@nextlyhq/plugin-form-builder 0.0.2-alpha.64 → 0.0.2-alpha.66

package/dist/index.js

@@ -31,13 +31,13 @@ import {
   pickedDocumentField,
   pluralize,
   toTitleCase
-} from "./chunk-W6NLZFHH.js";
+} from "./chunk-VIGKSRSH.js";
 
 // src/plugin.ts
 import { createRequire } from "module";
 import {
   definePlugin,
-  NextlyError as NextlyError2
+  NextlyError as NextlyError4
 } from "@nextlyhq/plugin-sdk";
 
 // src/collections/forms.ts
@@ -1134,18 +1134,32 @@ function validateFormData(data, fields) {
   const schema = generateZodSchema(fields);
   return schema.safeParse(transformed);
 }
-function getValidationErrors(result) {
-  if (result.success) {
-    return {};
-  }
-  const errors = {};
-  for (const error of result.error.issues) {
-    const path = error.path.join(".");
-    if (!errors[path]) {
-      errors[path] = error.message;
-    }
+function isBlank(value) {
+  return value === void 0 || value === null || value === "" || Array.isArray(value) && value.length === 0;
+}
+function getValidationIssues(result, submitted = {}) {
+  if (result.success) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const issues = [];
+  for (const issue of result.error.issues) {
+    const path = issue.path.join(".");
+    if (seen.has(path)) continue;
+    seen.add(path);
+    issues.push({
+      path,
+      // Read at the top level, which is the only depth a form field has: a
+      // declared field is one key, so a dotted path can only come from inside a
+      // value the visitor did supply.
+      code: isBlank(submitted[path]) ? "REQUIRED" : "INVALID",
+      message: issue.message
+    });
   }
-  return errors;
+  return issues;
+}
+function getValidationErrors(result) {
+  return Object.fromEntries(
+    getValidationIssues(result).map((issue) => [issue.path, issue.message])
+  );
 }
 
 // src/handlers/prepare-submission.ts
@@ -1203,167 +1217,883 @@ function prepareSubmission({
   }
   const result = generateZodSchema(fields).safeParse(transformed);
   if (!result.success) {
-    return { data: transformed, validationErrors: getValidationErrors(result) };
+    return {
+      data: transformed,
+      validationErrors: getValidationErrors(result),
+      // The RAW submission, not the transformed payload. Transformation
+      // normalises a value before the schema sees it, so a required
+      // multi-select sent a scalar `0` arrives here as `[]` and would read as
+      // blank: the visitor answered, and would be told they had not.
+      validationIssues: getValidationIssues(result, data)
+    };
   }
   return { data: result.data };
 }
 
-// src/plugin.ts
-var { version: PLUGIN_VERSION } = createRequire(import.meta.url)(
-  "../package.json"
-);
-function resolveConfig(options) {
-  const formOverrides = options.formOverrides || {};
-  const submissionOverrides = options.formSubmissionOverrides || {};
-  return {
-    formOverrides: {
-      ...formOverrides,
-      slug: formOverrides.slug || "forms",
-      labels: {
-        singular: formOverrides.labels?.singular || "Form",
-        plural: formOverrides.labels?.plural || "Forms"
-      }
-    },
-    formSubmissionOverrides: {
-      ...submissionOverrides,
-      slug: submissionOverrides.slug || "form-submissions",
-      labels: {
-        singular: submissionOverrides.labels?.singular || "Submission",
-        plural: submissionOverrides.labels?.plural || "Submissions"
+// src/handlers/spam-detection.ts
+import { RateLimiter, resolveRateLimitStore } from "nextly";
+async function checkSpam(options) {
+  const { data, ipAddress, formSlug, config } = options;
+  if (config.honeypot) {
+    const honeypotResult = checkHoneypot(data);
+    if (honeypotResult.isSpam) {
+      return honeypotResult;
+    }
+  }
+  if (config.rateLimit && ipAddress) {
+    const rateLimitResult = await checkRateLimit(
+      ipAddress,
+      formSlug,
+      config.rateLimit
+    );
+    if (rateLimitResult.isSpam) {
+      return rateLimitResult;
+    }
+  }
+  return { isSpam: false };
+}
+var HONEYPOT_FIELDS = [
+  "__honeypot",
+  "_honeypot",
+  "honeypot",
+  "__hp",
+  "_hp",
+  "website",
+  // Common honeypot field name
+  "url_field",
+  // Another common honeypot
+  "fax_number"
+  // Rarely used by humans
+];
+function checkHoneypot(data) {
+  for (const fieldName of HONEYPOT_FIELDS) {
+    const value = data[fieldName];
+    if (value !== void 0 && value !== null && value !== "") {
+      let raw;
+      if (typeof value === "object") {
+        raw = JSON.stringify(value);
+      } else {
+        raw = String(value);
       }
-    },
-    fields: {
-      text: options.fields?.text ?? true,
-      email: options.fields?.email ?? true,
-      number: options.fields?.number ?? true,
-      phone: options.fields?.phone ?? true,
-      url: options.fields?.url ?? true,
-      textarea: options.fields?.textarea ?? true,
-      select: options.fields?.select ?? true,
-      checkbox: options.fields?.checkbox ?? true,
-      radio: options.fields?.radio ?? true,
-      file: options.fields?.file ?? true,
-      date: options.fields?.date ?? true,
-      time: options.fields?.time ?? true,
-      hidden: options.fields?.hidden ?? true
-    },
-    redirectRelationships: normalizeRedirectRelationships(
-      options.redirectRelationships
-    ),
-    // Filled at `init` from each collection's own metadata. Empty until then,
-    // and a slug that stays absent reads as unknown rather than as not
-    // localized — see `ResolvedFormBuilderConfig`.
-    redirectTargetLocalization: {},
-    beforeEmail: options.beforeEmail,
-    notifications: {
-      defaultFrom: options.notifications?.defaultFrom,
-      defaultToEmail: options.notifications?.defaultToEmail,
-      enabled: options.notifications?.enabled ?? true
-    },
-    spamProtection: {
-      honeypot: options.spamProtection?.honeypot ?? true,
-      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
-      rateLimit: {
-        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
-        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
+      const stringValue = raw.trim();
+      if (stringValue.length > 0) {
+        return {
+          isSpam: true,
+          reason: "honeypot",
+          details: `Honeypot field "${fieldName}" was filled`
+        };
       }
-    },
-    uploads: {
-      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
-      // 10 MB
-      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
-        "image/*",
-        "application/pdf",
-        "text/*"
-      ],
-      uploadCollection: options.uploads?.uploadCollection ?? "media"
-    },
-    features: {
-      builder: options.features?.builder ?? true,
-      conditionalLogic: options.features?.conditionalLogic ?? true,
-      fileUploads: options.features?.fileUploads ?? true
     }
+  }
+  return { isSpam: false };
+}
+async function checkRateLimit(ipAddress, formSlug, config) {
+  const limiter = new RateLimiter(resolveRateLimitStore());
+  const result = await limiter.check(
+    `form-submit:${formSlug}:${ipAddress}`,
+    config.maxSubmissions,
+    config.windowMs
+  );
+  if (result.allowed) return { isSpam: false };
+  return {
+    isSpam: true,
+    reason: "rate_limit",
+    details: `Rate limit exceeded: ${config.maxSubmissions} per ${config.windowMs}ms`
   };
 }
-function formBuilder(options = {}) {
-  const resolvedConfig = resolveConfig(options);
-  const formsCol = formsCollection(resolvedConfig);
-  const submissionsCol = submissionsCollection(resolvedConfig);
-  const plugin = definePlugin({
-    name: "@nextlyhq/plugin-form-builder",
-    version: PLUGIN_VERSION,
-    nextly: ">=0.0.2-alpha.21",
-    // Identity metadata for the admin plugins page, mirroring package.json.
-    author: "Nextly",
-    homepage: "https://nextlyhq.com",
-    repository: "https://github.com/nextlyhq/nextly",
-    license: "MIT",
-    category: "forms",
-    tags: ["forms", "submissions", "email-notifications"],
-    // Declarative schema: the merged pipeline folds these into the
-    // app schema — no manual `setup()` append needed. Just register the plugin.
-    contributes: {
-      collections: [formsCol, submissionsCol],
-      // Custom permission — gates submission export beyond CRUD. The
-      // canonical example third-party plugin authors copy.
-      permissions: [
-        {
-          action: "export",
-          resource: "submissions",
-          label: "Export Submissions",
-          description: "Export form submissions as CSV/JSON",
-          // No `group`: the admin already files this under the plugin that
-          // declared it, so naming the plugin again would nest it inside
-          // itself. `group` is for a plugin with enough permissions to sort
-          // its own into headings, which one is not.
-          //
-          // `danger` because the point of the permission is to take
-          // submissions — names, emails, whatever a form asked for — out of
-          // the site in a file.
-          danger: true
-        }
-      ],
-      // HTTP route — exported at
-      // /api/plugins/@nextlyhq/plugin-form-builder/submissions/export. Secure by
-      // default: gated by the custom `export-submissions` permission. Reads
-      // via the secure-by-default service path as the authed user and
-      // resolves its OWN slug through `ctx.self`. The canonical
-      // contributes.routes example for third-party authors.
-      routes: [
+
+// src/routes/public-forms.ts
+import {
+  buildPaginatedResponse,
+  clampLimit,
+  formAvailability as formAvailability2,
+  NextlyError as NextlyError3,
+  NO_SUCH_FORM as NO_SUCH_FORM2,
+  respondAction,
+  respondDoc,
+  respondList,
+  trustedClientIp
+} from "nextly";
+
+// src/handlers/submit-form.ts
+import { isLocaleSelector } from "@nextlyhq/plugin-sdk";
+import { formAvailability, NextlyError as NextlyError2, NO_SUCH_FORM } from "nextly";
+async function submitForm(options, context) {
+  const { formSlug, data, metadata, request } = options;
+  const access = options.access ?? { as: "system" };
+  const locale = visitorLocale(options.locale);
+  const targetRead = { access, locale, request };
+  const { pluginContext, pluginConfig } = context;
+  const { collections } = pluginContext.services;
+  const { logger } = pluginContext;
+  try {
+    const form = await fetchFormBySlug(
+      formSlug,
+      pluginConfig,
+      pluginContext,
+      access
+    );
+    if (!form) {
+      logger.warn?.("Form submission attempted for non-existent form", {
+        formSlug
+      });
+      return { success: false, outcome: "no-such-form", error: NO_SUCH_FORM };
+    }
+    const redirectFor = () => resolveRedirectUrl(form, pluginConfig, pluginContext, targetRead);
+    const availability = formAvailability(form);
+    if (availability.kind !== "open") {
+      logger.info?.("Form submission rejected - form not accepting", {
+        formSlug,
+        status: form.status,
+        availability: availability.kind
+      });
+      return {
+        success: false,
+        outcome: availability.kind === "closed" ? "closed" : "no-such-form",
+        error: availability.kind === "closed" ? availability.message : NO_SUCH_FORM
+      };
+    }
+    const settings = normalizeFormSettings(form.settings);
+    if (settings.allowMultipleSubmissions === false && !metadata?.ipAddress) {
+      logger.warn?.(
+        "Single-submission form received a submission without an IP \u2014 the restriction cannot apply",
+        { formSlug }
+      );
+    }
+    if (settings.allowMultipleSubmissions === false && metadata?.ipAddress) {
+      const existing = await collections.count(
+        pluginConfig.formSubmissionOverrides.slug,
         {
-          method: "GET",
-          path: "/submissions/export",
-          requiredPermission: "export-submissions",
-          handler: async (req, ctx) => {
-            const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
-            const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
-            const url2 = new URL(req.url);
-            const format = url2.searchParams.get("format") ?? "json";
-            const formId = url2.searchParams.get("form");
-            const status = url2.searchParams.get("status");
-            const where = {};
-            if (formId) where.form = { equals: formId };
-            if (status) where.status = { equals: status };
-            else where.status = { not_equals: "spam" };
-            const opts = { as: "user", user: ctx.user ?? void 0 };
-            let form;
-            if (format === "csv") {
-              if (!formId) {
-                return Response.json(
-                  {
-                    error: {
-                      code: "VALIDATION_ERROR",
-                      message: "CSV export requires a form parameter."
-                    }
-                  },
-                  { status: 400 }
-                );
-              }
-              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
-              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
-              const formResult = await ctx.services.collections.listEntries(
-                formsSlug,
-                { where: { id: { equals: formId } } },
+          where: {
+            form: { equals: form.id },
+            ipAddress: { equals: metadata.ipAddress },
+            status: { not_equals: "spam" }
+          }
+        },
+        // Deliberately elevated, unlike the write below. This counts rows the
+        // visitor is not entitled to see in order to refuse their second
+        // submission; judged as the public it would count zero on any install
+        // that hides submissions and the restriction would never apply.
+        { as: "system" }
+      );
+      if (existing > 0) {
+        logger.info?.("Repeat submission rejected (single-submission form)", {
+          formSlug,
+          ipAddress: metadata.ipAddress
+        });
+        return {
+          success: false,
+          outcome: "duplicate",
+          error: "You have already submitted this form."
+        };
+      }
+    }
+    const declaredFieldNames = new Set(form.fields.map((field) => field.name));
+    const undeclaredData = Object.fromEntries(
+      Object.entries(data).filter(([key]) => !declaredFieldNames.has(key))
+    );
+    const spamResult = await checkSpam({
+      data: undeclaredData,
+      formSlug,
+      config: {
+        // Per-form overrides win where set; blank inherits the plugin config.
+        honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot
+      }
+    });
+    const isContentSpam = spamResult.isSpam;
+    if (isContentSpam) {
+      logger.info?.("Spam submission detected \u2014 storing flagged", {
+        formSlug,
+        reason: spamResult.reason,
+        ipAddress: metadata?.ipAddress
+      });
+    }
+    const prepared = prepareSubmission({
+      data,
+      fields: form.fields,
+      validate: !isContentSpam
+    });
+    if (prepared.validationErrors) {
+      logger.debug?.("Form validation failed", {
+        formSlug,
+        errors: prepared.validationErrors
+      });
+      return {
+        success: false,
+        outcome: "invalid",
+        error: "Validation failed",
+        validationErrors: prepared.validationErrors,
+        validationIssues: prepared.validationIssues
+      };
+    }
+    const storedData = prepared.data;
+    const submissionData = {
+      form: form.id,
+      data: storedData,
+      status: isContentSpam ? "spam" : "new",
+      spamReason: isContentSpam ? spamResult.reason ?? null : null,
+      ipAddress: metadata?.ipAddress || null,
+      userAgent: metadata?.userAgent || null,
+      submittedAt: /* @__PURE__ */ new Date()
+    };
+    let submission;
+    try {
+      submission = await collections.createEntry(
+        pluginConfig.formSubmissionOverrides.slug,
+        asPluginSubmission(submissionData, {
+          keepAsEvidence: isContentSpam,
+          form: { id: form.id, fields: form.fields }
+        }),
+        // Public form submission — create as system. No ambient user; an
+        // empty context already resolves to system, but be explicit.
+        //
+        // The request travels with it so the seam judges this submission on the
+        // same facts as one arriving through a Nextly route. Omitted by a caller
+        // that has none, and then the seam correctly reads the write as
+        // server-side work.
+        //
+        // `access` rather than a fixed `system`, so a route serving an anonymous
+        // visitor is still judged against the collection's own create rule. A
+        // host that closed public submissions configured that on the
+        // collection, and a write elevated past it reports a 201 for a
+        // submission they had refused.
+        { ...access, ...request ? { request } : {} }
+      );
+    } catch (error) {
+      if (NextlyError2.isRateLimited(error)) {
+        logger.info?.("Form submission refused (rate limit)", { formSlug });
+        return {
+          success: true,
+          outcome: "accepted",
+          successMessage: settings.successMessage,
+          // The same destination an accepted submission gets. Returning early
+          // without it left a throttled visitor on the form instead of the
+          // page its author sends people to, and made the one response this
+          // whole branch exists to disguise the only accepted one carrying no
+          // redirect.
+          redirect: await redirectFor()
+        };
+      }
+      throw error;
+    }
+    logger.info?.("Form submission created successfully", {
+      formSlug,
+      submissionId: submission.item.id,
+      flaggedAsSpam: isContentSpam
+    });
+    if (submission.warnings) {
+      logger.warn?.("Form submission side effects failed", {
+        formSlug,
+        submissionId: submission.item.id,
+        warnings: submission.warnings
+      });
+    }
+    const redirect = await redirectFor();
+    if (isContentSpam) {
+      return {
+        success: true,
+        outcome: "accepted",
+        successMessage: settings.successMessage,
+        redirect
+      };
+    }
+    return {
+      success: true,
+      outcome: "accepted",
+      successMessage: settings.successMessage,
+      // The created ROW, not the envelope around it. Through the shared
+      // conversion, which is where the unchecked step lives and says so; the
+      // integration test reads `submission.id` off the result because nothing
+      // at compile time will.
+      submission: asSubmissionDocument(submission.item),
+      redirect
+    };
+  } catch (error) {
+    logger.error?.("Form submission error", {
+      formSlug,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return {
+      success: false,
+      outcome: "failed",
+      error: "An error occurred processing your submission. Please try again.",
+      cause: error
+    };
+  }
+}
+async function fetchFormBySlug(slug, pluginConfig, pluginContext, access = { as: "system" }) {
+  const { collections } = pluginContext.services;
+  const result = await collections.listEntries(
+    pluginConfig.formOverrides.slug,
+    { where: { slug: { equals: slug } }, pagination: { limit: 1 } },
+    access
+  );
+  const form = result.data?.[0];
+  return form ? asFormDocument(form) : null;
+}
+async function resolveRedirectUrl(form, pluginConfig, pluginContext, read) {
+  const settings = form.settings;
+  if (!settings) return void 0;
+  if (settings.confirmationType === "redirect" && settings.redirectUrl) {
+    return settings.redirectUrl;
+  }
+  const field = pickedDocumentField(settings);
+  if (!field) return void 0;
+  return urlForPickedDocument(
+    settings[field],
+    form,
+    pluginConfig,
+    pluginContext,
+    read
+  );
+}
+async function urlForPickedDocument(stored, form, pluginConfig, pluginContext, read) {
+  const { logger } = pluginContext;
+  const patterns = pluginConfig.redirectRelationships;
+  const reference = parseRedirectReference(stored, Object.keys(patterns));
+  if (!reference) {
+    logger.warn?.("Form redirects to a page, but names no readable document", {
+      form: form.slug
+    });
+    return void 0;
+  }
+  const pattern = patterns[reference.collection];
+  if (!pattern) {
+    logger.warn?.(
+      "Form redirects to a collection that is not in redirectRelationships",
+      { form: form.slug, collection: reference.collection }
+    );
+    return void 0;
+  }
+  const target = await readTarget(reference, form, pluginContext, read);
+  if (!target) return void 0;
+  if (documentReachability(
+    target,
+    pluginConfig.redirectTargetLocalization[reference.collection]
+  ) === "unreachable") {
+    logger.warn?.("Form redirects to a page that has never been published", {
+      form: form.slug,
+      collection: reference.collection,
+      target: reference.id
+    });
+    return void 0;
+  }
+  return buildUrl(pattern, target, reference.collection, form, pluginContext);
+}
+function buildUrl(pattern, target, collection, form, pluginContext) {
+  const { logger } = pluginContext;
+  try {
+    const url2 = applyRedirectPattern(pattern, target);
+    if (!url2) {
+      logger.warn?.(
+        "Form redirect pattern could not be filled from the target document",
+        { form: form.slug, collection }
+      );
+    }
+    return url2;
+  } catch (error) {
+    logger.warn?.("Form redirect pattern threw while building a URL", {
+      form: form.slug,
+      collection,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return void 0;
+  }
+}
+function visitorLocale(locale) {
+  if (locale === void 0 || isLocaleSelector(locale)) return void 0;
+  return locale;
+}
+async function readTarget(reference, form, pluginContext, read) {
+  const { logger } = pluginContext;
+  const context = {
+    form: form.slug,
+    collection: reference.collection,
+    id: reference.id
+  };
+  let row;
+  try {
+    row = await pluginContext.services.collections.findEntryById(
+      reference.collection,
+      reference.id,
+      { ...read.access, locale: read.locale, request: read.request }
+    );
+  } catch (error) {
+    logger.warn?.("Form redirect target could not be read", {
+      ...context,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return void 0;
+  }
+  if (!row || typeof row !== "object") {
+    logger.warn?.("Form redirect target no longer exists", context);
+    return void 0;
+  }
+  return row;
+}
+async function validateSubmission(formSlug, data, context) {
+  const { pluginContext, pluginConfig } = context;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return { valid: false, errors: { _form: "Form not found" } };
+  }
+  const prepared = prepareSubmission({
+    data,
+    fields: form.fields,
+    validate: true
+  });
+  if (!prepared.validationErrors) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    errors: prepared.validationErrors
+  };
+}
+async function isFormAcceptingSubmissions(formSlug, context) {
+  const { pluginContext, pluginConfig } = context;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return false;
+  }
+  return form.status === "published";
+}
+async function getFormSubmissionStats(formSlug, context) {
+  const { pluginContext, pluginConfig } = context;
+  const { collections } = pluginContext.services;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return null;
+  }
+  try {
+    const submissionsSlug = pluginConfig.formSubmissionOverrides.slug;
+    const sys = { as: "system" };
+    const base = { form: { equals: form.id } };
+    const [total, newCount, read, archived] = await Promise.all([
+      collections.count(submissionsSlug, { where: base }, sys),
+      collections.count(
+        submissionsSlug,
+        { where: { ...base, status: { equals: "new" } } },
+        sys
+      ),
+      collections.count(
+        submissionsSlug,
+        { where: { ...base, status: { equals: "read" } } },
+        sys
+      ),
+      collections.count(
+        submissionsSlug,
+        { where: { ...base, status: { equals: "archived" } } },
+        sys
+      )
+    ]);
+    return { total, new: newCount, read, archived };
+  } catch {
+    return null;
+  }
+}
+
+// src/routes/public-forms.ts
+var PUBLIC = { as: "public" };
+var DEFAULT_LIST_LIMIT = 100;
+var DEFAULT_SUCCESS_MESSAGE = "Thank you for your submission!";
+function installedSlugs(config, self) {
+  const declaredForms = config.formOverrides.slug;
+  const declaredSubmissions = config.formSubmissionOverrides.slug;
+  return {
+    forms: self.collections[declaredForms] ?? declaredForms,
+    submissions: self.collections[declaredSubmissions] ?? declaredSubmissions
+  };
+}
+function configForInstall(config, self) {
+  const slugs = installedSlugs(config, self);
+  return {
+    ...config,
+    formOverrides: { ...config.formOverrides, slug: slugs.forms },
+    formSubmissionOverrides: {
+      ...config.formSubmissionOverrides,
+      slug: slugs.submissions
+    }
+  };
+}
+function positiveInt(raw) {
+  if (raw === null) return void 0;
+  const value = Number(raw);
+  return Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function toPageMeta(pagination) {
+  const limit = pagination.limit > 0 ? pagination.limit : DEFAULT_LIST_LIMIT;
+  const built = buildPaginatedResponse([], {
+    total: pagination.total,
+    page: Math.floor(pagination.offset / limit) + 1,
+    limit
+  });
+  return {
+    total: built.totalDocs,
+    page: built.page,
+    limit: built.limit,
+    totalPages: built.totalPages,
+    hasNext: built.hasNextPage,
+    hasPrev: built.hasPrevPage
+  };
+}
+async function listPublishedForms(req, ctx, config) {
+  const url2 = new URL(req.url);
+  const slugs = installedSlugs(config, ctx.self);
+  const result = await ctx.services.collections.listEntries(
+    slugs.forms,
+    {
+      where: { status: { equals: "published" } },
+      pagination: {
+        // Clamped HERE, with the canonical bound, so the limit that computes
+        // the offset is the limit that comes back. The query service clamps to
+        // 500 internally and reports the clamped value, while the offset is
+        // built from what was asked for, so `?limit=1000&page=2` returned the
+        // second 500-row slice and dividing the two reported page 3.
+        limit: clampLimit(
+          positiveInt(url2.searchParams.get("limit")) ?? DEFAULT_LIST_LIMIT
+        ),
+        page: positiveInt(url2.searchParams.get("page")) ?? 1
+      }
+    },
+    PUBLIC
+  );
+  return respondList(result.data ?? [], toPageMeta(result.pagination));
+}
+async function readFormBySlug(slug, ctx, config) {
+  const slugs = installedSlugs(config, ctx.self);
+  const result = await ctx.services.collections.listEntries(
+    slugs.forms,
+    { where: { slug: { equals: slug } }, pagination: { limit: 1 } },
+    PUBLIC
+  );
+  const doc = result.data?.[0];
+  const availability = formAvailability2(doc);
+  if (availability.kind === "absent") {
+    throw NextlyError3.notFound({
+      message: NO_SUCH_FORM2,
+      logContext: { entity: "form", slug, reason: availability.reason }
+    });
+  }
+  if (availability.kind === "closed") {
+    return respondDoc({
+      slug,
+      status: "closed",
+      closedMessage: availability.message
+    });
+  }
+  return respondDoc(doc);
+}
+async function readSubmittedData(req, slug) {
+  let parsed;
+  try {
+    parsed = await req.json();
+  } catch {
+    parsed = void 0;
+  }
+  const body = parsed;
+  if (!body?.data || typeof body.data !== "object") {
+    throw NextlyError3.validation({
+      errors: [
+        {
+          path: "data",
+          code: "MISSING_FIELD",
+          message: "Request body must contain a 'data' object."
+        }
+      ],
+      logContext: { slug }
+    });
+  }
+  return body.data;
+}
+function refusalFor(result, slug) {
+  const entity = { entity: "form", slug };
+  switch (result.outcome) {
+    case "no-such-form":
+      return NextlyError3.notFound({
+        message: NO_SUCH_FORM2,
+        logContext: entity
+      });
+    // A state conflict, not a validation failure. `validation` fixes the
+    // canonical `error.message` to "Validation failed." and nests the real one
+    // under `error.data.errors[0]`, so a client reading the documented envelope
+    // would be handed the author's explanation and never show it.
+    case "closed":
+      return NextlyError3.conflict({
+        reason: "state",
+        message: result.error ?? NO_SUCH_FORM2,
+        logContext: { ...entity, reason: "closed" }
+      });
+    case "duplicate":
+      return NextlyError3.conflict({
+        reason: "state",
+        message: result.error ?? "You have already submitted this form.",
+        logContext: { ...entity, reason: "duplicate" }
+      });
+    // The codes come from the issue list, not from the message map beside it.
+    // A client tells "you left this blank" from "this is not an email" by the
+    // code, and reporting every failure as `INVALID` stops that working while
+    // looking correct in a status-only test.
+    case "invalid":
+      return NextlyError3.validation({
+        errors: (result.validationIssues ?? []).map((issue) => ({
+          path: issue.path,
+          code: issue.code,
+          message: issue.message
+        })),
+        logContext: { slug }
+      });
+    // A typed refusal is re-thrown as itself. The collection may refuse a write
+    // for a reason its host chose, and those carry their own status and field
+    // detail; answering all of them with one internal error tells a visitor the
+    // server broke when their submission was in fact answered deliberately.
+    // Anything untyped stays a 500, which is what an unexpected failure is.
+    default:
+      if (result.cause instanceof NextlyError3) return result.cause;
+      return NextlyError3.internal({
+        logContext: { ...entity, reason: "submission-failed" }
+      });
+  }
+}
+async function acceptSubmission(req, ctx, config, slug) {
+  const data = await readSubmittedData(req, slug);
+  const result = await submitForm(
+    {
+      formSlug: slug,
+      data,
+      // The visitor's language, from `?locale=` on the submit URL — the same
+      // place core's own routes read a locale on the wire — so a picked
+      // redirect page answers with its URL in that language. A form on a
+      // French page posts to `/api/forms/contact/submit?locale=fr` and is
+      // sent to `/merci`; one that names no locale is answered in the
+      // default, as before. An unconfigured code reads as the default rather
+      // than refusing the submission: the visitor filled the form in, and a
+      // wrong query string is not a reason to lose what they wrote.
+      locale: new URL(req.url).searchParams.get("locale") || void 0,
+      // The request itself, so the write seam resolves the client under this
+      // deployment's proxy-trust settings and judges this submission on the
+      // same facts as one arriving through any other door.
+      request: req,
+      // The address for the audit column and the single-submission check,
+      // resolved by the core rather than read off a header here, which would
+      // record whatever the sender chose to claim and let one visitor pass as
+      // many.
+      metadata: {
+        ipAddress: trustedClientIp(req) ?? void 0,
+        userAgent: req.headers.get("user-agent") ?? void 0
+      },
+      access: PUBLIC
+    },
+    {
+      pluginContext: ctx,
+      pluginConfig: configForInstall(config, ctx.self)
+    }
+  );
+  if (result.outcome !== "accepted") throw refusalFor(result, slug);
+  return respondAction(
+    result.successMessage ?? DEFAULT_SUCCESS_MESSAGE,
+    {
+      ...result.submission ? { submissionId: result.submission.id } : {},
+      // Forwarded because this route is the only thing that can act on it. A
+      // form configured to redirect on success resolves one here, and core's
+      // endpoint dropped it, so the setting did nothing for any client posting
+      // over HTTP. Additive, and present on a flagged submission too, so it
+      // cannot be diffed against an accepted one.
+      ...result.redirect ? { redirect: result.redirect } : {}
+    },
+    { status: 201 }
+  );
+}
+function publicFormRoutes(config) {
+  return [
+    {
+      method: "GET",
+      path: "/forms",
+      mount: "root",
+      public: true,
+      // Collection documents, so their stored timestamps are presented in the
+      // installation's timezone exactly as the built-in read did.
+      formatTimestamps: true,
+      handler: (req, ctx) => listPublishedForms(req, ctx, config)
+    },
+    {
+      method: "GET",
+      path: "/forms/:slug",
+      mount: "root",
+      public: true,
+      formatTimestamps: true,
+      handler: (_req, ctx) => readFormBySlug(ctx.params.slug, ctx, config)
+    },
+    {
+      method: "POST",
+      path: "/forms/:slug/submit",
+      mount: "root",
+      public: true,
+      handler: (req, ctx) => acceptSubmission(req, ctx, config, ctx.params.slug)
+    }
+  ];
+}
+
+// src/plugin.ts
+var { version: PLUGIN_VERSION } = createRequire(import.meta.url)(
+  "../package.json"
+);
+function resolveConfig(options) {
+  const formOverrides = options.formOverrides || {};
+  const submissionOverrides = options.formSubmissionOverrides || {};
+  return {
+    formOverrides: {
+      ...formOverrides,
+      slug: formOverrides.slug || "forms",
+      labels: {
+        singular: formOverrides.labels?.singular || "Form",
+        plural: formOverrides.labels?.plural || "Forms"
+      }
+    },
+    formSubmissionOverrides: {
+      ...submissionOverrides,
+      slug: submissionOverrides.slug || "form-submissions",
+      labels: {
+        singular: submissionOverrides.labels?.singular || "Submission",
+        plural: submissionOverrides.labels?.plural || "Submissions"
+      }
+    },
+    fields: {
+      text: options.fields?.text ?? true,
+      email: options.fields?.email ?? true,
+      number: options.fields?.number ?? true,
+      phone: options.fields?.phone ?? true,
+      url: options.fields?.url ?? true,
+      textarea: options.fields?.textarea ?? true,
+      select: options.fields?.select ?? true,
+      checkbox: options.fields?.checkbox ?? true,
+      radio: options.fields?.radio ?? true,
+      file: options.fields?.file ?? true,
+      date: options.fields?.date ?? true,
+      time: options.fields?.time ?? true,
+      hidden: options.fields?.hidden ?? true
+    },
+    redirectRelationships: normalizeRedirectRelationships(
+      options.redirectRelationships
+    ),
+    // Filled at `init` from each collection's own metadata. Empty until then,
+    // and a slug that stays absent reads as unknown rather than as not
+    // localized — see `ResolvedFormBuilderConfig`.
+    redirectTargetLocalization: {},
+    beforeEmail: options.beforeEmail,
+    notifications: {
+      defaultFrom: options.notifications?.defaultFrom,
+      defaultToEmail: options.notifications?.defaultToEmail,
+      enabled: options.notifications?.enabled ?? true
+    },
+    spamProtection: {
+      honeypot: options.spamProtection?.honeypot ?? true,
+      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
+      rateLimit: {
+        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
+        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
+      }
+    },
+    uploads: {
+      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
+      // 10 MB
+      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
+        "image/*",
+        "application/pdf",
+        "text/*"
+      ],
+      uploadCollection: options.uploads?.uploadCollection ?? "media"
+    },
+    features: {
+      builder: options.features?.builder ?? true,
+      conditionalLogic: options.features?.conditionalLogic ?? true,
+      fileUploads: options.features?.fileUploads ?? true
+    }
+  };
+}
+function formBuilder(options = {}) {
+  const resolvedConfig = resolveConfig(options);
+  const formsCol = formsCollection(resolvedConfig);
+  const submissionsCol = submissionsCollection(resolvedConfig);
+  const plugin = definePlugin({
+    name: "@nextlyhq/plugin-form-builder",
+    version: PLUGIN_VERSION,
+    nextly: ">=0.0.2-alpha.21",
+    // Identity metadata for the admin plugins page, mirroring package.json.
+    author: "Nextly",
+    homepage: "https://nextlyhq.com",
+    repository: "https://github.com/nextlyhq/nextly",
+    license: "MIT",
+    category: "forms",
+    tags: ["forms", "submissions", "email-notifications"],
+    // Declarative schema: the merged pipeline folds these into the
+    // app schema — no manual `setup()` append needed. Just register the plugin.
+    contributes: {
+      collections: [formsCol, submissionsCol],
+      // Custom permission — gates submission export beyond CRUD. The
+      // canonical example third-party plugin authors copy.
+      permissions: [
+        {
+          action: "export",
+          resource: "submissions",
+          label: "Export Submissions",
+          description: "Export form submissions as CSV/JSON",
+          // No `group`: the admin already files this under the plugin that
+          // declared it, so naming the plugin again would nest it inside
+          // itself. `group` is for a plugin with enough permissions to sort
+          // its own into headings, which one is not.
+          //
+          // `danger` because the point of the permission is to take
+          // submissions — names, emails, whatever a form asked for — out of
+          // the site in a file.
+          danger: true
+        }
+      ],
+      // HTTP route — exported at
+      // /api/plugins/@nextlyhq/plugin-form-builder/submissions/export. Secure by
+      // default: gated by the custom `export-submissions` permission. Reads
+      // via the secure-by-default service path as the authed user and
+      // resolves its OWN slug through `ctx.self`. The canonical
+      // contributes.routes example for third-party authors.
+      routes: [
+        // The public form endpoints, at the addresses core used to serve
+        // before this plugin took them over. Root-mounted, so no caller's URL
+        // changes; see `routes/public-forms`.
+        ...publicFormRoutes(resolvedConfig),
+        {
+          method: "GET",
+          path: "/submissions/export",
+          requiredPermission: "export-submissions",
+          handler: async (req, ctx) => {
+            const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
+            const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
+            const url2 = new URL(req.url);
+            const format = url2.searchParams.get("format") ?? "json";
+            const formId = url2.searchParams.get("form");
+            const status = url2.searchParams.get("status");
+            const where = {};
+            if (formId) where.form = { equals: formId };
+            if (status) where.status = { equals: status };
+            else where.status = { not_equals: "spam" };
+            const opts = { as: "user", user: ctx.user ?? void 0 };
+            let form;
+            if (format === "csv") {
+              if (!formId) {
+                return Response.json(
+                  {
+                    error: {
+                      code: "VALIDATION_ERROR",
+                      message: "CSV export requires a form parameter."
+                    }
+                  },
+                  { status: 400 }
+                );
+              }
+              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
+              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
+              const formResult = await ctx.services.collections.listEntries(
+                formsSlug,
+                { where: { id: { equals: formId } } },
                 opts
               );
               form = formResult.data[0];
@@ -1541,30 +2271,11 @@ function formBuilder(options = {}) {
         }
         return ctx.data;
       });
-      nextly.hooks.on("afterRead", formsSlug, async (context) => {
-        const data = context.data;
-        const records = Array.isArray(data) ? data : data ? [data] : [];
-        await Promise.all(
-          records.map(async (record) => {
-            const form = record;
-            if (typeof form.id !== "string") return;
-            try {
-              form.submissionCount = await nextly.services.collections.count(
-                submissionSlug,
-                {
-                  where: {
-                    form: { equals: form.id },
-                    status: { not_equals: "spam" }
-                  }
-                },
-                { as: "system" }
-              );
-            } catch {
-              form.submissionCount = 0;
-            }
-          })
-        );
-      });
+      nextly.hooks.on(
+        "afterRead",
+        formsSlug,
+        (context) => injectSubmissionCount(context, submissionSlug, nextly)
+      );
     }
   });
   return {
@@ -1690,7 +2401,7 @@ function submittedPayload(raw) {
   } else if (raw && typeof raw === "object" && !Array.isArray(raw)) {
     return raw;
   }
-  throw NextlyError2.validation({
+  throw NextlyError4.validation({
     errors: [
       {
         path: "data",
@@ -1720,30 +2431,39 @@ async function prepareSubmissionForWrite(context, formsSlug, nextly) {
     submission.data !== void 0 ? submission.data : stored?.data
   );
   const marks = submissionMarks(submission);
-  const fields = await fieldsToCheckAgainst(marks, formsSlug, formId, nextly);
+  const form = await formToCheckAgainst(marks, formsSlug, formId, nextly);
+  const fields = form.fields;
+  const spam = ctx.operation === "create" && ctx.req?.http ? await judgeSubmission(incoming, form, ctx.req.http, nextly) : void 0;
+  if (spam?.reason === "rate_limit") {
+    throw NextlyError4.rateLimited();
+  }
   const prepared = prepareSubmission({
     data: incoming,
     fields,
-    validate: marks?.keepAsEvidence !== true
+    validate: marks?.keepAsEvidence !== true && spam === void 0
   });
   if (prepared.validationErrors) {
-    throw NextlyError2.validation({
+    throw NextlyError4.validation({
       errors: Object.entries(prepared.validationErrors).map(
         ([path, message]) => ({ path, code: "INVALID", message })
       )
     });
   }
   ctx.data = { ...submission, data: prepared.data };
+  if (spam) {
+    ctx.data.status = "spam";
+    ctx.data.spamReason = spam.reason ?? null;
+  }
   if (ctx.operation !== "create" && submission.data === void 0) {
     stampDerivedEdit(ctx.data, ctx.user, incoming, prepared.data);
   }
   return ctx.data;
 }
-async function fieldsToCheckAgainst(marks, formsSlug, formId, nextly) {
+async function formToCheckAgainst(marks, formsSlug, formId, nextly) {
   const handedOver = marks?.form?.id === formId ? marks.form : null;
   const form = handedOver ?? await fetchParentForm(formsSlug, formId, nextly);
   if (!form || !Array.isArray(form.fields)) {
-    throw NextlyError2.validation({
+    throw NextlyError4.validation({
       errors: [
         {
           path: "form",
@@ -1753,7 +2473,32 @@ async function fieldsToCheckAgainst(marks, formsSlug, formId, nextly) {
       ]
     });
   }
-  return form.fields;
+  return form;
+}
+function rateLimitKeyFor(form) {
+  const { id } = form;
+  return typeof id === "string" && id.length > 0 ? id : "unidentified-form";
+}
+async function judgeSubmission(payload, form, http, nextly) {
+  const config = getFormBuilderConfig(nextly);
+  if (!config) return void 0;
+  const declared = new Set(
+    (Array.isArray(form.fields) ? form.fields : []).map((field) => field.name).filter((name) => typeof name === "string")
+  );
+  const undeclared = Object.fromEntries(
+    Object.entries(payload).filter(([key]) => !declared.has(key))
+  );
+  const settings = form.settings ?? {};
+  const verdict = await checkSpam({
+    data: undeclared,
+    ipAddress: http.ip ?? void 0,
+    formSlug: rateLimitKeyFor(form),
+    config: {
+      honeypot: settings.honeypotEnabled ?? config.spamProtection.honeypot,
+      rateLimit: config.spamProtection.rateLimit
+    }
+  });
+  return verdict.isSpam ? verdict : void 0;
 }
 function stampDerivedEdit(row, user, before, after) {
   if (sameSubmittedPayload(before, after)) return;
@@ -1836,16 +2581,42 @@ async function handleSubmissionCreated(context, config, nextly) {
     }
   }
 }
+async function injectSubmissionCount(context, submissionSlug, nextly) {
+  const hook = context;
+  if (hook.context?.[SCHEMA_ONLY_READ] === true) return;
+  const records = Array.isArray(hook.data) ? hook.data : hook.data ? [hook.data] : [];
+  await Promise.all(
+    records.map(async (record) => {
+      const form = record;
+      if (typeof form.id !== "string") return;
+      try {
+        form.submissionCount = await nextly.services.collections.count(
+          submissionSlug,
+          {
+            where: {
+              form: { equals: form.id },
+              status: { not_equals: "spam" }
+            }
+          },
+          { as: "system" }
+        );
+      } catch {
+        form.submissionCount = 0;
+      }
+    })
+  );
+}
+var SCHEMA_ONLY_READ = "formBuilder.schemaOnlyRead";
 async function fetchParentForm(formsSlug, formId, nextly) {
   try {
     const form = await nextly.services.collections.findEntryById(
       formsSlug,
       formId,
-      { as: "system" }
+      { as: "system", context: { [SCHEMA_ONLY_READ]: true } }
     );
     return form;
   } catch (err) {
-    if (!NextlyError2.isNotFound(err)) throw err;
+    if (!NextlyError4.isNotFound(err)) throw err;
     nextly.logger.error?.("Form Builder: form not found", {
       formId,
       error: err instanceof Error ? err.message : String(err)
@@ -1909,834 +2680,383 @@ function validateSlug(slug, errors) {
       code: "SLUG_TOO_LONG"
     });
   }
-  if (!SLUG_PATTERN.test(slug)) {
-    errors.push({
-      path,
-      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
-      code: "SLUG_INVALID_FORMAT"
-    });
-  }
-  if (isReservedSlug(slug)) {
-    errors.push({
-      path,
-      message: `Form slug '${slug}' is reserved and cannot be used`,
-      code: "SLUG_RESERVED"
-    });
-  }
-}
-function validateFieldName(name, path, errors, seenNames) {
-  if (!name) {
-    errors.push({
-      path: `${path}.name`,
-      message: "Field name is required",
-      code: "FIELD_NAME_REQUIRED"
-    });
-    return;
-  }
-  if (typeof name !== "string") {
-    errors.push({
-      path: `${path}.name`,
-      message: "Field name must be a string",
-      code: "FIELD_NAME_REQUIRED"
-    });
-    return;
-  }
-  if (!FIELD_NAME_PATTERN.test(name)) {
-    errors.push({
-      path: `${path}.name`,
-      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
-      code: "FIELD_NAME_INVALID_FORMAT"
-    });
-  }
-  const nameLower = name.toLowerCase();
-  if (seenNames.has(nameLower)) {
-    errors.push({
-      path: `${path}.name`,
-      message: `Duplicate field name '${name}'`,
-      code: "FIELD_NAME_DUPLICATE"
-    });
-  } else {
-    seenNames.add(nameLower);
-  }
-}
-function validateFieldLabel(label, path, errors) {
-  if (!label || typeof label === "string" && label.trim() === "") {
-    errors.push({
-      path: `${path}.label`,
-      message: "Field label is required",
-      code: "FIELD_LABEL_REQUIRED"
-    });
-  }
-}
-function validateOptions(field, path, errors) {
-  const fieldWithOptions = field;
-  const options = fieldWithOptions.options;
-  if (!options) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field must have an 'options' array`,
-      code: "OPTIONS_REQUIRED"
-    });
-    return;
-  }
-  if (!Array.isArray(options)) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field 'options' must be an array`,
-      code: "OPTIONS_REQUIRED"
-    });
-    return;
-  }
-  if (options.length === 0) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field must have at least one option`,
-      code: "OPTIONS_EMPTY"
-    });
-  }
-}
-function validateConditionalLogic(field, path, errors) {
-  const { conditionalLogic } = field;
-  if (!conditionalLogic || !conditionalLogic.enabled) {
-    return;
-  }
-  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
-    errors.push({
-      path: `${path}.conditionalLogic.conditions`,
-      message: "Conditional logic must have at least one condition",
-      code: "CONDITIONS_REQUIRED"
-    });
-    return;
-  }
-  conditionalLogic.conditions.forEach((condition, index) => {
-    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
-    if (!condition.field) {
-      errors.push({
-        path: `${conditionPath}.field`,
-        message: "Condition must specify a field name",
-        code: "CONDITION_FIELD_REQUIRED"
-      });
-    }
-    if (!condition.comparison) {
-      errors.push({
-        path: `${conditionPath}.comparison`,
-        message: "Condition must specify a comparison operator",
-        code: "CONDITION_COMPARISON_REQUIRED"
-      });
-    }
-  });
-}
-function validateFieldByType(field, path, errors) {
-  switch (field.type) {
-    case "select":
-    case "radio":
-      validateOptions(field, path, errors);
-      break;
-    case "number": {
-      const numberField = field;
-      if (numberField.validation) {
-        const { min, max } = numberField.validation;
-        if (min !== void 0 && max !== void 0 && min > max) {
-          errors.push({
-            path: `${path}.validation`,
-            message: "Min value cannot be greater than max value",
-            code: "MIN_GREATER_THAN_MAX"
-          });
-        }
-      }
-      break;
-    }
-    case "text":
-    case "textarea": {
-      const textField = field;
-      if (textField.validation) {
-        const { minLength, maxLength } = textField.validation;
-        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
-          errors.push({
-            path: `${path}.validation`,
-            message: "Min length cannot be greater than max length",
-            code: "MIN_LENGTH_GREATER_THAN_MAX"
-          });
-        }
-      }
-      break;
-    }
-    case "file": {
-      const fileField = field;
-      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
-        errors.push({
-          path: `${path}.maxFileSize`,
-          message: "File maxFileSize must be a positive number",
-          code: "FILE_MAX_SIZE_INVALID"
-        });
-      }
-      break;
-    }
-  }
-}
-function validateField(field, path, errors, seenNames) {
-  if (!field || typeof field !== "object") {
-    return;
-  }
-  const f = field;
-  const fieldType = f.type;
-  if (!fieldType) {
-    errors.push({
-      path: `${path}.type`,
-      message: "Field type is required",
-      code: "FIELD_TYPE_REQUIRED"
-    });
-    return;
-  }
-  const isValidType = typeof fieldType === "string" && (VALID_FIELD_TYPES_SET.has(fieldType) || isPluginFieldTypeOnSurface(fieldType, "forms"));
-  if (!isValidType) {
-    let fieldTypeRepr;
-    if (typeof fieldType === "object" && fieldType !== null) {
-      fieldTypeRepr = JSON.stringify(fieldType);
-    } else {
-      fieldTypeRepr = String(fieldType);
-    }
-    errors.push({
-      path: `${path}.type`,
-      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
-      code: "FIELD_TYPE_INVALID"
-    });
-    return;
-  }
-  validateFieldName(f.name, path, errors, seenNames);
-  if (fieldType !== "hidden") {
-    validateFieldLabel(f.label, path, errors);
-  }
-  validateFieldByType(field, path, errors);
-  if (f.conditionalLogic) {
-    validateConditionalLogic(field, path, errors);
-  }
-}
-function validateFieldsArray(fields, basePath, errors) {
-  const seenNames = /* @__PURE__ */ new Set();
-  fields.forEach((field, index) => {
-    const fieldPath = `${basePath}[${index}]`;
-    validateField(field, fieldPath, errors, seenNames);
-  });
-}
-function validateFields(fields, errors) {
-  const path = "fields";
-  if (!fields) {
-    errors.push({
-      path,
-      message: "Form must have at least one field",
-      code: "FIELDS_REQUIRED"
-    });
-    return;
-  }
-  if (!Array.isArray(fields)) {
+  if (!SLUG_PATTERN.test(slug)) {
     errors.push({
       path,
-      message: "Form fields must be an array",
-      code: "FIELDS_INVALID_TYPE"
+      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
+      code: "SLUG_INVALID_FORMAT"
     });
-    return;
   }
-  if (fields.length === 0) {
+  if (isReservedSlug(slug)) {
     errors.push({
       path,
-      message: "Form must have at least one field",
-      code: "FIELDS_EMPTY"
+      message: `Form slug '${slug}' is reserved and cannot be used`,
+      code: "SLUG_RESERVED"
     });
-    return;
   }
-  validateFieldsArray(fields, path, errors);
 }
-function validateSettings(settings, errors) {
-  if (!settings) {
+function validateFieldName(name, path, errors, seenNames) {
+  if (!name) {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name is required",
+      code: "FIELD_NAME_REQUIRED"
+    });
     return;
   }
-  if (typeof settings !== "object" || Array.isArray(settings)) {
+  if (typeof name !== "string") {
     errors.push({
-      path: "settings",
-      message: "Form settings must be an object",
-      code: "SETTINGS_INVALID_TYPE"
+      path: `${path}.name`,
+      message: "Field name must be a string",
+      code: "FIELD_NAME_REQUIRED"
     });
     return;
   }
-  const s = settings;
-  if (s.confirmationType === "redirect") {
-    if (!s.redirectUrl && !s.redirectRelation) {
-      errors.push({
-        path: "settings.redirectUrl",
-        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
-        code: "REDIRECT_URL_REQUIRED"
-      });
-    }
+  if (!FIELD_NAME_PATTERN.test(name)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
+      code: "FIELD_NAME_INVALID_FORMAT"
+    });
   }
-  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
+  const nameLower = name.toLowerCase();
+  if (seenNames.has(nameLower)) {
     errors.push({
-      path: "settings.redirectPage",
-      message: "A page is required when confirmation type is 'relationship'",
-      code: "REDIRECT_PAGE_REQUIRED"
+      path: `${path}.name`,
+      message: `Duplicate field name '${name}'`,
+      code: "FIELD_NAME_DUPLICATE"
     });
+  } else {
+    seenNames.add(nameLower);
   }
 }
-function namesADocument(value) {
-  if (typeof value === "string") return value.length > 0;
-  return parseRedirectReference(value, []) !== null;
+function validateFieldLabel(label, path, errors) {
+  if (!label || typeof label === "string" && label.trim() === "") {
+    errors.push({
+      path: `${path}.label`,
+      message: "Field label is required",
+      code: "FIELD_LABEL_REQUIRED"
+    });
+  }
 }
-function validateAccess(access, errors) {
-  if (!access) {
+function validateOptions(field, path, errors) {
+  const fieldWithOptions = field;
+  const options = fieldWithOptions.options;
+  if (!options) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have an 'options' array`,
+      code: "OPTIONS_REQUIRED"
+    });
     return;
   }
-  if (typeof access !== "object" || Array.isArray(access)) {
+  if (!Array.isArray(options)) {
     errors.push({
-      path: "access",
-      message: "Access control must be an object",
-      code: "ACCESS_INVALID_TYPE"
+      path: `${path}.options`,
+      message: `${field.type} field 'options' must be an array`,
+      code: "OPTIONS_REQUIRED"
     });
     return;
   }
-  const accessObj = access;
-  const validAccessKeys = ["submit", "read"];
-  for (const key of validAccessKeys) {
-    const fn = accessObj[key];
-    if (fn !== void 0 && typeof fn !== "function") {
-      errors.push({
-        path: `access.${key}`,
-        message: `Access control '${key}' must be a function`,
-        code: "ACCESS_FUNCTION_INVALID"
-      });
-    }
-  }
-}
-function validateFormConfig(config) {
-  const errors = [];
-  validateSlug(config.slug, errors);
-  validateFields(config.fields, errors);
-  validateSettings(config.settings, errors);
-  validateAccess(config.access, errors);
-  return {
-    valid: errors.length === 0,
-    errors
-  };
-}
-function assertValidFormConfig(config) {
-  const result = validateFormConfig(config);
-  if (!result.valid) {
-    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
-    throw new Error(
-      `Invalid form config for '${config.slug || "unknown"}':
-${errorMessages}`
-    );
-  }
-}
-
-// src/config/field-helpers.ts
-var option = (label, value) => ({
-  label,
-  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
-});
-var text3 = (config) => ({
-  ...config,
-  type: "text"
-});
-var email = (config) => ({
-  ...config,
-  type: "email"
-});
-var phone = (config) => ({
-  ...config,
-  type: "phone"
-});
-var url = (config) => ({
-  ...config,
-  type: "url"
-});
-var textarea3 = (config) => ({
-  ...config,
-  type: "textarea"
-});
-var number = (config) => ({
-  ...config,
-  type: "number"
-});
-var select3 = (config) => ({
-  ...config,
-  type: "select"
-});
-var checkbox2 = (config) => ({
-  ...config,
-  type: "checkbox"
-});
-var radio = (config) => ({
-  ...config,
-  type: "radio"
-});
-var file = (config) => ({
-  ...config,
-  type: "file"
-});
-var date3 = (config) => ({
-  ...config,
-  type: "date"
-});
-var time = (config) => ({
-  ...config,
-  type: "time"
-});
-var hidden = (config) => ({
-  ...config,
-  type: "hidden"
-});
-
-// src/handlers/submit-form.ts
-import { formAvailability, NO_SUCH_FORM } from "nextly";
-
-// src/handlers/spam-detection.ts
-var rateLimitStore = /* @__PURE__ */ new Map();
-async function checkSpam(options) {
-  const { data, ipAddress, formSlug, config } = options;
-  if (config.honeypot) {
-    const honeypotResult = checkHoneypot(data);
-    if (honeypotResult.isSpam) {
-      return honeypotResult;
-    }
-  }
-  if (config.rateLimit && ipAddress) {
-    const rateLimitResult = checkRateLimit(
-      ipAddress,
-      formSlug,
-      config.rateLimit
-    );
-    if (rateLimitResult.isSpam) {
-      return rateLimitResult;
-    }
-  }
-  return { isSpam: false };
-}
-var HONEYPOT_FIELDS = [
-  "__honeypot",
-  "_honeypot",
-  "honeypot",
-  "__hp",
-  "_hp",
-  "website",
-  // Common honeypot field name
-  "url_field",
-  // Another common honeypot
-  "fax_number"
-  // Rarely used by humans
-];
-function checkHoneypot(data) {
-  for (const fieldName of HONEYPOT_FIELDS) {
-    const value = data[fieldName];
-    if (value !== void 0 && value !== null && value !== "") {
-      let raw;
-      if (typeof value === "object") {
-        raw = JSON.stringify(value);
-      } else {
-        raw = String(value);
-      }
-      const stringValue = raw.trim();
-      if (stringValue.length > 0) {
-        return {
-          isSpam: true,
-          reason: "honeypot",
-          details: `Honeypot field "${fieldName}" was filled`
-        };
-      }
-    }
-  }
-  return { isSpam: false };
-}
-function checkRateLimit(ipAddress, formSlug, config) {
-  const key = `${formSlug}:${ipAddress}`;
-  const now = Date.now();
-  const entry = rateLimitStore.get(key);
-  if (entry) {
-    if (now - entry.timestamp > config.windowMs) {
-      rateLimitStore.set(key, { count: 1, timestamp: now });
-      return { isSpam: false };
-    }
-    if (entry.count >= config.maxSubmissions) {
-      return {
-        isSpam: true,
-        reason: "rate_limit",
-        details: `Rate limit exceeded: ${entry.count}/${config.maxSubmissions} in ${config.windowMs}ms`
-      };
-    }
-    rateLimitStore.set(key, {
-      count: entry.count + 1,
-      timestamp: entry.timestamp
+  if (options.length === 0) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have at least one option`,
+      code: "OPTIONS_EMPTY"
     });
-  } else {
-    rateLimitStore.set(key, { count: 1, timestamp: now });
   }
-  return { isSpam: false };
-}
-function cleanupRateLimitStore(maxAgeMs = 5 * 60 * 1e3) {
-  const now = Date.now();
-  let removed = 0;
-  for (const [key, entry] of rateLimitStore.entries()) {
-    if (now - entry.timestamp > maxAgeMs) {
-      rateLimitStore.delete(key);
-      removed++;
-    }
-  }
-  return removed;
 }
-function getRateLimitStoreSize() {
-  return rateLimitStore.size;
-}
-function clearRateLimitStore() {
-  rateLimitStore.clear();
-}
-function isRateLimited(ipAddress, formSlug, config) {
-  const key = `${formSlug}:${ipAddress}`;
-  const now = Date.now();
-  const entry = rateLimitStore.get(key);
-  if (!entry) {
-    return false;
+function validateConditionalLogic(field, path, errors) {
+  const { conditionalLogic } = field;
+  if (!conditionalLogic || !conditionalLogic.enabled) {
+    return;
   }
-  if (now - entry.timestamp > config.windowMs) {
-    return false;
+  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
+    errors.push({
+      path: `${path}.conditionalLogic.conditions`,
+      message: "Conditional logic must have at least one condition",
+      code: "CONDITIONS_REQUIRED"
+    });
+    return;
   }
-  return entry.count >= config.maxSubmissions;
-}
-
-// src/handlers/submit-form.ts
-async function submitForm(options, context) {
-  const { formSlug, data, metadata } = options;
-  const { pluginContext, pluginConfig } = context;
-  const { collections } = pluginContext.services;
-  const { logger } = pluginContext;
-  try {
-    const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-    if (!form) {
-      logger.warn?.("Form submission attempted for non-existent form", {
-        formSlug
+  conditionalLogic.conditions.forEach((condition, index) => {
+    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
+    if (!condition.field) {
+      errors.push({
+        path: `${conditionPath}.field`,
+        message: "Condition must specify a field name",
+        code: "CONDITION_FIELD_REQUIRED"
       });
-      return { success: false, error: NO_SUCH_FORM };
     }
-    const availability = formAvailability(form);
-    if (availability.kind !== "open") {
-      logger.info?.("Form submission rejected - form not accepting", {
-        formSlug,
-        status: form.status,
-        availability: availability.kind
+    if (!condition.comparison) {
+      errors.push({
+        path: `${conditionPath}.comparison`,
+        message: "Condition must specify a comparison operator",
+        code: "CONDITION_COMPARISON_REQUIRED"
       });
-      return {
-        success: false,
-        error: availability.kind === "closed" ? availability.message : NO_SUCH_FORM
-      };
-    }
-    const settings = normalizeFormSettings(form.settings);
-    if (settings.allowMultipleSubmissions === false && !metadata?.ipAddress) {
-      logger.warn?.(
-        "Single-submission form received a submission without an IP \u2014 the restriction cannot apply",
-        { formSlug }
-      );
     }
-    if (settings.allowMultipleSubmissions === false && metadata?.ipAddress) {
-      const existing = await collections.count(
-        pluginConfig.formSubmissionOverrides.slug,
-        {
-          where: {
-            form: { equals: form.id },
-            ipAddress: { equals: metadata.ipAddress },
-            status: { not_equals: "spam" }
-          }
-        },
-        { as: "system" }
-      );
-      if (existing > 0) {
-        logger.info?.("Repeat submission rejected (single-submission form)", {
-          formSlug,
-          ipAddress: metadata.ipAddress
-        });
-        return {
-          success: false,
-          error: "You have already submitted this form."
-        };
+  });
+}
+function validateFieldByType(field, path, errors) {
+  switch (field.type) {
+    case "select":
+    case "radio":
+      validateOptions(field, path, errors);
+      break;
+    case "number": {
+      const numberField = field;
+      if (numberField.validation) {
+        const { min, max } = numberField.validation;
+        if (min !== void 0 && max !== void 0 && min > max) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min value cannot be greater than max value",
+            code: "MIN_GREATER_THAN_MAX"
+          });
+        }
       }
+      break;
     }
-    const declaredFieldNames = new Set(form.fields.map((field) => field.name));
-    const undeclaredData = Object.fromEntries(
-      Object.entries(data).filter(([key]) => !declaredFieldNames.has(key))
-    );
-    const spamResult = await checkSpam({
-      data: undeclaredData,
-      ipAddress: metadata?.ipAddress,
-      formSlug,
-      config: {
-        // Per-form overrides win where set; blank inherits the plugin config.
-        honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot,
-        rateLimit: pluginConfig.spamProtection.rateLimit,
-        recaptcha: {
-          ...pluginConfig.spamProtection.recaptcha,
-          enabled: settings.captchaEnabled ?? pluginConfig.spamProtection.recaptcha?.enabled ?? false
+    case "text":
+    case "textarea": {
+      const textField = field;
+      if (textField.validation) {
+        const { minLength, maxLength } = textField.validation;
+        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min length cannot be greater than max length",
+            code: "MIN_LENGTH_GREATER_THAN_MAX"
+          });
         }
       }
-    });
-    if (spamResult.isSpam && spamResult.reason === "rate_limit") {
-      logger.info?.("Spam submission rejected (rate limit)", {
-        formSlug,
-        ipAddress: metadata?.ipAddress
-      });
-      return { success: true };
-    }
-    const isContentSpam = spamResult.isSpam;
-    if (isContentSpam) {
-      logger.info?.("Spam submission detected \u2014 storing flagged", {
-        formSlug,
-        reason: spamResult.reason,
-        ipAddress: metadata?.ipAddress
-      });
+      break;
     }
-    const prepared = prepareSubmission({
-      data,
-      fields: form.fields,
-      validate: !isContentSpam
-    });
-    if (prepared.validationErrors) {
-      logger.debug?.("Form validation failed", {
-        formSlug,
-        errors: prepared.validationErrors
-      });
-      return {
-        success: false,
-        error: "Validation failed",
-        validationErrors: prepared.validationErrors
-      };
+    case "file": {
+      const fileField = field;
+      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
+        errors.push({
+          path: `${path}.maxFileSize`,
+          message: "File maxFileSize must be a positive number",
+          code: "FILE_MAX_SIZE_INVALID"
+        });
+      }
+      break;
     }
-    const storedData = prepared.data;
-    const submissionData = {
-      form: form.id,
-      data: storedData,
-      status: isContentSpam ? "spam" : "new",
-      spamReason: isContentSpam ? spamResult.reason ?? null : null,
-      ipAddress: metadata?.ipAddress || null,
-      userAgent: metadata?.userAgent || null,
-      submittedAt: /* @__PURE__ */ new Date()
-    };
-    const submission = await collections.createEntry(
-      pluginConfig.formSubmissionOverrides.slug,
-      asPluginSubmission(submissionData, {
-        keepAsEvidence: isContentSpam,
-        form: { id: form.id, fields: form.fields }
-      }),
-      // Public form submission — create as system. No ambient user; an
-      // empty context already resolves to system, but be explicit.
-      { as: "system" }
-    );
-    logger.info?.("Form submission created successfully", {
-      formSlug,
-      submissionId: submission.item.id,
-      flaggedAsSpam: isContentSpam
+  }
+}
+function validateField(field, path, errors, seenNames) {
+  if (!field || typeof field !== "object") {
+    return;
+  }
+  const f = field;
+  const fieldType = f.type;
+  if (!fieldType) {
+    errors.push({
+      path: `${path}.type`,
+      message: "Field type is required",
+      code: "FIELD_TYPE_REQUIRED"
     });
-    if (submission.warnings) {
-      logger.warn?.("Form submission side effects failed", {
-        formSlug,
-        submissionId: submission.item.id,
-        warnings: submission.warnings
-      });
-    }
-    const redirect = await resolveRedirectUrl(
-      form,
-      pluginConfig,
-      pluginContext
-    );
-    if (isContentSpam) {
-      return { success: true, redirect };
+    return;
+  }
+  const isValidType = typeof fieldType === "string" && (VALID_FIELD_TYPES_SET.has(fieldType) || isPluginFieldTypeOnSurface(fieldType, "forms"));
+  if (!isValidType) {
+    let fieldTypeRepr;
+    if (typeof fieldType === "object" && fieldType !== null) {
+      fieldTypeRepr = JSON.stringify(fieldType);
+    } else {
+      fieldTypeRepr = String(fieldType);
     }
-    return {
-      success: true,
-      // The created ROW, not the envelope around it. Through the shared
-      // conversion, which is where the unchecked step lives and says so; the
-      // integration test reads `submission.id` off the result because nothing
-      // at compile time will.
-      submission: asSubmissionDocument(submission.item),
-      redirect
-    };
-  } catch (error) {
-    logger.error?.("Form submission error", {
-      formSlug,
-      error: error instanceof Error ? error.message : String(error)
+    errors.push({
+      path: `${path}.type`,
+      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
+      code: "FIELD_TYPE_INVALID"
     });
-    return {
-      success: false,
-      error: "An error occurred processing your submission. Please try again."
-    };
+    return;
   }
-}
-async function fetchFormBySlug(slug, pluginConfig, pluginContext) {
-  try {
-    const { collections } = pluginContext.services;
-    const result = await collections.listEntries(
-      pluginConfig.formOverrides.slug,
-      { where: { slug: { equals: slug } }, pagination: { limit: 1 } },
-      { as: "system" }
-    );
-    const form = result.data?.[0];
-    return form ? asFormDocument(form) : null;
-  } catch {
-    return null;
+  validateFieldName(f.name, path, errors, seenNames);
+  if (fieldType !== "hidden") {
+    validateFieldLabel(f.label, path, errors);
   }
-}
-async function resolveRedirectUrl(form, pluginConfig, pluginContext) {
-  const settings = form.settings;
-  if (!settings) return void 0;
-  if (settings.confirmationType === "redirect" && settings.redirectUrl) {
-    return settings.redirectUrl;
+  validateFieldByType(field, path, errors);
+  if (f.conditionalLogic) {
+    validateConditionalLogic(field, path, errors);
   }
-  const field = pickedDocumentField(settings);
-  if (!field) return void 0;
-  return urlForPickedDocument(
-    settings[field],
-    form,
-    pluginConfig,
-    pluginContext
-  );
 }
-async function urlForPickedDocument(stored, form, pluginConfig, pluginContext) {
-  const { logger } = pluginContext;
-  const patterns = pluginConfig.redirectRelationships;
-  const reference = parseRedirectReference(stored, Object.keys(patterns));
-  if (!reference) {
-    logger.warn?.("Form redirects to a page, but names no readable document", {
-      form: form.slug
+function validateFieldsArray(fields, basePath, errors) {
+  const seenNames = /* @__PURE__ */ new Set();
+  fields.forEach((field, index) => {
+    const fieldPath = `${basePath}[${index}]`;
+    validateField(field, fieldPath, errors, seenNames);
+  });
+}
+function validateFields(fields, errors) {
+  const path = "fields";
+  if (!fields) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_REQUIRED"
     });
-    return void 0;
+    return;
   }
-  const pattern = patterns[reference.collection];
-  if (!pattern) {
-    logger.warn?.(
-      "Form redirects to a collection that is not in redirectRelationships",
-      { form: form.slug, collection: reference.collection }
-    );
-    return void 0;
+  if (!Array.isArray(fields)) {
+    errors.push({
+      path,
+      message: "Form fields must be an array",
+      code: "FIELDS_INVALID_TYPE"
+    });
+    return;
   }
-  const target = await readTarget(reference, form, pluginContext);
-  if (!target) return void 0;
-  if (documentReachability(
-    target,
-    pluginConfig.redirectTargetLocalization[reference.collection]
-  ) === "unreachable") {
-    logger.warn?.("Form redirects to a page that has never been published", {
-      form: form.slug,
-      collection: reference.collection,
-      target: reference.id
+  if (fields.length === 0) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_EMPTY"
     });
-    return void 0;
+    return;
   }
-  return buildUrl(pattern, target, reference.collection, form, pluginContext);
+  validateFieldsArray(fields, path, errors);
 }
-function buildUrl(pattern, target, collection, form, pluginContext) {
-  const { logger } = pluginContext;
-  try {
-    const url2 = applyRedirectPattern(pattern, target);
-    if (!url2) {
-      logger.warn?.(
-        "Form redirect pattern could not be filled from the target document",
-        { form: form.slug, collection }
-      );
+function validateSettings(settings, errors) {
+  if (!settings) {
+    return;
+  }
+  if (typeof settings !== "object" || Array.isArray(settings)) {
+    errors.push({
+      path: "settings",
+      message: "Form settings must be an object",
+      code: "SETTINGS_INVALID_TYPE"
+    });
+    return;
+  }
+  const s = settings;
+  if (s.confirmationType === "redirect") {
+    if (!s.redirectUrl && !s.redirectRelation) {
+      errors.push({
+        path: "settings.redirectUrl",
+        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
+        code: "REDIRECT_URL_REQUIRED"
+      });
     }
-    return url2;
-  } catch (error) {
-    logger.warn?.("Form redirect pattern threw while building a URL", {
-      form: form.slug,
-      collection,
-      error: error instanceof Error ? error.message : String(error)
+  }
+  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
+    errors.push({
+      path: "settings.redirectPage",
+      message: "A page is required when confirmation type is 'relationship'",
+      code: "REDIRECT_PAGE_REQUIRED"
     });
-    return void 0;
   }
 }
-async function readTarget(reference, form, pluginContext) {
-  const { logger } = pluginContext;
-  const context = {
-    form: form.slug,
-    collection: reference.collection,
-    id: reference.id
-  };
-  let row;
-  try {
-    row = await pluginContext.services.collections.findEntryById(
-      reference.collection,
-      reference.id,
-      { as: "system" }
-    );
-  } catch (error) {
-    logger.warn?.("Form redirect target could not be read", {
-      ...context,
-      error: error instanceof Error ? error.message : String(error)
+function namesADocument(value) {
+  if (typeof value === "string") return value.length > 0;
+  return parseRedirectReference(value, []) !== null;
+}
+function validateAccess(access, errors) {
+  if (!access) {
+    return;
+  }
+  if (typeof access !== "object" || Array.isArray(access)) {
+    errors.push({
+      path: "access",
+      message: "Access control must be an object",
+      code: "ACCESS_INVALID_TYPE"
     });
-    return void 0;
+    return;
   }
-  if (!row || typeof row !== "object") {
-    logger.warn?.("Form redirect target no longer exists", context);
-    return void 0;
+  const accessObj = access;
+  const validAccessKeys = ["submit", "read"];
+  for (const key of validAccessKeys) {
+    const fn = accessObj[key];
+    if (fn !== void 0 && typeof fn !== "function") {
+      errors.push({
+        path: `access.${key}`,
+        message: `Access control '${key}' must be a function`,
+        code: "ACCESS_FUNCTION_INVALID"
+      });
+    }
   }
-  return row;
 }
-async function validateSubmission(formSlug, data, context) {
-  const { pluginContext, pluginConfig } = context;
-  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-  if (!form) {
-    return { valid: false, errors: { _form: "Form not found" } };
-  }
-  const prepared = prepareSubmission({
-    data,
-    fields: form.fields,
-    validate: true
-  });
-  if (!prepared.validationErrors) {
-    return { valid: true };
-  }
+function validateFormConfig(config) {
+  const errors = [];
+  validateSlug(config.slug, errors);
+  validateFields(config.fields, errors);
+  validateSettings(config.settings, errors);
+  validateAccess(config.access, errors);
   return {
-    valid: false,
-    errors: prepared.validationErrors
+    valid: errors.length === 0,
+    errors
   };
 }
-async function isFormAcceptingSubmissions(formSlug, context) {
-  const { pluginContext, pluginConfig } = context;
-  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-  if (!form) {
-    return false;
-  }
-  return form.status === "published";
-}
-async function getFormSubmissionStats(formSlug, context) {
-  const { pluginContext, pluginConfig } = context;
-  const { collections } = pluginContext.services;
-  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-  if (!form) {
-    return null;
-  }
-  try {
-    const submissionsSlug = pluginConfig.formSubmissionOverrides.slug;
-    const sys = { as: "system" };
-    const base = { form: { equals: form.id } };
-    const [total, newCount, read, archived] = await Promise.all([
-      collections.count(submissionsSlug, { where: base }, sys),
-      collections.count(
-        submissionsSlug,
-        { where: { ...base, status: { equals: "new" } } },
-        sys
-      ),
-      collections.count(
-        submissionsSlug,
-        { where: { ...base, status: { equals: "read" } } },
-        sys
-      ),
-      collections.count(
-        submissionsSlug,
-        { where: { ...base, status: { equals: "archived" } } },
-        sys
-      )
-    ]);
-    return { total, new: newCount, read, archived };
-  } catch {
-    return null;
+function assertValidFormConfig(config) {
+  const result = validateFormConfig(config);
+  if (!result.valid) {
+    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
+    throw new Error(
+      `Invalid form config for '${config.slug || "unknown"}':
+${errorMessages}`
+    );
   }
 }
 
+// src/config/field-helpers.ts
+var option = (label, value) => ({
+  label,
+  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
+});
+var text3 = (config) => ({
+  ...config,
+  type: "text"
+});
+var email = (config) => ({
+  ...config,
+  type: "email"
+});
+var phone = (config) => ({
+  ...config,
+  type: "phone"
+});
+var url = (config) => ({
+  ...config,
+  type: "url"
+});
+var textarea3 = (config) => ({
+  ...config,
+  type: "textarea"
+});
+var number = (config) => ({
+  ...config,
+  type: "number"
+});
+var select3 = (config) => ({
+  ...config,
+  type: "select"
+});
+var checkbox2 = (config) => ({
+  ...config,
+  type: "checkbox"
+});
+var radio = (config) => ({
+  ...config,
+  type: "radio"
+});
+var file = (config) => ({
+  ...config,
+  type: "file"
+});
+var date3 = (config) => ({
+  ...config,
+  type: "date"
+});
+var time = (config) => ({
+  ...config,
+  type: "time"
+});
+var hidden = (config) => ({
+  ...config,
+  type: "hidden"
+});
+
 // src/handlers/webhooks.ts
 import { safeFetch, ExternalUrlError } from "nextly";
 var WEBHOOK_TIMEOUT_MS = 1e4;
@@ -2927,8 +3247,6 @@ export {
   assertValidFormConfig,
   checkSpam,
   checkbox2 as checkbox,
-  cleanupRateLimitStore,
-  clearRateLimitStore,
   createFormConfig,
   date3 as date,
   downloadFile,
@@ -2947,7 +3265,6 @@ export {
   generateZodSchema,
   getFormBuilderConfig,
   getFormSubmissionStats,
-  getRateLimitStoreSize,
   getSupportedComparisonOperators,
   getSupportedWebhookEvents,
   getValidationErrors,
@@ -2959,7 +3276,6 @@ export {
   isFormField,
   isFormFieldType,
   isKnownFormField,
-  isRateLimited,
   isSelectFormField,
   isTextFormField,
   isValidComparisonOperator,