@elytracms/forms 0.0.96 → 0.0.98

package/dist/next/submit.d.ts

@@ -3,7 +3,9 @@
  * asks the receiver for ONE short-lived storage URL, the bytes go straight to it), then one
  * `submission` that claims the stored files. The ONE flow, with injected transports, so the
  * browser (`submitForm`) and the site's no-JS form-post route (`createFormPostRoute`) send
- * exactly the same calls.
+ * exactly the same calls — and EC-685: hash every file in the same place, so each `upload`
+ * declares its bytes' SHA-256 (the claim binds a stored file only when its digest is the
+ * declared one).
  */
 /** A posted value: text, or a file (a `File` / `Blob` with a name). */
 type PostedValue = string | Blob;
@@ -55,6 +57,11 @@ export interface SubmitTransport {
  * Send one form post to form `target` (its key — see `defineFormSource`'s `key`): each file
  * uploaded first, then the submission claiming them. The first failure ends it and is
  * returned with its stage and status; nothing is retried here.
+ *
+ * EC-685: every file's SHA-256 is computed FIRST, here — the one hashing site of both flows —
+ * and declared with its `upload`. A browser computes it only on a secure page (WebCrypto,
+ * https or localhost); elsewhere the post is refused before anything is sent (stage `upload`,
+ * status 400, the reason in `error`), never sent without the digest.
  */
 export declare function sendFormSubmission(input: {
     target: string;

package/dist/next/submit.js

@@ -1,3 +1,4 @@
+import { ingestUploadSha256 } from '@elytracms/core/ingest';
 import { DEFAULT_HONEYPOT_FIELD, FORMS_HONEYPOT_KEY, FORMS_RESERVED_PREFIX, FORMS_SOURCE_KEY, FORMS_TARGET_FIELD, formFieldNameMessage, formFieldNameProblem, } from '../shared/submission.js';
 function isFile(value) {
     return typeof value !== 'string';
@@ -61,6 +62,11 @@ function failure(stage, status, body, fallback) {
  * Send one form post to form `target` (its key — see `defineFormSource`'s `key`): each file
  * uploaded first, then the submission claiming them. The first failure ends it and is
  * returned with its stage and status; nothing is retried here.
+ *
+ * EC-685: every file's SHA-256 is computed FIRST, here — the one hashing site of both flows —
+ * and declared with its `upload`. A browser computes it only on a secure page (WebCrypto,
+ * https or localhost); elsewhere the post is refused before anything is sent (stage `upload`,
+ * status 400, the reason in `error`), never sent without the digest.
  */
 export async function sendFormSubmission(input) {
     const { target, payload, transport } = input;
@@ -76,11 +82,19 @@ export async function sendFormSubmission(input) {
     if (issues.length > 0) {
         return { ok: false, stage: 'submission', status: 400, error: issues.map((issue) => issue.message).join(' '), issues };
     }
+    const digests = [];
+    for (const { file } of payload.files) {
+        const digest = await ingestUploadSha256(file);
+        if (!digest.ok)
+            return { ok: false, stage: 'upload', status: 400, error: digest.message };
+        digests.push(digest.sha256);
+    }
     const uploads = [];
-    for (const { field, file } of payload.files) {
+    for (const [index, { field, file }] of payload.files.entries()) {
         // The type the browser reports; an unknown one is declared as an opaque binary.
         const contentType = file.type || 'application/octet-stream';
-        const issued = await transport.ingest({ kind: 'upload', target, field, contentType, size: file.size });
+        const sha256 = digests[index];
+        const issued = await transport.ingest({ kind: 'upload', target, field, contentType, size: file.size, sha256 });
         const issuedBody = await readJson(issued);
         if (!issued.ok)
             return failure('upload', issued.status, issuedBody, 'The upload was refused.');

package/dist/next/submit.js.map

@@ -1 +1 @@
-{"version":3,"file":"submit.js","sourceRoot":"","sources":["../../src/next/submit.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AA0B7B,SAAS,MAAM,CAAC,KAAkB;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAA;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAwC,EAAE,UAA8B,EAAE;IACpG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAA;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC1C,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,kBAAkB;YAAE,SAAQ;QACzC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,aAAa,GAAG,KAAK,CAAA;YACpD,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAQ;YAC9B,MAAM,QAAQ,GAAI,KAAkC,CAAC,IAAI,IAAI,MAAM,CAAA;YACnE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YACxD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;YACzD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,GAAwB,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAA;IACjE,IAAI,CAAC,kBAAkB,CAAC,GAAG,aAAa,CAAA;IACxC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAsBD,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;QACjD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA0C,EAAE,MAAc,EAAE,IAA6B,EAAE,QAAgB;IAC1H,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK;QACL,MAAM;QACN,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ;QACnE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAqD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzH,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA2E;IAClH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAC5C,4FAA4F;IAC5F,4FAA4F;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,EAAE,CAAA;QACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvH,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACvH,CAAC;IACD,MAAM,OAAO,GAA8C,EAAE,CAAA;IAC7D,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5C,gFAAgF;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAA;QAC3D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAA;QAC9F,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAA;QACzG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,MAAM;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,6BAA6B,CAAC,CAAA;IAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAS1B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAA;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClG,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAqC,EAAE;QACjF,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAA;IAChD,OAAO,kBAAkB,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO;QACP,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACtH,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CACtC,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACjG;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import {\n  DEFAULT_HONEYPOT_FIELD,\n  FORMS_HONEYPOT_KEY,\n  FORMS_RESERVED_PREFIX,\n  FORMS_SOURCE_KEY,\n  FORMS_TARGET_FIELD,\n  formFieldNameMessage,\n  formFieldNameProblem,\n} from '../shared/submission'\n\n/**\n * EC-613 — a form post as the ingest seam's calls (EC-617): one `upload` per file (the route\n * asks the receiver for ONE short-lived storage URL, the bytes go straight to it), then one\n * `submission` that claims the stored files. The ONE flow, with injected transports, so the\n * browser (`submitForm`) and the site's no-JS form-post route (`createFormPostRoute`) send\n * exactly the same calls.\n */\n\n/** A posted value: text, or a file (a `File` / `Blob` with a name). */\ntype PostedValue = string | Blob\n\n/** The form's fields as the ingest payload carries them, and the files to upload. */\nexport interface FormPayload {\n  data: Record<string, string | string[]>\n  files: { field: string; file: Blob; name: string }[]\n}\n\nexport interface FormPayloadOptions {\n  /** The honeypot field the form renders (default `website`); its value goes to `elytra:honeypot`. */\n  honeypot?: string\n  /** The page the form was submitted from (`$source`). */\n  sourceUrl?: string\n}\n\nfunction isFile(value: PostedValue): value is Blob {\n  return typeof value !== 'string'\n}\n\n/**\n * Read a form's entries (pure): repeated names become a list, the honeypot moves to\n * `elytra:honeypot`, `elytra:form` (the no-JS target input) is not a field, and every non-empty file is\n * an upload whose NAME is the field's value (what the inbox and the mail list). A file input\n * left empty posts a nameless zero-byte part — it is skipped.\n */\nexport function formPayload(entries: Iterable<[string, PostedValue]>, options: FormPayloadOptions = {}): FormPayload {\n  const honeypot = options.honeypot ?? DEFAULT_HONEYPOT_FIELD\n  const values = new Map<string, string[]>()\n  const files: FormPayload['files'] = []\n  let honeypotValue = ''\n  for (const [name, value] of entries) {\n    if (name === FORMS_TARGET_FIELD) continue\n    if (name === honeypot) {\n      if (typeof value === 'string') honeypotValue = value\n      continue\n    }\n    if (isFile(value)) {\n      if (value.size === 0) continue\n      const fileName = (value as Blob & { name?: string }).name || 'file'\n      files.push({ field: name, file: value, name: fileName })\n      values.set(name, [...(values.get(name) ?? []), fileName])\n      continue\n    }\n    values.set(name, [...(values.get(name) ?? []), value])\n  }\n  const data: FormPayload['data'] = {}\n  for (const [name, list] of values) data[name] = list.length === 1 ? list[0]! : list\n  if (options.sourceUrl) data[FORMS_SOURCE_KEY] = options.sourceUrl\n  data[FORMS_HONEYPOT_KEY] = honeypotValue\n  return { data, files }\n}\n\n/** What a submit came to. */\nexport type SubmitResult =\n  | { ok: true; id: string }\n  | {\n      ok: false\n      /** Which call failed: an upload URL, the bytes, or the submission. */\n      stage: 'upload' | 'storage' | 'submission'\n      status: number\n      error: string\n      issues?: { path: (string | number)[]; message: string }[]\n    }\n\n/** The two transports the flow runs over. */\nexport interface SubmitTransport {\n  /** Send one ingest payload through the site's ingest route; resolve with its answer. */\n  ingest(payload: Record<string, unknown>): Promise<Response>\n  /** Send one file's bytes to an issued storage URL; resolve with the storage's answer (`{ storageId }`). */\n  store(uploadUrl: string, file: Blob, contentType: string): Promise<Response>\n}\n\nasync function readJson(response: Response): Promise<Record<string, unknown>> {\n  try {\n    const parsed = (await response.json()) as unknown\n    return parsed && typeof parsed === 'object' ? (parsed as Record<string, unknown>) : {}\n  } catch {\n    return {}\n  }\n}\n\nfunction failure(stage: 'upload' | 'storage' | 'submission', status: number, body: Record<string, unknown>, fallback: string): SubmitResult {\n  return {\n    ok: false,\n    stage,\n    status,\n    error: typeof body['error'] === 'string' ? body['error'] : fallback,\n    ...(Array.isArray(body['issues']) ? { issues: body['issues'] as { path: (string | number)[]; message: string }[] } : {}),\n  }\n}\n\n/**\n * Send one form post to form `target` (its key — see `defineFormSource`'s `key`): each file\n * uploaded first, then the submission claiming them. The first failure ends it and is\n * returned with its stage and status; nothing is retried here.\n */\nexport async function sendFormSubmission(input: { target: string; payload: FormPayload; transport: SubmitTransport }): Promise<SubmitResult> {\n  const { target, payload, transport } = input\n  // A name the envelope (or the forms addon) would refuse is refused here, before anything is\n  // sent — with the same reason, as the same `['data', name]` issues the route's 400 carries.\n  const names = new Set([...Object.keys(payload.data), ...payload.files.map((file) => file.field)])\n  const issues = [...names].flatMap((name) => {\n    if (name.startsWith(FORMS_RESERVED_PREFIX)) return []\n    const problem = formFieldNameProblem(name)\n    return problem ? [{ path: ['data', name] as (string | number)[], message: formFieldNameMessage(name, problem) }] : []\n  })\n  if (issues.length > 0) {\n    return { ok: false, stage: 'submission', status: 400, error: issues.map((issue) => issue.message).join(' '), issues }\n  }\n  const uploads: { uploadId: string; storageId: string }[] = []\n  for (const { field, file } of payload.files) {\n    // The type the browser reports; an unknown one is declared as an opaque binary.\n    const contentType = file.type || 'application/octet-stream'\n    const issued = await transport.ingest({ kind: 'upload', target, field, contentType, size: file.size })\n    const issuedBody = await readJson(issued)\n    if (!issued.ok) return failure('upload', issued.status, issuedBody, 'The upload was refused.')\n    const uploadId = issuedBody['uploadId']\n    const uploadUrl = issuedBody['uploadUrl']\n    if (typeof uploadId !== 'string' || typeof uploadUrl !== 'string') {\n      return failure('upload', 502, {}, 'The upload answer carried no upload URL.')\n    }\n    const stored = await transport.store(uploadUrl, file, contentType)\n    const storedBody = await readJson(stored)\n    if (!stored.ok || typeof storedBody['storageId'] !== 'string') {\n      return failure('storage', stored.ok ? 502 : stored.status, storedBody, 'The file could not be stored.')\n    }\n    uploads.push({ uploadId, storageId: storedBody['storageId'] })\n  }\n  const sent = await transport.ingest({\n    kind: 'submission',\n    target,\n    data: payload.data,\n    ...(uploads.length > 0 ? { uploads } : {}),\n  })\n  const body = await readJson(sent)\n  if (!sent.ok) return failure('submission', sent.status, body, 'The submission was refused.')\n  return { ok: true, id: typeof body['id'] === 'string' ? body['id'] : '' }\n}\n\n/**\n * Submit a form from the BROWSER (a client component's submit handler): its fields and files\n * through the site's ingest route (default `/api/ingest`), the files' bytes straight to the\n * deployment's storage — so an upload is not bound by the site's function body limit.\n *\n * ```tsx\n * const result = await submitForm({ form: event.currentTarget, target: 'contact' })\n * ```\n */\nexport function submitForm(input: {\n  form: HTMLFormElement | FormData\n  target: string\n  /** The site's ingest route (default `/api/ingest`). */\n  endpoint?: string\n  honeypot?: string\n  /** Default: the current page. */\n  sourceUrl?: string\n  fetchImpl?: typeof fetch\n}): Promise<SubmitResult> {\n  const fetchImpl = input.fetchImpl ?? fetch\n  const formData = input.form instanceof FormData ? input.form : new FormData(input.form)\n  const sourceUrl = input.sourceUrl ?? (typeof location === 'undefined' ? undefined : location.href)\n  const payload = formPayload(formData.entries() as Iterable<[string, PostedValue]>, {\n    ...(input.honeypot ? { honeypot: input.honeypot } : {}),\n    ...(sourceUrl ? { sourceUrl } : {}),\n  })\n  const endpoint = input.endpoint ?? '/api/ingest'\n  return sendFormSubmission({\n    target: input.target,\n    payload,\n    transport: {\n      ingest: (body) =>\n        fetchImpl(endpoint, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }),\n      store: (uploadUrl, file, contentType) =>\n        fetchImpl(uploadUrl, { method: 'POST', headers: { 'content-type': contentType }, body: file }),\n    },\n  })\n}\n"]}
+{"version":3,"file":"submit.js","sourceRoot":"","sources":["../../src/next/submit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AA4B7B,SAAS,MAAM,CAAC,KAAkB;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAA;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAwC,EAAE,UAA8B,EAAE;IACpG,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,sBAAsB,CAAA;IAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC1C,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,IAAI,aAAa,GAAG,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,kBAAkB;YAAE,SAAQ;QACzC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,aAAa,GAAG,KAAK,CAAA;YACpD,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;gBAAE,SAAQ;YAC9B,MAAM,QAAQ,GAAI,KAAkC,CAAC,IAAI,IAAI,MAAM,CAAA;YACnE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YACxD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;YACzD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,GAAwB,EAAE,CAAA;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,IAAI,OAAO,CAAC,SAAS;QAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAA;IACjE,IAAI,CAAC,kBAAkB,CAAC,GAAG,aAAa,CAAA;IACxC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC;AAsBD,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAY,CAAA;QACjD,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA0C,EAAE,MAAc,EAAE,IAA6B,EAAE,QAAgB;IAC1H,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK;QACL,MAAM;QACN,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ;QACnE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAqD,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzH,CAAA;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KAA2E;IAClH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,KAAK,CAAA;IAC5C,4FAA4F;IAC5F,4FAA4F;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjG,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,EAAE,CAAA;QACrD,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;QAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,CAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvH,CAAC,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;IACvH,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;QACzF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,OAAO,GAA8C,EAAE,CAAA;IAC7D,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/D,gFAAgF;QAChF,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,IAAI,0BAA0B,CAAA;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;QAC9G,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAA;QAC9F,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAA;QACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClE,OAAO,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,0CAA0C,CAAC,CAAA;QAC/E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,CAAA;QAClE,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,+BAA+B,CAAC,CAAA;QACzG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,MAAM;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,6BAA6B,CAAC,CAAA;IAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AAC3E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAS1B;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAA;IAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,YAAY,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACvF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAClG,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAqC,EAAE;QACjF,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAA;IAChD,OAAO,kBAAkB,CAAC;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO;QACP,SAAS,EAAE;YACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACf,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACtH,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CACtC,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;SACjG;KACF,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { ingestUploadSha256 } from '@elytracms/core/ingest'\nimport {\n  DEFAULT_HONEYPOT_FIELD,\n  FORMS_HONEYPOT_KEY,\n  FORMS_RESERVED_PREFIX,\n  FORMS_SOURCE_KEY,\n  FORMS_TARGET_FIELD,\n  formFieldNameMessage,\n  formFieldNameProblem,\n} from '../shared/submission'\n\n/**\n * EC-613 — a form post as the ingest seam's calls (EC-617): one `upload` per file (the route\n * asks the receiver for ONE short-lived storage URL, the bytes go straight to it), then one\n * `submission` that claims the stored files. The ONE flow, with injected transports, so the\n * browser (`submitForm`) and the site's no-JS form-post route (`createFormPostRoute`) send\n * exactly the same calls — and EC-685: hash every file in the same place, so each `upload`\n * declares its bytes' SHA-256 (the claim binds a stored file only when its digest is the\n * declared one).\n */\n\n/** A posted value: text, or a file (a `File` / `Blob` with a name). */\ntype PostedValue = string | Blob\n\n/** The form's fields as the ingest payload carries them, and the files to upload. */\nexport interface FormPayload {\n  data: Record<string, string | string[]>\n  files: { field: string; file: Blob; name: string }[]\n}\n\nexport interface FormPayloadOptions {\n  /** The honeypot field the form renders (default `website`); its value goes to `elytra:honeypot`. */\n  honeypot?: string\n  /** The page the form was submitted from (`$source`). */\n  sourceUrl?: string\n}\n\nfunction isFile(value: PostedValue): value is Blob {\n  return typeof value !== 'string'\n}\n\n/**\n * Read a form's entries (pure): repeated names become a list, the honeypot moves to\n * `elytra:honeypot`, `elytra:form` (the no-JS target input) is not a field, and every non-empty file is\n * an upload whose NAME is the field's value (what the inbox and the mail list). A file input\n * left empty posts a nameless zero-byte part — it is skipped.\n */\nexport function formPayload(entries: Iterable<[string, PostedValue]>, options: FormPayloadOptions = {}): FormPayload {\n  const honeypot = options.honeypot ?? DEFAULT_HONEYPOT_FIELD\n  const values = new Map<string, string[]>()\n  const files: FormPayload['files'] = []\n  let honeypotValue = ''\n  for (const [name, value] of entries) {\n    if (name === FORMS_TARGET_FIELD) continue\n    if (name === honeypot) {\n      if (typeof value === 'string') honeypotValue = value\n      continue\n    }\n    if (isFile(value)) {\n      if (value.size === 0) continue\n      const fileName = (value as Blob & { name?: string }).name || 'file'\n      files.push({ field: name, file: value, name: fileName })\n      values.set(name, [...(values.get(name) ?? []), fileName])\n      continue\n    }\n    values.set(name, [...(values.get(name) ?? []), value])\n  }\n  const data: FormPayload['data'] = {}\n  for (const [name, list] of values) data[name] = list.length === 1 ? list[0]! : list\n  if (options.sourceUrl) data[FORMS_SOURCE_KEY] = options.sourceUrl\n  data[FORMS_HONEYPOT_KEY] = honeypotValue\n  return { data, files }\n}\n\n/** What a submit came to. */\nexport type SubmitResult =\n  | { ok: true; id: string }\n  | {\n      ok: false\n      /** Which call failed: an upload URL, the bytes, or the submission. */\n      stage: 'upload' | 'storage' | 'submission'\n      status: number\n      error: string\n      issues?: { path: (string | number)[]; message: string }[]\n    }\n\n/** The two transports the flow runs over. */\nexport interface SubmitTransport {\n  /** Send one ingest payload through the site's ingest route; resolve with its answer. */\n  ingest(payload: Record<string, unknown>): Promise<Response>\n  /** Send one file's bytes to an issued storage URL; resolve with the storage's answer (`{ storageId }`). */\n  store(uploadUrl: string, file: Blob, contentType: string): Promise<Response>\n}\n\nasync function readJson(response: Response): Promise<Record<string, unknown>> {\n  try {\n    const parsed = (await response.json()) as unknown\n    return parsed && typeof parsed === 'object' ? (parsed as Record<string, unknown>) : {}\n  } catch {\n    return {}\n  }\n}\n\nfunction failure(stage: 'upload' | 'storage' | 'submission', status: number, body: Record<string, unknown>, fallback: string): SubmitResult {\n  return {\n    ok: false,\n    stage,\n    status,\n    error: typeof body['error'] === 'string' ? body['error'] : fallback,\n    ...(Array.isArray(body['issues']) ? { issues: body['issues'] as { path: (string | number)[]; message: string }[] } : {}),\n  }\n}\n\n/**\n * Send one form post to form `target` (its key — see `defineFormSource`'s `key`): each file\n * uploaded first, then the submission claiming them. The first failure ends it and is\n * returned with its stage and status; nothing is retried here.\n *\n * EC-685: every file's SHA-256 is computed FIRST, here — the one hashing site of both flows —\n * and declared with its `upload`. A browser computes it only on a secure page (WebCrypto,\n * https or localhost); elsewhere the post is refused before anything is sent (stage `upload`,\n * status 400, the reason in `error`), never sent without the digest.\n */\nexport async function sendFormSubmission(input: { target: string; payload: FormPayload; transport: SubmitTransport }): Promise<SubmitResult> {\n  const { target, payload, transport } = input\n  // A name the envelope (or the forms addon) would refuse is refused here, before anything is\n  // sent — with the same reason, as the same `['data', name]` issues the route's 400 carries.\n  const names = new Set([...Object.keys(payload.data), ...payload.files.map((file) => file.field)])\n  const issues = [...names].flatMap((name) => {\n    if (name.startsWith(FORMS_RESERVED_PREFIX)) return []\n    const problem = formFieldNameProblem(name)\n    return problem ? [{ path: ['data', name] as (string | number)[], message: formFieldNameMessage(name, problem) }] : []\n  })\n  if (issues.length > 0) {\n    return { ok: false, stage: 'submission', status: 400, error: issues.map((issue) => issue.message).join(' '), issues }\n  }\n  const digests: string[] = []\n  for (const { file } of payload.files) {\n    const digest = await ingestUploadSha256(file)\n    if (!digest.ok) return { ok: false, stage: 'upload', status: 400, error: digest.message }\n    digests.push(digest.sha256)\n  }\n  const uploads: { uploadId: string; storageId: string }[] = []\n  for (const [index, { field, file }] of payload.files.entries()) {\n    // The type the browser reports; an unknown one is declared as an opaque binary.\n    const contentType = file.type || 'application/octet-stream'\n    const sha256 = digests[index]!\n    const issued = await transport.ingest({ kind: 'upload', target, field, contentType, size: file.size, sha256 })\n    const issuedBody = await readJson(issued)\n    if (!issued.ok) return failure('upload', issued.status, issuedBody, 'The upload was refused.')\n    const uploadId = issuedBody['uploadId']\n    const uploadUrl = issuedBody['uploadUrl']\n    if (typeof uploadId !== 'string' || typeof uploadUrl !== 'string') {\n      return failure('upload', 502, {}, 'The upload answer carried no upload URL.')\n    }\n    const stored = await transport.store(uploadUrl, file, contentType)\n    const storedBody = await readJson(stored)\n    if (!stored.ok || typeof storedBody['storageId'] !== 'string') {\n      return failure('storage', stored.ok ? 502 : stored.status, storedBody, 'The file could not be stored.')\n    }\n    uploads.push({ uploadId, storageId: storedBody['storageId'] })\n  }\n  const sent = await transport.ingest({\n    kind: 'submission',\n    target,\n    data: payload.data,\n    ...(uploads.length > 0 ? { uploads } : {}),\n  })\n  const body = await readJson(sent)\n  if (!sent.ok) return failure('submission', sent.status, body, 'The submission was refused.')\n  return { ok: true, id: typeof body['id'] === 'string' ? body['id'] : '' }\n}\n\n/**\n * Submit a form from the BROWSER (a client component's submit handler): its fields and files\n * through the site's ingest route (default `/api/ingest`), the files' bytes straight to the\n * deployment's storage — so an upload is not bound by the site's function body limit.\n *\n * ```tsx\n * const result = await submitForm({ form: event.currentTarget, target: 'contact' })\n * ```\n */\nexport function submitForm(input: {\n  form: HTMLFormElement | FormData\n  target: string\n  /** The site's ingest route (default `/api/ingest`). */\n  endpoint?: string\n  honeypot?: string\n  /** Default: the current page. */\n  sourceUrl?: string\n  fetchImpl?: typeof fetch\n}): Promise<SubmitResult> {\n  const fetchImpl = input.fetchImpl ?? fetch\n  const formData = input.form instanceof FormData ? input.form : new FormData(input.form)\n  const sourceUrl = input.sourceUrl ?? (typeof location === 'undefined' ? undefined : location.href)\n  const payload = formPayload(formData.entries() as Iterable<[string, PostedValue]>, {\n    ...(input.honeypot ? { honeypot: input.honeypot } : {}),\n    ...(sourceUrl ? { sourceUrl } : {}),\n  })\n  const endpoint = input.endpoint ?? '/api/ingest'\n  return sendFormSubmission({\n    target: input.target,\n    payload,\n    transport: {\n      ingest: (body) =>\n        fetchImpl(endpoint, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }),\n      store: (uploadUrl, file, contentType) =>\n        fetchImpl(uploadUrl, { method: 'POST', headers: { 'content-type': contentType }, body: file }),\n    },\n  })\n}\n"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@elytracms/forms",
   "author": "finaldream <hi@finaldream.de>",
-  "version": "0.0.96",
+  "version": "0.0.98",
   "engines": {
     "node": ">=22.18.0"
   },
@@ -28,13 +28,13 @@
   "dependencies": {
     "lucide-react": "^1.23.0",
     "zod": "^4.4.3",
-    "@elytracms/core": "^0.0.96"
+    "@elytracms/core": "^0.0.98"
   },
   "peerDependencies": {
     "convex": "^1.42.1",
     "react": "^19.0.0",
-    "@elytracms/next": "^0.0.96",
-    "@elytracms/studio": "^0.0.96"
+    "@elytracms/next": "^0.0.98",
+    "@elytracms/studio": "^0.0.98"
   },
   "peerDependenciesMeta": {
     "@elytracms/next": {
@@ -59,8 +59,8 @@
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "typescript": "^6.0.3",
-    "@elytracms/next": "^0.0.96",
-    "@elytracms/studio": "^0.0.96"
+    "@elytracms/next": "^0.0.98",
+    "@elytracms/studio": "^0.0.98"
   },
   "files": [
     "dist",

package/src/convex/claim-ownership.convex.test.ts

@@ -0,0 +1,270 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import { makeFunctionReference } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import { INGEST_RECEIVER_PATH, ingestUploadSha256, signedIngestRequest } from '@elytracms/core/ingest'
+import type { IngestReceiverBody } from '@elytracms/core/ingest'
+import schema from '../../../studio/convex/schema'
+import * as assetsModule from '../../../studio/convex/assets'
+import * as deliveryModule from '../../../studio/convex/delivery'
+import { defineStudioHttp } from '../../../studio/convex/http'
+import { ConvexPersistenceAdapter } from '../../../studio/src/lib/persistence/convex-adapter'
+import * as formsModule from './index'
+import { submissionRecordKind } from '../shared/kind'
+import type { SubmissionRecord } from '../shared/kind'
+import { FORMS_DELIVERY_URL_ENV } from '../shared/delivery'
+import { FORMS_HONEYPOT_KEY } from '../shared/submission'
+
+/**
+ * EC-671 (Codex round 3 F20) — EC-304 Phase B's first EXECUTABLE probe: the ingest upload
+ * claim against storage ids a visitor does not own, through the real paths — the attacker's
+ * input harvested from the anonymous `delivery:snapshot`, a fresh intent of their own from
+ * the receiver, the forms addon's claim, its rollback and its removal. Every defect line
+ * says what the base (`3f9c636c`) did; the counterexample form (those lines asserted) passed
+ * 7/7 there before it was inverted. Run only inside convex-test, generated fixture ids, an
+ * unreachable `.invalid` delivery host; nothing is sent.
+ */
+
+/**
+ * The status a claim naming a file stored BEFORE its intent gets: the ownership refusal (422),
+ * before the declaration is measured (the floor alone answered the mismatch's 413).
+ */
+const REFUSED_MISMATCHING = 422
+
+const SECRET = 'ec671-ingest-secret'
+const PROJECT_ID = 'forms-test'
+const ADMIN = 'user_admin'
+const T0 = '2026-10-28T12:00:00.000Z'
+const at = (offsetMs: number) => new Date(Date.parse(T0) + offsetMs)
+
+function env(): Record<string, string | undefined> {
+  return (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(T0))
+  env()['ELYTRA_INGEST_SECRET'] = SECRET
+  env()[FORMS_DELIVERY_URL_ENV] = 'https://site.invalid/api/forms'
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete env()['ELYTRA_INGEST_SECRET']
+  delete env()[FORMS_DELIVERY_URL_ENV]
+})
+
+const silentAuth = { addHttpRoutes: () => {} }
+// The consumer's files this probe needs: the engine's `assets` (the editor's upload) and
+// `delivery` (the attacker's harvest) re-exports, the addon's `forms`, and the `http.ts` line.
+const modules = {
+  '/convex/_generated/api.ts': async () => ({}),
+  '/convex/assets.ts': async () => assetsModule,
+  '/convex/delivery.ts': async () => deliveryModule,
+  '/convex/forms.ts': async () => formsModule,
+  '/convex/http.ts': async () => ({
+    default: defineStudioHttp({ auth: silentAuth, ingest: { submission: formsModule.formsIngest } }),
+  }),
+}
+
+async function backend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: ADMIN, role: 'admin', createdAt: T0, updatedAt: T0 })
+  })
+  return t
+}
+type Backend = Awaited<ReturnType<typeof backend>>
+
+const asAdmin = (t: Backend) => t.withIdentity({ subject: ADMIN, issuer: 'https://convex.test' })
+const upsertAsset = makeFunctionReference<'mutation'>('assets:upsert')
+const snapshot = makeFunctionReference<'query', { projectId: string }, { assets: { id: string; storageKey: string }[] }>(
+  'delivery:snapshot',
+)
+
+async function post(t: Backend, body: IngestReceiverBody) {
+  const signed = await signedIngestRequest(body, SECRET)
+  return t.fetch(INGEST_RECEIVER_PATH, { method: 'POST', headers: signed.headers, body: signed.body })
+}
+
+/** Bytes as an issued upload URL stores them (convex-test records size only; the real upload records the type). */
+async function storeFile(t: Backend, bytes: number, contentType: string): Promise<string> {
+  return t.run(async (ctx) => {
+    const id = await ctx.storage.store(new Blob([new Uint8Array(bytes)], { type: contentType }))
+    await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(id, { contentType })
+    return id
+  })
+}
+
+/** An editor's asset upload: the bytes stored, then the row written through `assets:upsert` (the real write path). */
+async function publishAsset(t: Backend, assetId: string, bytes: number, contentType: string): Promise<string> {
+  const storageKey = await storeFile(t, bytes, contentType)
+  const stamp = new Date().toISOString()
+  await asAdmin(t).mutation(upsertAsset, {
+    assetId,
+    filename: `${assetId}.jpg`,
+    contentType,
+    byteSize: bytes,
+    storageKey,
+    createdAt: stamp,
+    updatedAt: stamp,
+  })
+  return storageKey
+}
+
+/** The attacker's harvest: the anonymous public delivery snapshot names every asset's storage id. */
+async function harvest(t: Backend, assetId: string): Promise<string> {
+  const { assets } = await t.query(snapshot, { projectId: PROJECT_ID })
+  const asset = assets.find((entry) => entry.id === assetId)
+  if (!asset) throw new Error(`asset ${assetId} not on the public snapshot`)
+  return asset.storageKey
+}
+
+/**
+ * EC-685: an intent declares its bytes' SHA-256 too. The harness stores zero-filled files, so
+ * `bytesOf` names the file whose digest an intent declares — for a "matching declaration" the
+ * VICTIM's (the strongest attacker: an asset's bytes are public, so its digest is known), which
+ * keeps each EC-671 check isolated from EC-685's.
+ */
+async function declare(t: Backend, contentType: string, size: number, bytesOf = size, field = 'cv'): Promise<string> {
+  const digest = await ingestUploadSha256(new Uint8Array(bytesOf))
+  if (!digest.ok) throw new Error(digest.message)
+  const answer = await post(t, { kind: 'upload', target: 'contact', field, contentType, size, sha256: digest.sha256 })
+  expect(answer.status).toBe(200)
+  return ((await answer.json()) as { uploadId: string }).uploadId
+}
+
+const SUBMISSION = {
+  kind: 'submission',
+  target: 'contact',
+  data: { email: 'mallory@example.test', message: 'hi', [FORMS_HONEYPOT_KEY]: '' },
+} as const
+
+async function rows(t: Backend): Promise<SubmissionRecord[]> {
+  return (await t.run(async (ctx) => (await ctx.db.query('records').collect()).filter((row) => row.kind === 'submission'))).map(
+    (row) => ({ ...(row.data as object), id: row.recordId }) as unknown as SubmissionRecord,
+  )
+}
+
+/** Whether stored bytes still exist (`storage.get` → a Blob, which is not a Convex value: answer a boolean). */
+const survives = (t: Backend, storageId: string) => t.run(async (ctx) => (await ctx.storage.get(storageId as never)) !== null)
+
+function editor(t: Backend) {
+  const client = {
+    query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin(t).query(ref, args ?? {}),
+    mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => asAdmin(t).mutation(ref, args ?? {}),
+  } as unknown as ConvexHttpClient
+  return new ConvexPersistenceAdapter(client, PROJECT_ID).records(submissionRecordKind)
+}
+
+/** An asset an editor published a day before the attacker's intent, harvested from the public snapshot. */
+async function harvestedOldAsset(t: Backend): Promise<string> {
+  vi.setSystemTime(at(-24 * 60 * 60 * 1000))
+  await publishAsset(t, 'hero', 400, 'image/jpeg')
+  vi.setSystemTime(new Date(T0))
+  return harvest(t, 'hero')
+}
+
+/** A refused submission whose second claim is a genuine mismatch — the shape that triggers the rollback. */
+async function postWithRefusedSecondClaim(t: Backend, first: { uploadId: string; storageId: string }) {
+  const liar = await declare(t, 'image/png', 500, 10) // its own 10 bytes' digest: the mismatch is the type
+  const bad = await storeFile(t, 10, 'text/html')
+  return post(t, { ...SUBMISSION, uploads: [first, { uploadId: liar, storageId: bad }] })
+}
+
+describe('EC-671 probe — a visitor names an asset’s storage id in an upload claim', () => {
+  it('control: the anonymous delivery snapshot names the asset’s storage id (the attacker’s input is public)', async () => {
+    const t = await backend()
+    vi.setSystemTime(at(-24 * 60 * 60 * 1000))
+    const storageKey = await publishAsset(t, 'hero', 400, 'image/jpeg')
+    vi.setSystemTime(new Date(T0))
+    expect(await harvest(t, 'hero')).toBe(storageKey)
+  })
+
+  it('(1) mismatching declaration: the claim is refused and the asset’s file survives', async () => {
+    const t = await backend()
+    const victim = await harvestedOldAsset(t)
+    const uploadId = await declare(t, 'image/png', 10) // a fresh intent of the attacker's own, mismatching the asset
+    const answer = await post(t, { ...SUBMISSION, uploads: [{ uploadId, storageId: victim }] })
+    expect(answer.status).toBe(REFUSED_MISMATCHING)
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — the claim deleted it (ingest.ts:256)
+  })
+
+  it('(2a) matching declaration, rollback: the asset’s file is never claimed, so a refused later claim cannot release it', async () => {
+    const t = await backend()
+    const victim = await harvestedOldAsset(t)
+    const matching = await declare(t, 'image/jpeg', 400)
+    const answer = await postWithRefusedSecondClaim(t, { uploadId: matching, storageId: victim })
+    expect(answer.status).toBe(422) // base: 415 — the first claim passed, the second refused
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — claimed, then released by the rollback
+  })
+
+  it('(2b) matching declaration, removal: the claim cannot attach the asset’s file; a row naming it by hand cannot delete it', async () => {
+    const t = await backend()
+    const victim = await harvestedOldAsset(t)
+    const matching = await declare(t, 'image/jpeg', 400)
+    const answer = await post(t, {
+      ...SUBMISSION,
+      data: { ...SUBMISSION.data, cv: 'cv.jpg' },
+      uploads: [{ uploadId: matching, storageId: victim }],
+    })
+    expect(answer.status).toBe(422) // base: 200 — claimed and attached
+    expect(await rows(t)).toEqual([])
+    // The deletion site holds on its own: a submission whose `files` name the asset's id (an
+    // editor's write — the kind's `save` takes the column) is removed, and the asset's file stays.
+    const repo = editor(t)
+    await repo.save(PROJECT_ID, {
+      id: 'submission_by_hand',
+      form: 'contact',
+      payload: [],
+      files: [{ field: 'cv', storageId: victim, contentType: 'image/jpeg', size: 400 }],
+      status: 'new',
+      spam: 'clean',
+      deliveryState: 'skipped',
+      submittedAt: T0,
+    })
+    expect((await rows(t)).map((row) => row.id)).toEqual(['submission_by_hand'])
+    await repo.remove(PROJECT_ID, 'submission_by_hand')
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — removal deletes whatever `files` names
+  })
+
+  it('(3) fresh asset (critic): uploaded AFTER the intent, a matching declaration, a refused second claim → it survives', async () => {
+    const t = await backend()
+    const matching = await declare(t, 'image/jpeg', 400) // the attacker holds a fresh intent open…
+    vi.setSystemTime(at(60 * 1000))
+    await publishAsset(t, 'hero', 400, 'image/jpeg') // …an editor uploads an asset a minute later…
+    const victim = await harvest(t, 'hero') // …which is public at once
+    const answer = await postWithRefusedSecondClaim(t, { uploadId: matching, storageId: victim })
+    expect(answer.status).toBe(422) // base: 415 — the first claim passed, the second refused
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, victim)).toBe(true) // base: false — claimed, then released by the rollback
+  })
+
+  it('control: a genuine upload claims and attaches; removing its submission deletes its file (the instrument sees a deletion)', async () => {
+    const t = await backend()
+    const uploadId = await declare(t, 'application/pdf', 900, 800)
+    const own = await storeFile(t, 800, 'application/pdf')
+    const answer = await post(t, { ...SUBMISSION, data: { ...SUBMISSION.data, cv: 'cv.pdf' }, uploads: [{ uploadId, storageId: own }] })
+    expect(answer.status).toBe(200)
+    const [row] = await rows(t)
+    expect(row!.files).toEqual([
+      { field: 'cv', name: 'cv.pdf', storageId: own, contentType: 'application/pdf', size: 800, url: expect.any(String) },
+    ])
+    expect(await survives(t, own)).toBe(true)
+    await editor(t).remove(PROJECT_ID, row!.id)
+    expect(await survives(t, own)).toBe(false)
+  })
+
+  it('control: a genuine mismatch is refused (no row); a genuine claim before it is released by the rollback', async () => {
+    const t = await backend()
+    const good = await declare(t, 'image/png', 500, 400)
+    const goodFile = await storeFile(t, 400, 'image/png')
+    const answer = await postWithRefusedSecondClaim(t, { uploadId: good, storageId: goodFile })
+    expect(answer.status).toBe(415)
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, goodFile)).toBe(false)
+  })
+})

package/src/convex/dev-ingest-runner.convex.test.ts

@@ -0,0 +1,192 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import * as wire from '@elytracms/core/ingest'
+import schema from '../../../studio/convex/schema'
+import * as assetsModule from '../../../studio/convex/assets'
+import * as deliveryModule from '../../../studio/convex/delivery'
+import { defineStudioHttp } from '../../../studio/convex/http'
+import * as formsModule from './index'
+// EC-618 (zone G): the `ec618-burst` scenario posts analytics events — the addon's handler answers them.
+import * as analyticsModule from '../../../analytics/src/convex/index'
+import { FORMS_DELIVERY_URL_ENV } from '../shared/delivery'
+
+/**
+ * EC-685 — the dev ingest runner's scenarios (`scripts/dev-ingest-core.mjs`, `pnpm dev:ingest`),
+ * run END TO END against the real engine in convex-test before the operator runs them against
+ * the dev deployment: the port signs with a PLANTED secret that is this backend's
+ * `ELYTRA_INGEST_SECRET`, the receiver verifies it, the forms claim / removal and the studio's
+ * asset functions answer. Every scenario's expectations hold, nothing it printed holds the
+ * secret, and it leaves no runner row behind. Negative control: the same scenarios with a port
+ * signing under ANOTHER secret fail (the instrument can fail).
+ */
+
+/** The runner's core, typed to what this test uses (a repo script, plain `.mjs`). */
+interface RunnerPort {
+  ingest(payload: unknown): Promise<{ status: number; body: Record<string, unknown> }>
+}
+interface RunnerCore {
+  INGEST_SCENARIOS: readonly { name: string }[]
+  createDeploymentPort(options: Record<string, unknown>): RunnerPort
+  runIngestScenario(
+    scenario: { name: string },
+    port: RunnerPort,
+    options: { say: (line: string) => void; wire: typeof wire; runId: string; now: () => string },
+  ): Promise<{ ok: boolean; passed: number; failed: string[] }>
+}
+const RUNNER = '../../../../scripts/dev-ingest-core.mjs'
+const runner = async () => (await import(RUNNER as string)) as RunnerCore
+
+const PLANTED = 'planted-fake-ingest-secret-ec685'
+const ADMIN = 'user_admin'
+const T0 = '2026-10-28T12:00:00.000Z'
+const SITE = 'https://rosy-armadillo-302.convex.site'
+
+function env(): Record<string, string | undefined> {
+  return (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(T0))
+  env()['ELYTRA_INGEST_SECRET'] = PLANTED
+  env()[FORMS_DELIVERY_URL_ENV] = 'https://site.invalid/api/forms'
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete env()['ELYTRA_INGEST_SECRET']
+  delete env()[FORMS_DELIVERY_URL_ENV]
+})
+
+const silentAuth = { addHttpRoutes: () => {} }
+const modules = {
+  '/convex/_generated/api.ts': async () => ({}),
+  '/convex/assets.ts': async () => assetsModule,
+  '/convex/delivery.ts': async () => deliveryModule,
+  '/convex/forms.ts': async () => formsModule,
+  '/convex/analytics.ts': async () => analyticsModule,
+  '/convex/http.ts': async () => ({
+    default: defineStudioHttp({ auth: silentAuth, ingest: { submission: formsModule.formsIngest, event: analyticsModule.analyticsIngest } }),
+  }),
+}
+
+async function backend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: ADMIN, role: 'admin', createdAt: T0, updatedAt: T0 })
+  })
+  return t
+}
+type Backend = Awaited<ReturnType<typeof backend>>
+type Patchable = { patch(id: unknown, value: unknown): Promise<void> }
+
+/**
+ * The deployment's HTTP surface over convex-test: the receiver (`t.fetch`), an issued upload URL
+ * (convex-test's URLs are not served — the bytes are stored as the upload would store them,
+ * with the uploader's Content-Type), and a serve URL (convex-test names a file by its digest).
+ */
+function transport(t: Backend): typeof fetch {
+  return (async (input: string | URL, init: RequestInit = {}) => {
+    const url = new URL(String(input))
+    if (url.origin === SITE) return t.fetch(url.pathname, init)
+    if (url.pathname === '/api/storage/upload') {
+      const contentType = String(new Headers(init.headers).get('content-type'))
+      const bytes = init.body as Uint8Array<ArrayBuffer>
+      const storageId = await t.run(async (ctx) => {
+        const id = await ctx.storage.store(new Blob([bytes], { type: contentType }))
+        await (ctx.db as unknown as Patchable).patch(id, { contentType })
+        return id
+      })
+      return Response.json({ storageId })
+    }
+    if (url.pathname.startsWith('/api/storage/')) {
+      const sha256 = decodeURIComponent(url.pathname.slice('/api/storage/'.length))
+      const bytes = await t.run(async (ctx) => {
+        const row = (await ctx.db.system.query('_storage').collect()).find((file) => file.sha256 === sha256)
+        const blob = row ? await ctx.storage.get(row._id) : null
+        return blob ? Array.from(new Uint8Array(await blob.arrayBuffer())) : null
+      })
+      return bytes ? new Response(new Uint8Array(bytes)) : new Response('not found', { status: 404 })
+    }
+    return new Response('unroutable', { status: 599 })
+  }) as typeof fetch
+}
+
+function port(core: RunnerCore, t: Backend, secret = PLANTED) {
+  const asAdmin = t.withIdentity({ subject: ADMIN, issuer: 'https://convex.test' })
+  type Caller = (ref: unknown, args: object) => Promise<unknown>
+  const call = (kind: 'query' | 'mutation', on: { query: unknown; mutation?: unknown }) => (name: string, args: object) =>
+    (on[kind] as Caller)(makeFunctionReference(name as never), args)
+  return core.createDeploymentPort({
+    siteUrl: SITE,
+    secret,
+    fetchImpl: transport(t),
+    wire,
+    admin: { query: call('query', asAdmin), mutation: call('mutation', asAdmin) },
+    anon: { query: call('query', t) },
+    readTable: (table: string) =>
+      t.run(async (ctx) =>
+        table === '_storage'
+          ? ctx.db.system.query('_storage').order('desc').take(500)
+          : ctx.db.query(table as 'records').order('desc').take(500),
+      ),
+  })
+}
+
+/** What a scenario left behind: runner submissions, runner assets, stored files. */
+async function leftovers(t: Backend) {
+  return t.run(async (ctx) => ({
+    submissions: (await ctx.db.query('records').collect()).filter((row) => row.kind === 'submission').length,
+    bindings: (await ctx.db.query('records').collect()).filter((row) => row.kind === 'ingestBinding').length,
+    assets: (await ctx.db.query('assets').collect()).length,
+  }))
+}
+
+describe('pnpm dev:ingest — every scenario against the real engine (convex-test)', () => {
+  it('each scenario’s expectations hold; nothing printed holds the secret; no runner row is left', async () => {
+    const core = await runner()
+    expect(core.INGEST_SCENARIOS.map((scenario) => scenario.name)).toEqual(['ec671', 'ec685-causal', 'ec685-release', 'storage-sha256', 'ec618-burst'])
+    for (const scenario of core.INGEST_SCENARIOS) {
+      const t = await backend()
+      const lines: string[] = []
+      const result = await core.runIngestScenario(scenario, port(core, t), {
+        say: (line) => lines.push(line),
+        wire,
+        runId: `run-${scenario.name}`,
+        now: () => new Date().toISOString(),
+      })
+      expect({ scenario: scenario.name, ...result, lines }).toMatchObject({ scenario: scenario.name, ok: true, failed: [] })
+      expect(result.passed).toBeGreaterThan(3)
+      expect(lines.join('\n').includes(PLANTED)).toBe(false)
+      expect(lines.join('\n')).not.toMatch(/https?:\/\//)
+      expect(await leftovers(t)).toEqual({ submissions: 0, bindings: 0, assets: 0 })
+    }
+  })
+
+  it('the encoding scenario names convex-test’s form: base64', async () => {
+    const core = await runner()
+    const t = await backend()
+    const lines: string[] = []
+    const scenario = core.INGEST_SCENARIOS.find((entry) => entry.name === 'storage-sha256')!
+    expect((await core.runIngestScenario(scenario, port(core, t), { say: (line) => lines.push(line), wire, runId: 'r', now: () => T0 })).ok).toBe(true)
+    expect(lines).toContain('  · _storage.sha256 form (hex, base64, or unreadable): base64')
+    expect(lines).toContain('  · _storage.sha256 length: 44')
+  })
+
+  it('negative control: signed under ANOTHER secret, every scenario fails visibly (the receiver refuses it)', async () => {
+    const core = await runner()
+    for (const scenario of core.INGEST_SCENARIOS) {
+      const t = await backend()
+      const lines: string[] = []
+      const result = await core.runIngestScenario(scenario, port(core, t, 'not-the-deployment-secret'), {
+        say: (line) => lines.push(line),
+        wire,
+        runId: 'r',
+        now: () => T0,
+      })
+      expect(result.ok, scenario.name).toBe(false)
+      expect(lines.some((line) => /✗ .*: 401 \(expected 200\)/.test(line)), scenario.name).toBe(true)
+      expect(await leftovers(t)).toMatchObject({ submissions: 0, assets: 0 })
+    }
+  })
+})

package/src/convex/forms.convex.test.ts

@@ -4,7 +4,7 @@ import type { ConvexHttpClient } from 'convex/browser'
 import { makeFunctionReference } from 'convex/server'
 import type { FunctionReference } from 'convex/server'
 import { CONVEX_MAX_NESTING_DEPTH, measureMaxDepth } from '@elytracms/core/cms-core'
-import { INGEST_RECEIVER_PATH, signedIngestRequest } from '@elytracms/core/ingest'
+import { INGEST_RECEIVER_PATH, ingestUploadSha256, signedIngestRequest } from '@elytracms/core/ingest'
 import type { IngestReceiverBody } from '@elytracms/core/ingest'
 import { InMemoryRecordStore } from '@elytracms/core/persistence'
 import type { RecordRepository } from '@elytracms/core/persistence'
@@ -372,8 +372,11 @@ describe('the editor’s writes (the kind’s save)', () => {
 
 // --- Uploads -----------------------------------------------------------------------------------
 
-async function declareUpload(t: Backend, contentType: string, size: number, field = 'cv') {
-  const answer = await post(t, { kind: 'upload', target: 'contact', field, contentType, size })
+/** An upload intent declaring the file's type, size and (EC-685) the SHA-256 of the zero-filled `bytesOf` bytes the test stores. */
+async function declareUpload(t: Backend, contentType: string, size: number, field = 'cv', bytesOf = size) {
+  const digest = await ingestUploadSha256(new Uint8Array(bytesOf))
+  if (!digest.ok) throw new Error(digest.message)
+  const answer = await post(t, { kind: 'upload', target: 'contact', field, contentType, size, sha256: digest.sha256 })
   return { status: answer.status, body: (await answer.json()) as { uploadId?: string; uploadUrl?: string } }
 }
 
@@ -381,7 +384,7 @@ describe('uploads, claimed by the submission', () => {
   it('a claimed file is on the row (name, type, size, URL), its URL reaches the mail; removing the row deletes it', async () => {
     const t = await backend()
     const { mails } = site()
-    const { status, body } = await declareUpload(t, 'application/pdf', 900)
+    const { status, body } = await declareUpload(t, 'application/pdf', 900, 'cv', 800)
     expect(status).toBe(200)
     expect(typeof body.uploadUrl).toBe('string')
     const storageId = await storeFile(t, 800, 'application/pdf')
@@ -406,12 +409,12 @@ describe('uploads, claimed by the submission', () => {
     expect(await t.run((ctx) => ctx.storage.get(storageId as never))).toBeNull()
   })
 
-  it('a claim that fails refuses the submission AND deletes the files it had already claimed', async () => {
+  it('a claim that fails refuses the submission AND deletes the files it had already claimed (never the refused one)', async () => {
     const t = await backend()
     site()
-    const good = await declareUpload(t, 'image/png', 500, 'photo')
+    const good = await declareUpload(t, 'image/png', 500, 'photo', 400)
     const goodFile = await storeFile(t, 400, 'image/png')
-    const liar = await declareUpload(t, 'image/png', 500, 'photo')
+    const liar = await declareUpload(t, 'image/png', 500, 'photo', 10) // its own bytes: the mismatch is the type
     const wrongType = await storeFile(t, 10, 'text/html')
     const answer = await post(t, {
       ...SUBMISSION,
@@ -423,7 +426,8 @@ describe('uploads, claimed by the submission', () => {
     expect(answer.status).toBe(415)
     expect(await rows(t)).toEqual([])
     expect(await t.run((ctx) => ctx.storage.get(goodFile as never))).toBeNull() // claimed, then released
-    expect(await t.run((ctx) => ctx.storage.get(wrongType as never))).toBeNull() // EC-617's claim deletes a mismatch
+    // EC-671: the refused claim never deletes the id it names (the visitor's word, not an ownership fact).
+    expect(await t.run(async (ctx) => (await ctx.storage.get(wrongType as never)) !== null)).toBe(true)
     expect(await scheduled(t)).toEqual([])
   })
 
@@ -456,10 +460,16 @@ describe('the site’s form post, end to end', () => {
     const t = await backend()
     const viaReceiver = (async (url: string, init: RequestInit) => t.fetch(new URL(url).pathname, init)) as unknown as typeof fetch
     const ingest = createIngestRoute({ secret: SECRET, siteUrl: 'https://happy-otter-123.convex.site', fetchImpl: viaReceiver })
-    // The bytes' destination: the issued storage URL (convex-test stores them directly).
+    // The bytes' destination: the issued storage URL — convex-test stores THE POSTED BYTES, so
+    // the digest the deployment computes is of what the form sent (EC-685: the form hashed them).
     const storeBytes = (async (_url: string, init: RequestInit) => {
       const blob = init.body as Blob
-      const storageId = await storeFile(t, blob.size, String(new Headers(init.headers).get('content-type')))
+      const contentType = String(new Headers(init.headers).get('content-type'))
+      const storageId = await t.run(async (ctx) => {
+        const id = await ctx.storage.store(new Blob([await blob.arrayBuffer()], { type: contentType }))
+        await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(id, { contentType })
+        return id
+      })
       return Response.json({ storageId })
     }) as unknown as typeof fetch
     const formPost = createFormPostRoute({ ingest, fetchImpl: storeBytes })
@@ -469,7 +479,7 @@ describe('the site’s form post, end to end', () => {
     form.set('email', 'ada@example.test')
     form.set('message', 'Please call back.')
     form.set('website', '')
-    form.set('cv', new File([new Uint8Array(300)], 'cv.pdf', { type: 'application/pdf' }))
+    form.set('cv', new File([new TextEncoder().encode('%PDF-1.7 Ada Lovelace, CV '.padEnd(300, '.'))], 'cv.pdf', { type: 'application/pdf' }))
     const answer = await formPost.POST(
       new Request('https://site.test/api/form', {
         method: 'POST',

package/src/convex/index.ts

@@ -16,6 +16,7 @@ import {
   ingestUploadRecordKind,
   parseIngestPayload,
   recordIngestUpload,
+  releaseIngestUploads,
 } from '@elytracms/studio/convex/ingest'
 import {
   defineRecordFunctions,
@@ -60,7 +61,9 @@ import type { FormDeliveryRequest } from '../shared/delivery'
  *   under the forms upload policy and its intent recorded; a `submission` is read
  *   (`readSubmissionPayload`), its uploads claimed, the row written and its delivery
  *   scheduled. A claim that fails refuses the submission and deletes the files already
- *   claimed for it — no claimed bytes ever sit without a row;
+ *   claimed for it — no claimed bytes ever sit without a row. Every deletion goes through
+ *   the engine's `releaseIngestUploads`, which deletes only bytes a claim bound to its
+ *   intent (EC-671): an id a visitor or an editor merely NAMES is never deleted;
  * - **`deliver`** — the scheduled action per row: it asks the site's delivery route to send
  *   (`attemptFormDelivery`) and `recordDelivery` logs the answer per recipient and schedules
  *   the next attempt (`applyDeliveryOutcome`);
@@ -130,24 +133,24 @@ export const save = mutation({
   },
 })
 
-/** Delete a submission AND the files it claimed (no bytes outlive their row). */
+/**
+ * Delete a submission AND the files it claimed (no claimed bytes outlive their row). EC-671:
+ * through `releaseIngestUploads`, which deletes only files a claim bound — a `files` entry
+ * naming anything else (an editor's write can put any id there) is kept, never deleted — and,
+ * EC-685, keeps a claimed file an editor has since made an asset of (the asset owns it now).
+ */
 export const remove = mutation({
   args: { [kind.idKey]: v.string() },
   handler: async (ctx, args: Record<string, unknown>) => {
     await requireCapability(ctx, kind.access.write)
     const doc = await findRecordDoc(ctx, kind, args[kind.idKey] as string)
     if (!doc) return
-    await deleteFiles(ctx, (doc.data['files'] as SubmissionFile[] | undefined) ?? [])
+    await releaseIngestUploads(ctx, storageIds((doc.data['files'] as SubmissionFile[] | undefined) ?? []))
     await ctx.db.delete(doc._id)
   },
 })
 
-async function deleteFiles(ctx: MutationCtx, files: readonly { storageId: string }[]): Promise<void> {
-  for (const file of files) {
-    const id = file.storageId as GenericId<'_storage'>
-    if (await ctx.db.system.get(id).catch(() => null)) await ctx.storage.delete(id)
-  }
-}
+const storageIds = (files: readonly { storageId: string }[]) => files.map((file) => file.storageId)
 
 // --- The receiver's handler ------------------------------------------------------------------
 
@@ -172,13 +175,14 @@ export const ingest = internalMutation({
     const read = readSubmissionPayload(body, { hasFiles: (body.uploads?.length ?? 0) > 0 })
     if (!read.ok) return { ok: false, status: read.status, message: read.message, issues: read.issues }
 
-    // Claim every upload; on the first refusal, delete what this submission already claimed.
+    // Claim every upload; on the first refusal, release what this submission already claimed
+    // (bound in this transaction — EC-671: nothing else is ever deleted here).
     const files: SubmissionFile[] = []
     const namesUsed = new Map<string, number>()
     for (const claim of body.uploads ?? []) {
       const claimed = await claimIngestUpload(ctx, claim, body.target, receivedAt)
       if (!claimed.ok) {
-        await deleteFiles(ctx, files)
+        await releaseIngestUploads(ctx, storageIds(files))
         return claimed
       }
       const index = namesUsed.get(claimed.field) ?? 0

package/src/convex/ingest-causation.convex.test.ts

@@ -0,0 +1,265 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import type { FunctionReference } from 'convex/server'
+import { INGEST_RECEIVER_PATH, ingestUploadSha256, signedIngestRequest } from '@elytracms/core/ingest'
+import type { IngestReceiverBody } from '@elytracms/core/ingest'
+import schema from '../../../studio/convex/schema'
+import * as assetsModule from '../../../studio/convex/assets'
+import * as deliveryModule from '../../../studio/convex/delivery'
+import { defineStudioHttp } from '../../../studio/convex/http'
+import { ConvexPersistenceAdapter } from '../../../studio/src/lib/persistence/convex-adapter'
+import { deleteAsset } from '../../../studio/src/lib/assets/delete-asset'
+import * as formsModule from './index'
+import { submissionRecordKind } from '../shared/kind'
+import type { SubmissionRecord } from '../shared/kind'
+import { FORMS_DELIVERY_URL_ENV } from '../shared/delivery'
+import { FORMS_HONEYPOT_KEY } from '../shared/submission'
+
+/**
+ * EC-685 (Codex round 4 F20 residual) — EC-304 Phase B's next executable probes: ownership
+ * that is CAUSAL (the claim binds only bytes its own intent stored) and that STAYS true when
+ * a delete spends it. Both orderings exactly as Codex wrote them, through the real paths —
+ * the signed receiver, the forms claim and removal, the real `assets:upsert` and the studio's
+ * own `deleteAsset` (bytes first, through `assets:deleteBlob`). Every defect line says what
+ * the base (`6310b7b4`) did. Run only inside convex-test, generated fixture ids, an
+ * unreachable `.invalid` delivery host; nothing is sent.
+ */
+
+const SECRET = 'ec685-ingest-secret'
+const PROJECT_ID = 'forms-test'
+const ADMIN = 'user_admin'
+const T0 = '2026-10-28T12:00:00.000Z'
+
+function env(): Record<string, string | undefined> {
+  return (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+}
+
+beforeEach(() => {
+  vi.useFakeTimers()
+  vi.setSystemTime(new Date(T0))
+  env()['ELYTRA_INGEST_SECRET'] = SECRET
+  env()[FORMS_DELIVERY_URL_ENV] = 'https://site.invalid/api/forms'
+})
+afterEach(() => {
+  vi.useRealTimers()
+  delete env()['ELYTRA_INGEST_SECRET']
+  delete env()[FORMS_DELIVERY_URL_ENV]
+})
+
+const silentAuth = { addHttpRoutes: () => {} }
+const modules = {
+  '/convex/_generated/api.ts': async () => ({}),
+  '/convex/assets.ts': async () => assetsModule,
+  '/convex/delivery.ts': async () => deliveryModule,
+  '/convex/forms.ts': async () => formsModule,
+  '/convex/http.ts': async () => ({
+    default: defineStudioHttp({ auth: silentAuth, ingest: { submission: formsModule.formsIngest } }),
+  }),
+}
+
+async function backend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: ADMIN, role: 'admin', createdAt: T0, updatedAt: T0 })
+  })
+  return t
+}
+type Backend = Awaited<ReturnType<typeof backend>>
+
+const asAdmin = (t: Backend) => t.withIdentity({ subject: ADMIN, issuer: 'https://convex.test' })
+
+/** The studio's own adapter over the deployment, signed in as an editor (the admin). */
+function studio(t: Backend) {
+  const client = {
+    query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin(t).query(ref, args ?? {}),
+    mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => asAdmin(t).mutation(ref, args ?? {}),
+  } as unknown as ConvexHttpClient
+  return new ConvexPersistenceAdapter(client, PROJECT_ID)
+}
+
+async function post(t: Backend, body: IngestReceiverBody) {
+  const signed = await signedIngestRequest(body, SECRET)
+  return t.fetch(INGEST_RECEIVER_PATH, { method: 'POST', headers: signed.headers, body: signed.body })
+}
+
+/** File content: distinct bytes per label (a victim's CV is not predictable by an attacker). */
+const content = (label: string, size: number) => {
+  const bytes = new Uint8Array(size)
+  const seed = new TextEncoder().encode(label)
+  for (let index = 0; index < size; index += 1) bytes[index] = seed[index % seed.length]! ^ (index & 0xff)
+  return bytes
+}
+
+/** Bytes as an issued upload URL stores them (convex-test records size only; the real upload records the type). */
+async function storeFile(t: Backend, bytes: Uint8Array<ArrayBuffer>, contentType: string): Promise<string> {
+  return t.run(async (ctx) => {
+    const id = await ctx.storage.store(new Blob([bytes], { type: contentType }))
+    await (ctx.db as unknown as { patch(id: unknown, value: unknown): Promise<void> }).patch(id, { contentType })
+    return id
+  })
+}
+
+/** The digest an uploader declares for `bytes` (the one encoder, `@elytracms/core/ingest`). */
+async function sha256Of(bytes: Uint8Array<ArrayBuffer>): Promise<string> {
+  const digest = await ingestUploadSha256(bytes)
+  if (!digest.ok) throw new Error(digest.message)
+  return digest.sha256
+}
+
+/** An upload intent from the receiver, declaring the file the uploader holds (`bytes`): its type, size and SHA-256. */
+async function declare(t: Backend, bytes: Uint8Array<ArrayBuffer>, contentType: string, size = bytes.byteLength): Promise<string> {
+  const answer = await post(t, { kind: 'upload', target: 'contact', field: 'cv', contentType, size, sha256: await sha256Of(bytes) })
+  expect(answer.status).toBe(200)
+  return ((await answer.json()) as { uploadId: string }).uploadId
+}
+
+const SUBMISSION = {
+  kind: 'submission',
+  target: 'contact',
+  data: { email: 'ec685@example.test', message: 'hi', cv: 'cv.pdf', [FORMS_HONEYPOT_KEY]: '' },
+} as const
+
+const claim = (t: Backend, uploadId: string, storageId: string) => post(t, { ...SUBMISSION, uploads: [{ uploadId, storageId }] })
+
+async function rows(t: Backend): Promise<SubmissionRecord[]> {
+  return (await t.run(async (ctx) => (await ctx.db.query('records').collect()).filter((row) => row.kind === 'submission'))).map(
+    (row) => ({ ...(row.data as object), id: row.recordId }) as unknown as SubmissionRecord,
+  )
+}
+
+const bindings = (t: Backend) =>
+  t.run(async (ctx) =>
+    (await ctx.db.query('records').collect())
+      .filter((row) => row.kind === 'ingestBinding')
+      .map((row) => ({ storageId: row.recordId, uploadId: (row.data as { uploadId: string }).uploadId })),
+  )
+
+/** Whether stored bytes still exist (`storage.get` → a Blob, which is not a Convex value: answer a boolean). */
+const survives = (t: Backend, storageId: string) => t.run(async (ctx) => (await ctx.storage.get(storageId as never)) !== null)
+
+/** A genuine upload, claimed and bound: its own intent, its own bytes. Returns the row and the file. */
+async function genuineSubmission(t: Backend, label: string): Promise<{ rowId: string; file: string }> {
+  const bytes = content(label, 800)
+  const uploadId = await declare(t, bytes, 'application/pdf')
+  const file = await storeFile(t, bytes, 'application/pdf')
+  const answer = await claim(t, uploadId, file)
+  expect(answer.status).toBe(200)
+  return { rowId: ((await answer.json()) as { id: string }).id, file }
+}
+
+/** An editor promotes the submission's file to an asset — `assets:upsert` over the bound storage id (a legitimate edit). */
+async function promote(t: Backend, assetId: string, file: string): Promise<void> {
+  await studio(t).assets.upsertAsset(PROJECT_ID, {
+    id: assetId,
+    filename: `${assetId}.pdf`,
+    contentType: 'application/pdf',
+    byteSize: 800,
+    storageKey: file,
+    url: `https://assets.invalid/${assetId}.pdf`,
+  })
+}
+
+/** The studio's own asset delete (bytes first, through `assets:deleteBlob`; then the row). */
+function deleteAssetInStudio(t: Backend, assetId: string) {
+  const adapter = studio(t)
+  return deleteAsset(
+    { assets: adapter.assets, blobs: adapter.blobs, references: { inbound: async () => [] } },
+    PROJECT_ID,
+    assetId,
+    { confirmInUse: true },
+  )
+}
+
+const assetIds = (t: Backend) => t.run(async (ctx) => (await ctx.db.query('assets').collect()).map((row) => row.assetId))
+
+describe('EC-685 probe (1) — causation: a claim binds only bytes its own intent stored', () => {
+  it('intents A and B issued; bytes stored through B’s URL: A’s claim naming them is refused, B’s claim binds them', async () => {
+    const t = await backend()
+    const victim = content('B: the victim’s own CV', 800)
+    const attacker = content('A: whatever the attacker holds', 800)
+    const a = await declare(t, attacker, 'application/pdf') // A's facts match B's file in type and size…
+    const b = await declare(t, victim, 'application/pdf')
+    const file = await storeFile(t, victim, 'application/pdf') // …and the bytes go through B's URL, after both intents
+    const byA = await claim(t, a, file)
+    expect(byA.status).toBe(422) // base: 200 — A bound B's file (eligibility checks only: after A, unbound, no asset's)
+    expect(await bindings(t)).toEqual([])
+    const byB = await claim(t, b, file)
+    expect(byB.status).toBe(200) // base: 422 — the file was A's binding already
+    expect(await bindings(t)).toEqual([{ storageId: file, uploadId: b }])
+    expect((await rows(t)).map((row) => row.files?.[0]?.storageId)).toEqual([file])
+  })
+
+  it('the claim reads the deployment’s stored digest by its form: convex-test stores BASE64 (measured), the intent declares hex', async () => {
+    const t = await backend()
+    const bytes = content('a CV', 800)
+    const file = await storeFile(t, bytes, 'application/pdf')
+    const stored = await t.run(async (ctx) => ((await ctx.db.system.get(file as never)) as { sha256: string }).sha256)
+    expect(stored).toMatch(/^[A-Za-z0-9+/]{43}=$/) // convex-test 0.0.54 `blobSha`: btoa(…)
+    expect(await sha256Of(bytes)).toMatch(/^[0-9a-f]{64}$/)
+  })
+
+  it('RESIDUAL (named, not closed): bytes an attacker can PREDICT can be declared — A binds them first', async () => {
+    // Causal only for unpredictable bytes: a deterministic file (one an addon generates, a
+    // well-known document) is known before it exists, so its digest can be declared by anyone.
+    const t = await backend()
+    const predictable = content('a template every visitor uploads', 800)
+    const a = await declare(t, predictable, 'application/pdf')
+    const b = await declare(t, predictable, 'application/pdf')
+    const file = await storeFile(t, predictable, 'application/pdf')
+    expect((await claim(t, a, file)).status).toBe(200)
+    expect((await claim(t, b, file)).status).toBe(422) // bound already (check 2)
+    expect(await bindings(t)).toEqual([{ storageId: file, uploadId: a }])
+  })
+
+  it('control: a genuine claim binds (its own intent, its own bytes)', async () => {
+    const t = await backend()
+    const { file } = await genuineSubmission(t, 'a genuine CV')
+    expect((await bindings(t)).map((binding) => binding.storageId)).toEqual([file])
+  })
+})
+
+describe('EC-685 probe (2) — ownership stays true when a delete spends it', () => {
+  it('a claimed, bound file; an asset is upserted over it; the submission is removed: the asset’s file survives', async () => {
+    const t = await backend()
+    const { rowId, file } = await genuineSubmission(t, 'a CV the editor keeps')
+    await promote(t, 'promoted-cv', file)
+    await studio(t).records(submissionRecordKind).remove(PROJECT_ID, rowId)
+    expect(await rows(t)).toEqual([])
+    expect(await survives(t, file)).toBe(true) // base: false — release deleted a file an asset now references
+    expect(await bindings(t)).toEqual([]) // ownership passed to the asset: the binding is spent
+    // …and the asset owns it now: deleting the asset deletes the file.
+    expect(await deleteAssetInStudio(t, 'promoted-cv')).toEqual({ outcome: 'deleted' })
+    expect(await survives(t, file)).toBe(false)
+  })
+
+  it('mirror: the asset is deleted while the binding holds: the submission’s file survives, the asset row goes', async () => {
+    const t = await backend()
+    const { rowId, file } = await genuineSubmission(t, 'a CV the editor un-promotes')
+    await promote(t, 'promoted-cv', file)
+    expect(await deleteAssetInStudio(t, 'promoted-cv')).toEqual({ outcome: 'deleted' })
+    expect(await assetIds(t)).toEqual([])
+    expect(await survives(t, file)).toBe(true) // base: false — deleteBlob deleted bytes an ingest binding holds
+    // …and the submission still owns it: removing the submission deletes the file.
+    await studio(t).records(submissionRecordKind).remove(PROJECT_ID, rowId)
+    expect(await survives(t, file)).toBe(false)
+    expect(await bindings(t)).toEqual([])
+  })
+
+  it('control: a genuine release of an unreferenced bound file deletes it (the instrument sees a deletion)', async () => {
+    const t = await backend()
+    const { rowId, file } = await genuineSubmission(t, 'a CV nobody promoted')
+    expect(await survives(t, file)).toBe(true)
+    await studio(t).records(submissionRecordKind).remove(PROJECT_ID, rowId)
+    expect(await survives(t, file)).toBe(false)
+    expect(await bindings(t)).toEqual([])
+  })
+
+  it('control: an asset nobody bound is deleted with its bytes (the instrument sees deleteBlob delete)', async () => {
+    const t = await backend()
+    const file = await storeFile(t, content('an editor’s own upload', 800), 'application/pdf')
+    await promote(t, 'own-asset', file)
+    expect(await deleteAssetInStudio(t, 'own-asset')).toEqual({ outcome: 'deleted' })
+    expect(await survives(t, file)).toBe(false)
+  })
+})