@jini-ai/cms 0.5.3 → 0.5.4

package/dist/forms/index.js

@@ -0,0 +1,17 @@
+export * from "./types.js";
+export * from "./ports.js";
+export * from "./errors.js";
+export * from "./forms.js";
+export * from "./rate-limit-key.js";
+export * from "./write-service.js";
+export * from "./submit-service.js";
+export * from "./notify-subscriber.js";
+export * from "./submission-ip-retention.js";
+export * from "./fields-json.js";
+export * from "./html-render.js";
+export * from "./submission-attempts.js";
+export * from "./submission-email-validation.js";
+export * from "./delete-submission.js";
+export * from "./duplicate-slug.js";
+export * from "./repo.memory.js";
+//# sourceMappingURL=index.js.map

package/dist/forms/notify-subscriber.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @file `registerFormNotifySubscriber` — the Forms-owned outbox subscriber (SPEC-010 REQ-12,
+ * ADR-PIPE-010 C-009).
+ *
+ * Purpose:
+ * Subscribes `form.submission.received`; on a notify-enabled definition, calls `MailerPort.send()`
+ * per configured recipient. The one piece of Forms-owned business logic riding the outbox — kept
+ * separate from the webhook-fanout forwarding (which is not Forms-owned logic; see
+ * `server/app.ts`'s wiring). A send failure (thrown or `{ ok: false }`) is logged, never thrown
+ * back into `EventBusPort.publish()`'s subscriber loop (`core/events/memory-bus.ts`'s `publish`
+ * does not catch handler errors itself — a subscriber that fails to catch its own errors would
+ * break every OTHER subscriber to the same event, including the webhook fan-out).
+ *
+ * Deliberately duplicates the `'form.submission.received'` topic-name literal rather than
+ * importing it from `./manifest` — see `types.ts`'s file header for why domain code never reads
+ * the manifest back.
+ */
+import type { Logger } from "@jini-ai/core/primitives";
+/** Notification subscriber with host sender, mail and logging ports. Each recipient receives a stable per-submission dedup key; delivery and repository failures never block sibling subscribers. */
+import type { EventBusPort } from "../core/index.js";
+import type { MailerPort, EmailAddress } from "./ports.js";
+import type { FormDefinitionRepoPort, FormSubmissionRepoPort } from "./ports.js";
+export interface RegisterFormNotifySubscriberDeps {
+    bus: EventBusPort;
+    sender: EmailAddress;
+    logger: Pick<Logger, 'warn'>;
+    mailer: MailerPort;
+    formDefinitionRepo: FormDefinitionRepoPort;
+    formSubmissionRepo: FormSubmissionRepoPort;
+}
+export declare function registerFormNotifySubscriber(deps: RegisterFormNotifySubscriberDeps, _optional?: Record<string, never>): Promise<() => Promise<void>>;
+//# sourceMappingURL=notify-subscriber.d.ts.map

package/dist/forms/notify-subscriber.js

@@ -0,0 +1,60 @@
+// Domain behavior owns its event contract; reading a host manifest back would invert dependency flow.
+const FORM_SUBMISSION_RECEIVED_TOPIC = "form.submission.received";
+export async function registerFormNotifySubscriber(deps, _optional = {}) {
+    return deps.bus.subscribe({ eventName: FORM_SUBMISSION_RECEIVED_TOPIC,
+        handler: async (event) => {
+            try {
+                const { workspaceId, formDefinitionId, submissionId } = event.payload;
+                const definition = await deps.formDefinitionRepo.findById({ workspaceId, id: formDefinitionId });
+                if (!definition || !definition.notify.enabled || definition.notify.recipients.length === 0) {
+                    return;
+                }
+                const submission = await deps.formSubmissionRepo.findById({ workspaceId, id: submissionId });
+                if (!submission)
+                    return;
+                for (const recipient of definition.notify.recipients) {
+                    try {
+                        const result = await deps.mailer.send({
+                            message: {
+                                workspaceId,
+                                to: { email: recipient },
+                                from: deps.sender,
+                                subject: `New submission: ${definition.name}`,
+                                text: JSON.stringify(submission.data),
+                            },
+                            options: {
+                                // Include the recipient so a shared dedup ledger never suppresses a sibling send.
+                                idempotencyKey: `forms:notify:${submissionId}:${recipient}`,
+                                workspaceId,
+                                sourceContext: { module: "forms", ref: formDefinitionId },
+                                purpose: "transactional",
+                                // Background notifications use the host mailer's durable-outbox readiness gate,
+                                // rather than the interactive send lane, when production delivery requires it.
+                                lane: "notification",
+                            }
+                        });
+                        if (!result.ok) {
+                            warn(deps.logger, `[forms:notify] mail send failed for submission '${submissionId}' recipient '${recipient}': ${result.errorCode} (${result.message})`);
+                        }
+                    }
+                    catch (err) {
+                        // A send failure is terminal for this delivery: log, never retry inline or alter
+                        // the persisted submission, and continue so the other recipients can still receive it.
+                        warn(deps.logger, `[forms:notify] mail send threw for submission '${submissionId}' recipient '${recipient}':`, err);
+                    }
+                }
+            }
+            catch (err) {
+                // Repository failures must not escape the bus's subscriber loop and break sibling handlers.
+                warn(deps.logger, "[forms:notify] subscriber failed:", err);
+            }
+        } });
+}
+/** Failure reporting is isolated too: a logger cannot interrupt sibling event subscribers. */
+function warn(logger, message, error) {
+    try {
+        logger.warn({ message }, error === undefined ? {} : { error });
+    }
+    catch { /* Host logging failure is terminal. */ }
+}
+//# sourceMappingURL=notify-subscriber.js.map

package/dist/forms/ports.d.ts

@@ -0,0 +1,168 @@
+/** Forms persistence and outbound effect contracts. Concrete repositories, HTTP routing, tool wiring and transport implementations belong to consumers. */
+import type { UUID } from "@jini-ai/core/primitives";
+import type { FormDefinitionRecord, FormSubmissionPage, FormSubmissionRecord } from "./types.js";
+/** Definitions and submissions have distinct lifecycles and therefore separate ports.
+ * Deletion belongs to the host's Trash/purge workflow, so neither persistence port exposes delete.
+ * Reads must hide trashed rows at the repository boundary: public submitters, widget resolvers
+ * and other direct consumers must get not-found even if they forget an additional domain filter. */
+export interface FormDefinitionRepoPort {
+    /** Reads and updates expose only live records; a trashed row still reserves its slug. */
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<FormDefinitionRecord | null>;
+    findBySlug(required: {
+        workspaceId: UUID;
+        slug: string;
+    }): Promise<FormDefinitionRecord | null>;
+    list(required: {
+        workspaceId: UUID;
+    }): Promise<FormDefinitionRecord[]>;
+    /** The database unique index is the tie-break for (workspaceId, slug); callers translate collisions.
+     * A trashed row retains its slug so restoring it is lossless, and can therefore still conflict. */
+    create(record: FormDefinitionRecord): Promise<void>;
+    /** Update only a live row, affecting zero rows if it was trashed meanwhile. Only Trash restore
+     * may revive it. Keep create/update separate so genuine insert uniqueness races remain visible. */
+    update(record: FormDefinitionRecord): Promise<void>;
+    /** Deliberately trash-blind: both live and trashed rows reserve a slug. Duplication must not
+     * propose a trashed slug as available and then collide with the database unique index. */
+    isSlugTaken(required: {
+        workspaceId: UUID;
+        slug: string;
+    }): Promise<boolean>;
+}
+export interface FormSubmissionRepoPort {
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<FormSubmissionRecord | null>;
+    create(record: FormSubmissionRecord): Promise<void>;
+    /** Optional repository-owned transaction. Hosts may instead bind a wider unit of work. */
+    transaction?: SubmissionTransactionPort;
+    /** Newest first, submittedAt descending then id descending for ties. The opaque cursor resumes
+     * after the last returned row; callers validate limit (1..100) before reaching persistence. */
+    listByDefinition(required: {
+        workspaceId: UUID;
+        formDefinitionId: UUID;
+        limit: number;
+    }, optional?: {
+        cursor?: string | null;
+    }): Promise<FormSubmissionPage>;
+}
+export interface RateLimiterPort {
+    check(required: {
+        key: string;
+    }): {
+        allowed: true;
+    } | {
+        allowed: false;
+        retryAfterSeconds: number;
+    } | Promise<{
+        allowed: true;
+    } | {
+        allowed: false;
+        retryAfterSeconds: number;
+    }>;
+}
+export interface FormOutboxPort {
+    enqueue(event: import("../core/index.js").DomainEvent): Promise<void>;
+}
+/**
+ * Runs `work` as one unit of persistence: commit when it resolves, roll back when it throws. A host
+ * binds its database transaction here so an accepted submission's row and its outbox event are
+ * written together; a submission stored without its event would never notify anyone.
+ */
+export type SubmissionTransactionPort = <T>(work: () => Promise<T>) => Promise<T>;
+/** Bound to the host's outbox/bus/clock; dispatch is kicked off without awaiting delivery. */
+export interface OutboxDispatcherPort {
+    dispatch(required: Record<string, never>): Promise<void>;
+}
+export interface EmailAddress {
+    email: string;
+    name?: string;
+}
+export interface OutboundEmail {
+    workspaceId: UUID;
+    to: EmailAddress;
+    from: EmailAddress;
+    subject: string;
+    text: string;
+}
+export interface MailerSendOptions {
+    idempotencyKey: string;
+    workspaceId: UUID;
+    sourceContext: {
+        module: string;
+        ref: string;
+    };
+    purpose: "transactional";
+    lane: "notification";
+}
+export type MailerSendResult = {
+    ok: true;
+    providerMessageId: string;
+    acceptedAt: string;
+} | {
+    ok: false;
+    retryable: boolean;
+    errorCode: string;
+    message: string;
+};
+export interface MailerPort {
+    send(required: {
+        message: OutboundEmail;
+        options: MailerSendOptions;
+    }): Promise<MailerSendResult>;
+}
+/** Generic audited mutation contract supplied by the host composition root. */
+export type FormCommandExecutorPort = typeof import("../core/index.js").executeCommand;
+/** Authoring stays behind a port so the universal write service never loads an HTML parser. */
+export interface FormAuthoringPort {
+    prepare(required: {
+        deps: Pick<import("./write-service.js").FormWriteServiceDeps, "authorize">;
+        input: import("./fields-json.js").FormAuthoring & {
+            workspaceId: string;
+            actor: {
+                id: string;
+            };
+        };
+        existing?: import("./fields-json.js").HtmlFormDefinitionRecord;
+    }, optional?: Record<string, never>): Promise<(import("./fields-json.js").FormAuthoring & {
+        fields?: FormDefinitionRecord["fields"];
+    }) | undefined>;
+    with(required: {
+        repo: FormDefinitionRepoPort;
+        authoring: import("./fields-json.js").FormAuthoring & {
+            fields?: FormDefinitionRecord["fields"];
+        };
+    }, optional?: {
+        replaceFields?: boolean;
+    }): FormDefinitionRepoPort;
+}
+/** A submission-only view; never changes the durable definition's descriptors. */
+export type FormDefinitionViewPort = (required: {
+    definition: FormDefinitionRecord;
+    body: Record<string, unknown>;
+}, optional?: Record<string, never>) => FormDefinitionRecord;
+/** Host-bound Trash removal; only the host's purge lifecycle permanently deletes rows. */
+export type RemoveFormSubmissionFn = (required: {
+    workspaceId: UUID;
+    id: UUID;
+    display: {
+        title: string;
+        subtitle?: string | null;
+    };
+    at: string;
+    expectedVersion: number | null;
+    actor: {
+        principalId: string;
+        pluginId?: string | null;
+    };
+}) => Promise<{
+    ok: true;
+    version: number | null;
+} | {
+    ok: false;
+    reason: "not-found" | "version-changed";
+}>;
+//# sourceMappingURL=ports.d.ts.map

package/dist/forms/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/forms/rate-limit-key.d.ts

@@ -0,0 +1,8 @@
+/** Builds a per-source, per-form key; rate-limit windows and quotas belong to the host. */
+/** Include the form id so a visitor submitting to two forms from the same IP is never
+ * cross-throttled by the other form's submissions. */
+export declare function buildFormsRateLimitKey({ sourceIp, formDefinitionId }: {
+    sourceIp: string;
+    formDefinitionId: string;
+}): string;
+//# sourceMappingURL=rate-limit-key.d.ts.map

package/dist/forms/rate-limit-key.js

@@ -0,0 +1,7 @@
+/** Builds a per-source, per-form key; rate-limit windows and quotas belong to the host. */
+/** Include the form id so a visitor submitting to two forms from the same IP is never
+ * cross-throttled by the other form's submissions. */
+export function buildFormsRateLimitKey({ sourceIp, formDefinitionId }) {
+    return `${sourceIp}:${formDefinitionId}`;
+}
+//# sourceMappingURL=rate-limit-key.js.map

package/dist/forms/repo.memory.d.ts

@@ -0,0 +1,120 @@
+import type { UUID } from "@jini-ai/core/primitives";
+import type { FormDefinitionRepoPort, FormSubmissionRepoPort } from "./ports.js";
+import type { FormDefinitionRecord, FormSubmissionPage, FormSubmissionRecord } from "./types.js";
+/**
+ * @file In-memory adapters for `forms` (rule-of-two half #1, ADR-006).
+ *
+ * Purpose:
+ * Test/dev-default implementations of `FormDefinitionRepoPort`/`FormSubmissionRepoPort`. Emulates
+ * the real DB unique index on `(workspaceId, slug)` (behavior.spec.md §6.1) so `create` throws the
+ * same `FormSlugConflictError` shape a `repo.sqlite.ts` unique-constraint violation would map to —
+ * write-service.ts's error handling is identical against either adapter.
+ *
+ * `InMemoryFormDefinitionRepo` stores `deletedAt` internally (mirroring `form_definitions.deleted_at`,
+ * owner ruling 2026-09-21) but never returns it through `FormDefinitionRepoPort` — those methods are
+ * trash-aware and fail-closed, same as `repo.sqlite.ts`'s `isNull(deletedAt)` reads. `findAnyById`/
+ * `save`/`hardDelete` are the deliberate, memory-ONLY exception: a trash-blind seam for the hermetic
+ * composition's `createRecordStoreTrashAdapter` (`@jini-ai/cms/trash`), which
+ * needs to see and flip a hidden row directly. They are not part of `FormDefinitionRepoPort`.
+ */
+/** Internal storage shape — the one place in this file allowed to know about `deletedAt`. */
+interface StoredFormDefinition extends FormDefinitionRecord {
+    deletedAt: string | null;
+}
+export declare class InMemoryFormDefinitionRepo implements FormDefinitionRepoPort {
+    private readonly rows;
+    /** Trash-aware: never returns a row with `deletedAt` set. */
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<FormDefinitionRecord | null>;
+    /** Trash-aware: never returns a row with `deletedAt` set. */
+    findBySlug(required: {
+        workspaceId: UUID;
+        slug: string;
+    }): Promise<FormDefinitionRecord | null>;
+    /** Trash-aware: never lists a row with `deletedAt` set. */
+    list(required: {
+        workspaceId: UUID;
+    }): Promise<FormDefinitionRecord[]>;
+    create(record: FormDefinitionRecord): Promise<void>;
+    /**
+     * Update-only path for a LIVE row. A stale in-hand copy of a row that has since been trashed is
+     * silently a no-op (mirrors `repo.sqlite.ts`'s `isNull(deletedAt)` WHERE guard) — it can never
+     * clear a marker it never knew was set. A record with no existing row at all is still accepted
+     * (pre-existing behavior of this in-memory double, unrelated to trashing).
+     */
+    update(record: FormDefinitionRecord): Promise<void>;
+    /** Trash-BLIND — see `ports.ts`'s doc for why this is the one deliberate exception. */
+    isSlugTaken(required: {
+        workspaceId: UUID;
+        slug: string;
+    }): Promise<boolean>;
+    /**
+     * Trash-BLIND — memory-only, NOT part of `FormDefinitionRepoPort`. The hermetic composition's
+     * `createRecordStoreTrashAdapter` reads through this to flip `deletedAt` directly, the same way
+     * the real adapter reads columns without going through the trash-aware port reads.
+     */
+    findAnyById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<StoredFormDefinition | null>;
+    /** Trash-BLIND write — memory-only, NOT part of `FormDefinitionRepoPort`. See `findAnyById`'s doc. */
+    save(record: StoredFormDefinition): Promise<void>;
+    /** Memory-only, NOT part of `FormDefinitionRepoPort`. Removes only the definition row — the
+     *  composition root pairs this with `InMemoryFormSubmissionRepo.deleteAllForDefinition` the same
+     *  way `features/trash/adapters/form.ts` deletes submissions before the definition. */
+    hardDelete(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<void>;
+}
+/** A stored submission: the port's record plus the two Trash columns only the Trash touches. */
+export interface StoredFormSubmission extends FormSubmissionRecord {
+    deletedAt: string | null;
+    version: number;
+}
+export declare class InMemoryFormSubmissionRepo implements FormSubmissionRepoPort {
+    private readonly rows;
+    private turn;
+    /** Trash-aware, like `repo.sqlite.ts`: a trashed submission reads as missing. */
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<FormSubmissionRecord | null>;
+    create(record: FormSubmissionRecord): Promise<void>;
+    /** Rolls this repo's rows back when `work` throws, as the SQL adapter's transaction does. Calls
+     *  take turns (as the SQLite kernel's do) so one rollback cannot erase another call's row; a
+     *  nested call would wait on itself. Other in-memory stores (the outbox) are not covered.
+     *  @complexity O(n) snapshot of the stored rows. */
+    transaction<T>(work: () => Promise<T>): Promise<T>;
+    listByDefinition(required: {
+        workspaceId: UUID;
+        formDefinitionId: UUID;
+        limit: number;
+    }, optional?: {
+        cursor?: string | null;
+    }): Promise<FormSubmissionPage>;
+    /** Trash-BLIND — memory-only, NOT part of `FormSubmissionRepoPort`. The hermetic composition's
+     *  record-store `TrashAdapter` reads and writes the marker through these three, the way the real
+     *  adapter reads columns without going through the trash-aware port reads. */
+    findAnyById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<StoredFormSubmission | null>;
+    /** Trash-BLIND write — see `findAnyById`. */
+    save(record: StoredFormSubmission): Promise<void>;
+    /** Trash-BLIND purge — see `findAnyById`. */
+    hardDelete(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }): Promise<void>;
+    /** Memory-only, NOT part of `FormSubmissionRepoPort`. Bulk cascade for a form purge — see
+     *  `InMemoryFormDefinitionRepo.hardDelete`'s doc for why the composition root pairs the two. */
+    deleteAllForDefinition(required: {
+        workspaceId: UUID;
+        formDefinitionId: UUID;
+    }): Promise<void>;
+}
+export {};
+//# sourceMappingURL=repo.memory.d.ts.map

package/dist/forms/repo.memory.js

@@ -0,0 +1,188 @@
+// The local trash fork was removed; @jini-ai/cms/trash owns the shared adapter/hooks.
+import { encodeKeysetCursor } from "../core/keyset-cursor.js";
+import { FormSlugConflictError } from "./errors.js";
+function cloneStored(row) {
+    return {
+        ...row,
+        fields: row.fields.map((f) => ({ ...f })),
+        notify: { ...row.notify, recipients: [...row.notify.recipients] },
+    };
+}
+/** Strips the internal-only `deletedAt` before a row crosses `FormDefinitionRepoPort`'s boundary. */
+function toPublicRecord(row) {
+    const { deletedAt: _deletedAt, ...record } = cloneStored(row);
+    return record;
+}
+export class InMemoryFormDefinitionRepo {
+    rows = new Map();
+    /** Trash-aware: never returns a row with `deletedAt` set. */
+    async findById(required) {
+        const row = this.rows.get(required.id);
+        if (!row || row.workspaceId !== required.workspaceId || row.deletedAt !== null)
+            return null;
+        return toPublicRecord(row);
+    }
+    /** Trash-aware: never returns a row with `deletedAt` set. */
+    async findBySlug(required) {
+        for (const row of this.rows.values()) {
+            if (row.workspaceId === required.workspaceId && row.slug === required.slug && row.deletedAt === null) {
+                return toPublicRecord(row);
+            }
+        }
+        return null;
+    }
+    /** Trash-aware: never lists a row with `deletedAt` set. */
+    async list(required) {
+        return [...this.rows.values()]
+            .filter((row) => row.workspaceId === required.workspaceId && row.deletedAt === null)
+            .map(toPublicRecord);
+    }
+    async create(record) {
+        const conflicting = [...this.rows.values()].find((row) => row.workspaceId === record.workspaceId && row.slug === record.slug);
+        if (conflicting) {
+            // Trash-blind, deliberately — see `ports.ts`'s doc on `create` for why a trashed row still
+            // conflicts, and `repo.sqlite.ts`'s identical message for why the two adapters must agree.
+            const message = conflicting.deletedAt !== null
+                ? `a form with slug '${record.slug}' is in the Trash — restore it, or delete it permanently from the Trash, to reuse the slug`
+                : `a form with slug '${record.slug}' already exists`;
+            throw new FormSlugConflictError({ message, slug: record.slug });
+        }
+        this.rows.set(record.id, { ...cloneStored({ ...record, deletedAt: null }) });
+    }
+    /**
+     * Update-only path for a LIVE row. A stale in-hand copy of a row that has since been trashed is
+     * silently a no-op (mirrors `repo.sqlite.ts`'s `isNull(deletedAt)` WHERE guard) — it can never
+     * clear a marker it never knew was set. A record with no existing row at all is still accepted
+     * (pre-existing behavior of this in-memory double, unrelated to trashing).
+     */
+    async update(record) {
+        const existing = this.rows.get(record.id);
+        if (existing && existing.deletedAt !== null)
+            return;
+        this.rows.set(record.id, cloneStored({ ...record, deletedAt: existing?.deletedAt ?? null }));
+    }
+    /** Trash-BLIND — see `ports.ts`'s doc for why this is the one deliberate exception. */
+    async isSlugTaken(required) {
+        for (const row of this.rows.values()) {
+            if (row.workspaceId === required.workspaceId && row.slug === required.slug)
+                return true;
+        }
+        return false;
+    }
+    /**
+     * Trash-BLIND — memory-only, NOT part of `FormDefinitionRepoPort`. The hermetic composition's
+     * `createRecordStoreTrashAdapter` reads through this to flip `deletedAt` directly, the same way
+     * the real adapter reads columns without going through the trash-aware port reads.
+     */
+    async findAnyById(required) {
+        const row = this.rows.get(required.id);
+        if (!row || row.workspaceId !== required.workspaceId)
+            return null;
+        return cloneStored(row);
+    }
+    /** Trash-BLIND write — memory-only, NOT part of `FormDefinitionRepoPort`. See `findAnyById`'s doc. */
+    async save(record) {
+        this.rows.set(record.id, cloneStored(record));
+    }
+    /** Memory-only, NOT part of `FormDefinitionRepoPort`. Removes only the definition row — the
+     *  composition root pairs this with `InMemoryFormSubmissionRepo.deleteAllForDefinition` the same
+     *  way `features/trash/adapters/form.ts` deletes submissions before the definition. */
+    async hardDelete(required) {
+        const row = this.rows.get(required.id);
+        if (row && row.workspaceId === required.workspaceId) {
+            this.rows.delete(required.id);
+        }
+    }
+}
+function cloneSubmission(row) {
+    return { ...row, data: { ...row.data } };
+}
+/** The port's view of a stored row: the Trash columns stay inside this adapter. */
+function toSubmissionRecord(row) {
+    const { deletedAt: _deletedAt, version: _version, ...record } = row;
+    return { ...record, data: { ...record.data } };
+}
+export class InMemoryFormSubmissionRepo {
+    rows = new Map();
+    turn = Promise.resolve();
+    /** Trash-aware, like `repo.sqlite.ts`: a trashed submission reads as missing. */
+    async findById(required) {
+        const row = this.rows.get(required.id);
+        if (!row || row.workspaceId !== required.workspaceId || row.deletedAt !== null)
+            return null;
+        return toSubmissionRecord(row);
+    }
+    async create(record) {
+        this.rows.set(record.id, { ...record, data: { ...record.data }, deletedAt: null, version: 1 });
+    }
+    /** Rolls this repo's rows back when `work` throws, as the SQL adapter's transaction does. Calls
+     *  take turns (as the SQLite kernel's do) so one rollback cannot erase another call's row; a
+     *  nested call would wait on itself. Other in-memory stores (the outbox) are not covered.
+     *  @complexity O(n) snapshot of the stored rows. */
+    transaction(work) {
+        const run = this.turn.then(async () => {
+            const snapshot = new Map(this.rows);
+            try {
+                return await work();
+            }
+            catch (error) {
+                this.rows.clear();
+                for (const [id, row] of snapshot)
+                    this.rows.set(id, row);
+                throw error;
+            }
+        });
+        this.turn = run.catch(() => undefined);
+        return run;
+    }
+    async listByDefinition(required, optional = {}) {
+        const all = [...this.rows.values()]
+            .filter((row) => row.workspaceId === required.workspaceId &&
+            row.formDefinitionId === required.formDefinitionId &&
+            row.deletedAt === null)
+            // Newest-first (behavior.spec.md §2.1): submittedAt desc, id desc tie-break.
+            .sort((a, b) => {
+            if (a.submittedAt !== b.submittedAt)
+                return b.submittedAt.localeCompare(a.submittedAt);
+            return b.id.localeCompare(a.id);
+        });
+        // Keep the published id cursor (unknown ids restart at the first page). Internally the
+        // shared keyset owner identifies a position by its timestamp and id, without another codec.
+        const cursorRow = optional.cursor ? all.find((row) => row.id === optional.cursor) : undefined;
+        const position = cursorRow ? encodeKeysetCursor({ createdAt: cursorRow.submittedAt, id: cursorRow.id }) : undefined;
+        const startIndex = position
+            ? all.findIndex((row) => encodeKeysetCursor({ createdAt: row.submittedAt, id: row.id }) === position) + 1
+            : 0;
+        const page = all.slice(startIndex, startIndex + required.limit);
+        const nextCursor = startIndex + required.limit < all.length ? page[page.length - 1]?.id ?? null : null;
+        return { items: page.map(toSubmissionRecord), nextCursor };
+    }
+    /** Trash-BLIND — memory-only, NOT part of `FormSubmissionRepoPort`. The hermetic composition's
+     *  record-store `TrashAdapter` reads and writes the marker through these three, the way the real
+     *  adapter reads columns without going through the trash-aware port reads. */
+    async findAnyById(required) {
+        const row = this.rows.get(required.id);
+        return row && row.workspaceId === required.workspaceId ? cloneSubmission(row) : null;
+    }
+    /** Trash-BLIND write — see `findAnyById`. */
+    async save(record) {
+        this.rows.set(record.id, cloneSubmission(record));
+    }
+    /** Trash-BLIND purge — see `findAnyById`. */
+    async hardDelete(required) {
+        const row = this.rows.get(required.id);
+        if (row && row.workspaceId === required.workspaceId) {
+            this.rows.delete(required.id);
+        }
+    }
+    /** Memory-only, NOT part of `FormSubmissionRepoPort`. Bulk cascade for a form purge — see
+     *  `InMemoryFormDefinitionRepo.hardDelete`'s doc for why the composition root pairs the two. */
+    async deleteAllForDefinition(required) {
+        for (const [id, row] of this.rows) {
+            if (row.workspaceId === required.workspaceId && row.formDefinitionId === required.formDefinitionId) {
+                this.rows.delete(id);
+            }
+        }
+    }
+}
+//# sourceMappingURL=repo.memory.js.map

package/dist/forms/sql/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./tables.js";
+export * from "./repo.js";
+export * from "./repo.rows.js";
+export * from "./submission-ip-retention-repo.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/forms/sql/index.js

@@ -0,0 +1,5 @@
+export * from "./tables.js";
+export * from "./repo.js";
+export * from "./repo.rows.js";
+export * from "./submission-ip-retention-repo.js";
+//# sourceMappingURL=index.js.map