@stapel/forms-react 0.1.0

package/package.json

@@ -0,0 +1,108 @@
+{
+  "name": "@stapel/forms-react",
+  "version": "0.1.0",
+  "description": "Headless React pair for stapel-forms: typed API client, TanStack Query hooks, LoadState-disciplined headless bags (fill / builder / responses / list), a per-kind field-widget registry over the stapel-attributes vocabulary, client-side validation that mirrors the server's own error keys, the captcha_token seam and the X-Forms-Next-Before CSV export cursor. Zero visual opinion in the main entry; an opt-in /default subpath ships the self-themed antd skin (StapelForm, FormBuilderPane, ResponsesPane, FormsListPane) — every field widget and skin slot swappable without a fork.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/usestapel/stapel-react.git",
+    "directory": "packages/forms-react"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./default": {
+      "types": "./dist/default/index.d.ts",
+      "default": "./dist/default/index.js"
+    },
+    "./i18n/ru": {
+      "types": "./dist/i18n/ru.d.ts",
+      "default": "./dist/i18n/ru.js"
+    },
+    "./i18n/es": {
+      "types": "./dist/i18n/es.d.ts",
+      "default": "./dist/i18n/es.js"
+    },
+    "./manifest": "./manifest.json",
+    "./manifest.json": "./manifest.json",
+    "./llms.txt": "./llms.txt",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "tsconfig.json",
+    "README.md",
+    "MODULE.md",
+    "CHANGELOG.md",
+    "manifest.json",
+    "llms.txt"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.test.json && vitest run --exclude test/prodBundlePurity.test.ts",
+    "lint": "eslint .",
+    "size": "size-limit",
+    "test:pack": "vitest run test/prodBundlePurity.test.ts"
+  },
+  "size-limit": [
+    {
+      "name": "index — headless forms pair (client + hooks + bags + widget registry + i18n)",
+      "path": "dist/index.js",
+      "limit": "12 KB"
+    },
+    {
+      "name": "default — the antd skin (form renderer, builder, responses) must stay out of the main bundle",
+      "path": "dist/default/index.js",
+      "limit": "18 KB"
+    },
+    {
+      "name": "i18n/ru — the Russian bundle is opt-in, not carried by the main entry",
+      "path": "dist/i18n/ru.js",
+      "limit": "5 KB"
+    },
+    {
+      "name": "i18n/es — the Spanish bundle is opt-in, not carried by the main entry",
+      "path": "dist/i18n/es.js",
+      "limit": "4 KB"
+    }
+  ],
+  "peerDependencies": {
+    "@stapel/core": ">=0.14.0 <1.0.0",
+    "@stapel/tokens-antd": ">=0.5.0",
+    "@tanstack/react-query": "^5.0.0",
+    "antd": ">=5.20.0 <7",
+    "react": ">=19"
+  },
+  "devDependencies": {
+    "@size-limit/preset-small-lib": "^11.2.0",
+    "@stapel/core": "workspace:^",
+    "@stapel/showcase": "workspace:^",
+    "@stapel/tokens": "workspace:^",
+    "@stapel/tokens-antd": "workspace:*",
+    "@tanstack/react-query": "^5.81.0",
+    "@testing-library/react": "^16.3.0",
+    "@types/react": "^19.1.0",
+    "@types/react-dom": "^19.1.0",
+    "antd": "^6.5.0",
+    "jsdom": "^26.1.0",
+    "msw": "^2.10.2",
+    "react": "^19.1.0",
+    "react-dom": "^19.1.0",
+    "size-limit": "^11.2.0",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/analytics/generated/events.json

@@ -0,0 +1,7 @@
+{
+  "$generated": "by scripts/gen-events.mjs — do not edit; drift-gated (pnpm gen:events:check)",
+  "package": "@stapel/forms-react",
+  "version": "0.1.0",
+  "defined": [],
+  "flows": []
+}

package/src/api/export.ts

@@ -0,0 +1,195 @@
+/**
+ * The CSV half of the stapel-forms surface — hand-authored api/ carve-out
+ * (the docs-react `api/content.ts` / recordings-react `uploadRecordingBlob`
+ * precedent, the one legal home of `fetch` per `stapel/no-raw-fetch`).
+ *
+ * `GET /forms/<id>/submissions/export` is not a JSON operation and cannot ride
+ * core's `StapelClient` for two independent reasons:
+ *
+ *  1. the body is a CSV file, and `StapelClient.request` parses/returns a
+ *     decoded JSON value;
+ *  2. the CONTINUATION CURSOR rides a response header,
+ *     `X-Forms-Next-Before` — which `StapelClient` does not surface at all.
+ *
+ * Backend delta note 6 explains why the cursor is a header rather than a
+ * trailing body field: the body is a spreadsheet, and a cursor appended to it
+ * lands as a row in somebody's export. The same note records why the value is
+ * **Z-suffixed** rather than isoformat — a bare `+00:00` in a query string
+ * decodes to a space, which made the second page a silent 400. This module
+ * therefore round-trips the header value VERBATIM into the next `?before=`
+ * and never re-formats it.
+ *
+ * Auth: the runtime's `credentials` / `defaultHeaders` are forwarded here, so
+ * a cookie-mode host works unchanged. The bearer-refresh and verification-403
+ * seams of `createStapelClient` do NOT run on this raw surface (the same v1
+ * limitation docs-react's raw transport documents); a 401 here throws like any
+ * other error status rather than triggering a refresh-and-retry.
+ */
+import { parseErrorEnvelope } from "@stapel/core";
+
+/**
+ * Raw-transport binding forwarded from the runtime. Declared here rather than
+ * in `formsApi.ts` so the two modules do not import each other's types in a
+ * cycle — `formsApi.ts` re-exports it as part of its public surface.
+ */
+export interface FormsApiOptions {
+  readonly fetch?: typeof globalThis.fetch;
+  readonly credentials?: RequestCredentials;
+  readonly defaultHeaders?: Record<string, string>;
+}
+
+/**
+ * Response header carrying the keyset cursor for the NEXT export page.
+ * Absent (or empty) means this was the last page.
+ */
+export const FORMS_NEXT_BEFORE_HEADER = "X-Forms-Next-Before";
+
+/** The raw-transport binding `createFormsApi` closes over. */
+export interface FormsRawTransport {
+  /** e.g. `/forms/api/v1` — the same base the pair's `StapelClient` uses. */
+  readonly baseUrl: string;
+  readonly fetch?: typeof globalThis.fetch;
+  readonly credentials?: RequestCredentials;
+  /** Merged into every raw request (e.g. a tenant id / auth header). */
+  readonly headers?: Record<string, string>;
+}
+
+/** One page of the CSV export. */
+export interface CsvExportPage {
+  /** The page's CSV text, header row included. */
+  readonly csv: string;
+  /**
+   * The cursor to pass as the next call's `before`, or `null` when the export
+   * is complete. Opaque — pass it back verbatim (see the module header).
+   */
+  readonly nextBefore: string | null;
+}
+
+/** Build the transport from the runtime options, dropping absent keys so
+ * `exactOptionalPropertyTypes` stays satisfied. */
+export function createExportTransport(
+  baseUrl: string,
+  options: FormsApiOptions
+): FormsRawTransport {
+  return {
+    baseUrl,
+    ...(options.fetch !== undefined ? { fetch: options.fetch } : {}),
+    ...(options.credentials !== undefined
+      ? { credentials: options.credentials }
+      : {}),
+    ...(options.defaultHeaders !== undefined
+      ? { headers: options.defaultHeaders }
+      : {}),
+  };
+}
+
+function exportUrl(
+  transport: FormsRawTransport,
+  formId: string,
+  query: Readonly<Record<string, string | number | undefined>>
+): string {
+  const base = transport.baseUrl.endsWith("/")
+    ? transport.baseUrl.slice(0, -1)
+    : transport.baseUrl;
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value !== undefined) search.set(key, String(value));
+  }
+  const qs = search.toString();
+  return (
+    `${base}/forms/${encodeURIComponent(formId)}/submissions/export` +
+    (qs.length > 0 ? `?${qs}` : "")
+  );
+}
+
+async function throwEnvelope(response: Response): Promise<never> {
+  const text = await response.text();
+  let body: unknown = text.length > 0 ? text : undefined;
+  if (text.length > 0) {
+    try {
+      body = JSON.parse(text) as unknown;
+    } catch {
+      /* a non-JSON error body stays the raw text */
+    }
+  }
+  throw parseErrorEnvelope(response.status, body);
+}
+
+/**
+ * Fetch one page of a form's CSV export.
+ *
+ * Drive it to completion by feeding {@link CsvExportPage.nextBefore} back in
+ * as `before` until it is `null`, concatenating the pages MINUS the repeated
+ * header row (see `useCsvExport`, which does exactly that).
+ */
+export async function exportSubmissionsCsv(
+  transport: FormsRawTransport,
+  params: {
+    readonly workspaceId: string;
+    readonly formId: string;
+    readonly before?: string;
+    readonly version?: number;
+    readonly signal?: AbortSignal;
+  }
+): Promise<CsvExportPage> {
+  const fetchImpl = transport.fetch ?? globalThis.fetch.bind(globalThis);
+  const headers = new Headers({ Accept: "text/csv" });
+  if (transport.headers) {
+    for (const [key, value] of Object.entries(transport.headers)) {
+      if (!headers.has(key)) headers.set(key, value);
+    }
+  }
+
+  const init: RequestInit = { method: "GET", headers };
+  if (transport.credentials !== undefined) init.credentials = transport.credentials;
+  if (params.signal) init.signal = params.signal;
+
+  const response = await fetchImpl(
+    exportUrl(transport, params.formId, {
+      workspace_id: params.workspaceId,
+      ...(params.before !== undefined ? { before: params.before } : {}),
+      ...(params.version !== undefined ? { version: params.version } : {}),
+    }),
+    init
+  );
+
+  if (!response.ok) return throwEnvelope(response);
+
+  const raw = response.headers.get(FORMS_NEXT_BEFORE_HEADER);
+  return {
+    csv: await response.text(),
+    // An empty header is "no more pages", not a cursor of "".
+    nextBefore: raw !== null && raw.length > 0 ? raw : null,
+  };
+}
+
+/**
+ * Concatenate export pages into one CSV, keeping the header row exactly once.
+ *
+ * Every page the server streams carries its own header row (it is a standalone
+ * CSV file); pasting the pages verbatim would sprinkle header rows through the
+ * middle of the spreadsheet. Splitting on the first newline is safe here
+ * because a stapel-forms header row is a list of field slugs — slugs cannot
+ * contain a newline, so the first line is always exactly the header.
+ *
+ * Each retained chunk is newline-terminated before the join: a page whose last
+ * row has no trailing newline would otherwise be glued to the next page's
+ * first row, silently producing one corrupt record per page boundary.
+ */
+export function concatCsvPages(pages: readonly string[]): string {
+  const nonEmpty = pages.filter((page) => page.length > 0);
+  const first = nonEmpty[0];
+  if (first === undefined) return "";
+  const chunks = [
+    first,
+    ...nonEmpty.slice(1).map((page) => {
+      const newline = page.indexOf("\n");
+      return newline === -1 ? "" : page.slice(newline + 1);
+    }),
+  ].filter((chunk) => chunk.length > 0);
+  return chunks
+    .map((chunk, index) =>
+      index === chunks.length - 1 || chunk.endsWith("\n") ? chunk : `${chunk}\n`
+    )
+    .join("");
+}

package/src/api/extensions.ts

@@ -0,0 +1,7 @@
+/**
+ * Hand-authored API surface the codegen does not (yet) cover — browser-redirect
+ * URL builders, open-redirect guards, narrow domain type-guards, header
+ * conventions. Everything that CAN be derived from schema.json belongs in the
+ * generated operations (`api/formsApi.ts`), not here.
+ */
+export {};

package/src/api/formsApi.ts

@@ -0,0 +1,329 @@
+import type { StapelClient, StapelRequestOptions } from "@stapel/core";
+import { createExportTransport, exportSubmissionsCsv } from "./export.js";
+import type {
+  CsvExportPage,
+  FormsApiOptions,
+  FormsRawTransport,
+} from "./export.js";
+import type {
+  FieldKind,
+  FieldKindCatalogue,
+  FormCreateRequest,
+  FormPatchRequest,
+  FormRow,
+  FormSchema,
+  FormState,
+  FormVersion,
+  PublicForm,
+  PublishResult,
+  ResendRequest,
+  ResendResult,
+  Submission,
+  SubmissionListParams,
+  SubmitRequest,
+  SubmitResult,
+} from "./types.js";
+
+/**
+ * CSRF rule for cookie-authenticated browser clients (mirrors auth-react and
+ * profiles-react): the simplest SPA rule is to always send
+ * `X-Requested-With: XMLHttpRequest` on mutating requests. Header-token clients
+ * ignore it; it is harmless there, so every mutation carries it.
+ *
+ * The two ANONYMOUS routes carry it too. They are unauthenticated, so there is
+ * no session for a cross-site POST to ride — but a host that mounts the form on
+ * a cookie-authenticated origin gets Django's CSRF middleware in the path
+ * anyway, and a header a server ignores costs nothing next to a submit that
+ * 403s only in production.
+ */
+const CSRF_HEADERS: Record<string, string> = {
+  "X-Requested-With": "XMLHttpRequest",
+};
+
+function mutating(
+  options?: Omit<StapelRequestOptions, "method" | "body">
+): Omit<StapelRequestOptions, "method" | "body"> {
+  return {
+    ...options,
+    headers: { ...CSRF_HEADERS, ...options?.headers },
+  };
+}
+
+/** URL-safe path segment. `public_id` is a non-enumerable token straight from
+ * the host's props, so it is encoded rather than trusted. */
+function seg(value: string): string {
+  return encodeURIComponent(value);
+}
+
+/** Every admin route is workspace-scoped by an explicit query parameter — the
+ * module never infers the workspace from the session. */
+function ws(workspaceId: string): { workspace_id: string } {
+  return { workspace_id: workspaceId };
+}
+
+/**
+ * The pair's typed operation surface — one method per stapel-forms endpoint a
+ * JS client may call, bound to the injected {@link StapelClient} (the
+ * per-module override seam of frontend-standard §7.2). Paths are relative to
+ * the runtime's `baseUrl` (e.g. `/forms/api/v1/`).
+ *
+ * Two families, and the split matters:
+ *
+ *  - **public** (`getPublicForm`, `submit`) — ANONYMOUS. No capability, no
+ *    workspace id, no session. A render-only host page needs nothing but
+ *    `createFormsRuntime({baseUrl})`; this is the standalone-embed property.
+ *  - **admin** — every one is `IsNotAnonymousUser` + `authorize()` +
+ *    `workspace_id`, gated on `forms.view` / `forms.manage` /
+ *    `forms.responses.view` / `forms.responses.manage`.
+ *
+ * These operations will be GENERATED from schema.json operationIds by gen-api
+ * v2 (task `core-typed-ops`); until then they are hand-authored here (the ONE
+ * legal home of path strings — `stapel/no-string-paths` §2.3 carve-out).
+ */
+export interface FormsApi {
+  readonly client: StapelClient;
+
+  // ── public, anonymous ──────────────────────────────────────────────────────
+
+  /**
+   * The active schema behind a public link. Refuses with
+   * `error.404.forms_not_found` (no such link / rotated / soft-deleted) or
+   * `error.410.forms_closed` — two DIFFERENT sentences a skin must not merge,
+   * and neither of which is "no form here" when the network is what failed.
+   */
+  getPublicForm(publicId: string): Promise<PublicForm>;
+
+  /**
+   * Submit answers. `answers` values are bare scalars keyed by slug; a `select`
+   * answer normalizes to a list server-side, so the caller need not wrap it.
+   *
+   * The refusals a renderer must tell apart: `409
+   * error.409.forms_version_superseded` (the schema moved under the
+   * respondent — refetch and preserve compatible values), `409
+   * error.409.forms_submission_cap`, `410 error.410.forms_closed`, `413
+   * error.413.forms_body_too_large`, `429` throttle, and the per-field
+   * `error.400.feature_*` family whose `params.field` names the offending slug.
+   */
+  submit(publicId: string, body: SubmitRequest): Promise<SubmitResult>;
+
+  // ── admin: the builder's dictionary ────────────────────────────────────────
+
+  /**
+   * The field kinds a form may be built from, with their config forms.
+   * `forms.manage` — a principal who cannot build a form has no use for the
+   * builder's dictionary, and the catalogue names host types whose slugs are
+   * internal vocabulary.
+   *
+   * This is what replaced the pair's hand-mirrored copy of
+   * `stapel_attributes.config_form` (stapel-forms 0.2.0): the declaration is
+   * the single source of truth again, so a type registered through
+   * `EXTRA_TYPES` shows up in the builder with no client release.
+   */
+  listFieldKinds(workspaceId: string): Promise<FieldKindCatalogue>;
+
+  // ── admin: forms ───────────────────────────────────────────────────────────
+
+  /** The workspace's forms. `forms.view`. */
+  listForms(workspaceId: string, state?: FormState): Promise<readonly FormRow[]>;
+  /** One form. `forms.view`. */
+  getForm(workspaceId: string, formId: string): Promise<FormRow>;
+  /** Create a form (state starts `draft`). `forms.manage`. */
+  createForm(body: FormCreateRequest): Promise<FormRow>;
+  /** Retitle / re-target a form. `forms.manage`. */
+  patchForm(
+    workspaceId: string,
+    formId: string,
+    body: FormPatchRequest
+  ): Promise<FormRow>;
+  /** Soft-delete. `forms.manage`. */
+  deleteForm(workspaceId: string, formId: string): Promise<void>;
+
+  /** Replace the builder's scratchpad. `forms.manage`. */
+  putDraft(
+    workspaceId: string,
+    formId: string,
+    schema: FormSchema
+  ): Promise<FormRow>;
+  /**
+   * Freeze the draft into the next immutable version. `forms.manage`.
+   * Refuses an empty schema, a duplicate slug, a kind outside `FIELD_KINDS`,
+   * a field count over the cap, and — backend delta note 1 — a config key the
+   * type's dataclass does not know (`error.400.forms_invalid_schema` with
+   * `params.key`), because a dropped key is a constraint that silently does
+   * not exist.
+   */
+  publish(workspaceId: string, formId: string): Promise<PublishResult>;
+  /** Open / close / return to draft. `forms.manage`. */
+  setState(
+    workspaceId: string,
+    formId: string,
+    state: FormState
+  ): Promise<FormRow>;
+  /** Mint a new `public_id`, retiring the old link. `forms.manage`. */
+  rotateLink(workspaceId: string, formId: string): Promise<FormRow>;
+  /** Every published version, for the responses view's column sets.
+   * `forms.view`. */
+  listVersions(
+    workspaceId: string,
+    formId: string
+  ): Promise<readonly FormVersion[]>;
+
+  // ── admin: responses ───────────────────────────────────────────────────────
+
+  /** One keyset page of responses. `forms.responses.view`. */
+  listSubmissions(params: SubmissionListParams): Promise<readonly Submission[]>;
+  /** One response. `forms.responses.view`. */
+  getSubmission(workspaceId: string, submissionId: string): Promise<Submission>;
+  /** Erase one response. `forms.responses.manage`. */
+  deleteSubmission(workspaceId: string, submissionId: string): Promise<void>;
+  /**
+   * Re-deliver one response through the form's notification targets.
+   * `forms.responses.manage`. An explicit destination override REPLACES the
+   * configured targets (backend delta note 7). Admin-initiated, so it is NOT
+   * subject to `NOTIFY_COOLDOWN_SECONDS`.
+   */
+  resendSubmission(
+    workspaceId: string,
+    submissionId: string,
+    body?: ResendRequest
+  ): Promise<ResendResult>;
+
+  /**
+   * One page of the CSV export, plus the continuation cursor. `forms.responses.view`.
+   * Rides the raw transport, not the JSON client — see `api/export.ts`.
+   */
+  exportSubmissions(params: {
+    readonly workspaceId: string;
+    readonly formId: string;
+    readonly before?: string;
+    readonly version?: number;
+    readonly signal?: AbortSignal;
+  }): Promise<CsvExportPage>;
+}
+
+/** Raw-transport binding forwarded from the runtime (declared in
+ * `api/export.ts`, which owns the surface that consumes it). */
+export type { FormsApiOptions } from "./export.js";
+
+export function createFormsApi(
+  client: StapelClient,
+  options: FormsApiOptions = {}
+): FormsApi {
+  const transport: FormsRawTransport = createExportTransport(
+    client.baseUrl,
+    options
+  );
+
+  return {
+    client,
+
+    // ── public ───────────────────────────────────────────────────────────────
+    getPublicForm: (publicId) => client.get(`/public/${seg(publicId)}/`),
+
+    submit: (publicId, body) =>
+      client.post(
+        `/public/${seg(publicId)}/submissions/`,
+        body satisfies SubmitRequest,
+        mutating()
+      ),
+
+    // ── admin: the builder's dictionary ──────────────────────────────────────
+    // Note the path: no `admin/` prefix and no trailing slash, unlike the two
+    // anonymous routes. Both are load-bearing — Django resolves this exactly.
+    listFieldKinds: async (workspaceId) => {
+      const dto = await client.get<{
+        kinds?: readonly FieldKind[];
+        config_widgets?: Readonly<Record<string, readonly string[]>>;
+      }>("/field-kinds", { query: ws(workspaceId) });
+      // Both members are optional on the wire (dataclass defaults), and a
+      // builder that reads `.kinds.map` off `undefined` is a crash where an
+      // empty catalogue would do.
+      return {
+        kinds: dto.kinds ?? [],
+        configWidgets: dto.config_widgets ?? {},
+      };
+    },
+
+    // ── admin: forms ─────────────────────────────────────────────────────────
+    listForms: (workspaceId, state) =>
+      client.get("/forms", {
+        query: { ...ws(workspaceId), ...(state !== undefined ? { state } : {}) },
+      }),
+
+    getForm: (workspaceId, formId) =>
+      client.get(`/forms/${seg(formId)}`, { query: ws(workspaceId) }),
+
+    createForm: (body) =>
+      client.post("/forms", body satisfies FormCreateRequest, mutating()),
+
+    patchForm: (workspaceId, formId, body) =>
+      client.patch(
+        `/forms/${seg(formId)}`,
+        body satisfies FormPatchRequest,
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    deleteForm: (workspaceId, formId) =>
+      client.delete(`/forms/${seg(formId)}`, mutating({ query: ws(workspaceId) })),
+
+    putDraft: (workspaceId, formId, schema) =>
+      client.put(
+        `/forms/${seg(formId)}/draft`,
+        { schema },
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    publish: (workspaceId, formId) =>
+      client.post(
+        `/forms/${seg(formId)}/publish`,
+        undefined,
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    setState: (workspaceId, formId, state) =>
+      client.post(
+        `/forms/${seg(formId)}/state`,
+        { state },
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    rotateLink: (workspaceId, formId) =>
+      client.post(
+        `/forms/${seg(formId)}/rotate-link`,
+        undefined,
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    listVersions: (workspaceId, formId) =>
+      client.get(`/forms/${seg(formId)}/versions`, { query: ws(workspaceId) }),
+
+    // ── admin: responses ─────────────────────────────────────────────────────
+    listSubmissions: (params) =>
+      client.get(`/forms/${seg(params.formId)}/submissions`, {
+        query: {
+          ...ws(params.workspaceId),
+          ...(params.before !== undefined ? { before: params.before } : {}),
+          ...(params.limit !== undefined ? { limit: params.limit } : {}),
+          ...(params.version !== undefined ? { version: params.version } : {}),
+        },
+      }),
+
+    getSubmission: (workspaceId, submissionId) =>
+      client.get(`/submissions/${seg(submissionId)}`, { query: ws(workspaceId) }),
+
+    deleteSubmission: (workspaceId, submissionId) =>
+      client.delete(
+        `/submissions/${seg(submissionId)}`,
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    resendSubmission: (workspaceId, submissionId, body) =>
+      client.post(
+        `/submissions/${seg(submissionId)}/resend`,
+        body ?? {},
+        mutating({ query: ws(workspaceId) })
+      ),
+
+    exportSubmissions: (params) => exportSubmissionsCsv(transport, params),
+  };
+}