@nextlyhq/plugin-form-builder 0.0.2-alpha.75 → 0.0.2-alpha.76

package/dist/index.js

@@ -1,8 +1,8 @@
-import { $ as SCHEMA_ONLY_READ, A as applyFieldDefaults, B as downloadFile, C as isKnownFormField, D as normalizeFormSettings, E as fieldsHiddenByCondition, F as warnIfWebhooksConfigured, G as generateExportFilename, H as exportToCSV, J as getSupportedComparisonOperators, K as evaluateConditions, M as createFormConfig, N as pluralize, O as DEFAULT_FORM_SETTINGS, P as toTitleCase, Q as SCHEMA_ONLY_CONTEXT, R as formsEmailTemplates, S as isFormFieldType, T as isTextFormField, U as exportToJSON, V as exportAndDownload, W as formatExportValue, X as NEW_SUBMISSIONS_WIDGET_ID, Y as isValidComparisonOperator, Z as readNewSubmissions, _ as BUILT_IN_FORM_FIELD_TYPES, at as addressedFormPages, b as isFileFormField, d as generateZodSchema, et as documentReachability, f as getValidationErrors, h as validateFormData, j as applyFormDefaults, k as DEFAULT_NOTIFICATION_SETTINGS, m as transformFormData, nt as pickedDocumentField, p as getValidationIssues, q as evaluateSingleCondition, r as parseFieldRef, rt as FORM_EDITOR_VIEW, tt as parseRedirectReference, u as oneResponseFieldProblem, v as isCheckboxFormField, w as isSelectFormField, x as isFormField, y as isEmailFormField } from "./field-references-oCuFEwkr.js";
+import { $ as applyFieldDefaults, A as getValidationIssues, At as fieldsHiddenByCondition, B as isKnownFormField, Bt as pickedDocumentField, Ct as isConsentAnswer, D as oneResponseFieldProblem, Et as askedAfterEdit, F as isCheckboxFormField, Ft as readNewSubmissions, G as latestByRecipient, H as isTextFormField, I as isEmailFormField, It as SCHEMA_ONLY_CONTEXT, L as isFileFormField, Lt as SCHEMA_ONLY_READ, M as validateFormData, Mt as getSupportedComparisonOperators, Nt as isValidComparisonOperator, O as generateZodSchema, Ot as askedSnapshotOf, P as BUILT_IN_FORM_FIELD_TYPES, Pt as NEW_SUBMISSIONS_WIDGET_ID, Q as DEFAULT_NOTIFICATION_SETTINGS, R as isFormField, Rt as documentReachability, S as pageFromReferer, St as editedConsents, Tt as storedConsentNames, U as addressableNow, Ut as addressedFormPages, V as isSelectFormField, Vt as FORM_EDITOR_VIEW, X as normalizeFormSettings, Y as sendInProgress, Z as DEFAULT_FORM_SETTINGS, _ as listWhere, _t as CONSENT_EDIT_REFUSED, a as parseFieldRef, b as scopeFromSearch, bt as blankConsentFields, c as attachFieldsOf, d as conditionsOf, dt as exportAndDownload, et as applyFormDefaults, f as fieldsMarkedToAttach, ft as exportToCSV, ht as generateExportFilename, it as warnIfWebhooksConfigured, j as transformFormData, jt as evaluateConditions, k as getValidationErrors, kt as readAskedSnapshot, l as attachmentsFrom, m as teamAddressesOf, mt as formatExportValue, n as submissionTitleOf, nt as pluralize, pt as exportToJSON, q as reachedExcept, rt as toTitleCase, st as formsEmailTemplates, tt as createFormConfig, u as conditionsMet, ut as downloadFile, vt as CONSENT_TEXT_CHANGED, wt as staleConsentNames, yt as CONSENT_TEXT_REQUIRED, z as isFormFieldType, zt as parseRedirectReference } from "./submission-title-CVixn15Z.js";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
-import { MAX_WIDGET_ROWS, NextlyError, defineJob, definePlugin, defineWidget, isLocaleSelector, listEntries, setting } from "@nextlyhq/plugin-sdk";
-import { NO_SUCH_FORM, NextlyError as NextlyError$1, RateLimiter, buildPaginatedResponse, checkbox as checkbox$1, clampLimit, date as date$1, formAvailability, group, isPluginFieldTypeOnSurface, json, number as number$1, relationship, resolveRateLimitStore, respondAction, respondDoc, respondList, select as select$1, stripHtmlTags, text as text$1, textarea as textarea$1, trustedClientIp } from "nextly";
+import { MAX_WIDGET_ROWS, NextlyError, date as date$1, defineJob, definePlugin, defineWidget, isLocaleSelector, json, listEntries, number as number$1, respondAction, respondList, respondMutation, setting, text as text$1, trustedClientIp } from "@nextlyhq/plugin-sdk";
+import { NO_SUCH_FORM, NextlyError as NextlyError$1, RateLimiter, buildPaginatedResponse, checkbox as checkbox$1, clampLimit, date as date$2, formAvailability, group, isPluginFieldTypeOnSurface, json as json$1, number as number$2, relationship, resolveRateLimitStore, respondAction as respondAction$1, respondDoc, respondList as respondList$1, select as select$1, stripHtmlTags, text as text$2, textarea as textarea$1, trustedClientIp as trustedClientIp$1 } from "nextly";
 import { previewUrlFromTemplate } from "nextly/config";
 import { z } from "zod";
 
@@ -495,7 +495,7 @@ function formsCollection(pluginConfig) {
 	const { slug, labels, fields: additionalFields, access: accessOverrides, hooks: hookOverrides, admin: adminOverrides, ...overrides } = pluginConfig.formOverrides;
 	const redirectCollections = Object.keys(pluginConfig.redirectRelationships);
 	const settingsFields = [
-		text$1({
+		text$2({
 			name: "submitButtonText",
 			label: "Submit Button Text",
 			defaultValue: "Submit",
@@ -533,7 +533,7 @@ function formsCollection(pluginConfig) {
 				}
 			}
 		}),
-		text$1({
+		text$2({
 			name: "redirectUrl",
 			label: "Redirect URL",
 			admin: {
@@ -582,15 +582,15 @@ function formsCollection(pluginConfig) {
 				value: "ip"
 			}
 		]
-	}), text$1({
+	}), text$2({
 		name: "oneResponseField",
 		label: "Email field for one response per person"
-	}), number$1({
+	}), number$2({
 		name: "oneResponseVersion",
 		label: "One-response version",
 		defaultValue: 0,
 		admin: { hidden: true }
-	}), number$1({
+	}), number$2({
 		name: "oneResponseKeyedVersion",
 		label: "One-response keys made for version",
 		admin: { hidden: true }
@@ -623,10 +623,10 @@ function formsCollection(pluginConfig) {
 				value: "turnstile"
 			}
 		]
-	}), date$1({
+	}), date$2({
 		name: "closesAt",
 		label: "Closes at"
-	}), number$1({
+	}), number$2({
 		name: "submissionLimit",
 		label: "Submission limit",
 		min: 1
@@ -634,7 +634,7 @@ function formsCollection(pluginConfig) {
 		name: "storeIpAndBrowser",
 		label: "Store IP address and browser",
 		defaultValue: true
-	}), number$1({
+	}), number$2({
 		name: "keepDays",
 		label: "Keep submissions for (days)",
 		min: 1
@@ -642,7 +642,7 @@ function formsCollection(pluginConfig) {
 		name: "internalNote",
 		label: "Internal note",
 		access: { read: readableByFormEditors(slug) }
-	}), text$1({
+	}), text$2({
 		name: "captchaSiteKey",
 		label: "reCAPTCHA Site Key",
 		admin: {
@@ -654,13 +654,13 @@ function formsCollection(pluginConfig) {
 		}
 	}));
 	const defaultFields = [
-		text$1({
+		text$2({
 			name: "name",
 			label: "Form Name",
 			required: true,
 			admin: { description: "Internal name for this form (not shown to users)" }
 		}),
-		text$1({
+		text$2({
 			name: "slug",
 			label: "Slug",
 			required: true,
@@ -672,7 +672,7 @@ function formsCollection(pluginConfig) {
 			label: "Description",
 			admin: { description: "Internal notes about this form's purpose" }
 		}),
-		json({
+		json$1({
 			name: "fields",
 			label: "Form Fields",
 			required: true,
@@ -684,7 +684,7 @@ function formsCollection(pluginConfig) {
 			label: "Form Settings",
 			fields: settingsFields
 		}),
-		json({
+		json$1({
 			name: "notifications",
 			label: "Notifications",
 			defaultValue: [],
@@ -712,7 +712,7 @@ function formsCollection(pluginConfig) {
 			],
 			admin: { description: "Only published forms can receive submissions. Closed forms display a message instead." }
 		}),
-		date$1({
+		date$2({
 			name: "wentLiveAt",
 			label: "First Published",
 			admin: {
@@ -772,6 +772,143 @@ function formsCollection(pluginConfig) {
 	};
 }
 
+// src/collections/sends.ts
+/**
+* Form Submission Sends collection
+*
+* The notifications each submission queued: the queued email's id and the
+* idempotency key it was sent with. Kept so every path that deletes a
+* submission can forget what it sent (`ctx.services.email.forgetSends`) in
+* the same transaction, cancelling a notification not yet sent and erasing
+* the delivery records of one that was. A notification's key is made from
+* the notification as it was when it was sent, so it cannot be worked out
+* again at deletion: it is recorded here.
+*
+* Each also keeps what became of the send, for as long as its submission
+* exists: where it stands, how many attempts it took, when it last changed,
+* why it was cancelled, and each recipient it went to (by a masked hint and
+* the plugin's keyed digest, never the address) with what became of it.
+* These are written in the transaction of each change of the queued email
+* (`handlers/send-history`), so they cannot fall behind the send, and they
+* outlive the delivery log, which core prunes. Written as each change
+* happens, they do not change when the submission's answers or the
+* notification are edited later. A send made by Resend names who asked.
+*
+* Internal: never in the admin's navigation, records no webhook events, and
+* no caller reaches it; only this plugin, acting as itself, writes and reads
+* it.
+*
+* @module collections/sends
+*/
+/** The slug the sends are kept under. */
+const SUBMISSION_SENDS_SLUG = "form-submission-sends";
+/** The slug Resend's requests are kept under. */
+const SUBMISSION_RESENDS_SLUG = "form-submission-resends";
+/**
+* The sends collection's slug as this install has it: a host may rename a
+* collection the plugin contributes, and the services know only the name it
+* was given.
+*/
+function sendsSlugOf(ctx) {
+	return ctx.self.collections["form-submission-sends"] ?? "form-submission-sends";
+}
+/** The resends collection's slug as this install has it, as above. */
+function resendsSlugOf(ctx) {
+	return ctx.self.collections[SUBMISSION_RESENDS_SLUG] ?? SUBMISSION_RESENDS_SLUG;
+}
+/** Nobody but the plugin itself, which acts as the system and skips this. */
+const nobody$1 = () => false;
+function submissionSendsCollection() {
+	return {
+		slug: SUBMISSION_SENDS_SLUG,
+		labels: {
+			singular: "Submission send",
+			plural: "Submission sends"
+		},
+		internal: true,
+		webhooks: false,
+		access: {
+			read: nobody$1,
+			create: nobody$1,
+			update: nobody$1,
+			delete: nobody$1
+		},
+		fields: [
+			text$1({
+				name: "submission",
+				required: true
+			}),
+			text$1({
+				name: "queuedId",
+				required: true
+			}),
+			text$1({
+				name: "sendKey",
+				required: true
+			}),
+			text$1({ name: "form" }),
+			text$1({ name: "notification" }),
+			text$1({ name: "notificationName" }),
+			text$1({ name: "state" }),
+			number$1({ name: "attempts" }),
+			number$1({ name: "retries" }),
+			date$1({ name: "changedAt" }),
+			json({ name: "cancel" }),
+			json({ name: "cancelRequested" }),
+			text$1({ name: "retiredBy" }),
+			json({ name: "configured" }),
+			json({ name: "recipients" }),
+			text$1({ name: "requestedBy" }),
+			text$1({ name: "resend" })
+		],
+		indexes: [
+			{ fields: ["submission"] },
+			{ fields: ["queuedId"] },
+			{ fields: ["form", "notification"] }
+		]
+	};
+}
+/**
+* Resend's requests: who asked to send a notification of a submission
+* again, and which recipients they ticked. A request is stored with the
+* send it makes, in one transaction (`handlers/resend`), so a request that
+* could not be sent leaves no trace, and is deleted with its submission.
+* Internal, as the sends are.
+*/
+function submissionResendsCollection() {
+	return {
+		slug: SUBMISSION_RESENDS_SLUG,
+		labels: {
+			singular: "Submission resend",
+			plural: "Submission resends"
+		},
+		internal: true,
+		webhooks: false,
+		access: {
+			read: nobody$1,
+			create: nobody$1,
+			update: nobody$1,
+			delete: nobody$1
+		},
+		fields: [
+			text$1({
+				name: "submission",
+				required: true
+			}),
+			text$1({
+				name: "notification",
+				required: true
+			}),
+			text$1({ name: "requestedBy" }),
+			json({ name: "ticked" }),
+			json({ name: "exclude" }),
+			json({ name: "retire" }),
+			json({ name: "settled" })
+		],
+		indexes: [{ fields: ["submission"] }]
+	};
+}
+
 // src/collections/submissions.ts
 /**
 * Whether a create keeps the `submittedAt` it names: only one made on the
@@ -796,28 +933,12 @@ function sameIndex(index, other) {
 	return index.fields.join("\0") === other.fields.join("\0") && (index.unique ?? false) === (other.unique ?? false);
 }
 /**
-* Generate the Form Submissions collection configuration.
-*
-* Creates a collection for storing form submissions with:
-* - Reference to the parent form
-* - Submitted data (JSON)
-* - Status tracking (new, read, archived)
-* - Metadata (IP, user agent, timestamp)
-* - Internal notes for admin use
-*
-* @param pluginConfig - Resolved plugin configuration
-* @returns CollectionConfig for the Submissions collection
-*
-* @example
-* ```typescript
-* const submissionsCol = submissionsCollection(resolvedConfig);
-* // Returns a collection with slug "form-submissions" (or custom slug from config)
-* ```
+* The fields the plugin itself gives every submission, whatever a host adds
+* through `formSubmissionOverrides.fields`. One list, read by the collection
+* and by what tells the admin which fields are the host's own.
 */
-function submissionsCollection(pluginConfig) {
-	const { slug, labels, fields: additionalFields, access: accessOverrides, ...overrides } = pluginConfig.formSubmissionOverrides;
-	const formSlug = pluginConfig.formOverrides.slug;
-	const defaultFields = [
+function builtInSubmissionFields(formSlug) {
+	return [
 		relationship({
 			name: "form",
 			label: "Form",
@@ -828,7 +949,7 @@ function submissionsCollection(pluginConfig) {
 				description: "The form this submission belongs to"
 			}
 		}),
-		json({
+		json$1({
 			name: "data",
 			label: "Submission Data",
 			required: true,
@@ -863,7 +984,7 @@ function submissionsCollection(pluginConfig) {
 			index: true,
 			admin: { description: "Track whether this submission has been reviewed" }
 		}),
-		text$1({
+		text$2({
 			name: "spamReason",
 			label: "Spam Reason",
 			admin: {
@@ -876,7 +997,7 @@ function submissionsCollection(pluginConfig) {
 			label: "Internal Notes",
 			admin: { description: "Notes visible only to admins (not shown to submitter)" }
 		}),
-		text$1({
+		text$2({
 			name: "ipAddress",
 			label: "IP Address",
 			admin: {
@@ -884,7 +1005,7 @@ function submissionsCollection(pluginConfig) {
 				description: "IP address of the submitter"
 			}
 		}),
-		text$1({
+		text$2({
 			name: "userAgent",
 			label: "User Agent",
 			admin: {
@@ -892,7 +1013,12 @@ function submissionsCollection(pluginConfig) {
 				description: "Browser/device information of the submitter"
 			}
 		}),
-		date$1({
+		textarea$1({
+			name: "page",
+			label: "Page",
+			admin: { hidden: true }
+		}),
+		date$2({
 			name: "submittedAt",
 			label: "Submitted At",
 			required: true,
@@ -902,7 +1028,7 @@ function submissionsCollection(pluginConfig) {
 				description: "When the form was submitted"
 			}
 		}),
-		date$1({
+		date$2({
 			name: "editedAt",
 			label: "Edited At",
 			admin: {
@@ -910,7 +1036,7 @@ function submissionsCollection(pluginConfig) {
 				description: "When an admin last edited the submitted data"
 			}
 		}),
-		text$1({
+		text$2({
 			name: "editedBy",
 			label: "Edited By",
 			admin: {
@@ -918,20 +1044,84 @@ function submissionsCollection(pluginConfig) {
 				description: "ID of the admin who last edited the submitted data"
 			}
 		}),
-		text$1({
+		text$2({
 			name: "responseKey",
 			label: "One-response key",
 			admin: { hidden: true }
+		}),
+		json$1({
+			name: "asked",
+			label: "Fields asked",
+			admin: { hidden: true }
+		}),
+		text$2({
+			name: "title",
+			label: "Sender",
+			admin: { hidden: true }
 		})
 	];
-	let finalFields;
-	if (Array.isArray(additionalFields) && additionalFields.length > 0) finalFields = [...defaultFields, ...additionalFields];
-	else finalFields = defaultFields;
+}
+/**
+* The fields a host added to the submissions collection: every named
+* top-level field that is not one of the plugin's own, and not one the host
+* hid from the admin. The submission page shows them, since it replaces the
+* default editor that would have drawn them.
+*/
+function submissionExtensionFields(pluginConfig) {
+	const builtIn = new Set(builtInSubmissionFields(pluginConfig.formOverrides.slug).map(fieldName));
+	return submissionsCollection(pluginConfig).fields.filter((field) => !hiddenFromAdmin(field)).map((field) => ({
+		name: fieldName(field),
+		label: fieldLabel(field),
+		type: field.type
+	})).filter((field) => field.name !== "" && !builtIn.has(field.name));
+}
+/**
+* Whether the page leaves a field out: one configured to stay out of the
+* admin; one shown only when a condition holds, which the page does not
+* judge; or one holding fields of its own (a group, an array, blocks), whose
+* value the page would show whole, hidden descendants included.
+*/
+function hiddenFromAdmin(field) {
+	const shape = field;
+	return shape.admin?.hidden === true || shape.admin?.condition !== void 0 || shape.fields !== void 0 || shape.blocks !== void 0;
+}
+/** A field's name, or "" for a layout field that has none. */
+function fieldName(field) {
+	return "name" in field && typeof field.name === "string" ? field.name : "";
+}
+/** A field's label as the page shows it: its own, else its name. */
+function fieldLabel(field) {
+	const label = field.label;
+	return typeof label === "string" && label !== "" ? label : fieldName(field);
+}
+/**
+* Generate the Form Submissions collection configuration.
+*
+* Creates a collection for storing form submissions with:
+* - Reference to the parent form
+* - Submitted data (JSON)
+* - Status tracking (new, read, archived)
+* - Metadata (IP, user agent, timestamp)
+* - Internal notes for admin use
+*
+* @param pluginConfig - Resolved plugin configuration
+* @returns CollectionConfig for the Submissions collection
+*
+* @example
+* ```typescript
+* const submissionsCol = submissionsCollection(resolvedConfig);
+* // Returns a collection with slug "form-submissions" (or custom slug from config)
+* ```
+*/
+function submissionsCollection(pluginConfig) {
+	const { slug, labels, fields: additionalFields, access: accessOverrides, ...overrides } = pluginConfig.formSubmissionOverrides;
+	const formSlug = pluginConfig.formOverrides.slug;
+	const submissionFields = [...builtInSubmissionFields(formSlug), ...Array.isArray(additionalFields) ? additionalFields : []];
 	return {
 		slug,
 		dbName: slug.replace(/-/g, "_"),
 		labels,
-		fields: finalFields,
+		fields: submissionFields,
 		timestamps: true,
 		webhooks: {
 			record: false,
@@ -948,10 +1138,13 @@ function submissionsCollection(pluginConfig) {
 			isPlugin: true,
 			group: "Forms",
 			order: 51,
-			useAsTitle: "id",
+			useAsTitle: "title",
 			description: "View and manage form submissions",
 			disableCreate: true,
-			components: { views: { List: { Component: "@nextlyhq/plugin-form-builder/admin#SubmissionsView" } } },
+			components: { views: {
+				List: { Component: "@nextlyhq/plugin-form-builder/admin#SubmissionsView" },
+				Edit: { Component: "@nextlyhq/plugin-form-builder/admin#SubmissionPage" }
+			} },
 			...overrides.admin
 		},
 		access: accessWithDefaults(accessOverrides, { create: true }),
@@ -971,6 +1164,81 @@ function submissionsCollection(pluginConfig) {
 	};
 }
 
+// src/collections/uploads.ts
+/**
+* Form Uploads collection
+*
+* Every file a visitor uploaded through a form's upload route
+* (`POST /api/forms/:slug/upload`): the media item, the form and file field
+* it was uploaded for, and the submission that claimed it, if one has. A
+* submission a trusted write stored naming a file another already holds is
+* recorded beside it, one row per holder, so the file stays while any of
+* them is left. A
+* file answer in a submission a request writes may only name an upload
+* recorded here for the same form and field that no other submission has
+* claimed, so the files a submission holds are known to be its own and can
+* be deleted with it.
+*
+* `releasedAt` is set, in the deleting transaction, when the submission
+* holding an upload is deleted (or, for one never claimed, when it is given
+* up): from then on no submission may claim it, and once the deletion has
+* committed its file is deleted, unless something else uses it, and the row
+* with it. A row whose file could not be deleted yet stays released, and the
+* nightly retention pass tries again.
+*
+* Internal: never in the admin's navigation, records no webhook events, and
+* no caller reaches it; only this plugin, acting as itself, writes and reads
+* it.
+*
+* @module collections/uploads
+*/
+/** The slug the uploads are kept under. */
+const FORM_UPLOADS_SLUG = "form-uploads";
+/** Nobody but the plugin itself, which acts as the system and skips this. */
+const nobody = () => false;
+function formUploadsCollection() {
+	return {
+		slug: FORM_UPLOADS_SLUG,
+		labels: {
+			singular: "Form upload",
+			plural: "Form uploads"
+		},
+		internal: true,
+		webhooks: false,
+		timestamps: true,
+		access: {
+			read: nobody,
+			create: nobody,
+			update: nobody,
+			delete: nobody
+		},
+		fields: [
+			text$1({
+				name: "media",
+				required: true
+			}),
+			text$1({
+				name: "form",
+				required: true
+			}),
+			text$1({
+				name: "field",
+				required: true
+			}),
+			text$1({ name: "submission" }),
+			date$1({ name: "releasedAt" })
+		],
+		indexes: [
+			{
+				fields: ["media", "submission"],
+				unique: true
+			},
+			{ fields: ["submission"] },
+			{ fields: ["form"] }
+		]
+	};
+}
+
 // src/dashboard/widget.ts
 /**
 * New form submissions: the form-builder plugin's dashboard widget, declared
@@ -1192,8 +1460,8 @@ async function sendVerification(fetch, provider, request) {
 * recoverable. A provider that cannot be reached leaves the submission
 * unchecked, and says so in the log: an outage must not send every real
 * submission to spam. A form whose check has no secret configured is
-* accepted unchecked, as before bot checks were verified, with a warning at
-* start and in Settings.
+* accepted unchecked, as before bot checks were verified, with a warning in
+* the log (see `warnUncheckedSiteDefault`) and in Settings.
 *
 * @module handlers/bot-check
 */
@@ -1338,15 +1606,18 @@ function botTokensOf(payload) {
 }
 /**
 * A request-made submission's bot check: none when its form's check is off,
-* or names a provider missing its secret or site key (accepted unchecked, as
-* warned at start and in Settings); a spam verdict when the token fails or
-* is missing.
+* or names a provider missing its secret or site key (accepted unchecked,
+* and said in the log the first time, see `warnUncheckedSubmission`); a spam
+* verdict when the token fails or is missing.
 */
 async function judgeBotCheck(input) {
 	const provider = botProviderOf(input.settings.botCheck, input.spam);
 	if (provider === void 0) return void 0;
 	const keys = readyKeys(provider, input.spam, input.settings);
-	if (keys === void 0) return void 0;
+	if (keys === void 0) {
+		warnUncheckedSubmission(provider, input.spam, input.form, input.warn);
+		return;
+	}
 	const verdict = await judgeBotToken({
 		provider,
 		secret: keys.secret,
@@ -1361,30 +1632,76 @@ async function judgeBotCheck(input) {
 		reason: provider
 	} : void 0;
 }
+/** What the log is told about `provider` missing a key, naming the options. */
+function uncheckedMessage(provider) {
+	return `Form Builder: the ${provider === "recaptcha" ? "reCAPTCHA" : "Turnstile"} bot check is in use without both of its keys, so its submissions are accepted unchecked. Set spamProtection.${provider}.secretKey and spamProtection.${provider}.siteKey in the plugin's options.`;
+}
 /**
-* Warn, once at start, for each bot check that is in use (the site default,
-* or named by a form) without both of its keys, naming the options: those
-* forms' submissions are accepted unchecked until it is. Reads at most the
-* first 500 forms; a failure to read them is not a reason to stop the start.
+* The providers a submission has already been warned about since the
+* plugin's last start, by the plugin's bot-check options. Keyed by the
+* options object, which each `formBuilder()` call resolves once, so two
+* installs of the plugin in one process keep apart, and an options object
+* no longer used is let go.
 */
-async function warnUncheckedBotChecks(input) {
-	let forms = [];
-	try {
-		forms = await input.forms();
-	} catch {
-		forms = [];
-	}
-	const counts = /* @__PURE__ */ new Map();
-	for (const form of forms) {
-		const settings = input.readSettings(form.settings);
-		const provider = botProviderOf(settings.botCheck, input.spam);
-		if (provider && readyKeys(provider, input.spam, settings) === void 0) counts.set(provider, (counts.get(provider) ?? 0) + 1);
+const saidForSubmissions = /* @__PURE__ */ new WeakMap();
+/**
+* At start, from the plugin's options alone: the site default's check, when
+* it is in use without both of its keys. Every form left on "Site default"
+* is accepted unchecked until it has them.
+*
+* A form that names a check of its own is not read for here: reading the
+* forms cost every start a round trip to say something that matters only
+* when such a form is saved (`warnUncheckedFormCheck`) or submitted
+* (`judgeBotCheck`), which is where it is said instead. A start also
+* forgets which providers submissions were warned about, so a restart or a
+* reload says it again, as the warning at start always did.
+*/
+function warnUncheckedSiteDefault(spam, warn) {
+	saidForSubmissions.set(spam, /* @__PURE__ */ new Set());
+	const provider = botProviderOf("default", spam);
+	if (provider && readyKeys(provider, spam, {}) === void 0) warn(uncheckedMessage(provider), { provider });
+}
+/**
+* When a form is saved: the check it names itself, when that check has not
+* both of its keys. Said at every such save, since the person saving it is
+* the one who can act; a form on "Site default" or "Off" is not, the site
+* default's having been said at start.
+*/
+function warnUncheckedFormCheck(settings, spam, form, warn) {
+	const named = settings.botCheck;
+	if (named !== "recaptcha" && named !== "turnstile") return;
+	if (readyKeys(named, spam, settings) === void 0) warn(uncheckedMessage(named), {
+		provider: named,
+		...form ? { form } : {}
+	});
+}
+/**
+* `warnUncheckedFormCheck` for a forms save, as its `beforeChange` hook is
+* handed it: only a save that carries settings chose a check, and the form
+* is named by the slug it is saved with, or the one it had.
+*/
+function warnSavedFormCheck(context, spam, warn) {
+	const { data, originalData } = context;
+	if (data?.settings === void 0) return;
+	const slug = data.slug ?? originalData?.slug;
+	warnUncheckedFormCheck(normalizeFormSettings(data.settings), spam, typeof slug === "string" ? slug : void 0, warn);
+}
+/**
+* When a submission is accepted unchecked because its check is missing a
+* key: said for the first such submission of each provider since the
+* plugin's start, naming its form, and not again for every one after it.
+*/
+function warnUncheckedSubmission(provider, spam, form, warn) {
+	let said = saidForSubmissions.get(spam);
+	if (said === void 0) {
+		said = /* @__PURE__ */ new Set();
+		saidForSubmissions.set(spam, said);
 	}
-	const siteDefault = botProviderOf("default", input.spam);
-	if (siteDefault && readyKeys(siteDefault, input.spam, {}) === void 0) counts.set(siteDefault, counts.get(siteDefault) ?? 0);
-	for (const [provider, forms] of counts) input.warn(`Form Builder: the ${provider === "recaptcha" ? "reCAPTCHA" : "Turnstile"} bot check is in use without both of its keys, so its submissions are accepted unchecked. Set spamProtection.${provider}.secretKey and spamProtection.${provider}.siteKey in the plugin's options.`, {
+	if (said.has(provider)) return;
+	said.add(provider);
+	warn(uncheckedMessage(provider), {
 		provider,
-		forms
+		...form ? { form } : {}
 	});
 }
 /** {@link BotCheckDefaults} for the admin: whether keys are set, never the keys. */
@@ -1420,6 +1737,507 @@ function publicBotCheck(storedSettings, spam) {
 	} : void 0;
 }
 
+// src/handlers/consent-text-check.ts
+/**
+* The save of a form refuses a consent field with no text to agree to. The
+* builder refuses the same before it sends; this holds it for every other way
+* a form is written (the API, an import), since a consent with a blank text
+* would record agreement to nothing.
+*
+* @module handlers/consent-text-check
+*/
+/** The saved fields as written: a list, or a JSON string of one. */
+function fieldsOf(value) {
+	let decoded = value;
+	if (typeof value === "string") try {
+		decoded = JSON.parse(value);
+	} catch {
+		return [];
+	}
+	return Array.isArray(decoded) ? decoded : [];
+}
+/** Refuse a form save holding a consent field with a blank agreement text. */
+function refuseBlankConsentText(context) {
+	const fields = context.data?.fields;
+	if (fields === void 0) return;
+	const blank = blankConsentFields(fieldsOf(fields));
+	if (blank.length === 0) return;
+	throw NextlyError.validation({ errors: blank.map((field) => ({
+		path: `fields.${field.name}.agreementText`,
+		code: "REQUIRED",
+		message: CONSENT_TEXT_REQUIRED
+	})) });
+}
+
+// src/handlers/send-views.ts
+const RECIPIENT = z.object({
+	digest: z.string(),
+	hint: z.string(),
+	kind: z.enum([
+		"to",
+		"cc",
+		"bcc"
+	]),
+	source: z.enum([
+		"team",
+		"visitor",
+		"cc",
+		"bcc",
+		"added"
+	]).catch("added"),
+	outcome: z.enum([
+		"accepted",
+		"refused",
+		"unknown",
+		"skipped"
+	]).optional(),
+	retries: z.number().int().optional()
+});
+const CAUSE = z.union([z.object({
+	by: z.literal("person"),
+	userId: z.string().nullable()
+}), z.object({ by: z.enum([
+	"spam",
+	"erasure",
+	"sender",
+	"request"
+]) })]);
+const STATE = z.enum([
+	"waiting",
+	"retrying",
+	"sending",
+	"sent",
+	"failed",
+	"cancelled"
+]);
+/** A JSON column's value, whether a dialect hands it back parsed or as text. */
+function jsonOf(value) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+/** A text column's value, or null. */
+function textOf$1(value) {
+	return typeof value === "string" && value !== "" ? value : null;
+}
+/** A date column's value as text, or null. */
+function dateOf(value) {
+	if (value instanceof Date) return value.toISOString();
+	return textOf$1(value);
+}
+/** A stored row of `form-submission-sends`, as the views read it. */
+function sendRowOf(entry) {
+	const recipients = z.array(RECIPIENT).safeParse(jsonOf(entry.recipients));
+	const configured = z.array(RECIPIENT).safeParse(jsonOf(entry.configured));
+	const cancel = CAUSE.safeParse(jsonOf(entry.cancel));
+	const requested = CAUSE.safeParse(jsonOf(entry.cancelRequested));
+	const state = STATE.safeParse(entry.state);
+	return {
+		id: String(entry.id),
+		submission: textOf$1(entry.submission) ?? "",
+		queuedId: textOf$1(entry.queuedId) ?? "",
+		form: textOf$1(entry.form),
+		notification: textOf$1(entry.notification),
+		notificationName: textOf$1(entry.notificationName),
+		state: state.success ? state.data : null,
+		attempts: typeof entry.attempts === "number" ? entry.attempts : null,
+		retries: typeof entry.retries === "number" ? entry.retries : null,
+		resend: textOf$1(entry.resend),
+		changedAt: dateOf(entry.changedAt),
+		createdAt: dateOf(entry.createdAt),
+		cancel: cancel.success ? cancel.data : null,
+		cancelRequested: requested.success ? requested.data : null,
+		retiredBy: textOf$1(entry.retiredBy),
+		configured: configured.success ? configured.data : null,
+		recipients: recipients.success ? recipients.data : null,
+		requestedBy: textOf$1(entry.requestedBy)
+	};
+}
+/** The most rows one read takes; a submission or a page needs far fewer. */
+const MOST_ROWS = 500;
+/** A row read against where core says its queued email stands. */
+function reconciled(send, status) {
+	if (!sendInProgress(send)) return send;
+	if (status === void 0) return {
+		...send,
+		state: "cancelled",
+		cancel: { by: "erasure" }
+	};
+	if (status.state === "cancelled") return {
+		...send,
+		state: "cancelled",
+		cancel: { by: "erasure" }
+	};
+	if (status.state === "sent" || status.state === "failed") return {
+		...send,
+		state: status.state
+	};
+	return send;
+}
+/** `rows` read against core's state of each one still on its way. */
+async function upToDate(ctx, rows) {
+	const unsettled = rows.filter(sendInProgress).map((row) => row.queuedId);
+	if (unsettled.length === 0) return [...rows];
+	const statuses = new Map((await ctx.services.email.readQueued(unsettled)).map((status) => [status.id, status]));
+	return rows.map((row) => reconciled(row, statuses.get(row.queuedId)));
+}
+/**
+* Sends in the order they were made. Rows stored in the same second sort
+* alike by their time on some dialects, so an original comes before a send
+* Resend made, which always follows it.
+*/
+function orderedSends(rows, options) {
+	const sign = options.newestFirst ? -1 : 1;
+	return rows.map((row, index) => ({
+		row,
+		index
+	})).sort((a, b) => {
+		const time = (a.row.createdAt ?? "").localeCompare(b.row.createdAt ?? "");
+		if (time !== 0) return sign * time;
+		const resent = Number(Boolean(a.row.resend)) - Number(Boolean(b.row.resend));
+		return resent !== 0 ? sign * resent : a.index - b.index;
+	}).map(({ row }) => row);
+}
+/** The sends rows `where` selects, oldest first. */
+async function sendRows(ctx, where, options = {}) {
+	const read = (page, limit) => ctx.services.ownCollections.listEntries(sendsSlugOf(ctx), {
+		where,
+		sort: {
+			field: "createdAt",
+			direction: options.newestFirst ? "desc" : "asc"
+		},
+		pagination: {
+			limit,
+			page
+		},
+		depth: 0
+	});
+	return orderedSends((options.limit === void 0 ? await everyPage(read) : (await read(1, options.limit)).data).map((entry) => sendRowOf(entry)), options);
+}
+/**
+* Every row `read` pages through, a page at a time: a history read whole,
+* since a result left on a later page would be taken as never having
+* happened.
+*/
+async function everyPage(read) {
+	const rows = [];
+	for (let page = 1;; page += 1) {
+		const { data } = await read(page, MOST_ROWS);
+		rows.push(...data);
+		if (data.length < MOST_ROWS) return rows;
+	}
+}
+/** The name a group of sends reads under: its latest one's. */
+function nameOf(sends) {
+	for (let index = sends.length - 1; index >= 0; index -= 1) {
+		const name = sends[index]?.notificationName;
+		if (name) return name;
+	}
+	return "Notification";
+}
+/** A submission's sends, up to date, by notification in the order sent. */
+function groupByNotification(rows) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = row.notification ?? `queued:${row.queuedId}`;
+		groups.set(key, [...groups.get(key) ?? [], row]);
+	}
+	return [...groups.values()].map((sends) => ({
+		notification: sends[0]?.notification ?? null,
+		name: nameOf(sends),
+		recipients: latestByRecipient(sends),
+		inProgress: sends.some(sendInProgress),
+		sends: sends.map((send) => ({
+			queuedId: send.queuedId,
+			state: send.state ?? "waiting",
+			attempts: send.attempts ?? 0,
+			at: send.changedAt ?? send.createdAt ?? null,
+			requestedBy: send.requestedBy ?? null,
+			retired: Boolean(send.retiredBy)
+		}))
+	}));
+}
+/** A submission's sends, up to date and grouped by notification. */
+async function submissionSends(ctx, submissionId) {
+	return groupByNotification(await upToDate(ctx, (await sendRows(ctx, { submission: { equals: submissionId } })).filter((row) => row.notification)));
+}
+/** A notification's latest sends across its form's submissions, newest first. */
+async function recentSends(ctx, formId, notificationId, limit) {
+	return (await upToDate(ctx, await sendRows(ctx, {
+		form: { equals: formId },
+		notification: { equals: notificationId }
+	}, {
+		newestFirst: true,
+		limit
+	}))).map((send) => ({
+		submission: send.submission,
+		recipients: latestByRecipient([send]),
+		at: send.changedAt ?? send.createdAt ?? null
+	}));
+}
+
+// src/handlers/send-history.ts
+/** A core cancel cause, as the send's row keeps it. */
+function causeOf(cause) {
+	return cause.by === "person" ? {
+		by: "person",
+		userId: cause.userId
+	} : { by: cause.by };
+}
+/** Where a final recipient came from: the line it was configured on, else a filter. */
+function sourceOf(configured, digest) {
+	return configured?.find((entry) => entry.digest === digest)?.source ?? "added";
+}
+/**
+* The change's recipients as the row keeps them, each with where it came
+* from, and one accepted with the retries recorded before it was: as an
+* earlier change recorded it, else the row's count so far. Counted from the
+* retries recorded rather than the attempt's number, so a send whose record
+* of acceptance was undone, and is made again by the next attempt, reads as
+* sent the first time, as it was.
+*/
+function foldedRecipients(stored, change) {
+	const before = new Map((stored.recipients ?? []).map((recipient) => [recipient.digest, recipient]));
+	return (change.recipients ?? []).map((recipient) => {
+		const accepted = recipient.outcome === "accepted";
+		const earlier = before.get(recipient.digest);
+		return {
+			digest: recipient.digest,
+			hint: recipient.hint,
+			kind: recipient.kind,
+			outcome: recipient.outcome,
+			source: sourceOf(stored.configured, recipient.digest),
+			...accepted ? { retries: earlier?.outcome === "accepted" && earlier.retries !== void 0 ? earlier.retries : stored.retries ?? 0 } : {}
+		};
+	});
+}
+/** What a cancelled change makes of the row. */
+function cancelledPatch(stored, change) {
+	if (stored.state === "failed" && stored.retiredBy && change.cancel?.by === "sender") return {};
+	return {
+		state: "cancelled",
+		cancel: change.cancel?.by === "request" || change.cancel === void 0 ? stored.cancelRequested ?? { by: "request" } : causeOf(change.cancel)
+	};
+}
+/**
+* The row's fields a change sets: where the send stands, its attempts, when
+* it changed, a cancel's cause, and each final recipient's outcome. Empty
+* when the change leaves the row as it is.
+*/
+function foldChange(stored, change) {
+	const state = change.state === "cancelled" ? cancelledPatch(stored, change) : { state: change.state };
+	if (Object.keys(state).length === 0) return {};
+	return {
+		...state,
+		attempts: Math.max(stored.attempts ?? 0, change.attempt),
+		...change.state === "retrying" ? { retries: (stored.retries ?? 0) + 1 } : {},
+		changedAt: change.at,
+		...change.cancelRequested ? { cancelRequested: causeOf(change.cancelRequested) } : {},
+		...change.recipients && change.recipients.length > 0 ? { recipients: foldedRecipients(stored, change) } : {}
+	};
+}
+/**
+* The send `queuedId` names, or undefined. Read with no lock: the change
+* that asks holds its queued email's row (core changes it, or cancels it,
+* under that row's lock before telling the plugin), so two changes of one
+* send never fold at once. A row lock here, beside a deletion's own reads of
+* a submission's sends, deadlocks MySQL when several submissions are deleted
+* together.
+*/
+async function sendRow(ctx, transaction, queuedId) {
+	const { data } = await ctx.services.ownCollections.listEntriesInTransaction(transaction, sendsSlugOf(ctx), {
+		where: { queuedId: { equals: queuedId } },
+		pagination: { limit: 1 },
+		depth: 0
+	}, { lock: "none" });
+	const [entry] = data;
+	return entry ? sendRowOf(entry) : void 0;
+}
+/** Keep each change of a submission's notifications with its send. */
+function registerSendHistory(ctx) {
+	ctx.services.email.onQueuedEmailChange(async (change, { transaction }) => {
+		const row = await sendRow(ctx, transaction, change.queuedId);
+		if (!row) return;
+		const patch = foldChange(row, change);
+		if (Object.keys(patch).length === 0) return;
+		await ctx.services.collections.updateEntryInTransaction(transaction, sendsSlugOf(ctx), String(row.id), {
+			...patch,
+			_overwrite: true
+		});
+	});
+}
+/**
+* Name `cause` as why the sends among `queuedIds` were cancelled, where the
+* plugin's own forgetting cancelled them (`sender`), in `transaction`: what
+* marking a submission Spam calls it.
+*/
+async function nameCancels(ctx, transaction, queuedIds, cause) {
+	for (const queuedId of queuedIds) {
+		const row = await sendRow(ctx, transaction, queuedId);
+		if (!row) continue;
+		const patch = {};
+		if (row.cancel?.by === "sender") patch.cancel = cause;
+		if (row.cancelRequested?.by === "sender") patch.cancelRequested = cause;
+		if (Object.keys(patch).length === 0) continue;
+		await ctx.services.collections.updateEntryInTransaction(transaction, sendsSlugOf(ctx), String(row.id), {
+			...patch,
+			_overwrite: true
+		});
+	}
+}
+
+// src/handlers/forget-sends.ts
+/**
+* How many rows a deletion reads at a time: a form's submissions, or a
+* submission's sends. Below the services' cap on one page, and drained until
+* none is left, so a large form or a submission with many notifications is
+* forgotten whole.
+*/
+const DELETE_PAGE = 200;
+/**
+* How a submission's sends and requests are read: with no row lock. The
+* write deleting the submission or marking it Spam holds the submission's
+* row, and core changes or cancels each queued email under that email's own
+* row lock before telling the plugin, so nothing else changes them
+* meanwhile, and each is then written by its id. A locking read would take
+* MySQL's next-key locks on the `submission` index, which deadlock when
+* several submissions are deleted or marked Spam at once, each in its own
+* transaction.
+*/
+const UNLOCKED = { lock: "none" };
+/**
+* The forms each transaction is deleting, by the transaction's key. A
+* submission deleted with its form need not hand its one-response key to
+* the next submission, which is about to go too.
+*/
+const formsBeingDeleted = /* @__PURE__ */ new WeakMap();
+/** Whether the transaction `write` runs in is deleting the form `formId`. */
+function deletingForm(write, formId) {
+	return formsBeingDeleted.get(write.transactionKey)?.has(formId) ?? false;
+}
+/**
+* Record that `submissionId` queued a notification, in `transaction`: the
+* one storing the submission and queuing the notification, so the record,
+* the submission and the queued email commit or roll back together.
+*/
+async function recordSend(ctx, transaction, submissionId, send) {
+	await ctx.services.collections.createEntryInTransaction(transaction, sendsSlugOf(ctx), {
+		submission: submissionId,
+		...send
+	});
+}
+/** A submission's status as a write describes it, or undefined. */
+function statusOf(row) {
+	return row && typeof row === "object" ? row.status : void 0;
+}
+/** Whether `write` is the update that marks its submission Spam. */
+function marksSpam(write) {
+	return write.operation === "update" && statusOf(write.data) === "spam" && statusOf(write.originalData) !== "spam";
+}
+/**
+* The queued emails a submission's notifications went out as, read on the
+* write's transaction. Paged by number: nothing here deletes the records.
+*/
+async function queuedIdsOf(ctx, write) {
+	const ids = [];
+	for (let page = 1;; page += 1) {
+		const { data } = await ctx.services.ownCollections.listEntriesInTransaction(write.transaction, sendsSlugOf(ctx), {
+			where: { submission: { equals: String(write.id) } },
+			pagination: {
+				limit: 200,
+				page
+			},
+			depth: 0
+		}, UNLOCKED);
+		const sends = data;
+		for (const send of sends) if (send.queuedId) ids.push(send.queuedId);
+		if (sends.length < 200) return ids;
+	}
+}
+/**
+* Cancel and clear what a submission queued as it is marked Spam (see the
+* module). Only the queued emails are named, not the keys they were sent
+* with, so the delivery records of what already went out are kept.
+*/
+async function cancelSpamSends(ctx, write) {
+	if (!marksSpam(write)) return;
+	const queuedIds = await queuedIdsOf(ctx, write);
+	if (queuedIds.length === 0) return;
+	await ctx.services.email.forgetSends({ queuedIds }, { tx: write.db });
+	await nameCancels(ctx, write.transaction, queuedIds, { by: "spam" });
+}
+/** Forget what the submission a delete removes sent, and its records of it. */
+async function forgetSubmissionSends(ctx, write) {
+	if (write.operation !== "delete" || write.id === void 0) return;
+	const slug = sendsSlugOf(ctx);
+	await inBatches(ctx, write, slug, (sends) => forgetBatch(ctx, write, slug, sends));
+	await inBatches(ctx, write, resendsSlugOf(ctx), async (requests) => {
+		for (const row of requests) await ctx.services.collections.deleteEntryInTransaction(write.transaction, resendsSlugOf(ctx), String(row.id));
+	});
+}
+/**
+* Hand `remove` each batch of the rows in `slug` that name the submission a
+* delete removes, until none is left. `remove` deletes the batch it is
+* given, so the first page is always the next batch.
+*/
+async function inBatches(ctx, write, slug, remove) {
+	for (;;) {
+		const { data } = await ctx.services.ownCollections.listEntriesInTransaction(write.transaction, slug, {
+			where: { submission: { equals: String(write.id) } },
+			pagination: { limit: 200 },
+			depth: 0
+		}, UNLOCKED);
+		const rows = data;
+		if (rows.length > 0) await remove(rows);
+		if (rows.length < 200) return;
+	}
+}
+/**
+* Delete a batch of a submission's send records, then forget the sends.
+* Records first: the cancel each forget causes then finds no record to fold
+* into (`send-history`), so a deletion writes nothing it is about to delete.
+* An update and a delete of one record in one transaction, beside another
+* deletion doing the same, deadlocks MySQL on the content-events table.
+*/
+async function forgetBatch(ctx, write, slug, sends) {
+	for (const send of sends) await ctx.services.collections.deleteEntryInTransaction(write.transaction, slug, String(send.id));
+	await ctx.services.email.forgetSends({
+		queuedIds: sends.flatMap((send) => send.queuedId ? [send.queuedId] : []),
+		idempotencyKeys: sends.flatMap((send) => send.sendKey ? [send.sendKey] : [])
+	}, { tx: write.db });
+}
+/** Delete a form's submissions with the form, each forgetting what it sent. */
+async function deleteFormSubmissions(ctx, write, submissionsSlug) {
+	if (write.operation !== "delete" || write.id === void 0) return;
+	const formId = String(write.id);
+	const deleting = formsBeingDeleted.get(write.transactionKey) ?? /* @__PURE__ */ new Set();
+	deleting.add(formId);
+	formsBeingDeleted.set(write.transactionKey, deleting);
+	for (;;) {
+		const { data } = await ctx.services.ownCollections.listEntriesInTransaction(write.transaction, submissionsSlug, {
+			where: { form: { equals: formId } },
+			pagination: { limit: 200 },
+			depth: 0
+		});
+		for (const row of data) await ctx.services.collections.deleteEntryInTransaction(write.transaction, submissionsSlug, String(row.id));
+		if (data.length < 200) return;
+	}
+}
+/**
+* Forget what submissions sent on every path that deletes them, and call
+* off what one queued as it is marked Spam.
+*/
+function registerForgettingSends(ctx, slugs) {
+	ctx.hooks.onInTransaction(slugs.submissions, async (write) => {
+		await forgetSubmissionSends(ctx, write);
+		await cancelSpamSends(ctx, write);
+	});
+	ctx.hooks.onInTransaction(slugs.forms, (write) => deleteFormSubmissions(ctx, write, slugs.submissions));
+}
+
 // src/utils/form-closing.ts
 /**
 * Whether a form is taking submissions now: its status, as core reads it for
@@ -1537,7 +2355,7 @@ function oneResponseIdentityOf(settings) {
 const BROWSER_TOKEN = z.string().trim().regex(/^[A-Za-z0-9_-]{16,128}$/);
 /** The browser token a submission's answers carry, if a well-formed one. */
 function browserTokenOf(payload) {
-	const parsed = BROWSER_TOKEN.safeParse(answersOf(payload)?.[BROWSER_TOKEN_FIELD]);
+	const parsed = BROWSER_TOKEN.safeParse(answersOf$1(payload)?.[BROWSER_TOKEN_FIELD]);
 	return parsed.success ? parsed.data : void 0;
 }
 /**
@@ -1565,7 +2383,7 @@ function textOf(value) {
 * A submission's answers as an object: as written, or as a stored row holds
 * them before a read decodes them, a JSON string.
 */
-function answersOf(data) {
+function answersOf$1(data) {
 	let value = data;
 	if (typeof value === "string") try {
 		value = JSON.parse(value);
@@ -1576,7 +2394,7 @@ function answersOf(data) {
 }
 /** The answer to `field` in a submission's data. */
 function answerOf(data, field) {
-	return field === void 0 ? void 0 : answersOf(data)?.[field];
+	return field === void 0 ? void 0 : answersOf$1(data)?.[field];
 }
 /**
 * The submission's key under the form's one-response setting, or null when
@@ -1803,6 +2621,7 @@ function sameValue$1(left, right) {
 	if (Object.is(left, right)) return true;
 	if (left instanceof Date && right instanceof Date) return left.getTime() === right.getTime();
 	if (Array.isArray(left) && Array.isArray(right)) return left.length === right.length && left.every((value, index) => sameValue$1(value, right[index]));
+	if (isConsentAnswer(left) && isConsentAnswer(right)) return left.agreed === right.agreed && left.text === right.text;
 	return false;
 }
 /** Whether two submitted payloads say the same thing. */
@@ -1831,16 +2650,25 @@ function sameSubmittedPayload(granted, incoming) {
 * handler has already prepared: transforming a projected payload projects it
 * again, and stripping tags from text that has none returns it unchanged.
 */
-function prepareSubmission({ data, fields, validate }) {
+function prepareSubmission({ data, fields, validate, fresh = true }) {
 	const transformed = transformFormData(data, fields);
 	sanitizeSubmissionData(transformed, fields);
 	if (!validate) return { data: transformed };
 	const hidden = fieldsHiddenByCondition(fields, transformed);
-	const result = generateZodSchema(fields.filter((field) => !hidden.has(field.name))).safeParse(transformed);
-	if (!result.success) return {
+	const shown = fields.filter((field) => !hidden.has(field.name));
+	const result = generateZodSchema(shown).safeParse(transformed);
+	const stale = fresh ? staleConsentNames(shown, data) : [];
+	if (!result.success || stale.length > 0) return {
 		data: transformed,
-		validationErrors: getValidationErrors(result),
-		validationIssues: getValidationIssues(result, data)
+		validationErrors: {
+			...result.success ? {} : getValidationErrors(result),
+			...Object.fromEntries(stale.map((name) => [name, CONSENT_TEXT_CHANGED]))
+		},
+		validationIssues: [...result.success ? [] : getValidationIssues(result, data), ...stale.map((path) => ({
+			path,
+			code: "INVALID",
+			message: CONSENT_TEXT_CHANGED
+		}))]
 	};
 	return { data: {
 		...transformed,
@@ -2125,6 +2953,7 @@ async function handOffKey(deps, write, slugs) {
 	const released = releasedKeyOf(write);
 	if (released === void 0) return;
 	const { key, formId, ipAddress } = released;
+	if (deletingForm(write, formId)) return;
 	const { settings } = await formOf(deps.own, write, slugs, formId, "update");
 	if (keyVersionOf(key) !== (settings.oneResponseVersion ?? 0)) return;
 	const next = await nextHolderOf(deps, write, slugs, {
@@ -2320,7 +3149,7 @@ function passCutoff() {
 	return new Date(Date.now() + CUTOFF_MARGIN_MS);
 }
 /** Rows read at a time: forms, then one form's submissions. */
-const PAGE = 100;
+const PAGE$2 = 100;
 /**
 * The mark on the sweep's own write of a form, saying which version's keys
 * it finished. Only the plugin sets it; `stampOneResponseVersion` takes the
@@ -2429,7 +3258,7 @@ async function rebuildInSave(deps, write) {
 			field: "id",
 			direction: "asc"
 		},
-		pagination: { limit: PAGE },
+		pagination: { limit: PAGE$2 },
 		depth: 0
 	}, { lock: "none" })).data, {
 		form: { equals: write.id },
@@ -2471,17 +3300,17 @@ async function rebuildResponseKeys(deps, deadline) {
 	for (let page = 1;; page++) {
 		const { data } = await deps.collections.listEntries(deps.formsSlug, {
 			pagination: {
-				limit: PAGE,
+				limit: PAGE$2,
 				page
 			},
 			depth: 0
 		}, { as: "system" });
 		const forms = data;
 		for (const form of forms) {
-			if (pastDeadline(deadline)) return;
+			if (pastDeadline$2(deadline)) return;
 			await bringUpToDate(deps, form, deadline);
 		}
-		if (forms.length < PAGE) return;
+		if (forms.length < PAGE$2) return;
 	}
 }
 /** One form: its keys made for its current version, if they are behind. */
@@ -2490,7 +3319,7 @@ async function bringUpToDate(deps, form, deadline) {
 	if (!keysBehind(settings)) return;
 	if (await rebuildForm(deps, form, settings, deadline) === "done") await markKeyed(deps, form, settings.oneResponseVersion ?? 0);
 }
-function pastDeadline(deadline) {
+function pastDeadline$2(deadline) {
 	return Date.now() >= deadline.getTime();
 }
 /**
@@ -2523,7 +3352,7 @@ async function rebuildPass(deps, formId, settings, deadline) {
 			field: "id",
 			direction: "asc"
 		},
-		pagination: { limit: PAGE },
+		pagination: { limit: PAGE$2 },
 		depth: 0
 	}, { as: "system" })).data, {
 		form: { equals: formId },
@@ -2532,7 +3361,7 @@ async function rebuildPass(deps, formId, settings, deadline) {
 	});
 	let retries = 0;
 	for (const row of rows) {
-		if (pastDeadline(deadline)) return "stop";
+		if (pastDeadline$2(deadline)) return "stop";
 		const outcome = await keyRow(deps, formId, settings, row);
 		if (outcome === "stale-form") return "stop";
 		if (outcome === "retry") retries += 1;
@@ -2553,7 +3382,7 @@ async function snapshotOf(page, where) {
 			id: { greater_than: after }
 		});
 		rows.push(...read);
-		if (read.length < PAGE) break;
+		if (read.length < PAGE$2) break;
 		after = String(read[read.length - 1]?.id);
 	}
 	return rows.sort(storedFirst);
@@ -2635,20 +3464,677 @@ async function markKeyed(deps, form, version) {
 	}
 }
 
-// src/handlers/spam-detection.ts
+// src/handlers/send-record.ts
 /**
-* Spam Detection
-*
-* Honeypot and rate limiting for form submissions.
-*
-* The honeypot is a pure read of the submitted payload. The rate limit is not:
-* it counts, and where the count lives decides whether the limit means
-* anything. It lives in the deployment's own {@link RateLimitStore}, the one
-* the REST and auth limiters already share, so `rateLimit.store` is configured
-* once and all three agree about what they are counting. A store private to
-* this module would count per process, and on a deployment that spans several
-* the effective limit becomes `configured x instances` -- a number the operator
-* never chose, that fails open, and only under load.
+* A mailbox masked for a screen: its first character, then `•••`, then its
+* domain (`j•••@example.com`), as core masks the recipients it reports.
+*/
+function maskedAddress(address) {
+	const mailbox = (/<([^<>]*)>\s*$/.exec(address.trim())?.[1] ?? address).trim();
+	const at = mailbox.lastIndexOf("@");
+	if (at <= 0) return "•••";
+	return `${mailbox.slice(0, 1)}•••${mailbox.slice(at)}`;
+}
+/** Every address on a line of an outgoing email. */
+function addressesOf(value) {
+	if (value === void 0) return [];
+	return (typeof value === "string" ? [value] : [...value]).filter((address) => address.trim() !== "");
+}
+/** The configured recipients of `email`, digested and masked. */
+async function configuredRecipients(email, toSource, digest) {
+	const lines = [
+		{
+			kind: "to",
+			source: toSource,
+			addresses: addressesOf(email.to)
+		},
+		{
+			kind: "cc",
+			source: "cc",
+			addresses: addressesOf(email.cc)
+		},
+		{
+			kind: "bcc",
+			source: "bcc",
+			addresses: addressesOf(email.bcc)
+		}
+	];
+	const listed = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const line of lines) for (const address of line.addresses) {
+		const recipient = await digest(address);
+		if (seen.has(recipient)) continue;
+		seen.add(recipient);
+		listed.push({
+			digest: recipient,
+			hint: maskedAddress(address),
+			kind: line.kind,
+			source: line.source
+		});
+	}
+	return listed;
+}
+/**
+* What a notification's queued send records beside its queued email: the
+* form and notification, the notification's name then, and its configured
+* recipients, waiting for their first attempt.
+*/
+async function notificationSendDetails(ctx, input) {
+	const notification = input.notifications.find((candidate) => candidate.id === input.email.notificationId);
+	return {
+		form: input.formId,
+		...input.email.notificationId ? { notification: input.email.notificationId } : {},
+		...notification?.name ? { notificationName: notification.name } : {},
+		state: "waiting",
+		configured: await configuredRecipients(input.email, notification?.recipientType === "field" ? "visitor" : "team", (address) => ctx.services.email.recipientDigest(address))
+	};
+}
+
+// src/handlers/resend.ts
+const BODY = z.object({
+	notification: z.string().min(1).max(200),
+	tick: z.array(z.string().min(1).max(128)).max(100).default([])
+});
+/** A stored request, as its handler reads it. */
+const REQUEST = z.object({
+	submission: z.string(),
+	notification: z.string(),
+	requestedBy: z.string().nullish(),
+	ticked: z.array(z.string()).default([]),
+	retire: z.array(z.string()).default([]),
+	settled: z.array(z.string()).default([])
+});
+/** The form a notification belongs to, and the notification itself. */
+function notificationOf(form, id) {
+	return (Array.isArray(form.notifications) ? form.notifications : []).find((notification) => notification.id === id);
+}
+/** An entry's id as text: a string or a number by dialect. */
+function idText$1(id) {
+	if (typeof id === "number") return `${id}`;
+	return typeof id === "string" ? id : "";
+}
+/** `configured`, with each recipient among `exclude` marked skipped. */
+function skipping(configured, exclude) {
+	return configured?.map((recipient) => exclude.includes(recipient.digest) ? {
+		...recipient,
+		outcome: "skipped"
+	} : recipient);
+}
+/** The refusal of a resend of a submission marked Spam. */
+function markedSpam() {
+	return NextlyError.conflict({
+		reason: "state",
+		message: "Mark this submission Not spam before sending its emails."
+	});
+}
+/**
+* Who a resend of `notification` can send to now, each marked as reached
+* when `history` (its latest result per recipient) shows it received it:
+* what the route plans with and the submission's page offers to tick.
+*/
+async function addressableFor(ctx, email, notification, history) {
+	const configured = await configuredRecipients(email, notification.recipientType === "field" ? "visitor" : "team", (address) => ctx.services.email.recipientDigest(address));
+	return addressableNow(configured, history);
+}
+/**
+* The recipients a resend leaves out, as `sends` show them: each one that
+* received it and is not ticked to send again. Refused when that leaves
+* nobody it can address now: what the route plans with, and what the
+* request's own transaction works out again from the sends as it locked
+* them.
+*/
+function leftOut(addressNow, sends, tick) {
+	const exclude = reachedExcept(latestByRecipient(sends), tick);
+	if (addressNow.every((recipient) => exclude.includes(recipient.digest))) throw NextlyError.conflict({
+		reason: "state",
+		message: "Everyone this notification can address has received it. Tick a recipient to send it to them again."
+	});
+	return exclude;
+}
+/**
+* Work out what a resend does, refusing one beside a send in progress, one
+* ticking a recipient it cannot address now, and one with nobody to send to.
+*/
+async function planResend(ctx, sends, addressNow, tick) {
+	if (sends.some(sendInProgress)) throw NextlyError.conflict({
+		reason: "state",
+		message: "A send of this notification is in progress. Wait for it to finish before sending it again."
+	});
+	const now = new Set(addressNow.map((recipient) => recipient.digest));
+	if (tick.some((digest) => !now.has(digest))) throw NextlyError.validation({ errors: [{
+		path: "tick",
+		code: "INVALID",
+		message: "Only a recipient this notification can address now can be ticked."
+	}] });
+	const exclude = leftOut(addressNow, sends, tick);
+	const failed = sends.filter((send) => send.state === "failed" && !send.retiredBy);
+	return {
+		exclude,
+		retire: (await ctx.services.email.readQueued(failed.map((send) => send.queuedId))).filter((status) => status.messageHeld).map((status) => status.id),
+		settled: sends.map((send) => send.queuedId)
+	};
+}
+/**
+* `POST /submissions/:id/resend`: send `notification` again. The route's own
+* permission is updating submissions; managing email deliveries is asked
+* here, before anything else.
+*/
+async function resendRoute(req, ctx, deps) {
+	if (!ctx.caller || !await ctx.caller.can("manage", "email-deliveries")) throw NextlyError.forbidden({ logContext: { reason: "resend needs manage-email-deliveries" } });
+	const parsed = BODY.safeParse(await req.json().catch(() => void 0));
+	if (!parsed.success) throw NextlyError.validation({ errors: [{
+		path: "notification",
+		code: "INVALID",
+		message: "Say which notification to send again."
+	}] });
+	const submissionId = ctx.params.id ?? "";
+	const submission = await ctx.services.collections.findEntryById(deps.submissionsSlug, submissionId, {
+		as: "user",
+		user: ctx.user ?? void 0
+	});
+	if (submission.status === "spam") throw markedSpam();
+	const form = await ctx.services.ownCollections.findEntryById(deps.formsSlug, formIdOf(submission.form) ?? "");
+	const notification = notificationOf(form, parsed.data.notification);
+	const email = notification ? deps.build(form, submission, notification) : void 0;
+	if (!notification || !email) throw NextlyError.notFound({ message: "This notification has no one to send to now." });
+	const sends = await upToDate(ctx, await sendRows(ctx, {
+		submission: { equals: String(submission.id) },
+		notification: { equals: notification.id }
+	}));
+	const plan = await planResend(ctx, sends, await addressableFor(ctx, email, notification, latestByRecipient(sends)), parsed.data.tick);
+	const created = await ctx.services.collections.createEntry(resendsSlugOf(ctx), {
+		submission: String(submission.id),
+		notification: notification.id,
+		requestedBy: ctx.user?.id ?? null,
+		ticked: parsed.data.tick,
+		...plan
+	});
+	return respondMutation("Sent again to the recipients who had not received it.", { id: idText$1(created.id) }, { status: 201 });
+}
+/** The submission's sends of a notification, locked for the resend. */
+async function lockedSends(ctx, write, submission, notification) {
+	const data = await everyPage((page, limit) => ctx.services.ownCollections.listEntriesInTransaction(write.transaction, sendsSlugOf(ctx), {
+		where: {
+			submission: { equals: submission },
+			notification: { equals: notification }
+		},
+		sort: {
+			field: "createdAt",
+			direction: "asc"
+		},
+		pagination: {
+			limit,
+			page
+		},
+		depth: 0
+	}, { lock: "update" }));
+	return orderedSends(data.map((entry) => sendRowOf(entry)), {});
+}
+/**
+* Retire the failed sends among `retire`: forgotten by their plugin, so their
+* messages are cleared and nothing retries them, and marked as retired by
+* this request, keeping their failure.
+*/
+async function retireFailed(ctx, write, sends, retire) {
+	if (retire.length === 0) return;
+	for (const send of sends.filter((row) => retire.includes(row.queuedId))) await ctx.services.collections.updateEntryInTransaction(write.transaction, sendsSlugOf(ctx), send.id, {
+		retiredBy: String(write.id),
+		_overwrite: true
+	});
+	await ctx.services.email.forgetSends({ queuedIds: [...retire] }, { tx: write.db });
+}
+/** Queue a stored resend request, in the transaction that stores it. */
+async function resendInTransaction(ctx, deps, write) {
+	if (write.operation !== "create") return;
+	const request = REQUEST.parse(write.data);
+	const submission = await ctx.services.ownCollections.findEntryByIdInTransaction(write.transaction, deps.submissionsSlug, request.submission, { lock: "update" });
+	if (submission.status === "spam") throw markedSpam();
+	const sends = await lockedSends(ctx, write, request.submission, request.notification);
+	const settled = new Set(request.settled);
+	if (sends.some((send) => sendInProgress(send) && !settled.has(send.queuedId))) throw NextlyError.conflict({
+		reason: "state",
+		message: "A send of this notification is in progress. Wait for it to finish before sending it again."
+	});
+	await retireFailed(ctx, write, sends, request.retire);
+	const form = await ctx.services.ownCollections.findEntryByIdInTransaction(write.transaction, deps.formsSlug, formIdOf(submission.form) ?? "", { lock: "none" });
+	const notification = notificationOf(form, request.notification);
+	const email = notification ? deps.build(form, submission, notification) : void 0;
+	if (!notification || !email) throw NextlyError.notFound({ message: "This notification has no one to send to now." });
+	const exclude = leftOut(await addressableFor(ctx, email, notification, latestByRecipient(sends)), sends, request.ticked);
+	let recorded = 0;
+	await deps.queue({
+		emails: await deps.filter([email], form, submission),
+		key: `${request.submission}:resend:${String(write.id)}`,
+		tx: write.db,
+		excludeRecipients: exclude,
+		record: async (sent, queued) => {
+			recorded += 1;
+			const details = await notificationSendDetails(ctx, {
+				formId: formIdOf(submission.form) ?? "",
+				notifications: [notification],
+				email: queued
+			});
+			await recordSend(ctx, write.transaction, request.submission, {
+				...sent,
+				...details,
+				configured: skipping(details.configured, exclude),
+				...request.requestedBy ? { requestedBy: request.requestedBy } : {},
+				resend: String(write.id)
+			});
+		}
+	});
+	if (recorded === 0) throw NextlyError.validation({ errors: [{
+		path: "notification",
+		code: "INVALID",
+		message: "The notification could not be sent again."
+	}] });
+}
+/** Queue each stored resend request in the transaction that stores it. */
+function registerResend(ctx, deps) {
+	ctx.hooks.onInTransaction(resendsSlugOf(ctx), (write) => resendInTransaction(ctx, deps, write));
+}
+
+// src/handlers/upload-cleanup.ts
+/**
+* The files of uploads no submission holds any more, deleted once that is
+* durable.
+*
+* An upload is released in the transaction that deletes its submission (one
+* deletion, a bulk one, the retention pass, or deleting the whole form), or
+* when a visitor uploaded it and never submitted (`releaseStaleUploads`,
+* after {@link UNCLAIMED_KEEP_MS}). Once released, its file is deleted after
+* the release commits, never inside it: a file cannot be put back by a
+* rollback. Before deleting, each is checked again: no other record of an
+* upload holds the same file, and nothing else on the site uses it
+* (`ctx.services.media.isInUse`: a document's field, an avatar, a logo). A
+* file in use is kept, with its record, and asked about again on the next
+* nightly pass, so it goes once nothing uses it.
+*
+* The file goes through `ctx.services.media.delete`, which records the
+* item's stored files as left to remove in the delete's own transaction and
+* has core's jobs queue remove them until they are gone. So once it returns
+* the bytes are core's to finish, even when storage refused them this time,
+* and the record here can go.
+*
+* Every step can run twice: a file or record already gone is what the step
+* wanted. A deletion that could not finish (a database error, a crash between
+* the commit and the delete) leaves the record released, and the nightly
+* retention pass finishes it, carrying on from where its last run stopped.
+*
+* @module handlers/upload-cleanup
+*/
+/** How long an upload no submission claimed is kept: a day. */
+const UNCLAIMED_KEEP_MS = 864e5;
+/** Rows read at a time. */
+const PAGE$1 = 100;
+function pastDeadline$1(deadline) {
+	return deadline !== void 0 && Date.now() >= deadline.getTime();
+}
+/** `work`, with a `NOT_FOUND` read as done: what it removes is gone. */
+async function goneIsDone(work) {
+	try {
+		await work();
+	} catch (error) {
+		if (!NextlyError.isNotFound(error)) throw error;
+	}
+}
+/** Whether another record that is not released holds the same file. */
+async function heldElsewhere(deps, upload) {
+	return await deps.own.count(deps.uploadsSlug, { where: {
+		media: { equals: String(upload.media) },
+		id: { not_equals: String(upload.id) },
+		releasedAt: { exists: false }
+	} }) > 0;
+}
+/** Whether the media item is still there. */
+async function mediaPresent(deps, mediaId) {
+	try {
+		await deps.media.findById(mediaId, {});
+		return true;
+	} catch (error) {
+		if (NextlyError.isNotFound(error)) return false;
+		throw error;
+	}
+}
+/**
+* Free one released upload: delete its file unless another record holds it
+* or something else uses it, then its record. A file in use keeps its
+* record, for the next pass. Answers whether the record is gone. Its stored
+* bytes are removed durably by the media delete itself, so the record need
+* not outlive it.
+*/
+async function freeUpload(deps, upload) {
+	const mediaId = String(upload.media);
+	if (!await heldElsewhere(deps, upload) && await mediaPresent(deps, mediaId)) {
+		if (await deps.media.isInUse(mediaId)) return false;
+		await goneIsDone(() => deps.media.delete(mediaId, { as: "system" }));
+	}
+	await goneIsDone(() => deps.collections.deleteEntry(deps.uploadsSlug, String(upload.id), { as: "system" }));
+	return true;
+}
+/** The next page of released uploads `where` narrows to, after `after`. */
+async function releasedAfter(deps, where, after) {
+	const { data } = await deps.own.listEntries(deps.uploadsSlug, {
+		where: {
+			...where,
+			releasedAt: { exists: true },
+			...after === void 0 ? {} : { id: { greater_than: after } }
+		},
+		sort: {
+			field: "id",
+			direction: "asc"
+		},
+		pagination: { limit: PAGE$1 },
+		depth: 0
+	});
+	return data;
+}
+/**
+* Free the released uploads `where` selects (every one, by default), in id
+* order from just after `from`, until `deadline`. Answers "done", or where
+* it stopped.
+*/
+async function freeReleasedUploads(deps, where = {}, deadline, from) {
+	let after = from;
+	for (;;) {
+		const page = await releasedAfter(deps, where, after);
+		for (const upload of page) {
+			if (pastDeadline$1(deadline)) return after === void 0 ? {} : { afterUpload: after };
+			await freeUpload(deps, upload);
+			after = String(upload.id);
+		}
+		if (page.length < PAGE$1) return "done";
+	}
+}
+/**
+* Release an upload nobody claimed, if nobody has since: read for update,
+* so a submission claiming it at this moment either commits first and it
+* stays, or waits and is refused. Answers the released row, or none.
+*/
+async function giveUp(deps, id) {
+	return deps.collections.withTransaction(async (tx) => {
+		let upload;
+		try {
+			upload = await deps.own.findEntryByIdInTransaction(tx, deps.uploadsSlug, id, { lock: "update" });
+		} catch (error) {
+			if (NextlyError.isNotFound(error)) return void 0;
+			throw error;
+		}
+		if (!upload || upload.submission || upload.releasedAt) return void 0;
+		const releasedAt = /* @__PURE__ */ new Date();
+		await deps.collections.updateEntryInTransaction(tx, deps.uploadsSlug, id, {
+			releasedAt,
+			_overwrite: true
+		});
+		return {
+			...upload,
+			releasedAt
+		};
+	});
+}
+/**
+* Release and free the uploads no submission claimed within a day of being
+* uploaded: a visitor who uploaded and never submitted. Answers false when
+* the deadline stopped it first. Each released row stops matching, so the
+* first page is always the next batch.
+*/
+async function releaseStaleUploads(deps, now, deadline) {
+	const where = {
+		submission: { exists: false },
+		releasedAt: { exists: false },
+		createdAt: { less_than: /* @__PURE__ */ new Date(now - UNCLAIMED_KEEP_MS) }
+	};
+	for (;;) {
+		const { data } = await deps.own.listEntries(deps.uploadsSlug, {
+			where,
+			pagination: { limit: PAGE$1 },
+			depth: 0
+		});
+		for (const row of data) {
+			if (pastDeadline$1(deadline)) return false;
+			const released = await giveUp(deps, String(row.id));
+			if (released) await freeUpload(deps, released);
+		}
+		if (data.length < PAGE$1) return true;
+	}
+}
+/**
+* The nightly part, from `cursor`: retry the released uploads an earlier
+* deletion could not free, then give up on the ones never claimed. Answers
+* "done", or where the deadline stopped it.
+*/
+async function sweepUploads(deps, now, deadline, cursor = {}) {
+	if (!cursor.releasedDone) {
+		const stopped = await freeReleasedUploads(deps, {}, deadline, cursor.afterUpload);
+		if (stopped !== "done") return stopped;
+	}
+	return await releaseStaleUploads(deps, now, deadline) ? "done" : { releasedDone: true };
+}
+/**
+* Once the deletion `context` describes is durable, free the uploads it
+* released. With no way to wait for the commit, it leaves them to the
+* nightly pass rather than delete a file a rollback would still need.
+*/
+function freeAfterCommit(context, deps, whereFor) {
+	const hook = context;
+	const id = hook.data?.id;
+	if (typeof id !== "string" && typeof id !== "number" || !hook.afterCommit) return;
+	return hook.afterCommit(() => freeReleasedUploads(deps, whereFor(String(id))));
+}
+/**
+* Free the files of every deletion's released uploads after it commits: one
+* submission's, and a form's (its submissions' and those nobody claimed).
+*/
+function registerUploadCleanup(ctx, deps, slugs) {
+	ctx.hooks.on("afterDelete", slugs.submissions, (context) => freeAfterCommit(context, deps, (id) => ({ submission: { equals: id } })));
+	ctx.hooks.on("afterDelete", slugs.forms, (context) => freeAfterCommit(context, deps, (id) => ({ form: { equals: id } })));
+}
+
+// src/handlers/retention.ts
+/**
+* Submissions are not kept forever. Each night a pass deletes:
+*
+* - each form's submissions older than the form keeps them for
+*   (`settings.keepDays`, set under Settings › Privacy; none keeps them), and
+* - every form's spam older than {@link SPAM_KEEP_DAYS} days, whatever the
+*   form's setting.
+*
+* Each submission is deleted through the collection, one transaction each,
+* so every deletion path runs the same handlers: what it sent is forgotten
+* (`forget-sends`) and its one-response key is handed on. Age is read from
+* `createdAt`, which the system sets, never from what a caller sent.
+*
+* Deleting a submission releases the uploads it held, and their files are
+* deleted once the deletion commits (`upload-claims`, `upload-cleanup`).
+* Last, the pass frees what an earlier deletion could not (a storage error,
+* a file then in use) and the uploads no submission claimed within a day.
+*
+* A pass stops at the deadline its jobs run gives it and queues a
+* continuation, so a large backlog is worked through on the next runs rather
+* than waiting a day.
+*
+* @module handlers/retention
+*/
+/** The retention job's slug. */
+const RETENTION_JOB = "form-builder:retention";
+/** The schedule that runs it each night. */
+const RETENTION_SCHEDULE = {
+	slug: "form-builder-retention-nightly",
+	cron: "@daily",
+	job: RETENTION_JOB
+};
+/** How long spam is kept, whatever a form's setting. */
+const SPAM_KEEP_DAYS = 30;
+const DAY_MS = 864e5;
+/** Rows read at a time: forms, or one form's submissions to delete. */
+const PAGE = 100;
+/** The retention job, run by `run` until the deadline the runner gives it. */
+function retentionJob(run) {
+	return defineJob({
+		slug: RETENTION_JOB,
+		handler: async (input, context) => {
+			await run(context.deadline, retentionCursorOf(input));
+		}
+	});
+}
+/** A form's settings as stored: an object, or a JSON string of one. */
+function settingsOf(value) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return;
+	}
+}
+function pastDeadline(deadline) {
+	return Date.now() >= deadline.getTime();
+}
+/** The cursor's yes-or-no parts, and its by-id parts. */
+const CURSOR_FLAGS = [
+	"spamDone",
+	"formsDone",
+	"releasedDone"
+];
+const CURSOR_IDS = ["afterForm", "afterUpload"];
+/** A continuation's cursor, read from its job input; none starts afresh. */
+function retentionCursorOf(input) {
+	if (!input || typeof input !== "object") return {};
+	const raw = input;
+	const cursor = {};
+	for (const flag of CURSOR_FLAGS) if (raw[flag] === true) cursor[flag] = true;
+	for (const key of CURSOR_IDS) {
+		const value = raw[key];
+		if (typeof value === "string") cursor[key] = value;
+	}
+	return cursor;
+}
+/**
+* Delete what is past keeping, until `deadline`, from `cursor`. Answers
+* whether it finished; one that did not has queued its continuation, with
+* where it stopped.
+*/
+async function runRetention(deps, deadline, cursor = {}) {
+	const now = (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime();
+	if (!cursor.spamDone) {
+		if (!await deleteWhere(deps, {
+			status: { equals: "spam" },
+			createdAt: { less_than: /* @__PURE__ */ new Date(now - SPAM_KEEP_DAYS * DAY_MS) }
+		}, deadline)) return continueFrom(deps, {});
+	}
+	if (!cursor.formsDone) {
+		const stoppedAt = await deleteAgedPerForm(deps, now, deadline, cursor);
+		if (stoppedAt !== "done") return continueFrom(deps, {
+			spamDone: true,
+			...stoppedAt
+		});
+	}
+	if (!deps.uploads) return "done";
+	const swept = await sweepUploads(deps.uploads, now, deadline, cursor);
+	if (swept === "done") return "done";
+	return continueFrom(deps, {
+		spamDone: true,
+		formsDone: true,
+		...swept
+	});
+}
+/** Queue the continuation, with where this run stopped. */
+async function continueFrom(deps, cursor) {
+	await deps.jobs.queue({
+		task: RETENTION_JOB,
+		input: Object.keys(cursor).length > 0 ? { ...cursor } : null
+	});
+	return "continued";
+}
+/**
+* Each form that keeps submissions for a while, in id order from the cursor:
+* those older than that. Answers "done", or where to carry on from: just
+* before the form it stopped in.
+*/
+async function deleteAgedPerForm(deps, now, deadline, cursor) {
+	let after = cursor.afterForm;
+	for (;;) {
+		const forms = await formsAfter(deps, after);
+		for (const form of forms) {
+			if (!await retainForm(deps, form, now, deadline)) return after === void 0 ? {} : { afterForm: after };
+			after = String(form.id);
+		}
+		if (forms.length < PAGE) return "done";
+	}
+}
+/** The next page of forms after `after`, by id. */
+async function formsAfter(deps, after) {
+	const { data } = await deps.collections.listEntries(deps.formsSlug, {
+		...after === void 0 ? {} : { where: { id: { greater_than: after } } },
+		sort: {
+			field: "id",
+			direction: "asc"
+		},
+		pagination: { limit: PAGE },
+		depth: 0
+	}, { as: "system" });
+	return data;
+}
+/**
+* One form: its submissions past keeping, if it keeps them for a while.
+* Answers false when the deadline stopped it first.
+*/
+async function retainForm(deps, form, now, deadline) {
+	if (pastDeadline(deadline)) return false;
+	const { keepDays } = normalizeFormSettings(settingsOf(form.settings));
+	if (keepDays === void 0) return true;
+	return deleteWhere(deps, {
+		form: { equals: String(form.id) },
+		createdAt: { less_than: /* @__PURE__ */ new Date(now - keepDays * DAY_MS) }
+	}, deadline);
+}
+/**
+* Delete the submissions `where` selects, a page at a time. Answers false
+* when the deadline stopped it with some left. Each page is read afresh,
+* since what was deleted no longer matches.
+*/
+async function deleteWhere(deps, where, deadline) {
+	for (;;) {
+		if (pastDeadline(deadline)) return false;
+		const { data } = await deps.collections.listEntries(deps.submissionsSlug, {
+			where,
+			pagination: { limit: PAGE },
+			depth: 0
+		}, { as: "system" });
+		const rows = data;
+		for (const row of rows) {
+			if (pastDeadline(deadline)) return false;
+			await deleteOne(deps, String(row.id));
+		}
+		if (rows.length < PAGE) return true;
+	}
+}
+/**
+* Delete one submission. One another runner, or a person, deleted first is
+* already gone, which is what this wanted.
+*/
+async function deleteOne(deps, id) {
+	try {
+		await deps.collections.deleteEntry(deps.submissionsSlug, id, { as: "system" });
+	} catch (error) {
+		if (NextlyError.isCode(error, "NOT_FOUND")) return;
+		throw error;
+	}
+}
+
+// src/handlers/spam-detection.ts
+/**
+* Spam Detection
+*
+* Honeypot and rate limiting for form submissions.
+*
+* The honeypot is a pure read of the submitted payload. The rate limit is not:
+* it counts, and where the count lives decides whether the limit means
+* anything. It lives in the deployment's own {@link RateLimitStore}, the one
+* the REST and auth limiters already share, so `rateLimit.store` is configured
+* once and all three agree about what they are counting. A store private to
+* this module would count per process, and on a deployment that spans several
+* the effective limit becomes `configured x instances` -- a number the operator
+* never chose, that fails open, and only under load.
 *
 * @module handlers/spam-detection
 * @since 0.1.0
@@ -2747,8 +4233,17 @@ function checkHoneypot(data) {
 * would lock out every visitor behind an untrusted proxy. The caller decides
 * what to do about an unidentifiable client; this counts only identified ones.
 */
+/**
+* Count one request under `key` against `max` per `windowMs`, in the
+* deployment's shared rate-limit store: whether it is allowed, and when the
+* window resets. The plugin's one door to the limiter, for submissions and
+* uploads alike.
+*/
+async function countAgainstLimit(key, max, windowMs) {
+	return new RateLimiter(resolveRateLimitStore()).check(key, max, windowMs);
+}
 async function checkRateLimit(ipAddress, formSlug, config) {
-	if ((await new RateLimiter(resolveRateLimitStore()).check(`form-submit:${formSlug}:${ipAddress}`, config.maxSubmissions, config.windowMs)).allowed) return { isSpam: false };
+	if ((await countAgainstLimit(`form-submit:${formSlug}:${ipAddress}`, config.maxSubmissions, config.windowMs)).allowed) return { isSpam: false };
 	return {
 		isSpam: true,
 		reason: "rate_limit",
@@ -2756,6 +4251,321 @@ async function checkRateLimit(ipAddress, formSlug, config) {
 	};
 }
 
+// src/utils/upload-rules.ts
+/** The longest name a stored file keeps, before its extension is lost. */
+const MAX_NAME_LENGTH = 200;
+/**
+* The patterns a file has to match: the field's own `accept` (the HTML
+* attribute's spelling: `.pdf`, `image/*`, `application/pdf`), or the
+* plugin's allowed types when the field names none.
+*/
+function acceptPatternsOf(field, settings) {
+	const own = typeof field.accept === "string" ? field.accept.split(",").map((pattern) => pattern.trim().toLowerCase()).filter((pattern) => pattern !== "") : [];
+	return own.length > 0 ? own : settings.allowedMimeTypes.map((type) => type.toLowerCase());
+}
+/** A media type without its parameters, in lower case. */
+function bareType(type) {
+	return (type.split(";")[0] ?? "").trim().toLowerCase();
+}
+/** Whether one `accept` pattern takes a file of this name and type. */
+function patternTakes(pattern, name, type) {
+	if (pattern === "*" || pattern === "*/*") return true;
+	if (pattern.startsWith(".")) return name.toLowerCase().endsWith(pattern);
+	if (pattern.endsWith("/*")) return type.startsWith(pattern.slice(0, -1)) && type.length > pattern.length - 1;
+	return type === pattern;
+}
+/**
+* Whether a file of this name and media type matches any of `patterns`, as
+* a browser reads an `accept` attribute: an extension matches the name, a
+* type or `type/*` matches the media type.
+*/
+function fileMatchesAccept(file, patterns) {
+	const type = bareType(file.type);
+	return patterns.some((pattern) => patternTakes(pattern, file.name, type));
+}
+/**
+* The largest file, in bytes, a field takes: its own limit, never more than
+* the plugin's, and the plugin's when the field sets none. A form's author
+* chooses a field's limit; the site's developer chooses how much any
+* visitor may store, and that bound holds whatever a form says.
+*/
+function uploadLimitOf(field, settings) {
+	const own = field.maxFileSize;
+	return typeof own === "number" && Number.isFinite(own) && own > 0 ? Math.min(own, settings.maxFileSize) : settings.maxFileSize;
+}
+/** Whether a character is a control character (C0, or DEL). */
+function isControl(char) {
+	const code = char.codePointAt(0) ?? 0;
+	return code < 32 || code === 127;
+}
+/**
+* The name a visitor's file is stored under: its last path segment (some
+* browsers send `C:\fakepath\cv.pdf`), without control characters, and no
+* longer than the storage keeps. A name with nothing left is `upload`.
+*/
+function safeUploadName(raw) {
+	const lastSegment = raw.split(/[\\/]/).pop() ?? "";
+	const printable = Array.from(lastSegment).filter((char) => !isControl(char)).join("").trim();
+	const named = /^\.*$/.test(printable) ? "upload" : printable;
+	if (named.length <= MAX_NAME_LENGTH) return named;
+	const dot = named.lastIndexOf(".");
+	const extension = dot > 0 && named.length - dot <= 16 ? named.slice(dot) : "";
+	return named.slice(0, MAX_NAME_LENGTH - extension.length) + extension;
+}
+/** A byte count as a person reads it: `5 MB`, `512 KB`. */
+function readableBytes(bytes) {
+	if (bytes >= 1048576) return `${Math.round(bytes / 1048576 * 10) / 10} MB`;
+	if (bytes >= 1024) return `${Math.round(bytes / 1024)} KB`;
+	return `${bytes} bytes`;
+}
+/** The media ids a file answer names: one id, or a list of them. */
+function mediaIdsOf(answer) {
+	if (typeof answer === "string") return answer === "" ? [] : [answer];
+	if (!Array.isArray(answer)) return [];
+	return answer.filter((item) => typeof item === "string" && item !== "");
+}
+
+// src/handlers/upload-claims.ts
+/**
+* Which files a submission holds, decided inside the transaction that stores
+* it, whatever stored it.
+*
+* A file answer names media ids. A submission a request writes (a visitor
+* submitting, or staff over the API) may only name uploads the plugin's
+* upload route issued for the same form and field, that no other submission
+* has claimed; anything else (another form's upload, one already claimed, a
+* site's own logo, an id made up) is refused, and the write rolls back. The
+* uploads it names are claimed for it in the same transaction, each read for
+* update first, so two submissions naming one upload take turns and the
+* second is refused.
+*
+* An update keeps the ids the submission already stores in a field: staff
+* editing other answers send the file answer back as it was, and that is not
+* a new claim. A submission stored as spam is evidence, judged as a write
+* with no request is, so a bot is not told which of its ids were refused.
+*
+* A write no request produced (the Direct API from site code, an import, a
+* job) is trusted, as it was before uploads were recorded: nothing it names
+* is refused, and an issued upload it names for the same form and field that
+* no submission has claimed is claimed for it, so the file is kept with the
+* submission and deleted with it. One it names that another submission
+* already holds is recorded again, as this submission's too: a file stays
+* while any submission holding it is left.
+*
+* Deleting a submission releases its uploads in the deleting transaction,
+* and deleting a form releases the uploads no submission claimed: a released
+* upload can never be claimed again, and its file is deleted once the
+* deletion commits (`upload-cleanup`).
+*
+* @module handlers/upload-claims
+*/
+/** The shared hook context key the write seam marks a write under. */
+const UPLOAD_CLAIMS_CONTEXT = "formBuilder.uploadClaims";
+/** What a visitor, or staff, is told about a file answer it may not name. */
+const UPLOAD_NOT_CLAIMABLE = "This file was not uploaded for this field. Please upload it again.";
+/** The names of a form's file fields. */
+function fileFieldNamesOf(fields) {
+	if (!Array.isArray(fields)) return [];
+	return fields.flatMap((field) => {
+		const { type, name } = field ?? {};
+		return type === "file" && typeof name === "string" ? [name] : [];
+	});
+}
+/**
+* Mark a submission's write for the transaction that stores it: whether a
+* request produced it and, once the form is read, its file fields. Written
+* over whatever the shared context held, so no caller decides it.
+*/
+function markUploadClaims(hook, form) {
+	if (!hook.context) return;
+	const marker = {
+		request: Boolean(hook.req?.http),
+		...form ? { fileFields: fileFieldNamesOf(form.fields) } : {}
+	};
+	hook.context[UPLOAD_CLAIMS_CONTEXT] = marker;
+}
+/** The mark the write seam left, if it ran. */
+function markerOf(context) {
+	const raw = context[UPLOAD_CLAIMS_CONTEXT];
+	if (!raw || typeof raw !== "object") return void 0;
+	const fileFields = Array.isArray(raw.fileFields) ? raw.fileFields.filter((name) => typeof name === "string") : void 0;
+	return {
+		request: raw.request === true,
+		...fileFields ? { fileFields } : {}
+	};
+}
+/** A submission's answers, as stored: an object, or a JSON string of one. */
+function answersOf(value) {
+	let parsed = value;
+	if (typeof value === "string") try {
+		parsed = JSON.parse(value);
+	} catch {
+		return {};
+	}
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+}
+/** The form's file fields, read on the write's transaction. */
+async function fileFieldsInTransaction(deps, write, formsSlug, formId) {
+	try {
+		return fileFieldNamesOf((await deps.own.findEntryByIdInTransaction(write.transaction, formsSlug, formId, { lock: "none" }))?.fields);
+	} catch (error) {
+		if (NextlyError.isNotFound(error)) return [];
+		throw error;
+	}
+}
+/** Whether an upload record still counts: not released for deletion. */
+function live(upload) {
+	return !upload.releasedAt;
+}
+/** Whether `upload` was issued for `field` of the form and nobody holds it. */
+function claimable(upload, terms, field) {
+	return live(upload) && !upload.submission && upload.form === terms.formId && upload.field === field;
+}
+/**
+* Whether the submission already holds `upload`: a request write only for
+* the field it names, a trusted one however it came to hold it.
+*/
+function heldBy(upload, terms, field) {
+	if (!live(upload) || upload.submission !== terms.submissionId) return false;
+	return !terms.strict || upload.form === terms.formId && upload.field === field;
+}
+/** The refusal of a file answer naming what it may not. */
+function notClaimable(field, mediaId, terms) {
+	return NextlyError.validation({
+		errors: [{
+			path: field,
+			code: "INVALID",
+			message: UPLOAD_NOT_CLAIMABLE
+		}],
+		logContext: {
+			mediaId,
+			formId: terms.formId,
+			reason: "upload-not-claimable"
+		}
+	});
+}
+/**
+* Hold the upload of `mediaId` for the submission: claim the record the
+* route issued, refuse a request write anything else, and record a trusted
+* write as one more holder of a file another submission holds.
+*/
+async function claimOne(deps, write, uploadsSlug, terms, field, mediaId) {
+	const { data } = await deps.own.listEntriesInTransaction(write.transaction, uploadsSlug, {
+		where: { media: { equals: mediaId } },
+		pagination: { limit: 200 },
+		depth: 0
+	}, { lock: "update" });
+	const uploads = data;
+	if (uploads.some((upload) => heldBy(upload, terms, field))) return;
+	const issued = uploads.find((upload) => claimable(upload, terms, field));
+	if (issued) {
+		await deps.collections.updateEntryInTransaction(write.transaction, uploadsSlug, String(issued.id), {
+			submission: terms.submissionId,
+			_overwrite: true
+		});
+		return;
+	}
+	if (terms.strict) throw notClaimable(field, mediaId, terms);
+	if (uploads.some(live)) await deps.collections.createEntryInTransaction(write.transaction, uploadsSlug, {
+		media: mediaId,
+		form: terms.formId,
+		field,
+		submission: terms.submissionId
+	});
+}
+/** The ids `field` names now that it did not name before this write. */
+function newIdsIn(field, answers, stored) {
+	const kept = new Set(mediaIdsOf(stored[field]));
+	return [...new Set(mediaIdsOf(answers[field]))].filter((id) => !kept.has(id));
+}
+/**
+* A write's answers as it leaves them, and as the submission stored them
+* before it (none for a create). `undefined` when the write changes no
+* answer, so nothing new can be named.
+*/
+function answersOfWrite(write, row) {
+	const answers = answersOf(row.data);
+	if (write.operation !== "update") return {
+		answers,
+		stored: {}
+	};
+	const before = write.originalData;
+	const stored = answersOf(before?.data);
+	return JSON.stringify(answers) === JSON.stringify(stored) ? void 0 : {
+		answers,
+		stored
+	};
+}
+/**
+* How strictly a write is judged: one a request produced is held to the
+* rules, unless it is stored as spam, which is evidence.
+*/
+function termsOf(write, row, formId, marker) {
+	return {
+		formId,
+		submissionId: String(write.id),
+		strict: marker?.request === true && row.status !== "spam"
+	};
+}
+/** Claim the uploads a created or updated submission newly names. */
+async function claimUploads(deps, write, slugs) {
+	const row = write.data;
+	const formId = formIdOf(row?.form);
+	if (!row || formId === void 0) return;
+	const changed = answersOfWrite(write, row);
+	if (changed === void 0) return;
+	const { answers, stored } = changed;
+	const marker = markerOf(write.context);
+	const fields = marker?.fileFields ?? await fileFieldsInTransaction(deps, write, slugs.forms, formId);
+	const terms = termsOf(write, row, formId, marker);
+	for (const field of fields) for (const mediaId of newIdsIn(field, answers, stored)) await claimOne(deps, write, slugs.uploads, terms, field, mediaId);
+}
+/** Release every upload `where` selects, a page at a time. */
+async function releaseWhere(deps, write, uploadsSlug, where) {
+	const releasedAt = /* @__PURE__ */ new Date();
+	for (;;) {
+		const { data } = await deps.own.listEntriesInTransaction(write.transaction, uploadsSlug, {
+			where: {
+				...where,
+				releasedAt: { exists: false }
+			},
+			pagination: { limit: 200 },
+			depth: 0
+		}, { lock: "update" });
+		for (const upload of data) await deps.collections.updateEntryInTransaction(write.transaction, uploadsSlug, String(upload.id), {
+			releasedAt,
+			_overwrite: true
+		});
+		if (data.length < 200) return;
+	}
+}
+/** A submission's write: claim what it names, or release what it held. */
+async function judgeSubmissionWrite(deps, write, slugs) {
+	if (write.operation !== "delete") return claimUploads(deps, write, slugs);
+	await releaseWhere(deps, write, slugs.uploads, { submission: { equals: String(write.id) } });
+}
+/**
+* A form's deletion: release the uploads made for it that no submission
+* claimed. Claimed ones go with their submissions, which the deletion
+* deletes, or stay with one moved to another form.
+*/
+async function releaseFormUploads(deps, write, uploadsSlug) {
+	if (write.operation !== "delete") return;
+	await releaseWhere(deps, write, uploadsSlug, {
+		form: { equals: String(write.id) },
+		submission: { exists: false }
+	});
+}
+/** Claim and release uploads in every write of a submission or a form. */
+function registerUploadClaims(ctx, slugs) {
+	const deps = {
+		own: ctx.services.ownCollections,
+		collections: ctx.services.collections
+	};
+	ctx.hooks.onInTransaction(slugs.submissions, (write) => judgeSubmissionWrite(deps, write, slugs));
+	ctx.hooks.onInTransaction(slugs.forms, (write) => releaseFormUploads(deps, write, slugs.uploads));
+}
+
 // src/handlers/submit-form.ts
 /**
 * Form Submission Handler
@@ -2996,6 +4806,7 @@ async function submitForm(options, context) {
 			spamReason: isContentSpam ? spamResult.reason ?? null : null,
 			ipAddress: metadata?.ipAddress || null,
 			userAgent: metadata?.userAgent || null,
+			page: pageFromReferer(metadata?.page) ?? null,
 			submittedAt: /* @__PURE__ */ new Date()
 		};
 		const browserToken = browserTokenOf(data);
@@ -3005,6 +4816,7 @@ async function submitForm(options, context) {
 				keepAsEvidence: isContentSpam,
 				form: {
 					id: form.id,
+					slug: form.slug,
 					fields: form.fields,
 					settings: form.settings
 				},
@@ -3354,6 +5166,19 @@ async function getFormSubmissionStats(formSlug, context) {
 * @module routes/public-forms
 */
 /**
+* The refusal for a form that is absent, not published, or not open: one
+* message whatever the reason, so the answer does not say which forms exist.
+*/
+function noSuchForm(slug) {
+	return NextlyError$1.notFound({
+		message: NO_SUCH_FORM,
+		logContext: {
+			entity: "form",
+			slug
+		}
+	});
+}
+/**
 * These routes read and write as the anonymous visitor on the other end.
 *
 * `public: true` waives the ROUTE's authentication and says nothing about the
@@ -3447,7 +5272,7 @@ async function listPublishedForms(req, ctx, config) {
 			page: positiveInt(url.searchParams.get("page")) ?? 1
 		}
 	}, PUBLIC);
-	return respondList(result.data ?? [], toPageMeta(result.pagination));
+	return respondList$1(result.data ?? [], toPageMeta(result.pagination));
 }
 /**
 * A found form's answer now: its status, then its closing time, then its
@@ -3467,13 +5292,25 @@ async function availabilityNow(form, ctx, slugs) {
 		taken
 	});
 }
-async function readFormBySlug(slug, ctx, config) {
+/**
+* The form at `slug`, read as the visitor, and what a visitor is told about
+* it now: absent, closed (with its message), or open. One reading for every
+* public endpoint that names a form by its slug, so they cannot come to
+* disagree about which forms are open.
+*/
+async function formAt(slug, ctx, config) {
 	const slugs = installedSlugs(config, ctx.self);
 	const doc = (await ctx.services.collections.listEntries(slugs.forms, {
 		where: { slug: { equals: slug } },
 		pagination: { limit: 1 }
 	}, PUBLIC)).data?.[0];
-	const availability = doc ? await availabilityNow(doc, ctx, slugs) : formAvailability(doc);
+	return {
+		doc,
+		availability: doc ? await availabilityNow(doc, ctx, slugs) : formAvailability(doc)
+	};
+}
+async function readFormBySlug(slug, ctx, config) {
+	const { doc, availability } = await formAt(slug, ctx, config);
 	if (availability.kind === "absent") throw NextlyError$1.notFound({
 		message: NO_SUCH_FORM,
 		logContext: {
@@ -3577,8 +5414,9 @@ async function acceptSubmission(req, ctx, config, slug) {
 		locale: new URL(req.url).searchParams.get("locale") || void 0,
 		request: req,
 		metadata: {
-			ipAddress: trustedClientIp(req) ?? void 0,
-			userAgent: req.headers.get("user-agent") ?? void 0
+			ipAddress: trustedClientIp$1(req) ?? void 0,
+			userAgent: req.headers.get("user-agent") ?? void 0,
+			page: req.headers.get("referer") ?? void 0
 		},
 		access: PUBLIC
 	}, {
@@ -3586,7 +5424,7 @@ async function acceptSubmission(req, ctx, config, slug) {
 		pluginConfig: configForInstall(config, ctx.self)
 	});
 	if (result.outcome !== "accepted") throw refusalFor(result, slug);
-	return respondAction(result.successMessage ?? DEFAULT_SUCCESS_MESSAGE, {
+	return respondAction$1(result.successMessage ?? DEFAULT_SUCCESS_MESSAGE, {
 		...result.submission ? { submissionId: result.submission.id } : {},
 		...result.redirect ? { redirect: result.redirect } : {}
 	}, { status: 201 });
@@ -3625,6 +5463,462 @@ function publicFormRoutes(config) {
 	];
 }
 
+// src/routes/form-upload.ts
+/**
+* `POST /api/forms/:slug/upload`: a visitor's file, for one file field of an
+* open form, before the form is submitted.
+*
+* A file answer in a submission names media ids. The route stores the file
+* in the media library (as the plugin itself; a visitor holds no media
+* permission) and records the upload (`form-uploads`): which form and field
+* it was made for, and, once a submission names it, that submission. A
+* submission a request writes may then name only uploads recorded here for
+* its own form and field that no other submission claimed
+* (`handlers/upload-claims`), so the files a submission holds are its own,
+* and are deleted with it.
+*
+* Refused unless the form exists and is open now (the reading `GET
+* /api/forms/:slug` and submitting make), the named field is one of its file
+* fields, and the file is one the field takes: its types (`accept`, or the
+* plugin's `uploads.allowedMimeTypes`), and its size (`maxFileSize`, never
+* above the plugin's `uploads.maxFileSize`). The body is read only up to that
+* ceiling, so an oversized request is refused without being held in memory.
+* The media library then judges the file as it judges every upload: its
+* contents against its claimed type, blocked types, and its name. Its type
+* is checked against the field again on what the library stored.
+*
+* Limited per visitor and form, in the window submissions are, at
+* {@link UPLOADS_PER_SUBMISSION} times their number: a form may have several
+* file fields, each taking several files. An upload no submission claims is
+* deleted after a day.
+*
+* @module routes/form-upload
+*/
+/** How many uploads a visitor may make per submission the limit allows. */
+const UPLOADS_PER_SUBMISSION = 5;
+/** Room in a request body for the multipart framing and the field's name. */
+const MULTIPART_OVERHEAD = 65536;
+/** What a visitor is told about a file of a type the field does not take. */
+const TYPE_REFUSED = "This type of file is not accepted here.";
+/** The multipart body's text part: which field the file is for. */
+const UPLOAD_PARTS = z.object({ field: z.string().trim().min(1).max(200) });
+/** A refusal of the request's `path` part, as a validation error. */
+function refusal$1(path, code, message, log = {}) {
+	return NextlyError.validation({
+		errors: [{
+			path,
+			code,
+			message
+		}],
+		logContext: log
+	});
+}
+function tooLarge(limit) {
+	return refusal$1("file", "SIZE_EXCEEDED", `This file is too large. The limit is ${readableBytes(limit)}.`);
+}
+/** The form at `slug` if it takes submissions now, refused as submit is. */
+async function openFormAt(slug, ctx, config) {
+	const { doc, availability } = await formAt(slug, ctx, config);
+	if (availability.kind === "closed") throw NextlyError.conflict({
+		reason: "state",
+		message: availability.message,
+		logContext: {
+			entity: "form",
+			slug,
+			reason: "closed"
+		}
+	});
+	if (availability.kind !== "open" || typeof doc?.id !== "string") throw noSuchForm(slug);
+	return doc;
+}
+/**
+* Count this upload against the visitor's limit for the form, refusing one
+* over it. A visitor whose address cannot be trusted is not limited, as
+* their submissions are not: one shared window for every such visitor would
+* let the first bot lock out everyone behind an untrusted proxy.
+*/
+async function holdUploadRate(req, formId, config) {
+	const limit = config.spamProtection.rateLimit;
+	const ip = trustedClientIp(req);
+	if (!limit || !ip) return;
+	const result = await countAgainstLimit(`form-upload:${formId}:${ip}`, limit.maxSubmissions * UPLOADS_PER_SUBMISSION, limit.windowMs);
+	if (result.allowed) return;
+	throw NextlyError.rateLimited({
+		retryAfterSeconds: Math.max(1, Math.ceil((result.resetAt.getTime() - Date.now()) / 1e3)),
+		logContext: {
+			formId,
+			reason: "form-upload-rate"
+		}
+	});
+}
+/**
+* The request body, read to `max` bytes and no further: a body past it is
+* refused, and its stream cancelled, before it is held whole.
+*/
+async function readCapped(req, max) {
+	if (!req.body) return Buffer.alloc(0);
+	const reader = req.body.getReader();
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) return Buffer.concat(chunks);
+		total += value.byteLength;
+		if (total > max) {
+			await reader.cancel();
+			throw tooLarge(max - MULTIPART_OVERHEAD);
+		}
+		chunks.push(value);
+	}
+}
+/** The multipart body, refused when it is not one or is larger than `limit`. */
+async function readUploadBody(req, limit) {
+	const max = limit + MULTIPART_OVERHEAD;
+	const declared = Number(req.headers.get("content-length") ?? NaN);
+	if (Number.isFinite(declared) && declared > max) throw tooLarge(limit);
+	const type = req.headers.get("content-type") ?? "";
+	if (!type.toLowerCase().startsWith("multipart/form-data")) throw refusal$1("file", "INVALID", "Send the file as multipart form data.");
+	const bytes = await readCapped(req, max);
+	try {
+		return await new Response(new Uint8Array(bytes), { headers: { "content-type": type } }).formData();
+	} catch {
+		throw refusal$1("file", "INVALID", "The upload could not be read.");
+	}
+}
+/** The form's file field named `name`, or a refusal naming `field`. */
+function fileFieldOf(form, name) {
+	const parsed = UPLOAD_PARTS.safeParse({ field: name });
+	const fields = Array.isArray(form.fields) ? form.fields : [];
+	const found = parsed.success ? fields.find((field) => {
+		const candidate = field ?? {};
+		return candidate.type === "file" && candidate.name === parsed.data.field;
+	}) : void 0;
+	if (!found) throw refusal$1("field", "INVALID", "This form has no file field by that name.");
+	return found;
+}
+/** The one file the body carries, or a refusal. */
+function theFile(body) {
+	const parts = body.getAll("file");
+	const [file] = parts;
+	if (parts.length !== 1 || typeof file === "string" || !file) throw refusal$1("file", "MISSING_FIELD", "Choose one file to upload.");
+	if (file.size === 0) throw refusal$1("file", "INVALID", "This file is empty.");
+	return file;
+}
+/** Whether this install lets visitors upload files at all. */
+function uploadsEnabled(config) {
+	return config.features.fileUploads !== false && config.fields.file !== false;
+}
+/** Delete a stored file the upload then refused; one already gone is fine. */
+async function discard(ctx, mediaId) {
+	try {
+		await ctx.services.media.delete(mediaId, { as: "system" });
+	} catch (error) {
+		if (!NextlyError.isNotFound(error)) throw error;
+	}
+}
+/** Store the file, judged by the field again on the type the library kept. */
+async function storeFile(ctx, file, patterns) {
+	const buffer = Buffer.from(await file.arrayBuffer());
+	const stored = await ctx.services.media.upload({
+		buffer,
+		filename: safeUploadName(file.name),
+		mimeType: file.type,
+		size: buffer.length
+	}, { as: "system" });
+	const kept = {
+		name: stored.originalFilename,
+		type: stored.mimeType
+	};
+	if (!fileMatchesAccept(kept, patterns)) {
+		await discard(ctx, stored.id);
+		throw refusal$1("file", "INVALID_TYPE", TYPE_REFUSED, { mimeType: stored.mimeType });
+	}
+	return stored;
+}
+/** Record the upload, or take its file back when it cannot be recorded. */
+async function recordUpload(ctx, upload) {
+	const slug = ctx.self.collections["form-uploads"] ?? "form-uploads";
+	try {
+		await ctx.services.collections.createEntry(slug, {
+			...upload,
+			submission: null
+		});
+	} catch (error) {
+		await discard(ctx, upload.media);
+		throw error;
+	}
+}
+async function acceptUpload(req, ctx, config, slug) {
+	const form = await openFormAt(slug, ctx, config);
+	if (!uploadsEnabled(config)) throw refusal$1("field", "INVALID", "This form takes no files.");
+	await holdUploadRate(req, form.id, config);
+	const body = await readUploadBody(req, config.uploads.maxFileSize);
+	const field = fileFieldOf(form, body.get("field"));
+	const file = theFile(body);
+	const limit = uploadLimitOf(field, config.uploads);
+	if (file.size > limit) throw tooLarge(limit);
+	const patterns = acceptPatternsOf(field, config.uploads);
+	if (!fileMatchesAccept({
+		name: file.name,
+		type: file.type
+	}, patterns)) throw refusal$1("file", "INVALID_TYPE", TYPE_REFUSED);
+	const stored = await storeFile(ctx, file, patterns);
+	await recordUpload(ctx, {
+		media: stored.id,
+		form: form.id,
+		field: field.name
+	});
+	return respondAction("File uploaded.", {
+		mediaId: stored.id,
+		field: field.name,
+		filename: stored.originalFilename,
+		mimeType: stored.mimeType,
+		size: stored.size
+	}, { status: 201 });
+}
+/** The upload route, at the root mount beside the other form endpoints. */
+function formUploadRoute(config) {
+	return {
+		method: "POST",
+		path: "/forms/:slug/upload",
+		mount: "root",
+		public: true,
+		handler: (req, ctx) => acceptUpload(req, ctx, config, ctx.params.slug)
+	};
+}
+
+// src/routes/submission-sends.ts
+/**
+* The routes a submission's emails are read and sent again through:
+*
+* - `GET /submissions/:id/sends`: each notification the submission sent,
+*   every recipient with its latest result, whether a send is in progress,
+*   and the recipients it can address now, for Resend. Asks reading
+*   submissions, and reads the submission as the person.
+* - `GET /notification-sends?form=&notification=&limit=`: a notification's
+*   recent sends across its form's submissions, newest first. Asks reading
+*   submissions.
+* - `POST /submissions/:id/resend`: Resend (`handlers/resend`). Asks updating
+*   submissions, and managing email deliveries before anything else.
+*
+* Lists answer `{ items, meta }`, Resend `{ message, item }`.
+*
+* @module routes/submission-sends
+*/
+/** A list that is whole: one page holding every item. */
+function wholeList(total) {
+	return toPageMeta({
+		total,
+		limit: Math.max(total, 1),
+		offset: 0
+	});
+}
+/**
+* The recipients each notification can address now, from the form and the
+* answers as they are, each marked as reached when a send of it has.
+*/
+async function withAddressable(ctx, deps, submission, groups) {
+	const form = await ctx.services.ownCollections.findEntryById(deps.formsSlug, formIdOf(submission.form) ?? "");
+	const notifications = Array.isArray(form.notifications) ? form.notifications : [];
+	return Promise.all(groups.map(async (group) => {
+		const notification = notifications.find((candidate) => candidate.id === group.notification);
+		const email = notification ? deps.build(form, submission, notification) : void 0;
+		if (!notification || !email) return {
+			...group,
+			addressable: []
+		};
+		return {
+			...group,
+			addressable: await addressableFor(ctx, email, notification, group.recipients)
+		};
+	}));
+}
+/** `GET /submissions/:id/sends`. */
+async function listSubmissionSends(ctx, deps) {
+	const submission = await ctx.services.collections.findEntryById(deps.submissionsSlug, ctx.params.id ?? "", {
+		as: "user",
+		user: ctx.user ?? void 0
+	});
+	const groups = await withAddressable(ctx, deps, submission, await submissionSends(ctx, String(submission.id)));
+	return respondList(groups, wholeList(groups.length));
+}
+const RECENT = z.object({
+	form: z.string().min(1).max(200),
+	notification: z.string().min(1).max(200),
+	limit: z.coerce.number().int().min(1).max(50).default(10)
+});
+/** `GET /notification-sends`. */
+async function listRecentSends(req, ctx, deps) {
+	const query = RECENT.parse(Object.fromEntries(new URL(req.url).searchParams.entries()));
+	const sends = await recentSends(ctx, query.form, query.notification, query.limit);
+	const ids = [...new Set(sends.map((send) => send.submission))];
+	const { data } = await ctx.services.collections.listEntries(deps.submissionsSlug, {
+		where: { id: { in: ids } },
+		pagination: { limit: Math.max(ids.length, 1) },
+		depth: 0
+	}, {
+		as: "user",
+		user: ctx.user ?? void 0
+	});
+	const titles = new Map(data.map((row) => [String(row.id), typeof row.title === "string" ? row.title : ""]));
+	const items = sends.filter((send) => titles.has(send.submission)).map((send) => ({
+		...send,
+		title: titles.get(send.submission) ?? ""
+	}));
+	return respondList(items, wholeList(items.length));
+}
+/** The routes, asked of the submissions collection as installed. */
+function submissionSendsRoutes(options) {
+	const may = (action) => ({ collection }) => collection(options.submissionsDeclared, action);
+	return [
+		{
+			method: "GET",
+			path: "/submissions/:id/sends",
+			requiredPermission: may("read"),
+			handler: (_req, ctx) => listSubmissionSends(ctx, options.deps(ctx))
+		},
+		{
+			method: "GET",
+			path: "/notification-sends",
+			requiredPermission: may("read"),
+			handler: (req, ctx) => listRecentSends(req, ctx, options.deps(ctx))
+		},
+		{
+			method: "POST",
+			path: "/submissions/:id/resend",
+			requiredPermission: may("update"),
+			handler: (req, ctx) => resendRoute(req, ctx, options.deps(ctx))
+		}
+	];
+}
+
+// src/routes/submissions-export.ts
+/**
+* The most rows one export holds. Past it the export is cut short and says
+* so in a header, never silently: an unbounded read of a busy form's table
+* would hold all of it in memory.
+*/
+const MAX_EXPORT_ROWS = 5e4;
+/** How many rows each read of the export asks for. */
+const READ_PAGE_SIZE = 200;
+/** The most submissions one export may name: a list's page shows far fewer. */
+const MAX_IDS = 500;
+/** The ticked rows an export names, as the list sends them. */
+const IDS = z.array(z.string().trim().min(1).max(128)).min(1).max(MAX_IDS);
+/** The request read from its address, or why it cannot be answered. */
+function readRequest(url) {
+	const params = url.searchParams;
+	const named = params.get("ids");
+	const ids = named === null ? void 0 : IDS.safeParse(named.split(","));
+	if (ids !== void 0 && !ids.success) return `"ids" names 1 to ${MAX_IDS} submissions, separated by commas.`;
+	return {
+		format: params.get("format") === "csv" ? "csv" : "json",
+		scope: scopeFromSearch(url.search),
+		...ids === void 0 ? {} : { ids: ids.data }
+	};
+}
+/**
+* Which submissions the export reads. Ticked rows are exported as ticked,
+* whatever their status is by now, but only from the form named, so a CSV
+* headed by one form's labels never holds another form's row.
+*/
+function exportWhere(request) {
+	if (request.ids === void 0) return listWhere(request.scope);
+	return {
+		id: { in: request.ids },
+		...request.scope.form ? { form: { equals: request.scope.form } } : {}
+	};
+}
+/** A refused export, in the canonical error envelope. */
+function refusal(status, code, message) {
+	return Response.json({ error: {
+		code,
+		message
+	} }, { status });
+}
+/** How the export reads: as the signed-in person, under their read rules. */
+function readerOf(ctx) {
+	return {
+		as: "user",
+		user: ctx.user ?? void 0
+	};
+}
+/** The form a CSV is headed by, read as the person; none if they cannot. */
+async function readForm(ctx, formsSlug, formId) {
+	return (await ctx.services.collections.listEntries(formsSlug, { where: { id: { equals: formId } } }, readerOf(ctx))).data[0];
+}
+/**
+* Every submission `where` matches, newest first as the list orders them,
+* page by page up to MAX_EXPORT_ROWS, and whether rows were left out.
+*/
+async function readRows(ctx, slug, where) {
+	const items = [];
+	for (let page = 1;; page += 1) {
+		const result = await ctx.services.collections.listEntries(slug, {
+			where,
+			sort: {
+				field: "submittedAt",
+				direction: "desc"
+			},
+			pagination: {
+				limit: READ_PAGE_SIZE,
+				page
+			}
+		}, readerOf(ctx));
+		items.push(...result.data);
+		const pageWasFull = result.data.length === READ_PAGE_SIZE;
+		if (items.length >= MAX_EXPORT_ROWS) {
+			const truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
+			return {
+				items: items.slice(0, MAX_EXPORT_ROWS),
+				truncated
+			};
+		}
+		if (!pageWasFull) return {
+			items,
+			truncated: false
+		};
+	}
+}
+/** The headers every export answers with: the file's name, and any cut. */
+function fileHeaders(filename, truncated) {
+	return {
+		"Content-Disposition": `attachment; filename="${filename}"`,
+		...truncated ? { "X-Export-Truncated": "true" } : {}
+	};
+}
+/** The rows as a CSV headed by `form`'s labels. */
+function csvResponse(items, form, truncated) {
+	const csv = exportToCSV(asSubmissionDocuments(items), asFormDocument(form));
+	const filename = generateExportFilename(typeof form.slug === "string" ? form.slug : "form", "csv");
+	return new Response(csv, { headers: {
+		"Content-Type": "text/csv; charset=utf-8",
+		...fileHeaders(filename, truncated)
+	} });
+}
+/** The export route, reading this install's collections. */
+function submissionsExportRoute(config) {
+	return {
+		method: "GET",
+		path: "/submissions/export",
+		requiredPermission: "export-submissions",
+		handler: async (req, ctx) => {
+			const request = readRequest(new URL(req.url));
+			if (typeof request === "string") return refusal(400, "VALIDATION_ERROR", request);
+			const slugs = installedSlugs(config, ctx.self);
+			let form;
+			if (request.format === "csv") {
+				if (!request.scope.form) return refusal(400, "VALIDATION_ERROR", "CSV export requires a form parameter.");
+				form = await readForm(ctx, slugs.forms, request.scope.form);
+				if (!form) return refusal(404, "NOT_FOUND", "Form not found.");
+			}
+			const { items, truncated } = await readRows(ctx, slugs.submissions, exportWhere(request));
+			if (form) return csvResponse(items, form, truncated);
+			return Response.json({ items }, { headers: fileHeaders(generateExportFilename("form", "json"), truncated) });
+		}
+	};
+}
+
 // src/plugin.ts
 /**
 * Form Builder Plugin
@@ -3672,7 +5966,8 @@ function resolveConfig(options) {
 			file: options.fields?.file ?? true,
 			date: options.fields?.date ?? true,
 			time: options.fields?.time ?? true,
-			hidden: options.fields?.hidden ?? true
+			hidden: options.fields?.hidden ?? true,
+			consent: options.fields?.consent ?? true
 		},
 		redirectRelationships: normalizeRedirectRelationships(options.redirectRelationships),
 		redirectTargetLocalization: {},
@@ -3738,6 +6033,10 @@ function formBuilder(options = {}) {
 	const resolvedConfig = resolveConfig(options);
 	const formsCol = formsCollection(resolvedConfig);
 	const submissionsCol = submissionsCollection(resolvedConfig);
+	const submissionFields = submissionExtensionFields(resolvedConfig);
+	const sendsCol = submissionSendsCollection();
+	const uploadsCol = formUploadsCollection();
+	const resendsCol = submissionResendsCollection();
 	let installedSubmissionsSlug = resolvedConfig.formSubmissionOverrides.slug;
 	const newSubmissions = newSubmissionsWidget({
 		forms: resolvedConfig.formOverrides.slug,
@@ -3745,6 +6044,7 @@ function formBuilder(options = {}) {
 	}, () => installedSubmissionsSlug);
 	const outbound = botCheckHosts(resolvedConfig.spamProtection);
 	let rebuildDeps;
+	let retentionDeps;
 	return {
 		plugin: definePlugin({
 			name: "@nextlyhq/plugin-form-builder",
@@ -3762,10 +6062,19 @@ function formBuilder(options = {}) {
 				"email-notifications"
 			],
 			contributes: {
-				collections: [formsCol, submissionsCol],
+				collections: [
+					formsCol,
+					submissionsCol,
+					sendsCol,
+					uploadsCol,
+					resendsCol
+				],
 				jobs: [rebuildKeysJob(async (deadline) => {
 					if (rebuildDeps) await rebuildResponseKeys(rebuildDeps, deadline);
+				}), retentionJob(async (deadline, cursor) => {
+					if (retentionDeps) await runRetention(retentionDeps, deadline, cursor);
 				})],
+				schedules: [RETENTION_SCHEDULE],
 				dashboard: { widgets: [newSubmissions] },
 				admin: { views: { [resolvedConfig.formOverrides.slug]: { documentViews: addressedFormPages().map((page) => ({
 					...page,
@@ -3785,71 +6094,8 @@ function formBuilder(options = {}) {
 				}],
 				routes: [
 					...publicFormRoutes(resolvedConfig),
-					{
-						method: "GET",
-						path: "/submissions/export",
-						requiredPermission: "export-submissions",
-						handler: async (req, ctx) => {
-							const declaredSlug = resolvedConfig.formSubmissionOverrides.slug;
-							const slug = ctx.self.collections[declaredSlug] ?? declaredSlug;
-							const url = new URL(req.url);
-							const format = url.searchParams.get("format") ?? "json";
-							const formId = url.searchParams.get("form");
-							const status = url.searchParams.get("status");
-							const where = {};
-							if (formId) where.form = { equals: formId };
-							if (status) where.status = { equals: status };
-							else where.status = { not_equals: "spam" };
-							const opts = {
-								as: "user",
-								user: ctx.user ?? void 0
-							};
-							let form;
-							if (format === "csv") {
-								if (!formId) return Response.json({ error: {
-									code: "VALIDATION_ERROR",
-									message: "CSV export requires a form parameter."
-								} }, { status: 400 });
-								const formsSlugDeclared = resolvedConfig.formOverrides.slug;
-								const formsSlug = ctx.self.collections[formsSlugDeclared] ?? formsSlugDeclared;
-								form = (await ctx.services.collections.listEntries(formsSlug, { where: { id: { equals: formId } } }, opts)).data[0];
-								if (!form) return Response.json({ error: {
-									code: "NOT_FOUND",
-									message: "Form not found."
-								} }, { status: 404 });
-							}
-							const MAX_EXPORT_ROWS = 5e4;
-							const items = [];
-							const pageSize = 200;
-							let truncated = false;
-							for (let page = 1;; page += 1) {
-								const result = await ctx.services.collections.listEntries(slug, {
-									where,
-									pagination: {
-										limit: pageSize,
-										page
-									}
-								}, opts);
-								items.push(...result.data);
-								const pageWasFull = result.data.length === pageSize;
-								if (items.length >= MAX_EXPORT_ROWS) {
-									truncated = pageWasFull || items.length > MAX_EXPORT_ROWS;
-									items.length = MAX_EXPORT_ROWS;
-									break;
-								}
-								if (!pageWasFull) break;
-							}
-							const truncationHeaders = truncated ? { "X-Export-Truncated": "true" } : {};
-							if (format !== "csv" || !form) return Response.json({ items }, { headers: truncationHeaders });
-							const csv = exportToCSV(asSubmissionDocuments(items), asFormDocument(form));
-							const filename = generateExportFilename(typeof form.slug === "string" ? form.slug : "form", "csv");
-							return new Response(csv, { headers: {
-								"Content-Type": "text/csv; charset=utf-8",
-								"Content-Disposition": `attachment; filename="${filename}"`,
-								...truncationHeaders
-							} });
-						}
-					},
+					formUploadRoute(resolvedConfig),
+					submissionsExportRoute(resolvedConfig),
 					{
 						method: "GET",
 						path: "/builder-config",
@@ -3871,7 +6117,17 @@ function formBuilder(options = {}) {
 								submissions: ctx.self.collections[resolvedConfig.formSubmissionOverrides.slug] ?? resolvedConfig.formSubmissionOverrides.slug
 							}
 						}))
-					}
+					},
+					{
+						method: "GET",
+						path: "/submission-fields",
+						requiredPermission: ({ collection }) => collection(resolvedConfig.formSubmissionOverrides.slug, "read"),
+						handler: () => Promise.resolve(Response.json({ fields: submissionFields }))
+					},
+					...submissionSendsRoutes({
+						submissionsDeclared: resolvedConfig.formSubmissionOverrides.slug,
+						deps: (ctx) => resendDeps(ctx, resolvedConfig)
+					})
 				]
 			},
 			admin: {
@@ -3895,8 +6151,14 @@ function formBuilder(options = {}) {
 					enabledFields: Object.entries(resolvedConfig.fields).filter(([, on]) => on).map(([name]) => name)
 				});
 				for (const slug of Object.keys(resolvedConfig.redirectTargetLocalization)) delete resolvedConfig.redirectTargetLocalization[slug];
+				const declaredCollections = nextly.config?.collections ?? [];
 				await Promise.all(Object.keys(resolvedConfig.redirectRelationships).map(async (declared) => {
 					const slug = nextly.self.collections[declared] ?? declared;
+					const declaration = declaredCollections.find((entry) => typeof entry === "object" && entry !== null && entry.slug === slug);
+					if (declaration !== void 0) {
+						resolvedConfig.redirectTargetLocalization[declared] = declaration.localized === true;
+						return;
+					}
 					try {
 						const localized = (await nextly.services.collections.getCollection(slug, {}))?.localized;
 						if (typeof localized === "boolean") resolvedConfig.redirectTargetLocalization[declared] = localized;
@@ -3913,9 +6175,6 @@ function formBuilder(options = {}) {
 				const declaredFormsSlug = resolvedConfig.formOverrides.slug;
 				const formsSlug = nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug;
 				nextly.hooks.on("beforeChange", submissionSlug, async (context) => prepareSubmissionForWrite(context, formsSlug, nextly));
-				nextly.hooks.on("afterCreate", submissionSlug, async (context) => {
-					await handleSubmissionCreated(context, resolvedConfig, nextly);
-				});
 				nextly.hooks.on("beforeUpdate", submissionSlug, (context) => {
 					const ctx = context;
 					if (ctx.data && ctx.data.data !== void 0) {
@@ -3924,14 +6183,12 @@ function formBuilder(options = {}) {
 					}
 					return ctx.data;
 				});
-				warnUncheckedBotChecks({
-					spam: resolvedConfig.spamProtection,
-					forms: async () => (await nextly.services.ownCollections.listEntries(formsSlug, { pagination: { limit: 500 } })).data ?? [],
-					readSettings: normalizeFormSettings,
-					warn: (message, context) => nextly.logger.warn?.(message, context)
-				});
+				const warnLog = (message, context) => nextly.logger.warn?.(message, context);
+				warnUncheckedSiteDefault(resolvedConfig.spamProtection, warnLog);
 				nextly.hooks.on("beforeChange", formsSlug, (context) => {
 					refuseOneResponseFieldProblem(context);
+					refuseBlankConsentText(context);
+					warnSavedFormCheck(context, resolvedConfig.spamProtection, warnLog);
 					return context.data;
 				});
 				rebuildDeps = {
@@ -3940,6 +6197,20 @@ function formBuilder(options = {}) {
 					formsSlug,
 					submissionsSlug: submissionSlug
 				};
+				const uploadsSlug = nextly.self.collections["form-uploads"] ?? "form-uploads";
+				const uploadCleanup = {
+					own: nextly.services.ownCollections,
+					collections: nextly.services.collections,
+					media: nextly.services.media,
+					uploadsSlug
+				};
+				retentionDeps = {
+					collections: nextly.services.collections,
+					jobs: nextly.services.jobs,
+					formsSlug,
+					submissionsSlug: submissionSlug,
+					uploads: uploadCleanup
+				};
 				nextly.hooks.on("beforeChange", formsSlug, async (context) => {
 					await stampOneResponseVersion(context, async (formId) => keysFitInSave(nextly, submissionSlug, formId, resolvedConfig.oneResponse.keysInSave));
 					return context.data;
@@ -3955,10 +6226,32 @@ function formBuilder(options = {}) {
 					forms: formsSlug,
 					submissions: submissionSlug
 				});
+				nextly.hooks.onInTransaction(submissionSlug, (write) => queueSubmissionNotifications(write, resolvedConfig, nextly, formsSlug));
+				registerForgettingSends(nextly, {
+					forms: formsSlug,
+					submissions: submissionSlug
+				});
+				registerSendHistory(nextly);
+				registerResend(nextly, resendDeps(nextly, resolvedConfig));
+				registerUploadClaims(nextly, {
+					forms: formsSlug,
+					submissions: submissionSlug,
+					uploads: uploadsSlug
+				});
+				registerUploadCleanup(nextly, uploadCleanup, {
+					forms: formsSlug,
+					submissions: submissionSlug
+				});
 				nextly.hooks.on("afterRead", formsSlug, (context) => injectSubmissionCount(context, submissionSlug, nextly));
 			}
 		}),
-		collections: [formsCol, submissionsCol],
+		collections: [
+			formsCol,
+			submissionsCol,
+			sendsCol,
+			uploadsCol,
+			resendsCol
+		],
 		config: resolvedConfig
 	};
 }
@@ -3980,29 +6273,6 @@ function resolveFieldRef(ref, data) {
 	return typeof value === "string" ? value : "";
 }
 /**
-* Scan form fields for file-upload fields marked `attachToEmail` and
-* collect the corresponding mediaIds from the submitted data. Returns
-* an array of `{ mediaId }` objects ready to pass as `attachments` to
-* `emailService.sendWithTemplate()`.
-*
-* Skips empty/missing values silently (optional file fields). Handles
-* both single-value and `multiple: true` file fields.
-*
-* @internal Exported for testing — not part of the public plugin API.
-*/
-function collectAttachmentInputs(fields, submittedData) {
-	const attachments = [];
-	for (const field of fields) {
-		if (field.type !== "file" || !field.attachToEmail) continue;
-		const value = submittedData[field.name];
-		if (value == null) continue;
-		if (Array.isArray(value)) {
-			for (const item of value) if (typeof item === "string" && item) attachments.push({ mediaId: item });
-		} else if (typeof value === "string" && value) attachments.push({ mediaId: value });
-	}
-	return attachments;
-}
-/**
 * Normalize a JSON column value from a raw DB row into an object. Hook
 * contexts carry the row as stored, so the value may be an already-parsed
 * object (jsonb dialects) or a serialized string (text-storage dialects).
@@ -4052,15 +6322,15 @@ function buildNotificationEmails(input) {
 		const key = notification.id || JSON.stringify(notification);
 		if (seen.has(key)) continue;
 		seen.add(key);
-		if (notification.condition && !evaluateSingleCondition(notification.condition, submittedData)) {
+		if (!conditionsMet(conditionsOf(notification), submittedData)) {
 			skipped.push({
 				notificationId: notification.id,
 				reason: "condition-unmet"
 			});
 			continue;
 		}
-		const to = (notification.recipientType === "field" ? resolveFieldRef(notification.to, submittedData) : notification.to).trim();
-		if (!to) {
+		const to = recipientsFor(notification, submittedData);
+		if (to === void 0) {
 			skipped.push({
 				notificationId: notification.id,
 				reason: "empty-recipient"
@@ -4088,7 +6358,8 @@ function buildNotificationEmails(input) {
 			replyTo,
 			cc,
 			bcc,
-			notificationId: notification.id
+			notificationId: notification.id,
+			attachments: attachmentsFrom(attachFieldsOf(notification, input.fields ?? []), submittedData)
 		});
 	}
 	return {
@@ -4097,6 +6368,19 @@ function buildNotificationEmails(input) {
 	};
 }
 /**
+* Who a notification goes to for these answers: the visitor's address from
+* the field it names, or the team's addresses, one as a string as before and
+* several as a list. Every address is trimmed on the way out, so
+* whitespace-only values count as empty and stray spaces never reach the
+* provider as headers. Undefined when nobody is left to send to.
+*/
+function recipientsFor(notification, data) {
+	if (notification.recipientType === "field") return resolveFieldRef(notification.to, data).trim() || void 0;
+	const addresses = teamAddressesOf(notification);
+	if (addresses.length === 0) return void 0;
+	return addresses.length === 1 ? addresses[0] : addresses;
+}
+/**
 * Send email notifications after a form submission is created.
 */
 /**
@@ -4256,8 +6540,11 @@ async function prepareSubmissionForWrite(context, formsSlug, nextly) {
 	const ctx = context;
 	const submission = ctx.data;
 	if (!submission || typeof submission !== "object") return ctx.data;
+	markUploadClaims(ctx);
 	if (pluginKeyWrite(ctx.operation, submission, ctx.originalData)) return submission;
 	delete submission.responseKey;
+	delete submission.asked;
+	delete submission.title;
 	const stored = ctx.originalData;
 	const formId = parentFormId(submission) ?? (stored ? parentFormId(stored) : null);
 	if (!formId) return ctx.data;
@@ -4268,12 +6555,15 @@ async function prepareSubmissionForWrite(context, formsSlug, nextly) {
 	const incoming = submittedPayload(submission.data !== void 0 ? submission.data : stored?.data);
 	const marks = submissionMarks(submission);
 	const form = await formToCheckAgainst(marks, formsSlug, formId, nextly);
-	const fields = form.fields;
+	markUploadClaims(ctx, form);
+	const storedAnswers = ctx.operation === "create" || stored?.data === void 0 ? void 0 : submittedPayload(stored.data);
+	const fields = consentsKept(form.fields, storedAnswers, incoming);
 	const spam = ctx.operation === "create" && ctx.req?.http ? await judgeSubmission(incoming, form, ctx.req.http, nextly, marks) : void 0;
 	if (spam?.reason === "rate_limit") throw NextlyError.rateLimited();
 	const prepared = prepareSubmission({
 		data: incoming,
 		fields,
+		fresh: ctx.operation === "create",
 		validate: marks?.keepAsEvidence !== true && spam === void 0
 	});
 	if (prepared.validationErrors) throw NextlyError.validation({ errors: Object.entries(prepared.validationErrors).map(([path, message]) => ({
@@ -4283,14 +6573,18 @@ async function prepareSubmissionForWrite(context, formsSlug, nextly) {
 	})) });
 	ctx.data = {
 		...submission,
-		data: prepared.data,
+		data: {
+			...prepared.data,
+			...storedConsents(form, storedAnswers)
+		},
 		...startingStatus(ctx, marks)
 	};
 	if (spam) {
 		ctx.data.status = "spam";
 		ctx.data.spamReason = spam.reason ?? null;
 	}
-	if (ctx.operation !== "create" && submission.data === void 0) stampDerivedEdit(ctx.data, ctx.user, incoming, prepared.data);
+	if (ctx.operation !== "create" && submission.data === void 0) stampDerivedEdit(ctx.data, ctx.user, incoming, ctx.data.data);
+	recordAsked(ctx, form.fields, formId);
 	stampRequestAddress(ctx, ctx.data);
 	if (ctx.operation === "create") {
 		const settings = normalizeFormSettings(form.settings);
@@ -4306,6 +6600,62 @@ async function prepareSubmissionForWrite(context, formsSlug, nextly) {
 	return ctx.data;
 }
 /**
+* Keep with the submission what it was asked (`asked-fields`): the form's
+* fields as the visitor saw them on create, or as staff edited an answer to
+* on update. A submission moved to another form is read with that form's
+* fields from then on; one stored before submissions kept this keeps none.
+*/
+function recordAsked(ctx, fields, formId) {
+	const row = ctx.data;
+	if (!row) return;
+	const data = submittedPayload(row.data);
+	const stored = ctx.originalData;
+	const movedFrom = stored ? parentFormId(stored) : null;
+	if (ctx.operation === "create" || movedFrom !== null && movedFrom !== formId) {
+		row.asked = askedSnapshotOf(fields, data);
+		titleFrom(row, fields, data);
+		return;
+	}
+	const after = askedAfterEdit(readAskedSnapshot(stored?.asked), fields, stored?.data === void 0 ? {} : submittedPayload(stored.data), data);
+	if (after !== void 0) row.asked = after;
+	titleFrom(row, fields, data);
+}
+/** The submission's title: who sent it, from its answers as asked. */
+function titleFrom(row, fields, data) {
+	const asked = readAskedSnapshot(row.asked);
+	row.title = submissionTitleOf(asked?.fields ?? fields, data) ?? null;
+}
+/**
+* The fields an update of a submission is checked against, refusing one that
+* would change a consent. A consent keeps what the visitor agreed to and the
+* text they were shown, so no edit, by staff or through the API, may change
+* it. Refused rather than quietly kept, so the editor learns their change did
+* not happen. A consent with no stored consent (the field was added after this
+* submission, or was another kind of field when it was made) is left out of
+* the checks: nobody but the visitor can give one, and they were not asked.
+*/
+function consentsKept(fields, stored, incoming) {
+	if (stored === void 0) return fields;
+	const edited = editedConsents(fields, stored, incoming);
+	if (edited.length > 0) throw NextlyError.validation({ errors: edited.map((path) => ({
+		path,
+		code: "INVALID",
+		message: CONSENT_EDIT_REFUSED
+	})) });
+	return fields.filter((field) => field.type === "consent" === isConsentAnswer(stored[field.name]));
+}
+/**
+* The stored consent answers an update carries over as they were. Checking an
+* update re-reads a consent with the form's current text, and drops one whose
+* field the form no longer has; this puts back what the visitor agreed to.
+*/
+function storedConsents(form, stored) {
+	if (stored === void 0) return {};
+	const kept = {};
+	for (const name of storedConsentNames(form.fields, stored)) if (stored[name] !== void 0) kept[name] = stored[name];
+	return kept;
+}
+/**
 * Say so when a visitor's submission reaches a form taking one response per
 * browser without the browser's token: it is accepted, as a browser that
 * cleared its data is, and nothing stops that visitor sending another. Left
@@ -4445,6 +6795,11 @@ function rateLimitKeyFor(form) {
 	const { id } = form;
 	return typeof id === "string" && id.length > 0 ? id : "unidentified-form";
 }
+/** How a log line names `form`: its slug, else its id, else not at all. */
+function formNamed(form) {
+	const name = typeof form.slug === "string" ? form.slug : form.id;
+	return typeof name === "string" ? { form: name } : {};
+}
 /**
 * Whether this submission looks like a bot's, and why.
 *
@@ -4481,6 +6836,7 @@ async function judgeSubmission(payload, form, http, nextly, marks) {
 	return judgeBotCheck({
 		settings: normalizeFormSettings(form.settings),
 		spam: config.spamProtection,
+		...formNamed(form),
 		tokens: marks?.botTokens ?? botTokensOf(payload),
 		ip: http.ip ?? void 0,
 		fetch: nextly.fetch,
@@ -4502,54 +6858,157 @@ function stampDerivedEdit(row, user, before, after) {
 	row.editedAt = /* @__PURE__ */ new Date();
 	row.editedBy = user?.id ?? null;
 }
-async function handleSubmissionCreated(context, config, nextly) {
-	if (!config.notifications.enabled) return;
-	const submission = context.data;
-	if (!submission) return;
-	if (submission.status === "spam") return;
-	const formId = parentFormId(submission);
-	if (!formId) return;
-	const declaredFormsSlug = config.formOverrides.slug;
-	const form = await fetchParentForm(nextly.self.collections[declaredFormsSlug] ?? declaredFormsSlug, formId, nextly);
+/**
+* The parent form, read on the submission's own transaction, so a form the
+* same transaction wrote is seen and no second connection is taken. Read
+* with no lock: the closing hold takes the one the form needs. Null for a
+* form that is not there, which sends nothing.
+*/
+async function formInTransaction(nextly, write, formsSlug, formId) {
+	try {
+		return await nextly.services.ownCollections.findEntryByIdInTransaction(write.transaction, formsSlug, formId, { lock: "none" });
+	} catch (err) {
+		if (!NextlyError.isNotFound(err)) throw err;
+		nextly.logger.error?.("Form Builder: form not found", { formId });
+		return null;
+	}
+}
+/**
+* Queue a new submission's notifications in the transaction that stores it.
+*
+* Each active notification whose conditions the answers meet is queued
+* through the email service's queued send with the write's transaction, and
+* recorded with the submission in it too, so the submission, its queued
+* emails and their records commit together or not at all: a stop between
+* the insert and the commit leaves none of them, and one after it leaves the
+* emails queued for the jobs trigger to send. Nothing is sent here: each
+* email's first attempt starts once the outermost transaction commits.
+*
+* The `form-builder.beforeEmail` filter runs here, inside the transaction,
+* so a handler that throws refuses the submission, and a transaction retried
+* after a version conflict runs it again.
+*/
+async function queueSubmissionNotifications(write, config, nextly, formsSlug) {
+	const target = submissionToNotify(write, config);
+	if (!target) return;
+	const { submission, formId } = target;
+	const form = await formInTransaction(nextly, write, formsSlug, formId);
 	if (!form) return;
 	const notifications = Array.isArray(form.notifications) ? form.notifications : [];
-	if (notifications.length === 0) return;
 	const emailService = nextly.services.email;
-	if (!emailService) return;
+	if (notifications.length === 0 || !emailService) return;
 	const submittedData = parseJsonColumn(submission.data);
-	const fileAttachments = collectAttachmentInputs(Array.isArray(form.fields) ? form.fields : [], submittedData);
+	const fields = Array.isArray(form.fields) ? form.fields : [];
 	const { emails, skipped } = buildNotificationEmails({
 		notifications,
 		submittedData,
 		formName: form.name,
-		submissionId: submission.id,
+		submissionId: write.id,
 		defaultFrom: config.notifications.defaultFrom,
-		fields: Array.isArray(form.fields) ? form.fields : []
-	});
-	for (const skip of skipped) if (skip.reason === "empty-recipient") nextly.logger.warn?.("Form Builder: empty recipient, skipping notification", {
-		notificationId: skip.notificationId,
-		formSlug: form.slug
-	});
-	else nextly.logger.debug?.("Form Builder: notification skipped", {
-		notificationId: skip.notificationId,
-		formSlug: form.slug,
-		reason: skip.reason
+		fields
 	});
+	logSkippedNotifications(skipped, form.slug, nextly.logger);
 	if (emails.length === 0) return;
 	const finalEmails = await nextly.filters.apply("form-builder.beforeEmail", emails, {
 		form,
 		submission
 	});
-	const send = () => queueNotificationEmails({
+	const submissionId = write.id;
+	await queueNotificationEmails({
 		emails: finalEmails,
 		emailService,
 		logger: nextly.logger,
 		formSlug: form.slug,
-		submissionId: typeof submission.id === "number" ? `${submission.id}` : typeof submission.id === "string" ? submission.id : "",
-		fileAttachments
+		submissionId,
+		fileAttachments: attachmentsFrom(fieldsMarkedToAttach(fields), submittedData),
+		tx: write.db,
+		record: async (sent, email) => recordSend(nextly, write.transaction, submissionId, {
+			...sent,
+			...await notificationSendDetails(nextly, {
+				formId,
+				notifications,
+				email
+			})
+		})
 	});
-	const { afterCommit } = context;
-	await (afterCommit ? afterCommit(send) : send());
+}
+/**
+* The new submission a write asks notifications for, and its form's id, or
+* undefined when it asks for none: not a create, notifications switched off
+* for the whole plugin, spam, or a row naming no form.
+*/
+function submissionToNotify(write, config) {
+	if (write.operation !== "create" || !config.notifications.enabled) return;
+	const submission = write.data;
+	if (!submission || submission.status === "spam") return void 0;
+	const formId = parentFormId(submission);
+	return formId ? {
+		submission,
+		formId
+	} : void 0;
+}
+/**
+* Log why each skipped notification was not queued: an empty recipient as a
+* warning, and unmet conditions or a missing template, which are expected
+* states rather than faults, at debug level only.
+*/
+function logSkippedNotifications(skipped, formSlug, logger) {
+	for (const skip of skipped) if (skip.reason === "empty-recipient") logger.warn?.("Form Builder: empty recipient, skipping notification", {
+		notificationId: skip.notificationId,
+		formSlug
+	});
+	else logger.debug?.("Form Builder: notification skipped", {
+		notificationId: skip.notificationId,
+		formSlug,
+		reason: skip.reason
+	});
+}
+/**
+* What Resend builds and queues with, from a context: the notification's
+* email as `buildNotificationEmails` makes it, whether or not it is active
+* or its conditions hold (a person chose to send it); the send filters; and
+* the queue, as a submission's own notifications are queued.
+*/
+function resendDeps(ctx, config) {
+	const declaredForms = config.formOverrides.slug;
+	const declaredSubmissions = config.formSubmissionOverrides.slug;
+	return {
+		formsSlug: ctx.self.collections[declaredForms] ?? declaredForms,
+		submissionsSlug: ctx.self.collections[declaredSubmissions] ?? declaredSubmissions,
+		build: (form, submission, notification) => buildNotificationEmails({
+			notifications: [{
+				...notification,
+				enabled: true,
+				condition: void 0,
+				conditions: void 0
+			}],
+			submittedData: parseJsonColumn(submission.data),
+			formName: form.name,
+			submissionId: idText(submission.id),
+			defaultFrom: config.notifications.defaultFrom,
+			fields: Array.isArray(form.fields) ? form.fields : []
+		}).emails[0],
+		filter: (emails, form, submission) => ctx.filters.apply("form-builder.beforeEmail", emails, {
+			form,
+			submission
+		}),
+		queue: (input) => queueNotificationEmails({
+			emails: input.emails,
+			emailService: ctx.services.email,
+			logger: ctx.logger,
+			formSlug: void 0,
+			submissionId: input.key,
+			fileAttachments: [],
+			tx: input.tx,
+			excludeRecipients: input.excludeRecipients,
+			record: input.record
+		})
+	};
+}
+/** A submission's id as text: a string or a number by dialect. */
+function idText(id) {
+	if (typeof id === "number") return `${id}`;
+	return typeof id === "string" ? id : "";
 }
 /**
 * The key a notification is queued under: its submission, its place among
@@ -4565,13 +7024,20 @@ function notificationKey(submissionId, index, notificationId) {
 * Queue each notification, and log where it stands.
 *
 * Queued through the email service's queued send rather than sent once: the
-* queue makes the first attempt at once, and a failure a retry can help is
-* tried again through the job queue, with backoff, until it is sent or fails
-* for good, never dropped. Each carries an idempotency key from its
-* submission and notification (`notificationKey`), so a provider that takes keys delivers it
-* once even if this hook runs again. No log line names a recipient: an
-* address in a log outlives the submission it came from, and the
-* notification's id and the queued email's id are enough to find it.
+* queue makes the first attempt at once (with `tx`, once that transaction
+* commits), and a failure a retry can help is tried again through the job
+* queue, with backoff, until it is sent or fails for good, never dropped.
+* Each carries an idempotency key from its submission and notification
+* (`notificationKey`), so a provider that takes keys delivers it once even if
+* this runs again. No log line names a recipient: an address in a log
+* outlives the submission it came from, and the notification's id and the
+* queued email's id are enough to find it.
+*
+* A refusal of the email itself (an invalid address) is logged and the
+* others are still queued. With `tx`, any other failure, and a failure to
+* record a queued one, is thrown as well as logged: the transaction then
+* rolls back with the submission, rather than keeping a submission whose
+* notification was silently never queued.
 */
 async function queueNotificationEmails(input) {
 	const { emails, emailService, logger, formSlug, fileAttachments } = input;
@@ -4581,6 +7047,9 @@ async function queueNotificationEmails(input) {
 			templateSlug: email.templateSlug,
 			notificationId: email.notificationId
 		};
+		const files = email.attachments ?? fileAttachments;
+		const sendKey = notificationKey(input.submissionId, index, email.notificationId);
+		let queuedId;
 		try {
 			const queued = await emailService.queueWithTemplate(email.templateSlug, email.to, email.variables, {
 				providerId: email.providerId,
@@ -4588,9 +7057,12 @@ async function queueNotificationEmails(input) {
 				replyTo: email.replyTo,
 				cc: email.cc,
 				bcc: email.bcc,
-				attachments: fileAttachments.length > 0 ? fileAttachments : void 0,
-				idempotencyKey: notificationKey(input.submissionId, index, email.notificationId)
+				attachments: files.length > 0 ? files : void 0,
+				idempotencyKey: sendKey,
+				...input.tx !== void 0 ? { tx: input.tx } : {},
+				...input.excludeRecipients ? { excludeRecipients: input.excludeRecipients } : {}
 			});
+			queuedId = queued.id;
 			if (queued.state === "failed") logger.error?.("Form Builder: notification failed", {
 				...identity,
 				queuedId: queued.id,
@@ -4600,15 +7072,40 @@ async function queueNotificationEmails(input) {
 				...identity,
 				queuedId: queued.id,
 				state: queued.state,
-				attachmentCount: fileAttachments.length
+				attachmentCount: files.length
 			});
 		} catch (err) {
+			const refused = NextlyError.isCode(err, "VALIDATION_ERROR");
 			logger.error?.("Form Builder: notification failed", {
 				...identity,
-				retryable: !NextlyError.isCode(err, "VALIDATION_ERROR"),
+				retryable: !refused,
 				error: err instanceof Error ? err.message : String(err)
 			});
+			if (!refused && input.tx !== void 0) throw err;
 		}
+		if (queuedId !== void 0) await recordQueued(input, identity, {
+			queuedId,
+			sendKey
+		}, email);
+	}
+}
+/**
+* Record a queued notification for its submission. A failure is logged; in
+* a transaction it is thrown too, so the submission and its queued email
+* roll back with the record. Outside one, the notification is queued either
+* way, and only its forgetting on deletion would miss it.
+*/
+async function recordQueued(input, identity, sent, email) {
+	if (!input.record) return;
+	try {
+		await input.record(sent, email);
+	} catch (err) {
+		input.logger.error?.("Form Builder: notification not recorded", {
+			...identity,
+			queuedId: sent.queuedId,
+			error: err instanceof Error ? err.message : String(err)
+		});
+		if (input.tx !== void 0) throw err;
 	}
 }
 /**
@@ -4917,6 +7414,11 @@ function validateFieldByType(field, path, errors) {
 			});
 			break;
 		}
+		case "consent": if (typeof field.agreementText !== "string" || field.agreementText.trim() === "") errors.push({
+			path: `${path}.agreementText`,
+			message: "A consent field needs the text the visitor agrees to",
+			code: "CONSENT_TEXT_REQUIRED"
+		});
 	}
 }
 /**
@@ -5538,6 +8040,31 @@ const hidden = (config) => ({
 	...config,
 	type: "hidden"
 });
+/**
+* Creates a consent field configuration.
+*
+* A box the visitor ticks to agree to `agreementText`. It is always required,
+* and the stored answer keeps the text the visitor was shown, so a later
+* change to the text leaves what earlier visitors agreed to as it was. Staff
+* can never edit a submitted consent.
+*
+* @param config - Field configuration without the `type` property
+* @returns Complete consent field configuration
+*
+* @example
+* ```typescript
+* consent({
+*   name: 'privacy',
+*   label: 'Privacy',
+*   agreementText: 'I agree to the privacy policy',
+* })
+* ```
+*/
+const consent = (config) => ({
+	...config,
+	type: "consent",
+	required: true
+});
 
 // src/index.ts
 /**
@@ -5582,5 +8109,5 @@ const hidden = (config) => ({
 */
 const formBuilderPlugin = formBuilder().plugin;
 
-export { BUILT_IN_FORM_FIELD_TYPES, DEFAULT_FORM_SETTINGS, DEFAULT_NOTIFICATION_SETTINGS, NEW_SUBMISSIONS_WIDGET_ID, RESERVED_FORM_SLUGS, applyFieldDefaults, applyFormDefaults, assertValidFormConfig, checkSpam, checkbox, createFormConfig, date, downloadFile, email, evaluateConditions, exportAndDownload, exportToCSV, exportToJSON, file, formBuilder, formBuilderPlugin, formatExportValue, formsCollection, generateExportFilename, generateZodSchema, getFormBuilderConfig, getFormSubmissionStats, getSupportedComparisonOperators, getValidationErrors, hidden, isCheckboxFormField, isEmailFormField, isFileFormField, isFormAcceptingSubmissions, isFormField, isFormFieldType, isKnownFormField, isSelectFormField, isTextFormField, isValidComparisonOperator, number, option, phone, pluralize, radio, select, submissionsCollection, submitForm, text, textarea, time, toTitleCase, transformFormData, url, validateFormConfig, validateFormData, validateSubmission };
+export { BUILT_IN_FORM_FIELD_TYPES, DEFAULT_FORM_SETTINGS, DEFAULT_NOTIFICATION_SETTINGS, NEW_SUBMISSIONS_WIDGET_ID, RESERVED_FORM_SLUGS, applyFieldDefaults, applyFormDefaults, assertValidFormConfig, checkSpam, checkbox, consent, createFormConfig, date, downloadFile, email, evaluateConditions, exportAndDownload, exportToCSV, exportToJSON, file, formBuilder, formBuilderPlugin, formatExportValue, formsCollection, generateExportFilename, generateZodSchema, getFormBuilderConfig, getFormSubmissionStats, getSupportedComparisonOperators, getValidationErrors, hidden, isCheckboxFormField, isEmailFormField, isFileFormField, isFormAcceptingSubmissions, isFormField, isFormFieldType, isKnownFormField, isSelectFormField, isTextFormField, isValidComparisonOperator, number, option, phone, pluralize, radio, select, submissionsCollection, submitForm, text, textarea, time, toTitleCase, transformFormData, url, validateFormConfig, validateFormData, validateSubmission };
 //# sourceMappingURL=index.js.map