@aglyn/plugins-forms 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/model/forms-record-lists.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type PluginRecordListSource } from '@aglyn/aglyn/plugin-manager/plugin-record-lists';
+/**
+ * A site's forms, listed in the console for another plugin's picker
+ * (AGL-3080) — a recipe that keys an automation on the form a person picks.
+ *
+ * A form is the site's: the query lists `hosts/{hostId}/forms`, ordered by
+ * document id so a reader asking one past its window learns it was cut, and
+ * answers nothing at the organization, where no site is named. An archived
+ * form collects nothing, so it is left out — an automation keyed on it would
+ * never fire. A form with no display name reads by its id, as every form list
+ * names one. Its one fact, `routesLeads`, says whether it files leads.
+ */
+export declare const formRecordListSource: PluginRecordListSource;
+/** Called from the console registrar, owner named for a spec that calls it directly. */
+export declare function registerFormRecordList(): void;

package/src/lib/model/forms-record-lists.js

@@ -0,0 +1,55 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { registerPluginRecordListSource } from "@aglyn/aglyn/plugin-manager/plugin-record-lists";
+import { collection, documentId, limit, orderBy, query } from "firebase/firestore";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+/**
+ * A site's forms, listed in the console for another plugin's picker
+ * (AGL-3080) — a recipe that keys an automation on the form a person picks.
+ *
+ * A form is the site's: the query lists `hosts/{hostId}/forms`, ordered by
+ * document id so a reader asking one past its window learns it was cut, and
+ * answers nothing at the organization, where no site is named. An archived
+ * form collects nothing, so it is left out — an automation keyed on it would
+ * never fire. A form with no display name reads by its id, as every form list
+ * names one. Its one fact, `routesLeads`, says whether it files leads.
+ */ export const formRecordListSource = {
+    query (firestore, request) {
+        if (!request.hostId) return null;
+        return query(collection(firestore, 'hosts', request.hostId, 'forms'), orderBy(documentId()), limit(request.limit));
+    },
+    record (id, data) {
+        var _data_displayName;
+        if (data['archivedAt'] != null) return null;
+        // Whether the form files its people as leads (`routing.lead`): a picker's
+        // recipe keys on the record such a form makes.
+        const routing = data['routing'];
+        return {
+            id,
+            name: String((_data_displayName = data['displayName']) != null ? _data_displayName : '').trim() || id,
+            facts: {
+                routesLeads: (routing == null ? void 0 : routing.lead) === true
+            }
+        };
+    }
+};
+/** Called from the console registrar, owner named for a spec that calls it directly. */ export function registerFormRecordList() {
+    registerPluginRecordListSource('form', formRecordListSource, {
+        pluginId: BUNDLE_ID
+    });
+}
+
+//# sourceMappingURL=forms-record-lists.js.map

package/src/lib/model/forms-record-lists.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/forms/src/lib/model/forms-record-lists.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  registerPluginRecordListSource,\n  type PluginRecordListSource,\n} from '@aglyn/aglyn/plugin-manager/plugin-record-lists'\nimport { collection, documentId, limit, orderBy, query } from 'firebase/firestore'\nimport { BUNDLE_ID } from '../constants/bundle-common'\n\n/**\n * A site's forms, listed in the console for another plugin's picker\n * (AGL-3080) — a recipe that keys an automation on the form a person picks.\n *\n * A form is the site's: the query lists `hosts/{hostId}/forms`, ordered by\n * document id so a reader asking one past its window learns it was cut, and\n * answers nothing at the organization, where no site is named. An archived\n * form collects nothing, so it is left out — an automation keyed on it would\n * never fire. A form with no display name reads by its id, as every form list\n * names one. Its one fact, `routesLeads`, says whether it files leads.\n */\nexport const formRecordListSource: PluginRecordListSource = {\n  query(firestore, request) {\n    if (!request.hostId) return null\n    return query(\n      collection(firestore, 'hosts', request.hostId, 'forms'),\n      orderBy(documentId()),\n      limit(request.limit),\n    )\n  },\n  record(id, data) {\n    if (data['archivedAt'] != null) return null\n    // Whether the form files its people as leads (`routing.lead`): a picker's\n    // recipe keys on the record such a form makes.\n    const routing = data['routing'] as { lead?: unknown } | null | undefined\n    return {\n      id,\n      name: String(data['displayName'] ?? '').trim() || id,\n      facts: { routesLeads: routing?.lead === true },\n    }\n  },\n}\n\n/** Called from the console registrar, owner named for a spec that calls it directly. */\nexport function registerFormRecordList(): void {\n  registerPluginRecordListSource('form', formRecordListSource, { pluginId: BUNDLE_ID })\n}\n"],"names":["registerPluginRecordListSource","collection","documentId","limit","orderBy","query","BUNDLE_ID","formRecordListSource","firestore","request","hostId","record","id","data","routing","name","String","trim","facts","routesLeads","lead","registerFormRecordList","pluginId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,8BAA8B,QAEzB,kDAAiD;AACxD,SAASC,UAAU,EAAEC,UAAU,EAAEC,KAAK,EAAEC,OAAO,EAAEC,KAAK,QAAQ,qBAAoB;AAClF,SAASC,SAAS,QAAQ,gCAA4B;AAEtD;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,uBAA+C;IAC1DF,OAAMG,SAAS,EAAEC,OAAO;QACtB,IAAI,CAACA,QAAQC,MAAM,EAAE,OAAO;QAC5B,OAAOL,MACLJ,WAAWO,WAAW,SAASC,QAAQC,MAAM,EAAE,UAC/CN,QAAQF,eACRC,MAAMM,QAAQN,KAAK;IAEvB;IACAQ,QAAOC,EAAE,EAAEC,IAAI;YAOEA;QANf,IAAIA,IAAI,CAAC,aAAa,IAAI,MAAM,OAAO;QACvC,0EAA0E;QAC1E,+CAA+C;QAC/C,MAAMC,UAAUD,IAAI,CAAC,UAAU;QAC/B,OAAO;YACLD;YACAG,MAAMC,QAAOH,oBAAAA,IAAI,CAAC,cAAc,YAAnBA,oBAAuB,IAAII,IAAI,MAAML;YAClDM,OAAO;gBAAEC,aAAaL,CAAAA,2BAAAA,QAASM,IAAI,MAAK;YAAK;QAC/C;IACF;AACF,EAAC;AAED,sFAAsF,GACtF,OAAO,SAASC;IACdrB,+BAA+B,QAAQO,sBAAsB;QAAEe,UAAUhB;IAAU;AACrF"}

package/src/lib/plan-entitlements.js

@@ -21,9 +21,9 @@
     free: 20,
     starter: 200,
     pro: 1000,
-    business: 8000,
-    scale: 25000,
-    advanced: 40000,
+    business: 5000,
+    scale: 10000,
+    advanced: 10000,
     // FINITE, where every other capacity row on this tier is unbounded. The
     // band is multiplied by `hostLimit` to get the org-wide band, so at 100
     // hosts an unbounded figure was not merely large — it made this tier's cost
@@ -34,9 +34,9 @@
     //
     // Metering makes it safe to bound. `meteredInfraPassThrough` is true here,
     // so submissions past the band BILL at the pass-through rate rather than
-    // being refused — a merchant's lead form does not stop working at 25,000.
-    agency: 25000,
-    enterprise: 50000
+    // being refused — a merchant's lead form does not stop working at the band.
+    agency: 10000,
+    enterprise: 20000
 };
 /** The forms plugin's plan figures, for the manifest generator. */ export function formsPlanEntitlements() {
     return {

package/src/lib/plan-entitlements.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/forms/src/lib/plan-entitlements.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Types only: the manifest generator loads this module on its own to compile\n// the plan figures, so nothing here may reach a core module at runtime.\nimport type { OrgPlan } from '@aglyn/aglyn/foundation/definitions/org-billing.types'\nimport type { PluginPlanEntitlementsDeclaration } from '@aglyn/aglyn/plugin-manager/plugin-plan-entitlements'\n\n/**\n * THE FORMS PLUGIN'S PLAN BAND (AGL-3080): the form submissions each plan\n * includes a month, per site. Compiled into core's `PLAN_ENTITLEMENTS` by the\n * manifest generator (`register.planEntitlements`); this is where the figure\n * is written, beside the reasoning that sized it.\n */\ndeclare module '@aglyn/aglyn/plugin-manager/plugin-entitlement-keys' {\n  interface PluginEntitlementQuotas {\n    /**\n     * Form submissions accepted per calendar month, per site (Forms & Lead\n     * Capture). The org-wide band is this times `hostLimit`.\n     *\n     * Not the same dimension as `formsPerHost`, which counts the saved form\n     * CATALOG rather than the replies: only this one is tiered, metered and\n     * part of a charged price.\n     */\n    formSubmissionsPerMonth?: number\n  }\n}\n\n/** The form submissions each plan includes a month, per site. */\nexport const FORM_SUBMISSIONS_PER_MONTH_BY_PLAN: Readonly<Record<OrgPlan, number>> = {\n  // A `Form` node placed on a page needs no saved definition to collect, so\n  // Free — which has no form catalog — still spends this band on its replies.\n  free: 20,\n  starter: 200,\n  pro: 1000,\n  business: 8000,\n  scale: 25000,\n  advanced: 40000,\n  // FINITE, where every other capacity row on this tier is unbounded. The\n  // band is multiplied by `hostLimit` to get the org-wide band, so at 100\n  // hosts an unbounded figure was not merely large — it made this tier's cost\n  // model unbounded, and an unbounded term reads as ZERO in any analysis that\n  // scores an absent band as nothing. That is how it stayed invisible: the\n  // biggest line item on the most expensive self-serve plan, contributing 0\n  // to every total.\n  //\n  // Metering makes it safe to bound. `meteredInfraPassThrough` is true here,\n  // so submissions past the band BILL at the pass-through rate rather than\n  // being refused — a merchant's lead form does not stop working at 25,000.\n  agency: 25000,\n  enterprise: 50_000,\n}\n\n/** The forms plugin's plan figures, for the manifest generator. */\nexport function formsPlanEntitlements(): PluginPlanEntitlementsDeclaration {\n  return {\n    quotas: [\n      {\n        key: 'formSubmissionsPerMonth',\n        label: 'Form subs / mo',\n        byPlan: FORM_SUBMISSIONS_PER_MONTH_BY_PLAN,\n      },\n    ],\n  }\n}\n"],"names":["FORM_SUBMISSIONS_PER_MONTH_BY_PLAN","free","starter","pro","business","scale","advanced","agency","enterprise","formsPlanEntitlements","quotas","key","label","byPlan"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,6EAA6E;AAC7E,wEAAwE;AAwBxE,+DAA+D,GAC/D,OAAO,MAAMA,qCAAwE;IACnF,0EAA0E;IAC1E,4EAA4E;IAC5EC,MAAM;IACNC,SAAS;IACTC,KAAK;IACLC,UAAU;IACVC,OAAO;IACPC,UAAU;IACV,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,kBAAkB;IAClB,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,0EAA0E;IAC1EC,QAAQ;IACRC,YAAY;AACd,EAAC;AAED,iEAAiE,GACjE,OAAO,SAASC;IACd,OAAO;QACLC,QAAQ;YACN;gBACEC,KAAK;gBACLC,OAAO;gBACPC,QAAQb;YACV;SACD;IACH;AACF"}
+{"version":3,"sources":["../../../../../../libs/plugins/forms/src/lib/plan-entitlements.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// Types only: the manifest generator loads this module on its own to compile\n// the plan figures, so nothing here may reach a core module at runtime.\nimport type { OrgPlan } from '@aglyn/aglyn/foundation/definitions/org-billing.types'\nimport type { PluginPlanEntitlementsDeclaration } from '@aglyn/aglyn/plugin-manager/plugin-plan-entitlements'\n\n/**\n * THE FORMS PLUGIN'S PLAN BAND (AGL-3080): the form submissions each plan\n * includes a month, per site. Compiled into core's `PLAN_ENTITLEMENTS` by the\n * manifest generator (`register.planEntitlements`); this is where the figure\n * is written, beside the reasoning that sized it.\n */\ndeclare module '@aglyn/aglyn/plugin-manager/plugin-entitlement-keys' {\n  interface PluginEntitlementQuotas {\n    /**\n     * Form submissions accepted per calendar month, per site (Forms & Lead\n     * Capture). The org-wide band is this times `hostLimit`.\n     *\n     * Not the same dimension as `formsPerHost`, which counts the saved form\n     * CATALOG rather than the replies: only this one is tiered, metered and\n     * part of a charged price.\n     */\n    formSubmissionsPerMonth?: number\n  }\n}\n\n/** The form submissions each plan includes a month, per site. */\nexport const FORM_SUBMISSIONS_PER_MONTH_BY_PLAN: Readonly<Record<OrgPlan, number>> = {\n  // A `Form` node placed on a page needs no saved definition to collect, so\n  // Free — which has no form catalog — still spends this band on its replies.\n  free: 20,\n  starter: 200,\n  pro: 1000,\n  business: 5000,\n  scale: 10000,\n  advanced: 10000,\n  // FINITE, where every other capacity row on this tier is unbounded. The\n  // band is multiplied by `hostLimit` to get the org-wide band, so at 100\n  // hosts an unbounded figure was not merely large — it made this tier's cost\n  // model unbounded, and an unbounded term reads as ZERO in any analysis that\n  // scores an absent band as nothing. That is how it stayed invisible: the\n  // biggest line item on the most expensive self-serve plan, contributing 0\n  // to every total.\n  //\n  // Metering makes it safe to bound. `meteredInfraPassThrough` is true here,\n  // so submissions past the band BILL at the pass-through rate rather than\n  // being refused — a merchant's lead form does not stop working at the band.\n  agency: 10000,\n  enterprise: 20_000,\n}\n\n/** The forms plugin's plan figures, for the manifest generator. */\nexport function formsPlanEntitlements(): PluginPlanEntitlementsDeclaration {\n  return {\n    quotas: [\n      {\n        key: 'formSubmissionsPerMonth',\n        label: 'Form subs / mo',\n        byPlan: FORM_SUBMISSIONS_PER_MONTH_BY_PLAN,\n      },\n    ],\n  }\n}\n"],"names":["FORM_SUBMISSIONS_PER_MONTH_BY_PLAN","free","starter","pro","business","scale","advanced","agency","enterprise","formsPlanEntitlements","quotas","key","label","byPlan"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,6EAA6E;AAC7E,wEAAwE;AAwBxE,+DAA+D,GAC/D,OAAO,MAAMA,qCAAwE;IACnF,0EAA0E;IAC1E,4EAA4E;IAC5EC,MAAM;IACNC,SAAS;IACTC,KAAK;IACLC,UAAU;IACVC,OAAO;IACPC,UAAU;IACV,wEAAwE;IACxE,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,kBAAkB;IAClB,EAAE;IACF,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5EC,QAAQ;IACRC,YAAY;AACd,EAAC;AAED,iEAAiE,GACjE,OAAO,SAASC;IACd,OAAO;QACLC,QAAQ;YACN;gBACEC,KAAK;gBACLC,OAAO;gBACPC,QAAQb;YACV;SACD;IACH;AACF"}

package/src/lib/plugin.js

@@ -16,11 +16,18 @@
  */ import * as Aglyn from "@aglyn/aglyn";
 import { mdiEmailFastOutline } from "@aglyn/shared-data-mdi";
 import { lazy } from "react";
+import { registerPluginTransferResourceUi } from "@aglyn/aglyn/plugin-manager/plugin-transfer-resources";
 import { registerPluginZone } from "@aglyn/aglyn/plugin-manager/plugin-zones";
 import { FORM_CONTACT_FIELDS_ZONE, FORM_SUBMISSIONS_ZONE, HOST_FORMS_ZONE } from "./components/form-zones.js";
 import { BUNDLE_ID } from "./constants/bundle-common.js";
+import { FORM_PACKAGE_KIND } from "./constants/site-package.js";
+import { registerFormSubmissionCounts } from "./model/form-submission-counts.js";
+import { registerFormSubmissionList } from "./model/form-submission-list.js";
+import { registerFormRecordList } from "./model/forms-record-lists.js";
 import { registerFormsRecordRoutes } from "./model/forms-record-routes.js";
+import { FORM_SUBMISSIONS_TRANSFER_KEY } from "./transfer/form-submissions-transfer-key.js";
 /** Code-split: the Forms console surface only loads when opened. */ const FormsConsolePage = lazy(()=>import("./components/forms-console-page.js"));
+const SitePackageFormPreview = lazy(()=>import("./components/site-package-form-preview.component.js"));
 /**
  * Console half: the Forms catalog and one form's own surface, served by the
  * shell's generic plugin route.
@@ -29,6 +36,20 @@ import { registerFormsRecordRoutes } from "./model/forms-record-routes.js";
  * declared section. Safe to call at console app load — the page is lazy.
  */ export function registerFormsConsole() {
     registerFormsRecordRoutes();
+    registerFormRecordList();
+    registerFormSubmissionList();
+    // How many submissions a site received, for another plugin's figure.
+    registerFormSubmissionCounts();
+    // The export dialog's name for a site's submissions; export only, so the
+    // wizard never offers it.
+    registerPluginTransferResourceUi(FORM_SUBMISSIONS_TRANSFER_KEY, {
+        label: 'Form submissions',
+        icon: {
+            path: mdiEmailFastOutline.path
+        }
+    }, {
+        pluginId: BUNDLE_ID
+    });
     registerPluginZone({
         zone: FORM_SUBMISSIONS_ZONE,
         label: 'One form’s submissions',
@@ -59,6 +80,19 @@ import { registerFormsRecordRoutes } from "./model/forms-record-routes.js";
     Aglyn.registerConsoleExtension({
         pluginId: BUNDLE_ID,
         displayName: 'Forms',
+        widgets: [
+            {
+                // A form in a site package import, each side drawn by the preview
+                // the form's own page shows (AGL-3545).
+                slot: Aglyn.CONSOLE_WIDGET_SLOTS.sitePackageItemPreview,
+                widgetId: 'forms-site-package-preview',
+                title: 'Form preview',
+                itemKinds: [
+                    FORM_PACKAGE_KIND
+                ],
+                Component: SitePackageFormPreview
+            }
+        ],
         navItems: [
             {
                 label: 'Forms',

package/src/lib/plugin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../libs/plugins/forms/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiEmailFastOutline } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport {\n  FORM_CONTACT_FIELDS_ZONE,\n  FORM_SUBMISSIONS_ZONE,\n  HOST_FORMS_ZONE,\n} from './components/form-zones'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { registerFormsRecordRoutes } from './model/forms-record-routes'\n\n/** Code-split: the Forms console surface only loads when opened. */\nconst FormsConsolePage = lazy(() => import('./components/forms-console-page'))\n\n/**\n * Console half: the Forms catalog and one form's own surface, served by the\n * shell's generic plugin route.\n *\n * `ownsSubtree` because a form's detail URL names a document id rather than a\n * declared section. Safe to call at console app load — the page is lazy.\n */\nexport function registerFormsConsole(): void {\n  registerFormsRecordRoutes()\n  registerPluginZone(\n    {\n      zone: FORM_SUBMISSIONS_ZONE,\n      label: 'One form’s submissions',\n      surface: 'console',\n      description:\n        'On one form’s page, behind the reader’s ask. A widget here reads the submissions to that form alone; it is handed the site and the form and nothing else.',\n    },\n    // Named, because a spec calls this registrar without the loader.\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: FORM_CONTACT_FIELDS_ZONE,\n      label: 'Where a form’s fields save on the person',\n      surface: 'console',\n      description:\n        'On one form’s page, beside routing and consent. A widget here decides which of the person’s fields each form field saves to and hands the new declaration to `saveFields`; the page writes the form document, and the widget writes nothing itself.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: HOST_FORMS_ZONE,\n      label: 'A site’s Forms page',\n      surface: 'console',\n      // One item in the page's row of actions, beside Create Form.\n      layout: 'bare',\n      description:\n        'On a site’s Forms page, beside Create Form: another way to start a form. A widget here is handed the site and its org and writes nothing through the page.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'Forms',\n    navItems: [\n      {\n        label: 'Forms',\n        href: '/forms',\n        // The tab id the console has always keyed this surface's active state\n        // on. It carries no release flag: forms is on for every workspace, and\n        // a site that switches it off loses this tab with the rest.\n        navTabId: 'nav-tab-forms',\n        icon: { path: mdiEmailFastOutline.path },\n        ownsSubtree: true,\n        header: {\n          title: 'Forms',\n          icon: { path: mdiEmailFastOutline.path },\n          docsTopic: 'forms',\n        },\n        Component: FormsConsolePage,\n      },\n    ],\n  })\n}\n\nexport * from './site'\n"],"names":["Aglyn","mdiEmailFastOutline","lazy","registerPluginZone","FORM_CONTACT_FIELDS_ZONE","FORM_SUBMISSIONS_ZONE","HOST_FORMS_ZONE","BUNDLE_ID","registerFormsRecordRoutes","FormsConsolePage","registerFormsConsole","zone","label","surface","description","pluginId","layout","registerConsoleExtension","displayName","navItems","href","navTabId","icon","path","ownsSubtree","header","title","docsTopic","Component"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,mBAAmB,QAAQ,yBAAwB;AAC5D,SAASC,IAAI,QAAQ,QAAO;AAC5B,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SACEC,wBAAwB,EACxBC,qBAAqB,EACrBC,eAAe,QACV,6BAAyB;AAChC,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,yBAAyB,QAAQ,iCAA6B;AAEvE,kEAAkE,GAClE,MAAMC,mBAAmBP,KAAK,IAAM,MAAM,CAAC;AAE3C;;;;;;CAMC,GACD,OAAO,SAASQ;IACdF;IACAL,mBACE;QACEQ,MAAMN;QACNO,OAAO;QACPC,SAAS;QACTC,aACE;IACJ,GACA,iEAAiE;IACjE;QAAEC,UAAUR;IAAU;IAExBJ,mBACE;QACEQ,MAAMP;QACNQ,OAAO;QACPC,SAAS;QACTC,aACE;IACJ,GACA;QAAEC,UAAUR;IAAU;IAExBJ,mBACE;QACEQ,MAAML;QACNM,OAAO;QACPC,SAAS;QACT,6DAA6D;QAC7DG,QAAQ;QACRF,aACE;IACJ,GACA;QAAEC,UAAUR;IAAU;IAExBP,MAAMiB,wBAAwB,CAAC;QAC7BF,UAAUR;QACVW,aAAa;QACbC,UAAU;YACR;gBACEP,OAAO;gBACPQ,MAAM;gBACN,sEAAsE;gBACtE,uEAAuE;gBACvE,4DAA4D;gBAC5DC,UAAU;gBACVC,MAAM;oBAAEC,MAAMtB,oBAAoBsB,IAAI;gBAAC;gBACvCC,aAAa;gBACbC,QAAQ;oBACNC,OAAO;oBACPJ,MAAM;wBAAEC,MAAMtB,oBAAoBsB,IAAI;oBAAC;oBACvCI,WAAW;gBACb;gBACAC,WAAWnB;YACb;SACD;IACH;AACF;AAEA,cAAc,YAAQ"}
+{"version":3,"sources":["../../../../../../libs/plugins/forms/src/lib/plugin.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport * as Aglyn from '@aglyn/aglyn'\nimport { mdiEmailFastOutline } from '@aglyn/shared-data-mdi'\nimport { lazy } from 'react'\nimport { registerPluginTransferResourceUi } from '@aglyn/aglyn/plugin-manager/plugin-transfer-resources'\nimport { registerPluginZone } from '@aglyn/aglyn/plugin-manager/plugin-zones'\nimport {\n  FORM_CONTACT_FIELDS_ZONE,\n  FORM_SUBMISSIONS_ZONE,\n  HOST_FORMS_ZONE,\n} from './components/form-zones'\nimport { BUNDLE_ID } from './constants/bundle-common'\nimport { FORM_PACKAGE_KIND } from './constants/site-package'\nimport { registerFormSubmissionCounts } from './model/form-submission-counts'\nimport { registerFormSubmissionList } from './model/form-submission-list'\nimport { registerFormRecordList } from './model/forms-record-lists'\nimport { registerFormsRecordRoutes } from './model/forms-record-routes'\nimport { FORM_SUBMISSIONS_TRANSFER_KEY } from './transfer/form-submissions-transfer-key'\n\n/** Code-split: the Forms console surface only loads when opened. */\nconst FormsConsolePage = lazy(() => import('./components/forms-console-page'))\nconst SitePackageFormPreview = lazy(\n  () => import('./components/site-package-form-preview.component'),\n)\n\n/**\n * Console half: the Forms catalog and one form's own surface, served by the\n * shell's generic plugin route.\n *\n * `ownsSubtree` because a form's detail URL names a document id rather than a\n * declared section. Safe to call at console app load — the page is lazy.\n */\nexport function registerFormsConsole(): void {\n  registerFormsRecordRoutes()\n  registerFormRecordList()\n  registerFormSubmissionList()\n  // How many submissions a site received, for another plugin's figure.\n  registerFormSubmissionCounts()\n  // The export dialog's name for a site's submissions; export only, so the\n  // wizard never offers it.\n  registerPluginTransferResourceUi(\n    FORM_SUBMISSIONS_TRANSFER_KEY,\n    { label: 'Form submissions', icon: { path: mdiEmailFastOutline.path } },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: FORM_SUBMISSIONS_ZONE,\n      label: 'One form’s submissions',\n      surface: 'console',\n      description:\n        'On one form’s page, behind the reader’s ask. A widget here reads the submissions to that form alone; it is handed the site and the form and nothing else.',\n    },\n    // Named, because a spec calls this registrar without the loader.\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: FORM_CONTACT_FIELDS_ZONE,\n      label: 'Where a form’s fields save on the person',\n      surface: 'console',\n      description:\n        'On one form’s page, beside routing and consent. A widget here decides which of the person’s fields each form field saves to and hands the new declaration to `saveFields`; the page writes the form document, and the widget writes nothing itself.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  registerPluginZone(\n    {\n      zone: HOST_FORMS_ZONE,\n      label: 'A site’s Forms page',\n      surface: 'console',\n      // One item in the page's row of actions, beside Create Form.\n      layout: 'bare',\n      description:\n        'On a site’s Forms page, beside Create Form: another way to start a form. A widget here is handed the site and its org and writes nothing through the page.',\n    },\n    { pluginId: BUNDLE_ID },\n  )\n  Aglyn.registerConsoleExtension({\n    pluginId: BUNDLE_ID,\n    displayName: 'Forms',\n    widgets: [\n      {\n        // A form in a site package import, each side drawn by the preview\n        // the form's own page shows (AGL-3545).\n        slot: Aglyn.CONSOLE_WIDGET_SLOTS.sitePackageItemPreview,\n        widgetId: 'forms-site-package-preview',\n        title: 'Form preview',\n        itemKinds: [FORM_PACKAGE_KIND],\n        Component: SitePackageFormPreview,\n      },\n    ],\n    navItems: [\n      {\n        label: 'Forms',\n        href: '/forms',\n        // The tab id the console has always keyed this surface's active state\n        // on. It carries no release flag: forms is on for every workspace, and\n        // a site that switches it off loses this tab with the rest.\n        navTabId: 'nav-tab-forms',\n        icon: { path: mdiEmailFastOutline.path },\n        ownsSubtree: true,\n        header: {\n          title: 'Forms',\n          icon: { path: mdiEmailFastOutline.path },\n          docsTopic: 'forms',\n        },\n        Component: FormsConsolePage,\n      },\n    ],\n  })\n}\n\nexport * from './site'\n"],"names":["Aglyn","mdiEmailFastOutline","lazy","registerPluginTransferResourceUi","registerPluginZone","FORM_CONTACT_FIELDS_ZONE","FORM_SUBMISSIONS_ZONE","HOST_FORMS_ZONE","BUNDLE_ID","FORM_PACKAGE_KIND","registerFormSubmissionCounts","registerFormSubmissionList","registerFormRecordList","registerFormsRecordRoutes","FORM_SUBMISSIONS_TRANSFER_KEY","FormsConsolePage","SitePackageFormPreview","registerFormsConsole","label","icon","path","pluginId","zone","surface","description","layout","registerConsoleExtension","displayName","widgets","slot","CONSOLE_WIDGET_SLOTS","sitePackageItemPreview","widgetId","title","itemKinds","Component","navItems","href","navTabId","ownsSubtree","header","docsTopic"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,YAAYA,WAAW,eAAc;AACrC,SAASC,mBAAmB,QAAQ,yBAAwB;AAC5D,SAASC,IAAI,QAAQ,QAAO;AAC5B,SAASC,gCAAgC,QAAQ,wDAAuD;AACxG,SAASC,kBAAkB,QAAQ,2CAA0C;AAC7E,SACEC,wBAAwB,EACxBC,qBAAqB,EACrBC,eAAe,QACV,6BAAyB;AAChC,SAASC,SAAS,QAAQ,+BAA2B;AACrD,SAASC,iBAAiB,QAAQ,8BAA0B;AAC5D,SAASC,4BAA4B,QAAQ,oCAAgC;AAC7E,SAASC,0BAA0B,QAAQ,kCAA8B;AACzE,SAASC,sBAAsB,QAAQ,gCAA4B;AACnE,SAASC,yBAAyB,QAAQ,iCAA6B;AACvE,SAASC,6BAA6B,QAAQ,8CAA0C;AAExF,kEAAkE,GAClE,MAAMC,mBAAmBb,KAAK,IAAM,MAAM,CAAC;AAC3C,MAAMc,yBAAyBd,KAC7B,IAAM,MAAM,CAAC;AAGf;;;;;;CAMC,GACD,OAAO,SAASe;IACdJ;IACAD;IACAD;IACA,qEAAqE;IACrED;IACA,yEAAyE;IACzE,0BAA0B;IAC1BP,iCACEW,+BACA;QAAEI,OAAO;QAAoBC,MAAM;YAAEC,MAAMnB,oBAAoBmB,IAAI;QAAC;IAAE,GACtE;QAAEC,UAAUb;IAAU;IAExBJ,mBACE;QACEkB,MAAMhB;QACNY,OAAO;QACPK,SAAS;QACTC,aACE;IACJ,GACA,iEAAiE;IACjE;QAAEH,UAAUb;IAAU;IAExBJ,mBACE;QACEkB,MAAMjB;QACNa,OAAO;QACPK,SAAS;QACTC,aACE;IACJ,GACA;QAAEH,UAAUb;IAAU;IAExBJ,mBACE;QACEkB,MAAMf;QACNW,OAAO;QACPK,SAAS;QACT,6DAA6D;QAC7DE,QAAQ;QACRD,aACE;IACJ,GACA;QAAEH,UAAUb;IAAU;IAExBR,MAAM0B,wBAAwB,CAAC;QAC7BL,UAAUb;QACVmB,aAAa;QACbC,SAAS;YACP;gBACE,kEAAkE;gBAClE,wCAAwC;gBACxCC,MAAM7B,MAAM8B,oBAAoB,CAACC,sBAAsB;gBACvDC,UAAU;gBACVC,OAAO;gBACPC,WAAW;oBAACzB;iBAAkB;gBAC9B0B,WAAWnB;YACb;SACD;QACDoB,UAAU;YACR;gBACElB,OAAO;gBACPmB,MAAM;gBACN,sEAAsE;gBACtE,uEAAuE;gBACvE,4DAA4D;gBAC5DC,UAAU;gBACVnB,MAAM;oBAAEC,MAAMnB,oBAAoBmB,IAAI;gBAAC;gBACvCmB,aAAa;gBACbC,QAAQ;oBACNP,OAAO;oBACPd,MAAM;wBAAEC,MAAMnB,oBAAoBmB,IAAI;oBAAC;oBACvCqB,WAAW;gBACb;gBACAN,WAAWpB;YACb;SACD;IACH;AACF;AAEA,cAAc,YAAQ"}

package/src/lib/server/api-v1/form-submissions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type ApiV1Context } from '@aglyn/tenant-data-admin/server/api-v1-kit';
+/**
+ * `/v1/sites/{siteId}/form-submissions[/{submissionId}]` (AGL-2127).
+ *
+ * The list was the whole surface, and that shaped every integration written
+ * against it badly. A lead sync polls, pushes new rows into a CRM, and then
+ * has nowhere to record that it did — so it either re-pushes the same lead
+ * next poll, or keeps its own high-water mark of ids against a list that
+ * `conventions.md` publishes as ordered by DOCUMENT ID, not by time. The
+ * `read` flag the console's inbox toggles on the very same document is the
+ * state the integration needed and could not write.
+ *
+ * `read` is the ONLY writable field. A submission is what a visitor typed,
+ * and an API that let an integration quietly rewrite it would make the
+ * inbox's contents unattributable — so anything else in the body is a
+ * `validation_failed` naming the offending key rather than a silent drop.
+ */
+export declare function handleFormSubmissions(request: Request, ctx: ApiV1Context, segments: string[], url: URL): Promise<Response>;

package/src/lib/server/api-v1/form-submissions.js

@@ -0,0 +1,273 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { ApiErrors, apiJson, listResponse } from "@aglyn/tenant-data-admin";
+import { claimWrite, paginate, readJsonBody, requireScope, serialize } from "@aglyn/tenant-data-admin/server/api-v1-kit";
+import { runPluginEventHandlers } from "@aglyn/aglyn/plugin-manager/plugin-events";
+/**
+ * A site's form submissions on the customer REST API,
+ * `/v1/sites/{siteId}/form-submissions/…` (AGL-2127, AGL-3080). Registered
+ * from this plugin's console server declarations; the console's `/v1`
+ * router owns the pipeline in front — the key, the plan's API access, the
+ * request quota, the rate limit — and refuses a site the key's organization
+ * does not own before it hands a request here.
+ */ function formSubmissionView(doc) {
+    var _doc_get, _doc_get1, _doc_get2, _doc_get3, _doc_get4, _serialize;
+    return {
+        id: doc.id,
+        object: 'form_submission',
+        // The form ENTITY this was sent to, `null` for a row written before the
+        // form was adopted. `form` below stays the caption — an integration
+        // grouping by it is grouping by a display string that a rename splits,
+        // which is the whole reason this field exists.
+        form_id: (_doc_get = doc.get('formId')) != null ? _doc_get : null,
+        form: (_doc_get1 = doc.get('formName')) != null ? _doc_get1 : null,
+        path: (_doc_get2 = doc.get('path')) != null ? _doc_get2 : null,
+        fields: (_doc_get3 = doc.get('fields')) != null ? _doc_get3 : {},
+        read: Boolean(doc.get('read')),
+        // Where the platform already sent this row. Omitting it meant an
+        // integration syncing submissions into a CRM could not tell that a record
+        // had already been written to a dataset — the one fact that stops it
+        // duplicating work the platform had done.
+        routing: (_doc_get4 = doc.get('routing')) != null ? _doc_get4 : null,
+        created: (_serialize = serialize(doc.get('createdAt'))) != null ? _serialize : null
+    };
+}
+/**
+ * `/v1/sites/{siteId}/form-submissions[/{submissionId}]` (AGL-2127).
+ *
+ * The list was the whole surface, and that shaped every integration written
+ * against it badly. A lead sync polls, pushes new rows into a CRM, and then
+ * has nowhere to record that it did — so it either re-pushes the same lead
+ * next poll, or keeps its own high-water mark of ids against a list that
+ * `conventions.md` publishes as ordered by DOCUMENT ID, not by time. The
+ * `read` flag the console's inbox toggles on the very same document is the
+ * state the integration needed and could not write.
+ *
+ * `read` is the ONLY writable field. A submission is what a visitor typed,
+ * and an API that let an integration quietly rewrite it would make the
+ * inbox's contents unattributable — so anything else in the body is a
+ * `validation_failed` naming the offending key rather than a silent drop.
+ */ export async function handleFormSubmissions(request, ctx, segments, url) {
+    const [, hostId, , submissionId] = segments;
+    const collection = ctx.firestore.collection('hosts').doc(hostId).collection('formSubmissions');
+    if (!submissionId) {
+        const denied = requireScope(ctx, 'forms:read');
+        if (denied) return denied;
+        if (request.method !== 'GET') {
+            return ApiErrors.methodNotAllowed({
+                headers: _extends({}, ctx.headers, {
+                    Allow: 'GET'
+                })
+            });
+        }
+        // An EMPTY value means the filter is absent, matching `?email=` and
+        // `?tag=` on contacts and `conventions.md`'s single rule for all three.
+        // A client serializing an unset form field sends `?read=`, and refusing
+        // that while `?email=` accepts it would be an inconsistency an integrator
+        // discovers one filter at a time.
+        const rawRead = url.searchParams.get('read') || null;
+        if (rawRead !== null && rawRead !== 'true' && rawRead !== 'false') {
+            return ApiErrors.badRequest({
+                message: 'Form submission filter failed validation',
+                code: 'validation_failed',
+                fields: {
+                    read: 'Must be true or false'
+                },
+                headers: ctx.headers
+            });
+        }
+        const read = rawRead === null ? null : rawRead === 'true';
+        let query = collection;
+        const form = url.searchParams.get('form');
+        const formId = url.searchParams.get('formId');
+        // `formId` is the id-first filter and wins when both are sent: it is the
+        // one that survives a rename. `?form=` is NOT removed and is not
+        // deprecated here — it filters on the caption every submission still
+        // carries, which is the only thing a form that has not been adopted yet
+        // can be filtered by. The same posture the legacy `?collection=` content
+        // parameters take.
+        if (formId) query = query.where('formId', '==', formId);
+        else if (form) query = query.where('formName', '==', form);
+        // `read` goes to FIRESTORE only when it is the sole filter, and is
+        // applied after the read when it joins `form` (AGL-2460).
+        //
+        // Two equality clauses plus the `orderBy(FieldPath.documentId())` every
+        // list here applies is a three-clause query, and Firestore serves that
+        // only from a composite index. Shipping one to serve a filter
+        // COMBINATION is a migration with a backfill, not a feature — and the
+        // failure mode while it builds is this route's documented realistic 500
+        // (see the route's `safeDispatch` docblock). Narrowing on `formName` and
+        // dropping the rest in memory keeps the pre-existing `?form=` query
+        // byte-for-byte what it already was, which is the property worth more
+        // than one saved round trip.
+        //
+        // `read=false` IS exact against Firestore, unlike `?channel=online` on
+        // orders. That filter is applied after the read because older orders
+        // predate the `channel` field and a `where` would silently drop them.
+        // The equivalent question was checked here rather than assumed: the
+        // ONLY writer of this collection is the tenant's form-submit route, and
+        // it has stamped `read: false` on every row since the feature's first
+        // commit (AGL-76/77, `fc149e538`). There is no fieldless generation to
+        // drop, so the cheap query is also the correct one.
+        // Either form filter already spent this list's one equality clause, so
+        // `read` is applied after the read exactly as it is for `?form=` — a
+        // second `where` plus the document-id ordering is a three-clause query
+        // and needs its own composite index per combination. The `formId ASC,
+        // createdAt DESC` index this work ships serves the CONSOLE's ordered
+        // list; `/v1` lists are ordered by document id and are a different query.
+        const narrowedByForm = Boolean(formId || form);
+        if (read !== null && !narrowedByForm) {
+            query = query.where('read', '==', read);
+        }
+        const { docs, nextCursor } = await paginate(query, url);
+        const matched = read !== null && narrowedByForm ? docs.filter((doc)=>Boolean(doc.get('read')) === read) : docs;
+        return listResponse(matched.map(formSubmissionView), nextCursor, ctx.headers);
+    }
+    const submissionRef = collection.doc(submissionId);
+    if (request.method === 'GET') {
+        const denied = requireScope(ctx, 'forms:read');
+        if (denied) return denied;
+        const snap = await submissionRef.get();
+        if (!snap.exists) {
+            return ApiErrors.notFound({
+                message: 'No such form submission',
+                headers: ctx.headers
+            });
+        }
+        return apiJson(formSubmissionView(snap), {
+            headers: ctx.headers
+        });
+    }
+    if (request.method === 'PATCH') {
+        const denied = requireScope(ctx, 'forms:write');
+        if (denied) return denied;
+        return updateFormSubmission(request, ctx, submissionRef);
+    }
+    if (request.method === 'DELETE') {
+        const denied = requireScope(ctx, 'forms:write');
+        if (denied) return denied;
+        return deleteFormSubmission(request, ctx, hostId, submissionRef);
+    }
+    return ApiErrors.methodNotAllowed({
+        headers: _extends({}, ctx.headers, {
+            Allow: 'GET, PATCH, DELETE'
+        })
+    });
+}
+/**
+ * Mark one submission read or unread. No `Idempotency-Key`: the same body
+ * twice lands the same state AND returns the same `200`, which is the test
+ * `updateRecord` and `updateDataset` are held to.
+ */ async function updateFormSubmission(request, ctx, submissionRef) {
+    const body = await readJsonBody(request);
+    const unknown = Object.keys(body).filter((key)=>key !== 'read');
+    if (unknown.length > 0) {
+        // Named, not dropped. `values` on a record drops unknown fields because a
+        // dataset model defines what exists; a submission has no model, so a
+        // silent drop here would read as "we stored your correction" when nothing
+        // was stored, and the visitor's answers are exactly the thing that must
+        // not be quietly editable.
+        return ApiErrors.badRequest({
+            message: 'Only `read` can be changed on a form submission',
+            code: 'validation_failed',
+            fields: Object.fromEntries(unknown.map((key)=>[
+                    key,
+                    'Not writable on a form submission'
+                ])),
+            headers: ctx.headers
+        });
+    }
+    if (typeof body.read !== 'boolean') {
+        return ApiErrors.badRequest({
+            message: 'Form submission failed validation',
+            code: 'validation_failed',
+            fields: {
+                read: 'Must be true or false'
+            },
+            headers: ctx.headers
+        });
+    }
+    const snap = await submissionRef.get();
+    if (!snap.exists) {
+        return ApiErrors.notFound({
+            message: 'No such form submission',
+            headers: ctx.headers
+        });
+    }
+    await submissionRef.update({
+        read: body.read
+    });
+    return apiJson(formSubmissionView(await submissionRef.get()), {
+        headers: ctx.headers
+    });
+}
+/**
+ * Delete one submission. Accepts an `Idempotency-Key` for the reason
+ * `deleteRecord` does: a purge that runs after an export is the operation
+ * most likely to be retried on a timer, and without a key the retry cannot
+ * tell "already gone" from "wrong id".
+ */ async function deleteFormSubmission(request, ctx, hostId, submissionRef) {
+    const claimed = await claimWrite(ctx, hostId, request.headers.get('Idempotency-Key'), 'form-submission-deletes');
+    if ('replay' in claimed) return claimed.replay;
+    const { claim } = claimed;
+    try {
+        var _snap_data;
+        const snap = await submissionRef.get();
+        if (!snap.exists) {
+            await claim.release();
+            return ApiErrors.notFound({
+                message: 'No such form submission',
+                headers: ctx.headers
+            });
+        }
+        const removed = {
+            id: snap.id,
+            data: (_snap_data = snap.data()) != null ? _snap_data : {}
+        };
+        await submissionRef.delete();
+        /*
+     * Whatever counted this row when it arrived (a form's counters, AGL-3330)
+     * cannot see a delete, so the plugins are told what left. Best effort,
+     * isolated per plugin by the seam: the delete is the request, and a
+     * recount that fails leaves its figures for the next one rather than
+     * failing a purge that already happened.
+     */ await runPluginEventHandlers('host.records.removed', {
+            orgId: ctx.orgId,
+            hostIds: [
+                hostId
+            ],
+            collection: 'formSubmissions',
+            records: [
+                removed
+            ]
+        }).catch((error)=>console.error('records-removed event after an API delete failed', error));
+        const view = {
+            id: submissionRef.id,
+            object: 'form_submission',
+            deleted: true
+        };
+        await claim.record(200, view);
+        return apiJson(view, {
+            headers: ctx.headers
+        });
+    } catch (error) {
+        await claim.release();
+        throw error;
+    }
+}
+
+//# sourceMappingURL=form-submissions.js.map

package/src/lib/server/api-v1/form-submissions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/forms/src/lib/server/api-v1/form-submissions.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  ApiErrors,\n  apiJson,\n  listResponse,\n} from '@aglyn/tenant-data-admin'\nimport {\n  type ApiV1Context,\n  claimWrite,\n  paginate,\n  readJsonBody,\n  requireScope,\n  serialize,\n} from '@aglyn/tenant-data-admin/server/api-v1-kit'\nimport { runPluginEventHandlers } from '@aglyn/aglyn/plugin-manager/plugin-events'\n\n/**\n * A site's form submissions on the customer REST API,\n * `/v1/sites/{siteId}/form-submissions/…` (AGL-2127, AGL-3080). Registered\n * from this plugin's console server declarations; the console's `/v1`\n * router owns the pipeline in front — the key, the plan's API access, the\n * request quota, the rate limit — and refuses a site the key's organization\n * does not own before it hands a request here.\n */\n\nfunction formSubmissionView(doc: FirebaseFirestore.DocumentSnapshot) {\n  return {\n    id: doc.id,\n    object: 'form_submission',\n    // The form ENTITY this was sent to, `null` for a row written before the\n    // form was adopted. `form` below stays the caption — an integration\n    // grouping by it is grouping by a display string that a rename splits,\n    // which is the whole reason this field exists.\n    form_id: doc.get('formId') ?? null,\n    form: doc.get('formName') ?? null,\n    path: doc.get('path') ?? null,\n    fields: doc.get('fields') ?? {},\n    read: Boolean(doc.get('read')),\n    // Where the platform already sent this row. Omitting it meant an\n    // integration syncing submissions into a CRM could not tell that a record\n    // had already been written to a dataset — the one fact that stops it\n    // duplicating work the platform had done.\n    routing: doc.get('routing') ?? null,\n    created: serialize(doc.get('createdAt')) ?? null,\n  }\n}\n\n/**\n * `/v1/sites/{siteId}/form-submissions[/{submissionId}]` (AGL-2127).\n *\n * The list was the whole surface, and that shaped every integration written\n * against it badly. A lead sync polls, pushes new rows into a CRM, and then\n * has nowhere to record that it did — so it either re-pushes the same lead\n * next poll, or keeps its own high-water mark of ids against a list that\n * `conventions.md` publishes as ordered by DOCUMENT ID, not by time. The\n * `read` flag the console's inbox toggles on the very same document is the\n * state the integration needed and could not write.\n *\n * `read` is the ONLY writable field. A submission is what a visitor typed,\n * and an API that let an integration quietly rewrite it would make the\n * inbox's contents unattributable — so anything else in the body is a\n * `validation_failed` naming the offending key rather than a silent drop.\n */\nexport async function handleFormSubmissions(\n  request: Request,\n  ctx: ApiV1Context,\n  segments: string[],\n  url: URL,\n): Promise<Response> {\n  const [, hostId, , submissionId] = segments\n  const collection = ctx.firestore\n    .collection('hosts')\n    .doc(hostId)\n    .collection('formSubmissions')\n\n  if (!submissionId) {\n    const denied = requireScope(ctx, 'forms:read')\n    if (denied) return denied\n    if (request.method !== 'GET') {\n      return ApiErrors.methodNotAllowed({\n        headers: { ...ctx.headers, Allow: 'GET' },\n      })\n    }\n    // An EMPTY value means the filter is absent, matching `?email=` and\n    // `?tag=` on contacts and `conventions.md`'s single rule for all three.\n    // A client serializing an unset form field sends `?read=`, and refusing\n    // that while `?email=` accepts it would be an inconsistency an integrator\n    // discovers one filter at a time.\n    const rawRead = url.searchParams.get('read') || null\n    if (rawRead !== null && rawRead !== 'true' && rawRead !== 'false') {\n      return ApiErrors.badRequest({\n        message: 'Form submission filter failed validation',\n        code: 'validation_failed',\n        fields: { read: 'Must be true or false' },\n        headers: ctx.headers,\n      })\n    }\n    const read = rawRead === null ? null : rawRead === 'true'\n\n    let query: FirebaseFirestore.Query = collection\n    const form = url.searchParams.get('form')\n    const formId = url.searchParams.get('formId')\n    // `formId` is the id-first filter and wins when both are sent: it is the\n    // one that survives a rename. `?form=` is NOT removed and is not\n    // deprecated here — it filters on the caption every submission still\n    // carries, which is the only thing a form that has not been adopted yet\n    // can be filtered by. The same posture the legacy `?collection=` content\n    // parameters take.\n    if (formId) query = query.where('formId', '==', formId)\n    else if (form) query = query.where('formName', '==', form)\n    // `read` goes to FIRESTORE only when it is the sole filter, and is\n    // applied after the read when it joins `form` (AGL-2460).\n    //\n    // Two equality clauses plus the `orderBy(FieldPath.documentId())` every\n    // list here applies is a three-clause query, and Firestore serves that\n    // only from a composite index. Shipping one to serve a filter\n    // COMBINATION is a migration with a backfill, not a feature — and the\n    // failure mode while it builds is this route's documented realistic 500\n    // (see the route's `safeDispatch` docblock). Narrowing on `formName` and\n    // dropping the rest in memory keeps the pre-existing `?form=` query\n    // byte-for-byte what it already was, which is the property worth more\n    // than one saved round trip.\n    //\n    // `read=false` IS exact against Firestore, unlike `?channel=online` on\n    // orders. That filter is applied after the read because older orders\n    // predate the `channel` field and a `where` would silently drop them.\n    // The equivalent question was checked here rather than assumed: the\n    // ONLY writer of this collection is the tenant's form-submit route, and\n    // it has stamped `read: false` on every row since the feature's first\n    // commit (AGL-76/77, `fc149e538`). There is no fieldless generation to\n    // drop, so the cheap query is also the correct one.\n    // Either form filter already spent this list's one equality clause, so\n    // `read` is applied after the read exactly as it is for `?form=` — a\n    // second `where` plus the document-id ordering is a three-clause query\n    // and needs its own composite index per combination. The `formId ASC,\n    // createdAt DESC` index this work ships serves the CONSOLE's ordered\n    // list; `/v1` lists are ordered by document id and are a different query.\n    const narrowedByForm = Boolean(formId || form)\n    if (read !== null && !narrowedByForm) {\n      query = query.where('read', '==', read)\n    }\n    const { docs, nextCursor } = await paginate(query, url)\n    const matched =\n      read !== null && narrowedByForm\n        ? docs.filter((doc) => Boolean(doc.get('read')) === read)\n        : docs\n    return listResponse(matched.map(formSubmissionView), nextCursor, ctx.headers)\n  }\n\n  const submissionRef = collection.doc(submissionId)\n\n  if (request.method === 'GET') {\n    const denied = requireScope(ctx, 'forms:read')\n    if (denied) return denied\n    const snap = await submissionRef.get()\n    if (!snap.exists) {\n      return ApiErrors.notFound({\n        message: 'No such form submission',\n        headers: ctx.headers,\n      })\n    }\n    return apiJson(formSubmissionView(snap), { headers: ctx.headers })\n  }\n\n  if (request.method === 'PATCH') {\n    const denied = requireScope(ctx, 'forms:write')\n    if (denied) return denied\n    return updateFormSubmission(request, ctx, submissionRef)\n  }\n\n  if (request.method === 'DELETE') {\n    const denied = requireScope(ctx, 'forms:write')\n    if (denied) return denied\n    return deleteFormSubmission(request, ctx, hostId, submissionRef)\n  }\n\n  return ApiErrors.methodNotAllowed({\n    headers: { ...ctx.headers, Allow: 'GET, PATCH, DELETE' },\n  })\n}\n\n/**\n * Mark one submission read or unread. No `Idempotency-Key`: the same body\n * twice lands the same state AND returns the same `200`, which is the test\n * `updateRecord` and `updateDataset` are held to.\n */\nasync function updateFormSubmission(\n  request: Request,\n  ctx: ApiV1Context,\n  submissionRef: FirebaseFirestore.DocumentReference,\n): Promise<Response> {\n  const body = await readJsonBody(request)\n  const unknown = Object.keys(body).filter((key) => key !== 'read')\n  if (unknown.length > 0) {\n    // Named, not dropped. `values` on a record drops unknown fields because a\n    // dataset model defines what exists; a submission has no model, so a\n    // silent drop here would read as \"we stored your correction\" when nothing\n    // was stored, and the visitor's answers are exactly the thing that must\n    // not be quietly editable.\n    return ApiErrors.badRequest({\n      message: 'Only `read` can be changed on a form submission',\n      code: 'validation_failed',\n      fields: Object.fromEntries(\n        unknown.map((key) => [key, 'Not writable on a form submission']),\n      ),\n      headers: ctx.headers,\n    })\n  }\n  if (typeof body.read !== 'boolean') {\n    return ApiErrors.badRequest({\n      message: 'Form submission failed validation',\n      code: 'validation_failed',\n      fields: { read: 'Must be true or false' },\n      headers: ctx.headers,\n    })\n  }\n\n  const snap = await submissionRef.get()\n  if (!snap.exists) {\n    return ApiErrors.notFound({\n      message: 'No such form submission',\n      headers: ctx.headers,\n    })\n  }\n  await submissionRef.update({ read: body.read })\n  return apiJson(formSubmissionView(await submissionRef.get()), {\n    headers: ctx.headers,\n  })\n}\n\n/**\n * Delete one submission. Accepts an `Idempotency-Key` for the reason\n * `deleteRecord` does: a purge that runs after an export is the operation\n * most likely to be retried on a timer, and without a key the retry cannot\n * tell \"already gone\" from \"wrong id\".\n */\nasync function deleteFormSubmission(\n  request: Request,\n  ctx: ApiV1Context,\n  hostId: string,\n  submissionRef: FirebaseFirestore.DocumentReference,\n): Promise<Response> {\n  const claimed = await claimWrite(\n    ctx,\n    hostId,\n    request.headers.get('Idempotency-Key'),\n    'form-submission-deletes',\n  )\n  if ('replay' in claimed) return claimed.replay\n  const { claim } = claimed\n\n  try {\n    const snap = await submissionRef.get()\n    if (!snap.exists) {\n      await claim.release()\n      return ApiErrors.notFound({\n        message: 'No such form submission',\n        headers: ctx.headers,\n      })\n    }\n    const removed = { id: snap.id, data: (snap.data() ?? {}) as Record<string, unknown> }\n    await submissionRef.delete()\n    /*\n     * Whatever counted this row when it arrived (a form's counters, AGL-3330)\n     * cannot see a delete, so the plugins are told what left. Best effort,\n     * isolated per plugin by the seam: the delete is the request, and a\n     * recount that fails leaves its figures for the next one rather than\n     * failing a purge that already happened.\n     */\n    await runPluginEventHandlers('host.records.removed', {\n      orgId: ctx.orgId,\n      hostIds: [hostId],\n      collection: 'formSubmissions',\n      records: [removed],\n    }).catch((error) => console.error('records-removed event after an API delete failed', error))\n    const view = {\n      id: submissionRef.id,\n      object: 'form_submission',\n      deleted: true,\n    }\n    await claim.record(200, view)\n    return apiJson(view, { headers: ctx.headers })\n  } catch (error) {\n    await claim.release()\n    throw error\n  }\n}\n\n"],"names":["ApiErrors","apiJson","listResponse","claimWrite","paginate","readJsonBody","requireScope","serialize","runPluginEventHandlers","formSubmissionView","doc","id","object","form_id","get","form","path","fields","read","Boolean","routing","created","handleFormSubmissions","request","ctx","segments","url","hostId","submissionId","collection","firestore","denied","method","methodNotAllowed","headers","Allow","rawRead","searchParams","badRequest","message","code","query","formId","where","narrowedByForm","docs","nextCursor","matched","filter","map","submissionRef","snap","exists","notFound","updateFormSubmission","deleteFormSubmission","body","unknown","Object","keys","key","length","fromEntries","update","claimed","replay","claim","release","removed","data","delete","orgId","hostIds","records","catch","error","console","view","deleted","record"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,SAAS,EACTC,OAAO,EACPC,YAAY,QACP,2BAA0B;AACjC,SAEEC,UAAU,EACVC,QAAQ,EACRC,YAAY,EACZC,YAAY,EACZC,SAAS,QACJ,6CAA4C;AACnD,SAASC,sBAAsB,QAAQ,4CAA2C;AAElF;;;;;;;CAOC,GAED,SAASC,mBAAmBC,GAAuC;QAQtDA,UACHA,WACAA,WACEA,WAMCA,WACAH;IAjBX,OAAO;QACLI,IAAID,IAAIC,EAAE;QACVC,QAAQ;QACR,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,+CAA+C;QAC/CC,OAAO,GAAEH,WAAAA,IAAII,GAAG,CAAC,qBAARJ,WAAqB;QAC9BK,IAAI,GAAEL,YAAAA,IAAII,GAAG,CAAC,uBAARJ,YAAuB;QAC7BM,IAAI,GAAEN,YAAAA,IAAII,GAAG,CAAC,mBAARJ,YAAmB;QACzBO,MAAM,GAAEP,YAAAA,IAAII,GAAG,CAAC,qBAARJ,YAAqB,CAAC;QAC9BQ,MAAMC,QAAQT,IAAII,GAAG,CAAC;QACtB,iEAAiE;QACjE,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1CM,OAAO,GAAEV,YAAAA,IAAII,GAAG,CAAC,sBAARJ,YAAsB;QAC/BW,OAAO,GAAEd,aAAAA,UAAUG,IAAII,GAAG,CAAC,yBAAlBP,aAAmC;IAC9C;AACF;AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,eAAee,sBACpBC,OAAgB,EAChBC,GAAiB,EACjBC,QAAkB,EAClBC,GAAQ;IAER,MAAM,GAAGC,UAAUC,aAAa,GAAGH;IACnC,MAAMI,aAAaL,IAAIM,SAAS,CAC7BD,UAAU,CAAC,SACXnB,GAAG,CAACiB,QACJE,UAAU,CAAC;IAEd,IAAI,CAACD,cAAc;QACjB,MAAMG,SAASzB,aAAakB,KAAK;QACjC,IAAIO,QAAQ,OAAOA;QACnB,IAAIR,QAAQS,MAAM,KAAK,OAAO;YAC5B,OAAOhC,UAAUiC,gBAAgB,CAAC;gBAChCC,SAAS,aAAKV,IAAIU,OAAO;oBAAEC,OAAO;;YACpC;QACF;QACA,oEAAoE;QACpE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,kCAAkC;QAClC,MAAMC,UAAUV,IAAIW,YAAY,CAACvB,GAAG,CAAC,WAAW;QAChD,IAAIsB,YAAY,QAAQA,YAAY,UAAUA,YAAY,SAAS;YACjE,OAAOpC,UAAUsC,UAAU,CAAC;gBAC1BC,SAAS;gBACTC,MAAM;gBACNvB,QAAQ;oBAAEC,MAAM;gBAAwB;gBACxCgB,SAASV,IAAIU,OAAO;YACtB;QACF;QACA,MAAMhB,OAAOkB,YAAY,OAAO,OAAOA,YAAY;QAEnD,IAAIK,QAAiCZ;QACrC,MAAMd,OAAOW,IAAIW,YAAY,CAACvB,GAAG,CAAC;QAClC,MAAM4B,SAAShB,IAAIW,YAAY,CAACvB,GAAG,CAAC;QACpC,yEAAyE;QACzE,iEAAiE;QACjE,qEAAqE;QACrE,wEAAwE;QACxE,yEAAyE;QACzE,mBAAmB;QACnB,IAAI4B,QAAQD,QAAQA,MAAME,KAAK,CAAC,UAAU,MAAMD;aAC3C,IAAI3B,MAAM0B,QAAQA,MAAME,KAAK,CAAC,YAAY,MAAM5B;QACrD,mEAAmE;QACnE,0DAA0D;QAC1D,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,8DAA8D;QAC9D,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,6BAA6B;QAC7B,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,oDAAoD;QACpD,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,0EAA0E;QAC1E,MAAM6B,iBAAiBzB,QAAQuB,UAAU3B;QACzC,IAAIG,SAAS,QAAQ,CAAC0B,gBAAgB;YACpCH,QAAQA,MAAME,KAAK,CAAC,QAAQ,MAAMzB;QACpC;QACA,MAAM,EAAE2B,IAAI,EAAEC,UAAU,EAAE,GAAG,MAAM1C,SAASqC,OAAOf;QACnD,MAAMqB,UACJ7B,SAAS,QAAQ0B,iBACbC,KAAKG,MAAM,CAAC,CAACtC,MAAQS,QAAQT,IAAII,GAAG,CAAC,aAAaI,QAClD2B;QACN,OAAO3C,aAAa6C,QAAQE,GAAG,CAACxC,qBAAqBqC,YAAYtB,IAAIU,OAAO;IAC9E;IAEA,MAAMgB,gBAAgBrB,WAAWnB,GAAG,CAACkB;IAErC,IAAIL,QAAQS,MAAM,KAAK,OAAO;QAC5B,MAAMD,SAASzB,aAAakB,KAAK;QACjC,IAAIO,QAAQ,OAAOA;QACnB,MAAMoB,OAAO,MAAMD,cAAcpC,GAAG;QACpC,IAAI,CAACqC,KAAKC,MAAM,EAAE;YAChB,OAAOpD,UAAUqD,QAAQ,CAAC;gBACxBd,SAAS;gBACTL,SAASV,IAAIU,OAAO;YACtB;QACF;QACA,OAAOjC,QAAQQ,mBAAmB0C,OAAO;YAAEjB,SAASV,IAAIU,OAAO;QAAC;IAClE;IAEA,IAAIX,QAAQS,MAAM,KAAK,SAAS;QAC9B,MAAMD,SAASzB,aAAakB,KAAK;QACjC,IAAIO,QAAQ,OAAOA;QACnB,OAAOuB,qBAAqB/B,SAASC,KAAK0B;IAC5C;IAEA,IAAI3B,QAAQS,MAAM,KAAK,UAAU;QAC/B,MAAMD,SAASzB,aAAakB,KAAK;QACjC,IAAIO,QAAQ,OAAOA;QACnB,OAAOwB,qBAAqBhC,SAASC,KAAKG,QAAQuB;IACpD;IAEA,OAAOlD,UAAUiC,gBAAgB,CAAC;QAChCC,SAAS,aAAKV,IAAIU,OAAO;YAAEC,OAAO;;IACpC;AACF;AAEA;;;;CAIC,GACD,eAAemB,qBACb/B,OAAgB,EAChBC,GAAiB,EACjB0B,aAAkD;IAElD,MAAMM,OAAO,MAAMnD,aAAakB;IAChC,MAAMkC,UAAUC,OAAOC,IAAI,CAACH,MAAMR,MAAM,CAAC,CAACY,MAAQA,QAAQ;IAC1D,IAAIH,QAAQI,MAAM,GAAG,GAAG;QACtB,0EAA0E;QAC1E,qEAAqE;QACrE,0EAA0E;QAC1E,wEAAwE;QACxE,2BAA2B;QAC3B,OAAO7D,UAAUsC,UAAU,CAAC;YAC1BC,SAAS;YACTC,MAAM;YACNvB,QAAQyC,OAAOI,WAAW,CACxBL,QAAQR,GAAG,CAAC,CAACW,MAAQ;oBAACA;oBAAK;iBAAoC;YAEjE1B,SAASV,IAAIU,OAAO;QACtB;IACF;IACA,IAAI,OAAOsB,KAAKtC,IAAI,KAAK,WAAW;QAClC,OAAOlB,UAAUsC,UAAU,CAAC;YAC1BC,SAAS;YACTC,MAAM;YACNvB,QAAQ;gBAAEC,MAAM;YAAwB;YACxCgB,SAASV,IAAIU,OAAO;QACtB;IACF;IAEA,MAAMiB,OAAO,MAAMD,cAAcpC,GAAG;IACpC,IAAI,CAACqC,KAAKC,MAAM,EAAE;QAChB,OAAOpD,UAAUqD,QAAQ,CAAC;YACxBd,SAAS;YACTL,SAASV,IAAIU,OAAO;QACtB;IACF;IACA,MAAMgB,cAAca,MAAM,CAAC;QAAE7C,MAAMsC,KAAKtC,IAAI;IAAC;IAC7C,OAAOjB,QAAQQ,mBAAmB,MAAMyC,cAAcpC,GAAG,KAAK;QAC5DoB,SAASV,IAAIU,OAAO;IACtB;AACF;AAEA;;;;;CAKC,GACD,eAAeqB,qBACbhC,OAAgB,EAChBC,GAAiB,EACjBG,MAAc,EACduB,aAAkD;IAElD,MAAMc,UAAU,MAAM7D,WACpBqB,KACAG,QACAJ,QAAQW,OAAO,CAACpB,GAAG,CAAC,oBACpB;IAEF,IAAI,YAAYkD,SAAS,OAAOA,QAAQC,MAAM;IAC9C,MAAM,EAAEC,KAAK,EAAE,GAAGF;IAElB,IAAI;YASoCb;QARtC,MAAMA,OAAO,MAAMD,cAAcpC,GAAG;QACpC,IAAI,CAACqC,KAAKC,MAAM,EAAE;YAChB,MAAMc,MAAMC,OAAO;YACnB,OAAOnE,UAAUqD,QAAQ,CAAC;gBACxBd,SAAS;gBACTL,SAASV,IAAIU,OAAO;YACtB;QACF;QACA,MAAMkC,UAAU;YAAEzD,IAAIwC,KAAKxC,EAAE;YAAE0D,IAAI,GAAGlB,aAAAA,KAAKkB,IAAI,cAATlB,aAAe,CAAC;QAA8B;QACpF,MAAMD,cAAcoB,MAAM;QAC1B;;;;;;KAMC,GACD,MAAM9D,uBAAuB,wBAAwB;YACnD+D,OAAO/C,IAAI+C,KAAK;YAChBC,SAAS;gBAAC7C;aAAO;YACjBE,YAAY;YACZ4C,SAAS;gBAACL;aAAQ;QACpB,GAAGM,KAAK,CAAC,CAACC,QAAUC,QAAQD,KAAK,CAAC,oDAAoDA;QACtF,MAAME,OAAO;YACXlE,IAAIuC,cAAcvC,EAAE;YACpBC,QAAQ;YACRkE,SAAS;QACX;QACA,MAAMZ,MAAMa,MAAM,CAAC,KAAKF;QACxB,OAAO5E,QAAQ4E,MAAM;YAAE3C,SAASV,IAAIU,OAAO;QAAC;IAC9C,EAAE,OAAOyC,OAAO;QACd,MAAMT,MAAMC,OAAO;QACnB,MAAMQ;IACR;AACF"}

package/src/lib/server/api-v1/openapi.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type ApiV1ResourceDescription } from '@aglyn/tenant-data-admin/server/api-v1-description';
+/**
+ * `/v1/sites/{siteId}/form-submissions` as the customer API's OpenAPI
+ * document describes it — what the console's builder turns into paths, a tag
+ * and schemas, and the MCP tools derive from. Transcribed unchanged from the
+ * builder's own list when the resource moved here (AGL-3080);
+ * `api-v1-openapi.spec.ts` holds the document to every endpoint the
+ * documentation promises.
+ */
+export declare const FORM_SUBMISSIONS_API_V1_DESCRIPTION: ApiV1ResourceDescription;