@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/services/encryption-service.js

@@ -0,0 +1,328 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { FormsEncryptionKey } from "../data/entities.js";
+const FORMAT_VERSION_V1 = 1;
+const HEADER_LENGTH = 4;
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+const DEK_LENGTH = 32;
+const ALGORITHM = "aes-256-gcm";
+const DEFAULT_DEK_TTL_MS = 60 * 60 * 1e3;
+const DEFAULT_DEK_CACHE_MAX = 256;
+class FormsEncryptionError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "FormsEncryptionError";
+    this.code = code;
+  }
+}
+class DevDeterministicKmsAdapter {
+  constructor(kmsKeyId) {
+    if (!kmsKeyId || typeof kmsKeyId !== "string") {
+      throw new FormsEncryptionError(
+        "KMS_KEY_ID_MISSING",
+        "FORMS_ENCRYPTION_KMS_KEY_ID is required (dev fallback derives the wrap key from this id)."
+      );
+    }
+    this.wrapKey = createHash("sha256").update(`forms-enc-v1::${kmsKeyId}`).digest();
+  }
+  async wrap(dek) {
+    if (dek.length !== DEK_LENGTH) {
+      throw new FormsEncryptionError("DEK_INVALID_LENGTH", "DEK must be 32 bytes.");
+    }
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.wrapKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(dek), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, ciphertext, tag]);
+  }
+  async unwrap(wrapped) {
+    if (wrapped.length !== IV_LENGTH + DEK_LENGTH + TAG_LENGTH) {
+      throw new FormsEncryptionError("WRAPPED_DEK_INVALID_LENGTH", "Wrapped DEK has unexpected length.");
+    }
+    const iv = wrapped.subarray(0, IV_LENGTH);
+    const ciphertext = wrapped.subarray(IV_LENGTH, IV_LENGTH + DEK_LENGTH);
+    const tag = wrapped.subarray(IV_LENGTH + DEK_LENGTH);
+    const decipher = createDecipheriv(ALGORITHM, this.wrapKey, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  }
+}
+class EnvMasterKeyKmsAdapter {
+  constructor(masterKey) {
+    if (masterKey.length !== DEK_LENGTH) {
+      throw new FormsEncryptionError(
+        "MASTER_KEY_INVALID_LENGTH",
+        `Master key must be exactly ${DEK_LENGTH} bytes, received ${masterKey.length}.`
+      );
+    }
+    this.masterKey = masterKey;
+  }
+  /**
+   * Builds an adapter from a base64- or hex-encoded master key string.
+   * Throws `FormsEncryptionError('MASTER_KEY_INVALID', ...)` when the value is
+   * missing, undecodable, or does not yield exactly 32 bytes.
+   */
+  static fromEncoded(encoded) {
+    if (!encoded || typeof encoded !== "string" || encoded.trim().length === 0) {
+      throw new FormsEncryptionError(
+        "MASTER_KEY_INVALID",
+        "FORMS_ENCRYPTION_MASTER_KEY is required and must be a base64- or hex-encoded 32-byte key."
+      );
+    }
+    const decoded = decodeMasterKey(encoded.trim());
+    if (!decoded) {
+      throw new FormsEncryptionError(
+        "MASTER_KEY_INVALID",
+        "FORMS_ENCRYPTION_MASTER_KEY must be a valid base64 or hex string."
+      );
+    }
+    if (decoded.length !== DEK_LENGTH) {
+      throw new FormsEncryptionError(
+        "MASTER_KEY_INVALID_LENGTH",
+        `FORMS_ENCRYPTION_MASTER_KEY must decode to exactly ${DEK_LENGTH} bytes, got ${decoded.length}.`
+      );
+    }
+    return new EnvMasterKeyKmsAdapter(decoded);
+  }
+  async wrap(dek) {
+    if (dek.length !== DEK_LENGTH) {
+      throw new FormsEncryptionError("DEK_INVALID_LENGTH", "DEK must be 32 bytes.");
+    }
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, this.masterKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(dek), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, ciphertext, tag]);
+  }
+  async unwrap(wrapped) {
+    if (wrapped.length !== IV_LENGTH + DEK_LENGTH + TAG_LENGTH) {
+      throw new FormsEncryptionError("WRAPPED_DEK_INVALID_LENGTH", "Wrapped DEK has unexpected length.");
+    }
+    const iv = wrapped.subarray(0, IV_LENGTH);
+    const ciphertext = wrapped.subarray(IV_LENGTH, IV_LENGTH + DEK_LENGTH);
+    const tag = wrapped.subarray(IV_LENGTH + DEK_LENGTH);
+    const decipher = createDecipheriv(ALGORITHM, this.masterKey, iv);
+    decipher.setAuthTag(tag);
+    try {
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown unwrap error";
+      throw new FormsEncryptionError("DEK_UNWRAP_FAILED", `Failed to unwrap DEK: ${message}`);
+    }
+  }
+}
+let registeredKmsAdapterFactory = null;
+function setKmsAdapterFactory(factory) {
+  registeredKmsAdapterFactory = factory;
+}
+function resolveKmsAdapter(env = process.env) {
+  if (registeredKmsAdapterFactory) {
+    return registeredKmsAdapterFactory(env);
+  }
+  const masterKey = env.FORMS_ENCRYPTION_MASTER_KEY;
+  if (masterKey && masterKey.trim().length > 0) {
+    return EnvMasterKeyKmsAdapter.fromEncoded(masterKey);
+  }
+  if (env.NODE_ENV === "production") {
+    throw new FormsEncryptionError(
+      "INSECURE_KMS_IN_PRODUCTION",
+      "Refusing to encrypt forms PHI with the DEV-ONLY deterministic KMS adapter in production. Set FORMS_ENCRYPTION_MASTER_KEY to a 32-byte base64/hex master key, or inject a real cloud-KMS adapter via setKmsAdapterFactory(...) / the kmsAdapter DI slot."
+    );
+  }
+  const kmsKeyId = env.FORMS_ENCRYPTION_KMS_KEY_ID?.trim();
+  if (!kmsKeyId) {
+    throw new FormsEncryptionError(
+      "KMS_KEY_ID_MISSING",
+      "FORMS_ENCRYPTION_KMS_KEY_ID is required when no forms encryption master key or KMS adapter is configured."
+    );
+  }
+  return new DevDeterministicKmsAdapter(kmsKeyId);
+}
+function decodeMasterKey(encoded) {
+  if (/^[0-9a-fA-F]+$/.test(encoded) && encoded.length % 2 === 0) {
+    const hex = Buffer.from(encoded, "hex");
+    if (hex.length === encoded.length / 2) return hex;
+  }
+  if (/^[A-Za-z0-9+/=_-]+$/.test(encoded)) {
+    const base64 = Buffer.from(encoded, "base64");
+    if (base64.length > 0) return base64;
+  }
+  return null;
+}
+class FormsEncryptionService {
+  constructor(options) {
+    this.dekCache = /* @__PURE__ */ new Map();
+    this.currentVersionCache = /* @__PURE__ */ new Map();
+    this.emFactory = options.emFactory;
+    this.cacheMax = options.cacheMax ?? DEFAULT_DEK_CACHE_MAX;
+    this.cacheTtlMs = options.cacheTtlMs ?? DEFAULT_DEK_TTL_MS;
+    this.now = options.now ?? (() => Date.now());
+    this.kms = options.kmsAdapter ?? resolveKmsAdapter(process.env);
+  }
+  async encrypt(organizationId, plaintext) {
+    const keyVersion = await this.currentKeyVersion(organizationId);
+    const dek = await this.getDek(organizationId, keyVersion);
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, dek, iv);
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const header = Buffer.alloc(HEADER_LENGTH);
+    header.writeUInt16BE(FORMAT_VERSION_V1, 0);
+    header.writeUInt16BE(keyVersion, 2);
+    return Buffer.concat([header, iv, body, tag]);
+  }
+  async decrypt(organizationId, ciphertext) {
+    if (ciphertext.length < HEADER_LENGTH + IV_LENGTH + TAG_LENGTH) {
+      throw new FormsEncryptionError("CIPHERTEXT_TOO_SHORT", "Ciphertext too short to be a valid envelope.");
+    }
+    const formatVersion = ciphertext.readUInt16BE(0);
+    if (formatVersion !== FORMAT_VERSION_V1) {
+      throw new FormsEncryptionError(
+        "UNSUPPORTED_FORMAT_VERSION",
+        `Unsupported envelope format version ${formatVersion}.`
+      );
+    }
+    const keyVersion = ciphertext.readUInt16BE(2);
+    const iv = ciphertext.subarray(HEADER_LENGTH, HEADER_LENGTH + IV_LENGTH);
+    const tag = ciphertext.subarray(ciphertext.length - TAG_LENGTH);
+    const body = ciphertext.subarray(HEADER_LENGTH + IV_LENGTH, ciphertext.length - TAG_LENGTH);
+    const dek = await this.getDek(organizationId, keyVersion);
+    const decipher = createDecipheriv(ALGORITHM, dek, iv);
+    decipher.setAuthTag(tag);
+    try {
+      return Buffer.concat([decipher.update(body), decipher.final()]);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Unknown decryption error";
+      throw new FormsEncryptionError("DECRYPTION_FAILED", `Failed to decrypt envelope: ${message}`);
+    }
+  }
+  async currentKeyVersion(organizationId) {
+    const cached = this.currentVersionCache.get(organizationId);
+    if (typeof cached === "number") return cached;
+    const em = this.emFactory();
+    const active = await em.findOne(
+      FormsEncryptionKey,
+      { organizationId, retiredAt: null },
+      { orderBy: { keyVersion: "desc" } }
+    );
+    if (active) {
+      this.currentVersionCache.set(organizationId, active.keyVersion);
+      return active.keyVersion;
+    }
+    const created = await this.createInitialKey(em, organizationId);
+    this.currentVersionCache.set(organizationId, created.keyVersion);
+    return created.keyVersion;
+  }
+  async rotate(organizationId) {
+    const em = this.emFactory();
+    const current = await em.findOne(
+      FormsEncryptionKey,
+      { organizationId, retiredAt: null },
+      { orderBy: { keyVersion: "desc" } }
+    );
+    const nextVersion = (current?.keyVersion ?? 0) + 1;
+    const dek = randomBytes(DEK_LENGTH);
+    const wrapped = await this.kms.wrap(dek);
+    const fresh = em.create(FormsEncryptionKey, {
+      organizationId,
+      keyVersion: nextVersion,
+      wrappedDek: wrapped,
+      createdAt: new Date(this.now())
+    });
+    if (current) {
+      current.retiredAt = new Date(this.now());
+    }
+    em.persist(fresh);
+    if (current) em.persist(current);
+    await em.flush();
+    this.currentVersionCache.set(organizationId, nextVersion);
+    this.cacheDek(this.dekCacheKey(organizationId, nextVersion), dek);
+    return nextVersion;
+  }
+  /**
+   * Test/maintenance hook: drop all in-memory cached DEKs.
+   */
+  resetCache() {
+    this.dekCache.clear();
+    this.currentVersionCache.clear();
+  }
+  // --------------------------------------------------------------------------
+  // Internals
+  // --------------------------------------------------------------------------
+  async createInitialKey(em, organizationId) {
+    const dek = randomBytes(DEK_LENGTH);
+    const wrapped = await this.kms.wrap(dek);
+    const row = em.create(FormsEncryptionKey, {
+      organizationId,
+      keyVersion: 1,
+      wrappedDek: wrapped,
+      createdAt: new Date(this.now())
+    });
+    em.persist(row);
+    await em.flush();
+    this.cacheDek(this.dekCacheKey(organizationId, 1), dek);
+    return row;
+  }
+  async getDek(organizationId, keyVersion) {
+    const cacheKey = this.dekCacheKey(organizationId, keyVersion);
+    const cached = this.dekCache.get(cacheKey);
+    if (cached && cached.expiresAt > this.now()) {
+      this.dekCache.delete(cacheKey);
+      this.dekCache.set(cacheKey, cached);
+      return cached.dek;
+    }
+    if (cached) this.dekCache.delete(cacheKey);
+    const em = this.emFactory();
+    const row = await em.findOne(FormsEncryptionKey, { organizationId, keyVersion });
+    if (!row) {
+      throw new FormsEncryptionError(
+        "DEK_NOT_FOUND",
+        `Encryption key not found for organization ${organizationId} version ${keyVersion}.`
+      );
+    }
+    const wrapped = ensureBuffer(row.wrappedDek);
+    const dek = await this.kms.unwrap(wrapped);
+    this.cacheDek(cacheKey, dek);
+    return dek;
+  }
+  dekCacheKey(organizationId, keyVersion) {
+    return `${organizationId}:${keyVersion}`;
+  }
+  cacheDek(cacheKey, dek) {
+    while (this.dekCache.size >= this.cacheMax) {
+      const oldest = this.dekCache.keys().next().value;
+      if (!oldest) break;
+      this.dekCache.delete(oldest);
+    }
+    this.dekCache.set(cacheKey, { dek, expiresAt: this.now() + this.cacheTtlMs });
+  }
+}
+function ensureBuffer(value) {
+  if (Buffer.isBuffer(value)) return value;
+  if (value instanceof Uint8Array) return Buffer.from(value);
+  if (typeof value === "string") return Buffer.from(value, "binary");
+  throw new FormsEncryptionError("WRAPPED_DEK_INVALID_TYPE", "Wrapped DEK has unsupported representation.");
+}
+function redactSensitive(compiled, payload) {
+  if (!payload || typeof payload !== "object") return payload;
+  const out = {};
+  for (const [key, value] of Object.entries(payload)) {
+    const descriptor = compiled.fieldIndex[key];
+    if (descriptor?.sensitive) {
+      out[key] = "[REDACTED]";
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+export {
+  DevDeterministicKmsAdapter,
+  EnvMasterKeyKmsAdapter,
+  FormsEncryptionError,
+  FormsEncryptionService,
+  redactSensitive,
+  resolveKmsAdapter,
+  setKmsAdapterFactory
+};
+//# sourceMappingURL=encryption-service.js.map

package/dist/modules/forms/services/encryption-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/encryption-service.ts"],
+  "sourcesContent": ["/**\n * Forms module envelope encryption service.\n *\n * Lifts a per-tenant data-encryption key (DEK) wrapped under a master KMS key,\n * caches the unwrapped DEK in-memory, and uses it to encrypt/decrypt\n * submission revision payloads with AES-256-GCM. Ciphertext is self-describing\n * \u2014 the header carries the format version and the key version, so older\n * revisions remain decryptable across rotations.\n *\n * The `data` column on `forms_form_submission_revision` is encrypted by THIS\n * service, NOT by the global `findWithDecryption` pipeline. Phase 1c spec\n * (Cross-Cutting Concerns: encryption) is the source of truth for the format.\n *\n * Ciphertext layout:\n *   version(2B big-endian) | key_version(2B big-endian) | iv(12B) | ciphertext | tag(16B)\n * Format version is `0x0001` for v1; if/when the format changes, bump and\n * dispatch on the leading two bytes.\n *\n * KMS integration & env vars:\n *   The per-tenant DEK is wrapped under a master key. Three postures exist,\n *   selected by `resolveKmsAdapter(...)`:\n *\n *   1. `EnvMasterKeyKmsAdapter` (production-viable, default when configured) \u2014\n *      wraps/unwraps with a real 256-bit master key supplied via\n *      `FORMS_ENCRYPTION_MASTER_KEY` (base64 or hex, must decode to exactly 32\n *      bytes). This models the standard posture where a secret manager / cloud\n *      KMS decrypts the master key into the environment at boot.\n *   2. Operator-supplied cloud KMS adapter (AWS KMS, GCP KMS, HashiCorp Vault,\n *      \u2026) \u2014 injected via DI through the `kmsAdapter` constructor slot or the\n *      `setKmsAdapterFactory(...)` hook. No cloud SDK ships with this module.\n *   3. `DevDeterministicKmsAdapter` (DEV ONLY) \u2014 derives a deterministic wrap\n *      key from `FORMS_ENCRYPTION_KMS_KEY_ID`. Adequate for local development,\n *      tests, and CI but NEVER for production PHI.\n *\n *   Production guard: when `NODE_ENV === 'production'` and no real master key /\n *   adapter is configured, `resolveKmsAdapter(...)` throws\n *   `INSECURE_KMS_IN_PRODUCTION` rather than protecting PHI with the dev\n *   adapter (spec `.ai/specs/2026-05-21-...gap-analysis.md` W1 / risk R-1).\n *\n *   Env vars:\n *   - `FORMS_ENCRYPTION_MASTER_KEY` \u2014 32-byte master key, base64 or hex. When\n *     set and valid, the env master-key adapter is used.\n *   - `FORMS_ENCRYPTION_KMS_KEY_ID` \u2014 dev-only wrap-key seed for the\n *     deterministic fallback adapter.\n *\n *   All adapters emit the same wrapped-DEK envelope (iv | ciphertext | tag), so\n *   wrapped keys are format-compatible: a DEK wrapped by the dev adapter still\n *   unwraps with the dev adapter, and likewise for the env adapter.\n */\n\nimport { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CompiledFormVersion } from './form-version-compiler'\nimport { FormsEncryptionKey } from '../data/entities'\n\nconst FORMAT_VERSION_V1 = 0x0001\nconst HEADER_LENGTH = 4 // 2 bytes format version + 2 bytes key version\nconst IV_LENGTH = 12\nconst TAG_LENGTH = 16\nconst DEK_LENGTH = 32\nconst ALGORITHM = 'aes-256-gcm' as const\nconst DEFAULT_DEK_TTL_MS = 60 * 60 * 1000 // 1 hour\nconst DEFAULT_DEK_CACHE_MAX = 256\n\nexport class FormsEncryptionError extends Error {\n  readonly code: string\n  constructor(code: string, message: string) {\n    super(message)\n    this.name = 'FormsEncryptionError'\n    this.code = code\n  }\n}\n\nexport interface KmsAdapter {\n  /** Wraps a fresh 32-byte DEK under the master key (returns ciphertext). */\n  wrap(dek: Buffer): Promise<Buffer>\n  /** Unwraps a stored wrapped DEK (returns plaintext). */\n  unwrap(wrapped: Buffer): Promise<Buffer>\n}\n\n/**\n * DEV-ONLY KMS adapter \u2014 derives a deterministic AES-256-GCM \"wrap\" key from\n * `FORMS_ENCRYPTION_KMS_KEY_ID`. Provides envelope encryption for local\n * development, tests, and CI. Operators MUST replace this with a real KMS\n * adapter before production rollout.\n */\nexport class DevDeterministicKmsAdapter implements KmsAdapter {\n  private readonly wrapKey: Buffer\n\n  constructor(kmsKeyId: string) {\n    if (!kmsKeyId || typeof kmsKeyId !== 'string') {\n      throw new FormsEncryptionError(\n        'KMS_KEY_ID_MISSING',\n        'FORMS_ENCRYPTION_KMS_KEY_ID is required (dev fallback derives the wrap key from this id).',\n      )\n    }\n    this.wrapKey = createHash('sha256').update(`forms-enc-v1::${kmsKeyId}`).digest()\n  }\n\n  async wrap(dek: Buffer): Promise<Buffer> {\n    if (dek.length !== DEK_LENGTH) {\n      throw new FormsEncryptionError('DEK_INVALID_LENGTH', 'DEK must be 32 bytes.')\n    }\n    const iv = randomBytes(IV_LENGTH)\n    const cipher = createCipheriv(ALGORITHM, this.wrapKey, iv)\n    const ciphertext = Buffer.concat([cipher.update(dek), cipher.final()])\n    const tag = cipher.getAuthTag()\n    return Buffer.concat([iv, ciphertext, tag])\n  }\n\n  async unwrap(wrapped: Buffer): Promise<Buffer> {\n    if (wrapped.length !== IV_LENGTH + DEK_LENGTH + TAG_LENGTH) {\n      throw new FormsEncryptionError('WRAPPED_DEK_INVALID_LENGTH', 'Wrapped DEK has unexpected length.')\n    }\n    const iv = wrapped.subarray(0, IV_LENGTH)\n    const ciphertext = wrapped.subarray(IV_LENGTH, IV_LENGTH + DEK_LENGTH)\n    const tag = wrapped.subarray(IV_LENGTH + DEK_LENGTH)\n    const decipher = createDecipheriv(ALGORITHM, this.wrapKey, iv)\n    decipher.setAuthTag(tag)\n    return Buffer.concat([decipher.update(ciphertext), decipher.final()])\n  }\n}\n\n/**\n * Production-viable KMS adapter \u2014 wraps/unwraps the per-tenant DEK with an\n * externally-supplied 256-bit master key (NOT derived from an id string).\n *\n * The master key is read from `FORMS_ENCRYPTION_MASTER_KEY` and may be encoded\n * as base64 or hex; it MUST decode to exactly 32 bytes. This models the\n * standard posture where a secret manager / cloud KMS decrypts the master key\n * into the environment at boot. Wrap uses AES-256-GCM and emits the same\n * `iv | ciphertext | tag` envelope as the dev adapter, so stored wrapped-DEKs\n * are format-compatible.\n */\nexport class EnvMasterKeyKmsAdapter implements KmsAdapter {\n  private readonly masterKey: Buffer\n\n  constructor(masterKey: Buffer) {\n    if (masterKey.length !== DEK_LENGTH) {\n      throw new FormsEncryptionError(\n        'MASTER_KEY_INVALID_LENGTH',\n        `Master key must be exactly ${DEK_LENGTH} bytes, received ${masterKey.length}.`,\n      )\n    }\n    this.masterKey = masterKey\n  }\n\n  /**\n   * Builds an adapter from a base64- or hex-encoded master key string.\n   * Throws `FormsEncryptionError('MASTER_KEY_INVALID', ...)` when the value is\n   * missing, undecodable, or does not yield exactly 32 bytes.\n   */\n  static fromEncoded(encoded: string | undefined | null): EnvMasterKeyKmsAdapter {\n    if (!encoded || typeof encoded !== 'string' || encoded.trim().length === 0) {\n      throw new FormsEncryptionError(\n        'MASTER_KEY_INVALID',\n        'FORMS_ENCRYPTION_MASTER_KEY is required and must be a base64- or hex-encoded 32-byte key.',\n      )\n    }\n    const decoded = decodeMasterKey(encoded.trim())\n    if (!decoded) {\n      throw new FormsEncryptionError(\n        'MASTER_KEY_INVALID',\n        'FORMS_ENCRYPTION_MASTER_KEY must be a valid base64 or hex string.',\n      )\n    }\n    if (decoded.length !== DEK_LENGTH) {\n      throw new FormsEncryptionError(\n        'MASTER_KEY_INVALID_LENGTH',\n        `FORMS_ENCRYPTION_MASTER_KEY must decode to exactly ${DEK_LENGTH} bytes, got ${decoded.length}.`,\n      )\n    }\n    return new EnvMasterKeyKmsAdapter(decoded)\n  }\n\n  async wrap(dek: Buffer): Promise<Buffer> {\n    if (dek.length !== DEK_LENGTH) {\n      throw new FormsEncryptionError('DEK_INVALID_LENGTH', 'DEK must be 32 bytes.')\n    }\n    const iv = randomBytes(IV_LENGTH)\n    const cipher = createCipheriv(ALGORITHM, this.masterKey, iv)\n    const ciphertext = Buffer.concat([cipher.update(dek), cipher.final()])\n    const tag = cipher.getAuthTag()\n    return Buffer.concat([iv, ciphertext, tag])\n  }\n\n  async unwrap(wrapped: Buffer): Promise<Buffer> {\n    if (wrapped.length !== IV_LENGTH + DEK_LENGTH + TAG_LENGTH) {\n      throw new FormsEncryptionError('WRAPPED_DEK_INVALID_LENGTH', 'Wrapped DEK has unexpected length.')\n    }\n    const iv = wrapped.subarray(0, IV_LENGTH)\n    const ciphertext = wrapped.subarray(IV_LENGTH, IV_LENGTH + DEK_LENGTH)\n    const tag = wrapped.subarray(IV_LENGTH + DEK_LENGTH)\n    const decipher = createDecipheriv(ALGORITHM, this.masterKey, iv)\n    decipher.setAuthTag(tag)\n    try {\n      return Buffer.concat([decipher.update(ciphertext), decipher.final()])\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Unknown unwrap error'\n      throw new FormsEncryptionError('DEK_UNWRAP_FAILED', `Failed to unwrap DEK: ${message}`)\n    }\n  }\n}\n\n/**\n * Pluggable cloud-KMS hook.\n *\n * Operators integrating AWS KMS, GCP KMS, HashiCorp Vault, or any other key\n * manager implement the `KmsAdapter` interface (`wrap`/`unwrap`) and register a\n * factory here at boot \u2014 e.g. from the app's DI bootstrap \u2014 WITHOUT editing\n * this module or adding cloud SDK dependencies to it. When a factory is\n * registered it takes precedence over the env-var resolution below.\n *\n * Example (in app bootstrap):\n *   import { setKmsAdapterFactory } from '@open-mercato/core/modules/forms/services/encryption-service'\n *   setKmsAdapterFactory(() => new MyAwsKmsAdapter({ keyId: process.env.AWS_KMS_KEY_ARN }))\n */\nexport type KmsAdapterFactory = (env: NodeJS.ProcessEnv) => KmsAdapter\n\nlet registeredKmsAdapterFactory: KmsAdapterFactory | null = null\n\n/** Registers an operator-supplied cloud-KMS adapter factory (or clears it with `null`). */\nexport function setKmsAdapterFactory(factory: KmsAdapterFactory | null): void {\n  registeredKmsAdapterFactory = factory\n}\n\n/**\n * Selects the active KMS adapter and enforces the production safety guard.\n *\n * Resolution order:\n *   1. operator-registered factory (`setKmsAdapterFactory`) \u2014 always wins;\n *   2. `EnvMasterKeyKmsAdapter` when `FORMS_ENCRYPTION_MASTER_KEY` is set;\n *   3. `DevDeterministicKmsAdapter` when an explicit dev key id is configured.\n *\n * Throws when no adapter can be resolved. Even local development must opt in\n * to the deterministic adapter with `FORMS_ENCRYPTION_KMS_KEY_ID`; silently\n * sharing a built-in key would make encrypted data recoverable by anyone.\n */\nexport function resolveKmsAdapter(env: NodeJS.ProcessEnv = process.env): KmsAdapter {\n  if (registeredKmsAdapterFactory) {\n    return registeredKmsAdapterFactory(env)\n  }\n  const masterKey = env.FORMS_ENCRYPTION_MASTER_KEY\n  if (masterKey && masterKey.trim().length > 0) {\n    return EnvMasterKeyKmsAdapter.fromEncoded(masterKey)\n  }\n  if (env.NODE_ENV === 'production') {\n    throw new FormsEncryptionError(\n      'INSECURE_KMS_IN_PRODUCTION',\n      'Refusing to encrypt forms PHI with the DEV-ONLY deterministic KMS adapter in production. '\n        + 'Set FORMS_ENCRYPTION_MASTER_KEY to a 32-byte base64/hex master key, or inject a real '\n        + 'cloud-KMS adapter via setKmsAdapterFactory(...) / the kmsAdapter DI slot.',\n    )\n  }\n  const kmsKeyId = env.FORMS_ENCRYPTION_KMS_KEY_ID?.trim()\n  if (!kmsKeyId) {\n    throw new FormsEncryptionError(\n      'KMS_KEY_ID_MISSING',\n      'FORMS_ENCRYPTION_KMS_KEY_ID is required when no forms encryption master key or KMS adapter is configured.',\n    )\n  }\n  return new DevDeterministicKmsAdapter(kmsKeyId)\n}\n\nfunction decodeMasterKey(encoded: string): Buffer | null {\n  if (/^[0-9a-fA-F]+$/.test(encoded) && encoded.length % 2 === 0) {\n    const hex = Buffer.from(encoded, 'hex')\n    if (hex.length === encoded.length / 2) return hex\n  }\n  if (/^[A-Za-z0-9+/=_-]+$/.test(encoded)) {\n    const base64 = Buffer.from(encoded, 'base64')\n    if (base64.length > 0) return base64\n  }\n  return null\n}\n\nexport type EncryptionServiceOptions = {\n  emFactory: () => EntityManager\n  kmsAdapter?: KmsAdapter\n  cacheMax?: number\n  cacheTtlMs?: number\n  /** Override the clock for tests. */\n  now?: () => number\n}\n\ntype DekCacheEntry = {\n  dek: Buffer\n  expiresAt: number\n}\n\nexport interface EncryptionService {\n  encrypt(organizationId: string, plaintext: Buffer): Promise<Buffer>\n  decrypt(organizationId: string, ciphertext: Buffer): Promise<Buffer>\n  currentKeyVersion(organizationId: string): Promise<number>\n  rotate(organizationId: string): Promise<number>\n}\n\nexport class FormsEncryptionService implements EncryptionService {\n  private readonly emFactory: () => EntityManager\n  private readonly kms: KmsAdapter\n  private readonly cacheMax: number\n  private readonly cacheTtlMs: number\n  private readonly now: () => number\n  private readonly dekCache = new Map<string, DekCacheEntry>()\n  private readonly currentVersionCache = new Map<string, number>()\n\n  constructor(options: EncryptionServiceOptions) {\n    this.emFactory = options.emFactory\n    this.cacheMax = options.cacheMax ?? DEFAULT_DEK_CACHE_MAX\n    this.cacheTtlMs = options.cacheTtlMs ?? DEFAULT_DEK_TTL_MS\n    this.now = options.now ?? (() => Date.now())\n    // An explicitly injected adapter always wins over env resolution; otherwise\n    // resolveKmsAdapter selects the env master-key adapter or dev fallback and\n    // enforces the production guard (refuses the dev adapter in production).\n    this.kms = options.kmsAdapter ?? resolveKmsAdapter(process.env)\n  }\n\n  async encrypt(organizationId: string, plaintext: Buffer): Promise<Buffer> {\n    const keyVersion = await this.currentKeyVersion(organizationId)\n    const dek = await this.getDek(organizationId, keyVersion)\n    const iv = randomBytes(IV_LENGTH)\n    const cipher = createCipheriv(ALGORITHM, dek, iv)\n    const body = Buffer.concat([cipher.update(plaintext), cipher.final()])\n    const tag = cipher.getAuthTag()\n    const header = Buffer.alloc(HEADER_LENGTH)\n    header.writeUInt16BE(FORMAT_VERSION_V1, 0)\n    header.writeUInt16BE(keyVersion, 2)\n    return Buffer.concat([header, iv, body, tag])\n  }\n\n  async decrypt(organizationId: string, ciphertext: Buffer): Promise<Buffer> {\n    if (ciphertext.length < HEADER_LENGTH + IV_LENGTH + TAG_LENGTH) {\n      throw new FormsEncryptionError('CIPHERTEXT_TOO_SHORT', 'Ciphertext too short to be a valid envelope.')\n    }\n    const formatVersion = ciphertext.readUInt16BE(0)\n    if (formatVersion !== FORMAT_VERSION_V1) {\n      throw new FormsEncryptionError(\n        'UNSUPPORTED_FORMAT_VERSION',\n        `Unsupported envelope format version ${formatVersion}.`,\n      )\n    }\n    const keyVersion = ciphertext.readUInt16BE(2)\n    const iv = ciphertext.subarray(HEADER_LENGTH, HEADER_LENGTH + IV_LENGTH)\n    const tag = ciphertext.subarray(ciphertext.length - TAG_LENGTH)\n    const body = ciphertext.subarray(HEADER_LENGTH + IV_LENGTH, ciphertext.length - TAG_LENGTH)\n    const dek = await this.getDek(organizationId, keyVersion)\n    const decipher = createDecipheriv(ALGORITHM, dek, iv)\n    decipher.setAuthTag(tag)\n    try {\n      return Buffer.concat([decipher.update(body), decipher.final()])\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Unknown decryption error'\n      throw new FormsEncryptionError('DECRYPTION_FAILED', `Failed to decrypt envelope: ${message}`)\n    }\n  }\n\n  async currentKeyVersion(organizationId: string): Promise<number> {\n    const cached = this.currentVersionCache.get(organizationId)\n    if (typeof cached === 'number') return cached\n    const em = this.emFactory()\n    const active = await em.findOne(\n      FormsEncryptionKey,\n      { organizationId, retiredAt: null },\n      { orderBy: { keyVersion: 'desc' } },\n    )\n    if (active) {\n      this.currentVersionCache.set(organizationId, active.keyVersion)\n      return active.keyVersion\n    }\n    const created = await this.createInitialKey(em, organizationId)\n    this.currentVersionCache.set(organizationId, created.keyVersion)\n    return created.keyVersion\n  }\n\n  async rotate(organizationId: string): Promise<number> {\n    const em = this.emFactory()\n    const current = await em.findOne(\n      FormsEncryptionKey,\n      { organizationId, retiredAt: null },\n      { orderBy: { keyVersion: 'desc' } },\n    )\n    const nextVersion = (current?.keyVersion ?? 0) + 1\n    const dek = randomBytes(DEK_LENGTH)\n    const wrapped = await this.kms.wrap(dek)\n    const fresh = em.create(FormsEncryptionKey, {\n      organizationId,\n      keyVersion: nextVersion,\n      wrappedDek: wrapped,\n      createdAt: new Date(this.now()),\n    })\n    if (current) {\n      current.retiredAt = new Date(this.now())\n    }\n    em.persist(fresh)\n    if (current) em.persist(current)\n    await em.flush()\n    this.currentVersionCache.set(organizationId, nextVersion)\n    this.cacheDek(this.dekCacheKey(organizationId, nextVersion), dek)\n    return nextVersion\n  }\n\n  /**\n   * Test/maintenance hook: drop all in-memory cached DEKs.\n   */\n  resetCache(): void {\n    this.dekCache.clear()\n    this.currentVersionCache.clear()\n  }\n\n  // --------------------------------------------------------------------------\n  // Internals\n  // --------------------------------------------------------------------------\n\n  private async createInitialKey(\n    em: EntityManager,\n    organizationId: string,\n  ): Promise<FormsEncryptionKey> {\n    const dek = randomBytes(DEK_LENGTH)\n    const wrapped = await this.kms.wrap(dek)\n    const row = em.create(FormsEncryptionKey, {\n      organizationId,\n      keyVersion: 1,\n      wrappedDek: wrapped,\n      createdAt: new Date(this.now()),\n    })\n    em.persist(row)\n    await em.flush()\n    this.cacheDek(this.dekCacheKey(organizationId, 1), dek)\n    return row\n  }\n\n  private async getDek(organizationId: string, keyVersion: number): Promise<Buffer> {\n    const cacheKey = this.dekCacheKey(organizationId, keyVersion)\n    const cached = this.dekCache.get(cacheKey)\n    if (cached && cached.expiresAt > this.now()) {\n      // Refresh LRU position on hit.\n      this.dekCache.delete(cacheKey)\n      this.dekCache.set(cacheKey, cached)\n      return cached.dek\n    }\n    if (cached) this.dekCache.delete(cacheKey)\n    const em = this.emFactory()\n    const row = await em.findOne(FormsEncryptionKey, { organizationId, keyVersion })\n    if (!row) {\n      throw new FormsEncryptionError(\n        'DEK_NOT_FOUND',\n        `Encryption key not found for organization ${organizationId} version ${keyVersion}.`,\n      )\n    }\n    const wrapped = ensureBuffer(row.wrappedDek)\n    const dek = await this.kms.unwrap(wrapped)\n    this.cacheDek(cacheKey, dek)\n    return dek\n  }\n\n  private dekCacheKey(organizationId: string, keyVersion: number): string {\n    return `${organizationId}:${keyVersion}`\n  }\n\n  private cacheDek(cacheKey: string, dek: Buffer): void {\n    while (this.dekCache.size >= this.cacheMax) {\n      const oldest = this.dekCache.keys().next().value\n      if (!oldest) break\n      this.dekCache.delete(oldest)\n    }\n    this.dekCache.set(cacheKey, { dek, expiresAt: this.now() + this.cacheTtlMs })\n  }\n}\n\nfunction ensureBuffer(value: Buffer | Uint8Array | string): Buffer {\n  if (Buffer.isBuffer(value)) return value\n  if (value instanceof Uint8Array) return Buffer.from(value)\n  if (typeof value === 'string') return Buffer.from(value, 'binary')\n  throw new FormsEncryptionError('WRAPPED_DEK_INVALID_TYPE', 'Wrapped DEK has unsupported representation.')\n}\n\n/**\n * Redaction helper used by the logger middleware for R1 mitigation.\n *\n * Walks the payload at the root level and replaces any field marked\n * `x-om-sensitive: true` in the compiled form version with `\"[REDACTED]\"`.\n * Designed for shallow form payloads; nested sensitive structures should be\n * handled by the field type's own redactor in future phases.\n */\nexport function redactSensitive(\n  compiled: CompiledFormVersion,\n  payload: Record<string, unknown>,\n): Record<string, unknown> {\n  if (!payload || typeof payload !== 'object') return payload\n  const out: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(payload)) {\n    const descriptor = compiled.fieldIndex[key]\n    if (descriptor?.sensitive) {\n      out[key] = '[REDACTED]'\n    } else {\n      out[key] = value\n    }\n  }\n  return out\n}\n"],
+  "mappings": "AAkDA,SAAS,gBAAgB,kBAAkB,YAAY,mBAAmB;AAG1E,SAAS,0BAA0B;AAEnC,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;AACtB,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,YAAY;AAClB,MAAM,qBAAqB,KAAK,KAAK;AACrC,MAAM,wBAAwB;AAEvB,MAAM,6BAA6B,MAAM;AAAA,EAE9C,YAAY,MAAc,SAAiB;AACzC,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAeO,MAAM,2BAAiD;AAAA,EAG5D,YAAY,UAAkB;AAC5B,QAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,UAAU,WAAW,QAAQ,EAAE,OAAO,iBAAiB,QAAQ,EAAE,EAAE,OAAO;AAAA,EACjF;AAAA,EAEA,MAAM,KAAK,KAA8B;AACvC,QAAI,IAAI,WAAW,YAAY;AAC7B,YAAM,IAAI,qBAAqB,sBAAsB,uBAAuB;AAAA,IAC9E;AACA,UAAM,KAAK,YAAY,SAAS;AAChC,UAAM,SAAS,eAAe,WAAW,KAAK,SAAS,EAAE;AACzD,UAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,GAAG,GAAG,OAAO,MAAM,CAAC,CAAC;AACrE,UAAM,MAAM,OAAO,WAAW;AAC9B,WAAO,OAAO,OAAO,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,EAC5C;AAAA,EAEA,MAAM,OAAO,SAAkC;AAC7C,QAAI,QAAQ,WAAW,YAAY,aAAa,YAAY;AAC1D,YAAM,IAAI,qBAAqB,8BAA8B,oCAAoC;AAAA,IACnG;AACA,UAAM,KAAK,QAAQ,SAAS,GAAG,SAAS;AACxC,UAAM,aAAa,QAAQ,SAAS,WAAW,YAAY,UAAU;AACrE,UAAM,MAAM,QAAQ,SAAS,YAAY,UAAU;AACnD,UAAM,WAAW,iBAAiB,WAAW,KAAK,SAAS,EAAE;AAC7D,aAAS,WAAW,GAAG;AACvB,WAAO,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC;AAAA,EACtE;AACF;AAaO,MAAM,uBAA6C;AAAA,EAGxD,YAAY,WAAmB;AAC7B,QAAI,UAAU,WAAW,YAAY;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,8BAA8B,UAAU,oBAAoB,UAAU,MAAM;AAAA,MAC9E;AAAA,IACF;AACA,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,YAAY,SAA4D;AAC7E,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC1E,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,gBAAgB,QAAQ,KAAK,CAAC;AAC9C,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,YAAY;AACjC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,sDAAsD,UAAU,eAAe,QAAQ,MAAM;AAAA,MAC/F;AAAA,IACF;AACA,WAAO,IAAI,uBAAuB,OAAO;AAAA,EAC3C;AAAA,EAEA,MAAM,KAAK,KAA8B;AACvC,QAAI,IAAI,WAAW,YAAY;AAC7B,YAAM,IAAI,qBAAqB,sBAAsB,uBAAuB;AAAA,IAC9E;AACA,UAAM,KAAK,YAAY,SAAS;AAChC,UAAM,SAAS,eAAe,WAAW,KAAK,WAAW,EAAE;AAC3D,UAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,GAAG,GAAG,OAAO,MAAM,CAAC,CAAC;AACrE,UAAM,MAAM,OAAO,WAAW;AAC9B,WAAO,OAAO,OAAO,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,EAC5C;AAAA,EAEA,MAAM,OAAO,SAAkC;AAC7C,QAAI,QAAQ,WAAW,YAAY,aAAa,YAAY;AAC1D,YAAM,IAAI,qBAAqB,8BAA8B,oCAAoC;AAAA,IACnG;AACA,UAAM,KAAK,QAAQ,SAAS,GAAG,SAAS;AACxC,UAAM,aAAa,QAAQ,SAAS,WAAW,YAAY,UAAU;AACrE,UAAM,MAAM,QAAQ,SAAS,YAAY,UAAU;AACnD,UAAM,WAAW,iBAAiB,WAAW,KAAK,WAAW,EAAE;AAC/D,aAAS,WAAW,GAAG;AACvB,QAAI;AACF,aAAO,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC;AAAA,IACtE,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,IAAI,qBAAqB,qBAAqB,yBAAyB,OAAO,EAAE;AAAA,IACxF;AAAA,EACF;AACF;AAiBA,IAAI,8BAAwD;AAGrD,SAAS,qBAAqB,SAAyC;AAC5E,gCAA8B;AAChC;AAcO,SAAS,kBAAkB,MAAyB,QAAQ,KAAiB;AAClF,MAAI,6BAA6B;AAC/B,WAAO,4BAA4B,GAAG;AAAA,EACxC;AACA,QAAM,YAAY,IAAI;AACtB,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,WAAO,uBAAuB,YAAY,SAAS;AAAA,EACrD;AACA,MAAI,IAAI,aAAa,cAAc;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,QAAM,WAAW,IAAI,6BAA6B,KAAK;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI,2BAA2B,QAAQ;AAChD;AAEA,SAAS,gBAAgB,SAAgC;AACvD,MAAI,iBAAiB,KAAK,OAAO,KAAK,QAAQ,SAAS,MAAM,GAAG;AAC9D,UAAM,MAAM,OAAO,KAAK,SAAS,KAAK;AACtC,QAAI,IAAI,WAAW,QAAQ,SAAS,EAAG,QAAO;AAAA,EAChD;AACA,MAAI,sBAAsB,KAAK,OAAO,GAAG;AACvC,UAAM,SAAS,OAAO,KAAK,SAAS,QAAQ;AAC5C,QAAI,OAAO,SAAS,EAAG,QAAO;AAAA,EAChC;AACA,SAAO;AACT;AAuBO,MAAM,uBAAoD;AAAA,EAS/D,YAAY,SAAmC;AAH/C,SAAiB,WAAW,oBAAI,IAA2B;AAC3D,SAAiB,sBAAsB,oBAAI,IAAoB;AAG7D,SAAK,YAAY,QAAQ;AACzB,SAAK,WAAW,QAAQ,YAAY;AACpC,SAAK,aAAa,QAAQ,cAAc;AACxC,SAAK,MAAM,QAAQ,QAAQ,MAAM,KAAK,IAAI;AAI1C,SAAK,MAAM,QAAQ,cAAc,kBAAkB,QAAQ,GAAG;AAAA,EAChE;AAAA,EAEA,MAAM,QAAQ,gBAAwB,WAAoC;AACxE,UAAM,aAAa,MAAM,KAAK,kBAAkB,cAAc;AAC9D,UAAM,MAAM,MAAM,KAAK,OAAO,gBAAgB,UAAU;AACxD,UAAM,KAAK,YAAY,SAAS;AAChC,UAAM,SAAS,eAAe,WAAW,KAAK,EAAE;AAChD,UAAM,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,SAAS,GAAG,OAAO,MAAM,CAAC,CAAC;AACrE,UAAM,MAAM,OAAO,WAAW;AAC9B,UAAM,SAAS,OAAO,MAAM,aAAa;AACzC,WAAO,cAAc,mBAAmB,CAAC;AACzC,WAAO,cAAc,YAAY,CAAC;AAClC,WAAO,OAAO,OAAO,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC;AAAA,EAC9C;AAAA,EAEA,MAAM,QAAQ,gBAAwB,YAAqC;AACzE,QAAI,WAAW,SAAS,gBAAgB,YAAY,YAAY;AAC9D,YAAM,IAAI,qBAAqB,wBAAwB,8CAA8C;AAAA,IACvG;AACA,UAAM,gBAAgB,WAAW,aAAa,CAAC;AAC/C,QAAI,kBAAkB,mBAAmB;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,uCAAuC,aAAa;AAAA,MACtD;AAAA,IACF;AACA,UAAM,aAAa,WAAW,aAAa,CAAC;AAC5C,UAAM,KAAK,WAAW,SAAS,eAAe,gBAAgB,SAAS;AACvE,UAAM,MAAM,WAAW,SAAS,WAAW,SAAS,UAAU;AAC9D,UAAM,OAAO,WAAW,SAAS,gBAAgB,WAAW,WAAW,SAAS,UAAU;AAC1F,UAAM,MAAM,MAAM,KAAK,OAAO,gBAAgB,UAAU;AACxD,UAAM,WAAW,iBAAiB,WAAW,KAAK,EAAE;AACpD,aAAS,WAAW,GAAG;AACvB,QAAI;AACF,aAAO,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,GAAG,SAAS,MAAM,CAAC,CAAC;AAAA,IAChE,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,IAAI,qBAAqB,qBAAqB,+BAA+B,OAAO,EAAE;AAAA,IAC9F;AAAA,EACF;AAAA,EAEA,MAAM,kBAAkB,gBAAyC;AAC/D,UAAM,SAAS,KAAK,oBAAoB,IAAI,cAAc;AAC1D,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA,EAAE,gBAAgB,WAAW,KAAK;AAAA,MAClC,EAAE,SAAS,EAAE,YAAY,OAAO,EAAE;AAAA,IACpC;AACA,QAAI,QAAQ;AACV,WAAK,oBAAoB,IAAI,gBAAgB,OAAO,UAAU;AAC9D,aAAO,OAAO;AAAA,IAChB;AACA,UAAM,UAAU,MAAM,KAAK,iBAAiB,IAAI,cAAc;AAC9D,SAAK,oBAAoB,IAAI,gBAAgB,QAAQ,UAAU;AAC/D,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,OAAO,gBAAyC;AACpD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,UAAU,MAAM,GAAG;AAAA,MACvB;AAAA,MACA,EAAE,gBAAgB,WAAW,KAAK;AAAA,MAClC,EAAE,SAAS,EAAE,YAAY,OAAO,EAAE;AAAA,IACpC;AACA,UAAM,eAAe,SAAS,cAAc,KAAK;AACjD,UAAM,MAAM,YAAY,UAAU;AAClC,UAAM,UAAU,MAAM,KAAK,IAAI,KAAK,GAAG;AACvC,UAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,MAC1C;AAAA,MACA,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,WAAW,IAAI,KAAK,KAAK,IAAI,CAAC;AAAA,IAChC,CAAC;AACD,QAAI,SAAS;AACX,cAAQ,YAAY,IAAI,KAAK,KAAK,IAAI,CAAC;AAAA,IACzC;AACA,OAAG,QAAQ,KAAK;AAChB,QAAI,QAAS,IAAG,QAAQ,OAAO;AAC/B,UAAM,GAAG,MAAM;AACf,SAAK,oBAAoB,IAAI,gBAAgB,WAAW;AACxD,SAAK,SAAS,KAAK,YAAY,gBAAgB,WAAW,GAAG,GAAG;AAChE,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAmB;AACjB,SAAK,SAAS,MAAM;AACpB,SAAK,oBAAoB,MAAM;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,iBACZ,IACA,gBAC6B;AAC7B,UAAM,MAAM,YAAY,UAAU;AAClC,UAAM,UAAU,MAAM,KAAK,IAAI,KAAK,GAAG;AACvC,UAAM,MAAM,GAAG,OAAO,oBAAoB;AAAA,MACxC;AAAA,MACA,YAAY;AAAA,MACZ,YAAY;AAAA,MACZ,WAAW,IAAI,KAAK,KAAK,IAAI,CAAC;AAAA,IAChC,CAAC;AACD,OAAG,QAAQ,GAAG;AACd,UAAM,GAAG,MAAM;AACf,SAAK,SAAS,KAAK,YAAY,gBAAgB,CAAC,GAAG,GAAG;AACtD,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,OAAO,gBAAwB,YAAqC;AAChF,UAAM,WAAW,KAAK,YAAY,gBAAgB,UAAU;AAC5D,UAAM,SAAS,KAAK,SAAS,IAAI,QAAQ;AACzC,QAAI,UAAU,OAAO,YAAY,KAAK,IAAI,GAAG;AAE3C,WAAK,SAAS,OAAO,QAAQ;AAC7B,WAAK,SAAS,IAAI,UAAU,MAAM;AAClC,aAAO,OAAO;AAAA,IAChB;AACA,QAAI,OAAQ,MAAK,SAAS,OAAO,QAAQ;AACzC,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,MAAM,MAAM,GAAG,QAAQ,oBAAoB,EAAE,gBAAgB,WAAW,CAAC;AAC/E,QAAI,CAAC,KAAK;AACR,YAAM,IAAI;AAAA,QACR;AAAA,QACA,6CAA6C,cAAc,YAAY,UAAU;AAAA,MACnF;AAAA,IACF;AACA,UAAM,UAAU,aAAa,IAAI,UAAU;AAC3C,UAAM,MAAM,MAAM,KAAK,IAAI,OAAO,OAAO;AACzC,SAAK,SAAS,UAAU,GAAG;AAC3B,WAAO;AAAA,EACT;AAAA,EAEQ,YAAY,gBAAwB,YAA4B;AACtE,WAAO,GAAG,cAAc,IAAI,UAAU;AAAA,EACxC;AAAA,EAEQ,SAAS,UAAkB,KAAmB;AACpD,WAAO,KAAK,SAAS,QAAQ,KAAK,UAAU;AAC1C,YAAM,SAAS,KAAK,SAAS,KAAK,EAAE,KAAK,EAAE;AAC3C,UAAI,CAAC,OAAQ;AACb,WAAK,SAAS,OAAO,MAAM;AAAA,IAC7B;AACA,SAAK,SAAS,IAAI,UAAU,EAAE,KAAK,WAAW,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AAAA,EAC9E;AACF;AAEA,SAAS,aAAa,OAA6C;AACjE,MAAI,OAAO,SAAS,KAAK,EAAG,QAAO;AACnC,MAAI,iBAAiB,WAAY,QAAO,OAAO,KAAK,KAAK;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,OAAO,QAAQ;AACjE,QAAM,IAAI,qBAAqB,4BAA4B,6CAA6C;AAC1G;AAUO,SAAS,gBACd,UACA,SACyB;AACzB,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAM,aAAa,SAAS,WAAW,GAAG;AAC1C,QAAI,YAAY,WAAW;AACzB,UAAI,GAAG,IAAI;AAAA,IACb,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/services/export-service.js

@@ -0,0 +1,210 @@
+var _a, _b;
+import {
+  Form,
+  FormAttachment,
+  FormSubmission,
+  FormSubmissionRevision,
+  FormVersion
+} from "../data/entities.js";
+import { SIGNATURE_TYPE_KEY } from "../schema/signature-field.js";
+const EXPORT_DOCUMENT_VERSION = "1";
+const EXPORT_SERVICE_ERROR_MARKER = /* @__PURE__ */ Symbol.for("@open-mercato/forms/ExportServiceError");
+class ExportServiceError extends (_b = Error, _a = EXPORT_SERVICE_ERROR_MARKER, _b) {
+  constructor(message) {
+    super(message);
+    this[_a] = true;
+    this.code = "SUBMISSION_NOT_FOUND";
+    this.name = "ExportServiceError";
+  }
+}
+function resolveLabel(descriptor, schema, fieldKey, locale) {
+  const properties = schema?.properties ?? null;
+  const node = properties && typeof properties[fieldKey] === "object" ? properties[fieldKey] : null;
+  const labelMap = node?.["x-om-label"];
+  if (labelMap && typeof labelMap === "object" && !Array.isArray(labelMap)) {
+    const map = labelMap;
+    const localized = map[locale] ?? map.en;
+    if (typeof localized === "string" && localized.length > 0) return localized;
+    const first = Object.values(map).find((value) => typeof value === "string" && value.length > 0);
+    if (typeof first === "string") return first;
+  }
+  if (descriptor) return descriptor.key;
+  return fieldKey;
+}
+class ExportService {
+  constructor(options) {
+    this.emFactory = options.emFactory;
+    this.compiler = options.compiler;
+    this.encryption = options.encryption;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /**
+   * Build the full per-subject export. Returns the document plus the list of
+   * accessed submission ids so the caller can write one audit row per
+   * submission read.
+   */
+  async exportSubject(args) {
+    const em = this.emFactory();
+    const submissions = await em.find(
+      FormSubmission,
+      {
+        organizationId: args.organizationId,
+        tenantId: args.tenantId,
+        subjectType: args.subjectType,
+        subjectId: args.subjectId,
+        deletedAt: null
+      },
+      { orderBy: { firstSavedAt: "asc" } }
+    );
+    const exported = [];
+    for (const submission of submissions) {
+      exported.push(await this.buildSubmission(em, submission, args));
+    }
+    const document = {
+      exportVersion: EXPORT_DOCUMENT_VERSION,
+      generatedAt: this.now().toISOString(),
+      subjectType: args.subjectType,
+      subjectId: args.subjectId,
+      organizationId: args.organizationId,
+      submissionCount: exported.length,
+      submissions: exported
+    };
+    return { document, submissionIds: exported.map((entry) => entry.submissionId) };
+  }
+  /** Build a single-submission export (scoped). */
+  async exportSubmission(args) {
+    const em = this.emFactory();
+    const submission = await em.findOne(FormSubmission, {
+      id: args.submissionId,
+      organizationId: args.organizationId,
+      tenantId: args.tenantId,
+      deletedAt: null
+    });
+    if (!submission) {
+      throw new ExportServiceError("Submission not found.");
+    }
+    const document = await this.buildSubmission(em, submission, args);
+    return { document, submissionIds: [submission.id] };
+  }
+  async buildSubmission(em, submission, scope) {
+    const formVersion = await em.findOne(FormVersion, {
+      id: submission.formVersionId,
+      organizationId: scope.organizationId,
+      tenantId: scope.tenantId
+    });
+    const form = formVersion ? await em.findOne(Form, {
+      id: formVersion.formId,
+      organizationId: scope.organizationId,
+      tenantId: scope.tenantId
+    }) : null;
+    const locale = scope.locale ?? form?.defaultLocale ?? "en";
+    const revision = submission.currentRevisionId ? await em.findOne(FormSubmissionRevision, {
+      id: submission.currentRevisionId,
+      submissionId: submission.id,
+      organizationId: scope.organizationId
+    }) : null;
+    const decoded = revision ? await this.decodeRevision(scope.organizationId, revision) : {};
+    const compiled = formVersion ? this.compiler.compile({
+      id: formVersion.id,
+      updatedAt: formVersion.updatedAt,
+      schema: formVersion.schema,
+      uiSchema: formVersion.uiSchema
+    }) : null;
+    const fieldIndex = compiled?.fieldIndex ?? {};
+    const schema = formVersion?.schema ?? null;
+    const answers = [];
+    for (const [fieldKey, value] of Object.entries(decoded)) {
+      const descriptor = fieldIndex[fieldKey];
+      const type = descriptor?.type ?? "unknown";
+      const answer = {
+        fieldKey,
+        label: resolveLabel(descriptor, schema, fieldKey, locale),
+        type,
+        sensitive: descriptor?.sensitive ?? false,
+        value
+      };
+      if (type === SIGNATURE_TYPE_KEY) {
+        answer.signature = extractSignatureMeta(value);
+        answer.value = redactSignatureValue(value);
+      }
+      answers.push(answer);
+    }
+    const attachments = await em.find(FormAttachment, {
+      submissionId: submission.id,
+      organizationId: scope.organizationId,
+      removedAt: null
+    });
+    return {
+      submissionId: submission.id,
+      formKey: form?.key ?? "",
+      formName: form?.name ?? "",
+      formVersionId: submission.formVersionId,
+      versionNumber: formVersion?.versionNumber ?? 0,
+      status: submission.status,
+      subjectType: submission.subjectType,
+      subjectId: submission.subjectId,
+      startedAt: submission.firstSavedAt ? submission.firstSavedAt.toISOString() : null,
+      submittedAt: submission.submittedAt ? submission.submittedAt.toISOString() : null,
+      updatedAt: submission.updatedAt.toISOString(),
+      anonymizedAt: submission.anonymizedAt ? submission.anonymizedAt.toISOString() : null,
+      currentRevisionId: submission.currentRevisionId ?? null,
+      currentRevisionNumber: revision?.revisionNumber ?? null,
+      answers,
+      attachments: attachments.map((attachment) => ({
+        attachmentId: attachment.id,
+        fieldKey: attachment.fieldKey,
+        kind: attachment.kind,
+        filename: attachment.filename ?? null,
+        contentType: attachment.contentType ?? null,
+        sizeBytes: attachment.sizeBytes ?? null
+      }))
+    };
+  }
+  async decodeRevision(organizationId, revision) {
+    const ciphertext = ensureBuffer(revision.data);
+    if (ciphertext.length === 0) return {};
+    const plain = await this.encryption.decrypt(organizationId, ciphertext);
+    if (plain.length === 0) return {};
+    try {
+      const parsed = JSON.parse(plain.toString("utf8"));
+      return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    } catch {
+      return {};
+    }
+  }
+}
+function ensureBuffer(value) {
+  if (Buffer.isBuffer(value)) return value;
+  if (value instanceof Uint8Array) return Buffer.from(value);
+  if (typeof value === "string") return Buffer.from(value, "binary");
+  return Buffer.alloc(0);
+}
+function extractSignatureMeta(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { mode: null, signedAt: null, clauseSha256: null, typedName: null, hasImage: false };
+  }
+  const candidate = value;
+  return {
+    mode: typeof candidate.mode === "string" ? candidate.mode : null,
+    signedAt: typeof candidate.signedAt === "string" ? candidate.signedAt : null,
+    clauseSha256: typeof candidate.clauseSha256 === "string" ? candidate.clauseSha256 : null,
+    typedName: typeof candidate.typedName === "string" ? candidate.typedName : null,
+    hasImage: typeof candidate.image === "string" && candidate.image.length > 0
+  };
+}
+function redactSignatureValue(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  const candidate = value;
+  if (!("image" in candidate)) return value;
+  const { image: _image, ...rest } = candidate;
+  return rest;
+}
+function isExportServiceError(error) {
+  return typeof error === "object" && error !== null && EXPORT_SERVICE_ERROR_MARKER in error;
+}
+export {
+  ExportService,
+  ExportServiceError,
+  isExportServiceError
+};
+//# sourceMappingURL=export-service.js.map

package/dist/modules/forms/services/export-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/export-service.ts"],
+  "sourcesContent": ["/**\n * W5 (DP-5) \u2014 GDPR data-subject export (Art. 15 access / Art. 20 portability).\n *\n * Builds a structured, machine-readable JSON document for a data subject (a\n * `(subjectType, subjectId)` pair) or a single submission. The document\n * contains, per submission: the form key/name, the pinned version number,\n * status + lifecycle timestamps, and the DECRYPTED current-revision answers\n * keyed by field with human labels and types pulled from the compiled\n * `fieldIndex`. Signature answers contribute structured metadata (signed-at,\n * consent-clause SHA, mode) rather than the raw image blob. Large\n * blobs / uploads are referenced by attachment id, never inlined.\n *\n * This is a FULL data-subject export \u2014 it is NOT role-sliced. The caller is\n * responsible for the `forms.submissions.export` feature gate + audit row.\n *\n * Tenant isolation: every read is scoped by `organizationId` + `tenantId`.\n */\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  Form,\n  FormAttachment,\n  FormSubmission,\n  FormSubmissionRevision,\n  FormVersion,\n} from '../data/entities'\nimport type { EncryptionService } from './encryption-service'\nimport type { FormVersionCompiler, FieldDescriptor } from './form-version-compiler'\nimport { SIGNATURE_TYPE_KEY } from '../schema/signature-field'\n\nconst EXPORT_DOCUMENT_VERSION = '1' as const\n\ntype Scope = {\n  organizationId: string\n  tenantId: string\n}\n\n/**\n * `Symbol.for` so the brand survives module duplication across bundle\n * boundaries. `instanceof` does NOT: Next can load this module in more than\n * one chunk, and once a second copy of the class exists an error thrown\n * through one copy fails `instanceof` against the other \u2014 silently\n * downgrading a mapped domain error to a 500. Mirrors `CrudHttpError`.\n */\nconst EXPORT_SERVICE_ERROR_MARKER = Symbol.for('@open-mercato/forms/ExportServiceError')\n\nexport class ExportServiceError extends Error {\n  readonly [EXPORT_SERVICE_ERROR_MARKER] = true\n  readonly code: 'SUBMISSION_NOT_FOUND'\n  constructor(message: string) {\n    super(message)\n    this.code = 'SUBMISSION_NOT_FOUND'\n    this.name = 'ExportServiceError'\n  }\n}\n\n/** Locale-resolved label for a field, falling back through the field key. */\nfunction resolveLabel(\n  descriptor: FieldDescriptor | undefined,\n  schema: Record<string, unknown> | null,\n  fieldKey: string,\n  locale: string,\n): string {\n  const properties = (schema?.properties ?? null) as Record<string, unknown> | null\n  const node = properties && typeof properties[fieldKey] === 'object'\n    ? (properties[fieldKey] as Record<string, unknown>)\n    : null\n  const labelMap = node?.['x-om-label']\n  if (labelMap && typeof labelMap === 'object' && !Array.isArray(labelMap)) {\n    const map = labelMap as Record<string, unknown>\n    const localized = map[locale] ?? map.en\n    if (typeof localized === 'string' && localized.length > 0) return localized\n    const first = Object.values(map).find((value) => typeof value === 'string' && value.length > 0)\n    if (typeof first === 'string') return first\n  }\n  if (descriptor) return descriptor.key\n  return fieldKey\n}\n\n/** Signature metadata surfaced in the export (no raw image blob). */\nexport type ExportedSignatureMeta = {\n  mode: string | null\n  signedAt: string | null\n  clauseSha256: string | null\n  typedName: string | null\n  hasImage: boolean\n}\n\nexport type ExportedAnswer = {\n  fieldKey: string\n  label: string\n  type: string\n  sensitive: boolean\n  /**\n   * The decrypted answer value. For signature fields the raw image data URL\n   * is stripped \u2014 `signature` carries the structured metadata instead.\n   */\n  value: unknown\n  signature?: ExportedSignatureMeta\n}\n\nexport type ExportedSubmission = {\n  submissionId: string\n  formKey: string\n  formName: string\n  formVersionId: string\n  versionNumber: number\n  status: string\n  subjectType: string\n  subjectId: string\n  startedAt: string | null\n  submittedAt: string | null\n  updatedAt: string\n  anonymizedAt: string | null\n  currentRevisionId: string | null\n  currentRevisionNumber: number | null\n  answers: ExportedAnswer[]\n  /** PDF / upload artifacts referenced by id \u2014 never inlined. */\n  attachments: ExportedAttachmentRef[]\n}\n\nexport type ExportedAttachmentRef = {\n  attachmentId: string\n  fieldKey: string\n  kind: string\n  filename: string | null\n  contentType: string | null\n  sizeBytes: number | null\n}\n\nexport type DataSubjectExportDocument = {\n  exportVersion: typeof EXPORT_DOCUMENT_VERSION\n  generatedAt: string\n  subjectType: string\n  subjectId: string\n  organizationId: string\n  submissionCount: number\n  submissions: ExportedSubmission[]\n}\n\nexport type ExportServiceOptions = {\n  emFactory: () => EntityManager\n  compiler: FormVersionCompiler\n  encryption: EncryptionService\n  now?: () => Date\n}\n\nexport class ExportService {\n  private readonly emFactory: () => EntityManager\n  private readonly compiler: FormVersionCompiler\n  private readonly encryption: EncryptionService\n  private readonly now: () => Date\n\n  constructor(options: ExportServiceOptions) {\n    this.emFactory = options.emFactory\n    this.compiler = options.compiler\n    this.encryption = options.encryption\n    this.now = options.now ?? (() => new Date())\n  }\n\n  /**\n   * Build the full per-subject export. Returns the document plus the list of\n   * accessed submission ids so the caller can write one audit row per\n   * submission read.\n   */\n  async exportSubject(\n    args: Scope & { subjectType: string; subjectId: string; locale?: string },\n  ): Promise<{ document: DataSubjectExportDocument; submissionIds: string[] }> {\n    const em = this.emFactory()\n    const submissions = await em.find(\n      FormSubmission,\n      {\n        organizationId: args.organizationId,\n        tenantId: args.tenantId,\n        subjectType: args.subjectType,\n        subjectId: args.subjectId,\n        deletedAt: null,\n      },\n      { orderBy: { firstSavedAt: 'asc' } },\n    )\n\n    const exported: ExportedSubmission[] = []\n    for (const submission of submissions) {\n      exported.push(await this.buildSubmission(em, submission, args))\n    }\n\n    const document: DataSubjectExportDocument = {\n      exportVersion: EXPORT_DOCUMENT_VERSION,\n      generatedAt: this.now().toISOString(),\n      subjectType: args.subjectType,\n      subjectId: args.subjectId,\n      organizationId: args.organizationId,\n      submissionCount: exported.length,\n      submissions: exported,\n    }\n    return { document, submissionIds: exported.map((entry) => entry.submissionId) }\n  }\n\n  /** Build a single-submission export (scoped). */\n  async exportSubmission(\n    args: Scope & { submissionId: string; locale?: string },\n  ): Promise<{ document: ExportedSubmission; submissionIds: string[] }> {\n    const em = this.emFactory()\n    const submission = await em.findOne(FormSubmission, {\n      id: args.submissionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    })\n    if (!submission) {\n      throw new ExportServiceError('Submission not found.')\n    }\n    const document = await this.buildSubmission(em, submission, args)\n    return { document, submissionIds: [submission.id] }\n  }\n\n  private async buildSubmission(\n    em: EntityManager,\n    submission: FormSubmission,\n    scope: Scope & { locale?: string },\n  ): Promise<ExportedSubmission> {\n    const formVersion = await em.findOne(FormVersion, {\n      id: submission.formVersionId,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    })\n    const form = formVersion\n      ? await em.findOne(Form, {\n          id: formVersion.formId,\n          organizationId: scope.organizationId,\n          tenantId: scope.tenantId,\n        })\n      : null\n    const locale = scope.locale ?? form?.defaultLocale ?? 'en'\n\n    const revision = submission.currentRevisionId\n      ? await em.findOne(FormSubmissionRevision, {\n          id: submission.currentRevisionId,\n          submissionId: submission.id,\n          organizationId: scope.organizationId,\n        })\n      : null\n\n    const decoded = revision ? await this.decodeRevision(scope.organizationId, revision) : {}\n\n    const compiled = formVersion\n      ? this.compiler.compile({\n          id: formVersion.id,\n          updatedAt: formVersion.updatedAt,\n          schema: formVersion.schema,\n          uiSchema: formVersion.uiSchema,\n        })\n      : null\n    const fieldIndex = compiled?.fieldIndex ?? {}\n    const schema = (formVersion?.schema ?? null) as Record<string, unknown> | null\n\n    const answers: ExportedAnswer[] = []\n    for (const [fieldKey, value] of Object.entries(decoded)) {\n      const descriptor = fieldIndex[fieldKey]\n      const type = descriptor?.type ?? 'unknown'\n      const answer: ExportedAnswer = {\n        fieldKey,\n        label: resolveLabel(descriptor, schema, fieldKey, locale),\n        type,\n        sensitive: descriptor?.sensitive ?? false,\n        value,\n      }\n      if (type === SIGNATURE_TYPE_KEY) {\n        answer.signature = extractSignatureMeta(value)\n        answer.value = redactSignatureValue(value)\n      }\n      answers.push(answer)\n    }\n\n    const attachments = await em.find(FormAttachment, {\n      submissionId: submission.id,\n      organizationId: scope.organizationId,\n      removedAt: null,\n    })\n\n    return {\n      submissionId: submission.id,\n      formKey: form?.key ?? '',\n      formName: form?.name ?? '',\n      formVersionId: submission.formVersionId,\n      versionNumber: formVersion?.versionNumber ?? 0,\n      status: submission.status,\n      subjectType: submission.subjectType,\n      subjectId: submission.subjectId,\n      startedAt: submission.firstSavedAt ? submission.firstSavedAt.toISOString() : null,\n      submittedAt: submission.submittedAt ? submission.submittedAt.toISOString() : null,\n      updatedAt: submission.updatedAt.toISOString(),\n      anonymizedAt: submission.anonymizedAt ? submission.anonymizedAt.toISOString() : null,\n      currentRevisionId: submission.currentRevisionId ?? null,\n      currentRevisionNumber: revision?.revisionNumber ?? null,\n      answers,\n      attachments: attachments.map((attachment) => ({\n        attachmentId: attachment.id,\n        fieldKey: attachment.fieldKey,\n        kind: attachment.kind,\n        filename: attachment.filename ?? null,\n        contentType: attachment.contentType ?? null,\n        sizeBytes: attachment.sizeBytes ?? null,\n      })),\n    }\n  }\n\n  private async decodeRevision(\n    organizationId: string,\n    revision: FormSubmissionRevision,\n  ): Promise<Record<string, unknown>> {\n    const ciphertext = ensureBuffer(revision.data)\n    if (ciphertext.length === 0) return {}\n    const plain = await this.encryption.decrypt(organizationId, ciphertext)\n    if (plain.length === 0) return {}\n    try {\n      const parsed = JSON.parse(plain.toString('utf8'))\n      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)\n        ? (parsed as Record<string, unknown>)\n        : {}\n    } catch {\n      return {}\n    }\n  }\n}\n\nfunction ensureBuffer(value: Buffer | Uint8Array | string): Buffer {\n  if (Buffer.isBuffer(value)) return value\n  if (value instanceof Uint8Array) return Buffer.from(value)\n  if (typeof value === 'string') return Buffer.from(value, 'binary')\n  return Buffer.alloc(0)\n}\n\nfunction extractSignatureMeta(value: unknown): ExportedSignatureMeta {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    return { mode: null, signedAt: null, clauseSha256: null, typedName: null, hasImage: false }\n  }\n  const candidate = value as Record<string, unknown>\n  return {\n    mode: typeof candidate.mode === 'string' ? candidate.mode : null,\n    signedAt: typeof candidate.signedAt === 'string' ? candidate.signedAt : null,\n    clauseSha256: typeof candidate.clauseSha256 === 'string' ? candidate.clauseSha256 : null,\n    typedName: typeof candidate.typedName === 'string' ? candidate.typedName : null,\n    hasImage: typeof candidate.image === 'string' && candidate.image.length > 0,\n  }\n}\n\n/** Strip the large data-URL image from a signature value; keep the rest. */\nfunction redactSignatureValue(value: unknown): unknown {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return value\n  const candidate = value as Record<string, unknown>\n  if (!('image' in candidate)) return value\n  const { image: _image, ...rest } = candidate\n  return rest\n}\n\n/** Brand check for ExportServiceError \u2014 use instead of `instanceof`. */\nexport function isExportServiceError(error: unknown): error is ExportServiceError {\n  return typeof error === 'object' && error !== null && (EXPORT_SERVICE_ERROR_MARKER in error)\n}\n"],
+  "mappings": "AAAA;AAmBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,0BAA0B;AAEnC,MAAM,0BAA0B;AAchC,MAAM,8BAA8B,uBAAO,IAAI,wCAAwC;AAEhF,MAAM,4BAA2B,YAC5B,kCAD4B,IAAM;AAAA,EAG5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AAHf,SAAU,MAA+B;AAIvC,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAGA,SAAS,aACP,YACA,QACA,UACA,QACQ;AACR,QAAM,aAAc,QAAQ,cAAc;AAC1C,QAAM,OAAO,cAAc,OAAO,WAAW,QAAQ,MAAM,WACtD,WAAW,QAAQ,IACpB;AACJ,QAAM,WAAW,OAAO,YAAY;AACpC,MAAI,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GAAG;AACxE,UAAM,MAAM;AACZ,UAAM,YAAY,IAAI,MAAM,KAAK,IAAI;AACrC,QAAI,OAAO,cAAc,YAAY,UAAU,SAAS,EAAG,QAAO;AAClE,UAAM,QAAQ,OAAO,OAAO,GAAG,EAAE,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAC9F,QAAI,OAAO,UAAU,SAAU,QAAO;AAAA,EACxC;AACA,MAAI,WAAY,QAAO,WAAW;AAClC,SAAO;AACT;AAsEO,MAAM,cAAc;AAAA,EAMzB,YAAY,SAA+B;AACzC,SAAK,YAAY,QAAQ;AACzB,SAAK,WAAW,QAAQ;AACxB,SAAK,aAAa,QAAQ;AAC1B,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cACJ,MAC2E;AAC3E,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,cAAc,MAAM,GAAG;AAAA,MAC3B;AAAA,MACA;AAAA,QACE,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,cAAc,MAAM,EAAE;AAAA,IACrC;AAEA,UAAM,WAAiC,CAAC;AACxC,eAAW,cAAc,aAAa;AACpC,eAAS,KAAK,MAAM,KAAK,gBAAgB,IAAI,YAAY,IAAI,CAAC;AAAA,IAChE;AAEA,UAAM,WAAsC;AAAA,MAC1C,eAAe;AAAA,MACf,aAAa,KAAK,IAAI,EAAE,YAAY;AAAA,MACpC,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,gBAAgB,KAAK;AAAA,MACrB,iBAAiB,SAAS;AAAA,MAC1B,aAAa;AAAA,IACf;AACA,WAAO,EAAE,UAAU,eAAe,SAAS,IAAI,CAAC,UAAU,MAAM,YAAY,EAAE;AAAA,EAChF;AAAA;AAAA,EAGA,MAAM,iBACJ,MACoE;AACpE,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,mBAAmB,uBAAuB;AAAA,IACtD;AACA,UAAM,WAAW,MAAM,KAAK,gBAAgB,IAAI,YAAY,IAAI;AAChE,WAAO,EAAE,UAAU,eAAe,CAAC,WAAW,EAAE,EAAE;AAAA,EACpD;AAAA,EAEA,MAAc,gBACZ,IACA,YACA,OAC6B;AAC7B,UAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,MAChD,IAAI,WAAW;AAAA,MACf,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,UAAM,OAAO,cACT,MAAM,GAAG,QAAQ,MAAM;AAAA,MACrB,IAAI,YAAY;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB,CAAC,IACD;AACJ,UAAM,SAAS,MAAM,UAAU,MAAM,iBAAiB;AAEtD,UAAM,WAAW,WAAW,oBACxB,MAAM,GAAG,QAAQ,wBAAwB;AAAA,MACvC,IAAI,WAAW;AAAA,MACf,cAAc,WAAW;AAAA,MACzB,gBAAgB,MAAM;AAAA,IACxB,CAAC,IACD;AAEJ,UAAM,UAAU,WAAW,MAAM,KAAK,eAAe,MAAM,gBAAgB,QAAQ,IAAI,CAAC;AAExF,UAAM,WAAW,cACb,KAAK,SAAS,QAAQ;AAAA,MACpB,IAAI,YAAY;AAAA,MAChB,WAAW,YAAY;AAAA,MACvB,QAAQ,YAAY;AAAA,MACpB,UAAU,YAAY;AAAA,IACxB,CAAC,IACD;AACJ,UAAM,aAAa,UAAU,cAAc,CAAC;AAC5C,UAAM,SAAU,aAAa,UAAU;AAEvC,UAAM,UAA4B,CAAC;AACnC,eAAW,CAAC,UAAU,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACvD,YAAM,aAAa,WAAW,QAAQ;AACtC,YAAM,OAAO,YAAY,QAAQ;AACjC,YAAM,SAAyB;AAAA,QAC7B;AAAA,QACA,OAAO,aAAa,YAAY,QAAQ,UAAU,MAAM;AAAA,QACxD;AAAA,QACA,WAAW,YAAY,aAAa;AAAA,QACpC;AAAA,MACF;AACA,UAAI,SAAS,oBAAoB;AAC/B,eAAO,YAAY,qBAAqB,KAAK;AAC7C,eAAO,QAAQ,qBAAqB,KAAK;AAAA,MAC3C;AACA,cAAQ,KAAK,MAAM;AAAA,IACrB;AAEA,UAAM,cAAc,MAAM,GAAG,KAAK,gBAAgB;AAAA,MAChD,cAAc,WAAW;AAAA,MACzB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb,CAAC;AAED,WAAO;AAAA,MACL,cAAc,WAAW;AAAA,MACzB,SAAS,MAAM,OAAO;AAAA,MACtB,UAAU,MAAM,QAAQ;AAAA,MACxB,eAAe,WAAW;AAAA,MAC1B,eAAe,aAAa,iBAAiB;AAAA,MAC7C,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,WAAW,WAAW,eAAe,WAAW,aAAa,YAAY,IAAI;AAAA,MAC7E,aAAa,WAAW,cAAc,WAAW,YAAY,YAAY,IAAI;AAAA,MAC7E,WAAW,WAAW,UAAU,YAAY;AAAA,MAC5C,cAAc,WAAW,eAAe,WAAW,aAAa,YAAY,IAAI;AAAA,MAChF,mBAAmB,WAAW,qBAAqB;AAAA,MACnD,uBAAuB,UAAU,kBAAkB;AAAA,MACnD;AAAA,MACA,aAAa,YAAY,IAAI,CAAC,gBAAgB;AAAA,QAC5C,cAAc,WAAW;AAAA,QACzB,UAAU,WAAW;AAAA,QACrB,MAAM,WAAW;AAAA,QACjB,UAAU,WAAW,YAAY;AAAA,QACjC,aAAa,WAAW,eAAe;AAAA,QACvC,WAAW,WAAW,aAAa;AAAA,MACrC,EAAE;AAAA,IACJ;AAAA,EACF;AAAA,EAEA,MAAc,eACZ,gBACA,UACkC;AAClC,UAAM,aAAa,aAAa,SAAS,IAAI;AAC7C,QAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AACrC,UAAM,QAAQ,MAAM,KAAK,WAAW,QAAQ,gBAAgB,UAAU;AACtE,QAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;AAChD,aAAO,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,IAC/D,SACD,CAAC;AAAA,IACP,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AAEA,SAAS,aAAa,OAA6C;AACjE,MAAI,OAAO,SAAS,KAAK,EAAG,QAAO;AACnC,MAAI,iBAAiB,WAAY,QAAO,OAAO,KAAK,KAAK;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,OAAO,QAAQ;AACjE,SAAO,OAAO,MAAM,CAAC;AACvB;AAEA,SAAS,qBAAqB,OAAuC;AACnE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAC/D,WAAO,EAAE,MAAM,MAAM,UAAU,MAAM,cAAc,MAAM,WAAW,MAAM,UAAU,MAAM;AAAA,EAC5F;AACA,QAAM,YAAY;AAClB,SAAO;AAAA,IACL,MAAM,OAAO,UAAU,SAAS,WAAW,UAAU,OAAO;AAAA,IAC5D,UAAU,OAAO,UAAU,aAAa,WAAW,UAAU,WAAW;AAAA,IACxE,cAAc,OAAO,UAAU,iBAAiB,WAAW,UAAU,eAAe;AAAA,IACpF,WAAW,OAAO,UAAU,cAAc,WAAW,UAAU,YAAY;AAAA,IAC3E,UAAU,OAAO,UAAU,UAAU,YAAY,UAAU,MAAM,SAAS;AAAA,EAC5E;AACF;AAGA,SAAS,qBAAqB,OAAyB;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY;AAClB,MAAI,EAAE,WAAW,WAAY,QAAO;AACpC,QAAM,EAAE,OAAO,QAAQ,GAAG,KAAK,IAAI;AACnC,SAAO;AACT;AAGO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,+BAA+B;AACxF;",
+  "names": []
+}