@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/forms/services/submission-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/submission-service.ts"],
+  "sourcesContent": ["/**\n * Forms module SubmissionService \u2014 owns the start/save/submit lifecycle.\n *\n * Critical invariants enforced here:\n *  - Append-only revision chain (only allowed UPDATE paths are anonymize\n *    in phase 2b and the coalesce-after-cap branch in this file).\n *  - Tenant-scoped queries on every read/write.\n *  - Server-derived `saved_by_role` from active actor row \u2014 never read from\n *    client input.\n *  - Optimistic concurrency via `base_revision_id`.\n *  - Tampering markers logged when patches contain non-editable field keys.\n *  - Per-tenant envelope encryption of revision payloads.\n *\n * The service is intentionally thin on cross-cutting concerns: emit hooks\n * are exposed via `eventEmitter` and pluggable audit-access logger\n * (`auditAccess`) so phase 2b can replace it without rewriting the service.\n */\n\nimport { randomUUID } from 'node:crypto'\nimport { LockMode } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport {\n  Form,\n  FormSubmission,\n  FormSubmissionActor,\n  FormSubmissionRevision,\n  FormVersion,\n} from '../data/entities'\nimport {\n  FormVersionCompiler,\n  type CompiledFormVersion,\n} from './form-version-compiler'\nimport type { EncryptionService } from './encryption-service'\nimport { RolePolicyService } from './role-policy-service'\nimport {\n  resolveVisibleFieldKeys,\n  sliceByVisibility,\n  type VisibilitySchemaNode,\n} from './visibility-resolver'\nimport { buildTamperingMarker, type StructuredLogger } from '../lib/log-redaction'\nimport { formsEventPayloadSchemas } from '../events-payloads'\nimport { validateFieldValue } from './field-validation-service'\nimport type { FieldNode } from '../backend/forms/[id]/studio/schema-helpers'\n\nconst DEFAULT_AUTOSAVE_INTERVAL_MS = (() => {\n  const raw = process.env.FORMS_AUTOSAVE_INTERVAL_MS\n  if (!raw) return 10_000\n  const parsed = Number.parseInt(raw, 10)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : 10_000\n})()\n\nconst DEFAULT_REVISION_CAP = (() => {\n  const raw = process.env.FORMS_REVISION_CAP\n  if (!raw) return 10_000\n  const parsed = Number.parseInt(raw, 10)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : 10_000\n})()\n\nconst MAX_SUBMISSION_PAYLOAD_BYTES = (() => {\n  const raw = process.env.FORMS_MAX_SUBMISSION_PAYLOAD_BYTES\n  if (!raw) return 256 * 1024\n  const parsed = Number.parseInt(raw, 10)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : 256 * 1024\n})()\n\nexport type SubmissionServiceErrorCode =\n  | 'STALE_BASE'\n  | 'VALIDATION_FAILED'\n  | 'RATE_LIMITED'\n  | 'NOT_FOUND'\n  | 'NO_ACTOR'\n  | 'INVALID_STATUS'\n  | 'INVALID_ROLE'\n  | 'FORM_INACTIVE'\n  | 'FORM_VERSION_NOT_PUBLISHED'\n\n/**\n * `Symbol.for` so the brand survives module duplication across bundle\n * boundaries. `instanceof` does NOT: Next can load this module in more than\n * one chunk, and once a second copy of the class exists an error thrown\n * through one copy fails `instanceof` against the other \u2014 silently\n * downgrading a mapped domain error to a 500. Mirrors `CrudHttpError`.\n */\nconst SUBMISSION_SERVICE_ERROR_MARKER = Symbol.for('@open-mercato/forms/SubmissionServiceError')\n\nexport class SubmissionServiceError extends Error {\n  readonly [SUBMISSION_SERVICE_ERROR_MARKER] = true\n  readonly code: SubmissionServiceErrorCode\n  readonly httpStatus: number\n  readonly details?: Record<string, unknown>\n\n  constructor(code: SubmissionServiceErrorCode, message: string, httpStatus: number, details?: Record<string, unknown>) {\n    super(message)\n    this.name = 'SubmissionServiceError'\n    this.code = code\n    this.httpStatus = httpStatus\n    this.details = details\n  }\n}\n\ntype Scope = {\n  tenantId: string\n  organizationId: string\n}\n\nexport type StartArgs = Scope & {\n  formKey: string\n  subjectType: string\n  subjectId: string\n  startedBy: string\n  /** Optional initial role override \u2014 when present, MUST be in form_version.roles. */\n  initialRole?: string | null\n  /**\n   * Optional published version to pin this submission to. When present, the\n   * form is still resolved by key (for scope + status checks) but the\n   * specified version is compiled instead of the form's current published\n   * version. Used by distribution flows (phase 2d) to lock a campaign to a\n   * particular version. When absent, behavior is unchanged.\n   */\n  pinnedVersionId?: string | null\n  /**\n   * Optional initial values keyed by field key (W8 / FD-1 prefill). Resolved\n   * by the route from `x-om-prefill` declarations + the injected\n   * `PrefillResolver`. Applied to the initial revision after being filtered\n   * through the participant role's `filterWritePatch` (only fields the\n   * participant may edit are kept) and validated by AJV. Backward-compatible:\n   * absent / empty \u21D2 the initial revision payload stays `{}` as before.\n   */\n  prefill?: Record<string, unknown> | null\n}\n\nexport type SaveArgs = Scope & {\n  submissionId: string\n  baseRevisionId: string\n  patch: Record<string, unknown>\n  savedBy: string\n  changeSummary?: string | null\n  changeSource?: 'user' | 'admin' | 'system'\n}\n\nexport type SubmitArgs = Scope & {\n  submissionId: string\n  baseRevisionId: string\n  submittedBy: string\n  submitMetadata?: Record<string, unknown> | null\n}\n\nexport type ReopenArgs = Scope & {\n  submissionId: string\n  reopenedBy: string\n}\n\nexport type AssignActorArgs = Scope & {\n  submissionId: string\n  userId: string\n  role: string\n  assignedBy: string\n}\n\nexport type RevokeActorArgs = Scope & {\n  submissionId: string\n  actorId: string\n  revokedBy: string\n}\n\nexport type GetCurrentArgs = Scope & {\n  submissionId: string\n  /** When provided, slice the response to only this role's visible fields. */\n  viewerRole?: string | null\n  /**\n   * User reading. Used for the audit-log call site, and \u2014 when `viewerRole` is\n   * absent \u2014 to derive the slice from that user's active actor row, which is\n   * the authority on what role a viewer actually holds.\n   */\n  viewerUserId?: string | null\n  /**\n   * Which surface is reading, for the access-audit row. `getCurrent` used to\n   * hard-code `'runtime'`, so the admin submission-detail read \u2014 the primary\n   * staff read of a submission's answers \u2014 was recorded as runtime traffic or,\n   * for an auditor filtering on `'admin'`, not visibly recorded at all.\n   * Defaults to `'runtime'` so the public and portal call sites are unchanged.\n   */\n  surface?: 'admin' | 'runtime'\n  /**\n   * TRUSTED INTERNAL CALLERS ONLY: return the full decoded payload with no role\n   * slice.\n   *\n   * There is exactly one legitimate use \u2014 the consent projector in `di.ts`,\n   * which has no viewer at all and must see `signature` answers to write\n   * `forms_consent_record` rows. It is an explicit opt-in rather than the\n   * default-when-unspecified it used to be, because that default silently\n   * handed the full decrypted payload to any caller that could not name a role,\n   * including a portal customer with no actor row on the submission.\n   *\n   * Never set this from anything reachable by a request principal.\n   */\n  unsliced?: boolean\n}\n\nexport type SubmissionViewModel = {\n  submission: FormSubmission\n  revision: FormSubmissionRevision\n  decodedData: Record<string, unknown>\n  actors: FormSubmissionActor[]\n  formVersion: FormVersion\n}\n\nexport type RevisionInsertOutcome = {\n  revision: FormSubmissionRevision\n  coalesced: boolean\n}\n\nexport type SubmissionEvents = {\n  'forms.submission.started': (payload: z.infer<typeof formsEventPayloadSchemas['forms.submission.started']>) => Promise<void> | void\n  'forms.submission.revision_appended': (payload: z.infer<typeof formsEventPayloadSchemas['forms.submission.revision_appended']>) => Promise<void> | void\n  'forms.submission.submitted': (payload: z.infer<typeof formsEventPayloadSchemas['forms.submission.submitted']>) => Promise<void> | void\n  'forms.submission.reopened': (payload: z.infer<typeof formsEventPayloadSchemas['forms.submission.reopened']>) => Promise<void> | void\n  'forms.submission.actor_assigned': (payload: z.infer<typeof formsEventPayloadSchemas['forms.submission.actor_assigned']>) => Promise<void> | void\n}\n\nexport type AuditAccessHook = (args: {\n  submissionId: string\n  organizationId: string\n  tenantId: string\n  viewerUserId: string | null\n  viewerRole: string | null\n  surface: 'admin' | 'runtime'\n  scope: 'submission' | 'revision'\n}) => Promise<void> | void\n\nexport type SubmissionServiceOptions = {\n  emFactory: () => EntityManager\n  formVersionCompiler: FormVersionCompiler\n  encryptionService: EncryptionService\n  rolePolicyService: RolePolicyService\n  /** Pluggable event emitter \u2014 wires to the typed forms events catalog. */\n  emitEvent: <K extends keyof SubmissionEvents>(eventId: K, payload: Parameters<SubmissionEvents[K]>[0]) => Promise<void> | void\n  /** Phase 2b replaces this with a real audit logger. Phase 1c uses a no-op. */\n  auditAccess?: AuditAccessHook\n  logger?: StructuredLogger\n  /** Override the clock for tests. */\n  now?: () => Date\n  autosaveIntervalMs?: number\n  revisionCap?: number\n}\n\nconst noopAuditAccess: AuditAccessHook = () => {}\n\nconst noopLogger: StructuredLogger = {\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n}\n\nexport class SubmissionService {\n  private readonly emFactory: () => EntityManager\n  private readonly compiler: FormVersionCompiler\n  private readonly encryption: EncryptionService\n  private readonly rolePolicy: RolePolicyService\n  private readonly emitEvent: SubmissionServiceOptions['emitEvent']\n  private readonly auditAccess: AuditAccessHook\n  private readonly logger: StructuredLogger\n  private readonly now: () => Date\n  private readonly autosaveIntervalMs: number\n  private readonly revisionCap: number\n\n  constructor(options: SubmissionServiceOptions) {\n    this.emFactory = options.emFactory\n    this.compiler = options.formVersionCompiler\n    this.encryption = options.encryptionService\n    this.rolePolicy = options.rolePolicyService\n    this.emitEvent = options.emitEvent\n    this.auditAccess = options.auditAccess ?? noopAuditAccess\n    this.logger = options.logger ?? noopLogger\n    this.now = options.now ?? (() => new Date())\n    this.autosaveIntervalMs = options.autosaveIntervalMs ?? DEFAULT_AUTOSAVE_INTERVAL_MS\n    this.revisionCap = options.revisionCap ?? DEFAULT_REVISION_CAP\n  }\n\n  // --------------------------------------------------------------------------\n  // Active form-version lookup\n  // --------------------------------------------------------------------------\n\n  async getActiveFormVersionByKey(args: Scope & { formKey: string }): Promise<{\n    form: Form\n    formVersion: FormVersion\n    compiled: CompiledFormVersion\n  }> {\n    const em = this.emFactory()\n    const form = await em.findOne(Form, {\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      key: args.formKey,\n      deletedAt: null,\n    })\n    if (!form) {\n      throw new SubmissionServiceError('NOT_FOUND', `Form \"${args.formKey}\" not found.`, 404)\n    }\n    if (form.status !== 'active') {\n      throw new SubmissionServiceError('FORM_INACTIVE', `Form \"${args.formKey}\" is not active.`, 422)\n    }\n    if (!form.currentPublishedVersionId) {\n      throw new SubmissionServiceError(\n        'FORM_VERSION_NOT_PUBLISHED',\n        `Form \"${args.formKey}\" has no published version.`,\n        422,\n      )\n    }\n    const formVersion = await em.findOne(FormVersion, {\n      id: form.currentPublishedVersionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n    })\n    if (!formVersion) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Pinned form version not found.', 404)\n    }\n    const compiled = this.compiler.compile({\n      id: formVersion.id,\n      updatedAt: formVersion.updatedAt,\n      schema: formVersion.schema,\n      uiSchema: formVersion.uiSchema,\n    })\n    return { form, formVersion, compiled }\n  }\n\n  /**\n   * Resolve a specific published form version pinned to a key. The form is\n   * resolved by key (so org/tenant scope and active status are validated) but\n   * the supplied version is compiled instead of the form's current published\n   * version. Asserts the version is published and belongs to the resolved\n   * form. Used by phase 2d distribution flows.\n   */\n  async getPinnedFormVersionByKey(args: Scope & { formKey: string; pinnedVersionId: string }): Promise<{\n    form: Form\n    formVersion: FormVersion\n    compiled: CompiledFormVersion\n  }> {\n    const em = this.emFactory()\n    const form = await em.findOne(Form, {\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      key: args.formKey,\n      deletedAt: null,\n    })\n    if (!form) {\n      throw new SubmissionServiceError('NOT_FOUND', `Form \"${args.formKey}\" not found.`, 404)\n    }\n    if (form.status !== 'active') {\n      throw new SubmissionServiceError('FORM_INACTIVE', `Form \"${args.formKey}\" is not active.`, 422)\n    }\n    const formVersion = await em.findOne(FormVersion, {\n      id: args.pinnedVersionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n    })\n    if (!formVersion || formVersion.formId !== form.id) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Pinned form version not found.', 404)\n    }\n    if (formVersion.status !== 'published') {\n      throw new SubmissionServiceError(\n        'FORM_VERSION_NOT_PUBLISHED',\n        'Pinned form version is not published.',\n        422,\n      )\n    }\n    const compiled = this.compiler.compile({\n      id: formVersion.id,\n      updatedAt: formVersion.updatedAt,\n      schema: formVersion.schema,\n      uiSchema: formVersion.uiSchema,\n    })\n    return { form, formVersion, compiled }\n  }\n\n  // --------------------------------------------------------------------------\n  // Lifecycle: start\n  // --------------------------------------------------------------------------\n\n  async start(args: StartArgs): Promise<SubmissionViewModel> {\n    const { form, formVersion, compiled } = args.pinnedVersionId\n      ? await this.getPinnedFormVersionByKey({\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          formKey: args.formKey,\n          pinnedVersionId: args.pinnedVersionId,\n        })\n      : await this.getActiveFormVersionByKey({\n          tenantId: args.tenantId,\n          organizationId: args.organizationId,\n          formKey: args.formKey,\n        })\n    const declaredRoles = readDeclaredRoles(formVersion)\n    const role = args.initialRole\n      ?? readDefaultActorRole(formVersion)\n      ?? declaredRoles[0]\n      ?? null\n    if (!role) {\n      throw new SubmissionServiceError('INVALID_ROLE', 'Form version does not declare any roles.', 422)\n    }\n    if (!declaredRoles.includes(role) && role !== 'admin') {\n      throw new SubmissionServiceError('INVALID_ROLE', `Role \"${role}\" is not declared on the form version.`, 422)\n    }\n\n    const em = this.emFactory()\n    const result = await em.transactional(async (trx) => {\n      const now = this.now()\n      // Assign UUID PKs in app code so cross-row FKs (actor/revision \u2192\n      // submission, submission \u2192 revision) are known before flush. The DB\n      // `defaultRaw` only fills them on insert, which is too late here.\n      const submissionId = randomUUID()\n      const revisionId = randomUUID()\n      const submission = trx.create(FormSubmission, {\n        id: submissionId,\n        organizationId: args.organizationId,\n        tenantId: args.tenantId,\n        formVersionId: formVersion.id,\n        subjectType: args.subjectType,\n        subjectId: args.subjectId,\n        status: 'draft',\n        startedBy: args.startedBy,\n        firstSavedAt: now,\n        createdAt: now,\n        updatedAt: now,\n      })\n      trx.persist(submission)\n\n      const actor = trx.create(FormSubmissionActor, {\n        submissionId,\n        organizationId: args.organizationId,\n        userId: args.startedBy,\n        role,\n        assignedAt: now,\n        createdAt: now,\n        updatedAt: now,\n      })\n      trx.persist(actor)\n\n      // Seed prefill values (W8 / FD-1) \u2014 only fields the participant role may\n      // write, then validate the seed against AJV. A failing seed is dropped\n      // (start must never fail because of prefill); the submission opens empty.\n      const initialPayload = this.buildInitialPayload(compiled, role, args.prefill ?? null)\n      const ciphertext = await this.encryption.encrypt(\n        args.organizationId,\n        Buffer.from(JSON.stringify(initialPayload), 'utf8'),\n      )\n      const keyVersion = await this.encryption.currentKeyVersion(args.organizationId)\n      const revision = trx.create(FormSubmissionRevision, {\n        id: revisionId,\n        submissionId,\n        organizationId: args.organizationId,\n        revisionNumber: 1,\n        data: ciphertext,\n        encryptionKeyVersion: keyVersion,\n        savedAt: now,\n        savedBy: args.startedBy,\n        savedByRole: role,\n        changeSource: 'system',\n        changedFieldKeys: [],\n        changeSummary: null,\n      })\n      trx.persist(revision)\n\n      submission.currentRevisionId = revisionId\n      await trx.flush()\n\n      return { submission, actor, revision, initialPayload }\n    })\n\n    await this.safeEmit('forms.submission.started', {\n      submissionId: result.submission.id,\n      formVersionId: formVersion.id,\n    })\n\n    return {\n      submission: result.submission,\n      revision: result.revision,\n      decodedData: this.rolePolicy.resolve(compiled, role).sliceReadPayload(result.initialPayload),\n      actors: [result.actor],\n      formVersion,\n    }\n  }\n\n  /**\n   * Builds the initial revision payload from optional prefill values (W8).\n   * Filters through the participant role's write policy (only editable fields\n   * seed) and validates the result against AJV. Returns `{}` when there is no\n   * prefill or the seeded payload fails validation \u2014 start must stay\n   * backward-compatible and never fail because of prefill.\n   */\n  private buildInitialPayload(\n    compiled: CompiledFormVersion,\n    role: string,\n    prefill: Record<string, unknown> | null,\n  ): Record<string, unknown> {\n    if (!prefill || Object.keys(prefill).length === 0) return {}\n    const { accepted } = this.rolePolicy.resolve(compiled, role).filterWritePatch(prefill)\n    const seed: Record<string, unknown> = {}\n    for (const [key, value] of Object.entries(accepted)) {\n      if (value === null || value === undefined) continue\n      seed[key] = value\n    }\n    if (Object.keys(seed).length === 0) return {}\n    const valid = compiled.ajv(seed)\n    if (!valid) {\n      this.logger.warn(\n        { event: 'forms.submission.prefill_rejected', role, fieldKeys: Object.keys(seed) },\n        'Forms prefill seed failed validation \u2014 starting with an empty payload.',\n      )\n      return {}\n    }\n    return seed\n  }\n\n  // --------------------------------------------------------------------------\n  // Lifecycle: save\n  // --------------------------------------------------------------------------\n\n  async save(args: SaveArgs): Promise<RevisionInsertOutcome> {\n    assertSubmissionPayloadSize(args.patch)\n    const em = this.emFactory()\n    const result = await em.transactional(async (trx) => {\n      const submission = await trx.findOne(\n        FormSubmission,\n        {\n          id: args.submissionId,\n          organizationId: args.organizationId,\n          tenantId: args.tenantId,\n          deletedAt: null,\n        },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n      )\n      if (!submission) {\n        throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)\n      }\n      if (submission.status === 'archived') {\n        throw new SubmissionServiceError('INVALID_STATUS', 'Submission is archived.', 422)\n      }\n      // A submitted submission is a signed record: `submittedAt` and\n      // `submitMetadata` attest to what was submitted. Without this arm a\n      // participant holding a live access token could keep appending revisions\n      // afterwards \u2014 the attestation would still point at the original submit\n      // while the answers moved underneath it, and the lazily-rendered PDF\n      // snapshot could capture content the signer never submitted. Re-editing\n      // has a deliberate, audited path: `reopen()`, gated on\n      // `forms.submissions.manage`. `submit()` and `reopen()` both already\n      // guard this status; `save()` was the gap.\n      if (submission.status === 'submitted') {\n        throw new SubmissionServiceError(\n          'INVALID_STATUS',\n          'Submission is already submitted \u2014 reopen it before saving further changes.',\n          422,\n        )\n      }\n\n      const formVersion = await trx.findOne(FormVersion, {\n        id: submission.formVersionId,\n        organizationId: args.organizationId,\n        tenantId: args.tenantId,\n      })\n      if (!formVersion) {\n        throw new SubmissionServiceError('NOT_FOUND', 'Form version not found.', 404)\n      }\n\n      // Active actor for this user\n      const actor = await trx.findOne(FormSubmissionActor, {\n        submissionId: submission.id,\n        organizationId: args.organizationId,\n        userId: args.savedBy,\n        revokedAt: null,\n        deletedAt: null,\n      })\n      if (!actor) {\n        throw new SubmissionServiceError('NO_ACTOR', 'No active actor row for this user on this submission.', 403)\n      }\n\n      // Optimistic concurrency\n      if (submission.currentRevisionId !== args.baseRevisionId) {\n        throw new SubmissionServiceError('STALE_BASE', 'base_revision_id is stale.', 409, {\n          currentRevisionId: submission.currentRevisionId,\n        })\n      }\n\n      const currentRevision = await trx.findOne(FormSubmissionRevision, {\n        id: args.baseRevisionId,\n        submissionId: submission.id,\n        organizationId: args.organizationId,\n      })\n      if (!currentRevision) {\n        throw new SubmissionServiceError('NOT_FOUND', 'Base revision not found.', 404)\n      }\n\n      // Rate limit (skip for system change source). When autosaveIntervalMs\n      // is configured to 0 the rate limit is disabled \u2014 useful in tests.\n      const changeSource = args.changeSource ?? 'user'\n      if (changeSource !== 'system' && this.autosaveIntervalMs > 0) {\n        const minIntervalMs = Math.floor(this.autosaveIntervalMs / 2)\n        if (minIntervalMs > 0) {\n          const elapsed = this.now().getTime() - currentRevision.savedAt.getTime()\n          if (elapsed < minIntervalMs) {\n            throw new SubmissionServiceError('RATE_LIMITED', 'Save rate limit exceeded.', 429, {\n              retryAfterMs: minIntervalMs - elapsed,\n            })\n          }\n        }\n      }\n\n      // Compile schema + filter patch by role\n      const compiled = this.compiler.compile({\n        id: formVersion.id,\n        updatedAt: formVersion.updatedAt,\n        schema: formVersion.schema,\n        uiSchema: formVersion.uiSchema,\n      })\n      const policy = this.rolePolicy.resolve(compiled, actor.role)\n      const { accepted, droppedFieldKeys } = policy.filterWritePatch(args.patch)\n      if (droppedFieldKeys.length > 0) {\n        this.logger.warn(\n          buildTamperingMarker({\n            submissionId: submission.id,\n            userId: args.savedBy,\n            role: actor.role,\n            droppedFieldKeys,\n          }),\n          'Forms tampering marker \u2014 fields outside actor editable set were dropped.',\n        )\n      }\n\n      // Decrypt + merge\n      const priorPlain = await this.decodeRevision(args.organizationId, currentRevision)\n      const merged: Record<string, unknown> = { ...priorPlain }\n      for (const [key, value] of Object.entries(accepted)) {\n        if (value === null || value === undefined) {\n          delete merged[key]\n        } else {\n          merged[key] = value\n        }\n      }\n      assertSubmissionPayloadSize(merged)\n\n      // Validate merged payload\n      const ajvValid = compiled.ajv(merged)\n      if (!ajvValid) {\n        const errors = Array.isArray(compiled.ajv.errors) ? compiled.ajv.errors : []\n        throw new SubmissionServiceError('VALIDATION_FAILED', 'Merged payload failed validation.', 422, {\n          errors: errors.map((err) => ({\n            instancePath: err.instancePath,\n            keyword: err.keyword,\n            message: err.message,\n            params: err.params,\n          })),\n        })\n      }\n      validateCompiledFieldRules(compiled, formVersion.schema, merged)\n\n      // Compute changed field keys vs prior\n      const changedFieldKeys = computeChangedFieldKeys(priorPlain, merged)\n\n      // Encrypt merged payload\n      const ciphertext = await this.encryption.encrypt(\n        args.organizationId,\n        Buffer.from(JSON.stringify(merged), 'utf8'),\n      )\n      const keyVersion = await this.encryption.currentKeyVersion(args.organizationId)\n\n      const nextRevisionNumber = currentRevision.revisionNumber + 1\n      const coalesce = nextRevisionNumber > this.revisionCap\n      let outcome: RevisionInsertOutcome\n      if (coalesce) {\n        // Coalesce-after-cap: UPDATE the latest revision in place. The only\n        // UPDATE path other than anonymize. Bump saved_at, replace data,\n        // accumulate changedFieldKeys, force changeSource = 'system'.\n        currentRevision.data = ciphertext\n        currentRevision.encryptionKeyVersion = keyVersion\n        currentRevision.savedAt = this.now()\n        currentRevision.savedBy = args.savedBy\n        currentRevision.savedByRole = actor.role\n        currentRevision.changeSource = 'system'\n        currentRevision.changedFieldKeys = uniqueStrings([\n          ...(currentRevision.changedFieldKeys ?? []),\n          ...changedFieldKeys,\n        ])\n        if (typeof args.changeSummary === 'string') currentRevision.changeSummary = args.changeSummary\n        submission.updatedAt = this.now()\n        await trx.flush()\n        outcome = { revision: currentRevision, coalesced: true }\n      } else {\n        const savedAt = this.now()\n        // Assign the PK in app code so currentRevisionId points at it before\n        // flush \u2014 the DB `defaultRaw` only fills the id on insert, which would\n        // make `submission.currentRevisionId = revision.id` persist as NULL.\n        const revisionId = randomUUID()\n        const revision = trx.create(FormSubmissionRevision, {\n          id: revisionId,\n          submissionId: submission.id,\n          organizationId: args.organizationId,\n          revisionNumber: nextRevisionNumber,\n          data: ciphertext,\n          encryptionKeyVersion: keyVersion,\n          savedAt,\n          savedBy: args.savedBy,\n          savedByRole: actor.role,\n          changeSource,\n          changedFieldKeys,\n          changeSummary: args.changeSummary ?? null,\n        })\n        trx.persist(revision)\n        submission.currentRevisionId = revisionId\n        submission.updatedAt = this.now()\n        await trx.flush()\n        outcome = { revision, coalesced: false }\n      }\n\n      return {\n        outcome,\n        savedByRole: actor.role,\n      }\n    })\n\n    await this.safeEmit('forms.submission.revision_appended', {\n      submissionId: args.submissionId,\n      revisionId: result.outcome.revision.id,\n      savedBy: args.savedBy,\n      savedByRole: result.savedByRole,\n      changedFieldKeys: result.outcome.revision.changedFieldKeys ?? [],\n    })\n\n    return result.outcome\n  }\n\n  // --------------------------------------------------------------------------\n  // Lifecycle: submit\n  // --------------------------------------------------------------------------\n\n  async submit(args: SubmitArgs): Promise<FormSubmission> {\n    const em = this.emFactory()\n    const result = await em.transactional(async (trx) => {\n      const submission = await trx.findOne(\n        FormSubmission,\n        {\n          id: args.submissionId,\n          organizationId: args.organizationId,\n          tenantId: args.tenantId,\n          deletedAt: null,\n        },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n      )\n      if (!submission) {\n        throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)\n      }\n      if (submission.status === 'submitted') {\n        throw new SubmissionServiceError('INVALID_STATUS', 'Submission already submitted.', 422)\n      }\n      if (submission.status === 'archived') {\n        throw new SubmissionServiceError('INVALID_STATUS', 'Submission is archived.', 422)\n      }\n\n      // Active actor for this user \u2014 the same authorization `save()` requires.\n      // Without it a caller who may not EDIT a submission could still freeze\n      // someone else's draft by submitting it. `start()` always creates an actor\n      // row for `startedBy`, and that is the principal every flow submits as\n      // (`auth.sub` for a portal customer, the invitation id for an anonymous\n      // link or invite), so this denies only a genuinely unauthorized caller.\n      const actor = await trx.findOne(FormSubmissionActor, {\n        submissionId: submission.id,\n        organizationId: args.organizationId,\n        userId: args.submittedBy,\n        revokedAt: null,\n        deletedAt: null,\n      })\n      if (!actor) {\n        throw new SubmissionServiceError('NO_ACTOR', 'No active actor row for this user on this submission.', 403)\n      }\n\n      if (submission.currentRevisionId !== args.baseRevisionId) {\n        throw new SubmissionServiceError('STALE_BASE', 'base_revision_id is stale.', 409, {\n          currentRevisionId: submission.currentRevisionId,\n        })\n      }\n      submission.status = 'submitted'\n      submission.submittedAt = this.now()\n      submission.submittedBy = args.submittedBy\n      if (args.submitMetadata) submission.submitMetadata = args.submitMetadata\n      await trx.flush()\n      return submission\n    })\n\n    await this.safeEmit('forms.submission.submitted', { submissionId: result.id })\n    return result\n  }\n\n  // --------------------------------------------------------------------------\n  // Lifecycle: reopen\n  // --------------------------------------------------------------------------\n\n  async reopen(args: ReopenArgs): Promise<FormSubmission> {\n    const em = this.emFactory()\n    const result = await em.transactional(async (trx) => {\n      const submission = await trx.findOne(\n        FormSubmission,\n        {\n          id: args.submissionId,\n          organizationId: args.organizationId,\n          tenantId: args.tenantId,\n          deletedAt: null,\n        },\n        { lockMode: LockMode.PESSIMISTIC_WRITE },\n      )\n      if (!submission) {\n        throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)\n      }\n      if (submission.status !== 'submitted') {\n        throw new SubmissionServiceError('INVALID_STATUS', 'Only submitted submissions can be reopened.', 422)\n      }\n      submission.status = 'reopened'\n      submission.submittedAt = null\n      submission.submittedBy = null\n      await trx.flush()\n      return submission\n    })\n    await this.safeEmit('forms.submission.reopened', { submissionId: result.id })\n    return result\n  }\n\n  // --------------------------------------------------------------------------\n  // Actors\n  // --------------------------------------------------------------------------\n\n  async assignActor(args: AssignActorArgs): Promise<FormSubmissionActor> {\n    const em = this.emFactory()\n    const submission = await em.findOne(FormSubmission, {\n      id: args.submissionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    })\n    if (!submission) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)\n    }\n    const formVersion = await em.findOne(FormVersion, {\n      id: submission.formVersionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n    })\n    if (!formVersion) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Form version not found.', 404)\n    }\n    const declaredRoles = readDeclaredRoles(formVersion)\n    if (args.role !== 'admin' && !declaredRoles.includes(args.role)) {\n      throw new SubmissionServiceError('INVALID_ROLE', `Role \"${args.role}\" is not declared on the form version.`, 422)\n    }\n    const existing = await em.findOne(FormSubmissionActor, {\n      submissionId: submission.id,\n      organizationId: args.organizationId,\n      userId: args.userId,\n      revokedAt: null,\n      deletedAt: null,\n    })\n    if (existing) {\n      if (existing.role === args.role) return existing\n      // Different role on the same user \u2014 revoke the previous assignment.\n      existing.revokedAt = this.now()\n      em.persist(existing)\n    }\n    const nowDate = this.now()\n    const actor = em.create(FormSubmissionActor, {\n      submissionId: submission.id,\n      organizationId: args.organizationId,\n      userId: args.userId,\n      role: args.role,\n      assignedAt: nowDate,\n      createdAt: nowDate,\n      updatedAt: nowDate,\n    })\n    em.persist(actor)\n    await em.flush()\n    await this.safeEmit('forms.submission.actor_assigned', {\n      submissionId: submission.id,\n      userId: args.userId,\n      role: args.role,\n    })\n    return actor\n  }\n\n  async revokeActor(args: RevokeActorArgs): Promise<void> {\n    const em = this.emFactory()\n    const actor = await em.findOne(FormSubmissionActor, {\n      id: args.actorId,\n      organizationId: args.organizationId,\n      submissionId: args.submissionId,\n      deletedAt: null,\n    })\n    if (!actor) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Actor row not found.', 404)\n    }\n    if (actor.revokedAt) return\n    actor.revokedAt = this.now()\n    em.persist(actor)\n    await em.flush()\n  }\n\n  // --------------------------------------------------------------------------\n  // Reads\n  // --------------------------------------------------------------------------\n\n  async getCurrent(args: GetCurrentArgs): Promise<SubmissionViewModel> {\n    const em = this.emFactory()\n    const submission = await em.findOne(FormSubmission, {\n      id: args.submissionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    })\n    if (!submission) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)\n    }\n    const formVersion = await em.findOne(FormVersion, {\n      id: submission.formVersionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n    })\n    if (!formVersion) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Form version not found.', 404)\n    }\n    const revision = submission.currentRevisionId\n      ? await em.findOne(FormSubmissionRevision, {\n          id: submission.currentRevisionId,\n          submissionId: submission.id,\n          organizationId: args.organizationId,\n        })\n      : null\n    if (!revision) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Current revision not found.', 404)\n    }\n    const actors = await em.find(FormSubmissionActor, {\n      submissionId: submission.id,\n      organizationId: args.organizationId,\n      deletedAt: null,\n    })\n\n    const compiled = this.compiler.compile({\n      id: formVersion.id,\n      updatedAt: formVersion.updatedAt,\n      schema: formVersion.schema,\n      uiSchema: formVersion.uiSchema,\n    })\n    const decodedFull = await this.decodeRevision(args.organizationId, revision)\n    // Slicing fails closed. An absent `viewerRole` used to skip it entirely and\n    // return the full decrypted payload, so any caller that could not name a\n    // role \u2014 notably a portal customer with no actor row on this submission \u2014\n    // read everything.\n    //\n    // Resolution order, most specific first:\n    //   1. `unsliced: true` \u2014 the one trusted internal caller (see the type).\n    //   2. an explicit `viewerRole`.\n    //   3. the active actor row for `viewerUserId`. This is what an invitation\n    //      resume needs: `FormInvitation.role` is null for every invitation the\n    //      admin UI creates (it posts only `{ email, name }`), so the actor row\n    //      is the only authority on the respondent's role.\n    //   4. otherwise nothing is readable.\n    const viewerRole = args.viewerRole\n      ?? (args.viewerUserId\n        ? actors.find((actor) => actor.userId === args.viewerUserId && !actor.revokedAt)?.role ?? null\n        : null)\n\n    const decodedData = args.unsliced === true\n      ? decodedFull\n      // Fail-closed by construction: with no role there is nothing to slice\n      // by, so the answer is the empty payload rather than a role-shaped\n      // lookup that happens to match no field.\n      : viewerRole === null\n        ? {}\n        : sliceForRole({\n          rolePolicy: this.rolePolicy,\n          compiled,\n          schema: formVersion.schema as { properties?: Record<string, VisibilitySchemaNode> },\n          role: viewerRole,\n          decodedFull,\n        })\n\n    // TODO(forms-2b): write form_access_audit row via auditAccess hook.\n    await this.auditAccess({\n      submissionId: submission.id,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      viewerUserId: args.viewerUserId ?? null,\n      viewerRole: args.viewerRole ?? null,\n      surface: args.surface ?? 'runtime',\n      scope: 'submission',\n    })\n\n    return {\n      submission,\n      revision,\n      decodedData,\n      actors,\n      formVersion,\n    }\n  }\n\n  async listRevisions(args: Scope & { submissionId: string; viewerUserId?: string | null; viewerRole?: string | null }): Promise<{\n    submission: FormSubmission\n    revisions: FormSubmissionRevision[]\n  }> {\n    const em = this.emFactory()\n    const submission = await em.findOne(FormSubmission, {\n      id: args.submissionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    })\n    if (!submission) {\n      throw new SubmissionServiceError('NOT_FOUND', 'Submission not found.', 404)\n    }\n    const revisions = await em.find(\n      FormSubmissionRevision,\n      { submissionId: submission.id, organizationId: args.organizationId },\n      { orderBy: { revisionNumber: 'asc' } },\n    )\n\n    // TODO(forms-2b): write form_access_audit row via auditAccess hook.\n    await this.auditAccess({\n      submissionId: submission.id,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      viewerUserId: args.viewerUserId ?? null,\n      viewerRole: args.viewerRole ?? null,\n      surface: 'admin',\n      scope: 'revision',\n    })\n\n    return { submission, revisions }\n  }\n\n  async listSubmissionsBySubject(args: Scope & { subjectType: string; subjectId: string }): Promise<FormSubmission[]> {\n    const em = this.emFactory()\n    return em.find(\n      FormSubmission,\n      {\n        organizationId: args.organizationId,\n        tenantId: args.tenantId,\n        subjectType: args.subjectType,\n        subjectId: args.subjectId,\n        deletedAt: null,\n      },\n      { orderBy: { firstSavedAt: 'desc' } },\n    )\n  }\n\n  async listSubmissionsByForm(args: Scope & {\n    formId: string\n    page: number\n    pageSize: number\n    status?: string\n  }): Promise<{ items: FormSubmission[]; total: number; page: number; pageSize: number }> {\n    const em = this.emFactory()\n    const where: Record<string, unknown> = {\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    }\n    if (args.status) where.status = args.status\n    // Filter by all versions belonging to the form\n    const versions = await em.find(FormVersion, {\n      formId: args.formId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n    })\n    const versionIds = versions.map((v) => v.id)\n    if (versionIds.length === 0) {\n      return { items: [], total: 0, page: args.page, pageSize: args.pageSize }\n    }\n    where.formVersionId = { $in: versionIds }\n    const offset = Math.max(0, (args.page - 1) * args.pageSize)\n    const [items, total] = await em.findAndCount<FormSubmission>(\n      FormSubmission,\n      where as never,\n      {\n        orderBy: { firstSavedAt: 'desc' },\n        limit: args.pageSize,\n        offset,\n      },\n    )\n    return { items, total, page: args.page, pageSize: args.pageSize }\n  }\n\n  // --------------------------------------------------------------------------\n  // Helpers\n  // --------------------------------------------------------------------------\n\n  private async decodeRevision(\n    organizationId: string,\n    revision: FormSubmissionRevision,\n  ): Promise<Record<string, unknown>> {\n    const ciphertext = ensureBuffer(revision.data)\n    if (ciphertext.length === 0) return {}\n    const plain = await this.encryption.decrypt(organizationId, ciphertext)\n    if (plain.length === 0) return {}\n    try {\n      return JSON.parse(plain.toString('utf8'))\n    } catch {\n      return {}\n    }\n  }\n\n  private async safeEmit<K extends keyof SubmissionEvents>(\n    eventId: K,\n    payload: Parameters<SubmissionEvents[K]>[0],\n  ): Promise<void> {\n    try {\n      await this.emitEvent(eventId, payload)\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Unknown emit error'\n      this.logger.warn({ event: 'forms.submission.event_emit_failed', eventId, message }, 'forms event emission failed')\n    }\n  }\n}\n\n// ============================================================================\n// Helpers\n// ============================================================================\n\nfunction ensureBuffer(value: Buffer | Uint8Array | string): Buffer {\n  if (Buffer.isBuffer(value)) return value\n  if (value instanceof Uint8Array) return Buffer.from(value)\n  if (typeof value === 'string') return Buffer.from(value, 'binary')\n  return Buffer.alloc(0)\n}\n\nfunction readDeclaredRoles(formVersion: FormVersion): string[] {\n  // Union the persisted `roles` column with the schema's `x-om-roles`. Both are\n  // authoritative declarations; the column can lag the schema if a publish\n  // predates the roles-sync, so a role declared in the published schema must\n  // never be rejected at runtime.\n  const declared = new Set<string>()\n  const roles = formVersion.roles\n  if (Array.isArray(roles)) {\n    for (const entry of roles) if (typeof entry === 'string') declared.add(entry)\n  }\n  const fromSchema = (formVersion.schema as Record<string, unknown> | null | undefined)?.['x-om-roles']\n  if (Array.isArray(fromSchema)) {\n    for (const entry of fromSchema) if (typeof entry === 'string') declared.add(entry)\n  }\n  return Array.from(declared)\n}\n\nfunction readDefaultActorRole(formVersion: FormVersion): string | null {\n  const value = (formVersion.schema as Record<string, unknown> | null | undefined)?.['x-om-default-actor-role']\n  return typeof value === 'string' && value.length > 0 ? value : null\n}\n\nfunction computeChangedFieldKeys(\n  prior: Record<string, unknown>,\n  next: Record<string, unknown>,\n): string[] {\n  const keys = new Set<string>([...Object.keys(prior), ...Object.keys(next)])\n  const changed: string[] = []\n  for (const key of keys) {\n    const a = prior[key]\n    const b = next[key]\n    if (!deepEqual(a, b)) changed.push(key)\n  }\n  return changed\n}\n\nfunction deepEqual(a: unknown, b: unknown): boolean {\n  if (a === b) return true\n  if (a === null || b === null) return false\n  if (typeof a !== typeof b) return false\n  if (typeof a !== 'object') return false\n  if (Array.isArray(a) || Array.isArray(b)) {\n    if (!Array.isArray(a) || !Array.isArray(b)) return false\n    if (a.length !== b.length) return false\n    return a.every((entry, index) => deepEqual(entry, b[index]))\n  }\n  const aKeys = Object.keys(a as Record<string, unknown>)\n  const bKeys = Object.keys(b as Record<string, unknown>)\n  if (aKeys.length !== bKeys.length) return false\n  return aKeys.every((key) => deepEqual((a as Record<string, unknown>)[key], (b as Record<string, unknown>)[key]))\n}\n\nfunction uniqueStrings(values: string[]): string[] {\n  return Array.from(new Set(values))\n}\n\nfunction assertSubmissionPayloadSize(payload: Record<string, unknown>): void {\n  const bytes = Buffer.byteLength(JSON.stringify(payload), 'utf8')\n  if (bytes <= MAX_SUBMISSION_PAYLOAD_BYTES) return\n  throw new SubmissionServiceError(\n    'VALIDATION_FAILED',\n    'Submission payload exceeds the configured size limit.',\n    413,\n    { maxBytes: MAX_SUBMISSION_PAYLOAD_BYTES },\n  )\n}\n\nfunction validateCompiledFieldRules(\n  compiled: CompiledFormVersion,\n  schema: Record<string, unknown>,\n  payload: Record<string, unknown>,\n): void {\n  const properties =\n    schema.properties && typeof schema.properties === 'object' && !Array.isArray(schema.properties)\n      ? (schema.properties as Record<string, unknown>)\n      : {}\n  for (const [fieldKey, descriptor] of Object.entries(compiled.fieldIndex)) {\n    if (!(fieldKey in payload)) continue\n    const rawNode = properties[fieldKey]\n    const fieldNode =\n      rawNode && typeof rawNode === 'object' && !Array.isArray(rawNode)\n        ? (rawNode as FieldNode)\n        : undefined\n    const result = validateFieldValue(\n      payload[fieldKey],\n      descriptor.validations,\n      'en',\n      descriptor.validationMessages,\n      fieldNode,\n    )\n    if (result.valid) continue\n    throw new SubmissionServiceError(\n      'VALIDATION_FAILED',\n      'Submission field failed validation.',\n      422,\n      { errors: [{ fieldKey, rule: result.rule, message: result.message }] },\n    )\n  }\n}\n\n/**\n * Role read-slice plus the visibility pass, in that order.\n *\n * Visibility is evaluated against the FULL decoded payload: an\n * `x-om-visibility-if` predicate may reference a field the role-sliced subset\n * omits, and it must see the real answer. The resulting visible set then\n * narrows the role-sliced payload. A form with no `x-om-visibility-if`\n * resolves to all readable keys, so the second pass is a no-op for it.\n */\nfunction sliceForRole(args: {\n  rolePolicy: RolePolicyService\n  compiled: CompiledFormVersion\n  schema: { properties?: Record<string, VisibilitySchemaNode> }\n  role: string\n  decodedFull: Record<string, unknown>\n}): Record<string, unknown> {\n  const roleSliced = args.rolePolicy.resolve(args.compiled, args.role).sliceReadPayload(args.decodedFull)\n  const visible = resolveVisibleFieldKeys({\n    compiled: args.compiled,\n    schema: args.schema,\n    role: args.role,\n    data: args.decodedFull,\n  })\n  return sliceByVisibility(roleSliced, visible)\n}\n\n/** Brand check for SubmissionServiceError \u2014 use instead of `instanceof`. */\nexport function isSubmissionServiceError(error: unknown): error is SubmissionServiceError {\n  return typeof error === 'object' && error !== null && (SUBMISSION_SERVICE_ERROR_MARKER in error)\n}\n"],
+  "mappings": "AAAA;AAkBA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AAGzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAOP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,4BAAmD;AAE5D,SAAS,0BAA0B;AAGnC,MAAM,gCAAgC,MAAM;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,SAAO,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAC1D,GAAG;AAEH,MAAM,wBAAwB,MAAM;AAClC,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,SAAO,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAC1D,GAAG;AAEH,MAAM,gCAAgC,MAAM;AAC1C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO,MAAM;AACvB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,SAAO,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS,MAAM;AAChE,GAAG;AAoBH,MAAM,kCAAkC,uBAAO,IAAI,4CAA4C;AAExF,MAAM,gCAA+B,YAChC,sCADgC,IAAM;AAAA,EAMhD,YAAY,MAAkC,SAAiB,YAAoB,SAAmC;AACpH,UAAM,OAAO;AANf,SAAU,MAAmC;AAO3C,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAClB,SAAK,UAAU;AAAA,EACjB;AACF;AAoJA,MAAM,kBAAmC,MAAM;AAAC;AAEhD,MAAM,aAA+B;AAAA,EACnC,MAAM,MAAM;AAAA,EAAC;AAAA,EACb,MAAM,MAAM;AAAA,EAAC;AAAA,EACb,OAAO,MAAM;AAAA,EAAC;AAChB;AAEO,MAAM,kBAAkB;AAAA,EAY7B,YAAY,SAAmC;AAC7C,SAAK,YAAY,QAAQ;AACzB,SAAK,WAAW,QAAQ;AACxB,SAAK,aAAa,QAAQ;AAC1B,SAAK,aAAa,QAAQ;AAC1B,SAAK,YAAY,QAAQ;AACzB,SAAK,cAAc,QAAQ,eAAe;AAC1C,SAAK,SAAS,QAAQ,UAAU;AAChC,SAAK,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC1C,SAAK,qBAAqB,QAAQ,sBAAsB;AACxD,SAAK,cAAc,QAAQ,eAAe;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,0BAA0B,MAI7B;AACD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM;AAAA,MAClC,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,KAAK,KAAK;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,uBAAuB,aAAa,SAAS,KAAK,OAAO,gBAAgB,GAAG;AAAA,IACxF;AACA,QAAI,KAAK,WAAW,UAAU;AAC5B,YAAM,IAAI,uBAAuB,iBAAiB,SAAS,KAAK,OAAO,oBAAoB,GAAG;AAAA,IAChG;AACA,QAAI,CAAC,KAAK,2BAA2B;AACnC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,SAAS,KAAK,OAAO;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AACA,UAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,MAChD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,aAAa,kCAAkC,GAAG;AAAA,IACrF;AACA,UAAM,WAAW,KAAK,SAAS,QAAQ;AAAA,MACrC,IAAI,YAAY;AAAA,MAChB,WAAW,YAAY;AAAA,MACvB,QAAQ,YAAY;AAAA,MACpB,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,WAAO,EAAE,MAAM,aAAa,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,0BAA0B,MAI7B;AACD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,OAAO,MAAM,GAAG,QAAQ,MAAM;AAAA,MAClC,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,KAAK,KAAK;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,uBAAuB,aAAa,SAAS,KAAK,OAAO,gBAAgB,GAAG;AAAA,IACxF;AACA,QAAI,KAAK,WAAW,UAAU;AAC5B,YAAM,IAAI,uBAAuB,iBAAiB,SAAS,KAAK,OAAO,oBAAoB,GAAG;AAAA,IAChG;AACA,UAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,MAChD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,eAAe,YAAY,WAAW,KAAK,IAAI;AAClD,YAAM,IAAI,uBAAuB,aAAa,kCAAkC,GAAG;AAAA,IACrF;AACA,QAAI,YAAY,WAAW,aAAa;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,KAAK,SAAS,QAAQ;AAAA,MACrC,IAAI,YAAY;AAAA,MAChB,WAAW,YAAY;AAAA,MACvB,QAAQ,YAAY;AAAA,MACpB,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,WAAO,EAAE,MAAM,aAAa,SAAS;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,MAA+C;AACzD,UAAM,EAAE,MAAM,aAAa,SAAS,IAAI,KAAK,kBACzC,MAAM,KAAK,0BAA0B;AAAA,MACnC,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,SAAS,KAAK;AAAA,MACd,iBAAiB,KAAK;AAAA,IACxB,CAAC,IACD,MAAM,KAAK,0BAA0B;AAAA,MACnC,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,SAAS,KAAK;AAAA,IAChB,CAAC;AACL,UAAM,gBAAgB,kBAAkB,WAAW;AACnD,UAAM,OAAO,KAAK,eACb,qBAAqB,WAAW,KAChC,cAAc,CAAC,KACf;AACL,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,uBAAuB,gBAAgB,4CAA4C,GAAG;AAAA,IAClG;AACA,QAAI,CAAC,cAAc,SAAS,IAAI,KAAK,SAAS,SAAS;AACrD,YAAM,IAAI,uBAAuB,gBAAgB,SAAS,IAAI,0CAA0C,GAAG;AAAA,IAC7G;AAEA,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAAG,cAAc,OAAO,QAAQ;AACnD,YAAM,MAAM,KAAK,IAAI;AAIrB,YAAM,eAAe,WAAW;AAChC,YAAM,aAAa,WAAW;AAC9B,YAAM,aAAa,IAAI,OAAO,gBAAgB;AAAA,QAC5C,IAAI;AAAA,QACJ,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,eAAe,YAAY;AAAA,QAC3B,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK;AAAA,QAChB,QAAQ;AAAA,QACR,WAAW,KAAK;AAAA,QAChB,cAAc;AAAA,QACd,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,UAAI,QAAQ,UAAU;AAEtB,YAAM,QAAQ,IAAI,OAAO,qBAAqB;AAAA,QAC5C;AAAA,QACA,gBAAgB,KAAK;AAAA,QACrB,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,UAAI,QAAQ,KAAK;AAKjB,YAAM,iBAAiB,KAAK,oBAAoB,UAAU,MAAM,KAAK,WAAW,IAAI;AACpF,YAAM,aAAa,MAAM,KAAK,WAAW;AAAA,QACvC,KAAK;AAAA,QACL,OAAO,KAAK,KAAK,UAAU,cAAc,GAAG,MAAM;AAAA,MACpD;AACA,YAAM,aAAa,MAAM,KAAK,WAAW,kBAAkB,KAAK,cAAc;AAC9E,YAAM,WAAW,IAAI,OAAO,wBAAwB;AAAA,QAClD,IAAI;AAAA,QACJ;AAAA,QACA,gBAAgB,KAAK;AAAA,QACrB,gBAAgB;AAAA,QAChB,MAAM;AAAA,QACN,sBAAsB;AAAA,QACtB,SAAS;AAAA,QACT,SAAS,KAAK;AAAA,QACd,aAAa;AAAA,QACb,cAAc;AAAA,QACd,kBAAkB,CAAC;AAAA,QACnB,eAAe;AAAA,MACjB,CAAC;AACD,UAAI,QAAQ,QAAQ;AAEpB,iBAAW,oBAAoB;AAC/B,YAAM,IAAI,MAAM;AAEhB,aAAO,EAAE,YAAY,OAAO,UAAU,eAAe;AAAA,IACvD,CAAC;AAED,UAAM,KAAK,SAAS,4BAA4B;AAAA,MAC9C,cAAc,OAAO,WAAW;AAAA,MAChC,eAAe,YAAY;AAAA,IAC7B,CAAC;AAED,WAAO;AAAA,MACL,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO;AAAA,MACjB,aAAa,KAAK,WAAW,QAAQ,UAAU,IAAI,EAAE,iBAAiB,OAAO,cAAc;AAAA,MAC3F,QAAQ,CAAC,OAAO,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,oBACN,UACA,MACA,SACyB;AACzB,QAAI,CAAC,WAAW,OAAO,KAAK,OAAO,EAAE,WAAW,EAAG,QAAO,CAAC;AAC3D,UAAM,EAAE,SAAS,IAAI,KAAK,WAAW,QAAQ,UAAU,IAAI,EAAE,iBAAiB,OAAO;AACrF,UAAM,OAAgC,CAAC;AACvC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,UAAI,UAAU,QAAQ,UAAU,OAAW;AAC3C,WAAK,GAAG,IAAI;AAAA,IACd;AACA,QAAI,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG,QAAO,CAAC;AAC5C,UAAM,QAAQ,SAAS,IAAI,IAAI;AAC/B,QAAI,CAAC,OAAO;AACV,WAAK,OAAO;AAAA,QACV,EAAE,OAAO,qCAAqC,MAAM,WAAW,OAAO,KAAK,IAAI,EAAE;AAAA,QACjF;AAAA,MACF;AACA,aAAO,CAAC;AAAA,IACV;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAK,MAAgD;AACzD,gCAA4B,KAAK,KAAK;AACtC,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAAG,cAAc,OAAO,QAAQ;AACnD,YAAM,aAAa,MAAM,IAAI;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,IAAI,KAAK;AAAA,UACT,gBAAgB,KAAK;AAAA,UACrB,UAAU,KAAK;AAAA,UACf,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,MACzC;AACA,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,MAC5E;AACA,UAAI,WAAW,WAAW,YAAY;AACpC,cAAM,IAAI,uBAAuB,kBAAkB,2BAA2B,GAAG;AAAA,MACnF;AAUA,UAAI,WAAW,WAAW,aAAa;AACrC,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,cAAc,MAAM,IAAI,QAAQ,aAAa;AAAA,QACjD,IAAI,WAAW;AAAA,QACf,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,MACjB,CAAC;AACD,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,uBAAuB,aAAa,2BAA2B,GAAG;AAAA,MAC9E;AAGA,YAAM,QAAQ,MAAM,IAAI,QAAQ,qBAAqB;AAAA,QACnD,cAAc,WAAW;AAAA,QACzB,gBAAgB,KAAK;AAAA,QACrB,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,uBAAuB,YAAY,yDAAyD,GAAG;AAAA,MAC3G;AAGA,UAAI,WAAW,sBAAsB,KAAK,gBAAgB;AACxD,cAAM,IAAI,uBAAuB,cAAc,8BAA8B,KAAK;AAAA,UAChF,mBAAmB,WAAW;AAAA,QAChC,CAAC;AAAA,MACH;AAEA,YAAM,kBAAkB,MAAM,IAAI,QAAQ,wBAAwB;AAAA,QAChE,IAAI,KAAK;AAAA,QACT,cAAc,WAAW;AAAA,QACzB,gBAAgB,KAAK;AAAA,MACvB,CAAC;AACD,UAAI,CAAC,iBAAiB;AACpB,cAAM,IAAI,uBAAuB,aAAa,4BAA4B,GAAG;AAAA,MAC/E;AAIA,YAAM,eAAe,KAAK,gBAAgB;AAC1C,UAAI,iBAAiB,YAAY,KAAK,qBAAqB,GAAG;AAC5D,cAAM,gBAAgB,KAAK,MAAM,KAAK,qBAAqB,CAAC;AAC5D,YAAI,gBAAgB,GAAG;AACrB,gBAAM,UAAU,KAAK,IAAI,EAAE,QAAQ,IAAI,gBAAgB,QAAQ,QAAQ;AACvE,cAAI,UAAU,eAAe;AAC3B,kBAAM,IAAI,uBAAuB,gBAAgB,6BAA6B,KAAK;AAAA,cACjF,cAAc,gBAAgB;AAAA,YAChC,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAGA,YAAM,WAAW,KAAK,SAAS,QAAQ;AAAA,QACrC,IAAI,YAAY;AAAA,QAChB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,QACpB,UAAU,YAAY;AAAA,MACxB,CAAC;AACD,YAAM,SAAS,KAAK,WAAW,QAAQ,UAAU,MAAM,IAAI;AAC3D,YAAM,EAAE,UAAU,iBAAiB,IAAI,OAAO,iBAAiB,KAAK,KAAK;AACzE,UAAI,iBAAiB,SAAS,GAAG;AAC/B,aAAK,OAAO;AAAA,UACV,qBAAqB;AAAA,YACnB,cAAc,WAAW;AAAA,YACzB,QAAQ,KAAK;AAAA,YACb,MAAM,MAAM;AAAA,YACZ;AAAA,UACF,CAAC;AAAA,UACD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,aAAa,MAAM,KAAK,eAAe,KAAK,gBAAgB,eAAe;AACjF,YAAM,SAAkC,EAAE,GAAG,WAAW;AACxD,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACnD,YAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,iBAAO,OAAO,GAAG;AAAA,QACnB,OAAO;AACL,iBAAO,GAAG,IAAI;AAAA,QAChB;AAAA,MACF;AACA,kCAA4B,MAAM;AAGlC,YAAM,WAAW,SAAS,IAAI,MAAM;AACpC,UAAI,CAAC,UAAU;AACb,cAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,MAAM,IAAI,SAAS,IAAI,SAAS,CAAC;AAC3E,cAAM,IAAI,uBAAuB,qBAAqB,qCAAqC,KAAK;AAAA,UAC9F,QAAQ,OAAO,IAAI,CAAC,SAAS;AAAA,YAC3B,cAAc,IAAI;AAAA,YAClB,SAAS,IAAI;AAAA,YACb,SAAS,IAAI;AAAA,YACb,QAAQ,IAAI;AAAA,UACd,EAAE;AAAA,QACJ,CAAC;AAAA,MACH;AACA,iCAA2B,UAAU,YAAY,QAAQ,MAAM;AAG/D,YAAM,mBAAmB,wBAAwB,YAAY,MAAM;AAGnE,YAAM,aAAa,MAAM,KAAK,WAAW;AAAA,QACvC,KAAK;AAAA,QACL,OAAO,KAAK,KAAK,UAAU,MAAM,GAAG,MAAM;AAAA,MAC5C;AACA,YAAM,aAAa,MAAM,KAAK,WAAW,kBAAkB,KAAK,cAAc;AAE9E,YAAM,qBAAqB,gBAAgB,iBAAiB;AAC5D,YAAM,WAAW,qBAAqB,KAAK;AAC3C,UAAI;AACJ,UAAI,UAAU;AAIZ,wBAAgB,OAAO;AACvB,wBAAgB,uBAAuB;AACvC,wBAAgB,UAAU,KAAK,IAAI;AACnC,wBAAgB,UAAU,KAAK;AAC/B,wBAAgB,cAAc,MAAM;AACpC,wBAAgB,eAAe;AAC/B,wBAAgB,mBAAmB,cAAc;AAAA,UAC/C,GAAI,gBAAgB,oBAAoB,CAAC;AAAA,UACzC,GAAG;AAAA,QACL,CAAC;AACD,YAAI,OAAO,KAAK,kBAAkB,SAAU,iBAAgB,gBAAgB,KAAK;AACjF,mBAAW,YAAY,KAAK,IAAI;AAChC,cAAM,IAAI,MAAM;AAChB,kBAAU,EAAE,UAAU,iBAAiB,WAAW,KAAK;AAAA,MACzD,OAAO;AACL,cAAM,UAAU,KAAK,IAAI;AAIzB,cAAM,aAAa,WAAW;AAC9B,cAAM,WAAW,IAAI,OAAO,wBAAwB;AAAA,UAClD,IAAI;AAAA,UACJ,cAAc,WAAW;AAAA,UACzB,gBAAgB,KAAK;AAAA,UACrB,gBAAgB;AAAA,UAChB,MAAM;AAAA,UACN,sBAAsB;AAAA,UACtB;AAAA,UACA,SAAS,KAAK;AAAA,UACd,aAAa,MAAM;AAAA,UACnB;AAAA,UACA;AAAA,UACA,eAAe,KAAK,iBAAiB;AAAA,QACvC,CAAC;AACD,YAAI,QAAQ,QAAQ;AACpB,mBAAW,oBAAoB;AAC/B,mBAAW,YAAY,KAAK,IAAI;AAChC,cAAM,IAAI,MAAM;AAChB,kBAAU,EAAE,UAAU,WAAW,MAAM;AAAA,MACzC;AAEA,aAAO;AAAA,QACL;AAAA,QACA,aAAa,MAAM;AAAA,MACrB;AAAA,IACF,CAAC;AAED,UAAM,KAAK,SAAS,sCAAsC;AAAA,MACxD,cAAc,KAAK;AAAA,MACnB,YAAY,OAAO,QAAQ,SAAS;AAAA,MACpC,SAAS,KAAK;AAAA,MACd,aAAa,OAAO;AAAA,MACpB,kBAAkB,OAAO,QAAQ,SAAS,oBAAoB,CAAC;AAAA,IACjE,CAAC;AAED,WAAO,OAAO;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,MAA2C;AACtD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAAG,cAAc,OAAO,QAAQ;AACnD,YAAM,aAAa,MAAM,IAAI;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,IAAI,KAAK;AAAA,UACT,gBAAgB,KAAK;AAAA,UACrB,UAAU,KAAK;AAAA,UACf,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,MACzC;AACA,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,MAC5E;AACA,UAAI,WAAW,WAAW,aAAa;AACrC,cAAM,IAAI,uBAAuB,kBAAkB,iCAAiC,GAAG;AAAA,MACzF;AACA,UAAI,WAAW,WAAW,YAAY;AACpC,cAAM,IAAI,uBAAuB,kBAAkB,2BAA2B,GAAG;AAAA,MACnF;AAQA,YAAM,QAAQ,MAAM,IAAI,QAAQ,qBAAqB;AAAA,QACnD,cAAc,WAAW;AAAA,QACzB,gBAAgB,KAAK;AAAA,QACrB,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,UAAI,CAAC,OAAO;AACV,cAAM,IAAI,uBAAuB,YAAY,yDAAyD,GAAG;AAAA,MAC3G;AAEA,UAAI,WAAW,sBAAsB,KAAK,gBAAgB;AACxD,cAAM,IAAI,uBAAuB,cAAc,8BAA8B,KAAK;AAAA,UAChF,mBAAmB,WAAW;AAAA,QAChC,CAAC;AAAA,MACH;AACA,iBAAW,SAAS;AACpB,iBAAW,cAAc,KAAK,IAAI;AAClC,iBAAW,cAAc,KAAK;AAC9B,UAAI,KAAK,eAAgB,YAAW,iBAAiB,KAAK;AAC1D,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AAED,UAAM,KAAK,SAAS,8BAA8B,EAAE,cAAc,OAAO,GAAG,CAAC;AAC7E,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,MAA2C;AACtD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,MAAM,GAAG,cAAc,OAAO,QAAQ;AACnD,YAAM,aAAa,MAAM,IAAI;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,IAAI,KAAK;AAAA,UACT,gBAAgB,KAAK;AAAA,UACrB,UAAU,KAAK;AAAA,UACf,WAAW;AAAA,QACb;AAAA,QACA,EAAE,UAAU,SAAS,kBAAkB;AAAA,MACzC;AACA,UAAI,CAAC,YAAY;AACf,cAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,MAC5E;AACA,UAAI,WAAW,WAAW,aAAa;AACrC,cAAM,IAAI,uBAAuB,kBAAkB,+CAA+C,GAAG;AAAA,MACvG;AACA,iBAAW,SAAS;AACpB,iBAAW,cAAc;AACzB,iBAAW,cAAc;AACzB,YAAM,IAAI,MAAM;AAChB,aAAO;AAAA,IACT,CAAC;AACD,UAAM,KAAK,SAAS,6BAA6B,EAAE,cAAc,OAAO,GAAG,CAAC;AAC5E,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,YAAY,MAAqD;AACrE,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,IAC5E;AACA,UAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,MAChD,IAAI,WAAW;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,aAAa,2BAA2B,GAAG;AAAA,IAC9E;AACA,UAAM,gBAAgB,kBAAkB,WAAW;AACnD,QAAI,KAAK,SAAS,WAAW,CAAC,cAAc,SAAS,KAAK,IAAI,GAAG;AAC/D,YAAM,IAAI,uBAAuB,gBAAgB,SAAS,KAAK,IAAI,0CAA0C,GAAG;AAAA,IAClH;AACA,UAAM,WAAW,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MACrD,cAAc,WAAW;AAAA,MACzB,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,QAAI,UAAU;AACZ,UAAI,SAAS,SAAS,KAAK,KAAM,QAAO;AAExC,eAAS,YAAY,KAAK,IAAI;AAC9B,SAAG,QAAQ,QAAQ;AAAA,IACrB;AACA,UAAM,UAAU,KAAK,IAAI;AACzB,UAAM,QAAQ,GAAG,OAAO,qBAAqB;AAAA,MAC3C,cAAc,WAAW;AAAA,MACzB,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,OAAG,QAAQ,KAAK;AAChB,UAAM,GAAG,MAAM;AACf,UAAM,KAAK,SAAS,mCAAmC;AAAA,MACrD,cAAc,WAAW;AAAA,MACzB,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,MAAsC;AACtD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,QAAQ,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,cAAc,KAAK;AAAA,MACnB,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,uBAAuB,aAAa,wBAAwB,GAAG;AAAA,IAC3E;AACA,QAAI,MAAM,UAAW;AACrB,UAAM,YAAY,KAAK,IAAI;AAC3B,OAAG,QAAQ,KAAK;AAChB,UAAM,GAAG,MAAM;AAAA,EACjB;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,MAAoD;AACnE,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,IAC5E;AACA,UAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,MAChD,IAAI,WAAW;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI,uBAAuB,aAAa,2BAA2B,GAAG;AAAA,IAC9E;AACA,UAAM,WAAW,WAAW,oBACxB,MAAM,GAAG,QAAQ,wBAAwB;AAAA,MACvC,IAAI,WAAW;AAAA,MACf,cAAc,WAAW;AAAA,MACzB,gBAAgB,KAAK;AAAA,IACvB,CAAC,IACD;AACJ,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,uBAAuB,aAAa,+BAA+B,GAAG;AAAA,IAClF;AACA,UAAM,SAAS,MAAM,GAAG,KAAK,qBAAqB;AAAA,MAChD,cAAc,WAAW;AAAA,MACzB,gBAAgB,KAAK;AAAA,MACrB,WAAW;AAAA,IACb,CAAC;AAED,UAAM,WAAW,KAAK,SAAS,QAAQ;AAAA,MACrC,IAAI,YAAY;AAAA,MAChB,WAAW,YAAY;AAAA,MACvB,QAAQ,YAAY;AAAA,MACpB,UAAU,YAAY;AAAA,IACxB,CAAC;AACD,UAAM,cAAc,MAAM,KAAK,eAAe,KAAK,gBAAgB,QAAQ;AAc3E,UAAM,aAAa,KAAK,eAClB,KAAK,eACL,OAAO,KAAK,CAAC,UAAU,MAAM,WAAW,KAAK,gBAAgB,CAAC,MAAM,SAAS,GAAG,QAAQ,OACxF;AAEN,UAAM,cAAc,KAAK,aAAa,OAClC,cAIA,eAAe,OACb,CAAC,IACD,aAAa;AAAA,MACb,YAAY,KAAK;AAAA,MACjB;AAAA,MACA,QAAQ,YAAY;AAAA,MACpB,MAAM;AAAA,MACN;AAAA,IACF,CAAC;AAGL,UAAM,KAAK,YAAY;AAAA,MACrB,cAAc,WAAW;AAAA,MACzB,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,SAAS,KAAK,WAAW;AAAA,MACzB,OAAO;AAAA,IACT,CAAC;AAED,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,MAGjB;AACD,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,IAC5E;AACA,UAAM,YAAY,MAAM,GAAG;AAAA,MACzB;AAAA,MACA,EAAE,cAAc,WAAW,IAAI,gBAAgB,KAAK,eAAe;AAAA,MACnE,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AAGA,UAAM,KAAK,YAAY;AAAA,MACrB,cAAc,WAAW;AAAA,MACzB,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,SAAS;AAAA,MACT,OAAO;AAAA,IACT,CAAC;AAED,WAAO,EAAE,YAAY,UAAU;AAAA,EACjC;AAAA,EAEA,MAAM,yBAAyB,MAAqF;AAClH,UAAM,KAAK,KAAK,UAAU;AAC1B,WAAO,GAAG;AAAA,MACR;AAAA,MACA;AAAA,QACE,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,aAAa,KAAK;AAAA,QAClB,WAAW,KAAK;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,cAAc,OAAO,EAAE;AAAA,IACtC;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,MAK4D;AACtF,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,QAAiC;AAAA,MACrC,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AACA,QAAI,KAAK,OAAQ,OAAM,SAAS,KAAK;AAErC,UAAM,WAAW,MAAM,GAAG,KAAK,aAAa;AAAA,MAC1C,QAAQ,KAAK;AAAA,MACb,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,UAAM,aAAa,SAAS,IAAI,CAAC,MAAM,EAAE,EAAE;AAC3C,QAAI,WAAW,WAAW,GAAG;AAC3B,aAAO,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,KAAK,MAAM,UAAU,KAAK,SAAS;AAAA,IACzE;AACA,UAAM,gBAAgB,EAAE,KAAK,WAAW;AACxC,UAAM,SAAS,KAAK,IAAI,IAAI,KAAK,OAAO,KAAK,KAAK,QAAQ;AAC1D,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,GAAG;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,QACE,SAAS,EAAE,cAAc,OAAO;AAAA,QAChC,OAAO,KAAK;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,OAAO,MAAM,KAAK,MAAM,UAAU,KAAK,SAAS;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA,EAMA,MAAc,eACZ,gBACA,UACkC;AAClC,UAAM,aAAa,aAAa,SAAS,IAAI;AAC7C,QAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AACrC,UAAM,QAAQ,MAAM,KAAK,WAAW,QAAQ,gBAAgB,UAAU;AACtE,QAAI,MAAM,WAAW,EAAG,QAAO,CAAC;AAChC,QAAI;AACF,aAAO,KAAK,MAAM,MAAM,SAAS,MAAM,CAAC;AAAA,IAC1C,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAAA,EAEA,MAAc,SACZ,SACA,SACe;AACf,QAAI;AACF,YAAM,KAAK,UAAU,SAAS,OAAO;AAAA,IACvC,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAK,OAAO,KAAK,EAAE,OAAO,sCAAsC,SAAS,QAAQ,GAAG,6BAA6B;AAAA,IACnH;AAAA,EACF;AACF;AAMA,SAAS,aAAa,OAA6C;AACjE,MAAI,OAAO,SAAS,KAAK,EAAG,QAAO;AACnC,MAAI,iBAAiB,WAAY,QAAO,OAAO,KAAK,KAAK;AACzD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,OAAO,QAAQ;AACjE,SAAO,OAAO,MAAM,CAAC;AACvB;AAEA,SAAS,kBAAkB,aAAoC;AAK7D,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,QAAQ,YAAY;AAC1B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,SAAS,MAAO,KAAI,OAAO,UAAU,SAAU,UAAS,IAAI,KAAK;AAAA,EAC9E;AACA,QAAM,aAAc,YAAY,SAAwD,YAAY;AACpG,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,eAAW,SAAS,WAAY,KAAI,OAAO,UAAU,SAAU,UAAS,IAAI,KAAK;AAAA,EACnF;AACA,SAAO,MAAM,KAAK,QAAQ;AAC5B;AAEA,SAAS,qBAAqB,aAAyC;AACrE,QAAM,QAAS,YAAY,SAAwD,yBAAyB;AAC5G,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,IAAI,QAAQ;AACjE;AAEA,SAAS,wBACP,OACA,MACU;AACV,QAAM,OAAO,oBAAI,IAAY,CAAC,GAAG,OAAO,KAAK,KAAK,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC;AAC1E,QAAM,UAAoB,CAAC;AAC3B,aAAW,OAAO,MAAM;AACtB,UAAM,IAAI,MAAM,GAAG;AACnB,UAAM,IAAI,KAAK,GAAG;AAClB,QAAI,CAAC,UAAU,GAAG,CAAC,EAAG,SAAQ,KAAK,GAAG;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,UAAU,GAAY,GAAqB;AAClD,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,MAAM,QAAQ,MAAM,KAAM,QAAO;AACrC,MAAI,OAAO,MAAM,OAAO,EAAG,QAAO;AAClC,MAAI,OAAO,MAAM,SAAU,QAAO;AAClC,MAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;AACxC,QAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,EAAG,QAAO;AACnD,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,WAAO,EAAE,MAAM,CAAC,OAAO,UAAU,UAAU,OAAO,EAAE,KAAK,CAAC,CAAC;AAAA,EAC7D;AACA,QAAM,QAAQ,OAAO,KAAK,CAA4B;AACtD,QAAM,QAAQ,OAAO,KAAK,CAA4B;AACtD,MAAI,MAAM,WAAW,MAAM,OAAQ,QAAO;AAC1C,SAAO,MAAM,MAAM,CAAC,QAAQ,UAAW,EAA8B,GAAG,GAAI,EAA8B,GAAG,CAAC,CAAC;AACjH;AAEA,SAAS,cAAc,QAA4B;AACjD,SAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC;AACnC;AAEA,SAAS,4BAA4B,SAAwC;AAC3E,QAAM,QAAQ,OAAO,WAAW,KAAK,UAAU,OAAO,GAAG,MAAM;AAC/D,MAAI,SAAS,6BAA8B;AAC3C,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,UAAU,6BAA6B;AAAA,EAC3C;AACF;AAEA,SAAS,2BACP,UACA,QACA,SACM;AACN,QAAM,aACJ,OAAO,cAAc,OAAO,OAAO,eAAe,YAAY,CAAC,MAAM,QAAQ,OAAO,UAAU,IACzF,OAAO,aACR,CAAC;AACP,aAAW,CAAC,UAAU,UAAU,KAAK,OAAO,QAAQ,SAAS,UAAU,GAAG;AACxE,QAAI,EAAE,YAAY,SAAU;AAC5B,UAAM,UAAU,WAAW,QAAQ;AACnC,UAAM,YACJ,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3D,UACD;AACN,UAAM,SAAS;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,WAAW;AAAA,MACX;AAAA,MACA,WAAW;AAAA,MACX;AAAA,IACF;AACA,QAAI,OAAO,MAAO;AAClB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,QAAQ,CAAC,EAAE,UAAU,MAAM,OAAO,MAAM,SAAS,OAAO,QAAQ,CAAC,EAAE;AAAA,IACvE;AAAA,EACF;AACF;AAWA,SAAS,aAAa,MAMM;AAC1B,QAAM,aAAa,KAAK,WAAW,QAAQ,KAAK,UAAU,KAAK,IAAI,EAAE,iBAAiB,KAAK,WAAW;AACtG,QAAM,UAAU,wBAAwB;AAAA,IACtC,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,EACb,CAAC;AACD,SAAO,kBAAkB,YAAY,OAAO;AAC9C;AAGO,SAAS,yBAAyB,OAAiD;AACxF,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,mCAAmC;AAC5F;",
+  "names": []
+}

package/dist/modules/forms/services/upload-scanner.js

@@ -0,0 +1,9 @@
+class NoopUploadScanner {
+  async scan() {
+    return { clean: true };
+  }
+}
+export {
+  NoopUploadScanner
+};
+//# sourceMappingURL=upload-scanner.js.map

package/dist/modules/forms/services/upload-scanner.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/upload-scanner.ts"],
+  "sourcesContent": ["/**\n * Pluggable virus / malware scan hook \u2014 W4 (SEC-4).\n *\n * The default implementation is a NO-OP that reports every payload as clean.\n * Operators inject a real scanner (ClamAV, a cloud AV API, \u2026) by registering\n * an `UploadScanner` under the DI key `formsUploadScanner` \u2014 see `di.ts`. When\n * a scanner reports `{ clean: false }`, the upload service rejects the upload\n * (HTTP 422) and never persists the bytes.\n */\n\nexport type UploadScanInput = {\n  bytes: Buffer\n  contentType: string\n  filename: string\n}\n\nexport type UploadScanResult = {\n  clean: boolean\n  /** Optional human-readable reason surfaced when `clean === false`. */\n  reason?: string\n}\n\nexport interface UploadScanner {\n  scan(input: UploadScanInput): Promise<UploadScanResult>\n}\n\n/**\n * Default no-op scanner. SAFE-BY-DECLARATION ONLY \u2014 it performs no inspection\n * and always returns `{ clean: true }`. Operators MUST replace it with a real\n * scanner before accepting untrusted uploads in production.\n */\nexport class NoopUploadScanner implements UploadScanner {\n  async scan(): Promise<UploadScanResult> {\n    return { clean: true }\n  }\n}\n"],
+  "mappings": "AA+BO,MAAM,kBAA2C;AAAA,EACtD,MAAM,OAAkC;AACtC,WAAO,EAAE,OAAO,KAAK;AAAA,EACvB;AACF;",
+  "names": []
+}

package/dist/modules/forms/services/upload-validation.js

@@ -0,0 +1,54 @@
+const DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024;
+function resolveMaxUploadBytes(env = process.env) {
+  const raw = env.FORMS_MAX_UPLOAD_BYTES;
+  if (typeof raw !== "string" || raw.trim().length === 0) return DEFAULT_MAX_UPLOAD_BYTES;
+  const parsed = Number.parseInt(raw.trim(), 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_UPLOAD_BYTES;
+  return parsed;
+}
+function matchesAcceptEntry(contentType, entry) {
+  const normalizedType = contentType.trim().toLowerCase();
+  const normalizedEntry = entry.trim().toLowerCase();
+  if (normalizedEntry.length === 0) return false;
+  if (normalizedEntry === "*/*") return true;
+  if (normalizedEntry.endsWith("/*")) {
+    const prefix = normalizedEntry.slice(0, normalizedEntry.length - 1);
+    return normalizedType.startsWith(prefix);
+  }
+  return normalizedType === normalizedEntry;
+}
+function isContentTypeAllowed(contentType, accept) {
+  if (!accept || accept.length === 0) return true;
+  return accept.some((entry) => matchesAcceptEntry(contentType, entry));
+}
+function evaluateUploadGate(input) {
+  if (!Number.isFinite(input.sizeBytes) || input.sizeBytes <= 0) {
+    return { ok: false, code: "EMPTY", status: 413, message: "Uploaded file is empty." };
+  }
+  const fieldCap = typeof input.fieldMaxSizeBytes === "number" && Number.isFinite(input.fieldMaxSizeBytes) && input.fieldMaxSizeBytes > 0 ? input.fieldMaxSizeBytes : null;
+  const effectiveCap = fieldCap === null ? input.hardCeilingBytes : Math.min(fieldCap, input.hardCeilingBytes);
+  if (input.sizeBytes > effectiveCap) {
+    return {
+      ok: false,
+      code: "TOO_LARGE",
+      status: 413,
+      message: `File exceeds the maximum allowed size of ${effectiveCap} bytes.`
+    };
+  }
+  if (!isContentTypeAllowed(input.contentType, input.accept)) {
+    return {
+      ok: false,
+      code: "DISALLOWED_TYPE",
+      status: 422,
+      message: `Content type "${input.contentType}" is not allowed for this field.`
+    };
+  }
+  return { ok: true };
+}
+export {
+  DEFAULT_MAX_UPLOAD_BYTES,
+  evaluateUploadGate,
+  isContentTypeAllowed,
+  resolveMaxUploadBytes
+};
+//# sourceMappingURL=upload-validation.js.map

package/dist/modules/forms/services/upload-validation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/upload-validation.ts"],
+  "sourcesContent": ["/**\n * Pure upload-gate helpers \u2014 W4 (SEC-4).\n *\n * No I/O, no DI. Used by the attachment service / API routes to enforce the\n * MIME allowlist and size ceilings BEFORE any bytes are persisted. The server\n * is always authoritative; the renderer mirrors these checks only for UX.\n */\n\n/** Default server-side hard ceiling (10 MiB) when `FORMS_MAX_UPLOAD_BYTES` is unset/invalid. */\nexport const DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024\n\nexport type UploadGateInput = {\n  contentType: string\n  sizeBytes: number\n  /** Field-configured MIME allowlist (`x-om-accept`). Empty \u21D2 any type allowed. */\n  accept?: string[] | null\n  /** Field-configured max size (`x-om-max-size-bytes`). */\n  fieldMaxSizeBytes?: number | null\n  /** Server-side hard ceiling (env `FORMS_MAX_UPLOAD_BYTES`). */\n  hardCeilingBytes: number\n}\n\nexport type UploadGateResult =\n  | { ok: true }\n  | { ok: false; code: 'EMPTY' | 'TOO_LARGE'; status: 413; message: string }\n  | { ok: false; code: 'DISALLOWED_TYPE'; status: 422; message: string }\n\n/**\n * Resolves the server-side hard upload ceiling from the environment. Falls\n * back to {@link DEFAULT_MAX_UPLOAD_BYTES} when unset, non-numeric, or <= 0.\n */\nexport function resolveMaxUploadBytes(env: NodeJS.ProcessEnv = process.env): number {\n  const raw = env.FORMS_MAX_UPLOAD_BYTES\n  if (typeof raw !== 'string' || raw.trim().length === 0) return DEFAULT_MAX_UPLOAD_BYTES\n  const parsed = Number.parseInt(raw.trim(), 10)\n  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_UPLOAD_BYTES\n  return parsed\n}\n\n/**\n * Matches a concrete content-type against an allowlist entry. Supports exact\n * matches and wildcard subtypes (`image/*`).\n */\nfunction matchesAcceptEntry(contentType: string, entry: string): boolean {\n  const normalizedType = contentType.trim().toLowerCase()\n  const normalizedEntry = entry.trim().toLowerCase()\n  if (normalizedEntry.length === 0) return false\n  if (normalizedEntry === '*/*') return true\n  if (normalizedEntry.endsWith('/*')) {\n    const prefix = normalizedEntry.slice(0, normalizedEntry.length - 1) // keep trailing slash\n    return normalizedType.startsWith(prefix)\n  }\n  return normalizedType === normalizedEntry\n}\n\nexport function isContentTypeAllowed(contentType: string, accept?: string[] | null): boolean {\n  if (!accept || accept.length === 0) return true\n  return accept.some((entry) => matchesAcceptEntry(contentType, entry))\n}\n\n/**\n * Enforces empty / size / MIME rules. The effective size cap is the smaller of\n * the field-configured cap and the server hard ceiling; the server ceiling\n * always wins even if the field config is larger or absent.\n */\nexport function evaluateUploadGate(input: UploadGateInput): UploadGateResult {\n  if (!Number.isFinite(input.sizeBytes) || input.sizeBytes <= 0) {\n    return { ok: false, code: 'EMPTY', status: 413, message: 'Uploaded file is empty.' }\n  }\n  const fieldCap =\n    typeof input.fieldMaxSizeBytes === 'number'\n      && Number.isFinite(input.fieldMaxSizeBytes)\n      && input.fieldMaxSizeBytes > 0\n      ? input.fieldMaxSizeBytes\n      : null\n  const effectiveCap = fieldCap === null ? input.hardCeilingBytes : Math.min(fieldCap, input.hardCeilingBytes)\n  if (input.sizeBytes > effectiveCap) {\n    return {\n      ok: false,\n      code: 'TOO_LARGE',\n      status: 413,\n      message: `File exceeds the maximum allowed size of ${effectiveCap} bytes.`,\n    }\n  }\n  if (!isContentTypeAllowed(input.contentType, input.accept)) {\n    return {\n      ok: false,\n      code: 'DISALLOWED_TYPE',\n      status: 422,\n      message: `Content type \"${input.contentType}\" is not allowed for this field.`,\n    }\n  }\n  return { ok: true }\n}\n"],
+  "mappings": "AASO,MAAM,2BAA2B,KAAK,OAAO;AAsB7C,SAAS,sBAAsB,MAAyB,QAAQ,KAAa;AAClF,QAAM,MAAM,IAAI;AAChB,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AAC/D,QAAM,SAAS,OAAO,SAAS,IAAI,KAAK,GAAG,EAAE;AAC7C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO;AACT;AAMA,SAAS,mBAAmB,aAAqB,OAAwB;AACvE,QAAM,iBAAiB,YAAY,KAAK,EAAE,YAAY;AACtD,QAAM,kBAAkB,MAAM,KAAK,EAAE,YAAY;AACjD,MAAI,gBAAgB,WAAW,EAAG,QAAO;AACzC,MAAI,oBAAoB,MAAO,QAAO;AACtC,MAAI,gBAAgB,SAAS,IAAI,GAAG;AAClC,UAAM,SAAS,gBAAgB,MAAM,GAAG,gBAAgB,SAAS,CAAC;AAClE,WAAO,eAAe,WAAW,MAAM;AAAA,EACzC;AACA,SAAO,mBAAmB;AAC5B;AAEO,SAAS,qBAAqB,aAAqB,QAAmC;AAC3F,MAAI,CAAC,UAAU,OAAO,WAAW,EAAG,QAAO;AAC3C,SAAO,OAAO,KAAK,CAAC,UAAU,mBAAmB,aAAa,KAAK,CAAC;AACtE;AAOO,SAAS,mBAAmB,OAA0C;AAC3E,MAAI,CAAC,OAAO,SAAS,MAAM,SAAS,KAAK,MAAM,aAAa,GAAG;AAC7D,WAAO,EAAE,IAAI,OAAO,MAAM,SAAS,QAAQ,KAAK,SAAS,0BAA0B;AAAA,EACrF;AACA,QAAM,WACJ,OAAO,MAAM,sBAAsB,YAC9B,OAAO,SAAS,MAAM,iBAAiB,KACvC,MAAM,oBAAoB,IAC3B,MAAM,oBACN;AACN,QAAM,eAAe,aAAa,OAAO,MAAM,mBAAmB,KAAK,IAAI,UAAU,MAAM,gBAAgB;AAC3G,MAAI,MAAM,YAAY,cAAc;AAClC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,4CAA4C,YAAY;AAAA,IACnE;AAAA,EACF;AACA,MAAI,CAAC,qBAAqB,MAAM,aAAa,MAAM,MAAM,GAAG;AAC1D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS,iBAAiB,MAAM,WAAW;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,EAAE,IAAI,KAAK;AACpB;",
+  "names": []
+}

package/dist/modules/forms/services/visibility-resolver.js

@@ -0,0 +1,30 @@
+import { evaluateJsonLogic } from "./jsonlogic-evaluator.js";
+function resolveVisibleFieldKeys(args) {
+  const visible = /* @__PURE__ */ new Set();
+  const properties = args.schema.properties ?? {};
+  for (const [fieldKey, node] of Object.entries(properties)) {
+    const policy = args.compiled.rolePolicyLookup(args.role, fieldKey);
+    if (!policy.canRead) continue;
+    const expr = node["x-om-visibility-if"];
+    if (expr === void 0 || expr === null) {
+      visible.add(fieldKey);
+      continue;
+    }
+    if (evaluateJsonLogic(expr, args.data)) {
+      visible.add(fieldKey);
+    }
+  }
+  return visible;
+}
+function sliceByVisibility(data, visible) {
+  const out = {};
+  for (const key of Object.keys(data)) {
+    if (visible.has(key)) out[key] = data[key];
+  }
+  return out;
+}
+export {
+  resolveVisibleFieldKeys,
+  sliceByVisibility
+};
+//# sourceMappingURL=visibility-resolver.js.map

package/dist/modules/forms/services/visibility-resolver.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/visibility-resolver.ts"],
+  "sourcesContent": ["import { evaluateJsonLogic, type JsonLogicExpression } from './jsonlogic-evaluator'\nimport type { CompiledFormVersion } from './form-version-compiler'\n\n/**\n * Phase 2c \u2014 resolve which fields are visible for a given role + current data.\n *\n * Decoupled from `SubmissionService` so it can be reused both server-side\n * (response slicing) and client-side (renderer hides fields live). The\n * server is authoritative; the client evaluator is a UX optimization only.\n *\n * Inputs:\n *   - compiled: phase 1a's `CompiledFormVersion` with the role policy\n *     lookup and the field schema nodes (we read `x-om-visibility-if`\n *     from the original schema).\n *   - schema: the original JSON Schema (we need to access raw\n *     `x-om-visibility-if` expressions; compiled `fieldIndex` only carries\n *     resolved descriptors).\n *   - role: the viewer's role.\n *   - data: decoded submission data.\n *\n * Output: `Set<string>` of visible field keys. Combine with the role\n * policy's visible set for the final response payload.\n */\n\nexport type VisibilitySchemaNode = {\n  'x-om-visibility-if'?: JsonLogicExpression\n}\n\nexport type VisibilityResolverArgs = {\n  compiled: CompiledFormVersion\n  schema: { properties?: Record<string, VisibilitySchemaNode> }\n  role: string\n  data: Record<string, unknown>\n}\n\nexport function resolveVisibleFieldKeys(args: VisibilityResolverArgs): Set<string> {\n  const visible = new Set<string>()\n  const properties = args.schema.properties ?? {}\n  for (const [fieldKey, node] of Object.entries(properties)) {\n    const policy = args.compiled.rolePolicyLookup(args.role, fieldKey)\n    if (!policy.canRead) continue\n    const expr = node['x-om-visibility-if']\n    if (expr === undefined || expr === null) {\n      visible.add(fieldKey)\n      continue\n    }\n    if (evaluateJsonLogic(expr, args.data)) {\n      visible.add(fieldKey)\n    }\n  }\n  return visible\n}\n\nexport function sliceByVisibility<T extends Record<string, unknown>>(\n  data: T,\n  visible: Set<string>,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {}\n  for (const key of Object.keys(data)) {\n    if (visible.has(key)) out[key] = data[key]\n  }\n  return out\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAmD;AAmCrD,SAAS,wBAAwB,MAA2C;AACjF,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,aAAa,KAAK,OAAO,cAAc,CAAC;AAC9C,aAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,UAAU,GAAG;AACzD,UAAM,SAAS,KAAK,SAAS,iBAAiB,KAAK,MAAM,QAAQ;AACjE,QAAI,CAAC,OAAO,QAAS;AACrB,UAAM,OAAO,KAAK,oBAAoB;AACtC,QAAI,SAAS,UAAa,SAAS,MAAM;AACvC,cAAQ,IAAI,QAAQ;AACpB;AAAA,IACF;AACA,QAAI,kBAAkB,MAAM,KAAK,IAAI,GAAG;AACtC,cAAQ,IAAI,QAAQ;AAAA,IACtB;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,kBACd,MACA,SACyB;AACzB,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,IAAI,GAAG;AACnC,QAAI,QAAQ,IAAI,GAAG,EAAG,KAAI,GAAG,IAAI,KAAK,GAAG;AAAA,EAC3C;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/setup.js

@@ -0,0 +1,18 @@
+const setup = {
+  defaultRoleFeatures: {
+    admin: [
+      "forms.view",
+      "forms.design",
+      "forms.submissions.manage",
+      "forms.submissions.export",
+      "forms.submissions.anonymize",
+      "forms.distribute"
+    ]
+  }
+};
+var setup_default = setup;
+export {
+  setup_default as default,
+  setup
+};
+//# sourceMappingURL=setup.js.map

package/dist/modules/forms/setup.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/forms/setup.ts"],
+  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    admin: [\n      'forms.view',\n      'forms.design',\n      'forms.submissions.manage',\n      'forms.submissions.export',\n      'forms.submissions.anonymize',\n      'forms.distribute',\n    ],\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/forms/subscribers/forms-consent-projector.js

@@ -0,0 +1,58 @@
+import { FormSubmission } from "../data/entities.js";
+import { emitFormsEvent } from "../events.js";
+import { formsEventPayloadSchemas } from "../events-payloads.js";
+const metadata = {
+  event: "forms.submission.submitted",
+  persistent: true,
+  id: "forms.consent-projector.submitted"
+};
+async function handleSubmissionSubmitted(payload, ctx) {
+  try {
+    const em = ctx.container.resolve("em").fork();
+    const submission = await em.findOne(FormSubmission, {
+      id: payload.submissionId,
+      deletedAt: null
+    });
+    if (!submission || submission.status !== "submitted") return;
+    const service = ctx.container.resolve("formsConsentRecordService");
+    const created = await service.projectFromSubmission({
+      submissionId: submission.id,
+      organizationId: submission.organizationId,
+      tenantId: submission.tenantId
+    });
+    for (const record of created) {
+      await safeEmitConsentRecorded(record.id, submission.id);
+    }
+  } catch (error) {
+    tryResolveLogger(ctx.container)?.warn(
+      {
+        event: "forms.consent_projector.failed",
+        submissionId: payload.submissionId,
+        message: error instanceof Error ? error.message : "Unknown projection error"
+      },
+      "forms consent projection failed (swallowed \u2014 submit pipeline unaffected)"
+    );
+  }
+}
+async function safeEmitConsentRecorded(recordId, submissionId) {
+  try {
+    const validated = formsEventPayloadSchemas["forms.consent.recorded"].parse({ recordId, submissionId });
+    await emitFormsEvent("forms.consent.recorded", validated);
+  } catch {
+  }
+}
+function tryResolveLogger(container) {
+  try {
+    const resolved = container.resolve("logger");
+    if (resolved && typeof resolved.warn === "function") {
+      return resolved;
+    }
+  } catch {
+  }
+  return null;
+}
+export {
+  handleSubmissionSubmitted as default,
+  metadata
+};
+//# sourceMappingURL=forms-consent-projector.js.map

package/dist/modules/forms/subscribers/forms-consent-projector.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/subscribers/forms-consent-projector.ts"],
+  "sourcesContent": ["/**\n * Phase 3 Track D \u2014 consent-record projector.\n *\n * Reacts to `forms.submission.submitted` (id-only payload) and projects every\n * signed `signature`-typed answer into the `forms_consent_record` aggregate\n * via `ConsentRecordService`. For each signature field with a value it creates\n * a fresh `active` record and supersedes any prior `active` record for the\n * same subject + form + clause.\n *\n * Org/tenant scope is re-derived from the persisted submission row inside the\n * service (the event payload is id-only by catalog construction).\n *\n * Idempotent (the service no-ops when a record already exists for the\n * submission + field) and fail-soft: any error is logged + swallowed so a\n * projection failure never breaks the submit pipeline. The subscriber is\n * `persistent: true` so delivery is at-least-once.\n */\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FormSubmission } from '../data/entities'\nimport type { ConsentRecordService } from '../services/consent-record-service'\nimport { emitFormsEvent } from '../events'\nimport { formsEventPayloadSchemas } from '../events-payloads'\n\nexport const metadata = {\n  event: 'forms.submission.submitted',\n  persistent: true,\n  id: 'forms.consent-projector.submitted',\n}\n\ntype ResolveContainer = {\n  resolve: <T = unknown>(key: string) => T\n}\n\ntype SubscriberContext = {\n  container: ResolveContainer\n}\n\ntype SubmissionSubmittedPayload = {\n  submissionId: string\n}\n\ntype Logger = {\n  warn: (data: Record<string, unknown>, message: string) => void\n}\n\nexport default async function handleSubmissionSubmitted(\n  payload: SubmissionSubmittedPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  try {\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const submission = await em.findOne(FormSubmission, {\n      id: payload.submissionId,\n      deletedAt: null,\n    })\n    if (!submission || submission.status !== 'submitted') return\n\n    const service = ctx.container.resolve('formsConsentRecordService') as ConsentRecordService\n    const created = await service.projectFromSubmission({\n      submissionId: submission.id,\n      organizationId: submission.organizationId,\n      tenantId: submission.tenantId,\n    })\n\n    for (const record of created) {\n      await safeEmitConsentRecorded(record.id, submission.id)\n    }\n  } catch (error) {\n    tryResolveLogger(ctx.container)?.warn(\n      {\n        event: 'forms.consent_projector.failed',\n        submissionId: payload.submissionId,\n        message: error instanceof Error ? error.message : 'Unknown projection error',\n      },\n      'forms consent projection failed (swallowed \u2014 submit pipeline unaffected)',\n    )\n  }\n}\n\nasync function safeEmitConsentRecorded(recordId: string, submissionId: string): Promise<void> {\n  try {\n    const validated = formsEventPayloadSchemas['forms.consent.recorded'].parse({ recordId, submissionId })\n    await emitFormsEvent('forms.consent.recorded', validated)\n  } catch {\n    /* event emission is best-effort \u2014 the record is already persisted */\n  }\n}\n\nfunction tryResolveLogger(container: ResolveContainer): Logger | null {\n  try {\n    const resolved = container.resolve('logger')\n    if (resolved && typeof (resolved as { warn?: unknown }).warn === 'function') {\n      return resolved as Logger\n    }\n  } catch {\n    /* logger is optional */\n  }\n  return null\n}\n"],
+  "mappings": "AAmBA,SAAS,sBAAsB;AAE/B,SAAS,sBAAsB;AAC/B,SAAS,gCAAgC;AAElC,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAkBA,eAAO,0BACL,SACA,KACe;AACf,MAAI;AACF,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,QAAQ;AAAA,MACZ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,cAAc,WAAW,WAAW,YAAa;AAEtD,UAAM,UAAU,IAAI,UAAU,QAAQ,2BAA2B;AACjE,UAAM,UAAU,MAAM,QAAQ,sBAAsB;AAAA,MAClD,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,IACvB,CAAC;AAED,eAAW,UAAU,SAAS;AAC5B,YAAM,wBAAwB,OAAO,IAAI,WAAW,EAAE;AAAA,IACxD;AAAA,EACF,SAAS,OAAO;AACd,qBAAiB,IAAI,SAAS,GAAG;AAAA,MAC/B;AAAA,QACE,OAAO;AAAA,QACP,cAAc,QAAQ;AAAA,QACtB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACpD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,UAAkB,cAAqC;AAC5F,MAAI;AACF,UAAM,YAAY,yBAAyB,wBAAwB,EAAE,MAAM,EAAE,UAAU,aAAa,CAAC;AACrG,UAAM,eAAe,0BAA0B,SAAS;AAAA,EAC1D,QAAQ;AAAA,EAER;AACF;AAEA,SAAS,iBAAiB,WAA4C;AACpE,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,QAAQ;AAC3C,QAAI,YAAY,OAAQ,SAAgC,SAAS,YAAY;AAC3E,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/subscribers/forms-pdf-snapshot.js

@@ -0,0 +1,68 @@
+import { createQueue, resolveQueueStrategy } from "@open-mercato/queue";
+import { FormSubmission } from "../data/entities.js";
+import { PDF_SNAPSHOT_QUEUE_NAME } from "../workers/pdf-snapshot.js";
+const metadata = {
+  event: "forms.submission.submitted",
+  persistent: true,
+  id: "forms.pdf-snapshot.submitted"
+};
+async function handleSubmissionSubmitted(payload, ctx) {
+  const em = ctx.container.resolve("em").fork();
+  const submission = await em.findOne(FormSubmission, {
+    id: payload.submissionId,
+    deletedAt: null
+  });
+  if (!submission || submission.status !== "submitted") return;
+  if (submission.pdfSnapshotAttachmentId) return;
+  const job = {
+    submissionId: submission.id,
+    organizationId: submission.organizationId,
+    tenantId: submission.tenantId
+  };
+  try {
+    const queue = createQueue(PDF_SNAPSHOT_QUEUE_NAME, resolveQueueStrategy());
+    await queue.enqueue(job);
+    return;
+  } catch (error) {
+    tryResolveLogger(ctx.container)?.warn(
+      {
+        event: "forms.pdf_snapshot.enqueue_failed",
+        submissionId: payload.submissionId,
+        message: error instanceof Error ? error.message : "Unknown enqueue error"
+      },
+      "forms PDF snapshot enqueue failed (falling back to inline generation)"
+    );
+  }
+  try {
+    const service = ctx.container.resolve("formsPdfSnapshotService");
+    await service.ensureSnapshot({
+      organizationId: submission.organizationId,
+      tenantId: submission.tenantId,
+      submissionId: submission.id
+    });
+  } catch (error) {
+    tryResolveLogger(ctx.container)?.warn(
+      {
+        event: "forms.pdf_snapshot.generation_failed",
+        submissionId: payload.submissionId,
+        message: error instanceof Error ? error.message : "Unknown snapshot error"
+      },
+      "forms PDF snapshot inline fallback failed (will retry on download)"
+    );
+  }
+}
+function tryResolveLogger(container) {
+  try {
+    const resolved = container.resolve("logger");
+    if (resolved && typeof resolved.warn === "function") {
+      return resolved;
+    }
+  } catch {
+  }
+  return null;
+}
+export {
+  handleSubmissionSubmitted as default,
+  metadata
+};
+//# sourceMappingURL=forms-pdf-snapshot.js.map

package/dist/modules/forms/subscribers/forms-pdf-snapshot.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/subscribers/forms-pdf-snapshot.ts"],
+  "sourcesContent": ["/**\n * W3 (T7) \u2014 signed-PDF snapshot dispatch on submit.\n *\n * Reacts to `forms.submission.submitted` and ENQUEUES a job on the\n * `forms-pdf-snapshot` queue so the (CPU-heavy, pdf-lib) render runs off the\n * submit request path in a dedicated worker (`workers/pdf-snapshot.ts`). The\n * `PdfSnapshotService` is idempotent (skips when `pdf_snapshot_attachment_id`\n * is set), so at-least-once delivery is safe.\n *\n * Fail-soft + degradation ladder:\n *   1. Enqueue on the queue (preferred \u2014 off the request path).\n *   2. If enqueueing throws (queue misconfigured / unavailable), fall back to\n *      inline generation so a snapshot is still produced.\n *   3. If inline generation also fails, log + swallow \u2014 the snapshot is also\n *      generated lazily on first download, so submit never breaks.\n *\n * Org/tenant scope is re-derived from the persisted submission row (never from\n * the event payload, which is id-only by catalog construction).\n */\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createQueue, resolveQueueStrategy } from '@open-mercato/queue'\nimport { FormSubmission } from '../data/entities'\nimport type { PdfSnapshotService } from '../services/pdf-snapshot-service'\nimport { PDF_SNAPSHOT_QUEUE_NAME, type PdfSnapshotJob } from '../workers/pdf-snapshot'\n\nexport const metadata = {\n  event: 'forms.submission.submitted',\n  persistent: true,\n  id: 'forms.pdf-snapshot.submitted',\n}\n\ntype ResolveContainer = {\n  resolve: <T = unknown>(key: string) => T\n}\n\ntype SubscriberContext = {\n  container: ResolveContainer\n}\n\ntype SubmissionSubmittedPayload = {\n  submissionId: string\n}\n\ntype Logger = {\n  warn: (data: Record<string, unknown>, message: string) => void\n}\n\nexport default async function handleSubmissionSubmitted(\n  payload: SubmissionSubmittedPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const submission = await em.findOne(FormSubmission, {\n    id: payload.submissionId,\n    deletedAt: null,\n  })\n  if (!submission || submission.status !== 'submitted') return\n  if (submission.pdfSnapshotAttachmentId) return\n\n  const job: PdfSnapshotJob = {\n    submissionId: submission.id,\n    organizationId: submission.organizationId,\n    tenantId: submission.tenantId,\n  }\n\n  try {\n    const queue = createQueue<PdfSnapshotJob>(PDF_SNAPSHOT_QUEUE_NAME, resolveQueueStrategy())\n    await queue.enqueue(job)\n    return\n  } catch (error) {\n    tryResolveLogger(ctx.container)?.warn(\n      {\n        event: 'forms.pdf_snapshot.enqueue_failed',\n        submissionId: payload.submissionId,\n        message: error instanceof Error ? error.message : 'Unknown enqueue error',\n      },\n      'forms PDF snapshot enqueue failed (falling back to inline generation)',\n    )\n  }\n\n  // Fallback: queue unavailable \u2014 generate inline so a snapshot is still made.\n  try {\n    const service = ctx.container.resolve('formsPdfSnapshotService') as PdfSnapshotService\n    await service.ensureSnapshot({\n      organizationId: submission.organizationId,\n      tenantId: submission.tenantId,\n      submissionId: submission.id,\n    })\n  } catch (error) {\n    tryResolveLogger(ctx.container)?.warn(\n      {\n        event: 'forms.pdf_snapshot.generation_failed',\n        submissionId: payload.submissionId,\n        message: error instanceof Error ? error.message : 'Unknown snapshot error',\n      },\n      'forms PDF snapshot inline fallback failed (will retry on download)',\n    )\n  }\n}\n\nfunction tryResolveLogger(container: ResolveContainer): Logger | null {\n  try {\n    const resolved = container.resolve('logger')\n    if (resolved && typeof (resolved as { warn?: unknown }).warn === 'function') {\n      return resolved as Logger\n    }\n  } catch {\n    /* logger is optional */\n  }\n  return null\n}\n"],
+  "mappings": "AAqBA,SAAS,aAAa,4BAA4B;AAClD,SAAS,sBAAsB;AAE/B,SAAS,+BAAoD;AAEtD,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAkBA,eAAO,0BACL,SACA,KACe;AACf,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI,QAAQ;AAAA,IACZ,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,cAAc,WAAW,WAAW,YAAa;AACtD,MAAI,WAAW,wBAAyB;AAExC,QAAM,MAAsB;AAAA,IAC1B,cAAc,WAAW;AAAA,IACzB,gBAAgB,WAAW;AAAA,IAC3B,UAAU,WAAW;AAAA,EACvB;AAEA,MAAI;AACF,UAAM,QAAQ,YAA4B,yBAAyB,qBAAqB,CAAC;AACzF,UAAM,MAAM,QAAQ,GAAG;AACvB;AAAA,EACF,SAAS,OAAO;AACd,qBAAiB,IAAI,SAAS,GAAG;AAAA,MAC/B;AAAA,QACE,OAAO;AAAA,QACP,cAAc,QAAQ;AAAA,QACtB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACpD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACF,UAAM,UAAU,IAAI,UAAU,QAAQ,yBAAyB;AAC/D,UAAM,QAAQ,eAAe;AAAA,MAC3B,gBAAgB,WAAW;AAAA,MAC3B,UAAU,WAAW;AAAA,MACrB,cAAc,WAAW;AAAA,IAC3B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,qBAAiB,IAAI,SAAS,GAAG;AAAA,MAC/B;AAAA,QACE,OAAO;AAAA,QACP,cAAc,QAAQ;AAAA,QACtB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACpD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,WAA4C;AACpE,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,QAAQ;AAC3C,QAAI,YAAY,OAAQ,SAAgC,SAAS,YAAY;AAC3E,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/subscribers/forms-webhook-bridge-anonymized.js

@@ -0,0 +1,29 @@
+const metadata = {
+  event: "forms.submission.anonymized",
+  persistent: true,
+  id: "forms.webhook-bridge.anonymized"
+};
+async function handleSubmissionAnonymized(payload, ctx) {
+  let dispatcher = null;
+  try {
+    const resolved = ctx.container.resolve("webhookDispatcher");
+    if (resolved && typeof resolved.dispatch === "function") {
+      dispatcher = resolved;
+    }
+  } catch {
+    return;
+  }
+  if (!dispatcher) return;
+  await dispatcher.dispatch({
+    event: "forms.submission.anonymized",
+    payload: {
+      submissionId: payload.submissionId,
+      emittedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+}
+export {
+  handleSubmissionAnonymized as default,
+  metadata
+};
+//# sourceMappingURL=forms-webhook-bridge-anonymized.js.map

package/dist/modules/forms/subscribers/forms-webhook-bridge-anonymized.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/subscribers/forms-webhook-bridge-anonymized.ts"],
+  "sourcesContent": ["/**\n * Phase 3 Track C \u2014 webhook bridge for anonymized events.\n * See `forms-webhook-bridge.ts` for the rationale.\n */\n\nexport const metadata = {\n  event: 'forms.submission.anonymized',\n  persistent: true,\n  id: 'forms.webhook-bridge.anonymized',\n}\n\ntype Payload = {\n  submissionId: string\n}\n\nexport default async function handleSubmissionAnonymized(payload: Payload, ctx: {\n  container: { resolve: (key: string) => unknown }\n}): Promise<void> {\n  let dispatcher: { dispatch: (event: { event: string; payload: unknown }) => Promise<void> } | null = null\n  try {\n    const resolved = ctx.container.resolve('webhookDispatcher')\n    if (resolved && typeof (resolved as { dispatch?: unknown }).dispatch === 'function') {\n      dispatcher = resolved as { dispatch: (event: { event: string; payload: unknown }) => Promise<void> }\n    }\n  } catch {\n    return\n  }\n  if (!dispatcher) return\n  await dispatcher.dispatch({\n    event: 'forms.submission.anonymized',\n    payload: {\n      submissionId: payload.submissionId,\n      emittedAt: new Date().toISOString(),\n    },\n  })\n}\n"],
+  "mappings": "AAKO,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAMA,eAAO,2BAAkD,SAAkB,KAEzD;AAChB,MAAI,aAAiG;AACrG,MAAI;AACF,UAAM,WAAW,IAAI,UAAU,QAAQ,mBAAmB;AAC1D,QAAI,YAAY,OAAQ,SAAoC,aAAa,YAAY;AACnF,mBAAa;AAAA,IACf;AAAA,EACF,QAAQ;AACN;AAAA,EACF;AACA,MAAI,CAAC,WAAY;AACjB,QAAM,WAAW,SAAS;AAAA,IACxB,OAAO;AAAA,IACP,SAAS;AAAA,MACP,cAAc,QAAQ;AAAA,MACtB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/forms/subscribers/forms-webhook-bridge.js

@@ -0,0 +1,35 @@
+const metadata = {
+  event: "forms.submission.submitted",
+  persistent: true,
+  id: "forms.webhook-bridge.submitted"
+};
+async function handleSubmissionSubmitted(payload, ctx) {
+  const dispatcher = tryResolve(ctx.container, "webhookDispatcher");
+  if (!dispatcher) return;
+  await callDispatcher(dispatcher, {
+    event: "forms.submission.submitted",
+    payload: {
+      submissionId: payload.submissionId,
+      emittedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+}
+function tryResolve(container, key) {
+  try {
+    const resolved = container.resolve(key);
+    if (resolved && typeof resolved.dispatch === "function") {
+      return resolved;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function callDispatcher(dispatcher, event) {
+  await dispatcher.dispatch(event);
+}
+export {
+  handleSubmissionSubmitted as default,
+  metadata
+};
+//# sourceMappingURL=forms-webhook-bridge.js.map

package/dist/modules/forms/subscribers/forms-webhook-bridge.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/subscribers/forms-webhook-bridge.ts"],
+  "sourcesContent": ["/**\n * Phase 3 Track C \u2014 webhook bridge.\n *\n * Forwards `forms.submission.submitted` and `forms.submission.anonymized`\n * events to the project's webhooks module. Payloads are id-only (no\n * sensitive fields) by construction in the catalog (`events-payloads.ts`).\n *\n * The subscriber is `persistent: true` so retries are at-least-once.\n * Idempotent forwarding is the responsibility of the webhooks module.\n */\n\nexport const metadata = {\n  event: 'forms.submission.submitted',\n  persistent: true,\n  id: 'forms.webhook-bridge.submitted',\n}\n\ntype Payload = {\n  submissionId: string\n}\n\nexport default async function handleSubmissionSubmitted(payload: Payload, ctx: {\n  container: { resolve: (key: string) => unknown }\n}): Promise<void> {\n  const dispatcher = tryResolve(ctx.container, 'webhookDispatcher')\n  if (!dispatcher) return\n  await callDispatcher(dispatcher, {\n    event: 'forms.submission.submitted',\n    payload: {\n      submissionId: payload.submissionId,\n      emittedAt: new Date().toISOString(),\n    },\n  })\n}\n\nfunction tryResolve(\n  container: { resolve: (key: string) => unknown },\n  key: string,\n): { dispatch: (event: { event: string; payload: unknown }) => Promise<void> } | null {\n  try {\n    const resolved = container.resolve(key)\n    if (resolved && typeof (resolved as { dispatch?: unknown }).dispatch === 'function') {\n      return resolved as { dispatch: (event: { event: string; payload: unknown }) => Promise<void> }\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\nasync function callDispatcher(\n  dispatcher: { dispatch: (event: { event: string; payload: unknown }) => Promise<void> },\n  event: { event: string; payload: unknown },\n): Promise<void> {\n  await dispatcher.dispatch(event)\n}\n"],
+  "mappings": "AAWO,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAMA,eAAO,0BAAiD,SAAkB,KAExD;AAChB,QAAM,aAAa,WAAW,IAAI,WAAW,mBAAmB;AAChE,MAAI,CAAC,WAAY;AACjB,QAAM,eAAe,YAAY;AAAA,IAC/B,OAAO;AAAA,IACP,SAAS;AAAA,MACP,cAAc,QAAQ;AAAA,MACtB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAAA,EACF,CAAC;AACH;AAEA,SAAS,WACP,WACA,KACoF;AACpF,MAAI;AACF,UAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,QAAI,YAAY,OAAQ,SAAoC,aAAa,YAAY;AACnF,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,eACb,YACA,OACe;AACf,QAAM,WAAW,SAAS,KAAK;AACjC;",
+  "names": []
+}