@kelpie/server 0.1.0

package/dist/modules/decisions/tools.js

@@ -0,0 +1,32 @@
+import { RECORD_TARGET_TYPES } from '@kelpie/schemas';
+import { z } from 'zod';
+import { idArg, idSetArg, listWindowShape, registerCrudTools, termArg, toSet } from '../crudTools.js';
+import { createBody, decisionResponse, toCreateInput, toUpdateInput, updateBody } from './routes.js';
+/** `decisions_*`. Same schemas and mappers as `/v1/decisions`. */
+const listArgs = z.strictObject({
+    ...listWindowShape,
+    q: termArg,
+    target_type: z.enum(RECORD_TARGET_TYPES).optional().describe('Decisions on this kind of record.'),
+    target_id: idSetArg.optional().describe('The decisions on these records.'),
+});
+export function registerDecisionsTools(mcp, service) {
+    registerCrudTools(mcp, {
+        resource: 'decisions',
+        subject: 'decision',
+        about: 'A commitment this company has already made. Read the open ones before proposing ' +
+            'anything; contradicting one is worse than saying nothing.',
+        service,
+        render: decisionResponse,
+        listArgs,
+        toFilters: (args) => ({
+            term: args.q,
+            targetType: args.target_type,
+            targetIds: toSet(args.target_id),
+        }),
+        createArgs: createBody,
+        toCreateInput,
+        updateArgs: updateBody.extend({ id: idArg }),
+        toUpdateInput,
+    });
+}
+//# sourceMappingURL=tools.js.map

package/dist/modules/decisions/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/modules/decisions/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAA;AACrG,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGpG,kEAAkE;AAElE,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9B,GAAG,eAAe;IAClB,CAAC,EAAE,OAAO;IACV,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IACjG,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;CAC3E,CAAC,CAAA;AAEF,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,OAAyB;IACpF,iBAAiB,CAAC,GAAG,EAAE;QACrB,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,UAAU;QACnB,KAAK,EACH,kFAAkF;YAClF,2DAA2D;QAC7D,OAAO;QACP,MAAM,EAAE,gBAAgB;QACxB,QAAQ;QACR,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACpB,IAAI,EAAE,IAAI,CAAC,CAAC;YACZ,UAAU,EAAE,IAAI,CAAC,WAAW;YAC5B,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;SACjC,CAAC;QACF,UAAU,EAAE,UAAU;QACtB,aAAa;QACb,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAC5C,aAAa;KACd,CAAC,CAAA;AACJ,CAAC"}

package/dist/modules/forms/embed.d.ts

@@ -0,0 +1,50 @@
+import type { FormFieldRecord, FormRecord } from './repository.ts';
+/**
+ * Escapes text for both element content and quoted attribute values.
+ *
+ * Every value a form author typed reaches this page, so a label of
+ * `"><script>…` would otherwise be a stored cross-site scripting hole against
+ * whoever embeds the form. One function for both positions because the set of
+ * characters that break out of either is the same.
+ */
+export declare function escapeHtml(text: string): string;
+export interface EmbedPageOptions {
+    readonly form: FormRecord;
+    readonly fields: readonly FormFieldRecord[];
+    /** Absolute URL of the public submit endpoint this page posts to. */
+    readonly submitUrl: string;
+    /** Per-response value tying the inline style and script to the CSP header. */
+    readonly nonce: string;
+}
+/**
+ * The whole page, as one document.
+ *
+ * A paused form still renders. Somebody visiting the page a customer's site
+ * already embeds should be told the form is closed rather than shown a working
+ * form whose submit answers 409.
+ */
+export declare function renderEmbedPage(options: EmbedPageOptions): string;
+/**
+ * The page's Content-Security-Policy.
+ *
+ * `default-src 'none'` because the page loads nothing: no fonts, no images, no
+ * scripts from anywhere. `connect-src 'self'` allows the one `fetch` back to the
+ * submit endpoint. `frame-ancestors *` is the point of the page and is why it
+ * must not also send `X-Frame-Options`.
+ */
+export declare function embedContentSecurityPolicy(nonce: string): string;
+/** What a customer pastes into their site. Both put the same hosted page on the page. */
+export interface EmbedSnippets {
+    readonly url: string;
+    readonly iframe: string;
+    readonly script: string;
+}
+/**
+ * The two ways to embed.
+ *
+ * The iframe is the honest minimum: one tag, no JavaScript, fixed height. The
+ * script adds the listener that resizes it as fields appear and as the thank-you
+ * replaces the form, which is the only thing an iframe cannot do for itself.
+ */
+export declare function embedSnippets(url: string, formId: string): EmbedSnippets;
+//# sourceMappingURL=embed.d.ts.map

package/dist/modules/forms/embed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/embed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAuBlE;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAuID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAA;IAC3C,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAoCjE;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAShE;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,CAkBxE"}

package/dist/modules/forms/embed.js

@@ -0,0 +1,236 @@
+/**
+ * The hosted embed page and the snippets that put it on a customer's site.
+ *
+ * Server-rendered and self-contained on purpose. A site embedding a Kelpie form
+ * frames a page from the Kelpie origin, and that page must not drag the CRM's
+ * React bundle into somebody else's marketing site to draw five inputs.
+ *
+ * Everything here is pure: a form, its fields, and a URL in; a string out. That
+ * is what makes the escaping testable, which for a page built by string
+ * concatenation is the part worth testing.
+ */
+/** `'` as `'` rather than `'`, which older HTML parsers do not know. */
+const HTML_ESCAPES = {
+    '&': '&',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#39;',
+};
+/**
+ * Escapes text for both element content and quoted attribute values.
+ *
+ * Every value a form author typed reaches this page, so a label of
+ * `"><script>…` would otherwise be a stored cross-site scripting hole against
+ * whoever embeds the form. One function for both positions because the set of
+ * characters that break out of either is the same.
+ */
+export function escapeHtml(text) {
+    return text.replaceAll(/[&<>"']/gu, (match) => HTML_ESCAPES[match] ?? match);
+}
+/**
+ * Escapes a string for a `<script>` body.
+ *
+ * An HTML parser ends a script at the literal `</script`, wherever it appears,
+ * including inside a JSON string. Breaking the sequence is what keeps embedded
+ * data from closing the element that carries it.
+ */
+function escapeScriptJson(value) {
+    return JSON.stringify(value).replaceAll('<', '\\u003c').replaceAll('\u2028', '\\u2028').replaceAll('\u2029', '\\u2029');
+}
+function renderOptions(field) {
+    const blank = field.required ? '' : '<option value="">—</option>';
+    const choices = field.options
+        .map((option) => `<option value="${escapeHtml(option.key)}">${escapeHtml(option.value)}</option>`)
+        .join('');
+    return blank + choices;
+}
+function renderControl(field) {
+    const shared = [
+        `id="${escapeHtml(field.id)}"`,
+        `name="${escapeHtml(field.id)}"`,
+        ...(field.required ? ['required'] : []),
+        ...(field.placeholder === null ? [] : [`placeholder="${escapeHtml(field.placeholder)}"`]),
+    ].join(' ');
+    if (field.type === 'select') {
+        return `<select ${shared}>${renderOptions(field)}</select>`;
+    }
+    if (field.type === 'textarea') {
+        return `<textarea ${shared} rows="4"></textarea>`;
+    }
+    // `type="email"` gives a phone keyboard the @ key and catches a typo before a
+    // round trip. The server validates the address regardless.
+    return `<input ${shared} type="${field.type === 'email' ? 'email' : 'text'}">`;
+}
+function renderField(field) {
+    const required = field.required ? '<span class="req" aria-hidden="true">*</span>' : '';
+    return [
+        '<div class="field">',
+        `<label for="${escapeHtml(field.id)}">${escapeHtml(field.label)}${required}</label>`,
+        renderControl(field),
+        '</div>',
+    ].join('');
+}
+/**
+ * Styles for the page. Deliberately plain and system-font: this renders inside
+ * somebody else's design, and a form that tries to bring its own brand fights
+ * the site it was embedded in.
+ */
+const EMBED_STYLES = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body { margin: 0; padding: 16px; font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
+form { display: grid; gap: 14px; max-width: 32rem; margin: 0 auto; }
+.field { display: grid; gap: 5px; }
+label { font-weight: 600; font-size: 0.875rem; }
+.req { color: #b4232c; margin-left: 2px; }
+input, textarea, select { width: 100%; padding: 9px 10px; border: 1px solid #b9bfc9; border-radius: 6px; font: inherit; background: Field; color: FieldText; }
+input:focus-visible, textarea:focus-visible, select:focus-visible { outline: 2px solid #2f6feb; outline-offset: 1px; }
+textarea { resize: vertical; }
+button { padding: 10px 16px; border: 0; border-radius: 6px; background: #2f6feb; color: #fff; font: inherit; font-weight: 600; cursor: pointer; }
+button[disabled] { opacity: 0.6; cursor: progress; }
+.note { margin: 0; font-size: 0.875rem; }
+.error { color: #b4232c; }
+.done { max-width: 32rem; margin: 0 auto; }
+`;
+/**
+ * The browser half of the page.
+ *
+ * Plain `fetch` and no dependencies, so the page loads nothing from anywhere and
+ * a strict Content-Security-Policy can refuse every external origin. The height
+ * is posted to the parent because an iframe cannot size itself; the companion
+ * listener ships in `scriptSnippet`.
+ */
+const EMBED_SCRIPT = `
+(function () {
+  var config = JSON.parse(document.getElementById('kelpie-config').textContent);
+  var form = document.getElementById('kelpie-form');
+  var status = document.getElementById('kelpie-status');
+  var button = document.getElementById('kelpie-submit');
+
+  function postHeight() {
+    parent.postMessage({ kelpie: 'height', formId: config.formId, height: document.documentElement.scrollHeight }, '*');
+  }
+
+  new ResizeObserver(postHeight).observe(document.documentElement);
+
+  form.addEventListener('submit', function (event) {
+    event.preventDefault();
+    status.textContent = '';
+    status.className = 'note';
+    button.disabled = true;
+
+    var answers = {};
+    config.fieldIds.forEach(function (id) {
+      var value = form.elements[id].value.trim();
+      if (value) { answers[id] = value; }
+    });
+
+    fetch(config.submitUrl, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ answers: answers })
+    }).then(function (response) {
+      return response.json().then(function (body) { return { ok: response.ok, body: body }; });
+    }).then(function (result) {
+      if (!result.ok) {
+        throw new Error((result.body && result.body.error && result.body.error.message) || 'Something went wrong.');
+      }
+      var done = document.createElement('div');
+      done.className = 'done';
+      done.textContent = result.body.thank_you_message || config.thankYou;
+      form.replaceWith(done);
+      parent.postMessage({ kelpie: 'submitted', formId: config.formId }, '*');
+      postHeight();
+    }).catch(function (error) {
+      status.textContent = error.message;
+      status.className = 'note error';
+      button.disabled = false;
+    });
+  });
+})();
+`;
+/**
+ * The whole page, as one document.
+ *
+ * A paused form still renders. Somebody visiting the page a customer's site
+ * already embeds should be told the form is closed rather than shown a working
+ * form whose submit answers 409.
+ */
+export function renderEmbedPage(options) {
+    const { form, fields, submitUrl, nonce } = options;
+    const config = escapeScriptJson({
+        formId: form.id,
+        submitUrl,
+        thankYou: form.thankYouMessage,
+        fieldIds: fields.map((field) => field.id),
+    });
+    const body = form.status === 'paused'
+        ? `<div class="done"><p class="note">This form is not accepting submissions right now.</p></div>`
+        : [
+            '<form id="kelpie-form" novalidate>',
+            fields.map(renderField).join(''),
+            '<div><button id="kelpie-submit" type="submit">Submit</button></div>',
+            '<p id="kelpie-status" class="note" role="status" aria-live="polite"></p>',
+            '</form>',
+            `<script type="application/json" id="kelpie-config">${config}</script>`,
+            `<script nonce="${escapeHtml(nonce)}">${EMBED_SCRIPT}</script>`,
+        ].join('');
+    return [
+        '<!doctype html>',
+        '<html lang="en">',
+        '<head>',
+        '<meta charset="utf-8">',
+        '<meta name="viewport" content="width=device-width, initial-scale=1">',
+        // Not indexed: the canonical page for this form is the customer's own, and
+        // a bare embed ranking above it would be a worse result for a reader.
+        '<meta name="robots" content="noindex">',
+        `<title>${escapeHtml(form.name)}</title>`,
+        `<style nonce="${escapeHtml(nonce)}">${EMBED_STYLES}</style>`,
+        '</head>',
+        `<body>${body}</body>`,
+        '</html>',
+    ].join('');
+}
+/**
+ * The page's Content-Security-Policy.
+ *
+ * `default-src 'none'` because the page loads nothing: no fonts, no images, no
+ * scripts from anywhere. `connect-src 'self'` allows the one `fetch` back to the
+ * submit endpoint. `frame-ancestors *` is the point of the page and is why it
+ * must not also send `X-Frame-Options`.
+ */
+export function embedContentSecurityPolicy(nonce) {
+    return [
+        "default-src 'none'",
+        `style-src 'nonce-${nonce}'`,
+        `script-src 'nonce-${nonce}'`,
+        "connect-src 'self'",
+        "form-action 'none'",
+        'frame-ancestors *',
+    ].join('; ');
+}
+/**
+ * The two ways to embed.
+ *
+ * The iframe is the honest minimum: one tag, no JavaScript, fixed height. The
+ * script adds the listener that resizes it as fields appear and as the thank-you
+ * replaces the form, which is the only thing an iframe cannot do for itself.
+ */
+export function embedSnippets(url, formId) {
+    const iframe = `<iframe src="${escapeHtml(url)}" title="Contact form" ` +
+        `style="width:100%;border:0;height:520px" loading="lazy"></iframe>`;
+    const script = [
+        `<iframe id="kelpie-${formId}" src="${escapeHtml(url)}" title="Contact form"`,
+        `        style="width:100%;border:0;height:520px" loading="lazy"></iframe>`,
+        `<script>`,
+        `  window.addEventListener('message', function (event) {`,
+        `    if (event.data && event.data.kelpie === 'height' && event.data.formId === '${formId}') {`,
+        `      document.getElementById('kelpie-${formId}').style.height = event.data.height + 'px';`,
+        `    }`,
+        `  });`,
+        `</script>`,
+    ].join('\n');
+    return { url, iframe, script };
+}
+//# sourceMappingURL=embed.js.map

package/dist/modules/forms/embed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embed.js","sourceRoot":"","sources":["../../../src/modules/forms/embed.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AAEH,iFAAiF;AACjF,MAAM,YAAY,GAAqC;IACrD,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,MAAM;IACX,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,OAAO;CACb,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;AACzH,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B,CAAA;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO;SAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;SACjG,IAAI,CAAC,EAAE,CAAC,CAAA;IAEX,OAAO,KAAK,GAAG,OAAO,CAAA;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,MAAM,GAAG;QACb,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG;QAC9B,SAAS,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG;QAChC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;KAC1F,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAEX,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,WAAW,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,WAAW,CAAA;IAC7D,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,aAAa,MAAM,uBAAuB,CAAA;IACnD,CAAC;IAED,8EAA8E;IAC9E,2DAA2D;IAC3D,OAAO,UAAU,MAAM,UAAU,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAA;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,EAAE,CAAA;IAEtF,OAAO;QACL,qBAAqB;QACrB,eAAe,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,QAAQ,UAAU;QACpF,aAAa,CAAC,KAAK,CAAC;QACpB,QAAQ;KACT,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;CAgBpB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDpB,CAAA;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC;QAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,eAAe;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAA;IACF,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,KAAK,QAAQ;QACtB,CAAC,CAAC,+FAA+F;QACjG,CAAC,CAAC;YACE,oCAAoC;YACpC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,qEAAqE;YACrE,0EAA0E;YAC1E,SAAS;YACT,sDAAsD,MAAM,WAAW;YACvE,kBAAkB,UAAU,CAAC,KAAK,CAAC,KAAK,YAAY,WAAW;SAChE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAEhB,OAAO;QACL,iBAAiB;QACjB,kBAAkB;QAClB,QAAQ;QACR,wBAAwB;QACxB,sEAAsE;QACtE,2EAA2E;QAC3E,sEAAsE;QACtE,wCAAwC;QACxC,UAAU,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;QACzC,iBAAiB,UAAU,CAAC,KAAK,CAAC,KAAK,YAAY,UAAU;QAC7D,SAAS;QACT,SAAS,IAAI,SAAS;QACtB,SAAS;KACV,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO;QACL,oBAAoB;QACpB,oBAAoB,KAAK,GAAG;QAC5B,qBAAqB,KAAK,GAAG;QAC7B,oBAAoB;QACpB,oBAAoB;QACpB,mBAAmB;KACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAc;IACvD,MAAM,MAAM,GACV,gBAAgB,UAAU,CAAC,GAAG,CAAC,yBAAyB;QACxD,mEAAmE,CAAA;IAErE,MAAM,MAAM,GAAG;QACb,sBAAsB,MAAM,UAAU,UAAU,CAAC,GAAG,CAAC,wBAAwB;QAC7E,2EAA2E;QAC3E,UAAU;QACV,yDAAyD;QACzD,kFAAkF,MAAM,MAAM;QAC9F,yCAAyC,MAAM,6CAA6C;QAC5F,OAAO;QACP,OAAO;QACP,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AAChC,CAAC"}

package/dist/modules/forms/fields.d.ts

@@ -0,0 +1,71 @@
+import type { ErrorDetail } from '../../lib/errors.ts';
+import type { StoredFormFieldOption } from './schema.ts';
+import type { FormFieldMapTarget, FormFieldType, FormOptionValueType } from './schema.ts';
+/**
+ * What a form's field list has to satisfy before it is stored.
+ *
+ * Per-form rules, which is why they are not check constraints: "at most one
+ * `person.email` mapping" is a statement about a set of rows, and the database
+ * has nowhere to hang it. Pure, so the rules that decide whether a form can ever
+ * process a submission are testable without one.
+ */
+/** A field as a write request carries it: no id, no position, both derived. */
+export interface FieldDraft {
+    readonly label: string;
+    readonly type: FormFieldType;
+    readonly required: boolean;
+    readonly mapTo: FormFieldMapTarget;
+    readonly options: readonly OptionDraft[];
+    readonly placeholder: string | null;
+}
+export interface OptionDraft {
+    readonly key: string;
+    readonly value: string;
+    readonly valueType: FormOptionValueType;
+}
+/**
+ * Everything wrong with a field list, as `api.md` field details.
+ *
+ * All of it at once: a field builder sends the whole list, so reporting one
+ * problem per request would make fixing three of them three round trips.
+ *
+ * @param fields In the order they were sent, which becomes their order on screen.
+ * @param createsDeal Whether the form the list belongs to creates Deals. A Deal
+ *   belongs to a Company, and a submit only resolves one from a `company.name`
+ *   or `company.domain` answer, so a deal-creating form without either would
+ *   quietly never create a deal. Refused here rather than discovered later by
+ *   somebody wondering where their inbound pipeline went.
+ */
+export declare function findFieldProblems(fields: readonly FieldShape[], createsDeal: boolean): readonly ErrorDetail[];
+/** A field's options as they are stored. Structurally the drafts, narrowed to the stored type. */
+export declare function storedOptions(options: readonly OptionDraft[]): readonly StoredFormFieldOption[];
+/**
+ * A field with its ids and tenancy stripped: everything a write can change.
+ *
+ * Both a stored row and an inbound `FieldDraft` satisfy this, which is what lets
+ * one comparison and one rule set serve both sides. `type` and `mapTo` are
+ * `string` rather than their unions because that is what a `text` column reads
+ * back as; narrowing them here would mean asserting a value that is only ever
+ * tested for equality, and the check constraint is what guarantees the column
+ * holds one of the set.
+ */
+export interface FieldShape {
+    readonly label: string;
+    readonly type: string;
+    readonly required: boolean;
+    readonly mapTo: string;
+    readonly options: readonly StoredFormFieldOption[];
+    readonly placeholder: string | null;
+}
+/**
+ * Whether a submitted field list differs from the stored one.
+ *
+ * A write replaces the whole list, so without this a client resending what it
+ * already had would delete and reinsert every row, move every id, and publish a
+ * `record.updated` that no consumer can act on. Order counts: it is the order
+ * the embed renders, and reordering is the one edit that changes nothing else.
+ *
+ * @param stored In `sort_order`, which is the order the repository returns.
+ */
+export declare function fieldsDiffer(stored: readonly FieldShape[], drafts: readonly FieldDraft[]): boolean;
+//# sourceMappingURL=fields.d.ts.map

package/dist/modules/forms/fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/fields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEzF;;;;;;;GAOG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAA;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;CACxC;AAcD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,WAAW,EAAE,OAAO,GACnB,SAAS,WAAW,EAAE,CAiCxB;AAiCD,kGAAkG;AAClG,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,WAAW,EAAE,GAC9B,SAAS,qBAAqB,EAAE,CAMlC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,UAAU,EAAE,EAC7B,MAAM,EAAE,SAAS,UAAU,EAAE,GAC5B,OAAO,CAkBT"}

package/dist/modules/forms/fields.js

@@ -0,0 +1,122 @@
+import { PERSON_EMAIL_TARGET } from './schema.js';
+/**
+ * Targets a form may map more than one field to.
+ *
+ * Only `submission`, which writes no CRM field and so has nothing to collide
+ * over. Two fields both mapped to `person.name` would leave the submit picking
+ * one of them by field order, which is not a decision a form author made.
+ */
+const REPEATABLE_TARGETS = new Set(['submission']);
+/** The two targets that establish a company for a submit to attach a Deal to. */
+const COMPANY_TARGETS = ['company.name', 'company.domain'];
+/**
+ * Everything wrong with a field list, as `api.md` field details.
+ *
+ * All of it at once: a field builder sends the whole list, so reporting one
+ * problem per request would make fixing three of them three round trips.
+ *
+ * @param fields In the order they were sent, which becomes their order on screen.
+ * @param createsDeal Whether the form the list belongs to creates Deals. A Deal
+ *   belongs to a Company, and a submit only resolves one from a `company.name`
+ *   or `company.domain` answer, so a deal-creating form without either would
+ *   quietly never create a deal. Refused here rather than discovered later by
+ *   somebody wondering where their inbound pipeline went.
+ */
+export function findFieldProblems(fields, createsDeal) {
+    const problems = [];
+    const seenTargets = new Set();
+    if (!fields.some((field) => field.mapTo === PERSON_EMAIL_TARGET)) {
+        problems.push({
+            field: 'fields',
+            message: `A form needs exactly one field mapped to ${PERSON_EMAIL_TARGET}`,
+        });
+    }
+    if (createsDeal && !fields.some((field) => COMPANY_TARGETS.includes(field.mapTo))) {
+        problems.push({
+            field: 'fields',
+            message: `A form that creates deals needs a field mapped to ${COMPANY_TARGETS.join(' or ')}`,
+        });
+    }
+    for (const [index, field] of fields.entries()) {
+        const at = `fields.${String(index)}`;
+        if (!REPEATABLE_TARGETS.has(field.mapTo)) {
+            if (seenTargets.has(field.mapTo)) {
+                problems.push({ field: `${at}.map_to`, message: `Another field already maps to ${field.mapTo}` });
+            }
+            seenTargets.add(field.mapTo);
+        }
+        problems.push(...findOptionProblems(field, at));
+    }
+    return problems;
+}
+/** A select needs choices; everything else must not carry any. */
+function findOptionProblems(field, at) {
+    if (field.type !== 'select') {
+        return field.options.length === 0
+            ? []
+            : [{ field: `${at}.options`, message: `A ${field.type} field has no options` }];
+    }
+    if (field.options.length === 0) {
+        return [{ field: `${at}.options`, message: 'A select field needs at least one option' }];
+    }
+    const problems = [];
+    const seenKeys = new Set();
+    for (const [index, option] of field.options.entries()) {
+        // The key is what a stored answer holds, so a duplicate would make an
+        // existing submission ambiguous about which choice was made.
+        if (seenKeys.has(option.key)) {
+            problems.push({
+                field: `${at}.options.${String(index)}.key`,
+                message: `Another option already uses "${option.key}"`,
+            });
+        }
+        seenKeys.add(option.key);
+    }
+    return problems;
+}
+/** A field's options as they are stored. Structurally the drafts, narrowed to the stored type. */
+export function storedOptions(options) {
+    return options.map((option) => ({
+        key: option.key,
+        value: option.value,
+        valueType: option.valueType,
+    }));
+}
+/**
+ * Whether a submitted field list differs from the stored one.
+ *
+ * A write replaces the whole list, so without this a client resending what it
+ * already had would delete and reinsert every row, move every id, and publish a
+ * `record.updated` that no consumer can act on. Order counts: it is the order
+ * the embed renders, and reordering is the one edit that changes nothing else.
+ *
+ * @param stored In `sort_order`, which is the order the repository returns.
+ */
+export function fieldsDiffer(stored, drafts) {
+    if (stored.length !== drafts.length) {
+        return true;
+    }
+    return stored.some((field, index) => {
+        const draft = drafts[index];
+        return (draft === undefined ||
+            field.label !== draft.label ||
+            field.type !== draft.type ||
+            field.required !== draft.required ||
+            field.mapTo !== draft.mapTo ||
+            field.placeholder !== draft.placeholder ||
+            optionsDiffer(field.options, draft.options));
+    });
+}
+function optionsDiffer(stored, drafts) {
+    if (stored.length !== drafts.length) {
+        return true;
+    }
+    return stored.some((option, index) => {
+        const draft = drafts[index];
+        return (draft === undefined ||
+            option.key !== draft.key ||
+            option.value !== draft.value ||
+            option.valueType !== draft.valueType);
+    });
+}
+//# sourceMappingURL=fields.js.map

package/dist/modules/forms/fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fields.js","sourceRoot":"","sources":["../../../src/modules/forms/fields.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AA4BjD;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAA;AAEvE,iFAAiF;AACjF,MAAM,eAAe,GAAsB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;AAE7E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA6B,EAC7B,WAAoB;IAEpB,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IAErC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,mBAAmB,CAAC,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,4CAA4C,mBAAmB,EAAE;SAC3E,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAClF,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,qDAAqD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;SAC7F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;QAEpC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,iCAAiC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACnG,CAAC;YAED,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC9B,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,kEAAkE;AAClE,SAAS,kBAAkB,CAAC,KAAiB,EAAE,EAAU;IACvD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,IAAI,uBAAuB,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAElC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACtD,sEAAsE;QACtE,6DAA6D;QAC7D,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,GAAG,EAAE,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC3C,OAAO,EAAE,gCAAgC,MAAM,CAAC,GAAG,GAAG;aACvD,CAAC,CAAA;QACJ,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,aAAa,CAC3B,OAA+B;IAE/B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC,CAAA;AACL,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA6B,EAC7B,MAA6B;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAE3B,OAAO,CACL,KAAK,KAAK,SAAS;YACnB,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAC3B,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YACzB,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;YACjC,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAC3B,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;YACvC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAC5C,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAAwC,EACxC,MAA8B;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAE3B,OAAO,CACL,KAAK,KAAK,SAAS;YACnB,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YACxB,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAC5B,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CACrC,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/modules/forms/index.d.ts

@@ -0,0 +1,15 @@
+import type { KelpieModule } from '../../runtime/module.ts';
+/**
+ * Forms: embeddable inbound capture, per `forms.md`.
+ *
+ * The only core module with a public surface. Managing forms needs credentials
+ * like everything else; submitting one needs nothing but the form's `publicKey`,
+ * because the caller is a stranger's browser on a stranger's website.
+ *
+ * It requires everything a submit writes. `people`, `companies` and `positions`
+ * are the upsert; `deals` and `pipelines` are the optional deal and the stage it
+ * opens in; `activities` is the timeline entry, in the same transaction as the
+ * records it describes. `workspace` arrives through those.
+ */
+export declare function createFormsModule(migrationsDirectory: string): KelpieModule;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/forms/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/forms/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAS3D;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,GAAG,YAAY,CAuC3E"}

package/dist/modules/forms/index.js

@@ -0,0 +1,53 @@
+import { createActivityRecorder } from '../activities/index.js';
+import { mountPublicFormRoutes } from './publicRoutes.js';
+import { mountFormsRoutes } from './routes.js';
+import * as schema from './schema.js';
+import { createFormsService } from './service.js';
+import { createFormSubmitService } from './submission.js';
+import { registerFormsTools } from './tools.js';
+/**
+ * Forms: embeddable inbound capture, per `forms.md`.
+ *
+ * The only core module with a public surface. Managing forms needs credentials
+ * like everything else; submitting one needs nothing but the form's `publicKey`,
+ * because the caller is a stranger's browser on a stranger's website.
+ *
+ * It requires everything a submit writes. `people`, `companies` and `positions`
+ * are the upsert; `deals` and `pipelines` are the optional deal and the stage it
+ * opens in; `activities` is the timeline entry, in the same transaction as the
+ * records it describes. `workspace` arrives through those.
+ */
+export function createFormsModule(migrationsDirectory) {
+    return {
+        id: 'forms',
+        requires: ['people', 'companies', 'positions', 'pipelines', 'deals', 'activities'],
+        register(context) {
+            const service = createFormsService({
+                db: context.db,
+                transaction: context.transaction,
+                createId: context.createId,
+                now: context.now,
+            });
+            const submissions = createFormSubmitService({
+                db: context.db,
+                transaction: context.transaction,
+                createId: context.createId,
+                now: context.now,
+                recordActivity: createActivityRecorder({
+                    createId: context.createId,
+                    now: context.now,
+                }),
+            });
+            context.schema(schema, migrationsDirectory);
+            context.routes((router) => {
+                mountFormsRoutes(router, { db: context.db, now: context.now, service });
+            });
+            context.publicRoutes((router) => {
+                mountPublicFormRoutes(router, { db: context.db, submissions });
+            });
+            registerFormsTools(context.mcp, service);
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/modules/forms/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/forms/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,mBAA2B;IAC3D,OAAO;QACL,EAAE,EAAE,OAAO;QACX,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,CAAC;QAElF,QAAQ,CAAC,OAAO;YACd,MAAM,OAAO,GAAG,kBAAkB,CAAC;gBACjC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,uBAAuB,CAAC;gBAC1C,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,cAAc,EAAE,sBAAsB,CAAC;oBACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;iBACjB,CAAC;aACH,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,gBAAgB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YACzE,CAAC,CAAC,CAAA;YAEF,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC9B,qBAAqB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAA;YAChE,CAAC,CAAC,CAAA;YAEF,kBAAkB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAExC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}