@orion-studios/cms 0.5.4 → 0.5.6

package/dist/server/index.js

@@ -3,12 +3,14 @@ import {
 } from "../chunk-AYV6KYDP.js";
 import {
   createMemoryRateLimitStore,
+  getAutoReplyEmailFields,
   isOriginAllowed,
-  processSubmission
-} from "../chunk-VPUODCNH.js";
+  processSubmission,
+  resolveAutoReplyEmailField
+} from "../chunk-CFZP7674.js";
 
 // src/server/routes.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 
 // src/analytics/aggregate.ts
 var CONVERSION_NAMES = /* @__PURE__ */ new Set(["call", "email"]);
@@ -38,7 +40,7 @@ function normalizeSource(utmSource, referrer) {
   if (host.includes("twitter.") || host === "t.co" || host.includes("x.com")) return "X (Twitter)";
   return host;
 }
-var isConversion = (event) => event.type === "click" && CONVERSION_NAMES.has(event.name) || event.type === "form" && event.name.endsWith(":submit");
+var isConversion = (event) => event.server_verified === true && (event.type === "click" && CONVERSION_NAMES.has(event.name) || event.type === "form" && event.name.endsWith(":submit"));
 var top = (map, limit, by) => [...map.entries()].sort((a, b) => by(b[1]) - by(a[1])).slice(0, limit);
 function computeKpis(events) {
   const sessions = /* @__PURE__ */ new Set();
@@ -63,10 +65,12 @@ function computeKpis(events) {
     if (event.type === "click" && event.name === "call") calls += 1;
     if (event.type === "click" && event.name === "email") emails += 1;
     if (event.type === "click" && event.name === "portal") portalClicks += 1;
-    if (event.type === "form" && event.name.endsWith(":submit")) formSubmits += 1;
+    if (event.server_verified === true && event.type === "form" && event.name.endsWith(":submit")) {
+      formSubmits += 1;
+    }
     if (isConversion(event) && event.session_key) converting.add(event.session_key);
   }
-  const conversions = calls + formSubmits + emails;
+  const conversions = events.filter(isConversion).length;
   const returningVisitors = [...visitorSessions.values()].filter((keys) => keys.size > 1).length;
   return {
     visitors: visitors.size,
@@ -173,7 +177,7 @@ function aggregateAnalytics(events, previousEvents, range) {
     const entry = forms.get(slug) || { views: 0, starts: 0, submits: 0 };
     if (stage === "view") entry.views += 1;
     if (stage === "start") entry.starts += 1;
-    if (stage === "submit") entry.submits += 1;
+    if (stage === "submit" && event.server_verified === true) entry.submits += 1;
     forms.set(slug, entry);
   }
   const notFound = /* @__PURE__ */ new Map();
@@ -338,12 +342,16 @@ ${rendered}
   }
   return lines.join("\n");
 }
+function resolveSubmitterEmail(config, data) {
+  const fieldName = resolveAutoReplyEmailField(config);
+  if (!fieldName) return void 0;
+  const value = data[fieldName];
+  return isEmail(value) ? value.trim().toLowerCase() : void 0;
+}
 async function notifySubmission(args) {
   const notify = args.config.notify || {};
   const recipients = (notify.emails || []).filter(isEmail);
-  const submitterEmail = Object.entries(args.data).find(
-    ([key, value]) => key.toLowerCase().includes("email") && isEmail(value)
-  )?.[1];
+  const submitterEmail = resolveSubmitterEmail(args.config, args.data);
   const subject = (notify.subject || "New {form} submission").replace(
     /\{form\}/g,
     args.formTitle || "form"
@@ -360,7 +368,7 @@ async function notifySubmission(args) {
       console.error("[orion-cms] submission notification failed:", error);
     }
   }
-  if (notify.autoReply && submitterEmail) {
+  if (notify.autoReply === true && submitterEmail && args.autoReplyAllowed === true) {
     try {
       await args.sendEmail({
         to: [submitterEmail],
@@ -429,12 +437,15 @@ var encode = (value) => Buffer.from(value, "utf8").toString("base64url");
 var decode = (value) => Buffer.from(value, "base64url").toString("utf8");
 var sign = (payload, secret) => createHmac2("sha256", secret).update(payload).digest("base64url");
 var PREVIEW_TOKEN_TTL_MS = 60 * 60 * 1e3;
+var PREVIEW_SESSION_COOKIE = "orion_preview_session";
 function createPreviewToken(pageId, secret, ttlMs = PREVIEW_TOKEN_TTL_MS) {
   const payload = encode(`${pageId}|${Date.now() + ttlMs}`);
   return `${payload}.${sign(payload, secret)}`;
 }
 function verifyPreviewToken(token, secret) {
-  const [payload, signature] = token.split(".");
+  const segments = token.split(".");
+  if (segments.length !== 2) return null;
+  const [payload, signature] = segments;
   if (!payload || !signature) return null;
   const expected = sign(payload, secret);
   const expectedBuffer = Buffer.from(expected);
@@ -506,6 +517,11 @@ async function resolveUser(request, client = getServiceClient()) {
 
 // src/server/sync.ts
 var isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
+var publicFormConfig = (value) => {
+  const config = isRecord(value) ? { ...value } : {};
+  delete config.notify;
+  return config;
+};
 var mimeByExtension = {
   avif: "image/avif",
   gif: "image/gif",
@@ -629,7 +645,7 @@ async function runContentSync(client, registry, input) {
       {
         slug: form.slug,
         title: typeof form.title === "string" ? form.title : form.slug,
-        config: isRecord(form.config) ? form.config : {},
+        config: publicFormConfig(form.config),
         success_message: typeof form.successMessage === "string" ? form.successMessage : "",
         updated_at: (/* @__PURE__ */ new Date()).toISOString()
       },
@@ -642,7 +658,6 @@ async function runContentSync(client, registry, input) {
 }
 
 // src/server/routes.ts
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var tokenEquals = (candidate, secret) => {
   if (!candidate || !secret) return false;
   const a = Buffer.from(candidate);
@@ -666,15 +681,29 @@ var PATH_PATTERN = /^\/(?:[a-z0-9-]+(?:\/[a-z0-9-]+)*)?$/;
 var USER_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var canonicalizeUserId = (value) => USER_ID_PATTERN.test(value) ? value.toLowerCase() : null;
 var DEFAULT_MAX_UPLOAD_BYTES = 15 * 1024 * 1024;
-var ALLOWED_UPLOAD_TYPES = /* @__PURE__ */ new Set([
-  "image/jpeg",
-  "image/png",
-  "image/webp",
-  "image/gif",
-  "image/avif",
-  "image/svg+xml",
-  "application/pdf"
-]);
+var UPLOAD_RULES = {
+  "image/jpeg": {
+    extensions: ["jpg", "jpeg"],
+    decodedFormat: "jpeg"
+  },
+  "image/png": {
+    extensions: ["png"],
+    decodedFormat: "png"
+  },
+  "image/webp": {
+    extensions: ["webp"],
+    decodedFormat: "webp"
+  },
+  "image/gif": {
+    extensions: ["gif"],
+    decodedFormat: "gif"
+  },
+  "image/avif": {
+    extensions: ["avif"],
+    decodedFormat: "heif"
+  }
+};
+var uploadExtension = (filename) => filename.split(".").pop()?.toLowerCase() || "";
 async function readJson(request) {
   try {
     const parsed = await request.json();
@@ -735,22 +764,36 @@ async function readJsonLimited(request, limits) {
   return parsed;
 }
 var hashedClientKey = (ip) => createHash2("sha256").update(ip).digest("hex").slice(0, 24);
+var requestPagePath = (request) => {
+  const referrer = request.headers.get("referer");
+  if (!referrer) return "";
+  try {
+    const page = new URL(referrer);
+    if (page.origin !== new URL(request.url).origin) return "";
+    return PATH_PATTERN.test(page.pathname) ? page.pathname : "";
+  } catch {
+    return "";
+  }
+};
 function createDurableRateLimitStore(getClient, options) {
   const max = options?.max ?? 5;
   const windowSeconds = Math.max(1, Math.round((options?.windowMs ?? 6e4) / 1e3));
   const bucket = options?.bucket ?? "default";
+  const failClosed = options?.failClosed === true;
   return {
-    async isLimited(key) {
+    async isLimited(key, _now, cost = 1) {
       try {
-        const { data, error } = await getClient().rpc("cms_rate_limit_consume", {
+        const args = {
           p_key: `${bucket}:${key}`,
           p_max: max,
           p_window_seconds: windowSeconds
-        });
-        if (error) return false;
-        return data === false;
+        };
+        if (cost !== 1) args.p_cost = cost;
+        const { data, error } = await getClient().rpc("cms_rate_limit_consume", args);
+        if (error) return failClosed;
+        return failClosed ? data !== true : data === false;
       } catch {
-        return false;
+        return failClosed;
       }
     }
   };
@@ -766,7 +809,86 @@ function createCmsRoutes(options) {
     if (hostedMemoryMode) return "";
     return options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
   };
-  const eventsRateLimit = options.memoryMode ? createMemoryRateLimitStore({ max: 120, windowMs: 6e4 }) : createDurableRateLimitStore(db, { max: 120, windowMs: 6e4, bucket: "events" });
+  const analyticsLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
+  const autoReplyLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
+  const boundedAutoReplyMax = (name, fallback) => {
+    const candidate = options.autoReplyLimits?.[name];
+    return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? Math.min(candidate, fallback) : fallback;
+  };
+  const autoReplyLimits = {
+    recipientPerHour: autoReplyLimit(
+      boundedAutoReplyMax("recipientPerHour", 3),
+      36e5,
+      "auto-reply-recipient-hour"
+    ),
+    sitePerMinute: autoReplyLimit(
+      boundedAutoReplyMax("sitePerMinute", 10),
+      6e4,
+      "auto-reply-site-minute"
+    ),
+    sitePerDay: autoReplyLimit(
+      boundedAutoReplyMax("sitePerDay", 200),
+      864e5,
+      "auto-reply-site-day"
+    )
+  };
+  const autoReplyRecipientKey = (email) => createHmac3(
+    "sha256",
+    previewSecret() || syncToken || "orion-memory-auto-reply-secret"
+  ).update(`recipient:${email}`).digest("hex").slice(0, 24);
+  const maySendAutoReply = async (config, data) => {
+    if (config.notify?.autoReply !== true) return false;
+    const recipient = resolveSubmitterEmail(config, data);
+    if (!recipient) return false;
+    const now = Date.now();
+    if (await autoReplyLimits.recipientPerHour.isLimited(autoReplyRecipientKey(recipient), now)) {
+      return false;
+    }
+    if (await autoReplyLimits.sitePerMinute.isLimited("all", now)) return false;
+    if (await autoReplyLimits.sitePerDay.isLimited("all", now)) return false;
+    return true;
+  };
+  const boundedAnalyticsMax = (name, fallback) => {
+    const candidate = options.analyticsLimits?.[name];
+    return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? Math.min(candidate, fallback) : fallback;
+  };
+  const analyticsLimits = {
+    siteRequestsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("siteRequestsPerMinute", 300),
+      6e4,
+      "events-site-request-minute"
+    ),
+    siteRequestsPerDay: analyticsLimit(
+      boundedAnalyticsMax("siteRequestsPerDay", 2e4),
+      864e5,
+      "events-site-request-day"
+    ),
+    requestsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("requestsPerMinute", 60),
+      6e4,
+      "events-request-minute"
+    ),
+    clientEventsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("clientEventsPerMinute", 120),
+      6e4,
+      "events-client-minute"
+    ),
+    clientEventsPerDay: analyticsLimit(
+      boundedAnalyticsMax("clientEventsPerDay", 1e3),
+      864e5,
+      "events-client-day"
+    ),
+    siteEventsPerMinute: analyticsLimit(
+      boundedAnalyticsMax("siteEventsPerMinute", 2e3),
+      6e4,
+      "events-site-minute"
+    ),
+    siteEventsPerDay: analyticsLimit(
+      boundedAnalyticsMax("siteEventsPerDay", 5e4),
+      864e5,
+      "events-site-day"
+    )
+  };
   const analyticsRetentionDays = options.analyticsRetentionDays ?? 90;
   const requestSessionKey = (request) => {
     const secret = previewSecret() || "orion-analytics";
@@ -1050,27 +1172,16 @@ function createCmsRoutes(options) {
     const { data } = await db().from("cms_pages").select("id, path").eq("id", id).maybeSingle();
     if (!data) return errors.notFound();
     const token = createPreviewToken(id, secret);
-    return json({ token, path: data.path, url: `${data.path}?preview=${encodeURIComponent(token)}` });
-  };
-  const previewPage = async (request) => {
-    if (hostedMemoryMode) return errors.notFound();
-    const secret = previewSecret();
-    if (!secret) return errors.notFound();
-    const token = new URL(request.url).searchParams.get("token") || "";
-    const pageId = verifyPreviewToken(token, secret);
-    if (!pageId) return errors.forbidden();
-    const { data } = await db().from("cms_pages").select("id, slug, path, title, seo, draft_layout").eq("id", pageId).maybeSingle();
-    if (!data) return errors.notFound();
-    return json({
-      page: {
-        id: data.id,
-        slug: data.slug,
-        path: data.path,
-        title: data.title,
-        seo: data.seo ?? {},
-        layout: data.draft_layout ?? []
-      }
-    });
+    const previewUrl = `/cms-preview/${encodeURIComponent(String(data.id))}`;
+    const response = json({ path: data.path, url: previewUrl });
+    const secure = process.env.NODE_ENV === "production" || new URL(request.url).protocol === "https:";
+    response.headers.set("cache-control", "private, no-store");
+    response.headers.set("referrer-policy", "no-referrer");
+    response.headers.append(
+      "set-cookie",
+      `${PREVIEW_SESSION_COOKIE}=${token}; Path=${previewUrl}; HttpOnly; SameSite=Strict; Max-Age=${Math.floor(PREVIEW_TOKEN_TTL_MS / 1e3)}${secure ? "; Secure" : ""}`
+    );
+    return response;
   };
   const listVersions = async (request, id) => {
     const auth = await guard(request, "pages.restore");
@@ -1158,15 +1269,56 @@ function createCmsRoutes(options) {
     if (error) return errors.badRequest(error.message);
     return json({ media: data });
   };
-  const validateUpload = (file) => {
+  const prepareUpload = async (file, target) => {
     if (file.size > maxUploadBytes) {
       return `File is too large (max ${Math.round(maxUploadBytes / 1024 / 1024)} MB).`;
     }
     const type = file.type || "";
-    if (!ALLOWED_UPLOAD_TYPES.has(type)) {
-      return "Unsupported file type. Allowed: images (JPEG, PNG, WebP, GIF, AVIF, SVG) and PDF.";
+    const rule = UPLOAD_RULES[type];
+    if (!rule) {
+      return "Unsupported file type. Allowed: JPEG, PNG, WebP, GIF, and AVIF images.";
+    }
+    const extension = uploadExtension(file.name);
+    if (!rule.extensions.includes(extension)) {
+      return "File extension does not match its declared type.";
+    }
+    if (target) {
+      const knownTargetType = Boolean(UPLOAD_RULES[target.mimeType]);
+      const pathMatches = target.path.startsWith("data:") || rule.extensions.includes(uploadExtension(target.path));
+      if (knownTargetType && target.mimeType !== type || !knownTargetType && !pathMatches) {
+        return "Replacement files must use the same format as the stored file.";
+      }
+    }
+    try {
+      const { default: sharp } = await import("sharp");
+      const input = Buffer.from(await file.arrayBuffer());
+      const image = sharp(input, {
+        animated: type === "image/gif",
+        failOn: "error",
+        limitInputPixels: 4e7
+      });
+      const metadata = await image.metadata();
+      const width = metadata.width || 0;
+      const height = metadata.height || 0;
+      const pages = metadata.pages || 1;
+      if (metadata.format !== rule.decodedFormat || width < 1 || height < 1 || width * height * pages > 4e7) {
+        return "File contents do not match its declared type.";
+      }
+      const normalized = type === "image/jpeg" ? await image.rotate().jpeg({ quality: 90 }).toBuffer() : type === "image/png" ? await image.rotate().png().toBuffer() : type === "image/webp" ? await image.rotate().webp({ quality: 90 }).toBuffer() : type === "image/gif" ? await image.rotate().gif().toBuffer() : await image.rotate().avif({ quality: 60 }).toBuffer();
+      if (normalized.byteLength > maxUploadBytes) {
+        return `Normalized file is too large (max ${Math.round(maxUploadBytes / 1024 / 1024)} MB).`;
+      }
+      return {
+        file: new File([Uint8Array.from(normalized)], file.name, {
+          type,
+          lastModified: file.lastModified
+        }),
+        width,
+        height
+      };
+    } catch {
+      return "File contents do not match its declared type.";
     }
-    return null;
   };
   const uploadMedia = async (request) => {
     const auth = await guard(request, "media.upload");
@@ -1174,35 +1326,32 @@ function createCmsRoutes(options) {
     const form = await request.formData().catch(() => null);
     const file = form?.get("file");
     if (!form || !(file instanceof File)) return errors.badRequest("file is required.");
-    const invalid = validateUpload(file);
-    if (invalid) return errors.badRequest(invalid);
+    const prepared = await prepareUpload(file);
+    if (typeof prepared === "string") return errors.badRequest(prepared);
+    const normalizedFile = prepared.file;
     const safeName = file.name.replace(/[^a-zA-Z0-9._-]+/g, "-").toLowerCase();
     let storagePath = `${Date.now().toString(36)}-${safeName}`;
     if (options.memoryMode) {
-      const buffer = Buffer.from(await file.arrayBuffer());
-      storagePath = `data:${file.type || "application/octet-stream"};base64,${buffer.toString("base64")}`;
-    } else {
-      const { error: storageError } = await db().storage.from("media").upload(storagePath, file, { contentType: file.type || "application/octet-stream" });
-      if (storageError) return errors.badRequest(storageError.message);
+      const buffer = Buffer.from(await normalizedFile.arrayBuffer());
+      storagePath = `data:${normalizedFile.type};base64,${buffer.toString("base64")}`;
     }
-    const uploadedToStorage = !options.memoryMode;
-    const width = Number(form.get("width")) || null;
-    const height = Number(form.get("height")) || null;
     const { data, error } = await db().from("cms_media").insert({
       storage_path: storagePath,
       filename: safeName,
       alt: String(form.get("alt") || ""),
       caption: String(form.get("caption") || ""),
-      mime_type: file.type || "",
-      width,
-      height,
-      filesize: file.size
+      mime_type: normalizedFile.type,
+      width: prepared.width,
+      height: prepared.height,
+      filesize: normalizedFile.size
     }).select("*").single();
-    if (error) {
-      if (uploadedToStorage) {
-        await db().storage.from("media").remove([storagePath]).catch(() => void 0);
+    if (error) return errors.badRequest(error.message);
+    if (!options.memoryMode) {
+      const { error: storageError } = await db().storage.from("media").upload(storagePath, normalizedFile, { contentType: normalizedFile.type });
+      if (storageError) {
+        await db().from("cms_media").delete().eq("id", data.id);
+        return errors.badRequest(storageError.message);
       }
-      return errors.badRequest(error.message);
     }
     await logActivity(auth.user, "media.upload", safeName);
     return json({ media: data }, 201);
@@ -1248,27 +1397,29 @@ function createCmsRoutes(options) {
     const form = await request.formData().catch(() => null);
     const file = form?.get("file");
     if (!form || !(file instanceof File)) return errors.badRequest("file is required.");
-    const invalid = validateUpload(file);
-    if (invalid) return errors.badRequest(invalid);
+    const prepared = await prepareUpload(file, {
+      path: String(doc.storage_path),
+      mimeType: String(doc.mime_type || "")
+    });
+    if (typeof prepared === "string") return errors.badRequest(prepared);
+    const normalizedFile = prepared.file;
     let storagePath = String(doc.storage_path);
     if (options.memoryMode) {
-      const buffer = Buffer.from(await file.arrayBuffer());
-      storagePath = `data:${file.type || "application/octet-stream"};base64,${buffer.toString("base64")}`;
+      const buffer = Buffer.from(await normalizedFile.arrayBuffer());
+      storagePath = `data:${normalizedFile.type};base64,${buffer.toString("base64")}`;
     } else {
-      const { error: storageError } = await db().storage.from("media").upload(storagePath, file, {
-        contentType: file.type || "application/octet-stream",
+      const { error: storageError } = await db().storage.from("media").upload(storagePath, normalizedFile, {
+        contentType: normalizedFile.type,
         upsert: true
       });
       if (storageError) return errors.badRequest(storageError.message);
     }
-    const width = Number(form.get("width")) || null;
-    const height = Number(form.get("height")) || null;
     const { data, error } = await db().from("cms_media").update({
       storage_path: storagePath,
-      mime_type: file.type || "",
-      filesize: file.size,
-      width,
-      height,
+      mime_type: normalizedFile.type,
+      filesize: normalizedFile.size,
+      width: prepared.width,
+      height: prepared.height,
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     }).eq("id", id).select("*").single();
     if (error) return errors.badRequest(error.message);
@@ -1286,11 +1437,17 @@ function createCmsRoutes(options) {
     if (usage.length > 0 && !force) {
       return errors.conflict("This file is used on pages.", { usage });
     }
+    const storagePath = String(doc.storage_path);
+    if (!storagePath.startsWith("data:") && !storagePath.startsWith("/")) {
+      try {
+        const { error: storageError } = await db().storage.from("media").remove([storagePath]);
+        if (storageError) return errors.badRequest(storageError.message);
+      } catch (error2) {
+        return errors.badRequest(error2 instanceof Error ? error2.message : "Unable to remove stored file.");
+      }
+    }
     const { error } = await db().from("cms_media").delete().eq("id", id);
     if (error) return errors.badRequest(error.message);
-    if (!String(doc.storage_path).startsWith("data:")) {
-      await db().storage.from("media").remove([doc.storage_path]).catch(() => void 0);
-    }
     await logActivity(auth.user, "media.delete", String(doc.filename));
     return json({ success: true });
   };
@@ -1356,8 +1513,32 @@ function createCmsRoutes(options) {
     const body = await readJson(request);
     if (!body) return errors.badRequest("Invalid body.");
     const config = isRecord2(body.config) ? { ...body.config } : {};
-    const notify = isRecord2(body.notify) ? body.notify : isRecord2(config.notify) ? config.notify : {};
+    if (body.notify !== void 0 && !isRecord2(body.notify)) {
+      return errors.badRequest("Notification settings must be an object.");
+    }
+    if (body.notify === void 0 && config.notify !== void 0 && !isRecord2(config.notify)) {
+      return errors.badRequest("Notification settings must be an object.");
+    }
+    const rawNotify = isRecord2(body.notify) ? body.notify : isRecord2(config.notify) ? config.notify : {};
     delete config.notify;
+    if (rawNotify.autoReply !== void 0 && typeof rawNotify.autoReply !== "boolean") {
+      return errors.badRequest("autoReply must be a boolean.");
+    }
+    if (rawNotify.autoReplyEmailField !== void 0 && (typeof rawNotify.autoReplyEmailField !== "string" || !rawNotify.autoReplyEmailField.trim())) {
+      return errors.badRequest("autoReplyEmailField must name a declared email field.");
+    }
+    const emailFields = getAutoReplyEmailFields(config);
+    const selectedEmailField = typeof rawNotify.autoReplyEmailField === "string" ? rawNotify.autoReplyEmailField.trim() : "";
+    if (selectedEmailField && !emailFields.includes(selectedEmailField)) {
+      return errors.badRequest("autoReplyEmailField must name a declared email field.");
+    }
+    if (rawNotify.autoReply === true && emailFields.length !== 1 && !selectedEmailField) {
+      return errors.badRequest("Auto-reply requires one selected declared email field.");
+    }
+    const notify = {
+      ...rawNotify,
+      ...selectedEmailField ? { autoReplyEmailField: selectedEmailField } : {}
+    };
     const { data, error } = await db().from("cms_forms").upsert(
       {
         slug,
@@ -1420,7 +1601,7 @@ function createCmsRoutes(options) {
   const csvEscape = (value) => {
     let text = Array.isArray(value) ? value.join("; ") : typeof value === "string" ? value : value === null || value === void 0 ? "" : JSON.stringify(value);
     if (/^[=+\-@\t\r]/.test(text)) text = `'${text}`;
-    return /[",\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
   };
   const exportSubmissions = async (request) => {
     const auth = await guard(request, "submissions.read");
@@ -1520,18 +1701,36 @@ function createCmsRoutes(options) {
       session_key: requestSessionKey(request)
     }).select("id").single();
     if (error) return errors.badRequest(error.message);
+    try {
+      const userAgent = request.headers.get("user-agent") || "";
+      await db().from("cms_events").insert({
+        session_key: requestSessionKey(request),
+        visitor_key: "",
+        type: "form",
+        name: `${form.slug}:submit`,
+        path: requestPagePath(request),
+        referrer: "",
+        utm: {},
+        device: deviceFrom(userAgent),
+        ...geoFrom(request),
+        meta: {},
+        server_verified: true
+      });
+    } catch {
+    }
     if (sendEmail) {
+      const notificationConfig = {
+        ...form.config || {},
+        ...isRecord2(form.notify) && Object.keys(form.notify).length > 0 ? { notify: form.notify } : {}
+      };
       await notifySubmission({
         sendEmail,
         formTitle: String(form.title || form.slug),
-        // Notify settings live in their own column; merge for legacy configs.
-        config: {
-          ...form.config || {},
-          ...isRecord2(form.notify) && Object.keys(form.notify).length > 0 ? { notify: form.notify } : {}
-        },
+        config: notificationConfig,
         successMessage: String(form.success_message || ""),
         data: result.normalizedData,
-        siteName: options.siteName
+        siteName: options.siteName,
+        autoReplyAllowed: await maySendAutoReply(notificationConfig, result.normalizedData)
       });
     }
     return json({ success: true, id: created.id });
@@ -1571,11 +1770,17 @@ function createCmsRoutes(options) {
     if (!isOriginAllowed(request, allowedOrigins)) return errors.forbidden();
     const userAgent = request.headers.get("user-agent") || "";
     if (isBotRequest(userAgent)) return json({ success: true });
+    const now = Date.now();
+    if (await analyticsLimits.siteRequestsPerMinute.isLimited("all", now) || await analyticsLimits.siteRequestsPerDay.isLimited("all", now)) {
+      return json({ success: true });
+    }
     const key = hashedClientKey(clientKey(request));
-    if (await eventsRateLimit.isLimited(key, Date.now())) return json({ success: true });
+    if (await analyticsLimits.requestsPerMinute.isLimited(key, now)) {
+      return json({ success: true });
+    }
     const body = await readJsonLimited(request, { maxBytes: 128 * 1024, maxDepth: 8 });
     if (!body) return json({ success: true });
-    const { rows } = parseEventBatch(body, {
+    const parsed = parseEventBatch(body, {
       sessionKey: requestSessionKey(request),
       visitorKey: visitorKeyFor(
         body?.visitorId,
@@ -1584,9 +1789,25 @@ function createCmsRoutes(options) {
       device: deviceFrom(userAgent),
       ...geoFrom(request)
     });
+    const rows = parsed.rows.filter(
+      (row) => !(row.type === "form" && row.name.endsWith(":submit"))
+    );
     if (rows.length > 0) {
+      const limitChecks = [
+        [analyticsLimits.clientEventsPerMinute, key],
+        [analyticsLimits.clientEventsPerDay, key],
+        [analyticsLimits.siteEventsPerMinute, "all"],
+        [analyticsLimits.siteEventsPerDay, "all"]
+      ];
+      for (const [limit, limitKey] of limitChecks) {
+        if (await limit.isLimited(limitKey, now, rows.length)) {
+          return json({ success: true });
+        }
+      }
       try {
-        await db().from("cms_events").insert(rows);
+        await db().from("cms_events").insert(
+          rows.map((row) => ({ ...row, server_verified: false }))
+        );
       } catch {
       }
     }
@@ -1596,7 +1817,7 @@ function createCmsRoutes(options) {
     const all = [];
     let cursor = 0;
     for (let page = 0; page < 60; page += 1) {
-      const { data, error } = await db().from("cms_events").select("id, session_key, type, name, path, referrer, utm, device, region, city, meta, created_at").gte("created_at", fromIso).lte("created_at", toIso).gt("id", cursor).order("id", { ascending: true }).limit(1e3);
+      const { data, error } = await db().from("cms_events").select("id, session_key, type, name, path, referrer, utm, device, region, city, meta, server_verified, created_at").gte("created_at", fromIso).lte("created_at", toIso).gt("id", cursor).order("id", { ascending: true }).limit(1e3);
       if (error || !data || data.length === 0) break;
       all.push(...data);
       cursor = Number(data[data.length - 1].id);
@@ -1623,8 +1844,10 @@ function createCmsRoutes(options) {
   };
   const pruneEvents = async () => {
     const cutoff = new Date(Date.now() - analyticsRetentionDays * 864e5).toISOString();
+    const limitCutoff = new Date(Date.now() - 2 * 864e5).toISOString();
     try {
       await db().from("cms_events").delete().lt("created_at", cutoff);
+      await db().rpc("cms_prune_rate_limits", { p_before: limitCutoff });
     } catch {
     }
   };
@@ -1872,7 +2095,6 @@ function createCmsRoutes(options) {
         return listVersions(request, second);
       }
     }
-    if (head === "preview" && !second && method === "GET") return previewPage(request);
     if (head === "versions" && second) {
       if (third === "restore" && method === "POST") return restoreVersion(request, second);
       if (!third && method === "GET") return getVersion(request, second);
@@ -2262,7 +2484,11 @@ function runRpc(store, fn, args = {}) {
       const limits = store.table("cms_rate_limits");
       const key = String(args.p_key);
       const max = Number(args.p_max);
+      const cost = args.p_cost === void 0 ? 1 : Number(args.p_cost);
       const windowMs = Number(args.p_window_seconds) * 1e3;
+      if (!Number.isSafeInteger(cost) || cost < 1 || cost > max) {
+        return { data: false, error: null };
+      }
       const nowMs = Date.now();
       let row = limits.find((r) => r.key === key);
       if (!row) {
@@ -2271,12 +2497,22 @@ function runRpc(store, fn, args = {}) {
       }
       if (nowMs - Number(row.window_start) >= windowMs) {
         row.window_start = nowMs;
-        row.count = 1;
+        row.count = cost;
       } else {
-        row.count = Number(row.count) + 1;
+        row.count = Number(row.count) + cost;
       }
       return { data: Number(row.count) <= max, error: null };
     }
+    case "cms_prune_rate_limits": {
+      const before = Date.parse(String(args.p_before));
+      const limits = store.table("cms_rate_limits");
+      const kept = limits.filter((row) => {
+        const started = typeof row.window_start === "number" ? row.window_start : Date.parse(String(row.window_start));
+        return !Number.isFinite(before) || !Number.isFinite(started) || started >= before;
+      });
+      store.setTable("cms_rate_limits", kept);
+      return { data: limits.length - kept.length, error: null };
+    }
     case "cms_publish_due_pages": {
       const nowMs = Date.now();
       const published = [];
@@ -2409,6 +2645,7 @@ function getMemoryCms() {
 export {
   CONTENT_CACHE_TAG,
   MEMORY_DEV_TOKEN,
+  PREVIEW_SESSION_COOKIE,
   PREVIEW_TOKEN_TTL_MS,
   aggregateAnalytics,
   can,