@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/runner/SignatureField.js

@@ -0,0 +1,132 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { Button } from "@open-mercato/ui/primitives/button";
+function SignatureCanvas({
+  value,
+  onChange,
+  disabled = false,
+  ariaLabel,
+  clearLabel
+}) {
+  const canvasRef = React.useRef(null);
+  const drawingRef = React.useRef(false);
+  const lastPointRef = React.useRef(null);
+  const hasStrokesRef = React.useRef(false);
+  const getContext = React.useCallback(() => {
+    const canvas = canvasRef.current;
+    if (!canvas) return null;
+    const context = canvas.getContext("2d");
+    if (!context) return null;
+    context.lineCap = "round";
+    context.lineJoin = "round";
+    context.lineWidth = 2;
+    context.strokeStyle = getComputedStyle(canvas).color;
+    return context;
+  }, []);
+  const pointFromEvent = React.useCallback((event) => {
+    const canvas = canvasRef.current;
+    if (!canvas) return { x: 0, y: 0 };
+    const rect = canvas.getBoundingClientRect();
+    const scaleX = canvas.width / rect.width;
+    const scaleY = canvas.height / rect.height;
+    return {
+      x: (event.clientX - rect.left) * scaleX,
+      y: (event.clientY - rect.top) * scaleY
+    };
+  }, []);
+  const handlePointerDown = React.useCallback(
+    (event) => {
+      if (disabled) return;
+      event.preventDefault();
+      const context = getContext();
+      if (!context) return;
+      canvasRef.current?.setPointerCapture(event.pointerId);
+      drawingRef.current = true;
+      lastPointRef.current = pointFromEvent(event);
+    },
+    [disabled, getContext, pointFromEvent]
+  );
+  const handlePointerMove = React.useCallback(
+    (event) => {
+      if (!drawingRef.current || disabled) return;
+      event.preventDefault();
+      const context = getContext();
+      const last = lastPointRef.current;
+      if (!context || !last) return;
+      const point = pointFromEvent(event);
+      context.beginPath();
+      context.moveTo(last.x, last.y);
+      context.lineTo(point.x, point.y);
+      context.stroke();
+      lastPointRef.current = point;
+      hasStrokesRef.current = true;
+    },
+    [disabled, getContext, pointFromEvent]
+  );
+  const commit = React.useCallback(() => {
+    const canvas = canvasRef.current;
+    if (!canvas) return;
+    if (!hasStrokesRef.current) return;
+    onChange(canvas.toDataURL("image/png"));
+  }, [onChange]);
+  const handlePointerUp = React.useCallback(
+    (event) => {
+      if (!drawingRef.current) return;
+      drawingRef.current = false;
+      lastPointRef.current = null;
+      canvasRef.current?.releasePointerCapture(event.pointerId);
+      commit();
+    },
+    [commit]
+  );
+  const clear = React.useCallback(() => {
+    const canvas = canvasRef.current;
+    const context = canvas?.getContext("2d");
+    if (canvas && context) context.clearRect(0, 0, canvas.width, canvas.height);
+    hasStrokesRef.current = false;
+    onChange(null);
+  }, [onChange]);
+  return /* @__PURE__ */ jsxs("div", { className: "flex flex-col gap-2", children: [
+    /* @__PURE__ */ jsx(
+      "canvas",
+      {
+        ref: canvasRef,
+        width: 600,
+        height: 200,
+        role: "img",
+        "aria-label": ariaLabel,
+        className: "w-full rounded-md border border-input bg-background",
+        style: { touchAction: "none", cursor: disabled ? "not-allowed" : "crosshair", aspectRatio: "3 / 1" },
+        onPointerDown: handlePointerDown,
+        onPointerMove: handlePointerMove,
+        onPointerUp: handlePointerUp,
+        onPointerLeave: handlePointerUp
+      }
+    ),
+    /* @__PURE__ */ jsx("div", { children: /* @__PURE__ */ jsx(
+      Button,
+      {
+        type: "button",
+        variant: "link",
+        size: "2xs",
+        disabled: disabled || !value,
+        onClick: clear,
+        className: "h-auto px-0 py-0 text-xs text-muted-foreground",
+        children: clearLabel
+      }
+    ) })
+  ] });
+}
+async function computeClauseSha256(clauseText) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return null;
+  const bytes = new TextEncoder().encode(clauseText);
+  const digest = await subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest)).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+export {
+  SignatureCanvas,
+  computeClauseSha256
+};
+//# sourceMappingURL=SignatureField.js.map

package/dist/modules/forms/runner/SignatureField.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/runner/SignatureField.tsx"],
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\n\nexport type SignatureCaptureMode = 'drawn' | 'typed'\n\nexport type SignatureCanvasProps = {\n  value: string | null\n  onChange: (dataUrl: string | null) => void\n  disabled?: boolean\n  ariaLabel?: string\n  clearLabel: string\n}\n\n/**\n * Mobile / tablet-first signature canvas. Strokes are captured via pointer\n * events with `touch-action: none` so a finger or stylus drag draws instead of\n * scrolling the page. On pointer-up the canvas is exported to a PNG data URL.\n */\nexport function SignatureCanvas({\n  value,\n  onChange,\n  disabled = false,\n  ariaLabel,\n  clearLabel,\n}: SignatureCanvasProps) {\n  const canvasRef = React.useRef<HTMLCanvasElement | null>(null)\n  const drawingRef = React.useRef(false)\n  const lastPointRef = React.useRef<{ x: number; y: number } | null>(null)\n  const hasStrokesRef = React.useRef(false)\n\n  const getContext = React.useCallback((): CanvasRenderingContext2D | null => {\n    const canvas = canvasRef.current\n    if (!canvas) return null\n    const context = canvas.getContext('2d')\n    if (!context) return null\n    context.lineCap = 'round'\n    context.lineJoin = 'round'\n    context.lineWidth = 2\n    context.strokeStyle = getComputedStyle(canvas).color\n    return context\n  }, [])\n\n  const pointFromEvent = React.useCallback((event: React.PointerEvent<HTMLCanvasElement>) => {\n    const canvas = canvasRef.current\n    if (!canvas) return { x: 0, y: 0 }\n    const rect = canvas.getBoundingClientRect()\n    const scaleX = canvas.width / rect.width\n    const scaleY = canvas.height / rect.height\n    return {\n      x: (event.clientX - rect.left) * scaleX,\n      y: (event.clientY - rect.top) * scaleY,\n    }\n  }, [])\n\n  const handlePointerDown = React.useCallback(\n    (event: React.PointerEvent<HTMLCanvasElement>) => {\n      if (disabled) return\n      event.preventDefault()\n      const context = getContext()\n      if (!context) return\n      canvasRef.current?.setPointerCapture(event.pointerId)\n      drawingRef.current = true\n      lastPointRef.current = pointFromEvent(event)\n    },\n    [disabled, getContext, pointFromEvent],\n  )\n\n  const handlePointerMove = React.useCallback(\n    (event: React.PointerEvent<HTMLCanvasElement>) => {\n      if (!drawingRef.current || disabled) return\n      event.preventDefault()\n      const context = getContext()\n      const last = lastPointRef.current\n      if (!context || !last) return\n      const point = pointFromEvent(event)\n      context.beginPath()\n      context.moveTo(last.x, last.y)\n      context.lineTo(point.x, point.y)\n      context.stroke()\n      lastPointRef.current = point\n      hasStrokesRef.current = true\n    },\n    [disabled, getContext, pointFromEvent],\n  )\n\n  const commit = React.useCallback(() => {\n    const canvas = canvasRef.current\n    if (!canvas) return\n    if (!hasStrokesRef.current) return\n    onChange(canvas.toDataURL('image/png'))\n  }, [onChange])\n\n  const handlePointerUp = React.useCallback(\n    (event: React.PointerEvent<HTMLCanvasElement>) => {\n      if (!drawingRef.current) return\n      drawingRef.current = false\n      lastPointRef.current = null\n      canvasRef.current?.releasePointerCapture(event.pointerId)\n      commit()\n    },\n    [commit],\n  )\n\n  const clear = React.useCallback(() => {\n    const canvas = canvasRef.current\n    const context = canvas?.getContext('2d')\n    if (canvas && context) context.clearRect(0, 0, canvas.width, canvas.height)\n    hasStrokesRef.current = false\n    onChange(null)\n  }, [onChange])\n\n  return (\n    <div className=\"flex flex-col gap-2\">\n      <canvas\n        ref={canvasRef}\n        width={600}\n        height={200}\n        role=\"img\"\n        aria-label={ariaLabel}\n        className=\"w-full rounded-md border border-input bg-background\"\n        style={{ touchAction: 'none', cursor: disabled ? 'not-allowed' : 'crosshair', aspectRatio: '3 / 1' }}\n        onPointerDown={handlePointerDown}\n        onPointerMove={handlePointerMove}\n        onPointerUp={handlePointerUp}\n        onPointerLeave={handlePointerUp}\n      />\n      <div>\n        <Button\n          type=\"button\"\n          variant=\"link\"\n          size=\"2xs\"\n          disabled={disabled || !value}\n          onClick={clear}\n          className=\"h-auto px-0 py-0 text-xs text-muted-foreground\"\n        >\n          {clearLabel}\n        </Button>\n      </div>\n    </div>\n  )\n}\n\n/**\n * SHA-256 hex digest of the resolved consent clause text via Web Crypto.\n * Returns `null` when the crypto subtle API is unavailable (older runtime /\n * insecure context) so the caller can decline to set a partial value.\n */\nexport async function computeClauseSha256(clauseText: string): Promise<string | null> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) return null\n  const bytes = new TextEncoder().encode(clauseText)\n  const digest = await subtle.digest('SHA-256', bytes)\n  return Array.from(new Uint8Array(digest))\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('')\n}\n"],
+  "mappings": ";AAkHI,SACE,KADF;AAhHJ,YAAY,WAAW;AACvB,SAAS,cAAc;AAiBhB,SAAS,gBAAgB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX;AAAA,EACA;AACF,GAAyB;AACvB,QAAM,YAAY,MAAM,OAAiC,IAAI;AAC7D,QAAM,aAAa,MAAM,OAAO,KAAK;AACrC,QAAM,eAAe,MAAM,OAAwC,IAAI;AACvE,QAAM,gBAAgB,MAAM,OAAO,KAAK;AAExC,QAAM,aAAa,MAAM,YAAY,MAAuC;AAC1E,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,UAAU,OAAO,WAAW,IAAI;AACtC,QAAI,CAAC,QAAS,QAAO;AACrB,YAAQ,UAAU;AAClB,YAAQ,WAAW;AACnB,YAAQ,YAAY;AACpB,YAAQ,cAAc,iBAAiB,MAAM,EAAE;AAC/C,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,iBAAiB,MAAM,YAAY,CAAC,UAAiD;AACzF,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ,QAAO,EAAE,GAAG,GAAG,GAAG,EAAE;AACjC,UAAM,OAAO,OAAO,sBAAsB;AAC1C,UAAM,SAAS,OAAO,QAAQ,KAAK;AACnC,UAAM,SAAS,OAAO,SAAS,KAAK;AACpC,WAAO;AAAA,MACL,IAAI,MAAM,UAAU,KAAK,QAAQ;AAAA,MACjC,IAAI,MAAM,UAAU,KAAK,OAAO;AAAA,IAClC;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,oBAAoB,MAAM;AAAA,IAC9B,CAAC,UAAiD;AAChD,UAAI,SAAU;AACd,YAAM,eAAe;AACrB,YAAM,UAAU,WAAW;AAC3B,UAAI,CAAC,QAAS;AACd,gBAAU,SAAS,kBAAkB,MAAM,SAAS;AACpD,iBAAW,UAAU;AACrB,mBAAa,UAAU,eAAe,KAAK;AAAA,IAC7C;AAAA,IACA,CAAC,UAAU,YAAY,cAAc;AAAA,EACvC;AAEA,QAAM,oBAAoB,MAAM;AAAA,IAC9B,CAAC,UAAiD;AAChD,UAAI,CAAC,WAAW,WAAW,SAAU;AACrC,YAAM,eAAe;AACrB,YAAM,UAAU,WAAW;AAC3B,YAAM,OAAO,aAAa;AAC1B,UAAI,CAAC,WAAW,CAAC,KAAM;AACvB,YAAM,QAAQ,eAAe,KAAK;AAClC,cAAQ,UAAU;AAClB,cAAQ,OAAO,KAAK,GAAG,KAAK,CAAC;AAC7B,cAAQ,OAAO,MAAM,GAAG,MAAM,CAAC;AAC/B,cAAQ,OAAO;AACf,mBAAa,UAAU;AACvB,oBAAc,UAAU;AAAA,IAC1B;AAAA,IACA,CAAC,UAAU,YAAY,cAAc;AAAA,EACvC;AAEA,QAAM,SAAS,MAAM,YAAY,MAAM;AACrC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ;AACb,QAAI,CAAC,cAAc,QAAS;AAC5B,aAAS,OAAO,UAAU,WAAW,CAAC;AAAA,EACxC,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,kBAAkB,MAAM;AAAA,IAC5B,CAAC,UAAiD;AAChD,UAAI,CAAC,WAAW,QAAS;AACzB,iBAAW,UAAU;AACrB,mBAAa,UAAU;AACvB,gBAAU,SAAS,sBAAsB,MAAM,SAAS;AACxD,aAAO;AAAA,IACT;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAEA,QAAM,QAAQ,MAAM,YAAY,MAAM;AACpC,UAAM,SAAS,UAAU;AACzB,UAAM,UAAU,QAAQ,WAAW,IAAI;AACvC,QAAI,UAAU,QAAS,SAAQ,UAAU,GAAG,GAAG,OAAO,OAAO,OAAO,MAAM;AAC1E,kBAAc,UAAU;AACxB,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,QAAQ,CAAC;AAEb,SACE,qBAAC,SAAI,WAAU,uBACb;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,KAAK;AAAA,QACL,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAK;AAAA,QACL,cAAY;AAAA,QACZ,WAAU;AAAA,QACV,OAAO,EAAE,aAAa,QAAQ,QAAQ,WAAW,gBAAgB,aAAa,aAAa,QAAQ;AAAA,QACnG,eAAe;AAAA,QACf,eAAe;AAAA,QACf,aAAa;AAAA,QACb,gBAAgB;AAAA;AAAA,IAClB;AAAA,IACA,oBAAC,SACC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,UAAU,YAAY,CAAC;AAAA,QACvB,SAAS;AAAA,QACT,WAAU;AAAA,QAET;AAAA;AAAA,IACH,GACF;AAAA,KACF;AAEJ;AAOA,eAAsB,oBAAoB,YAA4C;AACpF,QAAM,SAAS,WAAW,QAAQ;AAClC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,UAAU;AACjD,QAAM,SAAS,MAAM,OAAO,OAAO,WAAW,KAAK;AACnD,SAAO,MAAM,KAAK,IAAI,WAAW,MAAM,CAAC,EACrC,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;",
+  "names": []
+}

package/dist/modules/forms/runner/tamper-check.js

@@ -0,0 +1,85 @@
+import { evaluateFormLogic } from "../services/form-logic-evaluator.js";
+import { OM_ROOT_KEYWORDS } from "../schema/jsonschema-extensions.js";
+function checkSubmissionTamper(input) {
+  const sections = readSections(input.schema);
+  const pageSections = sections.filter((entry) => entry.kind === "page" || entry.kind === void 0);
+  const endingSections = sections.filter((entry) => entry.kind === "ending");
+  const endingKeys = new Set(endingSections.map((entry) => entry.key));
+  if (input.claimedEndingKey && !endingKeys.has(input.claimedEndingKey)) {
+    return { ok: false, reason: "unknown_ending", reachedEndingKey: null };
+  }
+  const state = evaluateFormLogic(input.schema, {
+    answers: input.answers,
+    hidden: input.hidden,
+    locale: input.locale
+  });
+  let reachedEnding = null;
+  const visitedPages = /* @__PURE__ */ new Set();
+  let cursorIndex = 0;
+  let safety = 0;
+  while (cursorIndex < pageSections.length) {
+    if (safety++ > pageSections.length + 1) break;
+    const currentPage = pageSections[cursorIndex];
+    if (visitedPages.has(currentPage.key)) {
+      cursorIndex += 1;
+      continue;
+    }
+    visitedPages.add(currentPage.key);
+    const target = state.nextTarget(currentPage.key);
+    if (target.type === "ending") {
+      reachedEnding = target.endingKey;
+      break;
+    }
+    if (target.type === "submit") {
+      break;
+    }
+    if (target.type === "page") {
+      const nextIndex = pageSections.findIndex((entry) => entry.key === target.pageKey);
+      if (nextIndex >= 0) {
+        cursorIndex = nextIndex;
+        continue;
+      }
+    }
+    cursorIndex += 1;
+  }
+  if (input.claimedEndingKey !== reachedEnding) {
+    return { ok: false, reason: "ending_mismatch", reachedEndingKey: reachedEnding };
+  }
+  return { ok: true, reachedEndingKey: reachedEnding };
+}
+function readSections(schema) {
+  const raw = schema[OM_ROOT_KEYWORDS.sections];
+  if (!Array.isArray(raw)) return [];
+  const result = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const candidate = entry;
+    if (typeof candidate.key !== "string") continue;
+    const kind = typeof candidate.kind === "string" ? candidate.kind : void 0;
+    result.push({ key: candidate.key, kind });
+  }
+  return result;
+}
+function pickHiddenFromUrl(schema, searchParams) {
+  const declarations = schema[OM_ROOT_KEYWORDS.hiddenFields];
+  if (!Array.isArray(declarations)) return {};
+  const result = {};
+  const getter = searchParams instanceof URLSearchParams ? (name) => searchParams.get(name) : (name) => searchParams[name] ?? null;
+  for (const entry of declarations) {
+    if (!entry || typeof entry !== "object") continue;
+    const candidate = entry;
+    if (typeof candidate.name !== "string") continue;
+    const raw = getter(candidate.name);
+    if (typeof raw === "string" && raw.length > 0) {
+      result[candidate.name] = raw;
+    } else if (typeof candidate.defaultValue === "string") {
+      result[candidate.name] = candidate.defaultValue;
+    }
+  }
+  return result;
+}
+export {
+  checkSubmissionTamper,
+  pickHiddenFromUrl
+};
+//# sourceMappingURL=tamper-check.js.map

package/dist/modules/forms/runner/tamper-check.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/runner/tamper-check.ts"],
+  "sourcesContent": ["/**\n * Runner tamper-resistance helpers (R-3 mitigation).\n *\n * The public submission endpoint re-runs the evaluator against the\n * `(answers, hidden)` payload posted by the client and asserts the claimed\n * `endingKey` is the one the evaluator actually reaches. If the respondent\n * tampered with the request (e.g. claiming the \"qualified\" ending while\n * sending answers that don't trigger it), this returns `false` and the\n * route rejects the submission with 422.\n *\n * Pure \u2014 no I/O, no DI. Suitable for unit testing.\n */\n\nimport { evaluateFormLogic } from '../services/form-logic-evaluator'\nimport { OM_ROOT_KEYWORDS } from '../schema/jsonschema-extensions'\n\nexport type TamperCheckInput = {\n  schema: Record<string, unknown>\n  answers: Record<string, unknown>\n  hidden: Record<string, unknown>\n  claimedEndingKey: string | null\n  locale: string\n}\n\nexport type TamperCheckResult = {\n  ok: boolean\n  reason?: string\n  reachedEndingKey?: string | null\n}\n\n/**\n * Validates that `claimedEndingKey` matches the ending the evaluator would\n * reach by walking from the first page through every jump rule.\n *\n * Empty/non-ending claim \u2192 the runner exited via \"Submit\" (no ending), which\n * is valid iff the evaluator never routes to an ending in any reachable\n * branch. (For \"no ending claimed\", we accept any non-ending outcome.)\n */\nexport function checkSubmissionTamper(input: TamperCheckInput): TamperCheckResult {\n  const sections = readSections(input.schema)\n  const pageSections = sections.filter((entry) => entry.kind === 'page' || entry.kind === undefined)\n  const endingSections = sections.filter((entry) => entry.kind === 'ending')\n  const endingKeys = new Set(endingSections.map((entry) => entry.key))\n  if (input.claimedEndingKey && !endingKeys.has(input.claimedEndingKey)) {\n    return { ok: false, reason: 'unknown_ending', reachedEndingKey: null }\n  }\n\n  const state = evaluateFormLogic(input.schema, {\n    answers: input.answers,\n    hidden: input.hidden,\n    locale: input.locale,\n  })\n\n  let reachedEnding: string | null = null\n  const visitedPages = new Set<string>()\n  let cursorIndex = 0\n  let safety = 0\n  while (cursorIndex < pageSections.length) {\n    if (safety++ > pageSections.length + 1) break\n    const currentPage = pageSections[cursorIndex]\n    if (visitedPages.has(currentPage.key)) {\n      cursorIndex += 1\n      continue\n    }\n    visitedPages.add(currentPage.key)\n    const target = state.nextTarget(currentPage.key)\n    if (target.type === 'ending') {\n      reachedEnding = target.endingKey\n      break\n    }\n    if (target.type === 'submit') {\n      break\n    }\n    if (target.type === 'page') {\n      const nextIndex = pageSections.findIndex((entry) => entry.key === target.pageKey)\n      if (nextIndex >= 0) {\n        cursorIndex = nextIndex\n        continue\n      }\n    }\n    cursorIndex += 1\n  }\n\n  if (input.claimedEndingKey !== reachedEnding) {\n    return { ok: false, reason: 'ending_mismatch', reachedEndingKey: reachedEnding }\n  }\n  return { ok: true, reachedEndingKey: reachedEnding }\n}\n\nfunction readSections(schema: Record<string, unknown>): Array<{ key: string; kind?: string }> {\n  const raw = schema[OM_ROOT_KEYWORDS.sections]\n  if (!Array.isArray(raw)) return []\n  const result: Array<{ key: string; kind?: string }> = []\n  for (const entry of raw) {\n    if (!entry || typeof entry !== 'object') continue\n    const candidate = entry as Record<string, unknown>\n    if (typeof candidate.key !== 'string') continue\n    const kind = typeof candidate.kind === 'string' ? candidate.kind : undefined\n    result.push({ key: candidate.key, kind })\n  }\n  return result\n}\n\n/**\n * Picks URL-derived hidden field values out of a `URLSearchParams`, matching\n * declared names from `x-om-hidden-fields`. Unknown query keys are ignored;\n * declared names absent from the URL fall back to their declared default.\n */\nexport function pickHiddenFromUrl(\n  schema: Record<string, unknown>,\n  searchParams: URLSearchParams | Record<string, string>,\n): Record<string, unknown> {\n  const declarations = schema[OM_ROOT_KEYWORDS.hiddenFields]\n  if (!Array.isArray(declarations)) return {}\n  const result: Record<string, unknown> = {}\n  const getter = searchParams instanceof URLSearchParams\n    ? (name: string) => searchParams.get(name)\n    : (name: string) => searchParams[name] ?? null\n  for (const entry of declarations) {\n    if (!entry || typeof entry !== 'object') continue\n    const candidate = entry as Record<string, unknown>\n    if (typeof candidate.name !== 'string') continue\n    const raw = getter(candidate.name)\n    if (typeof raw === 'string' && raw.length > 0) {\n      result[candidate.name] = raw\n    } else if (typeof candidate.defaultValue === 'string') {\n      result[candidate.name] = candidate.defaultValue\n    }\n  }\n  return result\n}\n"],
+  "mappings": "AAaA,SAAS,yBAAyB;AAClC,SAAS,wBAAwB;AAwB1B,SAAS,sBAAsB,OAA4C;AAChF,QAAM,WAAW,aAAa,MAAM,MAAM;AAC1C,QAAM,eAAe,SAAS,OAAO,CAAC,UAAU,MAAM,SAAS,UAAU,MAAM,SAAS,MAAS;AACjG,QAAM,iBAAiB,SAAS,OAAO,CAAC,UAAU,MAAM,SAAS,QAAQ;AACzE,QAAM,aAAa,IAAI,IAAI,eAAe,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;AACnE,MAAI,MAAM,oBAAoB,CAAC,WAAW,IAAI,MAAM,gBAAgB,GAAG;AACrE,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB,kBAAkB,KAAK;AAAA,EACvE;AAEA,QAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAAA,IAC5C,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,EAChB,CAAC;AAED,MAAI,gBAA+B;AACnC,QAAM,eAAe,oBAAI,IAAY;AACrC,MAAI,cAAc;AAClB,MAAI,SAAS;AACb,SAAO,cAAc,aAAa,QAAQ;AACxC,QAAI,WAAW,aAAa,SAAS,EAAG;AACxC,UAAM,cAAc,aAAa,WAAW;AAC5C,QAAI,aAAa,IAAI,YAAY,GAAG,GAAG;AACrC,qBAAe;AACf;AAAA,IACF;AACA,iBAAa,IAAI,YAAY,GAAG;AAChC,UAAM,SAAS,MAAM,WAAW,YAAY,GAAG;AAC/C,QAAI,OAAO,SAAS,UAAU;AAC5B,sBAAgB,OAAO;AACvB;AAAA,IACF;AACA,QAAI,OAAO,SAAS,UAAU;AAC5B;AAAA,IACF;AACA,QAAI,OAAO,SAAS,QAAQ;AAC1B,YAAM,YAAY,aAAa,UAAU,CAAC,UAAU,MAAM,QAAQ,OAAO,OAAO;AAChF,UAAI,aAAa,GAAG;AAClB,sBAAc;AACd;AAAA,MACF;AAAA,IACF;AACA,mBAAe;AAAA,EACjB;AAEA,MAAI,MAAM,qBAAqB,eAAe;AAC5C,WAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB,kBAAkB,cAAc;AAAA,EACjF;AACA,SAAO,EAAE,IAAI,MAAM,kBAAkB,cAAc;AACrD;AAEA,SAAS,aAAa,QAAwE;AAC5F,QAAM,MAAM,OAAO,iBAAiB,QAAQ;AAC5C,MAAI,CAAC,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AACjC,QAAM,SAAgD,CAAC;AACvD,aAAW,SAAS,KAAK;AACvB,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,UAAM,YAAY;AAClB,QAAI,OAAO,UAAU,QAAQ,SAAU;AACvC,UAAM,OAAO,OAAO,UAAU,SAAS,WAAW,UAAU,OAAO;AACnE,WAAO,KAAK,EAAE,KAAK,UAAU,KAAK,KAAK,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;AAOO,SAAS,kBACd,QACA,cACyB;AACzB,QAAM,eAAe,OAAO,iBAAiB,YAAY;AACzD,MAAI,CAAC,MAAM,QAAQ,YAAY,EAAG,QAAO,CAAC;AAC1C,QAAM,SAAkC,CAAC;AACzC,QAAM,SAAS,wBAAwB,kBACnC,CAAC,SAAiB,aAAa,IAAI,IAAI,IACvC,CAAC,SAAiB,aAAa,IAAI,KAAK;AAC5C,aAAW,SAAS,cAAc;AAChC,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,UAAM,YAAY;AAClB,QAAI,OAAO,UAAU,SAAS,SAAU;AACxC,UAAM,MAAM,OAAO,UAAU,IAAI;AACjC,QAAI,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC7C,aAAO,UAAU,IAAI,IAAI;AAAA,IAC3B,WAAW,OAAO,UAAU,iBAAiB,UAAU;AACrD,aAAO,UAAU,IAAI,IAAI,UAAU;AAAA,IACrC;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/schema/address-countries.js

@@ -0,0 +1,43 @@
+const COUNTRY_OPTIONS = [
+  { code: "US", name: "United States" },
+  { code: "GB", name: "United Kingdom" },
+  { code: "DE", name: "Germany" },
+  { code: "FR", name: "France" },
+  { code: "ES", name: "Spain" },
+  { code: "IT", name: "Italy" },
+  { code: "PL", name: "Poland" },
+  { code: "NL", name: "Netherlands" },
+  { code: "BE", name: "Belgium" },
+  { code: "SE", name: "Sweden" },
+  { code: "NO", name: "Norway" },
+  { code: "DK", name: "Denmark" },
+  { code: "FI", name: "Finland" },
+  { code: "IE", name: "Ireland" },
+  { code: "PT", name: "Portugal" },
+  { code: "AT", name: "Austria" },
+  { code: "CH", name: "Switzerland" },
+  { code: "CA", name: "Canada" },
+  { code: "AU", name: "Australia" },
+  { code: "NZ", name: "New Zealand" },
+  { code: "JP", name: "Japan" },
+  { code: "IN", name: "India" },
+  { code: "BR", name: "Brazil" },
+  { code: "MX", name: "Mexico" },
+  { code: "ZA", name: "South Africa" }
+];
+const COUNTRY_NAME_BY_CODE = (() => {
+  const map = {};
+  for (const option of COUNTRY_OPTIONS) {
+    map[option.code] = option.name;
+  }
+  return map;
+})();
+function resolveCountryName(code) {
+  if (!code) return "";
+  return COUNTRY_NAME_BY_CODE[code] ?? code;
+}
+export {
+  COUNTRY_OPTIONS,
+  resolveCountryName
+};
+//# sourceMappingURL=address-countries.js.map

package/dist/modules/forms/schema/address-countries.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/schema/address-countries.ts"],
+  "sourcesContent": ["/**\n * Curated ISO 3166-1 alpha-2 country catalog for the v1 `address` field type\n * (Phase C of `.ai/specs/2026-05-14-forms-tier-2-question-palette.md`).\n *\n * The list is intentionally small (~25 commonly-targeted countries for the\n * pilot vertical + early B2B deployments). Authors who need a longer catalog\n * can override the country select per-form via Phase F+ extensions. The codes\n * follow ISO 3166-1 alpha-2 per \u00A7 Implementation Plan C.\n */\nexport type CountryOption = {\n  /** ISO 3166-1 alpha-2 code (uppercase). */\n  code: string\n  /** English display name. Translated labels land with the i18n bundle. */\n  name: string\n}\n\nexport const COUNTRY_OPTIONS: ReadonlyArray<CountryOption> = [\n  { code: 'US', name: 'United States' },\n  { code: 'GB', name: 'United Kingdom' },\n  { code: 'DE', name: 'Germany' },\n  { code: 'FR', name: 'France' },\n  { code: 'ES', name: 'Spain' },\n  { code: 'IT', name: 'Italy' },\n  { code: 'PL', name: 'Poland' },\n  { code: 'NL', name: 'Netherlands' },\n  { code: 'BE', name: 'Belgium' },\n  { code: 'SE', name: 'Sweden' },\n  { code: 'NO', name: 'Norway' },\n  { code: 'DK', name: 'Denmark' },\n  { code: 'FI', name: 'Finland' },\n  { code: 'IE', name: 'Ireland' },\n  { code: 'PT', name: 'Portugal' },\n  { code: 'AT', name: 'Austria' },\n  { code: 'CH', name: 'Switzerland' },\n  { code: 'CA', name: 'Canada' },\n  { code: 'AU', name: 'Australia' },\n  { code: 'NZ', name: 'New Zealand' },\n  { code: 'JP', name: 'Japan' },\n  { code: 'IN', name: 'India' },\n  { code: 'BR', name: 'Brazil' },\n  { code: 'MX', name: 'Mexico' },\n  { code: 'ZA', name: 'South Africa' },\n]\n\nconst COUNTRY_NAME_BY_CODE: Record<string, string> = (() => {\n  const map: Record<string, string> = {}\n  for (const option of COUNTRY_OPTIONS) {\n    map[option.code] = option.name\n  }\n  return map\n})()\n\n/**\n * Returns the English country name for the provided alpha-2 code, or the\n * code itself when the code is not in the curated catalog.\n */\nexport function resolveCountryName(code: string): string {\n  if (!code) return ''\n  return COUNTRY_NAME_BY_CODE[code] ?? code\n}\n"],
+  "mappings": "AAgBO,MAAM,kBAAgD;AAAA,EAC3D,EAAE,MAAM,MAAM,MAAM,gBAAgB;AAAA,EACpC,EAAE,MAAM,MAAM,MAAM,iBAAiB;AAAA,EACrC,EAAE,MAAM,MAAM,MAAM,UAAU;AAAA,EAC9B,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,QAAQ;AAAA,EAC5B,EAAE,MAAM,MAAM,MAAM,QAAQ;AAAA,EAC5B,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,cAAc;AAAA,EAClC,EAAE,MAAM,MAAM,MAAM,UAAU;AAAA,EAC9B,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,UAAU;AAAA,EAC9B,EAAE,MAAM,MAAM,MAAM,UAAU;AAAA,EAC9B,EAAE,MAAM,MAAM,MAAM,UAAU;AAAA,EAC9B,EAAE,MAAM,MAAM,MAAM,WAAW;AAAA,EAC/B,EAAE,MAAM,MAAM,MAAM,UAAU;AAAA,EAC9B,EAAE,MAAM,MAAM,MAAM,cAAc;AAAA,EAClC,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,YAAY;AAAA,EAChC,EAAE,MAAM,MAAM,MAAM,cAAc;AAAA,EAClC,EAAE,MAAM,MAAM,MAAM,QAAQ;AAAA,EAC5B,EAAE,MAAM,MAAM,MAAM,QAAQ;AAAA,EAC5B,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,SAAS;AAAA,EAC7B,EAAE,MAAM,MAAM,MAAM,eAAe;AACrC;AAEA,MAAM,wBAAgD,MAAM;AAC1D,QAAM,MAA8B,CAAC;AACrC,aAAW,UAAU,iBAAiB;AACpC,QAAI,OAAO,IAAI,IAAI,OAAO;AAAA,EAC5B;AACA,SAAO;AACT,GAAG;AAMI,SAAS,mBAAmB,MAAsB;AACvD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,qBAAqB,IAAI,KAAK;AACvC;",
+  "names": []
+}

package/dist/modules/forms/schema/field-type-patterns.js

@@ -0,0 +1,15 @@
+const FIELD_TYPE_DEFAULT_PATTERNS = {
+  email: "^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$",
+  phone: "^\\+?[0-9\\s\\-().]{6,32}$",
+  website: "^https?://[^\\s]+$"
+};
+const FIELD_TYPE_PATTERN_LABEL_KEY = {
+  email: "forms.studio.validation.pattern.standard.email",
+  phone: "forms.studio.validation.pattern.standard.phone",
+  website: "forms.studio.validation.pattern.standard.website"
+};
+export {
+  FIELD_TYPE_DEFAULT_PATTERNS,
+  FIELD_TYPE_PATTERN_LABEL_KEY
+};
+//# sourceMappingURL=field-type-patterns.js.map

package/dist/modules/forms/schema/field-type-patterns.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/schema/field-type-patterns.ts"],
+  "sourcesContent": ["/**\n * Default regex patterns for the format-typed field registrations (Phase B\n * of `.ai/specs/2026-05-14-forms-tier-2-question-palette.md`).\n *\n * Phase A registers the catalogue so the studio's pattern editor can offer a\n * \"Standard format\" chip even on plain `text` / `textarea` fields. Phases B\n * later register the `email` / `phone` / `website` field types whose\n * descriptors seed the pattern at read time.\n */\n\nexport const FIELD_TYPE_DEFAULT_PATTERNS: Record<string, string> = {\n  email: '^[^\\\\s@]+@[^\\\\s@]+\\\\.[^\\\\s@]+$',\n  phone: '^\\\\+?[0-9\\\\s\\\\-().]{6,32}$',\n  website: '^https?://[^\\\\s]+$',\n}\n\nexport const FIELD_TYPE_PATTERN_LABEL_KEY: Record<string, string> = {\n  email: 'forms.studio.validation.pattern.standard.email',\n  phone: 'forms.studio.validation.pattern.standard.phone',\n  website: 'forms.studio.validation.pattern.standard.website',\n}\n"],
+  "mappings": "AAUO,MAAM,8BAAsD;AAAA,EACjE,OAAO;AAAA,EACP,OAAO;AAAA,EACP,SAAS;AACX;AAEO,MAAM,+BAAuD;AAAA,EAClE,OAAO;AAAA,EACP,OAAO;AAAA,EACP,SAAS;AACX;",
+  "names": []
+}

package/dist/modules/forms/schema/field-type-registry-advanced.js

@@ -0,0 +1,32 @@
+import {
+  defaultFieldTypeRegistry
+} from "./field-type-registry.js";
+const DEMO_RATING_STARS_TYPE_KEY = "demo.rating_stars";
+const DEMO_RATING_STARS_DEFAULT_MAX = 5;
+const demoRatingStarsSpec = {
+  validator: (value, fieldNode) => {
+    if (typeof value !== "number" || !Number.isInteger(value)) return "Expected an integer star count.";
+    const min = typeof fieldNode["x-om-min"] === "number" ? fieldNode["x-om-min"] : 1;
+    const max = typeof fieldNode["x-om-max"] === "number" ? fieldNode["x-om-max"] : DEMO_RATING_STARS_DEFAULT_MAX;
+    if (value < min || value > max) {
+      return `Rating must be between ${min} and ${max} (inclusive).`;
+    }
+    return true;
+  },
+  renderer: null,
+  defaultUiSchema: { widget: "stars" },
+  exportAdapter: (value) => typeof value === "number" && Number.isInteger(value) ? `${value} \u2605` : ""
+};
+function registerVerticalDemoTypes(registry = defaultFieldTypeRegistry, ratingStarsRenderer = null) {
+  registry.register(DEMO_RATING_STARS_TYPE_KEY, demoRatingStarsSpec);
+  if (ratingStarsRenderer) {
+    registry.setRenderer(DEMO_RATING_STARS_TYPE_KEY, ratingStarsRenderer);
+  }
+}
+export {
+  DEMO_RATING_STARS_DEFAULT_MAX,
+  DEMO_RATING_STARS_TYPE_KEY,
+  demoRatingStarsSpec,
+  registerVerticalDemoTypes
+};
+//# sourceMappingURL=field-type-registry-advanced.js.map

package/dist/modules/forms/schema/field-type-registry-advanced.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/schema/field-type-registry-advanced.ts"],
+  "sourcesContent": ["import type { ComponentType } from 'react'\nimport {\n  FieldTypeRegistry,\n  defaultFieldTypeRegistry,\n  type FieldTypeSpec,\n} from './field-type-registry'\n\n/**\n * Phase 3 \u2014 vertical-extension demo.\n *\n * The Forms module ships ONE demo vertical type \u2014 `demo.rating_stars` \u2014 to\n * exercise the registry's `register(...)` extension surface and to anchor\n * the regression test that an unregistered type fails compile (R-3-1\n * regression test). Real vertical types (`dental.tooth_chart`, etc.) live\n * in consumer modules (e.g. `packages/<vertical>`); they follow this same\n * pattern.\n *\n * The pattern:\n *   1. Define a `FieldTypeSpec` with `validator` + `defaultUiSchema` +\n *      `exportAdapter` (renderer can be `null` and attached later via\n *      `setRenderer`).\n *   2. Register it on the singleton or a private registry at module\n *      bootstrap: `registry.register('module.type_key', spec)`.\n *   3. The compiler will recognize it and forms can reference it via\n *      `x-om-type: \"module.type_key\"`.\n */\n\nexport const DEMO_RATING_STARS_TYPE_KEY = 'demo.rating_stars' as const\nexport const DEMO_RATING_STARS_DEFAULT_MAX = 5\n\nexport const demoRatingStarsSpec: FieldTypeSpec = {\n  validator: (value, fieldNode) => {\n    if (typeof value !== 'number' || !Number.isInteger(value)) return 'Expected an integer star count.'\n    const min = typeof fieldNode['x-om-min'] === 'number' ? (fieldNode['x-om-min'] as number) : 1\n    const max =\n      typeof fieldNode['x-om-max'] === 'number'\n        ? (fieldNode['x-om-max'] as number)\n        : DEMO_RATING_STARS_DEFAULT_MAX\n    if (value < min || value > max) {\n      return `Rating must be between ${min} and ${max} (inclusive).`\n    }\n    return true\n  },\n  renderer: null,\n  defaultUiSchema: { widget: 'stars' },\n  exportAdapter: (value) =>\n    typeof value === 'number' && Number.isInteger(value) ? `${value} \u2605` : '',\n}\n\nexport function registerVerticalDemoTypes(\n  registry: FieldTypeRegistry = defaultFieldTypeRegistry,\n  ratingStarsRenderer: ComponentType<unknown> | null = null,\n): void {\n  registry.register(DEMO_RATING_STARS_TYPE_KEY, demoRatingStarsSpec)\n  if (ratingStarsRenderer) {\n    registry.setRenderer(DEMO_RATING_STARS_TYPE_KEY, ratingStarsRenderer)\n  }\n}\n"],
+  "mappings": "AACA;AAAA,EAEE;AAAA,OAEK;AAsBA,MAAM,6BAA6B;AACnC,MAAM,gCAAgC;AAEtC,MAAM,sBAAqC;AAAA,EAChD,WAAW,CAAC,OAAO,cAAc;AAC/B,QAAI,OAAO,UAAU,YAAY,CAAC,OAAO,UAAU,KAAK,EAAG,QAAO;AAClE,UAAM,MAAM,OAAO,UAAU,UAAU,MAAM,WAAY,UAAU,UAAU,IAAe;AAC5F,UAAM,MACJ,OAAO,UAAU,UAAU,MAAM,WAC5B,UAAU,UAAU,IACrB;AACN,QAAI,QAAQ,OAAO,QAAQ,KAAK;AAC9B,aAAO,0BAA0B,GAAG,QAAQ,GAAG;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAAA,EACA,UAAU;AAAA,EACV,iBAAiB,EAAE,QAAQ,QAAQ;AAAA,EACnC,eAAe,CAAC,UACd,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,IAAI,GAAG,KAAK,YAAO;AAC1E;AAEO,SAAS,0BACd,WAA8B,0BAC9B,sBAAqD,MAC/C;AACN,WAAS,SAAS,4BAA4B,mBAAmB;AACjE,MAAI,qBAAqB;AACvB,aAAS,YAAY,4BAA4B,mBAAmB;AAAA,EACtE;AACF;",
+  "names": []
+}