@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/forms/api/helpers.js

@@ -0,0 +1,124 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { createScopedApiHelpers } from "@open-mercato/shared/lib/api/scoped";
+import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+const logger = createLogger("forms").child({ component: "api" });
+const { withScopedPayload } = createScopedApiHelpers({
+  messages: {
+    tenantRequired: { key: "forms.errors.tenant_required", fallback: "Tenant context is required" },
+    organizationRequired: { key: "forms.errors.organization_required", fallback: "Organization context is required" }
+  }
+});
+async function buildFormsRouteContext(req) {
+  const container = await createRequestContainer();
+  const auth = await getAuthFromRequest(req);
+  const { translate } = await resolveTranslations();
+  if (!auth) {
+    throw new CrudHttpError(401, {
+      error: translate("forms.errors.unauthorized", "Unauthorized")
+    });
+  }
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
+  const ctx = {
+    container,
+    auth,
+    organizationScope: scope,
+    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+    request: req
+  };
+  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const tenantId = auth.tenantId ?? null;
+  return { ctx, organizationId, tenantId, translate };
+}
+function jsonError(status, error) {
+  return NextResponse.json({ error }, { status });
+}
+function handleRouteError(scope, error) {
+  if (isCrudHttpError(error)) {
+    return NextResponse.json(error.body, { status: error.status });
+  }
+  const interceptorRejection = getCommandInterceptorHttpRejection(error);
+  if (interceptorRejection) {
+    return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+  }
+  if (error instanceof z.ZodError) {
+    return NextResponse.json({ error: "forms.errors.invalid_payload", details: error.issues }, { status: 400 });
+  }
+  logger.error("forms route failed", { scope, err: error });
+  return NextResponse.json({ error: "forms.errors.internal" }, { status: 500 });
+}
+function attachOperationMetadata(response, logEntry, fallbackResourceKind, fallbackResourceId) {
+  const id = logEntry?.id;
+  const undoToken = logEntry?.undoToken;
+  const commandId = logEntry?.commandId;
+  if (!undoToken || !id || !commandId) return response;
+  response.headers.set(
+    "x-om-operation",
+    serializeOperationMetadata({
+      id,
+      undoToken,
+      commandId,
+      actionLabel: logEntry?.actionLabel ?? null,
+      resourceKind: logEntry?.resourceKind ?? fallbackResourceKind,
+      resourceId: logEntry?.resourceId ?? fallbackResourceId,
+      executedAt: logEntry?.createdAt instanceof Date ? logEntry.createdAt.toISOString() : typeof logEntry?.createdAt === "string" ? logEntry.createdAt : (/* @__PURE__ */ new Date()).toISOString()
+    })
+  );
+  return response;
+}
+async function withMutationGuard(opts) {
+  const userId = opts.ctx.auth?.sub ?? null;
+  if (!userId) {
+    throw new CrudHttpError(401, { error: "forms.errors.unauthorized" });
+  }
+  const validation = await validateCrudMutationGuard(opts.ctx.container, {
+    tenantId: opts.tenantId,
+    organizationId: opts.organizationId,
+    userId,
+    resourceKind: opts.resourceKind,
+    resourceId: opts.resourceId,
+    operation: opts.operation,
+    requestMethod: opts.request.method,
+    requestHeaders: opts.request.headers,
+    mutationPayload: opts.payload ?? null
+  });
+  if (validation && !validation.ok) {
+    throw new CrudHttpError(validation.status ?? 422, validation.body);
+  }
+  const result = await opts.run();
+  if (validation?.ok && validation.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(opts.ctx.container, {
+      tenantId: opts.tenantId,
+      organizationId: opts.organizationId,
+      userId,
+      resourceKind: opts.resourceKind,
+      resourceId: opts.resourceId,
+      operation: opts.operation,
+      requestMethod: opts.request.method,
+      requestHeaders: opts.request.headers,
+      metadata: validation.metadata ?? null
+    });
+  }
+  return result;
+}
+export {
+  attachOperationMetadata,
+  buildFormsRouteContext,
+  handleRouteError,
+  jsonError,
+  withMutationGuard,
+  withScopedPayload
+};
+//# sourceMappingURL=helpers.js.map

package/dist/modules/forms/api/helpers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/api/helpers.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { createScopedApiHelpers } from '@open-mercato/shared/lib/api/scoped'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nconst logger = createLogger('forms').child({ component: 'api' })\n\nconst { withScopedPayload } = createScopedApiHelpers({\n  messages: {\n    tenantRequired: { key: 'forms.errors.tenant_required', fallback: 'Tenant context is required' },\n    organizationRequired: { key: 'forms.errors.organization_required', fallback: 'Organization context is required' },\n  },\n})\n\nexport { withScopedPayload }\n\n/**\n * Build the per-request CommandRuntimeContext used by every forms admin route.\n *\n * Throws `CrudHttpError(401)` when authentication is missing \u2014 translated to\n * `forms.errors.unauthorized` so the client surface stays consistent.\n */\nexport async function buildFormsRouteContext(req: Request): Promise<{\n  ctx: CommandRuntimeContext\n  organizationId: string | null\n  tenantId: string | null\n  translate: (key: string, fallback?: string) => string\n}> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth) {\n    throw new CrudHttpError(401, {\n      error: translate('forms.errors.unauthorized', 'Unauthorized'),\n    })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  const tenantId = auth.tenantId ?? null\n  return { ctx, organizationId, tenantId, translate: translate as (key: string, fallback?: string) => string }\n}\n\nexport function jsonError(status: number, error: string): NextResponse {\n  return NextResponse.json({ error }, { status })\n}\n\nexport function handleRouteError(scope: string, error: unknown): NextResponse {\n  if (isCrudHttpError(error)) {\n    return NextResponse.json(error.body, { status: error.status })\n  }\n  const interceptorRejection = getCommandInterceptorHttpRejection(error)\n  if (interceptorRejection) {\n    return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n  }\n  // Every forms admin route validates its payload with a bare `schema.parse(...)`\n  // inside the try block this catches, so a rejected payload arrives here as a\n  // ZodError. Without this arm it became a 500 while the route's own `openApi`\n  // promised 400 \u2014 a client could not tell its own bad request from a server\n  // fault. Shape matches the CRUD factory and the other core modules that\n  // hand-roll this: `{ error, details: issues }` at 400.\n  if (error instanceof z.ZodError) {\n    return NextResponse.json({ error: 'forms.errors.invalid_payload', details: error.issues }, { status: 400 })\n  }\n  logger.error('forms route failed', { scope, err: error })\n  return NextResponse.json({ error: 'forms.errors.internal' }, { status: 500 })\n}\n\nexport function attachOperationMetadata(\n  response: NextResponse,\n  logEntry: {\n    id?: string | null\n    undoToken?: string | null\n    commandId?: string | null\n    actionLabel?: string | null\n    resourceKind?: string | null\n    resourceId?: string | null\n    createdAt?: Date | string | null\n  } | null | undefined,\n  fallbackResourceKind: string,\n  fallbackResourceId: string | null,\n): NextResponse {\n  const id = logEntry?.id\n  const undoToken = logEntry?.undoToken\n  const commandId = logEntry?.commandId\n  if (!undoToken || !id || !commandId) return response\n  response.headers.set(\n    'x-om-operation',\n    serializeOperationMetadata({\n      id,\n      undoToken,\n      commandId,\n      actionLabel: logEntry?.actionLabel ?? null,\n      resourceKind: logEntry?.resourceKind ?? fallbackResourceKind,\n      resourceId: logEntry?.resourceId ?? fallbackResourceId,\n      executedAt:\n        logEntry?.createdAt instanceof Date\n          ? logEntry.createdAt.toISOString()\n          : typeof logEntry?.createdAt === 'string'\n            ? logEntry.createdAt\n            : new Date().toISOString(),\n    }),\n  )\n  return response\n}\n\n/**\n * Wrap a non-CRUD mutation handler with the legacy mutation-guard contract.\n * The wrapper aborts with the guard's status/body if the guard rejects, and\n * runs the after-success hook when the operation completes.\n */\nexport async function withMutationGuard<TResult>(opts: {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string | null\n  resourceKind: string\n  resourceId: string\n  operation: 'create' | 'update' | 'delete' | 'custom'\n  request: Request\n  payload?: Record<string, unknown> | null\n  run: () => Promise<TResult>\n}): Promise<TResult> {\n  const userId = opts.ctx.auth?.sub ?? null\n  if (!userId) {\n    throw new CrudHttpError(401, { error: 'forms.errors.unauthorized' })\n  }\n  const validation = await validateCrudMutationGuard(opts.ctx.container, {\n    tenantId: opts.tenantId,\n    organizationId: opts.organizationId,\n    userId,\n    resourceKind: opts.resourceKind,\n    resourceId: opts.resourceId,\n    operation: opts.operation,\n    requestMethod: opts.request.method,\n    requestHeaders: opts.request.headers,\n    mutationPayload: opts.payload ?? null,\n  })\n  if (validation && !validation.ok) {\n    throw new CrudHttpError(validation.status ?? 422, validation.body)\n  }\n  const result = await opts.run()\n  if (validation?.ok && validation.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(opts.ctx.container, {\n      tenantId: opts.tenantId,\n      organizationId: opts.organizationId,\n      userId,\n      resourceKind: opts.resourceKind,\n      resourceId: opts.resourceId,\n      operation: opts.operation,\n      requestMethod: opts.request.method,\n      requestHeaders: opts.request.headers,\n      metadata: validation.metadata ?? null,\n    })\n  }\n  return result\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE/D,MAAM,EAAE,kBAAkB,IAAI,uBAAuB;AAAA,EACnD,UAAU;AAAA,IACR,gBAAgB,EAAE,KAAK,gCAAgC,UAAU,6BAA6B;AAAA,IAC9F,sBAAsB,EAAE,KAAK,sCAAsC,UAAU,mCAAmC;AAAA,EAClH;AACF,CAAC;AAUD,eAAsB,uBAAuB,KAK1C;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,MAAM;AACT,UAAM,IAAI,cAAc,KAAK;AAAA,MAC3B,OAAO,UAAU,6BAA6B,cAAc;AAAA,IAC9D,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,OAAO,cAAc,KAAK,SAAS;AAAA,IAC3D,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,QAAM,WAAW,KAAK,YAAY;AAClC,SAAO,EAAE,KAAK,gBAAgB,UAAU,UAAmE;AAC7G;AAEO,SAAS,UAAU,QAAgB,OAA6B;AACrE,SAAO,aAAa,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;AAChD;AAEO,SAAS,iBAAiB,OAAe,OAA8B;AAC5E,MAAI,gBAAgB,KAAK,GAAG;AAC1B,WAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC/D;AACA,QAAM,uBAAuB,mCAAmC,KAAK;AACrE,MAAI,sBAAsB;AACxB,WAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,EAC7F;AAOA,MAAI,iBAAiB,EAAE,UAAU;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,SAAS,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5G;AACA,SAAO,MAAM,sBAAsB,EAAE,OAAO,KAAK,MAAM,CAAC;AACxD,SAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E;AAEO,SAAS,wBACd,UACA,UASA,sBACA,oBACc;AACd,QAAM,KAAK,UAAU;AACrB,QAAM,YAAY,UAAU;AAC5B,QAAM,YAAY,UAAU;AAC5B,MAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAW,QAAO;AAC5C,WAAS,QAAQ;AAAA,IACf;AAAA,IACA,2BAA2B;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,UAAU,eAAe;AAAA,MACtC,cAAc,UAAU,gBAAgB;AAAA,MACxC,YAAY,UAAU,cAAc;AAAA,MACpC,YACE,UAAU,qBAAqB,OAC3B,SAAS,UAAU,YAAY,IAC/B,OAAO,UAAU,cAAc,WAC7B,SAAS,aACT,oBAAI,KAAK,GAAE,YAAY;AAAA,IACjC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAOA,eAAsB,kBAA2B,MAU5B;AACnB,QAAM,SAAS,KAAK,IAAI,MAAM,OAAO;AACrC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,4BAA4B,CAAC;AAAA,EACrE;AACA,QAAM,aAAa,MAAM,0BAA0B,KAAK,IAAI,WAAW;AAAA,IACrE,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA,cAAc,KAAK;AAAA,IACnB,YAAY,KAAK;AAAA,IACjB,WAAW,KAAK;AAAA,IAChB,eAAe,KAAK,QAAQ;AAAA,IAC5B,gBAAgB,KAAK,QAAQ;AAAA,IAC7B,iBAAiB,KAAK,WAAW;AAAA,EACnC,CAAC;AACD,MAAI,cAAc,CAAC,WAAW,IAAI;AAChC,UAAM,IAAI,cAAc,WAAW,UAAU,KAAK,WAAW,IAAI;AAAA,EACnE;AACA,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,MAAI,YAAY,MAAM,WAAW,uBAAuB;AACtD,UAAM,iCAAiC,KAAK,IAAI,WAAW;AAAA,MACzD,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB;AAAA,MACA,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK,QAAQ;AAAA,MAC5B,gBAAgB,KAAK,QAAQ;AAAA,MAC7B,UAAU,WAAW,YAAY;AAAA,IACnC,CAAC;AAAA,EACH;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/api/public/distributions/[slug]/embed-policy/route.js

@@ -0,0 +1,47 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { buildPublicRateLimitKey, enforcePublicRateLimit } from "../../../rate-limit.js";
+const metadata = {
+  GET: { requireAuth: false }
+};
+async function GET(req, context) {
+  const params = await Promise.resolve(context.params);
+  const slug = String(params.slug);
+  const limited = await enforcePublicRateLimit(
+    req,
+    buildPublicRateLimitKey("embed-policy", slug)
+  );
+  if (limited) return limited;
+  const container = await createRequestContainer();
+  const service = container.resolve("formsDistributionService");
+  const { frameAncestors, embeddable } = await service.getEmbedPolicyBySlug(slug);
+  return NextResponse.json(
+    { frame_ancestors: frameAncestors, embeddable },
+    { headers: { "cache-control": "public, max-age=60" } }
+  );
+}
+const responseSchema = z.object({
+  frame_ancestors: z.string(),
+  embeddable: z.boolean()
+});
+const getMethodDoc = {
+  summary: "Resolve the embed framing policy for a distribution",
+  description: "Returns the Content-Security-Policy frame-ancestors directive authorizing which origins may frame the /embed/:slug host page. Fails closed to frame-ancestors none for non-embeddable or unknown distributions.",
+  tags: ["Forms Public Runtime"],
+  responses: [{ status: 200, description: "Embed framing policy", schema: responseSchema }],
+  errors: [
+    { status: 429, description: "Rate limit exceeded" },
+    { status: 503, description: "Rate limiting unavailable" }
+  ]
+};
+const openApi = {
+  summary: "Public distribution embed framing policy",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/public/distributions/[slug]/embed-policy/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/forms/api/public/distributions/%5Bslug%5D/embed-policy/route.ts"],
+  "sourcesContent": ["/**\n * Public runtime API \u2014 GET /api/forms/public/distributions/:slug/embed-policy\n *\n * Returns the `frame-ancestors` CSP directive authorizing which third-party\n * origins may frame the `/embed/:slug` host page (forms render-surfaces spec\n * `2026-05-21-forms-render-surfaces.md`, S4 / D6 / R-RS-1). Unauthenticated by\n * design \u2014 the value it returns is the same allowlist the browser enforces and\n * exposes to the framing site anyway.\n *\n * Fails closed: a non-embeddable / unknown slug yields `frame-ancestors 'none'`.\n *\n * NOTE: this endpoint is currently unconsumed. It is designed to be read\n * server-side by an app-level `/embed` proxy branch that sets the per-request\n * framing header, and that branch does not exist in this repo \u2014 see\n * `frontend/embed/[slug]/page.meta.ts` for why and what it would take. Until it\n * lands, the app's global `frame-ancestors 'self'` blocks cross-origin framing\n * of `/embed/:slug` outright, so the surface is safe but inert.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DistributionService } from '../../../../../services/distribution-service'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../../rate-limit'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { slug: string } | Promise<{ slug: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const slug = String(params.slug)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('embed-policy', slug),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsDistributionService') as DistributionService\n\n  const { frameAncestors, embeddable } = await service.getEmbedPolicyBySlug(slug)\n  return NextResponse.json(\n    { frame_ancestors: frameAncestors, embeddable },\n    { headers: { 'cache-control': 'public, max-age=60' } },\n  )\n}\n\nconst responseSchema = z.object({\n  frame_ancestors: z.string(),\n  embeddable: z.boolean(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Resolve the embed framing policy for a distribution',\n  description:\n    'Returns the Content-Security-Policy frame-ancestors directive authorizing which origins may frame the /embed/:slug host page. Fails closed to frame-ancestors none for non-embeddable or unknown distributions.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 200, description: 'Embed framing policy', schema: responseSchema }],\n  errors: [\n    { status: 429, description: 'Rate limit exceeded' },\n    { status: 503, description: 'Rate limiting unavailable' },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public distribution embed framing policy',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAmBA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AAEvC,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,OAAO,OAAO,OAAO,IAAI;AAE/B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,gBAAgB,IAAI;AAAA,EAC9C;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,0BAA0B;AAE5D,QAAM,EAAE,gBAAgB,WAAW,IAAI,MAAM,QAAQ,qBAAqB,IAAI;AAC9E,SAAO,aAAa;AAAA,IAClB,EAAE,iBAAiB,gBAAgB,WAAW;AAAA,IAC9C,EAAE,SAAS,EAAE,iBAAiB,qBAAqB,EAAE;AAAA,EACvD;AACF;AAEA,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,iBAAiB,EAAE,OAAO;AAAA,EAC1B,YAAY,EAAE,QAAQ;AACxB,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,eAAe,CAAC;AAAA,EACxF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,IAClD,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,EAC1D;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/public/distributions/[slug]/route.js

@@ -0,0 +1,81 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { mapDistributionError, serializeFormContext } from "../../../runtime-helpers.js";
+import { buildPublicRateLimitKey, enforcePublicRateLimit } from "../../rate-limit.js";
+const metadata = {
+  GET: { requireAuth: false }
+};
+async function GET(req, context) {
+  const params = await Promise.resolve(context.params);
+  const slug = String(params.slug);
+  const limited = await enforcePublicRateLimit(
+    req,
+    buildPublicRateLimitKey("distribution-read", slug)
+  );
+  if (limited) return limited;
+  const container = await createRequestContainer();
+  const service = container.resolve("formsDistributionService");
+  try {
+    const { distribution } = await service.resolveBySlug(slug);
+    const formContext = await service.getFormContext({ distribution });
+    return NextResponse.json({
+      distribution_id: distribution.id,
+      ...serializeFormContext({ ...formContext, distribution }),
+      requires_customer_auth: distribution.requireCustomerAuth,
+      default_locale: distribution.defaultLocale
+    });
+  } catch (error) {
+    return mapDistributionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const responseSchema = z.object({
+  distribution_id: z.string().uuid(),
+  form: z.object({
+    key: z.string(),
+    name: z.string(),
+    defaultLocale: z.string(),
+    supportedLocales: z.array(z.string())
+  }),
+  schema: z.record(z.string(), z.unknown()),
+  ui_schema: z.record(z.string(), z.unknown()),
+  fieldIndex: z.record(z.string(), z.unknown()),
+  completion: z.object({
+    title: z.string().nullable(),
+    message: z.string().nullable()
+  }),
+  redirect_url: z.string().nullable(),
+  embed: z.object({
+    theme: z.enum(["light", "dark", "auto"]).nullable(),
+    autoResize: z.boolean()
+  }).nullable(),
+  requires_customer_auth: z.boolean(),
+  default_locale: z.string()
+});
+const getMethodDoc = {
+  summary: "Resolve an open-link distribution",
+  description: "Returns the form context served by an open-mode distribution identified by its public slug.",
+  tags: ["Forms Public Runtime"],
+  responses: [{ status: 200, description: "Distribution form context", schema: responseSchema }],
+  errors: [
+    { status: 404, description: "Distribution or form not found", schema: errorSchema },
+    { status: 410, description: "Distribution closed, not yet open, or response cap reached", schema: errorSchema },
+    { status: 429, description: "Rate limit exceeded", schema: errorSchema },
+    { status: 503, description: "Rate limiting unavailable", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Public open-link distribution context",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/public/distributions/[slug]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/public/distributions/%5Bslug%5D/route.ts"],
+  "sourcesContent": ["/**\n * Public runtime API \u2014 GET /api/forms/public/distributions/:slug\n *\n * Resolves an open-mode distribution by its public slug and returns the served\n * form context (schema / ui schema / field index) plus availability metadata.\n * Unauthenticated by design \u2014 the slug is the bearer of access. A closed,\n * expired, or response-capped distribution propagates a 410 GONE from the\n * DistributionService.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DistributionService } from '../../../../services/distribution-service'\nimport { mapDistributionError, serializeFormContext } from '../../../runtime-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../rate-limit'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { slug: string } | Promise<{ slug: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const slug = String(params.slug)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('distribution-read', slug),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsDistributionService') as DistributionService\n\n  try {\n    const { distribution } = await service.resolveBySlug(slug)\n    const formContext = await service.getFormContext({ distribution })\n    return NextResponse.json({\n      distribution_id: distribution.id,\n      ...serializeFormContext({ ...formContext, distribution }),\n      requires_customer_auth: distribution.requireCustomerAuth,\n      default_locale: distribution.defaultLocale,\n    })\n  } catch (error) {\n    return mapDistributionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({\n  distribution_id: z.string().uuid(),\n  form: z.object({\n    key: z.string(),\n    name: z.string(),\n    defaultLocale: z.string(),\n    supportedLocales: z.array(z.string()),\n  }),\n  schema: z.record(z.string(), z.unknown()),\n  ui_schema: z.record(z.string(), z.unknown()),\n  fieldIndex: z.record(z.string(), z.unknown()),\n  completion: z.object({\n    title: z.string().nullable(),\n    message: z.string().nullable(),\n  }),\n  redirect_url: z.string().nullable(),\n  embed: z\n    .object({\n      theme: z.enum(['light', 'dark', 'auto']).nullable(),\n      autoResize: z.boolean(),\n    })\n    .nullable(),\n  requires_customer_auth: z.boolean(),\n  default_locale: z.string(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Resolve an open-link distribution',\n  description: 'Returns the form context served by an open-mode distribution identified by its public slug.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 200, description: 'Distribution form context', schema: responseSchema }],\n  errors: [\n    { status: 404, description: 'Distribution or form not found', schema: errorSchema },\n    { status: 410, description: 'Distribution closed, not yet open, or response cap reached', schema: errorSchema },\n    { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n    { status: 503, description: 'Rate limiting unavailable', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public open-link distribution context',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAUA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AAEvC,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,OAAO,OAAO,OAAO,IAAI;AAE/B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,qBAAqB,IAAI;AAAA,EACnD;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,0BAA0B;AAE5D,MAAI;AACF,UAAM,EAAE,aAAa,IAAI,MAAM,QAAQ,cAAc,IAAI;AACzD,UAAM,cAAc,MAAM,QAAQ,eAAe,EAAE,aAAa,CAAC;AACjE,WAAO,aAAa,KAAK;AAAA,MACvB,iBAAiB,aAAa;AAAA,MAC9B,GAAG,qBAAqB,EAAE,GAAG,aAAa,aAAa,CAAC;AAAA,MACxD,wBAAwB,aAAa;AAAA,MACrC,gBAAgB,aAAa;AAAA,IAC/B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,qBAAqB,KAAK;AAAA,EACnC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,MAAM,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,eAAe,EAAE,OAAO;AAAA,IACxB,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACtC,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC;AAAA,EACD,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,OAAO,EACJ,OAAO;AAAA,IACN,OAAO,EAAE,KAAK,CAAC,SAAS,QAAQ,MAAM,CAAC,EAAE,SAAS;AAAA,IAClD,YAAY,EAAE,QAAQ;AAAA,EACxB,CAAC,EACA,SAAS;AAAA,EACZ,wBAAwB,EAAE,QAAQ;AAAA,EAClC,gBAAgB,EAAE,OAAO;AAC3B,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,eAAe,CAAC;AAAA,EAC7F,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,YAAY;AAAA,IAClF,EAAE,QAAQ,KAAK,aAAa,8DAA8D,QAAQ,YAAY;AAAA,IAC9G,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/public/embed-loader/route.js

@@ -0,0 +1,116 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+const metadata = {
+  GET: { requireAuth: false }
+};
+const MAX_IFRAME_HEIGHT = 2e4;
+const MIN_IFRAME_HEIGHT = 150;
+const LOADER_SCRIPT = `(function () {
+  "use strict";
+  var current = document.currentScript;
+  if (!current || !current.src) return;
+  var origin;
+  try { origin = new URL(current.src).origin; } catch (e) { return; }
+
+  var MAX_HEIGHT = ${MAX_IFRAME_HEIGHT};
+  var MIN_HEIGHT = ${MIN_IFRAME_HEIGHT};
+  var TYPE_PREFIX = "om-forms:";
+  var frames = {};
+
+  function clamp(value) {
+    if (typeof value !== "number" || isNaN(value)) return MIN_HEIGHT;
+    if (value < MIN_HEIGHT) return MIN_HEIGHT;
+    if (value > MAX_HEIGHT) return MAX_HEIGHT;
+    return Math.ceil(value);
+  }
+
+  function mount(el) {
+    if (el.getAttribute("data-om-form-mounted") === "1") return;
+    var slug = el.getAttribute("data-om-form");
+    if (!slug) return;
+    el.setAttribute("data-om-form-mounted", "1");
+
+    var iframe = document.createElement("iframe");
+    iframe.src = origin + "/embed/" + encodeURIComponent(slug);
+    iframe.title = el.getAttribute("data-om-form-title") || "Form";
+    iframe.setAttribute("loading", "lazy");
+    iframe.style.width = "100%";
+    iframe.style.border = "0";
+    iframe.style.height = MIN_HEIGHT + "px";
+    iframe.style.display = "block";
+    el.appendChild(iframe);
+    frames[slug] = iframe;
+  }
+
+  function mountAll() {
+    var nodes = document.querySelectorAll("[data-om-form]");
+    for (var i = 0; i < nodes.length; i++) mount(nodes[i]);
+  }
+
+  var pending = null;
+  function onMessage(event) {
+    if (event.origin !== origin) return;
+    var data = event.data;
+    if (!data || typeof data.type !== "string") return;
+    if (data.type.indexOf(TYPE_PREFIX) !== 0) return;
+    if (data.type !== TYPE_PREFIX + "resize") return;
+    if (event.source == null) return;
+
+    var target = null;
+    for (var slug in frames) {
+      if (frames.hasOwnProperty(slug) && frames[slug].contentWindow === event.source) {
+        target = frames[slug];
+        break;
+      }
+    }
+    if (!target) return;
+
+    var height = clamp(data.height);
+    if (pending) return;
+    pending = (window.requestAnimationFrame || window.setTimeout)(function () {
+      pending = null;
+      target.style.height = height + "px";
+    }, 16);
+  }
+
+  window.addEventListener("message", onMessage, false);
+
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", mountAll, false);
+  } else {
+    mountAll();
+  }
+})();
+`;
+async function GET() {
+  return new NextResponse(LOADER_SCRIPT, {
+    status: 200,
+    headers: {
+      "content-type": "application/javascript; charset=utf-8",
+      "cache-control": "public, max-age=300",
+      "x-content-type-options": "nosniff"
+    }
+  });
+}
+const getMethodDoc = {
+  summary: "Serve the external embed loader script",
+  description: "Returns a framework-free JS loader that injects an iframe per [data-om-form] element pointing at /embed/:slug and wires postMessage auto-resize.",
+  tags: ["Forms Public Runtime"],
+  responses: [
+    {
+      status: 200,
+      description: "The embed loader script (application/javascript)",
+      schema: z.string()
+    }
+  ]
+};
+const openApi = {
+  summary: "Forms external embed loader script",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/public/embed-loader/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/api/public/embed-loader/route.ts"],
+  "sourcesContent": ["/**\n * Public embed loader \u2014 GET /api/forms/public/embed-loader\n *\n * Serves a tiny, framework-free ES5 IIFE that a third-party site drops in via\n * `<script src=\".../api/forms/public/embed-loader\"></script>`. The loader:\n *   - finds every `[data-om-form=\"SLUG\"]` placeholder element,\n *   - reads its OWN script origin (the OM app origin it loaded from),\n *   - injects an `<iframe src=\"<origin>/embed/SLUG\">`,\n *   - listens for `message` events and accepts ONLY messages whose\n *     `event.origin` equals the script origin AND whose `type` starts with\n *     `om-forms:` (R-RS-4),\n *   - resizes the matching iframe on `om-forms:resize` \u2014 debounced via\n *     `requestAnimationFrame` and clamped to a max height (R-RS-5).\n *\n * Unauthenticated by design (the script is public). No secrets, no PII.\n * Spec: `2026-05-21-forms-render-surfaces.md` (S4 / D4).\n */\n\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nconst MAX_IFRAME_HEIGHT = 20000\nconst MIN_IFRAME_HEIGHT = 150\n\nconst LOADER_SCRIPT = `(function () {\n  \"use strict\";\n  var current = document.currentScript;\n  if (!current || !current.src) return;\n  var origin;\n  try { origin = new URL(current.src).origin; } catch (e) { return; }\n\n  var MAX_HEIGHT = ${MAX_IFRAME_HEIGHT};\n  var MIN_HEIGHT = ${MIN_IFRAME_HEIGHT};\n  var TYPE_PREFIX = \"om-forms:\";\n  var frames = {};\n\n  function clamp(value) {\n    if (typeof value !== \"number\" || isNaN(value)) return MIN_HEIGHT;\n    if (value < MIN_HEIGHT) return MIN_HEIGHT;\n    if (value > MAX_HEIGHT) return MAX_HEIGHT;\n    return Math.ceil(value);\n  }\n\n  function mount(el) {\n    if (el.getAttribute(\"data-om-form-mounted\") === \"1\") return;\n    var slug = el.getAttribute(\"data-om-form\");\n    if (!slug) return;\n    el.setAttribute(\"data-om-form-mounted\", \"1\");\n\n    var iframe = document.createElement(\"iframe\");\n    iframe.src = origin + \"/embed/\" + encodeURIComponent(slug);\n    iframe.title = el.getAttribute(\"data-om-form-title\") || \"Form\";\n    iframe.setAttribute(\"loading\", \"lazy\");\n    iframe.style.width = \"100%\";\n    iframe.style.border = \"0\";\n    iframe.style.height = MIN_HEIGHT + \"px\";\n    iframe.style.display = \"block\";\n    el.appendChild(iframe);\n    frames[slug] = iframe;\n  }\n\n  function mountAll() {\n    var nodes = document.querySelectorAll(\"[data-om-form]\");\n    for (var i = 0; i < nodes.length; i++) mount(nodes[i]);\n  }\n\n  var pending = null;\n  function onMessage(event) {\n    if (event.origin !== origin) return;\n    var data = event.data;\n    if (!data || typeof data.type !== \"string\") return;\n    if (data.type.indexOf(TYPE_PREFIX) !== 0) return;\n    if (data.type !== TYPE_PREFIX + \"resize\") return;\n    if (event.source == null) return;\n\n    var target = null;\n    for (var slug in frames) {\n      if (frames.hasOwnProperty(slug) && frames[slug].contentWindow === event.source) {\n        target = frames[slug];\n        break;\n      }\n    }\n    if (!target) return;\n\n    var height = clamp(data.height);\n    if (pending) return;\n    pending = (window.requestAnimationFrame || window.setTimeout)(function () {\n      pending = null;\n      target.style.height = height + \"px\";\n    }, 16);\n  }\n\n  window.addEventListener(\"message\", onMessage, false);\n\n  if (document.readyState === \"loading\") {\n    document.addEventListener(\"DOMContentLoaded\", mountAll, false);\n  } else {\n    mountAll();\n  }\n})();\n`\n\nexport async function GET() {\n  return new NextResponse(LOADER_SCRIPT, {\n    status: 200,\n    headers: {\n      'content-type': 'application/javascript; charset=utf-8',\n      'cache-control': 'public, max-age=300',\n      'x-content-type-options': 'nosniff',\n    },\n  })\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Serve the external embed loader script',\n  description:\n    'Returns a framework-free JS loader that injects an iframe per [data-om-form] element pointing at /embed/:slug and wires postMessage auto-resize.',\n  tags: ['Forms Public Runtime'],\n  responses: [\n    {\n      status: 200,\n      description: 'The embed loader script (application/javascript)',\n      schema: z.string(),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Forms external embed loader script',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAkBA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;AAE1B,MAAM,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAOD,iBAAiB;AAAA,qBACjB,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAsEtC,eAAsB,MAAM;AAC1B,SAAO,IAAI,aAAa,eAAe;AAAA,IACrC,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,0BAA0B;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aACE;AAAA,EACF,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO;AAAA,IACnB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/public/invitations/[token]/route.js

@@ -0,0 +1,87 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { mapDistributionError, serializeFormContext } from "../../../runtime-helpers.js";
+import { buildPublicRateLimitKey, enforcePublicRateLimit } from "../../rate-limit.js";
+const metadata = {
+  GET: { requireAuth: false }
+};
+async function GET(req, context) {
+  const params = await Promise.resolve(context.params);
+  const token = String(params.token);
+  const limited = await enforcePublicRateLimit(
+    req,
+    buildPublicRateLimitKey("invitation-read", token)
+  );
+  if (limited) return limited;
+  const container = await createRequestContainer();
+  const service = container.resolve("formsDistributionService");
+  try {
+    const { invitation, distribution } = await service.resolveByToken(token);
+    const formContext = await service.getFormContext({ distribution });
+    return NextResponse.json({
+      distribution_id: distribution.id,
+      ...serializeFormContext({ ...formContext, distribution }),
+      requires_customer_auth: distribution.requireCustomerAuth,
+      default_locale: distribution.defaultLocale,
+      invitation: {
+        id: invitation.id,
+        status: invitation.status,
+        locale: invitation.locale ?? null
+      }
+    });
+  } catch (error) {
+    return mapDistributionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const responseSchema = z.object({
+  distribution_id: z.string().uuid(),
+  form: z.object({
+    key: z.string(),
+    name: z.string(),
+    defaultLocale: z.string(),
+    supportedLocales: z.array(z.string())
+  }),
+  schema: z.record(z.string(), z.unknown()),
+  ui_schema: z.record(z.string(), z.unknown()),
+  fieldIndex: z.record(z.string(), z.unknown()),
+  completion: z.object({
+    title: z.string().nullable(),
+    message: z.string().nullable()
+  }),
+  redirect_url: z.string().nullable(),
+  requires_customer_auth: z.boolean(),
+  default_locale: z.string(),
+  invitation: z.object({
+    id: z.string().uuid(),
+    status: z.string(),
+    locale: z.string().nullable()
+  })
+});
+const getMethodDoc = {
+  summary: "Resolve a personal invitation",
+  description: "Returns the form context for a personal-mode invitation identified by its raw token, marking the invitation opened.",
+  tags: ["Forms Public Runtime"],
+  responses: [{ status: 200, description: "Invitation form context", schema: responseSchema }],
+  errors: [
+    { status: 404, description: "Invitation, distribution, or form not found", schema: errorSchema },
+    { status: 410, description: "Invitation submitted, expired, or revoked; distribution unavailable", schema: errorSchema },
+    { status: 429, description: "Rate limit exceeded", schema: errorSchema },
+    { status: 503, description: "Rate limiting unavailable", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Public personal-invitation context",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/public/invitations/[token]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/public/invitations/%5Btoken%5D/route.ts"],
+  "sourcesContent": ["/**\n * Public runtime API \u2014 GET /api/forms/public/invitations/:token\n *\n * Resolves a personal-mode invitation by its raw token, marking it `opened`\n * on first resolve, and returns the served form context plus a lightweight,\n * PII-free invitation descriptor. A submitted / expired / revoked invitation\n * propagates a 410 GONE from the DistributionService.\n *\n * Recipient PII (`recipient_email` / `recipient_name`) is deliberately NOT\n * echoed in the response (R-2d-3).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DistributionService } from '../../../../services/distribution-service'\nimport { mapDistributionError, serializeFormContext } from '../../../runtime-helpers'\nimport { buildPublicRateLimitKey, enforcePublicRateLimit } from '../../rate-limit'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { token: string } | Promise<{ token: string }> },\n) {\n  const params = await Promise.resolve(context.params)\n  const token = String(params.token)\n\n  const limited = await enforcePublicRateLimit(\n    req,\n    buildPublicRateLimitKey('invitation-read', token),\n  )\n  if (limited) return limited\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsDistributionService') as DistributionService\n\n  try {\n    const { invitation, distribution } = await service.resolveByToken(token)\n    const formContext = await service.getFormContext({ distribution })\n    return NextResponse.json({\n      distribution_id: distribution.id,\n      ...serializeFormContext({ ...formContext, distribution }),\n      requires_customer_auth: distribution.requireCustomerAuth,\n      default_locale: distribution.defaultLocale,\n      invitation: {\n        id: invitation.id,\n        status: invitation.status,\n        locale: invitation.locale ?? null,\n      },\n    })\n  } catch (error) {\n    return mapDistributionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({\n  distribution_id: z.string().uuid(),\n  form: z.object({\n    key: z.string(),\n    name: z.string(),\n    defaultLocale: z.string(),\n    supportedLocales: z.array(z.string()),\n  }),\n  schema: z.record(z.string(), z.unknown()),\n  ui_schema: z.record(z.string(), z.unknown()),\n  fieldIndex: z.record(z.string(), z.unknown()),\n  completion: z.object({\n    title: z.string().nullable(),\n    message: z.string().nullable(),\n  }),\n  redirect_url: z.string().nullable(),\n  requires_customer_auth: z.boolean(),\n  default_locale: z.string(),\n  invitation: z.object({\n    id: z.string().uuid(),\n    status: z.string(),\n    locale: z.string().nullable(),\n  }),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Resolve a personal invitation',\n  description: 'Returns the form context for a personal-mode invitation identified by its raw token, marking the invitation opened.',\n  tags: ['Forms Public Runtime'],\n  responses: [{ status: 200, description: 'Invitation form context', schema: responseSchema }],\n  errors: [\n    { status: 404, description: 'Invitation, distribution, or form not found', schema: errorSchema },\n    { status: 410, description: 'Invitation submitted, expired, or revoked; distribution unavailable', schema: errorSchema },\n    { status: 429, description: 'Rate limit exceeded', schema: errorSchema },\n    { status: 503, description: 'Rate limiting unavailable', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Public personal-invitation context',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAYA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AAEvC,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,yBAAyB,8BAA8B;AAEzD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,QAAQ,OAAO,OAAO,KAAK;AAEjC,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA,wBAAwB,mBAAmB,KAAK;AAAA,EAClD;AACA,MAAI,QAAS,QAAO;AAEpB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,0BAA0B;AAE5D,MAAI;AACF,UAAM,EAAE,YAAY,aAAa,IAAI,MAAM,QAAQ,eAAe,KAAK;AACvE,UAAM,cAAc,MAAM,QAAQ,eAAe,EAAE,aAAa,CAAC;AACjE,WAAO,aAAa,KAAK;AAAA,MACvB,iBAAiB,aAAa;AAAA,MAC9B,GAAG,qBAAqB,EAAE,GAAG,aAAa,aAAa,CAAC;AAAA,MACxD,wBAAwB,aAAa;AAAA,MACrC,gBAAgB,aAAa;AAAA,MAC7B,YAAY;AAAA,QACV,IAAI,WAAW;AAAA,QACf,QAAQ,WAAW;AAAA,QACnB,QAAQ,WAAW,UAAU;AAAA,MAC/B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,qBAAqB,KAAK;AAAA,EACnC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,MAAM,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO;AAAA,IACf,eAAe,EAAE,OAAO;AAAA,IACxB,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACtC,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,YAAY,EAAE,OAAO;AAAA,IACnB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC3B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC;AAAA,EACD,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,wBAAwB,EAAE,QAAQ;AAAA,EAClC,gBAAgB,EAAE,OAAO;AAAA,EACzB,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,QAAQ,EAAE,OAAO;AAAA,IACjB,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,CAAC;AACH,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,sBAAsB;AAAA,EAC7B,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,eAAe,CAAC;AAAA,EAC3F,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,uEAAuE,QAAQ,YAAY;AAAA,IACvH,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/public/rate-limit.js

@@ -0,0 +1,54 @@
+import { createHash } from "node:crypto";
+import { NextResponse } from "next/server";
+import { getCachedRateLimiterService } from "@open-mercato/core/bootstrap";
+import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
+import {
+  getClientIp,
+  RATE_LIMIT_ERROR_FALLBACK
+} from "@open-mercato/shared/lib/ratelimit/helpers";
+const PUBLIC_POINTS = Number.parseInt(process.env.FORMS_PUBLIC_RATE_LIMIT_PER_MIN ?? "", 10);
+const publicRateLimitConfig = readEndpointRateLimitConfig("FORMS_PUBLIC", {
+  points: Number.isFinite(PUBLIC_POINTS) && PUBLIC_POINTS > 0 ? PUBLIC_POINTS : 30,
+  duration: 60,
+  blockDuration: 60,
+  keyPrefix: "forms-public"
+});
+function unavailableResponse() {
+  return NextResponse.json(
+    { error: "RATE_LIMIT_UNAVAILABLE" },
+    { status: 503 }
+  );
+}
+function buildPublicRateLimitKey(namespace, ...identifiers) {
+  const digest = createHash("sha256").update(identifiers.join("\0")).digest("base64url").slice(0, 32);
+  return `${namespace}:${digest}`;
+}
+function getPublicClientIp(req) {
+  const limiter = getCachedRateLimiterService();
+  if (!limiter) return void 0;
+  return getClientIp(req, limiter.trustProxyDepth) ?? void 0;
+}
+async function enforcePublicRateLimit(req, resourceKey) {
+  const limiter = getCachedRateLimiterService();
+  if (!limiter) return unavailableResponse();
+  const clientIp = getClientIp(req, limiter.trustProxyDepth);
+  const key = clientIp ? `${resourceKey}:client:${clientIp}` : `${resourceKey}:resource`;
+  try {
+    const result = await limiter.consume(key, publicRateLimitConfig);
+    if ("degraded" in result && result.degraded === true) return unavailableResponse();
+    if (result.allowed) return null;
+    const retryAfter = Math.ceil((result.msBeforeNext ?? 0) / 1e3);
+    return NextResponse.json(
+      { error: "RATE_LIMITED", message: RATE_LIMIT_ERROR_FALLBACK, details: { retryAfterSeconds: retryAfter } },
+      { status: 429, headers: { "Retry-After": String(retryAfter) } }
+    );
+  } catch {
+    return unavailableResponse();
+  }
+}
+export {
+  buildPublicRateLimitKey,
+  enforcePublicRateLimit,
+  getPublicClientIp
+};
+//# sourceMappingURL=rate-limit.js.map

package/dist/modules/forms/api/public/rate-limit.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/forms/api/public/rate-limit.ts"],
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport { NextResponse } from 'next/server'\nimport { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport {\n  getClientIp,\n  RATE_LIMIT_ERROR_FALLBACK,\n} from '@open-mercato/shared/lib/ratelimit/helpers'\n\nconst PUBLIC_POINTS = Number.parseInt(process.env.FORMS_PUBLIC_RATE_LIMIT_PER_MIN ?? '', 10)\n\nconst publicRateLimitConfig = readEndpointRateLimitConfig('FORMS_PUBLIC', {\n  points: Number.isFinite(PUBLIC_POINTS) && PUBLIC_POINTS > 0 ? PUBLIC_POINTS : 30,\n  duration: 60,\n  blockDuration: 60,\n  keyPrefix: 'forms-public',\n})\n\nfunction unavailableResponse(): NextResponse {\n  return NextResponse.json(\n    { error: 'RATE_LIMIT_UNAVAILABLE' },\n    { status: 503 },\n  )\n}\n\nexport function buildPublicRateLimitKey(namespace: string, ...identifiers: string[]): string {\n  const digest = createHash('sha256')\n    .update(identifiers.join('\\0'))\n    .digest('base64url')\n    .slice(0, 32)\n  return `${namespace}:${digest}`\n}\n\nexport function getPublicClientIp(req: Request): string | undefined {\n  const limiter = getCachedRateLimiterService()\n  if (!limiter) return undefined\n  return getClientIp(req, limiter.trustProxyDepth) ?? undefined\n}\n\n/**\n * Applies the shared process/Redis-backed limiter to a public Forms resource.\n * Proxy headers are trusted only at the globally configured proxy depth. When\n * no trusted client address is available, the caller-supplied resource digest\n * remains the bucket key instead of collapsing all respondents into one global\n * bucket. An absent, degraded, or throwing limiter fails closed.\n */\nexport async function enforcePublicRateLimit(\n  req: Request,\n  resourceKey: string,\n): Promise<NextResponse | null> {\n  const limiter = getCachedRateLimiterService()\n  if (!limiter) return unavailableResponse()\n\n  const clientIp = getClientIp(req, limiter.trustProxyDepth)\n  const key = clientIp ? `${resourceKey}:client:${clientIp}` : `${resourceKey}:resource`\n\n  try {\n    const result = await limiter.consume(key, publicRateLimitConfig)\n    if ('degraded' in result && result.degraded === true) return unavailableResponse()\n    if (result.allowed) return null\n    const retryAfter = Math.ceil((result.msBeforeNext ?? 0) / 1000)\n    return NextResponse.json(\n      { error: 'RATE_LIMITED', message: RATE_LIMIT_ERROR_FALLBACK, details: { retryAfterSeconds: retryAfter } },\n      { status: 429, headers: { 'Retry-After': String(retryAfter) } },\n    )\n  } catch {\n    return unavailableResponse()\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAC7B,SAAS,mCAAmC;AAC5C,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,gBAAgB,OAAO,SAAS,QAAQ,IAAI,mCAAmC,IAAI,EAAE;AAE3F,MAAM,wBAAwB,4BAA4B,gBAAgB;AAAA,EACxE,QAAQ,OAAO,SAAS,aAAa,KAAK,gBAAgB,IAAI,gBAAgB;AAAA,EAC9E,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AACb,CAAC;AAED,SAAS,sBAAoC;AAC3C,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,yBAAyB;AAAA,IAClC,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,SAAS,wBAAwB,cAAsB,aAA+B;AAC3F,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,YAAY,KAAK,IAAI,CAAC,EAC7B,OAAO,WAAW,EAClB,MAAM,GAAG,EAAE;AACd,SAAO,GAAG,SAAS,IAAI,MAAM;AAC/B;AAEO,SAAS,kBAAkB,KAAkC;AAClE,QAAM,UAAU,4BAA4B;AAC5C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,YAAY,KAAK,QAAQ,eAAe,KAAK;AACtD;AASA,eAAsB,uBACpB,KACA,aAC8B;AAC9B,QAAM,UAAU,4BAA4B;AAC5C,MAAI,CAAC,QAAS,QAAO,oBAAoB;AAEzC,QAAM,WAAW,YAAY,KAAK,QAAQ,eAAe;AACzD,QAAM,MAAM,WAAW,GAAG,WAAW,WAAW,QAAQ,KAAK,GAAG,WAAW;AAE3E,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK,qBAAqB;AAC/D,QAAI,cAAc,UAAU,OAAO,aAAa,KAAM,QAAO,oBAAoB;AACjF,QAAI,OAAO,QAAS,QAAO;AAC3B,UAAM,aAAa,KAAK,MAAM,OAAO,gBAAgB,KAAK,GAAI;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,gBAAgB,SAAS,2BAA2B,SAAS,EAAE,mBAAmB,WAAW,EAAE;AAAA,MACxG,EAAE,QAAQ,KAAK,SAAS,EAAE,eAAe,OAAO,UAAU,EAAE,EAAE;AAAA,IAChE;AAAA,EACF,QAAQ;AACN,WAAO,oBAAoB;AAAA,EAC7B;AACF;",
+  "names": []
+}