@jini-ai/cms 0.5.3 → 0.5.4

package/dist/forms/submission-ip-retention.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Submission metadata retention, independent of databases and host scheduling.
+ * Answers and submission identity are never deleted by this maintenance operation.
+ */
+/**
+ * Owner decision 2026-10-04: retain form submitter IPs for 90 days for abuse investigation,
+ * then remove them automatically. Matches the privacy wording: "IP addresses on form
+ * submissions are deleted after 90 days"; this is not expiry of the submission itself.
+ */
+export declare const SUBMISSION_IP_RETENTION_DAYS = 90;
+export interface SubmissionIpRetentionPort {
+    /**
+     * Clear only sourceIp to NULL for at most limit rows submitted at/before the ISO UTC cutoff.
+     * Include all workspaces and Trash rows. Perform one atomic guarded update; return actual
+     * affected rows, excluding already-NULL values. Concurrent passes must be idempotent.
+     */
+    clearExpiredIps(required: {
+        submittedBeforeOrAt: string;
+    }, optional?: {
+        limit?: number;
+    }): Promise<number>;
+}
+/** A complete pass, using bounded updates and one fixed cutoff even across multiple batches. */
+export declare function sweepExpiredSubmissionIps({ now, repo }: {
+    now: number;
+    repo: SubmissionIpRetentionPort;
+}, { batchSize }?: {
+    batchSize?: number;
+}): Promise<number>;
+//# sourceMappingURL=submission-ip-retention.d.ts.map

package/dist/forms/submission-ip-retention.js

@@ -0,0 +1,27 @@
+/**
+ * Submission metadata retention, independent of databases and host scheduling.
+ * Answers and submission identity are never deleted by this maintenance operation.
+ */
+/**
+ * Owner decision 2026-10-04: retain form submitter IPs for 90 days for abuse investigation,
+ * then remove them automatically. Matches the privacy wording: "IP addresses on form
+ * submissions are deleted after 90 days"; this is not expiry of the submission itself.
+ */
+export const SUBMISSION_IP_RETENTION_DAYS = 90;
+/** A complete pass, using bounded updates and one fixed cutoff even across multiple batches. */
+export async function sweepExpiredSubmissionIps({ now, repo }, { batchSize = 500 } = {}) {
+    const cutoff = now - SUBMISSION_IP_RETENTION_DAYS * 24 * 60 * 60 * 1000;
+    if (!Number.isFinite(now) || !Number.isFinite(new Date(cutoff).getTime()))
+        throw new RangeError("submission IP sweep needs a valid timestamp");
+    if (!Number.isSafeInteger(batchSize) || batchSize <= 0)
+        throw new RangeError("submission IP sweep batchSize must be a positive integer");
+    const submittedBeforeOrAt = new Date(cutoff).toISOString();
+    let total = 0;
+    let cleared;
+    do {
+        cleared = await repo.clearExpiredIps({ submittedBeforeOrAt }, { limit: batchSize });
+        total += cleared;
+    } while (cleared === batchSize);
+    return total;
+}
+//# sourceMappingURL=submission-ip-retention.js.map

package/dist/forms/submit-service.d.ts

@@ -0,0 +1,78 @@
+/**
+ * @file `submit-service.ts` — the sole public submission write path (SPEC-010 REQ-05..09/16,
+ * ADR-PIPE-010 C-008).
+ *
+ * Purpose:
+ * `submitForm` deliberately bypasses `executeCommand` (no actor/permission fits an anonymous
+ * visitor — ADR-PIPE-010 Pattern Evaluation); mirrors `routes/site/analytics-ingest.ts`'s
+ * `ingestHit` shape. Order: resolve slug -> honeypot check -> validate -> rate-limit -> persist ->
+ * enqueue `form.submission.received` -> return, WITHOUT awaiting outbox drainage.
+ *
+ * CRITICAL (INV-05/REQ-16/AC-24, tasks.md T023): the package kicks off the bound dispatcher without
+ * awaiting it. An inline route drain may await delivery when its subscribers are cheap; that is
+ * directly unacceptable here, where a subscriber calls `MailerPort.send()`. Copying that pattern
+ * verbatim would silently reintroduce the exact response-blocking bug REQ-16/INV-05 forbid.
+ * Do not await the dispatcher at the submission boundary — see T023/T049 for the standing
+ * Code Review gate on this exact line.
+ *
+ * Double submit (2026-10-05): a double-clicked Send posts the same form twice and the rendered form
+ * ships no script, so the dedupe is server-side — see `submission-attempts.ts` for the attempt token,
+ * its cached/static fallback and why it lives in process memory. Ids are random; the submission row
+ * and its event are written in one transaction, so a failed enqueue leaves nothing a retry could
+ * mistake for a finished submission.
+ */
+import type { Logger } from "@jini-ai/core/primitives";
+import type { RateLimiterPort, FormOutboxPort, OutboxDispatcherPort, SubmissionTransactionPort } from "./ports.js";
+import type { Clock, IdGenerator, UUID } from "@jini-ai/core/primitives";
+import type { FormDefinitionRepoPort, FormSubmissionRepoPort } from "./ports.js";
+import type { FormDefinitionViewPort } from "./ports.js";
+import { type SubmissionAttempts } from "./submission-attempts.js";
+export interface SubmitFormDeps {
+    definitionRepo: FormDefinitionRepoPort;
+    submissionRepo: FormSubmissionRepoPort;
+    outbox: FormOutboxPort;
+    dispatcher: OutboxDispatcherPort;
+    logger: Pick<Logger, 'warn'>;
+    clock: Clock;
+    idGen: IdGenerator;
+    rateLimiter: RateLimiterPort;
+    /** Omitted: the two writes run back to back with no rollback between them. */
+    transaction?: SubmissionTransactionPort;
+}
+export interface SubmitFormInput {
+    workspaceId: UUID;
+    slug: string;
+    body: Record<string, unknown>;
+    sourceIp: string;
+}
+export interface SubmitFormRequired {
+    deps: SubmitFormDeps;
+    input: SubmitFormInput;
+}
+/**
+ * Binds Tovu's outbox delivery to Jini's anonymous submission service. The package awaits the
+ * object-shaped limiter check and queues delivery without awaiting notifications.
+ *
+ * A repeat of an attempt accepted within the window (same token, or for a request without one the
+ * same IP and body) is answered exactly like the original — `accepted` — with no row, no event and
+ * no notification. It still passes the slug, honeypot, validation and rate checks first (and so
+ * consumes a rate-limit slot, as any request does): the attempt is claimed only where the package
+ * opens its persistence transaction, and a copy that must wait for the first copy waits there,
+ * outside any database transaction. The `_attempt` field is removed from the body before
+ * validation; it is never stored.
+ * @returns Accepted for a valid submission, a duplicate, or a honeypot discard; package errors propagate.
+ * @complexity O(f + k) package validation plus O(b log b) attempt hashing; fixed-count persistence
+ * effects, background dispatch.
+ * @example await submitForm({ deps, input: { workspaceId, slug, body, sourceIp } });
+ */
+export declare function submitForm(required: SubmitFormRequired, optional?: SubmitFormOptional): Promise<{
+    status: "accepted";
+}>;
+/** All extensions are opt-in: omitted options preserve the original package submission behavior. */
+export interface SubmitFormOptional {
+    definitionView?: FormDefinitionViewPort;
+    validateEmails?: boolean;
+    dispatch?: OutboxDispatcherPort["dispatch"];
+    attempts?: SubmissionAttempts;
+}
+//# sourceMappingURL=submit-service.d.ts.map

package/dist/forms/submit-service.js

@@ -0,0 +1,109 @@
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
+/** Anonymous submission path: active lookup, honeypot, validation, rate check, persistence + event enqueue in one host transaction, then background dispatch. */
+import { buildFormsRateLimitKey } from "./rate-limit-key.js";
+import { FormDefinitionNotFoundError, FormRateLimitExceededError, FormSubmissionValidationError, } from "./errors.js";
+import { isHoneypotTripped, validateSubmissionPayload } from "./forms.js";
+import { assertSubmissionEmails } from "./submission-email-validation.js";
+import { DUPLICATE_ATTEMPT, FORM_ATTEMPT_FIELD } from "./submission-attempts.js";
+const HONEYPOT_KEY = "_hp";
+// Anonymous visitors have no actor/permission for an administrative command gateway; this public
+// path instead owns validation, throttling and durable submission/event persistence directly.
+/**
+ * Binds Tovu's outbox delivery to Jini's anonymous submission service. The package awaits the
+ * object-shaped limiter check and queues delivery without awaiting notifications.
+ *
+ * A repeat of an attempt accepted within the window (same token, or for a request without one the
+ * same IP and body) is answered exactly like the original — `accepted` — with no row, no event and
+ * no notification. It still passes the slug, honeypot, validation and rate checks first (and so
+ * consumes a rate-limit slot, as any request does): the attempt is claimed only where the package
+ * opens its persistence transaction, and a copy that must wait for the first copy waits there,
+ * outside any database transaction. The `_attempt` field is removed from the body before
+ * validation; it is never stored.
+ * @returns Accepted for a valid submission, a duplicate, or a honeypot discard; package errors propagate.
+ * @complexity O(f + k) package validation plus O(b log b) attempt hashing; fixed-count persistence
+ * effects, background dispatch.
+ * @example await submitForm({ deps, input: { workspaceId, slug, body, sourceIp } });
+ */
+export async function submitForm(required, optional = {}) {
+    const { deps } = required;
+    let attemptToken;
+    let input = required.input;
+    if (optional.attempts) {
+        const { [FORM_ATTEMPT_FIELD]: token, ...body } = input.body;
+        attemptToken = token;
+        input = { ...input, body };
+    }
+    // Missing and disabled slugs are deliberately indistinguishable to public callers.
+    const stored = await deps.definitionRepo.findBySlug({ workspaceId: input.workspaceId, slug: input.slug });
+    const definition = stored && optional.definitionView ? optional.definitionView({ definition: stored, body: input.body }) : stored;
+    if (definition && optional.validateEmails)
+        assertSubmissionEmails({ definition, body: input.body });
+    if (!definition || definition.status !== "active") {
+        throw new FormDefinitionNotFoundError({ message: `form '${input.slug}' was not found` });
+    }
+    // Discard before validation, rate limiting or writes; a bot sees the same accepted response
+    // without consuming capacity or creating a submission/event.
+    if (isHoneypotTripped({ hp: input.body[HONEYPOT_KEY] })) {
+        return { status: "accepted" };
+    }
+    const validation = validateSubmissionPayload({ definition, body: input.body });
+    if (!validation.valid) {
+        throw new FormSubmissionValidationError({ message: "submission failed field validation", fieldErrors: validation.fieldErrors });
+    }
+    // Scope by both IP and form so one client's different forms cannot cross-throttle each other.
+    const rateLimitKey = buildFormsRateLimitKey({ sourceIp: input.sourceIp, formDefinitionId: definition.id });
+    const rateLimitResult = await deps.rateLimiter.check({ key: rateLimitKey });
+    if (!rateLimitResult.allowed) {
+        throw new FormRateLimitExceededError({ message: `rate limit exceeded for form '${definition.id}'`, retryAfterSeconds: rateLimitResult.retryAfterSeconds });
+    }
+    const now = kernelNowIso({ clock: deps.clock });
+    const submissionId = deps.idGen.newId();
+    const submission = {
+        id: submissionId,
+        workspaceId: input.workspaceId,
+        formDefinitionId: definition.id,
+        data: validation.data,
+        sourceIp: input.sourceIp,
+        submittedAt: now,
+    };
+    const event = {
+        id: deps.idGen.newId(),
+        name: "form.submission.received",
+        occurredAt: now,
+        workspaceId: input.workspaceId,
+        aggregateId: submissionId,
+        payload: { workspaceId: input.workspaceId, formDefinitionId: definition.id, submissionId },
+    };
+    // Only a persisted accepted submission gets this event; honeypot discards emit nothing. Row and
+    // event commit together: a failed enqueue must not leave a stored submission nobody is told about.
+    const transaction = deps.transaction ?? ((work) => work());
+    const persist = () => transaction(async () => {
+        await deps.submissionRepo.create(submission);
+        await deps.outbox.enqueue(event);
+    });
+    if (optional.attempts) {
+        // The attempt is claimed only where persistence begins, after validation and rate limiting.
+        // A copy waits outside the database transaction; failed first copies free the claim for retry.
+        const outcome = await optional.attempts.once({
+            key: optional.attempts.key({ input, attemptToken }),
+            nowMs: () => deps.clock.nowMs(),
+            submit: persist,
+        });
+        if (outcome === DUPLICATE_ATTEMPT)
+            return { status: "accepted" };
+    }
+    else {
+        await persist();
+    }
+    // Dispatch failures cannot affect an accepted submission or create an unhandled rejection.
+    // Never await delivery here: a subscriber sends mail, so awaiting it would reintroduce the
+    // response-blocking bug. Persistence/enqueue are awaited; outbox drainage remains background work.
+    void Promise.resolve().then(() => (optional.dispatch ?? deps.dispatcher.dispatch.bind(deps.dispatcher))({})).catch((error) => {
+        try {
+            deps.logger.warn({ message: "form outbox dispatch failed" }, { error });
+        }
+        catch { /* Logging must not reject background work. */ }
+    });
+    return { status: "accepted" };
+}
+//# sourceMappingURL=submit-service.js.map

package/dist/forms/types.d.ts

@@ -0,0 +1,49 @@
+import type { UUID } from "@jini-ai/core/primitives";
+export type FieldType = "text" | "email" | "textarea" | "checkbox";
+export type FormDefinitionStatus = "active" | "disabled";
+export interface FieldDescriptor {
+    id: string;
+    label: string;
+    type: FieldType;
+    required: boolean;
+    maxLength?: number | null;
+    /** Presence distinguishes an authored checkbox value (even "") from the native boolean default. */
+    checkboxValue?: string;
+    /** Length-bounded and HTML-escaped at rendering; class names are inert after escaping. */
+    className?: string;
+    /** Attribute names require a closed allowlist: escaping a name cannot make it safe.
+     * Values remain plain strings and must be HTML-escaped by the renderer. */
+    attributes?: Record<string, string>;
+}
+export interface NotifyConfig {
+    enabled: boolean;
+    recipients: string[];
+}
+export interface FormDefinitionRecord {
+    id: UUID;
+    workspaceId: UUID;
+    name: string;
+    slug: string;
+    fields: FieldDescriptor[];
+    notify: NotifyConfig;
+    status: FormDefinitionStatus;
+    createdAt: string;
+    updatedAt: string;
+    /** Compare-and-set counter for trash transitions; never an admin-editable field.
+     * Every record constructor, including fixtures, must supply it. */
+    version: number;
+}
+export interface FormSubmissionRecord {
+    id: UUID;
+    workspaceId: UUID;
+    formDefinitionId: UUID;
+    data: Record<string, string | boolean>;
+    /** Cleared by metadata retention; answers and the submission itself remain. */
+    sourceIp: string | null;
+    submittedAt: string;
+}
+export interface FormSubmissionPage {
+    items: FormSubmissionRecord[];
+    nextCursor: string | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/forms/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/forms/write-service.d.ts

@@ -0,0 +1,83 @@
+/** Audited definition writes through the CMS command gateway. Host permissions and reserved slugs are explicit policies; notify, idempotency and optional outbox wiring live in the second argument. */
+import type { ChangeSetRepoPort } from "../core/index.js";
+import type { Clock, IdGenerator, UUID } from "@jini-ai/core/primitives";
+import type { AuthorizeFn, CommandActor } from "../core/index.js";
+import type { FormAuthoringPort, FormCommandExecutorPort, FormDefinitionRepoPort } from "./ports.js";
+import type { FieldDescriptor, FormDefinitionRecord, FormDefinitionStatus, NotifyConfig } from "./types.js";
+import type { FormAuthoring } from "./fields-json.js";
+export interface FormWriteServiceDeps {
+    /** Host-bound audited command gateway; no runtime CMS implementation is imported. */
+    executeCommand: FormCommandExecutorPort;
+    repo: FormDefinitionRepoPort;
+    clock: Clock;
+    idGen: IdGenerator;
+    changeSets: ChangeSetRepoPort;
+    permission: string;
+    reservedSlugs: ReadonlySet<string>;
+    authorize: AuthorizeFn;
+}
+export declare const MAX_NOTIFY_RECIPIENTS = 10;
+export declare const SLUG_PATTERN: RegExp;
+export declare const MAX_NAME_LENGTH = 200;
+export interface CreateFormDefinitionRequired {
+    deps: FormWriteServiceDeps;
+    input: {
+        workspaceId: UUID;
+        actor: CommandActor;
+        name: string;
+        slug: string;
+        fields: FieldDescriptor[];
+    } & FormAuthoring;
+}
+/**
+ * All definition writes pass through the injected command gateway for authorization, audit
+ * capture and optional change-set event enqueue. There is no delete here: permanent removal
+ * belongs to a separate trash purge, and the definition repository exposes no delete method.
+ * Slug uniqueness is enforced by the repository's unique index, avoiding a racy pre-insert check;
+ * repository slug-conflict errors propagate unchanged from the mutation.
+ */
+export declare function createFormDefinition(required: CreateFormDefinitionRequired, optional?: CreateFormDefinitionOptional): Promise<{
+    definition: FormDefinitionRecord;
+}>;
+export interface UpdateFormDefinitionRequired {
+    deps: FormWriteServiceDeps;
+    input: {
+        workspaceId: UUID;
+        actor: CommandActor;
+        formId: UUID;
+        patch: {
+            name?: string;
+            fields?: FieldDescriptor[];
+            notify?: NotifyConfig;
+            slug?: string;
+        } & FormAuthoring;
+    };
+}
+export declare function updateFormDefinition(required: UpdateFormDefinitionRequired, optional?: UpdateFormDefinitionOptional): Promise<{
+    definition: FormDefinitionRecord;
+}>;
+export interface SetFormDefinitionStatusRequired {
+    deps: FormWriteServiceDeps;
+    input: {
+        workspaceId: UUID;
+        actor: CommandActor;
+        formId: UUID;
+        status: FormDefinitionStatus;
+    };
+}
+/** Status changes preserve the row; deletion requires the separate trash lifecycle. */
+export declare function setFormDefinitionStatus(required: SetFormDefinitionStatusRequired, optional?: FormWriteOptional): Promise<{
+    definition: FormDefinitionRecord;
+}>;
+export interface FormWriteOptional {
+    idempotencyKey?: string;
+    outbox?: import("../core/index.js").OutboxPort;
+}
+export interface CreateFormDefinitionOptional extends FormWriteOptional {
+    notify?: NotifyConfig;
+    authoring?: FormAuthoringPort;
+}
+export interface UpdateFormDefinitionOptional extends FormWriteOptional {
+    authoring?: FormAuthoringPort;
+}
+//# sourceMappingURL=write-service.d.ts.map

package/dist/forms/write-service.js

@@ -0,0 +1,271 @@
+/**
+ * @file `write-service.ts` — the admin-CRUD write chokepoint (SPEC-010 REQ-01..04, ADR-PIPE-010).
+ *
+ * Purpose:
+ * `createFormDefinition`/`updateFormDefinition`/`setFormDefinitionStatus`, each wrapping the
+ * existing core/commands `executeCommand` gateway (mirrors `posts/create.ts`'s pattern — the
+ * gateway captures the auditable change-set record, authorizes `admin.forms.manage`, and enqueues
+ * `change-set.applied` onto the outbox). Never exposes a delete: a form definition is removed
+ * permanently only by a Trash purge (owner ruling 2026-09-21, superseding the original INV-08
+ * "never deleted" wording) — the repo port itself has no delete method for this file to call.
+ *
+ * Slug-uniqueness relies on the DB unique index (`db/schema.sqlite.ts`), not an app-level check
+ * (behavior.spec.md §6.1) — `repo.memory.ts`/`repo.ts` both map a conflicting insert to
+ * `FormSlugConflictError`, which this file lets propagate unchanged out of `mutation.execute()`.
+ */
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
+import { FormDefinitionNotFoundError, FormFieldValidationError } from "./errors.js";
+import { validateFieldDescriptors } from "./forms.js";
+// Export validation bounds so host tool schemas can share them rather than drift from the service.
+export const MAX_NOTIFY_RECIPIENTS = 10;
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export const SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+const MIN_NAME_LENGTH = 1;
+export const MAX_NAME_LENGTH = 200;
+function defaultNotify() {
+    return { enabled: false, recipients: [] };
+}
+function validateNotify(notify) {
+    const resolved = notify ?? defaultNotify();
+    if (!Array.isArray(resolved.recipients)) {
+        throw new FormFieldValidationError({ message: "notify.recipients must be an array", fieldErrors: [
+                { field: "notify.recipients", reason: "must be an array" },
+            ] });
+    }
+    if (typeof resolved.enabled !== "boolean") {
+        throw new FormFieldValidationError({ message: "notify.enabled must be a boolean", fieldErrors: [
+                { field: "notify.enabled", reason: "must be a boolean" },
+            ] });
+    }
+    if (resolved.recipients.length > MAX_NOTIFY_RECIPIENTS) {
+        throw new FormFieldValidationError({ message: `notify.recipients may not exceed ${MAX_NOTIFY_RECIPIENTS} addresses`, fieldErrors: [{ field: "notify.recipients", reason: `at most ${MAX_NOTIFY_RECIPIENTS} recipients are allowed` }] });
+    }
+    for (const recipient of resolved.recipients) {
+        if (!EMAIL_PATTERN.test(recipient)) {
+            throw new FormFieldValidationError({ message: `'${recipient}' is not a valid email address`, fieldErrors: [
+                    { field: "notify.recipients", reason: `'${recipient}' is not a valid email address` },
+                ] });
+        }
+    }
+    return resolved;
+}
+function validateNameAndSlug(name, slug, reservedSlugs) {
+    if (name.length < MIN_NAME_LENGTH || name.length > MAX_NAME_LENGTH) {
+        throw new FormFieldValidationError({ message: `name must be ${MIN_NAME_LENGTH}-${MAX_NAME_LENGTH} characters`, fieldErrors: [
+                { field: "name", reason: `must be ${MIN_NAME_LENGTH}-${MAX_NAME_LENGTH} characters` },
+            ] });
+    }
+    if (!SLUG_PATTERN.test(slug)) {
+        throw new FormFieldValidationError({ message: "slug must match ^[a-z0-9][a-z0-9-]{0,63}$", fieldErrors: [
+                { field: "slug", reason: "must match ^[a-z0-9][a-z0-9-]{0,63}$" },
+            ] });
+    }
+    if (reservedSlugs.has(slug)) {
+        throw new FormFieldValidationError({ message: `slug '${slug}' is reserved`, fieldErrors: [
+                { field: "slug", reason: `'${slug}' is reserved by the host` },
+            ] });
+    }
+}
+function assertValidFields(fields) {
+    const validation = validateFieldDescriptors({ fields });
+    if (!validation.valid) {
+        throw new FormFieldValidationError({ message: "one or more field descriptors are invalid", fieldErrors: validation.fieldErrors });
+    }
+}
+/**
+ * All definition writes pass through the injected command gateway for authorization, audit
+ * capture and optional change-set event enqueue. There is no delete here: permanent removal
+ * belongs to a separate trash purge, and the definition repository exposes no delete method.
+ * Slug uniqueness is enforced by the repository's unique index, avoiding a racy pre-insert check;
+ * repository slug-conflict errors propagate unchanged from the mutation.
+ */
+export async function createFormDefinition(required, optional = {}) {
+    let { deps, input } = required;
+    if (optional.authoring) {
+        const authored = await optional.authoring.prepare({ deps, input });
+        if (authored) {
+            deps = { ...deps, repo: optional.authoring.with({ repo: deps.repo, authoring: authored }) };
+            input = { ...input, ...(authored.fields ? { fields: authored.fields } : {}) };
+        }
+    }
+    validateNameAndSlug(input.name, input.slug, deps.reservedSlugs);
+    assertValidFields(input.fields);
+    const notify = validateNotify(optional.notify);
+    const definitionId = deps.idGen.newId();
+    const { result } = await deps.executeCommand({
+        deps: {
+            clock: deps.clock,
+            idGen: deps.idGen,
+            changeSets: deps.changeSets,
+            outbox: optional.outbox,
+            authorize: deps.authorize,
+        },
+        command: {
+            workspaceId: input.workspaceId,
+            actor: input.actor,
+            summary: `Create form definition '${input.slug}'`,
+            idempotencyKey: optional.idempotencyKey,
+            permission: deps.permission,
+        },
+        mutation: {
+            entityType: "form_definition",
+            entityId: definitionId,
+            operation: "create",
+            captureInverse: async () => null,
+            execute: async () => {
+                const now = kernelNowIso({ clock: deps.clock });
+                const definition = {
+                    id: definitionId,
+                    workspaceId: input.workspaceId,
+                    name: input.name,
+                    slug: input.slug,
+                    fields: input.fields,
+                    notify,
+                    status: "active",
+                    createdAt: now,
+                    updatedAt: now,
+                    // Start the optimistic-concurrency version at 1 for the trash compare-and-set lifecycle.
+                    version: 1,
+                };
+                await deps.repo.create(definition);
+                return { definition };
+            },
+        },
+    });
+    return result;
+}
+export async function updateFormDefinition(required, optional = {}) {
+    if (optional.authoring)
+        return updateAuthoredFormDefinition(required, optional);
+    const { deps, input } = required;
+    const { result } = await deps.executeCommand({
+        deps: {
+            clock: deps.clock,
+            idGen: deps.idGen,
+            changeSets: deps.changeSets,
+            outbox: optional.outbox,
+            authorize: deps.authorize,
+        },
+        command: {
+            workspaceId: input.workspaceId,
+            actor: input.actor,
+            summary: `Update form definition '${input.formId}'`,
+            idempotencyKey: optional.idempotencyKey,
+            permission: deps.permission,
+        },
+        mutation: {
+            entityType: "form_definition",
+            entityId: input.formId,
+            operation: "update",
+            captureInverse: async () => null,
+            execute: async () => {
+                const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.formId });
+                if (!existing) {
+                    throw new FormDefinitionNotFoundError({ message: `form definition '${input.formId}' was not found` });
+                }
+                const name = input.patch.name !== undefined ? input.patch.name : existing.name;
+                if (input.patch.name !== undefined) {
+                    validateNameAndSlug(name, existing.slug, deps.reservedSlugs);
+                }
+                let fields = existing.fields;
+                if (input.patch.fields !== undefined) {
+                    assertValidFields(input.patch.fields);
+                    const existingIds = new Set(existing.fields.map((f) => f.id));
+                    const newIds = new Set(input.patch.fields.map((f) => f.id));
+                    const missing = [...existingIds].filter((id) => !newIds.has(id));
+                    if (missing.length > 0) {
+                        throw new FormFieldValidationError({ message: `patch omits existing field id(s): ${missing.join(", ")} (behavior.spec.md §1.2)`, fieldErrors: missing.map((id) => ({ field: id, reason: "existing field ids cannot be removed" })) });
+                    }
+                    fields = input.patch.fields;
+                }
+                const notify = input.patch.notify !== undefined ? validateNotify(input.patch.notify) : existing.notify;
+                const definition = {
+                    ...existing,
+                    name,
+                    fields,
+                    notify,
+                    slug: existing.slug,
+                    updatedAt: kernelNowIso({ clock: deps.clock }),
+                };
+                await deps.repo.update(definition);
+                return { definition };
+            },
+        },
+    });
+    return result;
+}
+/** Status changes preserve the row; deletion requires the separate trash lifecycle. */
+export async function setFormDefinitionStatus(required, optional = {}) {
+    const { deps, input } = required;
+    const { result } = await deps.executeCommand({
+        deps: {
+            clock: deps.clock,
+            idGen: deps.idGen,
+            changeSets: deps.changeSets,
+            outbox: optional.outbox,
+            authorize: deps.authorize,
+        },
+        command: {
+            workspaceId: input.workspaceId,
+            actor: input.actor,
+            summary: `Set form definition '${input.formId}' status to '${input.status}'`,
+            idempotencyKey: optional.idempotencyKey,
+            permission: deps.permission,
+        },
+        mutation: {
+            entityType: "form_definition",
+            entityId: input.formId,
+            operation: "update",
+            captureInverse: async () => null,
+            execute: async () => {
+                const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.formId });
+                if (!existing) {
+                    throw new FormDefinitionNotFoundError({ message: `form definition '${input.formId}' was not found` });
+                }
+                const definition = {
+                    ...existing,
+                    status: input.status,
+                    updatedAt: kernelNowIso({ clock: deps.clock }),
+                };
+                await deps.repo.update(definition);
+                return { definition };
+            },
+        },
+    });
+    return result;
+}
+/** Authoring pre-reads are authorized once; the audited gateway replays that decision.
+ * @complexity O(f + h) authoring/validation, with fixed-count repository and command calls. */
+async function updateAuthoredFormDefinition({ deps, input }, optional) {
+    // Authorize BEFORE the authoring pre-read below, so a denied caller is refused before any
+    // lookup and the refusal never discloses whether the form exists (5e9f338f6 put the read
+    // first). The gateway then replays this one decision instead of evaluating a second time —
+    // ADR-021 §2 "one evaluator". Its only authorize() caller is executeCommand's single gate,
+    // pinned to FORMS_PERMISSION by packageDeps; prepareFormAuthoring keeps the real authorize.
+    const decision = await deps.authorize({
+        principalId: input.actor.id,
+        permission: deps.permission,
+        workspaceId: input.workspaceId,
+        entityType: "form_definition",
+        entityId: input.formId,
+    });
+    const gatewayDeps = { ...deps, authorize: async () => decision };
+    const { mode, html, ...builderPatch } = input.patch;
+    const { authoring, ...writeOptions } = optional;
+    // Denied: skip the pre-read entirely; the gateway throws its own ForbiddenError.
+    if (!decision.allowed) {
+        return updateFormDefinition({ deps: gatewayDeps, input: { ...input, patch: builderPatch } }, writeOptions);
+    }
+    const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.formId });
+    const authored = await authoring.prepare({
+        deps, input: { workspaceId: input.workspaceId, actor: input.actor, ...input.patch }, ...(existing ? { existing } : {}),
+    });
+    const boundDeps = authored ? {
+        ...gatewayDeps,
+        repo: authoring.with({ repo: deps.repo, authoring: authored }, { replaceFields: authored.mode === "html" || (existing?.mode === "html" && input.patch.fields !== undefined) }),
+    } : gatewayDeps;
+    return updateFormDefinition({
+        deps: boundDeps, input: { ...input, patch: { ...builderPatch, ...(authored?.fields ? { fields: authored.fields } : {}) } },
+    }, writeOptions);
+}
+//# sourceMappingURL=write-service.js.map