@orion-studios/cms 0.5.5 → 0.5.6

package/dist/{chunk-LQTXMLKZ.js → chunk-CFZP7674.js}

@@ -274,6 +274,25 @@ function collectFieldDefinitions(config) {
   }
   return definitions;
 }
+function getAutoReplyEmailFields(config) {
+  const fieldTypes = /* @__PURE__ */ new Map();
+  for (const definition of collectFieldDefinitions(config)) {
+    const types = fieldTypes.get(definition.name) || /* @__PURE__ */ new Set();
+    types.add(definition.type);
+    fieldTypes.set(definition.name, types);
+  }
+  return [...fieldTypes.entries()].filter(([, types]) => types.size === 1 && types.has("email")).map(([name]) => name);
+}
+function resolveAutoReplyEmailField(config) {
+  const eligibleFields = getAutoReplyEmailFields(config);
+  const configuredValue = config.notify?.autoReplyEmailField;
+  if (configuredValue !== void 0 && typeof configuredValue !== "string") return null;
+  const configuredField = configuredValue?.trim();
+  if (configuredField) {
+    return eligibleFields.includes(configuredField) ? configuredField : null;
+  }
+  return eligibleFields.length === 1 ? eligibleFields[0] : null;
+}
 var MAX_UNKNOWN_FIELDS = 20;
 var MAX_VALUE_LENGTH = 5e3;
 function validateChoice(definition, rawValue) {
@@ -443,6 +462,8 @@ export {
   fieldOptions,
   HONEYPOT_FIELD_NAME,
   createMemoryRateLimitStore,
+  getAutoReplyEmailFields,
+  resolveAutoReplyEmailField,
   processSubmission,
   isOriginAllowed
 };

package/dist/{chunk-2BCEB26C.js → chunk-ULE565KD.js}

@@ -221,6 +221,32 @@ function fieldOptions(field) {
 
 // src/forms/submission.ts
 var HONEYPOT_FIELD_NAME = "website_url_confirm";
+function collectFieldDefinitions(config) {
+  const definitions = [];
+  for (const step of config.steps || []) {
+    for (const field of step.fields || []) {
+      const name = typeof field.name === "string" ? field.name.trim() : "";
+      if (!name) continue;
+      definitions.push({
+        name,
+        type: inferFieldType(field),
+        required: field.required === true,
+        label: typeof field.label === "string" && field.label.length > 0 ? field.label : name,
+        options: fieldOptions(field)
+      });
+    }
+  }
+  return definitions;
+}
+function getAutoReplyEmailFields(config) {
+  const fieldTypes = /* @__PURE__ */ new Map();
+  for (const definition of collectFieldDefinitions(config)) {
+    const types = fieldTypes.get(definition.name) || /* @__PURE__ */ new Set();
+    types.add(definition.type);
+    fieldTypes.set(definition.name, types);
+  }
+  return [...fieldTypes.entries()].filter(([, types]) => types.size === 1 && types.has("email")).map(([name]) => name);
+}
 
 // src/forms/react.tsx
 import { jsx, jsxs } from "react/jsx-runtime";
@@ -522,5 +548,6 @@ function FormRenderer({
 
 export {
   FORM_FIELD_TYPES,
+  getAutoReplyEmailFields,
   FormRenderer
 };

package/dist/forms/index.d.ts

@@ -1,4 +1,4 @@
-export { F as FormConfig, a as FormFieldConfig, b as FormNotifyConfig, H as HONEYPOT_FIELD_NAME, P as ProcessSubmissionArgs, c as ProcessSubmissionResult, R as RateLimitStore, d as createMemoryRateLimitStore, p as processSubmission } from '../submission-D_x2qNJl.js';
+export { F as FormConfig, a as FormFieldConfig, b as FormNotifyConfig, H as HONEYPOT_FIELD_NAME, P as ProcessSubmissionArgs, c as ProcessSubmissionResult, R as RateLimitStore, d as createMemoryRateLimitStore, g as getAutoReplyEmailFields, p as processSubmission, r as resolveAutoReplyEmailField } from '../submission-CGz0lElf.js';
 
 /**
  * Shared, isomorphic form validation and normalization.

package/dist/forms/index.js

@@ -4,31 +4,35 @@ import {
   createMemoryRateLimitStore,
   fieldOptions,
   formatPhoneUS,
+  getAutoReplyEmailFields,
   inferFieldType,
   normalizeEmail,
   normalizeFieldValue,
   normalizePhone,
   normalizeUrl,
   processSubmission,
+  resolveAutoReplyEmailField,
   validateDate,
   validateEmail,
   validateNumber,
   validatePhoneUS,
   validateRequired,
   validateUrl
-} from "../chunk-LQTXMLKZ.js";
+} from "../chunk-CFZP7674.js";
 export {
   FORM_FIELD_TYPES,
   HONEYPOT_FIELD_NAME,
   createMemoryRateLimitStore,
   fieldOptions,
   formatPhoneUS,
+  getAutoReplyEmailFields,
   inferFieldType,
   normalizeEmail,
   normalizeFieldValue,
   normalizePhone,
   normalizeUrl,
   processSubmission,
+  resolveAutoReplyEmailField,
   validateDate,
   validateEmail,
   validateNumber,

package/dist/forms/react.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
-import { F as FormConfig } from '../submission-CzrfXu17.js';
+import { F as FormConfig } from '../submission-CKZgx1h7.js';
 
 /**
  * The shared, config-driven form renderer: the same component renders a form

package/dist/forms/react.js

@@ -2,7 +2,7 @@
 "use client";
 import {
   FormRenderer
-} from "../chunk-2BCEB26C.js";
+} from "../chunk-ULE565KD.js";
 export {
   FormRenderer
 };

package/dist/server/index.d.ts

@@ -1,6 +1,6 @@
 import { SupabaseClient } from '@supabase/supabase-js';
 import { BlockRegistry, PageLayout } from '../blocks/index.js';
-import { F as FormConfig, R as RateLimitStore } from '../submission-D_x2qNJl.js';
+import { F as FormConfig, R as RateLimitStore } from '../submission-CGz0lElf.js';
 export { CONTENT_CACHE_TAG } from '../content/index.js';
 import 'react';
 import 'zod';
@@ -34,6 +34,8 @@ type NotifySubmissionArgs = {
     successMessage?: string;
     data: Record<string, unknown>;
     siteName?: string;
+    /** Caller confirmation that abuse controls admitted this auto-reply. */
+    autoReplyAllowed?: boolean;
 };
 /**
  * Sends the notification email(s) for one accepted submission: a copy to each
@@ -79,6 +81,12 @@ type CmsRoutesOptions = {
         siteEventsPerMinute: number;
         siteEventsPerDay: number;
     }>;
+    /** Optional stricter auto-reply budgets. Values cannot raise defaults. */
+    autoReplyLimits?: Partial<{
+        recipientPerHour: number;
+        sitePerMinute: number;
+        sitePerDay: number;
+    }>;
     /**
      * Dev-only: uploads are stored as data URLs instead of Supabase Storage so
      * the memory backend can serve them. Never enable in production.
@@ -112,6 +120,7 @@ declare function createCmsRoutes(options: CmsRoutesOptions): {
 };
 
 declare const PREVIEW_TOKEN_TTL_MS: number;
+declare const PREVIEW_SESSION_COOKIE = "orion_preview_session";
 declare function createPreviewToken(pageId: string, secret: string, ttlMs?: number): string;
 /** Returns the page id when the token is valid and unexpired, else null. */
 declare function verifyPreviewToken(token: string, secret: string): string | null;
@@ -414,4 +423,4 @@ declare function createMemoryCms(): MemoryCms;
 /** Process-wide singleton for Next.js dev servers (module state survives HMR via globalThis). */
 declare function getMemoryCms(): MemoryCms;
 
-export { type AnalyticsEventType, type AnalyticsKpis, type AnalyticsSummary, type CmsAction, type CmsEnv, type CmsRole, type CmsRoutesOptions, type CmsUser, type EmailMessage, type EmailSender, type IncomingEvent, MEMORY_DEV_TOKEN, type MemoryCms, PREVIEW_TOKEN_TTL_MS, type PreviewPage, type ResendSenderOptions, type StoredEvent, type SyncFormInput, type SyncGlobalInput, type SyncInput, type SyncMediaInput, type SyncPageInput, type SyncResult, aggregateAnalytics, can, createCmsRoutes, createDurableRateLimitStore, createMemoryCms, createPreviewToken, createResendSender, deviceFrom, formatSubmissionText, geoFrom, getMemoryCms, getPreviewPage, getServiceClient, isBotRequest, isStructuralChange, notifySubmission, parseEventBatch, readCmsEnv, resolveUser, runContentSync, sessionKeyFor, setServiceClientForTesting, verifyPreviewToken, visitorKeyFor };
+export { type AnalyticsEventType, type AnalyticsKpis, type AnalyticsSummary, type CmsAction, type CmsEnv, type CmsRole, type CmsRoutesOptions, type CmsUser, type EmailMessage, type EmailSender, type IncomingEvent, MEMORY_DEV_TOKEN, type MemoryCms, PREVIEW_SESSION_COOKIE, PREVIEW_TOKEN_TTL_MS, type PreviewPage, type ResendSenderOptions, type StoredEvent, type SyncFormInput, type SyncGlobalInput, type SyncInput, type SyncMediaInput, type SyncPageInput, type SyncResult, aggregateAnalytics, can, createCmsRoutes, createDurableRateLimitStore, createMemoryCms, createPreviewToken, createResendSender, deviceFrom, formatSubmissionText, geoFrom, getMemoryCms, getPreviewPage, getServiceClient, isBotRequest, isStructuralChange, notifySubmission, parseEventBatch, readCmsEnv, resolveUser, runContentSync, sessionKeyFor, setServiceClientForTesting, verifyPreviewToken, visitorKeyFor };

package/dist/server/index.js

@@ -1,14 +1,16 @@
-import {
-  createMemoryRateLimitStore,
-  isOriginAllowed,
-  processSubmission
-} from "../chunk-LQTXMLKZ.js";
 import {
   CONTENT_CACHE_TAG
 } from "../chunk-AYV6KYDP.js";
+import {
+  createMemoryRateLimitStore,
+  getAutoReplyEmailFields,
+  isOriginAllowed,
+  processSubmission,
+  resolveAutoReplyEmailField
+} from "../chunk-CFZP7674.js";
 
 // src/server/routes.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash2, createHmac as createHmac3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 
 // src/analytics/aggregate.ts
 var CONVERSION_NAMES = /* @__PURE__ */ new Set(["call", "email"]);
@@ -340,12 +342,16 @@ ${rendered}
   }
   return lines.join("\n");
 }
+function resolveSubmitterEmail(config, data) {
+  const fieldName = resolveAutoReplyEmailField(config);
+  if (!fieldName) return void 0;
+  const value = data[fieldName];
+  return isEmail(value) ? value.trim().toLowerCase() : void 0;
+}
 async function notifySubmission(args) {
   const notify = args.config.notify || {};
   const recipients = (notify.emails || []).filter(isEmail);
-  const submitterEmail = Object.entries(args.data).find(
-    ([key, value]) => key.toLowerCase().includes("email") && isEmail(value)
-  )?.[1];
+  const submitterEmail = resolveSubmitterEmail(args.config, args.data);
   const subject = (notify.subject || "New {form} submission").replace(
     /\{form\}/g,
     args.formTitle || "form"
@@ -362,7 +368,7 @@ async function notifySubmission(args) {
       console.error("[orion-cms] submission notification failed:", error);
     }
   }
-  if (notify.autoReply && submitterEmail) {
+  if (notify.autoReply === true && submitterEmail && args.autoReplyAllowed === true) {
     try {
       await args.sendEmail({
         to: [submitterEmail],
@@ -431,12 +437,15 @@ var encode = (value) => Buffer.from(value, "utf8").toString("base64url");
 var decode = (value) => Buffer.from(value, "base64url").toString("utf8");
 var sign = (payload, secret) => createHmac2("sha256", secret).update(payload).digest("base64url");
 var PREVIEW_TOKEN_TTL_MS = 60 * 60 * 1e3;
+var PREVIEW_SESSION_COOKIE = "orion_preview_session";
 function createPreviewToken(pageId, secret, ttlMs = PREVIEW_TOKEN_TTL_MS) {
   const payload = encode(`${pageId}|${Date.now() + ttlMs}`);
   return `${payload}.${sign(payload, secret)}`;
 }
 function verifyPreviewToken(token, secret) {
-  const [payload, signature] = token.split(".");
+  const segments = token.split(".");
+  if (segments.length !== 2) return null;
+  const [payload, signature] = segments;
   if (!payload || !signature) return null;
   const expected = sign(payload, secret);
   const expectedBuffer = Buffer.from(expected);
@@ -649,7 +658,6 @@ async function runContentSync(client, registry, input) {
 }
 
 // src/server/routes.ts
-import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var tokenEquals = (candidate, secret) => {
   if (!candidate || !secret) return false;
   const a = Buffer.from(candidate);
@@ -802,6 +810,44 @@ function createCmsRoutes(options) {
     return options.previewSecret || process.env.SUPABASE_SERVICE_ROLE_KEY || (options.memoryMode ? "orion-memory-preview-secret" : "");
   };
   const analyticsLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
+  const autoReplyLimit = (max, windowMs, bucket) => options.memoryMode ? createMemoryRateLimitStore({ max, windowMs }) : createDurableRateLimitStore(db, { max, windowMs, bucket, failClosed: true });
+  const boundedAutoReplyMax = (name, fallback) => {
+    const candidate = options.autoReplyLimits?.[name];
+    return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? Math.min(candidate, fallback) : fallback;
+  };
+  const autoReplyLimits = {
+    recipientPerHour: autoReplyLimit(
+      boundedAutoReplyMax("recipientPerHour", 3),
+      36e5,
+      "auto-reply-recipient-hour"
+    ),
+    sitePerMinute: autoReplyLimit(
+      boundedAutoReplyMax("sitePerMinute", 10),
+      6e4,
+      "auto-reply-site-minute"
+    ),
+    sitePerDay: autoReplyLimit(
+      boundedAutoReplyMax("sitePerDay", 200),
+      864e5,
+      "auto-reply-site-day"
+    )
+  };
+  const autoReplyRecipientKey = (email) => createHmac3(
+    "sha256",
+    previewSecret() || syncToken || "orion-memory-auto-reply-secret"
+  ).update(`recipient:${email}`).digest("hex").slice(0, 24);
+  const maySendAutoReply = async (config, data) => {
+    if (config.notify?.autoReply !== true) return false;
+    const recipient = resolveSubmitterEmail(config, data);
+    if (!recipient) return false;
+    const now = Date.now();
+    if (await autoReplyLimits.recipientPerHour.isLimited(autoReplyRecipientKey(recipient), now)) {
+      return false;
+    }
+    if (await autoReplyLimits.sitePerMinute.isLimited("all", now)) return false;
+    if (await autoReplyLimits.sitePerDay.isLimited("all", now)) return false;
+    return true;
+  };
   const boundedAnalyticsMax = (name, fallback) => {
     const candidate = options.analyticsLimits?.[name];
     return typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate > 0 ? Math.min(candidate, fallback) : fallback;
@@ -1126,27 +1172,16 @@ function createCmsRoutes(options) {
     const { data } = await db().from("cms_pages").select("id, path").eq("id", id).maybeSingle();
     if (!data) return errors.notFound();
     const token = createPreviewToken(id, secret);
-    return json({ token, path: data.path, url: `${data.path}?preview=${encodeURIComponent(token)}` });
-  };
-  const previewPage = async (request) => {
-    if (hostedMemoryMode) return errors.notFound();
-    const secret = previewSecret();
-    if (!secret) return errors.notFound();
-    const token = new URL(request.url).searchParams.get("token") || "";
-    const pageId = verifyPreviewToken(token, secret);
-    if (!pageId) return errors.forbidden();
-    const { data } = await db().from("cms_pages").select("id, slug, path, title, seo, draft_layout").eq("id", pageId).maybeSingle();
-    if (!data) return errors.notFound();
-    return json({
-      page: {
-        id: data.id,
-        slug: data.slug,
-        path: data.path,
-        title: data.title,
-        seo: data.seo ?? {},
-        layout: data.draft_layout ?? []
-      }
-    });
+    const previewUrl = `/cms-preview/${encodeURIComponent(String(data.id))}`;
+    const response = json({ path: data.path, url: previewUrl });
+    const secure = process.env.NODE_ENV === "production" || new URL(request.url).protocol === "https:";
+    response.headers.set("cache-control", "private, no-store");
+    response.headers.set("referrer-policy", "no-referrer");
+    response.headers.append(
+      "set-cookie",
+      `${PREVIEW_SESSION_COOKIE}=${token}; Path=${previewUrl}; HttpOnly; SameSite=Strict; Max-Age=${Math.floor(PREVIEW_TOKEN_TTL_MS / 1e3)}${secure ? "; Secure" : ""}`
+    );
+    return response;
   };
   const listVersions = async (request, id) => {
     const auth = await guard(request, "pages.restore");
@@ -1478,8 +1513,32 @@ function createCmsRoutes(options) {
     const body = await readJson(request);
     if (!body) return errors.badRequest("Invalid body.");
     const config = isRecord2(body.config) ? { ...body.config } : {};
-    const notify = isRecord2(body.notify) ? body.notify : isRecord2(config.notify) ? config.notify : {};
+    if (body.notify !== void 0 && !isRecord2(body.notify)) {
+      return errors.badRequest("Notification settings must be an object.");
+    }
+    if (body.notify === void 0 && config.notify !== void 0 && !isRecord2(config.notify)) {
+      return errors.badRequest("Notification settings must be an object.");
+    }
+    const rawNotify = isRecord2(body.notify) ? body.notify : isRecord2(config.notify) ? config.notify : {};
     delete config.notify;
+    if (rawNotify.autoReply !== void 0 && typeof rawNotify.autoReply !== "boolean") {
+      return errors.badRequest("autoReply must be a boolean.");
+    }
+    if (rawNotify.autoReplyEmailField !== void 0 && (typeof rawNotify.autoReplyEmailField !== "string" || !rawNotify.autoReplyEmailField.trim())) {
+      return errors.badRequest("autoReplyEmailField must name a declared email field.");
+    }
+    const emailFields = getAutoReplyEmailFields(config);
+    const selectedEmailField = typeof rawNotify.autoReplyEmailField === "string" ? rawNotify.autoReplyEmailField.trim() : "";
+    if (selectedEmailField && !emailFields.includes(selectedEmailField)) {
+      return errors.badRequest("autoReplyEmailField must name a declared email field.");
+    }
+    if (rawNotify.autoReply === true && emailFields.length !== 1 && !selectedEmailField) {
+      return errors.badRequest("Auto-reply requires one selected declared email field.");
+    }
+    const notify = {
+      ...rawNotify,
+      ...selectedEmailField ? { autoReplyEmailField: selectedEmailField } : {}
+    };
     const { data, error } = await db().from("cms_forms").upsert(
       {
         slug,
@@ -1542,7 +1601,7 @@ function createCmsRoutes(options) {
   const csvEscape = (value) => {
     let text = Array.isArray(value) ? value.join("; ") : typeof value === "string" ? value : value === null || value === void 0 ? "" : JSON.stringify(value);
     if (/^[=+\-@\t\r]/.test(text)) text = `'${text}`;
-    return /[",\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
+    return /[",\r\n]/.test(text) ? `"${text.replace(/"/g, '""')}"` : text;
   };
   const exportSubmissions = async (request) => {
     const auth = await guard(request, "submissions.read");
@@ -1660,17 +1719,18 @@ function createCmsRoutes(options) {
     } catch {
     }
     if (sendEmail) {
+      const notificationConfig = {
+        ...form.config || {},
+        ...isRecord2(form.notify) && Object.keys(form.notify).length > 0 ? { notify: form.notify } : {}
+      };
       await notifySubmission({
         sendEmail,
         formTitle: String(form.title || form.slug),
-        // Notify settings live in their own column; merge for legacy configs.
-        config: {
-          ...form.config || {},
-          ...isRecord2(form.notify) && Object.keys(form.notify).length > 0 ? { notify: form.notify } : {}
-        },
+        config: notificationConfig,
         successMessage: String(form.success_message || ""),
         data: result.normalizedData,
-        siteName: options.siteName
+        siteName: options.siteName,
+        autoReplyAllowed: await maySendAutoReply(notificationConfig, result.normalizedData)
       });
     }
     return json({ success: true, id: created.id });
@@ -2035,7 +2095,6 @@ function createCmsRoutes(options) {
         return listVersions(request, second);
       }
     }
-    if (head === "preview" && !second && method === "GET") return previewPage(request);
     if (head === "versions" && second) {
       if (third === "restore" && method === "POST") return restoreVersion(request, second);
       if (!third && method === "GET") return getVersion(request, second);
@@ -2586,6 +2645,7 @@ function getMemoryCms() {
 export {
   CONTENT_CACHE_TAG,
   MEMORY_DEV_TOKEN,
+  PREVIEW_SESSION_COOKIE,
   PREVIEW_TOKEN_TTL_MS,
   aggregateAnalytics,
   can,

package/dist/studio/index.d.ts

@@ -2,7 +2,7 @@ import * as react from 'react';
 import { ComponentType, InputHTMLAttributes } from 'react';
 import { z } from 'zod';
 import { SupabaseClient, Session } from '@supabase/supabase-js';
-import { F as FormConfig, a as FormNotifyConfig } from '../submission-CzrfXu17.js';
+import { F as FormConfig, a as FormNotifyConfig } from '../submission-CKZgx1h7.js';
 
 /**
  * Editor field derivation: turns a block's Zod schema into a default editor
@@ -395,7 +395,6 @@ declare function createStudioApi(options: {
         success: true;
     }>;
     previewToken: (id: string) => Promise<{
-        token: string;
         path: string;
         url: string;
     }>;

package/dist/studio/index.js

@@ -2,8 +2,9 @@
 "use client";
 import {
   FORM_FIELD_TYPES,
-  FormRenderer
-} from "../chunk-2BCEB26C.js";
+  FormRenderer,
+  getAutoReplyEmailFields
+} from "../chunk-ULE565KD.js";
 
 // src/studio/Studio.tsx
 import { useCallback as useCallback5, useEffect as useEffect11, useMemo as useMemo5, useState as useState12 } from "react";
@@ -988,6 +989,7 @@ function FormEditor({
   const [notifyEmails, setNotifyEmails] = useState5("");
   const [notifySubject, setNotifySubject] = useState5("");
   const [autoReply, setAutoReply] = useState5(false);
+  const [autoReplyEmailField, setAutoReplyEmailField] = useState5("");
   const [dirty, setDirty] = useState5(false);
   const [message, setMessage] = useState5("");
   const [error, setError] = useState5("");
@@ -1005,6 +1007,10 @@ function FormEditor({
       setNotifyEmails((notify.emails || []).join(", "));
       setNotifySubject(notify.subject || "");
       setAutoReply(notify.autoReply === true);
+      const emailFields = getAutoReplyEmailFields(loadedConfig);
+      setAutoReplyEmailField(
+        notify.autoReplyEmailField && emailFields.includes(notify.autoReplyEmailField) ? notify.autoReplyEmailField : emailFields.length === 1 ? emailFields[0] : ""
+      );
     }, (e) => setError(e.message));
   }, [api, slug]);
   const touch = () => {
@@ -1027,6 +1033,12 @@ function FormEditor({
   const save = async () => {
     setError("");
     const emails = notifyEmails.split(/[,\s]+/).map((entry) => entry.trim()).filter(Boolean);
+    const emailFields = getAutoReplyEmailFields(config);
+    const selectedEmailField = emailFields.includes(autoReplyEmailField) ? autoReplyEmailField : emailFields.length === 1 ? emailFields[0] : "";
+    if (autoReply && !selectedEmailField) {
+      setError("Choose one declared email field before enabling auto-reply.");
+      return;
+    }
     try {
       const { form: saved } = await api.updateForm(slug, {
         title,
@@ -1034,7 +1046,8 @@ function FormEditor({
         notify: {
           emails,
           ...notifySubject.trim() ? { subject: notifySubject.trim() } : {},
-          autoReply
+          autoReply,
+          ...autoReply && selectedEmailField ? { autoReplyEmailField: selectedEmailField } : {}
         },
         successMessage
       });
@@ -1048,6 +1061,8 @@ function FormEditor({
   if (!form && !error) return /* @__PURE__ */ jsx5("div", { className: "ost-loading", children: "Loading form\u2026" });
   if (error && !form) return /* @__PURE__ */ jsx5("div", { className: "ost-error", children: error });
   const steps = config.steps || [];
+  const autoReplyEmailFields = getAutoReplyEmailFields(config);
+  const selectedAutoReplyEmailField = autoReplyEmailFields.includes(autoReplyEmailField) ? autoReplyEmailField : autoReplyEmailFields.length === 1 ? autoReplyEmailFields[0] : "";
   return /* @__PURE__ */ jsxs5("div", { className: "ost-view ost-view-wide", children: [
     /* @__PURE__ */ jsxs5("header", { className: "ost-view-header", children: [
       /* @__PURE__ */ jsxs5("div", { className: "ost-row", children: [
@@ -1212,7 +1227,26 @@ function FormEditor({
             ),
             "Auto-reply to the submitter with the success message"
           ] }),
-          /* @__PURE__ */ jsx5("p", { className: "ost-muted", children: "Requires the site's email sending to be configured (RESEND_API_KEY)." })
+          autoReply ? /* @__PURE__ */ jsxs5("label", { className: "ost-label", children: [
+            "Auto-reply email field",
+            /* @__PURE__ */ jsxs5(
+              "select",
+              {
+                className: "ost-input",
+                disabled: !canWrite || autoReplyEmailFields.length === 0,
+                onChange: (event) => {
+                  setAutoReplyEmailField(event.target.value);
+                  touch();
+                },
+                value: selectedAutoReplyEmailField,
+                children: [
+                  autoReplyEmailFields.length !== 1 ? /* @__PURE__ */ jsx5("option", { value: "", children: "Choose an email field" }) : null,
+                  autoReplyEmailFields.map((fieldName) => /* @__PURE__ */ jsx5("option", { value: fieldName, children: fieldName }, fieldName))
+                ]
+              }
+            )
+          ] }) : null,
+          /* @__PURE__ */ jsx5("p", { className: "ost-muted", children: "Auto-reply requires a declared email field and configured email sending (RESEND_API_KEY)." })
         ] })
       ] }),
       /* @__PURE__ */ jsxs5("div", { className: "ost-form-preview", children: [
@@ -2225,7 +2259,7 @@ function PageEditor({
     setBusy("preview");
     try {
       const { url } = await api.previewToken(pageId);
-      window.open(url, "_blank", "noopener");
+      window.open(url, "_blank", "noopener,noreferrer");
     } catch (previewError) {
       setError(previewError instanceof Error ? previewError.message : "Preview failed.");
     } finally {

package/dist/{submission-D_x2qNJl.d.ts → submission-CGz0lElf.d.ts}

@@ -24,6 +24,8 @@ type FormNotifyConfig = {
     subject?: string;
     /** Send the success message back to the submitter's email field. */
     autoReply?: boolean;
+    /** Declared email field used for staff reply-to and auto-replies. */
+    autoReplyEmailField?: string;
 };
 type FormConfig = {
     steps?: Array<{
@@ -39,6 +41,13 @@ declare function createMemoryRateLimitStore(options?: {
     max?: number;
     windowMs?: number;
 }): RateLimitStore;
+/**
+ * Returns unambiguous declared email fields in form order. A repeated name is
+ * eligible only when every declaration for that name is an email field.
+ */
+declare function getAutoReplyEmailFields(config: FormConfig): string[];
+/** Resolves the one declared field that may control submission email delivery. */
+declare function resolveAutoReplyEmailField(config: FormConfig): string | null;
 type ProcessSubmissionArgs = {
     config: FormConfig;
     data: Record<string, unknown>;
@@ -58,4 +67,4 @@ type ProcessSubmissionResult = {
 };
 declare function processSubmission(args: ProcessSubmissionArgs): ProcessSubmissionResult;
 
-export { type FormConfig as F, HONEYPOT_FIELD_NAME as H, type ProcessSubmissionArgs as P, type RateLimitStore as R, type FormFieldConfig as a, type FormNotifyConfig as b, type ProcessSubmissionResult as c, createMemoryRateLimitStore as d, processSubmission as p };
+export { type FormConfig as F, HONEYPOT_FIELD_NAME as H, type ProcessSubmissionArgs as P, type RateLimitStore as R, type FormFieldConfig as a, type FormNotifyConfig as b, type ProcessSubmissionResult as c, createMemoryRateLimitStore as d, getAutoReplyEmailFields as g, processSubmission as p, resolveAutoReplyEmailField as r };

package/dist/{submission-CzrfXu17.d.ts → submission-CKZgx1h7.d.ts}

@@ -18,6 +18,8 @@ type FormNotifyConfig = {
     subject?: string;
     /** Send the success message back to the submitter's email field. */
     autoReply?: boolean;
+    /** Declared email field used for staff reply-to and auto-replies. */
+    autoReplyEmailField?: string;
 };
 type FormConfig = {
     steps?: Array<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-studios/cms",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Orion CMS v2 core engine \u2014 JSONB content model on Supabase primitives",
   "type": "module",
   "exports": {