@nextlyhq/plugin-form-builder 0.0.2-alpha.60 → 0.0.2-alpha.62

package/dist/index.js

@@ -2,9 +2,11 @@ import {
   BUILT_IN_FORM_FIELD_TYPES,
   DEFAULT_FORM_SETTINGS,
   DEFAULT_NOTIFICATION_SETTINGS,
+  ENFORCED_VALIDATION_RULES,
   applyFieldDefaults,
   applyFormDefaults,
   createFormConfig,
+  documentReachability,
   downloadFile,
   evaluateConditions,
   evaluateSingleCondition,
@@ -24,9 +26,12 @@ import {
   isTextFormField,
   isValidComparisonOperator,
   normalizeFormSettings,
+  parseFieldRef,
+  parseRedirectReference,
+  pickedDocumentField,
   pluralize,
   toTitleCase
-} from "./chunk-XCICDELK.js";
+} from "./chunk-H5X3FKOZ.js";
 
 // src/plugin.ts
 import { createRequire } from "module";
@@ -39,18 +44,284 @@ import {
   textarea,
   select,
   checkbox,
+  date,
   group,
   json,
   relationship
 } from "nextly";
+
+// src/utils/redirect-target.ts
+import { previewUrlFromTemplate } from "nextly/config";
+var DEFAULT_REDIRECT_PATTERN = "/{slug}";
+function normalizeRedirectRelationships(option2) {
+  if (!option2) return {};
+  const entries = Array.isArray(option2) ? option2.map((collection) => [collection, DEFAULT_REDIRECT_PATTERN]) : Object.entries(option2);
+  return Object.fromEntries(
+    entries.filter(
+      ([, pattern]) => typeof pattern !== "string" || pattern.trim()
+    )
+  );
+}
+function applyRedirectPattern(pattern, document) {
+  if (typeof pattern === "function") {
+    const produced = pattern(document);
+    return produced ? produced : void 0;
+  }
+  return previewUrlFromTemplate(pattern)(document) ?? void 0;
+}
+
+// src/collections/access-defaults.ts
+var authenticated = ({ user }) => !!user;
+var administrative = ({ roles }) => roles.includes("admin") || roles.includes("super-admin");
+function accessWithDefaults(overrides, defaults = {}) {
+  return {
+    read: overrides?.read ?? defaults.read ?? authenticated,
+    create: overrides?.create ?? defaults.create ?? authenticated,
+    update: overrides?.update ?? authenticated,
+    // Deleting is administrative in both collections; the DB permission layer
+    // remains the backstop underneath it.
+    delete: overrides?.delete ?? administrative
+  };
+}
+
+// src/collections/forms.ts
+function withHostHooks(pluginHooks, hostHooks, trailing = {}) {
+  const host = { ...hostHooks };
+  const asList = (value) => Array.isArray(value) ? value : value === void 0 ? [] : [value];
+  const merged = { ...host };
+  for (const [phase, handlers] of Object.entries(
+    pluginHooks
+  )) {
+    merged[phase] = [...asList(handlers), ...asList(host[phase])];
+  }
+  for (const [phase, handlers] of Object.entries(trailing)) {
+    merged[phase] = [...asList(merged[phase]), ...asList(handlers)];
+  }
+  return merged;
+}
+function documentRedirectSettings(settings) {
+  if (typeof settings !== "object" || settings === null) return null;
+  const record = settings;
+  const field = pickedDocumentField(record);
+  return field ? { settings: record, field } : null;
+}
+function pageRedirectSettings(data, operation) {
+  if (!data) return null;
+  if (operation !== "create" && data.settings === void 0) return null;
+  return documentRedirectSettings(data.settings);
+}
+function formAcceptsSubmissions(data, originalData) {
+  return (data?.status ?? originalData?.status) === "published";
+}
+function storedSettings(value) {
+  if (typeof value === "string") {
+    try {
+      return documentRedirectSettings(JSON.parse(value));
+    } catch {
+      return null;
+    }
+  }
+  return documentRedirectSettings(value);
+}
+function storedRedirectReference(originalData, patterns) {
+  const picked = storedSettings(originalData?.settings);
+  if (!picked) return null;
+  const collections = Object.keys(patterns);
+  const reference = parseRedirectReference(
+    picked.settings[picked.field],
+    collections
+  );
+  if (!reference) return null;
+  return {
+    reference,
+    field: picked.field,
+    configured: collections.includes(reference.collection)
+  };
+}
+function normalizeStoredReference(settings, field, reference) {
+  const stored = settings[field];
+  if (typeof stored === "string") {
+    if (stored !== reference.id) settings[field] = reference.id;
+    return;
+  }
+  if (typeof stored !== "object" || stored === null || Array.isArray(stored)) {
+    return;
+  }
+  const record = stored;
+  if (record.relationTo !== reference.collection) {
+    settings[field] = { ...record, relationTo: reference.collection };
+  }
+}
+function namedRedirectReference(data, operation, patterns) {
+  const picked = pageRedirectSettings(data, operation);
+  if (!picked) return null;
+  const { settings, field } = picked;
+  const collections = Object.keys(patterns);
+  const reference = parseRedirectReference(settings[field], collections);
+  if (reference) normalizeStoredReference(settings, field, reference);
+  return {
+    settings,
+    field,
+    reference,
+    configured: reference !== null && collections.includes(reference.collection)
+  };
+}
+function wouldStrandVisitors(data, originalData, target, targetCollectionIsLocalized) {
+  return formAcceptsSubmissions(data, originalData) && documentReachability(target, targetCollectionIsLocalized) === "unreachable";
+}
+function publishesForm(data, originalData) {
+  if (data?.status !== "published") return false;
+  return originalData?.status !== "published";
+}
+function sameTarget(named, stored) {
+  if (!named.reference || !stored) return false;
+  return stored.field === named.field && stored.reference.collection === named.reference.collection && stored.reference.id === named.reference.id;
+}
+function judgeNamedReference(named, stored) {
+  if (sameTarget(named, stored) && named.reference) {
+    return {
+      reference: named.reference,
+      field: named.field,
+      chosen: false,
+      configured: named.configured
+    };
+  }
+  if (!named.reference || !named.configured) {
+    throw redirectRefusal(
+      "Choose a page to redirect to, or pick a different confirmation.",
+      named.field
+    );
+  }
+  return {
+    reference: named.reference,
+    field: named.field,
+    chosen: true,
+    configured: true
+  };
+}
+function redirectReferenceForWrite(context, patterns) {
+  const stored = storedRedirectReference(
+    context.originalData,
+    patterns
+  );
+  const named = namedRedirectReference(
+    context.data,
+    context.operation,
+    patterns
+  );
+  if (named) return judgeNamedReference(named, stored);
+  const data = context.data;
+  if (data?.settings !== void 0) return null;
+  return stored ? { ...stored, chosen: false } : null;
+}
+function assertPatternBuildsUrl(patterns, reference, field, target) {
+  let url2;
+  try {
+    url2 = applyRedirectPattern(patterns[reference.collection], target);
+  } catch {
+    return;
+  }
+  if (url2) return;
+  throw redirectRefusal(
+    `No URL could be built for that page from the pattern configured for "${reference.collection}". Choose another page, or ask a developer to check that collection's redirect pattern.`,
+    field
+  );
+}
+async function assertRedirectTargetUsable(context, patterns, localization) {
+  const write = redirectReferenceForWrite(context, patterns);
+  if (!write) return;
+  const { reference, field, chosen, configured } = write;
+  if (!configured) {
+    if (publishesForm(
+      context.data,
+      context.originalData
+    )) {
+      throw redirectRefusal(
+        `This form redirects to "${reference.collection}", which is no longer configured as a redirect target, so it has nowhere to send anyone. Choose another page, or pick a different confirmation.`,
+        field
+      );
+    }
+    return;
+  }
+  const nextly = context.req?.nextly;
+  if (!nextly) return;
+  if (context.executor) return;
+  const found = await readRedirectTarget(nextly, reference);
+  if (found.status === "unreadable") return;
+  if (found.status === "missing") {
+    if (!chosen && !publishesForm(
+      context.data,
+      context.originalData
+    )) {
+      return;
+    }
+    throw redirectRefusal(
+      `That page no longer exists in "${reference.collection}". Pick another.`,
+      field
+    );
+  }
+  const judged = chosen || publishesForm(
+    context.data,
+    context.originalData
+  );
+  if (judged && wouldStrandVisitors(
+    context.data,
+    context.originalData,
+    found.document,
+    localization[reference.collection]
+  )) {
+    throw redirectRefusal(
+      `That page is not published yet, and this form is. A visitor sent there would reach a "page not found". Publish the page, or save this form as a draft until you do.`,
+      field
+    );
+  }
+  if (chosen)
+    assertPatternBuildsUrl(patterns, reference, field, found.document);
+}
+async function readRedirectTarget(nextly, reference) {
+  try {
+    const row = await nextly.findByID({
+      collection: reference.collection,
+      id: reference.id
+    });
+    return row ? { status: "ok", document: row } : { status: "missing" };
+  } catch (error) {
+    return isMissingTarget(error) ? { status: "missing" } : { status: "unreadable" };
+  }
+}
+function isMissingTarget(error) {
+  return typeof error === "object" && error !== null && error.code === "NOT_FOUND";
+}
+function stampFirstPublish(context) {
+  const data = context.data;
+  if (!data) return;
+  const stored = context.originalData;
+  delete data.wentLiveAt;
+  if (recordedStamp(stored) !== void 0) return;
+  if (data.status === "published" || stored?.status === "published") {
+    data.wentLiveAt = /* @__PURE__ */ new Date();
+  }
+}
+function recordedStamp(stored) {
+  const value = stored?.wentLiveAt;
+  return value === null || value === "" ? void 0 : value;
+}
+function redirectRefusal(message, field) {
+  return NextlyError.validation({
+    errors: [{ path: `settings.${field}`, code: "REQUIRED", message }]
+  });
+}
 function formsCollection(pluginConfig) {
   const {
     slug,
     labels,
     fields: additionalFields,
     access: accessOverrides,
+    hooks: hookOverrides,
+    admin: adminOverrides,
     ...overrides
   } = pluginConfig.formOverrides;
+  const redirectCollections = Object.keys(pluginConfig.redirectRelationships);
   const settingsFields = [
     text({
       name: "submitButtonText",
@@ -67,7 +338,7 @@ function formsCollection(pluginConfig) {
       options: [
         { label: "Show Message", value: "message" },
         { label: "Redirect to URL", value: "redirect" },
-        ...pluginConfig.redirectRelationships.length > 0 ? [{ label: "Redirect to Page", value: "relationship" }] : []
+        ...redirectCollections.length > 0 ? [{ label: "Redirect to Page", value: "relationship" }] : []
       ],
       admin: {
         description: "What happens after a successful form submission"
@@ -97,12 +368,12 @@ function formsCollection(pluginConfig) {
       }
     })
   ];
-  if (pluginConfig.redirectRelationships.length > 0) {
+  if (redirectCollections.length > 0) {
     settingsFields.push(
       relationship({
         name: "redirectPage",
         label: "Redirect Page",
-        relationTo: pluginConfig.redirectRelationships,
+        relationTo: redirectCollections,
         admin: {
           description: "Select a page to redirect to after submission",
           condition: {
@@ -224,6 +495,19 @@ function formsCollection(pluginConfig) {
         description: "Only published forms can receive submissions. Closed forms display a message instead."
       }
     }),
+    // NOT `firstPublishedAt`, which is the obvious name and the one to reach
+    // for next. The framework owns that name on collections it manages the
+    // publish lifecycle for, and a write naming it from a plugin collection is
+    // stripped on the way to the insert — silently, leaving the column null and
+    // every closed form reading as one that was never public.
+    date({
+      name: "wentLiveAt",
+      label: "First Published",
+      admin: {
+        readOnly: true,
+        description: "When this form first went live. Written once and never changed."
+      }
+    }),
     textarea({
       name: "closedMessage",
       label: "Closed Form Message",
@@ -265,49 +549,75 @@ function formsCollection(pluginConfig) {
           }
         }
       },
-      ...overrides.admin
+      ...adminOverrides
     },
     // Access control with sensible defaults
-    access: {
-      // Anyone can read forms (needed for frontend rendering)
-      read: accessOverrides?.read ?? true,
-      // Only authenticated users can create/update forms
-      create: accessOverrides?.create ?? (({ user }) => !!user),
-      update: accessOverrides?.update ?? (({ user }) => !!user),
-      // Only admins can delete forms (falls back to DB permissions)
-      delete: accessOverrides?.delete ?? (({ roles }) => roles.includes("admin") || roles.includes("super-admin"))
-    },
-    hooks: {
-      // Auto-generate slug from name if not provided
-      beforeValidate: [
-        (context) => {
-          const { data, operation } = context;
-          if (operation === "create" && data && !data.slug && data.name) {
-            data.slug = String(data.name).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+    // `read: true` — a form is public because a site renders it. The rest are
+    // the shared defaults.
+    access: accessWithDefaults(accessOverrides, { read: true }),
+    hooks: withHostHooks(
+      {
+        // Auto-generate slug from name if not provided
+        beforeValidate: [
+          (context) => {
+            const { data, operation } = context;
+            if (operation === "create" && data && !data.slug && data.name) {
+              data.slug = String(data.name).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+            }
+            const setsFields = operation === "create" || data?.fields !== void 0;
+            if (data && setsFields && (data.fields === void 0 || Array.isArray(data.fields) && data.fields.length === 0)) {
+              throw NextlyError.validation({
+                errors: [
+                  {
+                    path: "fields",
+                    code: "REQUIRED",
+                    message: "Form must have at least one field."
+                  }
+                ]
+              });
+            }
+            namedRedirectReference(
+              data,
+              operation,
+              pluginConfig.redirectRelationships
+            );
+            return data;
           }
-          const setsFields = operation === "create" || data?.fields !== void 0;
-          if (data && setsFields && (data.fields === void 0 || Array.isArray(data.fields) && data.fields.length === 0)) {
-            throw NextlyError.validation({
-              errors: [
-                {
-                  path: "fields",
-                  code: "REQUIRED",
-                  message: "Form must have at least one field."
-                }
-              ]
-            });
+        ]
+      },
+      hookOverrides,
+      {
+        // The last COLLECTION-level phase, after every host handler in it. A
+        // host `beforeValidate` may rewrite the payload once the earlier call
+        // has passed, so the check has to run again here.
+        //
+        // It is not the last mutating point in the write, and saying so would
+        // be false: `collection-mutation-service` runs FIELD-level
+        // `beforeChange` hooks after this one, and a host may contribute a
+        // field through `formOverrides.fields`. Nothing collection-level can
+        // sit after that — the next steps are hashing and the insert. What
+        // bounds the consequence is the submit path, which resolves an
+        // unusable target to NO redirect and logs it, never to a wrong one.
+        beforeChange: [
+          async (context) => {
+            await assertRedirectTargetUsable(
+              context,
+              pluginConfig.redirectRelationships,
+              pluginConfig.redirectTargetLocalization
+            );
+            stampFirstPublish(context);
+            return context.data;
           }
-          return data;
-        }
-      ]
-    },
+        ]
+      }
+    ),
     // Spread any additional overrides (excluding already used properties)
     ...overrides
   };
 }
 
 // src/collections/submissions.ts
-import { text as text2, textarea as textarea2, select as select2, json as json2, date, relationship as relationship2 } from "nextly";
+import { text as text2, textarea as textarea2, select as select2, json as json2, date as date2, relationship as relationship2 } from "nextly";
 function submissionsCollection(pluginConfig) {
   const {
     slug,
@@ -400,7 +710,7 @@ function submissionsCollection(pluginConfig) {
         description: "Browser/device information of the submitter"
       }
     }),
-    date({
+    date2({
       name: "submittedAt",
       label: "Submitted At",
       required: true,
@@ -411,7 +721,7 @@ function submissionsCollection(pluginConfig) {
     }),
     // Honesty stamps for admin edits of submitted data: a corrected
     // submission must never be indistinguishable from what the visitor sent.
-    date({
+    date2({
       name: "editedAt",
       label: "Edited At",
       admin: {
@@ -475,16 +785,9 @@ function submissionsCollection(pluginConfig) {
     },
     // Access control with sensible defaults
     // Public can create (submit forms), but only authenticated users can read/update/delete
-    access: {
-      // Anyone can submit forms (public access)
-      create: accessOverrides?.create ?? true,
-      // Only authenticated users can view submissions
-      read: accessOverrides?.read ?? (({ user }) => !!user),
-      // Only authenticated users can update submissions (e.g., change status, add notes)
-      update: accessOverrides?.update ?? (({ user }) => !!user),
-      // Only admins can delete submissions (falls back to DB permissions)
-      delete: accessOverrides?.delete ?? (({ roles }) => roles.includes("admin") || roles.includes("super-admin"))
-    },
+    // `create: true` — a visitor submits without an account. Reading, updating
+    // and deleting are the shared defaults.
+    access: accessWithDefaults(accessOverrides, { create: true }),
     hooks: {
       // Auto-set submittedAt timestamp on creation. (The edit stamp for
       // updates is registered in plugin.ts init — direct registry hooks are
@@ -560,7 +863,13 @@ function resolveConfig(options) {
       time: options.fields?.time ?? true,
       hidden: options.fields?.hidden ?? true
     },
-    redirectRelationships: options.redirectRelationships || [],
+    redirectRelationships: normalizeRedirectRelationships(
+      options.redirectRelationships
+    ),
+    // Filled at `init` from each collection's own metadata. Empty until then,
+    // and a slug that stays absent reads as unknown rather than as not
+    // localized — see `ResolvedFormBuilderConfig`.
+    redirectTargetLocalization: {},
     beforeEmail: options.beforeEmail,
     notifications: {
       defaultFrom: options.notifications?.defaultFrom,
@@ -750,6 +1059,12 @@ function formBuilder(options = {}) {
               // Runtime-resolved collection slugs (through ctx.self, so a
               // framework .rename() is honored too) — admin components
               // never hardcode "forms"/"form-submissions".
+              // Names only. A pattern may be a function, which does not
+              // survive JSON and which the browser has no use for — the
+              // admin picks a document, the server builds the URL.
+              redirectCollections: Object.keys(
+                resolvedConfig.redirectRelationships
+              ),
               slugs: {
                 forms: ctx.self.collections[resolvedConfig.formOverrides.slug] ?? resolvedConfig.formOverrides.slug,
                 submissions: ctx.self.collections[resolvedConfig.formSubmissionOverrides.slug] ?? resolvedConfig.formSubmissionOverrides.slug
@@ -776,7 +1091,7 @@ function formBuilder(options = {}) {
     },
     // -- Init ----------------------------------------------------------------
     // Registers an afterCreate hook on submissions to send email notifications.
-    init(nextly) {
+    async init(nextly) {
       const declaredSubmissionsSlug = resolvedConfig.formSubmissionOverrides.slug;
       const submissionSlug = nextly.self.collections[declaredSubmissionsSlug] ?? declaredSubmissionsSlug;
       nextly.logger.info("Form Builder plugin initialized", {
@@ -784,6 +1099,30 @@ function formBuilder(options = {}) {
         submissionsCollection: submissionSlug,
         enabledFields: Object.entries(resolvedConfig.fields).filter(([, on]) => on).map(([name]) => name)
       });
+      for (const slug of Object.keys(
+        resolvedConfig.redirectTargetLocalization
+      )) {
+        delete resolvedConfig.redirectTargetLocalization[slug];
+      }
+      await Promise.all(
+        Object.keys(resolvedConfig.redirectRelationships).map(
+          async (declared) => {
+            const slug = nextly.self.collections[declared] ?? declared;
+            try {
+              const collection = await nextly.services.collections.getCollection(slug, {});
+              const localized = collection?.localized;
+              if (typeof localized === "boolean") {
+                resolvedConfig.redirectTargetLocalization[declared] = localized;
+              }
+            } catch {
+              nextly.logger.debug?.(
+                "Redirect target localization could not be read",
+                { collection: slug }
+              );
+            }
+          }
+        )
+      );
       nextly.__formBuilderConfig = resolvedConfig;
       if (resolvedConfig.beforeEmail) {
         nextly.filters.add(
@@ -850,9 +1189,9 @@ function getFormBuilderConfig(nextly) {
   return nextly.__formBuilderConfig;
 }
 function resolveFieldRef(ref, data) {
-  const match = ref.match(/^\{\{(\w+)\}\}$/);
-  if (!match) return ref;
-  const value = data[match[1]];
+  const name = parseFieldRef(ref);
+  if (name === null) return ref;
+  const value = data[name];
   return typeof value === "string" ? value : "";
 }
 function collectAttachmentInputs(fields, submittedData) {
@@ -1351,6 +1690,17 @@ function validateSettings(settings, errors) {
       });
     }
   }
+  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
+    errors.push({
+      path: "settings.redirectPage",
+      message: "A page is required when confirmation type is 'relationship'",
+      code: "REDIRECT_PAGE_REQUIRED"
+    });
+  }
+}
+function namesADocument(value) {
+  if (typeof value === "string") return value.length > 0;
+  return parseRedirectReference(value, []) !== null;
 }
 function validateAccess(access, errors) {
   if (!access) {
@@ -1444,7 +1794,7 @@ var file = (config) => ({
   ...config,
   type: "file"
 });
-var date2 = (config) => ({
+var date3 = (config) => ({
   ...config,
   type: "date"
 });
@@ -1512,53 +1862,74 @@ function generateFieldSchema(field) {
       return z.unknown();
   }
 }
-function generateTextSchema(field) {
-  let schema = z.string();
-  if (field.validation?.minLength !== void 0) {
-    schema = schema.min(
-      field.validation.minLength,
-      field.validation.errorMessage || `Minimum ${field.validation.minLength} characters required`
-    );
-  }
-  if (field.validation?.maxLength !== void 0) {
-    schema = schema.max(
-      field.validation.maxLength,
-      field.validation.errorMessage || `Maximum ${field.validation.maxLength} characters allowed`
-    );
-  }
-  if (field.validation?.pattern) {
-    schema = schema.regex(
-      new RegExp(field.validation.pattern),
-      field.validation.errorMessage || "Invalid format"
-    );
+function customMessage(field) {
+  const enforced = ENFORCED_VALIDATION_RULES[field.type] ?? [];
+  if (!enforced.includes("message")) return void 0;
+  return field.validation?.errorMessage;
+}
+function enforcedValidation(field) {
+  const stored = field.validation ?? {};
+  return { ...stored, errorMessage: customMessage(field) };
+}
+var STRING_RULE_APPLIERS = {
+  minLength: (schema, validation) => validation.minLength === void 0 ? schema : schema.min(
+    validation.minLength,
+    validation.errorMessage || `Minimum ${validation.minLength} characters required`
+  ),
+  maxLength: (schema, validation) => validation.maxLength === void 0 ? schema : schema.max(
+    validation.maxLength,
+    validation.errorMessage || `Maximum ${validation.maxLength} characters allowed`
+  ),
+  pattern: (schema, validation, fallback) => validation.pattern ? schema.regex(
+    new RegExp(validation.pattern),
+    validation.errorMessage || fallback
+  ) : schema
+};
+var NUMBER_RULE_APPLIERS = {
+  min: (schema, validation) => validation.min === void 0 ? schema : schema.min(
+    validation.min,
+    validation.errorMessage || `Minimum value is ${validation.min}`
+  ),
+  max: (schema, validation) => validation.max === void 0 ? schema : schema.max(
+    validation.max,
+    validation.errorMessage || `Maximum value is ${validation.max}`
+  )
+};
+function overridesPattern(field) {
+  const enforced = ENFORCED_VALIDATION_RULES[field.type] ?? [];
+  if (!enforced.includes("pattern")) return false;
+  const validation = field.validation ?? {};
+  return Boolean(validation.pattern);
+}
+function applyStringRules(schema, field, patternMessage) {
+  const validation = enforcedValidation(field);
+  let constrained = schema;
+  for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
+    const apply = STRING_RULE_APPLIERS[rule];
+    if (apply) constrained = apply(constrained, validation, patternMessage);
   }
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  return constrained;
+}
+function generateTextSchema(field) {
+  const schema = applyStringRules(z.string(), field, "Invalid format");
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateEmailSchema(field) {
-  let schema = z.string().email(field.validation?.errorMessage || "Invalid email address");
-  if (field.validation?.pattern) {
-    schema = schema.regex(
-      new RegExp(field.validation.pattern),
-      field.validation.errorMessage || "Invalid email format"
-    );
-  }
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  const schema = applyStringRules(
+    z.string().email(customMessage(field) || "Invalid email address"),
+    field,
+    "Invalid email format"
+  );
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateNumberSchema(field) {
   let schema = z.number({
-    error: (issue) => issue.input === void 0 ? field.validation?.errorMessage || "This field is required" : "Must be a number"
+    error: (issue) => issue.input === void 0 ? customMessage(field) || "This field is required" : "Must be a number"
   });
-  if (field.validation?.min !== void 0) {
-    schema = schema.min(
-      field.validation.min,
-      field.validation.errorMessage || `Minimum value is ${field.validation.min}`
-    );
-  }
-  if (field.validation?.max !== void 0) {
-    schema = schema.max(
-      field.validation.max,
-      field.validation.errorMessage || `Maximum value is ${field.validation.max}`
-    );
+  const validation = enforcedValidation(field);
+  for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
+    const apply = NUMBER_RULE_APPLIERS[rule];
+    if (apply) schema = apply(schema, validation);
   }
   if (field.required) {
     return schema;
@@ -1566,45 +1937,24 @@ function generateNumberSchema(field) {
   return schema.optional().nullable();
 }
 function generatePhoneSchema(field) {
-  let schema = z.string();
-  if (field.validation?.pattern) {
-    schema = schema.regex(
-      new RegExp(field.validation.pattern),
-      field.validation.errorMessage || "Invalid phone number format"
-    );
-  } else {
-    schema = schema.regex(
-      /^[\d\s\-+()]+$/,
-      field.validation?.errorMessage || "Invalid phone number"
-    );
-  }
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  const base = overridesPattern(field) ? z.string() : z.string().regex(
+    /^[\d\s\-+()]+$/,
+    customMessage(field) || "Invalid phone number"
+  );
+  const schema = applyStringRules(base, field, "Invalid phone number format");
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateUrlSchema(field) {
-  let schema = z.string().url(field.validation?.errorMessage || "Invalid URL");
-  if (field.validation?.pattern) {
-    schema = schema.regex(
-      new RegExp(field.validation.pattern),
-      field.validation.errorMessage || "Invalid URL format"
-    );
-  }
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  const schema = applyStringRules(
+    z.string().url(customMessage(field) || "Invalid URL"),
+    field,
+    "Invalid URL format"
+  );
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateTextareaSchema(field) {
-  let schema = z.string();
-  if (field.validation?.minLength !== void 0) {
-    schema = schema.min(
-      field.validation.minLength,
-      field.validation.errorMessage || `Minimum ${field.validation.minLength} characters required`
-    );
-  }
-  if (field.validation?.maxLength !== void 0) {
-    schema = schema.max(
-      field.validation.maxLength,
-      field.validation.errorMessage || `Maximum ${field.validation.maxLength} characters allowed`
-    );
-  }
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  const schema = applyStringRules(z.string(), field, "Invalid format");
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateSelectSchema(field) {
   const validValues = field.options.map((opt) => opt.value);
@@ -1613,13 +1963,13 @@ function generateSelectSchema(field) {
     if (field.required) {
       return schema2.min(
         1,
-        field.validation?.errorMessage || "Please select at least one option"
+        customMessage(field) || "Please select at least one option"
       );
     }
     return schema2.optional();
   }
   const schema = z.enum(validValues, {
-    error: () => field.validation?.errorMessage || "Please select a valid option"
+    error: () => customMessage(field) || "Please select a valid option"
   });
   if (field.required) {
     return schema;
@@ -1630,7 +1980,7 @@ function generateCheckboxSchema(field) {
   const schema = z.boolean();
   if (field.required) {
     return schema.refine((val) => val === true, {
-      message: field.validation?.errorMessage || "This field is required"
+      message: customMessage(field) || "This field is required"
     });
   }
   return schema.optional();
@@ -1638,7 +1988,7 @@ function generateCheckboxSchema(field) {
 function generateRadioSchema(field) {
   const validValues = field.options.map((opt) => opt.value);
   const schema = z.enum(validValues, {
-    error: () => field.validation?.errorMessage || "Please select an option"
+    error: () => customMessage(field) || "Please select an option"
   });
   if (field.required) {
     return schema;
@@ -1651,42 +2001,42 @@ function generateFileSchema(field) {
     if (field.required) {
       return schema2.min(
         1,
-        field.validation?.errorMessage || "Please upload at least one file"
+        customMessage(field) || "Please upload at least one file"
       );
     }
     return schema2.optional();
   }
   const schema = z.string();
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateDateSchema(field) {
   let schema = z.string();
   schema = schema.refine(
     (val) => {
       if (!val) return true;
-      const date3 = new Date(val);
-      return !isNaN(date3.getTime());
+      const date4 = new Date(val);
+      return !isNaN(date4.getTime());
     },
-    { message: field.validation?.errorMessage || "Invalid date" }
+    { message: customMessage(field) || "Invalid date" }
   );
   if (field.min || field.max) {
     schema = schema.refine(
       (val) => {
         if (!val) return true;
-        const date3 = new Date(val);
-        if (field.min && date3 < new Date(field.min)) return false;
-        if (field.max && date3 > new Date(field.max)) return false;
+        const date4 = new Date(val);
+        if (field.min && date4 < new Date(field.min)) return false;
+        if (field.max && date4 > new Date(field.max)) return false;
         return true;
       },
       {
-        message: field.validation?.errorMessage || `Date must be between ${field.min || "any"} and ${field.max || "any"}`
+        message: customMessage(field) || `Date must be between ${field.min || "any"} and ${field.max || "any"}`
       }
     );
   }
   if (field.required) {
     return schema.refine(
       (val) => val !== void 0 && val !== null && val !== "",
-      { message: field.validation?.errorMessage || "This field is required" }
+      { message: customMessage(field) || "This field is required" }
     );
   }
   return schema.optional().or(z.literal(""));
@@ -1694,13 +2044,13 @@ function generateDateSchema(field) {
 function generateTimeSchema(field) {
   const schema = z.string().regex(
     /^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/,
-    field.validation?.errorMessage || "Invalid time format (HH:mm)"
+    customMessage(field) || "Invalid time format (HH:mm)"
   );
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function generateHiddenSchema(field) {
   const schema = z.string();
-  return applyRequired(schema, field.required, field.validation?.errorMessage);
+  return applyRequired(schema, field.required, customMessage(field));
 }
 function applyRequired(schema, required, errorMessage) {
   if (required) {
@@ -1775,6 +2125,9 @@ function getValidationErrors(result) {
   return errors;
 }
 
+// src/handlers/submit-form.ts
+import { formAvailability, NO_SUCH_FORM } from "nextly";
+
 // src/handlers/spam-detection.ts
 var rateLimitStore = /* @__PURE__ */ new Map();
 async function checkSpam(options) {
@@ -1899,19 +2252,18 @@ async function submitForm(options, context) {
       logger.warn?.("Form submission attempted for non-existent form", {
         formSlug
       });
-      return {
-        success: false,
-        error: "Form not found"
-      };
+      return { success: false, error: NO_SUCH_FORM };
     }
-    if (form.status !== "published") {
-      logger.info?.("Form submission rejected - form not published", {
+    const availability = formAvailability(form);
+    if (availability.kind !== "open") {
+      logger.info?.("Form submission rejected - form not accepting", {
         formSlug,
-        status: form.status
+        status: form.status,
+        availability: availability.kind
       });
       return {
         success: false,
-        error: "This form is not currently accepting submissions"
+        error: availability.kind === "closed" ? availability.message : NO_SUCH_FORM
       };
     }
     const settings = normalizeFormSettings(form.settings);
@@ -2026,7 +2378,11 @@ async function submitForm(options, context) {
         warnings: submission.warnings
       });
     }
-    const redirect = determineRedirectUrl(form);
+    const redirect = await resolveRedirectUrl(
+      form,
+      pluginConfig,
+      pluginContext
+    );
     if (isContentSpam) {
       return { success: true, redirect };
     }
@@ -2064,21 +2420,100 @@ async function fetchFormBySlug(slug, pluginConfig, pluginContext) {
     return null;
   }
 }
-function determineRedirectUrl(form) {
-  if (!form.settings) {
+async function resolveRedirectUrl(form, pluginConfig, pluginContext) {
+  const settings = form.settings;
+  if (!settings) return void 0;
+  if (settings.confirmationType === "redirect" && settings.redirectUrl) {
+    return settings.redirectUrl;
+  }
+  const field = pickedDocumentField(settings);
+  if (!field) return void 0;
+  return urlForPickedDocument(
+    settings[field],
+    form,
+    pluginConfig,
+    pluginContext
+  );
+}
+async function urlForPickedDocument(stored, form, pluginConfig, pluginContext) {
+  const { logger } = pluginContext;
+  const patterns = pluginConfig.redirectRelationships;
+  const reference = parseRedirectReference(stored, Object.keys(patterns));
+  if (!reference) {
+    logger.warn?.("Form redirects to a page, but names no readable document", {
+      form: form.slug
+    });
+    return void 0;
+  }
+  const pattern = patterns[reference.collection];
+  if (!pattern) {
+    logger.warn?.(
+      "Form redirects to a collection that is not in redirectRelationships",
+      { form: form.slug, collection: reference.collection }
+    );
+    return void 0;
+  }
+  const target = await readTarget(reference, form, pluginContext);
+  if (!target) return void 0;
+  if (documentReachability(
+    target,
+    pluginConfig.redirectTargetLocalization[reference.collection]
+  ) === "unreachable") {
+    logger.warn?.("Form redirects to a page that has never been published", {
+      form: form.slug,
+      collection: reference.collection,
+      target: reference.id
+    });
     return void 0;
   }
-  if (form.settings.confirmationType !== "redirect") {
+  return buildUrl(pattern, target, reference.collection, form, pluginContext);
+}
+function buildUrl(pattern, target, collection, form, pluginContext) {
+  const { logger } = pluginContext;
+  try {
+    const url2 = applyRedirectPattern(pattern, target);
+    if (!url2) {
+      logger.warn?.(
+        "Form redirect pattern could not be filled from the target document",
+        { form: form.slug, collection }
+      );
+    }
+    return url2;
+  } catch (error) {
+    logger.warn?.("Form redirect pattern threw while building a URL", {
+      form: form.slug,
+      collection,
+      error: error instanceof Error ? error.message : String(error)
+    });
     return void 0;
   }
-  if (form.settings.redirectUrl) {
-    return form.settings.redirectUrl;
+}
+async function readTarget(reference, form, pluginContext) {
+  const { logger } = pluginContext;
+  const context = {
+    form: form.slug,
+    collection: reference.collection,
+    id: reference.id
+  };
+  let row;
+  try {
+    row = await pluginContext.services.collections.findEntryById(
+      reference.collection,
+      reference.id,
+      { as: "system" }
+    );
+  } catch (error) {
+    logger.warn?.("Form redirect target could not be read", {
+      ...context,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return void 0;
   }
-  if (form.settings.redirectRelation) {
-    const { relationTo, value } = form.settings.redirectRelation;
-    return `relationship://${relationTo}/${value}`;
+  if (!row || typeof row !== "object") {
+    logger.warn?.("Form redirect target no longer exists", context);
+    return void 0;
   }
-  return void 0;
+  return row;
 }
 async function validateSubmission(formSlug, data, context) {
   const { pluginContext, pluginConfig } = context;
@@ -2352,7 +2787,7 @@ export {
   cleanupRateLimitStore,
   clearRateLimitStore,
   createFormConfig,
-  date2 as date,
+  date3 as date,
   downloadFile,
   email,
   evaluateConditions,