@nextlyhq/plugin-form-builder 0.0.2-alpha.34 → 0.0.2-alpha.35

package/dist/index.js

@@ -1,3 +1,24 @@
+import {
+  DEFAULT_FORM_SETTINGS,
+  DEFAULT_NOTIFICATION_SETTINGS,
+  applyFieldDefaults,
+  applyFormDefaults,
+  createFormConfig,
+  downloadFile,
+  evaluateConditions,
+  evaluateSingleCondition,
+  exportAndDownload,
+  exportToCSV,
+  exportToJSON,
+  formatExportValue,
+  generateExportFilename,
+  getSupportedComparisonOperators,
+  isValidComparisonOperator,
+  normalizeFormSettings,
+  pluralize,
+  toTitleCase
+} from "./chunk-I4VFGPNR.js";
+
 // src/plugin.ts
 import { createRequire } from "module";
 import { definePlugin } from "@nextlyhq/plugin-sdk";
@@ -91,12 +112,18 @@ function formsCollection(pluginConfig) {
         description: "Allow the same user/IP to submit this form multiple times"
       }
     }),
+    checkbox({
+      name: "honeypotEnabled",
+      label: "Honeypot",
+      admin: {
+        description: "Per-form honeypot override; unset inherits the plugin default"
+      }
+    }),
     checkbox({
       name: "captchaEnabled",
       label: "Enable reCAPTCHA",
-      defaultValue: false,
       admin: {
-        description: "Protect this form with Google reCAPTCHA v3"
+        description: "Per-form reCAPTCHA override; unset inherits the plugin default"
       }
     }),
     text({
@@ -164,10 +191,10 @@ function formsCollection(pluginConfig) {
     // ============================================================
     json({
       name: "notifications",
-      label: "Email Integrations",
+      label: "Notifications",
       defaultValue: [],
       admin: {
-        description: "Email notification integrations. Managed by the Form Builder UI."
+        description: "Email notification rules. Managed by the Form Builder UI."
       }
     }),
     // ============================================================
@@ -253,16 +280,6 @@ function formsCollection(pluginConfig) {
           }
           return data;
         }
-      ],
-      // Add virtual submission count field
-      afterRead: [
-        (context) => {
-          const { data } = context;
-          if (data) {
-            data.submissionCount = 0;
-          }
-          return data;
-        }
       ]
     },
     // Spread any additional overrides (excluding already used properties)
@@ -318,12 +335,23 @@ function submissionsCollection(pluginConfig) {
       options: [
         { label: "New", value: "new" },
         { label: "Read", value: "read" },
-        { label: "Archived", value: "archived" }
+        { label: "Archived", value: "archived" },
+        // Spam is stored and flagged, never silently dropped: a false
+        // positive stays reviewable and recoverable ("Not spam" = back to new).
+        { label: "Spam", value: "spam" }
       ],
       admin: {
         description: "Track whether this submission has been reviewed"
       }
     }),
+    text2({
+      name: "spamReason",
+      label: "Spam Reason",
+      admin: {
+        readOnly: true,
+        description: "Which spam check flagged this submission (empty for clean submissions)"
+      }
+    }),
     // ============================================================
     // Internal Notes
     // ============================================================
@@ -361,6 +389,24 @@ function submissionsCollection(pluginConfig) {
         readOnly: true,
         description: "When the form was submitted"
       }
+    }),
+    // Honesty stamps for admin edits of submitted data: a corrected
+    // submission must never be indistinguishable from what the visitor sent.
+    date({
+      name: "editedAt",
+      label: "Edited At",
+      admin: {
+        readOnly: true,
+        description: "When an admin last edited the submitted data"
+      }
+    }),
+    text2({
+      name: "editedBy",
+      label: "Edited By",
+      admin: {
+        readOnly: true,
+        description: "ID of the admin who last edited the submitted data"
+      }
     })
   ];
   let finalFields;
@@ -382,10 +428,17 @@ function submissionsCollection(pluginConfig) {
       order: 51,
       useAsTitle: "id",
       description: "View and manage form submissions",
-      // Custom components for submissions list
+      // Submissions are created by visitors submitting forms — a hand-typed
+      // "New Submission" would be fiction, so the admin never offers one.
+      disableCreate: true,
       components: {
-        // Filter dropdown to filter submissions by form
-        BeforeListTable: "@nextlyhq/plugin-form-builder/admin#SubmissionsFilter"
+        // The full submissions experience (per-form columns, status tabs,
+        // drawer detail, export) replaces the generic list.
+        views: {
+          List: {
+            Component: "@nextlyhq/plugin-form-builder/admin#SubmissionsView"
+          }
+        }
       },
       ...overrides.admin
     },
@@ -402,7 +455,9 @@ function submissionsCollection(pluginConfig) {
       delete: accessOverrides?.delete ?? (({ roles }) => roles.includes("admin") || roles.includes("super-admin"))
     },
     hooks: {
-      // Auto-set submittedAt timestamp on creation
+      // Auto-set submittedAt timestamp on creation. (The edit stamp for
+      // updates is registered in plugin.ts init — direct registry hooks are
+      // the path that runs for every API surface.)
       beforeValidate: [
         (context) => {
           const { data, operation } = context;
@@ -503,6 +558,13 @@ function formBuilder(options = {}) {
     name: "@nextlyhq/plugin-form-builder",
     version: PLUGIN_VERSION,
     nextly: ">=0.0.2-alpha.21",
+    // Identity metadata for the admin plugins page, mirroring package.json.
+    author: "Nextly",
+    homepage: "https://nextlyhq.com",
+    repository: "https://github.com/nextlyhq/nextly",
+    license: "MIT",
+    category: "forms",
+    tags: ["forms", "submissions", "email-notifications"],
     // Declarative schema: the merged pipeline folds these into the
     // app schema — no manual `setup()` append needed. Just register the plugin.
     contributes: {
@@ -515,7 +577,15 @@ function formBuilder(options = {}) {
           resource: "submissions",
           label: "Export Submissions",
           description: "Export form submissions as CSV/JSON",
-          group: "Form Builder"
+          // No `group`: the admin already files this under the plugin that
+          // declared it, so naming the plugin again would nest it inside
+          // itself. `group` is for a plugin with enough permissions to sort
+          // its own into headings, which one is not.
+          //
+          // `danger` because the point of the permission is to take
+          // submissions — names, emails, whatever a form asked for — out of
+          // the site in a file.
+          danger: true
         }
       ],
       // HTTP route — exported at
@@ -529,53 +599,137 @@ function formBuilder(options = {}) {
           method: "GET",
           path: "/submissions/export",
           requiredPermission: "export-submissions",
-          handler: async (_req, ctx) => {
+          handler: async (req, ctx) => {
             const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
             const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
-            const result = await ctx.services.collections.listEntries(
-              slug,
-              {},
-              { as: "user", user: ctx.user ?? void 0 }
+            const url2 = new URL(req.url);
+            const format = url2.searchParams.get("format") ?? "json";
+            const formId = url2.searchParams.get("form");
+            const status = url2.searchParams.get("status");
+            const where = {};
+            if (formId) where.form = { equals: formId };
+            if (status) where.status = { equals: status };
+            else where.status = { not_equals: "spam" };
+            const opts = { as: "user", user: ctx.user ?? void 0 };
+            let form;
+            if (format === "csv") {
+              if (!formId) {
+                return Response.json(
+                  {
+                    error: {
+                      code: "VALIDATION_ERROR",
+                      message: "CSV export requires a form parameter."
+                    }
+                  },
+                  { status: 400 }
+                );
+              }
+              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
+              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
+              const formResult = await ctx.services.collections.listEntries(
+                formsSlug,
+                { where: { id: { equals: formId } } },
+                opts
+              );
+              form = formResult.data[0];
+              if (!form) {
+                return Response.json(
+                  { error: { code: "NOT_FOUND", message: "Form not found." } },
+                  { status: 404 }
+                );
+              }
+            }
+            const MAX_EXPORT_ROWS = 5e4;
+            const items = [];
+            const pageSize = 200;
+            let truncated = false;
+            for (let page = 1; ; page += 1) {
+              const result = await ctx.services.collections.listEntries(
+                slug,
+                { where, pagination: { limit: pageSize, page } },
+                opts
+              );
+              items.push(...result.data);
+              const pageWasFull = result.data.length === pageSize;
+              if (items.length >= MAX_EXPORT_ROWS) {
+                truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
+                items.length = MAX_EXPORT_ROWS;
+                break;
+              }
+              if (!pageWasFull) break;
+            }
+            const truncationHeaders = truncated ? { "X-Export-Truncated": "true" } : {};
+            if (format !== "csv" || !form) {
+              return Response.json({ items }, { headers: truncationHeaders });
+            }
+            const csv = exportToCSV(
+              items,
+              form
             );
-            return Response.json({ items: result.data });
-          }
-        }
-      ],
-      // Admin UI — the canonical contributes.admin example. Paths
-      // are the components form-builder's `/admin` module self-registers (kept
-      // as literals so this node entry stays React-free). menu links to
-      // the forms collection; settings renders the builder UI at
-      // /admin/plugins/<slug>; a custom page is gated by export-submissions;
-      // a submissions beforeList view injects the filter above the list.
-      admin: {
-        menu: [
-          {
-            label: "Forms",
-            to: `/admin/collections/${resolvedConfig.formOverrides.slug}`,
-            icon: "file-text",
-            order: 50,
-            requiredPermission: `read-${resolvedConfig.formOverrides.slug}`
+            const filename = generateExportFilename(
+              typeof form.slug === "string" ? form.slug : "form",
+              "csv"
+            );
+            return new Response(csv, {
+              headers: {
+                "Content-Type": "text/csv; charset=utf-8",
+                "Content-Disposition": `attachment; filename="${filename}"`,
+                ...truncationHeaders
+              }
+            });
           }
-        ],
-        settings: {
-          component: "@nextlyhq/plugin-form-builder/admin#FormBuilderView"
         },
-        pages: [
-          {
-            path: "submissions",
-            component: "@nextlyhq/plugin-form-builder/admin#SubmissionsFilter",
-            requiredPermission: "export-submissions"
-          }
-        ],
-        views: {
-          [resolvedConfig.formSubmissionOverrides.slug]: {
-            beforeList: "@nextlyhq/plugin-form-builder/admin#SubmissionsFilter"
-          }
+        {
+          // The builder UI reads the host's resolved field enable/disable map
+          // from here, so the plugin option actually gates the type picker.
+          // Options resolve server-side only; this is the one channel the
+          // admin client has to them.
+          method: "GET",
+          path: "/builder-config",
+          // Derived from the forms slug like the menu entry: with an
+          // overridden slug, users hold read-<slug>, not read-forms.
+          requiredPermission: `read-${resolvedConfig.formOverrides.slug}`,
+          handler: (_req, ctx) => Promise.resolve(
+            Response.json({
+              fields: resolvedConfig.fields,
+              // Notification defaults the builder surfaces: defaultToEmail
+              // seeds a new form's first rule, defaultFrom renders as the
+              // inherited sender placeholder.
+              notifications: {
+                defaultFrom: resolvedConfig.notifications.defaultFrom,
+                defaultToEmail: resolvedConfig.notifications.defaultToEmail
+              },
+              // Spam defaults the Settings tab surfaces, so per-form
+              // override selects can show what "inherit" resolves to.
+              spamProtection: {
+                honeypot: resolvedConfig.spamProtection.honeypot,
+                recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false
+              },
+              // Runtime-resolved collection slugs (through ctx.self, so a
+              // framework .rename() is honored too) — admin components
+              // never hardcode "forms"/"form-submissions".
+              slugs: {
+                forms: ctx.self.collections[resolvedConfig.formOverrides.slug] ?? resolvedConfig.formOverrides.slug,
+                submissions: ctx.self.collections[resolvedConfig.formSubmissionOverrides.slug] ?? resolvedConfig.formSubmissionOverrides.slug
+              }
+            })
+          )
         }
-      }
+      ]
     },
+    // Forms is a first-class destination, not a plugin detail: standalone
+    // placement gives it its own main-rail icon after Media, and its
+    // sub-sidebar lists the plugin's collections (Forms, Submissions) —
+    // no separate menu contribution, so "Forms" exists exactly once.
+    // Hosts preferring the Plugins section override placement in config.
+    // (The old admin.settings.component that rendered a second full builder
+    // at /admin/plugins/<slug> is gone; the collection Edit-view override
+    // is the single FormBuilderView mount.)
     admin: {
+      placement: "standalone",
+      after: "media",
       order: 50,
+      appearance: { icon: "FileText", label: "Forms" },
       description: "Create and manage forms with submission tracking"
     },
     // -- Init ----------------------------------------------------------------
@@ -607,6 +761,40 @@ function formBuilder(options = {}) {
           await handleSubmissionCreated(context, resolvedConfig, nextly);
         }
       );
+      nextly.hooks.on("beforeUpdate", submissionSlug, (context) => {
+        const ctx = context;
+        if (ctx.data && ctx.data.data !== void 0) {
+          ctx.data.editedAt = /* @__PURE__ */ new Date();
+          ctx.data.editedBy = ctx.user?.id ?? null;
+        }
+        return ctx.data;
+      });
+      const declaredFormsSlug = resolvedConfig.formOverrides.slug;
+      const formsSlug = nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug;
+      nextly.hooks.on("afterRead", formsSlug, async (context) => {
+        const data = context.data;
+        const records = Array.isArray(data) ? data : data ? [data] : [];
+        await Promise.all(
+          records.map(async (record) => {
+            const form = record;
+            if (typeof form.id !== "string") return;
+            try {
+              form.submissionCount = await nextly.services.collections.count(
+                submissionSlug,
+                {
+                  where: {
+                    form: { equals: form.id },
+                    status: { not_equals: "spam" }
+                  }
+                },
+                { as: "system" }
+              );
+            } catch {
+              form.submissionCount = 0;
+            }
+          })
+        );
+      });
     }
   });
   return {
@@ -644,9 +832,78 @@ function collectAttachmentInputs(fields, submittedData) {
   }
   return attachments;
 }
+function parseJsonColumn(value) {
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function normalizeAddressList(addresses) {
+  if (!Array.isArray(addresses)) return void 0;
+  const cleaned = addresses.map((address) => typeof address === "string" ? address.trim() : "").filter(Boolean);
+  return cleaned.length > 0 ? cleaned : void 0;
+}
+function buildNotificationEmails(input) {
+  const { notifications, submittedData, formName, submissionId, defaultFrom } = input;
+  const seen = /* @__PURE__ */ new Set();
+  const emails = [];
+  const skipped = [];
+  for (const notification of notifications) {
+    if (!notification.enabled) continue;
+    if (!notification.templateSlug) {
+      skipped.push({ notificationId: notification.id, reason: "no-template" });
+      continue;
+    }
+    const key = notification.id || JSON.stringify(notification);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (notification.condition && !evaluateSingleCondition(notification.condition, submittedData)) {
+      skipped.push({
+        notificationId: notification.id,
+        reason: "condition-unmet"
+      });
+      continue;
+    }
+    const to = (notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to).trim();
+    if (!to) {
+      skipped.push({
+        notificationId: notification.id,
+        reason: "empty-recipient"
+      });
+      continue;
+    }
+    const cc = normalizeAddressList(notification.cc);
+    const bcc = normalizeAddressList(notification.bcc);
+    const from = notification.senderEmail?.trim() || defaultFrom?.trim() || void 0;
+    const replyTo = notification.replyTo ? resolveFieldRef(notification.replyTo, submittedData).trim() || void 0 : void 0;
+    emails.push({
+      to,
+      templateSlug: notification.templateSlug,
+      variables: {
+        ...submittedData,
+        formName,
+        submissionId
+      },
+      providerId: notification.providerId,
+      from,
+      replyTo,
+      cc,
+      bcc,
+      notificationId: notification.id
+    });
+  }
+  return { emails, skipped };
+}
 async function handleSubmissionCreated(context, config, nextly) {
+  if (!config.notifications.enabled) return;
   const submission = context.data;
   if (!submission) return;
+  if (submission.status === "spam") return;
   const rawFormId = submission.form;
   let formId = null;
   if (typeof rawFormId === "string") {
@@ -662,39 +919,29 @@ async function handleSubmissionCreated(context, config, nextly) {
   if (notifications.length === 0) return;
   const emailService = nextly.services.email;
   if (!emailService) return;
-  const submittedData = submission.data ?? {};
+  const submittedData = parseJsonColumn(submission.data);
   const formFields = Array.isArray(form.fields) ? form.fields : [];
   const fileAttachments = collectAttachmentInputs(formFields, submittedData);
-  const seen = /* @__PURE__ */ new Set();
-  const emails = [];
-  for (const notification of notifications) {
-    if (!notification.enabled || !notification.templateSlug) continue;
-    const key = notification.id || `${notification.to}::${notification.templateSlug}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    const to = notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to;
-    if (!to) {
+  const { emails, skipped } = buildNotificationEmails({
+    notifications,
+    submittedData,
+    formName: form.name,
+    submissionId: submission.id,
+    defaultFrom: config.notifications.defaultFrom
+  });
+  for (const skip of skipped) {
+    if (skip.reason === "empty-recipient") {
       nextly.logger.warn?.(
         "Form Builder: empty recipient, skipping notification",
-        { notificationId: notification.id, formSlug: form.slug }
+        { notificationId: skip.notificationId, formSlug: form.slug }
       );
-      continue;
+    } else {
+      nextly.logger.debug?.("Form Builder: notification skipped", {
+        notificationId: skip.notificationId,
+        formSlug: form.slug,
+        reason: skip.reason
+      });
     }
-    const cc = Array.isArray(notification.cc) && notification.cc.length ? notification.cc : void 0;
-    const bcc = Array.isArray(notification.bcc) && notification.bcc.length ? notification.bcc : void 0;
-    emails.push({
-      to,
-      templateSlug: notification.templateSlug,
-      variables: {
-        ...submittedData,
-        formName: form.name,
-        submissionId: submission.id
-      },
-      providerId: notification.providerId,
-      cc,
-      bcc,
-      notificationId: notification.id
-    });
   }
   if (emails.length === 0) return;
   const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, { form, submission });
@@ -706,6 +953,8 @@ async function handleSubmissionCreated(context, config, nextly) {
         email2.variables,
         {
           providerId: email2.providerId,
+          from: email2.from,
+          replyTo: email2.replyTo,
           cc: email2.cc,
           bcc: email2.bcc,
           attachments: fileAttachments.length > 0 ? fileAttachments : void 0
@@ -1143,82 +1392,6 @@ ${errorMessages}`
   }
 }
 
-// src/config/defaults.ts
-var DEFAULT_FORM_SETTINGS = {
-  submitButtonText: "Submit",
-  confirmationType: "message",
-  successMessage: "Thank you for your submission!",
-  allowMultipleSubmissions: true
-};
-var DEFAULT_NOTIFICATION_SETTINGS = {
-  enabled: true,
-  replyTo: true
-};
-function toTitleCase(str) {
-  return str.replace(/[-_]/g, " ").replace(/\b\w/g, (char) => char.toUpperCase());
-}
-function pluralize(singular) {
-  if (singular.endsWith("y") && !/[aeiou]y$/i.test(singular)) {
-    return singular.slice(0, -1) + "ies";
-  }
-  if (singular.endsWith("s") || singular.endsWith("x") || singular.endsWith("z") || singular.endsWith("ch") || singular.endsWith("sh")) {
-    return singular + "es";
-  }
-  return singular + "s";
-}
-function applyFormDefaults(config) {
-  const singularLabel = config.labels?.singular || toTitleCase(config.slug);
-  return {
-    ...config,
-    // Generate labels from slug if not provided
-    labels: {
-      singular: singularLabel,
-      plural: config.labels?.plural || pluralize(singularLabel)
-    },
-    // Apply settings defaults
-    settings: {
-      submitButtonText: config.settings?.submitButtonText || DEFAULT_FORM_SETTINGS.submitButtonText,
-      confirmationType: config.settings?.confirmationType || DEFAULT_FORM_SETTINGS.confirmationType,
-      successMessage: config.settings?.successMessage || DEFAULT_FORM_SETTINGS.successMessage,
-      allowMultipleSubmissions: config.settings?.allowMultipleSubmissions ?? DEFAULT_FORM_SETTINGS.allowMultipleSubmissions,
-      // Preserve other settings that don't have defaults
-      redirectUrl: config.settings?.redirectUrl,
-      redirectRelation: config.settings?.redirectRelation,
-      captcha: config.settings?.captcha
-    },
-    // Apply notification defaults if notifications are configured
-    notifications: config.notifications ? {
-      enabled: config.notifications.enabled ?? DEFAULT_NOTIFICATION_SETTINGS.enabled,
-      recipients: config.notifications.recipients || [],
-      subject: config.notifications.subject || `New submission for ${singularLabel}`,
-      replyTo: config.notifications.replyTo ?? DEFAULT_NOTIFICATION_SETTINGS.replyTo,
-      template: config.notifications.template
-    } : void 0,
-    // Apply access defaults
-    access: {
-      // Default: anyone can submit the form
-      submit: config.access?.submit || (() => true),
-      // Default: only authenticated users can view submissions
-      read: config.access?.read || (({ req }) => !!req.user)
-    }
-  };
-}
-function applyFieldDefaults(field) {
-  const label = field.label || (field.name ? toTitleCase(field.name.replace(/([A-Z])/g, " $1").trim()) : "");
-  return {
-    ...field,
-    label,
-    required: field.required ?? false
-  };
-}
-function createFormConfig(slug, fields, options) {
-  return applyFormDefaults({
-    slug,
-    fields,
-    ...options
-  });
-}
-
 // src/config/field-helpers.ts
 var option = (label, value) => ({
   label,
@@ -1277,184 +1450,6 @@ var hidden = (config) => ({
   type: "hidden"
 });
 
-// src/utils/evaluate-conditions.ts
-function isEmptyValue(value) {
-  if (value === void 0 || value === null) {
-    return true;
-  }
-  if (typeof value === "string" && value.trim() === "") {
-    return true;
-  }
-  if (Array.isArray(value) && value.length === 0) {
-    return true;
-  }
-  return false;
-}
-function toNumber(value) {
-  if (typeof value === "number") {
-    return value;
-  }
-  if (typeof value === "string") {
-    const trimmed = value.trim();
-    if (trimmed === "") {
-      return NaN;
-    }
-    return Number(trimmed);
-  }
-  return NaN;
-}
-function toString(value) {
-  if (value === void 0 || value === null) {
-    return "";
-  }
-  if (typeof value === "string") {
-    return value;
-  }
-  if (Array.isArray(value)) {
-    return value.join(", ");
-  }
-  if (typeof value === "object") {
-    return JSON.stringify(value);
-  }
-  return String(value);
-}
-function compareValues(operator, fieldValue, conditionValue) {
-  switch (operator) {
-    case "equals": {
-      if (Array.isArray(fieldValue)) {
-        if (Array.isArray(conditionValue)) {
-          if (fieldValue.length !== conditionValue.length) {
-            return false;
-          }
-          return fieldValue.every((v, i) => v === conditionValue[i]);
-        }
-        return fieldValue.includes(conditionValue);
-      }
-      return toString(fieldValue) === toString(conditionValue);
-    }
-    case "notEquals": {
-      if (Array.isArray(fieldValue)) {
-        if (Array.isArray(conditionValue)) {
-          if (fieldValue.length !== conditionValue.length) {
-            return true;
-          }
-          return !fieldValue.every((v, i) => v === conditionValue[i]);
-        }
-        return !fieldValue.includes(conditionValue);
-      }
-      return toString(fieldValue) !== toString(conditionValue);
-    }
-    case "contains": {
-      const fieldStr = toString(fieldValue).toLowerCase();
-      const conditionStr = toString(conditionValue).toLowerCase();
-      if (Array.isArray(fieldValue)) {
-        return fieldValue.some(
-          (v) => toString(v).toLowerCase().includes(conditionStr)
-        );
-      }
-      return fieldStr.includes(conditionStr);
-    }
-    case "isEmpty": {
-      return isEmptyValue(fieldValue);
-    }
-    case "isNotEmpty": {
-      return !isEmptyValue(fieldValue);
-    }
-    case "greaterThan": {
-      const fieldNum = toNumber(fieldValue);
-      const conditionNum = toNumber(conditionValue);
-      if (!Number.isNaN(fieldNum) && !Number.isNaN(conditionNum)) {
-        return fieldNum > conditionNum;
-      }
-      return toString(fieldValue) > toString(conditionValue);
-    }
-    case "lessThan": {
-      const fieldNum = toNumber(fieldValue);
-      const conditionNum = toNumber(conditionValue);
-      if (!Number.isNaN(fieldNum) && !Number.isNaN(conditionNum)) {
-        return fieldNum < conditionNum;
-      }
-      return toString(fieldValue) < toString(conditionValue);
-    }
-    default: {
-      console.warn(
-        `[evaluateConditions] Unknown comparison operator: ${String(operator)}`
-      );
-      return false;
-    }
-  }
-}
-function evaluateSingleCondition(condition, formData) {
-  const { field, comparison, value: conditionValue } = condition;
-  const fieldValue = getNestedValue(formData, field);
-  return compareValues(comparison, fieldValue, conditionValue);
-}
-function getNestedValue(obj, path) {
-  if (!path) {
-    return void 0;
-  }
-  if (!path.includes(".")) {
-    return obj[path];
-  }
-  const parts = path.split(".");
-  let current = obj;
-  for (const part of parts) {
-    if (current === void 0 || current === null) {
-      return void 0;
-    }
-    if (typeof current !== "object") {
-      return void 0;
-    }
-    current = current[part];
-  }
-  return current;
-}
-function evaluateConditions(logic, formData) {
-  if (!logic || !logic.enabled) {
-    return true;
-  }
-  const { action, operator, conditions } = logic;
-  if (!conditions || conditions.length === 0) {
-    return true;
-  }
-  const results = conditions.map(
-    (condition) => evaluateSingleCondition(condition, formData)
-  );
-  let conditionsMet;
-  if (operator === "OR") {
-    conditionsMet = results.some((result) => result);
-  } else {
-    conditionsMet = results.every((result) => result);
-  }
-  if (action === "hide") {
-    return !conditionsMet;
-  }
-  return conditionsMet;
-}
-function isValidComparisonOperator(operator) {
-  const validOperators = [
-    "equals",
-    "notEquals",
-    "contains",
-    "isEmpty",
-    "isNotEmpty",
-    "greaterThan",
-    "lessThan"
-  ];
-  return validOperators.includes(operator);
-}
-function getSupportedComparisonOperators() {
-  return [
-    "equals",
-    "notEquals",
-    "contains",
-    "isEmpty",
-    "isNotEmpty",
-    "greaterThan",
-    "lessThan"
-  ];
-}
-
 // src/utils/generate-schema.ts
 import { z } from "zod";
 function generateZodSchema(fields) {
@@ -1537,8 +1532,7 @@ function generateEmailSchema(field) {
 }
 function generateNumberSchema(field) {
   let schema = z.number({
-    required_error: field.validation?.errorMessage || "This field is required",
-    invalid_type_error: "Must be a number"
+    error: (issue) => issue.input === void 0 ? field.validation?.errorMessage || "This field is required" : "Must be a number"
   });
   if (field.validation?.min !== void 0) {
     schema = schema.min(
@@ -1611,9 +1605,7 @@ function generateSelectSchema(field) {
     return schema2.optional();
   }
   const schema = z.enum(validValues, {
-    errorMap: () => ({
-      message: field.validation?.errorMessage || "Please select a valid option"
-    })
+    error: () => field.validation?.errorMessage || "Please select a valid option"
   });
   if (field.required) {
     return schema;
@@ -1632,9 +1624,7 @@ function generateCheckboxSchema(field) {
 function generateRadioSchema(field) {
   const validValues = field.options.map((opt) => opt.value);
   const schema = z.enum(validValues, {
-    errorMap: () => ({
-      message: field.validation?.errorMessage || "Please select an option"
-    })
+    error: () => field.validation?.errorMessage || "Please select an option"
   });
   if (field.required) {
     return schema;
@@ -1762,7 +1752,7 @@ function getValidationErrors(result) {
     return {};
   }
   const errors = {};
-  for (const error of result.error.errors) {
+  for (const error of result.error.issues) {
     const path = error.path.join(".");
     if (!errors[path]) {
       errors[path] = error.message;
@@ -1771,203 +1761,6 @@ function getValidationErrors(result) {
   return errors;
 }
 
-// src/utils/export-formats.ts
-var UTF8_BOM = "\uFEFF";
-function safeString(value) {
-  if (typeof value === "object" && value !== null) {
-    return JSON.stringify(value);
-  }
-  return String(value);
-}
-function formatExportValue(value, field) {
-  if (value === null || value === void 0) {
-    return "";
-  }
-  if (field) {
-    switch (field.type) {
-      case "checkbox":
-        return value ? "Yes" : "No";
-      case "select":
-        if (Array.isArray(value)) {
-          return value.join(", ");
-        }
-        return safeString(value);
-      case "file":
-        if (Array.isArray(value)) {
-          return value.map((v) => safeString(v)).join(", ");
-        }
-        return safeString(value);
-      case "date":
-        if (value instanceof Date) {
-          return value.toISOString().split("T")[0];
-        }
-        if (typeof value === "string") {
-          const parsed = new Date(value);
-          if (!isNaN(parsed.getTime())) {
-            return parsed.toISOString().split("T")[0];
-          }
-        }
-        return safeString(value);
-      case "time":
-        return safeString(value);
-      case "hidden":
-        return safeString(value);
-      default:
-        break;
-    }
-  }
-  if (Array.isArray(value)) {
-    return value.join(", ");
-  }
-  if (typeof value === "boolean") {
-    return value ? "Yes" : "No";
-  }
-  if (value instanceof Date) {
-    return value.toISOString();
-  }
-  return safeString(value);
-}
-function formatDate(date3, format = "iso") {
-  if (!date3) return "";
-  const d = typeof date3 === "string" ? new Date(date3) : date3;
-  if (isNaN(d.getTime())) {
-    return "";
-  }
-  return format === "iso" ? d.toISOString() : d.toLocaleString();
-}
-function escapeCSVValue(value, delimiter = ",") {
-  const needsQuoting = value.includes(delimiter) || value.includes('"') || value.includes("\n") || value.includes("\r");
-  if (!needsQuoting) {
-    return value;
-  }
-  const escaped = value.replace(/"/g, '""');
-  return `"${escaped}"`;
-}
-function exportToCSV(submissions, form, options = {}) {
-  const {
-    includeMetadata = true,
-    delimiter = ",",
-    includeBOM = true,
-    dateFormat = "iso"
-  } = options;
-  const exportableFields = form.fields;
-  const headers = [];
-  for (const field of exportableFields) {
-    headers.push(field.label);
-  }
-  if (includeMetadata) {
-    headers.push("ID", "Status", "Submitted At", "IP Address", "User Agent");
-  }
-  const rows = [];
-  for (const submission of submissions) {
-    const row = [];
-    const data = submission.data;
-    for (const field of exportableFields) {
-      const value = data[field.name];
-      const formatted = formatExportValue(value, field);
-      row.push(escapeCSVValue(formatted, delimiter));
-    }
-    if (includeMetadata) {
-      row.push(escapeCSVValue(submission.id, delimiter));
-      row.push(escapeCSVValue(submission.status, delimiter));
-      row.push(
-        escapeCSVValue(
-          formatDate(submission.submittedAt, dateFormat),
-          delimiter
-        )
-      );
-      row.push(escapeCSVValue(submission.ipAddress || "", delimiter));
-      row.push(escapeCSVValue(submission.userAgent || "", delimiter));
-    }
-    rows.push(row);
-  }
-  const escapedHeaders = headers.map((h) => escapeCSVValue(h, delimiter));
-  const lines = [
-    escapedHeaders.join(delimiter),
-    ...rows.map((row) => row.join(delimiter))
-  ];
-  const csvContent = lines.join("\r\n");
-  return includeBOM ? UTF8_BOM + csvContent : csvContent;
-}
-function exportToJSON(submissions, form, options = {}) {
-  const {
-    includeMetadata = true,
-    includeFormDefinition = true,
-    indent = 2
-  } = options;
-  const exportableFields = form.fields;
-  const formDefinition = includeFormDefinition ? {
-    id: form.id,
-    name: form.name,
-    slug: form.slug,
-    fields: exportableFields.map((f) => ({
-      name: f.name,
-      label: f.label,
-      type: f.type
-    }))
-  } : void 0;
-  const exportedSubmissions = submissions.map((submission) => {
-    const data = submission.data;
-    const fieldData = {};
-    for (const field of exportableFields) {
-      const value = data[field.name];
-      fieldData[field.name] = value;
-    }
-    if (includeMetadata) {
-      return {
-        ...fieldData,
-        _metadata: {
-          id: submission.id,
-          status: submission.status,
-          submittedAt: submission.submittedAt,
-          ipAddress: submission.ipAddress || null,
-          userAgent: submission.userAgent || null,
-          createdAt: submission.createdAt,
-          updatedAt: submission.updatedAt
-        }
-      };
-    }
-    return fieldData;
-  });
-  const exportData = {
-    exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    totalSubmissions: submissions.length,
-    submissions: exportedSubmissions
-  };
-  if (formDefinition) {
-    exportData.form = formDefinition;
-  }
-  return JSON.stringify(exportData, null, indent);
-}
-function downloadFile(content, filename, mimeType) {
-  if (typeof window === "undefined" || typeof document === "undefined") {
-    throw new Error("downloadFile is only available in browser environments");
-  }
-  const blob = new Blob([content], { type: mimeType });
-  const url2 = URL.createObjectURL(blob);
-  const link = document.createElement("a");
-  link.href = url2;
-  link.download = filename;
-  document.body.appendChild(link);
-  link.click();
-  document.body.removeChild(link);
-  URL.revokeObjectURL(url2);
-}
-function generateExportFilename(formSlug, format) {
-  const date3 = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-  return `${formSlug}-submissions-${date3}.${format}`;
-}
-function exportAndDownload(submissions, form, format, options) {
-  const filename = generateExportFilename(form.slug, format);
-  if (format === "csv") {
-    const content = exportToCSV(submissions, form, options);
-    downloadFile(content, filename, "text/csv;charset=utf-8");
-  } else {
-    const content = exportToJSON(submissions, form, options);
-    downloadFile(content, filename, "application/json");
-  }
-}
-
 // src/handlers/spam-detection.ts
 var rateLimitStore = /* @__PURE__ */ new Map();
 async function checkSpam(options) {
@@ -2107,46 +1900,95 @@ async function submitForm(options, context) {
         error: "This form is not currently accepting submissions"
       };
     }
-    const transformedData = transformFormData(data, form.fields);
-    const schema = generateZodSchema(form.fields);
-    const validationResult = schema.safeParse(transformedData);
-    if (!validationResult.success) {
-      const validationErrors = getValidationErrors(validationResult);
-      logger.debug?.("Form validation failed", {
-        formSlug,
-        errors: validationErrors
-      });
-      return {
-        success: false,
-        error: "Validation failed",
-        validationErrors
-      };
+    const settings = normalizeFormSettings(form.settings);
+    if (settings.allowMultipleSubmissions === false && !metadata?.ipAddress) {
+      logger.warn?.(
+        "Single-submission form received a submission without an IP \u2014 the restriction cannot apply",
+        { formSlug }
+      );
     }
-    sanitizeSubmissionData(validationResult.data, form.fields);
+    if (settings.allowMultipleSubmissions === false && metadata?.ipAddress) {
+      const existing = await collections.count(
+        pluginConfig.formSubmissionOverrides.slug,
+        {
+          where: {
+            form: { equals: form.id },
+            ipAddress: { equals: metadata.ipAddress },
+            status: { not_equals: "spam" }
+          }
+        },
+        { as: "system" }
+      );
+      if (existing > 0) {
+        logger.info?.("Repeat submission rejected (single-submission form)", {
+          formSlug,
+          ipAddress: metadata.ipAddress
+        });
+        return {
+          success: false,
+          error: "You have already submitted this form."
+        };
+      }
+    }
+    const declaredFieldNames = new Set(form.fields.map((field) => field.name));
+    const undeclaredData = Object.fromEntries(
+      Object.entries(data).filter(([key]) => !declaredFieldNames.has(key))
+    );
     const spamResult = await checkSpam({
-      data: transformedData,
+      data: undeclaredData,
       ipAddress: metadata?.ipAddress,
       formSlug,
       config: {
-        honeypot: pluginConfig.spamProtection.honeypot,
+        // Per-form overrides win where set; blank inherits the plugin config.
+        honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot,
         rateLimit: pluginConfig.spamProtection.rateLimit,
-        recaptcha: pluginConfig.spamProtection.recaptcha
+        recaptcha: {
+          ...pluginConfig.spamProtection.recaptcha,
+          enabled: settings.captchaEnabled ?? pluginConfig.spamProtection.recaptcha?.enabled ?? false
+        }
       }
     });
-    if (spamResult.isSpam) {
-      logger.info?.("Spam submission detected and rejected", {
+    if (spamResult.isSpam && spamResult.reason === "rate_limit") {
+      logger.info?.("Spam submission rejected (rate limit)", {
+        formSlug,
+        ipAddress: metadata?.ipAddress
+      });
+      return { success: true };
+    }
+    const isContentSpam = spamResult.isSpam;
+    const transformedData = transformFormData(data, form.fields);
+    let storedData;
+    if (isContentSpam) {
+      logger.info?.("Spam submission detected \u2014 storing flagged", {
         formSlug,
         reason: spamResult.reason,
         ipAddress: metadata?.ipAddress
       });
-      return {
-        success: true
-      };
+      sanitizeSubmissionData(transformedData, form.fields);
+      storedData = transformedData;
+    } else {
+      const schema = generateZodSchema(form.fields);
+      const validationResult = schema.safeParse(transformedData);
+      if (!validationResult.success) {
+        const validationErrors = getValidationErrors(validationResult);
+        logger.debug?.("Form validation failed", {
+          formSlug,
+          errors: validationErrors
+        });
+        return {
+          success: false,
+          error: "Validation failed",
+          validationErrors
+        };
+      }
+      sanitizeSubmissionData(validationResult.data, form.fields);
+      storedData = validationResult.data;
     }
     const submissionData = {
       form: form.id,
-      data: validationResult.data,
-      status: "new",
+      data: storedData,
+      status: isContentSpam ? "spam" : "new",
+      spamReason: isContentSpam ? spamResult.reason ?? null : null,
       ipAddress: metadata?.ipAddress || null,
       userAgent: metadata?.userAgent || null,
       submittedAt: /* @__PURE__ */ new Date()
@@ -2160,9 +2002,13 @@ async function submitForm(options, context) {
     );
     logger.info?.("Form submission created successfully", {
       formSlug,
-      submissionId: submission.id
+      submissionId: submission.id,
+      flaggedAsSpam: isContentSpam
     });
     const redirect = determineRedirectUrl(form);
+    if (isContentSpam) {
+      return { success: true, redirect };
+    }
     return {
       success: true,
       submission,