domma-cms 0.30.0 → 0.32.1

package/plugins/surveys/admin/views/survey-editor.js

@@ -0,0 +1,211 @@
+/**
+ * Surveys plugin — campaign create/edit view.
+ *
+ * The form is hand-built in the template as native inputs laid out in an
+ * explicit CSS grid (guaranteed multi-column), so this view only populates the
+ * dynamic options (forms, groups), seeds values on edit, collects the payload,
+ * and POST/PUTs to the admin API. On an open survey it also exposes the
+ * send / reminder actions.
+ *
+ * @module surveys/admin/views/survey-editor
+ */
+
+const BASE = '/api/plugins/surveys';
+
+/** Authenticated JSON fetch helper. Mirrors plugins/contacts/admin/views/contacts.js. */
+async function api(url, method = 'GET', body) {
+    const opts = {method, headers: {'Authorization': 'Bearer ' + (S.get('auth_token') || '')}};
+    if (body !== undefined) {
+        opts.headers['Content-Type'] = 'application/json';
+        opts.body = JSON.stringify(body);
+    }
+    const res = await fetch(url, opts);
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({error: res.statusText}));
+        throw new Error(err.error || res.statusText);
+    }
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+}
+
+export const surveyEditorView = {
+    templateUrl: '/plugins/surveys/admin/templates/survey-editor.html',
+
+    async onMount($container) {
+        const root = $container.find('.survey-editor-plugin').get(0) || $container.get(0);
+        if (!root) return;
+
+        const hashMatch = location.hash.match(/^#\/plugins\/surveys\/edit\/(.+)$/);
+        const editSlug = hashMatch ? decodeURIComponent(hashMatch[1]) : null;
+        const isEdit = !!editSlug;
+
+        const titleEl = root.querySelector('#editor-title');
+        if (titleEl) titleEl.textContent = isEdit ? 'Edit Survey' : 'New Survey';
+
+        // ---- Helpers to read/write the native inputs by field name ----------
+        const field = (name) => root.querySelector(`[name="${name}"]`);
+
+        function setValue(name, value) {
+            const el = field(name);
+            if (!el) return;
+            if (el.multiple) {
+                const set = new Set(Array.isArray(value) ? value : []);
+                Array.from(el.options).forEach((o) => { o.selected = set.has(o.value); });
+            } else {
+                el.value = value ?? '';
+            }
+        }
+
+        function readField(name) {
+            const el = field(name);
+            if (!el) return undefined;
+            if (el.multiple) return Array.from(el.selectedOptions).map((o) => o.value);
+            if (el.type === 'number') return el.value === '' ? '' : Number(el.value);
+            return el.value;
+        }
+
+        // ---- Load reference data + (on edit) the survey ---------------------
+        let survey = null;
+        let forms = [];
+        let groups = [];
+        try { forms = await api('/api/forms'); } catch { forms = []; }
+        try { groups = await api(`${BASE}/groups`); } catch { groups = []; }
+        if (isEdit) {
+            try {
+                survey = await api(`${BASE}/surveys/${encodeURIComponent(editSlug)}`);
+            } catch (err) {
+                E.toast(err?.message ?? 'Failed to load survey.', {type: 'error'});
+                location.hash = '#/plugins/surveys';
+                return;
+            }
+        }
+
+        // ---- Populate dynamic <select> options ------------------------------
+        const formSelect = field('formSlug');
+        if (formSelect) {
+            forms.forEach((f) => {
+                const opt = document.createElement('option');
+                opt.value = f.slug;
+                opt.textContent = f.title || f.slug;
+                formSelect.appendChild(opt);
+            });
+        }
+        // Audience uses group NAMES (sending.js reads groupIds as names).
+        const groupSelect = field('groupIds');
+        if (groupSelect) {
+            groups.forEach((g) => {
+                const opt = document.createElement('option');
+                opt.value = g.name;
+                opt.textContent = g.name;
+                groupSelect.appendChild(opt);
+            });
+        }
+
+        // ---- Seed values ----------------------------------------------------
+        const invite = survey?.inviteEmail ?? {};
+        setValue('title', survey?.title ?? '');
+        setValue('slug', survey?.slug ?? '');
+        setValue('description', survey?.description ?? '');
+        setValue('formSlug', survey?.formSlug ?? '');
+        setValue('mode', survey?.mode ?? 'identified');
+        setValue('status', survey?.status ?? 'draft');
+        setValue('groupIds', Array.isArray(survey?.groupIds) ? survey.groupIds : []);
+        setValue('opensAt', survey?.opensAt ?? '');
+        setValue('closesAt', survey?.closesAt ?? '');
+        setValue('reminderAfterDays', survey?.reminderAfterDays ?? 7);
+        setValue('intro', survey?.intro ?? '');
+        setValue('footer', survey?.footer ?? '');
+        setValue('thankYou', survey?.thankYou ?? '');
+        setValue('inviteSubject', invite.subject ?? '');
+        setValue('inviteBody', invite.body ?? '');
+
+        // Slug is immutable after creation.
+        if (isEdit) {
+            const slugEl = field('slug');
+            if (slugEl) slugEl.disabled = true;
+            const hint = root.querySelector('#slug-hint');
+            if (hint) hint.textContent = 'Slug cannot be changed after creation.';
+        }
+
+        // ---- Collect + save -------------------------------------------------
+        function collect() {
+            return {
+                title: (readField('title') ?? '').trim(),
+                slug: (readField('slug') ?? '').trim(),
+                description: (readField('description') ?? '').trim(),
+                formSlug: readField('formSlug') ?? '',
+                mode: readField('mode') ?? 'identified',
+                status: readField('status') ?? 'draft',
+                groupIds: readField('groupIds') ?? [],
+                opensAt: readField('opensAt') ?? '',
+                closesAt: readField('closesAt') ?? '',
+                reminderAfterDays: Number(readField('reminderAfterDays')) || 0,
+                intro: (readField('intro') ?? '').trim(),
+                footer: (readField('footer') ?? '').trim(),
+                thankYou: (readField('thankYou') ?? '').trim(),
+                inviteEmail: {
+                    subject: (readField('inviteSubject') ?? '').trim(),
+                    body: (readField('inviteBody') ?? '').trim()
+                }
+            };
+        }
+
+        async function save() {
+            const body = collect();
+            if (!body.title) { E.toast('Title is required.', {type: 'error'}); return; }
+            if (!isEdit && !body.slug) { E.toast('Slug is required.', {type: 'error'}); return; }
+            try {
+                if (isEdit) {
+                    const {slug, ...patch} = body; // slug immutable
+                    await api(`${BASE}/surveys/${encodeURIComponent(editSlug)}`, 'PUT', patch);
+                    E.toast('Survey updated.', {type: 'success'});
+                } else {
+                    await api(`${BASE}/surveys`, 'POST', body);
+                    E.toast('Survey created.', {type: 'success'});
+                }
+                location.hash = '#/plugins/surveys';
+            } catch (err) {
+                E.toast(err?.message ?? 'Failed to save survey.', {type: 'error'});
+            }
+        }
+
+        const saveBtn = root.querySelector('#save-btn');
+        if (saveBtn) {
+            saveBtn.textContent = isEdit ? 'Update Survey' : 'Create Survey';
+            saveBtn.addEventListener('click', save);
+        }
+        const goBack = () => { location.hash = '#/plugins/surveys'; };
+        root.querySelector('#cancel-btn')?.addEventListener('click', goBack);
+        root.querySelector('#back-btn')?.addEventListener('click', goBack);
+
+        // ---- Send / reminder (edit + open only) -----------------------------
+        const sendPanel = root.querySelector('#send-panel');
+        const sendHint = root.querySelector('#send-hint');
+        if (sendPanel && isEdit) {
+            sendPanel.style.display = '';
+            if (sendHint) {
+                sendHint.textContent = survey?.status === 'open'
+                    ? ''
+                    : 'Survey must be Open before invitations are meaningful.';
+            }
+        }
+
+        async function send(audience, label) {
+            const ok = await E.confirm(`${label}?`);
+            if (!ok) return;
+            try {
+                const res = await api(`${BASE}/surveys/${encodeURIComponent(editSlug)}/send`, 'POST', {audience});
+                const results = Array.isArray(res?.results) ? res.results : [];
+                const sent = results.filter((r) => r.ok).length;
+                E.toast(`${sent} of ${results.length} invitation(s) sent.`, {type: 'success'});
+            } catch (err) {
+                E.toast(err?.message ?? 'Send failed.', {type: 'error'});
+            }
+        }
+
+        root.querySelector('#send-all-btn')?.addEventListener('click', () => send('all', 'Send invitations to the whole audience'));
+        root.querySelector('#send-reminder-btn')?.addEventListener('click', () => send('non-responders', 'Send a reminder to non-responders'));
+
+        if (typeof Domma !== 'undefined' && Domma.icons) Domma.icons.scan();
+    }
+};

package/plugins/surveys/admin/views/surveys.js

@@ -0,0 +1,161 @@
+/**
+ * Surveys plugin — campaign list view.
+ *
+ * Lists survey campaigns in a Domma table with status/mode badges and
+ * row actions that navigate to the editor and results views.
+ *
+ * @module surveys/admin/views/surveys
+ */
+
+const BASE = '/api/plugins/surveys';
+
+/**
+ * Authenticated JSON fetch helper. Mirrors plugins/contacts/admin/views/contacts.js.
+ *
+ * @param {string} url
+ * @param {string} [method]
+ * @param {object} [body]
+ * @returns {Promise<*>}
+ */
+async function api(url, method = 'GET', body) {
+    const opts = {method, headers: {'Authorization': 'Bearer ' + (S.get('auth_token') || '')}};
+    if (body !== undefined) {
+        opts.headers['Content-Type'] = 'application/json';
+        opts.body = JSON.stringify(body);
+    }
+    const res = await fetch(url, opts);
+    if (!res.ok) {
+        const err = await res.json().catch(() => ({error: res.statusText}));
+        throw new Error(err.error || res.statusText);
+    }
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+}
+
+/**
+ * Escape HTML special characters to prevent XSS in render strings.
+ *
+ * @param {*} str
+ * @returns {string}
+ */
+function esc(str) {
+    return String(str ?? '')
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+
+const STATUS_VARIANT = {draft: 'badge-secondary', open: 'badge-success', closed: 'badge-warning'};
+
+export const surveysView = {
+    templateUrl: '/plugins/surveys/admin/templates/surveys.html',
+
+    /**
+     * Mount the surveys list view.
+     *
+     * @param {object} $container - Domma-wrapped container element
+     * @returns {Promise<void>}
+     */
+    async onMount($container) {
+        let surveys = [];
+        let table = null;
+
+        async function load() {
+            try {
+                surveys = await api(`${BASE}/surveys`);
+            } catch (err) {
+                surveys = [];
+                E.toast(err?.message ?? 'Failed to load surveys.', {type: 'error'});
+            }
+        }
+
+        function build() {
+            const tableEl = $container.find('#surveys-table').get(0);
+            const emptyEl = $container.find('#surveys-empty').get(0);
+
+            if (!surveys.length) {
+                if (tableEl) tableEl.style.display = 'none';
+                if (emptyEl) emptyEl.style.display = 'block';
+                return;
+            }
+            if (emptyEl) emptyEl.style.display = 'none';
+            if (tableEl) tableEl.style.display = '';
+
+            if (table) {
+                table.setData(surveys);
+                Domma.icons.scan();
+                return;
+            }
+
+            // Render functions MUST return HTML strings (T.create contract).
+            // Action buttons carry data-slug + a class; DOMPurify (run by the
+            // table renderer) strips inline onclick, so clicks are wired via
+            // unnamespaced delegation on $container after the table mounts.
+            table = T.create($container.find('#surveys-table').get(0), {
+                data: surveys,
+                columns: [
+                    {
+                        key: 'title',
+                        title: 'Title',
+                        sortable: true,
+                        render: (v) => `<strong>${esc(v)}</strong>`
+                    },
+                    {
+                        key: 'status',
+                        title: 'Status',
+                        sortable: true,
+                        render: (v) => {
+                            const variant = STATUS_VARIANT[v] || 'badge-secondary';
+                            return `<span class="badge ${variant}">${esc(v || 'draft')}</span>`;
+                        }
+                    },
+                    {
+                        key: 'mode',
+                        title: 'Mode',
+                        sortable: true,
+                        render: (v) => esc(v || 'identified')
+                    },
+                    {
+                        key: 'slug',
+                        title: 'Actions',
+                        sortable: false,
+                        render: (slug) => {
+                            const s = esc(slug);
+                            return `<button class="btn btn-sm btn-outline btn-edit-survey" ` +
+                                `data-slug="${s}" style="margin-right:4px;">` +
+                                `<span data-icon="edit" data-icon-size="14"></span> Edit</button>` +
+                                `<button class="btn btn-sm btn-outline btn-results-survey" ` +
+                                `data-slug="${s}">` +
+                                `<span data-icon="bar-chart" data-icon-size="14"></span> Results</button>`;
+                        }
+                    }
+                ],
+                emptyMessage: 'No surveys yet.'
+            });
+
+            Domma.icons.scan();
+        }
+
+        // Toolbar wiring
+        const newBtn = $container.find('#new-survey').get(0);
+        if (newBtn) newBtn.addEventListener('click', () => { location.hash = '#/plugins/surveys/new'; });
+
+        const audienceBtn = $container.find('#manage-audience').get(0);
+        if (audienceBtn) audienceBtn.addEventListener('click', () => { location.hash = '#/plugins/surveys/audience'; });
+
+        // Row-action delegation (proven pattern — see admin/js/views/api-tokens.js).
+        // Unnamespaced + idempotent via .off()/.on(); namespaced delegation is
+        // broken in this codebase.
+        $container.off('click', '.btn-edit-survey').on('click', '.btn-edit-survey', function () {
+            location.hash = '#/plugins/surveys/edit/' + this.getAttribute('data-slug');
+        });
+        $container.off('click', '.btn-results-survey').on('click', '.btn-results-survey', function () {
+            location.hash = '#/plugins/surveys/results/' + this.getAttribute('data-slug');
+        });
+
+        await load();
+        build();
+        Domma.icons.scan();
+    }
+};

package/plugins/surveys/collections/survey-contacts/schema.json

@@ -0,0 +1,13 @@
+{
+  "slug": "surveys-contacts",
+  "title": "Survey Contacts",
+  "description": "Shared survey audience contacts.",
+  "plugin": "surveys",
+  "storage": {"adapter": "mongodb", "connection": "default"},
+  "fields": [
+    {"name": "name",  "label": "Name",  "type": "text",     "required": false},
+    {"name": "email", "label": "Email", "type": "text",     "required": true},
+    {"name": "groups","label": "Groups","type": "text",     "required": false},
+    {"name": "meta",  "label": "Meta",  "type": "textarea", "required": false}
+  ]
+}

package/plugins/surveys/collections/survey-groups/schema.json

@@ -0,0 +1,11 @@
+{
+  "slug": "surveys-groups",
+  "title": "Survey Groups",
+  "description": "Named survey audience groups.",
+  "plugin": "surveys",
+  "storage": {"adapter": "mongodb", "connection": "default"},
+  "fields": [
+    {"name": "name",        "label": "Name",        "type": "text",     "required": true},
+    {"name": "description", "label": "Description", "type": "textarea", "required": false}
+  ]
+}

package/plugins/surveys/collections/survey-invites/schema.json

@@ -0,0 +1,16 @@
+{
+  "slug": "surveys-invites",
+  "title": "Survey Invites",
+  "description": "Per-recipient invite ledger (token hashes + status).",
+  "plugin": "surveys",
+  "storage": {"adapter": "mongodb", "connection": "default"},
+  "fields": [
+    {"name": "surveyId",    "label": "Survey",      "type": "text", "required": true},
+    {"name": "contactId",   "label": "Contact",     "type": "text", "required": true},
+    {"name": "tokenHash",   "label": "Token Hash",  "type": "text", "required": true},
+    {"name": "status",      "label": "Status",      "type": "text", "required": true},
+    {"name": "sentAt",      "label": "Sent At",     "type": "text", "required": false},
+    {"name": "completedAt", "label": "Completed At","type": "text", "required": false},
+    {"name": "responseId",  "label": "Response",    "type": "text", "required": false}
+  ]
+}

package/plugins/surveys/collections/surveys/schema.json

@@ -0,0 +1,23 @@
+{
+  "slug": "surveys-surveys",
+  "title": "Surveys",
+  "description": "Survey campaigns.",
+  "plugin": "surveys",
+  "storage": {"adapter": "mongodb", "connection": "default"},
+  "fields": [
+    {"name": "slug",              "label": "Slug",              "type": "text",     "required": true},
+    {"name": "title",             "label": "Title",             "type": "text",     "required": true},
+    {"name": "description",       "label": "Description",       "type": "textarea", "required": false},
+    {"name": "formSlug",          "label": "Form",              "type": "text",     "required": true},
+    {"name": "groupIds",          "label": "Groups",            "type": "text",     "required": false},
+    {"name": "mode",              "label": "Mode",              "type": "text",     "required": true},
+    {"name": "status",            "label": "Status",            "type": "text",     "required": true},
+    {"name": "opensAt",           "label": "Opens At",          "type": "text",     "required": false},
+    {"name": "closesAt",          "label": "Closes At",         "type": "text",     "required": false},
+    {"name": "reminderAfterDays", "label": "Reminder (days)",   "type": "text",     "required": false},
+    {"name": "intro",             "label": "Intro (Markdown)",  "type": "textarea", "required": false},
+    {"name": "footer",            "label": "Footer (Markdown)", "type": "textarea", "required": false},
+    {"name": "thankYou",          "label": "Thank-you message", "type": "textarea", "required": false},
+    {"name": "inviteEmail",       "label": "Invite Email",      "type": "textarea", "required": false}
+  ]
+}

package/plugins/surveys/config.js

@@ -0,0 +1,8 @@
+export default {
+    // Pro: Mongo when config/connections.json exists; degrades to file otherwise.
+    storage: {adapter: 'mongodb', connection: 'default'},
+    // Service token (dcms_...) the external scheduler presents to /due-work + /run.
+    // Empty disables the scheduler endpoints (403). Set in config/plugins.json.
+    schedulerToken: '',
+    fromName: 'Surveys'
+};

package/plugins/surveys/plugin.js

@@ -0,0 +1,169 @@
+import defaultConfig from './config.js';
+import {createEntry, deleteEntry, getEntry, listEntries, updateEntry} from '../../server/services/collections.js';
+import {createCampaigns} from './lib/campaigns.js';
+import {createAudience} from './lib/audience.js';
+import {createLedger} from './lib/ledger.js';
+import {createTransport, sendEmail} from '../../server/services/email.js';
+import {getConfig} from '../../server/config.js';
+import {readForm} from '../../server/services/forms.js';
+import {runSend} from './lib/sending.js';
+import {aggregateField, campaignHealth, toCsv} from './lib/stats.js';
+import {registerPluginResource} from '../../server/services/permissionRegistry.js';
+
+const col = {createEntry, deleteEntry, getEntry, listEntries, updateEntry};
+
+// Register the `surveys` permission family (idempotent — no-op if already present).
+// Custom roles are NOT back-filled; admins grant it in the role editor (same gotcha
+// as Menus/Projects).
+registerPluginResource({
+    key: 'surveys',
+    label: 'Surveys',
+    description: 'Create and manage survey campaigns, audiences, and results.',
+    icon: 'clipboard-list',
+    group: 'Plugins',
+    actions: [
+        {key: 'read',   label: 'View',   description: 'View surveys, audience, and results'},
+        {key: 'create', label: 'Create', description: 'Create surveys, contacts, and groups'},
+        {key: 'update', label: 'Edit',   description: 'Edit surveys and send invitations'},
+        {key: 'delete', label: 'Delete', description: 'Delete surveys, contacts, and groups'}
+    ]
+}, 'surveys');
+
+export default async function surveysPlugin(fastify, options) {
+    const {authenticate} = options.auth;
+    const config = {...defaultConfig, ...(options.settings || {})};
+    const campaigns = createCampaigns(col);
+    const audience = createAudience(col);
+    const ledger = createLedger(col);
+    const auth = {preHandler: [authenticate]};
+
+    // ---- [survey] embed shortcode ----
+    // Drops a survey mount point into any page. The client (survey.mjs) resolves
+    // the form slug at runtime, so `data-form-slug` may safely be left empty.
+    // Guarded so the registration never throws when hooks are absent (test harness).
+    if (options.hooks?.registerShortcode) {
+        options.hooks.registerShortcode('survey', async (attrStr, body, context) => {
+            const attrs = context.parseShortcodeAttrs(attrStr);
+            const slug = attrs.slug || '';
+            const esc = context.escapeAttr || ((v) => String(v ?? ''));
+            let formSlug = '';
+            try {
+                const survey = slug ? await campaigns.getBySlug(slug) : null;
+                formSlug = survey?.data?.formSlug || '';
+            } catch {
+                formSlug = '';
+            }
+            return `<div class="survey-mount" data-survey-slug="${esc(slug)}" data-form-slug="${esc(formSlug)}"></div>`
+                + `<script type="module" src="/plugins/surveys/public/survey.mjs"></script>`;
+        });
+    }
+
+    // ---- Surveys (campaigns) ----
+    fastify.get('/surveys', auth, async () => (await campaigns.all()).map(e => ({id: e.id, ...e.data})));
+
+    fastify.post('/surveys', auth, async (req, reply) => {
+        try {
+            const s = await campaigns.createSurvey(req.body ?? {});
+            return reply.code(201).send({id: s.id, ...s.data});
+        } catch (err) { return reply.code(400).send({error: err.message}); }
+    });
+
+    fastify.get('/surveys/:slug', auth, async (req, reply) => {
+        const s = await campaigns.getBySlug(req.params.slug);
+        if (!s) return reply.code(404).send({error: 'Survey not found'});
+        return {id: s.id, ...s.data};
+    });
+
+    fastify.put('/surveys/:slug', auth, async (req, reply) => {
+        const s = await campaigns.getBySlug(req.params.slug);
+        if (!s) return reply.code(404).send({error: 'Survey not found'});
+        const updated = await campaigns.updateSurvey(s.id, req.body ?? {});
+        return {id: updated.id, ...updated.data};
+    });
+
+    // ---- Audience: contacts ----
+    fastify.get('/contacts', auth, async () => audience.listContacts());
+    fastify.post('/contacts', auth, async (req, reply) => {
+        const {name, email, groups} = req.body ?? {};
+        if (!email) return reply.code(400).send({error: 'email is required'});
+        const e = await createEntry('surveys-contacts', {name: name ?? '', email, groups: Array.isArray(groups) ? groups : []}, {source: 'admin'});
+        return reply.code(201).send({id: e.id, ...e.data});
+    });
+    fastify.delete('/contacts/:id', auth, async (req, reply) => {
+        await deleteEntry('surveys-contacts', req.params.id).catch(() => {});
+        return {ok: true};
+    });
+
+    // ---- Audience: groups ----
+    fastify.get('/groups', auth, async () => {
+        const {entries} = await listEntries('surveys-groups', {limit: 10000});
+        return entries.map(e => ({id: e.id, name: e.data.name, description: e.data.description ?? ''}));
+    });
+    fastify.post('/groups', auth, async (req, reply) => {
+        const {name, description} = req.body ?? {};
+        if (!name) return reply.code(400).send({error: 'name is required'});
+        const e = await createEntry('surveys-groups', {name, description: description ?? ''}, {source: 'admin'});
+        return reply.code(201).send({id: e.id, ...e.data});
+    });
+
+    // ---- Import from Contacts plugin ----
+    fastify.post('/import-from-contacts', auth, async (req, reply) => {
+        const {entries} = await listEntries('contacts-contacts', {limit: 100000}).catch(() => ({entries: []}));
+        const source = entries.map(e => ({name: e.data.name, email: e.data.email, groups: e.data.groups}));
+        const result = await audience.importFromContacts(source);
+        return reply.send(result);
+    });
+
+    fastify.post('/surveys/:slug/send', auth, async (req, reply) => {
+        const survey = await campaigns.getBySlug(req.params.slug);
+        if (!survey) return reply.code(404).send({error: 'Survey not found'});
+        const mode = (req.body?.audience === 'non-responders') ? 'non-responders' : 'all';
+        const smtp = getConfig('site').smtp || {};
+        const transport = await createTransport(smtp);
+        // Survey links in emails must be ABSOLUTE. Prefer the configured canonical
+        // site URL; fall back to the origin of this admin request so links work
+        // out of the box even when config/site.json has no `url`.
+        const baseUrl = (getConfig('site').url || '').replace(/\/$/, '')
+            || `${req.protocol}://${req.headers.host}`;
+        const {results} = await runSend({
+            survey, mode, audience, ledger, transport, sendEmail, smtp,
+            baseUrl, fromName: config.fromName, nowIso: new Date().toISOString()
+        });
+        return reply.send({results});
+    });
+
+    fastify.get('/surveys/:slug/stats', auth, async (req, reply) => {
+        const survey = await campaigns.getBySlug(req.params.slug);
+        if (!survey) return reply.code(404).send({error: 'Survey not found'});
+        const form = await readForm(survey.data.formSlug).catch(() => null);
+        const {entries} = await listEntries(survey.data.formSlug, {limit: 100000}).catch(() => ({entries: []}));
+        // Scope to THIS survey's responses (tagged `survey:<slug>` at submit time),
+        // so direct submissions to a shared form are excluded.
+        const tag = `survey:${survey.data.slug}`;
+        const rows = entries.filter(e => e.meta?.source === tag).map(e => e.data);
+        const fields = (form?.fields || [])
+            .filter(f => !['page-break', 'spacer', 'heading', 'paragraph', 'html'].includes(f.type))
+            .map(f => aggregateField(f, rows));
+        const health = campaignHealth(await ledger.invitesForSurvey(survey.id));
+        return reply.send({health, fields});
+    });
+
+    fastify.get('/surveys/:slug/export', auth, async (req, reply) => {
+        const survey = await campaigns.getBySlug(req.params.slug);
+        if (!survey) return reply.code(404).send({error: 'Survey not found'});
+        const form = await readForm(survey.data.formSlug).catch(() => null);
+        const cols = (form?.fields || []).map(f => f.name).filter(Boolean);
+        const {entries} = await listEntries(survey.data.formSlug, {limit: 100000}).catch(() => ({entries: []}));
+        // Export only this survey's tagged responses, not stray form submissions.
+        const tag = `survey:${survey.data.slug}`;
+        const rows = entries.filter(e => e.meta?.source === tag).map(e => e.data);
+        if ((req.query.format || 'csv') === 'json') {
+            return reply.header('Content-Disposition', `attachment; filename="${survey.data.slug}.json"`).send(rows);
+        }
+        return reply.header('Content-Type', 'text/csv')
+            .header('Content-Disposition', `attachment; filename="${survey.data.slug}.csv"`)
+            .send(toCsv(rows, cols));
+    });
+
+    fastify.surveys = {campaigns, audience, ledger, col, config};
+}