@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/data/entities.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/data/entities.ts"],
+  "sourcesContent": ["import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\n\nexport type FormStatus = 'draft' | 'active' | 'archived'\nexport type FormVersionStatus = 'draft' | 'published' | 'archived'\nexport type FormSubmissionStatus = 'draft' | 'submitted' | 'reopened' | 'archived'\nexport type FormSubmissionRevisionChangeSource = 'user' | 'admin' | 'system'\n\n@Entity({ tableName: 'forms_form' })\n@Unique({ name: 'forms_form_org_key_unique', properties: ['organizationId', 'key'] })\n@Index({ name: 'forms_form_org_status_idx', properties: ['organizationId', 'status'] })\n@Index({ name: 'forms_form_org_tenant_deleted_idx', properties: ['organizationId', 'tenantId', 'deletedAt'] })\nexport class Form {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'key', type: 'text' })\n  key!: string\n\n  @Property({ name: 'name', type: 'text' })\n  name!: string\n\n  @Property({ name: 'description', type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'status', type: 'text', default: 'draft' })\n  status: FormStatus = 'draft'\n\n  @Property({ name: 'current_published_version_id', type: 'uuid', nullable: true })\n  currentPublishedVersionId?: string | null\n\n  @Property({ name: 'default_locale', type: 'text' })\n  defaultLocale!: string\n\n  @Property({ name: 'supported_locales', type: 'text[]' })\n  supportedLocales!: string[]\n\n  @Property({ name: 'created_by', type: 'uuid' })\n  createdBy!: string\n\n  /**\n   * W5 (DP-6) \u2014 per-form retention window in days. `null` \u21D2 keep forever.\n   * The retention-purge worker anonymizes submissions whose age (measured\n   * from `submitted_at`, or `updated_at` for drafts) exceeds this window.\n   * Consent / signature submissions honour the same window \u2014 the legal\n   * retention story is satisfied by the immutable version-pinned signed\n   * record surviving anonymization (only `x-om-sensitive` answers are\n   * tombstoned), not by skipping the purge.\n   */\n  @Property({ name: 'retention_days', type: 'int', nullable: true })\n  retentionDays?: number | null\n\n  @Property({ name: 'archived_at', type: Date, nullable: true })\n  archivedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n@Entity({ tableName: 'forms_form_version' })\n@Unique({ name: 'forms_form_version_form_id_version_number_unique', properties: ['formId', 'versionNumber'] })\n@Index({ name: 'forms_form_version_form_id_status_idx', properties: ['formId', 'status'] })\n@Index({ name: 'forms_form_version_org_tenant_idx', properties: ['organizationId', 'tenantId'] })\nexport class FormVersion {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'form_id', type: 'uuid' })\n  formId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'version_number', type: 'int' })\n  versionNumber!: number\n\n  @Property({ name: 'status', type: 'text', default: 'draft' })\n  status: FormVersionStatus = 'draft'\n\n  @Property({ name: 'schema', type: 'json' })\n  schema!: Record<string, unknown>\n\n  @Property({ name: 'ui_schema', type: 'json' })\n  uiSchema!: Record<string, unknown>\n\n  @Property({ name: 'roles', type: 'json' })\n  roles!: string[]\n\n  @Property({ name: 'schema_hash', type: 'text' })\n  schemaHash!: string\n\n  @Property({ name: 'registry_version', type: 'text' })\n  registryVersion!: string\n\n  @Property({ name: 'published_at', type: Date, nullable: true })\n  publishedAt?: Date | null\n\n  @Property({ name: 'published_by', type: 'uuid', nullable: true })\n  publishedBy?: string | null\n\n  @Property({ name: 'changelog', type: 'text', nullable: true })\n  changelog?: string | null\n\n  @Property({ name: 'archived_at', type: Date, nullable: true })\n  archivedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n/**\n * Form submission \u2014 a fillable artifact bound to a pinned form_version.\n *\n * Phase 1c entity. Subject identifiers (`subjectType`, `subjectId`) are kept\n * polymorphic and validated at the application layer; cross-module ORM\n * relations are intentionally avoided. The `currentRevisionId` advances on\n * every successful save.\n */\n@Entity({ tableName: 'forms_form_submission' })\n@Index({ name: 'forms_form_submission_org_version_status_idx', properties: ['organizationId', 'formVersionId', 'status'] })\n@Index({ name: 'forms_form_submission_subject_idx', properties: ['subjectType', 'subjectId'] })\n@Index({ name: 'forms_form_submission_org_submitted_at_idx', properties: ['organizationId', 'submittedAt'] })\n@Index({ name: 'forms_form_submission_org_tenant_deleted_idx', properties: ['organizationId', 'tenantId', 'deletedAt'] })\nexport class FormSubmission {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'form_version_id', type: 'uuid' })\n  formVersionId!: string\n\n  @Property({ name: 'subject_type', type: 'text' })\n  subjectType!: string\n\n  @Property({ name: 'subject_id', type: 'uuid' })\n  subjectId!: string\n\n  @Property({ name: 'status', type: 'text', default: 'draft' })\n  status: FormSubmissionStatus = 'draft'\n\n  @Property({ name: 'current_revision_id', type: 'uuid', nullable: true })\n  currentRevisionId?: string | null\n\n  @Property({ name: 'started_by', type: 'uuid' })\n  startedBy!: string\n\n  @Property({ name: 'submitted_by', type: 'uuid', nullable: true })\n  submittedBy?: string | null\n\n  @Property({ name: 'first_saved_at', type: Date, onCreate: () => new Date() })\n  firstSavedAt: Date = new Date()\n\n  @Property({ name: 'submitted_at', type: Date, nullable: true })\n  submittedAt?: Date | null\n\n  @Property({ name: 'submit_metadata', type: 'json', nullable: true })\n  submitMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'pdf_snapshot_attachment_id', type: 'uuid', nullable: true })\n  pdfSnapshotAttachmentId?: string | null\n\n  @Property({ name: 'anonymized_at', type: Date, nullable: true })\n  anonymizedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n/**\n * Form submission actor \u2014 an active or revoked role assignment for a\n * (submission, user) pair. The same user may be assigned multiple roles, but\n * only one *active* row per (submission, user) is permitted via partial\n * unique index where `revoked_at IS NULL` (enforced in the migration).\n */\n@Entity({ tableName: 'forms_form_submission_actor' })\n@Index({ name: 'forms_form_submission_actor_submission_role_idx', properties: ['submissionId', 'role'] })\n@Index({ name: 'forms_form_submission_actor_org_idx', properties: ['organizationId'] })\nexport class FormSubmissionActor {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'submission_id', type: 'uuid' })\n  submissionId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'user_id', type: 'uuid' })\n  userId!: string\n\n  @Property({ name: 'role', type: 'text' })\n  role!: string\n\n  @Property({ name: 'assigned_at', type: Date, onCreate: () => new Date() })\n  assignedAt: Date = new Date()\n\n  @Property({ name: 'revoked_at', type: Date, nullable: true })\n  revokedAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\n/**\n * Form submission revision \u2014 append-only revision chain for a submission.\n *\n * Invariants (enforced at the service layer; the only allowed UPDATE paths\n * are the anonymization tombstone (phase 2b) and the coalesce-after-cap\n * branch in `SubmissionService.save` when `revision_number` would exceed\n * `FORMS_REVISION_CAP`). Never DELETE.\n *\n * The `data` column is an envelope ciphertext managed directly by the\n * forms-module `EncryptionService` \u2014 NOT the global `findWithDecryption`\n * pipeline. The header self-describes the key version\n * (`version(2B) | key_version(2B) | iv(12B) | ciphertext | tag(16B)`).\n */\n@Entity({ tableName: 'forms_form_submission_revision' })\n@Index({ name: 'forms_form_submission_revision_submission_idx', properties: ['submissionId', 'revisionNumber'] })\n@Index({ name: 'forms_form_submission_revision_org_saved_idx', properties: ['organizationId', 'savedAt'] })\nexport class FormSubmissionRevision {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'submission_id', type: 'uuid' })\n  submissionId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'revision_number', type: 'int' })\n  revisionNumber!: number\n\n  // Envelope-encrypted JSON payload \u2014 see EncryptionService for the format.\n  @Property({ name: 'data', type: 'bytea' })\n  data!: Buffer\n\n  @Property({ name: 'encryption_key_version', type: 'int' })\n  encryptionKeyVersion!: number\n\n  @Property({ name: 'saved_at', type: Date, onCreate: () => new Date() })\n  savedAt: Date = new Date()\n\n  @Property({ name: 'saved_by', type: 'uuid' })\n  savedBy!: string\n\n  @Property({ name: 'saved_by_role', type: 'text' })\n  savedByRole!: string\n\n  @Property({ name: 'change_source', type: 'text', default: 'user' })\n  changeSource: FormSubmissionRevisionChangeSource = 'user'\n\n  @Property({ name: 'changed_field_keys', type: 'text[]' })\n  changedFieldKeys: string[] = []\n\n  @Property({ name: 'change_summary', type: 'text', nullable: true })\n  changeSummary?: string | null\n\n  @Property({ name: 'anonymized_at', type: Date, nullable: true })\n  anonymizedAt?: Date | null\n}\n\n/**\n * Per-tenant envelope-encryption key. Stores the KMS-wrapped DEK; one row\n * per (organization_id, key_version). On rotate, the previous row is marked\n * `retired_at = now()` and a fresh row with `key_version + 1` is inserted.\n */\n@Entity({ tableName: 'forms_encryption_key' })\n@Unique({ name: 'forms_encryption_key_org_version_unique', properties: ['organizationId', 'keyVersion'] })\nexport class FormsEncryptionKey {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'key_version', type: 'int' })\n  keyVersion!: number\n\n  @Property({ name: 'wrapped_dek', type: 'bytea' })\n  wrappedDek!: Buffer\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'retired_at', type: Date, nullable: true })\n  retiredAt?: Date | null\n}\n\nexport type FormAccessAuditPurpose = 'view' | 'export' | 'revert' | 'anonymize' | 'reopen'\nexport type FormAttachmentKind = 'user_upload' | 'snapshot' | 'generated'\n\n/**\n * Per-admin-read audit row. Written by `AccessAuditLogger` for every\n * admin-surface read of a submission. The body never contains payload\n * values \u2014 only metadata (user, purpose, IP, UA, optional `revision_id`).\n *\n * Runtime (patient/customer) reads of one's own submission do NOT write\n * audit rows \u2014 phase 1c R1 posture.\n */\n@Entity({ tableName: 'forms_form_access_audit' })\n@Index({ name: 'forms_access_audit_submission_idx', properties: ['submissionId', 'accessedAt'] })\n@Index({ name: 'forms_access_audit_org_idx', properties: ['organizationId', 'accessedAt'] })\nexport class FormAccessAudit {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'submission_id', type: 'uuid' })\n  submissionId!: string\n\n  @Property({ name: 'accessed_by', type: 'uuid' })\n  accessedBy!: string\n\n  @Property({ name: 'accessed_at', type: Date, onCreate: () => new Date() })\n  accessedAt: Date = new Date()\n\n  @Property({ name: 'access_purpose', type: 'text' })\n  accessPurpose!: FormAccessAuditPurpose\n\n  @Property({ name: 'ip', type: 'text', nullable: true })\n  ip?: string | null\n\n  @Property({ name: 'ua', type: 'text', nullable: true })\n  ua?: string | null\n\n  @Property({ name: 'revision_id', type: 'uuid', nullable: true })\n  revisionId?: string | null\n}\n\n/**\n * Form attachment indirection \u2014 links a submission/field to a stored file.\n *\n * `kind` distinguishes user uploads (phase 2c file field) from the\n * single PDF snapshot generated at submit time (phase 2b) or other\n * system-generated artifacts. The `file_id` references the project's\n * files-module storage; `payload_inline` is a short-circuit field for\n * deployments without a files module \u2014 phase 2b's PdfSnapshotRenderer\n * uses one or the other depending on which is wired in DI.\n *\n * `removed_at` lets phase 2c soft-remove user uploads on revoke/replace\n * without destroying the audit chain.\n */\n@Entity({ tableName: 'forms_form_attachment' })\n@Index({ name: 'forms_attachment_submission_field_idx', properties: ['submissionId', 'fieldKey'] })\n@Index({ name: 'forms_attachment_org_kind_idx', properties: ['organizationId', 'kind'] })\nexport class FormAttachment {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'submission_id', type: 'uuid' })\n  submissionId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'field_key', type: 'text' })\n  fieldKey!: string\n\n  @Property({ name: 'kind', type: 'text' })\n  kind!: FormAttachmentKind\n\n  // FK id to the project's files module (nullable when storage is inline).\n  @Property({ name: 'file_id', type: 'uuid', nullable: true })\n  fileId?: string | null\n\n  // Inline payload bytes for deployments without a files module. Use\n  // sparingly \u2014 large blobs belong in object storage.\n  @Property({ name: 'payload_inline', type: 'bytea', nullable: true })\n  payloadInline?: Buffer | null\n\n  @Property({ name: 'content_type', type: 'text', nullable: true })\n  contentType?: string | null\n\n  @Property({ name: 'filename', type: 'text', nullable: true })\n  filename?: string | null\n\n  @Property({ name: 'size_bytes', type: 'int', nullable: true })\n  sizeBytes?: number | null\n\n  @Property({ name: 'uploaded_by', type: 'uuid', nullable: true })\n  uploadedBy?: string | null\n\n  @Property({ name: 'uploaded_at', type: Date, onCreate: () => new Date() })\n  uploadedAt: Date = new Date()\n\n  @Property({ name: 'removed_at', type: Date, nullable: true })\n  removedAt?: Date | null\n}\n\nexport type FormDistributionMode = 'open' | 'personal'\nexport type FormDistributionStatus = 'active' | 'paused' | 'closed'\n\n/**\n * Form distribution \u2014 a publishable channel that exposes a form to external\n * participants. `mode = 'open'` opens an anonymous public link keyed by\n * `public_slug`; `mode = 'personal'` issues per-recipient invitations\n * (`forms_invitation`). `pinned_version_id` optionally locks the served\n * version; when null the distribution serves the form's current published\n * version. Cross-module identifiers (`form_id`, `pinned_version_id`) are plain\n * uuid columns \u2014 no ORM relations.\n *\n * The `forms_distribution_org_public_slug_idx` index backs the partial unique\n * index on (organization_id, public_slug) WHERE public_slug IS NOT NULL \u2014\n * declared in the migration SQL because the partial predicate cannot be\n * expressed via the @Unique decorator.\n */\n@Entity({ tableName: 'forms_distribution' })\n@Index({ name: 'forms_distribution_org_public_slug_idx', properties: ['organizationId', 'publicSlug'] })\n@Index({ name: 'forms_distribution_org_form_idx', properties: ['organizationId', 'formId'] })\n@Index({ name: 'forms_distribution_org_status_idx', properties: ['organizationId', 'status'] })\nexport class FormDistribution {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'form_id', type: 'uuid' })\n  formId!: string\n\n  @Property({ name: 'pinned_version_id', type: 'uuid', nullable: true })\n  pinnedVersionId?: string | null\n\n  @Property({ name: 'mode', type: 'text' })\n  mode!: FormDistributionMode\n\n  @Property({ name: 'public_slug', type: 'text', nullable: true })\n  publicSlug?: string | null\n\n  @Property({ name: 'status', type: 'text', default: 'active' })\n  status: FormDistributionStatus = 'active'\n\n  @Property({ name: 'title', type: 'text', nullable: true })\n  title?: string | null\n\n  @Property({ name: 'default_locale', type: 'text' })\n  defaultLocale!: string\n\n  @Property({ name: 'require_customer_auth', type: 'boolean', default: false })\n  requireCustomerAuth: boolean = false\n\n  @Property({ name: 'allow_multiple_submissions', type: 'boolean', default: false })\n  allowMultipleSubmissions: boolean = false\n\n  @Property({ name: 'max_responses', type: 'int', nullable: true })\n  maxResponses?: number | null\n\n  @Property({ name: 'response_count', type: 'int', default: 0 })\n  responseCount: number = 0\n\n  @Property({ name: 'opens_at', type: Date, nullable: true })\n  opensAt?: Date | null\n\n  @Property({ name: 'closes_at', type: Date, nullable: true })\n  closesAt?: Date | null\n\n  @Property({ name: 'redirect_url', type: 'text', nullable: true })\n  redirectUrl?: string | null\n\n  @Property({ name: 'settings', type: 'json', nullable: true })\n  settings?: Record<string, unknown> | null\n\n  @Property({ name: 'created_by', type: 'uuid' })\n  createdBy!: string\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n\nexport type FormConsentRecordStatus = 'active' | 'superseded' | 'revoked'\n\n/**\n * Form consent record \u2014 Phase 3 Track D.\n *\n * A per-subject, per-clause projection of signed consent from\n * `signature`-typed fields. Materialized by the `forms-consent-projector`\n * subscriber on `forms.submission.submitted`: each signature answer becomes\n * one `active` record, and any prior `active` record for the same\n * `(organization_id, subject_type, subject_id, form_id, consent_field_key)`\n * is marked `superseded`.\n *\n * Deliberately PII-free: it stores only the consent-clause SHA + `signed_at`\n * timestamp + ids \u2014 never the signature image, typed name, or any answer\n * value. This is non-sensitive audit data that survives anonymization, so the\n * projection is a safe queryable surface for \"did subject X sign clause Y, and\n * when\". Cross-module identifiers (`form_id`, `subject_id`, `submission_id`)\n * are plain uuid columns \u2014 no ORM relations.\n */\n@Entity({ tableName: 'forms_consent_record' })\n@Index({ name: 'forms_consent_record_org_subject_idx', properties: ['organizationId', 'subjectType', 'subjectId'] })\n@Index({ name: 'forms_consent_record_org_form_status_idx', properties: ['organizationId', 'formId', 'status'] })\n@Index({ name: 'forms_consent_record_submission_idx', properties: ['submissionId'] })\nexport class FormConsentRecord {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'subject_type', type: 'text' })\n  subjectType!: string\n\n  @Property({ name: 'subject_id', type: 'uuid' })\n  subjectId!: string\n\n  @Property({ name: 'form_id', type: 'uuid' })\n  formId!: string\n\n  @Property({ name: 'form_version_id', type: 'uuid' })\n  formVersionId!: string\n\n  @Property({ name: 'version_number', type: 'int' })\n  versionNumber!: number\n\n  @Property({ name: 'submission_id', type: 'uuid' })\n  submissionId!: string\n\n  @Property({ name: 'consent_field_key', type: 'text' })\n  consentFieldKey!: string\n\n  @Property({ name: 'clause_sha256', type: 'text' })\n  clauseSha256!: string\n\n  @Property({ name: 'signed_at', type: Date })\n  signedAt!: Date\n\n  @Property({ name: 'status', type: 'text', default: 'active' })\n  status: FormConsentRecordStatus = 'active'\n\n  @Property({ name: 'superseded_by_record_id', type: 'uuid', nullable: true })\n  supersededByRecordId?: string | null\n\n  @Property({ name: 'superseded_at', type: Date, nullable: true })\n  supersededAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\nexport type FormInvitationStatus =\n  | 'pending'\n  | 'sent'\n  | 'opened'\n  | 'started'\n  | 'submitted'\n  | 'expired'\n  | 'revoked'\n\n/**\n * Form invitation \u2014 a per-recipient handle for a `personal`-mode\n * distribution. The row `id` doubles as the anonymous participant principal\n * (the subject identifier on the resulting submission), so the invitation\n * itself is the identity anchor for an unauthenticated respondent.\n *\n * `recipient_email` / `recipient_name` are PII routed through the global\n * `findWithDecryption` pipeline (declared in `encryption.ts`). `token_hash`\n * stores a one-way hash of the bearer token \u2014 never the raw token; its\n * partial unique index (WHERE token_hash IS NOT NULL) is declared in the\n * migration SQL. Cross-module identifiers (`distribution_id`,\n * `submission_id`, `recipient_ref`) are plain columns \u2014 no ORM relations.\n */\n@Entity({ tableName: 'forms_invitation' })\n@Index({ name: 'forms_invitation_distribution_status_idx', properties: ['distributionId', 'status'] })\n@Index({ name: 'forms_invitation_org_submission_idx', properties: ['organizationId', 'submissionId'] })\n@Index({ name: 'forms_invitation_token_hash_idx', properties: ['tokenHash'] })\nexport class FormInvitation {\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'distribution_id', type: 'uuid' })\n  distributionId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'recipient_email', type: 'text', nullable: true })\n  recipientEmail?: string | null\n\n  @Property({ name: 'recipient_name', type: 'text', nullable: true })\n  recipientName?: string | null\n\n  @Property({ name: 'recipient_ref', type: 'text', nullable: true })\n  recipientRef?: string | null\n\n  @Property({ name: 'role', type: 'text', nullable: true })\n  role?: string | null\n\n  @Property({ name: 'token_hash', type: 'text', nullable: true })\n  tokenHash?: string | null\n\n  @Property({ name: 'status', type: 'text', default: 'pending' })\n  status: FormInvitationStatus = 'pending'\n\n  @Property({ name: 'submission_id', type: 'uuid', nullable: true })\n  submissionId?: string | null\n\n  @Property({ name: 'locale', type: 'text', nullable: true })\n  locale?: string | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  expiresAt?: Date | null\n\n  @Property({ name: 'sent_at', type: Date, nullable: true })\n  sentAt?: Date | null\n\n  @Property({ name: 'opened_at', type: Date, nullable: true })\n  openedAt?: Date | null\n\n  @Property({ name: 'started_at', type: Date, nullable: true })\n  startedAt?: Date | null\n\n  @Property({ name: 'submitted_at', type: Date, nullable: true })\n  submittedAt?: Date | null\n\n  @Property({ name: 'send_count', type: 'int', default: 0 })\n  sendCount: number = 0\n\n  @Property({ name: 'last_error', type: 'text', nullable: true })\n  lastError?: string | null\n\n  @Property({ name: 'created_by', type: 'uuid', nullable: true })\n  createdBy?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n\n  @Property({ name: 'deleted_at', type: Date, nullable: true })\n  deletedAt?: Date | null\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAWrD,IAAM,OAAN,MAAW;AAAA,EAAX;AAoBL,kBAAqB;AA8BrB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAvDE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,KAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,KAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,KAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,GAV5B,KAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,GAb7B,KAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBpD,KAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAnBjD,KAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gCAAgC,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtBrE,KAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GAzBvC,KA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,SAAS,CAAC;AAAA,GA5B5C,KA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GA/BnC,KAgCX;AAYA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,UAAU,KAAK,CAAC;AAAA,GA3CtD,KA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA9ClD,KA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAjD7D,KAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GApD7D,KAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAvDjD,KAwDX;AAxDW,OAAN;AAAA,EAJN,OAAO,EAAE,WAAW,aAAa,CAAC;AAAA,EAClC,OAAO,EAAE,MAAM,6BAA6B,YAAY,CAAC,kBAAkB,KAAK,EAAE,CAAC;AAAA,EACnF,MAAM,EAAE,MAAM,6BAA6B,YAAY,CAAC,kBAAkB,QAAQ,EAAE,CAAC;AAAA,EACrF,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,kBAAkB,YAAY,WAAW,EAAE,CAAC;AAAA,GAChG;AA+DN,IAAM,cAAN,MAAkB;AAAA,EAAlB;AAiBL,kBAA4B;AA8B5B,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAjDE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,YAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAJhC,YAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,YAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAVlC,YAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,MAAM,CAAC;AAAA,GAbtC,YAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAhBjD,YAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,OAAO,CAAC;AAAA,GAnB/B,YAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAtBlC,YAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,SAAS,MAAM,OAAO,CAAC;AAAA,GAzB9B,YA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GA5BpC,YA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,OAAO,CAAC;AAAA,GA/BzC,YAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAlCnD,YAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCrD,YAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAxClD,YAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA3ClD,YA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA9C7D,YA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAjD7D,YAkDX;AAlDW,cAAN;AAAA,EAJN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,OAAO,EAAE,MAAM,oDAAoD,YAAY,CAAC,UAAU,eAAe,EAAE,CAAC;AAAA,EAC5G,MAAM,EAAE,MAAM,yCAAyC,YAAY,CAAC,UAAU,QAAQ,EAAE,CAAC;AAAA,EACzF,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,kBAAkB,UAAU,EAAE,CAAC;AAAA,GACnF;AAkEN,IAAM,iBAAN,MAAqB;AAAA,EAArB;AAoBL,kBAA+B;AAY/B,wBAAqB,oBAAI,KAAK;AAe9B,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AApDE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,eAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,eAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,eAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAVxC,eAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAbrC,eAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAhBnC,eAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAnBjD,eAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,uBAAuB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtB5D,eAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAzBnC,eA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BrD,eA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/BjE,eAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAlCnD,eAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GArCxD,eAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,8BAA8B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAxCnE,eAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA3CpD,eA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA9C7D,eA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAjD7D,eAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GApDjD,eAqDX;AArDW,iBAAN;AAAA,EALN,OAAO,EAAE,WAAW,wBAAwB,CAAC;AAAA,EAC7C,MAAM,EAAE,MAAM,gDAAgD,YAAY,CAAC,kBAAkB,iBAAiB,QAAQ,EAAE,CAAC;AAAA,EACzH,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,eAAe,WAAW,EAAE,CAAC;AAAA,EAC7F,MAAM,EAAE,MAAM,8CAA8C,YAAY,CAAC,kBAAkB,aAAa,EAAE,CAAC;AAAA,EAC3G,MAAM,EAAE,MAAM,gDAAgD,YAAY,CAAC,kBAAkB,YAAY,WAAW,EAAE,CAAC;AAAA,GAC3G;AAiEN,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAiBL,sBAAmB,oBAAI,KAAK;AAM5B,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AA5BE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,oBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAJtC,oBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,oBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAVhC,oBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,GAb7B,oBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhB9D,oBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnBjD,oBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAtB7D,oBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAzB7D,oBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA5BjD,oBA6BX;AA7BW,sBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,8BAA8B,CAAC;AAAA,EACnD,MAAM,EAAE,MAAM,mDAAmD,YAAY,CAAC,gBAAgB,MAAM,EAAE,CAAC;AAAA,EACvG,MAAM,EAAE,MAAM,uCAAuC,YAAY,CAAC,gBAAgB,EAAE,CAAC;AAAA,GACzE;AAgDN,IAAM,yBAAN,MAA6B;AAAA,EAA7B;AAqBL,mBAAgB,oBAAI,KAAK;AASzB,wBAAmD;AAGnD,4BAA6B,CAAC;AAAA;AAOhC;AAtCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,uBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAJtC,uBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,uBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,MAAM,CAAC;AAAA,GAVvC,uBAWX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,GAd9B,uBAeX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,0BAA0B,MAAM,MAAM,CAAC;AAAA,GAjB9C,uBAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GApB3D,uBAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,OAAO,CAAC;AAAA,GAvBjC,uBAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GA1BtC,uBA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,SAAS,OAAO,CAAC;AAAA,GA7BvD,uBA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,sBAAsB,MAAM,SAAS,CAAC;AAAA,GAhC7C,uBAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnCvD,uBAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAtCpD,uBAuCX;AAvCW,yBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,iCAAiC,CAAC;AAAA,EACtD,MAAM,EAAE,MAAM,iDAAiD,YAAY,CAAC,gBAAgB,gBAAgB,EAAE,CAAC;AAAA,EAC/G,MAAM,EAAE,MAAM,gDAAgD,YAAY,CAAC,kBAAkB,SAAS,EAAE,CAAC;AAAA,GAC7F;AAiDN,IAAM,qBAAN,MAAyB;AAAA,EAAzB;AAcL,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAhBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,mBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,mBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,CAAC;AAAA,GAPnC,mBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,CAAC;AAAA,GAVrC,mBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAb7D,mBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhBjD,mBAiBX;AAjBW,qBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,uBAAuB,CAAC;AAAA,EAC5C,OAAO,EAAE,MAAM,2CAA2C,YAAY,CAAC,kBAAkB,YAAY,EAAE,CAAC;AAAA,GAC5F;AAkCN,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AAcL,sBAAmB,oBAAI,KAAK;AAAA;AAa9B;AAzBE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,gBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,gBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAPtC,gBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAVpC,gBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAb9D,gBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GAhBvC,gBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,MAAM,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnB3C,gBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,MAAM,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtB3C,gBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBpD,gBA0BX;AA1BW,kBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,0BAA0B,CAAC;AAAA,EAC/C,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,gBAAgB,YAAY,EAAE,CAAC;AAAA,EAC/F,MAAM,EAAE,MAAM,8BAA8B,YAAY,CAAC,kBAAkB,YAAY,EAAE,CAAC;AAAA,GAC9E;AA6CN,IAAM,iBAAN,MAAqB;AAAA,EAArB;AAsCL,sBAAmB,oBAAI,KAAK;AAAA;AAI9B;AAxCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,eAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAJtC,eAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,eAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAVlC,eAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,GAb7B,eAcX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjBhD,eAkBX;AAKA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtBxD,eAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBrD,eA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5BjD,eA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,UAAU,KAAK,CAAC;AAAA,GA/BlD,eAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlCpD,eAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArC9D,eAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAxCjD,eAyCX;AAzCW,iBAAN;AAAA,EAHN,OAAO,EAAE,WAAW,wBAAwB,CAAC;AAAA,EAC7C,MAAM,EAAE,MAAM,yCAAyC,YAAY,CAAC,gBAAgB,UAAU,EAAE,CAAC;AAAA,EACjG,MAAM,EAAE,MAAM,iCAAiC,YAAY,CAAC,kBAAkB,MAAM,EAAE,CAAC;AAAA,GAC3E;AAiEN,IAAM,mBAAN,MAAuB;AAAA,EAAvB;AAuBL,kBAAiC;AASjC,+BAA+B;AAG/B,oCAAoC;AAMpC,yBAAwB;AAkBxB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAhEE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,iBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,iBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,iBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAVhC,iBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAb1D,iBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,GAhB7B,iBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBpD,iBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,SAAS,SAAS,CAAC;AAAA,GAtBlD,iBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,SAAS,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzB9C,iBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GA5BvC,iBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,yBAAyB,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GA/BjE,iBAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,8BAA8B,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAlCtE,iBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,UAAU,KAAK,CAAC;AAAA,GArCrD,iBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,SAAS,EAAE,CAAC;AAAA,GAxClD,iBAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA3C/C,iBA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA9ChD,iBA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjDrD,iBAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,YAAY,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GApDjD,iBAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAvDnC,iBAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA1D7D,iBA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7D7D,iBA8DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAhEjD,iBAiEX;AAjEW,mBAAN;AAAA,EAJN,OAAO,EAAE,WAAW,qBAAqB,CAAC;AAAA,EAC1C,MAAM,EAAE,MAAM,0CAA0C,YAAY,CAAC,kBAAkB,YAAY,EAAE,CAAC;AAAA,EACtG,MAAM,EAAE,MAAM,mCAAmC,YAAY,CAAC,kBAAkB,QAAQ,EAAE,CAAC;AAAA,EAC3F,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,kBAAkB,QAAQ,EAAE,CAAC;AAAA,GACjF;AA2FN,IAAM,oBAAN,MAAwB;AAAA,EAAxB;AAsCL,kBAAkC;AASlC,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAjDE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,kBAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,kBAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAPlC,kBAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAVrC,kBAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,CAAC;AAAA,GAbnC,kBAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,OAAO,CAAC;AAAA,GAhBhC,kBAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAnBxC,kBAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,MAAM,CAAC;AAAA,GAtBtC,kBAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GAzBtC,kBA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,OAAO,CAAC;AAAA,GA5B1C,kBA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,OAAO,CAAC;AAAA,GA/BtC,kBAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,KAAK,CAAC;AAAA,GAlChC,kBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,SAAS,SAAS,CAAC;AAAA,GArClD,kBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,2BAA2B,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAxChE,kBAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA3CpD,kBA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA9C7D,kBA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAjD7D,kBAkDX;AAlDW,oBAAN;AAAA,EAJN,OAAO,EAAE,WAAW,uBAAuB,CAAC;AAAA,EAC5C,MAAM,EAAE,MAAM,wCAAwC,YAAY,CAAC,kBAAkB,eAAe,WAAW,EAAE,CAAC;AAAA,EAClH,MAAM,EAAE,MAAM,4CAA4C,YAAY,CAAC,kBAAkB,UAAU,QAAQ,EAAE,CAAC;AAAA,EAC9G,MAAM,EAAE,MAAM,uCAAuC,YAAY,CAAC,cAAc,EAAE,CAAC;AAAA,GACvE;AA+EN,IAAM,iBAAN,MAAqB;AAAA,EAArB;AA6BL,kBAA+B;AAwB/B,qBAAoB;AASpB,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAI7B;AAnEE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GADlD,eAEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAJxC,eAKX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GAPxC,eAQX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAVlC,eAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,eAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBvD,eAiBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAnBtD,eAoBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtB7C,eAuBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAzBnD,eA0BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,SAAS,UAAU,CAAC;AAAA,GA5BnD,eA6BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,iBAAiB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA/BtD,eAgCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlC/C,eAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GArCjD,eAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAxC9C,eAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA3ChD,eA4CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GA9CjD,eA+CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAjDnD,eAkDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,OAAO,SAAS,EAAE,CAAC;AAAA,GApD9C,eAqDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAvDnD,eAwDX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA1DnD,eA2DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7D7D,eA8DX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhE7D,eAiEX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,GAnEjD,eAoEX;AApEW,iBAAN;AAAA,EAJN,OAAO,EAAE,WAAW,mBAAmB,CAAC;AAAA,EACxC,MAAM,EAAE,MAAM,4CAA4C,YAAY,CAAC,kBAAkB,QAAQ,EAAE,CAAC;AAAA,EACpG,MAAM,EAAE,MAAM,uCAAuC,YAAY,CAAC,kBAAkB,cAAc,EAAE,CAAC;AAAA,EACrG,MAAM,EAAE,MAAM,mCAAmC,YAAY,CAAC,WAAW,EAAE,CAAC;AAAA,GAChE;",
+  "names": []
+}

package/dist/modules/forms/data/validators.js

@@ -0,0 +1,254 @@
+import { z } from "zod";
+import { normalizeEmbedOrigin } from "../lib/embed-frame-policy.js";
+import { isNavigableUrl } from "../lib/navigable-url.js";
+const formKeySchema = z.string().min(3).max(64).regex(/^[a-z][a-z0-9_-]*$/, {
+  message: "Form key must start with a lowercase letter and only contain lowercase letters, digits, hyphens, and underscores."
+});
+const localeSchema = z.string().min(2).max(10).regex(/^[a-z]{2,3}(?:-[A-Z]{2})?$/, {
+  message: 'Locale must be a BCP-47 tag like "en" or "en-US".'
+});
+const roleIdentifierSchema = z.string().min(2).max(64).regex(/^[a-z][a-z0-9_-]*$/, {
+  message: "Role identifier must start with a lowercase letter and only contain lowercase letters, digits, hyphens, and underscores."
+});
+const submissionSubjectSchema = z.object({
+  subject_type: z.string().min(1).max(64),
+  subject_id: z.string().uuid()
+});
+const submissionStartInputSchema = z.object({
+  form_key: formKeySchema,
+  subject_type: z.string().min(1).max(64),
+  subject_id: z.string().uuid(),
+  locale: localeSchema.optional()
+});
+const submissionSaveInputSchema = z.object({
+  base_revision_id: z.string().uuid(),
+  patch: z.record(z.string(), z.unknown()),
+  change_summary: z.string().max(500).optional()
+});
+const submissionSubmitInputSchema = z.object({
+  base_revision_id: z.string().uuid(),
+  submit_metadata: z.record(z.string(), z.unknown()).optional()
+});
+const assignActorInputSchema = z.object({
+  user_id: z.string().uuid(),
+  role: roleIdentifierSchema
+});
+const revokeActorInputSchema = z.object({
+  actor_id: z.string().uuid()
+});
+const scopedFields = {
+  tenantId: z.string().uuid(),
+  organizationId: z.string().uuid()
+};
+const optionalDescription = z.string().trim().max(2e3).optional().nullable();
+const optionalChangelog = z.string().trim().max(4e3).optional().nullable();
+const formStatusSchema = z.enum(["draft", "active", "archived"]);
+const formVersionStatusSchema = z.enum(["draft", "published", "archived"]);
+const jsonObjectSchema = z.record(z.string(), z.unknown());
+const supportedLocalesSchema = z.array(localeSchema).min(1).max(20);
+const retentionDaysSchema = z.number().int().min(1).max(36500).optional().nullable();
+const formListQuerySchema = z.object({
+  status: z.union([formStatusSchema, z.array(formStatusSchema).max(3)]).optional(),
+  q: z.string().trim().max(200).optional(),
+  page: z.coerce.number().int().min(1).optional(),
+  pageSize: z.coerce.number().int().min(1).max(100).optional()
+});
+const formCreateCommandSchema = z.object({
+  ...scopedFields,
+  key: formKeySchema,
+  name: z.string().trim().min(1).max(200),
+  description: optionalDescription,
+  defaultLocale: localeSchema,
+  supportedLocales: supportedLocalesSchema,
+  retentionDays: retentionDaysSchema
+});
+const formRenameCommandSchema = z.object({
+  ...scopedFields,
+  id: z.string().uuid(),
+  name: z.string().trim().min(1).max(200).optional(),
+  description: optionalDescription,
+  defaultLocale: localeSchema.optional(),
+  supportedLocales: supportedLocalesSchema.optional(),
+  retentionDays: retentionDaysSchema
+});
+const formArchiveCommandSchema = z.object({
+  ...scopedFields,
+  id: z.string().uuid()
+});
+const formRestoreCommandSchema = z.object({
+  ...scopedFields,
+  id: z.string().uuid()
+});
+const formVersionForkDraftCommandSchema = z.object({
+  ...scopedFields,
+  formId: z.string().uuid(),
+  fromVersionId: z.string().uuid().optional().nullable()
+});
+const formVersionUpdateDraftCommandSchema = z.object({
+  ...scopedFields,
+  formId: z.string().uuid(),
+  versionId: z.string().uuid(),
+  schema: jsonObjectSchema.optional(),
+  uiSchema: jsonObjectSchema.optional(),
+  roles: z.array(roleIdentifierSchema).max(50).optional(),
+  changelog: optionalChangelog
+});
+const formVersionPublishCommandSchema = z.object({
+  ...scopedFields,
+  formId: z.string().uuid(),
+  versionId: z.string().uuid(),
+  changelog: z.string().trim().max(4e3).optional().nullable()
+});
+const formVersionArchiveCommandSchema = z.object({
+  ...scopedFields,
+  formId: z.string().uuid(),
+  versionId: z.string().uuid()
+});
+const formCreateRequestSchema = formCreateCommandSchema.omit({
+  tenantId: true,
+  organizationId: true
+});
+const formPatchRequestSchema = z.object({
+  name: z.string().trim().min(1).max(200).optional(),
+  description: optionalDescription,
+  defaultLocale: localeSchema.optional(),
+  supportedLocales: supportedLocalesSchema.optional(),
+  retentionDays: retentionDaysSchema
+});
+const formVersionForkRequestSchema = z.object({
+  fromVersionId: z.string().uuid().optional().nullable()
+});
+const formVersionPatchRequestSchema = z.object({
+  schema: jsonObjectSchema.optional(),
+  uiSchema: jsonObjectSchema.optional(),
+  roles: z.array(roleIdentifierSchema).max(50).optional(),
+  changelog: optionalChangelog
+});
+const formVersionPublishRequestSchema = z.object({
+  changelog: z.string().trim().max(4e3).optional().nullable()
+});
+const formVersionDiffQuerySchema = z.object({
+  against: z.string().uuid()
+});
+const distributionModeSchema = z.enum(["open", "personal"]);
+const distributionStatusSchema = z.enum(["active", "paused", "closed"]);
+const isoDateTimeSchema = z.string().datetime({ offset: true });
+const optionalRedirectUrl = z.string().url().max(2e3).refine((value) => isNavigableUrl(value), {
+  message: "forms.errors.redirect_url_scheme"
+}).optional().nullable();
+const embedAllowedDomainSchema = z.string().trim().min(1).max(253).refine((value) => normalizeEmbedOrigin(value) !== null, {
+  message: 'Allowed domain must be an https origin like "https://www.acme.com" (http is permitted only for localhost). No path, query, or fragment.'
+});
+const embedSettingsSchema = z.object({
+  enabled: z.boolean().default(false),
+  allowedDomains: z.array(embedAllowedDomainSchema).max(50).default([]),
+  theme: z.enum(["light", "dark", "auto"]).optional(),
+  autoResize: z.boolean().default(true)
+}).strict().refine((value) => !value.enabled || value.allowedDomains.length > 0, {
+  message: "Embedding cannot be enabled without at least one allowed domain.",
+  path: ["allowedDomains"]
+});
+const distributionSettingsSchema = z.object({
+  embed: embedSettingsSchema.optional()
+}).passthrough();
+const distributionCreateCommandSchema = z.object({
+  ...scopedFields,
+  formId: z.string().uuid(),
+  mode: distributionModeSchema,
+  pinnedVersionId: z.string().uuid().optional().nullable(),
+  title: z.string().trim().min(1).max(200).optional().nullable(),
+  defaultLocale: localeSchema,
+  requireCustomerAuth: z.boolean().optional(),
+  allowMultipleSubmissions: z.boolean().optional(),
+  maxResponses: z.number().int().positive().optional().nullable(),
+  opensAt: isoDateTimeSchema.optional().nullable(),
+  closesAt: isoDateTimeSchema.optional().nullable(),
+  redirectUrl: optionalRedirectUrl,
+  settings: distributionSettingsSchema.optional().nullable()
+});
+const distributionUpdateCommandSchema = z.object({
+  ...scopedFields,
+  distributionId: z.string().uuid(),
+  status: distributionStatusSchema.optional(),
+  title: z.string().trim().min(1).max(200).optional().nullable(),
+  maxResponses: z.number().int().positive().optional().nullable(),
+  opensAt: isoDateTimeSchema.optional().nullable(),
+  closesAt: isoDateTimeSchema.optional().nullable(),
+  redirectUrl: optionalRedirectUrl,
+  allowMultipleSubmissions: z.boolean().optional(),
+  requireCustomerAuth: z.boolean().optional(),
+  settings: distributionSettingsSchema.optional().nullable()
+});
+const distributionCloseCommandSchema = z.object({
+  ...scopedFields,
+  distributionId: z.string().uuid()
+});
+const invitationRecipientSchema = z.object({
+  email: z.string().email().max(320).optional(),
+  name: z.string().trim().min(1).max(200).optional(),
+  ref: z.string().trim().min(1).max(200).optional(),
+  role: roleIdentifierSchema.optional(),
+  locale: localeSchema.optional(),
+  expiresAt: isoDateTimeSchema.optional()
+});
+const invitationCreateCommandSchema = z.object({
+  ...scopedFields,
+  distributionId: z.string().uuid(),
+  recipients: z.array(invitationRecipientSchema).min(1).max(1e3)
+});
+const invitationSendCommandSchema = z.object({
+  ...scopedFields,
+  invitationId: z.string().uuid()
+});
+const invitationRevokeCommandSchema = z.object({
+  ...scopedFields,
+  invitationId: z.string().uuid()
+});
+const publicStartInputSchema = z.object({
+  slug: z.string().min(1).max(200).optional(),
+  token: z.string().min(1).max(512).optional(),
+  locale: localeSchema.optional(),
+  captchaToken: z.string().min(1).max(4e3).optional()
+}).refine((value) => Boolean(value.slug) !== Boolean(value.token), {
+  message: 'Exactly one of "slug" or "token" must be provided.'
+});
+export {
+  assignActorInputSchema,
+  distributionCloseCommandSchema,
+  distributionCreateCommandSchema,
+  distributionModeSchema,
+  distributionSettingsSchema,
+  distributionStatusSchema,
+  distributionUpdateCommandSchema,
+  embedSettingsSchema,
+  formArchiveCommandSchema,
+  formCreateCommandSchema,
+  formCreateRequestSchema,
+  formKeySchema,
+  formListQuerySchema,
+  formPatchRequestSchema,
+  formRenameCommandSchema,
+  formRestoreCommandSchema,
+  formStatusSchema,
+  formVersionArchiveCommandSchema,
+  formVersionDiffQuerySchema,
+  formVersionForkDraftCommandSchema,
+  formVersionForkRequestSchema,
+  formVersionPatchRequestSchema,
+  formVersionPublishCommandSchema,
+  formVersionPublishRequestSchema,
+  formVersionStatusSchema,
+  formVersionUpdateDraftCommandSchema,
+  invitationCreateCommandSchema,
+  invitationRevokeCommandSchema,
+  invitationSendCommandSchema,
+  localeSchema,
+  publicStartInputSchema,
+  revokeActorInputSchema,
+  roleIdentifierSchema,
+  submissionSaveInputSchema,
+  submissionStartInputSchema,
+  submissionSubjectSchema,
+  submissionSubmitInputSchema
+};
+//# sourceMappingURL=validators.js.map

package/dist/modules/forms/data/validators.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/data/validators.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport { normalizeEmbedOrigin } from '../lib/embed-frame-policy'\nimport { isNavigableUrl } from '../lib/navigable-url'\n\n/**\n * Forms module shared Zod primitives + Phase 1b/1c command/API schemas.\n *\n * Phase 1a shipped only the building-block primitives. Phase 1b extends with\n * the form definition + version lifecycle command/API schemas. Phase 1c adds\n * the runtime submission schemas.\n */\n\n/**\n * Form key \u2014 stable per-organization slug. 3-64 chars; starts with a lower\n * case letter; contains only `[a-z0-9_-]`. Treated as a contract surface for\n * external integrations; uniqueness is enforced at the DB level by\n * UNIQUE (organization_id, key).\n */\nexport const formKeySchema = z\n  .string()\n  .min(3)\n  .max(64)\n  .regex(/^[a-z][a-z0-9_-]*$/, {\n    message: 'Form key must start with a lowercase letter and only contain lowercase letters, digits, hyphens, and underscores.',\n  })\n\n/**\n * Locale tag \u2014 minimal BCP-47 shape. `en`, `en-US`, `pl`, `pl-PL`, etc.\n * Studio (phase 1b) may expand this once the locale picker ships.\n */\nexport const localeSchema = z\n  .string()\n  .min(2)\n  .max(10)\n  .regex(/^[a-z]{2,3}(?:-[A-Z]{2})?$/, {\n    message: 'Locale must be a BCP-47 tag like \"en\" or \"en-US\".',\n  })\n\n/**\n * Role identifier \u2014 used in `x-om-roles`, `x-om-editable-by`, `x-om-visible-to`,\n * and the form-version `roles` column. Lower-case, slug-shaped, snake-kebab\n * mix tolerated. Common values: `patient`, `clinician`, `admin`, `guardian`.\n */\nexport const roleIdentifierSchema = z\n  .string()\n  .min(2)\n  .max(64)\n  .regex(/^[a-z][a-z0-9_-]*$/, {\n    message: 'Role identifier must start with a lowercase letter and only contain lowercase letters, digits, hyphens, and underscores.',\n  })\n\nexport type FormKey = z.infer<typeof formKeySchema>\nexport type Locale = z.infer<typeof localeSchema>\nexport type RoleIdentifier = z.infer<typeof roleIdentifierSchema>\n\n/**\n * Submission subject identifier. Polymorphic: subject_type is a free-form\n * string tag (`patient`, `customer`, `case`, etc.); subject_id MUST be a\n * UUID. Validation of the (subject_type, subject_id) pair against actual\n * domain entities is the responsibility of the calling module.\n */\nexport const submissionSubjectSchema = z.object({\n  subject_type: z.string().min(1).max(64),\n  subject_id: z.string().uuid(),\n})\n\n/**\n * Body for `POST /api/form-submissions` \u2014 runtime start.\n */\nexport const submissionStartInputSchema = z.object({\n  form_key: formKeySchema,\n  subject_type: z.string().min(1).max(64),\n  subject_id: z.string().uuid(),\n  locale: localeSchema.optional(),\n})\n\nexport type SubmissionStartInput = z.infer<typeof submissionStartInputSchema>\n\n/**\n * Body for `PATCH /api/form-submissions/:id` \u2014 autosave.\n *\n * `patch` is left as `passthrough` because the field-set is dynamic per form\n * version; the SubmissionService enforces `additionalProperties: false`\n * via the AJV validator from the compiler before persisting.\n */\nexport const submissionSaveInputSchema = z.object({\n  base_revision_id: z.string().uuid(),\n  patch: z.record(z.string(), z.unknown()),\n  change_summary: z.string().max(500).optional(),\n})\n\nexport type SubmissionSaveInput = z.infer<typeof submissionSaveInputSchema>\n\n/**\n * Body for `POST /api/form-submissions/:id/submit` \u2014 final submit.\n */\nexport const submissionSubmitInputSchema = z.object({\n  base_revision_id: z.string().uuid(),\n  submit_metadata: z.record(z.string(), z.unknown()).optional(),\n})\n\nexport type SubmissionSubmitInput = z.infer<typeof submissionSubmitInputSchema>\n\n/**\n * Body for `POST /api/forms/submissions/:submissionId/actors` \u2014 admin assigns\n * a (user, role) pair to a submission. The role MUST be one of the form\n * version's declared roles; the SubmissionService enforces this.\n */\nexport const assignActorInputSchema = z.object({\n  user_id: z.string().uuid(),\n  role: roleIdentifierSchema,\n})\n\nexport type AssignActorInput = z.infer<typeof assignActorInputSchema>\n\nexport const revokeActorInputSchema = z.object({\n  actor_id: z.string().uuid(),\n})\n\nexport type RevokeActorInput = z.infer<typeof revokeActorInputSchema>\n\n// ============================================================================\n// Phase 1b \u2014 Definition Authoring (CRUD + Studio) command + API schemas\n// ============================================================================\n\nconst scopedFields = {\n  tenantId: z.string().uuid(),\n  organizationId: z.string().uuid(),\n} as const\n\nconst optionalDescription = z\n  .string()\n  .trim()\n  .max(2000)\n  .optional()\n  .nullable()\n\nconst optionalChangelog = z\n  .string()\n  .trim()\n  .max(4000)\n  .optional()\n  .nullable()\n\nexport const formStatusSchema = z.enum(['draft', 'active', 'archived'])\nexport const formVersionStatusSchema = z.enum(['draft', 'published', 'archived'])\n\nconst jsonObjectSchema = z.record(z.string(), z.unknown())\n\nconst supportedLocalesSchema = z.array(localeSchema).min(1).max(20)\n\n/**\n * Per-form retention window in days (W5 / DP-6). `null` keeps submissions\n * forever; a positive integer drives the retention-purge worker. Capped at\n * ~100 years so a typo cannot disable purge by accident while still allowing\n * decade-long legal-retention windows.\n */\nconst retentionDaysSchema = z.number().int().min(1).max(36500).optional().nullable()\n\n/** Query schema for `GET /api/forms`. */\nexport const formListQuerySchema = z.object({\n  status: z\n    .union([formStatusSchema, z.array(formStatusSchema).max(3)])\n    .optional(),\n  q: z.string().trim().max(200).optional(),\n  page: z.coerce.number().int().min(1).optional(),\n  pageSize: z.coerce.number().int().min(1).max(100).optional(),\n})\n\nexport type FormListQueryInput = z.infer<typeof formListQuerySchema>\n\n/** Command input for `forms.form.create`. */\nexport const formCreateCommandSchema = z.object({\n  ...scopedFields,\n  key: formKeySchema,\n  name: z.string().trim().min(1).max(200),\n  description: optionalDescription,\n  defaultLocale: localeSchema,\n  supportedLocales: supportedLocalesSchema,\n  retentionDays: retentionDaysSchema,\n})\n\nexport type FormCreateCommandInput = z.infer<typeof formCreateCommandSchema>\n\n/**\n * Command input for `forms.form.rename`. Despite the name, this command is the\n * single form-metadata update path: name, description, and (W7) the locale set.\n * `defaultLocale` must be one of `supportedLocales` \u2014 enforced at execute time.\n */\nexport const formRenameCommandSchema = z.object({\n  ...scopedFields,\n  id: z.string().uuid(),\n  name: z.string().trim().min(1).max(200).optional(),\n  description: optionalDescription,\n  defaultLocale: localeSchema.optional(),\n  supportedLocales: supportedLocalesSchema.optional(),\n  retentionDays: retentionDaysSchema,\n})\n\nexport type FormRenameCommandInput = z.infer<typeof formRenameCommandSchema>\n\n/** Command input for `forms.form.archive`. */\nexport const formArchiveCommandSchema = z.object({\n  ...scopedFields,\n  id: z.string().uuid(),\n})\n\nexport type FormArchiveCommandInput = z.infer<typeof formArchiveCommandSchema>\n\n/** Command input for `forms.form.restore`. */\nexport const formRestoreCommandSchema = z.object({\n  ...scopedFields,\n  id: z.string().uuid(),\n})\n\nexport type FormRestoreCommandInput = z.infer<typeof formRestoreCommandSchema>\n\n/** Command input for `forms.form_version.fork_draft`. */\nexport const formVersionForkDraftCommandSchema = z.object({\n  ...scopedFields,\n  formId: z.string().uuid(),\n  fromVersionId: z.string().uuid().optional().nullable(),\n})\n\nexport type FormVersionForkDraftCommandInput = z.infer<typeof formVersionForkDraftCommandSchema>\n\n/** Command input for `forms.form_version.update_draft`. */\nexport const formVersionUpdateDraftCommandSchema = z.object({\n  ...scopedFields,\n  formId: z.string().uuid(),\n  versionId: z.string().uuid(),\n  schema: jsonObjectSchema.optional(),\n  uiSchema: jsonObjectSchema.optional(),\n  roles: z.array(roleIdentifierSchema).max(50).optional(),\n  changelog: optionalChangelog,\n})\n\nexport type FormVersionUpdateDraftCommandInput = z.infer<typeof formVersionUpdateDraftCommandSchema>\n\n/** Command input for `forms.form_version.publish`. */\nexport const formVersionPublishCommandSchema = z.object({\n  ...scopedFields,\n  formId: z.string().uuid(),\n  versionId: z.string().uuid(),\n  changelog: z.string().trim().max(4000).optional().nullable(),\n})\n\nexport type FormVersionPublishCommandInput = z.infer<typeof formVersionPublishCommandSchema>\n\n/** Command input for `forms.form_version.archive`. */\nexport const formVersionArchiveCommandSchema = z.object({\n  ...scopedFields,\n  formId: z.string().uuid(),\n  versionId: z.string().uuid(),\n})\n\nexport type FormVersionArchiveCommandInput = z.infer<typeof formVersionArchiveCommandSchema>\n\n/** POST /api/forms request body (route layer fills tenant/organization scope). */\nexport const formCreateRequestSchema = formCreateCommandSchema.omit({\n  tenantId: true,\n  organizationId: true,\n})\n\n/** PATCH /api/forms/:id request body. */\nexport const formPatchRequestSchema = z.object({\n  name: z.string().trim().min(1).max(200).optional(),\n  description: optionalDescription,\n  defaultLocale: localeSchema.optional(),\n  supportedLocales: supportedLocalesSchema.optional(),\n  retentionDays: retentionDaysSchema,\n})\n\n/** POST /api/forms/:id/versions/fork request body. */\nexport const formVersionForkRequestSchema = z.object({\n  fromVersionId: z.string().uuid().optional().nullable(),\n})\n\n/** PATCH /api/forms/:id/versions/:versionId request body. */\nexport const formVersionPatchRequestSchema = z.object({\n  schema: jsonObjectSchema.optional(),\n  uiSchema: jsonObjectSchema.optional(),\n  roles: z.array(roleIdentifierSchema).max(50).optional(),\n  changelog: optionalChangelog,\n})\n\n/** POST /api/forms/:id/versions/:versionId/publish request body. */\nexport const formVersionPublishRequestSchema = z.object({\n  changelog: z.string().trim().max(4000).optional().nullable(),\n})\n\n/** GET /api/forms/:id/versions/:versionId/diff query. */\nexport const formVersionDiffQuerySchema = z.object({\n  against: z.string().uuid(),\n})\n\nexport type FormCreateRequestInput = z.infer<typeof formCreateRequestSchema>\nexport type FormPatchRequestInput = z.infer<typeof formPatchRequestSchema>\nexport type FormVersionForkRequestInput = z.infer<typeof formVersionForkRequestSchema>\nexport type FormVersionPatchRequestInput = z.infer<typeof formVersionPatchRequestSchema>\nexport type FormVersionPublishRequestInput = z.infer<typeof formVersionPublishRequestSchema>\nexport type FormVersionDiffQueryInput = z.infer<typeof formVersionDiffQuerySchema>\n\nexport type FormStatus = z.infer<typeof formStatusSchema>\nexport type FormVersionStatus = z.infer<typeof formVersionStatusSchema>\n\n// ============================================================================\n// Phase 2d \u2014 Distribution & Anonymous Submission command/API schemas\n// ============================================================================\n\nexport const distributionModeSchema = z.enum(['open', 'personal'])\nexport const distributionStatusSchema = z.enum(['active', 'paused', 'closed'])\n\nexport type FormDistributionMode = z.infer<typeof distributionModeSchema>\nexport type FormDistributionStatus = z.infer<typeof distributionStatusSchema>\n\nconst isoDateTimeSchema = z.string().datetime({ offset: true })\n\n/**\n * Post-submission redirect target. `z.string().url()` alone is not enough: it\n * only asks whether `new URL(...)` parses, so `javascript:`, `data:` and\n * `vbscript:` all pass it \u2014 and this value is assigned to `window.location` by\n * the anonymous public runner, in the app's own origin, under a CSP that allows\n * `'unsafe-inline'`. The scheme check is what makes it safe.\n */\nconst optionalRedirectUrl = z\n  .string()\n  .url()\n  .max(2000)\n  .refine((value) => isNavigableUrl(value), {\n    message: 'forms.errors.redirect_url_scheme',\n  })\n  .optional()\n  .nullable()\n\n/**\n * A single embed allowlist origin. Validated to the strict origin shape\n * (scheme + host + optional port, https-only except localhost) via the shared\n * `normalizeEmbedOrigin` policy helper so the Zod layer and the runtime CSP\n * builder agree byte-for-byte (R-RS-1).\n */\nconst embedAllowedDomainSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(253)\n  .refine((value) => normalizeEmbedOrigin(value) !== null, {\n    message:\n      'Allowed domain must be an https origin like \"https://www.acme.com\" (http is permitted only for localhost). No path, query, or fragment.',\n  })\n\n/**\n * `settings.embed` \u2014 opt-in external-website framing config (spec D6). Rides on\n * the existing `forms_distribution.settings` JSON column; no migration. Enabling\n * embedding REQUIRES a non-empty allowlist \u2014 an enabled bag with zero allowed\n * domains is rejected at save time (R-RS-1). `allowedDomains` is NEVER echoed to\n * any public context payload.\n */\nexport const embedSettingsSchema = z\n  .object({\n    enabled: z.boolean().default(false),\n    allowedDomains: z.array(embedAllowedDomainSchema).max(50).default([]),\n    theme: z.enum(['light', 'dark', 'auto']).optional(),\n    autoResize: z.boolean().default(true),\n  })\n  .strict()\n  .refine((value) => !value.enabled || value.allowedDomains.length > 0, {\n    message: 'Embedding cannot be enabled without at least one allowed domain.',\n    path: ['allowedDomains'],\n  })\n\nexport type EmbedSettingsInput = z.infer<typeof embedSettingsSchema>\n\n/**\n * Distribution `settings` JSON bag. Additive, backward-compatible: known keys\n * (`embed`) are validated; every other key (`captcha`, `completion`, \u2026) passes\n * through untouched so existing settings shapes keep working.\n */\nexport const distributionSettingsSchema = z\n  .object({\n    embed: embedSettingsSchema.optional(),\n  })\n  .passthrough()\n\nexport type DistributionSettingsInput = z.infer<typeof distributionSettingsSchema>\n\n/** Command input for `forms.distribution.create`. */\nexport const distributionCreateCommandSchema = z.object({\n  ...scopedFields,\n  formId: z.string().uuid(),\n  mode: distributionModeSchema,\n  pinnedVersionId: z.string().uuid().optional().nullable(),\n  title: z.string().trim().min(1).max(200).optional().nullable(),\n  defaultLocale: localeSchema,\n  requireCustomerAuth: z.boolean().optional(),\n  allowMultipleSubmissions: z.boolean().optional(),\n  maxResponses: z.number().int().positive().optional().nullable(),\n  opensAt: isoDateTimeSchema.optional().nullable(),\n  closesAt: isoDateTimeSchema.optional().nullable(),\n  redirectUrl: optionalRedirectUrl,\n  settings: distributionSettingsSchema.optional().nullable(),\n})\n\nexport type FormDistributionCreateCommandInput = z.infer<typeof distributionCreateCommandSchema>\n\n/** Command input for `forms.distribution.update`. */\nexport const distributionUpdateCommandSchema = z.object({\n  ...scopedFields,\n  distributionId: z.string().uuid(),\n  status: distributionStatusSchema.optional(),\n  title: z.string().trim().min(1).max(200).optional().nullable(),\n  maxResponses: z.number().int().positive().optional().nullable(),\n  opensAt: isoDateTimeSchema.optional().nullable(),\n  closesAt: isoDateTimeSchema.optional().nullable(),\n  redirectUrl: optionalRedirectUrl,\n  allowMultipleSubmissions: z.boolean().optional(),\n  requireCustomerAuth: z.boolean().optional(),\n  settings: distributionSettingsSchema.optional().nullable(),\n})\n\nexport type FormDistributionUpdateCommandInput = z.infer<typeof distributionUpdateCommandSchema>\n\n/** Command input for `forms.distribution.close`. */\nexport const distributionCloseCommandSchema = z.object({\n  ...scopedFields,\n  distributionId: z.string().uuid(),\n})\n\nexport type FormDistributionCloseCommandInput = z.infer<typeof distributionCloseCommandSchema>\n\nconst invitationRecipientSchema = z.object({\n  email: z.string().email().max(320).optional(),\n  name: z.string().trim().min(1).max(200).optional(),\n  ref: z.string().trim().min(1).max(200).optional(),\n  role: roleIdentifierSchema.optional(),\n  locale: localeSchema.optional(),\n  expiresAt: isoDateTimeSchema.optional(),\n})\n\nexport type FormInvitationRecipientInput = z.infer<typeof invitationRecipientSchema>\n\n/** Command input for `forms.invitation.create` \u2014 bulk recipient creation. */\nexport const invitationCreateCommandSchema = z.object({\n  ...scopedFields,\n  distributionId: z.string().uuid(),\n  recipients: z.array(invitationRecipientSchema).min(1).max(1000),\n})\n\nexport type FormInvitationCreateCommandInput = z.infer<typeof invitationCreateCommandSchema>\n\n/** Command input for `forms.invitation.send`. */\nexport const invitationSendCommandSchema = z.object({\n  ...scopedFields,\n  invitationId: z.string().uuid(),\n})\n\nexport type FormInvitationSendCommandInput = z.infer<typeof invitationSendCommandSchema>\n\n/** Command input for `forms.invitation.revoke`. */\nexport const invitationRevokeCommandSchema = z.object({\n  ...scopedFields,\n  invitationId: z.string().uuid(),\n})\n\nexport type FormInvitationRevokeCommandInput = z.infer<typeof invitationRevokeCommandSchema>\n\n/**\n * Body for the public anonymous start endpoint. Exactly one of `slug`\n * (open-mode public link) or `token` (personal-mode invitation) MUST be\n * present; the refine below enforces the disjunction.\n */\nexport const publicStartInputSchema = z\n  .object({\n    slug: z.string().min(1).max(200).optional(),\n    token: z.string().min(1).max(512).optional(),\n    locale: localeSchema.optional(),\n    captchaToken: z.string().min(1).max(4000).optional(),\n  })\n  .refine((value) => Boolean(value.slug) !== Boolean(value.token), {\n    message: 'Exactly one of \"slug\" or \"token\" must be provided.',\n  })\n\nexport type PublicStartInput = z.infer<typeof publicStartInputSchema>\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAgBxB,MAAM,gBAAgB,EAC1B,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,sBAAsB;AAAA,EAC3B,SAAS;AACX,CAAC;AAMI,MAAM,eAAe,EACzB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,8BAA8B;AAAA,EACnC,SAAS;AACX,CAAC;AAOI,MAAM,uBAAuB,EACjC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,sBAAsB;AAAA,EAC3B,SAAS;AACX,CAAC;AAYI,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,KAAK;AAC9B,CAAC;AAKM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACtC,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,QAAQ,aAAa,SAAS;AAChC,CAAC;AAWM,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,kBAAkB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACvC,gBAAgB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAC/C,CAAC;AAOM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,kBAAkB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAC9D,CAAC;AASM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,MAAM;AACR,CAAC;AAIM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,UAAU,EAAE,OAAO,EAAE,KAAK;AAC5B,CAAC;AAQD,MAAM,eAAe;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAClC;AAEA,MAAM,sBAAsB,EACzB,OAAO,EACP,KAAK,EACL,IAAI,GAAI,EACR,SAAS,EACT,SAAS;AAEZ,MAAM,oBAAoB,EACvB,OAAO,EACP,KAAK,EACL,IAAI,GAAI,EACR,SAAS,EACT,SAAS;AAEL,MAAM,mBAAmB,EAAE,KAAK,CAAC,SAAS,UAAU,UAAU,CAAC;AAC/D,MAAM,0BAA0B,EAAE,KAAK,CAAC,SAAS,aAAa,UAAU,CAAC;AAEhF,MAAM,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAEzD,MAAM,yBAAyB,EAAE,MAAM,YAAY,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAQlE,MAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,SAAS;AAG5E,MAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,QAAQ,EACL,MAAM,CAAC,kBAAkB,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,EAC1D,SAAS;AAAA,EACZ,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvC,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC7D,CAAC;AAKM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,GAAG;AAAA,EACH,KAAK;AAAA,EACL,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,aAAa;AAAA,EACb,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,eAAe;AACjB,CAAC;AASM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,GAAG;AAAA,EACH,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,aAAa;AAAA,EACb,eAAe,aAAa,SAAS;AAAA,EACrC,kBAAkB,uBAAuB,SAAS;AAAA,EAClD,eAAe;AACjB,CAAC;AAKM,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,GAAG;AAAA,EACH,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAKM,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,GAAG;AAAA,EACH,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAKM,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,GAAG;AAAA,EACH,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AACvD,CAAC;AAKM,MAAM,sCAAsC,EAAE,OAAO;AAAA,EAC1D,GAAG;AAAA,EACH,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,iBAAiB,SAAS;AAAA,EAClC,UAAU,iBAAiB,SAAS;AAAA,EACpC,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACtD,WAAW;AACb,CAAC;AAKM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,GAAG;AAAA,EACH,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAKM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,GAAG;AAAA,EACH,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,WAAW,EAAE,OAAO,EAAE,KAAK;AAC7B,CAAC;AAKM,MAAM,0BAA0B,wBAAwB,KAAK;AAAA,EAClE,UAAU;AAAA,EACV,gBAAgB;AAClB,CAAC;AAGM,MAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,aAAa;AAAA,EACb,eAAe,aAAa,SAAS;AAAA,EACrC,kBAAkB,uBAAuB,SAAS;AAAA,EAClD,eAAe;AACjB,CAAC;AAGM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AACvD,CAAC;AAGM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,QAAQ,iBAAiB,SAAS;AAAA,EAClC,UAAU,iBAAiB,SAAS;AAAA,EACpC,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACtD,WAAW;AACb,CAAC;AAGM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC;AAGM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAgBM,MAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC;AAC1D,MAAM,2BAA2B,EAAE,KAAK,CAAC,UAAU,UAAU,QAAQ,CAAC;AAK7E,MAAM,oBAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAS9D,MAAM,sBAAsB,EACzB,OAAO,EACP,IAAI,EACJ,IAAI,GAAI,EACR,OAAO,CAAC,UAAU,eAAe,KAAK,GAAG;AAAA,EACxC,SAAS;AACX,CAAC,EACA,SAAS,EACT,SAAS;AAQZ,MAAM,2BAA2B,EAC9B,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,OAAO,CAAC,UAAU,qBAAqB,KAAK,MAAM,MAAM;AAAA,EACvD,SACE;AACJ,CAAC;AASI,MAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EAClC,gBAAgB,EAAE,MAAM,wBAAwB,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAAA,EACpE,OAAO,EAAE,KAAK,CAAC,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,EAClD,YAAY,EAAE,QAAQ,EAAE,QAAQ,IAAI;AACtC,CAAC,EACA,OAAO,EACP,OAAO,CAAC,UAAU,CAAC,MAAM,WAAW,MAAM,eAAe,SAAS,GAAG;AAAA,EACpE,SAAS;AAAA,EACT,MAAM,CAAC,gBAAgB;AACzB,CAAC;AASI,MAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,OAAO,oBAAoB,SAAS;AACtC,CAAC,EACA,YAAY;AAKR,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,GAAG;AAAA,EACH,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,MAAM;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,eAAe;AAAA,EACf,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC1C,0BAA0B,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,SAAS,kBAAkB,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,kBAAkB,SAAS,EAAE,SAAS;AAAA,EAChD,aAAa;AAAA,EACb,UAAU,2BAA2B,SAAS,EAAE,SAAS;AAC3D,CAAC;AAKM,MAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,GAAG;AAAA,EACH,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,QAAQ,yBAAyB,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EAC7D,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9D,SAAS,kBAAkB,SAAS,EAAE,SAAS;AAAA,EAC/C,UAAU,kBAAkB,SAAS,EAAE,SAAS;AAAA,EAChD,aAAa;AAAA,EACb,0BAA0B,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC/C,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC1C,UAAU,2BAA2B,SAAS,EAAE,SAAS;AAC3D,CAAC;AAKM,MAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,GAAG;AAAA,EACH,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAClC,CAAC;AAID,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,MAAM,qBAAqB,SAAS;AAAA,EACpC,QAAQ,aAAa,SAAS;AAAA,EAC9B,WAAW,kBAAkB,SAAS;AACxC,CAAC;AAKM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,GAAG;AAAA,EACH,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,YAAY,EAAE,MAAM,yBAAyB,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAChE,CAAC;AAKM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,GAAG;AAAA,EACH,cAAc,EAAE,OAAO,EAAE,KAAK;AAChC,CAAC;AAKM,MAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,GAAG;AAAA,EACH,cAAc,EAAE,OAAO,EAAE,KAAK;AAChC,CAAC;AASM,MAAM,yBAAyB,EACnC,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,QAAQ,aAAa,SAAS;AAAA,EAC9B,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AACrD,CAAC,EACA,OAAO,CAAC,UAAU,QAAQ,MAAM,IAAI,MAAM,QAAQ,MAAM,KAAK,GAAG;AAAA,EAC/D,SAAS;AACX,CAAC;",
+  "names": []
+}

package/dist/modules/forms/di.js

@@ -0,0 +1,199 @@
+import { asValue, asFunction } from "awilix";
+import { getOrm } from "@open-mercato/shared/lib/db/mikro";
+import { defaultFieldTypeRegistry } from "./schema/field-type-registry.js";
+import { FormVersionCompiler } from "./services/form-version-compiler.js";
+import { FormVersionDiffer } from "./services/form-version-differ.js";
+import {
+  FormsEncryptionService,
+  resolveKmsAdapter
+} from "./services/encryption-service.js";
+import { RolePolicyService } from "./services/role-policy-service.js";
+import { SubmissionService } from "./services/submission-service.js";
+import { DistributionService } from "./services/distribution-service.js";
+import {
+  BatchingAccessAuditLogger,
+  FormsAccessAuditLogger,
+  resolveAccessAuditBatchMs
+} from "./services/access-audit-logger.js";
+import { AnonymizeService } from "./services/anonymize-service.js";
+import { AnalyticsService } from "./services/analytics-service.js";
+import { ConsentRecordService } from "./services/consent-record-service.js";
+import { ExportService } from "./services/export-service.js";
+import { AttachmentService } from "./services/attachment-service.js";
+import { PdfSnapshotService } from "./services/pdf-snapshot-service.js";
+import { NoopUploadScanner } from "./services/upload-scanner.js";
+import { resolveCaptchaVerifier } from "./services/captcha-verifier.js";
+import { DefaultPrefillResolver } from "./services/prefill-resolver.js";
+import { emitFormsEvent } from "./events.js";
+import { formsEventPayloadSchemas } from "./events-payloads.js";
+function register(container) {
+  const formVersionCompiler = new FormVersionCompiler({ registry: defaultFieldTypeRegistry });
+  const formVersionDiffer = new FormVersionDiffer();
+  const rolePolicyService = new RolePolicyService();
+  const accessAuditBatchMs = resolveAccessAuditBatchMs(process.env);
+  const accessAuditLogger = accessAuditBatchMs > 0 ? new BatchingAccessAuditLogger({
+    batchMs: accessAuditBatchMs,
+    // Fork a fresh EM at flush time — the request EM is long gone.
+    emFactory: async () => {
+      const orm = await getOrm();
+      return orm.em.fork();
+    }
+  }) : new FormsAccessAuditLogger();
+  container.register({
+    fieldTypeRegistry: asValue(defaultFieldTypeRegistry),
+    formVersionCompiler: asValue(formVersionCompiler),
+    formVersionDiffer: asValue(formVersionDiffer),
+    formsRolePolicyService: asValue(rolePolicyService),
+    formsAccessAuditLogger: asValue(accessAuditLogger),
+    formsEncryptionService: asFunction(({ em }) => {
+      return new FormsEncryptionService({
+        emFactory: () => em,
+        kmsAdapter: resolveKmsAdapter(process.env)
+      });
+    }).proxy().singleton(),
+    formsSubmissionService: asFunction(({ em, formsEncryptionService }) => {
+      return new SubmissionService({
+        emFactory: () => em,
+        formVersionCompiler,
+        encryptionService: formsEncryptionService,
+        rolePolicyService,
+        emitEvent: async (eventId, payload) => {
+          const schema = formsEventPayloadSchemas[eventId];
+          const validated = schema ? schema.parse(payload) : payload;
+          await emitFormsEvent(eventId, validated);
+        },
+        auditAccess: async (args) => {
+          if (args.surface !== "admin") return;
+          if (!args.viewerUserId) return;
+          const event = {
+            organizationId: args.organizationId,
+            submissionId: args.submissionId,
+            accessedBy: args.viewerUserId,
+            accessPurpose: "view"
+          };
+          await accessAuditLogger.log(em, event);
+        }
+      });
+    }).proxy().singleton(),
+    formsDistributionService: asFunction(({ em, formsSubmissionService }) => {
+      return new DistributionService({
+        emFactory: () => em,
+        submissionService: formsSubmissionService,
+        emitEvent: async (eventId, payload) => {
+          const schema = formsEventPayloadSchemas[eventId];
+          const validated = schema ? schema.parse(payload) : payload;
+          await emitFormsEvent(eventId, validated);
+        }
+      });
+    }).proxy().singleton(),
+    formsAnonymizeService: asFunction(({ em, formsEncryptionService }) => {
+      return new AnonymizeService({
+        em,
+        compiler: formVersionCompiler,
+        encryption: formsEncryptionService
+      });
+    }).proxy().singleton(),
+    // Phase 3 Track B — aggregate, PII-safe form analytics. Decrypts revision
+    // payloads only to tally enumerable answers; never returns decrypted
+    // values. Lazy-resolves `em` per request so EM request scoping is honoured.
+    formsAnalyticsService: asFunction(({ em, formsEncryptionService }) => {
+      return new AnalyticsService({
+        emFactory: () => em,
+        compiler: formVersionCompiler,
+        encryption: formsEncryptionService
+      });
+    }).proxy().singleton(),
+    // Phase 3 Track D — projects signed `signature` answers into the
+    // `forms_consent_record` per-subject consent aggregate. Loads the
+    // submission via the submission service (admin/full read, no role slice)
+    // so signature answers are present, then upserts + supersedes. PII-free.
+    // Lazy-resolves `em` per request so EM request scoping is honoured.
+    formsConsentRecordService: asFunction(
+      ({ em, formsSubmissionService }) => {
+        return new ConsentRecordService({
+          emFactory: () => em,
+          compiler: formVersionCompiler,
+          loadSubmission: async ({ submissionId, organizationId, tenantId }) => {
+            const view = await formsSubmissionService.getCurrent({
+              submissionId,
+              organizationId,
+              tenantId,
+              // The projector has no viewer and must see `signature` answers to
+              // write consent rows. `getCurrent` fails closed on an absent role,
+              // so this opt-in is required — without it every signature reads
+              // `undefined` and consent records are silently never written.
+              unsliced: true
+            });
+            return {
+              submission: view.submission,
+              formVersion: view.formVersion,
+              decodedData: view.decodedData
+            };
+          }
+        });
+      }
+    ).proxy().singleton(),
+    // W5 (DP-5) — builds the structured GDPR data-subject export document.
+    // Lazy-resolves `em` per request so EM request scoping is honoured.
+    formsExportService: asFunction(({ em, formsEncryptionService }) => {
+      return new ExportService({
+        emFactory: () => em,
+        compiler: formVersionCompiler,
+        encryption: formsEncryptionService
+      });
+    }).proxy().singleton(),
+    // W4 — no-op virus/malware scanner. Operators inject a real scanner by
+    // overriding `formsUploadScanner` with their own `UploadScanner`.
+    formsUploadScanner: asValue(new NoopUploadScanner()),
+    // W8 / FD-1 — default patient prefill resolver. Maps `name`/`email` from
+    // the customer auth context; anonymous principals resolve to `{}`. Stateless
+    // and pure, so `asValue` is correct. Operators inject a richer resolver
+    // (e.g. dental-os providing `dob`) by overriding `formsPrefillResolver`.
+    formsPrefillResolver: asValue(new DefaultPrefillResolver()),
+    // T5 — pluggable CAPTCHA verifier for the public start route. Selects a
+    // provider verifier (Cloudflare Turnstile / Google reCAPTCHA) when
+    // `FORMS_CAPTCHA_PROVIDER` + `FORMS_CAPTCHA_SECRET` are set; otherwise a
+    // no-op verifier (token presence is still enforced by the route for
+    // backward-compat). Stateless, so `asValue` is correct. Operators inject a
+    // custom verifier by overriding `formsCaptchaVerifier`.
+    formsCaptchaVerifier: asValue(resolveCaptchaVerifier(process.env)),
+    // W4 — encrypts + persists participant uploads as `forms_form_attachment`
+    // rows. Lazy-resolves `em` per request so EM request scoping is honoured.
+    formsAttachmentService: asFunction(
+      ({
+        em,
+        formsEncryptionService,
+        formsUploadScanner
+      }) => {
+        return new AttachmentService({
+          emFactory: () => em,
+          encryptionService: formsEncryptionService,
+          scanner: formsUploadScanner
+        });
+      }
+    ).proxy().singleton(),
+    // W3 — renders + stores the immutable signed PDF snapshot as an encrypted
+    // `forms_form_attachment` (`kind = 'snapshot'`). Generated once (on-submit
+    // subscriber or lazily on first download) and idempotent thereafter.
+    formsPdfSnapshotService: asFunction(
+      ({
+        em,
+        formsEncryptionService
+      }) => {
+        return new PdfSnapshotService({
+          emFactory: () => em,
+          encryptionService: formsEncryptionService,
+          emitEvent: async (eventId, payload) => {
+            const schema = formsEventPayloadSchemas[eventId];
+            const validated = schema ? schema.parse(payload) : payload;
+            await emitFormsEvent(eventId, validated);
+          }
+        });
+      }
+    ).proxy().singleton()
+  });
+}
+export {
+  register
+};
+//# sourceMappingURL=di.js.map