@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/forms/api/[id]/route.js

@@ -0,0 +1,225 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { Form, FormVersion } from "../../data/entities.js";
+import {
+  formArchiveCommandSchema,
+  formPatchRequestSchema,
+  formRenameCommandSchema
+} from "../../data/validators.js";
+import {
+  attachOperationMetadata,
+  buildFormsRouteContext,
+  handleRouteError,
+  jsonError,
+  withMutationGuard,
+  withScopedPayload
+} from "../helpers.js";
+import { FORM_RESOURCE_KIND } from "../../commands/shared.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["forms.view"] },
+  PATCH: { requireAuth: true, requireFeatures: ["forms.design"] },
+  DELETE: { requireAuth: true, requireFeatures: ["forms.design"] }
+};
+const versionSummarySchema = z.object({
+  id: z.string().uuid(),
+  versionNumber: z.number().int(),
+  status: z.enum(["draft", "published", "archived"]),
+  schemaHash: z.string(),
+  registryVersion: z.string(),
+  publishedAt: z.string().nullable(),
+  publishedBy: z.string().uuid().nullable(),
+  changelog: z.string().nullable(),
+  archivedAt: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+const detailResponseSchema = z.object({
+  id: z.string().uuid(),
+  key: z.string(),
+  name: z.string(),
+  description: z.string().nullable(),
+  status: z.enum(["draft", "active", "archived"]),
+  defaultLocale: z.string(),
+  supportedLocales: z.array(z.string()),
+  currentPublishedVersionId: z.string().uuid().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  versions: z.array(versionSummarySchema)
+});
+const okSchema = z.object({ ok: z.literal(true), updatedAt: z.string() });
+const errorSchema = z.object({ error: z.string() });
+function extractFormId(req) {
+  const url = new URL(req.url);
+  const segments = url.pathname.split("/").filter(Boolean);
+  const idx = segments.findIndex((segment) => segment === "forms");
+  return idx >= 0 ? segments[idx + 1] ?? "" : "";
+}
+async function loadForm(em, id, tenantId, organizationId) {
+  return em.findOne(Form, { id, tenantId, organizationId, deletedAt: null });
+}
+async function GET(req) {
+  try {
+    const { ctx, organizationId, tenantId } = await buildFormsRouteContext(req);
+    if (!organizationId || !tenantId) {
+      return jsonError(400, "forms.errors.organization_required");
+    }
+    const id = extractFormId(req);
+    if (!id) return jsonError(400, "forms.errors.invalid_id");
+    const em = ctx.container.resolve("em");
+    const form = await loadForm(em, id, tenantId, organizationId);
+    if (!form) return jsonError(404, "forms.errors.form_not_found");
+    const versions = await em.find(
+      FormVersion,
+      { formId: form.id, tenantId, organizationId },
+      { orderBy: { versionNumber: "desc" } }
+    );
+    return NextResponse.json({
+      id: form.id,
+      key: form.key,
+      name: form.name,
+      description: form.description ?? null,
+      status: form.status,
+      defaultLocale: form.defaultLocale,
+      supportedLocales: [...form.supportedLocales],
+      currentPublishedVersionId: form.currentPublishedVersionId ?? null,
+      createdAt: form.createdAt.toISOString(),
+      updatedAt: form.updatedAt.toISOString(),
+      versions: versions.map((version) => ({
+        id: version.id,
+        versionNumber: version.versionNumber,
+        status: version.status,
+        schemaHash: version.schemaHash,
+        registryVersion: version.registryVersion,
+        publishedAt: version.publishedAt ? version.publishedAt.toISOString() : null,
+        publishedBy: version.publishedBy ?? null,
+        changelog: version.changelog ?? null,
+        archivedAt: version.archivedAt ? version.archivedAt.toISOString() : null,
+        createdAt: version.createdAt.toISOString(),
+        updatedAt: version.updatedAt.toISOString()
+      }))
+    });
+  } catch (error) {
+    return handleRouteError("forms[id].GET", error);
+  }
+}
+async function PATCH(req) {
+  try {
+    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req);
+    if (!organizationId || !tenantId) {
+      return jsonError(400, "forms.errors.organization_required");
+    }
+    const id = extractFormId(req);
+    if (!id) return jsonError(400, "forms.errors.invalid_id");
+    const body = await readJsonSafe(req, {}) ?? {};
+    const parsed = formPatchRequestSchema.parse(body);
+    const scoped = withScopedPayload({ ...parsed, id }, ctx, translate);
+    const renameInput = formRenameCommandSchema.parse(scoped);
+    return await withMutationGuard({
+      ctx,
+      tenantId,
+      organizationId,
+      resourceKind: FORM_RESOURCE_KIND,
+      resourceId: id,
+      operation: "update",
+      request: req,
+      payload: scoped,
+      run: async () => {
+        const commandBus = ctx.container.resolve("commandBus");
+        const { result, logEntry } = await commandBus.execute(
+          "forms.form.rename",
+          { input: renameInput, ctx }
+        );
+        const response = NextResponse.json({ ok: true, updatedAt: result?.updatedAt });
+        return attachOperationMetadata(response, logEntry, FORM_RESOURCE_KIND, result?.formId ?? id);
+      }
+    });
+  } catch (error) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(error);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return handleRouteError("forms[id].PATCH", error);
+  }
+}
+async function DELETE(req) {
+  try {
+    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req);
+    if (!organizationId || !tenantId) {
+      return jsonError(400, "forms.errors.organization_required");
+    }
+    const id = extractFormId(req);
+    if (!id) return jsonError(400, "forms.errors.invalid_id");
+    const scoped = withScopedPayload({ id }, ctx, translate);
+    const archiveInput = formArchiveCommandSchema.parse(scoped);
+    return await withMutationGuard({
+      ctx,
+      tenantId,
+      organizationId,
+      resourceKind: FORM_RESOURCE_KIND,
+      resourceId: id,
+      operation: "delete",
+      request: req,
+      payload: scoped,
+      run: async () => {
+        const commandBus = ctx.container.resolve("commandBus");
+        const { result, logEntry } = await commandBus.execute(
+          "forms.form.archive",
+          { input: archiveInput, ctx }
+        );
+        const response = NextResponse.json({ ok: true, updatedAt: result?.updatedAt });
+        return attachOperationMetadata(response, logEntry, FORM_RESOURCE_KIND, result?.formId ?? id);
+      }
+    });
+  } catch (error) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(error);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    return handleRouteError("forms[id].DELETE", error);
+  }
+}
+const openApi = {
+  tag: "Forms",
+  summary: "Form detail and lifecycle",
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: "Get form detail",
+      description: "Returns the form metadata + version summaries.",
+      responses: [
+        { status: 200, description: "Form detail", schema: detailResponseSchema }
+      ],
+      errors: [
+        { status: 404, description: "Form not found", schema: errorSchema }
+      ]
+    },
+    PATCH: {
+      summary: "Update form metadata",
+      description: "Updates the form name, description, and/or locale set (supportedLocales + defaultLocale).",
+      requestBody: { contentType: "application/json", schema: formPatchRequestSchema },
+      responses: [{ status: 200, description: "Form updated", schema: okSchema }],
+      errors: [
+        { status: 404, description: "Form not found", schema: errorSchema },
+        { status: 400, description: "Invalid payload", schema: errorSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Archive form",
+      description: "Soft-archives the form (sets archived_at, status=archived).",
+      responses: [{ status: 200, description: "Form archived", schema: okSchema }],
+      errors: [
+        { status: 404, description: "Form not found", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  GET,
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/forms/api/%5Bid%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { Form, FormVersion } from '../../data/entities'\nimport {\n  formArchiveCommandSchema,\n  formPatchRequestSchema,\n  formRenameCommandSchema,\n  type FormArchiveCommandInput,\n  type FormRenameCommandInput,\n} from '../../data/validators'\nimport {\n  attachOperationMetadata,\n  buildFormsRouteContext,\n  handleRouteError,\n  jsonError,\n  withMutationGuard,\n  withScopedPayload,\n} from '../helpers'\nimport { FORM_RESOURCE_KIND } from '../../commands/shared'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['forms.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['forms.design'] },\n  DELETE: { requireAuth: true, requireFeatures: ['forms.design'] },\n}\n\nconst versionSummarySchema = z.object({\n  id: z.string().uuid(),\n  versionNumber: z.number().int(),\n  status: z.enum(['draft', 'published', 'archived']),\n  schemaHash: z.string(),\n  registryVersion: z.string(),\n  publishedAt: z.string().nullable(),\n  publishedBy: z.string().uuid().nullable(),\n  changelog: z.string().nullable(),\n  archivedAt: z.string().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n})\n\nconst detailResponseSchema = z.object({\n  id: z.string().uuid(),\n  key: z.string(),\n  name: z.string(),\n  description: z.string().nullable(),\n  status: z.enum(['draft', 'active', 'archived']),\n  defaultLocale: z.string(),\n  supportedLocales: z.array(z.string()),\n  currentPublishedVersionId: z.string().uuid().nullable(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n  versions: z.array(versionSummarySchema),\n})\n\nconst okSchema = z.object({ ok: z.literal(true), updatedAt: z.string() })\nconst errorSchema = z.object({ error: z.string() })\n\nfunction extractFormId(req: Request): string {\n  const url = new URL(req.url)\n  const segments = url.pathname.split('/').filter(Boolean)\n  const idx = segments.findIndex((segment) => segment === 'forms')\n  return idx >= 0 ? segments[idx + 1] ?? '' : ''\n}\n\nasync function loadForm(em: EntityManager, id: string, tenantId: string, organizationId: string): Promise<Form | null> {\n  return em.findOne(Form, { id, tenantId, organizationId, deletedAt: null })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const id = extractFormId(req)\n    if (!id) return jsonError(400, 'forms.errors.invalid_id')\n\n    const em = ctx.container.resolve('em') as EntityManager\n    const form = await loadForm(em, id, tenantId, organizationId)\n    if (!form) return jsonError(404, 'forms.errors.form_not_found')\n\n    const versions = await em.find(\n      FormVersion,\n      { formId: form.id, tenantId, organizationId },\n      { orderBy: { versionNumber: 'desc' } },\n    )\n\n    return NextResponse.json({\n      id: form.id,\n      key: form.key,\n      name: form.name,\n      description: form.description ?? null,\n      status: form.status,\n      defaultLocale: form.defaultLocale,\n      supportedLocales: [...form.supportedLocales],\n      currentPublishedVersionId: form.currentPublishedVersionId ?? null,\n      createdAt: form.createdAt.toISOString(),\n      updatedAt: form.updatedAt.toISOString(),\n      versions: versions.map((version) => ({\n        id: version.id,\n        versionNumber: version.versionNumber,\n        status: version.status,\n        schemaHash: version.schemaHash,\n        registryVersion: version.registryVersion,\n        publishedAt: version.publishedAt ? version.publishedAt.toISOString() : null,\n        publishedBy: version.publishedBy ?? null,\n        changelog: version.changelog ?? null,\n        archivedAt: version.archivedAt ? version.archivedAt.toISOString() : null,\n        createdAt: version.createdAt.toISOString(),\n        updatedAt: version.updatedAt.toISOString(),\n      })),\n    })\n  } catch (error) {\n    return handleRouteError('forms[id].GET', error)\n  }\n}\n\nexport async function PATCH(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const id = extractFormId(req)\n    if (!id) return jsonError(400, 'forms.errors.invalid_id')\n\n    const body = (await readJsonSafe<Record<string, unknown>>(req, {})) ?? {}\n    const parsed = formPatchRequestSchema.parse(body)\n    const scoped = withScopedPayload({ ...parsed, id }, ctx, translate)\n    const renameInput = formRenameCommandSchema.parse(scoped) satisfies FormRenameCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_RESOURCE_KIND,\n      resourceId: id,\n      operation: 'update',\n      request: req,\n      payload: scoped as Record<string, unknown>,\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<\n          FormRenameCommandInput,\n          { formId: string; updatedAt: string }\n        >(\n          'forms.form.rename',\n          { input: renameInput, ctx },\n        )\n        const response = NextResponse.json({ ok: true, updatedAt: result?.updatedAt })\n        return attachOperationMetadata(response, logEntry, FORM_RESOURCE_KIND, result?.formId ?? id)\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('forms[id].PATCH', error)\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const { ctx, organizationId, tenantId, translate } = await buildFormsRouteContext(req)\n    if (!organizationId || !tenantId) {\n      return jsonError(400, 'forms.errors.organization_required')\n    }\n    const id = extractFormId(req)\n    if (!id) return jsonError(400, 'forms.errors.invalid_id')\n\n    const scoped = withScopedPayload({ id }, ctx, translate)\n    const archiveInput = formArchiveCommandSchema.parse(scoped) satisfies FormArchiveCommandInput\n\n    return await withMutationGuard({\n      ctx,\n      tenantId,\n      organizationId,\n      resourceKind: FORM_RESOURCE_KIND,\n      resourceId: id,\n      operation: 'delete',\n      request: req,\n      payload: scoped as Record<string, unknown>,\n      run: async () => {\n        const commandBus = ctx.container.resolve('commandBus') as CommandBus\n        const { result, logEntry } = await commandBus.execute<\n          FormArchiveCommandInput,\n          { formId: string; updatedAt: string }\n        >(\n          'forms.form.archive',\n          { input: archiveInput, ctx },\n        )\n        const response = NextResponse.json({ ok: true, updatedAt: result?.updatedAt })\n        return attachOperationMetadata(response, logEntry, FORM_RESOURCE_KIND, result?.formId ?? id)\n      },\n    })\n  } catch (error) {\n    const interceptorRejection = getCommandInterceptorHttpRejection(error)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    return handleRouteError('forms[id].DELETE', error)\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Forms',\n  summary: 'Form detail and lifecycle',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: {\n      summary: 'Get form detail',\n      description: 'Returns the form metadata + version summaries.',\n      responses: [\n        { status: 200, description: 'Form detail', schema: detailResponseSchema },\n      ],\n      errors: [\n        { status: 404, description: 'Form not found', schema: errorSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Update form metadata',\n      description: 'Updates the form name, description, and/or locale set (supportedLocales + defaultLocale).',\n      requestBody: { contentType: 'application/json', schema: formPatchRequestSchema },\n      responses: [{ status: 200, description: 'Form updated', schema: okSchema }],\n      errors: [\n        { status: 404, description: 'Form not found', schema: errorSchema },\n        { status: 400, description: 'Invalid payload', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Archive form',\n      description: 'Soft-archives the form (sets archived_at, status=archived).',\n      responses: [{ status: 200, description: 'Form archived', schema: okSchema }],\n      errors: [\n        { status: 404, description: 'Form not found', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,0CAA0C;AAEnD,SAAS,oBAAoB;AAC7B,SAAS,MAAM,mBAAmB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAAA,EAC1D,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AAAA,EAC9D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,cAAc,EAAE;AACjE;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,EAC9B,QAAQ,EAAE,KAAK,CAAC,SAAS,aAAa,UAAU,CAAC;AAAA,EACjD,YAAY,EAAE,OAAO;AAAA,EACrB,iBAAiB,EAAE,OAAO;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,KAAK,CAAC,SAAS,UAAU,UAAU,CAAC;AAAA,EAC9C,eAAe,EAAE,OAAO;AAAA,EACxB,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACpC,2BAA2B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtD,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AAAA,EACpB,UAAU,EAAE,MAAM,oBAAoB;AACxC,CAAC;AAED,MAAM,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,CAAC;AACxE,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,SAAS,cAAc,KAAsB;AAC3C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,WAAW,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACvD,QAAM,MAAM,SAAS,UAAU,CAAC,YAAY,YAAY,OAAO;AAC/D,SAAO,OAAO,IAAI,SAAS,MAAM,CAAC,KAAK,KAAK;AAC9C;AAEA,eAAe,SAAS,IAAmB,IAAY,UAAkB,gBAA8C;AACrH,SAAO,GAAG,QAAQ,MAAM,EAAE,IAAI,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAC3E;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,SAAS,IAAI,MAAM,uBAAuB,GAAG;AAC1E,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,KAAK,cAAc,GAAG;AAC5B,QAAI,CAAC,GAAI,QAAO,UAAU,KAAK,yBAAyB;AAExD,UAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,UAAM,OAAO,MAAM,SAAS,IAAI,IAAI,UAAU,cAAc;AAC5D,QAAI,CAAC,KAAM,QAAO,UAAU,KAAK,6BAA6B;AAE9D,UAAM,WAAW,MAAM,GAAG;AAAA,MACxB;AAAA,MACA,EAAE,QAAQ,KAAK,IAAI,UAAU,eAAe;AAAA,MAC5C,EAAE,SAAS,EAAE,eAAe,OAAO,EAAE;AAAA,IACvC;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,QAAQ,KAAK;AAAA,MACb,eAAe,KAAK;AAAA,MACpB,kBAAkB,CAAC,GAAG,KAAK,gBAAgB;AAAA,MAC3C,2BAA2B,KAAK,6BAA6B;AAAA,MAC7D,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,WAAW,KAAK,UAAU,YAAY;AAAA,MACtC,UAAU,SAAS,IAAI,CAAC,aAAa;AAAA,QACnC,IAAI,QAAQ;AAAA,QACZ,eAAe,QAAQ;AAAA,QACvB,QAAQ,QAAQ;AAAA,QAChB,YAAY,QAAQ;AAAA,QACpB,iBAAiB,QAAQ;AAAA,QACzB,aAAa,QAAQ,cAAc,QAAQ,YAAY,YAAY,IAAI;AAAA,QACvE,aAAa,QAAQ,eAAe;AAAA,QACpC,WAAW,QAAQ,aAAa;AAAA,QAChC,YAAY,QAAQ,aAAa,QAAQ,WAAW,YAAY,IAAI;AAAA,QACpE,WAAW,QAAQ,UAAU,YAAY;AAAA,QACzC,WAAW,QAAQ,UAAU,YAAY;AAAA,MAC3C,EAAE;AAAA,IACJ,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,iBAAiB,iBAAiB,KAAK;AAAA,EAChD;AACF;AAEA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,UAAU,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,KAAK,cAAc,GAAG;AAC5B,QAAI,CAAC,GAAI,QAAO,UAAU,KAAK,yBAAyB;AAExD,UAAM,OAAQ,MAAM,aAAsC,KAAK,CAAC,CAAC,KAAM,CAAC;AACxE,UAAM,SAAS,uBAAuB,MAAM,IAAI;AAChD,UAAM,SAAS,kBAAkB,EAAE,GAAG,QAAQ,GAAG,GAAG,KAAK,SAAS;AAClE,UAAM,cAAc,wBAAwB,MAAM,MAAM;AAExD,WAAO,MAAM,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS;AAAA,MACT,KAAK,YAAY;AACf,cAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,cAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,UAI5C;AAAA,UACA,EAAE,OAAO,aAAa,IAAI;AAAA,QAC5B;AACA,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,QAAQ,UAAU,CAAC;AAC7E,eAAO,wBAAwB,UAAU,UAAU,oBAAoB,QAAQ,UAAU,EAAE;AAAA,MAC7F;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,iBAAiB,mBAAmB,KAAK;AAAA,EAClD;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,EAAE,KAAK,gBAAgB,UAAU,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACrF,QAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,aAAO,UAAU,KAAK,oCAAoC;AAAA,IAC5D;AACA,UAAM,KAAK,cAAc,GAAG;AAC5B,QAAI,CAAC,GAAI,QAAO,UAAU,KAAK,yBAAyB;AAExD,UAAM,SAAS,kBAAkB,EAAE,GAAG,GAAG,KAAK,SAAS;AACvD,UAAM,eAAe,yBAAyB,MAAM,MAAM;AAE1D,WAAO,MAAM,kBAAkB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS;AAAA,MACT,KAAK,YAAY;AACf,cAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,cAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW;AAAA,UAI5C;AAAA,UACA,EAAE,OAAO,cAAc,IAAI;AAAA,QAC7B;AACA,cAAM,WAAW,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,QAAQ,UAAU,CAAC;AAC7E,eAAO,wBAAwB,UAAU,UAAU,oBAAoB,QAAQ,UAAU,EAAE;AAAA,MAC7F;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,uBAAuB,mCAAmC,KAAK;AACrE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,iBAAiB,oBAAoB,KAAK;AAAA,EACnD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,qBAAqB;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,MACpE;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,MAC/E,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,SAAS,CAAC;AAAA,MAC1E,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,QAClE,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,MACrE;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,SAAS,CAAC;AAAA,MAC3E,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/forms/api/[id]/run/context/route.js

@@ -0,0 +1,115 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { Form } from "../../../../data/entities.js";
+import { FormVersion } from "../../../../data/entities.js";
+import { buildFormsRouteContext, jsonError } from "../../../helpers.js";
+const metadata = {
+  GET: { requireAuth: true }
+};
+async function GET(req, context) {
+  const params = await Promise.resolve(context.params);
+  const formId = String(params.id);
+  let scoped;
+  try {
+    scoped = await buildFormsRouteContext(req);
+  } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
+    throw error;
+  }
+  const { ctx, organizationId, tenantId } = scoped;
+  if (!organizationId || !tenantId) {
+    return jsonError(400, "forms.errors.organization_required");
+  }
+  const compiler = ctx.container.resolve("formVersionCompiler");
+  const em = ctx.container.resolve("em");
+  const form = await em.findOne(Form, { id: formId, tenantId, organizationId, deletedAt: null });
+  if (!form) {
+    return NextResponse.json({ error: "NOT_FOUND", message: "Form not found." }, { status: 404 });
+  }
+  if (form.status !== "active") {
+    return NextResponse.json({ error: "FORM_INACTIVE", message: "Form is not active." }, { status: 422 });
+  }
+  if (!form.currentPublishedVersionId) {
+    return NextResponse.json(
+      { error: "FORM_VERSION_NOT_PUBLISHED", message: "Form has no published version." },
+      { status: 422 }
+    );
+  }
+  const formVersion = await em.findOne(FormVersion, {
+    id: form.currentPublishedVersionId,
+    organizationId: form.organizationId,
+    tenantId: form.tenantId
+  });
+  if (!formVersion) {
+    return NextResponse.json({ error: "NOT_FOUND", message: "Form version not found." }, { status: 404 });
+  }
+  const compiled = compiler.compile({
+    id: formVersion.id,
+    updatedAt: formVersion.updatedAt,
+    schema: formVersion.schema,
+    uiSchema: formVersion.uiSchema
+  });
+  return NextResponse.json({
+    form: {
+      id: form.id,
+      key: form.key,
+      name: form.name,
+      defaultLocale: form.defaultLocale,
+      supportedLocales: form.supportedLocales
+    },
+    formVersion: {
+      id: formVersion.id,
+      versionNumber: formVersion.versionNumber,
+      schemaHash: compiled.schemaHash,
+      registryVersion: compiled.registryVersion
+    },
+    schema: formVersion.schema,
+    uiSchema: formVersion.uiSchema,
+    requiresCustomerAuth: false
+  });
+}
+const responseSchema = z.object({
+  form: z.object({
+    id: z.string().uuid(),
+    key: z.string(),
+    name: z.string(),
+    defaultLocale: z.string(),
+    supportedLocales: z.array(z.string())
+  }),
+  formVersion: z.object({
+    id: z.string().uuid(),
+    versionNumber: z.number().int(),
+    schemaHash: z.string(),
+    registryVersion: z.string()
+  }),
+  schema: z.record(z.string(), z.unknown()),
+  uiSchema: z.record(z.string(), z.unknown()),
+  requiresCustomerAuth: z.boolean()
+});
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional()
+});
+const getMethodDoc = {
+  summary: "Get the published form version for the in-app runner.",
+  description: "Returns the schema + uiSchema for the form's currently published version. Authenticated and scoped to the caller's tenant and organization \u2014 anonymous runs go through POST /api/forms/public/start instead.",
+  tags: ["Forms Runtime"],
+  responses: [{ status: 200, description: "Published form version", schema: responseSchema }],
+  errors: [
+    { status: 400, description: "Missing tenant or organization context", schema: errorSchema },
+    { status: 401, description: "Unauthenticated", schema: errorSchema },
+    { status: 404, description: "Form or version not found", schema: errorSchema },
+    { status: 422, description: "Form not active or unpublished", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Public form version bootstrap",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/[id]/run/context/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/%5Bid%5D/run/context/route.ts"],
+  "sourcesContent": ["/**\n * In-app runner \u2014 GET /api/forms/:id/run/context.\n *\n * Returns the currently published `FormVersion` for the form id so the\n * in-app runner at `/forms/:id/run` can render.\n *\n * Authenticated and tenant-scoped. This route is addressed by FORM id, not by\n * a distribution slug or an invitation token, so it carries no capability a\n * tenant deliberately handed out. Served anonymously it would return the full\n * `schema` + `uiSchema` of ANY active published form in ANY tenant to anyone\n * holding the form UUID \u2014 bypassing the distribution gate, the availability and\n * cap checks, the CAPTCHA and the rate limiter that `/api/forms/public/*`\n * enforces. Anonymous traffic belongs on that flow (`/f/:slug`, `/i/:token`),\n * which is what the render-surfaces spec assigns it to.\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { Form } from '../../../../data/entities'\nimport { FormVersion } from '../../../../data/entities'\nimport { FormVersionCompiler } from '../../../../services/form-version-compiler'\nimport { buildFormsRouteContext, jsonError } from '../../../helpers'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nexport async function GET(\n  req: Request,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const formId = String(params.id)\n\n  let scoped: Awaited<ReturnType<typeof buildFormsRouteContext>>\n  try {\n    scoped = await buildFormsRouteContext(req)\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    throw error\n  }\n  const { ctx, organizationId, tenantId } = scoped\n  if (!organizationId || !tenantId) {\n    return jsonError(400, 'forms.errors.organization_required')\n  }\n\n  const compiler = ctx.container.resolve('formVersionCompiler') as FormVersionCompiler\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const form = await em.findOne(Form, { id: formId, tenantId, organizationId, deletedAt: null })\n  if (!form) {\n    return NextResponse.json({ error: 'NOT_FOUND', message: 'Form not found.' }, { status: 404 })\n  }\n  if (form.status !== 'active') {\n    return NextResponse.json({ error: 'FORM_INACTIVE', message: 'Form is not active.' }, { status: 422 })\n  }\n  if (!form.currentPublishedVersionId) {\n    return NextResponse.json(\n      { error: 'FORM_VERSION_NOT_PUBLISHED', message: 'Form has no published version.' },\n      { status: 422 },\n    )\n  }\n  const formVersion = await em.findOne(FormVersion, {\n    id: form.currentPublishedVersionId,\n    organizationId: form.organizationId,\n    tenantId: form.tenantId,\n  })\n  if (!formVersion) {\n    return NextResponse.json({ error: 'NOT_FOUND', message: 'Form version not found.' }, { status: 404 })\n  }\n\n  const compiled = compiler.compile({\n    id: formVersion.id,\n    updatedAt: formVersion.updatedAt,\n    schema: formVersion.schema,\n    uiSchema: formVersion.uiSchema,\n  })\n\n  return NextResponse.json({\n    form: {\n      id: form.id,\n      key: form.key,\n      name: form.name,\n      defaultLocale: form.defaultLocale,\n      supportedLocales: form.supportedLocales,\n    },\n    formVersion: {\n      id: formVersion.id,\n      versionNumber: formVersion.versionNumber,\n      schemaHash: compiled.schemaHash,\n      registryVersion: compiled.registryVersion,\n    },\n    schema: formVersion.schema,\n    uiSchema: formVersion.uiSchema,\n    requiresCustomerAuth: false,\n  })\n}\n\nconst responseSchema = z.object({\n  form: z.object({\n    id: z.string().uuid(),\n    key: z.string(),\n    name: z.string(),\n    defaultLocale: z.string(),\n    supportedLocales: z.array(z.string()),\n  }),\n  formVersion: z.object({\n    id: z.string().uuid(),\n    versionNumber: z.number().int(),\n    schemaHash: z.string(),\n    registryVersion: z.string(),\n  }),\n  schema: z.record(z.string(), z.unknown()),\n  uiSchema: z.record(z.string(), z.unknown()),\n  requiresCustomerAuth: z.boolean(),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get the published form version for the in-app runner.',\n  description: 'Returns the schema + uiSchema for the form\\'s currently published version. Authenticated and scoped to the caller\\'s tenant and organization \u2014 anonymous runs go through POST /api/forms/public/start instead.',\n  tags: ['Forms Runtime'],\n  responses: [{ status: 200, description: 'Published form version', schema: responseSchema }],\n  errors: [\n    { status: 400, description: 'Missing tenant or organization context', schema: errorSchema },\n    { status: 401, description: 'Unauthenticated', schema: errorSchema },\n    { status: 404, description: 'Form or version not found', schema: errorSchema },\n    { status: 422, description: 'Form not active or unpublished', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public form version bootstrap',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAgBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,SAAS,wBAAwB,iBAAiB;AAE3C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,SAAS,OAAO,OAAO,EAAE;AAE/B,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,uBAAuB,GAAG;AAAA,EAC3C,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,UAAM;AAAA,EACR;AACA,QAAM,EAAE,KAAK,gBAAgB,SAAS,IAAI;AAC1C,MAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,WAAO,UAAU,KAAK,oCAAoC;AAAA,EAC5D;AAEA,QAAM,WAAW,IAAI,UAAU,QAAQ,qBAAqB;AAC5D,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAC7F,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACA,MAAI,KAAK,WAAW,UAAU;AAC5B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AACA,MAAI,CAAC,KAAK,2BAA2B;AACnC,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,8BAA8B,SAAS,iCAAiC;AAAA,MACjF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,IAChD,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AAEA,QAAM,WAAW,SAAS,QAAQ;AAAA,IAChC,IAAI,YAAY;AAAA,IAChB,WAAW,YAAY;AAAA,IACvB,QAAQ,YAAY;AAAA,IACpB,UAAU,YAAY;AAAA,EACxB,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,MAAM;AAAA,MACJ,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,MAAM,KAAK;AAAA,MACX,eAAe,KAAK;AAAA,MACpB,kBAAkB,KAAK;AAAA,IACzB;AAAA,IACA,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,eAAe,YAAY;AAAA,MAC3B,YAAY,SAAS;AAAA,MACrB,iBAAiB,SAAS;AAAA,IAC5B;AAAA,IACA,QAAQ,YAAY;AAAA,IACpB,UAAU,YAAY;AAAA,IACtB,sBAAsB;AAAA,EACxB,CAAC;AACH;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,KAAK,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,eAAe,EAAE,OAAO;AAAA,IACxB,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACtC,CAAC;AAAA,EACD,aAAa,EAAE,OAAO;AAAA,IACpB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,eAAe,EAAE,OAAO,EAAE,IAAI;AAAA,IAC9B,YAAY,EAAE,OAAO;AAAA,IACrB,iBAAiB,EAAE,OAAO;AAAA,EAC5B,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,sBAAsB,EAAE,QAAQ;AAClC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,eAAe,CAAC;AAAA,EAC1F,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,YAAY;AAAA,IAC1F,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,IACnE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,IAC7E,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EACpF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/[id]/run/submissions/route.js

@@ -0,0 +1,109 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { Form, FormVersion } from "../../../../data/entities.js";
+import { checkSubmissionTamper } from "../../../../runner/tamper-check.js";
+import { buildFormsRouteContext, jsonError } from "../../../helpers.js";
+const bodySchema = z.object({
+  formVersionId: z.string().uuid(),
+  answers: z.record(z.string(), z.unknown()),
+  hidden: z.record(z.string(), z.unknown()),
+  endingKey: z.string().nullable(),
+  locale: z.string().min(2)
+});
+const metadata = {
+  POST: { requireAuth: true }
+};
+async function POST(req, context) {
+  const params = await Promise.resolve(context.params);
+  const formId = String(params.id);
+  let payload;
+  try {
+    payload = bodySchema.parse(await req.json());
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Invalid request body.";
+    return NextResponse.json({ error: "INVALID_BODY", message }, { status: 400 });
+  }
+  let scoped;
+  try {
+    scoped = await buildFormsRouteContext(req);
+  } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status });
+    throw error;
+  }
+  const { ctx, organizationId, tenantId } = scoped;
+  if (!organizationId || !tenantId) {
+    return jsonError(400, "forms.errors.organization_required");
+  }
+  const em = ctx.container.resolve("em");
+  const form = await em.findOne(Form, { id: formId, tenantId, organizationId, deletedAt: null });
+  if (!form) {
+    return NextResponse.json({ error: "NOT_FOUND", message: "Form not found." }, { status: 404 });
+  }
+  if (form.status !== "active") {
+    return NextResponse.json({ error: "FORM_INACTIVE", message: "Form is not active." }, { status: 422 });
+  }
+  const formVersion = await em.findOne(FormVersion, {
+    id: payload.formVersionId,
+    organizationId: form.organizationId,
+    tenantId: form.tenantId
+  });
+  if (!formVersion) {
+    return NextResponse.json(
+      { error: "NOT_FOUND", message: "Form version not found." },
+      { status: 404 }
+    );
+  }
+  const result = checkSubmissionTamper({
+    schema: formVersion.schema,
+    answers: payload.answers,
+    hidden: payload.hidden,
+    claimedEndingKey: payload.endingKey,
+    locale: payload.locale
+  });
+  if (!result.ok) {
+    return NextResponse.json(
+      {
+        error: "TAMPER_DETECTED",
+        message: "Claimed ending does not match the evaluator outcome.",
+        details: { reason: result.reason, reachedEndingKey: result.reachedEndingKey ?? null }
+      },
+      { status: 422 }
+    );
+  }
+  return NextResponse.json({
+    accepted: true,
+    reachedEndingKey: result.reachedEndingKey ?? null
+  });
+}
+const responseSchema = z.object({
+  accepted: z.boolean(),
+  reachedEndingKey: z.string().nullable()
+});
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.record(z.string(), z.unknown()).optional()
+});
+const postMethodDoc = {
+  summary: "Submit answers via the in-app runner with tamper validation.",
+  description: "Server-side re-runs the evaluator against the posted answers and asserts the claimed ending is reachable. 422 on mismatch. Authenticated and scoped to the caller's tenant and organization; deprecated in favour of POST /api/forms/public/submissions/:id/submit.",
+  tags: ["Forms Runtime"],
+  responses: [{ status: 200, description: "Submission accepted (validation only \u2014 persistence in phase 1d).", schema: responseSchema }],
+  errors: [
+    { status: 400, description: "Malformed body, or missing tenant/organization context", schema: errorSchema },
+    { status: 401, description: "Unauthenticated", schema: errorSchema },
+    { status: 404, description: "Form or version not found", schema: errorSchema },
+    { status: 422, description: "Form inactive or tamper detected", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "In-app form submission",
+  methods: { POST: postMethodDoc }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/[id]/run/submissions/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/%5Bid%5D/run/submissions/route.ts"],
+  "sourcesContent": ["/**\n * In-app runner \u2014 POST /api/forms/:id/run/submissions.\n *\n * Authenticated and tenant-scoped, for the same reason as the sibling\n * `run/context` route: it is addressed by FORM id rather than by a distribution\n * slug or invitation token, so it carries no capability a tenant deliberately\n * handed out, and served anonymously it let any caller holding a form UUID\n * confirm that form's existence and drive the logic evaluator against another\n * tenant's schema \u2014 outside the CAPTCHA and rate limiter that\n * `/api/forms/public/*` enforces.\n *\n * @deprecated Phase 2d superseded this validation-only stub with the\n * persisting public runtime flow under `/api/forms/public/*`\n * (`POST /api/forms/public/start` \u2192 `PATCH /api/forms/public/submissions/:id`\n * \u2192 `POST /api/forms/public/submissions/:id/submit`). This route is retained as\n * a one-version backward-compatibility bridge per the root deprecation protocol\n * \u2014 it STILL only re-runs the tamper evaluator and returns\n * `{ accepted, reachedEndingKey }` without persisting \u2014 and will be removed in a\n * later release. New clients MUST use the `/api/forms/public/*` flow.\n *\n * Accepts the runner's `{ formVersionId, answers, hidden, endingKey, locale }`\n * payload, re-runs the evaluator against `(answers, hidden)` server-side,\n * and asserts that the claimed ending is the one the evaluator reaches\n * (R-3 tamper-resistance).\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { Form, FormVersion } from '../../../../data/entities'\nimport { checkSubmissionTamper } from '../../../../runner/tamper-check'\nimport { buildFormsRouteContext, jsonError } from '../../../helpers'\n\nconst bodySchema = z.object({\n  formVersionId: z.string().uuid(),\n  answers: z.record(z.string(), z.unknown()),\n  hidden: z.record(z.string(), z.unknown()),\n  endingKey: z.string().nullable(),\n  locale: z.string().min(2),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(\n  req: Request,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const formId = String(params.id)\n\n  let payload: z.infer<typeof bodySchema>\n  try {\n    payload = bodySchema.parse(await req.json())\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Invalid request body.'\n    return NextResponse.json({ error: 'INVALID_BODY', message }, { status: 400 })\n  }\n\n  let scoped: Awaited<ReturnType<typeof buildFormsRouteContext>>\n  try {\n    scoped = await buildFormsRouteContext(req)\n  } catch (error) {\n    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })\n    throw error\n  }\n  const { ctx, organizationId, tenantId } = scoped\n  if (!organizationId || !tenantId) {\n    return jsonError(400, 'forms.errors.organization_required')\n  }\n\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const form = await em.findOne(Form, { id: formId, tenantId, organizationId, deletedAt: null })\n  if (!form) {\n    return NextResponse.json({ error: 'NOT_FOUND', message: 'Form not found.' }, { status: 404 })\n  }\n  if (form.status !== 'active') {\n    return NextResponse.json({ error: 'FORM_INACTIVE', message: 'Form is not active.' }, { status: 422 })\n  }\n  const formVersion = await em.findOne(FormVersion, {\n    id: payload.formVersionId,\n    organizationId: form.organizationId,\n    tenantId: form.tenantId,\n  })\n  if (!formVersion) {\n    return NextResponse.json(\n      { error: 'NOT_FOUND', message: 'Form version not found.' },\n      { status: 404 },\n    )\n  }\n\n  const result = checkSubmissionTamper({\n    schema: formVersion.schema as Record<string, unknown>,\n    answers: payload.answers,\n    hidden: payload.hidden,\n    claimedEndingKey: payload.endingKey,\n    locale: payload.locale,\n  })\n  if (!result.ok) {\n    return NextResponse.json(\n      {\n        error: 'TAMPER_DETECTED',\n        message: 'Claimed ending does not match the evaluator outcome.',\n        details: { reason: result.reason, reachedEndingKey: result.reachedEndingKey ?? null },\n      },\n      { status: 422 },\n    )\n  }\n\n  return NextResponse.json({\n    accepted: true,\n    reachedEndingKey: result.reachedEndingKey ?? null,\n  })\n}\n\nconst responseSchema = z.object({\n  accepted: z.boolean(),\n  reachedEndingKey: z.string().nullable(),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.record(z.string(), z.unknown()).optional(),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Submit answers via the in-app runner with tamper validation.',\n  description: 'Server-side re-runs the evaluator against the posted answers and asserts the claimed ending is reachable. 422 on mismatch. Authenticated and scoped to the caller\\'s tenant and organization; deprecated in favour of POST /api/forms/public/submissions/:id/submit.',\n  tags: ['Forms Runtime'],\n  responses: [{ status: 200, description: 'Submission accepted (validation only \u2014 persistence in phase 1d).', schema: responseSchema }],\n  errors: [\n    { status: 400, description: 'Malformed body, or missing tenant/organization context', schema: errorSchema },\n    { status: 401, description: 'Unauthenticated', schema: errorSchema },\n    { status: 404, description: 'Form or version not found', schema: errorSchema },\n    { status: 422, description: 'Form inactive or tamper detected', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'In-app form submission',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AA0BA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,MAAM,mBAAmB;AAClC,SAAS,6BAA6B;AACtC,SAAS,wBAAwB,iBAAiB;AAElD,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACzC,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,SAAS,OAAO,OAAO,EAAE;AAE/B,MAAI;AACJ,MAAI;AACF,cAAU,WAAW,MAAM,MAAM,IAAI,KAAK,CAAC;AAAA,EAC7C,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,uBAAuB,GAAG;AAAA,EAC3C,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,EAAG,QAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AACzF,UAAM;AAAA,EACR;AACA,QAAM,EAAE,KAAK,gBAAgB,SAAS,IAAI;AAC1C,MAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,WAAO,UAAU,KAAK,oCAAoC;AAAA,EAC5D;AAEA,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,QAAQ,UAAU,gBAAgB,WAAW,KAAK,CAAC;AAC7F,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,aAAa,SAAS,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AACA,MAAI,KAAK,WAAW,UAAU;AAC5B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,SAAS,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtG;AACA,QAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,IAChD,IAAI,QAAQ;AAAA,IACZ,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,EACjB,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,aAAa,SAAS,0BAA0B;AAAA,MACzD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,SAAS,QAAQ;AAAA,IACjB,QAAQ,QAAQ;AAAA,IAChB,kBAAkB,QAAQ;AAAA,IAC1B,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO;AAAA,QACP,SAAS;AAAA,QACT,SAAS,EAAE,QAAQ,OAAO,QAAQ,kBAAkB,OAAO,oBAAoB,KAAK;AAAA,MACtF;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,UAAU;AAAA,IACV,kBAAkB,OAAO,oBAAoB;AAAA,EAC/C,CAAC;AACH;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,QAAQ;AAAA,EACpB,kBAAkB,EAAE,OAAO,EAAE,SAAS;AACxC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AACtD,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,yEAAoE,QAAQ,eAAe,CAAC;AAAA,EACpI,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0DAA0D,QAAQ,YAAY;AAAA,IAC1G,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,IACnE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,IAC7E,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,YAAY;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "names": []
+}

package/dist/modules/forms/api/[id]/submissions/route.js

@@ -0,0 +1,83 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { mapSubmissionError, serializeSubmission } from "../../runtime-helpers.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["forms.view"] }
+};
+const querySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(100).default(25),
+  status: z.enum(["draft", "submitted", "reopened", "archived"]).optional()
+});
+async function GET(req, context) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: "Tenant scope required" }, { status: 403 });
+  }
+  const params = await Promise.resolve(context.params);
+  const formId = String(params.id);
+  const url = new URL(req.url);
+  const parsed = querySchema.safeParse(Object.fromEntries(url.searchParams));
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", details: parsed.error.flatten() },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  try {
+    const result = await service.listSubmissionsByForm({
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      formId,
+      page: parsed.data.page,
+      pageSize: parsed.data.pageSize,
+      status: parsed.data.status
+    });
+    return NextResponse.json({
+      items: result.items.map(serializeSubmission),
+      total: result.total,
+      page: result.page,
+      pageSize: result.pageSize
+    });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const responseSchema = z.object({
+  items: z.array(z.record(z.string(), z.unknown())),
+  total: z.number().int().nonnegative(),
+  page: z.number().int().positive(),
+  pageSize: z.number().int().positive()
+});
+const getMethodDoc = {
+  summary: "List submissions for a form (admin inbox)",
+  description: "Paginated submission listing scoped to the form id.",
+  tags: ["Forms Admin"],
+  responses: [{ status: 200, description: "Submission list", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 422, description: "Bad query parameters", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Form submissions inbox",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/[id]/submissions/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/api/%5Bid%5D/submissions/route.ts"],
+  "sourcesContent": ["/**\n * Admin API \u2014 GET /api/forms/:id/submissions\n *\n * Paginated submissions inbox for a given form. Phase 2a's UI hangs off this\n * route. Staff auth + `forms.view` feature required; the page itself\n * resolves auth via `metadata.requireFeatures`.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { SubmissionService } from '../../../services/submission-service'\nimport { mapSubmissionError, serializeSubmission } from '../../runtime-helpers'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['forms.view'] },\n}\n\nconst querySchema = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(25),\n  status: z.enum(['draft', 'submitted', 'reopened', 'archived']).optional(),\n})\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  if (!auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Tenant scope required' }, { status: 403 })\n  }\n  const params = await Promise.resolve(context.params)\n  const formId = String(params.id)\n\n  const url = new URL(req.url)\n  const parsed = querySchema.safeParse(Object.fromEntries(url.searchParams))\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const result = await service.listSubmissionsByForm({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      formId,\n      page: parsed.data.page,\n      pageSize: parsed.data.pageSize,\n      status: parsed.data.status,\n    })\n    return NextResponse.json({\n      items: result.items.map(serializeSubmission),\n      total: result.total,\n      page: result.page,\n      pageSize: result.pageSize,\n    })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({\n  items: z.array(z.record(z.string(), z.unknown())),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'List submissions for a form (admin inbox)',\n  description: 'Paginated submission listing scoped to the form id.',\n  tags: ['Forms Admin'],\n  responses: [{ status: 200, description: 'Submission list', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 422, description: 'Bad query parameters', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Form submissions inbox',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAQA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB,2BAA2B;AAEjD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,YAAY,EAAE;AAC5D;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAC5D,QAAQ,EAAE,KAAK,CAAC,SAAS,aAAa,YAAY,UAAU,CAAC,EAAE,SAAS;AAC1E,CAAC;AAED,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,SAAS,OAAO,OAAO,EAAE;AAE/B,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,YAAY,UAAU,OAAO,YAAY,IAAI,YAAY,CAAC;AACzE,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,sBAAsB;AAAA,MACjD,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf;AAAA,MACA,MAAM,OAAO,KAAK;AAAA,MAClB,UAAU,OAAO,KAAK;AAAA,MACtB,QAAQ,OAAO,KAAK;AAAA,IACtB,CAAC;AACD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,MAAM,IAAI,mBAAmB;AAAA,MAC3C,OAAO,OAAO;AAAA,MACd,MAAM,OAAO;AAAA,MACb,UAAU,OAAO;AAAA,IACnB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AAAA,EAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACtC,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe,CAAC;AAAA,EACnF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,EAC1E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}