@nextlyhq/plugin-form-builder 0.0.2-alpha.73 → 0.0.2-alpha.75

package/dist/index.js

@@ -1,7 +1,8 @@
-import { A as isKnownFormField, D as isFileFormField, E as isEmailFormField, F as SCHEMA_ONLY_CONTEXT, I as SCHEMA_ONLY_READ, L as documentReachability, M as isTextFormField, N as NEW_SUBMISSIONS_WIDGET_ID, O as isFormField, P as readNewSubmissions, R as parseRedirectReference, S as ENFORCED_VALIDATION_RULES, T as isCheckboxFormField, _ as applyFormDefaults, a as exportToCSV, b as toTitleCase, c as generateExportFilename, d as getSupportedComparisonOperators, f as isValidComparisonOperator, g as applyFieldDefaults, h as DEFAULT_NOTIFICATION_SETTINGS, i as exportAndDownload, j as isSelectFormField, k as isFormFieldType, l as evaluateConditions, m as DEFAULT_FORM_SETTINGS, n as parseFieldRef, o as exportToJSON, p as normalizeFormSettings, r as downloadFile, s as formatExportValue, u as evaluateSingleCondition, v as createFormConfig, w as BUILT_IN_FORM_FIELD_TYPES, x as warnIfWebhooksConfigured, y as pluralize, z as pickedDocumentField } from "./field-references-CtzGg51W.js";
+import { $ as SCHEMA_ONLY_READ, A as applyFieldDefaults, B as downloadFile, C as isKnownFormField, D as normalizeFormSettings, E as fieldsHiddenByCondition, F as warnIfWebhooksConfigured, G as generateExportFilename, H as exportToCSV, J as getSupportedComparisonOperators, K as evaluateConditions, M as createFormConfig, N as pluralize, O as DEFAULT_FORM_SETTINGS, P as toTitleCase, Q as SCHEMA_ONLY_CONTEXT, R as formsEmailTemplates, S as isFormFieldType, T as isTextFormField, U as exportToJSON, V as exportAndDownload, W as formatExportValue, X as NEW_SUBMISSIONS_WIDGET_ID, Y as isValidComparisonOperator, Z as readNewSubmissions, _ as BUILT_IN_FORM_FIELD_TYPES, at as addressedFormPages, b as isFileFormField, d as generateZodSchema, et as documentReachability, f as getValidationErrors, h as validateFormData, j as applyFormDefaults, k as DEFAULT_NOTIFICATION_SETTINGS, m as transformFormData, nt as pickedDocumentField, p as getValidationIssues, q as evaluateSingleCondition, r as parseFieldRef, rt as FORM_EDITOR_VIEW, tt as parseRedirectReference, u as oneResponseFieldProblem, v as isCheckboxFormField, w as isSelectFormField, x as isFormField, y as isEmailFormField } from "./field-references-oCuFEwkr.js";
 import { createRequire } from "node:module";
-import { NextlyError, definePlugin, defineWidget, isLocaleSelector, rowsThatFit } from "@nextlyhq/plugin-sdk";
-import { NO_SUCH_FORM, NextlyError as NextlyError$1, RateLimiter, buildPaginatedResponse, checkbox as checkbox$1, clampLimit, date as date$1, formAvailability, group, isPluginFieldTypeOnSurface, json, relationship, resolveRateLimitStore, respondAction, respondDoc, respondList, select as select$1, stripHtmlTags, text as text$1, textarea as textarea$1, trustedClientIp } from "nextly";
+import { createHash } from "node:crypto";
+import { MAX_WIDGET_ROWS, NextlyError, defineJob, definePlugin, defineWidget, isLocaleSelector, listEntries, setting } from "@nextlyhq/plugin-sdk";
+import { NO_SUCH_FORM, NextlyError as NextlyError$1, RateLimiter, buildPaginatedResponse, checkbox as checkbox$1, clampLimit, date as date$1, formAvailability, group, isPluginFieldTypeOnSurface, json, number as number$1, relationship, resolveRateLimitStore, respondAction, respondDoc, respondList, select as select$1, stripHtmlTags, text as text$1, textarea as textarea$1, trustedClientIp } from "nextly";
 import { previewUrlFromTemplate } from "nextly/config";
 import { z } from "zod";
 
@@ -476,6 +477,20 @@ function redirectRefusal(message, field) {
 		message
 	}] });
 }
+/**
+* A field read rule admitting the callers who can update forms of this
+* collection, and no one else: what the people managing a form may see, and
+* a visitor may not.
+*
+* A super-admin is admitted by role. They may save any form, since the
+* collection gate admits them before any rule, but field rules still apply
+* to them, and their role need not hold `update-<slug>` as a stored grant. A
+* field they could save but not read would come back empty to the editor
+* and be saved empty. So everyone who can save a form can read these fields.
+*/
+function readableByFormEditors(slug) {
+	return ({ permissions, roles }) => permissions.includes(`update-${slug}`) || roles.includes("super-admin");
+}
 function formsCollection(pluginConfig) {
 	const { slug, labels, fields: additionalFields, access: accessOverrides, hooks: hookOverrides, admin: adminOverrides, ...overrides } = pluginConfig.formOverrides;
 	const redirectCollections = Object.keys(pluginConfig.redirectRelationships);
@@ -545,8 +560,40 @@ function formsCollection(pluginConfig) {
 	settingsFields.push(checkbox$1({
 		name: "allowMultipleSubmissions",
 		label: "Allow Multiple Submissions",
-		defaultValue: true,
-		admin: { description: "Allow the same user/IP to submit this form multiple times" }
+		admin: { hidden: true }
+	}), select$1({
+		name: "oneResponse",
+		label: "One response per person",
+		options: [
+			{
+				label: "Allow several responses",
+				value: "off"
+			},
+			{
+				label: "One per email address",
+				value: "email"
+			},
+			{
+				label: "One per browser",
+				value: "browser"
+			},
+			{
+				label: "One per network (IP address)",
+				value: "ip"
+			}
+		]
+	}), text$1({
+		name: "oneResponseField",
+		label: "Email field for one response per person"
+	}), number$1({
+		name: "oneResponseVersion",
+		label: "One-response version",
+		defaultValue: 0,
+		admin: { hidden: true }
+	}), number$1({
+		name: "oneResponseKeyedVersion",
+		label: "One-response keys made for version",
+		admin: { hidden: true }
 	}), checkbox$1({
 		name: "honeypotEnabled",
 		label: "Honeypot",
@@ -554,7 +601,47 @@ function formsCollection(pluginConfig) {
 	}), checkbox$1({
 		name: "captchaEnabled",
 		label: "Enable reCAPTCHA",
-		admin: { description: "Per-form reCAPTCHA override; unset inherits the plugin default" }
+		admin: { hidden: true }
+	}), select$1({
+		name: "botCheck",
+		label: "Bot check",
+		options: [
+			{
+				label: "Site default",
+				value: "default"
+			},
+			{
+				label: "Off",
+				value: "off"
+			},
+			{
+				label: "reCAPTCHA",
+				value: "recaptcha"
+			},
+			{
+				label: "Turnstile",
+				value: "turnstile"
+			}
+		]
+	}), date$1({
+		name: "closesAt",
+		label: "Closes at"
+	}), number$1({
+		name: "submissionLimit",
+		label: "Submission limit",
+		min: 1
+	}), checkbox$1({
+		name: "storeIpAndBrowser",
+		label: "Store IP address and browser",
+		defaultValue: true
+	}), number$1({
+		name: "keepDays",
+		label: "Keep submissions for (days)",
+		min: 1
+	}), textarea$1({
+		name: "internalNote",
+		label: "Internal note",
+		access: { read: readableByFormEditors(slug) }
 	}), text$1({
 		name: "captchaSiteKey",
 		label: "reCAPTCHA Site Key",
@@ -601,7 +688,8 @@ function formsCollection(pluginConfig) {
 			name: "notifications",
 			label: "Notifications",
 			defaultValue: [],
-			admin: { description: "Email notification rules. Managed by the Form Builder UI." }
+			admin: { description: "Email notification rules. Managed by the Form Builder UI." },
+			access: { read: readableByFormEditors(slug) }
 		}),
 		select$1({
 			name: "status",
@@ -660,7 +748,7 @@ function formsCollection(pluginConfig) {
 			order: 50,
 			useAsTitle: "name",
 			description: "Create and manage your form templates using the visual form builder. Create and manage forms for collecting user submissions",
-			components: { views: { Edit: { Component: "@nextlyhq/plugin-form-builder/admin#FormBuilderView" } } },
+			components: { views: { Edit: { Component: FORM_EDITOR_VIEW } } },
 			...adminOverrides
 		},
 		access: accessWithDefaults(accessOverrides, { read: true }),
@@ -698,6 +786,15 @@ function formsCollection(pluginConfig) {
 function trustedSubmittedAt(context) {
 	return context.req?.http === void 0 && Boolean(context.data?.submittedAt);
 }
+/** The unique index one response per person rests on. */
+const RESPONSE_KEY_INDEX = {
+	fields: ["form", "responseKey"],
+	unique: true
+};
+/** Whether two index declarations name the same columns and uniqueness. */
+function sameIndex(index, other) {
+	return index.fields.join("\0") === other.fields.join("\0") && (index.unique ?? false) === (other.unique ?? false);
+}
 /**
 * Generate the Form Submissions collection configuration.
 *
@@ -820,6 +917,11 @@ function submissionsCollection(pluginConfig) {
 				readOnly: true,
 				description: "ID of the admin who last edited the submitted data"
 			}
+		}),
+		text$1({
+			name: "responseKey",
+			label: "One-response key",
+			admin: { hidden: true }
 		})
 	];
 	let finalFields;
@@ -864,7 +966,8 @@ function submissionsCollection(pluginConfig) {
 				return data;
 			}]
 		},
-		...overrides
+		...overrides,
+		indexes: [RESPONSE_KEY_INDEX, ...(overrides.indexes ?? []).filter((index) => !sameIndex(index, RESPONSE_KEY_INDEX))]
 	};
 }
 
@@ -938,8 +1041,14 @@ function newSubmissionsWidget(declared, submissionsPath) {
 			signal
 		}) > 0,
 		skeleton: "list",
-		load: async ({ services, size, signal, scope }) => readNewSubmissions(services, declared, {
-			limit: rowsThatFit(size, { density: "default" }),
+		settings: { limit: setting.number({
+			label: "Number of entries",
+			defaultValue: 5,
+			min: 1,
+			max: MAX_WIDGET_ROWS
+		}) },
+		load: async ({ services, settings, signal, scope }) => readNewSubmissions(services, declared, {
+			limit: listEntries(settings.limit),
 			signal,
 			scope,
 			submissionsPath: submissionsPath()
@@ -988,408 +1097,609 @@ function asFormDocument(row) {
 	return row;
 }
 
-// src/utils/generate-schema.ts
-/**
-* Generate a Zod validation schema from form field configuration.
-*
-* Creates a dynamic Zod schema based on the form fields array,
-* applying appropriate validation rules for each field type.
-*
-* @param fields - Array of form field configurations
-* @returns Zod object schema for validating submission data
-*
-* @example
-* ```typescript
-* const fields: FormField[] = [
-*   { type: 'text', name: 'firstName', label: 'First Name', required: true },
-*   { type: 'email', name: 'email', label: 'Email', required: true },
-*   { type: 'number', name: 'age', label: 'Age', validation: { min: 18, max: 120 } },
-* ];
-*
-* const schema = generateZodSchema(fields);
-* const result = schema.safeParse({ firstName: 'John', email: 'john@example.com', age: 25 });
-* ```
-*/
-function generateZodSchema(fields) {
-	const schemaShape = {};
+// src/emails/answers.ts
+/** Whether a stored answer counts as given. */
+function isAnswered(value) {
+	if (value === void 0 || value === null) return false;
+	if (typeof value === "string") return value.trim() !== "";
+	if (Array.isArray(value)) return value.length > 0;
+	return true;
+}
+/** A choice field's stored value(s) replaced by its option labels. */
+function choiceLabels(field, value) {
+	const options = field.options;
+	if (!Array.isArray(options)) return value;
+	const label = (v) => options.find((option) => option.value === v)?.label ?? v;
+	return Array.isArray(value) ? value.map(label) : label(value);
+}
+/** A file answer: how many, and whether they come with the email. */
+function fileAnswer(field, value) {
+	const count = Array.isArray(value) ? value.length : 1;
+	const files = count === 1 ? "1 file" : `${count} files`;
+	return field.attachToEmail ? `${files}, attached` : `${files}, uploaded`;
+}
+/** Whether the form's conditions showed `field` for these answers. */
+function wasShown(field, data) {
+	const logic = field.conditionalLogic;
+	return evaluateConditions(logic, data);
+}
+/** The answers in a submission, for a notification's `_submission.answers`. */
+function submissionAnswers(fields, data) {
+	const answers = [];
 	for (const field of fields) {
-		if (!isKnownFormField(field)) {
-			schemaShape[field.name] = field.required ? z.unknown().refine((value) => value !== void 0 && value !== null && value !== "", { message: `${field.label || field.name} is required` }) : z.unknown();
-			continue;
-		}
-		if (field.type === "hidden" && !field.required) {
-			schemaShape[field.name] = z.string().optional();
+		if (field.type === "hidden") continue;
+		const value = data[field.name];
+		if (!isAnswered(value) || !wasShown(field, data)) continue;
+		if (field.type === "file") {
+			answers.push({
+				label: field.label || field.name,
+				value: fileAnswer(field, value)
+			});
 			continue;
 		}
-		const fieldSchema = generateFieldSchema(field);
-		if (fieldSchema) schemaShape[field.name] = fieldSchema;
+		const shown = field.type === "select" || field.type === "radio" ? choiceLabels(field, value) : value;
+		answers.push({
+			label: field.label || field.name,
+			value: formatExportValue(shown, field)
+		});
 	}
-	return z.object(schemaShape);
+	return answers;
 }
+
+// src/handlers/bot-check-send.ts
+/** Where each provider verifies a token. */
+const VERIFY_URLS = {
+	recaptcha: "https://www.google.com/recaptcha/api/siteverify",
+	turnstile: "https://challenges.cloudflare.com/turnstile/v0/siteverify"
+};
+/** The hosts those requests go to, for the plugin's outbound allowlist. */
+const VERIFY_HOSTS = {
+	recaptcha: "www.google.com",
+	turnstile: "challenges.cloudflare.com"
+};
 /**
-* Generate a Zod schema for a single field.
+* Ask `provider` whether `token` is good, as both providers take it: a form
+* post of the secret, the token and, where known, the visitor's address.
+* Answers the provider's JSON; throws when it could not be reached or did
+* not answer 200.
 */
-function generateFieldSchema(field) {
-	switch (field.type) {
-		case "text": return generateTextSchema(field);
-		case "email": return generateEmailSchema(field);
-		case "number": return generateNumberSchema(field);
-		case "phone": return generatePhoneSchema(field);
-		case "url": return generateUrlSchema(field);
-		case "textarea": return generateTextareaSchema(field);
-		case "select": return generateSelectSchema(field);
-		case "checkbox": return generateCheckboxSchema(field);
-		case "radio": return generateRadioSchema(field);
-		case "file": return generateFileSchema(field);
-		case "date": return generateDateSchema(field);
-		case "time": return generateTimeSchema(field);
-		case "hidden": return generateHiddenSchema(field);
-		default: return z.unknown();
-	}
+async function sendVerification(fetch, provider, request) {
+	const body = new URLSearchParams({
+		secret: request.secret,
+		response: request.token,
+		...request.ip ? { remoteip: request.ip } : {}
+	});
+	const response = await fetch(VERIFY_URLS[provider], {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: body.toString()
+	});
+	if (!response.ok) throw new Error(`${provider} verification answered ${response.status}`);
+	return response.json();
 }
+
+// src/handlers/bot-check.ts
+/**
+* Bot checks: Google reCAPTCHA v3, which scores each visitor in the
+* background, and Cloudflare Turnstile, which checks them in the background
+* and rarely shows a puzzle. Either gives the visitor's browser a token,
+* which the site's form sends with the submission under the provider's own
+* field name, and which the server verifies with the provider before the
+* submission is accepted.
+*
+* A token that fails, or a submission that brings none, is stored flagged as
+* spam, as a honeypot hit is, so a false positive stays reviewable and
+* recoverable. A provider that cannot be reached leaves the submission
+* unchecked, and says so in the log: an outage must not send every real
+* submission to spam. A form whose check has no secret configured is
+* accepted unchecked, as before bot checks were verified, with a warning at
+* start and in Settings.
+*
+* @module handlers/bot-check
+*/
+/** The field each provider's widget puts its token in, as forms send it. */
+const TOKEN_FIELDS = {
+	recaptcha: "g-recaptcha-response",
+	turnstile: "cf-turnstile-response"
+};
+/** The score below which reCAPTCHA calls a visitor a bot, unless set. */
+const DEFAULT_SCORE_THRESHOLD = .5;
 /**
-* Generate schema for text field.
+* The provider a form's bot check names, its site default resolved: the
+* plugin's reCAPTCHA when enabled, else its Turnstile when enabled, else none.
 */
-/**
-* The author's own wording for a failure, or `undefined` when this field's type
-* does not enforce `message`.
-*
-* Asked of the row rather than read off `validation` directly, for the reason
-* the table exists at all: the editor decides whether to OFFER the control from
-* that row, so a generator honouring a stored message regardless would enforce
-* a value the author was never shown a box for — and, worse, the table would
-* describe a rule it did not govern.
-*
-* `message` was the one rule that stayed outside this. It agreed with the table
-* only because every row happens to list it, which is agreement by coincidence:
-* drop `message` from a row and the control disappears while the wording went
-* on being applied.
-*/
-function customMessage(field) {
-	if (!(ENFORCED_VALIDATION_RULES[field.type] ?? []).includes("message")) return void 0;
-	return field.validation?.errorMessage;
+function botProviderOf(botCheck, spam) {
+	if (botCheck === "off") return void 0;
+	if (botCheck === "recaptcha" || botCheck === "turnstile") return botCheck;
+	if (spam.recaptcha?.enabled === true) return "recaptcha";
+	if (spam.turnstile?.enabled === true) return "turnstile";
+}
+/** The plugin's secret for `provider`, when one is set. */
+function secretOf(provider, spam) {
+	const secret = spam[provider]?.secretKey;
+	return secret ? secret : void 0;
 }
 /**
-* A field's stored bounds, with the custom message already resolved by the row.
-*
-* Handed to the appliers so they cannot read an ungated message: they take a
-* validation object, and giving them one whose `errorMessage` has been through
-* {@link customMessage} makes the rule hold for every applier without each of
-* them having to remember it.
+* The site key a visitor's form renders `provider`'s widget with: the
+* plugin's, or, for reCAPTCHA, a key the form stored itself before keys
+* moved into the plugin's options.
 */
-function enforcedValidation(field) {
-	return {
-		...field.validation ?? {},
-		errorMessage: customMessage(field)
-	};
+function siteKeyOf(provider, spam, settings) {
+	const own = spam[provider]?.siteKey;
+	if (own) return own;
+	return provider === "recaptcha" ? settings.captchaSiteKey : void 0;
 }
 /**
-* Which rules a type's schema applies, and how each one constrains a string.
-*
-* The WHICH comes from {@link ENFORCED_VALIDATION_RULES}, which the field
-* editor also reads to decide what to offer. One definition answers both
-* questions, so a rule cannot be offered by the editor and ignored here, or
-* honoured here and hidden there — the two used to state the same thing
-* separately and could only agree by being edited together.
-*
-* The HOW stays here, because it is about zod and the table is deliberately
-* free of it: the editor imports the table, and pulling the schema builder in
-* behind it would ship this file and its validation library to every admin
-* client before anyone opened a field.
-*/
-const STRING_RULE_APPLIERS = {
-	minLength: (schema, validation) => validation.minLength === void 0 ? schema : schema.min(validation.minLength, validation.errorMessage || `Minimum ${validation.minLength} characters required`),
-	maxLength: (schema, validation) => validation.maxLength === void 0 ? schema : schema.max(validation.maxLength, validation.errorMessage || `Maximum ${validation.maxLength} characters allowed`),
-	pattern: (schema, validation, fallback) => validation.pattern ? schema.regex(new RegExp(validation.pattern), validation.errorMessage || fallback) : schema
-};
-/** The same, for the bounds a number carries. */
-const NUMBER_RULE_APPLIERS = {
-	min: (schema, validation) => validation.min === void 0 ? schema : schema.min(validation.min, validation.errorMessage || `Minimum value is ${validation.min}`),
-	max: (schema, validation) => validation.max === void 0 ? schema : schema.max(validation.max, validation.errorMessage || `Maximum value is ${validation.max}`)
-};
+* `provider`'s keys for a form, when both are known: the secret to verify
+* with and a site key for the visitor's widget. A check missing either is
+* not run: without a site key no visitor could produce a token, and every
+* real submission would be flagged.
+*/
+function readyKeys(provider, spam, settings) {
+	const secret = secretOf(provider, spam);
+	const siteKey = siteKeyOf(provider, spam, settings);
+	return secret && siteKey ? {
+		secret,
+		siteKey
+	} : void 0;
+}
 /**
-* Whether an author-supplied pattern actually replaces a type's intrinsic one.
-*
-* Two conditions, and both are load-bearing: a pattern must be stored, AND the
-* type's row must enforce `pattern`. A type that keeps its own shape check —
-* a phone, a URL — stands it down only for an override that will really be
-* applied, because standing down for one that will not leaves nothing behind.
+* Whether a form's bot check will be run: it names a provider and that
+* provider's keys are both known. The same answer `judgeBotCheck` acts on.
 */
-function overridesPattern(field) {
-	if (!(ENFORCED_VALIDATION_RULES[field.type] ?? []).includes("pattern")) return false;
-	const validation = field.validation ?? {};
-	return Boolean(validation.pattern);
+function botCheckReady(settings, spam) {
+	const provider = botProviderOf(settings.botCheck, spam);
+	return provider !== void 0 && readyKeys(provider, spam, settings) !== void 0;
 }
+const RECAPTCHA_ANSWER = z.object({
+	success: z.boolean(),
+	score: z.number().optional()
+});
+const TURNSTILE_ANSWER = z.object({ success: z.boolean() });
 /**
-* Constrain a string schema by the rules this field's TYPE enforces.
-*
-* A rule the type does not list is not applied even when the field carries a
-* value for it, which is the point: a `pattern` stored on a textarea is a bound
-* the editor never offered, and honouring it here would enforce a restriction
-* its author could not see.
-*
-* `patternMessage` is the type's own wording for a failed pattern — "Invalid
-* URL format" reads differently from "Invalid format" — so the rule set decides
-* WHICH constraints apply while each type keeps its own voice.
+* Verify `token` with `provider`. A missing token fails: the form's widget
+* never ran. A provider that cannot be reached, or answers something that is
+* not its answer, leaves the submission unchecked.
 */
-function applyStringRules(schema, field, patternMessage) {
-	const validation = enforcedValidation(field);
-	let constrained = schema;
-	for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
-		const apply = STRING_RULE_APPLIERS[rule];
-		if (apply) constrained = apply(constrained, validation, patternMessage);
+async function judgeBotToken(input) {
+	if (!input.token) return "fail";
+	if (!input.fetch) return "unchecked";
+	let answer;
+	try {
+		answer = await sendVerification(input.fetch, input.provider, {
+			secret: input.secret,
+			token: input.token,
+			...input.ip ? { ip: input.ip } : {}
+		});
+	} catch {
+		return "unchecked";
 	}
-	return constrained;
-}
-function generateTextSchema(field) {
-	return applyRequired(applyStringRules(z.string(), field, "Invalid format"), field.required, customMessage(field));
+	if (input.provider === "turnstile") {
+		const parsed = TURNSTILE_ANSWER.safeParse(answer);
+		if (!parsed.success) return "unchecked";
+		return parsed.data.success ? "pass" : "fail";
+	}
+	const parsed = RECAPTCHA_ANSWER.safeParse(answer);
+	if (!parsed.success) return "unchecked";
+	const threshold = input.scoreThreshold ?? DEFAULT_SCORE_THRESHOLD;
+	return parsed.data.success && (parsed.data.score ?? 0) >= threshold ? "pass" : "fail";
 }
+const KEY = z.string().trim().min(1).optional();
+/** The bot-check options, as the plugin's options give them. */
+const BOT_CHECK_OPTIONS = z.object({
+	recaptcha: z.object({
+		enabled: z.boolean(),
+		siteKey: KEY,
+		secretKey: KEY,
+		scoreThreshold: z.number().min(0).max(1).optional()
+	}).optional(),
+	turnstile: z.object({
+		enabled: z.boolean(),
+		siteKey: KEY,
+		secretKey: KEY
+	}).optional()
+});
 /**
-* Generate schema for email field.
+* The bot-check part of the plugin's options, parsed at start: a key that is
+* not a string, or a score threshold outside 0 to 1, fails the start with
+* the option named, rather than every submission later.
 */
-function generateEmailSchema(field) {
-	return applyRequired(applyStringRules(z.string().email(customMessage(field) || "Invalid email address"), field, "Invalid email format"), field.required, customMessage(field));
+function botCheckOptions(spamProtection) {
+	const source = spamProtection !== null && typeof spamProtection === "object" ? spamProtection : {};
+	const parsed = BOT_CHECK_OPTIONS.safeParse({
+		recaptcha: source.recaptcha,
+		turnstile: source.turnstile
+	});
+	if (!parsed.success) {
+		const issue = parsed.error.issues[0];
+		throw new Error(`formBuilder: spamProtection.${issue?.path.join(".") ?? ""} is not valid: ${issue?.message ?? "invalid"}`);
+	}
+	return {
+		recaptcha: parsed.data.recaptcha ?? { enabled: false },
+		turnstile: parsed.data.turnstile ?? { enabled: false }
+	};
 }
 /**
-* Generate schema for number field.
+* The hosts the plugin's bot checks call, for its outbound allowlist: a
+* provider's only when its secret is set, so a site using neither declares
+* no network access at all.
 */
-function generateNumberSchema(field) {
-	let schema = z.number({ error: (issue) => issue.input === void 0 ? customMessage(field) || "This field is required" : "Must be a number" });
-	const validation = enforcedValidation(field);
-	for (const rule of ENFORCED_VALIDATION_RULES[field.type] ?? []) {
-		const apply = NUMBER_RULE_APPLIERS[rule];
-		if (apply) schema = apply(schema, validation);
+function botCheckHosts(spam) {
+	return ["recaptcha", "turnstile"].filter((provider) => secretOf(provider, spam) !== void 0).map((provider) => VERIFY_HOSTS[provider]);
+}
+/** The tokens in a submission's payload, before its own fields are kept. */
+function botTokensOf(payload) {
+	const tokens = {};
+	for (const provider of ["recaptcha", "turnstile"]) {
+		const value = payload[TOKEN_FIELDS[provider]];
+		if (typeof value === "string" && value.trim() !== "") tokens[provider] = value.trim();
 	}
-	if (field.required) return schema;
-	return schema.optional().nullable();
+	return tokens;
 }
 /**
-* Generate schema for phone field.
-*/
-function generatePhoneSchema(field) {
-	return applyRequired(applyStringRules(overridesPattern(field) ? z.string() : z.string().regex(/^[\d\s\-+()]+$/, customMessage(field) || "Invalid phone number"), field, "Invalid phone number format"), field.required, customMessage(field));
+* A request-made submission's bot check: none when its form's check is off,
+* or names a provider missing its secret or site key (accepted unchecked, as
+* warned at start and in Settings); a spam verdict when the token fails or
+* is missing.
+*/
+async function judgeBotCheck(input) {
+	const provider = botProviderOf(input.settings.botCheck, input.spam);
+	if (provider === void 0) return void 0;
+	const keys = readyKeys(provider, input.spam, input.settings);
+	if (keys === void 0) return void 0;
+	const verdict = await judgeBotToken({
+		provider,
+		secret: keys.secret,
+		token: input.tokens[provider],
+		...input.ip ? { ip: input.ip } : {},
+		scoreThreshold: input.spam.recaptcha?.scoreThreshold,
+		fetch: input.fetch
+	});
+	if (verdict === "unchecked") input.warn("Form Builder: the bot check could not be completed, so the submission was accepted unchecked", { provider });
+	return verdict === "fail" ? {
+		isSpam: true,
+		reason: provider
+	} : void 0;
 }
 /**
-* Generate schema for URL field.
+* Warn, once at start, for each bot check that is in use (the site default,
+* or named by a form) without both of its keys, naming the options: those
+* forms' submissions are accepted unchecked until it is. Reads at most the
+* first 500 forms; a failure to read them is not a reason to stop the start.
 */
-function generateUrlSchema(field) {
-	return applyRequired(applyStringRules(z.string().url(customMessage(field) || "Invalid URL"), field, "Invalid URL format"), field.required, customMessage(field));
+async function warnUncheckedBotChecks(input) {
+	let forms = [];
+	try {
+		forms = await input.forms();
+	} catch {
+		forms = [];
+	}
+	const counts = /* @__PURE__ */ new Map();
+	for (const form of forms) {
+		const settings = input.readSettings(form.settings);
+		const provider = botProviderOf(settings.botCheck, input.spam);
+		if (provider && readyKeys(provider, input.spam, settings) === void 0) counts.set(provider, (counts.get(provider) ?? 0) + 1);
+	}
+	const siteDefault = botProviderOf("default", input.spam);
+	if (siteDefault && readyKeys(siteDefault, input.spam, {}) === void 0) counts.set(siteDefault, counts.get(siteDefault) ?? 0);
+	for (const [provider, forms] of counts) input.warn(`Form Builder: the ${provider === "recaptcha" ? "reCAPTCHA" : "Turnstile"} bot check is in use without both of its keys, so its submissions are accepted unchecked. Set spamProtection.${provider}.secretKey and spamProtection.${provider}.siteKey in the plugin's options.`, {
+		provider,
+		forms
+	});
 }
-/**
-* Generate schema for textarea field.
-*/
-function generateTextareaSchema(field) {
-	return applyRequired(applyStringRules(z.string(), field, "Invalid format"), field.required, customMessage(field));
+/** {@link BotCheckDefaults} for the admin: whether keys are set, never the keys. */
+function botCheckDefaults(spam) {
+	const keys = (provider) => ({
+		secret: secretOf(provider, spam) !== void 0,
+		siteKey: Boolean(spam[provider]?.siteKey)
+	});
+	return {
+		botCheckDefault: botProviderOf("default", spam) ?? null,
+		botChecks: {
+			recaptcha: keys("recaptcha"),
+			turnstile: keys("turnstile")
+		},
+		rateLimit: spam.rateLimit ?? null
+	};
 }
 /**
-* Generate schema for select field.
-*/
-function generateSelectSchema(field) {
-	const validValues = field.options.map((opt) => opt.value);
-	if (field.allowMultiple) {
-		const schema = z.array(z.enum(validValues));
-		if (field.required) return schema.min(1, customMessage(field) || "Please select at least one option");
-		return schema.optional();
-	}
-	const schema = z.enum(validValues, { error: () => customMessage(field) || "Please select a valid option" });
-	if (field.required) return schema;
-	return schema.optional();
+* The bot check a visitor's form renders, as the public read of a form gives
+* it: the provider and its site key, or none when the form's check is off,
+* names a provider with no secret (not verified, so not shown), or has no
+* site key to render with.
+*/
+function publicBotCheck(storedSettings, spam) {
+	const settings = normalizeFormSettings(storedSettings);
+	const provider = botProviderOf(settings.botCheck, spam);
+	if (provider === void 0) return void 0;
+	const keys = readyKeys(provider, spam, settings);
+	return keys ? {
+		provider,
+		siteKey: keys.siteKey,
+		field: TOKEN_FIELDS[provider]
+	} : void 0;
 }
+
+// src/utils/form-closing.ts
 /**
-* Generate schema for checkbox field.
+* Whether a form is taking submissions now: its status, as core reads it for
+* every way a form is reached, then the form's closing time and its limit.
+*
+* Whatever closes a form (its author by hand, its closing time or its limit),
+* a visitor is told one thing: the form's closed message, or the generic
+* sentence when its author wrote none. That message is core's own answer for
+* a closed form, asked of this form, so the three causes cannot drift apart.
+*
+* @module utils/form-closing
 */
-function generateCheckboxSchema(field) {
-	const schema = z.boolean();
-	if (field.required) return schema.refine((val) => val === true, { message: customMessage(field) || "This field is required" });
-	return schema.optional();
-}
 /**
-* Generate schema for radio field.
+* The message a visitor is given when this form is closed: core's answer for
+* the form had its author closed it, whether or not they did.
 */
-function generateRadioSchema(field) {
-	const validValues = field.options.map((opt) => opt.value);
-	const schema = z.enum(validValues, { error: () => customMessage(field) || "Please select an option" });
-	if (field.required) return schema;
-	return schema.optional();
+function closedMessageOf(form) {
+	const asClosed = formAvailability({
+		closedMessage: form.closedMessage,
+		status: "closed",
+		wentLiveAt: "live"
+	});
+	if (asClosed.kind !== "closed") throw new Error("a closed form that has been public explains itself");
+	return asClosed.message;
+}
+/** Whether the form's closing time has passed at `now`. */
+function pastClosingTime(settings, now) {
+	if (settings.closesAt === void 0) return false;
+	const closesAt = Date.parse(settings.closesAt);
+	return Number.isFinite(closesAt) && now.getTime() >= closesAt;
+}
+/** Whether `taken` non-spam submissions fill the form's limit. */
+function limitReached(settings, taken) {
+	return settings.submissionLimit !== void 0 && taken >= settings.submissionLimit;
 }
 /**
-* Generate schema for file field.
-*
-* Note: File validation is typically handled server-side.
-* This schema validates file references (IDs or URLs).
-*/
-function generateFileSchema(field) {
-	if (field.multiple) {
-		const schema = z.array(z.string());
-		if (field.required) return schema.min(1, customMessage(field) || "Please upload at least one file");
-		return schema.optional();
-	}
-	return applyRequired(z.string(), field.required, customMessage(field));
+* The form's answer to a visitor now. Core decides by status first, so a
+* draft stays absent and a form closed by hand keeps its own answer; a
+* published one is then closed by its closing time, and by its limit when
+* `taken` (its non-spam submissions) is known.
+*/
+function formAvailabilityNow(form, settings, at) {
+	const byStatus = formAvailability(form);
+	if (byStatus.kind !== "open") return byStatus;
+	const closedBy = closedByNow(settings, at);
+	return closedBy === void 0 ? byStatus : {
+		kind: "closed",
+		message: closedMessageOf(form),
+		closedBy
+	};
+}
+/** What closes an open form now, if anything does. */
+function closedByNow(settings, at) {
+	if (pastClosingTime(settings, at.now)) return "date";
+	if (at.taken !== void 0 && limitReached(settings, at.taken)) return "limit";
+}
+
+// src/handlers/one-response.ts
+/** What a visitor sending a second response is told. */
+const ALREADY_RESPONDED = "You have already submitted this form.";
+/**
+* The answer a visitor's browser sends its token in, for a form that takes
+* one response per browser. The form's script keeps one random token per
+* browser and sends it with every submission; the row never stores it.
+*/
+const BROWSER_TOKEN_FIELD = "nextly-browser-token";
+/**
+* What every browser key starts with. The token is not stored, so a browser
+* key cannot be made again from the row the way an address's can; the prefix
+* is what lets the submission's hold tell a key made for one per browser from
+* one made for another mode, and refuse it once the form's mode has changed.
+* Digests are hex, so no address or network key can start with it.
+*/
+const BROWSER_KEY_PREFIX = "browser:";
+/**
+* What a key made under the form's one-response `version` starts with. The
+* version moves on each time the form changes how it tells people apart (its
+* mode, or the Email field it reads), so every key made before the change
+* stops matching a new one without a write to any earlier submission; the
+* keys of earlier submissions are then made again for the new version
+* (`one-response-rebuild`). Version 0 has no prefix, so keys stored before
+* versions were written keep matching.
+*/
+function keyPrefixOf(version) {
+	return version !== void 0 && version > 0 ? `v${version}:` : "";
+}
+/** The one-response version a stored key was made under. */
+function keyVersionOf(key) {
+	const match = /^v(\d+):/.exec(key);
+	return match ? Number(match[1]) : 0;
 }
 /**
-* Generate schema for date field.
+* Whether the form's earlier submissions are still being given keys for its
+* current version (`one-response-rebuild`). Unset reads as up to date: a form
+* saved before the version was recorded has keys for version 0.
 */
-function generateDateSchema(field) {
-	let schema = z.string();
-	schema = schema.refine((val) => {
-		if (!val) return true;
-		const date = new Date(val);
-		return !isNaN(date.getTime());
-	}, { message: customMessage(field) || "Invalid date" });
-	if (field.min || field.max) schema = schema.refine((val) => {
-		if (!val) return true;
-		const date = new Date(val);
-		if (field.min && date < new Date(field.min)) return false;
-		if (field.max && date > new Date(field.max)) return false;
-		return true;
-	}, { message: customMessage(field) || `Date must be between ${field.min || "any"} and ${field.max || "any"}` });
-	if (field.required) return schema.refine((val) => val !== void 0 && val !== null && val !== "", { message: customMessage(field) || "This field is required" });
-	return schema.optional().or(z.literal(""));
+function keysBehind(settings) {
+	const keyed = settings.oneResponseKeyedVersion;
+	return keyed !== void 0 && keyed < (settings.oneResponseVersion ?? 0);
 }
 /**
-* Generate schema for time field.
+* What tells one person from another on a form: its mode, and for one per
+* email the field it reads. A change to it is a change of version.
 */
-function generateTimeSchema(field) {
-	return applyRequired(z.string().regex(/^([0-1]?[0-9]|2[0-3]):[0-5][0-9]$/, customMessage(field) || "Invalid time format (HH:mm)"), field.required, customMessage(field));
+function oneResponseIdentityOf(settings) {
+	const mode = settings.oneResponse ?? "off";
+	return mode === "email" ? `email:${settings.oneResponseField ?? ""}` : mode;
 }
 /**
-* Generate schema for hidden field.
+* A browser token as the form's script makes one: a random identifier
+* (`crypto.randomUUID()` is one), letters, digits, `-` and `_`. Anything else
+* is treated as no token, so a malformed value can neither be stored as a
+* key nor fill the index with arbitrary text.
 */
-function generateHiddenSchema(field) {
-	return applyRequired(z.string(), field.required, customMessage(field));
+const BROWSER_TOKEN = z.string().trim().regex(/^[A-Za-z0-9_-]{16,128}$/);
+/** The browser token a submission's answers carry, if a well-formed one. */
+function browserTokenOf(payload) {
+	const parsed = BROWSER_TOKEN.safeParse(answersOf(payload)?.[BROWSER_TOKEN_FIELD]);
+	return parsed.success ? parsed.data : void 0;
 }
 /**
-* Apply required/optional to a schema.
+* What a visitor's form needs to take part in one response per browser: the
+* answer to send its token in. Other modes need nothing from the browser, and
+* a form that does not compare by browser says nothing.
 */
-function applyRequired(schema, required, errorMessage) {
-	if (required) return schema.min(1, errorMessage || "This field is required");
-	return schema.optional().or(z.literal(""));
+function publicOneResponse(settings) {
+	return settings.oneResponse === "browser" ? {
+		by: "browser",
+		field: BROWSER_TOKEN_FIELD
+	} : void 0;
+}
+/** Whether `key` was made for one response per browser, under `version`. */
+function isBrowserKey(key, version) {
+	return typeof key === "string" && key.startsWith(`${keyPrefixOf(version)}${BROWSER_KEY_PREFIX}`);
+}
+/** A non-empty string, trimmed, or undefined. */
+function textOf(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
 }
 /**
-* Transform form data before validation.
-*
-* Handles type coercion and normalization:
-* - Converts string numbers to actual numbers
-* - Converts string booleans to actual booleans
-* - Trims string values
-* - Handles empty strings
-*
-* @param data - Raw form data
-* @param fields - Form field configurations
-* @returns Transformed data ready for validation
+* A submission's answers as an object: as written, or as a stored row holds
+* them before a read decodes them, a JSON string.
 */
-function transformFormData(data, fields) {
-	const transformed = {};
-	for (const field of fields) {
-		const value = data[field.name];
-		if (value === void 0) continue;
-		transformed[field.name] = isKnownFormField(field) ? transformFieldValue(value, field) : value;
+function answersOf(data) {
+	let value = data;
+	if (typeof value === "string") try {
+		value = JSON.parse(value);
+	} catch {
+		return;
 	}
-	return transformed;
+	return value !== null && typeof value === "object" ? value : void 0;
+}
+/** The answer to `field` in a submission's data. */
+function answerOf(data, field) {
+	return field === void 0 ? void 0 : answersOf(data)?.[field];
 }
 /**
-* Transform a single field value based on its type.
-*/
-function transformFieldValue(value, field) {
-	if (value === null || value === void 0) return value;
-	switch (field.type) {
-		case "number":
-			if (typeof value === "string") {
-				const num = parseFloat(value);
-				return isNaN(num) ? value : num;
-			}
-			return value;
-		case "checkbox":
-			if (typeof value === "string") return value === "true" || value === "1" || value === "on";
-			return Boolean(value);
-		case "text":
-		case "email":
-		case "phone":
-		case "url":
-		case "textarea":
-		case "hidden":
-			if (typeof value === "string") return value.trim();
-			return value;
-		case "select":
-			if (field.allowMultiple) {
-				if (!Array.isArray(value)) return value ? [value] : [];
-			}
-			return value;
-		default: return value;
+* The submission's key under the form's one-response setting, or null when
+* it has none: the form allows several responses, the submission is spam,
+* or what the mode compares is missing (a submission with no address, or
+* none of the browser token, which only a create brings).
+*/
+async function responseKeyOf(digests, settings, submission) {
+	if (submission.status === "spam") return null;
+	const prefix = keyPrefixOf(settings.oneResponseVersion);
+	switch (settings.oneResponse) {
+		case "ip": {
+			const address = textOf(submission.ipAddress);
+			return address === void 0 ? null : `${prefix}${await digests().digest("ip", address)}`;
+		}
+		case "email": {
+			const email = textOf(answerOf(submission.data, settings.oneResponseField));
+			return email === void 0 ? null : `${prefix}${await digests().digest("email", email.toLowerCase())}`;
+		}
+		case "browser": {
+			const token = submission.browserToken;
+			return token === void 0 ? null : `${prefix}${BROWSER_KEY_PREFIX}${await digests().digest("browser", token)}`;
+		}
+		default: return null;
 	}
 }
 /**
-* Validate form data against a form's field configuration.
-*
-* Combines transformation and validation in one step.
-*
-* @param data - Raw form data
-* @param fields - Form field configurations
-* @returns Zod safe parse result
-*
-* @example
-* ```typescript
-* const result = validateFormData({ name: 'John', email: 'john@example.com' }, fields);
-*
-* if (result.success) {
-*   console.log('Valid data:', result.data);
-* } else {
-*   console.log('Validation errors:', result.error.flatten());
-* }
-* ```
-*/
-function validateFormData(data, fields) {
-	const transformed = transformFormData(data, fields);
-	return generateZodSchema(fields).safeParse(transformed);
+* Whether the key a new submission was given is the one `settings` give it.
+* An address's key is made again from the row and compared. A browser's
+* cannot be, since its token is not stored: under one per browser a browser
+* key, or none (a submission sent without a token), is the right one, and a
+* key made for another mode is not. Nor can a network's on a form that keeps
+* no addresses, where a key for the current version is the right one.
+*/
+async function holdsKeyFor(digests, settings, row) {
+	const key = row.responseKey ?? null;
+	if (settings.oneResponse === "browser" && row.status !== "spam") return key === null || isBrowserKey(key, settings.oneResponseVersion);
+	if (settings.oneResponse === "ip" && textOf(row.ipAddress) === void 0 && typeof key === "string" && row.status !== "spam") return keyVersionOf(key) === (settings.oneResponseVersion ?? 0) && !key.includes(BROWSER_KEY_PREFIX);
+	return key === await responseKeyOf(digests, settings, row);
+}
+/** Whether an update changes what a submission's key is made from. */
+function touchesResponseKey(patch) {
+	return patch.status !== void 0 || patch.data !== void 0 || patch.ipAddress !== void 0;
 }
 /**
-* Whether the visitor supplied nothing at this field.
-*
-* The same four shapes the endpoint has always counted as blank. A `false`
-* checkbox and a `0` are answers, so neither is absent.
-*/
-function isBlank(value) {
-	return value === void 0 || value === null || value === "" || Array.isArray(value) && value.length === 0;
+* A submission's key after an update, made from the stored row with the
+* update applied: none once it is spam; its own again when restored from
+* spam, unless another submission has since taken that value, when it keeps
+* none and the value stays with that one; a new one when its answer or
+* address changed, which the unique index refuses if another submission
+* holds it already, so an edit cannot give two submissions one value; and,
+* when the value is unchanged, what it held.
+*/
+async function responseKeyAfterUpdate(input) {
+	const { patch, stored } = input;
+	if (input.settings.oneResponse === "browser") return browserKeyAfterUpdate(patch, stored, input.settings.oneResponseVersion, input.moved);
+	if (input.settings.oneResponse === "ip" && textOf(stored?.ipAddress) === void 0 && patch.ipAddress === void 0) return keptKeyAfterUpdate(patch, stored, input.settings.oneResponseVersion, input.moved);
+	const after = (field) => patch[field] === void 0 ? stored?.[field] : patch[field];
+	const key = await responseKeyOf(input.digests, input.settings, {
+		status: after("status"),
+		data: after("data"),
+		ipAddress: after("ipAddress")
+	});
+	if (key === null) return null;
+	const storedValue = await responseKeyOf(input.digests, input.settings, {
+		data: stored?.data,
+		ipAddress: stored?.ipAddress
+	});
+	if (input.moved || key !== storedValue) return key;
+	if (stored?.status === "spam") return await input.heldElsewhere(key) ? null : key;
+	return typeof stored?.responseKey === "string" ? stored.responseKey : null;
 }
 /**
-* The failures with their codes, first one per field.
-*
-* A code as well as a sentence, because the public submission error has always
-* carried one and a client uses it to tell "you left this blank" from "this is
-* not an email" without parsing English. Flattening every failure to `INVALID`
-* silently stopped required-field detection working for those clients.
-*
-* The code is decided by looking at the SUBMITTED VALUE, not at the Zod issue.
-* Zod's codes do not divide the same way: `too_small` covers a blank answer and
-* a four-character password under a minimum of eight, and `invalid_type` covers
-* an absent key and a string sent to a number field. Reading the code alone
-* told a visitor to fill in a field they had already filled in.
+* A submission's browser key after an update. The token is not stored, so
+* the key cannot be made again: the submission keeps the browser key it
+* holds until it is marked spam, which gives the browser its place back, and
+* one restored from spam stays without one. Answers edited keep it, and a
+* submission moved to another form taking one per browser takes it there,
+* for that form's version, since it is the same browser's response; the
+* unique index refuses a move onto a form where that browser has responded.
+*/
+function browserKeyAfterUpdate(patch, stored, version, moved) {
+	if ((patch.status === void 0 ? stored?.status : patch.status) === "spam") return null;
+	const key = stored?.responseKey;
+	if (moved) return browserKeyFor(key, version);
+	return isBrowserKey(key, version) ? key : null;
+}
+/** A browser key of any version, spelled for `version`; none for any other key. */
+function browserKeyFor(key, version) {
+	if (typeof key !== "string") return null;
+	const match = /^(?:v\d+:)?browser:([0-9a-f]+)$/.exec(key);
+	return match ? `${keyPrefixOf(version)}${BROWSER_KEY_PREFIX}${match[1]}` : null;
+}
+/**
+* A key the row holds but cannot be made again from it (a network's on a
+* form that keeps no addresses), after an update: none once the submission
+* is spam; spelled for the destination's version when it moves to another
+* form; else the key it holds, while that is for the form's current version.
 */
-function getValidationIssues(result, submitted = {}) {
-	if (result.success) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const issues = [];
-	for (const issue of result.error.issues) {
-		const path = issue.path.join(".");
-		if (seen.has(path)) continue;
-		seen.add(path);
-		issues.push({
-			path,
-			code: isBlank(submitted[path]) ? "REQUIRED" : "INVALID",
-			message: issue.message
-		});
-	}
-	return issues;
+function keptKeyAfterUpdate(patch, stored, version, moved) {
+	const key = networkKeyHeld(patch, stored);
+	if (key === null) return null;
+	if (moved) return `${keyPrefixOf(version)}${key.replace(/^v\d+:/, "")}`;
+	return keyVersionOf(key) === (version ?? 0) ? key : null;
 }
 /**
-* The same failures as a field-to-message map.
-*
-* Derived from {@link getValidationIssues} rather than walking the issues a
-* second time, so the two cannot disagree about which message belongs to a
-* field or which failure won when one field had several.
+* The key a stored submission should hold under `settings`: its value's,
+* made again from the row; or, for a network's on a row that kept no
+* address (a form that keeps none), the key it holds while that is for the
+* current version, since it cannot be made again. The rebuild asks this, so
+* a submission stored under a form that keeps no addresses keeps its key.
 */
-function getValidationErrors(result) {
-	return Object.fromEntries(getValidationIssues(result).map((issue) => [issue.path, issue.message]));
+async function storedRowKeyOf(digests, settings, row) {
+	if (settings.oneResponse !== "ip" || textOf(row.ipAddress) !== void 0) return responseKeyOf(digests, settings, row);
+	const key = networkKeyHeld({}, row);
+	return key !== null && keyVersionOf(key) === (settings.oneResponseVersion ?? 0) ? key : null;
+}
+/** The network key a submission holds, unless the update makes it spam. */
+function networkKeyHeld(patch, stored) {
+	const status = patch.status === void 0 ? stored?.status : patch.status;
+	const key = stored?.responseKey;
+	if (status === "spam" || typeof key !== "string") return null;
+	return key.includes(BROWSER_KEY_PREFIX) ? null : key;
 }
 
 // src/handlers/prepare-submission.ts
@@ -1489,17 +1799,17 @@ function submissionMarks(row) {
 	return row[PLUGIN_SUBMISSION];
 }
 /** A form value, compared the way a form value can be. */
-function sameValue(left, right) {
+function sameValue$1(left, right) {
 	if (Object.is(left, right)) return true;
 	if (left instanceof Date && right instanceof Date) return left.getTime() === right.getTime();
-	if (Array.isArray(left) && Array.isArray(right)) return left.length === right.length && left.every((value, index) => sameValue(value, right[index]));
+	if (Array.isArray(left) && Array.isArray(right)) return left.length === right.length && left.every((value, index) => sameValue$1(value, right[index]));
 	return false;
 }
 /** Whether two submitted payloads say the same thing. */
 function sameSubmittedPayload(granted, incoming) {
 	const answers = Object.entries(granted);
 	if (answers.length !== Object.keys(incoming).length) return false;
-	return answers.every(([field, answer]) => sameValue(answer, incoming[field]));
+	return answers.every(([field, answer]) => sameValue$1(answer, incoming[field]));
 }
 /**
 * Bring a submission to the shape the form declares.
@@ -1525,13 +1835,804 @@ function prepareSubmission({ data, fields, validate }) {
 	const transformed = transformFormData(data, fields);
 	sanitizeSubmissionData(transformed, fields);
 	if (!validate) return { data: transformed };
-	const result = generateZodSchema(fields).safeParse(transformed);
+	const hidden = fieldsHiddenByCondition(fields, transformed);
+	const result = generateZodSchema(fields.filter((field) => !hidden.has(field.name))).safeParse(transformed);
 	if (!result.success) return {
 		data: transformed,
 		validationErrors: getValidationErrors(result),
 		validationIssues: getValidationIssues(result, data)
 	};
-	return { data: result.data };
+	return { data: {
+		...transformed,
+		...result.data
+	} };
+}
+
+// src/handlers/form-closing-hold.ts
+/**
+* A form's closing time and limit, held where a submission is stored: inside
+* the submission's own write transaction, whatever wrote it (the public route,
+* `submitForm` called from another plugin, `nextly.forms.submit()` or the
+* admin). So no way of storing a submission can outlive the form's closing.
+*
+* Past the closing time, every new submission is refused, spam included.
+*
+* Two submissions for a form's last place must not both be stored. Checking a
+* count before the write lets both read "one place left", so the check runs
+* after the submission's row is inserted, in the same transaction, under the
+* form's row locked for update: a second submission to the same form waits
+* there until the first has committed or rolled back, then counts again, its
+* own row and the first's both included, and is refused if they are more
+* than the limit. The refusal rolls the whole write back, so nothing is kept.
+*
+* Per dialect:
+*
+* - PostgreSQL and MySQL. A write that opens its own transaction and runs
+*   in-transaction handlers reads committed, so the count after the lock sees
+*   what the submission before it committed. The count takes no lock of its
+*   own: a locking read would wait on another submission's uncommitted row
+*   while that submission waits for this one's lock. The submission's `form`
+*   column is a plain column with no database foreign key, so its insert holds
+*   no lock on the form's row, and two submissions waiting on each other's
+*   insert cannot arise.
+* - SQLite. One writer at a time already, so the count sees every commit.
+*
+* One limit to this: a submission created inside a transaction its caller
+* opened (`withTransaction` with `createEntryInTransaction`) reads at that
+* transaction's isolation. On MySQL that is REPEATABLE READ, where the count
+* answers from the transaction's first read, so two such transactions racing
+* for the last place can both be stored. Every way of submitting this plugin
+* and core offer opens its own transaction.
+*
+* Spam does not count, and a submission stored as spam takes no place.
+* Marking a submission spam or not spam, deleting submissions and the
+* retention pass change the count by changing the rows it reads: there is no
+* counter to keep in step. Only a new submission is judged: marking a stored
+* one "not spam" restores a place it was entitled to when it arrived.
+*
+* @module handlers/form-closing-hold
+*/
+/** The mark on a refusal for a closed form, for the caller to recognise it. */
+const FORM_CLOSED = "form-builder:form-closed";
+/** The mark on a refusal for a setting changed while the write was in flight. */
+const SETTINGS_CHANGED_MARK = "form-builder:settings-changed";
+/** The mark on a refusal for a person who has responded already. */
+const RESPONDED_MARK = "form-builder:responded";
+/** Rows read at a time when earlier submissions are compared one by one. */
+const COMPARE_PAGE = 200;
+/** What a submission refused for a setting changed in flight is told. */
+const SETTINGS_CHANGED = "This form's settings changed while your response was being sent. Please send it again.";
+/** The id a submission's `form` names, as an id or a populated document. */
+function formIdOf(value) {
+	if (typeof value === "string" && value !== "") return value;
+	if (typeof value === "number") return String(value);
+	if (value && typeof value === "object" && "id" in value) return formIdOf(value.id);
+}
+/** The form a new submission is made to, and whether it takes a place. */
+function newSubmission(write) {
+	if (write.operation !== "create") return void 0;
+	const data = write.data;
+	const formId = formIdOf(data?.form);
+	return formId === void 0 ? void 0 : {
+		formId,
+		takesAPlace: data?.status !== "spam"
+	};
+}
+/** The refusal a submission to a closed form gets, and rolls back with. */
+function closedRefusal(form, logContext) {
+	return NextlyError.conflict({
+		reason: "state",
+		message: closedMessageOf(form),
+		logContext: {
+			cause: FORM_CLOSED,
+			...logContext
+		}
+	});
+}
+/** The form, as stored, with its settings read. */
+async function formOf(own, write, slugs, formId, lock) {
+	const form = await own.findEntryByIdInTransaction(write.transaction, slugs.forms, formId, { lock });
+	return {
+		form,
+		settings: normalizeFormSettings(form.settings)
+	};
+}
+/**
+* Refuse a new submission to a form past its closing time, one that would
+* take it past its limit, or one whose one-response key is not the one the
+* form's committed settings give it.
+*/
+async function holdFormClosing(deps, write, slugs) {
+	const submission = newSubmission(write);
+	if (submission === void 0) return;
+	const { formId } = submission;
+	const locked = await formOf(deps.own, write, slugs, formId, "update");
+	if (pastClosingTime(locked.settings, /* @__PURE__ */ new Date())) throw closedRefusal(locked.form, {
+		formId,
+		closedBy: "date"
+	});
+	refuseKeptAddress(write, formId, locked.settings);
+	if (submission.takesAPlace) await holdLimit(deps.own, write, slugs, formId, locked);
+	await holdResponseKey(deps, write, slugs, formId, locked.settings);
+}
+/**
+* Refuse a new submission that carries an IP address or browser to a form
+* that, as committed, keeps neither: the write seam read the setting before
+* it changed. The visitor sends it again, and it is stored without them.
+*/
+function refuseKeptAddress(write, formId, settings) {
+	if (settings.storeIpAndBrowser !== false) return;
+	const row = write.data;
+	const kept = (value) => typeof value === "string" && value !== "";
+	if (kept(row?.ipAddress) || kept(row?.userAgent)) throw changedRefusal(formId);
+}
+/** Refuse a submission that takes the form past its limit, under the lock. */
+async function holdLimit(own, write, slugs, formId, { form, settings }) {
+	const limit = settings.submissionLimit;
+	if (limit === void 0) return;
+	const { pagination } = await own.listEntriesInTransaction(write.transaction, slugs.submissions, {
+		where: {
+			form: { equals: formId },
+			status: { not_equals: "spam" }
+		},
+		pagination: { limit: 1 }
+	}, { lock: "none" });
+	if (pagination.total > limit) throw closedRefusal(form, {
+		formId,
+		closedBy: "limit",
+		limit
+	});
+}
+/**
+* Refuse a submission whose one-response key is not the one the form's
+* setting, as stored now, gives it. The key was made before the write, from
+* the settings read then; a change of mode or Email field committed since
+* would leave a key no longer compared by anything, or none where one is
+* owed. The visitor sends it again, under the setting that applies.
+*/
+async function holdResponseKey(deps, write, slugs, formId, settings) {
+	const row = write.data;
+	if (!await holdsKeyFor(() => deps.digests, settings, row)) throw changedRefusal(formId);
+	if (row.responseKey === null || row.responseKey === void 0) return;
+	await refuseEarlierResponse(deps, write, slugs, formId, settings);
+}
+/** The refusal for a key made under a setting the form has since left. */
+function changedRefusal(formId) {
+	return NextlyError.conflict({
+		reason: "state",
+		message: SETTINGS_CHANGED,
+		logContext: {
+			cause: SETTINGS_CHANGED_MARK,
+			formId
+		}
+	});
+}
+/**
+* Refuse a keyed submission when an earlier one holds its value without the
+* key that would show it.
+*
+* One per network compares the stored address itself, every time: a form
+* that took one response per network before keys were stored has earlier
+* submissions with an address and no key. One per email compares the earlier
+* answers while the form's keys are still being made for its current version
+* (`keysBehind`), after a change of mode or Email field. Both run under the
+* form's lock, so a submission stored meanwhile is counted.
+*/
+async function refuseEarlierResponse(deps, write, slugs, formId, settings) {
+	const row = write.data;
+	const earlier = {
+		form: { equals: formId },
+		status: { not_equals: "spam" },
+		id: { not_equals: write.id }
+	};
+	const read = (where, limit, page = 1) => deps.own.listEntriesInTransaction(write.transaction, slugs.submissions, {
+		where,
+		pagination: {
+			limit,
+			page
+		},
+		depth: 0
+	}, { lock: "none" });
+	if (settings.oneResponse === "ip" && typeof row.ipAddress === "string") {
+		const { pagination } = await read({
+			...earlier,
+			ipAddress: { equals: row.ipAddress }
+		}, 1);
+		if (pagination.total > 0) throw respondedRefusal(formId);
+		return;
+	}
+	if (settings.oneResponse === "email" && keysBehind(settings)) await refuseEarlierEmail(deps, formId, settings, row.responseKey, (page) => read(earlier, COMPARE_PAGE, page));
+}
+/**
+* Compare a new submission's key with the key each earlier submission's
+* answer would have, a page at a time.
+*/
+async function refuseEarlierEmail(deps, formId, settings, key, page) {
+	for (let n = 1;; n++) {
+		const { data } = await page(n);
+		for (const other of data) if (await responseKeyOf(() => deps.digests, settings, other) === key) throw respondedRefusal(formId);
+		if (data.length < COMPARE_PAGE) return;
+	}
+}
+/** The refusal for a person who has responded to the form already. */
+function respondedRefusal(formId) {
+	return NextlyError.conflict({
+		reason: "state",
+		message: ALREADY_RESPONDED,
+		logContext: {
+			cause: RESPONDED_MARK,
+			formId
+		}
+	});
+}
+/**
+* Refuse a key written to a stored submission (an edit that moves its key,
+* or the plugin giving it one) when the key was made for a version the form
+* has left: the form's mode or Email field changed after it was made. The
+* form's lock orders it after the change, so the version it reads is the one
+* committed.
+*/
+async function holdKeyWrite(deps, write, slugs) {
+	const changed = changedKeyOf(write);
+	if (changed === void 0) return;
+	const { key, formId } = changed;
+	const { settings } = await formOf(deps.own, write, slugs, formId, "update");
+	if (keyVersionOf(key) !== (settings.oneResponseVersion ?? 0)) throw changedRefusal(formId);
+	if (sameValue(write)) return;
+	await refuseEarlierResponse(deps, write, slugs, formId, settings);
+}
+/**
+* The key an update gave a stored submission, and its form, when the update
+* changed the key to one: undefined for a create, a key cleared or kept.
+*/
+function changedKeyOf(write) {
+	if (write.operation !== "update") return void 0;
+	const after = write.data;
+	const before = write.originalData;
+	const key = after?.responseKey;
+	if (typeof key !== "string" || key === before?.responseKey) return void 0;
+	const formId = formIdOf(after.form);
+	return formId === void 0 ? void 0 : {
+		key,
+		formId
+	};
+}
+/**
+* Whether an update left a submission's answers, address and form as they
+* were. A submission moved to another form joins that form's responses, so a
+* move is compared as an edit is.
+*/
+function sameValue(write) {
+	const after = write.data;
+	const before = write.originalData;
+	const same = (field) => JSON.stringify(after?.[field] ?? null) === JSON.stringify(before?.[field] ?? null);
+	return same("data") && same("ipAddress") && formIdOf(after?.form) === formIdOf(before?.form);
+}
+/**
+* When the submission holding a one-response key stops holding it (deleted,
+* marked spam, or edited or moved to another value), the earliest other
+* non-spam submission of the form with the same value takes the key, in the
+* same transaction. Without it, a keyless duplicate (one stored before the
+* form compared that value, or kept as evidence and restored) would leave
+* the value free, and a person who had responded could respond again.
+*
+* Under the form's lock, so a new submission with that value waits and then
+* meets the key. A key made for a version the form has left is not handed
+* on: nothing compares it. One per browser hands nothing on, since no
+* earlier submission kept its browser's token.
+*/
+async function handOffKey(deps, write, slugs) {
+	const released = releasedKeyOf(write);
+	if (released === void 0) return;
+	const { key, formId, ipAddress } = released;
+	const { settings } = await formOf(deps.own, write, slugs, formId, "update");
+	if (keyVersionOf(key) !== (settings.oneResponseVersion ?? 0)) return;
+	const next = await nextHolderOf(deps, write, slugs, {
+		formId,
+		settings,
+		key,
+		ipAddress
+	});
+	if (next === void 0) return;
+	await deps.collections.updateEntryInTransaction(write.transaction, slugs.submissions, next, asPluginSubmission({
+		responseKey: key,
+		_overwrite: true
+	}, {
+		keepAsEvidence: false,
+		setKey: key
+	}));
+}
+/**
+* The key a write took from the submission that held it, with that
+* submission's form and address as they were: undefined when it still holds
+* it, or held none.
+*/
+function releasedKeyOf(write) {
+	const before = heldBefore(write);
+	const key = before?.responseKey;
+	if (typeof key !== "string" || stillHeld(write, key, before)) return;
+	const formId = formIdOf(before?.form);
+	return formId === void 0 ? void 0 : {
+		key,
+		formId,
+		ipAddress: before?.ipAddress
+	};
+}
+/**
+* The submission as it was before a write: a delete describes it as it was,
+* an update by its original; a create had none.
+*/
+function heldBefore(write) {
+	if (write.operation === "create") return void 0;
+	return write.operation === "delete" ? write.data : write.originalData;
+}
+/** Whether an update left the submission holding `key` on the same form. */
+function stillHeld(write, key, before) {
+	const after = write.data;
+	return write.operation === "update" && after?.responseKey === key && formIdOf(after?.form) === formIdOf(before?.form);
+}
+/**
+* The earliest non-spam submission of the form, other than the one writing,
+* that holds no key and whose value gives `key`. One per network reads only
+* the submissions from the same address; one per email reads the keyless
+* ones a page at a time.
+*/
+async function nextHolderOf(deps, write, slugs, wanted) {
+	const { settings } = wanted;
+	if (settings.oneResponse !== "ip" && settings.oneResponse !== "email") return;
+	const where = {
+		form: { equals: wanted.formId },
+		status: { not_equals: "spam" },
+		id: { not_equals: write.id },
+		responseKey: { exists: false }
+	};
+	if (settings.oneResponse === "ip") {
+		if (typeof wanted.ipAddress !== "string") return void 0;
+		where.ipAddress = { equals: wanted.ipAddress };
+	}
+	for (let page = 1;; page++) {
+		const { data } = await deps.own.listEntriesInTransaction(write.transaction, slugs.submissions, {
+			where,
+			sort: {
+				field: "createdAt",
+				direction: "asc"
+			},
+			pagination: {
+				limit: COMPARE_PAGE,
+				page
+			},
+			depth: 0
+		}, { lock: "none" });
+		for (const row of data) if (await responseKeyOf(() => deps.digests, settings, row) === wanted.key) return String(row.id);
+		if (data.length < COMPARE_PAGE) return void 0;
+	}
+}
+/** Hold every form's closing on the submissions this plugin stores. */
+function registerFormClosing(ctx, slugs) {
+	const deps = {
+		own: ctx.services.ownCollections,
+		digests: ctx.security.digests,
+		collections: ctx.services.collections
+	};
+	ctx.hooks.onInTransaction(slugs.submissions, async (write) => {
+		await holdFormClosing(deps, write, slugs);
+		await holdKeyWrite(deps, write, slugs);
+		await handOffKey(deps, write, slugs);
+	});
+}
+/**
+* Which of the hold's refusals `error` is, or one it was made from: a closed
+* form's, a setting changed while the submission was in flight, or a person
+* who has responded already.
+*/
+function heldRefusal(error) {
+	let current = error;
+	for (let depth = 0; depth < 10 && current; depth += 1) {
+		if (current instanceof NextlyError) {
+			const cause = current.logContext?.cause;
+			if (cause === FORM_CLOSED) return "closed";
+			if (cause === SETTINGS_CHANGED_MARK) return "changed";
+			if (cause === RESPONDED_MARK) return "responded";
+		}
+		current = current.cause;
+	}
+}
+
+// src/handlers/one-response-field-check.ts
+/**
+* The save of a form refuses a one response per email it could not keep:
+* no Email field chosen, or one that is missing, optional or hidden by a
+* condition. The builder and Settings refuse the same, and this holds it for
+* every other way a form is written (the API, an import).
+*
+* @module handlers/one-response-field-check
+*/
+/** A stored value as written: itself, or a JSON string before a read decodes it. */
+function decoded(value) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+/**
+* Refuse a form save whose one response per email has no Email field it can
+* compare. What the save leaves out is read as stored, so a save of the
+* fields alone is judged against the stored settings, and the other way
+* round.
+*/
+function refuseOneResponseFieldProblem(context) {
+	const ctx = context;
+	const data = ctx.data;
+	if (!data || data.settings === void 0 && data.fields === void 0) return;
+	const settings = normalizeFormSettings(decoded(data.settings !== void 0 ? data.settings : ctx.originalData?.settings));
+	const fields = decoded(data.fields !== void 0 ? data.fields : ctx.originalData?.fields);
+	const problem = oneResponseFieldProblem(settings, Array.isArray(fields) ? fields : []);
+	if (problem === void 0) return;
+	throw NextlyError.validation({ errors: [{
+		path: "settings.oneResponseField",
+		code: "INVALID",
+		message: problem
+	}] });
+}
+
+// src/handlers/one-response-rebuild.ts
+/**
+* One response per person, after a form changes how it tells people apart.
+*
+* A submission's key is made under the form's one-response version
+* (`one-response`). Saving a form with another mode or another Email field
+* moves the version on (`stampOneResponseVersion`), so every earlier key stops
+* matching new ones at once, with no write to any earlier submission. The
+* earlier submissions are then given keys for the new version by a sweep
+* (`rebuildResponseKeys`): oldest first, each the key of its own answer or
+* address, or none where an earlier one holds that value already, so the
+* earliest of several with one value keeps it. The sweep runs right after the
+* save commits, and the job runner carries on with what it could not finish.
+*
+* Until it has finished, the form records the version its keys are made for
+* (`oneResponseKeyedVersion`) behind the current one, and the submission's
+* hold compares a new submission with the earlier ones' answers themselves
+* (`form-closing-hold`), so no person gets a second response in between.
+*
+* Each key written is checked again where it is stored: the hold refuses a
+* key made for a version the form has since left, so a sweep that started
+* before a second change writes nothing for the old version. Each write also
+* names the revision the sweep read, so a submission edited meanwhile keeps
+* the key its edit gave it.
+*
+* @module handlers/one-response-rebuild
+*/
+/** The sweep that gives earlier submissions their keys. */
+const REBUILD_KEYS_JOB = "form-builder:one-response-keys";
+/** How long a save waits for the sweep after it commits, at most. */
+const REBUILD_ON_SAVE_MS = 5e3;
+/**
+* How far past the start of a pass its cutoff lies. MySQL stores a row's
+* `createdAt` to the second, rounded, so a submission stored a moment before
+* the pass can read as up to a second after it; a cutoff at the start would
+* leave it out of every pass and without a key. Rows inside the margin are
+* ones stored after the change, keyed already, so reading them costs a look.
+*/
+const CUTOFF_MARGIN_MS = 2e3;
+function passCutoff() {
+	return new Date(Date.now() + CUTOFF_MARGIN_MS);
+}
+/** Rows read at a time: forms, then one form's submissions. */
+const PAGE = 100;
+/**
+* The mark on the sweep's own write of a form, saying which version's keys
+* it finished. Only the plugin sets it; `stampOneResponseVersion` takes the
+* finished version from nowhere else.
+*/
+const FORM_KEYED = Symbol.for("nextly.plugin-form-builder.form-keyed");
+/** A form's settings as stored: an object, or a JSON string before a read decodes it. */
+function settingsObjectOf(value) {
+	let parsed = value;
+	if (typeof parsed === "string") try {
+		parsed = JSON.parse(parsed);
+	} catch {
+		return;
+	}
+	return parsed !== null && typeof parsed === "object" ? parsed : void 0;
+}
+/**
+* The version a save leaves the form at, and the version its keys are made
+* for, both decided here from what is stored and never taken from the
+* payload: a caller that could set them could make every earlier response
+* count again, or none.
+*
+* A save that changes the mode or the Email field moves the version on by
+* one. Its keys are up to date at once when the new mode compares nothing
+* an earlier submission stored (several responses allowed, or one per
+* browser, whose earlier tokens were never kept), or when the form has few
+* enough submissions for the save to key them itself (`rebuildInSave`);
+* otherwise they are behind until the sweep has made them.
+*/
+async function stampOneResponseVersion(context, fitsInSave) {
+	const ctx = context;
+	const incoming = settingsObjectOf(ctx.data?.settings);
+	if (!ctx.data || incoming === void 0) return;
+	const next = { ...incoming };
+	delete next.oneResponseKeyedVersion;
+	if (ctx.operation === "create") {
+		next.oneResponseVersion = 0;
+		ctx.data.settings = next;
+		return;
+	}
+	const stored = normalizeFormSettings(settingsObjectOf(ctx.originalData?.settings) ?? {});
+	const changed = oneResponseIdentityOf(stored) !== oneResponseIdentityOf(normalizeFormSettings(incoming));
+	const version = (stored.oneResponseVersion ?? 0) + (changed ? 1 : 0);
+	next.oneResponseVersion = version;
+	const storedId = ctx.originalData?.id;
+	const formId = typeof storedId === "string" || typeof storedId === "number" ? String(storedId) : void 0;
+	const keyed = keyedVersionAfterSave({
+		stored,
+		changed,
+		version,
+		mode: normalizeFormSettings(incoming).oneResponse,
+		finished: ctx.data[FORM_KEYED]?.version,
+		inSave: changed && formId !== void 0 && await fitsInSave(formId)
+	});
+	if (keyed !== void 0) next.oneResponseKeyedVersion = keyed;
+	ctx.data.settings = next;
+}
+/** The version a form's keys are made for once a save has been stamped. */
+function keyedVersionAfterSave(input) {
+	const { stored, changed, version } = input;
+	if (changed) return (input.mode === "ip" || input.mode === "email") && !input.inSave ? stored.oneResponseKeyedVersion ?? stored.oneResponseVersion ?? 0 : version;
+	if (input.finished === version) return version;
+	return stored.oneResponseKeyedVersion;
+}
+/**
+* After a save leaves the form's keys behind (a form too large to key inside
+* the save), start the sweep once the save has committed. Not awaited: the
+* save answers with the form as it committed, and the sweep's own write of
+* the form, when it finishes, comes after. What one run leaves, the job
+* runner finishes.
+*/
+async function rebuildAfterSave(context, run, warn) {
+	const ctx = context;
+	const settings = normalizeFormSettings(settingsObjectOf(ctx.data?.settings) ?? {});
+	if (!keysBehind(settings) || !ctx.afterCommit) return;
+	await ctx.afterCommit(() => {
+		run().catch((error) => warn("The one-response key sweep failed; the job runner retries it.", { error: error instanceof Error ? error.message : String(error) }));
+	});
+}
+/** The plugin's one-response options, with their defaults. */
+function oneResponseOptions(options) {
+	const keysInSave = options?.keysInSave;
+	return { keysInSave: typeof keysInSave === "number" && keysInSave >= 0 ? Math.floor(keysInSave) : KEYS_IN_SAVE };
+}
+/** Earlier submissions a form may have for the save itself to key them. */
+const KEYS_IN_SAVE = 200;
+/**
+* Give a form's earlier submissions keys for its new version inside the
+* save that changed it, when the save decided they fit
+* (`stampOneResponseVersion` recorded the keys as made). Read whole first,
+* then keyed oldest first, the earliest of several with one value keeping it. The save holds the form's
+* row, so no submission to the form is stored meanwhile, and the save
+* answers with every key in place and no later write to the form.
+*/
+async function rebuildInSave(deps, write) {
+	if (write.operation !== "update") return;
+	const after = normalizeFormSettings(settingsObjectOf(write.data?.settings) ?? {});
+	const before = normalizeFormSettings(settingsObjectOf(write.originalData?.settings) ?? {});
+	const version = after.oneResponseVersion ?? 0;
+	if (version === (before.oneResponseVersion ?? 0)) return;
+	if (after.oneResponseKeyedVersion !== version) return;
+	if (after.oneResponse !== "ip" && after.oneResponse !== "email") return;
+	const rows = await snapshotOf(async (where) => (await deps.own.listEntriesInTransaction(write.transaction, deps.submissionsSlug, {
+		where,
+		sort: {
+			field: "id",
+			direction: "asc"
+		},
+		pagination: { limit: PAGE },
+		depth: 0
+	}, { lock: "none" })).data, {
+		form: { equals: write.id },
+		status: { not_equals: "spam" }
+	});
+	const held = /* @__PURE__ */ new Set();
+	for (const row of rows) await keyInSave(deps, write, after, held, row);
+}
+/** One row keyed inside the save: its value's key unless held already. */
+async function keyInSave(deps, write, settings, held, row) {
+	const own = await storedRowKeyOf(deps.digests, settings, row);
+	const target = own === null || held.has(own) ? null : own;
+	if (target !== null) held.add(target);
+	if ((row.responseKey ?? null) === target) return;
+	await deps.collections.updateEntryInTransaction(write.transaction, deps.submissionsSlug, String(row.id), asPluginSubmission({
+		responseKey: target,
+		_overwrite: true
+	}, {
+		keepAsEvidence: false,
+		setKey: target
+	}));
+}
+/** The sweep's job, run by `run` until the deadline the runner gives it. */
+function rebuildKeysJob(run) {
+	return defineJob({
+		slug: REBUILD_KEYS_JOB,
+		sweep: true,
+		handler: async (_input, context) => {
+			await run(context.deadline);
+		}
+	});
+}
+/**
+* Give every form whose keys are behind its earlier submissions' keys, until
+* `deadline`. A form is marked up to date only after a pass over all its
+* submissions in which every one took its key, with none to look at again.
+*/
+async function rebuildResponseKeys(deps, deadline) {
+	for (let page = 1;; page++) {
+		const { data } = await deps.collections.listEntries(deps.formsSlug, {
+			pagination: {
+				limit: PAGE,
+				page
+			},
+			depth: 0
+		}, { as: "system" });
+		const forms = data;
+		for (const form of forms) {
+			if (pastDeadline(deadline)) return;
+			await bringUpToDate(deps, form, deadline);
+		}
+		if (forms.length < PAGE) return;
+	}
+}
+/** One form: its keys made for its current version, if they are behind. */
+async function bringUpToDate(deps, form, deadline) {
+	const settings = normalizeFormSettings(settingsObjectOf(form.settings) ?? {});
+	if (!keysBehind(settings)) return;
+	if (await rebuildForm(deps, form, settings, deadline) === "done") await markKeyed(deps, form, settings.oneResponseVersion ?? 0);
+}
+function pastDeadline(deadline) {
+	return Date.now() >= deadline.getTime();
+}
+/**
+* Passes over one form's submissions until one leaves nothing to look at
+* again: done, or `stop` when the deadline passed or the form's version moved
+* on, which leaves the rest to a later sweep. A sweep that resumes passes
+* quickly over the rows an earlier run keyed: each holds its own key, which
+* is recognised without a query.
+*/
+async function rebuildForm(deps, form, settings, deadline) {
+	if (settings.oneResponse !== "ip" && settings.oneResponse !== "email") return "done";
+	for (;;) {
+		const pass = await rebuildPass(deps, String(form.id), settings, deadline);
+		if (pass !== "again") return pass;
+	}
+}
+/**
+* One pass over a form's non-spam submissions, oldest first. The rows are
+* read first, whole (`snapshotOf`), then keyed in order: a submission deleted
+* or restored while the pass runs cannot move another out of a page it reads.
+* Rows stored after the pass began are left out (`passCutoff`): they were
+* keyed for the current version when they were stored. A row whose write was
+* refused, as edited since or as holding a value taken since, sends the
+* sweep round again.
+*/
+async function rebuildPass(deps, formId, settings, deadline) {
+	const rows = await snapshotOf(async (where) => (await deps.collections.listEntries(deps.submissionsSlug, {
+		where,
+		sort: {
+			field: "id",
+			direction: "asc"
+		},
+		pagination: { limit: PAGE },
+		depth: 0
+	}, { as: "system" })).data, {
+		form: { equals: formId },
+		status: { not_equals: "spam" },
+		createdAt: { less_than_equal: passCutoff() }
+	});
+	let retries = 0;
+	for (const row of rows) {
+		if (pastDeadline(deadline)) return "stop";
+		const outcome = await keyRow(deps, formId, settings, row);
+		if (outcome === "stale-form") return "stop";
+		if (outcome === "retry") retries += 1;
+	}
+	return retries === 0 ? "done" : "again";
+}
+/**
+* Every row `where` matches, oldest first. Read a page at a time by id, each
+* page after the last id read: ids are unique and fixed, so a row deleted or
+* added meanwhile never moves one that is there throughout out of reach, as
+* a page by position would. Then put in the order they were stored.
+*/
+async function snapshotOf(page, where) {
+	const rows = [];
+	for (let after;;) {
+		const read = await page(after === void 0 ? where : {
+			...where,
+			id: { greater_than: after }
+		});
+		rows.push(...read);
+		if (read.length < PAGE) break;
+		after = String(read[read.length - 1]?.id);
+	}
+	return rows.sort(storedFirst);
+}
+/** Older first, by when each was stored; ties by id, the same every time. */
+function storedFirst(a, b) {
+	const at = (row) => new Date(row.createdAt).getTime();
+	return at(a) - at(b) || (String(a.id) < String(b.id) ? -1 : 1);
+}
+/**
+* Give one submission the key of its answer or address, or none where
+* another submission of the form holds that value already.
+*/
+async function keyRow(deps, formId, settings, row) {
+	const target = await targetKeyOf(deps, formId, settings, row);
+	if (target === void 0) return "unchanged";
+	if ((row.responseKey ?? null) === target) return "unchanged";
+	return writeKey(deps, row, target);
+}
+/**
+* The key a row should hold: its own value's, or none (null) where another
+* submission holds that value; undefined when it holds its own already.
+*/
+async function targetKeyOf(deps, formId, settings, row) {
+	const own = await storedRowKeyOf(deps.digests, settings, row);
+	if (own === null) return null;
+	if (row.responseKey === own) return void 0;
+	return await heldByAnother(deps, formId, row, own) ? null : own;
+}
+/** Write `key` to a row as the plugin's own key write. */
+async function writeKey(deps, row, key) {
+	try {
+		await deps.collections.updateEntry(deps.submissionsSlug, String(row.id), asPluginSubmission({
+			responseKey: key,
+			_rev: row._rev
+		}, {
+			keepAsEvidence: false,
+			setKey: key
+		}), { as: "system" });
+	} catch (error) {
+		if (heldRefusal(error) === "changed") return "stale-form";
+		const code = codeOf(error);
+		if (code === "STALE_VERSION" || code === "DUPLICATE") return "retry";
+		throw error;
+	}
+	return "written";
+}
+function codeOf(error) {
+	return error instanceof NextlyError ? error.code : void 0;
+}
+/** Whether a submission of the form other than `row` holds `key`. */
+async function heldByAnother(deps, formId, row, key) {
+	return await deps.collections.count(deps.submissionsSlug, { where: {
+		form: { equals: formId },
+		responseKey: { equals: key },
+		id: { not_equals: String(row.id) }
+	} }, { as: "system" }) > 0;
+}
+/**
+* Record that the form's keys are made for `version`, by a write that names
+* the revision the sweep read: a form saved meanwhile is left for the next
+* sweep to judge.
+*/
+async function markKeyed(deps, form, version) {
+	const payload = {
+		settings: settingsObjectOf(form.settings) ?? {},
+		_rev: form._rev
+	};
+	Object.defineProperty(payload, FORM_KEYED, {
+		value: { version },
+		enumerable: true,
+		configurable: true
+	});
+	try {
+		await deps.collections.updateEntry(deps.formsSlug, String(form.id), payload, { as: "system" });
+	} catch (error) {
+		if (codeOf(error) === "STALE_VERSION") return;
+		throw error;
+	}
 }
 
 // src/handlers/spam-detection.ts
@@ -1558,7 +2659,9 @@ function prepareSubmission({ data, fields, validate }) {
 * Performs multiple spam checks based on configuration:
 * 1. Honeypot field detection
 * 2. Rate limiting by IP/form
-* 3. reCAPTCHA verification (future)
+*
+* A form's bot check (reCAPTCHA or Turnstile) is verified with its provider
+* where the submission is stored (`handlers/bot-check`), not here.
 *
 * @param options - Spam check options
 * @returns Spam check result
@@ -1664,6 +2767,98 @@ async function checkRateLimit(ipAddress, formSlug, config) {
 * @since 0.1.0
 */
 /**
+* A submission's spam verdict and its prepared data: the honeypot first,
+* BEFORE validation, so a bot that trips the trap while also failing
+* validation still receives the same fake success as any other bot; then the
+* form's bot check for one that would otherwise be refused as invalid.
+*/
+async function judgeAndPrepare(input) {
+	const { data, form, settings, pluginConfig, pluginContext, formSlug } = input;
+	const { logger } = pluginContext;
+	const declaredFieldNames = new Set(form.fields.map((field) => field.name));
+	const undeclaredData = Object.fromEntries(Object.entries(data).filter(([key]) => !declaredFieldNames.has(key)));
+	let spamResult = await checkSpam({
+		data: undeclaredData,
+		formSlug,
+		config: { honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot }
+	});
+	const isContentSpam = spamResult.isSpam;
+	if (isContentSpam) logger.info?.("Spam submission detected — storing flagged", {
+		formSlug,
+		reason: spamResult.reason,
+		ipAddress: input.ipAddress
+	});
+	let prepared = prepareSubmission({
+		data,
+		fields: form.fields,
+		validate: !isContentSpam
+	});
+	let early = { rateCounted: false };
+	if (prepared.validationErrors && !isContentSpam) {
+		early = await botCheckBeforeRefusal(input);
+		if (early.spam) {
+			spamResult = early.spam;
+			prepared = prepareSubmission({
+				data,
+				fields: form.fields,
+				validate: false
+			});
+		}
+	}
+	return {
+		spamResult,
+		prepared,
+		throttled: early.throttled === true,
+		rateCounted: early.rateCounted
+	};
+}
+/**
+* An invalid submission meets its form's bot check here, before it is
+* refused, so it is judged as one written any other way: a failing or
+* missing token keeps it as spam evidence rather than answering the bot with
+* validation errors. Only for a request-made submission to a form whose
+* check is ready, as the write seam judges. The rate limit is asked first,
+* so a throttled network cannot make the provider be called, and is counted
+* once: the seam is told it has been.
+*/
+async function botCheckBeforeRefusal(input) {
+	const spam = input.pluginConfig.spamProtection;
+	if (!input.requested || !botCheckReady(input.settings, spam)) return { rateCounted: false };
+	const rateCounted = Boolean(spam.rateLimit && input.ipAddress);
+	if (rateCounted) {
+		if ((await checkSpam({
+			data: {},
+			ipAddress: input.ipAddress,
+			formSlug: input.form.id,
+			config: { rateLimit: spam.rateLimit }
+		})).isSpam) return {
+			throttled: true,
+			rateCounted
+		};
+	}
+	const { logger } = input.pluginContext;
+	const bot = await judgeBotCheck({
+		settings: input.settings,
+		spam,
+		tokens: botTokensOf(input.data),
+		ip: input.ipAddress,
+		fetch: input.pluginContext.fetch,
+		warn: (message, warnContext) => logger.warn?.(message, warnContext)
+	});
+	return bot ? {
+		spam: bot,
+		rateCounted
+	} : { rateCounted };
+}
+/**
+* Whether a failed store was refused because the person has responded
+* already: the database refused a second one-response key, or the hold found
+* an earlier submission with the same value (`heldRefusal`).
+*/
+function isRepeatResponse(error, held) {
+	return held === "responded" || error instanceof NextlyError$1 && error.code === "DUPLICATE";
+}
+/**
 * Process a form submission.
 *
 * This is the main entry point for handling form submissions.
@@ -1726,7 +2921,17 @@ async function submitForm(options, context) {
 			};
 		}
 		const redirectFor = () => resolveRedirectUrl(form, pluginConfig, pluginContext, targetRead);
-		const availability = formAvailability(form);
+		const throttledAnswer = async () => {
+			logger.info?.("Form submission refused (rate limit)", { formSlug });
+			return {
+				success: true,
+				outcome: "accepted",
+				successMessage: settings.successMessage,
+				redirect: await redirectFor()
+			};
+		};
+		const settings = normalizeFormSettings(form.settings);
+		const availability = formAvailabilityNow(form, settings, { now: /* @__PURE__ */ new Date() });
 		if (availability.kind !== "open") {
 			logger.info?.("Form submission rejected - form not accepting", {
 				formSlug,
@@ -1739,9 +2944,9 @@ async function submitForm(options, context) {
 				error: availability.kind === "closed" ? availability.message : NO_SUCH_FORM
 			};
 		}
-		const settings = normalizeFormSettings(form.settings);
-		if (settings.allowMultipleSubmissions === false && !metadata?.ipAddress) logger.warn?.("Single-submission form received a submission without an IP — the restriction cannot apply", { formSlug });
-		if (settings.allowMultipleSubmissions === false && metadata?.ipAddress) {
+		const onePerAddress = settings.oneResponse === "ip";
+		if (onePerAddress && !metadata?.ipAddress) logger.warn?.("Single-submission form received a submission without an IP — the restriction cannot apply", { formSlug });
+		if (onePerAddress && metadata?.ipAddress) {
 			if (await collections.count(pluginConfig.formSubmissionOverrides.slug, { where: {
 				form: { equals: form.id },
 				ipAddress: { equals: metadata.ipAddress },
@@ -1754,28 +2959,22 @@ async function submitForm(options, context) {
 				return {
 					success: false,
 					outcome: "duplicate",
-					error: "You have already submitted this form."
+					error: ALREADY_RESPONDED
 				};
 			}
 		}
-		const declaredFieldNames = new Set(form.fields.map((field) => field.name));
-		const undeclaredData = Object.fromEntries(Object.entries(data).filter(([key]) => !declaredFieldNames.has(key)));
-		const spamResult = await checkSpam({
-			data: undeclaredData,
-			formSlug,
-			config: { honeypot: settings.honeypotEnabled ?? pluginConfig.spamProtection.honeypot }
-		});
-		const isContentSpam = spamResult.isSpam;
-		if (isContentSpam) logger.info?.("Spam submission detected — storing flagged", {
-			formSlug,
-			reason: spamResult.reason,
-			ipAddress: metadata?.ipAddress
-		});
-		const prepared = prepareSubmission({
+		const { spamResult, prepared, throttled, rateCounted } = await judgeAndPrepare({
 			data,
-			fields: form.fields,
-			validate: !isContentSpam
+			form,
+			settings,
+			pluginConfig,
+			pluginContext,
+			ipAddress: metadata?.ipAddress,
+			formSlug,
+			requested: request !== void 0
 		});
+		if (throttled) return throttledAnswer();
+		let isContentSpam = spamResult.isSpam;
 		if (prepared.validationErrors) {
 			logger.debug?.("Form validation failed", {
 				formSlug,
@@ -1799,30 +2998,53 @@ async function submitForm(options, context) {
 			userAgent: metadata?.userAgent || null,
 			submittedAt: /* @__PURE__ */ new Date()
 		};
+		const browserToken = browserTokenOf(data);
 		let submission;
 		try {
 			submission = await collections.createEntry(pluginConfig.formSubmissionOverrides.slug, asPluginSubmission(submissionData, {
 				keepAsEvidence: isContentSpam,
 				form: {
 					id: form.id,
-					fields: form.fields
-				}
+					fields: form.fields,
+					settings: form.settings
+				},
+				botTokens: botTokensOf(data),
+				...browserToken === void 0 ? {} : { browserToken },
+				...rateCounted ? { rateCounted } : {}
 			}), {
 				...access,
 				...request ? { request } : {}
 			});
 		} catch (error) {
-			if (NextlyError$1.isRateLimited(error)) {
-				logger.info?.("Form submission refused (rate limit)", { formSlug });
+			const held = heldRefusal(error);
+			if (held === "closed") {
+				logger.info?.("Form submission refused (form closed)", { formSlug });
+				return {
+					success: false,
+					outcome: "closed",
+					error: closedMessageOf(form)
+				};
+			}
+			if (held === "changed") {
+				logger.info?.("Form submission refused (settings changed)", { formSlug });
 				return {
-					success: true,
-					outcome: "accepted",
-					successMessage: settings.successMessage,
-					redirect: await redirectFor()
+					success: false,
+					outcome: "failed",
+					error: SETTINGS_CHANGED
+				};
+			}
+			if (isRepeatResponse(error, held)) {
+				logger.info?.("Repeat submission rejected (one response per person)", { formSlug });
+				return {
+					success: false,
+					outcome: "duplicate",
+					error: ALREADY_RESPONDED
 				};
 			}
+			if (NextlyError$1.isRateLimited(error)) return throttledAnswer();
 			throw error;
 		}
+		if (submission.item.status === "spam") isContentSpam = true;
 		logger.info?.("Form submission created successfully", {
 			formSlug,
 			submissionId: submission.item.id,
@@ -2227,13 +3449,31 @@ async function listPublishedForms(req, ctx, config) {
 	}, PUBLIC);
 	return respondList(result.data ?? [], toPageMeta(result.pagination));
 }
+/**
+* A found form's answer now: its status, then its closing time, then its
+* limit, so a visitor reaching a form that has closed by itself is given its
+* closed message rather than fields to fill in. The count here is a plain
+* read: what is stored at the submission decides exactly, under its lock.
+*/
+async function availabilityNow(form, ctx, slugs) {
+	const settings = normalizeFormSettings(form.settings);
+	const formId = typeof form.id === "string" ? form.id : void 0;
+	const taken = settings.submissionLimit === void 0 || formId === void 0 ? void 0 : await ctx.services.ownCollections.count(slugs.submissions, { where: {
+		form: { equals: formId },
+		status: { not_equals: "spam" }
+	} });
+	return formAvailabilityNow(form, settings, {
+		now: /* @__PURE__ */ new Date(),
+		taken
+	});
+}
 async function readFormBySlug(slug, ctx, config) {
 	const slugs = installedSlugs(config, ctx.self);
 	const doc = (await ctx.services.collections.listEntries(slugs.forms, {
 		where: { slug: { equals: slug } },
 		pagination: { limit: 1 }
 	}, PUBLIC)).data?.[0];
-	const availability = formAvailability(doc);
+	const availability = doc ? await availabilityNow(doc, ctx, slugs) : formAvailability(doc);
 	if (availability.kind === "absent") throw NextlyError$1.notFound({
 		message: NO_SUCH_FORM,
 		logContext: {
@@ -2247,7 +3487,13 @@ async function readFormBySlug(slug, ctx, config) {
 		status: "closed",
 		closedMessage: availability.message
 	});
-	return respondDoc(doc);
+	const botCheck = publicBotCheck(doc?.settings, config.spamProtection);
+	const oneResponse = publicOneResponse(normalizeFormSettings(doc?.settings));
+	return respondDoc({
+		...doc,
+		...botCheck ? { botCheck } : {},
+		...oneResponse ? { oneResponse } : {}
+	});
 }
 /**
 * The submitted answers, or the refusal for a body that carries none.
@@ -2436,9 +3682,10 @@ function resolveConfig(options) {
 			defaultToEmail: options.notifications?.defaultToEmail,
 			enabled: options.notifications?.enabled ?? true
 		},
+		oneResponse: oneResponseOptions(options.oneResponse),
 		spamProtection: {
 			honeypot: options.spamProtection?.honeypot ?? true,
-			recaptcha: options.spamProtection?.recaptcha ?? { enabled: false },
+			...botCheckOptions(options.spamProtection),
 			rateLimit: {
 				maxSubmissions: options.spamProtection?.rateLimit?.maxSubmissions ?? 10,
 				windowMs: options.spamProtection?.rateLimit?.windowMs ?? 6e4
@@ -2496,11 +3743,14 @@ function formBuilder(options = {}) {
 		forms: resolvedConfig.formOverrides.slug,
 		submissions: resolvedConfig.formSubmissionOverrides.slug
 	}, () => installedSubmissionsSlug);
+	const outbound = botCheckHosts(resolvedConfig.spamProtection);
+	let rebuildDeps;
 	return {
 		plugin: definePlugin({
 			name: "@nextlyhq/plugin-form-builder",
 			version: PLUGIN_VERSION,
 			nextly: ">=0.0.2-alpha.21",
+			...outbound.length > 0 ? { capabilities: { net: { outbound } } } : {},
 			author: "Nextly",
 			homepage: "https://nextlyhq.com",
 			repository: "https://github.com/nextlyhq/nextly",
@@ -2513,7 +3763,15 @@ function formBuilder(options = {}) {
 			],
 			contributes: {
 				collections: [formsCol, submissionsCol],
+				jobs: [rebuildKeysJob(async (deadline) => {
+					if (rebuildDeps) await rebuildResponseKeys(rebuildDeps, deadline);
+				})],
 				dashboard: { widgets: [newSubmissions] },
+				admin: { views: { [resolvedConfig.formOverrides.slug]: { documentViews: addressedFormPages().map((page) => ({
+					...page,
+					component: FORM_EDITOR_VIEW
+				})) } } },
+				emailTemplates: formsEmailTemplates(),
 				publicGrants: [{
 					collection: resolvedConfig.formSubmissionOverrides.slug,
 					action: "create"
@@ -2604,7 +3862,8 @@ function formBuilder(options = {}) {
 							},
 							spamProtection: {
 								honeypot: resolvedConfig.spamProtection.honeypot,
-								recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false
+								recaptchaEnabled: resolvedConfig.spamProtection.recaptcha?.enabled ?? false,
+								...botCheckDefaults(resolvedConfig.spamProtection)
 							},
 							redirectCollections: Object.keys(resolvedConfig.redirectRelationships),
 							slugs: {
@@ -2629,6 +3888,7 @@ function formBuilder(options = {}) {
 				const declaredSubmissionsSlug = resolvedConfig.formSubmissionOverrides.slug;
 				const submissionSlug = nextly.self.collections[declaredSubmissionsSlug] ?? declaredSubmissionsSlug;
 				installedSubmissionsSlug = submissionSlug;
+				await nextly.security.digests.prepare();
 				nextly.logger.info("Form Builder plugin initialized", {
 					formsCollection: resolvedConfig.formOverrides.slug,
 					submissionsCollection: submissionSlug,
@@ -2664,6 +3924,37 @@ function formBuilder(options = {}) {
 					}
 					return ctx.data;
 				});
+				warnUncheckedBotChecks({
+					spam: resolvedConfig.spamProtection,
+					forms: async () => (await nextly.services.ownCollections.listEntries(formsSlug, { pagination: { limit: 500 } })).data ?? [],
+					readSettings: normalizeFormSettings,
+					warn: (message, context) => nextly.logger.warn?.(message, context)
+				});
+				nextly.hooks.on("beforeChange", formsSlug, (context) => {
+					refuseOneResponseFieldProblem(context);
+					return context.data;
+				});
+				rebuildDeps = {
+					collections: nextly.services.collections,
+					digests: () => nextly.security.digests,
+					formsSlug,
+					submissionsSlug: submissionSlug
+				};
+				nextly.hooks.on("beforeChange", formsSlug, async (context) => {
+					await stampOneResponseVersion(context, async (formId) => keysFitInSave(nextly, submissionSlug, formId, resolvedConfig.oneResponse.keysInSave));
+					return context.data;
+				});
+				nextly.hooks.onInTransaction(formsSlug, (write) => rebuildInSave({
+					own: nextly.services.ownCollections,
+					collections: nextly.services.collections,
+					digests: () => nextly.security.digests,
+					submissionsSlug: submissionSlug
+				}, write));
+				nextly.hooks.on("afterUpdate", formsSlug, (context) => rebuildAfterSave(context, () => nextly.services.jobs.runSweepNow(REBUILD_KEYS_JOB, { maxDurationMs: REBUILD_ON_SAVE_MS }), (message, context) => nextly.logger.warn?.(message, context)));
+				registerFormClosing(nextly, {
+					forms: formsSlug,
+					submissions: submissionSlug
+				});
 				nextly.hooks.on("afterRead", formsSlug, (context) => injectSubmissionCount(context, submissionSlug, nextly));
 			}
 		}),
@@ -2745,6 +4036,7 @@ function normalizeAddressList(addresses) {
 */
 function buildNotificationEmails(input) {
 	const { notifications, submittedData, formName, submissionId, defaultFrom } = input;
+	const answers = submissionAnswers(input.fields ?? [], submittedData);
 	const seen = /* @__PURE__ */ new Set();
 	const emails = [];
 	const skipped = [];
@@ -2785,7 +4077,11 @@ function buildNotificationEmails(input) {
 			variables: {
 				...submittedData,
 				formName,
-				submissionId
+				submissionId,
+				_submission: {
+					id: submissionId,
+					answers
+				}
 			},
 			providerId: notification.providerId,
 			from,
@@ -2897,19 +4193,83 @@ function updateNeedsChecking(submission, stored) {
 	if (submission.form !== void 0) return true;
 	return stored.status === "spam" && submission.status !== void 0 && submission.status !== "spam";
 }
+/**
+* Whether a form has few enough non-spam submissions for a change of its
+* one-response setting to give them keys inside the save.
+*/
+async function keysFitInSave(nextly, submissionsSlug, formId, limit) {
+	return await nextly.services.collections.count(submissionsSlug, { where: {
+		form: { equals: formId },
+		status: { not_equals: "spam" }
+	} }, { as: "system" }) <= limit;
+}
+/**
+* On a form that keeps no addresses, compare a keyed submission's address
+* with the earlier submissions' before it is dropped: the hold compares
+* stored addresses, and this one will have none. An earlier submission with
+* the address but without a key for the current version (one stored before
+* the form stopped keeping addresses, while its keys are made) would
+* otherwise let the network respond again. Read outside the form's lock,
+* which is enough: the earlier submissions it guards against are not being
+* written, and new ones race on their keys, which the unique index decides.
+*/
+async function refuseEarlierAddress(settings, ctx, formId, nextly) {
+	const row = ctx.data;
+	if (settings.storeIpAndBrowser !== false || settings.oneResponse !== "ip") return;
+	if (typeof row?.ipAddress !== "string" || !row.responseKey) return;
+	if (await nextly.services.collections.count(ctx.collection ?? "form-submissions", { where: {
+		form: { equals: formId },
+		ipAddress: { equals: row.ipAddress },
+		status: { not_equals: "spam" }
+	} }, { as: "system" }) > 0) throw respondedRefusal(formId);
+}
+/**
+* A form that keeps no IP address or browser (Settings › Privacy) stores
+* neither with a new submission. Cleared after the one-response key is made,
+* so one per network still compares the address, by its keyed digest only.
+*/
+function withholdAddress(settings, row) {
+	if (settings.storeIpAndBrowser !== false) return;
+	row.ipAddress = null;
+	row.userAgent = null;
+}
+/**
+* A request's address as the server judged it, never one the caller posted:
+* the collection grants public create, and a posted address would choose the
+* network one response per person compares. A create no request produced
+* (an import) keeps the address it was given.
+*/
+function stampRequestAddress(ctx, row) {
+	if (ctx.operation === "create" && ctx.req?.http) row.ipAddress = ctx.req.http.ip ?? null;
+}
+/**
+* The plugin's own write of a one-response key it made (`setKey`): the
+* key is written and nothing else is done to the patch. Whether `row` was one.
+*/
+function pluginKeyWrite(operation, row, stored) {
+	const key = submissionMarks(row)?.setKey;
+	if (operation !== "update" || key === void 0) return false;
+	row.responseKey = stored?.status === "spam" ? null : key;
+	return true;
+}
 async function prepareSubmissionForWrite(context, formsSlug, nextly) {
 	const ctx = context;
 	const submission = ctx.data;
 	if (!submission || typeof submission !== "object") return ctx.data;
+	if (pluginKeyWrite(ctx.operation, submission, ctx.originalData)) return submission;
+	delete submission.responseKey;
 	const stored = ctx.originalData;
 	const formId = parentFormId(submission) ?? (stored ? parentFormId(stored) : null);
 	if (!formId) return ctx.data;
-	if (ctx.operation !== "create" && !updateNeedsChecking(submission, stored)) return ctx.data;
+	if (ctx.operation !== "create" && !updateNeedsChecking(submission, stored)) {
+		await rekeyAfterUpdate(ctx, formsSlug, formId, nextly);
+		return ctx.data;
+	}
 	const incoming = submittedPayload(submission.data !== void 0 ? submission.data : stored?.data);
 	const marks = submissionMarks(submission);
 	const form = await formToCheckAgainst(marks, formsSlug, formId, nextly);
 	const fields = form.fields;
-	const spam = ctx.operation === "create" && ctx.req?.http ? await judgeSubmission(incoming, form, ctx.req.http, nextly) : void 0;
+	const spam = ctx.operation === "create" && ctx.req?.http ? await judgeSubmission(incoming, form, ctx.req.http, nextly, marks) : void 0;
 	if (spam?.reason === "rate_limit") throw NextlyError.rateLimited();
 	const prepared = prepareSubmission({
 		data: incoming,
@@ -2931,9 +4291,112 @@ async function prepareSubmissionForWrite(context, formsSlug, nextly) {
 		ctx.data.spamReason = spam.reason ?? null;
 	}
 	if (ctx.operation !== "create" && submission.data === void 0) stampDerivedEdit(ctx.data, ctx.user, incoming, prepared.data);
+	stampRequestAddress(ctx, ctx.data);
+	if (ctx.operation === "create") {
+		const settings = normalizeFormSettings(form.settings);
+		const browserToken = marks?.browserToken ?? browserTokenOf(incoming);
+		ctx.data.responseKey = await responseKeyOf(() => nextly.security.digests, settings, {
+			...ctx.data,
+			browserToken
+		});
+		warnTokenless(settings, browserToken, ctx, formId, nextly);
+		await refuseEarlierAddress(settings, ctx, formId, nextly);
+		withholdAddress(settings, ctx.data);
+	} else await rekeyAfterUpdate(ctx, formsSlug, formId, nextly, form);
 	return ctx.data;
 }
 /**
+* Say so when a visitor's submission reaches a form taking one response per
+* browser without the browser's token: it is accepted, as a browser that
+* cleared its data is, and nothing stops that visitor sending another. Left
+* silent, a site whose form script does not send the token would never learn
+* the setting has no effect.
+*/
+function warnTokenless(settings, browserToken, ctx, formId, nextly) {
+	if (settings.oneResponse !== "browser" || browserToken !== void 0) return;
+	if (!ctx.req?.http || ctx.data?.status === "spam") return;
+	nextly.logger.warn?.("A submission to a form taking one response per browser came without the browser's token, so it is accepted without a check. The form's script sends it as the `nextly-browser-token` answer.", { formId });
+}
+/**
+* Move an updated submission's one-response key with what the update changes
+* (`responseKeyAfterUpdate`): spam gives it back, a restored or edited
+* submission takes the key of what it now holds. An update that touches none
+* of status, answers or address leaves it as stored.
+*/
+async function rekeyAfterUpdate(ctx, formsSlug, formId, nextly, form) {
+	const row = ctx.data;
+	if (!row || !touchesResponseKey(row)) return;
+	const parent = form ?? await formToCheckAgainst(void 0, formsSlug, formId, nextly);
+	const stored = ctx.originalData;
+	const movedFrom = stored ? parentFormId(stored) : null;
+	row.responseKey = await responseKeyAfterUpdate({
+		moved: movedFrom !== null && movedFrom !== formId,
+		digests: () => nextly.security.digests,
+		settings: normalizeFormSettings(parent.settings),
+		patch: row,
+		stored,
+		heldElsewhere: async (key) => await nextly.services.collections.count(ctx.collection ?? "form-submissions", { where: {
+			form: { equals: formId },
+			responseKey: { equals: key },
+			...stored?.id ? { id: { not_equals: stored.id } } : {}
+		} }, { as: "system" }) > 0
+	});
+	await refuseTakenAddress(ctx, formId, nextly, parent);
+}
+/**
+* Refuse an edit that moves a submission onto an email address another
+* submission of the form already holds, saying which one only to a person who
+* may read it. The holder is found as the system, since the address is taken
+* whoever may see it; whether to name it is the editor's own read, judged by
+* the access gate. Anyone else is told only that the address is used, so the
+* refusal never shows a submission they could not open. The unique index
+* still refuses a holder that commits after this look, without the name.
+*/
+async function refuseTakenAddress(ctx, formId, nextly, form) {
+	const key = ctx.data?.responseKey;
+	const stored = ctx.originalData;
+	if (typeof key !== "string" || key === stored?.responseKey) return;
+	if (normalizeFormSettings(form.settings).oneResponse !== "email") return;
+	const collection = ctx.collection ?? "form-submissions";
+	const { data: holders } = await nextly.services.collections.listEntries(collection, {
+		where: {
+			form: { equals: formId },
+			responseKey: { equals: key },
+			...stored?.id ? { id: { not_equals: stored.id } } : {}
+		},
+		pagination: { limit: 1 }
+	}, { as: "system" });
+	const id = (holders?.[0])?.id;
+	if (typeof id !== "string" && typeof id !== "number") return;
+	const holderId = String(id);
+	const named = await mayRead(nextly, collection, holderId, ctx.user);
+	throw NextlyError.duplicate({
+		message: named ? `This email address is already used by submission ${holderId} of this form.` : "This email address is already used by another submission of this form.",
+		logContext: {
+			formId,
+			holderId
+		}
+	});
+}
+/** Whether a hook's user is a signed-in person the access gate can judge. */
+function isAuthUser(user) {
+	if (!user || typeof user !== "object") return false;
+	const { id, email } = user;
+	return typeof id === "string" && typeof email === "string";
+}
+/** Whether `user` may read the submission `id`, asked of the access gate. */
+async function mayRead(nextly, collection, id, user) {
+	if (!isAuthUser(user)) return false;
+	try {
+		return await nextly.services.collections.count(collection, { where: { id: { equals: id } } }, {
+			as: "user",
+			user
+		}) > 0;
+	} catch {
+		return false;
+	}
+}
+/**
 * The status a submission a request created starts with: `new`, whatever the
 * request named, before the spam verdict may make it `spam`. The collection
 * grants public create and nothing restricts `status`, so a visitor posting
@@ -2998,7 +4461,7 @@ function rateLimitKeyFor(form) {
 * every visitor behind an untrusted proxy. The honeypot still applies, because
 * it reads the payload rather than the caller.
 */
-async function judgeSubmission(payload, form, http, nextly) {
+async function judgeSubmission(payload, form, http, nextly, marks) {
 	const config = getFormBuilderConfig(nextly);
 	if (!config) return void 0;
 	const declared = new Set((Array.isArray(form.fields) ? form.fields : []).map((field) => field.name).filter((name) => typeof name === "string"));
@@ -3010,10 +4473,19 @@ async function judgeSubmission(payload, form, http, nextly) {
 		formSlug: rateLimitKeyFor(form),
 		config: {
 			honeypot: settings.honeypotEnabled ?? config.spamProtection.honeypot,
-			rateLimit: config.spamProtection.rateLimit
+			rateLimit: marks?.rateCounted === true ? void 0 : config.spamProtection.rateLimit
 		}
 	});
-	return verdict.isSpam ? verdict : void 0;
+	if (verdict.isSpam) return verdict;
+	if (marks?.keepAsEvidence === true) return void 0;
+	return judgeBotCheck({
+		settings: normalizeFormSettings(form.settings),
+		spam: config.spamProtection,
+		tokens: marks?.botTokens ?? botTokensOf(payload),
+		ip: http.ip ?? void 0,
+		fetch: nextly.fetch,
+		warn: (message, context) => nextly.logger.warn?.(message, context)
+	});
 }
 /**
 * Record a payload change this hook derived, since nothing else will.
@@ -3051,7 +4523,8 @@ async function handleSubmissionCreated(context, config, nextly) {
 		submittedData,
 		formName: form.name,
 		submissionId: submission.id,
-		defaultFrom: config.notifications.defaultFrom
+		defaultFrom: config.notifications.defaultFrom,
+		fields: Array.isArray(form.fields) ? form.fields : []
 	});
 	for (const skip of skipped) if (skip.reason === "empty-recipient") nextly.logger.warn?.("Form Builder: empty recipient, skipping notification", {
 		notificationId: skip.notificationId,
@@ -3063,52 +4536,71 @@ async function handleSubmissionCreated(context, config, nextly) {
 		reason: skip.reason
 	});
 	if (emails.length === 0) return;
-	await sendNotificationEmails({
-		emails: await nextly.filters.apply("form-builder.beforeEmail", emails, {
-			form,
-			submission
-		}),
+	const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, {
+		form,
+		submission
+	});
+	const send = () => queueNotificationEmails({
+		emails: finalEmails,
 		emailService,
 		logger: nextly.logger,
 		formSlug: form.slug,
+		submissionId: typeof submission.id === "number" ? `${submission.id}` : typeof submission.id === "string" ? submission.id : "",
 		fileAttachments
 	});
+	const { afterCommit } = context;
+	await (afterCommit ? afterCommit(send) : send());
+}
+/**
+* The key a notification is queued under: its submission, its place among
+* the submission's emails, and a short digest of its notification's id. The
+* place keeps apart two emails of one notification (a `beforeEmail` hook
+* may add a copy of one), and the digest keeps the key short whatever the
+* id's length. The same submission's emails, built again, get the same keys.
+*/
+function notificationKey(submissionId, index, notificationId) {
+	return `form-notification:${submissionId}:${index}:${createHash("sha256").update(notificationId ?? "").digest("hex").slice(0, 16)}`;
 }
 /**
-* Send each notification, and log what happened to it.
+* Queue each notification, and log where it stands.
 *
-* The email service reports a provider's failure in its result rather than by
-* throwing, so the result is read: a notification the provider did not take is
-* logged as failed, with whether a retry can help, and never as sent. No log
-* line names a recipient: an address in a log outlives the submission it came
-* from, and the notification's id is enough to find it.
+* Queued through the email service's queued send rather than sent once: the
+* queue makes the first attempt at once, and a failure a retry can help is
+* tried again through the job queue, with backoff, until it is sent or fails
+* for good, never dropped. Each carries an idempotency key from its
+* submission and notification (`notificationKey`), so a provider that takes keys delivers it
+* once even if this hook runs again. No log line names a recipient: an
+* address in a log outlives the submission it came from, and the
+* notification's id and the queued email's id are enough to find it.
 */
-async function sendNotificationEmails(input) {
+async function queueNotificationEmails(input) {
 	const { emails, emailService, logger, formSlug, fileAttachments } = input;
-	for (const email of emails) {
+	for (const [index, email] of emails.entries()) {
 		const identity = {
 			formSlug,
 			templateSlug: email.templateSlug,
 			notificationId: email.notificationId
 		};
 		try {
-			const result = await emailService.sendWithTemplate(email.templateSlug, email.to, email.variables, {
+			const queued = await emailService.queueWithTemplate(email.templateSlug, email.to, email.variables, {
 				providerId: email.providerId,
 				from: email.from,
 				replyTo: email.replyTo,
 				cc: email.cc,
 				bcc: email.bcc,
-				attachments: fileAttachments.length > 0 ? fileAttachments : void 0
+				attachments: fileAttachments.length > 0 ? fileAttachments : void 0,
+				idempotencyKey: notificationKey(input.submissionId, index, email.notificationId)
 			});
-			if (result.success) logger.info?.("Form Builder: notification sent", {
+			if (queued.state === "failed") logger.error?.("Form Builder: notification failed", {
 				...identity,
-				attachmentCount: fileAttachments.length
+				queuedId: queued.id,
+				retryable: false
 			});
-			else logger.error?.("Form Builder: notification failed", {
+			else logger.info?.("Form Builder: notification queued", {
 				...identity,
-				retryable: result.failure?.retryable ?? true,
-				...result.failure?.status !== void 0 ? { status: result.failure.status } : {},
-				reason: result.failure?.reason ?? "The email was not sent."
+				queuedId: queued.id,
+				state: queued.state,
+				attachmentCount: fileAttachments.length
 			});
 		} catch (err) {
 			logger.error?.("Form Builder: notification failed", {