@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/services/distribution-service.js

@@ -0,0 +1,366 @@
+var _a, _b;
+import { LockMode } from "@mikro-orm/core";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import {
+  Form,
+  FormDistribution,
+  FormInvitation
+} from "../data/entities.js";
+import { buildFrameAncestorsCsp, isEmbedEnabled, readEmbedSettings } from "../lib/embed-frame-policy.js";
+import {
+  getAccessTokenTtlSeconds,
+  hashInvitationToken,
+  signAccessToken
+} from "./distribution-token.js";
+const DISTRIBUTION_SERVICE_ERROR_MARKER = /* @__PURE__ */ Symbol.for("@open-mercato/forms/DistributionServiceError");
+class DistributionServiceError extends (_b = Error, _a = DISTRIBUTION_SERVICE_ERROR_MARKER, _b) {
+  constructor(code, message, httpStatus, details) {
+    super(message);
+    this[_a] = true;
+    this.name = "DistributionServiceError";
+    this.code = code;
+    this.httpStatus = httpStatus;
+    this.details = details;
+  }
+}
+const noopLogger = {
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+const INVITATION_TERMINAL_STATUSES = /* @__PURE__ */ new Set(["submitted", "revoked", "expired"]);
+class DistributionService {
+  constructor(options) {
+    this.emFactory = options.emFactory;
+    this.submissionService = options.submissionService;
+    this.emitEvent = options.emitEvent;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.logger = options.logger ?? noopLogger;
+  }
+  // --------------------------------------------------------------------------
+  // Embed eligibility (spec D5 / R-RS-2)
+  // --------------------------------------------------------------------------
+  /**
+   * True only when a distribution may be framed on a third-party website:
+   * an active OPEN distribution that does not require customer auth and has
+   * opted in via a valid, non-empty `settings.embed` allowlist. There is no
+   * session inside a third-party iframe, so personal / auth-required / disabled
+   * distributions are never embeddable.
+   */
+  isEmbeddable(distribution) {
+    if (distribution.mode !== "open") return false;
+    if (distribution.status !== "active") return false;
+    if (distribution.requireCustomerAuth) return false;
+    return isEmbedEnabled(readEmbedSettings(distribution.settings));
+  }
+  /**
+   * Resolves the `frame-ancestors` CSP directive for the `/embed/:slug` host
+   * page WITHOUT enforcing the runtime availability window — framing is
+   * permitted for any config-embeddable distribution (open + active + !auth +
+   * opted-in allowlist) so the iframe can still load and render a graceful
+   * "unavailable" state for a capped / out-of-window form. Fails closed
+   * (`frame-ancestors 'none'`) for unknown or non-embeddable slugs.
+   */
+  async getEmbedPolicyBySlug(slug) {
+    const em = this.emFactory();
+    const distribution = await em.findOne(FormDistribution, {
+      publicSlug: slug,
+      deletedAt: null
+    });
+    if (!distribution) return { frameAncestors: "frame-ancestors 'none'", embeddable: false };
+    const embeddable = this.isEmbeddable(distribution);
+    const frameAncestors = embeddable ? buildFrameAncestorsCsp(readEmbedSettings(distribution.settings)) : "frame-ancestors 'none'";
+    return { frameAncestors, embeddable };
+  }
+  // --------------------------------------------------------------------------
+  // Resolve — open link (global slug lookup)
+  // --------------------------------------------------------------------------
+  async resolveBySlug(slug) {
+    const em = this.emFactory();
+    const distribution = await em.findOne(FormDistribution, {
+      publicSlug: slug,
+      deletedAt: null
+    });
+    if (!distribution) {
+      throw new DistributionServiceError("NOT_FOUND", "Distribution not found.", 404);
+    }
+    this.assertDistributionAvailable(distribution);
+    return { distribution };
+  }
+  // --------------------------------------------------------------------------
+  // Resolve — personal invitation (global token-hash lookup)
+  // --------------------------------------------------------------------------
+  async resolveByToken(rawToken) {
+    const em = this.emFactory();
+    const tokenHash = hashInvitationToken(rawToken);
+    const located = await em.findOne(FormInvitation, {
+      tokenHash,
+      deletedAt: null
+    });
+    if (!located) {
+      throw new DistributionServiceError("NOT_FOUND", "Invitation not found.", 404);
+    }
+    const invitation = await findOneWithDecryption(
+      em,
+      FormInvitation,
+      { id: located.id, organizationId: located.organizationId, tenantId: located.tenantId, deletedAt: null },
+      void 0,
+      { organizationId: located.organizationId, tenantId: located.tenantId }
+    );
+    if (!invitation) {
+      throw new DistributionServiceError("NOT_FOUND", "Invitation not found.", 404);
+    }
+    this.assertInvitationUsable(invitation);
+    const distribution = await em.findOne(FormDistribution, {
+      id: invitation.distributionId,
+      organizationId: invitation.organizationId,
+      tenantId: invitation.tenantId,
+      deletedAt: null
+    });
+    if (!distribution) {
+      throw new DistributionServiceError("NOT_FOUND", "Distribution not found.", 404);
+    }
+    this.assertDistributionAvailable(distribution);
+    if (invitation.status === "pending" || invitation.status === "sent") {
+      invitation.status = "opened";
+      invitation.openedAt = this.now();
+      await em.flush();
+      await this.safeEmit("forms.invitation.opened", { invitationId: invitation.id });
+    }
+    return { invitation, distribution };
+  }
+  // --------------------------------------------------------------------------
+  // Form context — resolve the served form version for a distribution
+  // --------------------------------------------------------------------------
+  async getFormContext(args) {
+    const { distribution } = args;
+    const em = this.emFactory();
+    const form = await em.findOne(Form, {
+      id: distribution.formId,
+      organizationId: distribution.organizationId,
+      tenantId: distribution.tenantId,
+      deletedAt: null
+    });
+    if (!form) {
+      throw new DistributionServiceError("NOT_FOUND", "Form not found.", 404);
+    }
+    if (distribution.pinnedVersionId) {
+      return this.submissionService.getPinnedFormVersionByKey({
+        organizationId: distribution.organizationId,
+        tenantId: distribution.tenantId,
+        formKey: form.key,
+        pinnedVersionId: distribution.pinnedVersionId
+      });
+    }
+    return this.submissionService.getActiveFormVersionByKey({
+      organizationId: distribution.organizationId,
+      tenantId: distribution.tenantId,
+      formKey: form.key
+    });
+  }
+  // --------------------------------------------------------------------------
+  // Begin anonymous — mint/link invitation, start submission, sign token
+  // --------------------------------------------------------------------------
+  async beginAnonymous(args) {
+    const { distribution } = args;
+    this.assertDistributionAvailable(distribution);
+    const em = this.emFactory();
+    const form = await em.findOne(Form, {
+      id: distribution.formId,
+      organizationId: distribution.organizationId,
+      tenantId: distribution.tenantId,
+      deletedAt: null
+    });
+    if (!form) {
+      throw new DistributionServiceError("NOT_FOUND", "Form not found.", 404);
+    }
+    let invitation;
+    if (args.invitation) {
+      invitation = args.invitation;
+      this.assertInvitationUsable(invitation);
+      if (invitation.submissionId) {
+        return this.resumeExisting(distribution, form.key, invitation);
+      }
+    } else {
+      const now2 = this.now();
+      invitation = em.create(FormInvitation, {
+        distributionId: distribution.id,
+        organizationId: distribution.organizationId,
+        tenantId: distribution.tenantId,
+        recipientEmail: null,
+        recipientName: null,
+        recipientRef: null,
+        role: null,
+        tokenHash: null,
+        status: "started",
+        submissionId: null,
+        locale: args.locale ?? distribution.defaultLocale ?? null,
+        sendCount: 0,
+        createdBy: null,
+        createdAt: now2,
+        updatedAt: now2
+      });
+      em.persist(invitation);
+      await em.flush();
+    }
+    const view = await this.submissionService.start({
+      organizationId: distribution.organizationId,
+      tenantId: distribution.tenantId,
+      formKey: form.key,
+      subjectType: "forms_invitation",
+      subjectId: invitation.id,
+      startedBy: invitation.id,
+      initialRole: invitation.role ?? null,
+      pinnedVersionId: distribution.pinnedVersionId ?? void 0
+    });
+    const now = this.now();
+    invitation.submissionId = view.submission.id;
+    invitation.status = "started";
+    invitation.startedAt = now;
+    if (!invitation.locale) invitation.locale = args.locale ?? distribution.defaultLocale ?? null;
+    await em.flush();
+    const role = view.actors[0]?.role ?? invitation.role ?? null;
+    return this.issueAccess(view, invitation, role);
+  }
+  // --------------------------------------------------------------------------
+  // Reserve a response slot (atomic cap enforcement — R-2d-5)
+  // --------------------------------------------------------------------------
+  async reserveResponseSlot(args) {
+    const em = this.emFactory();
+    await em.transactional(async (trx) => {
+      const distribution = await trx.findOne(
+        FormDistribution,
+        {
+          id: args.distributionId,
+          organizationId: args.organizationId,
+          tenantId: args.tenantId,
+          deletedAt: null
+        },
+        { lockMode: LockMode.PESSIMISTIC_WRITE }
+      );
+      if (!distribution) {
+        throw new DistributionServiceError("NOT_FOUND", "Distribution not found.", 404);
+      }
+      this.assertDistributionAvailable(distribution);
+      distribution.responseCount += 1;
+      await trx.flush();
+    });
+  }
+  // --------------------------------------------------------------------------
+  // Mark invitation submitted
+  // --------------------------------------------------------------------------
+  async markInvitationSubmitted(args) {
+    const em = this.emFactory();
+    const invitation = await em.findOne(FormInvitation, {
+      id: args.invitationId,
+      organizationId: args.organizationId,
+      tenantId: args.tenantId,
+      deletedAt: null
+    });
+    if (!invitation) {
+      throw new DistributionServiceError("NOT_FOUND", "Invitation not found.", 404);
+    }
+    invitation.status = "submitted";
+    invitation.submittedAt = this.now();
+    await em.flush();
+    await this.safeEmit("forms.invitation.submitted", {
+      invitationId: invitation.id,
+      submissionId: args.submissionId
+    });
+  }
+  // --------------------------------------------------------------------------
+  // Slide the access-token expiry (used by the autosave route)
+  // --------------------------------------------------------------------------
+  refreshAccessToken(submissionId, invitationId, role) {
+    return signAccessToken({
+      submissionId,
+      invitationId,
+      role,
+      expiresAtSeconds: this.expiresAtSeconds()
+    });
+  }
+  // --------------------------------------------------------------------------
+  // Helpers
+  // --------------------------------------------------------------------------
+  async resumeExisting(distribution, formKey, invitation) {
+    const view = await this.submissionService.getCurrent({
+      organizationId: invitation.organizationId,
+      tenantId: invitation.tenantId,
+      submissionId: invitation.submissionId,
+      viewerRole: invitation.role ?? null,
+      viewerUserId: invitation.id
+    });
+    void distribution;
+    void formKey;
+    const role = view.actors.find((actor) => actor.userId === invitation.id)?.role ?? invitation.role ?? view.actors[0]?.role ?? null;
+    return this.issueAccess(view, invitation, role);
+  }
+  issueAccess(view, invitation, role) {
+    const expiresAtSeconds = this.expiresAtSeconds();
+    const accessToken = signAccessToken({
+      submissionId: view.submission.id,
+      invitationId: invitation.id,
+      role,
+      expiresAtSeconds
+    });
+    return {
+      view,
+      invitation,
+      accessToken,
+      expiresAt: new Date(expiresAtSeconds * 1e3).toISOString()
+    };
+  }
+  expiresAtSeconds() {
+    return Math.floor(this.now().getTime() / 1e3) + getAccessTokenTtlSeconds();
+  }
+  assertDistributionAvailable(distribution) {
+    if (distribution.status !== "active") {
+      throw new DistributionServiceError("GONE", "Distribution is not active.", 410, {
+        status: distribution.status
+      });
+    }
+    const now = this.now().getTime();
+    if (distribution.opensAt && now < distribution.opensAt.getTime()) {
+      throw new DistributionServiceError("GONE", "Distribution is not open yet.", 410);
+    }
+    if (distribution.closesAt && now > distribution.closesAt.getTime()) {
+      throw new DistributionServiceError("GONE", "Distribution is closed.", 410);
+    }
+    if (distribution.maxResponses != null && distribution.responseCount >= distribution.maxResponses) {
+      throw new DistributionServiceError("GONE", "Distribution response cap reached.", 410);
+    }
+  }
+  assertInvitationUsable(invitation) {
+    if (INVITATION_TERMINAL_STATUSES.has(invitation.status)) {
+      throw new DistributionServiceError("GONE", `Invitation is ${invitation.status}.`, 410, {
+        status: invitation.status
+      });
+    }
+    if (invitation.expiresAt && this.now().getTime() > invitation.expiresAt.getTime()) {
+      throw new DistributionServiceError("GONE", "Invitation is expired.", 410);
+    }
+  }
+  async safeEmit(eventId, payload) {
+    try {
+      await this.emitEvent(eventId, payload);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown emit error";
+      this.logger.warn(
+        { event: "forms.distribution.event_emit_failed", eventId, message },
+        "forms distribution event emission failed"
+      );
+    }
+  }
+}
+function isDistributionServiceError(error) {
+  return typeof error === "object" && error !== null && DISTRIBUTION_SERVICE_ERROR_MARKER in error;
+}
+export {
+  DistributionService,
+  DistributionServiceError,
+  isDistributionServiceError
+};
+//# sourceMappingURL=distribution-service.js.map

package/dist/modules/forms/services/distribution-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/distribution-service.ts"],
+  "sourcesContent": ["/**\n * Forms DistributionService \u2014 phase 2d.\n *\n * Orchestrates the distribution / invitation layer that puts a published form\n * in front of an unauthenticated participant and bootstraps an anonymous\n * submission by delegating to the unchanged `SubmissionService`.\n *\n * Invariants:\n *  - Every query is tenant-scoped (`organization_id` + `tenant_id`) EXCEPT the\n *    two deliberately-global lookups \u2014 by random `public_slug` and by\n *    `token_hash` \u2014 both high-entropy and globally unique in practice. After a\n *    global lookup the org/tenant scope is taken from the found row and used\n *    for every subsequent query.\n *  - Recipient PII (`recipient_email` / `recipient_name`) is encrypted via the\n *    GLOBAL pipeline; reads that need the plaintext use `findOneWithDecryption`.\n *  - The submission access token never carries org/tenant \u2014 those are\n *    re-derived from the persisted submission downstream (see runtime-principal).\n */\n\nimport { LockMode } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  Form,\n  FormDistribution,\n  FormInvitation,\n  FormVersion,\n} from '../data/entities'\nimport type { CompiledFormVersion } from './form-version-compiler'\nimport type { SubmissionService, SubmissionViewModel } from './submission-service'\nimport type { StructuredLogger } from '../lib/log-redaction'\nimport { buildFrameAncestorsCsp, isEmbedEnabled, readEmbedSettings } from '../lib/embed-frame-policy'\nimport { formsEventPayloadSchemas } from '../events-payloads'\nimport {\n  getAccessTokenTtlSeconds,\n  hashInvitationToken,\n  signAccessToken,\n} from './distribution-token'\n\nexport type DistributionServiceErrorCode =\n  | 'NOT_FOUND'\n  | 'GONE'\n  | 'INVALID_STATUS'\n\n/**\n * `Symbol.for` so the brand survives module duplication across bundle\n * boundaries. `instanceof` does NOT: Next can load this module in more than\n * one chunk, and once a second copy of the class exists an error thrown\n * through one copy fails `instanceof` against the other \u2014 silently\n * downgrading a mapped domain error to a 500. Mirrors `CrudHttpError`.\n */\nconst DISTRIBUTION_SERVICE_ERROR_MARKER = Symbol.for('@open-mercato/forms/DistributionServiceError')\n\nexport class DistributionServiceError extends Error {\n  readonly [DISTRIBUTION_SERVICE_ERROR_MARKER] = true\n  readonly code: DistributionServiceErrorCode\n  readonly httpStatus: number\n  readonly details?: Record<string, unknown>\n\n  constructor(\n    code: DistributionServiceErrorCode,\n    message: string,\n    httpStatus: number,\n    details?: Record<string, unknown>,\n  ) {\n    super(message)\n    this.name = 'DistributionServiceError'\n    this.code = code\n    this.httpStatus = httpStatus\n    this.details = details\n  }\n}\n\ntype DistributionEvents = {\n  'forms.invitation.opened': z.infer<typeof formsEventPayloadSchemas['forms.invitation.opened']>\n  'forms.invitation.submitted': z.infer<typeof formsEventPayloadSchemas['forms.invitation.submitted']>\n}\n\nexport type DistributionServiceOptions = {\n  emFactory: () => EntityManager\n  submissionService: SubmissionService\n  /** Pluggable, schema-validated event emitter \u2014 wired in di.ts. */\n  emitEvent: <K extends keyof DistributionEvents>(eventId: K, payload: DistributionEvents[K]) => Promise<void> | void\n  now?: () => Date\n  logger?: StructuredLogger\n}\n\nconst noopLogger: StructuredLogger = {\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n}\n\nconst INVITATION_TERMINAL_STATUSES: ReadonlySet<string> = new Set(['submitted', 'revoked', 'expired'])\n\nexport type BeginAnonymousArgs = {\n  distribution: FormDistribution\n  invitation?: FormInvitation\n  locale?: string | null\n}\n\nexport type BeginAnonymousResult = {\n  view: SubmissionViewModel\n  invitation: FormInvitation\n  accessToken: string\n  expiresAt: string\n}\n\nexport type FormContextResult = {\n  form: Form\n  formVersion: FormVersion\n  compiled: CompiledFormVersion\n}\n\nexport class DistributionService {\n  private readonly emFactory: () => EntityManager\n  private readonly submissionService: SubmissionService\n  private readonly emitEvent: DistributionServiceOptions['emitEvent']\n  private readonly now: () => Date\n  private readonly logger: StructuredLogger\n\n  constructor(options: DistributionServiceOptions) {\n    this.emFactory = options.emFactory\n    this.submissionService = options.submissionService\n    this.emitEvent = options.emitEvent\n    this.now = options.now ?? (() => new Date())\n    this.logger = options.logger ?? noopLogger\n  }\n\n  // --------------------------------------------------------------------------\n  // Embed eligibility (spec D5 / R-RS-2)\n  // --------------------------------------------------------------------------\n\n  /**\n   * True only when a distribution may be framed on a third-party website:\n   * an active OPEN distribution that does not require customer auth and has\n   * opted in via a valid, non-empty `settings.embed` allowlist. There is no\n   * session inside a third-party iframe, so personal / auth-required / disabled\n   * distributions are never embeddable.\n   */\n  isEmbeddable(distribution: FormDistribution): boolean {\n    if (distribution.mode !== 'open') return false\n    if (distribution.status !== 'active') return false\n    if (distribution.requireCustomerAuth) return false\n    return isEmbedEnabled(readEmbedSettings(distribution.settings))\n  }\n\n  /**\n   * Resolves the `frame-ancestors` CSP directive for the `/embed/:slug` host\n   * page WITHOUT enforcing the runtime availability window \u2014 framing is\n   * permitted for any config-embeddable distribution (open + active + !auth +\n   * opted-in allowlist) so the iframe can still load and render a graceful\n   * \"unavailable\" state for a capped / out-of-window form. Fails closed\n   * (`frame-ancestors 'none'`) for unknown or non-embeddable slugs.\n   */\n  async getEmbedPolicyBySlug(\n    slug: string,\n  ): Promise<{ frameAncestors: string; embeddable: boolean }> {\n    const em = this.emFactory()\n    const distribution = await em.findOne(FormDistribution, {\n      publicSlug: slug,\n      deletedAt: null,\n    })\n    if (!distribution) return { frameAncestors: \"frame-ancestors 'none'\", embeddable: false }\n    const embeddable = this.isEmbeddable(distribution)\n    const frameAncestors = embeddable\n      ? buildFrameAncestorsCsp(readEmbedSettings(distribution.settings))\n      : \"frame-ancestors 'none'\"\n    return { frameAncestors, embeddable }\n  }\n\n  // --------------------------------------------------------------------------\n  // Resolve \u2014 open link (global slug lookup)\n  // --------------------------------------------------------------------------\n\n  async resolveBySlug(slug: string): Promise<{ distribution: FormDistribution }> {\n    const em = this.emFactory()\n    const distribution = await em.findOne(FormDistribution, {\n      publicSlug: slug,\n      deletedAt: null,\n    })\n    if (!distribution) {\n      throw new DistributionServiceError('NOT_FOUND', 'Distribution not found.', 404)\n    }\n    this.assertDistributionAvailable(distribution)\n    return { distribution }\n  }\n\n  // --------------------------------------------------------------------------\n  // Resolve \u2014 personal invitation (global token-hash lookup)\n  // --------------------------------------------------------------------------\n\n  async resolveByToken(rawToken: string): Promise<{ invitation: FormInvitation; distribution: FormDistribution }> {\n    const em = this.emFactory()\n    const tokenHash = hashInvitationToken(rawToken)\n    // Locate the row first (no scope) to derive org/tenant, then re-read with\n    // decryption scoped to that row so recipient PII is available to the caller.\n    const located = await em.findOne(FormInvitation, {\n      tokenHash,\n      deletedAt: null,\n    })\n    if (!located) {\n      throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)\n    }\n    const invitation = await findOneWithDecryption(\n      em,\n      FormInvitation,\n      { id: located.id, organizationId: located.organizationId, tenantId: located.tenantId, deletedAt: null },\n      undefined,\n      { organizationId: located.organizationId, tenantId: located.tenantId },\n    )\n    if (!invitation) {\n      throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)\n    }\n\n    this.assertInvitationUsable(invitation)\n\n    const distribution = await em.findOne(FormDistribution, {\n      id: invitation.distributionId,\n      organizationId: invitation.organizationId,\n      tenantId: invitation.tenantId,\n      deletedAt: null,\n    })\n    if (!distribution) {\n      throw new DistributionServiceError('NOT_FOUND', 'Distribution not found.', 404)\n    }\n    this.assertDistributionAvailable(distribution)\n\n    // Mark opened on first resolve from a pre-fill status.\n    if (invitation.status === 'pending' || invitation.status === 'sent') {\n      invitation.status = 'opened'\n      invitation.openedAt = this.now()\n      await em.flush()\n      await this.safeEmit('forms.invitation.opened', { invitationId: invitation.id })\n    }\n\n    return { invitation, distribution }\n  }\n\n  // --------------------------------------------------------------------------\n  // Form context \u2014 resolve the served form version for a distribution\n  // --------------------------------------------------------------------------\n\n  async getFormContext(args: { distribution: FormDistribution }): Promise<FormContextResult> {\n    const { distribution } = args\n    const em = this.emFactory()\n    const form = await em.findOne(Form, {\n      id: distribution.formId,\n      organizationId: distribution.organizationId,\n      tenantId: distribution.tenantId,\n      deletedAt: null,\n    })\n    if (!form) {\n      throw new DistributionServiceError('NOT_FOUND', 'Form not found.', 404)\n    }\n    if (distribution.pinnedVersionId) {\n      return this.submissionService.getPinnedFormVersionByKey({\n        organizationId: distribution.organizationId,\n        tenantId: distribution.tenantId,\n        formKey: form.key,\n        pinnedVersionId: distribution.pinnedVersionId,\n      })\n    }\n    return this.submissionService.getActiveFormVersionByKey({\n      organizationId: distribution.organizationId,\n      tenantId: distribution.tenantId,\n      formKey: form.key,\n    })\n  }\n\n  // --------------------------------------------------------------------------\n  // Begin anonymous \u2014 mint/link invitation, start submission, sign token\n  // --------------------------------------------------------------------------\n\n  async beginAnonymous(args: BeginAnonymousArgs): Promise<BeginAnonymousResult> {\n    const { distribution } = args\n    this.assertDistributionAvailable(distribution)\n\n    const em = this.emFactory()\n    const form = await em.findOne(Form, {\n      id: distribution.formId,\n      organizationId: distribution.organizationId,\n      tenantId: distribution.tenantId,\n      deletedAt: null,\n    })\n    if (!form) {\n      throw new DistributionServiceError('NOT_FOUND', 'Form not found.', 404)\n    }\n\n    let invitation: FormInvitation\n    if (args.invitation) {\n      invitation = args.invitation\n      this.assertInvitationUsable(invitation)\n      // Resume: invitation already has a submission \u2014 return the existing one.\n      if (invitation.submissionId) {\n        return this.resumeExisting(distribution, form.key, invitation)\n      }\n    } else {\n      const now = this.now()\n      invitation = em.create(FormInvitation, {\n        distributionId: distribution.id,\n        organizationId: distribution.organizationId,\n        tenantId: distribution.tenantId,\n        recipientEmail: null,\n        recipientName: null,\n        recipientRef: null,\n        role: null,\n        tokenHash: null,\n        status: 'started',\n        submissionId: null,\n        locale: args.locale ?? distribution.defaultLocale ?? null,\n        sendCount: 0,\n        createdBy: null,\n        createdAt: now,\n        updatedAt: now,\n      })\n      em.persist(invitation)\n      await em.flush()\n    }\n\n    const view = await this.submissionService.start({\n      organizationId: distribution.organizationId,\n      tenantId: distribution.tenantId,\n      formKey: form.key,\n      subjectType: 'forms_invitation',\n      subjectId: invitation.id,\n      startedBy: invitation.id,\n      initialRole: invitation.role ?? null,\n      pinnedVersionId: distribution.pinnedVersionId ?? undefined,\n    })\n\n    const now = this.now()\n    invitation.submissionId = view.submission.id\n    invitation.status = 'started'\n    invitation.startedAt = now\n    if (!invitation.locale) invitation.locale = args.locale ?? distribution.defaultLocale ?? null\n    await em.flush()\n\n    const role = view.actors[0]?.role ?? invitation.role ?? null\n    return this.issueAccess(view, invitation, role)\n  }\n\n  // --------------------------------------------------------------------------\n  // Reserve a response slot (atomic cap enforcement \u2014 R-2d-5)\n  // --------------------------------------------------------------------------\n\n  async reserveResponseSlot(args: { distributionId: string; organizationId: string; tenantId: string }): Promise<void> {\n    const em = this.emFactory()\n    await em.transactional(async (trx) => {\n      const distribution = await trx.findOne(\n        FormDistribution,\n        {\n          id: args.distributionId,\n          organizationId: args.organizationId,\n          tenantId: args.tenantId,\n          deletedAt: null,\n        },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n      )\n      if (!distribution) {\n        throw new DistributionServiceError('NOT_FOUND', 'Distribution not found.', 404)\n      }\n      this.assertDistributionAvailable(distribution)\n      distribution.responseCount += 1\n      await trx.flush()\n    })\n  }\n\n  // --------------------------------------------------------------------------\n  // Mark invitation submitted\n  // --------------------------------------------------------------------------\n\n  async markInvitationSubmitted(args: {\n    invitationId: string\n    organizationId: string\n    tenantId: string\n    submissionId: string\n  }): Promise<void> {\n    const em = this.emFactory()\n    const invitation = await em.findOne(FormInvitation, {\n      id: args.invitationId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    })\n    if (!invitation) {\n      throw new DistributionServiceError('NOT_FOUND', 'Invitation not found.', 404)\n    }\n    invitation.status = 'submitted'\n    invitation.submittedAt = this.now()\n    await em.flush()\n    await this.safeEmit('forms.invitation.submitted', {\n      invitationId: invitation.id,\n      submissionId: args.submissionId,\n    })\n  }\n\n  // --------------------------------------------------------------------------\n  // Slide the access-token expiry (used by the autosave route)\n  // --------------------------------------------------------------------------\n\n  refreshAccessToken(submissionId: string, invitationId: string, role: string | null): string {\n    return signAccessToken({\n      submissionId,\n      invitationId,\n      role,\n      expiresAtSeconds: this.expiresAtSeconds(),\n    })\n  }\n\n  // --------------------------------------------------------------------------\n  // Helpers\n  // --------------------------------------------------------------------------\n\n  private async resumeExisting(\n    distribution: FormDistribution,\n    formKey: string,\n    invitation: FormInvitation,\n  ): Promise<BeginAnonymousResult> {\n    const view = await this.submissionService.getCurrent({\n      organizationId: invitation.organizationId,\n      tenantId: invitation.tenantId,\n      submissionId: invitation.submissionId as string,\n      viewerRole: invitation.role ?? null,\n      viewerUserId: invitation.id,\n    })\n    void distribution\n    void formKey\n    const role = view.actors.find((actor) => actor.userId === invitation.id)?.role\n      ?? invitation.role\n      ?? view.actors[0]?.role\n      ?? null\n    return this.issueAccess(view, invitation, role)\n  }\n\n  private issueAccess(\n    view: SubmissionViewModel,\n    invitation: FormInvitation,\n    role: string | null,\n  ): BeginAnonymousResult {\n    const expiresAtSeconds = this.expiresAtSeconds()\n    const accessToken = signAccessToken({\n      submissionId: view.submission.id,\n      invitationId: invitation.id,\n      role,\n      expiresAtSeconds,\n    })\n    return {\n      view,\n      invitation,\n      accessToken,\n      expiresAt: new Date(expiresAtSeconds * 1000).toISOString(),\n    }\n  }\n\n  private expiresAtSeconds(): number {\n    return Math.floor(this.now().getTime() / 1000) + getAccessTokenTtlSeconds()\n  }\n\n  private assertDistributionAvailable(distribution: FormDistribution): void {\n    if (distribution.status !== 'active') {\n      throw new DistributionServiceError('GONE', 'Distribution is not active.', 410, {\n        status: distribution.status,\n      })\n    }\n    const now = this.now().getTime()\n    if (distribution.opensAt && now < distribution.opensAt.getTime()) {\n      throw new DistributionServiceError('GONE', 'Distribution is not open yet.', 410)\n    }\n    if (distribution.closesAt && now > distribution.closesAt.getTime()) {\n      throw new DistributionServiceError('GONE', 'Distribution is closed.', 410)\n    }\n    if (distribution.maxResponses != null && distribution.responseCount >= distribution.maxResponses) {\n      throw new DistributionServiceError('GONE', 'Distribution response cap reached.', 410)\n    }\n  }\n\n  private assertInvitationUsable(invitation: FormInvitation): void {\n    if (INVITATION_TERMINAL_STATUSES.has(invitation.status)) {\n      throw new DistributionServiceError('GONE', `Invitation is ${invitation.status}.`, 410, {\n        status: invitation.status,\n      })\n    }\n    if (invitation.expiresAt && this.now().getTime() > invitation.expiresAt.getTime()) {\n      throw new DistributionServiceError('GONE', 'Invitation is expired.', 410)\n    }\n  }\n\n  private async safeEmit<K extends keyof DistributionEvents>(\n    eventId: K,\n    payload: DistributionEvents[K],\n  ): Promise<void> {\n    try {\n      await this.emitEvent(eventId, payload)\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Unknown emit error'\n      this.logger.warn(\n        { event: 'forms.distribution.event_emit_failed', eventId, message },\n        'forms distribution event emission failed',\n      )\n    }\n  }\n}\n\n/** Brand check for DistributionServiceError \u2014 use instead of `instanceof`. */\nexport function isDistributionServiceError(error: unknown): error is DistributionServiceError {\n  return typeof error === 'object' && error !== null && (DISTRIBUTION_SERVICE_ERROR_MARKER in error)\n}\n"],
+  "mappings": "AAAA;AAmBA,SAAS,gBAAgB;AAGzB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAIP,SAAS,wBAAwB,gBAAgB,yBAAyB;AAE1E;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAcP,MAAM,oCAAoC,uBAAO,IAAI,8CAA8C;AAE5F,MAAM,kCAAiC,YAClC,wCADkC,IAAM;AAAA,EAMlD,YACE,MACA,SACA,YACA,SACA;AACA,UAAM,OAAO;AAXf,SAAU,MAAqC;AAY7C,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,UAAU;AAAA,EACjB;AACF;AAgBA,MAAM,aAA+B;AAAA,EACnC,MAAM,MAAM;AAAA,EAAC;AAAA,EACb,MAAM,MAAM;AAAA,EAAC;AAAA,EACb,OAAO,MAAM;AAAA,EAAC;AAChB;AAEA,MAAM,+BAAoD,oBAAI,IAAI,CAAC,aAAa,WAAW,SAAS,CAAC;AAqB9F,MAAM,oBAAoB;AAAA,EAO/B,YAAY,SAAqC;AAC/C,SAAK,YAAY,QAAQ;AACzB,SAAK,oBAAoB,QAAQ;AACjC,SAAK,YAAY,QAAQ;AACzB,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,SAAS,QAAQ,UAAU;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAAa,cAAyC;AACpD,QAAI,aAAa,SAAS,OAAQ,QAAO;AACzC,QAAI,aAAa,WAAW,SAAU,QAAO;AAC7C,QAAI,aAAa,oBAAqB,QAAO;AAC7C,WAAO,eAAe,kBAAkB,aAAa,QAAQ,CAAC;AAAA,EAChE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,qBACJ,MAC0D;AAC1D,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,eAAe,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACtD,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,aAAc,QAAO,EAAE,gBAAgB,0BAA0B,YAAY,MAAM;AACxF,UAAM,aAAa,KAAK,aAAa,YAAY;AACjD,UAAM,iBAAiB,aACnB,uBAAuB,kBAAkB,aAAa,QAAQ,CAAC,IAC/D;AACJ,WAAO,EAAE,gBAAgB,WAAW;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,cAAc,MAA2D;AAC7E,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,eAAe,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACtD,YAAY;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,yBAAyB,aAAa,2BAA2B,GAAG;AAAA,IAChF;AACA,SAAK,4BAA4B,YAAY;AAC7C,WAAO,EAAE,aAAa;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,UAA2F;AAC9G,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,YAAY,oBAAoB,QAAQ;AAG9C,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAC/C;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,yBAAyB,aAAa,yBAAyB,GAAG;AAAA,IAC9E;AACA,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,QAAQ,IAAI,gBAAgB,QAAQ,gBAAgB,UAAU,QAAQ,UAAU,WAAW,KAAK;AAAA,MACtG;AAAA,MACA,EAAE,gBAAgB,QAAQ,gBAAgB,UAAU,QAAQ,SAAS;AAAA,IACvE;AACA,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,yBAAyB,aAAa,yBAAyB,GAAG;AAAA,IAC9E;AAEA,SAAK,uBAAuB,UAAU;AAEtC,UAAM,eAAe,MAAM,GAAG,QAAQ,kBAAkB;AAAA,MACtD,IAAI,WAAW;AAAA,MACf,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,cAAc;AACjB,YAAM,IAAI,yBAAyB,aAAa,2BAA2B,GAAG;AAAA,IAChF;AACA,SAAK,4BAA4B,YAAY;AAG7C,QAAI,WAAW,WAAW,aAAa,WAAW,WAAW,QAAQ;AACnE,iBAAW,SAAS;AACpB,iBAAW,WAAW,KAAK,IAAI;AAC/B,YAAM,GAAG,MAAM;AACf,YAAM,KAAK,SAAS,2BAA2B,EAAE,cAAc,WAAW,GAAG,CAAC;AAAA,IAChF;AAEA,WAAO,EAAE,YAAY,aAAa;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,MAAsE;AACzF,UAAM,EAAE,aAAa,IAAI;AACzB,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM;AAAA,MAClC,IAAI,aAAa;AAAA,MACjB,gBAAgB,aAAa;AAAA,MAC7B,UAAU,aAAa;AAAA,MACvB,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,yBAAyB,aAAa,mBAAmB,GAAG;AAAA,IACxE;AACA,QAAI,aAAa,iBAAiB;AAChC,aAAO,KAAK,kBAAkB,0BAA0B;AAAA,QACtD,gBAAgB,aAAa;AAAA,QAC7B,UAAU,aAAa;AAAA,QACvB,SAAS,KAAK;AAAA,QACd,iBAAiB,aAAa;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO,KAAK,kBAAkB,0BAA0B;AAAA,MACtD,gBAAgB,aAAa;AAAA,MAC7B,UAAU,aAAa;AAAA,MACvB,SAAS,KAAK;AAAA,IAChB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,eAAe,MAAyD;AAC5E,UAAM,EAAE,aAAa,IAAI;AACzB,SAAK,4BAA4B,YAAY;AAE7C,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM;AAAA,MAClC,IAAI,aAAa;AAAA,MACjB,gBAAgB,aAAa;AAAA,MAC7B,UAAU,aAAa;AAAA,MACvB,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,yBAAyB,aAAa,mBAAmB,GAAG;AAAA,IACxE;AAEA,QAAI;AACJ,QAAI,KAAK,YAAY;AACnB,mBAAa,KAAK;AAClB,WAAK,uBAAuB,UAAU;AAEtC,UAAI,WAAW,cAAc;AAC3B,eAAO,KAAK,eAAe,cAAc,KAAK,KAAK,UAAU;AAAA,MAC/D;AAAA,IACF,OAAO;AACL,YAAMA,OAAM,KAAK,IAAI;AACrB,mBAAa,GAAG,OAAO,gBAAgB;AAAA,QACrC,gBAAgB,aAAa;AAAA,QAC7B,gBAAgB,aAAa;AAAA,QAC7B,UAAU,aAAa;AAAA,QACvB,gBAAgB;AAAA,QAChB,eAAe;AAAA,QACf,cAAc;AAAA,QACd,MAAM;AAAA,QACN,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,QAAQ,KAAK,UAAU,aAAa,iBAAiB;AAAA,QACrD,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAWA;AAAA,QACX,WAAWA;AAAA,MACb,CAAC;AACD,SAAG,QAAQ,UAAU;AACrB,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,OAAO,MAAM,KAAK,kBAAkB,MAAM;AAAA,MAC9C,gBAAgB,aAAa;AAAA,MAC7B,UAAU,aAAa;AAAA,MACvB,SAAS,KAAK;AAAA,MACd,aAAa;AAAA,MACb,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW;AAAA,MACtB,aAAa,WAAW,QAAQ;AAAA,MAChC,iBAAiB,aAAa,mBAAmB;AAAA,IACnD,CAAC;AAED,UAAM,MAAM,KAAK,IAAI;AACrB,eAAW,eAAe,KAAK,WAAW;AAC1C,eAAW,SAAS;AACpB,eAAW,YAAY;AACvB,QAAI,CAAC,WAAW,OAAQ,YAAW,SAAS,KAAK,UAAU,aAAa,iBAAiB;AACzF,UAAM,GAAG,MAAM;AAEf,UAAM,OAAO,KAAK,OAAO,CAAC,GAAG,QAAQ,WAAW,QAAQ;AACxD,WAAO,KAAK,YAAY,MAAM,YAAY,IAAI;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,oBAAoB,MAA2F;AACnH,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,YAAM,eAAe,MAAM,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,UACE,IAAI,KAAK;AAAA,UACT,gBAAgB,KAAK;AAAA,UACrB,UAAU,KAAK;AAAA,UACf,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,MACzC;AACA,UAAI,CAAC,cAAc;AACjB,cAAM,IAAI,yBAAyB,aAAa,2BAA2B,GAAG;AAAA,MAChF;AACA,WAAK,4BAA4B,YAAY;AAC7C,mBAAa,iBAAiB;AAC9B,YAAM,IAAI,MAAM;AAAA,IAClB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,wBAAwB,MAKZ;AAChB,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,yBAAyB,aAAa,yBAAyB,GAAG;AAAA,IAC9E;AACA,eAAW,SAAS;AACpB,eAAW,cAAc,KAAK,IAAI;AAClC,UAAM,GAAG,MAAM;AACf,UAAM,KAAK,SAAS,8BAA8B;AAAA,MAChD,cAAc,WAAW;AAAA,MACzB,cAAc,KAAK;AAAA,IACrB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,mBAAmB,cAAsB,cAAsB,MAA6B;AAC1F,WAAO,gBAAgB;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB,KAAK,iBAAiB;AAAA,IAC1C,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,cACA,SACA,YAC+B;AAC/B,UAAM,OAAO,MAAM,KAAK,kBAAkB,WAAW;AAAA,MACnD,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,cAAc,WAAW;AAAA,MACzB,YAAY,WAAW,QAAQ;AAAA,MAC/B,cAAc,WAAW;AAAA,IAC3B,CAAC;AACD,SAAK;AACL,SAAK;AACL,UAAM,OAAO,KAAK,OAAO,KAAK,CAAC,UAAU,MAAM,WAAW,WAAW,EAAE,GAAG,QACrE,WAAW,QACX,KAAK,OAAO,CAAC,GAAG,QAChB;AACL,WAAO,KAAK,YAAY,MAAM,YAAY,IAAI;AAAA,EAChD;AAAA,EAEQ,YACN,MACA,YACA,MACsB;AACtB,UAAM,mBAAmB,KAAK,iBAAiB;AAC/C,UAAM,cAAc,gBAAgB;AAAA,MAClC,cAAc,KAAK,WAAW;AAAA,MAC9B,cAAc,WAAW;AAAA,MACzB;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA,WAAW,IAAI,KAAK,mBAAmB,GAAI,EAAE,YAAY;AAAA,IAC3D;AAAA,EACF;AAAA,EAEQ,mBAA2B;AACjC,WAAO,KAAK,MAAM,KAAK,IAAI,EAAE,QAAQ,IAAI,GAAI,IAAI,yBAAyB;AAAA,EAC5E;AAAA,EAEQ,4BAA4B,cAAsC;AACxE,QAAI,aAAa,WAAW,UAAU;AACpC,YAAM,IAAI,yBAAyB,QAAQ,+BAA+B,KAAK;AAAA,QAC7E,QAAQ,aAAa;AAAA,MACvB,CAAC;AAAA,IACH;AACA,UAAM,MAAM,KAAK,IAAI,EAAE,QAAQ;AAC/B,QAAI,aAAa,WAAW,MAAM,aAAa,QAAQ,QAAQ,GAAG;AAChE,YAAM,IAAI,yBAAyB,QAAQ,iCAAiC,GAAG;AAAA,IACjF;AACA,QAAI,aAAa,YAAY,MAAM,aAAa,SAAS,QAAQ,GAAG;AAClE,YAAM,IAAI,yBAAyB,QAAQ,2BAA2B,GAAG;AAAA,IAC3E;AACA,QAAI,aAAa,gBAAgB,QAAQ,aAAa,iBAAiB,aAAa,cAAc;AAChG,YAAM,IAAI,yBAAyB,QAAQ,sCAAsC,GAAG;AAAA,IACtF;AAAA,EACF;AAAA,EAEQ,uBAAuB,YAAkC;AAC/D,QAAI,6BAA6B,IAAI,WAAW,MAAM,GAAG;AACvD,YAAM,IAAI,yBAAyB,QAAQ,iBAAiB,WAAW,MAAM,KAAK,KAAK;AAAA,QACrF,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,KAAK,IAAI,EAAE,QAAQ,IAAI,WAAW,UAAU,QAAQ,GAAG;AACjF,YAAM,IAAI,yBAAyB,QAAQ,0BAA0B,GAAG;AAAA,IAC1E;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,SACA,SACe;AACf,QAAI;AACF,YAAM,KAAK,UAAU,SAAS,OAAO;AAAA,IACvC,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAK,OAAO;AAAA,QACV,EAAE,OAAO,wCAAwC,SAAS,QAAQ;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,2BAA2B,OAAmD;AAC5F,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,qCAAqC;AAC9F;",
+  "names": ["now"]
+}

package/dist/modules/forms/services/distribution-token.js

@@ -0,0 +1,93 @@
+import { createHmac, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+const DEFAULT_ACCESS_TOKEN_TTL_S = 86400;
+const DEFAULT_INVITATION_TOKEN_TTL_S = 1209600;
+const ROLE_NULL_SENTINEL = "-";
+function getSecret() {
+  const secret = process.env.FORMS_DISTRIBUTION_TOKEN_SECRET ?? process.env.JWT_SECRET ?? "";
+  if (!secret) {
+    throw new Error("FORMS_DISTRIBUTION_TOKEN_SECRET (or JWT_SECRET fallback) must be set.");
+  }
+  return secret;
+}
+function getAccessTokenTtlSeconds() {
+  const raw = process.env.FORMS_ACCESS_TOKEN_TTL_S;
+  if (!raw) return DEFAULT_ACCESS_TOKEN_TTL_S;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_ACCESS_TOKEN_TTL_S;
+}
+function getInvitationTokenTtlSeconds() {
+  const raw = process.env.FORMS_INVITATION_TOKEN_TTL_S;
+  if (!raw) return DEFAULT_INVITATION_TOKEN_TTL_S;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_INVITATION_TOKEN_TTL_S;
+}
+function encodeSegment(value) {
+  return Buffer.from(value, "utf8").toString("base64url");
+}
+function decodeSegment(value) {
+  return Buffer.from(value, "base64url").toString("utf8");
+}
+function encodeRole(role) {
+  if (role === null || role === void 0 || role.length === 0) return ROLE_NULL_SENTINEL;
+  return encodeSegment(role);
+}
+function decodeRole(segment) {
+  if (segment === ROLE_NULL_SENTINEL) return null;
+  const decoded = decodeSegment(segment);
+  return decoded.length === 0 ? null : decoded;
+}
+function signAccessToken(args) {
+  const submissionSegment = encodeSegment(args.submissionId);
+  const invitationSegment = encodeSegment(args.invitationId);
+  const roleSegment = encodeRole(args.role);
+  const expSegment = String(args.expiresAtSeconds);
+  const payload = `${submissionSegment}.${invitationSegment}.${roleSegment}.${expSegment}`;
+  const hmac = createHmac("sha256", getSecret()).update(payload).digest("hex");
+  return `${payload}.${hmac}`;
+}
+function verifyAccessToken(token) {
+  const parts = token.split(".");
+  if (parts.length !== 5) return { ok: false, reason: "malformed" };
+  const [submissionSegment, invitationSegment, roleSegment, expSegment, hmac] = parts;
+  const exp = Number.parseInt(expSegment, 10);
+  if (!Number.isFinite(exp)) return { ok: false, reason: "malformed_exp" };
+  if (Math.floor(Date.now() / 1e3) > exp) return { ok: false, reason: "expired" };
+  const payload = `${submissionSegment}.${invitationSegment}.${roleSegment}.${expSegment}`;
+  const expected = createHmac("sha256", getSecret()).update(payload).digest("hex");
+  const expectedBuf = Buffer.from(expected, "hex");
+  const actualBuf = Buffer.from(hmac, "hex");
+  if (expectedBuf.length !== actualBuf.length) return { ok: false, reason: "signature" };
+  if (!timingSafeEqual(expectedBuf, actualBuf)) return { ok: false, reason: "signature" };
+  let submissionId;
+  let invitationId;
+  let role;
+  try {
+    submissionId = decodeSegment(submissionSegment);
+    invitationId = decodeSegment(invitationSegment);
+    role = decodeRole(roleSegment);
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!submissionId || !invitationId) return { ok: false, reason: "malformed" };
+  return { ok: true, submissionId, invitationId, role };
+}
+function hashInvitationToken(rawToken) {
+  return createHash("sha256").update(rawToken, "utf8").digest("hex");
+}
+function generateRawInvitationToken() {
+  return randomBytes(32).toString("base64url");
+}
+function generatePublicSlug() {
+  return randomBytes(16).toString("base64url");
+}
+export {
+  generatePublicSlug,
+  generateRawInvitationToken,
+  getAccessTokenTtlSeconds,
+  getInvitationTokenTtlSeconds,
+  getSecret,
+  hashInvitationToken,
+  signAccessToken,
+  verifyAccessToken
+};
+//# sourceMappingURL=distribution-token.js.map

package/dist/modules/forms/services/distribution-token.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/distribution-token.ts"],
+  "sourcesContent": ["/**\n * Forms distribution token primitives \u2014 phase 2d.\n *\n * Two token kinds live here:\n *\n *  1. The stateless **submission access token** that authorizes an\n *     unauthenticated participant to run save/submit against exactly one\n *     submission, in exactly one role. It mirrors the phase 1d resume-token\n *     format (compact, no JWT to avoid header/cookie collisions):\n *\n *       base64url(submissionId).base64url(invitationId).role.exp.hmac\n *\n *     where `hmac = HMAC-SHA256(secret, payload)` over the full dotted body\n *     up to (but excluding) the hmac segment. The two UUIDs are base64url\n *     encoded so a stray dot in the body can never collide with the\n *     separators; `role` and `exp` are dot-safe by construction.\n *\n *     The org/tenant are NEVER encoded in \u2014 and never trusted from \u2014 the\n *     token. They are re-derived from the persisted submission row downstream\n *     (see `lib/runtime-principal.ts`), per R-2d-4.\n *\n *  2. The **personal invitation token** \u2014 a high-entropy raw string handed to\n *     a recipient once. Only its SHA-256 hash is persisted (`token_hash`);\n *     `hashInvitationToken` produces that hash and `generateRawInvitationToken`\n *     mints the raw value.\n */\n\nimport { createHmac, createHash, randomBytes, timingSafeEqual } from 'node:crypto'\n\nconst DEFAULT_ACCESS_TOKEN_TTL_S = 86_400\nconst DEFAULT_INVITATION_TOKEN_TTL_S = 1_209_600\n\nexport type AccessTokenRole = string | null\n\nexport type SignAccessTokenArgs = {\n  submissionId: string\n  invitationId: string\n  role: AccessTokenRole\n  expiresAtSeconds: number\n}\n\nexport type VerifyAccessTokenResult = {\n  ok: boolean\n  submissionId?: string\n  invitationId?: string\n  role?: string | null\n  reason?: string\n}\n\nconst ROLE_NULL_SENTINEL = '-'\n\nexport function getSecret(): string {\n  const secret = process.env.FORMS_DISTRIBUTION_TOKEN_SECRET ?? process.env.JWT_SECRET ?? ''\n  if (!secret) {\n    throw new Error('FORMS_DISTRIBUTION_TOKEN_SECRET (or JWT_SECRET fallback) must be set.')\n  }\n  return secret\n}\n\nexport function getAccessTokenTtlSeconds(): number {\n  const raw = process.env.FORMS_ACCESS_TOKEN_TTL_S\n  if (!raw) return DEFAULT_ACCESS_TOKEN_TTL_S\n  const parsed = Number.parseInt(raw, 10)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_ACCESS_TOKEN_TTL_S\n}\n\nexport function getInvitationTokenTtlSeconds(): number {\n  const raw = process.env.FORMS_INVITATION_TOKEN_TTL_S\n  if (!raw) return DEFAULT_INVITATION_TOKEN_TTL_S\n  const parsed = Number.parseInt(raw, 10)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_INVITATION_TOKEN_TTL_S\n}\n\nfunction encodeSegment(value: string): string {\n  return Buffer.from(value, 'utf8').toString('base64url')\n}\n\nfunction decodeSegment(value: string): string {\n  return Buffer.from(value, 'base64url').toString('utf8')\n}\n\nfunction encodeRole(role: AccessTokenRole): string {\n  if (role === null || role === undefined || role.length === 0) return ROLE_NULL_SENTINEL\n  return encodeSegment(role)\n}\n\nfunction decodeRole(segment: string): string | null {\n  if (segment === ROLE_NULL_SENTINEL) return null\n  const decoded = decodeSegment(segment)\n  return decoded.length === 0 ? null : decoded\n}\n\nexport function signAccessToken(args: SignAccessTokenArgs): string {\n  const submissionSegment = encodeSegment(args.submissionId)\n  const invitationSegment = encodeSegment(args.invitationId)\n  const roleSegment = encodeRole(args.role)\n  const expSegment = String(args.expiresAtSeconds)\n  const payload = `${submissionSegment}.${invitationSegment}.${roleSegment}.${expSegment}`\n  const hmac = createHmac('sha256', getSecret()).update(payload).digest('hex')\n  return `${payload}.${hmac}`\n}\n\nexport function verifyAccessToken(token: string): VerifyAccessTokenResult {\n  const parts = token.split('.')\n  if (parts.length !== 5) return { ok: false, reason: 'malformed' }\n  const [submissionSegment, invitationSegment, roleSegment, expSegment, hmac] = parts\n  const exp = Number.parseInt(expSegment, 10)\n  if (!Number.isFinite(exp)) return { ok: false, reason: 'malformed_exp' }\n  if (Math.floor(Date.now() / 1000) > exp) return { ok: false, reason: 'expired' }\n\n  const payload = `${submissionSegment}.${invitationSegment}.${roleSegment}.${expSegment}`\n  const expected = createHmac('sha256', getSecret()).update(payload).digest('hex')\n  const expectedBuf = Buffer.from(expected, 'hex')\n  const actualBuf = Buffer.from(hmac, 'hex')\n  if (expectedBuf.length !== actualBuf.length) return { ok: false, reason: 'signature' }\n  if (!timingSafeEqual(expectedBuf, actualBuf)) return { ok: false, reason: 'signature' }\n\n  let submissionId: string\n  let invitationId: string\n  let role: string | null\n  try {\n    submissionId = decodeSegment(submissionSegment)\n    invitationId = decodeSegment(invitationSegment)\n    role = decodeRole(roleSegment)\n  } catch {\n    return { ok: false, reason: 'malformed' }\n  }\n  if (!submissionId || !invitationId) return { ok: false, reason: 'malformed' }\n  return { ok: true, submissionId, invitationId, role }\n}\n\n/**\n * SHA-256 hex of the raw personal invitation token. Deterministic \u2014 the same\n * raw token always hashes to the same value, enabling a `token_hash` lookup.\n */\nexport function hashInvitationToken(rawToken: string): string {\n  return createHash('sha256').update(rawToken, 'utf8').digest('hex')\n}\n\n/**\n * Mint a URL-safe raw personal invitation token with \u2265256 bits of entropy.\n * Shown to the recipient once; only its hash is persisted.\n */\nexport function generateRawInvitationToken(): string {\n  return randomBytes(32).toString('base64url')\n}\n\n/**\n * Mint a URL-safe random public-link slug with \u2265128 bits of entropy.\n */\nexport function generatePublicSlug(): string {\n  return randomBytes(16).toString('base64url')\n}\n"],
+  "mappings": "AA2BA,SAAS,YAAY,YAAY,aAAa,uBAAuB;AAErE,MAAM,6BAA6B;AACnC,MAAM,iCAAiC;AAmBvC,MAAM,qBAAqB;AAEpB,SAAS,YAAoB;AAClC,QAAM,SAAS,QAAQ,IAAI,mCAAmC,QAAQ,IAAI,cAAc;AACxF,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF;AACA,SAAO;AACT;AAEO,SAAS,2BAAmC;AACjD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,SAAO,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAC1D;AAEO,SAAS,+BAAuC;AACrD,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,SAAO,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAC1D;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW;AACxD;AAEA,SAAS,cAAc,OAAuB;AAC5C,SAAO,OAAO,KAAK,OAAO,WAAW,EAAE,SAAS,MAAM;AACxD;AAEA,SAAS,WAAW,MAA+B;AACjD,MAAI,SAAS,QAAQ,SAAS,UAAa,KAAK,WAAW,EAAG,QAAO;AACrE,SAAO,cAAc,IAAI;AAC3B;AAEA,SAAS,WAAW,SAAgC;AAClD,MAAI,YAAY,mBAAoB,QAAO;AAC3C,QAAM,UAAU,cAAc,OAAO;AACrC,SAAO,QAAQ,WAAW,IAAI,OAAO;AACvC;AAEO,SAAS,gBAAgB,MAAmC;AACjE,QAAM,oBAAoB,cAAc,KAAK,YAAY;AACzD,QAAM,oBAAoB,cAAc,KAAK,YAAY;AACzD,QAAM,cAAc,WAAW,KAAK,IAAI;AACxC,QAAM,aAAa,OAAO,KAAK,gBAAgB;AAC/C,QAAM,UAAU,GAAG,iBAAiB,IAAI,iBAAiB,IAAI,WAAW,IAAI,UAAU;AACtF,QAAM,OAAO,WAAW,UAAU,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC3E,SAAO,GAAG,OAAO,IAAI,IAAI;AAC3B;AAEO,SAAS,kBAAkB,OAAwC;AACxE,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAChE,QAAM,CAAC,mBAAmB,mBAAmB,aAAa,YAAY,IAAI,IAAI;AAC9E,QAAM,MAAM,OAAO,SAAS,YAAY,EAAE;AAC1C,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AACvE,MAAI,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAE/E,QAAM,UAAU,GAAG,iBAAiB,IAAI,iBAAiB,IAAI,WAAW,IAAI,UAAU;AACtF,QAAM,WAAW,WAAW,UAAU,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC/E,QAAM,cAAc,OAAO,KAAK,UAAU,KAAK;AAC/C,QAAM,YAAY,OAAO,KAAK,MAAM,KAAK;AACzC,MAAI,YAAY,WAAW,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACrF,MAAI,CAAC,gBAAgB,aAAa,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAEtF,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,mBAAe,cAAc,iBAAiB;AAC9C,mBAAe,cAAc,iBAAiB;AAC9C,WAAO,WAAW,WAAW;AAAA,EAC/B,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAAA,EAC1C;AACA,MAAI,CAAC,gBAAgB,CAAC,aAAc,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAC5E,SAAO,EAAE,IAAI,MAAM,cAAc,cAAc,KAAK;AACtD;AAMO,SAAS,oBAAoB,UAA0B;AAC5D,SAAO,WAAW,QAAQ,EAAE,OAAO,UAAU,MAAM,EAAE,OAAO,KAAK;AACnE;AAMO,SAAS,6BAAqC;AACnD,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAKO,SAAS,qBAA6B;AAC3C,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;",
+  "names": []
+}