@we8/cms 0.1.0

package/dist/modules/forms/db.js

@@ -0,0 +1,62 @@
+import { formSettingsSchema } from '../../shared/index.js';
+import { HttpError } from '../../lib/errors.js';
+export function parseFormSettings(settingsJson) {
+    return formSettingsSchema.parse(JSON.parse(settingsJson));
+}
+export function toFormRecord(row) {
+    return {
+        id: row.id,
+        key: row.form_key,
+        name: row.name,
+        type: row.type,
+        settings: parseFormSettings(row.settings),
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        archivedAt: row.archived_at,
+        submissionCount: row.submission_count,
+        lastSubmissionAt: row.last_submission_at,
+    };
+}
+export function toSubmissionRecord(row) {
+    return {
+        id: row.id,
+        formId: row.form_id,
+        formName: row.form_name,
+        submittedAt: row.submitted_at,
+        payload: JSON.parse(row.payload),
+        email: row.email,
+        name: row.name,
+        status: row.status,
+        notes: row.notes,
+        sourcePage: row.source_page,
+        referrer: row.referrer,
+    };
+}
+export async function fetchFormByKey(db, formKey) {
+    const row = await db
+        .prepare('SELECT * FROM forms WHERE form_key = ?1')
+        .bind(formKey)
+        .first();
+    if (!row)
+        throw new HttpError('not_found', 'form not found');
+    return row;
+}
+export async function fetchFormById(db, id) {
+    const row = await db.prepare('SELECT * FROM forms WHERE id = ?1').bind(id).first();
+    if (!row)
+        throw new HttpError('not_found', 'form not found');
+    return row;
+}
+/** Single submission joined with its form name; 404s if the id is unknown. */
+export async function fetchSubmissionRow(db, id) {
+    const row = await db
+        .prepare(`SELECT submissions.*, forms.name AS form_name
+         FROM submissions LEFT JOIN forms ON forms.id = submissions.form_id
+        WHERE submissions.id = ?1`)
+        .bind(id)
+        .first();
+    if (!row)
+        throw new HttpError('not_found', 'submission not found');
+    return row;
+}
+//# sourceMappingURL=db.js.map

package/dist/modules/forms/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/modules/forms/db.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAuChD,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAgB;IAC3C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,gBAAgB,EAAE,GAAG,CAAC,kBAAkB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAA0B;IAC3D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAA4B;QAC3D,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAc,EAAE,OAAe;IAClE,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,yCAAyC,CAAC;SAClD,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,EAAW,CAAC;IACpB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc,EAAE,EAAU;IAC5D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,EAAW,CAAC;IAC5F,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAc,EACd,EAAU;IAEV,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CACN;;kCAE4B,CAC7B;SACA,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,EAAyB,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/modules/forms/forms-routes.admin.d.ts

@@ -0,0 +1,6 @@
+import { Hono } from 'hono';
+import type { Bindings } from '../../env.js';
+export declare const formsAdminRoutes: Hono<{
+    Bindings: Bindings;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=forms-routes.admin.d.ts.map

package/dist/modules/forms/forms-routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-routes.admin.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/forms-routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAY7C,eAAO,MAAM,gBAAgB;cAAwB,QAAQ;yCAAK,CAAC"}

package/dist/modules/forms/forms-routes.admin.js

@@ -0,0 +1,37 @@
+import { formCreateInputSchema, formListQuerySchema, formUpdateInputSchema, ok } from '../../shared/index.js';
+import { Hono } from 'hono';
+import { parseOrThrow } from '../../lib/validate.js';
+import { archiveForm, createForm, deleteForm, getFormAdmin, listFormsAdmin, unarchiveForm, updateForm, } from './forms-service.js';
+export const formsAdminRoutes = new Hono();
+formsAdminRoutes.get('/', async (c) => {
+    const query = parseOrThrow(formListQuerySchema, c.req.query());
+    const { items, total } = await listFormsAdmin(c.env.DB, query);
+    return c.json(ok({ items, page: query.page, pageSize: query.pageSize, total }));
+});
+formsAdminRoutes.post('/', async (c) => {
+    const input = parseOrThrow(formCreateInputSchema, await c.req.json());
+    const form = await createForm(c.env.DB, input);
+    return c.json(ok({ form }));
+});
+formsAdminRoutes.get('/:id', async (c) => {
+    const form = await getFormAdmin(c.env.DB, c.req.param('id'));
+    return c.json(ok({ form }));
+});
+formsAdminRoutes.patch('/:id', async (c) => {
+    const patch = parseOrThrow(formUpdateInputSchema, await c.req.json());
+    const form = await updateForm(c.env.DB, c.req.param('id'), patch);
+    return c.json(ok({ form }));
+});
+formsAdminRoutes.post('/:id/archive', async (c) => {
+    const form = await archiveForm(c.env.DB, c.req.param('id'));
+    return c.json(ok({ form }));
+});
+formsAdminRoutes.post('/:id/unarchive', async (c) => {
+    const form = await unarchiveForm(c.env.DB, c.req.param('id'));
+    return c.json(ok({ form }));
+});
+formsAdminRoutes.delete('/:id', async (c) => {
+    await deleteForm(c.env.DB, c.req.param('id'));
+    return c.json(ok({ deleted: true }));
+});
+//# sourceMappingURL=forms-routes.admin.js.map

package/dist/modules/forms/forms-routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-routes.admin.js","sourceRoot":"","sources":["../../../src/modules/forms/forms-routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,EAAE,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,WAAW,EACX,UAAU,EACV,UAAU,EACV,YAAY,EACZ,cAAc,EACd,aAAa,EACb,UAAU,GACX,MAAM,oBAAoB,CAAC;AAE5B,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAA0B,CAAC;AAEnE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzC,MAAM,KAAK,GAAG,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEH,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC"}

package/dist/modules/forms/forms-service.d.ts

@@ -0,0 +1,18 @@
+import { type FormCreateInput, type FormListQuery, type FormRecord, type FormUpdateInput } from '../../shared/index.js';
+export declare function getFormAdmin(db: D1Database, id: string): Promise<FormRecord>;
+export declare function listFormsAdmin(db: D1Database, query: FormListQuery): Promise<{
+    items: FormRecord[];
+    total: number;
+}>;
+export declare function createForm(db: D1Database, input: FormCreateInput): Promise<FormRecord>;
+export declare function updateForm(db: D1Database, id: string, patch: FormUpdateInput): Promise<FormRecord>;
+export declare function archiveForm(db: D1Database, id: string): Promise<FormRecord>;
+export declare function unarchiveForm(db: D1Database, id: string): Promise<FormRecord>;
+/**
+ * Hard delete, allowed only when the form has no submissions: the inbox is the
+ * CRM of record, so a form with leads is archived (intake stops, submissions
+ * stay), never deleted. Callers who want a form gone-but-with-history use
+ * archiveForm instead.
+ */
+export declare function deleteForm(db: D1Database, id: string): Promise<void>;
+//# sourceMappingURL=forms-service.d.ts.map

package/dist/modules/forms/forms-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-service.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/forms-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AA6B/B,wBAAsB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOlF;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBjD;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CA6B5F;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,UAAU,CAAC,CAiBrB;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CASjF;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAOnF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa1E"}

package/dist/modules/forms/forms-service.js

@@ -0,0 +1,121 @@
+import { formSettingsSchema, } from '../../shared/index.js';
+import { HttpError } from '../../lib/errors.js';
+import { fetchFormById, toFormRecord } from './db.js';
+/**
+ * Slugify a form name into a URL/embed-safe key: lowercase, non-alphanumeric
+ * runs become single hyphens, trimmed. Empty result (e.g. a name of only
+ * punctuation) falls back to "form" so a key always exists.
+ */
+function slugify(name) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug || 'form';
+}
+async function keyExists(db, key) {
+    const row = await db.prepare('SELECT 1 FROM forms WHERE form_key = ?1').bind(key).first();
+    return row !== null;
+}
+/**
+ * The submission-aggregate query shared by list and get: LEFT JOIN so a form
+ * with zero submissions still returns a row (count 0, last null).
+ */
+const FORM_SELECT = `SELECT forms.*, COUNT(submissions.id) AS submission_count, MAX(submissions.submitted_at) AS last_submission_at
+  FROM forms LEFT JOIN submissions ON submissions.form_id = forms.id`;
+export async function getFormAdmin(db, id) {
+    const row = await db
+        .prepare(`${FORM_SELECT} WHERE forms.id = ?1 GROUP BY forms.id`)
+        .bind(id)
+        .first();
+    if (!row)
+        throw new HttpError('not_found', 'form not found');
+    return toFormRecord(row);
+}
+export async function listFormsAdmin(db, query) {
+    const offset = (query.page - 1) * query.pageSize;
+    const where = query.includeArchived ? '' : 'WHERE forms.archived_at IS NULL';
+    const { results } = await db
+        .prepare(`${FORM_SELECT} ${where} GROUP BY forms.id ORDER BY forms.created_at DESC LIMIT ?1 OFFSET ?2`)
+        .bind(query.pageSize, offset)
+        .all();
+    const countRow = await db
+        .prepare(`SELECT COUNT(*) as count FROM forms ${where}`)
+        .first();
+    return { items: results.map(toFormRecord), total: countRow?.count ?? 0 };
+}
+export async function createForm(db, input) {
+    // An explicit key must be unique as given (surprising the caller with a
+    // suffix would break the embed contract they typed); a derived key silently
+    // suffixes until free so create never fails on a name collision.
+    let key;
+    if (input.key) {
+        if (await keyExists(db, input.key)) {
+            throw new HttpError('validation_error', `a form with key "${input.key}" already exists`);
+        }
+        key = input.key;
+    }
+    else {
+        const base = slugify(input.name);
+        key = base;
+        for (let n = 2; await keyExists(db, key); n++) {
+            key = `${base}-${n}`;
+        }
+    }
+    const settings = formSettingsSchema.parse(input.settings ?? {});
+    const id = crypto.randomUUID();
+    await db
+        .prepare(`INSERT INTO forms (id, form_key, name, type, settings, updated_at)
+       VALUES (?1, ?2, ?3, ?4, ?5, datetime('now'))`)
+        .bind(id, key, input.name, input.type, JSON.stringify(settings))
+        .run();
+    return getFormAdmin(db, id);
+}
+export async function updateForm(db, id, patch) {
+    const row = await fetchFormById(db, id);
+    // Replace-wholesale when settings is present (the repo's nested-update
+    // convention, R2; reaffirmed by the R7 review): the schema validated the
+    // full object, and an omitted optional field (notifyEmails, successMessage)
+    // means "cleared". A field-level merge would make clearing impossible over
+    // JSON, since undefined-valued keys vanish in JSON.stringify.
+    const settings = patch.settings ?? formSettingsSchema.parse(JSON.parse(row.settings));
+    await db
+        .prepare(`UPDATE forms SET name = ?2, type = ?3, settings = ?4, updated_at = datetime('now') WHERE id = ?1`)
+        .bind(id, patch.name ?? row.name, patch.type ?? row.type, JSON.stringify(settings))
+        .run();
+    return getFormAdmin(db, id);
+}
+export async function archiveForm(db, id) {
+    await fetchFormById(db, id);
+    await db
+        .prepare(`UPDATE forms SET archived_at = datetime('now'), updated_at = datetime('now') WHERE id = ?1`)
+        .bind(id)
+        .run();
+    return getFormAdmin(db, id);
+}
+export async function unarchiveForm(db, id) {
+    await fetchFormById(db, id);
+    await db
+        .prepare(`UPDATE forms SET archived_at = NULL, updated_at = datetime('now') WHERE id = ?1`)
+        .bind(id)
+        .run();
+    return getFormAdmin(db, id);
+}
+/**
+ * Hard delete, allowed only when the form has no submissions: the inbox is the
+ * CRM of record, so a form with leads is archived (intake stops, submissions
+ * stay), never deleted. Callers who want a form gone-but-with-history use
+ * archiveForm instead.
+ */
+export async function deleteForm(db, id) {
+    await fetchFormById(db, id);
+    const countRow = await db
+        .prepare('SELECT COUNT(*) as count FROM submissions WHERE form_id = ?1')
+        .bind(id)
+        .first();
+    if ((countRow?.count ?? 0) > 0) {
+        throw new HttpError('validation_error', 'this form has submissions; archive it instead of deleting');
+    }
+    await db.prepare('DELETE FROM forms WHERE id = ?1').bind(id).run();
+}
+//# sourceMappingURL=forms-service.js.map

package/dist/modules/forms/forms-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forms-service.js","sourceRoot":"","sources":["../../../src/modules/forms/forms-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAKnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAoB,MAAM,SAAS,CAAC;AAExE;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,MAAM,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,EAAc,EAAE,GAAW;IAClD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1F,OAAO,GAAG,KAAK,IAAI,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG;qEACiD,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU;IAC3D,MAAM,GAAG,GAAG,MAAM,EAAE;SACjB,OAAO,CAAC,GAAG,WAAW,wCAAwC,CAAC;SAC/D,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,EAAe,CAAC;IACxB,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAC7D,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAc,EACd,KAAoB;IAEpB,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;IAE7E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE;SACzB,OAAO,CACN,GAAG,WAAW,IAAI,KAAK,sEAAsE,CAC9F;SACA,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,GAAG,EAAe,CAAC;IAEtB,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,OAAO,CAAC,uCAAuC,KAAK,EAAE,CAAC;SACvD,KAAK,EAAqB,CAAC;IAE9B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAc,EAAE,KAAsB;IACrE,wEAAwE;IACxE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,GAAW,CAAC;IAChB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,IAAI,MAAM,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,KAAK,CAAC,GAAG,kBAAkB,CAAC,CAAC;QAC3F,CAAC;QACD,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,GAAG,GAAG,IAAI,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,EAAE;SACL,OAAO,CACN;oDAC8C,CAC/C;SACA,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;SAC/D,GAAG,EAAE,CAAC;IAET,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAc,EACd,EAAU,EACV,KAAsB;IAEtB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACxC,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEtF,MAAM,EAAE;SACL,OAAO,CACN,kGAAkG,CACnG;SACA,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;SAClF,GAAG,EAAE,CAAC;IAET,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAc,EAAE,EAAU;IAC1D,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE;SACL,OAAO,CACN,4FAA4F,CAC7F;SACA,IAAI,CAAC,EAAE,CAAC;SACR,GAAG,EAAE,CAAC;IACT,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAc,EAAE,EAAU;IAC5D,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,EAAE;SACL,OAAO,CAAC,iFAAiF,CAAC;SAC1F,IAAI,CAAC,EAAE,CAAC;SACR,GAAG,EAAE,CAAC;IACT,OAAO,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAc,EAAE,EAAU;IACzD,MAAM,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,OAAO,CAAC,8DAA8D,CAAC;SACvE,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,EAAqB,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CACjB,kBAAkB,EAClB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACrE,CAAC"}

package/dist/modules/forms/routes.public.d.ts

@@ -0,0 +1,6 @@
+import { Hono } from 'hono';
+import { type Bindings } from '../../env.js';
+export declare const formsPublicRoutes: Hono<{
+    Bindings: Bindings;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=routes.public.d.ts.map

package/dist/modules/forms/routes.public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/routes.public.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAQ1D,eAAO,MAAM,iBAAiB;cAAwB,QAAQ;yCAAK,CAAC"}

package/dist/modules/forms/routes.public.js

@@ -0,0 +1,41 @@
+import { ok, sha256Hex } from '../../shared/index.js';
+import { Hono } from 'hono';
+import { getSettings } from '../../env.js';
+import { resolveEmailSender, sendBestEffort } from '../../lib/email.js';
+import { buildSubmissionNotification } from '../../lib/notify.js';
+import { corsMiddleware, enforceOrigin } from '../../middleware/cors.js';
+import { rateLimit } from '../../middleware/rate-limit.js';
+import { dispatchWebhook } from '../webhooks/dispatch.js';
+import { submitForm } from './submissions-service.js';
+export const formsPublicRoutes = new Hono();
+formsPublicRoutes.use('/:formKey/submissions', corsMiddleware('publicWrite'), enforceOrigin, rateLimit('formsBurst'), rateLimit('formsHourly'));
+formsPublicRoutes.post('/:formKey/submissions', async (c) => {
+    const body = (await c.req.json().catch(() => ({})));
+    const ip = c.req.header('CF-Connecting-IP');
+    const result = await submitForm(c.env.DB, c.req.param('formKey'), body, c.env.TURNSTILE_SECRET, {
+        ipHash: ip ? await sha256Hex(ip) : null,
+        userAgent: c.req.header('User-Agent') ?? null,
+        referrer: c.req.header('Referer') ?? null,
+    });
+    if (result.id) {
+        const settings = await getSettings(c.env.DB);
+        // A form's own notifyEmails overrides the site-wide default when set.
+        const notifyEmails = result.notifyEmailsOverride ?? settings.notifyEmails;
+        // Best effort by construction: the submission is already stored, so the
+        // visitor gets their success regardless of what the mail transport does.
+        // With no sender configured this drops the message and moves on.
+        await sendBestEffort(resolveEmailSender(c.env), buildSubmissionNotification(notifyEmails, c.env.SITE_URL, {
+            email: result.email,
+            name: result.name,
+            message: typeof body['message'] === 'string' ? body['message'] : null,
+            sourcePage: result.sourcePage,
+        }));
+        await dispatchWebhook(c.env.DB, c.executionCtx, c.env.SITE_URL, 'form.submission.created', {
+            submissionId: result.id,
+            formId: result.formId,
+            email: result.email,
+        });
+    }
+    return c.json(ok({ id: result.id }));
+});
+//# sourceMappingURL=routes.public.js.map

package/dist/modules/forms/routes.public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.public.js","sourceRoot":"","sources":["../../../src/modules/forms/routes.public.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAiB,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAA0B,CAAC;AAEpE,iBAAiB,CAAC,GAAG,CACnB,uBAAuB,EACvB,cAAc,CAAC,aAAa,CAAC,EAC7B,aAAa,EACb,SAAS,CAAC,YAAY,CAAC,EACvB,SAAS,CAAC,aAAa,CAAC,CACzB,CAAC;AAEF,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1D,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC/E,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE;QAC9F,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QACvC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;QAC7C,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI;KAC1C,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,sEAAsE;QACtE,MAAM,YAAY,GAAG,MAAM,CAAC,oBAAoB,IAAI,QAAQ,CAAC,YAAY,CAAC;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,cAAc,CAClB,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EACzB,2BAA2B,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;YACxD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACrE,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CACH,CAAC;QACF,MAAM,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE;YACzF,YAAY,EAAE,MAAM,CAAC,EAAE;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC"}

package/dist/modules/forms/submissions-routes.admin.d.ts

@@ -0,0 +1,6 @@
+import { Hono } from 'hono';
+import type { Bindings } from '../../env.js';
+export declare const submissionsAdminRoutes: Hono<{
+    Bindings: Bindings;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=submissions-routes.admin.d.ts.map

package/dist/modules/forms/submissions-routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissions-routes.admin.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/submissions-routes.admin.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAW7C,eAAO,MAAM,sBAAsB;cAAwB,QAAQ;yCAAK,CAAC"}

package/dist/modules/forms/submissions-routes.admin.js

@@ -0,0 +1,46 @@
+import { ok, statsQuerySchema, submissionListQuerySchema, submissionUpdateInputSchema, SUBMISSIONS_STATS_MAX_DAYS, } from '../../shared/index.js';
+import { Hono } from 'hono';
+import { requireOwner } from '../../middleware/auth.js';
+import { parseOrThrow } from '../../lib/validate.js';
+import { exportSubmissionsCsv, getSubmissionAdmin, getSubmissionsStats, listSubmissionsAdmin, updateSubmissionAdmin, } from './submissions-service.js';
+export const submissionsAdminRoutes = new Hono();
+// The whole inbox is other people's personal data (list, detail, stats, CSV
+// export, status update), so it is OWNER-ONLY. Applied at the router so EVERY
+// route here, including the bare `/` list, is gated independently of the mount
+// prefix. sessionAuth has already authenticated the request; this narrows which
+// authenticated user.
+submissionsAdminRoutes.use('*', requireOwner);
+submissionsAdminRoutes.get('/', async (c) => {
+    const query = parseOrThrow(submissionListQuerySchema, c.req.query());
+    const { items, total } = await listSubmissionsAdmin(c.env.DB, query);
+    return c.json(ok({ items, page: query.page, pageSize: query.pageSize, total }));
+});
+// Registered BEFORE /:id below, same reasoning as /export.csv further down:
+// an unconstrained :id would otherwise swallow the literal "stats" segment.
+submissionsAdminRoutes.get('/stats', async (c) => {
+    const query = parseOrThrow(statsQuerySchema(SUBMISSIONS_STATS_MAX_DAYS), c.req.query());
+    const stats = await getSubmissionsStats(c.env.DB, query.days);
+    return c.json(ok(stats));
+});
+submissionsAdminRoutes.get('/export.csv', async (c) => {
+    const query = c.req.query();
+    const csv = await exportSubmissionsCsv(c.env.DB, {
+        status: query['status'],
+        search: query['search'],
+        formId: query['formId'],
+    });
+    return c.body(csv, 200, {
+        'Content-Type': 'text/csv; charset=UTF-8',
+        'Content-Disposition': 'attachment; filename="submissions.csv"',
+    });
+});
+submissionsAdminRoutes.get('/:id', async (c) => {
+    const submission = await getSubmissionAdmin(c.env.DB, c.req.param('id'));
+    return c.json(ok({ submission }));
+});
+submissionsAdminRoutes.patch('/:id', async (c) => {
+    const patch = parseOrThrow(submissionUpdateInputSchema, await c.req.json());
+    const submission = await updateSubmissionAdmin(c.env.DB, c.req.param('id'), patch);
+    return c.json(ok({ submission }));
+});
+//# sourceMappingURL=submissions-routes.admin.js.map

package/dist/modules/forms/submissions-routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissions-routes.admin.js","sourceRoot":"","sources":["../../../src/modules/forms/submissions-routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,EAAE,EACF,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,IAAI,EAA0B,CAAC;AAEzE,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,sBAAsB;AACtB,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AAE9C,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,yBAAyB,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACrE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,4EAA4E;AAC5E,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3B,CAAC,CAAC,CAAC;AAEH,sBAAsB,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QAC/C,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;QACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;KACxB,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;QACtB,cAAc,EAAE,yBAAyB;QACzC,qBAAqB,EAAE,wCAAwC;KAChE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7C,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEH,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC"}

package/dist/modules/forms/submissions-service.d.ts

@@ -0,0 +1,45 @@
+import { type SubmissionListQuery, type SubmissionRecord, type SubmissionsStats, type SubmissionUpdateInput } from '../../shared/index.js';
+export interface SubmissionContext {
+    ipHash: string | null;
+    userAgent: string | null;
+    referrer: string | null;
+}
+export interface SubmitFormResult {
+    /** null when the honeypot triggered: accepted silently, nothing was stored. */
+    id: string | null;
+    formId: string;
+    email: string | null;
+    name: string | null;
+    sourcePage: string | null;
+    /** This form's settings.notifyEmails override, if configured; undefined falls back to site-wide notifyEmails. */
+    notifyEmailsOverride: string[] | undefined;
+}
+/**
+ * The full public submission flow, in spec order: honeypot (before schema
+ * validation, so a bot's malformed payload is still swallowed silently rather
+ * than surfaced as a 400) -> schema validation -> payload size cap -> Turnstile
+ * (if the form has it enabled) -> 5-minute email-or-IP dedupe -> store. An
+ * archived form 404s like an unknown key (intake stops, existing submissions
+ * stay). Resend notification and webhook dispatch are NOT here: both are
+ * HTTP/env-layer side effects fired by the route handler after this returns.
+ */
+export declare function submitForm(db: D1Database, formKey: string, rawBody: Record<string, unknown>, turnstileSecret: string | undefined, context: SubmissionContext): Promise<SubmitFormResult>;
+export declare function getSubmissionAdmin(db: D1Database, id: string): Promise<SubmissionRecord>;
+export declare function listSubmissionsAdmin(db: D1Database, query: SubmissionListQuery): Promise<{
+    items: SubmissionRecord[];
+    total: number;
+}>;
+export declare function updateSubmissionAdmin(db: D1Database, id: string, patch: SubmissionUpdateInput): Promise<SubmissionRecord>;
+/**
+ * The inbox's own stats: getVisitStats's daily-aggregate pattern applied to
+ * submissions instead of page_visits, so the two "stats over a day window"
+ * queries in this package stay structurally identical.
+ */
+export declare function getSubmissionsStats(db: D1Database, days: number): Promise<SubmissionsStats>;
+/** All submissions matching the same filters as listSubmissionsAdmin, unpaginated, as CSV text. */
+export declare function exportSubmissionsCsv(db: D1Database, filters: {
+    status?: string | undefined;
+    search?: string | undefined;
+    formId?: string | undefined;
+}): Promise<string>;
+//# sourceMappingURL=submissions-service.d.ts.map

package/dist/modules/forms/submissions-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submissions-service.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/submissions-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAe/B,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iHAAiH;IACjH,oBAAoB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5C;AAED;;;;;;;;GAQG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,eAAe,EAAE,MAAM,GAAG,SAAS,EACnC,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CA8E3B;AAED,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE9F;AA4BD,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC;IAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBvD;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,UAAU,EACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAO3B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgCjG;AASD,mGAAmG;AACnG,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,UAAU,EACd,OAAO,EAAE;IACP,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GACA,OAAO,CAAC,MAAM,CAAC,CA+BjB"}

package/dist/modules/forms/submissions-service.js

@@ -0,0 +1,174 @@
+import { submissionCreateInputSchema, } from '../../shared/index.js';
+import { HttpError } from '../../lib/errors.js';
+import { verifyTurnstile } from '../../lib/turnstile.js';
+import { parseOrThrow } from '../../lib/validate.js';
+import { fetchFormByKey, fetchSubmissionRow, parseFormSettings, toSubmissionRecord, } from './db.js';
+const MAX_PAYLOAD_BYTES = 10_000;
+const DEDUPE_WINDOW_MINUTES = 5;
+/**
+ * The full public submission flow, in spec order: honeypot (before schema
+ * validation, so a bot's malformed payload is still swallowed silently rather
+ * than surfaced as a 400) -> schema validation -> payload size cap -> Turnstile
+ * (if the form has it enabled) -> 5-minute email-or-IP dedupe -> store. An
+ * archived form 404s like an unknown key (intake stops, existing submissions
+ * stay). Resend notification and webhook dispatch are NOT here: both are
+ * HTTP/env-layer side effects fired by the route handler after this returns.
+ */
+export async function submitForm(db, formKey, rawBody, turnstileSecret, context) {
+    const form = await fetchFormByKey(db, formKey);
+    if (form.archived_at)
+        throw new HttpError('not_found', 'form not found');
+    const settings = parseFormSettings(form.settings);
+    const honeypotValue = rawBody[settings.honeypotField];
+    if (typeof honeypotValue === 'string' && honeypotValue.trim().length > 0) {
+        return {
+            id: null,
+            formId: form.id,
+            email: null,
+            name: null,
+            sourcePage: null,
+            notifyEmailsOverride: settings.notifyEmails,
+        };
+    }
+    const input = parseOrThrow(submissionCreateInputSchema, rawBody);
+    const payloadJson = JSON.stringify(rawBody);
+    if (payloadJson.length > MAX_PAYLOAD_BYTES) {
+        throw new HttpError('payload_too_large', 'submission payload too large');
+    }
+    if (settings.turnstileEnabled) {
+        const verified = await verifyTurnstile(turnstileSecret, input.turnstileToken, context.ipHash ?? undefined);
+        if (!verified) {
+            throw new HttpError('validation_error', 'Turnstile verification failed');
+        }
+    }
+    const dedupeCondition = context.ipHash ? 'email = ?1 OR ip_hash = ?2' : 'email = ?1';
+    const dedupeBindings = context.ipHash ? [input.email, context.ipHash] : [input.email];
+    const duplicate = await db
+        .prepare(`SELECT id FROM submissions WHERE (${dedupeCondition}) AND submitted_at > datetime('now', ?${dedupeBindings.length + 1})`)
+        .bind(...dedupeBindings, `-${DEDUPE_WINDOW_MINUTES} minutes`)
+        .first();
+    if (duplicate) {
+        throw new HttpError('rate_limited', 'a submission from this email or IP was already received recently');
+    }
+    const id = crypto.randomUUID();
+    await db
+        .prepare(`INSERT INTO submissions
+         (id, form_id, payload, email, name, source_page, referrer, ip_hash, user_agent)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)`)
+        .bind(id, form.id, payloadJson, input.email, input.name ?? null, input.sourcePage ?? null, context.referrer, context.ipHash, context.userAgent)
+        .run();
+    return {
+        id,
+        formId: form.id,
+        email: input.email,
+        name: input.name ?? null,
+        sourcePage: input.sourcePage ?? null,
+        notifyEmailsOverride: settings.notifyEmails,
+    };
+}
+export async function getSubmissionAdmin(db, id) {
+    return toSubmissionRecord(await fetchSubmissionRow(db, id));
+}
+/** Builds the shared WHERE clause + bindings for the list and CSV export queries. */
+function submissionFilters(filters) {
+    const conditions = [];
+    const bindings = [];
+    if (filters.status) {
+        conditions.push(`submissions.status = ?${bindings.length + 1}`);
+        bindings.push(filters.status);
+    }
+    if (filters.formId) {
+        conditions.push(`submissions.form_id = ?${bindings.length + 1}`);
+        bindings.push(filters.formId);
+    }
+    if (filters.search) {
+        conditions.push(`(submissions.email LIKE ?${bindings.length + 1} OR submissions.name LIKE ?${bindings.length + 1})`);
+        bindings.push(`%${filters.search}%`);
+    }
+    const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    return { where, bindings };
+}
+export async function listSubmissionsAdmin(db, query) {
+    const offset = (query.page - 1) * query.pageSize;
+    const { where, bindings } = submissionFilters(query);
+    const { results } = await db
+        .prepare(`SELECT submissions.*, forms.name AS form_name
+         FROM submissions LEFT JOIN forms ON forms.id = submissions.form_id
+         ${where}
+         ORDER BY submissions.submitted_at DESC LIMIT ?${bindings.length + 1} OFFSET ?${bindings.length + 2}`)
+        .bind(...bindings, query.pageSize, offset)
+        .all();
+    const countRow = await db
+        .prepare(`SELECT COUNT(*) as count FROM submissions ${where}`)
+        .bind(...bindings)
+        .first();
+    return { items: results.map(toSubmissionRecord), total: countRow?.count ?? 0 };
+}
+export async function updateSubmissionAdmin(db, id, patch) {
+    const row = await fetchSubmissionRow(db, id);
+    await db
+        .prepare('UPDATE submissions SET status=?2, notes=?3 WHERE id=?1')
+        .bind(id, patch.status ?? row.status, patch.notes !== undefined ? patch.notes : row.notes)
+        .run();
+    return getSubmissionAdmin(db, id);
+}
+/**
+ * The inbox's own stats: getVisitStats's daily-aggregate pattern applied to
+ * submissions instead of page_visits, so the two "stats over a day window"
+ * queries in this package stay structurally identical.
+ */
+export async function getSubmissionsStats(db, days) {
+    const since = `-${days} days`;
+    const totals = await db
+        .prepare(`SELECT COUNT(*) as total FROM submissions WHERE submitted_at > datetime('now', ?1)`)
+        .bind(since)
+        .first();
+    const byForm = (await db
+        .prepare(`SELECT submissions.form_id as formId, forms.name as formName, COUNT(*) as count
+           FROM submissions LEFT JOIN forms ON forms.id = submissions.form_id
+           WHERE submissions.submitted_at > datetime('now', ?1)
+           GROUP BY submissions.form_id ORDER BY count DESC`)
+        .bind(since)
+        .all()).results;
+    const daily = (await db
+        .prepare(`SELECT date(submitted_at) as date, COUNT(*) as count FROM submissions
+           WHERE submitted_at > datetime('now', ?1)
+           GROUP BY date(submitted_at) ORDER BY date ASC`)
+        .bind(since)
+        .all()).results;
+    return { total: totals?.total ?? 0, byForm, daily };
+}
+function csvEscape(value) {
+    if (/[",\n]/.test(value)) {
+        return `"${value.replace(/"/g, '""')}"`;
+    }
+    return value;
+}
+/** All submissions matching the same filters as listSubmissionsAdmin, unpaginated, as CSV text. */
+export async function exportSubmissionsCsv(db, filters) {
+    const { where, bindings } = submissionFilters(filters);
+    const { results } = await db
+        .prepare(`SELECT submissions.*, forms.name AS form_name
+         FROM submissions LEFT JOIN forms ON forms.id = submissions.form_id
+         ${where} ORDER BY submissions.submitted_at DESC`)
+        .bind(...bindings)
+        .all();
+    const header = ['id', 'submittedAt', 'form', 'email', 'name', 'status', 'sourcePage', 'notes'];
+    const lines = [header.join(',')];
+    for (const row of results) {
+        lines.push([
+            row.id,
+            row.submitted_at,
+            row.form_name ?? '',
+            row.email ?? '',
+            row.name ?? '',
+            row.status,
+            row.source_page ?? '',
+            row.notes ?? '',
+        ]
+            .map((value) => csvEscape(String(value)))
+            .join(','));
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=submissions-service.js.map