@teamnovu/nuxt-statamic-formbuilder

@teamnovu/nuxt-statamic-formbuilder

Core Nuxt module: form configuration types, Valibot validation from Statamic rules, field conditions, field registry, Statamic CSRF submit, StatamicFormBuilder, and StatamicFormBuilderFields.

See the monorepo README for install and usage.

Security / validation

Client-side Valibot rules are for UX only. Authoritative validation is Statamic form/field validate on the server. Most PHP fieldtypes currently ship empty rules() — editors must set validation in the form blueprint (or accept weak server checks). Do not treat the Nuxt UI as a trust boundary.

Texts vs i18n

Bundled locales cover field validation messages and toast titles (form.user_feedback.*). Submit / loading / success / error body copy belongs on CMS FormBuilderTexts (see monorepo README).

By default the module publishes en/de/fr via i18n:registerModule. Set statamicFormBuilder.publishI18n: false to disable that and provide those keys in the host app instead.

CSRF preflight

By default, submitStatamicForm GETs /sanctum/csrf-cookie before posting and requires an XSRF-TOKEN cookie. Set statamicFormBuilder.fetchCsrfCookie: false (or pass fetchCsrfCookie: false to useFormBuilder / :fetch-csrf-cookie="false" on StatamicFormBuilder) to skip the preflight. When disabled, submission proceeds without a token; an existing cookie is still sent as X-XSRF-TOKEN when present.