@actuate-media/cms-core 0.30.0 → 0.32.0

package/dist/forms/spam.js

@@ -0,0 +1,93 @@
+function hostOf(value) {
+    if (!value)
+        return null;
+    try {
+        return new URL(value).hostname.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeHost(domain) {
+    return domain
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, '')
+        .replace(/\/.*$/, '')
+        .replace(/^\*\./, '');
+}
+/** Concatenate user-supplied string values for keyword scanning. */
+function textBlob(fields, rawValues) {
+    const parts = [];
+    for (const field of fields) {
+        if (field.type === 'honeypot' || field.type === 'divider')
+            continue;
+        const v = rawValues[field.key];
+        if (typeof v === 'string')
+            parts.push(v);
+        else if (Array.isArray(v))
+            parts.push(v.map((x) => String(x)).join(' '));
+    }
+    return parts.join(' \n ').toLowerCase();
+}
+export function scoreSubmissionSpam(input) {
+    const reasons = [];
+    const settings = input.settings ?? {};
+    const strategies = new Set([
+        ...(input.defaultStrategies ?? []),
+        ...(settings.strategies ?? []),
+    ]);
+    // Honeypot — always evaluated when a honeypot field/key exists. A populated
+    // honeypot means an automated client filled a field that is hidden from
+    // humans via CSS.
+    const honeypotKey = settings.honeypotFieldKey ?? input.fields.find((f) => f.type === 'honeypot')?.key;
+    if (honeypotKey) {
+        const v = input.rawValues[honeypotKey];
+        const filled = typeof v === 'string' ? v.trim() !== '' : v != null && v !== false;
+        if (filled)
+            reasons.push('honeypot');
+    }
+    // Time-to-submit — humans take a few seconds; instant submits are bots.
+    if (strategies.has('timeToSubmit') &&
+        typeof settings.minSubmitSeconds === 'number' &&
+        settings.minSubmitSeconds > 0 &&
+        typeof input.elapsedMs === 'number' &&
+        input.elapsedMs >= 0) {
+        if (input.elapsedMs < settings.minSubmitSeconds * 1000)
+            reasons.push('too_fast');
+    }
+    // Email / domain blocklist.
+    if (strategies.has('blocklist')) {
+        const email = (input.senderEmail ?? '').trim().toLowerCase();
+        if (email) {
+            const blockedEmails = (settings.blockedEmails ?? []).map((e) => e.trim().toLowerCase());
+            if (blockedEmails.includes(email))
+                reasons.push('blocked_email');
+            const domain = email.split('@')[1] ?? '';
+            const blockedDomains = (settings.blockedDomains ?? []).map((d) => normalizeHost(d));
+            if (domain && blockedDomains.includes(domain))
+                reasons.push('blocked_domain');
+        }
+    }
+    // Keyword blocklist.
+    if (strategies.has('keyword') && (settings.blockedKeywords?.length ?? 0) > 0) {
+        const blob = textBlob(input.fields, input.rawValues);
+        for (const keyword of settings.blockedKeywords ?? []) {
+            const k = keyword.trim().toLowerCase();
+            if (k && blob.includes(k)) {
+                reasons.push('blocked_keyword');
+                break;
+            }
+        }
+    }
+    // Domain allowlist — the submitting origin must be on the allowlist.
+    if (strategies.has('domainAllowlist') && (settings.allowedDomains?.length ?? 0) > 0) {
+        const host = hostOf(input.origin) ?? hostOf(input.referrer);
+        const allowed = (settings.allowedDomains ?? []).map((d) => normalizeHost(d));
+        const ok = host != null && allowed.some((a) => host === a || host.endsWith(`.${a}`));
+        if (!ok)
+            reasons.push('origin_not_allowed');
+    }
+    return { status: reasons.length > 0 ? 'spam' : 'clean', reasons };
+}
+//# sourceMappingURL=spam.js.map

package/dist/forms/spam.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spam.js","sourceRoot":"","sources":["../../src/forms/spam.ts"],"names":[],"mappings":"AAkCA,SAAS,MAAM,CAAC,KAAgC;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,MAAM;SACV,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACzB,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,MAAmB,EAAE,SAAkC;IACvE,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,SAAQ;QACnE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;aACnC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACvD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAA;IACrC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAyB;QACjD,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;KAC/B,CAAC,CAAA;IAEF,4EAA4E;IAC5E,wEAAwE;IACxE,kBAAkB;IAClB,MAAM,WAAW,GACf,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,GAAG,CAAA;IACnF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,CAAA;QACjF,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACtC,CAAC;IAED,wEAAwE;IACxE,IACE,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC;QAC9B,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;QAC7C,QAAQ,CAAC,gBAAgB,GAAG,CAAC;QAC7B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,KAAK,CAAC,SAAS,IAAI,CAAC,EACpB,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,gBAAgB,GAAG,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAClF,CAAC;IAED,4BAA4B;IAC5B,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;YACvF,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;YAChE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACxC,MAAM,cAAc,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;YACnF,IAAI,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC/E,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QACpD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACtC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBAC/B,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5E,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QACpF,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAA;AACnE,CAAC"}

package/dist/forms/submission.d.ts

@@ -0,0 +1,95 @@
+import { type FieldError } from './validation.js';
+import { type IncomingFile } from './files.js';
+import type { FormDefinition, FormField, SpamStatus } from './types.js';
+export interface SubmissionConfirmation {
+    type: 'message' | 'redirect';
+    message?: string;
+    redirectUrl?: string;
+}
+export interface SubmissionContext {
+    /** Raw field values from the request (object keyed by field key). */
+    values: Record<string, unknown>;
+    /** Already-validated file uploads to attach after the row is created. */
+    files?: IncomingFile[];
+    ip?: string;
+    userAgent?: string | null;
+    referrer?: string | null;
+    origin?: string | null;
+    pageUrl?: string | null;
+    /** Opaque attribution blob captured client-side; stored as-is. */
+    attribution?: Record<string, unknown> | null;
+    /** Milliseconds between render and submit (for the time-trap spam check). */
+    elapsedMs?: number | null;
+}
+export interface SubmissionResult {
+    submissionId: string;
+    entryNumber: number | null;
+    spamStatus: SpamStatus;
+    confirmation: SubmissionConfirmation;
+}
+/** Thrown when field validation fails; mapped to HTTP 422 by the API layer. */
+export declare class SubmissionValidationError extends Error {
+    fieldErrors: FieldError[];
+    constructor(fieldErrors: FieldError[]);
+}
+/** Resolve the field schema the submission should be validated against. */
+declare function resolveFields(form: FormDefinition): Promise<{
+    fields: FormField[];
+    versionId: string | null;
+}>;
+/**
+ * Process a validated request into a persisted submission. Throws
+ * `SubmissionValidationError` when field validation fails so the caller can
+ * return a structured 422.
+ */
+export declare function processSubmission(form: FormDefinition, ctx: SubmissionContext): Promise<SubmissionResult>;
+export interface PublicFormField {
+    id: string;
+    key: string;
+    label: string;
+    type: string;
+    required: boolean;
+    placeholder?: string;
+    helpText?: string;
+    defaultValue?: unknown;
+    options?: {
+        label: string;
+        value: string;
+    }[];
+    width?: string;
+    sortOrder: number;
+    validationRules?: Record<string, unknown>;
+    conditionalLogic?: unknown;
+}
+export interface PublicForm {
+    id: string;
+    name: string;
+    slug: string;
+    description?: string;
+    fields: PublicFormField[];
+    submitPath: string;
+    successMessage?: string;
+    redirectUrl?: string;
+    spam: {
+        honeypotFieldKey?: string;
+        minSubmitSeconds?: number;
+    };
+    captcha?: {
+        provider: string;
+        siteKey: string;
+    };
+    schemaVersionId?: string | null;
+}
+/**
+ * Project a form definition into the public, embeddable schema. Strips every
+ * server-only concern (access rules, notification recipients, webhook secrets,
+ * blocklists, encryption flags) so nothing sensitive leaks to the browser.
+ */
+export declare function buildPublicForm(form: FormDefinition, fields: FormField[], schemaVersionId: string | null, options?: {
+    captcha?: {
+        provider: string;
+        siteKey: string;
+    };
+}): PublicForm;
+export { resolveFields as resolveSubmissionFields };
+//# sourceMappingURL=submission.d.ts.map

package/dist/forms/submission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission.d.ts","sourceRoot":"","sources":["../../src/forms/submission.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAkC,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjF,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAA0B,UAAU,EAAE,MAAM,YAAY,CAAA;AAI/F,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,GAAG,UAAU,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,yEAAyE;IACzE,KAAK,CAAC,EAAE,YAAY,EAAE,CAAA;IACtB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC5C,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,YAAY,EAAE,sBAAsB,CAAA;CACrC;AAED,+EAA+E;AAC/E,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,WAAW,EAAE,UAAU,EAAE,CAAA;gBACb,WAAW,EAAE,UAAU,EAAE;CAKtC;AAUD,2EAA2E;AAC3E,iBAAe,aAAa,CAC1B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAQ5D;AAmHD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAkF3B;AAID,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACzC,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE;QACJ,gBAAgB,CAAC,EAAE,MAAM,CAAA;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,SAAS,EAAE,EACnB,eAAe,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAO,GAChE,UAAU,CAwCZ;AAQD,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,CAAA"}

package/dist/forms/submission.js

@@ -0,0 +1,282 @@
+/**
+ * Public submission pipeline.
+ *
+ * Orchestrates the full lifecycle for an incoming public submission:
+ *   resolve schema → validate + normalize → sanitize → score spam →
+ *   derive sender/preview → assign entry number (transaction) → persist →
+ *   attach files → fire plugin hooks → audit log → build confirmation.
+ *
+ * The HTTP layer (`api/handlers.ts`) is responsible only for parsing the
+ * request (JSON or multipart), resolving the form, rate-limiting, CORS, and
+ * optional CAPTCHA verification. All trust decisions live here so the same
+ * pipeline backs every entry point (public slug route, legacy id route, and
+ * the future page-builder block).
+ */
+import { getDB } from '../db.js';
+import { logEvent } from '../security/audit.js';
+import { hashClientIp } from '../security/client-ip.js';
+import { getActuateConfig } from '../config/runtime.js';
+import { getSchemaVersion } from './service.js';
+import { validateAndNormalizeSubmission } from './validation.js';
+import { scoreSubmissionSpam } from './spam.js';
+import { persistSubmissionFiles } from './files.js';
+/** Thrown when field validation fails; mapped to HTTP 422 by the API layer. */
+export class SubmissionValidationError extends Error {
+    fieldErrors;
+    constructor(fieldErrors) {
+        super('Submission validation failed');
+        this.name = 'SubmissionValidationError';
+        this.fieldErrors = fieldErrors;
+    }
+}
+const DEFAULT_SUCCESS_MESSAGE = 'Thank you! Your submission has been received.';
+function asString(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return '';
+}
+/** Resolve the field schema the submission should be validated against. */
+async function resolveFields(form) {
+    if (form.activeSchemaVersionId) {
+        const version = await getSchemaVersion(form.activeSchemaVersionId);
+        if (version && version.fields.length > 0) {
+            return { fields: version.fields, versionId: version.id };
+        }
+    }
+    return { fields: form.fields ?? [], versionId: form.activeSchemaVersionId ?? null };
+}
+function deriveSender(fields, data) {
+    let name = null;
+    let email = null;
+    let phone = null;
+    for (const field of fields) {
+        const v = asString(data[field.key]).trim();
+        if (!v)
+            continue;
+        if (!email && field.type === 'email')
+            email = v;
+        if (!phone && field.type === 'phone')
+            phone = v;
+        if (!name && /name/i.test(field.key))
+            name = v;
+    }
+    // Fallbacks by common key naming when the schema didn't use typed fields.
+    if (!email)
+        email = firstByKeys(data, ['email', 'emailaddress', 'email_address']);
+    if (!name)
+        name = firstByKeys(data, ['name', 'fullname', 'full_name', 'firstname', 'first_name']);
+    if (!phone)
+        phone = firstByKeys(data, ['phone', 'phonenumber', 'phone_number', 'tel']);
+    return { name, email, phone };
+}
+function firstByKeys(data, candidates) {
+    const lower = new Map(Object.entries(data).map(([k, v]) => [k.toLowerCase(), v]));
+    for (const c of candidates) {
+        const v = asString(lower.get(c)).trim();
+        if (v)
+            return v;
+    }
+    return null;
+}
+function derivePreview(fields, data) {
+    // Prefer long-form fields, then any non-empty string value.
+    for (const field of fields) {
+        if (field.type === 'textarea') {
+            const v = asString(data[field.key]).trim();
+            if (v)
+                return v.slice(0, 200);
+        }
+    }
+    const messageKeys = ['message', 'body', 'comments', 'notes', 'description'];
+    const byKey = firstByKeys(data, messageKeys);
+    if (byKey)
+        return byKey.slice(0, 200);
+    for (const v of Object.values(data)) {
+        const s = asString(v).trim();
+        if (s)
+            return s.slice(0, 200);
+    }
+    return null;
+}
+/** Site-wide default spam strategies; per-form strategies are merged in `scoreSubmissionSpam`. */
+function defaultSpamStrategies() {
+    return (getActuateConfig()?.forms?.defaultSpamProtection ?? []);
+}
+async function assignAndCreate(db, row, formId) {
+    // Sequential per-form entry number assigned inside a transaction so two
+    // concurrent submissions don't read the same max. Not globally unique by DB
+    // constraint, but the transaction makes collisions vanishingly unlikely.
+    if (typeof db.$transaction === 'function') {
+        return db.$transaction(async (tx) => {
+            const agg = await tx.formSubmission.aggregate({
+                where: { formId },
+                _max: { entryNumber: true },
+            });
+            const entryNumber = (agg?._max?.entryNumber ?? 0) + 1;
+            const created = await tx.formSubmission.create({
+                data: { ...row, entryNumber },
+                select: { id: true, entryNumber: true },
+            });
+            return { id: String(created.id), entryNumber: created.entryNumber ?? entryNumber };
+        });
+    }
+    const created = await db.formSubmission.create({
+        data: row,
+        select: { id: true, entryNumber: true },
+    });
+    return { id: String(created.id), entryNumber: created.entryNumber ?? null };
+}
+function buildConfirmation(form) {
+    if (form.redirectUrl && form.redirectUrl.trim()) {
+        return { type: 'redirect', redirectUrl: form.redirectUrl.trim() };
+    }
+    const message = form.successMessage?.trim() ||
+        getActuateConfig()?.forms?.defaultSuccessMessage ||
+        DEFAULT_SUCCESS_MESSAGE;
+    return { type: 'message', message };
+}
+async function fireSubmissionHooks(formId, data) {
+    try {
+        const config = getActuateConfig();
+        const hooks = (config?._pluginHooks ?? []);
+        for (const hook of hooks.filter((h) => h?.event === 'afterCreate:form-submissions')) {
+            await hook.handler({ formId, data });
+        }
+    }
+    catch (err) {
+        if (process.env.NODE_ENV !== 'test') {
+            console.error('[Actuate CMS] Form submission hook error:', err);
+        }
+    }
+}
+/**
+ * Process a validated request into a persisted submission. Throws
+ * `SubmissionValidationError` when field validation fails so the caller can
+ * return a structured 422.
+ */
+export async function processSubmission(form, ctx) {
+    const db = getDB();
+    const { fields, versionId } = await resolveFields(form);
+    const fileKeys = new Set((ctx.files ?? []).map((f) => f.fieldKey));
+    const validation = validateAndNormalizeSubmission(fields, ctx.values, { fileKeys });
+    if (!validation.ok) {
+        throw new SubmissionValidationError(validation.errors);
+    }
+    const sender = deriveSender(fields, validation.data);
+    const spam = scoreSubmissionSpam({
+        fields,
+        rawValues: ctx.values,
+        settings: form.spamSettings,
+        defaultStrategies: defaultSpamStrategies(),
+        senderEmail: sender.email,
+        elapsedMs: ctx.elapsedMs ?? null,
+        origin: ctx.origin ?? null,
+        referrer: ctx.referrer ?? null,
+    });
+    const attribution = ctx.attribution && typeof ctx.attribution === 'object' ? ctx.attribution : null;
+    const row = {
+        formId: form.id,
+        schemaVersionId: versionId,
+        data: validation.data,
+        normalizedData: validation.normalized,
+        attribution,
+        senderName: sender.name,
+        senderEmail: sender.email,
+        senderPhone: sender.phone,
+        preview: derivePreview(fields, validation.data),
+        spamStatus: spam.status,
+        unread: true,
+        ipAddressHash: hashClientIp(ctx.ip ?? 'unknown'),
+        userAgent: ctx.userAgent ?? null,
+        referrer: ctx.referrer ?? null,
+        pageUrl: ctx.pageUrl ?? null,
+        utmSource: asString(attribution?.source) || null,
+        utmMedium: asString(attribution?.medium) || null,
+        utmCampaign: asString(attribution?.campaign) || null,
+        submittedAt: new Date(),
+    };
+    const { id, entryNumber } = await assignAndCreate(db, row, form.id);
+    if ((ctx.files?.length ?? 0) > 0) {
+        try {
+            await persistSubmissionFiles(form.id, id, ctx.files ?? []);
+        }
+        catch (err) {
+            if (process.env.NODE_ENV !== 'test') {
+                console.error('[Actuate CMS] Failed to persist submission files:', err);
+            }
+        }
+    }
+    // Notification/webhook side-effects (PR6) run via plugin hooks; never block
+    // or fail the submission on them. Spam is not notified.
+    if (spam.status !== 'spam') {
+        void fireSubmissionHooks(form.id, validation.data);
+    }
+    await logEvent({
+        event: spam.status === 'spam' ? 'form.spam_detected' : 'form.submitted',
+        details: {
+            formId: form.id,
+            submissionId: id,
+            entryNumber,
+            spamStatus: spam.status,
+            ...(spam.reasons.length > 0 ? { spamReasons: spam.reasons } : {}),
+        },
+    });
+    return {
+        submissionId: id,
+        entryNumber,
+        spamStatus: spam.status,
+        confirmation: buildConfirmation(form),
+    };
+}
+/**
+ * Project a form definition into the public, embeddable schema. Strips every
+ * server-only concern (access rules, notification recipients, webhook secrets,
+ * blocklists, encryption flags) so nothing sensitive leaks to the browser.
+ */
+export function buildPublicForm(form, fields, schemaVersionId, options = {}) {
+    const publicFields = fields
+        .filter((f) => f.type !== 'honeypot')
+        .map((f) => ({
+        id: f.id,
+        key: f.key,
+        label: f.label,
+        type: f.type,
+        required: Boolean(f.required),
+        placeholder: f.placeholder,
+        helpText: f.helpText,
+        defaultValue: f.defaultValue ?? undefined,
+        options: f.options,
+        width: f.width,
+        sortOrder: f.sortOrder,
+        validationRules: f.validationRules
+            ? sanitizePublicRules(f.validationRules)
+            : undefined,
+        conditionalLogic: f.conditionalLogic,
+    }));
+    const basePath = getActuateConfig()?.forms?.publicSubmissionPath ?? '/api/cms/public/forms';
+    return {
+        id: form.id,
+        name: form.name,
+        slug: form.slug,
+        description: form.description || undefined,
+        fields: publicFields,
+        submitPath: `${basePath.replace(/\/$/, '')}/${form.slug}/submit`,
+        successMessage: form.successMessage,
+        redirectUrl: form.redirectUrl,
+        spam: {
+            honeypotFieldKey: form.spamSettings?.honeypotFieldKey ?? fields.find((f) => f.type === 'honeypot')?.key,
+            minSubmitSeconds: form.spamSettings?.minSubmitSeconds,
+        },
+        captcha: options.captcha && options.captcha.provider !== 'none' ? options.captcha : undefined,
+        schemaVersionId,
+    };
+}
+/** Strip server-side-only validation hints (custom validator names) before exposing rules. */
+function sanitizePublicRules(rules) {
+    const { customValidator: _drop, ...rest } = rules;
+    return rest;
+}
+export { resolveFields as resolveSubmissionFields };
+//# sourceMappingURL=submission.js.map

package/dist/forms/submission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"submission.js","sourceRoot":"","sources":["../../src/forms/submission.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,EAAE,8BAA8B,EAAmB,MAAM,iBAAiB,CAAA;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAqB,MAAM,YAAY,CAAA;AAkCtE,+EAA+E;AAC/E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,WAAW,CAAc;IACzB,YAAY,WAAyB;QACnC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACrC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;CACF;AAED,MAAM,uBAAuB,GAAG,+CAA+C,CAAA;AAE/E,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,OAAO,EAAE,CAAA;AACX,CAAC;AAED,2EAA2E;AAC3E,KAAK,UAAU,aAAa,CAC1B,IAAoB;IAEpB,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAClE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,qBAAqB,IAAI,IAAI,EAAE,CAAA;AACrF,CAAC;AAED,SAAS,YAAY,CACnB,MAAmB,EACnB,IAA6B;IAE7B,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,KAAK,GAAkB,IAAI,CAAA;IAC/B,IAAI,KAAK,GAAkB,IAAI,CAAA;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,CAAC,CAAC;YAAE,SAAQ;QAChB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,KAAK,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,KAAK,GAAG,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,CAAC,CAAA;IAChD,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAA;IACjF,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAA;IACjG,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAA;IAEtF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,UAAoB;IACtE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAA6B;IACvE,4DAA4D;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAC1C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAC5C,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,qBAAqB;IAC5B,OAAO,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,qBAAqB,IAAI,EAAE,CAA6B,CAAA;AAC7F,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,EAAM,EACN,GAA4B,EAC5B,MAAc;IAEd,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,EAAE,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,EAAM,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;gBAC5C,KAAK,EAAE,EAAE,MAAM,EAAE;gBACjB,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;aAC5B,CAAC,CAAA;YACF,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;YACrD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;gBAC7C,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE;gBAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;aACxC,CAAC,CAAA;YACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,WAAW,EAAE,CAAA;QACpF,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;KACxC,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAA;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAoB;IAC7C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAA;IACnE,CAAC;IACD,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE;QAC3B,gBAAgB,EAAE,EAAE,KAAK,EAAE,qBAAqB;QAChD,uBAAuB,CAAA;IACzB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAA;AACrC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAA6B;IAC9E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAA;QACjC,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAGvC,CAAA;QACF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,KAAK,8BAA8B,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAoB,EACpB,GAAsB;IAEtB,MAAM,EAAE,GAAG,KAAK,EAAM,CAAA;IACtB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAEvD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG,8BAA8B,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,yBAAyB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,mBAAmB,CAAC;QAC/B,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,MAAM;QACrB,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,iBAAiB,EAAE,qBAAqB,EAAE;QAC1C,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;KAC/B,CAAC,CAAA;IAEF,MAAM,WAAW,GACf,GAAG,CAAC,WAAW,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAA;IAEjF,MAAM,GAAG,GAA4B;QACnC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,eAAe,EAAE,SAAS;QAC1B,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,cAAc,EAAE,UAAU,CAAC,UAAU;QACrC,WAAW;QACX,UAAU,EAAE,MAAM,CAAC,IAAI;QACvB,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC;QAC/C,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,MAAM,EAAE,IAAI;QACZ,aAAa,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC;QAChD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,SAAS,EAAE,QAAQ,CAAE,WAA8C,EAAE,MAAM,CAAC,IAAI,IAAI;QACpF,SAAS,EAAE,QAAQ,CAAE,WAA8C,EAAE,MAAM,CAAC,IAAI,IAAI;QACpF,WAAW,EAAE,QAAQ,CAAE,WAA8C,EAAE,QAAQ,CAAC,IAAI,IAAI;QACxF,WAAW,EAAE,IAAI,IAAI,EAAE;KACxB,CAAA;IAED,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;IAEnE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,KAAK,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;IACpD,CAAC;IAED,MAAM,QAAQ,CAAC;QACb,KAAK,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB;QACvE,OAAO,EAAE;YACP,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,YAAY,EAAE,EAAE;YAChB,WAAW;YACX,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE;KACF,CAAC,CAAA;IAEF,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,WAAW;QACX,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC;KACtC,CAAA;AACH,CAAC;AAqCD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAoB,EACpB,MAAmB,EACnB,eAA8B,EAC9B,UAA+D,EAAE;IAEjE,MAAM,YAAY,GAAsB,MAAM;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;QACzC,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,eAAe,EAAE,CAAC,CAAC,eAAe;YAChC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAA0C,CAAC;YACnE,CAAC,CAAC,SAAS;QACb,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;KACrC,CAAC,CAAC,CAAA;IAEL,MAAM,QAAQ,GAAG,gBAAgB,EAAE,EAAE,KAAK,EAAE,oBAAoB,IAAI,uBAAuB,CAAA;IAE3F,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;QAC1C,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,SAAS;QAChE,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,IAAI,EAAE;YACJ,gBAAgB,EACd,IAAI,CAAC,YAAY,EAAE,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,GAAG;YACvF,gBAAgB,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB;SACtD;QACD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAC7F,eAAe;KAChB,CAAA;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,mBAAmB,CAAC,KAA8B;IACzD,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAA;IACjD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,OAAO,EAAE,aAAa,IAAI,uBAAuB,EAAE,CAAA"}