@ketvietlab/ketsuite 0.1.2 → 0.1.5

package/dist/modules/website_form/index.js

@@ -1,13 +1,12 @@
 import { defineModule } from '@ketvietlab/ketjs';
 import { functions } from './functions.js';
+import { jobs } from './jobs.js';
 import { models } from './models.js';
 import { sections } from './sections.js';
 import { routes } from './routes.js';
 export default defineModule({
     name: 'website_form',
     version: '0.1.0',
-    app: true,
-    install: 'auto',
     depends: ['website'],
     title: 'Biểu mẫu website',
     summary: 'Biểu mẫu có cấu trúc, chống spam và lưu submission theo từng website.',
@@ -37,6 +36,17 @@ export default defineModule({
             'error.invalidMessage': 'Thông báo thành công không hợp lệ hoặc quá dài.',
             'error.unavailable': 'Biểu mẫu hiện không khả dụng.',
             'error.rateLimit': 'Bạn đã gửi quá nhiều lần. Vui lòng thử lại sau.',
+            'error.staleForm': 'Biểu mẫu đã được cập nhật. Hãy tải lại trang trước khi gửi.',
+            'error.saveConflict': 'Biểu mẫu vừa được người khác lưu. Hãy tải lại rồi lưu lại.',
+            'error.consentRequired': 'Bạn cần đồng ý với thông báo trước khi gửi.',
+            'error.consentVersionRequired': 'Hãy tải lại trang trước khi gửi, để ghi nhận đúng thông báo bạn đã đồng ý.',
+            'error.invalidSummaryFields': 'Danh sách trường xem trước không hợp lệ.',
+            'error.unknownSummaryField': 'Trường xem trước không có trong biểu mẫu.',
+            'error.invalidRetention': 'Thời hạn lưu phải là số ngày từ 1 đến 3650.',
+            'error.noRetention': 'Biểu mẫu này chưa đặt thời hạn lưu.',
+            'error.exportFieldsRequired': 'Hãy chọn ít nhất một trường để xuất.',
+            'error.submissionNotFound': 'Không tìm thấy lượt gửi.',
+            'error.submissionPurged': 'Lượt gửi đã được xóa nội dung, không thể giữ lại.',
         },
         en: {
             'app.title': 'Website forms',
@@ -62,10 +72,22 @@ export default defineModule({
             'error.invalidMessage': 'The success message is invalid or too long.',
             'error.unavailable': 'The form is not available.',
             'error.rateLimit': 'Too many submissions. Please try again later.',
+            'error.staleForm': 'This form has been updated. Reload the page before submitting.',
+            'error.saveConflict': 'Someone else saved this form. Reload and save again.',
+            'error.consentRequired': 'You must agree to the notice before submitting.',
+            'error.consentVersionRequired': 'Reload the page before submitting, so the notice you agreed to is recorded correctly.',
+            'error.invalidSummaryFields': 'The preview field list is invalid.',
+            'error.unknownSummaryField': 'The preview field is not declared in the form.',
+            'error.invalidRetention': 'Retention must be a whole number of days between 1 and 3650.',
+            'error.noRetention': 'This form has no retention period set.',
+            'error.exportFieldsRequired': 'Choose at least one field to export.',
+            'error.submissionNotFound': 'The submission was not found.',
+            'error.submissionPurged': 'This submission has been erased and cannot be held.',
         },
     },
     models,
     functions,
+    jobs,
     sections,
     routes,
 });

package/dist/modules/website_form/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,OAAO;IAChB,GAAG,EAAE,IAAI;IACT,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,KAAK,EAAE,kBAAkB;IACzB,OAAO,EAAE,uEAAuE;IAChF,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE;QACR,EAAE,EAAE;YACF,WAAW,EAAE,kBAAkB;YAC/B,aAAa,EAAE,uEAAuE;YACtF,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,UAAU;YAC1B,sBAAsB,EAAE,kCAAkC;YAC1D,qBAAqB,EAAE,wCAAwC;YAC/D,sBAAsB,EAAE,6CAA6C;YACrE,wBAAwB,EAAE,0BAA0B;YACpD,sBAAsB,EAAE,sBAAsB;YAC9C,wBAAwB,EAAE,gCAAgC;YAC1D,uBAAuB,EAAE,oCAAoC;YAC7D,oBAAoB,EAAE,+BAA+B;YACrD,gBAAgB,EAAE,qBAAqB;YACvC,oBAAoB,EAAE,6BAA6B;YACnD,qBAAqB,EAAE,0BAA0B;YACjD,uBAAuB,EAAE,gCAAgC;YACzD,oBAAoB,EAAE,kBAAkB;YACxC,oBAAoB,EAAE,yBAAyB;YAC/C,mBAAmB,EAAE,yCAAyC;YAC9D,qBAAqB,EAAE,4CAA4C;YACnE,sBAAsB,EAAE,iDAAiD;YACzE,mBAAmB,EAAE,+BAA+B;YACpD,iBAAiB,EAAE,iDAAiD;SACrE;QACD,EAAE,EAAE;YACF,WAAW,EAAE,eAAe;YAC5B,aAAa,EAAE,iEAAiE;YAChF,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,MAAM;YACtB,sBAAsB,EAAE,kCAAkC;YAC1D,qBAAqB,EAAE,uCAAuC;YAC9D,sBAAsB,EAAE,2CAA2C;YACnE,wBAAwB,EAAE,4BAA4B;YACtD,sBAAsB,EAAE,+BAA+B;YACvD,wBAAwB,EAAE,kCAAkC;YAC5D,uBAAuB,EAAE,iDAAiD;YAC1E,oBAAoB,EAAE,0CAA0C;YAChE,gBAAgB,EAAE,yBAAyB;YAC3C,oBAAoB,EAAE,+BAA+B;YACrD,qBAAqB,EAAE,+BAA+B;YACtD,uBAAuB,EAAE,gCAAgC;YACzD,oBAAoB,EAAE,wBAAwB;YAC9C,oBAAoB,EAAE,yBAAyB;YAC/C,mBAAmB,EAAE,uCAAuC;YAC5D,qBAAqB,EAAE,+CAA+C;YACtE,sBAAsB,EAAE,6CAA6C;YACrE,mBAAmB,EAAE,4BAA4B;YACjD,iBAAiB,EAAE,+CAA+C;SACnE;KACF;IACD,MAAM;IACN,SAAS;IACT,QAAQ;IACR,MAAM;CACP,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,CAAC,SAAS,CAAC;IACpB,KAAK,EAAE,kBAAkB;IACzB,OAAO,EAAE,uEAAuE;IAChF,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE;QACR,EAAE,EAAE;YACF,WAAW,EAAE,kBAAkB;YAC/B,aAAa,EAAE,uEAAuE;YACtF,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,UAAU;YAC1B,sBAAsB,EAAE,kCAAkC;YAC1D,qBAAqB,EAAE,wCAAwC;YAC/D,sBAAsB,EAAE,6CAA6C;YACrE,wBAAwB,EAAE,0BAA0B;YACpD,sBAAsB,EAAE,sBAAsB;YAC9C,wBAAwB,EAAE,gCAAgC;YAC1D,uBAAuB,EAAE,oCAAoC;YAC7D,oBAAoB,EAAE,+BAA+B;YACrD,gBAAgB,EAAE,qBAAqB;YACvC,oBAAoB,EAAE,6BAA6B;YACnD,qBAAqB,EAAE,0BAA0B;YACjD,uBAAuB,EAAE,gCAAgC;YACzD,oBAAoB,EAAE,kBAAkB;YACxC,oBAAoB,EAAE,yBAAyB;YAC/C,mBAAmB,EAAE,yCAAyC;YAC9D,qBAAqB,EAAE,4CAA4C;YACnE,sBAAsB,EAAE,iDAAiD;YACzE,mBAAmB,EAAE,+BAA+B;YACpD,iBAAiB,EAAE,iDAAiD;YACpE,iBAAiB,EAAE,6DAA6D;YAChF,oBAAoB,EAAE,4DAA4D;YAClF,uBAAuB,EAAE,6CAA6C;YACtE,8BAA8B,EAC5B,4EAA4E;YAC9E,4BAA4B,EAAE,0CAA0C;YACxE,2BAA2B,EAAE,2CAA2C;YACxE,wBAAwB,EAAE,6CAA6C;YACvE,mBAAmB,EAAE,qCAAqC;YAC1D,4BAA4B,EAAE,sCAAsC;YACpE,0BAA0B,EAAE,0BAA0B;YACtD,wBAAwB,EAAE,mDAAmD;SAC9E;QACD,EAAE,EAAE;YACF,WAAW,EAAE,eAAe;YAC5B,aAAa,EAAE,iEAAiE;YAChF,cAAc,EAAE,SAAS;YACzB,cAAc,EAAE,MAAM;YACtB,sBAAsB,EAAE,kCAAkC;YAC1D,qBAAqB,EAAE,uCAAuC;YAC9D,sBAAsB,EAAE,2CAA2C;YACnE,wBAAwB,EAAE,4BAA4B;YACtD,sBAAsB,EAAE,+BAA+B;YACvD,wBAAwB,EAAE,kCAAkC;YAC5D,uBAAuB,EAAE,iDAAiD;YAC1E,oBAAoB,EAAE,0CAA0C;YAChE,gBAAgB,EAAE,yBAAyB;YAC3C,oBAAoB,EAAE,+BAA+B;YACrD,qBAAqB,EAAE,+BAA+B;YACtD,uBAAuB,EAAE,gCAAgC;YACzD,oBAAoB,EAAE,wBAAwB;YAC9C,oBAAoB,EAAE,yBAAyB;YAC/C,mBAAmB,EAAE,uCAAuC;YAC5D,qBAAqB,EAAE,+CAA+C;YACtE,sBAAsB,EAAE,6CAA6C;YACrE,mBAAmB,EAAE,4BAA4B;YACjD,iBAAiB,EAAE,+CAA+C;YAClE,iBAAiB,EAAE,gEAAgE;YACnF,oBAAoB,EAAE,sDAAsD;YAC5E,uBAAuB,EAAE,iDAAiD;YAC1E,8BAA8B,EAC5B,uFAAuF;YACzF,4BAA4B,EAAE,oCAAoC;YAClE,2BAA2B,EAAE,gDAAgD;YAC7E,wBAAwB,EAAE,8DAA8D;YACxF,mBAAmB,EAAE,wCAAwC;YAC7D,4BAA4B,EAAE,sCAAsC;YACpE,0BAA0B,EAAE,+BAA+B;YAC3D,wBAAwB,EAAE,qDAAqD;SAChF;KACF;IACD,MAAM;IACN,SAAS;IACT,IAAI;IACJ,QAAQ;IACR,MAAM;CACP,CAAC,CAAA"}

package/dist/modules/website_form/jobs.d.ts

@@ -0,0 +1,11 @@
+import type { JobSpec } from '@ketvietlab/ketjs';
+/**
+ * Retention runs on its own, because a retention period nobody enforces is a
+ * sentence in a privacy notice rather than a property of the system.
+ *
+ * `every`, not `dailyAt`: an age in days is compared against a timestamp, and
+ * has no opinion about what time of day it is anywhere. Naming a wall clock
+ * here would force a timezone into a decision that does not have one.
+ */
+export declare const jobs: Record<string, JobSpec>;
+//# sourceMappingURL=jobs.d.ts.map

package/dist/modules/website_form/jobs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/jobs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAQhD;;;;;;;GAOG;AACH,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAwExC,CAAA"}

package/dist/modules/website_form/jobs.js

@@ -0,0 +1,80 @@
+import { defineJob } from '@ketvietlab/ketjs';
+import { formsWithRetention, purgeFormOnce } from './purge.js';
+/** How many batches one run will do before handing the rest to another run. */
+const PASSES_PER_RUN = 8;
+const dayStamp = (now) => now.toISOString().slice(0, 10);
+/**
+ * Retention runs on its own, because a retention period nobody enforces is a
+ * sentence in a privacy notice rather than a property of the system.
+ *
+ * `every`, not `dailyAt`: an age in days is compared against a timestamp, and
+ * has no opinion about what time of day it is anywhere. Naming a wall clock
+ * here would force a timezone into a decision that does not have one.
+ */
+export const jobs = {
+    retentionSweep: defineJob({
+        input: {},
+        idempotent: true,
+        crossCompany: true,
+        schedule: { every: '24h' },
+        effects: ['read:website_form.Form', 'enqueue:website_form.purgeExpired'],
+        handler: async (ctx) => {
+            const now = new Date();
+            const companies = new Set();
+            for (const form of await formsWithRetention(ctx)) {
+                const company = form.companyId == null ? '' : String(form.companyId);
+                if (company)
+                    companies.add(company);
+            }
+            // One job per legal entity, keyed on the day: a sweep retried after a
+            // worker restart finds today's job already queued rather than queueing a
+            // second one behind it.
+            for (const company of [...companies].sort())
+                await ctx.jobs.enqueue('website_form.purgeExpired', { pass: 1 }, { company, uniqueKey: `website_form.retention:${company}:${dayStamp(now)}:1` });
+        },
+    }),
+    purgeExpired: defineJob({
+        input: { pass: 'int?' },
+        idempotent: true,
+        effects: [
+            'read:website_form.Form',
+            'read:website_form.FormSubmission',
+            'write:website_form.FormSubmission',
+            'write:website_form.FormSubmissionAudit',
+            'enqueue:website_form.purgeExpired',
+        ],
+        handler: async (ctx, args) => {
+            const now = new Date();
+            const pass = Number.isInteger(Number(args.pass)) ? Math.max(Number(args.pass), 1) : 1;
+            const forms = await formsWithRetention(ctx);
+            let budget = PASSES_PER_RUN;
+            let unfinished = false;
+            for (const form of forms) {
+                if (budget === 0) {
+                    // Forms this run never reached.
+                    unfinished = true;
+                    break;
+                }
+                let more = true;
+                while (more && budget > 0) {
+                    more = (await purgeFormOnce(ctx, form, now)).more;
+                    budget -= 1;
+                }
+                if (more)
+                    unfinished = true;
+            }
+            // A backlog is finished by another run rather than by a longer one, so a
+            // first pass over years of submissions cannot hold a worker slot open
+            // long enough to be killed and retried from the beginning.
+            //
+            // The company is in the key because a unique job key is unique per tenant,
+            // not per company: without it, two companies both needing a second pass on
+            // the same day would collide and one of them would silently never run.
+            if (unfinished)
+                await ctx.jobs.enqueue('website_form.purgeExpired', { pass: pass + 1 }, {
+                    uniqueKey: `website_form.retention:${ctx.scope.company ?? ''}:${dayStamp(now)}:${pass + 1}`,
+                });
+        },
+    }),
+};
+//# sourceMappingURL=jobs.js.map

package/dist/modules/website_form/jobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/jobs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE9D,+EAA+E;AAC/E,MAAM,cAAc,GAAG,CAAC,CAAA;AAExB,MAAM,QAAQ,GAAG,CAAC,GAAS,EAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAEtE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,IAAI,GAA4B;IAC3C,cAAc,EAAE,SAAS,CAAC;QACxB,KAAK,EAAE,EAAE;QACT,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QAC1B,OAAO,EAAE,CAAC,wBAAwB,EAAE,mCAAmC,CAAC;QACxE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;YACnC,KAAK,MAAM,IAAI,IAAI,MAAM,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBACpE,IAAI,OAAO;oBAAE,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACrC,CAAC;YACD,sEAAsE;YACtE,yEAAyE;YACzE,wBAAwB;YACxB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE;gBACzC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CACpB,2BAA2B,EAC3B,EAAE,IAAI,EAAE,CAAC,EAAE,EACX,EAAE,OAAO,EAAE,SAAS,EAAE,0BAA0B,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAC/E,CAAA;QACL,CAAC;KACF,CAAC;IAEF,YAAY,EAAE,SAAS,CAAC;QACtB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACvB,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE;YACP,wBAAwB;YACxB,kCAAkC;YAClC,mCAAmC;YACnC,wCAAwC;YACxC,mCAAmC;SACpC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAA;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACrF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAA;YAC3C,IAAI,MAAM,GAAG,cAAc,CAAA;YAC3B,IAAI,UAAU,GAAG,KAAK,CAAA;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;oBACjB,gCAAgC;oBAChC,UAAU,GAAG,IAAI,CAAA;oBACjB,MAAK;gBACP,CAAC;gBACD,IAAI,IAAI,GAAG,IAAI,CAAA;gBACf,OAAO,IAAI,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;oBACjD,MAAM,IAAI,CAAC,CAAA;gBACb,CAAC;gBACD,IAAI,IAAI;oBAAE,UAAU,GAAG,IAAI,CAAA;YAC7B,CAAC;YACD,yEAAyE;YACzE,sEAAsE;YACtE,2DAA2D;YAC3D,EAAE;YACF,2EAA2E;YAC3E,2EAA2E;YAC3E,uEAAuE;YACvE,IAAI,UAAU;gBACZ,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CACpB,2BAA2B,EAC3B,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,EAClB;oBACE,SAAS,EAAE,0BAA0B,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE;iBAC5F,CACF,CAAA;QACL,CAAC;KACF,CAAC;CACH,CAAA"}

package/dist/modules/website_form/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA4C3C,CAAA"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAEjD,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAqI3C,CAAA"}

package/dist/modules/website_form/models.js

@@ -7,6 +7,41 @@ export const models = {
             siteId: 'ref:website.Site',
             name: 'text',
             schema: 'json',
+            /**
+             * Bumped whenever the field contract changes. A form page rendered against
+             * version 3 must not be validated against version 4: the visitor would be
+             * told a field they were never shown is required. Optional so that forms
+             * created before versioning existed read as version 1.
+             */
+            schemaVersion: 'int?',
+            /**
+             * The privacy notice shown beside the consent box. Part of the versioned
+             * contract, not a separate one: a bare `consent: true` records that
+             * someone ticked a box without recording which text they agreed to, so
+             * changing the notice would silently reinterpret every earlier consent.
+             */
+            consentText: 'text?',
+            /**
+             * Which answers may appear in a list of submissions, by field name.
+             *
+             * Deliberately not part of `schema`, and so deliberately not part of the
+             * version: marking a field as safe to preview changes nothing a visitor
+             * sees, and versioning it would invalidate every page open against the
+             * form for an internal decision. It is also applied as it stands now
+             * rather than as it stood at collection time — someone who realises today
+             * that a field holds personal data expects yesterday's rows to be covered
+             * by that realisation, not exempt from it.
+             */
+            summaryFields: 'json?',
+            /**
+             * How long the answers are kept, in days.
+             *
+             * Absent means kept until someone says otherwise. That is the honest
+             * default: a form that has never been given a retention period has not
+             * been thought about, and quietly erasing its submissions on a number
+             * this module invented would destroy records nobody agreed to lose.
+             */
+            retentionDays: 'int?',
             successMessage: 'text',
             notifyTo: 'text?',
             active: 'bool',
@@ -19,17 +54,71 @@ export const models = {
             id: 'id',
             formId: 'ref:website_form.Form',
             payload: 'json',
+            /** Which field contract this payload was accepted against. */
+            schemaVersion: 'int?',
+            /**
+             * The exact notice this visitor agreed to, copied at the moment they
+             * agreed. A Form is one mutable row with no history, so the version alone
+             * cannot be resolved back to any text once the notice is edited — and a
+             * consent record that cannot say what was consented to is not a record.
+             */
+            consentText: 'text?',
             consent: 'bool',
             status: 'text',
             source: 'text?',
             fingerprint: 'text?',
             dedupeKey: 'text?',
             createdAt: 'datetime',
+            /**
+             * When the answers were erased, and why they were kept past their date.
+             *
+             * A hold is a reason rather than a flag so that the row says who is
+             * relying on it. Retention skips a held row for as long as the reason
+             * stands; clearing the reason puts it back in the ordinary queue rather
+             * than erasing it on the spot.
+             */
+            purgedAt: 'datetime?',
+            holdReason: 'text?',
+            heldBy: 'text?',
+            heldAt: 'datetime?',
         },
         indexes: {
             form_created: { fields: ['companyId', 'formId', 'createdAt'] },
             form_status: { fields: ['companyId', 'formId', 'status'] },
             form_dedupe: { fields: ['companyId', 'formId', 'dedupeKey'], unique: true },
+            /** Retention reads by age across every form in a company, not per form. */
+            retention: { fields: ['companyId', 'purgedAt', 'createdAt'] },
+        },
+    },
+    /**
+     * Who looked, who exported, who erased.
+     *
+     * Append-only, and separate from the submission it describes: the point of
+     * the record is that it survives the erasure of what it describes, so it
+     * cannot live on that row. It is a site-content record rather than an
+     * identity one, which is why it stays in this module instead of borrowing
+     * `user.SecurityAudit` and dragging a dependency on `user` behind it.
+     */
+    FormSubmissionAudit: {
+        scope: 'company',
+        fields: {
+            id: 'id',
+            formId: 'ref:website_form.Form',
+            /** Null for an action over a set: an export, or a retention pass. */
+            submissionId: 'text?',
+            /** read | export | purge | hold | release */
+            action: 'text',
+            /** The acting user, or `system` for a scheduled pass with no actor. */
+            actorKey: 'text',
+            /** Exactly which answers left the system, for an export. */
+            fields: 'json?',
+            rowCount: 'int?',
+            reason: 'text?',
+            occurredAt: 'datetime',
+        },
+        indexes: {
+            form_occurred: { fields: ['companyId', 'formId', 'occurredAt'] },
+            submission: { fields: ['companyId', 'submissionId'] },
         },
     },
     FormRateLimit: {

package/dist/modules/website_form/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/models.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,MAAM,GAA6B;IAC9C,IAAI,EAAE;QACJ,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;YACd,cAAc,EAAE,MAAM;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM;SACf;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAClF;IACD,cAAc,EAAE;QACd,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,UAAU;SACtB;QACD,OAAO,EAAE;YACP,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE;YAC9D,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YAC1D,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;SAC5E;KACF;IACD,aAAa,EAAE;QACb,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM;YACX,eAAe,EAAE,UAAU;YAC3B,KAAK,EAAE,KAAK;SACb;QACD,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KACjE;CACF,CAAA"}
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/models.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,MAAM,GAA6B;IAC9C,IAAI,EAAE;QACJ,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,MAAM;YACd;;;;;eAKG;YACH,aAAa,EAAE,MAAM;YACrB;;;;;eAKG;YACH,WAAW,EAAE,OAAO;YACpB;;;;;;;;;;eAUG;YACH,aAAa,EAAE,OAAO;YACtB;;;;;;;eAOG;YACH,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,MAAM;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,MAAM;SACf;QACD,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAClF;IACD,cAAc,EAAE;QACd,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,uBAAuB;YAC/B,OAAO,EAAE,MAAM;YACf,8DAA8D;YAC9D,aAAa,EAAE,MAAM;YACrB;;;;;eAKG;YACH,WAAW,EAAE,OAAO;YACpB,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,UAAU;YACrB;;;;;;;eAOG;YACH,QAAQ,EAAE,WAAW;YACrB,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,WAAW;SACpB;QACD,OAAO,EAAE;YACP,YAAY,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE;YAC9D,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE;YAC1D,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE;YAC3E,2EAA2E;YAC3E,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;SAC9D;KACF;IACD;;;;;;;;OAQG;IACH,mBAAmB,EAAE;QACnB,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,uBAAuB;YAC/B,qEAAqE;YACrE,YAAY,EAAE,OAAO;YACrB,6CAA6C;YAC7C,MAAM,EAAE,MAAM;YACd,uEAAuE;YACvE,QAAQ,EAAE,MAAM;YAChB,4DAA4D;YAC5D,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,OAAO;YACf,UAAU,EAAE,UAAU;SACvB;QACD,OAAO,EAAE;YACP,aAAa,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE;YAChE,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;SACtD;KACF;IACD,aAAa,EAAE;QACb,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE;YACN,EAAE,EAAE,IAAI;YACR,GAAG,EAAE,MAAM;YACX,eAAe,EAAE,UAAU;YAC3B,KAAK,EAAE,KAAK;SACb;QACD,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KACjE;CACF,CAAA"}

package/dist/modules/website_form/purge.d.ts

@@ -0,0 +1,22 @@
+import type { Ctx, Row } from '@ketvietlab/ketjs';
+export type PurgeOutcome = {
+    erased: number;
+    more: boolean;
+};
+/**
+ * Erase one form's answers that are past their retention window.
+ *
+ * Bounded on purpose. A form switched to a ninety-day window after two years
+ * of collecting has a very large first pass, and a retention sweep that runs
+ * for an hour is a retention sweep that gets killed halfway and retried from
+ * the start for ever. `more` says whether another pass has work, so the caller
+ * decides how much to do now.
+ *
+ * Held rows are excluded in the query rather than skipped in the loop: a hold
+ * that is filtered afterwards still fills the batch, so a form with five
+ * hundred held rows would make every pass do nothing and report nothing left.
+ */
+export declare const purgeFormOnce: (ctx: Ctx, form: Row, now: Date) => Promise<PurgeOutcome>;
+/** Every form in reach that has a retention window to enforce. */
+export declare const formsWithRetention: (ctx: Ctx) => Promise<Row[]>;
+//# sourceMappingURL=purge.d.ts.map

package/dist/modules/website_form/purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/purge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIjD,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAA;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,QAAe,GAAG,QAAQ,GAAG,OAAO,IAAI,KAAG,OAAO,CAAC,YAAY,CA6CxF,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,QAAe,GAAG,KAAG,OAAO,CAAC,GAAG,EAAE,CAGhE,CAAA"}

package/dist/modules/website_form/purge.js

@@ -0,0 +1,59 @@
+import { asc, eq, from, isNotNull, isNull, lte } from '@ketvietlab/ketjs';
+import { recordAccess } from './audit.js';
+import { PURGE_BATCH, purgePatch, retentionCutoff } from './retention.js';
+/**
+ * Erase one form's answers that are past their retention window.
+ *
+ * Bounded on purpose. A form switched to a ninety-day window after two years
+ * of collecting has a very large first pass, and a retention sweep that runs
+ * for an hour is a retention sweep that gets killed halfway and retried from
+ * the start for ever. `more` says whether another pass has work, so the caller
+ * decides how much to do now.
+ *
+ * Held rows are excluded in the query rather than skipped in the loop: a hold
+ * that is filtered afterwards still fills the batch, so a form with five
+ * hundred held rows would make every pass do nothing and report nothing left.
+ */
+export const purgeFormOnce = async (ctx, form, now) => {
+    const cutoff = retentionCutoff(form.retentionDays, now);
+    if (!cutoff)
+        return { erased: 0, more: false };
+    const Submission = ctx.table('website_form.FormSubmission');
+    const due = await ctx.db.all(from(Submission)
+        .where(eq(Submission.formId, form.id), isNull(Submission.purgedAt), isNull(Submission.holdReason), lte(Submission.createdAt, cutoff.toISOString()))
+        .select(Submission.id)
+        .orderBy(asc(Submission.createdAt))
+        .limit(PURGE_BATCH + 1));
+    const batch = due.slice(0, PURGE_BATCH);
+    if (!batch.length)
+        return { erased: 0, more: false };
+    const patch = purgePatch(now);
+    let erased = 0;
+    for (const row of batch) {
+        // Raced on `purgedAt` so that two passes over the same form — a scheduled
+        // one and an administrator pressing the button — cannot both count the
+        // same row, and so the audited total is the number of rows that actually
+        // changed rather than the number we looked at.
+        const changed = await ctx.db.compareAndSet('website_form.FormSubmission', { id: row.id }, { purgedAt: null }, patch);
+        if ('dryRun' in changed || changed.matched)
+            erased += 1;
+    }
+    if (erased)
+        await recordAccess(ctx, {
+            formId: form.id,
+            action: 'purge',
+            rowCount: erased,
+            reason: `retention:${Number(form.retentionDays)}d`,
+            at: now,
+        });
+    // One record for the pass, not one per row: which rows were erased is written
+    // on the rows themselves, in `purgedAt`. An automated erasure that files one
+    // audit row per submission grows the audit faster than the data it audits.
+    return { erased, more: due.length > batch.length };
+};
+/** Every form in reach that has a retention window to enforce. */
+export const formsWithRetention = async (ctx) => {
+    const Form = ctx.table('website_form.Form');
+    return ctx.db.all(from(Form).where(isNotNull(Form.retentionDays)).orderBy(asc(Form.id)));
+};
+//# sourceMappingURL=purge.js.map

package/dist/modules/website_form/purge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/purge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAIzE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAQ,EAAE,IAAS,EAAE,GAAS,EAAyB,EAAE;IAC3F,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,GAAG,CAC1B,IAAI,CAAC,UAAU,CAAC;SACb,KAAK,CACJ,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,EAC9B,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC3B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAC7B,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAChD;SACA,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;SACrB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAClC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC,CAC1B,CAAA;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IACvC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,aAAa,CACxC,6BAA6B,EAC7B,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EACd,EAAE,QAAQ,EAAE,IAAI,EAAE,EAClB,KAAK,CACN,CAAA;QACD,IAAI,QAAQ,IAAI,OAAO,IAAI,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,MAAM;QACR,MAAM,YAAY,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,aAAa,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG;YAClD,EAAE,EAAE,GAAG;SACR,CAAC,CAAA;IACJ,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAA;AACpD,CAAC,CAAA;AAED,kEAAkE;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,GAAQ,EAAkB,EAAE;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IAC3C,OAAO,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC,CAAA"}

package/dist/modules/website_form/retention.d.ts

@@ -0,0 +1,70 @@
+import type { Row } from '@ketvietlab/ketjs';
+/**
+ * What a submission is, after the answers are gone.
+ *
+ * The row stays. Deleting it would take the consent record with it — the one
+ * thing that says this person was asked and agreed — and would free the dedupe
+ * key, so a client replaying a months-old request would be accepted a second
+ * time as new. What the visitor is owed is that their answers stop existing,
+ * not that the fact they wrote to us is forgotten.
+ */
+export declare const PURGED_STATUS = "purged";
+/** The largest retention window we will accept, so a typo cannot mean "never". */
+export declare const MAX_RETENTION_DAYS = 3650;
+/** One pass erases at most this many rows, so a first run cannot stall a worker. */
+export declare const PURGE_BATCH = 500;
+/** An export is a file someone downloads, not a query — it has to end. */
+export declare const MAX_EXPORT_ROWS = 5000;
+export type FormFieldName = string;
+/** The field names a form declares, in declaration order. */
+export declare const schemaFieldNames: (schema: unknown) => FormFieldName[];
+/**
+ * The answers a list may show, as names.
+ *
+ * Unknown names are dropped rather than rejected: a field removed from the
+ * schema leaves its name behind in this list, and the right reading of a name
+ * with no field is "show nothing", not "fail the screen".
+ */
+export declare const summaryFieldsOf: (form: Row | null | undefined) => FormFieldName[];
+/**
+ * The part of a submission a worklist is allowed to render.
+ *
+ * Empty by default, and empty is a usable answer: a queue that shows when
+ * something arrived and whether it has been dealt with is workable without
+ * showing what anyone wrote. Opening one record is a separate, recorded act.
+ */
+export declare const summaryOf: (payload: unknown, allowed: FormFieldName[]) => Record<string, unknown>;
+/** The answers an export may carry, narrowed to what the form actually asks. */
+export declare const exportRow: (payload: unknown, fields: FormFieldName[]) => Record<string, unknown>;
+/** Rows created at or before this instant are past their retention window. */
+export declare const retentionCutoff: (retentionDays: unknown, now: Date) => Date | null;
+/** A hold is a reason someone wrote down; an empty one is not a hold. */
+export declare const isHeld: (row: Row | null | undefined) => boolean;
+export declare const isPurged: (row: Row | null | undefined) => boolean;
+/**
+ * Everything on a submission that describes the person who sent it.
+ *
+ * `fingerprint` and `source` go with the answers: one is derived from an
+ * address and a browser, the other is the page they came from, which routinely
+ * carries a query string. `dedupeKey` stays — it is a hash of a key the client
+ * chose, and it is what stops a replay being accepted twice.
+ */
+export declare const purgePatch: (now: Date) => Record<string, unknown>;
+export type Parsed<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+};
+/**
+ * What an editor may declare as safe to preview.
+ *
+ * A malformed list is refused rather than coerced: the alternative is an
+ * editor who mistyped a field name being shown an empty preview column and
+ * concluding the feature is broken, when what happened is that we silently
+ * dropped their input.
+ */
+export declare const parseSummaryFields: (value: unknown) => Parsed<string[] | null>;
+/** A retention window is a whole number of days inside a decade, or nothing. */
+export declare const parseRetentionDays: (value: unknown) => Parsed<number | null>;
+//# sourceMappingURL=retention.d.ts.map

package/dist/modules/website_form/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/retention.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAE5C;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,WAAW,CAAA;AAErC,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,OAAQ,CAAA;AAEvC,oFAAoF;AACpF,eAAO,MAAM,WAAW,MAAM,CAAA;AAE9B,0EAA0E;AAC1E,eAAO,MAAM,eAAe,OAAQ,CAAA;AAIpC,MAAM,MAAM,aAAa,GAAG,MAAM,CAAA;AAElC,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,WAAY,OAAO,KAAG,aAAa,EAO/D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SAAU,GAAG,GAAG,IAAI,GAAG,SAAS,KAAG,aAAa,EAa3E,CAAA;AAeD;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,YAAa,OAAO,WAAW,aAAa,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM5F,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,SAAS,YAAa,OAAO,UAAU,aAAa,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAK3F,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,eAAe,kBAAmB,OAAO,OAAO,IAAI,KAAG,IAAI,GAAG,IAI1E,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,MAAM,QAAS,GAAG,GAAG,IAAI,GAAG,SAAS,KAAG,OACoB,CAAA;AAEzE,eAAO,MAAM,QAAQ,QAAS,GAAG,GAAG,IAAI,GAAG,SAAS,KAAG,OAAgC,CAAA;AAEvF;;;;;;;GAOG;AACH,eAAO,MAAM,UAAU,QAAS,IAAI,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM3D,CAAA;AAEF,MAAM,MAAM,MAAM,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAA;AAE9D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CASzE,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,UAAW,OAAO,KAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAKvE,CAAA"}

package/dist/modules/website_form/retention.js

@@ -0,0 +1,145 @@
+/**
+ * What a submission is, after the answers are gone.
+ *
+ * The row stays. Deleting it would take the consent record with it — the one
+ * thing that says this person was asked and agreed — and would free the dedupe
+ * key, so a client replaying a months-old request would be accepted a second
+ * time as new. What the visitor is owed is that their answers stop existing,
+ * not that the fact they wrote to us is forgotten.
+ */
+export const PURGED_STATUS = 'purged';
+/** The largest retention window we will accept, so a typo cannot mean "never". */
+export const MAX_RETENTION_DAYS = 3_650;
+/** One pass erases at most this many rows, so a first run cannot stall a worker. */
+export const PURGE_BATCH = 500;
+/** An export is a file someone downloads, not a query — it has to end. */
+export const MAX_EXPORT_ROWS = 5_000;
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** The field names a form declares, in declaration order. */
+export const schemaFieldNames = (schema) => {
+    if (!schema || typeof schema !== 'object' || Array.isArray(schema))
+        return [];
+    const fields = schema.fields;
+    if (!Array.isArray(fields))
+        return [];
+    return fields
+        .map((field) => (field && typeof field === 'object' ? field.name : undefined))
+        .filter((name) => typeof name === 'string');
+};
+/**
+ * The answers a list may show, as names.
+ *
+ * Unknown names are dropped rather than rejected: a field removed from the
+ * schema leaves its name behind in this list, and the right reading of a name
+ * with no field is "show nothing", not "fail the screen".
+ */
+export const summaryFieldsOf = (form) => {
+    const declared = form?.summaryFields;
+    const raw = typeof declared === 'string' ? safeParse(declared) : declared;
+    if (!Array.isArray(raw))
+        return [];
+    const known = new Set(schemaFieldNames(form?.schema));
+    const seen = new Set();
+    const names = [];
+    for (const entry of raw) {
+        if (typeof entry !== 'string' || !known.has(entry) || seen.has(entry))
+            continue;
+        seen.add(entry);
+        names.push(entry);
+    }
+    return names;
+};
+const safeParse = (value) => {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+};
+const payloadOf = (payload) => {
+    const raw = typeof payload === 'string' ? safeParse(payload) : payload;
+    return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+};
+/**
+ * The part of a submission a worklist is allowed to render.
+ *
+ * Empty by default, and empty is a usable answer: a queue that shows when
+ * something arrived and whether it has been dealt with is workable without
+ * showing what anyone wrote. Opening one record is a separate, recorded act.
+ */
+export const summaryOf = (payload, allowed) => {
+    if (!allowed.length)
+        return {};
+    const value = payloadOf(payload);
+    const summary = {};
+    for (const name of allowed)
+        if (name in value)
+            summary[name] = value[name];
+    return summary;
+};
+/** The answers an export may carry, narrowed to what the form actually asks. */
+export const exportRow = (payload, fields) => {
+    const value = payloadOf(payload);
+    const row = {};
+    for (const name of fields)
+        row[name] = name in value ? value[name] : null;
+    return row;
+};
+/** Rows created at or before this instant are past their retention window. */
+export const retentionCutoff = (retentionDays, now) => {
+    const days = Number(retentionDays);
+    if (!Number.isInteger(days) || days < 1 || days > MAX_RETENTION_DAYS)
+        return null;
+    return new Date(now.getTime() - days * DAY_MS);
+};
+/** A hold is a reason someone wrote down; an empty one is not a hold. */
+export const isHeld = (row) => typeof row?.holdReason === 'string' && row.holdReason.trim().length > 0;
+export const isPurged = (row) => row?.purgedAt != null;
+/**
+ * Everything on a submission that describes the person who sent it.
+ *
+ * `fingerprint` and `source` go with the answers: one is derived from an
+ * address and a browser, the other is the page they came from, which routinely
+ * carries a query string. `dedupeKey` stays — it is a hash of a key the client
+ * chose, and it is what stops a replay being accepted twice.
+ */
+export const purgePatch = (now) => ({
+    payload: {},
+    source: null,
+    fingerprint: null,
+    status: PURGED_STATUS,
+    purgedAt: now.toISOString(),
+});
+/**
+ * What an editor may declare as safe to preview.
+ *
+ * A malformed list is refused rather than coerced: the alternative is an
+ * editor who mistyped a field name being shown an empty preview column and
+ * concluding the feature is broken, when what happened is that we silently
+ * dropped their input.
+ */
+export const parseSummaryFields = (value) => {
+    if (value == null)
+        return { ok: true, value: null };
+    if (!Array.isArray(value))
+        return { ok: false };
+    const names = [];
+    for (const entry of value) {
+        if (typeof entry !== 'string' || !entry.trim())
+            return { ok: false };
+        if (!names.includes(entry))
+            names.push(entry);
+    }
+    return { ok: true, value: names.length ? names : null };
+};
+/** A retention window is a whole number of days inside a decade, or nothing. */
+export const parseRetentionDays = (value) => {
+    if (value == null)
+        return { ok: true, value: null };
+    const days = Number(value);
+    if (!Number.isInteger(days) || days < 1 || days > MAX_RETENTION_DAYS)
+        return { ok: false };
+    return { ok: true, value: days };
+};
+//# sourceMappingURL=retention.js.map

package/dist/modules/website_form/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/website_form/retention.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAA;AAErC,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAEvC,oFAAoF;AACpF,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAA;AAE9B,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAA;AAEpC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAIlC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAe,EAAmB,EAAE;IACnE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IAC7E,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;SACrG,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAA4B,EAAmB,EAAE;IAC/E,MAAM,QAAQ,GAAG,IAAI,EAAE,aAAa,CAAA;IACpC,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAoB,EAAE,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC/E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE;IAC3C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,OAAgB,EAA2B,EAAE;IAC9D,MAAM,GAAG,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,EAAE,CAAA;AACtG,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,OAAwB,EAA2B,EAAE;IAC/F,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,IAAI,IAAI,IAAI,KAAK;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAA;IAC1E,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,MAAuB,EAA2B,EAAE;IAC9F,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,aAAsB,EAAE,GAAS,EAAe,EAAE;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,kBAAkB;QAAE,OAAO,IAAI,CAAA;IACjF,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,CAAA;AAChD,CAAC,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,GAA2B,EAAW,EAAE,CAC7D,OAAO,GAAG,EAAE,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAA;AAEzE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAA2B,EAAW,EAAE,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAA;AAEvF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAS,EAA2B,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,EAAE;IACX,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE,aAAa;IACrB,QAAQ,EAAE,GAAG,CAAC,WAAW,EAAE;CAC5B,CAAC,CAAA;AAIF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAA2B,EAAE;IAC5E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;QACpE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACzD,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAyB,EAAE;IAC1E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,kBAAkB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAA;IAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AAClC,CAAC,CAAA"}

package/dist/modules/website_form/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,UAAU,EAAgB,MAAM,mBAAmB,CAAA;AAgCxE,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA2C7C,CAAA"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/website_form/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,UAAU,EAAgB,MAAM,mBAAmB,CAAA;AAmCxE,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAiF7C,CAAA"}