@cogenta/forms 0.2.4

package/dist/csv.js

@@ -0,0 +1,56 @@
+import { isFormFileValue } from './types.js';
+/**
+ * Fiche 47 task 9 — the server-streamed CSV export. Deliberately mirrors
+ * `packages/admin/src/lib/csv.ts` byte for byte rather than importing it (an
+ * admin package is a browser bundle with React in its dependency tree;
+ * `@cogenta/forms` is plain Node/ESM and must stay that way) — including the
+ * CWE-1236 formula-injection guard, which is the one property a
+ * non-regression test (fiche 47 task 9's own requirement) checks survives
+ * the move from "build the whole CSV client-side" to "stream it from the
+ * server". Any change here must be mirrored there, and vice versa.
+ */
+const FORMULA_LEADING_CHARS = new Set(['=', '+', '-', '@']);
+export function csvField(value) {
+    const guarded = FORMULA_LEADING_CHARS.has(value.charAt(0)) ? `'${value}` : value;
+    if (/[",\n\r]/u.test(guarded)) {
+        return `"${guarded.replace(/"/gu, '""')}"`;
+    }
+    return guarded;
+}
+export function toCsvRow(values) {
+    return `${values.map(csvField).join(',')}\r\n`;
+}
+function valueText(value) {
+    if (value === undefined)
+        return '';
+    if (Array.isArray(value))
+        return value.join(', ');
+    if (isFormFileValue(value))
+        return value.filename;
+    return String(value);
+}
+/** The full set of value column names across a page of submissions, in first-seen order — same approach `form-submissions.tsx`'s client-side export already uses. */
+export function csvValueColumns(submissions) {
+    const seen = new Set();
+    for (const submission of submissions) {
+        for (const key of Object.keys(submission.values))
+            seen.add(key);
+    }
+    return [...seen];
+}
+export function csvHeaderRow(valueColumns) {
+    return toCsvRow(['id', 'form', 'status', 'submittedAt', 'referrer', ...valueColumns]);
+}
+export function csvSubmissionRow(submission, valueColumns) {
+    return toCsvRow([
+        submission.id,
+        submission.formName,
+        submission.status,
+        submission.submittedAt,
+        submission.referrer ?? '',
+        ...valueColumns.map((column) => valueText(submission.values[column])),
+    ]);
+}
+/** UTF-8 BOM, so Excel opens accented characters correctly — same reason `admin/src/lib/csv.ts`'s `downloadCsv` prepends one. */
+export const CSV_BOM = '';
+//# sourceMappingURL=csv.js.map

package/dist/csv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.js","sourceRoot":"","sources":["../src/csv.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C;;;;;;;;;GASG;AAEH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;AAE3D,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IAChF,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAA;IAC5C,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAyB;IAChD,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAA;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,KAA6C;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjD,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAA;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED,qKAAqK;AACrK,MAAM,UAAU,eAAe,CAAC,WAAsC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,YAA+B;IAC1D,OAAO,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,UAA0B,EAC1B,YAA+B;IAE/B,OAAO,QAAQ,CAAC;QACd,UAAU,CAAC,EAAE;QACb,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,MAAM;QACjB,UAAU,CAAC,WAAW;QACtB,UAAU,CAAC,QAAQ,IAAI,EAAE;QACzB,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAA2C,CAAC,CAC/E;KACF,CAAC,CAAA;AACJ,CAAC;AAED,iIAAiI;AACjI,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAA"}

package/dist/file-field.d.ts

@@ -0,0 +1,64 @@
+import { type FormFieldDefinition, type FormFileCategory, type FormFileValue } from './types.js';
+/**
+ * Fiche 47 task 3 — the `file` field's byte-level defence. Reuses the same
+ * discipline as the media pipeline's `verifyRealType` (`@cogenta/api`'s
+ * `media-router.ts`, L10 task 5): the category is read from the bytes,
+ * *never* from a filename or a declared `Content-Type` — both are
+ * attacker-controlled, and this route is reached by an anonymous visitor
+ * (fiche 47's own framing: "traite ça comme une vraie surface d'attaque").
+ *
+ * `sniffImageFormat` itself is imported straight from `@cogenta/core`
+ * (already a direct dependency) rather than duplicated; the three other
+ * categories are small, zero-dependency signature checks in the same spirit
+ * as `@cogenta/core`'s own `format-sniff.ts`.
+ */
+/** A hard ceiling regardless of what a form's own `maxSizeBytes` (or this default) says — an operator cannot accidentally turn an anonymous upload route into an unbounded disk sink. */
+export declare const FORM_FILE_HARD_MAX_BYTES: number;
+export declare const DEFAULT_FORM_FILE_MAX_BYTES: number;
+/** The category these bytes actually are, or `null` when nothing this route accepts recognises them. */
+export declare function sniffFormFileCategory(bytes: Uint8Array): FormFileCategory | null;
+/** The content type this category's bytes earn — never the uploader's declared `Content-Type`, same reasoning as `verifyRealType` in `media-router.ts`. */
+export declare function contentTypeForCategory(category: FormFileCategory): string;
+/**
+ * Throws `FORM_FILE_REJECTED` when `bytes` do not belong to a category this
+ * field accepts, or exceed the size ceiling. Returns the sniffed category on
+ * success — the caller (the router, which alone holds a `StorageDriver`)
+ * still has to actually store the bytes.
+ */
+export declare function assertAllowedFormFile(field: FormFieldDefinition, bytes: Uint8Array): FormFileCategory;
+/**
+ * Which field a signed token is good for — a second security-review pass on
+ * this exact scheme found that without this, a token legitimately issued
+ * for a real upload on one field (say, an `image`-only "photo" field) could
+ * be replayed as the value of an *unrelated* `file` field on the same or a
+ * different form (say, a `pdf`-only "attachment" field): the signature was
+ * valid, so `resolveFileFields` accepted it without re-checking that
+ * field's own `acceptCategories`. Binding the signature to `formId` and
+ * `fieldName` (mixed into what is hashed, not just embedded in the JSON
+ * payload a client could otherwise edit) makes a token useless anywhere
+ * but the exact field it was issued for.
+ */
+export interface FormFileTokenContext {
+    readonly formId: string;
+    readonly fieldName: string;
+}
+/**
+ * A `FormFileValue` carried forward across a multi-step form's pages
+ * (`_accumulated`) is client-supplied text like everything else in that
+ * blob — a security review of this exact file field found that trusting its
+ * *shape* alone (`isFormFileValue`) let an anonymous visitor hand-craft one,
+ * claiming any `storageKey` exists, without ever uploading a real byte.
+ * Signing with the site's own derived secret (never a value stored
+ * anywhere else, never re-derivable by a client — `@cogenta/cli`'s
+ * `serve.ts` derives it from `COGENTA_AUTH_SIGNING_KEY`, the same "derived,
+ * never a second secret" discipline `commentsIpHashSecret` already
+ * follows) is what turns "a client can carry this forward" into "a client
+ * cannot forge or edit this": the router's own `resolveFileFields` never
+ * accepts a raw carried-forward object again, only a token this function
+ * itself produced. See `FormFileTokenContext`'s own doc for why the token
+ * is additionally scoped to the exact form and field it was issued for.
+ */
+export declare function signFormFileToken(secret: string, context: FormFileTokenContext, value: FormFileValue): string;
+/** `null` for a missing/malformed/mis-signed/wrong-field token — the caller treats that exactly like the field being absent, never like a shape error worth a different message (nothing about *why* a forged token failed should be observable). */
+export declare function verifyFormFileToken(secret: string, context: FormFileTokenContext, token: string): FormFileValue | null;
+//# sourceMappingURL=file-field.d.ts.map

package/dist/file-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-field.d.ts","sourceRoot":"","sources":["../src/file-field.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;GAYG;AAEH,yLAAyL;AACzL,eAAO,MAAM,wBAAwB,QAAmB,CAAA;AACxD,eAAO,MAAM,2BAA2B,QAAmB,CAAA;AAiD3D,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,GAAG,IAAI,CAMhF;AASD,2JAA2J;AAC3J,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAEzE;AAWD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,mBAAmB,EAC1B,KAAK,EAAE,UAAU,GAChB,gBAAgB,CA6BlB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,aAAa,GACnB,MAAM,CAMR;AAED,qPAAqP;AACrP,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,GACZ,aAAa,GAAG,IAAI,CAmBtB"}

package/dist/file-field.js

@@ -0,0 +1,169 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { CogentaError, describeContainer, sniffImageFormat } from '@cogenta/core';
+import { FORM_FILE_CATEGORIES, isFormFileValue, } from './types.js';
+/**
+ * Fiche 47 task 3 — the `file` field's byte-level defence. Reuses the same
+ * discipline as the media pipeline's `verifyRealType` (`@cogenta/api`'s
+ * `media-router.ts`, L10 task 5): the category is read from the bytes,
+ * *never* from a filename or a declared `Content-Type` — both are
+ * attacker-controlled, and this route is reached by an anonymous visitor
+ * (fiche 47's own framing: "traite ça comme une vraie surface d'attaque").
+ *
+ * `sniffImageFormat` itself is imported straight from `@cogenta/core`
+ * (already a direct dependency) rather than duplicated; the three other
+ * categories are small, zero-dependency signature checks in the same spirit
+ * as `@cogenta/core`'s own `format-sniff.ts`.
+ */
+/** A hard ceiling regardless of what a form's own `maxSizeBytes` (or this default) says — an operator cannot accidentally turn an anonymous upload route into an unbounded disk sink. */
+export const FORM_FILE_HARD_MAX_BYTES = 25 * 1024 * 1024;
+export const DEFAULT_FORM_FILE_MAX_BYTES = 10 * 1024 * 1024;
+const PDF_SIGNATURE = [0x25, 0x50, 0x44, 0x46]; // "%PDF"
+// A ZIP local-file-header — what a .docx/.xlsx/.pptx/.odt *is*: an office
+// document is never distinguished further than "a ZIP archive with the
+// shape Office/OpenDocument containers share" — enough to refuse a renamed
+// executable without pretending to fully parse the container.
+const ZIP_SIGNATURES = [
+    [0x50, 0x4b, 0x03, 0x04],
+    [0x50, 0x4b, 0x05, 0x06],
+    [0x50, 0x4b, 0x07, 0x08],
+];
+function startsWithBytes(bytes, signature) {
+    if (bytes.length < signature.length)
+        return false;
+    return signature.every((byte, index) => bytes[index] === byte);
+}
+/**
+ * A conservative "this looks like text a human wrote" heuristic: no NUL byte
+ * (binary formats almost always have one in their first kilobyte) and at
+ * least 95% of the sampled bytes are printable ASCII, a tab, or part of a
+ * line ending. Not a real encoding detector — it does not need to be one, it
+ * only needs to keep out disguised binaries, and a `text`-category field is
+ * never executed or served as anything but a downloadable attachment.
+ */
+function looksLikePlainText(bytes) {
+    if (bytes.length === 0)
+        return false;
+    const sample = bytes.subarray(0, Math.min(bytes.length, 4096));
+    let printable = 0;
+    for (const byte of sample) {
+        if (byte === 0x00)
+            return false;
+        if (byte === 0x09 || byte === 0x0a || byte === 0x0d) {
+            printable += 1;
+            continue;
+        }
+        if (byte >= 0x20 && byte <= 0x7e) {
+            printable += 1;
+            continue;
+        }
+        // Allow UTF-8 continuation/lead bytes (accented text, BOM) without
+        // counting them against the printable ratio — but do not count them
+        // *for* it either, since a genuinely binary file can also contain runs
+        // of high bytes.
+        if (byte >= 0xc0)
+            continue;
+    }
+    return printable / sample.length >= 0.95;
+}
+/** The category these bytes actually are, or `null` when nothing this route accepts recognises them. */
+export function sniffFormFileCategory(bytes) {
+    if (sniffImageFormat(bytes) !== null)
+        return 'image';
+    if (startsWithBytes(bytes, PDF_SIGNATURE))
+        return 'pdf';
+    if (ZIP_SIGNATURES.some((signature) => startsWithBytes(bytes, signature)))
+        return 'document';
+    if (looksLikePlainText(bytes))
+        return 'text';
+    return null;
+}
+const CONTENT_TYPE_BY_CATEGORY = {
+    image: 'application/octet-stream', // refined by `sniffImageFormat`'s own format when the caller wants it; a form attachment is never inlined as `<img>`, so the generic type is enough here.
+    pdf: 'application/pdf',
+    document: 'application/octet-stream',
+    text: 'text/plain; charset=utf-8',
+};
+/** The content type this category's bytes earn — never the uploader's declared `Content-Type`, same reasoning as `verifyRealType` in `media-router.ts`. */
+export function contentTypeForCategory(category) {
+    return CONTENT_TYPE_BY_CATEGORY[category];
+}
+function rejected(field, reason) {
+    return new CogentaError({
+        code: 'FORM_FILE_REJECTED',
+        message: reason,
+        hint: 'Upload a file whose real content matches one of the types this field accepts.',
+        details: { field: field.name },
+    });
+}
+/**
+ * Throws `FORM_FILE_REJECTED` when `bytes` do not belong to a category this
+ * field accepts, or exceed the size ceiling. Returns the sniffed category on
+ * success — the caller (the router, which alone holds a `StorageDriver`)
+ * still has to actually store the bytes.
+ */
+export function assertAllowedFormFile(field, bytes) {
+    const maxBytes = Math.min(field.maxSizeBytes ?? DEFAULT_FORM_FILE_MAX_BYTES, FORM_FILE_HARD_MAX_BYTES);
+    if (bytes.length === 0)
+        throw rejected(field, `"${field.name}" needs a real file, not an empty one.`);
+    if (bytes.length > maxBytes) {
+        throw rejected(field, `"${field.name}" is larger than the ${Math.floor(maxBytes / (1024 * 1024))}MB this form accepts.`);
+    }
+    const category = sniffFormFileCategory(bytes);
+    const accepted = field.acceptCategories ?? FORM_FILE_CATEGORIES;
+    if (category === null) {
+        throw rejected(field, `"${field.name}" was sent as ${describeContainer(bytes)}, which is not a supported file type (accepted: ${accepted.join(', ')}).`);
+    }
+    if (!accepted.includes(category)) {
+        throw rejected(field, `"${field.name}" was sent as a ${category} file, which this field does not accept (accepted: ${accepted.join(', ')}).`);
+    }
+    return category;
+}
+function scopedPayload(context, payload) {
+    return `${context.formId}:${context.fieldName}:${payload}`;
+}
+/**
+ * A `FormFileValue` carried forward across a multi-step form's pages
+ * (`_accumulated`) is client-supplied text like everything else in that
+ * blob — a security review of this exact file field found that trusting its
+ * *shape* alone (`isFormFileValue`) let an anonymous visitor hand-craft one,
+ * claiming any `storageKey` exists, without ever uploading a real byte.
+ * Signing with the site's own derived secret (never a value stored
+ * anywhere else, never re-derivable by a client — `@cogenta/cli`'s
+ * `serve.ts` derives it from `COGENTA_AUTH_SIGNING_KEY`, the same "derived,
+ * never a second secret" discipline `commentsIpHashSecret` already
+ * follows) is what turns "a client can carry this forward" into "a client
+ * cannot forge or edit this": the router's own `resolveFileFields` never
+ * accepts a raw carried-forward object again, only a token this function
+ * itself produced. See `FormFileTokenContext`'s own doc for why the token
+ * is additionally scoped to the exact form and field it was issued for.
+ */
+export function signFormFileToken(secret, context, value) {
+    const payload = Buffer.from(JSON.stringify(value), 'utf8').toString('base64url');
+    const signature = createHmac('sha256', secret)
+        .update(scopedPayload(context, payload))
+        .digest('base64url');
+    return `${payload}.${signature}`;
+}
+/** `null` for a missing/malformed/mis-signed/wrong-field token — the caller treats that exactly like the field being absent, never like a shape error worth a different message (nothing about *why* a forged token failed should be observable). */
+export function verifyFormFileToken(secret, context, token) {
+    const separator = token.lastIndexOf('.');
+    if (separator === -1)
+        return null;
+    const payload = token.slice(0, separator);
+    const signature = token.slice(separator + 1);
+    const expected = createHmac('sha256', secret)
+        .update(scopedPayload(context, payload))
+        .digest('base64url');
+    const provided = Buffer.from(signature, 'utf8');
+    const wanted = Buffer.from(expected, 'utf8');
+    if (provided.length !== wanted.length || !timingSafeEqual(provided, wanted))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+        return isFormFileValue(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=file-field.js.map

package/dist/file-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-field.js","sourceRoot":"","sources":["../src/file-field.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AACjF,OAAO,EACL,oBAAoB,EAIpB,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;GAYG;AAEH,yLAAyL;AACzL,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAE3D,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA,CAAC,SAAS;AACxD,0EAA0E;AAC1E,uEAAuE;AACvE,2EAA2E;AAC3E,8DAA8D;AAC9D,MAAM,cAAc,GAAmC;IACrD,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACxB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACxB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;CACzB,CAAA;AAED,SAAS,eAAe,CAAC,KAAiB,EAAE,SAA4B;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACjD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAC9D,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACpD,SAAS,IAAI,CAAC,CAAA;YACd,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjC,SAAS,IAAI,CAAC,CAAA;YACd,SAAQ;QACV,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,iBAAiB;QACjB,IAAI,IAAI,IAAI,IAAI;YAAE,SAAQ;IAC5B,CAAC;IACD,OAAO,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,OAAO,CAAA;IACpD,IAAI,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IACvD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,UAAU,CAAA;IAC5F,IAAI,kBAAkB,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAC5C,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,wBAAwB,GAA+C;IAC3E,KAAK,EAAE,0BAA0B,EAAE,0JAA0J;IAC7L,GAAG,EAAE,iBAAiB;IACtB,QAAQ,EAAE,0BAA0B;IACpC,IAAI,EAAE,2BAA2B;CAClC,CAAA;AAED,2JAA2J;AAC3J,MAAM,UAAU,sBAAsB,CAAC,QAA0B;IAC/D,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,QAAQ,CAAC,KAA0B,EAAE,MAAc;IAC1D,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,+EAA+E;QACrF,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;KAC/B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA0B,EAC1B,KAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,KAAK,CAAC,YAAY,IAAI,2BAA2B,EACjD,wBAAwB,CACzB,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACpB,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,wCAAwC,CAAC,CAAA;IAC/E,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,QAAQ,CACZ,KAAK,EACL,IAAI,KAAK,CAAC,IAAI,wBAAwB,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,uBAAuB,CAClG,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,IAAI,oBAAoB,CAAA;IAC/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,CACZ,KAAK,EACL,IAAI,KAAK,CAAC,IAAI,iBAAiB,iBAAiB,CAAC,KAAK,CAAC,mDAAmD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAClI,CAAA;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,CACZ,KAAK,EACL,IAAI,KAAK,CAAC,IAAI,mBAAmB,QAAQ,sDAAsD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvH,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAmBD,SAAS,aAAa,CAAC,OAA6B,EAAE,OAAe;IACnE,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,EAAE,CAAA;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,OAA6B,EAC7B,KAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC3C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACvC,MAAM,CAAC,WAAW,CAAC,CAAA;IACtB,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,qPAAqP;AACrP,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,OAA6B,EAC7B,KAAa;IAEb,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAE5C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC1C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;SACvC,MAAM,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAExF,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACtF,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+export { checkFillDelay, checkHoneypot, checkSubmitRateLimit, HONEYPOT_FIELD, TIMESTAMP_FIELD, } from './anti-abuse.js';
+export type { CaptchaFetch, VerifyCaptchaOptions } from './captcha.js';
+export { verifyCaptcha } from './captcha.js';
+export { evaluateCondition, isFieldVisible } from './conditions.js';
+export { CSV_BOM, csvField, csvHeaderRow, csvSubmissionRow, csvValueColumns, toCsvRow, } from './csv.js';
+export type { FormFileTokenContext } from './file-field.js';
+export { assertAllowedFormFile, contentTypeForCategory, DEFAULT_FORM_FILE_MAX_BYTES, FORM_FILE_HARD_MAX_BYTES, signFormFileToken, sniffFormFileCategory, verifyFormFileToken, } from './file-field.js';
+export { hashIp } from './ip.js';
+export type { NotifyChannelsOptions, NotifyNewSubmissionOptions, SendAutoresponderOptions, } from './notify.js';
+export { buildSubmissionAlert, notifyChannels, notifyNewSubmission, sendAutoresponder, } from './notify.js';
+export type { FormDefinitionStore, FormStore, FormSubmissionStore, ListSubmissionsOptions, ListSubmissionsResult, PurgeReport, SubmitOptions, } from './store.js';
+export { createFormStore } from './store.js';
+export { ensureFormsTables, TABLES as FORMS_TABLES } from './tables.js';
+export type { AutoresponderConfig, CreateFormDefinitionInput, FormCaptchaConfig, FormConditionOperator, FormDefinition, FormFieldCondition, FormFieldDefinition, FormFieldKind, FormFileCategory, FormFileValue, FormNotifyChannel, FormStepDefinition, FormSubmission, FormSubmissionNote, FormSubmissionStatus, RecordedConsent, UpdateFormDefinitionInput, } from './types.js';
+export { emailValueOf, FORM_CONDITION_OPERATORS, FORM_FIELD_KINDS, FORM_FILE_CATEGORIES, isFormFileValue, } from './types.js';
+export type { ValidatedSubmission } from './validate.js';
+export { validateCaptchaConfig, validateDefinitionFields, validateFormSteps, validateNotifyChannels, validateSubmission, } from './validate.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,QAAQ,GACT,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAA;AACvE,YAAY,EACV,mBAAmB,EACnB,yBAAyB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAA;AACnB,YAAY,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,12 @@
+export { checkFillDelay, checkHoneypot, checkSubmitRateLimit, HONEYPOT_FIELD, TIMESTAMP_FIELD, } from './anti-abuse.js';
+export { verifyCaptcha } from './captcha.js';
+export { evaluateCondition, isFieldVisible } from './conditions.js';
+export { CSV_BOM, csvField, csvHeaderRow, csvSubmissionRow, csvValueColumns, toCsvRow, } from './csv.js';
+export { assertAllowedFormFile, contentTypeForCategory, DEFAULT_FORM_FILE_MAX_BYTES, FORM_FILE_HARD_MAX_BYTES, signFormFileToken, sniffFormFileCategory, verifyFormFileToken, } from './file-field.js';
+export { hashIp } from './ip.js';
+export { buildSubmissionAlert, notifyChannels, notifyNewSubmission, sendAutoresponder, } from './notify.js';
+export { createFormStore } from './store.js';
+export { ensureFormsTables, TABLES as FORMS_TABLES } from './tables.js';
+export { emailValueOf, FORM_CONDITION_OPERATORS, FORM_FIELD_KINDS, FORM_FILE_CATEGORIES, isFormFileValue, } from './types.js';
+export { validateCaptchaConfig, validateDefinitionFields, validateFormSteps, validateNotifyChannels, validateSubmission, } from './validate.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACnE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,QAAQ,GACT,MAAM,UAAU,CAAA;AAEjB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAMhC,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAA;AAUpB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAA;AAoBvE,OAAO,EACL,YAAY,EACZ,wBAAwB,EACxB,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAA"}

package/dist/ip.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `sha256(ip)`, hex-encoded — never the address itself (fiche 16 acceptance
+ * criterion: "Aucune adresse IP en clair"). Unlike `@cogenta/analytics`'s
+ * daily-salted hash (built for cross-day-unlinkable visitor counting), a
+ * submission's IP hash has a different job: letting an operator spot "the
+ * same source hammering this form" *within* the anti-abuse window, and the
+ * rate limiter's own key needs a stable value across the window to work at
+ * all. A per-day salt would defeat that. It is still one-way, and still never
+ * the address in the clear.
+ */
+export declare function hashIp(ip: string): string;
+//# sourceMappingURL=ip.d.ts.map

package/dist/ip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip.d.ts","sourceRoot":"","sources":["../src/ip.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzC"}

package/dist/ip.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+/**
+ * `sha256(ip)`, hex-encoded — never the address itself (fiche 16 acceptance
+ * criterion: "Aucune adresse IP en clair"). Unlike `@cogenta/analytics`'s
+ * daily-salted hash (built for cross-day-unlinkable visitor counting), a
+ * submission's IP hash has a different job: letting an operator spot "the
+ * same source hammering this form" *within* the anti-abuse window, and the
+ * rate limiter's own key needs a stable value across the window to work at
+ * all. A per-day salt would defeat that. It is still one-way, and still never
+ * the address in the clear.
+ */
+export function hashIp(ip) {
+    return createHash('sha256').update(ip, 'utf8').digest('hex');
+}
+//# sourceMappingURL=ip.js.map

package/dist/ip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip.js","sourceRoot":"","sources":["../src/ip.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CAAC,EAAU;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC"}

package/dist/notify.d.ts

@@ -0,0 +1,52 @@
+import { type AlertChannelMessage, type ChannelRegistry, type EmailTransport } from '@cogenta/channels';
+import { type RateLimitDriver } from '@cogenta/core';
+import type { FormDefinition, FormNotifyChannel, FormSubmission } from './types.js';
+export declare function buildSubmissionAlert(definition: FormDefinition, submission: FormSubmission, adminUrl: string): AlertChannelMessage;
+export interface NotifyNewSubmissionOptions {
+    readonly transport: EmailTransport;
+    readonly definition: FormDefinition;
+    readonly submission: FormSubmission;
+    readonly adminUrl: string;
+}
+/** Sends the "new submission" e-mail to every configured recipient. Never throws on a single bad address — logs are the caller's job, this returns what happened. */
+export declare function notifyNewSubmission(options: NotifyNewSubmissionOptions): Promise<{
+    readonly sent: readonly string[];
+    readonly failed: readonly string[];
+}>;
+export interface NotifyChannelsOptions {
+    readonly registry: ChannelRegistry;
+    readonly definition: FormDefinition;
+    readonly submission: FormSubmission;
+    readonly adminUrl: string;
+}
+/**
+ * Fiche 47 task 4 — the multi-channel half of a submission notification,
+ * built the same way `notifyNewSubmission` builds the e-mail one: reusing
+ * `buildSubmissionAlert` (never a second message shape) and the adapters
+ * `@cogenta/channels` already has, never a new transport of this package's
+ * own (R1/R9). A channel this form names but the site never configured (no
+ * live adapter of that name in the registry), or a channel whose `send`
+ * itself fails, is recorded as `failed` and every other configured channel
+ * still gets tried — the same "never throws on one bad recipient" contract
+ * `notifyNewSubmission` already holds for e-mail addresses.
+ */
+export declare function notifyChannels(options: NotifyChannelsOptions): Promise<{
+    readonly sent: readonly FormNotifyChannel[];
+    readonly failed: readonly FormNotifyChannel[];
+}>;
+/**
+ * The autoresponder — disabled by default, and rate-limited **per recipient
+ * address** on top of the generic per-IP submission limiter, because the
+ * address here was supplied by an anonymous visitor: without a hard cap this
+ * is a script that makes the site's domain send mail to any inbox it likes,
+ * on demand (fiche 16 § pièges: "l'accusé de réception est un relais de
+ * spam potentiel").
+ */
+export interface SendAutoresponderOptions {
+    readonly transport: EmailTransport;
+    readonly definition: FormDefinition;
+    readonly recipientEmail: string;
+    readonly rateLimit: RateLimitDriver;
+}
+export declare function sendAutoresponder(options: SendAutoresponderOptions): Promise<void>;
+//# sourceMappingURL=notify.d.ts.map

package/dist/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../src/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAyBnF,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,cAAc,EAC1B,QAAQ,EAAE,MAAM,GACf,mBAAmB,CAarB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,qKAAqK;AACrK,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAiBnF;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC3C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAC9C,CAAC,CAoBD;AAKD;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAA;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CACpC;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBxF"}

package/dist/notify.js

@@ -0,0 +1,113 @@
+import { createEmailAdapter, } from '@cogenta/channels';
+import { CogentaError } from '@cogenta/core';
+/**
+ * Notifications for a new submission — "réutiliser l'adaptateur e-mail
+ * existant de `@cogenta/channels`, jamais un second transport" (ADR-0026).
+ *
+ * The message goes through the same `AlertChannelMessage` shape and
+ * `createEmailAdapter` every other alert in this codebase already renders
+ * through (fiche 16 task 5: "réutiliser les formats de message de
+ * `@cogenta/channels`... plutôt qu'en inventant un message") — this file
+ * never writes its own subject/body HTML, it only describes *what happened*
+ * and lets the adapter decide how that becomes an e-mail.
+ */
+function fieldSummary(definition, submission) {
+    const lines = definition.fields
+        .filter((field) => field.kind !== 'consent')
+        .map((field) => {
+        const value = submission.values[field.name];
+        const text = Array.isArray(value) ? value.join(', ') : (value ?? '');
+        return `${field.label}: ${text === '' ? '(empty)' : text}`;
+    });
+    return lines.join('\n');
+}
+export function buildSubmissionAlert(definition, submission, adminUrl) {
+    return {
+        level: 'alert',
+        title: `New submission — ${definition.label}`,
+        severity: 'info',
+        // The submission's own field values, verbatim — this is external content
+        // (R8), but the destination here is a rendered e-mail read by a human,
+        // never an agent's prompt, so a plain, clearly-labelled dump is the
+        // right shape rather than a structured `data` channel meant for a model.
+        context: fieldSummary(definition, submission),
+        expectedAction: 'Review the submission in the admin.',
+        adminUrl,
+    };
+}
+/** Sends the "new submission" e-mail to every configured recipient. Never throws on a single bad address — logs are the caller's job, this returns what happened. */
+export async function notifyNewSubmission(options) {
+    if (options.definition.notifyEmails.length === 0)
+        return { sent: [], failed: [] };
+    const adapter = createEmailAdapter({ transport: options.transport });
+    const message = buildSubmissionAlert(options.definition, options.submission, options.adminUrl);
+    const sent = [];
+    const failed = [];
+    for (const email of options.definition.notifyEmails) {
+        try {
+            await adapter.send({ id: email }, message);
+            sent.push(email);
+        }
+        catch {
+            failed.push(email);
+        }
+    }
+    return { sent, failed };
+}
+/**
+ * Fiche 47 task 4 — the multi-channel half of a submission notification,
+ * built the same way `notifyNewSubmission` builds the e-mail one: reusing
+ * `buildSubmissionAlert` (never a second message shape) and the adapters
+ * `@cogenta/channels` already has, never a new transport of this package's
+ * own (R1/R9). A channel this form names but the site never configured (no
+ * live adapter of that name in the registry), or a channel whose `send`
+ * itself fails, is recorded as `failed` and every other configured channel
+ * still gets tried — the same "never throws on one bad recipient" contract
+ * `notifyNewSubmission` already holds for e-mail addresses.
+ */
+export async function notifyChannels(options) {
+    if (options.definition.notifyChannels.length === 0)
+        return { sent: [], failed: [] };
+    const message = buildSubmissionAlert(options.definition, options.submission, options.adminUrl);
+    const sent = [];
+    const failed = [];
+    for (const entry of options.definition.notifyChannels) {
+        if (!options.registry.has(entry.channel)) {
+            failed.push(entry);
+            continue;
+        }
+        try {
+            await options.registry.get(entry.channel).send({ id: entry.target }, message);
+            sent.push(entry);
+        }
+        catch {
+            failed.push(entry);
+        }
+    }
+    return { sent, failed };
+}
+const AUTORESPONDER_WINDOW_MS = 60 * 60 * 1000;
+const AUTORESPONDER_LIMIT_PER_WINDOW = 1;
+export async function sendAutoresponder(options) {
+    const { definition } = options;
+    if (!definition.autoresponder.enabled)
+        return;
+    const key = `forms:autoresponder:${definition.id}:${options.recipientEmail.toLowerCase()}`;
+    const result = await options.rateLimit.consume(key, {
+        limit: AUTORESPONDER_LIMIT_PER_WINDOW,
+        windowMs: AUTORESPONDER_WINDOW_MS,
+    });
+    if (!result.allowed) {
+        throw new CogentaError({
+            code: 'FORM_AUTORESPONDER_RATE_LIMITED',
+            message: `An autoresponder was already sent to this address for "${definition.name}" recently.`,
+            hint: 'This is a deliberate cap — it exists to stop this form from being used to relay mail to an arbitrary inbox.',
+        });
+    }
+    const adapter = createEmailAdapter({ transport: options.transport });
+    await adapter.send({ id: options.recipientEmail }, {
+        level: 'notification',
+        text: options.definition.autoresponder.body ?? 'Thank you — we received your message.',
+    });
+}
+//# sourceMappingURL=notify.js.map

package/dist/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../src/notify.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,kBAAkB,GAEnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,YAAY,EAAwB,MAAM,eAAe,CAAA;AAGlE;;;;;;;;;;GAUG;AAEH,SAAS,YAAY,CAAC,UAA0B,EAAE,UAA0B;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;SAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACpE,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5D,CAAC,CAAC,CAAA;IACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,UAA0B,EAC1B,UAA0B,EAC1B,QAAgB;IAEhB,OAAO;QACL,KAAK,EAAE,OAAO;QACd,KAAK,EAAE,oBAAoB,UAAU,CAAC,KAAK,EAAE;QAC7C,QAAQ,EAAE,MAAM;QAChB,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,yEAAyE;QACzE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC;QAC7C,cAAc,EAAE,qCAAqC;QACrD,QAAQ;KACT,CAAA;AACH,CAAC;AASD,qKAAqK;AACrK,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAmC;IAEnC,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAEjF,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAE9F,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAA;YAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA8B;IAIjE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAEnF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAwB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAwB,EAAE,CAAA;IAEtC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAA;YAC7E,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC9C,MAAM,8BAA8B,GAAG,CAAC,CAAA;AAiBxC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAiC;IACvE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAA;IAC9B,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO;QAAE,OAAM;IAE7C,MAAM,GAAG,GAAG,uBAAuB,UAAU,CAAC,EAAE,IAAI,OAAO,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,CAAA;IAC1F,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;QAClD,KAAK,EAAE,8BAA8B;QACrC,QAAQ,EAAE,uBAAuB;KAClC,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,0DAA0D,UAAU,CAAC,IAAI,aAAa;YAC/F,IAAI,EAAE,6GAA6G;SACpH,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,MAAM,OAAO,CAAC,IAAI,CAChB,EAAE,EAAE,EAAE,OAAO,CAAC,cAAc,EAAE,EAC9B;QACE,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,IAAI,uCAAuC;KACvF,CACF,CAAA;AACH,CAAC"}

package/dist/rows.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Reading rows back out of three databases that disagree about them — the
+ * same trouble `@cogenta/commerce`'s `rows.ts` documents, restated here
+ * because this package owns its own tables and does not depend on commerce.
+ */
+export declare function toText(value: unknown, what: string): string;
+export declare function toNullableText(value: unknown): string | null;
+export declare function toInt(value: unknown, what: string): number;
+export declare function toBool(value: unknown): boolean;
+/** Postgres wants a real boolean; MySQL/SQLite want 0/1. */
+export declare function fromBool(value: boolean, dialect: string): boolean | number;
+export declare function toJson<T>(value: unknown, what: string): T;
+//# sourceMappingURL=rows.d.ts.map

package/dist/rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../src/rows.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAS3D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI5D;AAED,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAa1D;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM9C;AAED,4DAA4D;AAC5D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAE1E;AAED,wBAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,CAYzD"}