@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/api/subjects/[subjectType]/[subjectId]/consents/route.js

@@ -0,0 +1,137 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { Form, FormConsentRecord } from "../../../../../data/entities.js";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional()
+});
+const consentItemSchema = z.object({
+  id: z.string().uuid(),
+  formId: z.string().uuid(),
+  formName: z.string().nullable(),
+  formVersionId: z.string().uuid(),
+  versionNumber: z.number().int(),
+  submissionId: z.string().uuid(),
+  consentFieldKey: z.string(),
+  clauseSha256: z.string(),
+  signedAt: z.string(),
+  status: z.string(),
+  supersededAt: z.string().nullable(),
+  supersededByRecordId: z.string().uuid().nullable()
+});
+const responseSchema = z.object({ items: z.array(consentItemSchema) });
+const CONSENT_STATUSES = ["active", "superseded", "revoked"];
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["forms.view"] }
+};
+async function GET(req, context) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: "Tenant scope required" }, { status: 403 });
+  }
+  const params = await Promise.resolve(context.params);
+  const subjectType = String(params.subjectType);
+  const subjectId = String(params.subjectId);
+  if (!subjectType || subjectType.length > 64) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", message: "subjectType is required." },
+      { status: 422 }
+    );
+  }
+  if (!UUID_PATTERN.test(subjectId)) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", message: "subjectId must be a UUID." },
+      { status: 422 }
+    );
+  }
+  const statusParam = req.nextUrl.searchParams.get("status");
+  const statusFilter = statusParam && CONSENT_STATUSES.includes(statusParam) ? statusParam : null;
+  if (statusParam && !statusFilter) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", message: "status must be one of active, superseded, revoked." },
+      { status: 422 }
+    );
+  }
+  const formIdParam = req.nextUrl.searchParams.get("formId");
+  if (formIdParam && !UUID_PATTERN.test(formIdParam)) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", message: "formId must be a UUID." },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
+  try {
+    const where = {
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      subjectType,
+      subjectId
+    };
+    if (statusFilter) where.status = statusFilter;
+    if (formIdParam) where.formId = formIdParam;
+    const records = await em.find(FormConsentRecord, where, {
+      orderBy: { signedAt: "desc" }
+    });
+    const formIds = Array.from(new Set(records.map((record) => record.formId)));
+    const forms = formIds.length ? await em.find(Form, {
+      id: { $in: formIds },
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId
+    }) : [];
+    const formNameById = new Map(forms.map((form) => [form.id, form.name]));
+    const items = records.map((record) => ({
+      id: record.id,
+      formId: record.formId,
+      formName: formNameById.get(record.formId) ?? null,
+      formVersionId: record.formVersionId,
+      versionNumber: record.versionNumber,
+      submissionId: record.submissionId,
+      consentFieldKey: record.consentFieldKey,
+      clauseSha256: record.clauseSha256,
+      signedAt: record.signedAt.toISOString(),
+      status: record.status,
+      supersededAt: record.supersededAt ? record.supersededAt.toISOString() : null,
+      supersededByRecordId: record.supersededByRecordId ?? null
+    }));
+    return NextResponse.json({ items }, { status: 200 });
+  } catch (error) {
+    return NextResponse.json(
+      { error: "forms.errors.internal", message: error instanceof Error ? error.message : "Unknown error" },
+      { status: 500 }
+    );
+  }
+}
+const getMethodDoc = {
+  summary: "List consent records for a data subject",
+  description: "Returns the subject's consent history projected from signed signature fields \u2014 active and superseded records. PII-free: clause SHA-256, signed-at, status timestamps, and ids only. Optional `status` and `formId` query filters. Requires `forms.view`.",
+  tags: ["Forms Compliance"],
+  responses: [
+    {
+      status: 200,
+      description: "Consent records for the subject (newest signed first)",
+      schema: responseSchema
+    }
+  ],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 403, description: "Tenant scope required", schema: errorSchema },
+    { status: 422, description: "Bad subject identifier or filter", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "List data-subject consent records",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/subjects/[subjectType]/[subjectId]/consents/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/forms/api/subjects/%5BsubjectType%5D/%5BsubjectId%5D/consents/route.ts"],
+  "sourcesContent": ["/**\n * Admin API \u2014 GET /api/forms/subjects/:subjectType/:subjectId/consents\n *\n * Phase 3 Track D \u2014 per-subject consent history.\n *\n * Returns the subject's `forms_consent_record` projection (active + history)\n * built by the `forms-consent-projector` subscriber from signed `signature`\n * fields. The response is PII-free by construction: clause SHA-256 + signed-at\n * + status timestamps + ids only \u2014 never the signature image, typed name, or\n * any answer value.\n *\n * Feature-gated (`forms.view`) and tenant-scoped. Optional filters:\n *   - `?status=active|superseded|revoked` \u2014 narrow to one status.\n *   - `?formId=<uuid>` \u2014 narrow to one form.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { Form, FormConsentRecord, type FormConsentRecordStatus } from '../../../../../data/entities'\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n})\n\nconst consentItemSchema = z.object({\n  id: z.string().uuid(),\n  formId: z.string().uuid(),\n  formName: z.string().nullable(),\n  formVersionId: z.string().uuid(),\n  versionNumber: z.number().int(),\n  submissionId: z.string().uuid(),\n  consentFieldKey: z.string(),\n  clauseSha256: z.string(),\n  signedAt: z.string(),\n  status: z.string(),\n  supersededAt: z.string().nullable(),\n  supersededByRecordId: z.string().uuid().nullable(),\n})\n\nconst responseSchema = z.object({ items: z.array(consentItemSchema) })\n\nconst CONSENT_STATUSES = ['active', 'superseded', 'revoked'] as const\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['forms.view'] },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: {\n    params:\n      | { subjectType: string; subjectId: string }\n      | Promise<{ subjectType: string; subjectId: string }>\n  },\n) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  if (!auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Tenant scope required' }, { status: 403 })\n  }\n  const params = await Promise.resolve(context.params)\n  const subjectType = String(params.subjectType)\n  const subjectId = String(params.subjectId)\n  if (!subjectType || subjectType.length > 64) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', message: 'subjectType is required.' },\n      { status: 422 },\n    )\n  }\n  if (!UUID_PATTERN.test(subjectId)) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', message: 'subjectId must be a UUID.' },\n      { status: 422 },\n    )\n  }\n\n  const statusParam = req.nextUrl.searchParams.get('status')\n  const statusFilter =\n    statusParam && (CONSENT_STATUSES as readonly string[]).includes(statusParam)\n      ? (statusParam as FormConsentRecordStatus)\n      : null\n  if (statusParam && !statusFilter) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', message: 'status must be one of active, superseded, revoked.' },\n      { status: 422 },\n    )\n  }\n  const formIdParam = req.nextUrl.searchParams.get('formId')\n  if (formIdParam && !UUID_PATTERN.test(formIdParam)) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', message: 'formId must be a UUID.' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n\n  try {\n    const where: Record<string, unknown> = {\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      subjectType,\n      subjectId,\n    }\n    if (statusFilter) where.status = statusFilter\n    if (formIdParam) where.formId = formIdParam\n\n    const records = await em.find(FormConsentRecord, where, {\n      orderBy: { signedAt: 'desc' },\n    })\n\n    const formIds = Array.from(new Set(records.map((record) => record.formId)))\n    const forms = formIds.length\n      ? await em.find(Form, {\n          id: { $in: formIds },\n          organizationId: auth.orgId,\n          tenantId: auth.tenantId,\n        })\n      : []\n    const formNameById = new Map(forms.map((form) => [form.id, form.name]))\n\n    const items = records.map((record) => ({\n      id: record.id,\n      formId: record.formId,\n      formName: formNameById.get(record.formId) ?? null,\n      formVersionId: record.formVersionId,\n      versionNumber: record.versionNumber,\n      submissionId: record.submissionId,\n      consentFieldKey: record.consentFieldKey,\n      clauseSha256: record.clauseSha256,\n      signedAt: record.signedAt.toISOString(),\n      status: record.status,\n      supersededAt: record.supersededAt ? record.supersededAt.toISOString() : null,\n      supersededByRecordId: record.supersededByRecordId ?? null,\n    }))\n\n    return NextResponse.json({ items }, { status: 200 })\n  } catch (error) {\n    return NextResponse.json(\n      { error: 'forms.errors.internal', message: error instanceof Error ? error.message : 'Unknown error' },\n      { status: 500 },\n    )\n  }\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'List consent records for a data subject',\n  description:\n    'Returns the subject\\'s consent history projected from signed signature fields \u2014 active and superseded records. PII-free: clause SHA-256, signed-at, status timestamps, and ids only. Optional `status` and `formId` query filters. Requires `forms.view`.',\n  tags: ['Forms Compliance'],\n  responses: [\n    {\n      status: 200,\n      description: 'Consent records for the subject (newest signed first)',\n      schema: responseSchema,\n    },\n  ],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Tenant scope required', schema: errorSchema },\n    { status: 422, description: 'Bad subject identifier or filter', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List data-subject consent records',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAgBA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,MAAM,yBAAuD;AAEtE,MAAM,eAAe;AAErB,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,iBAAiB,EAAE,OAAO;AAAA,EAC1B,cAAc,EAAE,OAAO;AAAA,EACvB,UAAU,EAAE,OAAO;AAAA,EACnB,QAAQ,EAAE,OAAO;AAAA,EACjB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACnD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,CAAC;AAErE,MAAM,mBAAmB,CAAC,UAAU,cAAc,SAAS;AAEpD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,eAAsB,IACpB,KACA,SAKA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,cAAc,OAAO,OAAO,WAAW;AAC7C,QAAM,YAAY,OAAO,OAAO,SAAS;AACzC,MAAI,CAAC,eAAe,YAAY,SAAS,IAAI;AAC3C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,2BAA2B;AAAA,MAClE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,CAAC,aAAa,KAAK,SAAS,GAAG;AACjC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,4BAA4B;AAAA,MACnE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,QAAQ,aAAa,IAAI,QAAQ;AACzD,QAAM,eACJ,eAAgB,iBAAuC,SAAS,WAAW,IACtE,cACD;AACN,MAAI,eAAe,CAAC,cAAc;AAChC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,qDAAqD;AAAA,MAC5F,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,cAAc,IAAI,QAAQ,aAAa,IAAI,QAAQ;AACzD,MAAI,eAAe,CAAC,aAAa,KAAK,WAAW,GAAG;AAClD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,yBAAyB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,MAAI;AACF,UAAM,QAAiC;AAAA,MACrC,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,QAAI,aAAc,OAAM,SAAS;AACjC,QAAI,YAAa,OAAM,SAAS;AAEhC,UAAM,UAAU,MAAM,GAAG,KAAK,mBAAmB,OAAO;AAAA,MACtD,SAAS,EAAE,UAAU,OAAO;AAAA,IAC9B,CAAC;AAED,UAAM,UAAU,MAAM,KAAK,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,CAAC;AAC1E,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM;AAAA,MAClB,IAAI,EAAE,KAAK,QAAQ;AAAA,MACnB,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC,IACD,CAAC;AACL,UAAM,eAAe,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,KAAK,IAAI,CAAC,CAAC;AAEtE,UAAM,QAAQ,QAAQ,IAAI,CAAC,YAAY;AAAA,MACrC,IAAI,OAAO;AAAA,MACX,QAAQ,OAAO;AAAA,MACf,UAAU,aAAa,IAAI,OAAO,MAAM,KAAK;AAAA,MAC7C,eAAe,OAAO;AAAA,MACtB,eAAe,OAAO;AAAA,MACtB,cAAc,OAAO;AAAA,MACrB,iBAAiB,OAAO;AAAA,MACxB,cAAc,OAAO;AAAA,MACrB,UAAU,OAAO,SAAS,YAAY;AAAA,MACtC,QAAQ,OAAO;AAAA,MACf,cAAc,OAAO,eAAe,OAAO,aAAa,YAAY,IAAI;AAAA,MACxE,sBAAsB,OAAO,wBAAwB;AAAA,IACvD,EAAE;AAEF,WAAO,aAAa,KAAK,EAAE,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrD,SAAS,OAAO;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,gBAAgB;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,kBAAkB;AAAA,EACzB,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,IACzE,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,YAAY;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/subjects/[subjectType]/[subjectId]/export/route.js

@@ -0,0 +1,101 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional()
+});
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["forms.submissions.export"] }
+};
+async function GET(req, context) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: "Tenant scope required" }, { status: 403 });
+  }
+  const params = await Promise.resolve(context.params);
+  const subjectType = String(params.subjectType);
+  const subjectId = String(params.subjectId);
+  if (!subjectType || subjectType.length > 64) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", message: "subjectType is required." },
+      { status: 422 }
+    );
+  }
+  if (!UUID_PATTERN.test(subjectId)) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", message: "subjectId must be a UUID." },
+      { status: 422 }
+    );
+  }
+  const localeParam = req.nextUrl.searchParams.get("locale");
+  const locale = localeParam && /^[a-z]{2,3}(?:-[A-Z]{2})?$/.test(localeParam) ? localeParam : void 0;
+  const container = await createRequestContainer();
+  const service = container.resolve("formsExportService");
+  const auditor = container.resolve("formsAccessAuditLogger");
+  const em = container.resolve("em");
+  try {
+    const { document, submissionIds } = await service.exportSubject({
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      subjectType,
+      subjectId,
+      locale
+    });
+    for (const submissionId of submissionIds) {
+      await auditor.log(em, {
+        organizationId: auth.orgId,
+        submissionId,
+        accessedBy: auth.sub,
+        accessPurpose: "export",
+        ip: req.headers.get("x-forwarded-for") ?? null,
+        ua: req.headers.get("user-agent") ?? null
+      });
+    }
+    const filename = `forms-export-${subjectType}-${subjectId}.json`;
+    return new NextResponse(JSON.stringify(document, null, 2), {
+      status: 200,
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        "content-disposition": `attachment; filename="${filename}"`
+      }
+    });
+  } catch (error) {
+    return NextResponse.json(
+      { error: "forms.errors.internal", message: error instanceof Error ? error.message : "Unknown error" },
+      { status: 500 }
+    );
+  }
+}
+const getMethodDoc = {
+  summary: "Export all submissions for a data subject (GDPR Art. 15/20)",
+  description: "Returns a structured JSON document with every submission for the subject \u2014 form key/name, version, status, timestamps, decrypted answers keyed by field with labels, and signature metadata. Attachments are referenced by id. Writes one `export` access-audit row per submission. Requires `forms.submissions.export`.",
+  tags: ["Forms Compliance"],
+  responses: [
+    {
+      status: 200,
+      description: "Export document (downloaded as an attachment)",
+      schema: z.record(z.string(), z.unknown())
+    }
+  ],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 403, description: "Tenant scope required", schema: errorSchema },
+    { status: 422, description: "Bad subject identifier", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Export data-subject submissions",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/subjects/[subjectType]/[subjectId]/export/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/forms/api/subjects/%5BsubjectType%5D/%5BsubjectId%5D/export/route.ts"],
+  "sourcesContent": ["/**\n * Admin API \u2014 GET /api/forms/subjects/:subjectType/:subjectId/export\n *\n * W5 (DP-5) \u2014 GDPR data-subject export (Art. 15 access / Art. 20 portability).\n *\n * Returns a structured, machine-readable JSON document containing every\n * submission for the supplied subject, each with form key/name, version\n * number, status, lifecycle timestamps, and the DECRYPTED current-revision\n * answers keyed by field with human labels + types. Signature answers carry\n * structured metadata (signed-at, consent-clause SHA, mode); large blobs /\n * uploads are referenced by attachment id, never inlined.\n *\n * Feature-gated (`forms.submissions.export`), tenant-scoped, and audited: one\n * `export` access-audit row is written per submission accessed.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { ExportService } from '../../../../../services/export-service'\nimport {\n  FormsAccessAuditLogger,\n  type AccessAuditLogger,\n} from '../../../../../services/access-audit-logger'\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['forms.submissions.export'] },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: {\n    params:\n      | { subjectType: string; subjectId: string }\n      | Promise<{ subjectType: string; subjectId: string }>\n  },\n) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  if (!auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Tenant scope required' }, { status: 403 })\n  }\n  const params = await Promise.resolve(context.params)\n  const subjectType = String(params.subjectType)\n  const subjectId = String(params.subjectId)\n  if (!subjectType || subjectType.length > 64) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', message: 'subjectType is required.' },\n      { status: 422 },\n    )\n  }\n  if (!UUID_PATTERN.test(subjectId)) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', message: 'subjectId must be a UUID.' },\n      { status: 422 },\n    )\n  }\n\n  const localeParam = req.nextUrl.searchParams.get('locale')\n  const locale = localeParam && /^[a-z]{2,3}(?:-[A-Z]{2})?$/.test(localeParam) ? localeParam : undefined\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsExportService') as ExportService\n  const auditor = container.resolve('formsAccessAuditLogger') as AccessAuditLogger\n  const em = container.resolve('em') as EntityManager\n\n  try {\n    const { document, submissionIds } = await service.exportSubject({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      subjectType,\n      subjectId,\n      locale,\n    })\n    for (const submissionId of submissionIds) {\n      await auditor.log(em, {\n        organizationId: auth.orgId,\n        submissionId,\n        accessedBy: auth.sub,\n        accessPurpose: 'export',\n        ip: req.headers.get('x-forwarded-for') ?? null,\n        ua: req.headers.get('user-agent') ?? null,\n      })\n    }\n    const filename = `forms-export-${subjectType}-${subjectId}.json`\n    return new NextResponse(JSON.stringify(document, null, 2), {\n      status: 200,\n      headers: {\n        'content-type': 'application/json; charset=utf-8',\n        'content-disposition': `attachment; filename=\"${filename}\"`,\n      },\n    })\n  } catch (error) {\n    return NextResponse.json(\n      { error: 'forms.errors.internal', message: error instanceof Error ? error.message : 'Unknown error' },\n      { status: 500 },\n    )\n  }\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Export all submissions for a data subject (GDPR Art. 15/20)',\n  description:\n    'Returns a structured JSON document with every submission for the subject \u2014 form key/name, version, status, timestamps, decrypted answers keyed by field with labels, and signature metadata. Attachments are referenced by id. Writes one `export` access-audit row per submission. Requires `forms.submissions.export`.',\n  tags: ['Forms Compliance'],\n  responses: [\n    {\n      status: 200,\n      description: 'Export document (downloaded as an attachment)',\n      schema: z.record(z.string(), z.unknown()),\n    },\n  ],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Tenant scope required', schema: errorSchema },\n    { status: 422, description: 'Bad subject identifier', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Export data-subject submissions',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAgBA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAOnC,MAAM,eAAe;AAErB,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,eAAsB,IACpB,KACA,SAKA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,cAAc,OAAO,OAAO,WAAW;AAC7C,QAAM,YAAY,OAAO,OAAO,SAAS;AACzC,MAAI,CAAC,eAAe,YAAY,SAAS,IAAI;AAC3C,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,2BAA2B;AAAA,MAClE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,CAAC,aAAa,KAAK,SAAS,GAAG;AACjC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,4BAA4B;AAAA,MACnE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,QAAQ,aAAa,IAAI,QAAQ;AACzD,QAAM,SAAS,eAAe,6BAA6B,KAAK,WAAW,IAAI,cAAc;AAE7F,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,oBAAoB;AACtD,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,MAAI;AACF,UAAM,EAAE,UAAU,cAAc,IAAI,MAAM,QAAQ,cAAc;AAAA,MAC9D,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,eAAW,gBAAgB,eAAe;AACxC,YAAM,QAAQ,IAAI,IAAI;AAAA,QACpB,gBAAgB,KAAK;AAAA,QACrB;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,eAAe;AAAA,QACf,IAAI,IAAI,QAAQ,IAAI,iBAAiB,KAAK;AAAA,QAC1C,IAAI,IAAI,QAAQ,IAAI,YAAY,KAAK;AAAA,MACvC,CAAC;AAAA,IACH;AACA,UAAM,WAAW,gBAAgB,WAAW,IAAI,SAAS;AACzD,WAAO,IAAI,aAAa,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,uBAAuB,yBAAyB,QAAQ;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,yBAAyB,SAAS,iBAAiB,QAAQ,MAAM,UAAU,gBAAgB;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,kBAAkB;AAAA,EACzB,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,IAC1C;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,YAAY;AAAA,IACzE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,EAC5E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/submissions/[submissionId]/access-audit/route.js

@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { FormAccessAudit, FormSubmission } from "../../../../data/entities.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["forms.view"] }
+};
+const MAX_AUDIT_ROWS = 100;
+async function GET(req, context) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: "Tenant scope required" }, { status: 403 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.submissionId);
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
+  const submission = await em.findOne(FormSubmission, {
+    id: submissionId,
+    organizationId: auth.orgId,
+    tenantId: auth.tenantId,
+    deletedAt: null
+  });
+  if (!submission) {
+    return NextResponse.json({ error: "forms.errors.submission_not_found" }, { status: 404 });
+  }
+  const rows = await em.find(
+    FormAccessAudit,
+    { submissionId, organizationId: auth.orgId },
+    { orderBy: { accessedAt: "DESC" }, limit: MAX_AUDIT_ROWS }
+  );
+  return NextResponse.json({
+    items: rows.map((row) => ({
+      id: row.id,
+      accessedBy: row.accessedBy,
+      accessedAt: row.accessedAt.toISOString(),
+      accessPurpose: row.accessPurpose,
+      ip: row.ip ?? null,
+      revisionId: row.revisionId ?? null
+    }))
+  });
+}
+const auditRowSchema = z.object({
+  id: z.string().uuid(),
+  accessedBy: z.string().uuid(),
+  accessedAt: z.string(),
+  accessPurpose: z.enum(["view", "export", "revert", "anonymize", "reopen"]),
+  ip: z.string().nullable(),
+  revisionId: z.string().uuid().nullable()
+});
+const responseSchema = z.object({ items: z.array(auditRowSchema) });
+const errorSchema = z.object({ error: z.string(), message: z.string().optional() });
+const getMethodDoc = {
+  summary: "List submission access-audit rows",
+  description: "Returns the access-audit trail for a submission (who/when/purpose/IP). Carries no payload content. Reading the list does not write a new audit row.",
+  tags: ["Forms Compliance"],
+  responses: [{ status: 200, description: "Access-audit rows", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Submission not found", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Submission access audit",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/submissions/[submissionId]/access-audit/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/submissions/%5BsubmissionId%5D/access-audit/route.ts"],
+  "sourcesContent": ["/**\n * Admin API \u2014 GET /api/forms/submissions/:submissionId/access-audit\n *\n * Phase 2b \u2014 lists the access-audit rows for one submission so the drawer's\n * AccessAuditPanel can render who/when/purpose. The rows carry no payload\n * content \u2014 only metadata (accessor, purpose, IP, UA, optional revision id),\n * preserving the R-2b-6 posture. Reading the audit list does NOT itself write\n * a new audit row (it is the audit surface, not a submission read).\n *\n * Strict tenant isolation: the submission is resolved by org/tenant from the\n * authenticated admin session before any audit row is returned.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { FormAccessAudit, FormSubmission } from '../../../../data/entities'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['forms.view'] },\n}\n\nconst MAX_AUDIT_ROWS = 100\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { submissionId: string } | Promise<{ submissionId: string }> },\n) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  if (!auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Tenant scope required' }, { status: 403 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.submissionId)\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n\n  const submission = await em.findOne(FormSubmission, {\n    id: submissionId,\n    organizationId: auth.orgId,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!submission) {\n    return NextResponse.json({ error: 'forms.errors.submission_not_found' }, { status: 404 })\n  }\n\n  const rows = await em.find(\n    FormAccessAudit,\n    { submissionId, organizationId: auth.orgId },\n    { orderBy: { accessedAt: 'DESC' }, limit: MAX_AUDIT_ROWS },\n  )\n\n  return NextResponse.json({\n    items: rows.map((row) => ({\n      id: row.id,\n      accessedBy: row.accessedBy,\n      accessedAt: row.accessedAt.toISOString(),\n      accessPurpose: row.accessPurpose,\n      ip: row.ip ?? null,\n      revisionId: row.revisionId ?? null,\n    })),\n  })\n}\n\nconst auditRowSchema = z.object({\n  id: z.string().uuid(),\n  accessedBy: z.string().uuid(),\n  accessedAt: z.string(),\n  accessPurpose: z.enum(['view', 'export', 'revert', 'anonymize', 'reopen']),\n  ip: z.string().nullable(),\n  revisionId: z.string().uuid().nullable(),\n})\n\nconst responseSchema = z.object({ items: z.array(auditRowSchema) })\nconst errorSchema = z.object({ error: z.string(), message: z.string().optional() })\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'List submission access-audit rows',\n  description:\n    'Returns the access-audit trail for a submission (who/when/purpose/IP). Carries no payload content. Reading the list does not write a new audit row.',\n  tags: ['Forms Compliance'],\n  responses: [{ status: 200, description: 'Access-audit rows', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Submission access audit',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAaA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,iBAAiB,sBAAsB;AAEzC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,iBAAiB;AAEvB,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,YAAY;AAE/C,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI;AAAA,IACJ,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,OAAO,MAAM,GAAG;AAAA,IACpB;AAAA,IACA,EAAE,cAAc,gBAAgB,KAAK,MAAM;AAAA,IAC3C,EAAE,SAAS,EAAE,YAAY,OAAO,GAAG,OAAO,eAAe;AAAA,EAC3D;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,IAAI,IAAI;AAAA,MACR,YAAY,IAAI;AAAA,MAChB,YAAY,IAAI,WAAW,YAAY;AAAA,MACvC,eAAe,IAAI;AAAA,MACnB,IAAI,IAAI,MAAM;AAAA,MACd,YAAY,IAAI,cAAc;AAAA,IAChC,EAAE;AAAA,EACJ,CAAC;AACH;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,KAAK,CAAC,QAAQ,UAAU,UAAU,aAAa,QAAQ,CAAC;AAAA,EACzE,IAAI,EAAE,OAAO,EAAE,SAAS;AAAA,EACxB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,EAAE,CAAC;AAClE,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAElF,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,kBAAkB;AAAA,EACzB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,eAAe,CAAC;AAAA,EACrF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,EAC1E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/submissions/[submissionId]/actors/[actorId]/route.js

@@ -0,0 +1,56 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { mapSubmissionError } from "../../../../runtime-helpers.js";
+const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ["forms.submissions.manage"] }
+};
+async function DELETE(req, context) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: "Tenant scope required" }, { status: 403 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.submissionId);
+  const actorId = String(params.actorId);
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  try {
+    await service.revokeActor({
+      submissionId,
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      actorId,
+      revokedBy: auth.sub
+    });
+    return NextResponse.json({ ok: true });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+const errorSchema = z.object({ error: z.string(), message: z.string().optional() });
+const responseSchema = z.object({ ok: z.literal(true) });
+const deleteMethodDoc = {
+  summary: "Revoke a submission actor",
+  description: "Revokes the supplied actor row by setting revoked_at.",
+  tags: ["Forms Admin"],
+  responses: [{ status: 200, description: "Actor revoked", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Actor not found", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Revoke submission actor",
+  methods: { DELETE: deleteMethodDoc }
+};
+export {
+  DELETE,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/submissions/[submissionId]/actors/[actorId]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/forms/api/submissions/%5BsubmissionId%5D/actors/%5BactorId%5D/route.ts"],
+  "sourcesContent": ["/**\n * Admin API \u2014 DELETE /api/forms/submissions/:submissionId/actors/:actorId\n *\n * Revokes the supplied actor row (sets `revoked_at`). Requires\n * `forms.submissions.manage`.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { SubmissionService } from '../../../../../services/submission-service'\nimport { mapSubmissionError } from '../../../../runtime-helpers'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['forms.submissions.manage'] },\n}\n\nexport async function DELETE(\n  req: NextRequest,\n  context: { params: { submissionId: string; actorId: string } | Promise<{ submissionId: string; actorId: string }> },\n) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  if (!auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Tenant scope required' }, { status: 403 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.submissionId)\n  const actorId = String(params.actorId)\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    await service.revokeActor({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      actorId,\n      revokedBy: auth.sub,\n    })\n    return NextResponse.json({ ok: true })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({ error: z.string(), message: z.string().optional() })\n\nconst responseSchema = z.object({ ok: z.literal(true) })\n\nconst deleteMethodDoc: OpenApiMethodDoc = {\n  summary: 'Revoke a submission actor',\n  description: 'Revokes the supplied actor row by setting revoked_at.',\n  tags: ['Forms Admin'],\n  responses: [{ status: 200, description: 'Actor revoked', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Actor not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Revoke submission actor',\n  methods: { DELETE: deleteMethodDoc },\n}\n"],
+  "mappings": "AAOA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC7E;AAEA,eAAsB,OACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,YAAY;AAC/C,QAAM,UAAU,OAAO,OAAO,OAAO;AAErC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,QAAQ,YAAY;AAAA,MACxB;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf;AAAA,MACA,WAAW,KAAK;AAAA,IAClB,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAElF,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEvD,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,eAAe,CAAC;AAAA,EACjF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,EACrE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ,gBAAgB;AACrC;",
+  "names": []
+}

package/dist/modules/forms/api/submissions/[submissionId]/actors/route.js

@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { assignActorInputSchema } from "../../../../data/validators.js";
+import { mapSubmissionError, readJsonBody, serializeActor } from "../../../runtime-helpers.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["forms.submissions.manage"] }
+};
+async function POST(req, context) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: "Tenant scope required" }, { status: 403 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.submissionId);
+  let raw;
+  try {
+    raw = await readJsonBody(req);
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+  const parsed = assignActorInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", details: parsed.error.flatten() },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  try {
+    const actor = await service.assignActor({
+      submissionId,
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      userId: parsed.data.user_id,
+      role: parsed.data.role,
+      assignedBy: auth.sub
+    });
+    return NextResponse.json({ actor: serializeActor(actor) }, { status: 201 });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const responseSchema = z.object({ actor: z.record(z.string(), z.unknown()) });
+const postMethodDoc = {
+  summary: "Assign an actor to a submission",
+  description: "Assigns a (user, role) pair as an active actor on the submission. The role MUST be declared on the form version.",
+  tags: ["Forms Admin"],
+  requestBody: { schema: assignActorInputSchema },
+  responses: [{ status: 201, description: "Actor assigned", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Submission not found", schema: errorSchema },
+    { status: 422, description: "Invalid role for the form version", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Assign submission actor",
+  methods: { POST: postMethodDoc }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/submissions/[submissionId]/actors/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/submissions/%5BsubmissionId%5D/actors/route.ts"],
+  "sourcesContent": ["/**\n * Admin API \u2014 POST /api/forms/submissions/:submissionId/actors\n *\n * Assigns a (user, role) pair to the submission. Requires\n * `forms.submissions.manage`. The role MUST be one of the form version's\n * declared roles; the SubmissionService validates this.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { SubmissionService } from '../../../../services/submission-service'\nimport { assignActorInputSchema } from '../../../../data/validators'\nimport { mapSubmissionError, readJsonBody, serializeActor } from '../../../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['forms.submissions.manage'] },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { submissionId: string } | Promise<{ submissionId: string }> },\n) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  if (!auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Tenant scope required' }, { status: 403 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.submissionId)\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = assignActorInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const actor = await service.assignActor({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      userId: parsed.data.user_id,\n      role: parsed.data.role,\n      assignedBy: auth.sub,\n    })\n    return NextResponse.json({ actor: serializeActor(actor) }, { status: 201 })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({ actor: z.record(z.string(), z.unknown()) })\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Assign an actor to a submission',\n  description: 'Assigns a (user, role) pair as an active actor on the submission. The role MUST be declared on the form version.',\n  tags: ['Forms Admin'],\n  requestBody: { schema: assignActorInputSchema },\n  responses: [{ status: 201, description: 'Actor assigned', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n    { status: 422, description: 'Invalid role for the form version', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Assign submission actor',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB,cAAc,sBAAsB;AAE1D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC3E;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,YAAY;AAE/C,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,uBAAuB,UAAU,GAAG;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,QAAQ,MAAM,QAAQ,YAAY;AAAA,MACtC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,QAAQ,OAAO,KAAK;AAAA,MACpB,MAAM,OAAO,KAAK;AAAA,MAClB,YAAY,KAAK;AAAA,IACnB,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,KAAK,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;AAE5E,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa,EAAE,QAAQ,uBAAuB;AAAA,EAC9C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,eAAe,CAAC;AAAA,EAClF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,YAAY;AAAA,EACvF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "names": []
+}