS);
+    try {
+      const response = await safeFetch(webhook.url, {
+        method: webhook.method || "POST",
+        headers,
+        body: payloadString,
+        signal: controller.signal,
+        allowLocalhost: process.env.NODE_ENV !== "production"
+      });
+      clearTimeout(timeoutId);
+      const durationMs = Date.now() - startTime;
+      if (response.ok) {
+        return {
+          url: webhook.url,
+          success: true,
+          statusCode: response.status,
+          durationMs
+        };
+      }
+      return {
+        url: webhook.url,
+        success: false,
+        statusCode: response.status,
+        error: `HTTP ${response.status}: ${response.statusText}`,
+        durationMs
+      };
+    } finally {
+      clearTimeout(timeoutId);
+    }
+  } catch (error) {
+    const durationMs = Date.now() - startTime;
+    if (error instanceof Error && error.name === "AbortError") {
+      return {
+        url: webhook.url,
+        success: false,
+        error: `Timeout after ${WEBHOOK_TIMEOUT_MS}ms`,
+        durationMs
+      };
+    }
+    if (error instanceof ExternalUrlError) {
+      return {
+        url: webhook.url,
+        success: false,
+        error: `Webhook URL rejected for SSRF safety: ${error.message}`,
+        durationMs
+      };
+    }
+    return {
+      url: webhook.url,
+      success: false,
+      error: error instanceof Error ? error.message : String(error),
+      durationMs
+    };
+  }
+}
+async function triggerWebhooks(options) {
+  const { event, form, submission } = options;
+  const webhooks = form.webhooks || [];
+  const relevantWebhooks = webhooks.filter((w) => w.events.includes(event));
+  if (relevantWebhooks.length === 0) {
+    return {
+      triggered: 0,
+      successful: 0,
+      failed: 0,
+      results: []
+    };
+  }
+  const deliveryPromises = relevantWebhooks.map(async (webhook) => {
+    const payload = {
+      event,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      form: {
+        id: form.id,
+        slug: form.slug,
+        name: form.name
+      },
+      submission: webhook.includeData !== false ? submission : {
+        id: submission.id,
+        submittedAt: submission.submittedAt
+      }
+    };
+    return sendWebhook(webhook, payload);
+  });
+  const results = await Promise.all(deliveryPromises);
+  const successful = results.filter((r) => r.success).length;
+  const failed = results.filter((r) => !r.success).length;
+  return {
+    triggered: relevantWebhooks.length,
+    successful,
+    failed,
+    results
+  };
+}
+function fireWebhooks(options, logger) {
+  triggerWebhooks(options).then((result) => {
+    if (result.triggered > 0) {
+      if (result.failed > 0) {
+        logger?.warn?.("Some webhooks failed", {
+          event: options.event,
+          formSlug: options.form.slug,
+          submissionId: options.submission.id,
+          triggered: result.triggered,
+          successful: result.successful,
+          failed: result.failed,
+          errors: result.results.filter((r) => !r.success).map((r) => ({ url: r.url, error: r.error }))
+        });
+      } else {
+        logger?.info?.("Webhooks triggered successfully", {
+          event: options.event,
+          formSlug: options.form.slug,
+          submissionId: options.submission.id,
+          count: result.triggered
+        });
+      }
+    }
+  }).catch((error) => {
+    logger?.error?.("Unexpected error triggering webhooks", {
+      event: options.event,
+      formSlug: options.form.slug,
+      submissionId: options.submission.id,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  });
+}
+function isValidWebhookUrl(url2) {
+  try {
+    const parsed = new URL(url2);
+    if (parsed.protocol !== "https:" && !parsed.hostname.match(/^(localhost|127\.0\.0\.1)$/)) {
+      return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getSupportedWebhookEvents() {
+  return ["submission.created", "submission.updated", "submission.deleted"];
+}
+
+// src/index.ts
+var formBuilderPlugin = formBuilder().plugin;
+export {
+  DEFAULT_FORM_SETTINGS,
+  DEFAULT_NOTIFICATION_SETTINGS,
+  RESERVED_FORM_SLUGS,
+  applyFieldDefaults,
+  applyFormDefaults,
+  assertValidFormConfig,
+  checkSpam,
+  checkbox2 as checkbox,
+  cleanupRateLimitStore,
+  clearRateLimitStore,
+  createFormConfig,
+  date2 as date,
+  downloadFile,
+  email,
+  evaluateConditions,
+  exportAndDownload,
+  exportToCSV,
+  exportToJSON,
+  file,
+  fireWebhooks,
+  formBuilder,
+  formBuilderPlugin,
+  formatExportValue,
+  formsCollection,
+  generateExportFilename,
+  generateZodSchema,
+  getFormBuilderConfig,
+  getFormSubmissionStats,
+  getRateLimitStoreSize,
+  getSupportedComparisonOperators,
+  getSupportedWebhookEvents,
+  getValidationErrors,
+  hidden,
+  isCheckboxFormField,
+  isEmailFormField,
+  isFileFormField,
+  isFormAcceptingSubmissions,
+  isFormField,
+  isFormFieldType,
+  isRateLimited,
+  isSelectFormField,
+  isTextFormField,
+  isValidComparisonOperator,
+  isValidWebhookUrl,
+  number,
+  option,
+  phone,
+  pluralize,
+  radio,
+  select3 as select,
+  submissionsCollection,
+  submitForm,
+  text3 as text,
+  textarea3 as textarea,
+  time,
+  toTitleCase,
+  transformFormData,
+  triggerWebhooks,
+  url,
+  validateFormConfig,
+  validateFormData,
+  validateSubmission
+};
+//# sourceMappingURL=index.js.map