@aglyn/plugins-forms 1.0.0-beta.221 → 1.0.0-beta.223

package/src/lib/server/api-v1/openapi.js

@@ -0,0 +1,133 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { booleanField as bool, objectKindField as OBJECT_FIELD, openObjectField as objectOf, queryParam as q, RECORD_STAMPS as STAMPS, stringField as str } from "@aglyn/tenant-data-admin/server/api-v1-description";
+/**
+ * `/v1/sites/{siteId}/form-submissions` as the customer API's OpenAPI
+ * document describes it — what the console's builder turns into paths, a tag
+ * and schemas, and the MCP tools derive from. Transcribed unchanged from the
+ * builder's own list when the resource moved here (AGL-3080);
+ * `api-v1-openapi.spec.ts` holds the document to every endpoint the
+ * documentation promises.
+ */ export const FORM_SUBMISSIONS_API_V1_DESCRIPTION = {
+    tag: 'Form submissions',
+    description: 'What visitors sent through a site’s forms.',
+    schemaName: 'FormSubmission',
+    required: [
+        'id',
+        'object',
+        'form_id',
+        'fields'
+    ],
+    writable: [
+        'read'
+    ],
+    writeRequired: [
+        'read'
+    ],
+    fields: {
+        id: str('Submission id.'),
+        object: OBJECT_FIELD('form_submission'),
+        form_id: str('Form id.'),
+        form: str('Form name.'),
+        path: str('Page path the form was submitted from.'),
+        fields: objectOf('The submitted values, keyed by field name.'),
+        read: bool('Whether the submission has been marked read.'),
+        routing: objectOf('Where the submission was routed.'),
+        created: STAMPS.created
+    },
+    ops: [
+        {
+            path: '/v1/sites/{siteId}/form-submissions',
+            method: 'get',
+            operationId: 'listFormSubmissions',
+            summary: 'List submissions',
+            list: true,
+            returns: 'FormSubmission',
+            description: 'Combining `form`/`formId` with `read` narrows on the form and checks `read` on the page, so pages can come back short.',
+            filters: [
+                q('form', 'Form name.'),
+                q('formId', 'Form id.'),
+                q('read', 'Either `true` or `false`. Anything else is a 400.', {
+                    type: 'string',
+                    enum: [
+                        'true',
+                        'false'
+                    ]
+                })
+            ],
+            pathParams: [
+                {
+                    name: 'siteId',
+                    description: 'Site id.'
+                }
+            ]
+        },
+        {
+            path: '/v1/sites/{siteId}/form-submissions/{submissionId}',
+            method: 'get',
+            operationId: 'getFormSubmission',
+            summary: 'Retrieve a submission',
+            returns: 'FormSubmission',
+            pathParams: [
+                {
+                    name: 'siteId',
+                    description: 'Site id.'
+                },
+                {
+                    name: 'submissionId',
+                    description: 'Submission id.'
+                }
+            ]
+        },
+        {
+            path: '/v1/sites/{siteId}/form-submissions/{submissionId}',
+            method: 'patch',
+            operationId: 'updateFormSubmission',
+            summary: 'Mark a submission read',
+            accepts: 'FormSubmissionWrite',
+            returns: 'FormSubmission',
+            pathParams: [
+                {
+                    name: 'siteId',
+                    description: 'Site id.'
+                },
+                {
+                    name: 'submissionId',
+                    description: 'Submission id.'
+                }
+            ]
+        },
+        {
+            path: '/v1/sites/{siteId}/form-submissions/{submissionId}',
+            method: 'delete',
+            operationId: 'deleteFormSubmission',
+            summary: 'Delete a submission',
+            returns: 'Deleted',
+            pathParams: [
+                {
+                    name: 'siteId',
+                    description: 'Site id.'
+                },
+                {
+                    name: 'submissionId',
+                    description: 'Submission id.'
+                }
+            ]
+        }
+    ]
+};
+
+//# sourceMappingURL=openapi.js.map

package/src/lib/server/api-v1/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/plugins/forms/src/lib/server/api-v1/openapi.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  type ApiV1ResourceDescription,\n  booleanField as bool,\n  objectKindField as OBJECT_FIELD,\n  openObjectField as objectOf,\n  queryParam as q,\n  RECORD_STAMPS as STAMPS,\n  stringField as str,\n} from '@aglyn/tenant-data-admin/server/api-v1-description'\n\n/**\n * `/v1/sites/{siteId}/form-submissions` as the customer API's OpenAPI\n * document describes it — what the console's builder turns into paths, a tag\n * and schemas, and the MCP tools derive from. Transcribed unchanged from the\n * builder's own list when the resource moved here (AGL-3080);\n * `api-v1-openapi.spec.ts` holds the document to every endpoint the\n * documentation promises.\n */\nexport const FORM_SUBMISSIONS_API_V1_DESCRIPTION: ApiV1ResourceDescription = {\n  tag: 'Form submissions',\n  description: 'What visitors sent through a site’s forms.',\n  schemaName: 'FormSubmission',\n  required: ['id', 'object', 'form_id', 'fields'],\n  writable: ['read'],\n  writeRequired: ['read'],\n  fields: {\n    id: str('Submission id.'),\n    object: OBJECT_FIELD('form_submission'),\n    form_id: str('Form id.'),\n    form: str('Form name.'),\n    path: str('Page path the form was submitted from.'),\n    fields: objectOf('The submitted values, keyed by field name.'),\n    read: bool('Whether the submission has been marked read.'),\n    routing: objectOf('Where the submission was routed.'),\n    created: STAMPS.created,\n  },\n  ops: [\n    { path: '/v1/sites/{siteId}/form-submissions', method: 'get', operationId: 'listFormSubmissions', summary: 'List submissions', list: true, returns: 'FormSubmission', description: 'Combining `form`/`formId` with `read` narrows on the form and checks `read` on the page, so pages can come back short.', filters: [q('form', 'Form name.'), q('formId', 'Form id.'), q('read', 'Either `true` or `false`. Anything else is a 400.', { type: 'string', enum: ['true', 'false'] })], pathParams: [{ name: 'siteId', description: 'Site id.' }] },\n    { path: '/v1/sites/{siteId}/form-submissions/{submissionId}', method: 'get', operationId: 'getFormSubmission', summary: 'Retrieve a submission', returns: 'FormSubmission', pathParams: [{ name: 'siteId', description: 'Site id.' }, { name: 'submissionId', description: 'Submission id.' }] },\n    { path: '/v1/sites/{siteId}/form-submissions/{submissionId}', method: 'patch', operationId: 'updateFormSubmission', summary: 'Mark a submission read', accepts: 'FormSubmissionWrite', returns: 'FormSubmission', pathParams: [{ name: 'siteId', description: 'Site id.' }, { name: 'submissionId', description: 'Submission id.' }] },\n    { path: '/v1/sites/{siteId}/form-submissions/{submissionId}', method: 'delete', operationId: 'deleteFormSubmission', summary: 'Delete a submission', returns: 'Deleted', pathParams: [{ name: 'siteId', description: 'Site id.' }, { name: 'submissionId', description: 'Submission id.' }] },\n  ],\n}\n"],"names":["booleanField","bool","objectKindField","OBJECT_FIELD","openObjectField","objectOf","queryParam","q","RECORD_STAMPS","STAMPS","stringField","str","FORM_SUBMISSIONS_API_V1_DESCRIPTION","tag","description","schemaName","required","writable","writeRequired","fields","id","object","form_id","form","path","read","routing","created","ops","method","operationId","summary","list","returns","filters","type","enum","pathParams","name","accepts"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAEEA,gBAAgBC,IAAI,EACpBC,mBAAmBC,YAAY,EAC/BC,mBAAmBC,QAAQ,EAC3BC,cAAcC,CAAC,EACfC,iBAAiBC,MAAM,EACvBC,eAAeC,GAAG,QACb,qDAAoD;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,sCAAgE;IAC3EC,KAAK;IACLC,aAAa;IACbC,YAAY;IACZC,UAAU;QAAC;QAAM;QAAU;QAAW;KAAS;IAC/CC,UAAU;QAAC;KAAO;IAClBC,eAAe;QAAC;KAAO;IACvBC,QAAQ;QACNC,IAAIT,IAAI;QACRU,QAAQlB,aAAa;QACrBmB,SAASX,IAAI;QACbY,MAAMZ,IAAI;QACVa,MAAMb,IAAI;QACVQ,QAAQd,SAAS;QACjBoB,MAAMxB,KAAK;QACXyB,SAASrB,SAAS;QAClBsB,SAASlB,OAAOkB,OAAO;IACzB;IACAC,KAAK;QACH;YAAEJ,MAAM;YAAuCK,QAAQ;YAAOC,aAAa;YAAuBC,SAAS;YAAoBC,MAAM;YAAMC,SAAS;YAAkBnB,aAAa;YAA0HoB,SAAS;gBAAC3B,EAAE,QAAQ;gBAAeA,EAAE,UAAU;gBAAaA,EAAE,QAAQ,qDAAqD;oBAAE4B,MAAM;oBAAUC,MAAM;wBAAC;wBAAQ;qBAAQ;gBAAC;aAAG;YAAEC,YAAY;gBAAC;oBAAEC,MAAM;oBAAUxB,aAAa;gBAAW;aAAE;QAAC;QACjhB;YAAEU,MAAM;YAAsDK,QAAQ;YAAOC,aAAa;YAAqBC,SAAS;YAAyBE,SAAS;YAAkBI,YAAY;gBAAC;oBAAEC,MAAM;oBAAUxB,aAAa;gBAAW;gBAAG;oBAAEwB,MAAM;oBAAgBxB,aAAa;gBAAiB;aAAE;QAAC;QAC/R;YAAEU,MAAM;YAAsDK,QAAQ;YAASC,aAAa;YAAwBC,SAAS;YAA0BQ,SAAS;YAAuBN,SAAS;YAAkBI,YAAY;gBAAC;oBAAEC,MAAM;oBAAUxB,aAAa;gBAAW;gBAAG;oBAAEwB,MAAM;oBAAgBxB,aAAa;gBAAiB;aAAE;QAAC;QACrU;YAAEU,MAAM;YAAsDK,QAAQ;YAAUC,aAAa;YAAwBC,SAAS;YAAuBE,SAAS;YAAWI,YAAY;gBAAC;oBAAEC,MAAM;oBAAUxB,aAAa;gBAAW;gBAAG;oBAAEwB,MAAM;oBAAgBxB,aAAa;gBAAiB;aAAE;QAAC;KAC7R;AACH,EAAC"}

package/src/lib/server/form-intake-gate.d.ts

@@ -0,0 +1,34 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginIntakeGate } from '@aglyn/aglyn/plugin-manager/plugin-intake-gates';
+/**
+ * The form door, asked without writing (AGL-2586, AGL-3080).
+ *
+ * The gates `POST /api/forms/submit` clears before its first write that are
+ * this plugin's, in the order it clears them, through the same functions: the
+ * site's Forms switch (AGL-3029), the plan's monthly allowance (a wall on
+ * Free, a meter on the plans that carry the infra pass-through, AGL-1280) and
+ * the ceiling that contains a flood (AGL-1655), the last two over the month's
+ * count the route reads. The funnel probe on `/api/health/funnel` asks this
+ * through `plugin-intake-gates`, so its verdict is the route's predicates
+ * about the real documents, and it writes nothing.
+ *
+ * The door is judged by this plugin's switch alone: the probe asks about a
+ * form, and a Marketing popup's capture through the same door is the route's
+ * to judge by its own plugin.
+ */
+export declare const formIntakeGate: PluginIntakeGate;

package/src/lib/server/form-intake-gate.js

@@ -0,0 +1,44 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { checkFormSubmissionAbuseCeiling, checkFormSubmissionQuota, isHostPluginEnabled, utcMonthKey } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { BUNDLE_ID } from "../constants/bundle-common.js";
+/**
+ * The form door, asked without writing (AGL-2586, AGL-3080).
+ *
+ * The gates `POST /api/forms/submit` clears before its first write that are
+ * this plugin's, in the order it clears them, through the same functions: the
+ * site's Forms switch (AGL-3029), the plan's monthly allowance (a wall on
+ * Free, a meter on the plans that carry the infra pass-through, AGL-1280) and
+ * the ceiling that contains a flood (AGL-1655), the last two over the month's
+ * count the route reads. The funnel probe on `/api/health/funnel` asks this
+ * through `plugin-intake-gates`, so its verdict is the route's predicates
+ * about the real documents, and it writes nothing.
+ *
+ * The door is judged by this plugin's switch alone: the probe asks about a
+ * form, and a Marketing popup's capture through the same door is the route's
+ * to judge by its own plugin.
+ */ export const formIntakeGate = async ({ hostId, host, org })=>{
+    var _counter_get;
+    if (!isHostPluginEnabled(org, host, BUNDLE_ID)) return 'switched-off';
+    const counter = await firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection('counters').doc('formSubmissions').get();
+    const used = Number((_counter_get = counter.get(utcMonthKey())) != null ? _counter_get : 0);
+    if (!checkFormSubmissionQuota(org, used).allowed) return 'plan-exhausted';
+    if (checkFormSubmissionAbuseCeiling(org, used).exceeded) return 'flood-ceiling';
+    return 'open';
+};
+
+//# sourceMappingURL=form-intake-gate.js.map

package/src/lib/server/form-intake-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/forms/src/lib/server/form-intake-gate.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  checkFormSubmissionAbuseCeiling,\n  checkFormSubmissionQuota,\n  isHostPluginEnabled,\n  utcMonthKey,\n} from '@aglyn/aglyn/server'\nimport type { PluginIntakeGate } from '@aglyn/aglyn/plugin-manager/plugin-intake-gates'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { BUNDLE_ID } from '../constants/bundle-common'\n\n/**\n * The form door, asked without writing (AGL-2586, AGL-3080).\n *\n * The gates `POST /api/forms/submit` clears before its first write that are\n * this plugin's, in the order it clears them, through the same functions: the\n * site's Forms switch (AGL-3029), the plan's monthly allowance (a wall on\n * Free, a meter on the plans that carry the infra pass-through, AGL-1280) and\n * the ceiling that contains a flood (AGL-1655), the last two over the month's\n * count the route reads. The funnel probe on `/api/health/funnel` asks this\n * through `plugin-intake-gates`, so its verdict is the route's predicates\n * about the real documents, and it writes nothing.\n *\n * The door is judged by this plugin's switch alone: the probe asks about a\n * form, and a Marketing popup's capture through the same door is the route's\n * to judge by its own plugin.\n */\nexport const formIntakeGate: PluginIntakeGate = async ({ hostId, host, org }) => {\n  if (!isHostPluginEnabled(org as never, host as never, BUNDLE_ID)) return 'switched-off'\n  const counter = await firebaseAdmin\n    .app()\n    .firestore()\n    .collection('hosts')\n    .doc(hostId)\n    .collection('counters')\n    .doc('formSubmissions')\n    .get()\n  const used = Number(counter.get(utcMonthKey()) ?? 0)\n  if (!checkFormSubmissionQuota(org as never, used).allowed) return 'plan-exhausted'\n  if (checkFormSubmissionAbuseCeiling(org as never, used).exceeded) return 'flood-ceiling'\n  return 'open'\n}\n"],"names":["checkFormSubmissionAbuseCeiling","checkFormSubmissionQuota","isHostPluginEnabled","utcMonthKey","firebaseAdmin","BUNDLE_ID","formIntakeGate","hostId","host","org","counter","app","firestore","collection","doc","get","used","Number","allowed","exceeded"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,+BAA+B,EAC/BC,wBAAwB,EACxBC,mBAAmB,EACnBC,WAAW,QACN,sBAAqB;AAE5B,SAASC,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,SAAS,QAAQ,gCAA4B;AAEtD;;;;;;;;;;;;;;;CAeC,GACD,OAAO,MAAMC,iBAAmC,OAAO,EAAEC,MAAM,EAAEC,IAAI,EAAEC,GAAG,EAAE;QAUtDC;IATpB,IAAI,CAACR,oBAAoBO,KAAcD,MAAeH,YAAY,OAAO;IACzE,MAAMK,UAAU,MAAMN,cACnBO,GAAG,GACHC,SAAS,GACTC,UAAU,CAAC,SACXC,GAAG,CAACP,QACJM,UAAU,CAAC,YACXC,GAAG,CAAC,mBACJC,GAAG;IACN,MAAMC,OAAOC,QAAOP,eAAAA,QAAQK,GAAG,CAACZ,0BAAZO,eAA8B;IAClD,IAAI,CAACT,yBAAyBQ,KAAcO,MAAME,OAAO,EAAE,OAAO;IAClE,IAAIlB,gCAAgCS,KAAcO,MAAMG,QAAQ,EAAE,OAAO;IACzE,OAAO;AACT,EAAC"}

package/src/lib/server/form-submission-index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { PluginRecordIndex } from '@aglyn/aglyn/plugin-manager/plugin-record-index';
+/**
+ * A site's form submissions on the server, for the plugin that reads them
+ * (AGL-3080) — the Inbox's reply and its list assignment. Site-scoped: a
+ * request that names no site answers none. Each record is
+ * `formSubmissionIndexedRecord`'s; `ref` hands the reader the one document it
+ * marks answered and threads its own records under, as that module documents.
+ * The reader proves who is asking first — the index authenticates nobody.
+ */
+export declare const formSubmissionRecordIndex: PluginRecordIndex;

package/src/lib/server/form-submission-index.js

@@ -0,0 +1,51 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { firebaseAdmin } from "@aglyn/tenant-data-admin/server/firebase-admin";
+import { formSubmissionIndexedRecord } from "../model/form-submission-record.js";
+/** The collection this plugin keeps submissions in, under a site. */ const SUBMISSIONS = 'formSubmissions';
+const submissions = (hostId)=>firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection(SUBMISSIONS);
+/**
+ * A site's form submissions on the server, for the plugin that reads them
+ * (AGL-3080) — the Inbox's reply and its list assignment. Site-scoped: a
+ * request that names no site answers none. Each record is
+ * `formSubmissionIndexedRecord`'s; `ref` hands the reader the one document it
+ * marks answered and threads its own records under, as that module documents.
+ * The reader proves who is asking first — the index authenticates nobody.
+ */ export const formSubmissionRecordIndex = {
+    async list ({ hostId, limit }) {
+        if (!hostId || limit < 1) return {
+            records: [],
+            truncated: false
+        };
+        const snapshot = await submissions(hostId).orderBy('createdAt', 'desc').limit(limit + 1).get();
+        const records = snapshot.docs.slice(0, limit).map((document)=>formSubmissionIndexedRecord(document.id, document.data())).filter((record)=>record !== null);
+        return {
+            records,
+            truncated: snapshot.size > limit
+        };
+    },
+    async get ({ hostId, id }) {
+        if (!hostId || !id) return null;
+        const snapshot = await submissions(hostId).doc(id).get();
+        return snapshot.exists ? formSubmissionIndexedRecord(snapshot.id, snapshot.data()) : null;
+    },
+    async ref ({ hostId, id }) {
+        if (!hostId || !id) return null;
+        return submissions(hostId).doc(id);
+    }
+};
+
+//# sourceMappingURL=form-submission-index.js.map

package/src/lib/server/form-submission-index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/forms/src/lib/server/form-submission-index.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { PluginRecordIndex } from '@aglyn/aglyn/plugin-manager/plugin-record-index'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin/server/firebase-admin'\nimport { formSubmissionIndexedRecord } from '../model/form-submission-record'\n\n/** The collection this plugin keeps submissions in, under a site. */\nconst SUBMISSIONS = 'formSubmissions'\n\nconst submissions = (hostId: string) =>\n  firebaseAdmin.app().firestore().collection('hosts').doc(hostId).collection(SUBMISSIONS)\n\n/**\n * A site's form submissions on the server, for the plugin that reads them\n * (AGL-3080) — the Inbox's reply and its list assignment. Site-scoped: a\n * request that names no site answers none. Each record is\n * `formSubmissionIndexedRecord`'s; `ref` hands the reader the one document it\n * marks answered and threads its own records under, as that module documents.\n * The reader proves who is asking first — the index authenticates nobody.\n */\nexport const formSubmissionRecordIndex: PluginRecordIndex = {\n  async list({ hostId, limit }) {\n    if (!hostId || limit < 1) return { records: [], truncated: false }\n    const snapshot = await submissions(hostId).orderBy('createdAt', 'desc').limit(limit + 1).get()\n    const records = snapshot.docs\n      .slice(0, limit)\n      .map((document) => formSubmissionIndexedRecord(document.id, document.data()))\n      .filter((record): record is NonNullable<typeof record> => record !== null)\n    return { records, truncated: snapshot.size > limit }\n  },\n  async get({ hostId, id }) {\n    if (!hostId || !id) return null\n    const snapshot = await submissions(hostId).doc(id).get()\n    return snapshot.exists ? formSubmissionIndexedRecord(snapshot.id, snapshot.data()) : null\n  },\n  async ref({ hostId, id }) {\n    if (!hostId || !id) return null\n    return submissions(hostId).doc(id)\n  },\n}\n"],"names":["firebaseAdmin","formSubmissionIndexedRecord","SUBMISSIONS","submissions","hostId","app","firestore","collection","doc","formSubmissionRecordIndex","list","limit","records","truncated","snapshot","orderBy","get","docs","slice","map","document","id","data","filter","record","size","exists","ref"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAGD,SAASA,aAAa,QAAQ,iDAAgD;AAC9E,SAASC,2BAA2B,QAAQ,qCAAiC;AAE7E,mEAAmE,GACnE,MAAMC,cAAc;AAEpB,MAAMC,cAAc,CAACC,SACnBJ,cAAcK,GAAG,GAAGC,SAAS,GAAGC,UAAU,CAAC,SAASC,GAAG,CAACJ,QAAQG,UAAU,CAACL;AAE7E;;;;;;;CAOC,GACD,OAAO,MAAMO,4BAA+C;IAC1D,MAAMC,MAAK,EAAEN,MAAM,EAAEO,KAAK,EAAE;QAC1B,IAAI,CAACP,UAAUO,QAAQ,GAAG,OAAO;YAAEC,SAAS,EAAE;YAAEC,WAAW;QAAM;QACjE,MAAMC,WAAW,MAAMX,YAAYC,QAAQW,OAAO,CAAC,aAAa,QAAQJ,KAAK,CAACA,QAAQ,GAAGK,GAAG;QAC5F,MAAMJ,UAAUE,SAASG,IAAI,CAC1BC,KAAK,CAAC,GAAGP,OACTQ,GAAG,CAAC,CAACC,WAAanB,4BAA4BmB,SAASC,EAAE,EAAED,SAASE,IAAI,KACxEC,MAAM,CAAC,CAACC,SAAiDA,WAAW;QACvE,OAAO;YAAEZ;YAASC,WAAWC,SAASW,IAAI,GAAGd;QAAM;IACrD;IACA,MAAMK,KAAI,EAAEZ,MAAM,EAAEiB,EAAE,EAAE;QACtB,IAAI,CAACjB,UAAU,CAACiB,IAAI,OAAO;QAC3B,MAAMP,WAAW,MAAMX,YAAYC,QAAQI,GAAG,CAACa,IAAIL,GAAG;QACtD,OAAOF,SAASY,MAAM,GAAGzB,4BAA4Ba,SAASO,EAAE,EAAEP,SAASQ,IAAI,MAAM;IACvF;IACA,MAAMK,KAAI,EAAEvB,MAAM,EAAEiB,EAAE,EAAE;QACtB,IAAI,CAACjB,UAAU,CAACiB,IAAI,OAAO;QAC3B,OAAOlB,YAAYC,QAAQI,GAAG,CAACa;IACjC;AACF,EAAC"}

package/src/lib/server/form-submit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `POST /api/forms/submit` — every form's door, and a Marketing popup's
+ * (AGL-76, AGL-3080).
+ *
+ * This plugin's route, served by the tenant's plugin API dispatcher at the
+ * address it has always had, and registered as a route that KEEPS ITS OWN
+ * VISITOR GATES (`ownVisitorGates`): the dispatcher hands it the request
+ * untouched, because every gate below is a published answer — which plugin's
+ * switch decides a submission (the door it came through, not this route's
+ * owner), the "not accepting" notice a site with Forms off gives, the
+ * per-(site, address) limit and the monthly ceiling, and where lockdown sits
+ * among them. The dispatcher's own versions of those would answer first and
+ * differently.
+ *
+ * Lead-capture submissions endpoint (AGL-76): validates the target host,
+ * drops honeypot hits silently, applies the plan's monthly submission quota
+ * via a per-month counter — a hard wall on free, a meter on plans that carry
+ * the infra pass-through (AGL-1280) — refuses above the per-site abuse
+ * ceiling (AGL-1655), and stores the submission for the console inbox. Writes
+ * go through the admin SDK, so client rules never allow arbitrary submission
+ * writes.
+ *
+ * The two 429s are different answers and must stay distinguishable: the plan
+ * wall means the customer's allowance is spent, the ceiling means the site is
+ * being flooded. Only the ceiling refusal carries `code`.
+ */
+export declare function POST(request: Request): Promise<Response>;