@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/api/[id]/versions/fork/route.js

@@ -0,0 +1,92 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import {
+  formVersionForkDraftCommandSchema,
+  formVersionForkRequestSchema
+} from "../../../../data/validators.js";
+import {
+  attachOperationMetadata,
+  buildFormsRouteContext,
+  handleRouteError,
+  jsonError,
+  withMutationGuard,
+  withScopedPayload
+} from "../../../helpers.js";
+import { FORM_VERSION_RESOURCE_KIND } from "../../../../commands/shared.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["forms.design"] }
+};
+const responseSchema = z.object({
+  versionId: z.string().uuid()
+});
+const errorSchema = z.object({ error: z.string() });
+function extractFormId(req) {
+  const url = new URL(req.url);
+  const segments = url.pathname.split("/").filter(Boolean);
+  const idx = segments.findIndex((segment) => segment === "forms");
+  return idx >= 0 ? segments[idx + 1] ?? "" : "";
+}
+async function POST(req) {
+  try {
+    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req);
+    if (!organizationId || !tenantId) {
+      return jsonError(400, "forms.errors.organization_required");
+    }
+    const formId = extractFormId(req);
+    if (!formId) return jsonError(400, "forms.errors.invalid_id");
+    const body = await readJsonSafe(req, {}) ?? {};
+    const parsed = formVersionForkRequestSchema.parse(body);
+    const scoped = withScopedPayload({ ...parsed, formId }, ctx, translate);
+    const input = formVersionForkDraftCommandSchema.parse(scoped);
+    return await withMutationGuard({
+      ctx,
+      tenantId,
+      organizationId,
+      resourceKind: FORM_VERSION_RESOURCE_KIND,
+      resourceId: "new",
+      operation: "create",
+      request: req,
+      payload: scoped,
+      run: async () => {
+        const commandBus = ctx.container.resolve("commandBus");
+        const { result, logEntry } = await commandBus.execute(
+          "forms.form_version.fork_draft",
+          { input, ctx }
+        );
+        const response = NextResponse.json({ versionId: result?.versionId ?? null }, { status: 201 });
+        return attachOperationMetadata(response, logEntry, FORM_VERSION_RESOURCE_KIND, result?.versionId ?? null);
+      }
+    });
+  } catch (error) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(error);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return handleRouteError("forms[id].versions.fork.POST", error);
+  }
+}
+const openApi = {
+  tag: "Forms",
+  summary: "Fork a new draft form version",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Fork draft",
+      description: "Creates a new draft version. Optionally clones from `fromVersionId`. Rejects if a draft already exists (422 draft_already_exists).",
+      requestBody: { contentType: "application/json", schema: formVersionForkRequestSchema },
+      responses: [{ status: 201, description: "Draft created", schema: responseSchema }],
+      errors: [
+        { status: 404, description: "Form not found", schema: errorSchema },
+        { status: 422, description: "Draft already exists", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/[id]/versions/fork/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/%5Bid%5D/versions/fork/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  formVersionForkDraftCommandSchema,\n  formVersionForkRequestSchema,\n  type FormVersionForkDraftCommandInput,\n} from '../../../../data/validators'\nimport {\n  attachOperationMetadata,\n  buildFormsRouteContext,\n  handleRouteError,\n  jsonError,\n  withMutationGuard,\n  withScopedPayload,\n} from '../../../helpers'\nimport { FORM_VERSION_RESOURCE_KIND } from '../../../../commands/shared'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['forms.design'] },\n}\n\nconst responseSchema = z.object({\n  versionId: z.string().uuid(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nfunction extractFormId(req: Request): string {\n  const url = new URL(req.url)\n  const segments = url.pathname.split('/').filter(Boolean)\n  const idx = segments.findIndex((segment) => segment === 'forms')\n  return idx >= 0 ? segments[idx + 1] ?? '' : ''\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const formId = extractFormId(req)\n    if (!formId) return jsonError(400, 'forms.errors.invalid_id')\n\n    const body = (await readJsonSafe<Record<string, unknown>>(req, {})) ?? {}\n    const parsed = formVersionForkRequestSchema.parse(body)\n    const scoped = withScopedPayload({ ...parsed, formId }, ctx, translate)\n    const input = formVersionForkDraftCommandSchema.parse(scoped) satisfies FormVersionForkDraftCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_VERSION_RESOURCE_KIND,\n      resourceId: 'new',\n      operation: 'create',\n      request: req,\n      payload: scoped as Record<string, unknown>,\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<FormVersionForkDraftCommandInput, { versionId: string }>(\n          'forms.form_version.fork_draft',\n          { input, ctx },\n        )\n        const response = NextResponse.json({ versionId: result?.versionId ?? null }, { status: 201 })\n        return attachOperationMetadata(response, logEntry, FORM_VERSION_RESOURCE_KIND, result?.versionId ?? null)\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('forms[id].versions.fork.POST', error)\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Forms',\n  summary: 'Fork a new draft form version',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Fork draft',\n      description:\n        'Creates a new draft version. Optionally clones from `fromVersionId`. Rejects if a draft already exists (422 draft_already_exists).',\n      requestBody: { contentType: 'application/json', schema: formVersionForkRequestSchema },\n      responses: [{ status: 201, description: 'Draft created', schema: responseSchema }],\n      errors: [\n        { status: 404, description: 'Form not found', schema: errorSchema },\n        { status: 422, description: 'Draft already exists', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0CAA0C;AAEnD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAC/D;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,KAAK;AAC7B,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,SAAS,cAAc,KAAsB;AAC3C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACvD,QAAM,MAAM,SAAS,UAAU,CAAC,YAAY,YAAY,OAAO;AAC/D,SAAO,OAAO,IAAI,SAAS,MAAM,CAAC,KAAK,KAAK;AAC9C;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,UAAU,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,SAAS,cAAc,GAAG;AAChC,QAAI,CAAC,OAAQ,QAAO,UAAU,KAAK,yBAAyB;AAE5D,UAAM,OAAQ,MAAM,aAAsC,KAAK,CAAC,CAAC,KAAM,CAAC;AACxE,UAAM,SAAS,6BAA6B,MAAM,IAAI;AACtD,UAAM,SAAS,kBAAkB,EAAE,GAAG,QAAQ,OAAO,GAAG,KAAK,SAAS;AACtE,UAAM,QAAQ,kCAAkC,MAAM,MAAM;AAE5D,WAAO,MAAM,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS;AAAA,MACT,KAAK,YAAY;AACf,cAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,cAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,UAC5C;AAAA,UACA,EAAE,OAAO,IAAI;AAAA,QACf;AACA,cAAM,WAAW,aAAa,KAAK,EAAE,WAAW,QAAQ,aAAa,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC5F,eAAO,wBAAwB,UAAU,UAAU,4BAA4B,QAAQ,aAAa,IAAI;AAAA,MAC1G;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,iBAAiB,gCAAgC,KAAK;AAAA,EAC/D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,6BAA6B;AAAA,MACrF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,eAAe,CAAC;AAAA,MACjF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/forms/api/attachment-helpers.js

@@ -0,0 +1,111 @@
+import { NextResponse } from "next/server";
+import { FormSubmission, FormVersion } from "../data/entities.js";
+import { isAttachmentServiceError } from "../services/attachment-service.js";
+import { resolveMaxUploadBytes } from "../services/upload-validation.js";
+const MULTIPART_OVERHEAD_BYTES = 64 * 1024;
+const SANDBOXED_DOWNLOAD_HEADERS = {
+  "content-security-policy": "default-src 'none'; sandbox",
+  "x-content-type-options": "nosniff"
+};
+function mapAttachmentError(error) {
+  if (isAttachmentServiceError(error)) {
+    return NextResponse.json({ error: error.code, message: error.message }, { status: error.httpStatus });
+  }
+  const message = error instanceof Error ? error.message : "Unknown error";
+  return NextResponse.json({ error: "INTERNAL_ERROR", message }, { status: 500 });
+}
+async function resolveFieldUploadConfig(em, args) {
+  const submission = await em.findOne(FormSubmission, {
+    id: args.submissionId,
+    organizationId: args.organizationId,
+    tenantId: args.tenantId,
+    deletedAt: null
+  });
+  if (!submission) return null;
+  const version = await em.findOne(FormVersion, {
+    id: submission.formVersionId,
+    organizationId: args.organizationId,
+    tenantId: args.tenantId
+  });
+  if (!version) return null;
+  const properties = version.schema.properties;
+  if (!properties || typeof properties !== "object" || Array.isArray(properties)) return null;
+  const node = properties[args.fieldKey];
+  if (!node || typeof node !== "object" || Array.isArray(node)) return null;
+  const record = node;
+  if (record["x-om-type"] !== "file") return null;
+  const acceptRaw = record["x-om-accept"];
+  const accept = Array.isArray(acceptRaw) ? acceptRaw.filter((entry) => typeof entry === "string" && entry.length > 0) : null;
+  const maxRaw = record["x-om-max-size-bytes"];
+  const maxSizeBytes = typeof maxRaw === "number" && Number.isFinite(maxRaw) && maxRaw > 0 ? maxRaw : null;
+  return {
+    fieldKey: args.fieldKey,
+    accept: accept && accept.length > 0 ? accept : null,
+    maxSizeBytes,
+    multiple: record["x-om-multiple"] === true
+  };
+}
+async function parseUploadBody(req, maxFileBytes = resolveMaxUploadBytes(process.env)) {
+  const maxBodyBytes = maxFileBytes + MULTIPART_OVERHEAD_BYTES;
+  const declaredLength = Number(req.headers.get("content-length"));
+  if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+    return NextResponse.json({ error: "TOO_LARGE", message: "Upload exceeds the allowed size." }, { status: 413 });
+  }
+  const boundedBody = await readBoundedBody(req, maxBodyBytes);
+  if (boundedBody instanceof NextResponse) return boundedBody;
+  let form;
+  try {
+    const boundedRequest = new Request(req.url, {
+      method: req.method,
+      headers: req.headers,
+      body: boundedBody
+    });
+    form = await boundedRequest.formData();
+  } catch {
+    return NextResponse.json({ error: "VALIDATION_FAILED", message: "Expected multipart/form-data." }, { status: 422 });
+  }
+  const fieldKeyRaw = form.get("field_key");
+  if (typeof fieldKeyRaw !== "string" || fieldKeyRaw.length === 0) {
+    return NextResponse.json({ error: "VALIDATION_FAILED", message: "Missing field_key." }, { status: 422 });
+  }
+  const filePart = form.get("file");
+  if (!(filePart instanceof File)) {
+    return NextResponse.json({ error: "VALIDATION_FAILED", message: "Missing file part." }, { status: 422 });
+  }
+  if (filePart.size > maxFileBytes) {
+    return NextResponse.json({ error: "TOO_LARGE", message: "Upload exceeds the allowed size." }, { status: 413 });
+  }
+  const arrayBuffer = await filePart.arrayBuffer();
+  return {
+    fieldKey: fieldKeyRaw,
+    filename: filePart.name || "upload",
+    contentType: filePart.type || "application/octet-stream",
+    bytes: Buffer.from(arrayBuffer)
+  };
+}
+async function readBoundedBody(req, maxBodyBytes) {
+  if (!req.body) {
+    return NextResponse.json({ error: "VALIDATION_FAILED", message: "Expected multipart/form-data." }, { status: 422 });
+  }
+  const reader = req.body.getReader();
+  const chunks = [];
+  let totalBytes = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    totalBytes += value.byteLength;
+    if (totalBytes > maxBodyBytes) {
+      await reader.cancel();
+      return NextResponse.json({ error: "TOO_LARGE", message: "Upload exceeds the allowed size." }, { status: 413 });
+    }
+    chunks.push(Buffer.from(value));
+  }
+  return Buffer.concat(chunks, totalBytes);
+}
+export {
+  SANDBOXED_DOWNLOAD_HEADERS,
+  mapAttachmentError,
+  parseUploadBody,
+  resolveFieldUploadConfig
+};
+//# sourceMappingURL=attachment-helpers.js.map

package/dist/modules/forms/api/attachment-helpers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/api/attachment-helpers.ts"],
+  "sourcesContent": ["/**\n * Shared helpers for the W4 attachment upload / download routes.\n *\n * Resolves the per-field upload config (`x-om-accept`, `x-om-max-size-bytes`,\n * `x-om-multiple`) from the submission's pinned form version \u2014 the server is\n * authoritative; the client never supplies these constraints.\n */\n\nimport { NextResponse } from 'next/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FormSubmission, FormVersion } from '../data/entities'\nimport { AttachmentServiceError, isAttachmentServiceError } from '../services/attachment-service'\nimport { resolveMaxUploadBytes } from '../services/upload-validation'\n\nconst MULTIPART_OVERHEAD_BYTES = 64 * 1024\n\nexport const SANDBOXED_DOWNLOAD_HEADERS = {\n  'content-security-policy': \"default-src 'none'; sandbox\",\n  'x-content-type-options': 'nosniff',\n} as const\n\nexport type FieldUploadConfig = {\n  fieldKey: string\n  accept: string[] | null\n  maxSizeBytes: number | null\n  multiple: boolean\n}\n\nexport function mapAttachmentError(error: unknown): NextResponse {\n  if (isAttachmentServiceError(error)) {\n    return NextResponse.json({ error: error.code, message: error.message }, { status: error.httpStatus })\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\n/**\n * Looks up the `file`-typed field node on the submission's pinned form version\n * and reads its upload config. Returns `null` when the submission, version, or\n * field is missing, or when the field is not a `file` type. Scope is enforced\n * by org+tenant on both reads.\n */\nexport async function resolveFieldUploadConfig(\n  em: EntityManager,\n  args: { organizationId: string; tenantId: string; submissionId: string; fieldKey: string },\n): Promise<FieldUploadConfig | null> {\n  const submission = await em.findOne(FormSubmission, {\n    id: args.submissionId,\n    organizationId: args.organizationId,\n    tenantId: args.tenantId,\n    deletedAt: null,\n  })\n  if (!submission) return null\n\n  const version = await em.findOne(FormVersion, {\n    id: submission.formVersionId,\n    organizationId: args.organizationId,\n    tenantId: args.tenantId,\n  })\n  if (!version) return null\n\n  const properties = (version.schema as Record<string, unknown>).properties\n  if (!properties || typeof properties !== 'object' || Array.isArray(properties)) return null\n  const node = (properties as Record<string, unknown>)[args.fieldKey]\n  if (!node || typeof node !== 'object' || Array.isArray(node)) return null\n\n  const record = node as Record<string, unknown>\n  if (record['x-om-type'] !== 'file') return null\n\n  const acceptRaw = record['x-om-accept']\n  const accept = Array.isArray(acceptRaw)\n    ? acceptRaw.filter((entry): entry is string => typeof entry === 'string' && entry.length > 0)\n    : null\n  const maxRaw = record['x-om-max-size-bytes']\n  const maxSizeBytes = typeof maxRaw === 'number' && Number.isFinite(maxRaw) && maxRaw > 0 ? maxRaw : null\n\n  return {\n    fieldKey: args.fieldKey,\n    accept: accept && accept.length > 0 ? accept : null,\n    maxSizeBytes,\n    multiple: record['x-om-multiple'] === true,\n  }\n}\n\nexport type ParsedUpload = {\n  fieldKey: string\n  filename: string\n  contentType: string\n  bytes: Buffer\n}\n\n/**\n * Parses a multipart/form-data upload body. Expects a `file` part and a\n * `field_key` text part. Returns a 422 response describing the failure when\n * the body is malformed.\n */\nexport async function parseUploadBody(\n  req: Request,\n  maxFileBytes: number = resolveMaxUploadBytes(process.env),\n): Promise<ParsedUpload | NextResponse> {\n  const maxBodyBytes = maxFileBytes + MULTIPART_OVERHEAD_BYTES\n  const declaredLength = Number(req.headers.get('content-length'))\n  if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {\n    return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n  }\n\n  const boundedBody = await readBoundedBody(req, maxBodyBytes)\n  if (boundedBody instanceof NextResponse) return boundedBody\n\n  let form: FormData\n  try {\n    const boundedRequest = new Request(req.url, {\n      method: req.method,\n      headers: req.headers,\n      body: boundedBody as unknown as BodyInit,\n    })\n    form = await boundedRequest.formData()\n  } catch {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Expected multipart/form-data.' }, { status: 422 })\n  }\n  const fieldKeyRaw = form.get('field_key')\n  if (typeof fieldKeyRaw !== 'string' || fieldKeyRaw.length === 0) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Missing field_key.' }, { status: 422 })\n  }\n  const filePart = form.get('file')\n  if (!(filePart instanceof File)) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Missing file part.' }, { status: 422 })\n  }\n  if (filePart.size > maxFileBytes) {\n    return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n  }\n  const arrayBuffer = await filePart.arrayBuffer()\n  return {\n    fieldKey: fieldKeyRaw,\n    filename: filePart.name || 'upload',\n    contentType: filePart.type || 'application/octet-stream',\n    bytes: Buffer.from(arrayBuffer),\n  }\n}\n\nasync function readBoundedBody(req: Request, maxBodyBytes: number): Promise<Buffer | NextResponse> {\n  if (!req.body) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'Expected multipart/form-data.' }, { status: 422 })\n  }\n\n  const reader = req.body.getReader()\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    totalBytes += value.byteLength\n    if (totalBytes > maxBodyBytes) {\n      await reader.cancel()\n      return NextResponse.json({ error: 'TOO_LARGE', message: 'Upload exceeds the allowed size.' }, { status: 413 })\n    }\n    chunks.push(Buffer.from(value))\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAoB;AAE7B,SAAS,gBAAgB,mBAAmB;AAC5C,SAAiC,gCAAgC;AACjE,SAAS,6BAA6B;AAEtC,MAAM,2BAA2B,KAAK;AAE/B,MAAM,6BAA6B;AAAA,EACxC,2BAA2B;AAAA,EAC3B,0BAA0B;AAC5B;AASO,SAAS,mBAAmB,OAA8B;AAC/D,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,QAAQ,GAAG,EAAE,QAAQ,MAAM,WAAW,CAAC;AAAA,EACtG;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAQA,eAAsB,yBACpB,IACA,MACmC;AACnC,QAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,WAAY,QAAO;AAExB,QAAM,UAAU,MAAM,GAAG,QAAQ,aAAa;AAAA,IAC5C,IAAI,WAAW;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,aAAc,QAAQ,OAAmC;AAC/D,MAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,EAAG,QAAO;AACvF,QAAM,OAAQ,WAAuC,KAAK,QAAQ;AAClE,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,EAAG,QAAO;AAErE,QAAM,SAAS;AACf,MAAI,OAAO,WAAW,MAAM,OAAQ,QAAO;AAE3C,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,SAAS,MAAM,QAAQ,SAAS,IAClC,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IAC1F;AACJ,QAAM,SAAS,OAAO,qBAAqB;AAC3C,QAAM,eAAe,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAEpG,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf,QAAQ,UAAU,OAAO,SAAS,IAAI,SAAS;AAAA,IAC/C;AAAA,IACA,UAAU,OAAO,eAAe,MAAM;AAAA,EACxC;AACF;AAcA,eAAsB,gBACpB,KACA,eAAuB,sBAAsB,QAAQ,GAAG,GAClB;AACtC,QAAM,eAAe,eAAe;AACpC,QAAM,iBAAiB,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC;AAC/D,MAAI,OAAO,SAAS,cAAc,KAAK,iBAAiB,cAAc;AACpE,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AAEA,QAAM,cAAc,MAAM,gBAAgB,KAAK,YAAY;AAC3D,MAAI,uBAAuB,aAAc,QAAO;AAEhD,MAAI;AACJ,MAAI;AACF,UAAM,iBAAiB,IAAI,QAAQ,IAAI,KAAK;AAAA,MAC1C,QAAQ,IAAI;AAAA,MACZ,SAAS,IAAI;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,WAAO,MAAM,eAAe,SAAS;AAAA,EACvC,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AACA,QAAM,cAAc,KAAK,IAAI,WAAW;AACxC,MAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,GAAG;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,QAAM,WAAW,KAAK,IAAI,MAAM;AAChC,MAAI,EAAE,oBAAoB,OAAO;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AACA,MAAI,SAAS,OAAO,cAAc;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/G;AACA,QAAM,cAAc,MAAM,SAAS,YAAY;AAC/C,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,SAAS,QAAQ;AAAA,IAC3B,aAAa,SAAS,QAAQ;AAAA,IAC9B,OAAO,OAAO,KAAK,WAAW;AAAA,EAChC;AACF;AAEA,eAAe,gBAAgB,KAAc,cAAsD;AACjG,MAAI,CAAC,IAAI,MAAM;AACb,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AAEA,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,SAAmB,CAAC;AAC1B,MAAI,aAAa;AACjB,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,kBAAc,MAAM;AACpB,QAAI,aAAa,cAAc;AAC7B,YAAM,OAAO,OAAO;AACpB,aAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/G;AACA,WAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,EAChC;AACA,SAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;",
+  "names": []
+}

package/dist/modules/forms/api/by-key/[key]/active/route.js

@@ -0,0 +1,140 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import { isSubmissionServiceError } from "../../../../services/submission-service.js";
+import { sliceFormDefinition } from "../../../../lib/form-definition-slicing.js";
+const metadata = {
+  GET: { requireAuth: false }
+};
+async function GET(req, context) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  const params = await Promise.resolve(context.params);
+  const key = String(params.key);
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  try {
+    const { form, formVersion, compiled } = await service.getActiveFormVersionByKey({
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      formKey: key
+    });
+    const callerRoles = resolveCallerRoles(auth.resolvedFeatures, formVersion.schema);
+    const fieldIndex = {};
+    for (const [fieldKey, descriptor] of Object.entries(compiled.fieldIndex)) {
+      const visible = callerRoles.some(
+        (role) => descriptor.visibleTo.includes(role) || descriptor.editableBy.includes(role)
+      );
+      if (!visible) continue;
+      fieldIndex[fieldKey] = {
+        key: descriptor.key,
+        type: descriptor.type,
+        sectionKey: descriptor.sectionKey,
+        sensitive: descriptor.sensitive,
+        editableBy: descriptor.editableBy,
+        visibleTo: descriptor.visibleTo,
+        required: descriptor.required
+      };
+    }
+    const slicedDefinition = sliceFormDefinition(
+      formVersion.schema,
+      formVersion.uiSchema,
+      new Set(Object.keys(fieldIndex))
+    );
+    return NextResponse.json({
+      form: {
+        id: form.id,
+        key: form.key,
+        name: form.name,
+        defaultLocale: form.defaultLocale,
+        supportedLocales: form.supportedLocales
+      },
+      formVersion: {
+        id: formVersion.id,
+        versionNumber: formVersion.versionNumber,
+        schemaHash: compiled.schemaHash,
+        registryVersion: compiled.registryVersion,
+        roles: Array.isArray(formVersion.roles) ? formVersion.roles : []
+      },
+      schema: slicedDefinition.schema,
+      uiSchema: slicedDefinition.uiSchema,
+      fieldIndex,
+      callerRoles
+    });
+  } catch (error) {
+    return mapError(error);
+  }
+}
+function resolveCallerRoles(features, schema) {
+  if (features.includes("*")) return ["admin"];
+  const defaultRole = schema["x-om-default-actor-role"];
+  return typeof defaultRole === "string" && defaultRole.length > 0 ? [defaultRole] : [];
+}
+function mapError(error) {
+  if (isSubmissionServiceError(error)) {
+    return NextResponse.json(
+      { error: error.code, message: error.message, details: error.details ?? null },
+      { status: error.httpStatus }
+    );
+  }
+  const message = error instanceof Error ? error.message : "Unknown error";
+  return NextResponse.json({ error: "INTERNAL_ERROR", message }, { status: 500 });
+}
+const fieldDescriptorSchema = z.object({
+  key: z.string(),
+  type: z.string(),
+  sectionKey: z.string().nullable(),
+  sensitive: z.boolean(),
+  editableBy: z.array(z.string()),
+  visibleTo: z.array(z.string()),
+  required: z.boolean()
+});
+const responseSchema = z.object({
+  form: z.object({
+    id: z.string().uuid(),
+    key: z.string(),
+    name: z.string(),
+    defaultLocale: z.string(),
+    supportedLocales: z.array(z.string())
+  }),
+  formVersion: z.object({
+    id: z.string().uuid(),
+    versionNumber: z.number().int(),
+    schemaHash: z.string(),
+    registryVersion: z.string(),
+    roles: z.array(z.string())
+  }),
+  schema: z.record(z.string(), z.unknown()),
+  uiSchema: z.record(z.string(), z.unknown()),
+  fieldIndex: z.record(z.string(), fieldDescriptorSchema),
+  callerRoles: z.array(z.string())
+});
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const getMethodDoc = {
+  summary: "Get active form version by key",
+  description: "Returns the published form version matching the supplied key, sliced to the caller's available roles.",
+  tags: ["Forms Runtime"],
+  responses: [{ status: 200, description: "Active form version", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Form not found", schema: errorSchema },
+    { status: 422, description: "Form is not active or has no published version", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Active form version",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/by-key/[key]/active/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/by-key/%5Bkey%5D/active/route.ts"],
+  "sourcesContent": ["/**\n * Runtime API \u2014 GET /api/forms/by-key/:key/active\n *\n * Returns the active (published) form version for a form key, sliced to the\n * roles the calling customer is permitted to act on. Customer authentication\n * is required.\n *\n * The API exposes the JSON Schema, ui schema, declared roles, declared\n * sections, and the field index sliced by the caller's available roles.\n * It does not return submission data.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService, isSubmissionServiceError } from '../../../../services/submission-service'\nimport { sliceFormDefinition } from '../../../../lib/form-definition-slicing'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { key: string } | Promise<{ key: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n\n  const params = await Promise.resolve(context.params)\n  const key = String(params.key)\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const { form, formVersion, compiled } = await service.getActiveFormVersionByKey({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      formKey: key,\n    })\n\n    const callerRoles = resolveCallerRoles(auth.resolvedFeatures, formVersion.schema)\n\n    const fieldIndex: Record<string, unknown> = {}\n    for (const [fieldKey, descriptor] of Object.entries(compiled.fieldIndex)) {\n      const visible = callerRoles.some((role) =>\n        descriptor.visibleTo.includes(role) || descriptor.editableBy.includes(role),\n      )\n      if (!visible) continue\n      fieldIndex[fieldKey] = {\n        key: descriptor.key,\n        type: descriptor.type,\n        sectionKey: descriptor.sectionKey,\n        sensitive: descriptor.sensitive,\n        editableBy: descriptor.editableBy,\n        visibleTo: descriptor.visibleTo,\n        required: descriptor.required,\n      }\n    }\n    const slicedDefinition = sliceFormDefinition(\n      formVersion.schema,\n      formVersion.uiSchema,\n      new Set(Object.keys(fieldIndex)),\n    )\n\n    return NextResponse.json({\n      form: {\n        id: form.id,\n        key: form.key,\n        name: form.name,\n        defaultLocale: form.defaultLocale,\n        supportedLocales: form.supportedLocales,\n      },\n      formVersion: {\n        id: formVersion.id,\n        versionNumber: formVersion.versionNumber,\n        schemaHash: compiled.schemaHash,\n        registryVersion: compiled.registryVersion,\n        roles: Array.isArray(formVersion.roles) ? formVersion.roles : [],\n      },\n      schema: slicedDefinition.schema,\n      uiSchema: slicedDefinition.uiSchema,\n      fieldIndex,\n      callerRoles,\n    })\n  } catch (error) {\n    return mapError(error)\n  }\n}\n\nfunction resolveCallerRoles(features: string[], schema: Record<string, unknown>): string[] {\n  if (features.includes('*')) return ['admin']\n  const defaultRole = schema['x-om-default-actor-role']\n  return typeof defaultRole === 'string' && defaultRole.length > 0 ? [defaultRole] : []\n}\n\nfunction mapError(error: unknown): NextResponse {\n  if (isSubmissionServiceError(error)) {\n    return NextResponse.json(\n      { error: error.code, message: error.message, details: error.details ?? null },\n      { status: error.httpStatus },\n    )\n  }\n  const message = error instanceof Error ? error.message : 'Unknown error'\n  return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n}\n\nconst fieldDescriptorSchema = z.object({\n  key: z.string(),\n  type: z.string(),\n  sectionKey: z.string().nullable(),\n  sensitive: z.boolean(),\n  editableBy: z.array(z.string()),\n  visibleTo: z.array(z.string()),\n  required: z.boolean(),\n})\n\nconst responseSchema = z.object({\n  form: z.object({\n    id: z.string().uuid(),\n    key: z.string(),\n    name: z.string(),\n    defaultLocale: z.string(),\n    supportedLocales: z.array(z.string()),\n  }),\n  formVersion: z.object({\n    id: z.string().uuid(),\n    versionNumber: z.number().int(),\n    schemaHash: z.string(),\n    registryVersion: z.string(),\n    roles: z.array(z.string()),\n  }),\n  schema: z.record(z.string(), z.unknown()),\n  uiSchema: z.record(z.string(), z.unknown()),\n  fieldIndex: z.record(z.string(), fieldDescriptorSchema),\n  callerRoles: z.array(z.string()),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get active form version by key',\n  description: 'Returns the published form version matching the supplied key, sliced to the caller\\'s available roles.',\n  tags: ['Forms Runtime'],\n  responses: [{ status: 200, description: 'Active form version', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Form not found', schema: errorSchema },\n    { status: 422, description: 'Form is not active or has no published version', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Active form version',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAYA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAA4B,gCAAgC;AAC5D,SAAS,2BAA2B;AAE7B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,MAAM,OAAO,OAAO,GAAG;AAE7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,EAAE,MAAM,aAAa,SAAS,IAAI,MAAM,QAAQ,0BAA0B;AAAA,MAC9E,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAED,UAAM,cAAc,mBAAmB,KAAK,kBAAkB,YAAY,MAAM;AAEhF,UAAM,aAAsC,CAAC;AAC7C,eAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,SAAS,UAAU,GAAG;AACxE,YAAM,UAAU,YAAY;AAAA,QAAK,CAAC,SAChC,WAAW,UAAU,SAAS,IAAI,KAAK,WAAW,WAAW,SAAS,IAAI;AAAA,MAC5E;AACA,UAAI,CAAC,QAAS;AACd,iBAAW,QAAQ,IAAI;AAAA,QACrB,KAAK,WAAW;AAAA,QAChB,MAAM,WAAW;AAAA,QACjB,YAAY,WAAW;AAAA,QACvB,WAAW,WAAW;AAAA,QACtB,YAAY,WAAW;AAAA,QACvB,WAAW,WAAW;AAAA,QACtB,UAAU,WAAW;AAAA,MACvB;AAAA,IACF;AACA,UAAM,mBAAmB;AAAA,MACvB,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC;AAAA,IACjC;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,MAAM;AAAA,QACJ,IAAI,KAAK;AAAA,QACT,KAAK,KAAK;AAAA,QACV,MAAM,KAAK;AAAA,QACX,eAAe,KAAK;AAAA,QACpB,kBAAkB,KAAK;AAAA,MACzB;AAAA,MACA,aAAa;AAAA,QACX,IAAI,YAAY;AAAA,QAChB,eAAe,YAAY;AAAA,QAC3B,YAAY,SAAS;AAAA,QACrB,iBAAiB,SAAS;AAAA,QAC1B,OAAO,MAAM,QAAQ,YAAY,KAAK,IAAI,YAAY,QAAQ,CAAC;AAAA,MACjE;AAAA,MACA,QAAQ,iBAAiB;AAAA,MACzB,UAAU,iBAAiB;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,SAAS,KAAK;AAAA,EACvB;AACF;AAEA,SAAS,mBAAmB,UAAoB,QAA2C;AACzF,MAAI,SAAS,SAAS,GAAG,EAAG,QAAO,CAAC,OAAO;AAC3C,QAAM,cAAc,OAAO,yBAAyB;AACpD,SAAO,OAAO,gBAAgB,YAAY,YAAY,SAAS,IAAI,CAAC,WAAW,IAAI,CAAC;AACtF;AAEA,SAAS,SAAS,OAA8B;AAC9C,MAAI,yBAAyB,KAAK,GAAG;AACnC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,MAAM,MAAM,SAAS,MAAM,SAAS,SAAS,MAAM,WAAW,KAAK;AAAA,MAC5E,EAAE,QAAQ,MAAM,WAAW;AAAA,IAC7B;AAAA,EACF;AACA,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,SAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,QAAQ;AAAA,EACrB,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC9B,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC7B,UAAU,EAAE,QAAQ;AACtB,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,KAAK,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,eAAe,EAAE,OAAO;AAAA,IACxB,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACtC,CAAC;AAAA,EACD,aAAa,EAAE,OAAO;AAAA,IACpB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,IAC9B,YAAY,EAAE,OAAO;AAAA,IACrB,iBAAiB,EAAE,OAAO;AAAA,IAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC3B,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,qBAAqB;AAAA,EACtD,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AACjC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,eAAe,CAAC;AAAA,EACvF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,kDAAkD,QAAQ,YAAY;AAAA,EACpG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/route.js

@@ -0,0 +1,84 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import {
+  invitationRevokeCommandSchema
+} from "../../../../../data/validators.js";
+import {
+  attachOperationMetadata,
+  buildFormsRouteContext,
+  handleRouteError,
+  jsonError,
+  withMutationGuard,
+  withScopedPayload
+} from "../../../../helpers.js";
+import { FORM_INVITATION_RESOURCE_KIND } from "../../../../../commands/invitation.js";
+const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ["forms.distribute"] }
+};
+const deleteResponseSchema = z.object({ id: z.string().uuid() });
+const errorSchema = z.object({ error: z.string() });
+function extractInvitationId(req) {
+  const url = new URL(req.url);
+  const segments = url.pathname.split("/").filter(Boolean);
+  const idx = segments.findIndex((segment) => segment === "invitations");
+  return idx >= 0 ? segments[idx + 1] ?? "" : "";
+}
+async function DELETE(req) {
+  try {
+    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req);
+    if (!organizationId || !tenantId) {
+      return jsonError(400, "forms.errors.organization_required");
+    }
+    const invitationId = extractInvitationId(req);
+    if (!invitationId) return jsonError(400, "forms.errors.invalid_id");
+    const scoped = withScopedPayload({ invitationId }, ctx, translate);
+    const input = invitationRevokeCommandSchema.parse(scoped);
+    return await withMutationGuard({
+      ctx,
+      tenantId,
+      organizationId,
+      resourceKind: FORM_INVITATION_RESOURCE_KIND,
+      resourceId: invitationId,
+      operation: "delete",
+      request: req,
+      payload: { invitationId },
+      run: async () => {
+        const commandBus = ctx.container.resolve("commandBus");
+        const { result, logEntry } = await commandBus.execute("forms.invitation.revoke", { input, ctx });
+        const response = NextResponse.json({ id: result?.invitationId ?? invitationId });
+        return attachOperationMetadata(
+          response,
+          logEntry,
+          FORM_INVITATION_RESOURCE_KIND,
+          result?.invitationId ?? invitationId
+        );
+      }
+    });
+  } catch (error) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(error);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return handleRouteError("invitations.DELETE", error);
+  }
+}
+const openApi = {
+  tag: "Forms",
+  summary: "Revoke an invitation",
+  pathParams: z.object({ distributionId: z.string().uuid(), invitationId: z.string().uuid() }),
+  methods: {
+    DELETE: {
+      summary: "Revoke invitation",
+      description: "Soft-revokes an invitation \u2014 the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).",
+      responses: [{ status: 200, description: "Invitation revoked", schema: deleteResponseSchema }],
+      errors: [{ status: 404, description: "Invitation not found", schema: errorSchema }]
+    }
+  }
+};
+export {
+  DELETE,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/forms/api/distributions/%5BdistributionId%5D/invitations/%5BinvitationId%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  invitationRevokeCommandSchema,\n  type FormInvitationRevokeCommandInput,\n} from '../../../../../data/validators'\nimport {\n  attachOperationMetadata,\n  buildFormsRouteContext,\n  handleRouteError,\n  jsonError,\n  withMutationGuard,\n  withScopedPayload,\n} from '../../../../helpers'\nimport { FORM_INVITATION_RESOURCE_KIND } from '../../../../../commands/invitation'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['forms.distribute'] },\n}\n\nconst deleteResponseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nfunction extractInvitationId(req: Request): string {\n  const url = new URL(req.url)\n  const segments = url.pathname.split('/').filter(Boolean)\n  const idx = segments.findIndex((segment) => segment === 'invitations')\n  return idx >= 0 ? segments[idx + 1] ?? '' : ''\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const invitationId = extractInvitationId(req)\n    if (!invitationId) return jsonError(400, 'forms.errors.invalid_id')\n\n    const scoped = withScopedPayload({ invitationId }, ctx, translate)\n    const input = invitationRevokeCommandSchema.parse(scoped) satisfies FormInvitationRevokeCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_INVITATION_RESOURCE_KIND,\n      resourceId: invitationId,\n      operation: 'delete',\n      request: req,\n      payload: { invitationId },\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<\n          FormInvitationRevokeCommandInput,\n          { invitationId: string }\n        >('forms.invitation.revoke', { input, ctx })\n        const response = NextResponse.json({ id: result?.invitationId ?? invitationId })\n        return attachOperationMetadata(\n          response,\n          logEntry,\n          FORM_INVITATION_RESOURCE_KIND,\n          result?.invitationId ?? invitationId,\n        )\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('invitations.DELETE', error)\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Forms',\n  summary: 'Revoke an invitation',\n  pathParams: z.object({ distributionId: z.string().uuid(), invitationId: z.string().uuid() }),\n  methods: {\n    DELETE: {\n      summary: 'Revoke invitation',\n      description:\n        'Soft-revokes an invitation \u2014 the row is retained and its status becomes revoked so a revoked token resolves to 410 (not 404).',\n      responses: [{ status: 200, description: 'Invitation revoked', schema: deleteResponseSchema }],\n      errors: [{ status: 404, description: 'Invitation not found', schema: errorSchema }],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0CAA0C;AAEnD;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACrE;AAEA,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/D,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,SAAS,oBAAoB,KAAsB;AACjD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACvD,QAAM,MAAM,SAAS,UAAU,CAAC,YAAY,YAAY,aAAa;AACrE,SAAO,OAAO,IAAI,SAAS,MAAM,CAAC,KAAK,KAAK;AAC9C;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,UAAU,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,eAAe,oBAAoB,GAAG;AAC5C,QAAI,CAAC,aAAc,QAAO,UAAU,KAAK,yBAAyB;AAElE,UAAM,SAAS,kBAAkB,EAAE,aAAa,GAAG,KAAK,SAAS;AACjE,UAAM,QAAQ,8BAA8B,MAAM,MAAM;AAExD,WAAO,MAAM,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS,EAAE,aAAa;AAAA,MACxB,KAAK,YAAY;AACf,cAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,cAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,2BAA2B,EAAE,OAAO,IAAI,CAAC;AAC3C,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,aAAa,CAAC;AAC/E,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,gBAAgB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,iBAAiB,sBAAsB,KAAK;AAAA,EACrD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC3F,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,qBAAqB,CAAC;AAAA,MAC5F,QAAQ,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY,CAAC;AAAA,IACpF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/send/route.js

@@ -0,0 +1,88 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import {
+  invitationSendCommandSchema
+} from "../../../../../../data/validators.js";
+import {
+  attachOperationMetadata,
+  buildFormsRouteContext,
+  handleRouteError,
+  jsonError,
+  withMutationGuard,
+  withScopedPayload
+} from "../../../../../helpers.js";
+import { FORM_INVITATION_RESOURCE_KIND } from "../../../../../../commands/invitation.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["forms.distribute"] }
+};
+const sendResponseSchema = z.object({ id: z.string().uuid() });
+const errorSchema = z.object({ error: z.string() });
+function extractInvitationId(req) {
+  const url = new URL(req.url);
+  const segments = url.pathname.split("/").filter(Boolean);
+  const idx = segments.findIndex((segment) => segment === "invitations");
+  return idx >= 0 ? segments[idx + 1] ?? "" : "";
+}
+async function POST(req) {
+  try {
+    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req);
+    if (!organizationId || !tenantId) {
+      return jsonError(400, "forms.errors.organization_required");
+    }
+    const invitationId = extractInvitationId(req);
+    if (!invitationId) return jsonError(400, "forms.errors.invalid_id");
+    const scoped = withScopedPayload({ invitationId }, ctx, translate);
+    const input = invitationSendCommandSchema.parse(scoped);
+    return await withMutationGuard({
+      ctx,
+      tenantId,
+      organizationId,
+      resourceKind: FORM_INVITATION_RESOURCE_KIND,
+      resourceId: invitationId,
+      operation: "custom",
+      request: req,
+      payload: { invitationId },
+      run: async () => {
+        const commandBus = ctx.container.resolve("commandBus");
+        const { result, logEntry } = await commandBus.execute("forms.invitation.send", { input, ctx });
+        const response = NextResponse.json({ id: result?.invitationId ?? invitationId });
+        return attachOperationMetadata(
+          response,
+          logEntry,
+          FORM_INVITATION_RESOURCE_KIND,
+          result?.invitationId ?? invitationId
+        );
+      }
+    });
+  } catch (error) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(error);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return handleRouteError("invitations.send.POST", error);
+  }
+}
+const openApi = {
+  tag: "Forms",
+  summary: "Send or resend an invitation",
+  pathParams: z.object({ distributionId: z.string().uuid(), invitationId: z.string().uuid() }),
+  methods: {
+    POST: {
+      summary: "Send invitation",
+      description: "Marks the invitation sent (sent_at, send_count += 1) and emits forms.invitation.sent so the email subscriber dispatches a reminder. Also the resend path.",
+      responses: [{ status: 200, description: "Invitation send tracked", schema: sendResponseSchema }],
+      errors: [
+        { status: 404, description: "Invitation not found", schema: errorSchema },
+        { status: 409, description: "Invitation revoked or already submitted", schema: errorSchema },
+        { status: 422, description: "Invitation has no recipient email", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/distributions/[distributionId]/invitations/[invitationId]/send/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../../src/modules/forms/api/distributions/%5BdistributionId%5D/invitations/%5BinvitationId%5D/send/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  invitationSendCommandSchema,\n  type FormInvitationSendCommandInput,\n} from '../../../../../../data/validators'\nimport {\n  attachOperationMetadata,\n  buildFormsRouteContext,\n  handleRouteError,\n  jsonError,\n  withMutationGuard,\n  withScopedPayload,\n} from '../../../../../helpers'\nimport { FORM_INVITATION_RESOURCE_KIND } from '../../../../../../commands/invitation'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['forms.distribute'] },\n}\n\nconst sendResponseSchema = z.object({ id: z.string().uuid() })\nconst errorSchema = z.object({ error: z.string() })\n\nfunction extractInvitationId(req: Request): string {\n  const url = new URL(req.url)\n  const segments = url.pathname.split('/').filter(Boolean)\n  const idx = segments.findIndex((segment) => segment === 'invitations')\n  return idx >= 0 ? segments[idx + 1] ?? '' : ''\n}\n\nexport async function POST(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const invitationId = extractInvitationId(req)\n    if (!invitationId) return jsonError(400, 'forms.errors.invalid_id')\n\n    const scoped = withScopedPayload({ invitationId }, ctx, translate)\n    const input = invitationSendCommandSchema.parse(scoped) satisfies FormInvitationSendCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_INVITATION_RESOURCE_KIND,\n      resourceId: invitationId,\n      operation: 'custom',\n      request: req,\n      payload: { invitationId },\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<\n          FormInvitationSendCommandInput,\n          { invitationId: string }\n        >('forms.invitation.send', { input, ctx })\n        const response = NextResponse.json({ id: result?.invitationId ?? invitationId })\n        return attachOperationMetadata(\n          response,\n          logEntry,\n          FORM_INVITATION_RESOURCE_KIND,\n          result?.invitationId ?? invitationId,\n        )\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('invitations.send.POST', error)\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Forms',\n  summary: 'Send or resend an invitation',\n  pathParams: z.object({ distributionId: z.string().uuid(), invitationId: z.string().uuid() }),\n  methods: {\n    POST: {\n      summary: 'Send invitation',\n      description:\n        'Marks the invitation sent (sent_at, send_count += 1) and emits forms.invitation.sent so the email subscriber dispatches a reminder. Also the resend path.',\n      responses: [{ status: 200, description: 'Invitation send tracked', schema: sendResponseSchema }],\n      errors: [\n        { status: 404, description: 'Invitation not found', schema: errorSchema },\n        { status: 409, description: 'Invitation revoked or already submitted', schema: errorSchema },\n        { status: 422, description: 'Invitation has no recipient email', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0CAA0C;AAEnD;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,MAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC7D,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,SAAS,oBAAoB,KAAsB;AACjD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACvD,QAAM,MAAM,SAAS,UAAU,CAAC,YAAY,YAAY,aAAa;AACrE,SAAO,OAAO,IAAI,SAAS,MAAM,CAAC,KAAK,KAAK;AAC9C;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,UAAU,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,eAAe,oBAAoB,GAAG;AAC5C,QAAI,CAAC,aAAc,QAAO,UAAU,KAAK,yBAAyB;AAElE,UAAM,SAAS,kBAAkB,EAAE,aAAa,GAAG,KAAK,SAAS;AACjE,UAAM,QAAQ,4BAA4B,MAAM,MAAM;AAEtD,WAAO,MAAM,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS,EAAE,aAAa;AAAA,MACxB,KAAK,YAAY;AACf,cAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,cAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAG5C,yBAAyB,EAAE,OAAO,IAAI,CAAC;AACzC,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,QAAQ,gBAAgB,aAAa,CAAC;AAC/E,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,gBAAgB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,iBAAiB,yBAAyB,KAAK;AAAA,EACxD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC3F,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,mBAAmB,CAAC;AAAA,MAC/F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,YAAY;AAAA,QAC3F,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}