@nextlyhq/plugin-form-builder 0.0.2-alpha.65 → 0.0.2-alpha.67

package/dist/index.js

@@ -30,14 +30,15 @@ import {
   parseRedirectReference,
   pickedDocumentField,
   pluralize,
-  toTitleCase
-} from "./chunk-W6NLZFHH.js";
+  toTitleCase,
+  warnIfWebhooksConfigured
+} from "./chunk-X5WLJLAR.js";
 
 // src/plugin.ts
 import { createRequire } from "module";
 import {
   definePlugin,
-  NextlyError as NextlyError2
+  NextlyError as NextlyError4
 } from "@nextlyhq/plugin-sdk";
 
 // src/collections/forms.ts
@@ -74,16 +75,13 @@ function applyRedirectPattern(pattern, document) {
 }
 
 // src/collections/access-defaults.ts
-var authenticated = ({ user }) => !!user;
-var administrative = ({ roles }) => roles.includes("admin") || roles.includes("super-admin");
+var permitted = ({ permissions, collection, operation }) => permissions.includes(`${collection}:${operation}`);
 function accessWithDefaults(overrides, defaults = {}) {
   return {
-    read: overrides?.read ?? defaults.read ?? authenticated,
-    create: overrides?.create ?? defaults.create ?? authenticated,
-    update: overrides?.update ?? authenticated,
-    // Deleting is administrative in both collections; the DB permission layer
-    // remains the backstop underneath it.
-    delete: overrides?.delete ?? administrative
+    read: overrides?.read ?? defaults.read ?? permitted,
+    create: overrides?.create ?? defaults.create ?? permitted,
+    update: overrides?.update ?? permitted,
+    delete: overrides?.delete ?? permitted
   };
 }
 
@@ -787,7 +785,8 @@ function submissionsCollection(pluginConfig) {
       ...overrides.admin
     },
     // Access control with sensible defaults
-    // Public can create (submit forms), but only authenticated users can read/update/delete
+    // Public can create (submit forms); reading, updating and deleting need the
+    // matching permission on the caller's role (`read-form-submissions`, ...).
     // `create: true` — a visitor submits without an account. Reading, updating
     // and deleting are the shared defaults.
     access: accessWithDefaults(accessOverrides, { create: true }),
@@ -1134,18 +1133,32 @@ function validateFormData(data, fields) {
   const schema = generateZodSchema(fields);
   return schema.safeParse(transformed);
 }
-function getValidationErrors(result) {
-  if (result.success) {
-    return {};
-  }
-  const errors = {};
-  for (const error of result.error.issues) {
-    const path = error.path.join(".");
-    if (!errors[path]) {
-      errors[path] = error.message;
-    }
+function isBlank(value) {
+  return value === void 0 || value === null || value === "" || Array.isArray(value) && value.length === 0;
+}
+function getValidationIssues(result, submitted = {}) {
+  if (result.success) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const issues = [];
+  for (const issue of result.error.issues) {
+    const path = issue.path.join(".");
+    if (seen.has(path)) continue;
+    seen.add(path);
+    issues.push({
+      path,
+      // Read at the top level, which is the only depth a form field has: a
+      // declared field is one key, so a dotted path can only come from inside a
+      // value the visitor did supply.
+      code: isBlank(submitted[path]) ? "REQUIRED" : "INVALID",
+      message: issue.message
+    });
   }
-  return errors;
+  return issues;
+}
+function getValidationErrors(result) {
+  return Object.fromEntries(
+    getValidationIssues(result).map((issue) => [issue.path, issue.message])
+  );
 }
 
 // src/handlers/prepare-submission.ts
@@ -1203,1724 +1216,1846 @@ function prepareSubmission({
   }
   const result = generateZodSchema(fields).safeParse(transformed);
   if (!result.success) {
-    return { data: transformed, validationErrors: getValidationErrors(result) };
+    return {
+      data: transformed,
+      validationErrors: getValidationErrors(result),
+      // The RAW submission, not the transformed payload. Transformation
+      // normalises a value before the schema sees it, so a required
+      // multi-select sent a scalar `0` arrives here as `[]` and would read as
+      // blank: the visitor answered, and would be told they had not.
+      validationIssues: getValidationIssues(result, data)
+    };
   }
   return { data: result.data };
 }
 
-// src/plugin.ts
-var { version: PLUGIN_VERSION } = createRequire(import.meta.url)(
-  "../package.json"
-);
-function resolveConfig(options) {
-  const formOverrides = options.formOverrides || {};
-  const submissionOverrides = options.formSubmissionOverrides || {};
-  return {
-    formOverrides: {
-      ...formOverrides,
-      slug: formOverrides.slug || "forms",
-      labels: {
-        singular: formOverrides.labels?.singular || "Form",
-        plural: formOverrides.labels?.plural || "Forms"
-      }
-    },
-    formSubmissionOverrides: {
-      ...submissionOverrides,
-      slug: submissionOverrides.slug || "form-submissions",
-      labels: {
-        singular: submissionOverrides.labels?.singular || "Submission",
-        plural: submissionOverrides.labels?.plural || "Submissions"
+// src/handlers/spam-detection.ts
+import { RateLimiter, resolveRateLimitStore } from "nextly";
+async function checkSpam(options) {
+  const { data, ipAddress, formSlug, config } = options;
+  if (config.honeypot) {
+    const honeypotResult = checkHoneypot(data);
+    if (honeypotResult.isSpam) {
+      return honeypotResult;
+    }
+  }
+  if (config.rateLimit && ipAddress) {
+    const rateLimitResult = await checkRateLimit(
+      ipAddress,
+      formSlug,
+      config.rateLimit
+    );
+    if (rateLimitResult.isSpam) {
+      return rateLimitResult;
+    }
+  }
+  return { isSpam: false };
+}
+var HONEYPOT_FIELDS = [
+  "__honeypot",
+  "_honeypot",
+  "honeypot",
+  "__hp",
+  "_hp",
+  "website",
+  // Common honeypot field name
+  "url_field",
+  // Another common honeypot
+  "fax_number"
+  // Rarely used by humans
+];
+function checkHoneypot(data) {
+  for (const fieldName of HONEYPOT_FIELDS) {
+    const value = data[fieldName];
+    if (value !== void 0 && value !== null && value !== "") {
+      let raw;
+      if (typeof value === "object") {
+        raw = JSON.stringify(value);
+      } else {
+        raw = String(value);
       }
-    },
-    fields: {
-      text: options.fields?.text ?? true,
-      email: options.fields?.email ?? true,
-      number: options.fields?.number ?? true,
-      phone: options.fields?.phone ?? true,
-      url: options.fields?.url ?? true,
-      textarea: options.fields?.textarea ?? true,
-      select: options.fields?.select ?? true,
-      checkbox: options.fields?.checkbox ?? true,
-      radio: options.fields?.radio ?? true,
-      file: options.fields?.file ?? true,
-      date: options.fields?.date ?? true,
-      time: options.fields?.time ?? true,
-      hidden: options.fields?.hidden ?? true
-    },
-    redirectRelationships: normalizeRedirectRelationships(
-      options.redirectRelationships
-    ),
-    // Filled at `init` from each collection's own metadata. Empty until then,
-    // and a slug that stays absent reads as unknown rather than as not
-    // localized — see `ResolvedFormBuilderConfig`.
-    redirectTargetLocalization: {},
-    beforeEmail: options.beforeEmail,
-    notifications: {
-      defaultFrom: options.notifications?.defaultFrom,
-      defaultToEmail: options.notifications?.defaultToEmail,
-      enabled: options.notifications?.enabled ?? true
-    },
-    spamProtection: {
-      honeypot: options.spamProtection?.honeypot ?? true,
-      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
-      rateLimit: {
-        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
-        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
+      const stringValue = raw.trim();
+      if (stringValue.length > 0) {
+        return {
+          isSpam: true,
+          reason: "honeypot",
+          details: `Honeypot field "${fieldName}" was filled`
+        };
       }
-    },
-    uploads: {
-      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
-      // 10 MB
-      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
-        "image/*",
-        "application/pdf",
-        "text/*"
-      ],
-      uploadCollection: options.uploads?.uploadCollection ?? "media"
-    },
-    features: {
-      builder: options.features?.builder ?? true,
-      conditionalLogic: options.features?.conditionalLogic ?? true,
-      fileUploads: options.features?.fileUploads ?? true
     }
+  }
+  return { isSpam: false };
+}
+async function checkRateLimit(ipAddress, formSlug, config) {
+  const limiter = new RateLimiter(resolveRateLimitStore());
+  const result = await limiter.check(
+    `form-submit:${formSlug}:${ipAddress}`,
+    config.maxSubmissions,
+    config.windowMs
+  );
+  if (result.allowed) return { isSpam: false };
+  return {
+    isSpam: true,
+    reason: "rate_limit",
+    details: `Rate limit exceeded: ${config.maxSubmissions} per ${config.windowMs}ms`
   };
 }
-function formBuilder(options = {}) {
-  const resolvedConfig = resolveConfig(options);
-  const formsCol = formsCollection(resolvedConfig);
-  const submissionsCol = submissionsCollection(resolvedConfig);
-  const plugin = definePlugin({
-    name: "@nextlyhq/plugin-form-builder",
-    version: PLUGIN_VERSION,
-    nextly: ">=0.0.2-alpha.21",
-    // Identity metadata for the admin plugins page, mirroring package.json.
-    author: "Nextly",
-    homepage: "https://nextlyhq.com",
-    repository: "https://github.com/nextlyhq/nextly",
-    license: "MIT",
-    category: "forms",
-    tags: ["forms", "submissions", "email-notifications"],
-    // Declarative schema: the merged pipeline folds these into the
-    // app schema — no manual `setup()` append needed. Just register the plugin.
-    contributes: {
-      collections: [formsCol, submissionsCol],
-      // Custom permission — gates submission export beyond CRUD. The
-      // canonical example third-party plugin authors copy.
-      permissions: [
-        {
-          action: "export",
-          resource: "submissions",
-          label: "Export Submissions",
-          description: "Export form submissions as CSV/JSON",
-          // No `group`: the admin already files this under the plugin that
-          // declared it, so naming the plugin again would nest it inside
-          // itself. `group` is for a plugin with enough permissions to sort
-          // its own into headings, which one is not.
-          //
-          // `danger` because the point of the permission is to take
-          // submissions — names, emails, whatever a form asked for — out of
-          // the site in a file.
-          danger: true
-        }
-      ],
-      // HTTP route — exported at
-      // /api/plugins/@nextlyhq/plugin-form-builder/submissions/export. Secure by
-      // default: gated by the custom `export-submissions` permission. Reads
-      // via the secure-by-default service path as the authed user and
-      // resolves its OWN slug through `ctx.self`. The canonical
-      // contributes.routes example for third-party authors.
-      routes: [
+
+// src/routes/public-forms.ts
+import {
+  buildPaginatedResponse,
+  clampLimit,
+  formAvailability as formAvailability2,
+  NextlyError as NextlyError3,
+  NO_SUCH_FORM as NO_SUCH_FORM2,
+  respondAction,
+  respondDoc,
+  respondList,
+  trustedClientIp
+} from "nextly";
+
+// src/handlers/submit-form.ts
+import { isLocaleSelector } from "@nextlyhq/plugin-sdk";
+import { formAvailability, NextlyError as NextlyError2, NO_SUCH_FORM } from "nextly";
+async function submitForm(options, context) {
+  const { formSlug, data, metadata, request } = options;
+  const access = options.access ?? { as: "system" };
+  const locale = visitorLocale(options.locale);
+  const targetRead = { access, locale, request };
+  const { pluginContext, pluginConfig } = context;
+  const { collections } = pluginContext.services;
+  const { logger } = pluginContext;
+  try {
+    const form = await fetchFormBySlug(
+      formSlug,
+      pluginConfig,
+      pluginContext,
+      access
+    );
+    if (!form) {
+      logger.warn?.("Form submission attempted for non-existent form", {
+        formSlug
+      });
+      return { success: false, outcome: "no-such-form", error: NO_SUCH_FORM };
+    }
+    const redirectFor = () => resolveRedirectUrl(form, pluginConfig, pluginContext, targetRead);
+    const availability = formAvailability(form);
+    if (availability.kind !== "open") {
+      logger.info?.("Form submission rejected - form not accepting", {
+        formSlug,
+        status: form.status,
+        availability: availability.kind
+      });
+      return {
+        success: false,
+        outcome: availability.kind === "closed" ? "closed" : "no-such-form",
+        error: availability.kind === "closed" ? availability.message : NO_SUCH_FORM
+      };
+    }
+    const settings = normalizeFormSettings(form.settings);
+    if (settings.allowMultipleSubmissions === false && !metadata?.ipAddress) {
+      logger.warn?.(
+        "Single-submission form received a submission without an IP \u2014 the restriction cannot apply",
+        { formSlug }
+      );
+    }
+    if (settings.allowMultipleSubmissions === false && metadata?.ipAddress) {
+      const existing = await collections.count(
+        pluginConfig.formSubmissionOverrides.slug,
         {
-          method: "GET",
-          path: "/submissions/export",
-          requiredPermission: "export-submissions",
-          handler: async (req, ctx) => {
-            const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
-            const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
-            const url2 = new URL(req.url);
-            const format = url2.searchParams.get("format") ?? "json";
-            const formId = url2.searchParams.get("form");
-            const status = url2.searchParams.get("status");
-            const where = {};
-            if (formId) where.form = { equals: formId };
-            if (status) where.status = { equals: status };
-            else where.status = { not_equals: "spam" };
-            const opts = { as: "user", user: ctx.user ?? void 0 };
-            let form;
-            if (format === "csv") {
-              if (!formId) {
-                return Response.json(
-                  {
-                    error: {
-                      code: "VALIDATION_ERROR",
-                      message: "CSV export requires a form parameter."
-                    }
-                  },
-                  { status: 400 }
-                );
-              }
-              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
-              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
-              const formResult = await ctx.services.collections.listEntries(
-                formsSlug,
-                { where: { id: { equals: formId } } },
-                opts
-              );
-              form = formResult.data[0];
-              if (!form) {
-                return Response.json(
-                  { error: { code: "NOT_FOUND", message: "Form not found." } },
-                  { status: 404 }
-                );
-              }
-            }
-            const MAX_EXPORT_ROWS = 5e4;
-            const items = [];
-            const pageSize = 200;
-            let truncated = false;
-            for (let page = 1; ; page += 1) {
-              const result = await ctx.services.collections.listEntries(
-                slug,
-                { where, pagination: { limit: pageSize, page } },
-                opts
-              );
-              items.push(...result.data);
-              const pageWasFull = result.data.length === pageSize;
-              if (items.length >= MAX_EXPORT_ROWS) {
-                truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
-                items.length = MAX_EXPORT_ROWS;
-                break;
-              }
-              if (!pageWasFull) break;
-            }
-            const truncationHeaders = truncated ? { "X-Export-Truncated": "true" } : {};
-            if (format !== "csv" || !form) {
-              return Response.json({ items }, { headers: truncationHeaders });
-            }
-            const csv = exportToCSV(
-              asSubmissionDocuments(items),
-              asFormDocument(form)
-            );
-            const filename = generateExportFilename(
-              typeof form.slug === "string" ? form.slug : "form",
-              "csv"
-            );
-            return new Response(csv, {
-              headers: {
-                "Content-Type": "text/csv; charset=utf-8",
-                "Content-Disposition": `attachment; filename="${filename}"`,
-                ...truncationHeaders
-              }
-            });
+          where: {
+            form: { equals: form.id },
+            ipAddress: { equals: metadata.ipAddress },
+            status: { not_equals: "spam" }
           }
         },
-        {
-          // The builder UI reads the host's resolved field enable/disable map
-          // from here, so the plugin option actually gates the type picker.
-          // Options resolve server-side only; this is the one channel the
-          // admin client has to them.
-          method: "GET",
-          path: "/builder-config",
-          // Derived from the forms slug like the menu entry: with an
-          // overridden slug, users hold read-<slug>, not read-forms.
-          requiredPermission: `read-${resolvedConfig.formOverrides.slug}`,
-          handler: (_req, ctx) => Promise.resolve(
-            Response.json({
-              fields: resolvedConfig.fields,
-              // Notification defaults the builder surfaces: defaultToEmail
-              // seeds a new form's first rule, defaultFrom renders as the
-              // inherited sender placeholder.
-              notifications: {
-                defaultFrom: resolvedConfig.notifications.defaultFrom,
-                defaultToEmail: resolvedConfig.notifications.defaultToEmail
-              },
-              // Spam defaults the Settings tab surfaces, so per-form
-              // override selects can show what "inherit" resolves to.
-              spamProtection: {
-                honeypot: resolvedConfig.spamProtection.honeypot,
-                recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false
-              },
-              // Runtime-resolved collection slugs (through ctx.self, so a
-              // framework .rename() is honored too) — admin components
-              // never hardcode "forms"/"form-submissions".
-              // Names only. A pattern may be a function, which does not
-              // survive JSON and which the browser has no use for — the
-              // admin picks a document, the server builds the URL.
-              redirectCollections: Object.keys(
-                resolvedConfig.redirectRelationships
-              ),
-              slugs: {
-                forms: ctx.self.collections[resolvedConfig.formOverrides.slug] ?? resolvedConfig.formOverrides.slug,
-                submissions: ctx.self.collections[resolvedConfig.formSubmissionOverrides.slug] ?? resolvedConfig.formSubmissionOverrides.slug
-              }
-            })
-          )
-        }
-      ]
-    },
-    // Forms is a first-class destination, not a plugin detail: standalone
-    // placement gives it its own main-rail icon after Media, and its
-    // sub-sidebar lists the plugin's collections (Forms, Submissions) —
-    // no separate menu contribution, so "Forms" exists exactly once.
-    // Hosts preferring the Plugins section override placement in config.
-    // (The old admin.settings.component that rendered a second full builder
-    // at /admin/plugins/<slug> is gone; the collection Edit-view override
-    // is the single FormBuilderView mount.)
-    admin: {
-      placement: "standalone",
-      after: "media",
-      order: 50,
-      appearance: { icon: "FileText", label: "Forms" },
-      description: "Create and manage forms with submission tracking"
-    },
-    // -- Init ----------------------------------------------------------------
-    // Registers an afterCreate hook on submissions to send email notifications.
-    async init(nextly) {
-      const declaredSubmissionsSlug = resolvedConfig.formSubmissionOverrides.slug;
-      const submissionSlug = nextly.self.collections[declaredSubmissionsSlug] ?? declaredSubmissionsSlug;
-      nextly.logger.info("Form Builder plugin initialized", {
-        formsCollection: resolvedConfig.formOverrides.slug,
-        submissionsCollection: submissionSlug,
-        enabledFields: Object.entries(resolvedConfig.fields).filter(([, on]) => on).map(([name]) => name)
-      });
-      for (const slug of Object.keys(
-        resolvedConfig.redirectTargetLocalization
-      )) {
-        delete resolvedConfig.redirectTargetLocalization[slug];
-      }
-      await Promise.all(
-        Object.keys(resolvedConfig.redirectRelationships).map(
-          async (declared) => {
-            const slug = nextly.self.collections[declared] ?? declared;
-            try {
-              const collection = await nextly.services.collections.getCollection(slug, {});
-              const localized = collection?.localized;
-              if (typeof localized === "boolean") {
-                resolvedConfig.redirectTargetLocalization[declared] = localized;
-              }
-            } catch {
-              nextly.logger.debug?.(
-                "Redirect target localization could not be read",
-                { collection: slug }
-              );
-            }
-          }
-        )
+        // Deliberately elevated, unlike the write below. This counts rows the
+        // visitor is not entitled to see in order to refuse their second
+        // submission; judged as the public it would count zero on any install
+        // that hides submissions and the restriction would never apply.
+        { as: "system" }
       );
-      nextly.__formBuilderConfig = resolvedConfig;
-      if (resolvedConfig.beforeEmail) {
-        nextly.filters.add(
-          "form-builder.beforeEmail",
-          (emails, ctx) => resolvedConfig.beforeEmail({
-            emails,
-            // Boundary: loose runtime documents → the user's typed contract.
-            form: asFormDocument(ctx.form),
-            submission: asSubmissionDocument(ctx.submission)
-          })
-        );
+      if (existing > 0) {
+        logger.info?.("Repeat submission rejected (single-submission form)", {
+          formSlug,
+          ipAddress: metadata.ipAddress
+        });
+        return {
+          success: false,
+          outcome: "duplicate",
+          error: "You have already submitted this form."
+        };
       }
-      const declaredFormsSlug = resolvedConfig.formOverrides.slug;
-      const formsSlug = nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug;
-      nextly.hooks.on(
-        "beforeChange",
-        submissionSlug,
-        async (context) => prepareSubmissionForWrite(context, formsSlug, nextly)
-      );
-      nextly.hooks.on(
-        "afterCreate",
-        submissionSlug,
-        async (context) => {
-          await handleSubmissionCreated(context, resolvedConfig, nextly);
-        }
-      );
-      nextly.hooks.on("beforeUpdate", submissionSlug, (context) => {
-        const ctx = context;
-        if (ctx.data && ctx.data.data !== void 0) {
-          ctx.data.editedAt = /* @__PURE__ */ new Date();
-          ctx.data.editedBy = ctx.user?.id ?? null;
-        }
-        return ctx.data;
-      });
-      nextly.hooks.on(
-        "afterRead",
-        formsSlug,
-        (context) => injectSubmissionCount(context, submissionSlug, nextly)
-      );
     }
-  });
-  return {
-    plugin,
-    collections: [formsCol, submissionsCol],
-    config: resolvedConfig
-  };
-}
-function getFormBuilderConfig(nextly) {
-  if (!nextly || typeof nextly !== "object") return void 0;
-  return nextly.__formBuilderConfig;
-}
-function resolveFieldRef(ref, data) {
-  const name = parseFieldRef(ref);
-  if (name === null) return ref;
-  const value = data[name];
-  return typeof value === "string" ? value : "";
-}
-function collectAttachmentInputs(fields, submittedData) {
-  const attachments = [];
-  for (const field of fields) {
-    if (field.type !== "file" || !field.attachToEmail) continue;
-    const name = field.name;
-    const value = submittedData[name];
-    if (value == null) continue;
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        if (typeof item === "string" && item) {
-          attachments.push({ mediaId: item });
-        }
+    const declaredFieldNames = new Set(form.fields.map((field) => field.name));
+    const undeclaredData = Object.fromEntries(
+      Object.entries(data).filter(([key]) => !declaredFieldNames.has(key))
+    );
+    const spamResult = await checkSpam({
+      data: undeclaredData,
+      formSlug,
+      config: {
+        // Per-form overrides win where set; blank inherits the plugin config.
+        honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot
       }
-    } else if (typeof value === "string" && value) {
-      attachments.push({ mediaId: value });
-    }
-  }
-  return attachments;
-}
-function parseJsonColumn(value) {
-  if (typeof value === "string") {
-    try {
-      const parsed = JSON.parse(value);
-      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-    } catch {
-      return {};
+    });
+    const isContentSpam = spamResult.isSpam;
+    if (isContentSpam) {
+      logger.info?.("Spam submission detected \u2014 storing flagged", {
+        formSlug,
+        reason: spamResult.reason,
+        ipAddress: metadata?.ipAddress
+      });
     }
-  }
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function normalizeAddressList(addresses) {
-  if (!Array.isArray(addresses)) return void 0;
-  const cleaned = addresses.map((address) => typeof address === "string" ? address.trim() : "").filter(Boolean);
-  return cleaned.length > 0 ? cleaned : void 0;
-}
-function buildNotificationEmails(input) {
-  const { notifications, submittedData, formName, submissionId, defaultFrom } = input;
-  const seen = /* @__PURE__ */ new Set();
-  const emails = [];
-  const skipped = [];
-  for (const notification of notifications) {
-    if (!notification.enabled) continue;
-    if (!notification.templateSlug) {
-      skipped.push({ notificationId: notification.id, reason: "no-template" });
-      continue;
-    }
-    const key = notification.id || JSON.stringify(notification);
-    if (seen.has(key)) continue;
-    seen.add(key);
-    if (notification.condition && !evaluateSingleCondition(notification.condition, submittedData)) {
-      skipped.push({
-        notificationId: notification.id,
-        reason: "condition-unmet"
-      });
-      continue;
-    }
-    const to = (notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to).trim();
-    if (!to) {
-      skipped.push({
-        notificationId: notification.id,
-        reason: "empty-recipient"
+    const prepared = prepareSubmission({
+      data,
+      fields: form.fields,
+      validate: !isContentSpam
+    });
+    if (prepared.validationErrors) {
+      logger.debug?.("Form validation failed", {
+        formSlug,
+        errors: prepared.validationErrors
       });
-      continue;
+      return {
+        success: false,
+        outcome: "invalid",
+        error: "Validation failed",
+        validationErrors: prepared.validationErrors,
+        validationIssues: prepared.validationIssues
+      };
     }
-    const cc = normalizeAddressList(notification.cc);
-    const bcc = normalizeAddressList(notification.bcc);
-    const from = notification.senderEmail?.trim() || defaultFrom?.trim() || void 0;
-    const replyTo = notification.replyTo ? resolveFieldRef(notification.replyTo, submittedData).trim() || void 0 : void 0;
-    emails.push({
-      to,
-      templateSlug: notification.templateSlug,
-      variables: {
-        ...submittedData,
-        formName,
-        submissionId
-      },
-      providerId: notification.providerId,
-      from,
-      replyTo,
-      cc,
-      bcc,
-      notificationId: notification.id
-    });
-  }
-  return { emails, skipped };
-}
-function parentFormId(submission) {
-  const raw = submission.form;
-  if (typeof raw === "string") return raw;
-  if (raw && typeof raw === "object") {
-    const maybeId = raw.id;
-    if (typeof maybeId === "string") return maybeId;
-  }
-  return null;
-}
-function submittedPayload(raw) {
-  if (typeof raw === "string") {
+    const storedData = prepared.data;
+    const submissionData = {
+      form: form.id,
+      data: storedData,
+      status: isContentSpam ? "spam" : "new",
+      spamReason: isContentSpam ? spamResult.reason ?? null : null,
+      ipAddress: metadata?.ipAddress || null,
+      userAgent: metadata?.userAgent || null,
+      submittedAt: /* @__PURE__ */ new Date()
+    };
+    let submission;
     try {
-      const parsed = JSON.parse(raw);
-      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-        return parsed;
+      submission = await collections.createEntry(
+        pluginConfig.formSubmissionOverrides.slug,
+        asPluginSubmission(submissionData, {
+          keepAsEvidence: isContentSpam,
+          form: { id: form.id, fields: form.fields }
+        }),
+        // Public form submission — create as system. No ambient user; an
+        // empty context already resolves to system, but be explicit.
+        //
+        // The request travels with it so the seam judges this submission on the
+        // same facts as one arriving through a Nextly route. Omitted by a caller
+        // that has none, and then the seam correctly reads the write as
+        // server-side work.
+        //
+        // `access` rather than a fixed `system`, so a route serving an anonymous
+        // visitor is still judged against the collection's own create rule. A
+        // host that closed public submissions configured that on the
+        // collection, and a write elevated past it reports a 201 for a
+        // submission they had refused.
+        { ...access, ...request ? { request } : {} }
+      );
+    } catch (error) {
+      if (NextlyError2.isRateLimited(error)) {
+        logger.info?.("Form submission refused (rate limit)", { formSlug });
+        return {
+          success: true,
+          outcome: "accepted",
+          successMessage: settings.successMessage,
+          // The same destination an accepted submission gets. Returning early
+          // without it left a throttled visitor on the form instead of the
+          // page its author sends people to, and made the one response this
+          // whole branch exists to disguise the only accepted one carrying no
+          // redirect.
+          redirect: await redirectFor()
+        };
       }
-    } catch {
+      throw error;
     }
-  } else if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-    return raw;
+    logger.info?.("Form submission created successfully", {
+      formSlug,
+      submissionId: submission.item.id,
+      flaggedAsSpam: isContentSpam
+    });
+    if (submission.warnings) {
+      logger.warn?.("Form submission side effects failed", {
+        formSlug,
+        submissionId: submission.item.id,
+        warnings: submission.warnings
+      });
+    }
+    const redirect = await redirectFor();
+    if (isContentSpam) {
+      return {
+        success: true,
+        outcome: "accepted",
+        successMessage: settings.successMessage,
+        redirect
+      };
+    }
+    return {
+      success: true,
+      outcome: "accepted",
+      successMessage: settings.successMessage,
+      // The created ROW, not the envelope around it. Through the shared
+      // conversion, which is where the unchecked step lives and says so; the
+      // integration test reads `submission.id` off the result because nothing
+      // at compile time will.
+      submission: asSubmissionDocument(submission.item),
+      redirect
+    };
+  } catch (error) {
+    logger.error?.("Form submission error", {
+      formSlug,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return {
+      success: false,
+      outcome: "failed",
+      error: "An error occurred processing your submission. Please try again.",
+      cause: error
+    };
   }
-  throw NextlyError2.validation({
-    errors: [
-      {
-        path: "data",
-        code: "INVALID",
-        message: "Submission data must be an object."
-      }
-    ]
-  });
 }
-function updateNeedsChecking(submission, stored) {
-  if (submission.data !== void 0) return true;
-  if (stored?.data === void 0) return false;
-  if (submission.form !== void 0) return true;
-  return stored.status === "spam" && submission.status !== void 0 && submission.status !== "spam";
+async function fetchFormBySlug(slug, pluginConfig, pluginContext, access = { as: "system" }) {
+  const { collections } = pluginContext.services;
+  const result = await collections.listEntries(
+    pluginConfig.formOverrides.slug,
+    { where: { slug: { equals: slug } }, pagination: { limit: 1 } },
+    access
+  );
+  const form = result.data?.[0];
+  return form ? asFormDocument(form) : null;
 }
-async function prepareSubmissionForWrite(context, formsSlug, nextly) {
-  const ctx = context;
-  const submission = ctx.data;
-  if (!submission || typeof submission !== "object") return ctx.data;
-  const stored = ctx.originalData;
-  const formId = parentFormId(submission) ?? (stored ? parentFormId(stored) : null);
-  if (!formId) return ctx.data;
-  if (ctx.operation !== "create" && !updateNeedsChecking(submission, stored)) {
-    return ctx.data;
+async function resolveRedirectUrl(form, pluginConfig, pluginContext, read) {
+  const settings = form.settings;
+  if (!settings) return void 0;
+  if (settings.confirmationType === "redirect" && settings.redirectUrl) {
+    return settings.redirectUrl;
   }
-  const incoming = submittedPayload(
-    submission.data !== void 0 ? submission.data : stored?.data
+  const field = pickedDocumentField(settings);
+  if (!field) return void 0;
+  return urlForPickedDocument(
+    settings[field],
+    form,
+    pluginConfig,
+    pluginContext,
+    read
   );
-  const marks = submissionMarks(submission);
-  const fields = await fieldsToCheckAgainst(marks, formsSlug, formId, nextly);
-  const prepared = prepareSubmission({
-    data: incoming,
-    fields,
-    validate: marks?.keepAsEvidence !== true
-  });
-  if (prepared.validationErrors) {
-    throw NextlyError2.validation({
-      errors: Object.entries(prepared.validationErrors).map(
-        ([path, message]) => ({ path, code: "INVALID", message })
-      )
+}
+async function urlForPickedDocument(stored, form, pluginConfig, pluginContext, read) {
+  const { logger } = pluginContext;
+  const patterns = pluginConfig.redirectRelationships;
+  const reference = parseRedirectReference(stored, Object.keys(patterns));
+  if (!reference) {
+    logger.warn?.("Form redirects to a page, but names no readable document", {
+      form: form.slug
     });
+    return void 0;
   }
-  ctx.data = { ...submission, data: prepared.data };
-  if (ctx.operation !== "create" && submission.data === void 0) {
-    stampDerivedEdit(ctx.data, ctx.user, incoming, prepared.data);
+  const pattern = patterns[reference.collection];
+  if (!pattern) {
+    logger.warn?.(
+      "Form redirects to a collection that is not in redirectRelationships",
+      { form: form.slug, collection: reference.collection }
+    );
+    return void 0;
   }
-  return ctx.data;
+  const target = await readTarget(reference, form, pluginContext, read);
+  if (!target) return void 0;
+  if (documentReachability(
+    target,
+    pluginConfig.redirectTargetLocalization[reference.collection]
+  ) === "unreachable") {
+    logger.warn?.("Form redirects to a page that has never been published", {
+      form: form.slug,
+      collection: reference.collection,
+      target: reference.id
+    });
+    return void 0;
+  }
+  return buildUrl(pattern, target, reference.collection, form, pluginContext);
 }
-async function fieldsToCheckAgainst(marks, formsSlug, formId, nextly) {
-  const handedOver = marks?.form?.id === formId ? marks.form : null;
-  const form = handedOver ?? await fetchParentForm(formsSlug, formId, nextly);
-  if (!form || !Array.isArray(form.fields)) {
-    throw NextlyError2.validation({
-      errors: [
-        {
-          path: "form",
-          code: "INVALID",
-          message: "The form this submission belongs to could not be read, so the submission could not be checked against it."
-        }
-      ]
+function buildUrl(pattern, target, collection, form, pluginContext) {
+  const { logger } = pluginContext;
+  try {
+    const url2 = applyRedirectPattern(pattern, target);
+    if (!url2) {
+      logger.warn?.(
+        "Form redirect pattern could not be filled from the target document",
+        { form: form.slug, collection }
+      );
+    }
+    return url2;
+  } catch (error) {
+    logger.warn?.("Form redirect pattern threw while building a URL", {
+      form: form.slug,
+      collection,
+      error: error instanceof Error ? error.message : String(error)
     });
+    return void 0;
   }
-  return form.fields;
 }
-function stampDerivedEdit(row, user, before, after) {
-  if (sameSubmittedPayload(before, after)) return;
-  row.editedAt = /* @__PURE__ */ new Date();
-  row.editedBy = user?.id ?? null;
+function visitorLocale(locale) {
+  if (locale === void 0 || isLocaleSelector(locale)) return void 0;
+  return locale;
 }
-async function handleSubmissionCreated(context, config, nextly) {
-  if (!config.notifications.enabled) return;
-  const submission = context.data;
-  if (!submission) return;
-  if (submission.status === "spam") return;
-  const formId = parentFormId(submission);
-  if (!formId) return;
-  const declaredFormsSlug = config.formOverrides.slug;
-  const form = await fetchParentForm(
-    nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug,
-    formId,
-    nextly
-  );
-  if (!form) return;
-  const notifications = Array.isArray(form.notifications) ? form.notifications : [];
-  if (notifications.length === 0) return;
-  const emailService = nextly.services.email;
-  if (!emailService) return;
-  const submittedData = parseJsonColumn(submission.data);
-  const formFields = Array.isArray(form.fields) ? form.fields : [];
-  const fileAttachments = collectAttachmentInputs(formFields, submittedData);
-  const { emails, skipped } = buildNotificationEmails({
-    notifications,
-    submittedData,
-    formName: form.name,
-    submissionId: submission.id,
-    defaultFrom: config.notifications.defaultFrom
-  });
-  for (const skip of skipped) {
-    if (skip.reason === "empty-recipient") {
-      nextly.logger.warn?.(
-        "Form Builder: empty recipient, skipping notification",
-        { notificationId: skip.notificationId, formSlug: form.slug }
-      );
-    } else {
-      nextly.logger.debug?.("Form Builder: notification skipped", {
-        notificationId: skip.notificationId,
-        formSlug: form.slug,
-        reason: skip.reason
-      });
-    }
+async function readTarget(reference, form, pluginContext, read) {
+  const { logger } = pluginContext;
+  const context = {
+    form: form.slug,
+    collection: reference.collection,
+    id: reference.id
+  };
+  let row;
+  try {
+    row = await pluginContext.services.collections.findEntryById(
+      reference.collection,
+      reference.id,
+      { ...read.access, locale: read.locale, request: read.request }
+    );
+  } catch (error) {
+    logger.warn?.("Form redirect target could not be read", {
+      ...context,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return void 0;
   }
-  if (emails.length === 0) return;
-  const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, { form, submission });
-  for (const email2 of finalEmails) {
-    try {
-      await emailService.sendWithTemplate(
-        email2.templateSlug,
-        email2.to,
-        email2.variables,
-        {
-          providerId: email2.providerId,
-          from: email2.from,
-          replyTo: email2.replyTo,
-          cc: email2.cc,
-          bcc: email2.bcc,
-          attachments: fileAttachments.length > 0 ? fileAttachments : void 0
-        }
-      );
-      nextly.logger.info?.("Form Builder: notification sent", {
-        formSlug: form.slug,
-        to: email2.to,
-        templateSlug: email2.templateSlug,
-        notificationId: email2.notificationId,
-        attachmentCount: fileAttachments.length
-      });
-    } catch (err) {
-      nextly.logger.error?.("Form Builder: notification failed", {
-        to: email2.to,
-        templateSlug: email2.templateSlug,
-        notificationId: email2.notificationId,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
+  if (!row || typeof row !== "object") {
+    logger.warn?.("Form redirect target no longer exists", context);
+    return void 0;
   }
+  return row;
 }
-async function injectSubmissionCount(context, submissionSlug, nextly) {
-  const hook = context;
-  if (hook.context?.[SCHEMA_ONLY_READ] === true) return;
-  const records = Array.isArray(hook.data) ? hook.data : hook.data ? [hook.data] : [];
-  await Promise.all(
-    records.map(async (record) => {
-      const form = record;
-      if (typeof form.id !== "string") return;
-      try {
-        form.submissionCount = await nextly.services.collections.count(
-          submissionSlug,
-          {
-            where: {
-              form: { equals: form.id },
-              status: { not_equals: "spam" }
-            }
-          },
-          { as: "system" }
-        );
-      } catch {
-        form.submissionCount = 0;
-      }
-    })
-  );
+async function validateSubmission(formSlug, data, context) {
+  const { pluginContext, pluginConfig } = context;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return { valid: false, errors: { _form: "Form not found" } };
+  }
+  const prepared = prepareSubmission({
+    data,
+    fields: form.fields,
+    validate: true
+  });
+  if (!prepared.validationErrors) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    errors: prepared.validationErrors
+  };
 }
-var SCHEMA_ONLY_READ = "formBuilder.schemaOnlyRead";
-async function fetchParentForm(formsSlug, formId, nextly) {
+async function isFormAcceptingSubmissions(formSlug, context) {
+  const { pluginContext, pluginConfig } = context;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return false;
+  }
+  return form.status === "published";
+}
+async function getFormSubmissionStats(formSlug, context) {
+  const { pluginContext, pluginConfig } = context;
+  const { collections } = pluginContext.services;
+  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
+  if (!form) {
+    return null;
+  }
   try {
-    const form = await nextly.services.collections.findEntryById(
-      formsSlug,
-      formId,
-      { as: "system", context: { [SCHEMA_ONLY_READ]: true } }
-    );
-    return form;
-  } catch (err) {
-    if (!NextlyError2.isNotFound(err)) throw err;
-    nextly.logger.error?.("Form Builder: form not found", {
-      formId,
-      error: err instanceof Error ? err.message : String(err)
-    });
+    const submissionsSlug = pluginConfig.formSubmissionOverrides.slug;
+    const sys = { as: "system" };
+    const base = { form: { equals: form.id } };
+    const [total, newCount, read, archived] = await Promise.all([
+      collections.count(submissionsSlug, { where: base }, sys),
+      collections.count(
+        submissionsSlug,
+        { where: { ...base, status: { equals: "new" } } },
+        sys
+      ),
+      collections.count(
+        submissionsSlug,
+        { where: { ...base, status: { equals: "read" } } },
+        sys
+      ),
+      collections.count(
+        submissionsSlug,
+        { where: { ...base, status: { equals: "archived" } } },
+        sys
+      )
+    ]);
+    return { total, new: newCount, read, archived };
+  } catch {
     return null;
   }
 }
 
-// src/config/validate-form.ts
-import { isPluginFieldTypeOnSurface } from "nextly";
-var RESERVED_FORM_SLUGS = [
-  // API routes
-  "api",
-  "submit",
-  "submissions",
-  "export",
-  // System slugs
-  "admin",
-  "new",
-  "create",
-  "edit",
-  "delete"
-];
-var RESERVED_SLUGS_SET = new Set(RESERVED_FORM_SLUGS);
-var SLUG_PATTERN = /^[a-z][a-z0-9_-]*$/;
-var FIELD_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
-var VALID_FIELD_TYPES = BUILT_IN_FORM_FIELD_TYPES;
-var VALID_FIELD_TYPES_SET = new Set(VALID_FIELD_TYPES);
-function isReservedSlug(slug) {
-  return RESERVED_SLUGS_SET.has(slug.toLowerCase());
+// src/routes/public-forms.ts
+var PUBLIC = { as: "public" };
+var DEFAULT_LIST_LIMIT = 100;
+var DEFAULT_SUCCESS_MESSAGE = "Thank you for your submission!";
+function installedSlugs(config, self) {
+  const declaredForms = config.formOverrides.slug;
+  const declaredSubmissions = config.formSubmissionOverrides.slug;
+  return {
+    forms: self.collections[declaredForms] ?? declaredForms,
+    submissions: self.collections[declaredSubmissions] ?? declaredSubmissions
+  };
 }
-function validateSlug(slug, errors) {
-  const path = "slug";
-  if (!slug) {
-    errors.push({
-      path,
-      message: "Form slug is required",
-      code: "SLUG_REQUIRED"
-    });
-    return;
-  }
-  if (typeof slug !== "string") {
-    errors.push({
-      path,
-      message: "Form slug must be a string",
-      code: "SLUG_INVALID_TYPE"
-    });
-    return;
-  }
-  if (slug.length < 1) {
-    errors.push({
-      path,
-      message: "Form slug must be at least 1 character",
-      code: "SLUG_TOO_SHORT"
+function configForInstall(config, self) {
+  const slugs = installedSlugs(config, self);
+  return {
+    ...config,
+    formOverrides: { ...config.formOverrides, slug: slugs.forms },
+    formSubmissionOverrides: {
+      ...config.formSubmissionOverrides,
+      slug: slugs.submissions
+    }
+  };
+}
+function positiveInt(raw) {
+  if (raw === null) return void 0;
+  const value = Number(raw);
+  return Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function toPageMeta(pagination) {
+  const limit = pagination.limit > 0 ? pagination.limit : DEFAULT_LIST_LIMIT;
+  const built = buildPaginatedResponse([], {
+    total: pagination.total,
+    page: Math.floor(pagination.offset / limit) + 1,
+    limit
+  });
+  return {
+    total: built.totalDocs,
+    page: built.page,
+    limit: built.limit,
+    totalPages: built.totalPages,
+    hasNext: built.hasNextPage,
+    hasPrev: built.hasPrevPage
+  };
+}
+async function listPublishedForms(req, ctx, config) {
+  const url2 = new URL(req.url);
+  const slugs = installedSlugs(config, ctx.self);
+  const result = await ctx.services.collections.listEntries(
+    slugs.forms,
+    {
+      where: { status: { equals: "published" } },
+      pagination: {
+        // Clamped HERE, with the canonical bound, so the limit that computes
+        // the offset is the limit that comes back. The query service clamps to
+        // 500 internally and reports the clamped value, while the offset is
+        // built from what was asked for, so `?limit=1000&page=2` returned the
+        // second 500-row slice and dividing the two reported page 3.
+        limit: clampLimit(
+          positiveInt(url2.searchParams.get("limit")) ?? DEFAULT_LIST_LIMIT
+        ),
+        page: positiveInt(url2.searchParams.get("page")) ?? 1
+      }
+    },
+    PUBLIC
+  );
+  return respondList(result.data ?? [], toPageMeta(result.pagination));
+}
+async function readFormBySlug(slug, ctx, config) {
+  const slugs = installedSlugs(config, ctx.self);
+  const result = await ctx.services.collections.listEntries(
+    slugs.forms,
+    { where: { slug: { equals: slug } }, pagination: { limit: 1 } },
+    PUBLIC
+  );
+  const doc = result.data?.[0];
+  const availability = formAvailability2(doc);
+  if (availability.kind === "absent") {
+    throw NextlyError3.notFound({
+      message: NO_SUCH_FORM2,
+      logContext: { entity: "form", slug, reason: availability.reason }
     });
   }
-  if (slug.length > 50) {
-    errors.push({
-      path,
-      message: "Form slug must be at most 50 characters",
-      code: "SLUG_TOO_LONG"
+  if (availability.kind === "closed") {
+    return respondDoc({
+      slug,
+      status: "closed",
+      closedMessage: availability.message
     });
   }
-  if (!SLUG_PATTERN.test(slug)) {
-    errors.push({
-      path,
-      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
-      code: "SLUG_INVALID_FORMAT"
-    });
+  return respondDoc(doc);
+}
+async function readSubmittedData(req, slug) {
+  let parsed;
+  try {
+    parsed = await req.json();
+  } catch {
+    parsed = void 0;
   }
-  if (isReservedSlug(slug)) {
-    errors.push({
-      path,
-      message: `Form slug '${slug}' is reserved and cannot be used`,
-      code: "SLUG_RESERVED"
+  const body = parsed;
+  if (!body?.data || typeof body.data !== "object") {
+    throw NextlyError3.validation({
+      errors: [
+        {
+          path: "data",
+          code: "MISSING_FIELD",
+          message: "Request body must contain a 'data' object."
+        }
+      ],
+      logContext: { slug }
     });
   }
+  return body.data;
 }
-function validateFieldName(name, path, errors, seenNames) {
-  if (!name) {
-    errors.push({
-      path: `${path}.name`,
-      message: "Field name is required",
-      code: "FIELD_NAME_REQUIRED"
-    });
-    return;
-  }
-  if (typeof name !== "string") {
-    errors.push({
-      path: `${path}.name`,
-      message: "Field name must be a string",
-      code: "FIELD_NAME_REQUIRED"
-    });
-    return;
-  }
-  if (!FIELD_NAME_PATTERN.test(name)) {
-    errors.push({
-      path: `${path}.name`,
-      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
-      code: "FIELD_NAME_INVALID_FORMAT"
-    });
-  }
-  const nameLower = name.toLowerCase();
-  if (seenNames.has(nameLower)) {
-    errors.push({
-      path: `${path}.name`,
-      message: `Duplicate field name '${name}'`,
-      code: "FIELD_NAME_DUPLICATE"
-    });
-  } else {
-    seenNames.add(nameLower);
+function refusalFor(result, slug) {
+  const entity = { entity: "form", slug };
+  switch (result.outcome) {
+    case "no-such-form":
+      return NextlyError3.notFound({
+        message: NO_SUCH_FORM2,
+        logContext: entity
+      });
+    // A state conflict, not a validation failure. `validation` fixes the
+    // canonical `error.message` to "Validation failed." and nests the real one
+    // under `error.data.errors[0]`, so a client reading the documented envelope
+    // would be handed the author's explanation and never show it.
+    case "closed":
+      return NextlyError3.conflict({
+        reason: "state",
+        message: result.error ?? NO_SUCH_FORM2,
+        logContext: { ...entity, reason: "closed" }
+      });
+    case "duplicate":
+      return NextlyError3.conflict({
+        reason: "state",
+        message: result.error ?? "You have already submitted this form.",
+        logContext: { ...entity, reason: "duplicate" }
+      });
+    // The codes come from the issue list, not from the message map beside it.
+    // A client tells "you left this blank" from "this is not an email" by the
+    // code, and reporting every failure as `INVALID` stops that working while
+    // looking correct in a status-only test.
+    case "invalid":
+      return NextlyError3.validation({
+        errors: (result.validationIssues ?? []).map((issue) => ({
+          path: issue.path,
+          code: issue.code,
+          message: issue.message
+        })),
+        logContext: { slug }
+      });
+    // A typed refusal is re-thrown as itself. The collection may refuse a write
+    // for a reason its host chose, and those carry their own status and field
+    // detail; answering all of them with one internal error tells a visitor the
+    // server broke when their submission was in fact answered deliberately.
+    // Anything untyped stays a 500, which is what an unexpected failure is.
+    default:
+      if (result.cause instanceof NextlyError3) return result.cause;
+      return NextlyError3.internal({
+        logContext: { ...entity, reason: "submission-failed" }
+      });
   }
 }
-function validateFieldLabel(label, path, errors) {
-  if (!label || typeof label === "string" && label.trim() === "") {
-    errors.push({
-      path: `${path}.label`,
-      message: "Field label is required",
-      code: "FIELD_LABEL_REQUIRED"
-    });
-  }
+async function acceptSubmission(req, ctx, config, slug) {
+  const data = await readSubmittedData(req, slug);
+  const result = await submitForm(
+    {
+      formSlug: slug,
+      data,
+      // The visitor's language, from `?locale=` on the submit URL — the same
+      // place core's own routes read a locale on the wire — so a picked
+      // redirect page answers with its URL in that language. A form on a
+      // French page posts to `/api/forms/contact/submit?locale=fr` and is
+      // sent to `/merci`; one that names no locale is answered in the
+      // default, as before. An unconfigured code reads as the default rather
+      // than refusing the submission: the visitor filled the form in, and a
+      // wrong query string is not a reason to lose what they wrote.
+      locale: new URL(req.url).searchParams.get("locale") || void 0,
+      // The request itself, so the write seam resolves the client under this
+      // deployment's proxy-trust settings and judges this submission on the
+      // same facts as one arriving through any other door.
+      request: req,
+      // The address for the audit column and the single-submission check,
+      // resolved by the core rather than read off a header here, which would
+      // record whatever the sender chose to claim and let one visitor pass as
+      // many.
+      metadata: {
+        ipAddress: trustedClientIp(req) ?? void 0,
+        userAgent: req.headers.get("user-agent") ?? void 0
+      },
+      access: PUBLIC
+    },
+    {
+      pluginContext: ctx,
+      pluginConfig: configForInstall(config, ctx.self)
+    }
+  );
+  if (result.outcome !== "accepted") throw refusalFor(result, slug);
+  return respondAction(
+    result.successMessage ?? DEFAULT_SUCCESS_MESSAGE,
+    {
+      ...result.submission ? { submissionId: result.submission.id } : {},
+      // Forwarded because this route is the only thing that can act on it. A
+      // form configured to redirect on success resolves one here, and core's
+      // endpoint dropped it, so the setting did nothing for any client posting
+      // over HTTP. Additive, and present on a flagged submission too, so it
+      // cannot be diffed against an accepted one.
+      ...result.redirect ? { redirect: result.redirect } : {}
+    },
+    { status: 201 }
+  );
 }
-function validateOptions(field, path, errors) {
-  const fieldWithOptions = field;
-  const options = fieldWithOptions.options;
-  if (!options) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field must have an 'options' array`,
-      code: "OPTIONS_REQUIRED"
-    });
-    return;
-  }
-  if (!Array.isArray(options)) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field 'options' must be an array`,
-      code: "OPTIONS_REQUIRED"
-    });
-    return;
-  }
-  if (options.length === 0) {
-    errors.push({
-      path: `${path}.options`,
-      message: `${field.type} field must have at least one option`,
-      code: "OPTIONS_EMPTY"
-    });
-  }
+function publicFormRoutes(config) {
+  return [
+    {
+      method: "GET",
+      path: "/forms",
+      mount: "root",
+      public: true,
+      // Collection documents, so their stored timestamps are presented in the
+      // installation's timezone exactly as the built-in read did.
+      formatTimestamps: true,
+      handler: (req, ctx) => listPublishedForms(req, ctx, config)
+    },
+    {
+      method: "GET",
+      path: "/forms/:slug",
+      mount: "root",
+      public: true,
+      formatTimestamps: true,
+      handler: (_req, ctx) => readFormBySlug(ctx.params.slug, ctx, config)
+    },
+    {
+      method: "POST",
+      path: "/forms/:slug/submit",
+      mount: "root",
+      public: true,
+      handler: (req, ctx) => acceptSubmission(req, ctx, config, ctx.params.slug)
+    }
+  ];
 }
-function validateConditionalLogic(field, path, errors) {
-  const { conditionalLogic } = field;
-  if (!conditionalLogic || !conditionalLogic.enabled) {
-    return;
-  }
-  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
-    errors.push({
-      path: `${path}.conditionalLogic.conditions`,
-      message: "Conditional logic must have at least one condition",
-      code: "CONDITIONS_REQUIRED"
-    });
-    return;
-  }
-  conditionalLogic.conditions.forEach((condition, index) => {
-    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
-    if (!condition.field) {
-      errors.push({
-        path: `${conditionPath}.field`,
-        message: "Condition must specify a field name",
-        code: "CONDITION_FIELD_REQUIRED"
-      });
+
+// src/plugin.ts
+var { version: PLUGIN_VERSION } = createRequire(import.meta.url)(
+  "../package.json"
+);
+function resolveConfig(options) {
+  const formOverrides = options.formOverrides || {};
+  const submissionOverrides = options.formSubmissionOverrides || {};
+  return {
+    formOverrides: {
+      ...formOverrides,
+      slug: formOverrides.slug || "forms",
+      labels: {
+        singular: formOverrides.labels?.singular || "Form",
+        plural: formOverrides.labels?.plural || "Forms"
+      }
+    },
+    formSubmissionOverrides: {
+      ...submissionOverrides,
+      slug: submissionOverrides.slug || "form-submissions",
+      labels: {
+        singular: submissionOverrides.labels?.singular || "Submission",
+        plural: submissionOverrides.labels?.plural || "Submissions"
+      }
+    },
+    fields: {
+      text: options.fields?.text ?? true,
+      email: options.fields?.email ?? true,
+      number: options.fields?.number ?? true,
+      phone: options.fields?.phone ?? true,
+      url: options.fields?.url ?? true,
+      textarea: options.fields?.textarea ?? true,
+      select: options.fields?.select ?? true,
+      checkbox: options.fields?.checkbox ?? true,
+      radio: options.fields?.radio ?? true,
+      file: options.fields?.file ?? true,
+      date: options.fields?.date ?? true,
+      time: options.fields?.time ?? true,
+      hidden: options.fields?.hidden ?? true
+    },
+    redirectRelationships: normalizeRedirectRelationships(
+      options.redirectRelationships
+    ),
+    // Filled at `init` from each collection's own metadata. Empty until then,
+    // and a slug that stays absent reads as unknown rather than as not
+    // localized — see `ResolvedFormBuilderConfig`.
+    redirectTargetLocalization: {},
+    beforeEmail: options.beforeEmail,
+    notifications: {
+      defaultFrom: options.notifications?.defaultFrom,
+      defaultToEmail: options.notifications?.defaultToEmail,
+      enabled: options.notifications?.enabled ?? true
+    },
+    spamProtection: {
+      honeypot: options.spamProtection?.honeypot ?? true,
+      recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
+      rateLimit: {
+        maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
+        windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
+      }
+    },
+    uploads: {
+      maxFileSize: options.uploads?.maxFileSize ?? 10485760,
+      // 10 MB
+      allowedMimeTypes: options.uploads?.allowedMimeTypes ?? [
+        "image/*",
+        "application/pdf",
+        "text/*"
+      ],
+      uploadCollection: options.uploads?.uploadCollection ?? "media"
+    },
+    features: {
+      builder: options.features?.builder ?? true,
+      conditionalLogic: options.features?.conditionalLogic ?? true,
+      fileUploads: options.features?.fileUploads ?? true
     }
-    if (!condition.comparison) {
-      errors.push({
-        path: `${conditionPath}.comparison`,
-        message: "Condition must specify a comparison operator",
-        code: "CONDITION_COMPARISON_REQUIRED"
+  };
+}
+function formBuilder(options = {}) {
+  const resolvedConfig = resolveConfig(options);
+  const formsCol = formsCollection(resolvedConfig);
+  const submissionsCol = submissionsCollection(resolvedConfig);
+  const plugin = definePlugin({
+    name: "@nextlyhq/plugin-form-builder",
+    version: PLUGIN_VERSION,
+    nextly: ">=0.0.2-alpha.21",
+    // Identity metadata for the admin plugins page, mirroring package.json.
+    author: "Nextly",
+    homepage: "https://nextlyhq.com",
+    repository: "https://github.com/nextlyhq/nextly",
+    license: "MIT",
+    category: "forms",
+    tags: ["forms", "submissions", "email-notifications"],
+    // Declarative schema: the merged pipeline folds these into the
+    // app schema — no manual `setup()` append needed. Just register the plugin.
+    contributes: {
+      collections: [formsCol, submissionsCol],
+      // Custom permission — gates submission export beyond CRUD. The
+      // canonical example third-party plugin authors copy.
+      permissions: [
+        {
+          action: "export",
+          resource: "submissions",
+          label: "Export Submissions",
+          description: "Export form submissions as CSV/JSON",
+          // No `group`: the admin already files this under the plugin that
+          // declared it, so naming the plugin again would nest it inside
+          // itself. `group` is for a plugin with enough permissions to sort
+          // its own into headings, which one is not.
+          //
+          // `danger` because the point of the permission is to take
+          // submissions — names, emails, whatever a form asked for — out of
+          // the site in a file.
+          danger: true
+        }
+      ],
+      // HTTP route — exported at
+      // /api/plugins/@nextlyhq/plugin-form-builder/submissions/export. Secure by
+      // default: gated by the custom `export-submissions` permission. Reads
+      // via the secure-by-default service path as the authed user and
+      // resolves its OWN slug through `ctx.self`. The canonical
+      // contributes.routes example for third-party authors.
+      routes: [
+        // The public form endpoints, at the addresses core used to serve
+        // before this plugin took them over. Root-mounted, so no caller's URL
+        // changes; see `routes/public-forms`.
+        ...publicFormRoutes(resolvedConfig),
+        {
+          method: "GET",
+          path: "/submissions/export",
+          requiredPermission: "export-submissions",
+          handler: async (req, ctx) => {
+            const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
+            const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
+            const url2 = new URL(req.url);
+            const format = url2.searchParams.get("format") ?? "json";
+            const formId = url2.searchParams.get("form");
+            const status = url2.searchParams.get("status");
+            const where = {};
+            if (formId) where.form = { equals: formId };
+            if (status) where.status = { equals: status };
+            else where.status = { not_equals: "spam" };
+            const opts = { as: "user", user: ctx.user ?? void 0 };
+            let form;
+            if (format === "csv") {
+              if (!formId) {
+                return Response.json(
+                  {
+                    error: {
+                      code: "VALIDATION_ERROR",
+                      message: "CSV export requires a form parameter."
+                    }
+                  },
+                  { status: 400 }
+                );
+              }
+              const formsSlugDeclared = resolvedConfig.formOverrides.slug;
+              const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
+              const formResult = await ctx.services.collections.listEntries(
+                formsSlug,
+                { where: { id: { equals: formId } } },
+                opts
+              );
+              form = formResult.data[0];
+              if (!form) {
+                return Response.json(
+                  { error: { code: "NOT_FOUND", message: "Form not found." } },
+                  { status: 404 }
+                );
+              }
+            }
+            const MAX_EXPORT_ROWS = 5e4;
+            const items = [];
+            const pageSize = 200;
+            let truncated = false;
+            for (let page = 1; ; page += 1) {
+              const result = await ctx.services.collections.listEntries(
+                slug,
+                { where, pagination: { limit: pageSize, page } },
+                opts
+              );
+              items.push(...result.data);
+              const pageWasFull = result.data.length === pageSize;
+              if (items.length >= MAX_EXPORT_ROWS) {
+                truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
+                items.length = MAX_EXPORT_ROWS;
+                break;
+              }
+              if (!pageWasFull) break;
+            }
+            const truncationHeaders = truncated ? { "X-Export-Truncated": "true" } : {};
+            if (format !== "csv" || !form) {
+              return Response.json({ items }, { headers: truncationHeaders });
+            }
+            const csv = exportToCSV(
+              asSubmissionDocuments(items),
+              asFormDocument(form)
+            );
+            const filename = generateExportFilename(
+              typeof form.slug === "string" ? form.slug : "form",
+              "csv"
+            );
+            return new Response(csv, {
+              headers: {
+                "Content-Type": "text/csv; charset=utf-8",
+                "Content-Disposition": `attachment; filename="${filename}"`,
+                ...truncationHeaders
+              }
+            });
+          }
+        },
+        {
+          // The builder UI reads the host's resolved field enable/disable map
+          // from here, so the plugin option actually gates the type picker.
+          // Options resolve server-side only; this is the one channel the
+          // admin client has to them.
+          method: "GET",
+          path: "/builder-config",
+          // Derived from the forms slug like the menu entry: with an
+          // overridden slug, users hold read-<slug>, not read-forms.
+          requiredPermission: `read-${resolvedConfig.formOverrides.slug}`,
+          handler: (_req, ctx) => Promise.resolve(
+            Response.json({
+              fields: resolvedConfig.fields,
+              // Notification defaults the builder surfaces: defaultToEmail
+              // seeds a new form's first rule, defaultFrom renders as the
+              // inherited sender placeholder.
+              notifications: {
+                defaultFrom: resolvedConfig.notifications.defaultFrom,
+                defaultToEmail: resolvedConfig.notifications.defaultToEmail
+              },
+              // Spam defaults the Settings tab surfaces, so per-form
+              // override selects can show what "inherit" resolves to.
+              spamProtection: {
+                honeypot: resolvedConfig.spamProtection.honeypot,
+                recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false
+              },
+              // Runtime-resolved collection slugs (through ctx.self, so a
+              // framework .rename() is honored too) — admin components
+              // never hardcode "forms"/"form-submissions".
+              // Names only. A pattern may be a function, which does not
+              // survive JSON and which the browser has no use for — the
+              // admin picks a document, the server builds the URL.
+              redirectCollections: Object.keys(
+                resolvedConfig.redirectRelationships
+              ),
+              slugs: {
+                forms: ctx.self.collections[resolvedConfig.formOverrides.slug] ?? resolvedConfig.formOverrides.slug,
+                submissions: ctx.self.collections[resolvedConfig.formSubmissionOverrides.slug] ?? resolvedConfig.formSubmissionOverrides.slug
+              }
+            })
+          )
+        }
+      ]
+    },
+    // Forms is a first-class destination, not a plugin detail: standalone
+    // placement gives it its own main-rail icon after Media, and its
+    // sub-sidebar lists the plugin's collections (Forms, Submissions) —
+    // no separate menu contribution, so "Forms" exists exactly once.
+    // Hosts preferring the Plugins section override placement in config.
+    // (The old admin.settings.component that rendered a second full builder
+    // at /admin/plugins/<slug> is gone; the collection Edit-view override
+    // is the single FormBuilderView mount.)
+    admin: {
+      placement: "standalone",
+      after: "media",
+      order: 50,
+      appearance: { icon: "FileText", label: "Forms" },
+      description: "Create and manage forms with submission tracking"
+    },
+    // -- Init ----------------------------------------------------------------
+    // Registers an afterCreate hook on submissions to send email notifications.
+    async init(nextly) {
+      const declaredSubmissionsSlug = resolvedConfig.formSubmissionOverrides.slug;
+      const submissionSlug = nextly.self.collections[declaredSubmissionsSlug] ?? declaredSubmissionsSlug;
+      nextly.logger.info("Form Builder plugin initialized", {
+        formsCollection: resolvedConfig.formOverrides.slug,
+        submissionsCollection: submissionSlug,
+        enabledFields: Object.entries(resolvedConfig.fields).filter(([, on]) => on).map(([name]) => name)
+      });
+      for (const slug of Object.keys(
+        resolvedConfig.redirectTargetLocalization
+      )) {
+        delete resolvedConfig.redirectTargetLocalization[slug];
+      }
+      await Promise.all(
+        Object.keys(resolvedConfig.redirectRelationships).map(
+          async (declared) => {
+            const slug = nextly.self.collections[declared] ?? declared;
+            try {
+              const collection = await nextly.services.collections.getCollection(slug, {});
+              const localized = collection?.localized;
+              if (typeof localized === "boolean") {
+                resolvedConfig.redirectTargetLocalization[declared] = localized;
+              }
+            } catch {
+              nextly.logger.debug?.(
+                "Redirect target localization could not be read",
+                { collection: slug }
+              );
+            }
+          }
+        )
+      );
+      nextly.__formBuilderConfig = resolvedConfig;
+      if (resolvedConfig.beforeEmail) {
+        nextly.filters.add(
+          "form-builder.beforeEmail",
+          (emails, ctx) => resolvedConfig.beforeEmail({
+            emails,
+            // Boundary: loose runtime documents → the user's typed contract.
+            form: asFormDocument(ctx.form),
+            submission: asSubmissionDocument(ctx.submission)
+          })
+        );
+      }
+      const declaredFormsSlug = resolvedConfig.formOverrides.slug;
+      const formsSlug = nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug;
+      nextly.hooks.on(
+        "beforeChange",
+        submissionSlug,
+        async (context) => prepareSubmissionForWrite(context, formsSlug, nextly)
+      );
+      nextly.hooks.on(
+        "afterCreate",
+        submissionSlug,
+        async (context) => {
+          await handleSubmissionCreated(context, resolvedConfig, nextly);
+        }
+      );
+      nextly.hooks.on("beforeUpdate", submissionSlug, (context) => {
+        const ctx = context;
+        if (ctx.data && ctx.data.data !== void 0) {
+          ctx.data.editedAt = /* @__PURE__ */ new Date();
+          ctx.data.editedBy = ctx.user?.id ?? null;
+        }
+        return ctx.data;
       });
+      nextly.hooks.on(
+        "afterRead",
+        formsSlug,
+        (context) => injectSubmissionCount(context, submissionSlug, nextly)
+      );
     }
   });
+  return {
+    plugin,
+    collections: [formsCol, submissionsCol],
+    config: resolvedConfig
+  };
 }
-function validateFieldByType(field, path, errors) {
-  switch (field.type) {
-    case "select":
-    case "radio":
-      validateOptions(field, path, errors);
-      break;
-    case "number": {
-      const numberField = field;
-      if (numberField.validation) {
-        const { min, max } = numberField.validation;
-        if (min !== void 0 && max !== void 0 && min > max) {
-          errors.push({
-            path: `${path}.validation`,
-            message: "Min value cannot be greater than max value",
-            code: "MIN_GREATER_THAN_MAX"
-          });
-        }
-      }
-      break;
-    }
-    case "text":
-    case "textarea": {
-      const textField = field;
-      if (textField.validation) {
-        const { minLength, maxLength } = textField.validation;
-        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
-          errors.push({
-            path: `${path}.validation`,
-            message: "Min length cannot be greater than max length",
-            code: "MIN_LENGTH_GREATER_THAN_MAX"
-          });
+function getFormBuilderConfig(nextly) {
+  if (!nextly || typeof nextly !== "object") return void 0;
+  return nextly.__formBuilderConfig;
+}
+function resolveFieldRef(ref, data) {
+  const name = parseFieldRef(ref);
+  if (name === null) return ref;
+  const value = data[name];
+  return typeof value === "string" ? value : "";
+}
+function collectAttachmentInputs(fields, submittedData) {
+  const attachments = [];
+  for (const field of fields) {
+    if (field.type !== "file" || !field.attachToEmail) continue;
+    const name = field.name;
+    const value = submittedData[name];
+    if (value == null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (typeof item === "string" && item) {
+          attachments.push({ mediaId: item });
         }
       }
-      break;
-    }
-    case "file": {
-      const fileField = field;
-      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
-        errors.push({
-          path: `${path}.maxFileSize`,
-          message: "File maxFileSize must be a positive number",
-          code: "FILE_MAX_SIZE_INVALID"
-        });
-      }
-      break;
+    } else if (typeof value === "string" && value) {
+      attachments.push({ mediaId: value });
     }
   }
+  return attachments;
 }
-function validateField(field, path, errors, seenNames) {
-  if (!field || typeof field !== "object") {
-    return;
-  }
-  const f = field;
-  const fieldType = f.type;
-  if (!fieldType) {
-    errors.push({
-      path: `${path}.type`,
-      message: "Field type is required",
-      code: "FIELD_TYPE_REQUIRED"
-    });
-    return;
-  }
-  const isValidType = typeof fieldType === "string" && (VALID_FIELD_TYPES_SET.has(fieldType) || isPluginFieldTypeOnSurface(fieldType, "forms"));
-  if (!isValidType) {
-    let fieldTypeRepr;
-    if (typeof fieldType === "object" && fieldType !== null) {
-      fieldTypeRepr = JSON.stringify(fieldType);
-    } else {
-      fieldTypeRepr = String(fieldType);
+function parseJsonColumn(value) {
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
     }
-    errors.push({
-      path: `${path}.type`,
-      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
-      code: "FIELD_TYPE_INVALID"
-    });
-    return;
-  }
-  validateFieldName(f.name, path, errors, seenNames);
-  if (fieldType !== "hidden") {
-    validateFieldLabel(f.label, path, errors);
-  }
-  validateFieldByType(field, path, errors);
-  if (f.conditionalLogic) {
-    validateConditionalLogic(field, path, errors);
   }
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function validateFieldsArray(fields, basePath, errors) {
-  const seenNames = /* @__PURE__ */ new Set();
-  fields.forEach((field, index) => {
-    const fieldPath = `${basePath}[${index}]`;
-    validateField(field, fieldPath, errors, seenNames);
-  });
+function normalizeAddressList(addresses) {
+  if (!Array.isArray(addresses)) return void 0;
+  const cleaned = addresses.map((address) => typeof address === "string" ? address.trim() : "").filter(Boolean);
+  return cleaned.length > 0 ? cleaned : void 0;
 }
-function validateFields(fields, errors) {
-  const path = "fields";
-  if (!fields) {
-    errors.push({
-      path,
-      message: "Form must have at least one field",
-      code: "FIELDS_REQUIRED"
+function buildNotificationEmails(input) {
+  const { notifications, submittedData, formName, submissionId, defaultFrom } = input;
+  const seen = /* @__PURE__ */ new Set();
+  const emails = [];
+  const skipped = [];
+  for (const notification of notifications) {
+    if (!notification.enabled) continue;
+    if (!notification.templateSlug) {
+      skipped.push({ notificationId: notification.id, reason: "no-template" });
+      continue;
+    }
+    const key = notification.id || JSON.stringify(notification);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (notification.condition && !evaluateSingleCondition(notification.condition, submittedData)) {
+      skipped.push({
+        notificationId: notification.id,
+        reason: "condition-unmet"
+      });
+      continue;
+    }
+    const to = (notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to).trim();
+    if (!to) {
+      skipped.push({
+        notificationId: notification.id,
+        reason: "empty-recipient"
+      });
+      continue;
+    }
+    const cc = normalizeAddressList(notification.cc);
+    const bcc = normalizeAddressList(notification.bcc);
+    const from = notification.senderEmail?.trim() || defaultFrom?.trim() || void 0;
+    const replyTo = notification.replyTo ? resolveFieldRef(notification.replyTo, submittedData).trim() || void 0 : void 0;
+    emails.push({
+      to,
+      templateSlug: notification.templateSlug,
+      variables: {
+        ...submittedData,
+        formName,
+        submissionId
+      },
+      providerId: notification.providerId,
+      from,
+      replyTo,
+      cc,
+      bcc,
+      notificationId: notification.id
     });
-    return;
   }
-  if (!Array.isArray(fields)) {
-    errors.push({
-      path,
-      message: "Form fields must be an array",
-      code: "FIELDS_INVALID_TYPE"
-    });
-    return;
+  return { emails, skipped };
+}
+function parentFormId(submission) {
+  const raw = submission.form;
+  if (typeof raw === "string") return raw;
+  if (raw && typeof raw === "object") {
+    const maybeId = raw.id;
+    if (typeof maybeId === "string") return maybeId;
   }
-  if (fields.length === 0) {
-    errors.push({
-      path,
-      message: "Form must have at least one field",
-      code: "FIELDS_EMPTY"
-    });
-    return;
+  return null;
+}
+function submittedPayload(raw) {
+  if (typeof raw === "string") {
+    try {
+      const parsed = JSON.parse(raw);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        return parsed;
+      }
+    } catch {
+    }
+  } else if (raw && typeof raw === "object" && !Array.isArray(raw)) {
+    return raw;
   }
-  validateFieldsArray(fields, path, errors);
+  throw NextlyError4.validation({
+    errors: [
+      {
+        path: "data",
+        code: "INVALID",
+        message: "Submission data must be an object."
+      }
+    ]
+  });
 }
-function validateSettings(settings, errors) {
-  if (!settings) {
-    return;
+function updateNeedsChecking(submission, stored) {
+  if (submission.data !== void 0) return true;
+  if (stored?.data === void 0) return false;
+  if (submission.form !== void 0) return true;
+  return stored.status === "spam" && submission.status !== void 0 && submission.status !== "spam";
+}
+async function prepareSubmissionForWrite(context, formsSlug, nextly) {
+  const ctx = context;
+  const submission = ctx.data;
+  if (!submission || typeof submission !== "object") return ctx.data;
+  const stored = ctx.originalData;
+  const formId = parentFormId(submission) ?? (stored ? parentFormId(stored) : null);
+  if (!formId) return ctx.data;
+  if (ctx.operation !== "create" && !updateNeedsChecking(submission, stored)) {
+    return ctx.data;
   }
-  if (typeof settings !== "object" || Array.isArray(settings)) {
-    errors.push({
-      path: "settings",
-      message: "Form settings must be an object",
-      code: "SETTINGS_INVALID_TYPE"
+  const incoming = submittedPayload(
+    submission.data !== void 0 ? submission.data : stored?.data
+  );
+  const marks = submissionMarks(submission);
+  const form = await formToCheckAgainst(marks, formsSlug, formId, nextly);
+  const fields = form.fields;
+  const spam = ctx.operation === "create" && ctx.req?.http ? await judgeSubmission(incoming, form, ctx.req.http, nextly) : void 0;
+  if (spam?.reason === "rate_limit") {
+    throw NextlyError4.rateLimited();
+  }
+  const prepared = prepareSubmission({
+    data: incoming,
+    fields,
+    validate: marks?.keepAsEvidence !== true && spam === void 0
+  });
+  if (prepared.validationErrors) {
+    throw NextlyError4.validation({
+      errors: Object.entries(prepared.validationErrors).map(
+        ([path, message]) => ({ path, code: "INVALID", message })
+      )
     });
-    return;
   }
-  const s = settings;
-  if (s.confirmationType === "redirect") {
-    if (!s.redirectUrl && !s.redirectRelation) {
-      errors.push({
-        path: "settings.redirectUrl",
-        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
-        code: "REDIRECT_URL_REQUIRED"
-      });
-    }
+  ctx.data = { ...submission, data: prepared.data };
+  if (spam) {
+    ctx.data.status = "spam";
+    ctx.data.spamReason = spam.reason ?? null;
   }
-  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
-    errors.push({
-      path: "settings.redirectPage",
-      message: "A page is required when confirmation type is 'relationship'",
-      code: "REDIRECT_PAGE_REQUIRED"
-    });
+  if (ctx.operation !== "create" && submission.data === void 0) {
+    stampDerivedEdit(ctx.data, ctx.user, incoming, prepared.data);
   }
+  return ctx.data;
 }
-function namesADocument(value) {
-  if (typeof value === "string") return value.length > 0;
-  return parseRedirectReference(value, []) !== null;
-}
-function validateAccess(access, errors) {
-  if (!access) {
-    return;
-  }
-  if (typeof access !== "object" || Array.isArray(access)) {
-    errors.push({
-      path: "access",
-      message: "Access control must be an object",
-      code: "ACCESS_INVALID_TYPE"
+async function formToCheckAgainst(marks, formsSlug, formId, nextly) {
+  const handedOver = marks?.form?.id === formId ? marks.form : null;
+  const form = handedOver ?? await fetchParentForm(formsSlug, formId, nextly);
+  if (!form || !Array.isArray(form.fields)) {
+    throw NextlyError4.validation({
+      errors: [
+        {
+          path: "form",
+          code: "INVALID",
+          message: "The form this submission belongs to could not be read, so the submission could not be checked against it."
+        }
+      ]
     });
-    return;
   }
-  const accessObj = access;
-  const validAccessKeys = ["submit", "read"];
-  for (const key of validAccessKeys) {
-    const fn = accessObj[key];
-    if (fn !== void 0 && typeof fn !== "function") {
-      errors.push({
-        path: `access.${key}`,
-        message: `Access control '${key}' must be a function`,
-        code: "ACCESS_FUNCTION_INVALID"
-      });
+  return form;
+}
+function rateLimitKeyFor(form) {
+  const { id } = form;
+  return typeof id === "string" && id.length > 0 ? id : "unidentified-form";
+}
+async function judgeSubmission(payload, form, http, nextly) {
+  const config = getFormBuilderConfig(nextly);
+  if (!config) return void 0;
+  const declared = new Set(
+    (Array.isArray(form.fields) ? form.fields : []).map((field) => field.name).filter((name) => typeof name === "string")
+  );
+  const undeclared = Object.fromEntries(
+    Object.entries(payload).filter(([key]) => !declared.has(key))
+  );
+  const settings = form.settings ?? {};
+  const verdict = await checkSpam({
+    data: undeclared,
+    ipAddress: http.ip ?? void 0,
+    formSlug: rateLimitKeyFor(form),
+    config: {
+      honeypot: settings.honeypotEnabled ?? config.spamProtection.honeypot,
+      rateLimit: config.spamProtection.rateLimit
     }
-  }
+  });
+  return verdict.isSpam ? verdict : void 0;
 }
-function validateFormConfig(config) {
-  const errors = [];
-  validateSlug(config.slug, errors);
-  validateFields(config.fields, errors);
-  validateSettings(config.settings, errors);
-  validateAccess(config.access, errors);
-  return {
-    valid: errors.length === 0,
-    errors
-  };
+function stampDerivedEdit(row, user, before, after) {
+  if (sameSubmittedPayload(before, after)) return;
+  row.editedAt = /* @__PURE__ */ new Date();
+  row.editedBy = user?.id ?? null;
 }
-function assertValidFormConfig(config) {
-  const result = validateFormConfig(config);
-  if (!result.valid) {
-    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
-    throw new Error(
-      `Invalid form config for '${config.slug || "unknown"}':
-${errorMessages}`
-    );
+async function handleSubmissionCreated(context, config, nextly) {
+  if (!config.notifications.enabled) return;
+  const submission = context.data;
+  if (!submission) return;
+  if (submission.status === "spam") return;
+  const formId = parentFormId(submission);
+  if (!formId) return;
+  const declaredFormsSlug = config.formOverrides.slug;
+  const form = await fetchParentForm(
+    nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug,
+    formId,
+    nextly
+  );
+  if (!form) return;
+  const notifications = Array.isArray(form.notifications) ? form.notifications : [];
+  if (notifications.length === 0) return;
+  const emailService = nextly.services.email;
+  if (!emailService) return;
+  const submittedData = parseJsonColumn(submission.data);
+  const formFields = Array.isArray(form.fields) ? form.fields : [];
+  const fileAttachments = collectAttachmentInputs(formFields, submittedData);
+  const { emails, skipped } = buildNotificationEmails({
+    notifications,
+    submittedData,
+    formName: form.name,
+    submissionId: submission.id,
+    defaultFrom: config.notifications.defaultFrom
+  });
+  for (const skip of skipped) {
+    if (skip.reason === "empty-recipient") {
+      nextly.logger.warn?.(
+        "Form Builder: empty recipient, skipping notification",
+        { notificationId: skip.notificationId, formSlug: form.slug }
+      );
+    } else {
+      nextly.logger.debug?.("Form Builder: notification skipped", {
+        notificationId: skip.notificationId,
+        formSlug: form.slug,
+        reason: skip.reason
+      });
+    }
   }
-}
-
-// src/config/field-helpers.ts
-var option = (label, value) => ({
-  label,
-  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
-});
-var text3 = (config) => ({
-  ...config,
-  type: "text"
-});
-var email = (config) => ({
-  ...config,
-  type: "email"
-});
-var phone = (config) => ({
-  ...config,
-  type: "phone"
-});
-var url = (config) => ({
-  ...config,
-  type: "url"
-});
-var textarea3 = (config) => ({
-  ...config,
-  type: "textarea"
-});
-var number = (config) => ({
-  ...config,
-  type: "number"
-});
-var select3 = (config) => ({
-  ...config,
-  type: "select"
-});
-var checkbox2 = (config) => ({
-  ...config,
-  type: "checkbox"
-});
-var radio = (config) => ({
-  ...config,
-  type: "radio"
-});
-var file = (config) => ({
-  ...config,
-  type: "file"
-});
-var date3 = (config) => ({
-  ...config,
-  type: "date"
-});
-var time = (config) => ({
-  ...config,
-  type: "time"
-});
-var hidden = (config) => ({
-  ...config,
-  type: "hidden"
-});
-
-// src/handlers/submit-form.ts
-import { formAvailability, NO_SUCH_FORM } from "nextly";
-
-// src/handlers/spam-detection.ts
-var rateLimitStore = /* @__PURE__ */ new Map();
-async function checkSpam(options) {
-  const { data, ipAddress, formSlug, config } = options;
-  if (config.honeypot) {
-    const honeypotResult = checkHoneypot(data);
-    if (honeypotResult.isSpam) {
-      return honeypotResult;
+  if (emails.length === 0) return;
+  const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, { form, submission });
+  for (const email2 of finalEmails) {
+    try {
+      await emailService.sendWithTemplate(
+        email2.templateSlug,
+        email2.to,
+        email2.variables,
+        {
+          providerId: email2.providerId,
+          from: email2.from,
+          replyTo: email2.replyTo,
+          cc: email2.cc,
+          bcc: email2.bcc,
+          attachments: fileAttachments.length > 0 ? fileAttachments : void 0
+        }
+      );
+      nextly.logger.info?.("Form Builder: notification sent", {
+        formSlug: form.slug,
+        to: email2.to,
+        templateSlug: email2.templateSlug,
+        notificationId: email2.notificationId,
+        attachmentCount: fileAttachments.length
+      });
+    } catch (err) {
+      nextly.logger.error?.("Form Builder: notification failed", {
+        to: email2.to,
+        templateSlug: email2.templateSlug,
+        notificationId: email2.notificationId,
+        error: err instanceof Error ? err.message : String(err)
+      });
     }
   }
-  if (config.rateLimit && ipAddress) {
-    const rateLimitResult = checkRateLimit(
-      ipAddress,
-      formSlug,
-      config.rateLimit
+}
+async function injectSubmissionCount(context, submissionSlug, nextly) {
+  const hook = context;
+  if (hook.context?.[SCHEMA_ONLY_READ] === true) return;
+  const records = Array.isArray(hook.data) ? hook.data : hook.data ? [hook.data] : [];
+  await Promise.all(
+    records.map(async (record) => {
+      const form = record;
+      if (typeof form.id !== "string") return;
+      try {
+        form.submissionCount = await nextly.services.collections.count(
+          submissionSlug,
+          {
+            where: {
+              form: { equals: form.id },
+              status: { not_equals: "spam" }
+            }
+          },
+          { as: "system" }
+        );
+      } catch {
+        form.submissionCount = 0;
+      }
+    })
+  );
+}
+var SCHEMA_ONLY_READ = "formBuilder.schemaOnlyRead";
+async function fetchParentForm(formsSlug, formId, nextly) {
+  try {
+    const form = await nextly.services.collections.findEntryById(
+      formsSlug,
+      formId,
+      { as: "system", context: { [SCHEMA_ONLY_READ]: true } }
     );
-    if (rateLimitResult.isSpam) {
-      return rateLimitResult;
-    }
+    return form;
+  } catch (err) {
+    if (!NextlyError4.isNotFound(err)) throw err;
+    nextly.logger.error?.("Form Builder: form not found", {
+      formId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return null;
   }
-  return { isSpam: false };
 }
-var HONEYPOT_FIELDS = [
-  "__honeypot",
-  "_honeypot",
-  "honeypot",
-  "__hp",
-  "_hp",
-  "website",
-  // Common honeypot field name
-  "url_field",
-  // Another common honeypot
-  "fax_number"
-  // Rarely used by humans
+
+// src/config/validate-form.ts
+import { isPluginFieldTypeOnSurface } from "nextly";
+var RESERVED_FORM_SLUGS = [
+  // API routes
+  "api",
+  "submit",
+  "submissions",
+  "export",
+  // System slugs
+  "admin",
+  "new",
+  "create",
+  "edit",
+  "delete"
 ];
-function checkHoneypot(data) {
-  for (const fieldName of HONEYPOT_FIELDS) {
-    const value = data[fieldName];
-    if (value !== void 0 && value !== null && value !== "") {
-      let raw;
-      if (typeof value === "object") {
-        raw = JSON.stringify(value);
-      } else {
-        raw = String(value);
-      }
-      const stringValue = raw.trim();
-      if (stringValue.length > 0) {
-        return {
-          isSpam: true,
-          reason: "honeypot",
-          details: `Honeypot field "${fieldName}" was filled`
-        };
-      }
-    }
+var RESERVED_SLUGS_SET = new Set(RESERVED_FORM_SLUGS);
+var SLUG_PATTERN = /^[a-z][a-z0-9_-]*$/;
+var FIELD_NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
+var VALID_FIELD_TYPES = BUILT_IN_FORM_FIELD_TYPES;
+var VALID_FIELD_TYPES_SET = new Set(VALID_FIELD_TYPES);
+function isReservedSlug(slug) {
+  return RESERVED_SLUGS_SET.has(slug.toLowerCase());
+}
+function validateSlug(slug, errors) {
+  const path = "slug";
+  if (!slug) {
+    errors.push({
+      path,
+      message: "Form slug is required",
+      code: "SLUG_REQUIRED"
+    });
+    return;
+  }
+  if (typeof slug !== "string") {
+    errors.push({
+      path,
+      message: "Form slug must be a string",
+      code: "SLUG_INVALID_TYPE"
+    });
+    return;
+  }
+  if (slug.length < 1) {
+    errors.push({
+      path,
+      message: "Form slug must be at least 1 character",
+      code: "SLUG_TOO_SHORT"
+    });
+  }
+  if (slug.length > 50) {
+    errors.push({
+      path,
+      message: "Form slug must be at most 50 characters",
+      code: "SLUG_TOO_LONG"
+    });
+  }
+  if (!SLUG_PATTERN.test(slug)) {
+    errors.push({
+      path,
+      message: "Form slug must start with a lowercase letter and contain only lowercase letters, numbers, hyphens, and underscores",
+      code: "SLUG_INVALID_FORMAT"
+    });
+  }
+  if (isReservedSlug(slug)) {
+    errors.push({
+      path,
+      message: `Form slug '${slug}' is reserved and cannot be used`,
+      code: "SLUG_RESERVED"
+    });
   }
-  return { isSpam: false };
 }
-function checkRateLimit(ipAddress, formSlug, config) {
-  const key = `${formSlug}:${ipAddress}`;
-  const now = Date.now();
-  const entry = rateLimitStore.get(key);
-  if (entry) {
-    if (now - entry.timestamp > config.windowMs) {
-      rateLimitStore.set(key, { count: 1, timestamp: now });
-      return { isSpam: false };
-    }
-    if (entry.count >= config.maxSubmissions) {
-      return {
-        isSpam: true,
-        reason: "rate_limit",
-        details: `Rate limit exceeded: ${entry.count}/${config.maxSubmissions} in ${config.windowMs}ms`
-      };
-    }
-    rateLimitStore.set(key, {
-      count: entry.count + 1,
-      timestamp: entry.timestamp
+function validateFieldName(name, path, errors, seenNames) {
+  if (!name) {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name is required",
+      code: "FIELD_NAME_REQUIRED"
+    });
+    return;
+  }
+  if (typeof name !== "string") {
+    errors.push({
+      path: `${path}.name`,
+      message: "Field name must be a string",
+      code: "FIELD_NAME_REQUIRED"
+    });
+    return;
+  }
+  if (!FIELD_NAME_PATTERN.test(name)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Field name '${name}' must start with a letter and contain only letters, numbers, and underscores`,
+      code: "FIELD_NAME_INVALID_FORMAT"
+    });
+  }
+  const nameLower = name.toLowerCase();
+  if (seenNames.has(nameLower)) {
+    errors.push({
+      path: `${path}.name`,
+      message: `Duplicate field name '${name}'`,
+      code: "FIELD_NAME_DUPLICATE"
     });
   } else {
-    rateLimitStore.set(key, { count: 1, timestamp: now });
+    seenNames.add(nameLower);
   }
-  return { isSpam: false };
 }
-function cleanupRateLimitStore(maxAgeMs = 5 * 60 * 1e3) {
-  const now = Date.now();
-  let removed = 0;
-  for (const [key, entry] of rateLimitStore.entries()) {
-    if (now - entry.timestamp > maxAgeMs) {
-      rateLimitStore.delete(key);
-      removed++;
-    }
+function validateFieldLabel(label, path, errors) {
+  if (!label || typeof label === "string" && label.trim() === "") {
+    errors.push({
+      path: `${path}.label`,
+      message: "Field label is required",
+      code: "FIELD_LABEL_REQUIRED"
+    });
   }
-  return removed;
-}
-function getRateLimitStoreSize() {
-  return rateLimitStore.size;
 }
-function clearRateLimitStore() {
-  rateLimitStore.clear();
-}
-function isRateLimited(ipAddress, formSlug, config) {
-  const key = `${formSlug}:${ipAddress}`;
-  const now = Date.now();
-  const entry = rateLimitStore.get(key);
-  if (!entry) {
-    return false;
-  }
-  if (now - entry.timestamp > config.windowMs) {
-    return false;
+function validateOptions(field, path, errors) {
+  const fieldWithOptions = field;
+  const options = fieldWithOptions.options;
+  if (!options) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have an 'options' array`,
+      code: "OPTIONS_REQUIRED"
+    });
+    return;
   }
-  return entry.count >= config.maxSubmissions;
-}
-
-// src/handlers/submit-form.ts
-async function submitForm(options, context) {
-  const { formSlug, data, metadata } = options;
-  const { pluginContext, pluginConfig } = context;
-  const { collections } = pluginContext.services;
-  const { logger } = pluginContext;
-  try {
-    const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-    if (!form) {
-      logger.warn?.("Form submission attempted for non-existent form", {
-        formSlug
-      });
-      return { success: false, error: NO_SUCH_FORM };
-    }
-    const availability = formAvailability(form);
-    if (availability.kind !== "open") {
-      logger.info?.("Form submission rejected - form not accepting", {
-        formSlug,
-        status: form.status,
-        availability: availability.kind
-      });
-      return {
-        success: false,
-        error: availability.kind === "closed" ? availability.message : NO_SUCH_FORM
-      };
-    }
-    const settings = normalizeFormSettings(form.settings);
-    if (settings.allowMultipleSubmissions === false && !metadata?.ipAddress) {
-      logger.warn?.(
-        "Single-submission form received a submission without an IP \u2014 the restriction cannot apply",
-        { formSlug }
-      );
-    }
-    if (settings.allowMultipleSubmissions === false && metadata?.ipAddress) {
-      const existing = await collections.count(
-        pluginConfig.formSubmissionOverrides.slug,
-        {
-          where: {
-            form: { equals: form.id },
-            ipAddress: { equals: metadata.ipAddress },
-            status: { not_equals: "spam" }
-          }
-        },
-        { as: "system" }
-      );
-      if (existing > 0) {
-        logger.info?.("Repeat submission rejected (single-submission form)", {
-          formSlug,
-          ipAddress: metadata.ipAddress
-        });
-        return {
-          success: false,
-          error: "You have already submitted this form."
-        };
-      }
-    }
-    const declaredFieldNames = new Set(form.fields.map((field) => field.name));
-    const undeclaredData = Object.fromEntries(
-      Object.entries(data).filter(([key]) => !declaredFieldNames.has(key))
-    );
-    const spamResult = await checkSpam({
-      data: undeclaredData,
-      ipAddress: metadata?.ipAddress,
-      formSlug,
-      config: {
-        // Per-form overrides win where set; blank inherits the plugin config.
-        honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot,
-        rateLimit: pluginConfig.spamProtection.rateLimit,
-        recaptcha: {
-          ...pluginConfig.spamProtection.recaptcha,
-          enabled: settings.captchaEnabled ?? pluginConfig.spamProtection.recaptcha?.enabled ?? false
-        }
-      }
+  if (!Array.isArray(options)) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field 'options' must be an array`,
+      code: "OPTIONS_REQUIRED"
+    });
+    return;
+  }
+  if (options.length === 0) {
+    errors.push({
+      path: `${path}.options`,
+      message: `${field.type} field must have at least one option`,
+      code: "OPTIONS_EMPTY"
     });
-    if (spamResult.isSpam && spamResult.reason === "rate_limit") {
-      logger.info?.("Spam submission rejected (rate limit)", {
-        formSlug,
-        ipAddress: metadata?.ipAddress
+  }
+}
+function validateConditionalLogic(field, path, errors) {
+  const { conditionalLogic } = field;
+  if (!conditionalLogic || !conditionalLogic.enabled) {
+    return;
+  }
+  if (!conditionalLogic.conditions || conditionalLogic.conditions.length === 0) {
+    errors.push({
+      path: `${path}.conditionalLogic.conditions`,
+      message: "Conditional logic must have at least one condition",
+      code: "CONDITIONS_REQUIRED"
+    });
+    return;
+  }
+  conditionalLogic.conditions.forEach((condition, index) => {
+    const conditionPath = `${path}.conditionalLogic.conditions[${index}]`;
+    if (!condition.field) {
+      errors.push({
+        path: `${conditionPath}.field`,
+        message: "Condition must specify a field name",
+        code: "CONDITION_FIELD_REQUIRED"
       });
-      return { success: true };
     }
-    const isContentSpam = spamResult.isSpam;
-    if (isContentSpam) {
-      logger.info?.("Spam submission detected \u2014 storing flagged", {
-        formSlug,
-        reason: spamResult.reason,
-        ipAddress: metadata?.ipAddress
+    if (!condition.comparison) {
+      errors.push({
+        path: `${conditionPath}.comparison`,
+        message: "Condition must specify a comparison operator",
+        code: "CONDITION_COMPARISON_REQUIRED"
       });
     }
-    const prepared = prepareSubmission({
-      data,
-      fields: form.fields,
-      validate: !isContentSpam
-    });
-    if (prepared.validationErrors) {
-      logger.debug?.("Form validation failed", {
-        formSlug,
-        errors: prepared.validationErrors
-      });
-      return {
-        success: false,
-        error: "Validation failed",
-        validationErrors: prepared.validationErrors
-      };
+  });
+}
+function validateFieldByType(field, path, errors) {
+  switch (field.type) {
+    case "select":
+    case "radio":
+      validateOptions(field, path, errors);
+      break;
+    case "number": {
+      const numberField = field;
+      if (numberField.validation) {
+        const { min, max } = numberField.validation;
+        if (min !== void 0 && max !== void 0 && min > max) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min value cannot be greater than max value",
+            code: "MIN_GREATER_THAN_MAX"
+          });
+        }
+      }
+      break;
     }
-    const storedData = prepared.data;
-    const submissionData = {
-      form: form.id,
-      data: storedData,
-      status: isContentSpam ? "spam" : "new",
-      spamReason: isContentSpam ? spamResult.reason ?? null : null,
-      ipAddress: metadata?.ipAddress || null,
-      userAgent: metadata?.userAgent || null,
-      submittedAt: /* @__PURE__ */ new Date()
-    };
-    const submission = await collections.createEntry(
-      pluginConfig.formSubmissionOverrides.slug,
-      asPluginSubmission(submissionData, {
-        keepAsEvidence: isContentSpam,
-        form: { id: form.id, fields: form.fields }
-      }),
-      // Public form submission — create as system. No ambient user; an
-      // empty context already resolves to system, but be explicit.
-      { as: "system" }
-    );
-    logger.info?.("Form submission created successfully", {
-      formSlug,
-      submissionId: submission.item.id,
-      flaggedAsSpam: isContentSpam
-    });
-    if (submission.warnings) {
-      logger.warn?.("Form submission side effects failed", {
-        formSlug,
-        submissionId: submission.item.id,
-        warnings: submission.warnings
-      });
+    case "text":
+    case "textarea": {
+      const textField = field;
+      if (textField.validation) {
+        const { minLength, maxLength } = textField.validation;
+        if (minLength !== void 0 && maxLength !== void 0 && minLength > maxLength) {
+          errors.push({
+            path: `${path}.validation`,
+            message: "Min length cannot be greater than max length",
+            code: "MIN_LENGTH_GREATER_THAN_MAX"
+          });
+        }
+      }
+      break;
     }
-    const redirect = await resolveRedirectUrl(
-      form,
-      pluginConfig,
-      pluginContext
-    );
-    if (isContentSpam) {
-      return { success: true, redirect };
+    case "file": {
+      const fileField = field;
+      if (fileField.maxFileSize !== void 0 && fileField.maxFileSize <= 0) {
+        errors.push({
+          path: `${path}.maxFileSize`,
+          message: "File maxFileSize must be a positive number",
+          code: "FILE_MAX_SIZE_INVALID"
+        });
+      }
+      break;
     }
-    return {
-      success: true,
-      // The created ROW, not the envelope around it. Through the shared
-      // conversion, which is where the unchecked step lives and says so; the
-      // integration test reads `submission.id` off the result because nothing
-      // at compile time will.
-      submission: asSubmissionDocument(submission.item),
-      redirect
-    };
-  } catch (error) {
-    logger.error?.("Form submission error", {
-      formSlug,
-      error: error instanceof Error ? error.message : String(error)
-    });
-    return {
-      success: false,
-      error: "An error occurred processing your submission. Please try again."
-    };
   }
 }
-async function fetchFormBySlug(slug, pluginConfig, pluginContext) {
-  try {
-    const { collections } = pluginContext.services;
-    const result = await collections.listEntries(
-      pluginConfig.formOverrides.slug,
-      { where: { slug: { equals: slug } }, pagination: { limit: 1 } },
-      { as: "system" }
-    );
-    const form = result.data?.[0];
-    return form ? asFormDocument(form) : null;
-  } catch {
-    return null;
+function validateField(field, path, errors, seenNames) {
+  if (!field || typeof field !== "object") {
+    return;
   }
-}
-async function resolveRedirectUrl(form, pluginConfig, pluginContext) {
-  const settings = form.settings;
-  if (!settings) return void 0;
-  if (settings.confirmationType === "redirect" && settings.redirectUrl) {
-    return settings.redirectUrl;
+  const f = field;
+  const fieldType = f.type;
+  if (!fieldType) {
+    errors.push({
+      path: `${path}.type`,
+      message: "Field type is required",
+      code: "FIELD_TYPE_REQUIRED"
+    });
+    return;
   }
-  const field = pickedDocumentField(settings);
-  if (!field) return void 0;
-  return urlForPickedDocument(
-    settings[field],
-    form,
-    pluginConfig,
-    pluginContext
-  );
-}
-async function urlForPickedDocument(stored, form, pluginConfig, pluginContext) {
-  const { logger } = pluginContext;
-  const patterns = pluginConfig.redirectRelationships;
-  const reference = parseRedirectReference(stored, Object.keys(patterns));
-  if (!reference) {
-    logger.warn?.("Form redirects to a page, but names no readable document", {
-      form: form.slug
+  const isValidType = typeof fieldType === "string" && (VALID_FIELD_TYPES_SET.has(fieldType) || isPluginFieldTypeOnSurface(fieldType, "forms"));
+  if (!isValidType) {
+    let fieldTypeRepr;
+    if (typeof fieldType === "object" && fieldType !== null) {
+      fieldTypeRepr = JSON.stringify(fieldType);
+    } else {
+      fieldTypeRepr = String(fieldType);
+    }
+    errors.push({
+      path: `${path}.type`,
+      message: `Invalid field type '${fieldTypeRepr}'. Valid types: ${VALID_FIELD_TYPES.join(", ")}`,
+      code: "FIELD_TYPE_INVALID"
     });
-    return void 0;
+    return;
   }
-  const pattern = patterns[reference.collection];
-  if (!pattern) {
-    logger.warn?.(
-      "Form redirects to a collection that is not in redirectRelationships",
-      { form: form.slug, collection: reference.collection }
-    );
-    return void 0;
+  validateFieldName(f.name, path, errors, seenNames);
+  if (fieldType !== "hidden") {
+    validateFieldLabel(f.label, path, errors);
   }
-  const target = await readTarget(reference, form, pluginContext);
-  if (!target) return void 0;
-  if (documentReachability(
-    target,
-    pluginConfig.redirectTargetLocalization[reference.collection]
-  ) === "unreachable") {
-    logger.warn?.("Form redirects to a page that has never been published", {
-      form: form.slug,
-      collection: reference.collection,
-      target: reference.id
-    });
-    return void 0;
+  validateFieldByType(field, path, errors);
+  if (f.conditionalLogic) {
+    validateConditionalLogic(field, path, errors);
   }
-  return buildUrl(pattern, target, reference.collection, form, pluginContext);
 }
-function buildUrl(pattern, target, collection, form, pluginContext) {
-  const { logger } = pluginContext;
-  try {
-    const url2 = applyRedirectPattern(pattern, target);
-    if (!url2) {
-      logger.warn?.(
-        "Form redirect pattern could not be filled from the target document",
-        { form: form.slug, collection }
-      );
-    }
-    return url2;
-  } catch (error) {
-    logger.warn?.("Form redirect pattern threw while building a URL", {
-      form: form.slug,
-      collection,
-      error: error instanceof Error ? error.message : String(error)
+function validateFieldsArray(fields, basePath, errors) {
+  const seenNames = /* @__PURE__ */ new Set();
+  fields.forEach((field, index) => {
+    const fieldPath = `${basePath}[${index}]`;
+    validateField(field, fieldPath, errors, seenNames);
+  });
+}
+function validateFields(fields, errors) {
+  const path = "fields";
+  if (!fields) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_REQUIRED"
+    });
+    return;
+  }
+  if (!Array.isArray(fields)) {
+    errors.push({
+      path,
+      message: "Form fields must be an array",
+      code: "FIELDS_INVALID_TYPE"
+    });
+    return;
+  }
+  if (fields.length === 0) {
+    errors.push({
+      path,
+      message: "Form must have at least one field",
+      code: "FIELDS_EMPTY"
     });
-    return void 0;
+    return;
   }
+  validateFieldsArray(fields, path, errors);
 }
-async function readTarget(reference, form, pluginContext) {
-  const { logger } = pluginContext;
-  const context = {
-    form: form.slug,
-    collection: reference.collection,
-    id: reference.id
-  };
-  let row;
-  try {
-    row = await pluginContext.services.collections.findEntryById(
-      reference.collection,
-      reference.id,
-      { as: "system" }
-    );
-  } catch (error) {
-    logger.warn?.("Form redirect target could not be read", {
-      ...context,
-      error: error instanceof Error ? error.message : String(error)
-    });
-    return void 0;
+function validateSettings(settings, errors) {
+  if (!settings) {
+    return;
   }
-  if (!row || typeof row !== "object") {
-    logger.warn?.("Form redirect target no longer exists", context);
-    return void 0;
+  if (typeof settings !== "object" || Array.isArray(settings)) {
+    errors.push({
+      path: "settings",
+      message: "Form settings must be an object",
+      code: "SETTINGS_INVALID_TYPE"
+    });
+    return;
   }
-  return row;
-}
-async function validateSubmission(formSlug, data, context) {
-  const { pluginContext, pluginConfig } = context;
-  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-  if (!form) {
-    return { valid: false, errors: { _form: "Form not found" } };
+  const s = settings;
+  if (s.confirmationType === "redirect") {
+    if (!s.redirectUrl && !s.redirectRelation) {
+      errors.push({
+        path: "settings.redirectUrl",
+        message: "Redirect URL or redirect relation is required when confirmation type is 'redirect'",
+        code: "REDIRECT_URL_REQUIRED"
+      });
+    }
   }
-  const prepared = prepareSubmission({
-    data,
-    fields: form.fields,
-    validate: true
-  });
-  if (!prepared.validationErrors) {
-    return { valid: true };
+  if (s.confirmationType === "relationship" && !namesADocument(s.redirectPage)) {
+    errors.push({
+      path: "settings.redirectPage",
+      message: "A page is required when confirmation type is 'relationship'",
+      code: "REDIRECT_PAGE_REQUIRED"
+    });
   }
-  return {
-    valid: false,
-    errors: prepared.validationErrors
-  };
 }
-async function isFormAcceptingSubmissions(formSlug, context) {
-  const { pluginContext, pluginConfig } = context;
-  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-  if (!form) {
-    return false;
-  }
-  return form.status === "published";
+function namesADocument(value) {
+  if (typeof value === "string") return value.length > 0;
+  return parseRedirectReference(value, []) !== null;
 }
-async function getFormSubmissionStats(formSlug, context) {
-  const { pluginContext, pluginConfig } = context;
-  const { collections } = pluginContext.services;
-  const form = await fetchFormBySlug(formSlug, pluginConfig, pluginContext);
-  if (!form) {
-    return null;
+function validateAccess(access, errors) {
+  if (!access) {
+    return;
   }
-  try {
-    const submissionsSlug = pluginConfig.formSubmissionOverrides.slug;
-    const sys = { as: "system" };
-    const base = { form: { equals: form.id } };
-    const [total, newCount, read, archived] = await Promise.all([
-      collections.count(submissionsSlug, { where: base }, sys),
-      collections.count(
-        submissionsSlug,
-        { where: { ...base, status: { equals: "new" } } },
-        sys
-      ),
-      collections.count(
-        submissionsSlug,
-        { where: { ...base, status: { equals: "read" } } },
-        sys
-      ),
-      collections.count(
-        submissionsSlug,
-        { where: { ...base, status: { equals: "archived" } } },
-        sys
-      )
-    ]);
-    return { total, new: newCount, read, archived };
-  } catch {
-    return null;
+  if (typeof access !== "object" || Array.isArray(access)) {
+    errors.push({
+      path: "access",
+      message: "Access control must be an object",
+      code: "ACCESS_INVALID_TYPE"
+    });
+    return;
   }
-}
-
-// src/handlers/webhooks.ts
-import { safeFetch, ExternalUrlError } from "nextly";
-var WEBHOOK_TIMEOUT_MS = 1e4;
-var SIGNATURE_HEADER = "X-Webhook-Signature";
-var EVENT_HEADER = "X-Webhook-Event";
-var DELIVERY_ID_HEADER = "X-Webhook-Delivery-ID";
-async function generateSignature(payload, secret) {
-  const encoder = new TextEncoder();
-  const keyData = encoder.encode(secret);
-  const messageData = encoder.encode(payload);
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    keyData,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign("HMAC", cryptoKey, messageData);
-  const hashArray = Array.from(new Uint8Array(signature));
-  const hashHex = hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
-  return `sha256=${hashHex}`;
-}
-async function sendWebhook(webhook, payload) {
-  const startTime = Date.now();
-  const payloadString = JSON.stringify(payload);
-  try {
-    const headers = {
-      "Content-Type": "application/json",
-      [EVENT_HEADER]: payload.event,
-      [DELIVERY_ID_HEADER]: payload.submission.id,
-      ...webhook.headers
-    };
-    if (webhook.secret) {
-      headers[SIGNATURE_HEADER] = await generateSignature(
-        payloadString,
-        webhook.secret
-      );
-    }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), WEBHOOK_TIMEOUT_MS);
-    try {
-      const response = await safeFetch(webhook.url, {
-        method: webhook.method || "POST",
-        headers,
-        body: payloadString,
-        signal: controller.signal,
-        allowLocalhost: process.env.NODE_ENV !== "production"
+  const accessObj = access;
+  const validAccessKeys = ["submit", "read"];
+  for (const key of validAccessKeys) {
+    const fn = accessObj[key];
+    if (fn !== void 0 && typeof fn !== "function") {
+      errors.push({
+        path: `access.${key}`,
+        message: `Access control '${key}' must be a function`,
+        code: "ACCESS_FUNCTION_INVALID"
       });
-      clearTimeout(timeoutId);
-      const durationMs = Date.now() - startTime;
-      if (response.ok) {
-        return {
-          url: webhook.url,
-          success: true,
-          statusCode: response.status,
-          durationMs
-        };
-      }
-      return {
-        url: webhook.url,
-        success: false,
-        statusCode: response.status,
-        error: `HTTP ${response.status}: ${response.statusText}`,
-        durationMs
-      };
-    } finally {
-      clearTimeout(timeoutId);
-    }
-  } catch (error) {
-    const durationMs = Date.now() - startTime;
-    if (error instanceof Error && error.name === "AbortError") {
-      return {
-        url: webhook.url,
-        success: false,
-        error: `Timeout after ${WEBHOOK_TIMEOUT_MS}ms`,
-        durationMs
-      };
-    }
-    if (error instanceof ExternalUrlError) {
-      return {
-        url: webhook.url,
-        success: false,
-        error: `Webhook URL rejected for SSRF safety: ${error.message}`,
-        durationMs
-      };
     }
-    return {
-      url: webhook.url,
-      success: false,
-      error: error instanceof Error ? error.message : String(error),
-      durationMs
-    };
   }
 }
-async function triggerWebhooks(options) {
-  const { event, form, submission } = options;
-  const webhooks = form.webhooks || [];
-  const relevantWebhooks = webhooks.filter((w) => w.events.includes(event));
-  if (relevantWebhooks.length === 0) {
-    return {
-      triggered: 0,
-      successful: 0,
-      failed: 0,
-      results: []
-    };
-  }
-  const deliveryPromises = relevantWebhooks.map(async (webhook) => {
-    const payload = {
-      event,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      form: {
-        id: form.id,
-        slug: form.slug,
-        name: form.name
-      },
-      submission: webhook.includeData !== false ? submission : {
-        id: submission.id,
-        submittedAt: submission.submittedAt
-      }
-    };
-    return sendWebhook(webhook, payload);
-  });
-  const results = await Promise.all(deliveryPromises);
-  const successful = results.filter((r) => r.success).length;
-  const failed = results.filter((r) => !r.success).length;
+function validateFormConfig(config) {
+  const errors = [];
+  warnIfWebhooksConfigured(config);
+  validateSlug(config.slug, errors);
+  validateFields(config.fields, errors);
+  validateSettings(config.settings, errors);
+  validateAccess(config.access, errors);
   return {
-    triggered: relevantWebhooks.length,
-    successful,
-    failed,
-    results
+    valid: errors.length === 0,
+    errors
   };
 }
-function fireWebhooks(options, logger) {
-  triggerWebhooks(options).then((result) => {
-    if (result.triggered > 0) {
-      if (result.failed > 0) {
-        logger?.warn?.("Some webhooks failed", {
-          event: options.event,
-          formSlug: options.form.slug,
-          submissionId: options.submission.id,
-          triggered: result.triggered,
-          successful: result.successful,
-          failed: result.failed,
-          errors: result.results.filter((r) => !r.success).map((r) => ({ url: r.url, error: r.error }))
-        });
-      } else {
-        logger?.info?.("Webhooks triggered successfully", {
-          event: options.event,
-          formSlug: options.form.slug,
-          submissionId: options.submission.id,
-          count: result.triggered
-        });
-      }
-    }
-  }).catch((error) => {
-    logger?.error?.("Unexpected error triggering webhooks", {
-      event: options.event,
-      formSlug: options.form.slug,
-      submissionId: options.submission.id,
-      error: error instanceof Error ? error.message : String(error)
-    });
-  });
-}
-function isValidWebhookUrl(url2) {
-  try {
-    const parsed = new URL(url2);
-    if (parsed.protocol !== "https:" && !parsed.hostname.match(/^(localhost|127\.0\.0\.1)$/)) {
-      return false;
-    }
-    return true;
-  } catch {
-    return false;
+function assertValidFormConfig(config) {
+  const result = validateFormConfig(config);
+  if (!result.valid) {
+    const errorMessages = result.errors.map((err) => `  - [${err.code}] ${err.path}: ${err.message}`).join("\n");
+    throw new Error(
+      `Invalid form config for '${config.slug || "unknown"}':
+${errorMessages}`
+    );
   }
 }
-function getSupportedWebhookEvents() {
-  return ["submission.created", "submission.updated", "submission.deleted"];
-}
+
+// src/config/field-helpers.ts
+var option = (label, value) => ({
+  label,
+  value: value ?? label.toLowerCase().replace(/\s+/g, "_")
+});
+var text3 = (config) => ({
+  ...config,
+  type: "text"
+});
+var email = (config) => ({
+  ...config,
+  type: "email"
+});
+var phone = (config) => ({
+  ...config,
+  type: "phone"
+});
+var url = (config) => ({
+  ...config,
+  type: "url"
+});
+var textarea3 = (config) => ({
+  ...config,
+  type: "textarea"
+});
+var number = (config) => ({
+  ...config,
+  type: "number"
+});
+var select3 = (config) => ({
+  ...config,
+  type: "select"
+});
+var checkbox2 = (config) => ({
+  ...config,
+  type: "checkbox"
+});
+var radio = (config) => ({
+  ...config,
+  type: "radio"
+});
+var file = (config) => ({
+  ...config,
+  type: "file"
+});
+var date3 = (config) => ({
+  ...config,
+  type: "date"
+});
+var time = (config) => ({
+  ...config,
+  type: "time"
+});
+var hidden = (config) => ({
+  ...config,
+  type: "hidden"
+});
 
 // src/index.ts
 var formBuilderPlugin = formBuilder().plugin;
@@ -2934,8 +3069,6 @@ export {
   assertValidFormConfig,
   checkSpam,
   checkbox2 as checkbox,
-  cleanupRateLimitStore,
-  clearRateLimitStore,
   createFormConfig,
   date3 as date,
   downloadFile,
@@ -2945,7 +3078,6 @@ export {
   exportToCSV,
   exportToJSON,
   file,
-  fireWebhooks,
   formBuilder,
   formBuilderPlugin,
   formatExportValue,
@@ -2954,9 +3086,7 @@ export {
   generateZodSchema,
   getFormBuilderConfig,
   getFormSubmissionStats,
-  getRateLimitStoreSize,
   getSupportedComparisonOperators,
-  getSupportedWebhookEvents,
   getValidationErrors,
   hidden,
   isCheckboxFormField,
@@ -2966,11 +3096,9 @@ export {
   isFormField,
   isFormFieldType,
   isKnownFormField,
-  isRateLimited,
   isSelectFormField,
   isTextFormField,
   isValidComparisonOperator,
-  isValidWebhookUrl,
   number,
   option,
   phone,
@@ -2984,7 +3112,6 @@ export {
   time,
   toTitleCase,
   transformFormData,
-  triggerWebhooks,
   url,
   validateFormConfig,
   validateFormData,