@nextlyhq/plugin-form-builder 0.0.2-alpha.62 → 0.0.2-alpha.65

package/dist/index.js

@@ -31,11 +31,14 @@ import {
   pickedDocumentField,
   pluralize,
   toTitleCase
-} from "./chunk-H5X3FKOZ.js";
+} from "./chunk-W6NLZFHH.js";
 
 // src/plugin.ts
 import { createRequire } from "module";
-import { definePlugin } from "@nextlyhq/plugin-sdk";
+import {
+  definePlugin,
+  NextlyError as NextlyError2
+} from "@nextlyhq/plugin-sdk";
 
 // src/collections/forms.ts
 import { NextlyError } from "@nextlyhq/plugin-sdk";
@@ -824,241 +827,622 @@ function asFormDocument(row) {
   return row;
 }
 
-// src/plugin.ts
-var { version: PLUGIN_VERSION } = createRequire(import.meta.url)(
-  "../package.json"
-);
-function resolveConfig(options) {
-  const formOverrides = options.formOverrides || {};
-  const submissionOverrides = options.formSubmissionOverrides || {};
-  return {
-    formOverrides: {
-      ...formOverrides,
-      slug: formOverrides.slug || "forms",
-      labels: {
-        singular: formOverrides.labels?.singular || "Form",
-        plural: formOverrides.labels?.plural || "Forms"
-      }
-    },
-    formSubmissionOverrides: {
-      ...submissionOverrides,
-      slug: submissionOverrides.slug || "form-submissions",
-      labels: {
-        singular: submissionOverrides.labels?.singular || "Submission",
-        plural: submissionOverrides.labels?.plural || "Submissions"
-      }
-    },
-    fields: {
-      text: options.fields?.text ?? true,
-      email: options.fields?.email ?? true,
-      number: options.fields?.number ?? true,
-      phone: options.fields?.phone ?? true,
-      url: options.fields?.url ?? true,
-      textarea: options.fields?.textarea ?? true,
-      select: options.fields?.select ?? true,
-      checkbox: options.fields?.checkbox ?? true,
-      radio: options.fields?.radio ?? true,
-      file: options.fields?.file ?? true,
-      date: options.fields?.date ?? true,
-      time: options.fields?.time ?? true,
-      hidden: options.fields?.hidden ?? true
-    },
-    redirectRelationships: normalizeRedirectRelationships(
-      options.redirectRelationships
-    ),
-    // Filled at `init` from each collection's own metadata. Empty until then,
-    // and a slug that stays absent reads as unknown rather than as not
-    // localized — see `ResolvedFormBuilderConfig`.
-    redirectTargetLocalization: {},
-    beforeEmail: options.beforeEmail,
-    notifications: {
-      defaultFrom: options.notifications?.defaultFrom,
-      defaultToEmail: options.notifications?.defaultToEmail,
-      enabled: options.notifications?.enabled ?? true
-    },
-    spamProtection: {
-      honeypot: options.spamProtection?.honeypot ?? true,
-      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
-      rateLimit: {
-        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
-        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
-      }
-    },
-    uploads: {
-      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
-      // 10 MB
-      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
-        "image/*",
-        "application/pdf",
-        "text/*"
-      ],
-      uploadCollection: options.uploads?.uploadCollection ?? "media"
-    },
-    features: {
-      builder: options.features?.builder ?? true,
-      conditionalLogic: options.features?.conditionalLogic ?? true,
-      fileUploads: options.features?.fileUploads ?? true
+// src/handlers/prepare-submission.ts
+import { stripHtmlTags } from "nextly";
+
+// src/utils/generate-schema.ts
+import { z } from "zod";
+function generateZodSchema(fields) {
+  const schemaShape = {};
+  for (const field of fields) {
+    if (!isKnownFormField(field)) {
+      schemaShape[field.name] = field.required ? z.unknown().refine(
+        (value) => value !== void 0 && value !== null && value !== "",
+        { message: `${field.label || field.name} is required` }
+      ) : z.unknown();
+      continue;
     }
-  };
+    if (field.type === "hidden" && !field.required) {
+      schemaShape[field.name] = z.string().optional();
+      continue;
+    }
+    const fieldSchema = generateFieldSchema(field);
+    if (fieldSchema) {
+      schemaShape[field.name] = fieldSchema;
+    }
+  }
+  return z.object(schemaShape);
 }
-function formBuilder(options = {}) {
-  const resolvedConfig = resolveConfig(options);
-  const formsCol = formsCollection(resolvedConfig);
-  const submissionsCol = submissionsCollection(resolvedConfig);
-  const plugin = definePlugin({
-    name: "@nextlyhq/plugin-form-builder",
-    version: PLUGIN_VERSION,
-    nextly: ">=0.0.2-alpha.21",
-    // Identity metadata for the admin plugins page, mirroring package.json.
-    author: "Nextly",
-    homepage: "https://nextlyhq.com",
-    repository: "https://github.com/nextlyhq/nextly",
-    license: "MIT",
-    category: "forms",
-    tags: ["forms", "submissions", "email-notifications"],
-    // Declarative schema: the merged pipeline folds these into the
-    // app schema — no manual `setup()` append needed. Just register the plugin.
-    contributes: {
-      collections: [formsCol, submissionsCol],
-      // Custom permission — gates submission export beyond CRUD. The
-      // canonical example third-party plugin authors copy.
-      permissions: [
-        {
-          action: "export",
-          resource: "submissions",
-          label: "Export Submissions",
-          description: "Export form submissions as CSV/JSON",
-          // No `group`: the admin already files this under the plugin that
-          // declared it, so naming the plugin again would nest it inside
-          // itself. `group` is for a plugin with enough permissions to sort
-          // its own into headings, which one is not.
-          //
-          // `danger` because the point of the permission is to take
-          // submissions — names, emails, whatever a form asked for — out of
-          // the site in a file.
-          danger: true
-        }
-      ],
-      // HTTP route — exported at
-      // /api/plugins/@nextlyhq/plugin-form-builder/submissions/export. Secure by
-      // default: gated by the custom `export-submissions` permission. Reads
-      // via the secure-by-default service path as the authed user and
-      // resolves its OWN slug through `ctx.self`. The canonical
-      // contributes.routes example for third-party authors.
-      routes: [
-        {
-          method: "GET",
-          path: "/submissions/export",
-          requiredPermission: "export-submissions",
-          handler: async (req, ctx) => {
-            const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
-            const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
-            const url2 = new URL(req.url);
-            const format = url2.searchParams.get("format") ?? "json";
-            const formId = url2.searchParams.get("form");
-            const status = url2.searchParams.get("status");
-            const where = {};
-            if (formId) where.form = { equals: formId };
-            if (status) where.status = { equals: status };
-            else where.status = { not_equals: "spam" };
-            const opts = { as: "user", user: ctx.user ?? void 0 };
-            let form;
-            if (format === "csv") {
-              if (!formId) {
-                return Response.json(
-                  {
-                    error: {
-                      code: "VALIDATION_ERROR",
-                      message: "CSV export requires a form parameter."
-                    }
-                  },
-                  { status: 400 }
-                );
-              }
-              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
-              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
-              const formResult = await ctx.services.collections.listEntries(
-                formsSlug,
-                { where: { id: { equals: formId } } },
-                opts
-              );
-              form = formResult.data[0];
-              if (!form) {
-                return Response.json(
-                  { error: { code: "NOT_FOUND", message: "Form not found." } },
-                  { status: 404 }
-                );
-              }
-            }
-            const MAX_EXPORT_ROWS = 5e4;
-            const items = [];
-            const pageSize = 200;
-            let truncated = false;
-            for (let page = 1; ; page += 1) {
-              const result = await ctx.services.collections.listEntries(
-                slug,
-                { where, pagination: { limit: pageSize, page } },
-                opts
-              );
-              items.push(...result.data);
-              const pageWasFull = result.data.length === pageSize;
-              if (items.length >= MAX_EXPORT_ROWS) {
-                truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
-                items.length = MAX_EXPORT_ROWS;
-                break;
-              }
-              if (!pageWasFull) break;
-            }
-            const truncationHeaders = truncated ? { "X-Export-Truncated": "true" } : {};
-            if (format !== "csv" || !form) {
-              return Response.json({ items }, { headers: truncationHeaders });
-            }
-            const csv = exportToCSV(
-              asSubmissionDocuments(items),
-              asFormDocument(form)
-            );
-            const filename = generateExportFilename(
-              typeof form.slug === "string" ? form.slug : "form",
-              "csv"
-            );
-            return new Response(csv, {
-              headers: {
-                "Content-Type": "text/csv; charset=utf-8",
-                "Content-Disposition": `attachment; filename="${filename}"`,
-                ...truncationHeaders
-              }
-            });
-          }
-        },
-        {
-          // The builder UI reads the host's resolved field enable/disable map
-          // from here, so the plugin option actually gates the type picker.
-          // Options resolve server-side only; this is the one channel the
-          // admin client has to them.
-          method: "GET",
-          path: "/builder-config",
-          // Derived from the forms slug like the menu entry: with an
-          // overridden slug, users hold read-<slug>, not read-forms.
-          requiredPermission: `read-${resolvedConfig.formOverrides.slug}`,
-          handler: (_req, ctx) => Promise.resolve(
-            Response.json({
-              fields: resolvedConfig.fields,
-              // Notification defaults the builder surfaces: defaultToEmail
-              // seeds a new form's first rule, defaultFrom renders as the
-              // inherited sender placeholder.
-              notifications: {
-                defaultFrom: resolvedConfig.notifications.defaultFrom,
-                defaultToEmail: resolvedConfig.notifications.defaultToEmail
-              },
-              // Spam defaults the Settings tab surfaces, so per-form
-              // override selects can show what "inherit" resolves to.
-              spamProtection: {
-                honeypot: resolvedConfig.spamProtection.honeypot,
-                recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false
-              },
-              // Runtime-resolved collection slugs (through ctx.self, so a
-              // framework .rename() is honored too) — admin components
-              // never hardcode "forms"/"form-submissions".
+function generateFieldSchema(field) {
+  switch (field.type) {
+    case "text":
+      return generateTextSchema(field);
+    case "email":
+      return generateEmailSchema(field);
+    case "number":
+      return generateNumberSchema(field);
+    case "phone":
+      return generatePhoneSchema(field);
+    case "url":
+      return generateUrlSchema(field);
+    case "textarea":
+      return generateTextareaSchema(field);
+    case "select":
+      return generateSelectSchema(field);
+    case "checkbox":
+      return generateCheckboxSchema(field);
+    case "radio":
+      return generateRadioSchema(field);
+    case "file":
+      return generateFileSchema(field);
+    case "date":
+      return generateDateSchema(field);
+    case "time":
+      return generateTimeSchema(field);
+    case "hidden":
+      return generateHiddenSchema(field);
+    default:
+      return z.unknown();
+  }
+}
+function customMessage(field) {
+  const enforced = ENFORCED_VALIDATION_RULES[field.type] ?? [];
+  if (!enforced.includes("message")) return void 0;
+  return field.validation?.errorMessage;
+}
+function enforcedValidation(field) {
+  const stored = field.validation ?? {};
+  return { ...stored, errorMessage: customMessage(field) };
+}
+var STRING_RULE_APPLIERS = {
+  minLength: (schema, validation) => validation.minLength === void 0 ? schema : schema.min(
+    validation.minLength,
+    validation.errorMessage || `Minimum ${validation.minLength} characters required`
+  ),
+  maxLength: (schema, validation) => validation.maxLength === void 0 ? schema : schema.max(
+    validation.maxLength,
+    validation.errorMessage || `Maximum ${validation.maxLength} characters allowed`
+  ),
+  pattern: (schema, validation, fallback) => validation.pattern ? schema.regex(
+    new RegExp(validation.pattern),
+    validation.errorMessage || fallback
+  ) : schema
+};
+var NUMBER_RULE_APPLIERS = {
+  min: (schema, validation) => validation.min === void 0 ? schema : schema.min(
+    validation.min,
+    validation.errorMessage || `Minimum value is ${validation.min}`
+  ),
+  max: (schema, validation) => validation.max === void 0 ? schema : schema.max(
+    validation.max,
+    validation.errorMessage || `Maximum value is ${validation.max}`
+  )
+};
+function overridesPattern(field) {
+  const enforced = ENFORCED_VALIDATION_RULES[field.type] ?? [];
+  if (!enforced.includes("pattern")) return false;
+  const validation = field.validation ?? {};
+  return Boolean(validation.pattern);
+}
+function applyStringRules(schema, field, patternMessage) {
+  const validation = enforcedValidation(field);
+  let constrained = schema;
+  for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
+    const apply = STRING_RULE_APPLIERS[rule];
+    if (apply) constrained = apply(constrained, validation, patternMessage);
+  }
+  return constrained;
+}
+function generateTextSchema(field) {
+  const schema = applyStringRules(z.string(), field, "Invalid format");
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateEmailSchema(field) {
+  const schema = applyStringRules(
+    z.string().email(customMessage(field) || "Invalid email address"),
+    field,
+    "Invalid email format"
+  );
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateNumberSchema(field) {
+  let schema = z.number({
+    error: (issue) => issue.input === void 0 ? customMessage(field) || "This field is required" : "Must be a number"
+  });
+  const validation = enforcedValidation(field);
+  for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
+    const apply = NUMBER_RULE_APPLIERS[rule];
+    if (apply) schema = apply(schema, validation);
+  }
+  if (field.required) {
+    return schema;
+  }
+  return schema.optional().nullable();
+}
+function generatePhoneSchema(field) {
+  const base = overridesPattern(field) ? z.string() : z.string().regex(
+    /^[\d\s\-+()]+$/,
+    customMessage(field) || "Invalid phone number"
+  );
+  const schema = applyStringRules(base, field, "Invalid phone number format");
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateUrlSchema(field) {
+  const schema = applyStringRules(
+    z.string().url(customMessage(field) || "Invalid URL"),
+    field,
+    "Invalid URL format"
+  );
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateTextareaSchema(field) {
+  const schema = applyStringRules(z.string(), field, "Invalid format");
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateSelectSchema(field) {
+  const validValues = field.options.map((opt) => opt.value);
+  if (field.allowMultiple) {
+    const schema2 = z.array(z.enum(validValues));
+    if (field.required) {
+      return schema2.min(
+        1,
+        customMessage(field) || "Please select at least one option"
+      );
+    }
+    return schema2.optional();
+  }
+  const schema = z.enum(validValues, {
+    error: () => customMessage(field) || "Please select a valid option"
+  });
+  if (field.required) {
+    return schema;
+  }
+  return schema.optional();
+}
+function generateCheckboxSchema(field) {
+  const schema = z.boolean();
+  if (field.required) {
+    return schema.refine((val) => val === true, {
+      message: customMessage(field) || "This field is required"
+    });
+  }
+  return schema.optional();
+}
+function generateRadioSchema(field) {
+  const validValues = field.options.map((opt) => opt.value);
+  const schema = z.enum(validValues, {
+    error: () => customMessage(field) || "Please select an option"
+  });
+  if (field.required) {
+    return schema;
+  }
+  return schema.optional();
+}
+function generateFileSchema(field) {
+  if (field.multiple) {
+    const schema2 = z.array(z.string());
+    if (field.required) {
+      return schema2.min(
+        1,
+        customMessage(field) || "Please upload at least one file"
+      );
+    }
+    return schema2.optional();
+  }
+  const schema = z.string();
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateDateSchema(field) {
+  let schema = z.string();
+  schema = schema.refine(
+    (val) => {
+      if (!val) return true;
+      const date4 = new Date(val);
+      return !isNaN(date4.getTime());
+    },
+    { message: customMessage(field) || "Invalid date" }
+  );
+  if (field.min || field.max) {
+    schema = schema.refine(
+      (val) => {
+        if (!val) return true;
+        const date4 = new Date(val);
+        if (field.min && date4 < new Date(field.min)) return false;
+        if (field.max && date4 > new Date(field.max)) return false;
+        return true;
+      },
+      {
+        message: customMessage(field) || `Date must be between ${field.min || "any"} and ${field.max || "any"}`
+      }
+    );
+  }
+  if (field.required) {
+    return schema.refine(
+      (val) => val !== void 0 && val !== null && val !== "",
+      { message: customMessage(field) || "This field is required" }
+    );
+  }
+  return schema.optional().or(z.literal(""));
+}
+function generateTimeSchema(field) {
+  const schema = z.string().regex(
+    /^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/,
+    customMessage(field) || "Invalid time format (HH:mm)"
+  );
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function generateHiddenSchema(field) {
+  const schema = z.string();
+  return applyRequired(schema, field.required, customMessage(field));
+}
+function applyRequired(schema, required, errorMessage) {
+  if (required) {
+    return schema.min(1, errorMessage || "This field is required");
+  }
+  return schema.optional().or(z.literal(""));
+}
+function transformFormData(data, fields) {
+  const transformed = {};
+  for (const field of fields) {
+    const value = data[field.name];
+    if (value === void 0) {
+      continue;
+    }
+    transformed[field.name] = isKnownFormField(field) ? transformFieldValue(value, field) : value;
+  }
+  return transformed;
+}
+function transformFieldValue(value, field) {
+  if (value === null || value === void 0) {
+    return value;
+  }
+  switch (field.type) {
+    case "number":
+      if (typeof value === "string") {
+        const num = parseFloat(value);
+        return isNaN(num) ? value : num;
+      }
+      return value;
+    case "checkbox":
+      if (typeof value === "string") {
+        return value === "true" || value === "1" || value === "on";
+      }
+      return Boolean(value);
+    case "text":
+    case "email":
+    case "phone":
+    case "url":
+    case "textarea":
+    case "hidden":
+      if (typeof value === "string") {
+        return value.trim();
+      }
+      return value;
+    case "select":
+      if (field.allowMultiple) {
+        if (!Array.isArray(value)) {
+          return value ? [value] : [];
+        }
+      }
+      return value;
+    default:
+      return value;
+  }
+}
+function validateFormData(data, fields) {
+  const transformed = transformFormData(data, fields);
+  const schema = generateZodSchema(fields);
+  return schema.safeParse(transformed);
+}
+function getValidationErrors(result) {
+  if (result.success) {
+    return {};
+  }
+  const errors = {};
+  for (const error of result.error.issues) {
+    const path = error.path.join(".");
+    if (!errors[path]) {
+      errors[path] = error.message;
+    }
+  }
+  return errors;
+}
+
+// src/handlers/prepare-submission.ts
+var TEXT_FORM_FIELDS = /* @__PURE__ */ new Set([
+  "text",
+  "email",
+  "textarea",
+  "phone",
+  "url",
+  "hidden"
+]);
+function sanitizeSubmissionData(data, fields) {
+  for (const field of fields) {
+    if (!TEXT_FORM_FIELDS.has(field.type)) continue;
+    const value = data[field.name];
+    if (typeof value !== "string") continue;
+    data[field.name] = stripHtmlTags(value);
+  }
+}
+var PLUGIN_SUBMISSION = Symbol.for("nextly.plugin-form-builder.submission");
+function asPluginSubmission(row, marks) {
+  return Object.defineProperty(row, PLUGIN_SUBMISSION, {
+    value: marks,
+    enumerable: true,
+    configurable: true
+  });
+}
+function submissionMarks(row) {
+  return row[PLUGIN_SUBMISSION];
+}
+function sameValue(left, right) {
+  if (Object.is(left, right)) return true;
+  if (left instanceof Date && right instanceof Date) {
+    return left.getTime() === right.getTime();
+  }
+  if (Array.isArray(left) && Array.isArray(right)) {
+    return left.length === right.length && left.every((value, index) => sameValue(value, right[index]));
+  }
+  return false;
+}
+function sameSubmittedPayload(granted, incoming) {
+  const answers = Object.entries(granted);
+  if (answers.length !== Object.keys(incoming).length) return false;
+  return answers.every(([field, answer]) => sameValue(answer, incoming[field]));
+}
+function prepareSubmission({
+  data,
+  fields,
+  validate
+}) {
+  const transformed = transformFormData(data, fields);
+  sanitizeSubmissionData(transformed, fields);
+  if (!validate) {
+    return { data: transformed };
+  }
+  const result = generateZodSchema(fields).safeParse(transformed);
+  if (!result.success) {
+    return { data: transformed, validationErrors: getValidationErrors(result) };
+  }
+  return { data: result.data };
+}
+
+// src/plugin.ts
+var { version: PLUGIN_VERSION } = createRequire(import.meta.url)(
+  "../package.json"
+);
+function resolveConfig(options) {
+  const formOverrides = options.formOverrides || {};
+  const submissionOverrides = options.formSubmissionOverrides || {};
+  return {
+    formOverrides: {
+      ...formOverrides,
+      slug: formOverrides.slug || "forms",
+      labels: {
+        singular: formOverrides.labels?.singular || "Form",
+        plural: formOverrides.labels?.plural || "Forms"
+      }
+    },
+    formSubmissionOverrides: {
+      ...submissionOverrides,
+      slug: submissionOverrides.slug || "form-submissions",
+      labels: {
+        singular: submissionOverrides.labels?.singular || "Submission",
+        plural: submissionOverrides.labels?.plural || "Submissions"
+      }
+    },
+    fields: {
+      text: options.fields?.text ?? true,
+      email: options.fields?.email ?? true,
+      number: options.fields?.number ?? true,
+      phone: options.fields?.phone ?? true,
+      url: options.fields?.url ?? true,
+      textarea: options.fields?.textarea ?? true,
+      select: options.fields?.select ?? true,
+      checkbox: options.fields?.checkbox ?? true,
+      radio: options.fields?.radio ?? true,
+      file: options.fields?.file ?? true,
+      date: options.fields?.date ?? true,
+      time: options.fields?.time ?? true,
+      hidden: options.fields?.hidden ?? true
+    },
+    redirectRelationships: normalizeRedirectRelationships(
+      options.redirectRelationships
+    ),
+    // Filled at `init` from each collection's own metadata. Empty until then,
+    // and a slug that stays absent reads as unknown rather than as not
+    // localized — see `ResolvedFormBuilderConfig`.
+    redirectTargetLocalization: {},
+    beforeEmail: options.beforeEmail,
+    notifications: {
+      defaultFrom: options.notifications?.defaultFrom,
+      defaultToEmail: options.notifications?.defaultToEmail,
+      enabled: options.notifications?.enabled ?? true
+    },
+    spamProtection: {
+      honeypot: options.spamProtection?.honeypot ?? true,
+      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
+      rateLimit: {
+        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
+        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
+      }
+    },
+    uploads: {
+      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
+      // 10 MB
+      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
+        "image/*",
+        "application/pdf",
+        "text/*"
+      ],
+      uploadCollection: options.uploads?.uploadCollection ?? "media"
+    },
+    features: {
+      builder: options.features?.builder ?? true,
+      conditionalLogic: options.features?.conditionalLogic ?? true,
+      fileUploads: options.features?.fileUploads ?? true
+    }
+  };
+}
+function formBuilder(options = {}) {
+  const resolvedConfig = resolveConfig(options);
+  const formsCol = formsCollection(resolvedConfig);
+  const submissionsCol = submissionsCollection(resolvedConfig);
+  const plugin = definePlugin({
+    name: "@nextlyhq/plugin-form-builder",
+    version: PLUGIN_VERSION,
+    nextly: ">=0.0.2-alpha.21",
+    // Identity metadata for the admin plugins page, mirroring package.json.
+    author: "Nextly",
+    homepage: "https://nextlyhq.com",
+    repository: "https://github.com/nextlyhq/nextly",
+    license: "MIT",
+    category: "forms",
+    tags: ["forms", "submissions", "email-notifications"],
+    // Declarative schema: the merged pipeline folds these into the
+    // app schema — no manual `setup()` append needed. Just register the plugin.
+    contributes: {
+      collections: [formsCol, submissionsCol],
+      // Custom permission — gates submission export beyond CRUD. The
+      // canonical example third-party plugin authors copy.
+      permissions: [
+        {
+          action: "export",
+          resource: "submissions",
+          label: "Export Submissions",
+          description: "Export form submissions as CSV/JSON",
+          // No `group`: the admin already files this under the plugin that
+          // declared it, so naming the plugin again would nest it inside
+          // itself. `group` is for a plugin with enough permissions to sort
+          // its own into headings, which one is not.
+          //
+          // `danger` because the point of the permission is to take
+          // submissions — names, emails, whatever a form asked for — out of
+          // the site in a file.
+          danger: true
+        }
+      ],
+      // HTTP route — exported at
+      // /api/plugins/@nextlyhq/plugin-form-builder/submissions/export. Secure by
+      // default: gated by the custom `export-submissions` permission. Reads
+      // via the secure-by-default service path as the authed user and
+      // resolves its OWN slug through `ctx.self`. The canonical
+      // contributes.routes example for third-party authors.
+      routes: [
+        {
+          method: "GET",
+          path: "/submissions/export",
+          requiredPermission: "export-submissions",
+          handler: async (req, ctx) => {
+            const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
+            const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
+            const url2 = new URL(req.url);
+            const format = url2.searchParams.get("format") ?? "json";
+            const formId = url2.searchParams.get("form");
+            const status = url2.searchParams.get("status");
+            const where = {};
+            if (formId) where.form = { equals: formId };
+            if (status) where.status = { equals: status };
+            else where.status = { not_equals: "spam" };
+            const opts = { as: "user", user: ctx.user ?? void 0 };
+            let form;
+            if (format === "csv") {
+              if (!formId) {
+                return Response.json(
+                  {
+                    error: {
+                      code: "VALIDATION_ERROR",
+                      message: "CSV export requires a form parameter."
+                    }
+                  },
+                  { status: 400 }
+                );
+              }
+              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
+              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
+              const formResult = await ctx.services.collections.listEntries(
+                formsSlug,
+                { where: { id: { equals: formId } } },
+                opts
+              );
+              form = formResult.data[0];
+              if (!form) {
+                return Response.json(
+                  { error: { code: "NOT_FOUND", message: "Form not found." } },
+                  { status: 404 }
+                );
+              }
+            }
+            const MAX_EXPORT_ROWS = 5e4;
+            const items = [];
+            const pageSize = 200;
+            let truncated = false;
+            for (let page = 1; ; page += 1) {
+              const result = await ctx.services.collections.listEntries(
+                slug,
+                { where, pagination: { limit: pageSize, page } },
+                opts
+              );
+              items.push(...result.data);
+              const pageWasFull = result.data.length === pageSize;
+              if (items.length >= MAX_EXPORT_ROWS) {
+                truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
+                items.length = MAX_EXPORT_ROWS;
+                break;
+              }
+              if (!pageWasFull) break;
+            }
+            const truncationHeaders = truncated ? { "X-Export-Truncated": "true" } : {};
+            if (format !== "csv" || !form) {
+              return Response.json({ items }, { headers: truncationHeaders });
+            }
+            const csv = exportToCSV(
+              asSubmissionDocuments(items),
+              asFormDocument(form)
+            );
+            const filename = generateExportFilename(
+              typeof form.slug === "string" ? form.slug : "form",
+              "csv"
+            );
+            return new Response(csv, {
+              headers: {
+                "Content-Type": "text/csv; charset=utf-8",
+                "Content-Disposition": `attachment; filename="${filename}"`,
+                ...truncationHeaders
+              }
+            });
+          }
+        },
+        {
+          // The builder UI reads the host's resolved field enable/disable map
+          // from here, so the plugin option actually gates the type picker.
+          // Options resolve server-side only; this is the one channel the
+          // admin client has to them.
+          method: "GET",
+          path: "/builder-config",
+          // Derived from the forms slug like the menu entry: with an
+          // overridden slug, users hold read-<slug>, not read-forms.
+          requiredPermission: `read-${resolvedConfig.formOverrides.slug}`,
+          handler: (_req, ctx) => Promise.resolve(
+            Response.json({
+              fields: resolvedConfig.fields,
+              // Notification defaults the builder surfaces: defaultToEmail
+              // seeds a new form's first rule, defaultFrom renders as the
+              // inherited sender placeholder.
+              notifications: {
+                defaultFrom: resolvedConfig.notifications.defaultFrom,
+                defaultToEmail: resolvedConfig.notifications.defaultToEmail
+              },
+              // Spam defaults the Settings tab surfaces, so per-form
+              // override selects can show what "inherit" resolves to.
+              spamProtection: {
+                honeypot: resolvedConfig.spamProtection.honeypot,
+                recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false
+              },
+              // Runtime-resolved collection slugs (through ctx.self, so a
+              // framework .rename() is honored too) — admin components
+              // never hardcode "forms"/"form-submissions".
               // Names only. A pattern may be a function, which does not
               // survive JSON and which the browser has no use for — the
               // admin picks a document, the server builds the URL.
@@ -1135,6 +1519,13 @@ function formBuilder(options = {}) {
           })
         );
       }
+      const declaredFormsSlug = resolvedConfig.formOverrides.slug;
+      const formsSlug = nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug;
+      nextly.hooks.on(
+        "beforeChange",
+        submissionSlug,
+        async (context) => prepareSubmissionForWrite(context, formsSlug, nextly)
+      );
       nextly.hooks.on(
         "afterCreate",
         submissionSlug,
@@ -1150,32 +1541,11 @@ function formBuilder(options = {}) {
         }
         return ctx.data;
       });
-      const declaredFormsSlug = resolvedConfig.formOverrides.slug;
-      const formsSlug = nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug;
-      nextly.hooks.on("afterRead", formsSlug, async (context) => {
-        const data = context.data;
-        const records = Array.isArray(data) ? data : data ? [data] : [];
-        await Promise.all(
-          records.map(async (record) => {
-            const form = record;
-            if (typeof form.id !== "string") return;
-            try {
-              form.submissionCount = await nextly.services.collections.count(
-                submissionSlug,
-                {
-                  where: {
-                    form: { equals: form.id },
-                    status: { not_equals: "spam" }
-                  }
-                },
-                { as: "system" }
-              );
-            } catch {
-              form.submissionCount = 0;
-            }
-          })
-        );
-      });
+      nextly.hooks.on(
+        "afterRead",
+        formsSlug,
+        (context) => injectSubmissionCount(context, submissionSlug, nextly)
+      );
     }
   });
   return {
@@ -1184,946 +1554,744 @@ function formBuilder(options = {}) {
     config: resolvedConfig
   };
 }
-function getFormBuilderConfig(nextly) {
-  if (!nextly || typeof nextly !== "object") return void 0;
-  return nextly.__formBuilderConfig;
-}
-function resolveFieldRef(ref, data) {
-  const name = parseFieldRef(ref);
-  if (name === null) return ref;
-  const value = data[name];
-  return typeof value === "string" ? value : "";
-}
-function collectAttachmentInputs(fields, submittedData) {
-  const attachments = [];
-  for (const field of fields) {
-    if (field.type !== "file" || !field.attachToEmail) continue;
-    const name = field.name;
-    const value = submittedData[name];
-    if (value == null) continue;
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        if (typeof item === "string" && item) {
-          attachments.push({ mediaId: item });
-        }
-      }
-    } else if (typeof value === "string" && value) {
-      attachments.push({ mediaId: value });
-    }
-  }
-  return attachments;
-}
-function parseJsonColumn(value) {
-  if (typeof value === "string") {
-    try {
-      const parsed = JSON.parse(value);
-      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-    } catch {
-      return {};
-    }
-  }
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function normalizeAddressList(addresses) {
-  if (!Array.isArray(addresses)) return void 0;
-  const cleaned = addresses.map((address) => typeof address === "string" ? address.trim() : "").filter(Boolean);
-  return cleaned.length > 0 ? cleaned : void 0;
-}
-function buildNotificationEmails(input) {
-  const { notifications, submittedData, formName, submissionId, defaultFrom } = input;
-  const seen = /* @__PURE__ */ new Set();
-  const emails = [];
-  const skipped = [];
-  for (const notification of notifications) {
-    if (!notification.enabled) continue;
-    if (!notification.templateSlug) {
-      skipped.push({ notificationId: notification.id, reason: "no-template" });
-      continue;
-    }
-    const key = notification.id || JSON.stringify(notification);
-    if (seen.has(key)) continue;
-    seen.add(key);
-    if (notification.condition && !evaluateSingleCondition(notification.condition, submittedData)) {
-      skipped.push({
-        notificationId: notification.id,
-        reason: "condition-unmet"
-      });
-      continue;
-    }
-    const to = (notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to).trim();
-    if (!to) {
-      skipped.push({
-        notificationId: notification.id,
-        reason: "empty-recipient"
-      });
-      continue;
-    }
-    const cc = normalizeAddressList(notification.cc);
-    const bcc = normalizeAddressList(notification.bcc);
-    const from = notification.senderEmail?.trim() || defaultFrom?.trim() || void 0;
-    const replyTo = notification.replyTo ? resolveFieldRef(notification.replyTo, submittedData).trim() || void 0 : void 0;
-    emails.push({
-      to,
-      templateSlug: notification.templateSlug,
-      variables: {
-        ...submittedData,
-        formName,
-        submissionId
-      },
-      providerId: notification.providerId,
-      from,
-      replyTo,
-      cc,
-      bcc,
-      notificationId: notification.id
-    });
-  }
-  return { emails, skipped };
-}
-async function handleSubmissionCreated(context, config, nextly) {
-  if (!config.notifications.enabled) return;
-  const submission = context.data;
-  if (!submission) return;
-  if (submission.status === "spam") return;
-  const rawFormId = submission.form;
-  let formId = null;
-  if (typeof rawFormId === "string") {
-    formId = rawFormId;
-  } else if (rawFormId && typeof rawFormId === "object") {
-    const maybeId = rawFormId.id;
-    if (typeof maybeId === "string") formId = maybeId;
-  }
-  if (!formId) return;
-  const form = await fetchParentForm(config, formId, nextly);
-  if (!form) return;
-  const notifications = Array.isArray(form.notifications) ? form.notifications : [];
-  if (notifications.length === 0) return;
-  const emailService = nextly.services.email;
-  if (!emailService) return;
-  const submittedData = parseJsonColumn(submission.data);
-  const formFields = Array.isArray(form.fields) ? form.fields : [];
-  const fileAttachments = collectAttachmentInputs(formFields, submittedData);
-  const { emails, skipped } = buildNotificationEmails({
-    notifications,
-    submittedData,
-    formName: form.name,
-    submissionId: submission.id,
-    defaultFrom: config.notifications.defaultFrom
-  });
-  for (const skip of skipped) {
-    if (skip.reason === "empty-recipient") {
-      nextly.logger.warn?.(
-        "Form Builder: empty recipient, skipping notification",
-        { notificationId: skip.notificationId, formSlug: form.slug }
-      );
-    } else {
-      nextly.logger.debug?.("Form Builder: notification skipped", {
-        notificationId: skip.notificationId,
-        formSlug: form.slug,
-        reason: skip.reason
-      });
-    }
-  }
-  if (emails.length === 0) return;
-  const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, { form, submission });
-  for (const email2 of finalEmails) {
-    try {
-      await emailService.sendWithTemplate(
-        email2.templateSlug,
-        email2.to,
-        email2.variables,
-        {
-          providerId: email2.providerId,
-          from: email2.from,
-          replyTo: email2.replyTo,
-          cc: email2.cc,
-          bcc: email2.bcc,
-          attachments: fileAttachments.length > 0 ? fileAttachments : void 0
-        }
-      );
-      nextly.logger.info?.("Form Builder: notification sent", {
-        formSlug: form.slug,
-        to: email2.to,
-        templateSlug: email2.templateSlug,
-        notificationId: email2.notificationId,
-        attachmentCount: fileAttachments.length
-      });
-    } catch (err) {
-      nextly.logger.error?.("Form Builder: notification failed", {
-        to: email2.to,
-        templateSlug: email2.templateSlug,
-        notificationId: email2.notificationId,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-}
-async function fetchParentForm(config, formId, nextly) {
-  try {
-    const form = await nextly.services.collections.findEntryById(
-      config.formOverrides.slug,
-      formId,
-      { as: "system" }
-    );
-    return form;
-  } catch (err) {
-    nextly.logger.error?.("Form Builder: failed to fetch form", {
-      formId,
-      error: err instanceof Error ? err.message : String(err)
-    });
-    return null;
-  }
-}
-
-// src/config/validate-form.ts
-import { isPluginFieldTypeOnSurface } from "nextly";
-var RESERVED_FORM_SLUGS = [
-  // API routes
-  "api",
-  "submit",
-  "submissions",
-  "export",
-  // System slugs
-  "admin",
-  "new",
-  "create",
-  "edit",
-  "delete"
-];
-var RESERVED_SLUGS_SET = new Set(RESERVED_FORM_SLUGS);
-var SLUG_PATTERN = /^[a-z][a-z0-9_-]*$/;
-var FIELD_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
-var VALID_FIELD_TYPES = BUILT_IN_FORM_FIELD_TYPES;
-var VALID_FIELD_TYPES_SET = new Set(VALID_FIELD_TYPES);
-function isReservedSlug(slug) {
-  return RESERVED_SLUGS_SET.has(slug.toLowerCase());
+function getFormBuilderConfig(nextly) {
+  if (!nextly || typeof nextly !== "object") return void 0;
+  return nextly.__formBuilderConfig;
 }
-function validateSlug(slug, errors) {
-  const path = "slug";
-  if (!slug) {
-    errors.push({
-      path,
-      message: "Form slug is required",
-      code: "SLUG_REQUIRED"
-    });
-    return;
-  }
-  if (typeof slug !== "string") {
-    errors.push({
-      path,
-      message: "Form slug must be a string",
-      code: "SLUG_INVALID_TYPE"
-    });
-    return;
-  }
-  if (slug.length < 1) {
-    errors.push({
-      path,
-      message: "Form slug must be at least 1 character",
-      code: "SLUG_TOO_SHORT"
-    });
-  }
-  if (slug.length > 50) {
-    errors.push({
-      path,
-      message: "Form slug must be at most 50 characters",
-      code: "SLUG_TOO_LONG"
-    });
-  }
-  if (!SLUG_PATTERN.test(slug)) {
-    errors.push({
-      path,
-      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
-      code: "SLUG_INVALID_FORMAT"
-    });
-  }
-  if (isReservedSlug(slug)) {
-    errors.push({
-      path,
-      message: `Form slug '${slug}' is reserved and cannot be used`,
-      code: "SLUG_RESERVED"
-    });
-  }
+function resolveFieldRef(ref, data) {
+  const name = parseFieldRef(ref);
+  if (name === null) return ref;
+  const value = data[name];
+  return typeof value === "string" ? value : "";
 }
-function validateFieldName(name, path, errors, seenNames) {
-  if (!name) {
-    errors.push({
-      path: `${path}.name`,
-      message: "Field name is required",
-      code: "FIELD_NAME_REQUIRED"
-    });
-    return;
-  }
-  if (typeof name !== "string") {
-    errors.push({
-      path: `${path}.name`,
-      message: "Field name must be a string",
-      code: "FIELD_NAME_REQUIRED"
-    });
-    return;
-  }
-  if (!FIELD_NAME_PATTERN.test(name)) {
-    errors.push({
-      path: `${path}.name`,
-      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
-      code: "FIELD_NAME_INVALID_FORMAT"
-    });
-  }
-  const nameLower = name.toLowerCase();
-  if (seenNames.has(nameLower)) {
-    errors.push({
-      path: `${path}.name`,
-      message: `Duplicate field name '${name}'`,
-      code: "FIELD_NAME_DUPLICATE"
-    });
-  } else {
-    seenNames.add(nameLower);
+function collectAttachmentInputs(fields, submittedData) {
+  const attachments = [];
+  for (const field of fields) {
+    if (field.type !== "file" || !field.attachToEmail) continue;
+    const name = field.name;
+    const value = submittedData[name];
+    if (value == null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (typeof item === "string" && item) {
+          attachments.push({ mediaId: item });
+        }
+      }
+    } else if (typeof value === "string" && value) {
+      attachments.push({ mediaId: value });
+    }
   }
+  return attachments;
 }
-function validateFieldLabel(label, path, errors) {
-  if (!label || typeof label === "string" && label.trim() === "") {
-    errors.push({
-      path: `${path}.label`,
-      message: "Field label is required",
-      code: "FIELD_LABEL_REQUIRED"
-    });
+function parseJsonColumn(value) {
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
   }
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function validateOptions(field, path, errors) {
-  const fieldWithOptions = field;
-  const options = fieldWithOptions.options;
-  if (!options) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field must have an 'options' array`,
-      code: "OPTIONS_REQUIRED"
-    });
-    return;
-  }
-  if (!Array.isArray(options)) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field 'options' must be an array`,
-      code: "OPTIONS_REQUIRED"
-    });
-    return;
-  }
-  if (options.length === 0) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field must have at least one option`,
-      code: "OPTIONS_EMPTY"
-    });
-  }
+function normalizeAddressList(addresses) {
+  if (!Array.isArray(addresses)) return void 0;
+  const cleaned = addresses.map((address) => typeof address === "string" ? address.trim() : "").filter(Boolean);
+  return cleaned.length > 0 ? cleaned : void 0;
 }
-function validateConditionalLogic(field, path, errors) {
-  const { conditionalLogic } = field;
-  if (!conditionalLogic || !conditionalLogic.enabled) {
-    return;
-  }
-  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
-    errors.push({
-      path: `${path}.conditionalLogic.conditions`,
-      message: "Conditional logic must have at least one condition",
-      code: "CONDITIONS_REQUIRED"
-    });
-    return;
-  }
-  conditionalLogic.conditions.forEach((condition, index) => {
-    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
-    if (!condition.field) {
-      errors.push({
-        path: `${conditionPath}.field`,
-        message: "Condition must specify a field name",
-        code: "CONDITION_FIELD_REQUIRED"
-      });
+function buildNotificationEmails(input) {
+  const { notifications, submittedData, formName, submissionId, defaultFrom } = input;
+  const seen = /* @__PURE__ */ new Set();
+  const emails = [];
+  const skipped = [];
+  for (const notification of notifications) {
+    if (!notification.enabled) continue;
+    if (!notification.templateSlug) {
+      skipped.push({ notificationId: notification.id, reason: "no-template" });
+      continue;
     }
-    if (!condition.comparison) {
-      errors.push({
-        path: `${conditionPath}.comparison`,
-        message: "Condition must specify a comparison operator",
-        code: "CONDITION_COMPARISON_REQUIRED"
+    const key = notification.id || JSON.stringify(notification);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (notification.condition && !evaluateSingleCondition(notification.condition, submittedData)) {
+      skipped.push({
+        notificationId: notification.id,
+        reason: "condition-unmet"
       });
+      continue;
     }
-  });
-}
-function validateFieldByType(field, path, errors) {
-  switch (field.type) {
-    case "select":
-    case "radio":
-      validateOptions(field, path, errors);
-      break;
-    case "number": {
-      const numberField = field;
-      if (numberField.validation) {
-        const { min, max } = numberField.validation;
-        if (min !== void 0 && max !== void 0 && min > max) {
-          errors.push({
-            path: `${path}.validation`,
-            message: "Min value cannot be greater than max value",
-            code: "MIN_GREATER_THAN_MAX"
-          });
-        }
-      }
-      break;
-    }
-    case "text":
-    case "textarea": {
-      const textField = field;
-      if (textField.validation) {
-        const { minLength, maxLength } = textField.validation;
-        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
-          errors.push({
-            path: `${path}.validation`,
-            message: "Min length cannot be greater than max length",
-            code: "MIN_LENGTH_GREATER_THAN_MAX"
-          });
-        }
-      }
-      break;
+    const to = (notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to).trim();
+    if (!to) {
+      skipped.push({
+        notificationId: notification.id,
+        reason: "empty-recipient"
+      });
+      continue;
     }
-    case "file": {
-      const fileField = field;
-      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
-        errors.push({
-          path: `${path}.maxFileSize`,
-          message: "File maxFileSize must be a positive number",
-          code: "FILE_MAX_SIZE_INVALID"
-        });
+    const cc = normalizeAddressList(notification.cc);
+    const bcc = normalizeAddressList(notification.bcc);
+    const from = notification.senderEmail?.trim() || defaultFrom?.trim() || void 0;
+    const replyTo = notification.replyTo ? resolveFieldRef(notification.replyTo, submittedData).trim() || void 0 : void 0;
+    emails.push({
+      to,
+      templateSlug: notification.templateSlug,
+      variables: {
+        ...submittedData,
+        formName,
+        submissionId
+      },
+      providerId: notification.providerId,
+      from,
+      replyTo,
+      cc,
+      bcc,
+      notificationId: notification.id
+    });
+  }
+  return { emails, skipped };
+}
+function parentFormId(submission) {
+  const raw = submission.form;
+  if (typeof raw === "string") return raw;
+  if (raw && typeof raw === "object") {
+    const maybeId = raw.id;
+    if (typeof maybeId === "string") return maybeId;
+  }
+  return null;
+}
+function submittedPayload(raw) {
+  if (typeof raw === "string") {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
       }
-      break;
+    } catch {
     }
+  } else if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+    return raw;
   }
+  throw NextlyError2.validation({
+    errors: [
+      {
+        path: "data",
+        code: "INVALID",
+        message: "Submission data must be an object."
+      }
+    ]
+  });
 }
-function validateField(field, path, errors, seenNames) {
-  if (!field || typeof field !== "object") {
-    return;
+function updateNeedsChecking(submission, stored) {
+  if (submission.data !== void 0) return true;
+  if (stored?.data === void 0) return false;
+  if (submission.form !== void 0) return true;
+  return stored.status === "spam" && submission.status !== void 0 && submission.status !== "spam";
+}
+async function prepareSubmissionForWrite(context, formsSlug, nextly) {
+  const ctx = context;
+  const submission = ctx.data;
+  if (!submission || typeof submission !== "object") return ctx.data;
+  const stored = ctx.originalData;
+  const formId = parentFormId(submission) ?? (stored ? parentFormId(stored) : null);
+  if (!formId) return ctx.data;
+  if (ctx.operation !== "create" && !updateNeedsChecking(submission, stored)) {
+    return ctx.data;
+  }
+  const incoming = submittedPayload(
+    submission.data !== void 0 ? submission.data : stored?.data
+  );
+  const marks = submissionMarks(submission);
+  const fields = await fieldsToCheckAgainst(marks, formsSlug, formId, nextly);
+  const prepared = prepareSubmission({
+    data: incoming,
+    fields,
+    validate: marks?.keepAsEvidence !== true
+  });
+  if (prepared.validationErrors) {
+    throw NextlyError2.validation({
+      errors: Object.entries(prepared.validationErrors).map(
+        ([path, message]) => ({ path, code: "INVALID", message })
+      )
+    });
   }
-  const f = field;
-  const fieldType = f.type;
-  if (!fieldType) {
-    errors.push({
-      path: `${path}.type`,
-      message: "Field type is required",
-      code: "FIELD_TYPE_REQUIRED"
+  ctx.data = { ...submission, data: prepared.data };
+  if (ctx.operation !== "create" && submission.data === void 0) {
+    stampDerivedEdit(ctx.data, ctx.user, incoming, prepared.data);
+  }
+  return ctx.data;
+}
+async function fieldsToCheckAgainst(marks, formsSlug, formId, nextly) {
+  const handedOver = marks?.form?.id === formId ? marks.form : null;
+  const form = handedOver ?? await fetchParentForm(formsSlug, formId, nextly);
+  if (!form || !Array.isArray(form.fields)) {
+    throw NextlyError2.validation({
+      errors: [
+        {
+          path: "form",
+          code: "INVALID",
+          message: "The form this submission belongs to could not be read, so the submission could not be checked against it."
+        }
+      ]
     });
-    return;
   }
-  const isValidType = typeof fieldType === "string" && (VALID_FIELD_TYPES_SET.has(fieldType) || isPluginFieldTypeOnSurface(fieldType, "forms"));
-  if (!isValidType) {
-    let fieldTypeRepr;
-    if (typeof fieldType === "object" && fieldType !== null) {
-      fieldTypeRepr = JSON.stringify(fieldType);
+  return form.fields;
+}
+function stampDerivedEdit(row, user, before, after) {
+  if (sameSubmittedPayload(before, after)) return;
+  row.editedAt = /* @__PURE__ */ new Date();
+  row.editedBy = user?.id ?? null;
+}
+async function handleSubmissionCreated(context, config, nextly) {
+  if (!config.notifications.enabled) return;
+  const submission = context.data;
+  if (!submission) return;
+  if (submission.status === "spam") return;
+  const formId = parentFormId(submission);
+  if (!formId) return;
+  const declaredFormsSlug = config.formOverrides.slug;
+  const form = await fetchParentForm(
+    nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug,
+    formId,
+    nextly
+  );
+  if (!form) return;
+  const notifications = Array.isArray(form.notifications) ? form.notifications : [];
+  if (notifications.length === 0) return;
+  const emailService = nextly.services.email;
+  if (!emailService) return;
+  const submittedData = parseJsonColumn(submission.data);
+  const formFields = Array.isArray(form.fields) ? form.fields : [];
+  const fileAttachments = collectAttachmentInputs(formFields, submittedData);
+  const { emails, skipped } = buildNotificationEmails({
+    notifications,
+    submittedData,
+    formName: form.name,
+    submissionId: submission.id,
+    defaultFrom: config.notifications.defaultFrom
+  });
+  for (const skip of skipped) {
+    if (skip.reason === "empty-recipient") {
+      nextly.logger.warn?.(
+        "Form Builder: empty recipient, skipping notification",
+        { notificationId: skip.notificationId, formSlug: form.slug }
+      );
     } else {
-      fieldTypeRepr = String(fieldType);
+      nextly.logger.debug?.("Form Builder: notification skipped", {
+        notificationId: skip.notificationId,
+        formSlug: form.slug,
+        reason: skip.reason
+      });
     }
-    errors.push({
-      path: `${path}.type`,
-      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
-      code: "FIELD_TYPE_INVALID"
-    });
-    return;
-  }
-  validateFieldName(f.name, path, errors, seenNames);
-  if (fieldType !== "hidden") {
-    validateFieldLabel(f.label, path, errors);
   }
-  validateFieldByType(field, path, errors);
-  if (f.conditionalLogic) {
-    validateConditionalLogic(field, path, errors);
+  if (emails.length === 0) return;
+  const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, { form, submission });
+  for (const email2 of finalEmails) {
+    try {
+      await emailService.sendWithTemplate(
+        email2.templateSlug,
+        email2.to,
+        email2.variables,
+        {
+          providerId: email2.providerId,
+          from: email2.from,
+          replyTo: email2.replyTo,
+          cc: email2.cc,
+          bcc: email2.bcc,
+          attachments: fileAttachments.length > 0 ? fileAttachments : void 0
+        }
+      );
+      nextly.logger.info?.("Form Builder: notification sent", {
+        formSlug: form.slug,
+        to: email2.to,
+        templateSlug: email2.templateSlug,
+        notificationId: email2.notificationId,
+        attachmentCount: fileAttachments.length
+      });
+    } catch (err) {
+      nextly.logger.error?.("Form Builder: notification failed", {
+        to: email2.to,
+        templateSlug: email2.templateSlug,
+        notificationId: email2.notificationId,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
   }
 }
-function validateFieldsArray(fields, basePath, errors) {
-  const seenNames = /* @__PURE__ */ new Set();
-  fields.forEach((field, index) => {
-    const fieldPath = `${basePath}[${index}]`;
-    validateField(field, fieldPath, errors, seenNames);
-  });
+async function injectSubmissionCount(context, submissionSlug, nextly) {
+  const hook = context;
+  if (hook.context?.[SCHEMA_ONLY_READ] === true) return;
+  const records = Array.isArray(hook.data) ? hook.data : hook.data ? [hook.data] : [];
+  await Promise.all(
+    records.map(async (record) => {
+      const form = record;
+      if (typeof form.id !== "string") return;
+      try {
+        form.submissionCount = await nextly.services.collections.count(
+          submissionSlug,
+          {
+            where: {
+              form: { equals: form.id },
+              status: { not_equals: "spam" }
+            }
+          },
+          { as: "system" }
+        );
+      } catch {
+        form.submissionCount = 0;
+      }
+    })
+  );
 }
-function validateFields(fields, errors) {
-  const path = "fields";
-  if (!fields) {
-    errors.push({
-      path,
-      message: "Form must have at least one field",
-      code: "FIELDS_REQUIRED"
+var SCHEMA_ONLY_READ = "formBuilder.schemaOnlyRead";
+async function fetchParentForm(formsSlug, formId, nextly) {
+  try {
+    const form = await nextly.services.collections.findEntryById(
+      formsSlug,
+      formId,
+      { as: "system", context: { [SCHEMA_ONLY_READ]: true } }
+    );
+    return form;
+  } catch (err) {
+    if (!NextlyError2.isNotFound(err)) throw err;
+    nextly.logger.error?.("Form Builder: form not found", {
+      formId,
+      error: err instanceof Error ? err.message : String(err)
     });
-    return;
+    return null;
   }
-  if (!Array.isArray(fields)) {
+}
+
+// src/config/validate-form.ts
+import { isPluginFieldTypeOnSurface } from "nextly";
+var RESERVED_FORM_SLUGS = [
+  // API routes
+  "api",
+  "submit",
+  "submissions",
+  "export",
+  // System slugs
+  "admin",
+  "new",
+  "create",
+  "edit",
+  "delete"
+];
+var RESERVED_SLUGS_SET = new Set(RESERVED_FORM_SLUGS);
+var SLUG_PATTERN = /^[a-z][a-z0-9_-]*$/;
+var FIELD_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+var VALID_FIELD_TYPES = BUILT_IN_FORM_FIELD_TYPES;
+var VALID_FIELD_TYPES_SET = new Set(VALID_FIELD_TYPES);
+function isReservedSlug(slug) {
+  return RESERVED_SLUGS_SET.has(slug.toLowerCase());
+}
+function validateSlug(slug, errors) {
+  const path = "slug";
+  if (!slug) {
     errors.push({
       path,
-      message: "Form fields must be an array",
-      code: "FIELDS_INVALID_TYPE"
+      message: "Form slug is required",
+      code: "SLUG_REQUIRED"
     });
     return;
   }
-  if (fields.length === 0) {
+  if (typeof slug !== "string") {
     errors.push({
       path,
-      message: "Form must have at least one field",
-      code: "FIELDS_EMPTY"
-    });
-    return;
-  }
-  validateFieldsArray(fields, path, errors);
-}
-function validateSettings(settings, errors) {
-  if (!settings) {
-    return;
-  }
-  if (typeof settings !== "object" || Array.isArray(settings)) {
-    errors.push({
-      path: "settings",
-      message: "Form settings must be an object",
-      code: "SETTINGS_INVALID_TYPE"
-    });
-    return;
-  }
-  const s = settings;
-  if (s.confirmationType === "redirect") {
-    if (!s.redirectUrl && !s.redirectRelation) {
-      errors.push({
-        path: "settings.redirectUrl",
-        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
-        code: "REDIRECT_URL_REQUIRED"
-      });
-    }
-  }
-  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
-    errors.push({
-      path: "settings.redirectPage",
-      message: "A page is required when confirmation type is 'relationship'",
-      code: "REDIRECT_PAGE_REQUIRED"
-    });
-  }
-}
-function namesADocument(value) {
-  if (typeof value === "string") return value.length > 0;
-  return parseRedirectReference(value, []) !== null;
-}
-function validateAccess(access, errors) {
-  if (!access) {
+      message: "Form slug must be a string",
+      code: "SLUG_INVALID_TYPE"
+    });
     return;
   }
-  if (typeof access !== "object" || Array.isArray(access)) {
+  if (slug.length < 1) {
     errors.push({
-      path: "access",
-      message: "Access control must be an object",
-      code: "ACCESS_INVALID_TYPE"
+      path,
+      message: "Form slug must be at least 1 character",
+      code: "SLUG_TOO_SHORT"
     });
-    return;
   }
-  const accessObj = access;
-  const validAccessKeys = ["submit", "read"];
-  for (const key of validAccessKeys) {
-    const fn = accessObj[key];
-    if (fn !== void 0 && typeof fn !== "function") {
-      errors.push({
-        path: `access.${key}`,
-        message: `Access control '${key}' must be a function`,
-        code: "ACCESS_FUNCTION_INVALID"
-      });
-    }
+  if (slug.length > 50) {
+    errors.push({
+      path,
+      message: "Form slug must be at most 50 characters",
+      code: "SLUG_TOO_LONG"
+    });
   }
-}
-function validateFormConfig(config) {
-  const errors = [];
-  validateSlug(config.slug, errors);
-  validateFields(config.fields, errors);
-  validateSettings(config.settings, errors);
-  validateAccess(config.access, errors);
-  return {
-    valid: errors.length === 0,
-    errors
-  };
-}
-function assertValidFormConfig(config) {
-  const result = validateFormConfig(config);
-  if (!result.valid) {
-    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
-    throw new Error(
-      `Invalid form config for '${config.slug || "unknown"}':
-${errorMessages}`
-    );
+  if (!SLUG_PATTERN.test(slug)) {
+    errors.push({
+      path,
+      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
+      code: "SLUG_INVALID_FORMAT"
+    });
   }
-}
-
-// src/config/field-helpers.ts
-var option = (label, value) => ({
-  label,
-  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
-});
-var text3 = (config) => ({
-  ...config,
-  type: "text"
-});
-var email = (config) => ({
-  ...config,
-  type: "email"
-});
-var phone = (config) => ({
-  ...config,
-  type: "phone"
-});
-var url = (config) => ({
-  ...config,
-  type: "url"
-});
-var textarea3 = (config) => ({
-  ...config,
-  type: "textarea"
-});
-var number = (config) => ({
-  ...config,
-  type: "number"
-});
-var select3 = (config) => ({
-  ...config,
-  type: "select"
-});
-var checkbox2 = (config) => ({
-  ...config,
-  type: "checkbox"
-});
-var radio = (config) => ({
-  ...config,
-  type: "radio"
-});
-var file = (config) => ({
-  ...config,
-  type: "file"
-});
-var date3 = (config) => ({
-  ...config,
-  type: "date"
-});
-var time = (config) => ({
-  ...config,
-  type: "time"
-});
-var hidden = (config) => ({
-  ...config,
-  type: "hidden"
-});
-
-// src/utils/generate-schema.ts
-import { z } from "zod";
-function generateZodSchema(fields) {
-  const schemaShape = {};
-  for (const field of fields) {
-    if (!isKnownFormField(field)) {
-      schemaShape[field.name] = field.required ? z.unknown().refine(
-        (value) => value !== void 0 && value !== null && value !== "",
-        { message: `${field.label || field.name} is required` }
-      ) : z.unknown();
-      continue;
-    }
-    if (field.type === "hidden" && !field.required) {
-      schemaShape[field.name] = z.string().optional();
-      continue;
-    }
-    const fieldSchema = generateFieldSchema(field);
-    if (fieldSchema) {
-      schemaShape[field.name] = fieldSchema;
-    }
+  if (isReservedSlug(slug)) {
+    errors.push({
+      path,
+      message: `Form slug '${slug}' is reserved and cannot be used`,
+      code: "SLUG_RESERVED"
+    });
   }
-  return z.object(schemaShape);
 }
-function generateFieldSchema(field) {
-  switch (field.type) {
-    case "text":
-      return generateTextSchema(field);
-    case "email":
-      return generateEmailSchema(field);
-    case "number":
-      return generateNumberSchema(field);
-    case "phone":
-      return generatePhoneSchema(field);
-    case "url":
-      return generateUrlSchema(field);
-    case "textarea":
-      return generateTextareaSchema(field);
-    case "select":
-      return generateSelectSchema(field);
-    case "checkbox":
-      return generateCheckboxSchema(field);
-    case "radio":
-      return generateRadioSchema(field);
-    case "file":
-      return generateFileSchema(field);
-    case "date":
-      return generateDateSchema(field);
-    case "time":
-      return generateTimeSchema(field);
-    case "hidden":
-      return generateHiddenSchema(field);
-    default:
-      return z.unknown();
+function validateFieldName(name, path, errors, seenNames) {
+  if (!name) {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name is required",
+      code: "FIELD_NAME_REQUIRED"
+    });
+    return;
   }
-}
-function customMessage(field) {
-  const enforced = ENFORCED_VALIDATION_RULES[field.type] ?? [];
-  if (!enforced.includes("message")) return void 0;
-  return field.validation?.errorMessage;
-}
-function enforcedValidation(field) {
-  const stored = field.validation ?? {};
-  return { ...stored, errorMessage: customMessage(field) };
-}
-var STRING_RULE_APPLIERS = {
-  minLength: (schema, validation) => validation.minLength === void 0 ? schema : schema.min(
-    validation.minLength,
-    validation.errorMessage || `Minimum ${validation.minLength} characters required`
-  ),
-  maxLength: (schema, validation) => validation.maxLength === void 0 ? schema : schema.max(
-    validation.maxLength,
-    validation.errorMessage || `Maximum ${validation.maxLength} characters allowed`
-  ),
-  pattern: (schema, validation, fallback) => validation.pattern ? schema.regex(
-    new RegExp(validation.pattern),
-    validation.errorMessage || fallback
-  ) : schema
-};
-var NUMBER_RULE_APPLIERS = {
-  min: (schema, validation) => validation.min === void 0 ? schema : schema.min(
-    validation.min,
-    validation.errorMessage || `Minimum value is ${validation.min}`
-  ),
-  max: (schema, validation) => validation.max === void 0 ? schema : schema.max(
-    validation.max,
-    validation.errorMessage || `Maximum value is ${validation.max}`
-  )
-};
-function overridesPattern(field) {
-  const enforced = ENFORCED_VALIDATION_RULES[field.type] ?? [];
-  if (!enforced.includes("pattern")) return false;
-  const validation = field.validation ?? {};
-  return Boolean(validation.pattern);
-}
-function applyStringRules(schema, field, patternMessage) {
-  const validation = enforcedValidation(field);
-  let constrained = schema;
-  for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
-    const apply = STRING_RULE_APPLIERS[rule];
-    if (apply) constrained = apply(constrained, validation, patternMessage);
+  if (typeof name !== "string") {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name must be a string",
+      code: "FIELD_NAME_REQUIRED"
+    });
+    return;
   }
-  return constrained;
-}
-function generateTextSchema(field) {
-  const schema = applyStringRules(z.string(), field, "Invalid format");
-  return applyRequired(schema, field.required, customMessage(field));
-}
-function generateEmailSchema(field) {
-  const schema = applyStringRules(
-    z.string().email(customMessage(field) || "Invalid email address"),
-    field,
-    "Invalid email format"
-  );
-  return applyRequired(schema, field.required, customMessage(field));
-}
-function generateNumberSchema(field) {
-  let schema = z.number({
-    error: (issue) => issue.input === void 0 ? customMessage(field) || "This field is required" : "Must be a number"
-  });
-  const validation = enforcedValidation(field);
-  for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
-    const apply = NUMBER_RULE_APPLIERS[rule];
-    if (apply) schema = apply(schema, validation);
+  if (!FIELD_NAME_PATTERN.test(name)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
+      code: "FIELD_NAME_INVALID_FORMAT"
+    });
   }
-  if (field.required) {
-    return schema;
+  const nameLower = name.toLowerCase();
+  if (seenNames.has(nameLower)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Duplicate field name '${name}'`,
+      code: "FIELD_NAME_DUPLICATE"
+    });
+  } else {
+    seenNames.add(nameLower);
   }
-  return schema.optional().nullable();
-}
-function generatePhoneSchema(field) {
-  const base = overridesPattern(field) ? z.string() : z.string().regex(
-    /^[\d\s\-+()]+$/,
-    customMessage(field) || "Invalid phone number"
-  );
-  const schema = applyStringRules(base, field, "Invalid phone number format");
-  return applyRequired(schema, field.required, customMessage(field));
-}
-function generateUrlSchema(field) {
-  const schema = applyStringRules(
-    z.string().url(customMessage(field) || "Invalid URL"),
-    field,
-    "Invalid URL format"
-  );
-  return applyRequired(schema, field.required, customMessage(field));
 }
-function generateTextareaSchema(field) {
-  const schema = applyStringRules(z.string(), field, "Invalid format");
-  return applyRequired(schema, field.required, customMessage(field));
+function validateFieldLabel(label, path, errors) {
+  if (!label || typeof label === "string" && label.trim() === "") {
+    errors.push({
+      path: `${path}.label`,
+      message: "Field label is required",
+      code: "FIELD_LABEL_REQUIRED"
+    });
+  }
 }
-function generateSelectSchema(field) {
-  const validValues = field.options.map((opt) => opt.value);
-  if (field.allowMultiple) {
-    const schema2 = z.array(z.enum(validValues));
-    if (field.required) {
-      return schema2.min(
-        1,
-        customMessage(field) || "Please select at least one option"
-      );
-    }
-    return schema2.optional();
+function validateOptions(field, path, errors) {
+  const fieldWithOptions = field;
+  const options = fieldWithOptions.options;
+  if (!options) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have an 'options' array`,
+      code: "OPTIONS_REQUIRED"
+    });
+    return;
   }
-  const schema = z.enum(validValues, {
-    error: () => customMessage(field) || "Please select a valid option"
-  });
-  if (field.required) {
-    return schema;
+  if (!Array.isArray(options)) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field 'options' must be an array`,
+      code: "OPTIONS_REQUIRED"
+    });
+    return;
   }
-  return schema.optional();
-}
-function generateCheckboxSchema(field) {
-  const schema = z.boolean();
-  if (field.required) {
-    return schema.refine((val) => val === true, {
-      message: customMessage(field) || "This field is required"
+  if (options.length === 0) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have at least one option`,
+      code: "OPTIONS_EMPTY"
     });
   }
-  return schema.optional();
 }
-function generateRadioSchema(field) {
-  const validValues = field.options.map((opt) => opt.value);
-  const schema = z.enum(validValues, {
-    error: () => customMessage(field) || "Please select an option"
+function validateConditionalLogic(field, path, errors) {
+  const { conditionalLogic } = field;
+  if (!conditionalLogic || !conditionalLogic.enabled) {
+    return;
+  }
+  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
+    errors.push({
+      path: `${path}.conditionalLogic.conditions`,
+      message: "Conditional logic must have at least one condition",
+      code: "CONDITIONS_REQUIRED"
+    });
+    return;
+  }
+  conditionalLogic.conditions.forEach((condition, index) => {
+    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
+    if (!condition.field) {
+      errors.push({
+        path: `${conditionPath}.field`,
+        message: "Condition must specify a field name",
+        code: "CONDITION_FIELD_REQUIRED"
+      });
+    }
+    if (!condition.comparison) {
+      errors.push({
+        path: `${conditionPath}.comparison`,
+        message: "Condition must specify a comparison operator",
+        code: "CONDITION_COMPARISON_REQUIRED"
+      });
+    }
   });
-  if (field.required) {
-    return schema;
+}
+function validateFieldByType(field, path, errors) {
+  switch (field.type) {
+    case "select":
+    case "radio":
+      validateOptions(field, path, errors);
+      break;
+    case "number": {
+      const numberField = field;
+      if (numberField.validation) {
+        const { min, max } = numberField.validation;
+        if (min !== void 0 && max !== void 0 && min > max) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min value cannot be greater than max value",
+            code: "MIN_GREATER_THAN_MAX"
+          });
+        }
+      }
+      break;
+    }
+    case "text":
+    case "textarea": {
+      const textField = field;
+      if (textField.validation) {
+        const { minLength, maxLength } = textField.validation;
+        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min length cannot be greater than max length",
+            code: "MIN_LENGTH_GREATER_THAN_MAX"
+          });
+        }
+      }
+      break;
+    }
+    case "file": {
+      const fileField = field;
+      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
+        errors.push({
+          path: `${path}.maxFileSize`,
+          message: "File maxFileSize must be a positive number",
+          code: "FILE_MAX_SIZE_INVALID"
+        });
+      }
+      break;
+    }
   }
-  return schema.optional();
 }
-function generateFileSchema(field) {
-  if (field.multiple) {
-    const schema2 = z.array(z.string());
-    if (field.required) {
-      return schema2.min(
-        1,
-        customMessage(field) || "Please upload at least one file"
-      );
+function validateField(field, path, errors, seenNames) {
+  if (!field || typeof field !== "object") {
+    return;
+  }
+  const f = field;
+  const fieldType = f.type;
+  if (!fieldType) {
+    errors.push({
+      path: `${path}.type`,
+      message: "Field type is required",
+      code: "FIELD_TYPE_REQUIRED"
+    });
+    return;
+  }
+  const isValidType = typeof fieldType === "string" && (VALID_FIELD_TYPES_SET.has(fieldType) || isPluginFieldTypeOnSurface(fieldType, "forms"));
+  if (!isValidType) {
+    let fieldTypeRepr;
+    if (typeof fieldType === "object" && fieldType !== null) {
+      fieldTypeRepr = JSON.stringify(fieldType);
+    } else {
+      fieldTypeRepr = String(fieldType);
     }
-    return schema2.optional();
+    errors.push({
+      path: `${path}.type`,
+      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
+      code: "FIELD_TYPE_INVALID"
+    });
+    return;
+  }
+  validateFieldName(f.name, path, errors, seenNames);
+  if (fieldType !== "hidden") {
+    validateFieldLabel(f.label, path, errors);
+  }
+  validateFieldByType(field, path, errors);
+  if (f.conditionalLogic) {
+    validateConditionalLogic(field, path, errors);
   }
-  const schema = z.string();
-  return applyRequired(schema, field.required, customMessage(field));
 }
-function generateDateSchema(field) {
-  let schema = z.string();
-  schema = schema.refine(
-    (val) => {
-      if (!val) return true;
-      const date4 = new Date(val);
-      return !isNaN(date4.getTime());
-    },
-    { message: customMessage(field) || "Invalid date" }
-  );
-  if (field.min || field.max) {
-    schema = schema.refine(
-      (val) => {
-        if (!val) return true;
-        const date4 = new Date(val);
-        if (field.min && date4 < new Date(field.min)) return false;
-        if (field.max && date4 > new Date(field.max)) return false;
-        return true;
-      },
-      {
-        message: customMessage(field) || `Date must be between ${field.min || "any"} and ${field.max || "any"}`
-      }
-    );
+function validateFieldsArray(fields, basePath, errors) {
+  const seenNames = /* @__PURE__ */ new Set();
+  fields.forEach((field, index) => {
+    const fieldPath = `${basePath}[${index}]`;
+    validateField(field, fieldPath, errors, seenNames);
+  });
+}
+function validateFields(fields, errors) {
+  const path = "fields";
+  if (!fields) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_REQUIRED"
+    });
+    return;
   }
-  if (field.required) {
-    return schema.refine(
-      (val) => val !== void 0 && val !== null && val !== "",
-      { message: customMessage(field) || "This field is required" }
-    );
+  if (!Array.isArray(fields)) {
+    errors.push({
+      path,
+      message: "Form fields must be an array",
+      code: "FIELDS_INVALID_TYPE"
+    });
+    return;
   }
-  return schema.optional().or(z.literal(""));
-}
-function generateTimeSchema(field) {
-  const schema = z.string().regex(
-    /^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/,
-    customMessage(field) || "Invalid time format (HH:mm)"
-  );
-  return applyRequired(schema, field.required, customMessage(field));
-}
-function generateHiddenSchema(field) {
-  const schema = z.string();
-  return applyRequired(schema, field.required, customMessage(field));
-}
-function applyRequired(schema, required, errorMessage) {
-  if (required) {
-    return schema.min(1, errorMessage || "This field is required");
+  if (fields.length === 0) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_EMPTY"
+    });
+    return;
   }
-  return schema.optional().or(z.literal(""));
+  validateFieldsArray(fields, path, errors);
 }
-function transformFormData(data, fields) {
-  const transformed = {};
-  for (const field of fields) {
-    const value = data[field.name];
-    if (value === void 0) {
-      continue;
-    }
-    transformed[field.name] = isKnownFormField(field) ? transformFieldValue(value, field) : value;
+function validateSettings(settings, errors) {
+  if (!settings) {
+    return;
   }
-  return transformed;
-}
-function transformFieldValue(value, field) {
-  if (value === null || value === void 0) {
-    return value;
+  if (typeof settings !== "object" || Array.isArray(settings)) {
+    errors.push({
+      path: "settings",
+      message: "Form settings must be an object",
+      code: "SETTINGS_INVALID_TYPE"
+    });
+    return;
   }
-  switch (field.type) {
-    case "number":
-      if (typeof value === "string") {
-        const num = parseFloat(value);
-        return isNaN(num) ? value : num;
-      }
-      return value;
-    case "checkbox":
-      if (typeof value === "string") {
-        return value === "true" || value === "1" || value === "on";
-      }
-      return Boolean(value);
-    case "text":
-    case "email":
-    case "phone":
-    case "url":
-    case "textarea":
-    case "hidden":
-      if (typeof value === "string") {
-        return value.trim();
-      }
-      return value;
-    case "select":
-      if (field.allowMultiple) {
-        if (!Array.isArray(value)) {
-          return value ? [value] : [];
-        }
-      }
-      return value;
-    default:
-      return value;
+  const s = settings;
+  if (s.confirmationType === "redirect") {
+    if (!s.redirectUrl && !s.redirectRelation) {
+      errors.push({
+        path: "settings.redirectUrl",
+        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
+        code: "REDIRECT_URL_REQUIRED"
+      });
+    }
+  }
+  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
+    errors.push({
+      path: "settings.redirectPage",
+      message: "A page is required when confirmation type is 'relationship'",
+      code: "REDIRECT_PAGE_REQUIRED"
+    });
   }
 }
-function validateFormData(data, fields) {
-  const transformed = transformFormData(data, fields);
-  const schema = generateZodSchema(fields);
-  return schema.safeParse(transformed);
+function namesADocument(value) {
+  if (typeof value === "string") return value.length > 0;
+  return parseRedirectReference(value, []) !== null;
 }
-function getValidationErrors(result) {
-  if (result.success) {
-    return {};
+function validateAccess(access, errors) {
+  if (!access) {
+    return;
   }
-  const errors = {};
-  for (const error of result.error.issues) {
-    const path = error.path.join(".");
-    if (!errors[path]) {
-      errors[path] = error.message;
+  if (typeof access !== "object" || Array.isArray(access)) {
+    errors.push({
+      path: "access",
+      message: "Access control must be an object",
+      code: "ACCESS_INVALID_TYPE"
+    });
+    return;
+  }
+  const accessObj = access;
+  const validAccessKeys = ["submit", "read"];
+  for (const key of validAccessKeys) {
+    const fn = accessObj[key];
+    if (fn !== void 0 && typeof fn !== "function") {
+      errors.push({
+        path: `access.${key}`,
+        message: `Access control '${key}' must be a function`,
+        code: "ACCESS_FUNCTION_INVALID"
+      });
     }
   }
-  return errors;
 }
+function validateFormConfig(config) {
+  const errors = [];
+  validateSlug(config.slug, errors);
+  validateFields(config.fields, errors);
+  validateSettings(config.settings, errors);
+  validateAccess(config.access, errors);
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function assertValidFormConfig(config) {
+  const result = validateFormConfig(config);
+  if (!result.valid) {
+    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
+    throw new Error(
+      `Invalid form config for '${config.slug || "unknown"}':
+${errorMessages}`
+    );
+  }
+}
+
+// src/config/field-helpers.ts
+var option = (label, value) => ({
+  label,
+  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
+});
+var text3 = (config) => ({
+  ...config,
+  type: "text"
+});
+var email = (config) => ({
+  ...config,
+  type: "email"
+});
+var phone = (config) => ({
+  ...config,
+  type: "phone"
+});
+var url = (config) => ({
+  ...config,
+  type: "url"
+});
+var textarea3 = (config) => ({
+  ...config,
+  type: "textarea"
+});
+var number = (config) => ({
+  ...config,
+  type: "number"
+});
+var select3 = (config) => ({
+  ...config,
+  type: "select"
+});
+var checkbox2 = (config) => ({
+  ...config,
+  type: "checkbox"
+});
+var radio = (config) => ({
+  ...config,
+  type: "radio"
+});
+var file = (config) => ({
+  ...config,
+  type: "file"
+});
+var date3 = (config) => ({
+  ...config,
+  type: "date"
+});
+var time = (config) => ({
+  ...config,
+  type: "time"
+});
+var hidden = (config) => ({
+  ...config,
+  type: "hidden"
+});
 
 // src/handlers/submit-form.ts
 import { formAvailability, NO_SUCH_FORM } from "nextly";
@@ -2322,34 +2490,30 @@ async function submitForm(options, context) {
       return { success: true };
     }
     const isContentSpam = spamResult.isSpam;
-    const transformedData = transformFormData(data, form.fields);
-    let storedData;
     if (isContentSpam) {
       logger.info?.("Spam submission detected \u2014 storing flagged", {
         formSlug,
         reason: spamResult.reason,
         ipAddress: metadata?.ipAddress
       });
-      sanitizeSubmissionData(transformedData, form.fields);
-      storedData = transformedData;
-    } else {
-      const schema = generateZodSchema(form.fields);
-      const validationResult = schema.safeParse(transformedData);
-      if (!validationResult.success) {
-        const validationErrors = getValidationErrors(validationResult);
-        logger.debug?.("Form validation failed", {
-          formSlug,
-          errors: validationErrors
-        });
-        return {
-          success: false,
-          error: "Validation failed",
-          validationErrors
-        };
-      }
-      sanitizeSubmissionData(validationResult.data, form.fields);
-      storedData = validationResult.data;
     }
+    const prepared = prepareSubmission({
+      data,
+      fields: form.fields,
+      validate: !isContentSpam
+    });
+    if (prepared.validationErrors) {
+      logger.debug?.("Form validation failed", {
+        formSlug,
+        errors: prepared.validationErrors
+      });
+      return {
+        success: false,
+        error: "Validation failed",
+        validationErrors: prepared.validationErrors
+      };
+    }
+    const storedData = prepared.data;
     const submissionData = {
       form: form.id,
       data: storedData,
@@ -2361,7 +2525,10 @@ async function submitForm(options, context) {
     };
     const submission = await collections.createEntry(
       pluginConfig.formSubmissionOverrides.slug,
-      submissionData,
+      asPluginSubmission(submissionData, {
+        keepAsEvidence: isContentSpam,
+        form: { id: form.id, fields: form.fields }
+      }),
       // Public form submission — create as system. No ambient user; an
       // empty context already resolves to system, but be explicit.
       { as: "system" }
@@ -2521,15 +2688,17 @@ async function validateSubmission(formSlug, data, context) {
   if (!form) {
     return { valid: false, errors: { _form: "Form not found" } };
   }
-  const transformedData = transformFormData(data, form.fields);
-  const schema = generateZodSchema(form.fields);
-  const result = schema.safeParse(transformedData);
-  if (result.success) {
+  const prepared = prepareSubmission({
+    data,
+    fields: form.fields,
+    validate: true
+  });
+  if (!prepared.validationErrors) {
     return { valid: true };
   }
   return {
     valid: false,
-    errors: getValidationErrors(result)
+    errors: prepared.validationErrors
   };
 }
 async function isFormAcceptingSubmissions(formSlug, context) {
@@ -2540,25 +2709,6 @@ async function isFormAcceptingSubmissions(formSlug, context) {
   }
   return form.status === "published";
 }
-var TEXT_FORM_FIELDS = /* @__PURE__ */ new Set([
-  "text",
-  "email",
-  "textarea",
-  "phone",
-  "url",
-  "hidden"
-]);
-function stripHtmlTags(input) {
-  return input.replace(/<[^>]*(?:>|$)/g, "").replace(/\s+/g, " ").trim();
-}
-function sanitizeSubmissionData(data, fields) {
-  for (const field of fields) {
-    if (!TEXT_FORM_FIELDS.has(field.type)) continue;
-    const value = data[field.name];
-    if (typeof value !== "string") continue;
-    data[field.name] = stripHtmlTags(value);
-  }
-}
 async function getFormSubmissionStats(formSlug, context) {
   const { pluginContext, pluginConfig } = context;
   const { collections } = pluginContext.services;