includio-cms 0.15.3 → 0.15.4

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to includio-cms are documented here.
 Generated from `src/lib/updates/` — do not edit manually.
 
+## 0.15.4 — 2026-04-21
+
+Forms: auto-scaffolded public submission endpoint + decoupled notification emails from submission success.
+
+### Added
+- CLI scaffold (`pnpm includio scaffold admin`) now emits `src/routes/api/forms/[slug]/submit/+server.ts` — the public POST endpoint for form submissions. Previously each project had to hand-roll this file (the handler lives in the library, but SvelteKit does not load routes from `node_modules`). New projects get it out-of-the-box; existing projects can run `includio scaffold admin` to generate it without overwriting other admin files.
+- Added `ideas/health-check-module.md` — proposal for built-in `/api/health` + `/api/health/ready` endpoints, opt-in SMTP verify, and a ręczny "Test SMTP connection / Send test mail" section in the admin maintenance page. Context: diagnosing a silent SMTP misconfiguration in a live project required grepping through library internals; a one-click diagnostics panel would have surfaced the empty `EMAIL_HOST` immediately.
+
+### Fixed
+- `createFormSubmission()` now keeps the notification-email call in a separate `try/catch` from the DB write. Before: if SMTP was misconfigured (empty `EMAIL_HOST` locally, unreachable relay, etc.) the whole operation returned `false` → endpoint responded `500 "Submission failed"` even though the submission was already persisted. After: DB failure still returns `false` (critical path); email failure is logged via `console.error` and the submission succeeds with `200`.
+
+### Notes
+
+No SQL migration. No API signature changes. Existing projects that already have a hand-rolled `src/routes/api/forms/[slug]/submit/+server.ts` keep working — scaffold skips existing files unless `--force` is passed.
+
 ## 0.15.3 — 2026-04-16
 
 Shop: InPost carrier adapter — Geowidget v5 picker + ShipX shipment + webhook auto-status.

package/DOCS.md

@@ -1,4 +1,4 @@
-# Includio CMS Documentation (v0.15.3)
+# Includio CMS Documentation (v0.15.4)
 
 > This file is auto-generated from the docs site. For the latest version, update the package.
 
@@ -2743,9 +2743,13 @@ Forms can be submitted from your frontend via a public POST endpoint:
 
 ```
 POST /api/forms/{slug}/submit
-Content-Type: multipart/form-data
+Content-Type: multipart/form-data   # or application/json for file-less payloads
 ```
 
+> **Auto-generated endpoint:** Running `includio scaffold admin` generates `src/routes/api/forms/[slug]/submit/+server.ts` automatically — no manual setup required. To customize (extra middleware, logging, honeypot handling), edit the generated file; it won't be overwritten unless you re-run scaffold with `--force`.
+
+> **Notification emails are best-effort:** If a form has `notificationEmailAddresses` set and email sending fails (e.g. misconfigured SMTP), the submission is still saved and the endpoint returns `200`. The error is logged to `console.error` — check server logs if you stop receiving notifications.
+
 ### Submitting from Frontend
 
 ```typescript

package/ROADMAP.md

@@ -318,6 +318,12 @@
 - [x] `[feature]` `[P2]` `inpostAdapter()` — Geowidget v5 (`<InpostPicker>` Svelte + raw config endpoint), ShipX shipment create + auto-buy + label PDF + cancel, webhook → status + tracking, per-shipping-method service config, customer tracking display in `<OrderStatus>` + email templates
 - [x] `[chore]` `[P2]` Verbose logging on adapter auto-confirm flow (offer prep wait, buy POST, polling) for sandbox debugging
 
+## 0.15.4 — Forms submission scaffold + best-effort notification emails
+
+- [x] `[feature]` `[P1]` CLI scaffold emits `src/routes/api/forms/[slug]/submit/+server.ts` — public form submit endpoint auto-generated, no manual setup per project <!-- files: src/lib/cli/scaffold/admin.ts, src/lib/cli/scaffold/admin.spec.ts -->
+- [x] `[fix]` `[P0]` `createFormSubmission` — split try/catch so SMTP failure no longer returns `false` (endpoint responded 500 even though submission was persisted); notification email is best-effort, logged via `console.error` <!-- files: src/lib/core/server/forms/submissions/operations/create.ts -->
+- [ ] `[feature]` `[P1]` Built-in `/api/health` + `/api/health/ready` with per-adapter checks (db/files/email/ai) + ręczny SMTP diagnostics panel in maintenance page <!-- files: ideas/health-check-module.md -->
+
 ## 0.16.0 — SEO module
 
 - [ ] `[feature]` `[P1]` SERP preview + character limits for title/description <!-- files: src/lib/admin/components/fields/seo-field.svelte -->

package/dist/cli/scaffold/admin.js

@@ -340,6 +340,65 @@ export const { GET, POST, PATCH, PUT, DELETE } = createAdminApiHandler();
 import { createRestApiHandler } from 'includio-cms/admin/api/rest/handler';
 
 export const { GET, POST, PUT, DELETE } = createRestApiHandler();
+`
+        },
+        {
+            path: 'api/forms/[slug]/submit/+server.ts',
+            content: `${GENERATED_COMMENT_TS}
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { createFormSubmission, parseFormDataForSubmission } from 'includio-cms/sveltekit/server';
+import { getCMS } from 'includio-cms/core';
+
+const counts = new Map<string, { count: number; resetAt: number }>();
+const LIMIT = 5;
+const WINDOW = 60 * 60 * 1000;
+
+function checkRateLimit(ip: string): boolean {
+	const now = Date.now();
+	const entry = counts.get(ip);
+	if (!entry || now > entry.resetAt) {
+		counts.set(ip, { count: 1, resetAt: now + WINDOW });
+		return true;
+	}
+	if (entry.count >= LIMIT) return false;
+	entry.count++;
+	return true;
+}
+
+export const POST: RequestHandler = async (event) => {
+	const slug = event.params.slug;
+	const ip = event.getClientAddress();
+	if (!checkRateLimit(ip)) return json({ error: 'Rate limit exceeded' }, { status: 429 });
+
+	const contentType = event.request.headers.get('content-type') || '';
+	const isMultipart = contentType.includes('multipart/form-data');
+	let data: Record<string, unknown>;
+
+	try {
+		if (isMultipart) {
+			const config = getCMS().getFormBySlug(slug);
+			const formData = await event.request.formData();
+			data = await parseFormDataForSubmission(formData, config.fields);
+		} else {
+			data = await event.request.json();
+		}
+	} catch (err) {
+		return json({ error: err instanceof Error ? err.message : 'Invalid request' }, { status: 400 });
+	}
+
+	try {
+		const success = await createFormSubmission({
+			slug,
+			data,
+			ip,
+			userAgent: event.request.headers.get('user-agent') || undefined
+		});
+		return success ? json({ success: true }) : json({ error: 'Submission failed' }, { status: 500 });
+	} catch (err) {
+		return json({ error: err instanceof Error ? err.message : 'Unknown error' }, { status: 400 });
+	}
+};
 `
         }
     ];

package/dist/core/server/forms/submissions/operations/create.js

@@ -16,7 +16,13 @@ export const createFormSubmission = async (options) => {
             ip,
             userAgent
         });
-        if (config.notificationEmailAddresses && config.notificationEmailAddresses.length > 0 && getCMS().emailAdapter) {
+    }
+    catch (err) {
+        console.error('[forms] DB createFormSubmission failed:', err);
+        return false;
+    }
+    if (config.notificationEmailAddresses && config.notificationEmailAddresses.length > 0 && getCMS().emailAdapter) {
+        try {
             await getCMS().emailAdapter.sendMail({
                 to: config.notificationEmailAddresses,
                 subject: `New submission for form "${getLocalizedLabel(config.label, 'en')}"`,
@@ -24,9 +30,9 @@ export const createFormSubmission = async (options) => {
 					   <p>Please log in to the admin panel to view the submission details.</p>`
             });
         }
-        return true;
-    }
-    catch {
-        return false;
+        catch (err) {
+            console.error('[forms] notification email failed (submission already saved):', err);
+        }
     }
+    return true;
 };

package/dist/paraglide/messages/_index.d.ts

@@ -1,36 +1,3 @@
-export function hello_world(inputs: {
-    name: NonNullable<unknown>;
-}, options?: {
-    locale?: "en" | "pl";
-}): string;
-/**
-* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
-*
-* - Changing this function will be over-written by the next build.
-*
-* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
-* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
-*
-* @param {{}} inputs
-* @param {{ locale?: "en" | "pl" }} options
-* @returns {string}
-*/
-declare function login_hello(inputs?: {}, options?: {
-    locale?: "en" | "pl";
-}): string;
-/**
-* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
-*
-* - Changing this function will be over-written by the next build.
-*
-* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
-* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
-*
-* @param {{}} inputs
-* @param {{ locale?: "en" | "pl" }} options
-* @returns {string}
-*/
-declare function login_please_login(inputs?: {}, options?: {
-    locale?: "en" | "pl";
-}): string;
-export { login_hello as login.hello, login_please_login as login.please_login };
+export * from "./hello_world.js";
+export * from "./login_hello.js";
+export * from "./login_please_login.js";

package/dist/paraglide/messages/_index.js

@@ -1,72 +1,4 @@
 /* eslint-disable */
-import { getLocale, trackMessageCall, experimentalMiddlewareLocaleSplitting, isServer } from "../runtime.js"
-import * as en from "./en.js"
-import * as pl from "./pl.js"
-/**
-* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
-*
-* - Changing this function will be over-written by the next build.
-*
-* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
-* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
-* 
-* @param {{ name: NonNullable<unknown> }} inputs
-* @param {{ locale?: "en" | "pl" }} options
-* @returns {string}
-*/
-/* @__NO_SIDE_EFFECTS__ */
-export const hello_world = (inputs, options = {}) => {
-	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
-		return /** @type {any} */ (globalThis).__paraglide_ssr.hello_world(inputs) 
-	}
-	const locale = options.locale ?? getLocale()
-	trackMessageCall("hello_world", locale)
-	if (locale === "en") return en.hello_world(inputs)
-	return pl.hello_world(inputs)
-};
-/**
-* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
-*
-* - Changing this function will be over-written by the next build.
-*
-* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
-* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
-* 
-* @param {{}} inputs
-* @param {{ locale?: "en" | "pl" }} options
-* @returns {string}
-*/
-/* @__NO_SIDE_EFFECTS__ */
-const login_hello = (inputs = {}, options = {}) => {
-	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
-		return /** @type {any} */ (globalThis).__paraglide_ssr.login_hello(inputs) 
-	}
-	const locale = options.locale ?? getLocale()
-	trackMessageCall("login_hello", locale)
-	if (locale === "en") return en.login_hello(inputs)
-	return pl.login_hello(inputs)
-};
-export { login_hello as "login.hello" }
-/**
-* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
-*
-* - Changing this function will be over-written by the next build.
-*
-* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
-* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
-* 
-* @param {{}} inputs
-* @param {{ locale?: "en" | "pl" }} options
-* @returns {string}
-*/
-/* @__NO_SIDE_EFFECTS__ */
-const login_please_login = (inputs = {}, options = {}) => {
-	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
-		return /** @type {any} */ (globalThis).__paraglide_ssr.login_please_login(inputs) 
-	}
-	const locale = options.locale ?? getLocale()
-	trackMessageCall("login_please_login", locale)
-	if (locale === "en") return en.login_please_login(inputs)
-	return pl.login_please_login(inputs)
-};
-export { login_please_login as "login.please_login" }
+export * from './hello_world.js'
+export * from './login_hello.js'
+export * from './login_please_login.js'

package/dist/paraglide/messages/hello_world.d.ts

@@ -0,0 +1,5 @@
+export function hello_world(inputs: {
+    name: NonNullable<unknown>;
+}, options?: {
+    locale?: "en" | "pl";
+}): string;

package/dist/paraglide/messages/hello_world.js

@@ -0,0 +1,33 @@
+/* eslint-disable */
+import { getLocale, trackMessageCall, experimentalMiddlewareLocaleSplitting, isServer } from '../runtime.js';
+
+const en_hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
+	return `Hello, ${i.name} from en!`
+};
+
+const pl_hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
+	return `Hello, ${i.name} from pl!`
+};
+
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{ name: NonNullable<unknown> }} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+export const hello_world = (inputs, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.hello_world(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("hello_world", locale)
+	if (locale === "en") return en_hello_world(inputs)
+	return pl_hello_world(inputs)
+};

package/dist/paraglide/messages/login_hello.d.ts

@@ -0,0 +1,16 @@
+export { login_hello as login.hello };
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+*
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+declare function login_hello(inputs?: {}, options?: {
+    locale?: "en" | "pl";
+}): string;

package/dist/paraglide/messages/login_hello.js

@@ -0,0 +1,34 @@
+/* eslint-disable */
+import { getLocale, trackMessageCall, experimentalMiddlewareLocaleSplitting, isServer } from '../runtime.js';
+
+const en_login_hello = /** @type {(inputs: {}) => string} */ () => {
+	return `Welcome back`
+};
+
+const pl_login_hello = /** @type {(inputs: {}) => string} */ () => {
+	return `Witaj ponownie`
+};
+
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+const login_hello = (inputs = {}, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.login_hello(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("login_hello", locale)
+	if (locale === "en") return en_login_hello(inputs)
+	return pl_login_hello(inputs)
+};
+export { login_hello as "login.hello" }

package/dist/paraglide/messages/login_please_login.d.ts

@@ -0,0 +1,16 @@
+export { login_please_login as login.please_login };
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+*
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+declare function login_please_login(inputs?: {}, options?: {
+    locale?: "en" | "pl";
+}): string;

package/dist/paraglide/messages/login_please_login.js

@@ -0,0 +1,34 @@
+/* eslint-disable */
+import { getLocale, trackMessageCall, experimentalMiddlewareLocaleSplitting, isServer } from '../runtime.js';
+
+const en_login_please_login = /** @type {(inputs: {}) => string} */ () => {
+	return `Login to your account`
+};
+
+const pl_login_please_login = /** @type {(inputs: {}) => string} */ () => {
+	return `Zaloguj się na swoje konto`
+};
+
+/**
+* This function has been compiled by [Paraglide JS](https://inlang.com/m/gerre34r).
+*
+* - Changing this function will be over-written by the next build.
+*
+* - If you want to change the translations, you can either edit the source files e.g. `en.json`, or
+* use another inlang app like [Fink](https://inlang.com/m/tdozzpar) or the [VSCode extension Sherlock](https://inlang.com/m/r7kp499g).
+* 
+* @param {{}} inputs
+* @param {{ locale?: "en" | "pl" }} options
+* @returns {string}
+*/
+/* @__NO_SIDE_EFFECTS__ */
+const login_please_login = (inputs = {}, options = {}) => {
+	if (experimentalMiddlewareLocaleSplitting && isServer === false) {
+		return /** @type {any} */ (globalThis).__paraglide_ssr.login_please_login(inputs) 
+	}
+	const locale = options.locale ?? getLocale()
+	trackMessageCall("login_please_login", locale)
+	if (locale === "en") return en_login_please_login(inputs)
+	return pl_login_please_login(inputs)
+};
+export { login_please_login as "login.please_login" }

package/dist/updates/0.15.4/index.d.ts

@@ -0,0 +1,2 @@
+import type { CmsUpdate } from '../index.js';
+export declare const update: CmsUpdate;

package/dist/updates/0.15.4/index.js

@@ -0,0 +1,14 @@
+export const update = {
+    version: '0.15.4',
+    date: '2026-04-21',
+    description: 'Forms: auto-scaffolded public submission endpoint + decoupled notification emails from submission success.',
+    features: [
+        'CLI scaffold (`pnpm includio scaffold admin`) now emits `src/routes/api/forms/[slug]/submit/+server.ts` — the public POST endpoint for form submissions. Previously each project had to hand-roll this file (the handler lives in the library, but SvelteKit does not load routes from `node_modules`). New projects get it out-of-the-box; existing projects can run `includio scaffold admin` to generate it without overwriting other admin files.',
+        'Added `ideas/health-check-module.md` — proposal for built-in `/api/health` + `/api/health/ready` endpoints, opt-in SMTP verify, and a ręczny "Test SMTP connection / Send test mail" section in the admin maintenance page. Context: diagnosing a silent SMTP misconfiguration in a live project required grepping through library internals; a one-click diagnostics panel would have surfaced the empty `EMAIL_HOST` immediately.'
+    ],
+    fixes: [
+        '`createFormSubmission()` now keeps the notification-email call in a separate `try/catch` from the DB write. Before: if SMTP was misconfigured (empty `EMAIL_HOST` locally, unreachable relay, etc.) the whole operation returned `false` → endpoint responded `500 "Submission failed"` even though the submission was already persisted. After: DB failure still returns `false` (critical path); email failure is logged via `console.error` and the submission succeeds with `200`.'
+    ],
+    breakingChanges: [],
+    notes: 'No SQL migration. No API signature changes. Existing projects that already have a hand-rolled `src/routes/api/forms/[slug]/submit/+server.ts` keep working — scaffold skips existing files unless `--force` is passed.'
+};

package/dist/updates/index.js

@@ -48,7 +48,8 @@ import { update as update0150 } from './0.15.0/index.js';
 import { update as update0151 } from './0.15.1/index.js';
 import { update as update0152 } from './0.15.2/index.js';
 import { update as update0153 } from './0.15.3/index.js';
-export const updates = [update0065, update0066, update0067, update0068, update0069, update010, update011, update012, update013, update014, update015, update020, update022, update050, update051, update052, update053, update054, update055, update056, update057, update058, update060, update061, update062, update070, update071, update072, update073, update080, update090, update0100, update0110, update0120, update0130, update0131, update0132, update0133, update0134, update0140, update0141, update0142, update0143, update0144, update0145, update0146, update0150, update0151, update0152, update0153];
+import { update as update0154 } from './0.15.4/index.js';
+export const updates = [update0065, update0066, update0067, update0068, update0069, update010, update011, update012, update013, update014, update015, update020, update022, update050, update051, update052, update053, update054, update055, update056, update057, update058, update060, update061, update062, update070, update071, update072, update073, update080, update090, update0100, update0110, update0120, update0130, update0131, update0132, update0133, update0134, update0140, update0141, update0142, update0143, update0144, update0145, update0146, update0150, update0151, update0152, update0153, update0154];
 export const getUpdatesFrom = (fromVersion) => {
     const fromParts = fromVersion.split('.').map(Number);
     return updates.filter((update) => {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "includio-cms",
-	"version": "0.15.3",
+	"version": "0.15.4",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build && npm run prepack",

package/dist/paraglide/messages/en.d.ts

@@ -1,5 +0,0 @@
-export const hello_world: (inputs: {
-    name: NonNullable<unknown>;
-}) => string;
-export const login_hello: (inputs: {}) => string;
-export const login_please_login: (inputs: {}) => string;

package/dist/paraglide/messages/en.js

@@ -1,14 +0,0 @@
-/* eslint-disable */
-
-
-export const hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
-	return `Hello, ${i.name} from en!`
-};
-
-export const login_hello = /** @type {(inputs: {}) => string} */ () => {
-	return `Welcome back`
-};
-
-export const login_please_login = /** @type {(inputs: {}) => string} */ () => {
-	return `Login to your account`
-};

package/dist/paraglide/messages/pl.d.ts

@@ -1,5 +0,0 @@
-export const hello_world: (inputs: {
-    name: NonNullable<unknown>;
-}) => string;
-export const login_hello: (inputs: {}) => string;
-export const login_please_login: (inputs: {}) => string;

package/dist/paraglide/messages/pl.js

@@ -1,14 +0,0 @@
-/* eslint-disable */
-
-
-export const hello_world = /** @type {(inputs: { name: NonNullable<unknown> }) => string} */ (i) => {
-	return `Hello, ${i.name} from pl!`
-};
-
-export const login_hello = /** @type {(inputs: {}) => string} */ () => {
-	return `Witaj ponownie`
-};
-
-export const login_please_login = /** @type {(inputs: {}) => string} */ () => {
-	return `Zaloguj się na swoje konto`
-};