@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/helpers/integration/formsFixtures.js

@@ -0,0 +1,448 @@
+import { randomUUID } from "node:crypto";
+import { expect } from "@playwright/test";
+import { apiRequest } from "./api.js";
+import { readJsonSafe } from "./generalFixtures.js";
+const AUTOSAVE_MIN_INTERVAL_MS = 5e3;
+async function waitForAutosaveWindow() {
+  await new Promise((resolve) => setTimeout(resolve, AUTOSAVE_MIN_INTERVAL_MS + 400));
+}
+function uniqueFormKey(prefix = "qa_forms") {
+  return `${prefix}_${Date.now()}_${randomUUID().slice(0, 8)}`.toLowerCase();
+}
+function uniqueClientIp() {
+  const octet = () => 1 + Math.floor(Number.parseInt(randomUUID().slice(0, 2), 16) / 1.05);
+  return `203.0.${Math.min(254, octet())}.${Math.min(254, octet())}`;
+}
+function buildMinimalFormSchema() {
+  return {
+    type: "object",
+    "x-om-roles": ["admin", "participant"],
+    "x-om-default-actor-role": "participant",
+    "x-om-sections": [
+      { key: "identity", title: { en: "Identity" }, fieldKeys: ["full_name", "notes"] }
+    ],
+    properties: {
+      full_name: {
+        type: "string",
+        minLength: 1,
+        maxLength: 200,
+        "x-om-type": "text",
+        "x-om-label": { en: "Full name" },
+        "x-om-editable-by": ["participant"],
+        "x-om-visible-to": ["admin", "participant"]
+      },
+      notes: {
+        type: "string",
+        maxLength: 2e3,
+        "x-om-type": "textarea",
+        "x-om-label": { en: "Notes" },
+        "x-om-editable-by": ["participant"],
+        "x-om-visible-to": ["admin", "participant"]
+      }
+    },
+    required: ["full_name"]
+  };
+}
+function buildSensitiveFormSchema() {
+  const schema = buildMinimalFormSchema();
+  const properties = schema.properties;
+  properties.diagnosis = {
+    type: "string",
+    maxLength: 500,
+    "x-om-type": "text",
+    "x-om-label": { en: "Diagnosis" },
+    "x-om-editable-by": ["participant"],
+    "x-om-visible-to": ["admin", "participant"],
+    "x-om-sensitive": true
+  };
+  properties.consented = {
+    type: "boolean",
+    "x-om-type": "boolean",
+    "x-om-label": { en: "Consented?" },
+    "x-om-editable-by": ["participant"],
+    "x-om-visible-to": ["admin", "participant"]
+  };
+  schema["x-om-sections"] = [
+    {
+      key: "identity",
+      title: { en: "Identity" },
+      fieldKeys: ["full_name", "notes", "diagnosis", "consented"]
+    }
+  ];
+  return schema;
+}
+function buildFileFieldFormSchema(options = {}) {
+  const schema = buildMinimalFormSchema();
+  const properties = schema.properties;
+  properties.scan = {
+    type: "array",
+    "x-om-type": "file",
+    "x-om-label": { en: "Scan" },
+    "x-om-editable-by": ["participant"],
+    "x-om-visible-to": ["admin", "participant"],
+    "x-om-accept": options.accept ?? ["image/png"],
+    "x-om-max-size-bytes": options.maxSizeBytes ?? 4096
+  };
+  schema["x-om-sections"] = [
+    { key: "identity", title: { en: "Identity" }, fieldKeys: ["full_name", "notes", "scan"] }
+  ];
+  return schema;
+}
+function buildUncompilableFormSchema() {
+  return {
+    type: "object",
+    "x-om-roles": ["admin", "participant"],
+    "x-om-default-actor-role": "participant",
+    properties: {
+      full_name: {
+        type: "string",
+        "x-om-type": "text",
+        "x-om-label": { en: "Full name" },
+        "x-om-editable-by": ["not_a_declared_role"]
+      }
+    }
+  };
+}
+function buildTinyPngBytes() {
+  return Buffer.from(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8AAAwAB/AF+DHkYAAAAAElFTkSuQmCC",
+    "base64"
+  );
+}
+function resolveUrl(path) {
+  const base = process.env.BASE_URL?.trim();
+  return base ? `${base}${path}` : path;
+}
+async function createFormFixture(request, token, input = {}) {
+  const key = input.key ?? uniqueFormKey();
+  const data = {
+    key,
+    name: input.name ?? `QA Forms ${key}`,
+    defaultLocale: input.defaultLocale ?? "en",
+    supportedLocales: input.supportedLocales ?? ["en"]
+  };
+  if (input.description !== void 0) data.description = input.description;
+  if (input.retentionDays !== void 0) data.retentionDays = input.retentionDays;
+  const response = input.selectedOrgId ? await request.fetch(resolveUrl("/api/forms"), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      Cookie: `om_selected_org=${input.selectedOrgId}`
+    },
+    data
+  }) : await apiRequest(request, "POST", "/api/forms", { token, data });
+  const body = await readJsonSafe(response);
+  expect(response.status(), `POST /api/forms should return 201 (got ${response.status()})`).toBe(201);
+  expect(typeof body?.id === "string" && body.id.length > 0, "form create should return an id").toBe(true);
+  return { id: body.id, key };
+}
+async function forkDraftFixture(request, token, formId, fromVersionId) {
+  const response = await apiRequest(request, "POST", `/api/forms/${formId}/versions/fork`, {
+    token,
+    data: fromVersionId ? { fromVersionId } : {}
+  });
+  const body = await readJsonSafe(response);
+  expect(response.status(), `fork should return 201 (got ${response.status()})`).toBe(201);
+  expect(typeof body?.versionId === "string" && body.versionId.length > 0, "fork should return versionId").toBe(true);
+  return body.versionId;
+}
+async function updateDraftFixture(request, token, formId, versionId, input) {
+  const response = await apiRequest(request, "PATCH", `/api/forms/${formId}/versions/${versionId}`, {
+    token,
+    data: input
+  });
+  expect(
+    response.status(),
+    `draft update should return 200 (got ${response.status()}: ${await response.text()})`
+  ).toBe(200);
+}
+async function publishVersionFixture(request, token, formId, versionId, changelog) {
+  const response = await apiRequest(
+    request,
+    "POST",
+    `/api/forms/${formId}/versions/${versionId}/publish`,
+    { token, data: changelog ? { changelog } : {} }
+  );
+  const body = await readJsonSafe(response);
+  expect(
+    response.status(),
+    `publish should return 200 (got ${response.status()}: ${JSON.stringify(body)})`
+  ).toBe(200);
+  return {
+    versionId: body?.versionId ?? versionId,
+    versionNumber: typeof body?.versionNumber === "number" ? body.versionNumber : 0
+  };
+}
+async function createPublishedFormFixture(request, token, options = {}) {
+  const { schema, uiSchema, roles, ...formInput } = options;
+  const form = await createFormFixture(request, token, formInput);
+  const versionId = await forkDraftFixture(request, token, form.id);
+  await updateDraftFixture(request, token, form.id, versionId, {
+    schema: schema ?? buildMinimalFormSchema(),
+    uiSchema: uiSchema ?? { full_name: { "ui:widget": "text" } },
+    roles: roles ?? ["admin", "participant"]
+  });
+  const published = await publishVersionFixture(request, token, form.id, versionId, "qa publish");
+  return {
+    formId: form.id,
+    formKey: form.key,
+    versionId: published.versionId,
+    versionNumber: published.versionNumber
+  };
+}
+async function deleteFormIfExists(request, token, formId) {
+  if (!token || !formId) return;
+  await apiRequest(request, "DELETE", `/api/forms/${formId}`, { token }).catch(() => void 0);
+}
+async function createDistributionFixture(request, token, formId, input = {}) {
+  const data = {
+    mode: input.mode ?? "open",
+    defaultLocale: input.defaultLocale ?? "en"
+  };
+  for (const key of [
+    "title",
+    "pinnedVersionId",
+    "requireCustomerAuth",
+    "allowMultipleSubmissions",
+    "maxResponses",
+    "opensAt",
+    "closesAt",
+    "redirectUrl",
+    "settings"
+  ]) {
+    if (input[key] !== void 0) data[key] = input[key];
+  }
+  const response = await apiRequest(request, "POST", `/api/forms/${formId}/distributions`, { token, data });
+  const created = await readJsonSafe(response);
+  expect(
+    response.status(),
+    `distribution create should return 201 (got ${response.status()}: ${JSON.stringify(created)})`
+  ).toBe(201);
+  const id = created.id;
+  const detail = await readDistribution(request, token, id);
+  return {
+    id,
+    publicSlug: detail?.publicSlug ?? null,
+    mode: detail?.mode ?? (input.mode ?? "open")
+  };
+}
+async function readDistribution(request, token, distributionId) {
+  const response = await apiRequest(request, "GET", `/api/forms/distributions/${distributionId}`, { token });
+  if (!response.ok()) return null;
+  return readJsonSafe(response);
+}
+async function patchDistribution(request, token, distributionId, data) {
+  return apiRequest(request, "PATCH", `/api/forms/distributions/${distributionId}`, { token, data });
+}
+async function deleteDistributionIfExists(request, token, distributionId) {
+  if (!token || !distributionId) return;
+  await patchDistribution(request, token, distributionId, { status: "closed" }).catch(() => void 0);
+}
+async function createInvitationsFixture(request, token, distributionId, recipients) {
+  const response = await apiRequest(
+    request,
+    "POST",
+    `/api/forms/distributions/${distributionId}/invitations`,
+    { token, data: { recipients } }
+  );
+  const body = await readJsonSafe(response);
+  expect(
+    response.status(),
+    `invitation create should return 201 (got ${response.status()}: ${JSON.stringify(body)})`
+  ).toBe(201);
+  expect(Array.isArray(body?.invitations), "invitation create should return an invitations array").toBe(true);
+  return body.invitations;
+}
+async function listInvitations(request, token, distributionId) {
+  const response = await apiRequest(
+    request,
+    "GET",
+    `/api/forms/distributions/${distributionId}/invitations`,
+    { token }
+  );
+  if (!response.ok()) return null;
+  return readJsonSafe(response);
+}
+async function revokeInvitationIfExists(request, token, distributionId, invitationId) {
+  if (!token || !distributionId || !invitationId) return;
+  await apiRequest(
+    request,
+    "DELETE",
+    `/api/forms/distributions/${distributionId}/invitations/${invitationId}`,
+    { token }
+  ).catch(() => void 0);
+}
+async function startPublicSubmission(request, input) {
+  const data = {};
+  if (input.slug) data.slug = input.slug;
+  if (input.token) data.token = input.token;
+  if (input.locale) data.locale = input.locale;
+  if (input.captchaToken) data.captchaToken = input.captchaToken;
+  const response = await request.fetch(resolveUrl("/api/forms/public/start"), {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "x-forwarded-for": input.clientIp ?? uniqueClientIp()
+    },
+    data
+  });
+  const body = await readJsonSafe(response) ?? {};
+  const submission = body.submission ?? {};
+  const revision = body.revision ?? {};
+  return {
+    status: response.status(),
+    submissionId: submission.id ?? "",
+    revisionId: revision.id ?? "",
+    accessToken: body.access_token ?? "",
+    body
+  };
+}
+async function startPublicSubmissionOrThrow(request, input) {
+  const result = await startPublicSubmission(request, input);
+  expect(
+    result.status,
+    `public start should return 201 (got ${result.status}: ${JSON.stringify(result.body)})`
+  ).toBe(201);
+  expect(result.submissionId, "public start should return a submission id").toBeTruthy();
+  expect(result.revisionId, "public start should return a revision id").toBeTruthy();
+  expect(result.accessToken, "public start should mint an access token").toBeTruthy();
+  return result;
+}
+async function publicAutosave(request, input) {
+  const headers = {
+    "Content-Type": "application/json",
+    "x-forwarded-for": input.clientIp ?? uniqueClientIp(),
+    ...input.headers ?? {}
+  };
+  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;
+  const data = { base_revision_id: input.baseRevisionId, patch: input.patch };
+  if (input.changeSummary) data.change_summary = input.changeSummary;
+  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}`), {
+    method: "PATCH",
+    headers,
+    data
+  });
+}
+async function publicSubmit(request, input) {
+  const headers = {
+    "Content-Type": "application/json",
+    "x-forwarded-for": input.clientIp ?? uniqueClientIp(),
+    ...input.headers ?? {}
+  };
+  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;
+  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}/submit`), {
+    method: "POST",
+    headers,
+    data: { base_revision_id: input.baseRevisionId }
+  });
+}
+async function publicRead(request, input) {
+  const headers = { ...input.headers ?? {} };
+  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;
+  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}`), {
+    method: "GET",
+    headers
+  });
+}
+async function publicUploadAttachment(request, input) {
+  const headers = { ...input.headers ?? {} };
+  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;
+  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}/attachments`), {
+    method: "POST",
+    headers,
+    multipart: {
+      field_key: input.fieldKey,
+      file: { name: input.filename, mimeType: input.contentType, buffer: input.bytes }
+    }
+  });
+}
+async function createAnonymousRunFixture(request, publicRequest, token, options = {}) {
+  const published = await createPublishedFormFixture(request, token, { schema: options.schema });
+  const distribution = await createDistributionFixture(request, token, published.formId, {
+    mode: "open",
+    ...options.distribution ?? {}
+  });
+  expect(distribution.publicSlug, "an open distribution must mint a public slug").toBeTruthy();
+  const clientIp = uniqueClientIp();
+  const started = await startPublicSubmissionOrThrow(publicRequest, {
+    slug: distribution.publicSlug,
+    clientIp
+  });
+  return {
+    ...published,
+    distributionId: distribution.id,
+    publicSlug: distribution.publicSlug,
+    submissionId: started.submissionId,
+    revisionId: started.revisionId,
+    accessToken: started.accessToken,
+    clientIp
+  };
+}
+async function portalCall(request, method, path, options) {
+  return request.fetch(resolveUrl(path), {
+    method,
+    headers: { "Content-Type": "application/json", ...options.cookies },
+    data: options.data
+  });
+}
+async function readSubmissionDetail(request, token, submissionId) {
+  return apiRequest(request, "GET", `/api/forms/submissions/${submissionId}`, { token });
+}
+async function readSubmissionRevisions(request, token, submissionId) {
+  return apiRequest(request, "GET", `/api/forms/submissions/${submissionId}/revisions`, { token });
+}
+async function readAccessAudit(request, token, submissionId) {
+  const response = await apiRequest(
+    request,
+    "GET",
+    `/api/forms/submissions/${submissionId}/access-audit`,
+    { token }
+  );
+  if (!response.ok()) return [];
+  const body = await readJsonSafe(response);
+  return body?.items ?? [];
+}
+async function listFormSubmissions(request, token, formId, query = {}) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) params.set(key, String(value));
+  const suffix = params.toString() ? `?${params.toString()}` : "";
+  return apiRequest(request, "GET", `/api/forms/${formId}/submissions${suffix}`, { token });
+}
+export {
+  AUTOSAVE_MIN_INTERVAL_MS,
+  buildFileFieldFormSchema,
+  buildMinimalFormSchema,
+  buildSensitiveFormSchema,
+  buildTinyPngBytes,
+  buildUncompilableFormSchema,
+  createAnonymousRunFixture,
+  createDistributionFixture,
+  createFormFixture,
+  createInvitationsFixture,
+  createPublishedFormFixture,
+  deleteDistributionIfExists,
+  deleteFormIfExists,
+  forkDraftFixture,
+  listFormSubmissions,
+  listInvitations,
+  patchDistribution,
+  portalCall,
+  publicAutosave,
+  publicRead,
+  publicSubmit,
+  publicUploadAttachment,
+  publishVersionFixture,
+  readAccessAudit,
+  readDistribution,
+  readSubmissionDetail,
+  readSubmissionRevisions,
+  revokeInvitationIfExists,
+  startPublicSubmission,
+  startPublicSubmissionOrThrow,
+  uniqueClientIp,
+  uniqueFormKey,
+  updateDraftFixture,
+  waitForAutosaveWindow
+};
+//# sourceMappingURL=formsFixtures.js.map

package/dist/helpers/integration/formsFixtures.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/formsFixtures.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto';\nimport { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { readJsonSafe } from './generalFixtures';\n\n/**\n * Forms integration fixtures.\n *\n * Modelled on `workflowsFixtures` \u2014 schema builders plus create/read/delete\n * helpers, all API-first so the same file works in the monorepo and standalone\n * lanes. Nothing here touches the database directly; the only records a spec\n * may assume exist are the three `mercato init` staff accounts.\n *\n * Two module behaviours drive most of the shapes below and are easy to get\n * wrong from the docs alone:\n *\n *  - A submission access token authorizes an `(submissionId, invitationId,\n *    role)` triple, so the anonymous runtime always goes through a\n *    distribution; `POST /api/forms/public/start` mints the invitation row for\n *    open-mode links itself.\n *  - `SubmissionService.save()` rate-limits consecutive autosaves to one per\n *    `FORMS_AUTOSAVE_INTERVAL_MS / 2` (5s on the shipped default) and counts\n *    from the revision `start` wrote, so the FIRST autosave after a start is\n *    throttled too. {@link waitForAutosaveWindow} is the wait every runtime\n *    spec needs before a `PATCH`; specs that chain saves must raise their own\n *    timeout with `test.setTimeout()`.\n */\n\ntype JsonRecord = Record<string, unknown>;\n\n/** Matches the 5s floor `SubmissionService` derives from its 10s default. */\nexport const AUTOSAVE_MIN_INTERVAL_MS = 5_000;\n\n/**\n * Sleeps past the autosave rate-limit floor. Without this a second `PATCH`\n * (or the first one after `start`) returns `429 RATE_LIMITED`, which reads like\n * a public-limiter hit but comes from the submission service.\n */\nexport async function waitForAutosaveWindow(): Promise<void> {\n  await new Promise((resolve) => setTimeout(resolve, AUTOSAVE_MIN_INTERVAL_MS + 400));\n}\n\n/**\n * Retry-safe unique form key. `formKeySchema` demands 3-64 chars matching\n * `/^[a-z][a-z0-9_-]*$/`, and `(organization_id, key)` is unique, so a spec that\n * reuses a literal collides with its own Playwright retry.\n */\nexport function uniqueFormKey(prefix = 'qa_forms'): string {\n  return `${prefix}_${Date.now()}_${randomUUID().slice(0, 8)}`.toLowerCase();\n}\n\n/** Unique synthetic client IP so a spec owns its public rate-limit bucket. */\nexport function uniqueClientIp(): string {\n  const octet = () => 1 + Math.floor(Number.parseInt(randomUUID().slice(0, 2), 16) / 1.05);\n  return `203.0.${Math.min(254, octet())}.${Math.min(254, octet())}`;\n}\n\n// ---------------------------------------------------------------------------\n// Schema builders\n// ---------------------------------------------------------------------------\n\n/**\n * The canonical compilable schema: two declared roles, a participant-editable\n * required text field and a participant-editable textarea. Shape copied from\n * `__tests__/form-version-compiler.test.ts`, which is already proven to compile.\n */\nexport function buildMinimalFormSchema(): JsonRecord {\n  return {\n    type: 'object',\n    'x-om-roles': ['admin', 'participant'],\n    'x-om-default-actor-role': 'participant',\n    'x-om-sections': [\n      { key: 'identity', title: { en: 'Identity' }, fieldKeys: ['full_name', 'notes'] },\n    ],\n    properties: {\n      full_name: {\n        type: 'string',\n        minLength: 1,\n        maxLength: 200,\n        'x-om-type': 'text',\n        'x-om-label': { en: 'Full name' },\n        'x-om-editable-by': ['participant'],\n        'x-om-visible-to': ['admin', 'participant'],\n      },\n      notes: {\n        type: 'string',\n        maxLength: 2000,\n        'x-om-type': 'textarea',\n        'x-om-label': { en: 'Notes' },\n        'x-om-editable-by': ['participant'],\n        'x-om-visible-to': ['admin', 'participant'],\n      },\n    },\n    required: ['full_name'],\n  };\n}\n\n/**\n * Adds an `x-om-sensitive` text field plus a non-sensitive enumerable boolean.\n * The anonymize and analytics-exclusion cases need all three field kinds in one\n * form: sensitive (tombstoned / never distributed), free-text (never\n * distributed) and enumerable (distributed as counts).\n */\nexport function buildSensitiveFormSchema(): JsonRecord {\n  const schema = buildMinimalFormSchema();\n  const properties = schema.properties as JsonRecord;\n  properties.diagnosis = {\n    type: 'string',\n    maxLength: 500,\n    'x-om-type': 'text',\n    'x-om-label': { en: 'Diagnosis' },\n    'x-om-editable-by': ['participant'],\n    'x-om-visible-to': ['admin', 'participant'],\n    'x-om-sensitive': true,\n  };\n  properties.consented = {\n    type: 'boolean',\n    'x-om-type': 'boolean',\n    'x-om-label': { en: 'Consented?' },\n    'x-om-editable-by': ['participant'],\n    'x-om-visible-to': ['admin', 'participant'],\n  };\n  schema['x-om-sections'] = [\n    {\n      key: 'identity',\n      title: { en: 'Identity' },\n      fieldKeys: ['full_name', 'notes', 'diagnosis', 'consented'],\n    },\n  ];\n  return schema;\n}\n\n/**\n * Adds an `x-om-type: 'file'` field. Without one `resolveFieldUploadConfig`\n * returns `null` and every upload answers `422 INVALID_FIELD`, so the whole\n * attachment area depends on this builder.\n */\nexport function buildFileFieldFormSchema(\n  options: { accept?: string[]; maxSizeBytes?: number } = {},\n): JsonRecord {\n  const schema = buildMinimalFormSchema();\n  const properties = schema.properties as JsonRecord;\n  properties.scan = {\n    type: 'array',\n    'x-om-type': 'file',\n    'x-om-label': { en: 'Scan' },\n    'x-om-editable-by': ['participant'],\n    'x-om-visible-to': ['admin', 'participant'],\n    'x-om-accept': options.accept ?? ['image/png'],\n    'x-om-max-size-bytes': options.maxSizeBytes ?? 4096,\n  };\n  schema['x-om-sections'] = [\n    { key: 'identity', title: { en: 'Identity' }, fieldKeys: ['full_name', 'notes', 'scan'] },\n  ];\n  return schema;\n}\n\n/** A schema the compiler must reject: `full_name` is editable by an undeclared role. */\nexport function buildUncompilableFormSchema(): JsonRecord {\n  return {\n    type: 'object',\n    'x-om-roles': ['admin', 'participant'],\n    'x-om-default-actor-role': 'participant',\n    properties: {\n      full_name: {\n        type: 'string',\n        'x-om-type': 'text',\n        'x-om-label': { en: 'Full name' },\n        'x-om-editable-by': ['not_a_declared_role'],\n      },\n    },\n  };\n}\n\n/** The smallest byte string Chromium and the upload gate both accept as a PNG. */\nexport function buildTinyPngBytes(): Buffer {\n  return Buffer.from(\n    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8AAAwAB/AF+DHkYAAAAAElFTkSuQmCC',\n    'base64',\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Form + version fixtures\n// ---------------------------------------------------------------------------\n\nexport type FormFixture = { id: string; key: string };\n\nexport type CreateFormInput = {\n  key?: string;\n  name?: string;\n  description?: string | null;\n  defaultLocale?: string;\n  supportedLocales?: string[];\n  retentionDays?: number | null;\n  /** Sends `om_selected_org` so the form lands in another organization. */\n  selectedOrgId?: string;\n};\n\nfunction resolveUrl(path: string): string {\n  const base = process.env.BASE_URL?.trim();\n  return base ? `${base}${path}` : path;\n}\n\nexport async function createFormFixture(\n  request: APIRequestContext,\n  token: string,\n  input: CreateFormInput = {},\n): Promise<FormFixture> {\n  const key = input.key ?? uniqueFormKey();\n  const data: JsonRecord = {\n    key,\n    name: input.name ?? `QA Forms ${key}`,\n    defaultLocale: input.defaultLocale ?? 'en',\n    supportedLocales: input.supportedLocales ?? ['en'],\n  };\n  if (input.description !== undefined) data.description = input.description;\n  if (input.retentionDays !== undefined) data.retentionDays = input.retentionDays;\n\n  const response = input.selectedOrgId\n    ? await request.fetch(resolveUrl('/api/forms'), {\n        method: 'POST',\n        headers: {\n          Authorization: `Bearer ${token}`,\n          'Content-Type': 'application/json',\n          Cookie: `om_selected_org=${input.selectedOrgId}`,\n        },\n        data,\n      })\n    : await apiRequest(request, 'POST', '/api/forms', { token, data });\n\n  const body = await readJsonSafe<{ id?: string }>(response);\n  expect(response.status(), `POST /api/forms should return 201 (got ${response.status()})`).toBe(201);\n  expect(typeof body?.id === 'string' && body.id.length > 0, 'form create should return an id').toBe(true);\n  return { id: body!.id as string, key };\n}\n\nexport async function forkDraftFixture(\n  request: APIRequestContext,\n  token: string,\n  formId: string,\n  fromVersionId?: string | null,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', `/api/forms/${formId}/versions/fork`, {\n    token,\n    data: fromVersionId ? { fromVersionId } : {},\n  });\n  const body = await readJsonSafe<{ versionId?: string }>(response);\n  expect(response.status(), `fork should return 201 (got ${response.status()})`).toBe(201);\n  expect(typeof body?.versionId === 'string' && body.versionId.length > 0, 'fork should return versionId').toBe(true);\n  return body!.versionId as string;\n}\n\nexport async function updateDraftFixture(\n  request: APIRequestContext,\n  token: string,\n  formId: string,\n  versionId: string,\n  input: { schema?: JsonRecord; uiSchema?: JsonRecord; roles?: string[]; changelog?: string | null },\n): Promise<void> {\n  const response = await apiRequest(request, 'PATCH', `/api/forms/${formId}/versions/${versionId}`, {\n    token,\n    data: input,\n  });\n  expect(\n    response.status(),\n    `draft update should return 200 (got ${response.status()}: ${await response.text()})`,\n  ).toBe(200);\n}\n\nexport async function publishVersionFixture(\n  request: APIRequestContext,\n  token: string,\n  formId: string,\n  versionId: string,\n  changelog?: string,\n): Promise<{ versionId: string; versionNumber: number }> {\n  const response = await apiRequest(\n    request,\n    'POST',\n    `/api/forms/${formId}/versions/${versionId}/publish`,\n    { token, data: changelog ? { changelog } : {} },\n  );\n  const body = await readJsonSafe<{ versionId?: string; versionNumber?: number }>(response);\n  expect(\n    response.status(),\n    `publish should return 200 (got ${response.status()}: ${JSON.stringify(body)})`,\n  ).toBe(200);\n  return {\n    versionId: body?.versionId ?? versionId,\n    versionNumber: typeof body?.versionNumber === 'number' ? body.versionNumber : 0,\n  };\n}\n\nexport type PublishedFormFixture = {\n  formId: string;\n  formKey: string;\n  versionId: string;\n  versionNumber: number;\n};\n\n/** create \u2192 fork \u2192 update draft \u2192 publish, the composite most cases need. */\nexport async function createPublishedFormFixture(\n  request: APIRequestContext,\n  token: string,\n  options: { schema?: JsonRecord; uiSchema?: JsonRecord; roles?: string[] } & CreateFormInput = {},\n): Promise<PublishedFormFixture> {\n  const { schema, uiSchema, roles, ...formInput } = options;\n  const form = await createFormFixture(request, token, formInput);\n  const versionId = await forkDraftFixture(request, token, form.id);\n  await updateDraftFixture(request, token, form.id, versionId, {\n    schema: schema ?? buildMinimalFormSchema(),\n    uiSchema: uiSchema ?? { full_name: { 'ui:widget': 'text' } },\n    roles: roles ?? ['admin', 'participant'],\n  });\n  const published = await publishVersionFixture(request, token, form.id, versionId, 'qa publish');\n  return {\n    formId: form.id,\n    formKey: form.key,\n    versionId: published.versionId,\n    versionNumber: published.versionNumber,\n  };\n}\n\nexport async function deleteFormIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  formId: string | null,\n): Promise<void> {\n  if (!token || !formId) return;\n  await apiRequest(request, 'DELETE', `/api/forms/${formId}`, { token }).catch(() => undefined);\n}\n\n// ---------------------------------------------------------------------------\n// Distribution + invitation fixtures\n// ---------------------------------------------------------------------------\n\nexport type DistributionFixture = {\n  id: string;\n  publicSlug: string | null;\n  mode: 'open' | 'personal';\n};\n\nexport type CreateDistributionInput = {\n  mode?: 'open' | 'personal';\n  defaultLocale?: string;\n  title?: string | null;\n  pinnedVersionId?: string | null;\n  requireCustomerAuth?: boolean;\n  allowMultipleSubmissions?: boolean;\n  maxResponses?: number | null;\n  opensAt?: string | null;\n  closesAt?: string | null;\n  redirectUrl?: string | null;\n  settings?: JsonRecord | null;\n};\n\n/**\n * `POST /api/forms/:id/distributions` answers `{ id }` only \u2014 the minted\n * `publicSlug` is only visible on the detail read, so this always re-reads.\n */\nexport async function createDistributionFixture(\n  request: APIRequestContext,\n  token: string,\n  formId: string,\n  input: CreateDistributionInput = {},\n): Promise<DistributionFixture> {\n  const data: JsonRecord = {\n    mode: input.mode ?? 'open',\n    defaultLocale: input.defaultLocale ?? 'en',\n  };\n  for (const key of [\n    'title',\n    'pinnedVersionId',\n    'requireCustomerAuth',\n    'allowMultipleSubmissions',\n    'maxResponses',\n    'opensAt',\n    'closesAt',\n    'redirectUrl',\n    'settings',\n  ] as const) {\n    if (input[key] !== undefined) data[key] = input[key];\n  }\n\n  const response = await apiRequest(request, 'POST', `/api/forms/${formId}/distributions`, { token, data });\n  const created = await readJsonSafe<{ id?: string }>(response);\n  expect(\n    response.status(),\n    `distribution create should return 201 (got ${response.status()}: ${JSON.stringify(created)})`,\n  ).toBe(201);\n  const id = created!.id as string;\n  const detail = await readDistribution(request, token, id);\n  return {\n    id,\n    publicSlug: (detail?.publicSlug as string | null) ?? null,\n    mode: (detail?.mode as 'open' | 'personal') ?? (input.mode ?? 'open'),\n  };\n}\n\nexport async function readDistribution(\n  request: APIRequestContext,\n  token: string,\n  distributionId: string,\n): Promise<JsonRecord | null> {\n  const response = await apiRequest(request, 'GET', `/api/forms/distributions/${distributionId}`, { token });\n  if (!response.ok()) return null;\n  return readJsonSafe<JsonRecord>(response);\n}\n\nexport async function patchDistribution(\n  request: APIRequestContext,\n  token: string,\n  distributionId: string,\n  data: JsonRecord,\n) {\n  return apiRequest(request, 'PATCH', `/api/forms/distributions/${distributionId}`, { token, data });\n}\n\nexport async function deleteDistributionIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  distributionId: string | null,\n): Promise<void> {\n  if (!token || !distributionId) return;\n  await patchDistribution(request, token, distributionId, { status: 'closed' }).catch(() => undefined);\n}\n\nexport type InvitationFixture = { id: string; rawToken: string | null };\n\nexport type InvitationRecipient = {\n  email?: string;\n  name?: string;\n  ref?: string;\n  role?: string;\n  locale?: string;\n  expiresAt?: string;\n};\n\n/** `rawToken` is returned exactly once \u2014 capture it here or lose it. */\nexport async function createInvitationsFixture(\n  request: APIRequestContext,\n  token: string,\n  distributionId: string,\n  recipients: InvitationRecipient[],\n): Promise<InvitationFixture[]> {\n  const response = await apiRequest(\n    request,\n    'POST',\n    `/api/forms/distributions/${distributionId}/invitations`,\n    { token, data: { recipients } },\n  );\n  const body = await readJsonSafe<{ invitations?: InvitationFixture[] }>(response);\n  expect(\n    response.status(),\n    `invitation create should return 201 (got ${response.status()}: ${JSON.stringify(body)})`,\n  ).toBe(201);\n  expect(Array.isArray(body?.invitations), 'invitation create should return an invitations array').toBe(true);\n  return body!.invitations as InvitationFixture[];\n}\n\nexport async function listInvitations(\n  request: APIRequestContext,\n  token: string,\n  distributionId: string,\n): Promise<{ items: JsonRecord[]; total: number } | null> {\n  const response = await apiRequest(\n    request,\n    'GET',\n    `/api/forms/distributions/${distributionId}/invitations`,\n    { token },\n  );\n  if (!response.ok()) return null;\n  return readJsonSafe<{ items: JsonRecord[]; total: number }>(response);\n}\n\nexport async function revokeInvitationIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  distributionId: string | null,\n  invitationId: string | null,\n): Promise<void> {\n  if (!token || !distributionId || !invitationId) return;\n  await apiRequest(\n    request,\n    'DELETE',\n    `/api/forms/distributions/${distributionId}/invitations/${invitationId}`,\n    { token },\n  ).catch(() => undefined);\n}\n\n// ---------------------------------------------------------------------------\n// Public runtime\n// ---------------------------------------------------------------------------\n\nexport type PublicStartResult = {\n  status: number;\n  submissionId: string;\n  revisionId: string;\n  accessToken: string;\n  body: JsonRecord;\n};\n\n/**\n * `POST /api/forms/public/start` with no ambient credentials.\n *\n * The caller passes its own isolated `APIRequestContext` (see\n * `withCredentialIsolatedRequest`) so the `request` fixture's cookie jar cannot\n * silently authorize the call, and its own `x-forwarded-for` so the public\n * limiter bucket is not shared with the next spec.\n */\nexport async function startPublicSubmission(\n  request: APIRequestContext,\n  input: { slug?: string; token?: string; locale?: string; captchaToken?: string; clientIp?: string },\n): Promise<PublicStartResult> {\n  const data: JsonRecord = {};\n  if (input.slug) data.slug = input.slug;\n  if (input.token) data.token = input.token;\n  if (input.locale) data.locale = input.locale;\n  if (input.captchaToken) data.captchaToken = input.captchaToken;\n\n  const response = await request.fetch(resolveUrl('/api/forms/public/start'), {\n    method: 'POST',\n    headers: {\n      'Content-Type': 'application/json',\n      'x-forwarded-for': input.clientIp ?? uniqueClientIp(),\n    },\n    data,\n  });\n  const body = (await readJsonSafe<JsonRecord>(response)) ?? {};\n  const submission = (body.submission as JsonRecord | undefined) ?? {};\n  const revision = (body.revision as JsonRecord | undefined) ?? {};\n  return {\n    status: response.status(),\n    submissionId: (submission.id as string) ?? '',\n    revisionId: (revision.id as string) ?? '',\n    accessToken: (body.access_token as string) ?? '',\n    body,\n  };\n}\n\n/** Asserts the start succeeded and returns it \u2014 the happy-path shorthand. */\nexport async function startPublicSubmissionOrThrow(\n  request: APIRequestContext,\n  input: { slug?: string; token?: string; locale?: string; clientIp?: string },\n): Promise<PublicStartResult> {\n  const result = await startPublicSubmission(request, input);\n  expect(\n    result.status,\n    `public start should return 201 (got ${result.status}: ${JSON.stringify(result.body)})`,\n  ).toBe(201);\n  expect(result.submissionId, 'public start should return a submission id').toBeTruthy();\n  expect(result.revisionId, 'public start should return a revision id').toBeTruthy();\n  expect(result.accessToken, 'public start should mint an access token').toBeTruthy();\n  return result;\n}\n\n/** Autosave through the public route with a submission access token. */\nexport async function publicAutosave(\n  request: APIRequestContext,\n  input: {\n    submissionId: string;\n    accessToken?: string | null;\n    baseRevisionId: string;\n    patch: JsonRecord;\n    changeSummary?: string;\n    clientIp?: string;\n    headers?: Record<string, string>;\n  },\n) {\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'x-forwarded-for': input.clientIp ?? uniqueClientIp(),\n    ...(input.headers ?? {}),\n  };\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  const data: JsonRecord = { base_revision_id: input.baseRevisionId, patch: input.patch };\n  if (input.changeSummary) data.change_summary = input.changeSummary;\n  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}`), {\n    method: 'PATCH',\n    headers,\n    data,\n  });\n}\n\n/** Final submit through the public route with a submission access token. */\nexport async function publicSubmit(\n  request: APIRequestContext,\n  input: {\n    submissionId: string;\n    accessToken?: string | null;\n    baseRevisionId: string;\n    clientIp?: string;\n    headers?: Record<string, string>;\n  },\n) {\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'x-forwarded-for': input.clientIp ?? uniqueClientIp(),\n    ...(input.headers ?? {}),\n  };\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}/submit`), {\n    method: 'POST',\n    headers,\n    data: { base_revision_id: input.baseRevisionId },\n  });\n}\n\n/** Reads the public submission view (resume) with an access token. */\nexport async function publicRead(\n  request: APIRequestContext,\n  input: { submissionId: string; accessToken?: string | null; headers?: Record<string, string> },\n) {\n  const headers: Record<string, string> = { ...(input.headers ?? {}) };\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}`), {\n    method: 'GET',\n    headers,\n  });\n}\n\n/** Multipart attachment upload on the public route. */\nexport async function publicUploadAttachment(\n  request: APIRequestContext,\n  input: {\n    submissionId: string;\n    accessToken?: string | null;\n    fieldKey: string;\n    filename: string;\n    contentType: string;\n    bytes: Buffer;\n    headers?: Record<string, string>;\n  },\n) {\n  const headers: Record<string, string> = { ...(input.headers ?? {}) };\n  if (input.accessToken) headers.Authorization = `Bearer ${input.accessToken}`;\n  return request.fetch(resolveUrl(`/api/forms/public/submissions/${input.submissionId}/attachments`), {\n    method: 'POST',\n    headers,\n    multipart: {\n      field_key: input.fieldKey,\n      file: { name: input.filename, mimeType: input.contentType, buffer: input.bytes },\n    },\n  });\n}\n\n/**\n * Convenience composite: published open-mode form + distribution + a started\n * anonymous submission, all fixtures returned for cleanup. The caller supplies\n * the isolated request context the public calls must run on.\n */\nexport type AnonymousRunFixture = PublishedFormFixture & {\n  distributionId: string;\n  publicSlug: string;\n  submissionId: string;\n  revisionId: string;\n  accessToken: string;\n  clientIp: string;\n};\n\nexport async function createAnonymousRunFixture(\n  request: APIRequestContext,\n  publicRequest: APIRequestContext,\n  token: string,\n  options: { schema?: JsonRecord; distribution?: CreateDistributionInput } = {},\n): Promise<AnonymousRunFixture> {\n  const published = await createPublishedFormFixture(request, token, { schema: options.schema });\n  const distribution = await createDistributionFixture(request, token, published.formId, {\n    mode: 'open',\n    ...(options.distribution ?? {}),\n  });\n  expect(distribution.publicSlug, 'an open distribution must mint a public slug').toBeTruthy();\n  const clientIp = uniqueClientIp();\n  const started = await startPublicSubmissionOrThrow(publicRequest, {\n    slug: distribution.publicSlug as string,\n    clientIp,\n  });\n  return {\n    ...published,\n    distributionId: distribution.id,\n    publicSlug: distribution.publicSlug as string,\n    submissionId: started.submissionId,\n    revisionId: started.revisionId,\n    accessToken: started.accessToken,\n    clientIp,\n  };\n}\n\n/**\n * Calls a portal-authenticated forms route.\n *\n * These routes are `requireAuth: false` at the platform layer and read the\n * customer identity from the portal cookies, so they must NOT go through\n * `apiRequest` (which would attach a staff `Authorization: Bearer`). Pass\n * `portalCookieHeaders(session)` as `cookies`.\n */\nexport async function portalCall(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { cookies: Record<string, string>; data?: unknown },\n) {\n  return request.fetch(resolveUrl(path), {\n    method,\n    headers: { 'Content-Type': 'application/json', ...options.cookies },\n    data: options.data,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Admin submission reads\n// ---------------------------------------------------------------------------\n\nexport async function readSubmissionDetail(\n  request: APIRequestContext,\n  token: string,\n  submissionId: string,\n) {\n  return apiRequest(request, 'GET', `/api/forms/submissions/${submissionId}`, { token });\n}\n\nexport async function readSubmissionRevisions(\n  request: APIRequestContext,\n  token: string,\n  submissionId: string,\n) {\n  return apiRequest(request, 'GET', `/api/forms/submissions/${submissionId}/revisions`, { token });\n}\n\nexport async function readAccessAudit(\n  request: APIRequestContext,\n  token: string,\n  submissionId: string,\n): Promise<JsonRecord[]> {\n  const response = await apiRequest(\n    request,\n    'GET',\n    `/api/forms/submissions/${submissionId}/access-audit`,\n    { token },\n  );\n  if (!response.ok()) return [];\n  const body = await readJsonSafe<{ items?: JsonRecord[] }>(response);\n  return body?.items ?? [];\n}\n\nexport async function listFormSubmissions(\n  request: APIRequestContext,\n  token: string,\n  formId: string,\n  query: Record<string, string | number> = {},\n) {\n  const params = new URLSearchParams();\n  for (const [key, value] of Object.entries(query)) params.set(key, String(value));\n  const suffix = params.toString() ? `?${params.toString()}` : '';\n  return apiRequest(request, 'GET', `/api/forms/${formId}/submissions${suffix}`, { token });\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AA4BtB,MAAM,2BAA2B;AAOxC,eAAsB,wBAAuC;AAC3D,QAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,2BAA2B,GAAG,CAAC;AACpF;AAOO,SAAS,cAAc,SAAS,YAAoB;AACzD,SAAO,GAAG,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,YAAY;AAC3E;AAGO,SAAS,iBAAyB;AACvC,QAAM,QAAQ,MAAM,IAAI,KAAK,MAAM,OAAO,SAAS,WAAW,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI;AACvF,SAAO,SAAS,KAAK,IAAI,KAAK,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,KAAK,MAAM,CAAC,CAAC;AAClE;AAWO,SAAS,yBAAqC;AACnD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,CAAC,SAAS,aAAa;AAAA,IACrC,2BAA2B;AAAA,IAC3B,iBAAiB;AAAA,MACf,EAAE,KAAK,YAAY,OAAO,EAAE,IAAI,WAAW,GAAG,WAAW,CAAC,aAAa,OAAO,EAAE;AAAA,IAClF;AAAA,IACA,YAAY;AAAA,MACV,WAAW;AAAA,QACT,MAAM;AAAA,QACN,WAAW;AAAA,QACX,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc,EAAE,IAAI,YAAY;AAAA,QAChC,oBAAoB,CAAC,aAAa;AAAA,QAClC,mBAAmB,CAAC,SAAS,aAAa;AAAA,MAC5C;AAAA,MACA,OAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAW;AAAA,QACX,aAAa;AAAA,QACb,cAAc,EAAE,IAAI,QAAQ;AAAA,QAC5B,oBAAoB,CAAC,aAAa;AAAA,QAClC,mBAAmB,CAAC,SAAS,aAAa;AAAA,MAC5C;AAAA,IACF;AAAA,IACA,UAAU,CAAC,WAAW;AAAA,EACxB;AACF;AAQO,SAAS,2BAAuC;AACrD,QAAM,SAAS,uBAAuB;AACtC,QAAM,aAAa,OAAO;AAC1B,aAAW,YAAY;AAAA,IACrB,MAAM;AAAA,IACN,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc,EAAE,IAAI,YAAY;AAAA,IAChC,oBAAoB,CAAC,aAAa;AAAA,IAClC,mBAAmB,CAAC,SAAS,aAAa;AAAA,IAC1C,kBAAkB;AAAA,EACpB;AACA,aAAW,YAAY;AAAA,IACrB,MAAM;AAAA,IACN,aAAa;AAAA,IACb,cAAc,EAAE,IAAI,aAAa;AAAA,IACjC,oBAAoB,CAAC,aAAa;AAAA,IAClC,mBAAmB,CAAC,SAAS,aAAa;AAAA,EAC5C;AACA,SAAO,eAAe,IAAI;AAAA,IACxB;AAAA,MACE,KAAK;AAAA,MACL,OAAO,EAAE,IAAI,WAAW;AAAA,MACxB,WAAW,CAAC,aAAa,SAAS,aAAa,WAAW;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,yBACd,UAAwD,CAAC,GAC7C;AACZ,QAAM,SAAS,uBAAuB;AACtC,QAAM,aAAa,OAAO;AAC1B,aAAW,OAAO;AAAA,IAChB,MAAM;AAAA,IACN,aAAa;AAAA,IACb,cAAc,EAAE,IAAI,OAAO;AAAA,IAC3B,oBAAoB,CAAC,aAAa;AAAA,IAClC,mBAAmB,CAAC,SAAS,aAAa;AAAA,IAC1C,eAAe,QAAQ,UAAU,CAAC,WAAW;AAAA,IAC7C,uBAAuB,QAAQ,gBAAgB;AAAA,EACjD;AACA,SAAO,eAAe,IAAI;AAAA,IACxB,EAAE,KAAK,YAAY,OAAO,EAAE,IAAI,WAAW,GAAG,WAAW,CAAC,aAAa,SAAS,MAAM,EAAE;AAAA,EAC1F;AACA,SAAO;AACT;AAGO,SAAS,8BAA0C;AACxD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,cAAc,CAAC,SAAS,aAAa;AAAA,IACrC,2BAA2B;AAAA,IAC3B,YAAY;AAAA,MACV,WAAW;AAAA,QACT,MAAM;AAAA,QACN,aAAa;AAAA,QACb,cAAc,EAAE,IAAI,YAAY;AAAA,QAChC,oBAAoB,CAAC,qBAAqB;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,oBAA4B;AAC1C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACF;AAmBA,SAAS,WAAW,MAAsB;AACxC,QAAM,OAAO,QAAQ,IAAI,UAAU,KAAK;AACxC,SAAO,OAAO,GAAG,IAAI,GAAG,IAAI,KAAK;AACnC;AAEA,eAAsB,kBACpB,SACA,OACA,QAAyB,CAAC,GACJ;AACtB,QAAM,MAAM,MAAM,OAAO,cAAc;AACvC,QAAM,OAAmB;AAAA,IACvB;AAAA,IACA,MAAM,MAAM,QAAQ,YAAY,GAAG;AAAA,IACnC,eAAe,MAAM,iBAAiB;AAAA,IACtC,kBAAkB,MAAM,oBAAoB,CAAC,IAAI;AAAA,EACnD;AACA,MAAI,MAAM,gBAAgB,OAAW,MAAK,cAAc,MAAM;AAC9D,MAAI,MAAM,kBAAkB,OAAW,MAAK,gBAAgB,MAAM;AAElE,QAAM,WAAW,MAAM,gBACnB,MAAM,QAAQ,MAAM,WAAW,YAAY,GAAG;AAAA,IAC5C,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,MAChB,QAAQ,mBAAmB,MAAM,aAAa;AAAA,IAChD;AAAA,IACA;AAAA,EACF,CAAC,IACD,MAAM,WAAW,SAAS,QAAQ,cAAc,EAAE,OAAO,KAAK,CAAC;AAEnE,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,0CAA0C,SAAS,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG;AAClG,SAAO,OAAO,MAAM,OAAO,YAAY,KAAK,GAAG,SAAS,GAAG,iCAAiC,EAAE,KAAK,IAAI;AACvG,SAAO,EAAE,IAAI,KAAM,IAAc,IAAI;AACvC;AAEA,eAAsB,iBACpB,SACA,OACA,QACA,eACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,cAAc,MAAM,kBAAkB;AAAA,IACvF;AAAA,IACA,MAAM,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,EAC7C,CAAC;AACD,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,OAAO,GAAG,+BAA+B,SAAS,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG;AACvF,SAAO,OAAO,MAAM,cAAc,YAAY,KAAK,UAAU,SAAS,GAAG,8BAA8B,EAAE,KAAK,IAAI;AAClH,SAAO,KAAM;AACf;AAEA,eAAsB,mBACpB,SACA,OACA,QACA,WACA,OACe;AACf,QAAM,WAAW,MAAM,WAAW,SAAS,SAAS,cAAc,MAAM,aAAa,SAAS,IAAI;AAAA,IAChG;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB,uCAAuC,SAAS,OAAO,CAAC,KAAK,MAAM,SAAS,KAAK,CAAC;AAAA,EACpF,EAAE,KAAK,GAAG;AACZ;AAEA,eAAsB,sBACpB,SACA,OACA,QACA,WACA,WACuD;AACvD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,cAAc,MAAM,aAAa,SAAS;AAAA,IAC1C,EAAE,OAAO,MAAM,YAAY,EAAE,UAAU,IAAI,CAAC,EAAE;AAAA,EAChD;AACA,QAAM,OAAO,MAAM,aAA6D,QAAQ;AACxF;AAAA,IACE,SAAS,OAAO;AAAA,IAChB,kCAAkC,SAAS,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC;AAAA,EAC9E,EAAE,KAAK,GAAG;AACV,SAAO;AAAA,IACL,WAAW,MAAM,aAAa;AAAA,IAC9B,eAAe,OAAO,MAAM,kBAAkB,WAAW,KAAK,gBAAgB;AAAA,EAChF;AACF;AAUA,eAAsB,2BACpB,SACA,OACA,UAA8F,CAAC,GAChE;AAC/B,QAAM,EAAE,QAAQ,UAAU,OAAO,GAAG,UAAU,IAAI;AAClD,QAAM,OAAO,MAAM,kBAAkB,SAAS,OAAO,SAAS;AAC9D,QAAM,YAAY,MAAM,iBAAiB,SAAS,OAAO,KAAK,EAAE;AAChE,QAAM,mBAAmB,SAAS,OAAO,KAAK,IAAI,WAAW;AAAA,IAC3D,QAAQ,UAAU,uBAAuB;AAAA,IACzC,UAAU,YAAY,EAAE,WAAW,EAAE,aAAa,OAAO,EAAE;AAAA,IAC3D,OAAO,SAAS,CAAC,SAAS,aAAa;AAAA,EACzC,CAAC;AACD,QAAM,YAAY,MAAM,sBAAsB,SAAS,OAAO,KAAK,IAAI,WAAW,YAAY;AAC9F,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,WAAW,UAAU;AAAA,IACrB,eAAe,UAAU;AAAA,EAC3B;AACF;AAEA,eAAsB,mBACpB,SACA,OACA,QACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,QAAM,WAAW,SAAS,UAAU,cAAc,MAAM,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9F;AA8BA,eAAsB,0BACpB,SACA,OACA,QACA,QAAiC,CAAC,GACJ;AAC9B,QAAM,OAAmB;AAAA,IACvB,MAAM,MAAM,QAAQ;AAAA,IACpB,eAAe,MAAM,iBAAiB;AAAA,EACxC;AACA,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAY;AACV,QAAI,MAAM,GAAG,MAAM,OAAW,MAAK,GAAG,IAAI,MAAM,GAAG;AAAA,EACrD;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,cAAc,MAAM,kBAAkB,EAAE,OAAO,KAAK,CAAC;AACxG,QAAM,UAAU,MAAM,aAA8B,QAAQ;AAC5D;AAAA,IACE,SAAS,OAAO;AAAA,IAChB,8CAA8C,SAAS,OAAO,CAAC,KAAK,KAAK,UAAU,OAAO,CAAC;AAAA,EAC7F,EAAE,KAAK,GAAG;AACV,QAAM,KAAK,QAAS;AACpB,QAAM,SAAS,MAAM,iBAAiB,SAAS,OAAO,EAAE;AACxD,SAAO;AAAA,IACL;AAAA,IACA,YAAa,QAAQ,cAAgC;AAAA,IACrD,MAAO,QAAQ,SAAiC,MAAM,QAAQ;AAAA,EAChE;AACF;AAEA,eAAsB,iBACpB,SACA,OACA,gBAC4B;AAC5B,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,4BAA4B,cAAc,IAAI,EAAE,MAAM,CAAC;AACzG,MAAI,CAAC,SAAS,GAAG,EAAG,QAAO;AAC3B,SAAO,aAAyB,QAAQ;AAC1C;AAEA,eAAsB,kBACpB,SACA,OACA,gBACA,MACA;AACA,SAAO,WAAW,SAAS,SAAS,4BAA4B,cAAc,IAAI,EAAE,OAAO,KAAK,CAAC;AACnG;AAEA,eAAsB,2BACpB,SACA,OACA,gBACe;AACf,MAAI,CAAC,SAAS,CAAC,eAAgB;AAC/B,QAAM,kBAAkB,SAAS,OAAO,gBAAgB,EAAE,QAAQ,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AACrG;AAcA,eAAsB,yBACpB,SACA,OACA,gBACA,YAC8B;AAC9B,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,4BAA4B,cAAc;AAAA,IAC1C,EAAE,OAAO,MAAM,EAAE,WAAW,EAAE;AAAA,EAChC;AACA,QAAM,OAAO,MAAM,aAAoD,QAAQ;AAC/E;AAAA,IACE,SAAS,OAAO;AAAA,IAChB,4CAA4C,SAAS,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC;AAAA,EACxF,EAAE,KAAK,GAAG;AACV,SAAO,MAAM,QAAQ,MAAM,WAAW,GAAG,sDAAsD,EAAE,KAAK,IAAI;AAC1G,SAAO,KAAM;AACf;AAEA,eAAsB,gBACpB,SACA,OACA,gBACwD;AACxD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,4BAA4B,cAAc;AAAA,IAC1C,EAAE,MAAM;AAAA,EACV;AACA,MAAI,CAAC,SAAS,GAAG,EAAG,QAAO;AAC3B,SAAO,aAAqD,QAAQ;AACtE;AAEA,eAAsB,yBACpB,SACA,OACA,gBACA,cACe;AACf,MAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,aAAc;AAChD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,4BAA4B,cAAc,gBAAgB,YAAY;AAAA,IACtE,EAAE,MAAM;AAAA,EACV,EAAE,MAAM,MAAM,MAAS;AACzB;AAsBA,eAAsB,sBACpB,SACA,OAC4B;AAC5B,QAAM,OAAmB,CAAC;AAC1B,MAAI,MAAM,KAAM,MAAK,OAAO,MAAM;AAClC,MAAI,MAAM,MAAO,MAAK,QAAQ,MAAM;AACpC,MAAI,MAAM,OAAQ,MAAK,SAAS,MAAM;AACtC,MAAI,MAAM,aAAc,MAAK,eAAe,MAAM;AAElD,QAAM,WAAW,MAAM,QAAQ,MAAM,WAAW,yBAAyB,GAAG;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,mBAAmB,MAAM,YAAY,eAAe;AAAA,IACtD;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,OAAQ,MAAM,aAAyB,QAAQ,KAAM,CAAC;AAC5D,QAAM,aAAc,KAAK,cAAyC,CAAC;AACnE,QAAM,WAAY,KAAK,YAAuC,CAAC;AAC/D,SAAO;AAAA,IACL,QAAQ,SAAS,OAAO;AAAA,IACxB,cAAe,WAAW,MAAiB;AAAA,IAC3C,YAAa,SAAS,MAAiB;AAAA,IACvC,aAAc,KAAK,gBAA2B;AAAA,IAC9C;AAAA,EACF;AACF;AAGA,eAAsB,6BACpB,SACA,OAC4B;AAC5B,QAAM,SAAS,MAAM,sBAAsB,SAAS,KAAK;AACzD;AAAA,IACE,OAAO;AAAA,IACP,uCAAuC,OAAO,MAAM,KAAK,KAAK,UAAU,OAAO,IAAI,CAAC;AAAA,EACtF,EAAE,KAAK,GAAG;AACV,SAAO,OAAO,cAAc,4CAA4C,EAAE,WAAW;AACrF,SAAO,OAAO,YAAY,0CAA0C,EAAE,WAAW;AACjF,SAAO,OAAO,aAAa,0CAA0C,EAAE,WAAW;AAClF,SAAO;AACT;AAGA,eAAsB,eACpB,SACA,OASA;AACA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,mBAAmB,MAAM,YAAY,eAAe;AAAA,IACpD,GAAI,MAAM,WAAW,CAAC;AAAA,EACxB;AACA,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,QAAM,OAAmB,EAAE,kBAAkB,MAAM,gBAAgB,OAAO,MAAM,MAAM;AACtF,MAAI,MAAM,cAAe,MAAK,iBAAiB,MAAM;AACrD,SAAO,QAAQ,MAAM,WAAW,iCAAiC,MAAM,YAAY,EAAE,GAAG;AAAA,IACtF,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,aACpB,SACA,OAOA;AACA,QAAM,UAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,mBAAmB,MAAM,YAAY,eAAe;AAAA,IACpD,GAAI,MAAM,WAAW,CAAC;AAAA,EACxB;AACA,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,SAAO,QAAQ,MAAM,WAAW,iCAAiC,MAAM,YAAY,SAAS,GAAG;AAAA,IAC7F,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,EAAE,kBAAkB,MAAM,eAAe;AAAA,EACjD,CAAC;AACH;AAGA,eAAsB,WACpB,SACA,OACA;AACA,QAAM,UAAkC,EAAE,GAAI,MAAM,WAAW,CAAC,EAAG;AACnE,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,SAAO,QAAQ,MAAM,WAAW,iCAAiC,MAAM,YAAY,EAAE,GAAG;AAAA,IACtF,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,uBACpB,SACA,OASA;AACA,QAAM,UAAkC,EAAE,GAAI,MAAM,WAAW,CAAC,EAAG;AACnE,MAAI,MAAM,YAAa,SAAQ,gBAAgB,UAAU,MAAM,WAAW;AAC1E,SAAO,QAAQ,MAAM,WAAW,iCAAiC,MAAM,YAAY,cAAc,GAAG;AAAA,IAClG,QAAQ;AAAA,IACR;AAAA,IACA,WAAW;AAAA,MACT,WAAW,MAAM;AAAA,MACjB,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,MAAM,aAAa,QAAQ,MAAM,MAAM;AAAA,IACjF;AAAA,EACF,CAAC;AACH;AAgBA,eAAsB,0BACpB,SACA,eACA,OACA,UAA2E,CAAC,GAC9C;AAC9B,QAAM,YAAY,MAAM,2BAA2B,SAAS,OAAO,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC7F,QAAM,eAAe,MAAM,0BAA0B,SAAS,OAAO,UAAU,QAAQ;AAAA,IACrF,MAAM;AAAA,IACN,GAAI,QAAQ,gBAAgB,CAAC;AAAA,EAC/B,CAAC;AACD,SAAO,aAAa,YAAY,8CAA8C,EAAE,WAAW;AAC3F,QAAM,WAAW,eAAe;AAChC,QAAM,UAAU,MAAM,6BAA6B,eAAe;AAAA,IAChE,MAAM,aAAa;AAAA,IACnB;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,gBAAgB,aAAa;AAAA,IAC7B,YAAY,aAAa;AAAA,IACzB,cAAc,QAAQ;AAAA,IACtB,YAAY,QAAQ;AAAA,IACpB,aAAa,QAAQ;AAAA,IACrB;AAAA,EACF;AACF;AAUA,eAAsB,WACpB,SACA,QACA,MACA,SACA;AACA,SAAO,QAAQ,MAAM,WAAW,IAAI,GAAG;AAAA,IACrC;AAAA,IACA,SAAS,EAAE,gBAAgB,oBAAoB,GAAG,QAAQ,QAAQ;AAAA,IAClE,MAAM,QAAQ;AAAA,EAChB,CAAC;AACH;AAMA,eAAsB,qBACpB,SACA,OACA,cACA;AACA,SAAO,WAAW,SAAS,OAAO,0BAA0B,YAAY,IAAI,EAAE,MAAM,CAAC;AACvF;AAEA,eAAsB,wBACpB,SACA,OACA,cACA;AACA,SAAO,WAAW,SAAS,OAAO,0BAA0B,YAAY,cAAc,EAAE,MAAM,CAAC;AACjG;AAEA,eAAsB,gBACpB,SACA,OACA,cACuB;AACvB,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,0BAA0B,YAAY;AAAA,IACtC,EAAE,MAAM;AAAA,EACV;AACA,MAAI,CAAC,SAAS,GAAG,EAAG,QAAO,CAAC;AAC5B,QAAM,OAAO,MAAM,aAAuC,QAAQ;AAClE,SAAO,MAAM,SAAS,CAAC;AACzB;AAEA,eAAsB,oBACpB,SACA,OACA,QACA,QAAyC,CAAC,GAC1C;AACA,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,EAAG,QAAO,IAAI,KAAK,OAAO,KAAK,CAAC;AAC/E,QAAM,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,SAAS,CAAC,KAAK;AAC7D,SAAO,WAAW,SAAS,OAAO,cAAc,MAAM,eAAe,MAAM,IAAI,EAAE,MAAM,CAAC;AAC1F;",
+  "names": []
+}

package/dist/modules/api_docs/api/get/version.js

@@ -2,21 +2,33 @@ import fs from "node:fs";
 import path from "node:path";
 import { NextResponse } from "next/server";
 import { z } from "zod";
+import { APP_VERSION } from "@open-mercato/shared/lib/version";
 const versionResponseSchema = z.object({
-  version: z.string()
+  version: z.string().describe(
+    "Deployed Open Mercato version: the OM_VERSION / OPEN_MERCATO_VERSION override when set, otherwise the installed platform version."
+  ),
+  platform: z.string().describe("Installed Open Mercato platform version (the version shown in the backend footer)."),
+  app: z.string().nullable().describe("Version from the deployment app's own package.json, or null when it cannot be read.")
 });
-function readDeployedVersion() {
+function readExplicitVersion() {
   const explicit = process.env.OM_VERSION || process.env.OPEN_MERCATO_VERSION;
-  if (explicit && explicit.length > 0) return explicit;
+  return explicit && explicit.length > 0 ? explicit : null;
+}
+function readAppVersion() {
   try {
     const packageJsonPath = path.join(process.cwd(), "package.json");
     const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
     if (typeof parsed.version === "string" && parsed.version.length > 0) return parsed.version;
   } catch {
+    return null;
   }
-  return "0.0.0-dev";
+  return null;
 }
-const deployedVersion = readDeployedVersion();
+const versionInfo = {
+  version: readExplicitVersion() ?? APP_VERSION,
+  platform: APP_VERSION,
+  app: readAppVersion()
+};
 const metadata = {
   path: "/version",
   GET: {
@@ -25,8 +37,7 @@ const metadata = {
   }
 };
 async function GET() {
-  const body = { version: deployedVersion };
-  return NextResponse.json(body);
+  return NextResponse.json(versionInfo);
 }
 var version_default = GET;
 const openApi = {
@@ -35,6 +46,7 @@ const openApi = {
   methods: {
     GET: {
       summary: "Return the deployed Open Mercato version",
+      description: "Reports the installed Open Mercato platform version (the same value the backend footer shows). `version` honours an explicit OM_VERSION / OPEN_MERCATO_VERSION override; `platform` is always the installed platform version; `app` is the deployment app shell version from its package.json.",
       tags: ["API Documentation"],
       responses: [
         {

package/dist/modules/api_docs/api/get/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/api_docs/api/get/version.ts"],
-  "sourcesContent": ["import fs from 'node:fs'\nimport path from 'node:path'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nconst versionResponseSchema = z.object({\n  version: z.string(),\n})\n\ntype VersionResponse = z.infer<typeof versionResponseSchema>\n\nfunction readDeployedVersion(): string {\n  // Explicit override wins: deployments that bundle a different version than the\n  // running app's package.json (or want to pin the Open Mercato platform version)\n  // set OM_VERSION / OPEN_MERCATO_VERSION.\n  const explicit = process.env.OM_VERSION || process.env.OPEN_MERCATO_VERSION\n  if (explicit && explicit.length > 0) return explicit\n  try {\n    const packageJsonPath = path.join(process.cwd(), 'package.json')\n    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) as { version?: string }\n    if (typeof parsed.version === 'string' && parsed.version.length > 0) return parsed.version\n  } catch {\n    // Fall through to the development sentinel below.\n  }\n  return '0.0.0-dev'\n}\n\nconst deployedVersion = readDeployedVersion()\n\nexport const metadata = {\n  path: '/version',\n  GET: {\n    requireAuth: false,\n    rateLimit: { points: 30, duration: 60, keyPrefix: 'api_version' },\n  },\n}\n\nexport async function GET() {\n  const body: VersionResponse = { version: deployedVersion }\n  return NextResponse.json(body)\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'API Documentation',\n  summary: 'Deployed Open Mercato version',\n  methods: {\n    GET: {\n      summary: 'Return the deployed Open Mercato version',\n      tags: ['API Documentation'],\n      responses: [\n        {\n          status: 200,\n          description: 'Current deployment version metadata',\n          schema: versionResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EAAE,OAAO;AACpB,CAAC;AAID,SAAS,sBAA8B;AAIrC,QAAM,WAAW,QAAQ,IAAI,cAAc,QAAQ,IAAI;AACvD,MAAI,YAAY,SAAS,SAAS,EAAG,QAAO;AAC5C,MAAI;AACF,UAAM,kBAAkB,KAAK,KAAK,QAAQ,IAAI,GAAG,cAAc;AAC/D,UAAM,SAAS,KAAK,MAAM,GAAG,aAAa,iBAAiB,MAAM,CAAC;AAClE,QAAI,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,SAAS,EAAG,QAAO,OAAO;AAAA,EACrF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,MAAM,kBAAkB,oBAAoB;AAErC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,IACb,WAAW,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,cAAc;AAAA,EAClE;AACF;AAEA,eAAsB,MAAM;AAC1B,QAAM,OAAwB,EAAE,SAAS,gBAAgB;AACzD,SAAO,aAAa,KAAK,IAAI;AAC/B;AAEA,IAAO,kBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,mBAAmB;AAAA,MAC1B,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import fs from 'node:fs'\nimport path from 'node:path'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { APP_VERSION } from '@open-mercato/shared/lib/version'\n\nconst versionResponseSchema = z.object({\n  version: z\n    .string()\n    .describe(\n      'Deployed Open Mercato version: the OM_VERSION / OPEN_MERCATO_VERSION override when set, otherwise the installed platform version.',\n    ),\n  platform: z\n    .string()\n    .describe('Installed Open Mercato platform version (the version shown in the backend footer).'),\n  app: z\n    .string()\n    .nullable()\n    .describe(\"Version from the deployment app's own package.json, or null when it cannot be read.\"),\n})\n\ntype VersionResponse = z.infer<typeof versionResponseSchema>\n\nfunction readExplicitVersion(): string | null {\n  const explicit = process.env.OM_VERSION || process.env.OPEN_MERCATO_VERSION\n  return explicit && explicit.length > 0 ? explicit : null\n}\n\nfunction readAppVersion(): string | null {\n  try {\n    const packageJsonPath = path.join(process.cwd(), 'package.json')\n    const parsed = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) as { version?: string }\n    if (typeof parsed.version === 'string' && parsed.version.length > 0) return parsed.version\n  } catch {\n    return null\n  }\n  return null\n}\n\nconst versionInfo: VersionResponse = {\n  version: readExplicitVersion() ?? APP_VERSION,\n  platform: APP_VERSION,\n  app: readAppVersion(),\n}\n\nexport const metadata = {\n  path: '/version',\n  GET: {\n    requireAuth: false,\n    rateLimit: { points: 30, duration: 60, keyPrefix: 'api_version' },\n  },\n}\n\nexport async function GET() {\n  return NextResponse.json(versionInfo)\n}\n\nexport default GET\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'API Documentation',\n  summary: 'Deployed Open Mercato version',\n  methods: {\n    GET: {\n      summary: 'Return the deployed Open Mercato version',\n      description:\n        'Reports the installed Open Mercato platform version (the same value the backend footer shows). `version` honours an explicit OM_VERSION / OPEN_MERCATO_VERSION override; `platform` is always the installed platform version; `app` is the deployment app shell version from its package.json.',\n      tags: ['API Documentation'],\n      responses: [\n        {\n          status: 200,\n          description: 'Current deployment version metadata',\n          schema: versionResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAE5B,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,SAAS,EACN,OAAO,EACP;AAAA,IACC;AAAA,EACF;AAAA,EACF,UAAU,EACP,OAAO,EACP,SAAS,oFAAoF;AAAA,EAChG,KAAK,EACF,OAAO,EACP,SAAS,EACT,SAAS,qFAAqF;AACnG,CAAC;AAID,SAAS,sBAAqC;AAC5C,QAAM,WAAW,QAAQ,IAAI,cAAc,QAAQ,IAAI;AACvD,SAAO,YAAY,SAAS,SAAS,IAAI,WAAW;AACtD;AAEA,SAAS,iBAAgC;AACvC,MAAI;AACF,UAAM,kBAAkB,KAAK,KAAK,QAAQ,IAAI,GAAG,cAAc;AAC/D,UAAM,SAAS,KAAK,MAAM,GAAG,aAAa,iBAAiB,MAAM,CAAC;AAClE,QAAI,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,SAAS,EAAG,QAAO,OAAO;AAAA,EACrF,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,MAAM,cAA+B;AAAA,EACnC,SAAS,oBAAoB,KAAK;AAAA,EAClC,UAAU;AAAA,EACV,KAAK,eAAe;AACtB;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA,IACH,aAAa;AAAA,IACb,WAAW,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW,cAAc;AAAA,EAClE;AACF;AAEA,eAAsB,MAAM;AAC1B,SAAO,aAAa,KAAK,WAAW;AACtC;AAEA,IAAO,kBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,MAAM,CAAC,mBAAmB;AAAA,MAC1B,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }