@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/forms/services/anonymize-service.js

@@ -0,0 +1,123 @@
+var _a, _b;
+import {
+  FormAttachment,
+  FormInvitation,
+  FormSubmission,
+  FormSubmissionRevision,
+  FormVersion
+} from "../data/entities.js";
+const ANONYMIZED_TOKEN = "__anonymized__";
+const ANONYMIZE_SERVICE_ERROR_MARKER = /* @__PURE__ */ Symbol.for("@open-mercato/forms/AnonymizeServiceError");
+class AnonymizeServiceError extends (_b = Error, _a = ANONYMIZE_SERVICE_ERROR_MARKER, _b) {
+  constructor(code, message) {
+    super(message);
+    this[_a] = true;
+    this.code = code;
+    this.name = "AnonymizeServiceError";
+  }
+}
+class AnonymizeService {
+  constructor(options) {
+    this.options = options;
+  }
+  async anonymize(submissionId, scope) {
+    const em = this.options.em;
+    const submission = await em.findOne(FormSubmission, {
+      id: submissionId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId
+    });
+    if (!submission) {
+      throw new AnonymizeServiceError("SUBMISSION_NOT_FOUND", "Submission not found.");
+    }
+    const revisions = await em.find(
+      FormSubmissionRevision,
+      { submissionId: submission.id },
+      { orderBy: { revisionNumber: "asc" } }
+    );
+    const attachments = await em.find(FormAttachment, {
+      submissionId: submission.id,
+      organizationId: submission.organizationId
+    });
+    const invitations = await em.find(FormInvitation, {
+      submissionId: submission.id,
+      organizationId: scope.organizationId,
+      tenantId: scope.tenantId
+    });
+    const pendingRevisions = revisions.filter((revision) => !revision.anonymizedAt);
+    let compiled = null;
+    if (pendingRevisions.length > 0) {
+      const formVersion = await em.findOne(FormVersion, {
+        id: submission.formVersionId,
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId
+      });
+      if (!formVersion) {
+        throw new AnonymizeServiceError("FORM_VERSION_NOT_FOUND", "Form version not found.");
+      }
+      compiled = this.options.compiler.compile({
+        id: formVersion.id,
+        updatedAt: formVersion.updatedAt,
+        schema: formVersion.schema,
+        uiSchema: formVersion.uiSchema
+      });
+    }
+    let anonymizedCount = 0;
+    const now = submission.anonymizedAt ?? /* @__PURE__ */ new Date();
+    for (const revision of pendingRevisions) {
+      const plaintext = await this.options.encryption.decrypt(submission.organizationId, revision.data);
+      const decoded = JSON.parse(plaintext.toString("utf-8"));
+      const tombstoned = applyTombstone(decoded, compiled);
+      const buffer = Buffer.from(JSON.stringify(tombstoned), "utf-8");
+      const reencrypted = await this.options.encryption.encrypt(submission.organizationId, buffer);
+      revision.data = reencrypted;
+      revision.anonymizedAt = now;
+      anonymizedCount += 1;
+    }
+    for (const attachment of attachments) {
+      attachment.removedAt = attachment.removedAt ?? now;
+      attachment.payloadInline = null;
+      attachment.fileId = null;
+      attachment.contentType = null;
+      attachment.filename = null;
+      attachment.sizeBytes = null;
+      attachment.uploadedBy = null;
+    }
+    for (const invitation of invitations) {
+      invitation.recipientEmail = null;
+      invitation.recipientName = null;
+      invitation.recipientRef = null;
+    }
+    submission.anonymizedAt = now;
+    submission.pdfSnapshotAttachmentId = null;
+    submission.submitMetadata = {
+      anonymized_at: now.toISOString()
+    };
+    await em.flush();
+    return {
+      revisionsAnonymized: anonymizedCount,
+      submissionAnonymizedAt: now
+    };
+  }
+}
+function applyTombstone(decoded, compiled) {
+  const result = { ...decoded };
+  for (const [key, descriptor] of Object.entries(compiled.fieldIndex)) {
+    if (!descriptor.sensitive) continue;
+    if (Object.prototype.hasOwnProperty.call(result, key)) {
+      result[key] = ANONYMIZED_TOKEN;
+    }
+  }
+  return result;
+}
+const ANONYMIZED_FIELD_TOKEN = ANONYMIZED_TOKEN;
+function isAnonymizeServiceError(error) {
+  return typeof error === "object" && error !== null && ANONYMIZE_SERVICE_ERROR_MARKER in error;
+}
+export {
+  ANONYMIZED_FIELD_TOKEN,
+  AnonymizeService,
+  AnonymizeServiceError,
+  isAnonymizeServiceError
+};
+//# sourceMappingURL=anonymize-service.js.map

package/dist/modules/forms/services/anonymize-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/anonymize-service.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  FormAttachment,\n  FormInvitation,\n  FormSubmission,\n  FormSubmissionRevision,\n  FormVersion,\n} from '../data/entities'\nimport type { EncryptionService } from './encryption-service'\nimport type { CompiledFormVersion } from './form-version-compiler'\nimport type { FormVersionCompiler } from './form-version-compiler'\n\nconst ANONYMIZED_TOKEN = '__anonymized__'\n\n/**\n * `Symbol.for` so the brand survives module duplication across bundle\n * boundaries. `instanceof` does NOT: Next can load this module in more than\n * one chunk, and once a second copy of the class exists an error thrown\n * through one copy fails `instanceof` against the other \u2014 silently\n * downgrading a mapped domain error to a 500. Mirrors `CrudHttpError`.\n */\nconst ANONYMIZE_SERVICE_ERROR_MARKER = Symbol.for('@open-mercato/forms/AnonymizeServiceError')\n\nexport class AnonymizeServiceError extends Error {\n  readonly [ANONYMIZE_SERVICE_ERROR_MARKER] = true\n  readonly code: string\n  constructor(code: string, message: string) {\n    super(message)\n    this.code = code\n    this.name = 'AnonymizeServiceError'\n  }\n}\n\nexport type AnonymizeServiceOptions = {\n  em: EntityManager\n  compiler: FormVersionCompiler\n  encryption: EncryptionService\n}\n\n/**\n * Tenant/organization the caller is acting within. Required, not optional: this\n * operation is irreversible, so every call site must state its scope and the\n * compiler must reject any that does not.\n */\nexport type AnonymizeScope = {\n  tenantId: string\n  organizationId: string\n}\n\n/**\n * Phase 2b \u2014 `submission.anonymize` flow.\n *\n * Walks every revision of a submission, decrypts the payload, replaces the\n * value of any field flagged `x-om-sensitive: true` (per the pinned form\n * version's compiled `fieldIndex`) with a tombstone token, re-encrypts the\n * record, and stamps `anonymized_at`. Clears `submit_metadata` IP/UA on the\n * parent submission and stamps `anonymized_at` on the parent.\n *\n * Idempotency: revisions with `anonymized_at` set are skipped. Re-running\n * the command is safe \u2014 it only continues from where the previous run left\n * off.\n *\n * Irreversible per spec \u2014 the command surface forbids undo.\n */\nexport class AnonymizeService {\n  constructor(private readonly options: AnonymizeServiceOptions) {}\n\n  async anonymize(submissionId: string, scope: AnonymizeScope): Promise<{\n    revisionsAnonymized: number\n    submissionAnonymizedAt: Date\n  }> {\n    const em = this.options.em\n    const submission = await em.findOne(FormSubmission, {\n      id: submissionId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    })\n    if (!submission) {\n      throw new AnonymizeServiceError('SUBMISSION_NOT_FOUND', 'Submission not found.')\n    }\n    const revisions = await em.find(\n      FormSubmissionRevision,\n      { submissionId: submission.id },\n      { orderBy: { revisionNumber: 'asc' } },\n    )\n    const attachments = await em.find(FormAttachment, {\n      submissionId: submission.id,\n      organizationId: submission.organizationId,\n    })\n    const invitations = await em.find(FormInvitation, {\n      submissionId: submission.id,\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n    })\n\n    const pendingRevisions = revisions.filter((revision) => !revision.anonymizedAt)\n    let compiled: CompiledFormVersion | null = null\n    if (pendingRevisions.length > 0) {\n      const formVersion = await em.findOne(FormVersion, {\n        id: submission.formVersionId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      })\n      if (!formVersion) {\n        throw new AnonymizeServiceError('FORM_VERSION_NOT_FOUND', 'Form version not found.')\n      }\n      compiled = this.options.compiler.compile({\n        id: formVersion.id,\n        updatedAt: formVersion.updatedAt,\n        schema: formVersion.schema,\n        uiSchema: formVersion.uiSchema,\n      })\n    }\n\n    let anonymizedCount = 0\n    const now = submission.anonymizedAt ?? new Date()\n    for (const revision of pendingRevisions) {\n      const plaintext = await this.options.encryption.decrypt(submission.organizationId, revision.data)\n      const decoded = JSON.parse(plaintext.toString('utf-8')) as Record<string, unknown>\n      const tombstoned = applyTombstone(decoded, compiled as CompiledFormVersion)\n      const buffer = Buffer.from(JSON.stringify(tombstoned), 'utf-8')\n      const reencrypted = await this.options.encryption.encrypt(submission.organizationId, buffer)\n      revision.data = reencrypted\n      revision.anonymizedAt = now\n      anonymizedCount += 1\n    }\n\n    for (const attachment of attachments) {\n      attachment.removedAt = attachment.removedAt ?? now\n      attachment.payloadInline = null\n      attachment.fileId = null\n      attachment.contentType = null\n      attachment.filename = null\n      attachment.sizeBytes = null\n      attachment.uploadedBy = null\n    }\n\n    for (const invitation of invitations) {\n      invitation.recipientEmail = null\n      invitation.recipientName = null\n      invitation.recipientRef = null\n    }\n\n    submission.anonymizedAt = now\n    submission.pdfSnapshotAttachmentId = null\n    submission.submitMetadata = {\n      anonymized_at: now.toISOString(),\n    }\n    await em.flush()\n\n    return {\n      revisionsAnonymized: anonymizedCount,\n      submissionAnonymizedAt: now,\n    }\n  }\n}\n\nfunction applyTombstone(\n  decoded: Record<string, unknown>,\n  compiled: CompiledFormVersion,\n): Record<string, unknown> {\n  const result: Record<string, unknown> = { ...decoded }\n  for (const [key, descriptor] of Object.entries(compiled.fieldIndex)) {\n    if (!descriptor.sensitive) continue\n    if (Object.prototype.hasOwnProperty.call(result, key)) {\n      result[key] = ANONYMIZED_TOKEN\n    }\n  }\n  return result\n}\n\nexport const ANONYMIZED_FIELD_TOKEN = ANONYMIZED_TOKEN\n\n/** Brand check for AnonymizeServiceError \u2014 use instead of `instanceof`. */\nexport function isAnonymizeServiceError(error: unknown): error is AnonymizeServiceError {\n  return typeof error === 'object' && error !== null && (ANONYMIZE_SERVICE_ERROR_MARKER in error)\n}\n"],
+  "mappings": "AAAA;AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,MAAM,mBAAmB;AASzB,MAAM,iCAAiC,uBAAO,IAAI,2CAA2C;AAEtF,MAAM,+BAA8B,YAC/B,qCAD+B,IAAM;AAAA,EAG/C,YAAY,MAAc,SAAiB;AACzC,UAAM,OAAO;AAHf,SAAU,MAAkC;AAI1C,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAiCO,MAAM,iBAAiB;AAAA,EAC5B,YAA6B,SAAkC;AAAlC;AAAA,EAAmC;AAAA,EAEhE,MAAM,UAAU,cAAsB,OAGnC;AACD,UAAM,KAAK,KAAK,QAAQ;AACxB,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,sBAAsB,wBAAwB,uBAAuB;AAAA,IACjF;AACA,UAAM,YAAY,MAAM,GAAG;AAAA,MACzB;AAAA,MACA,EAAE,cAAc,WAAW,GAAG;AAAA,MAC9B,EAAE,SAAS,EAAE,gBAAgB,MAAM,EAAE;AAAA,IACvC;AACA,UAAM,cAAc,MAAM,GAAG,KAAK,gBAAgB;AAAA,MAChD,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,IAC7B,CAAC;AACD,UAAM,cAAc,MAAM,GAAG,KAAK,gBAAgB;AAAA,MAChD,cAAc,WAAW;AAAA,MACzB,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,IAClB,CAAC;AAED,UAAM,mBAAmB,UAAU,OAAO,CAAC,aAAa,CAAC,SAAS,YAAY;AAC9E,QAAI,WAAuC;AAC3C,QAAI,iBAAiB,SAAS,GAAG;AAC/B,YAAM,cAAc,MAAM,GAAG,QAAQ,aAAa;AAAA,QAChD,IAAI,WAAW;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB,CAAC;AACD,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,sBAAsB,0BAA0B,yBAAyB;AAAA,MACrF;AACA,iBAAW,KAAK,QAAQ,SAAS,QAAQ;AAAA,QACvC,IAAI,YAAY;AAAA,QAChB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,QACpB,UAAU,YAAY;AAAA,MACxB,CAAC;AAAA,IACH;AAEA,QAAI,kBAAkB;AACtB,UAAM,MAAM,WAAW,gBAAgB,oBAAI,KAAK;AAChD,eAAW,YAAY,kBAAkB;AACvC,YAAM,YAAY,MAAM,KAAK,QAAQ,WAAW,QAAQ,WAAW,gBAAgB,SAAS,IAAI;AAChG,YAAM,UAAU,KAAK,MAAM,UAAU,SAAS,OAAO,CAAC;AACtD,YAAM,aAAa,eAAe,SAAS,QAA+B;AAC1E,YAAM,SAAS,OAAO,KAAK,KAAK,UAAU,UAAU,GAAG,OAAO;AAC9D,YAAM,cAAc,MAAM,KAAK,QAAQ,WAAW,QAAQ,WAAW,gBAAgB,MAAM;AAC3F,eAAS,OAAO;AAChB,eAAS,eAAe;AACxB,yBAAmB;AAAA,IACrB;AAEA,eAAW,cAAc,aAAa;AACpC,iBAAW,YAAY,WAAW,aAAa;AAC/C,iBAAW,gBAAgB;AAC3B,iBAAW,SAAS;AACpB,iBAAW,cAAc;AACzB,iBAAW,WAAW;AACtB,iBAAW,YAAY;AACvB,iBAAW,aAAa;AAAA,IAC1B;AAEA,eAAW,cAAc,aAAa;AACpC,iBAAW,iBAAiB;AAC5B,iBAAW,gBAAgB;AAC3B,iBAAW,eAAe;AAAA,IAC5B;AAEA,eAAW,eAAe;AAC1B,eAAW,0BAA0B;AACrC,eAAW,iBAAiB;AAAA,MAC1B,eAAe,IAAI,YAAY;AAAA,IACjC;AACA,UAAM,GAAG,MAAM;AAEf,WAAO;AAAA,MACL,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,SAAS,eACP,SACA,UACyB;AACzB,QAAM,SAAkC,EAAE,GAAG,QAAQ;AACrD,aAAW,CAAC,KAAK,UAAU,KAAK,OAAO,QAAQ,SAAS,UAAU,GAAG;AACnE,QAAI,CAAC,WAAW,UAAW;AAC3B,QAAI,OAAO,UAAU,eAAe,KAAK,QAAQ,GAAG,GAAG;AACrD,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,yBAAyB;AAG/B,SAAS,wBAAwB,OAAgD;AACtF,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,kCAAkC;AAC3F;",
+  "names": []
+}

package/dist/modules/forms/services/attachment-service.js

@@ -0,0 +1,123 @@
+var _a, _b;
+import { FormAttachment, FormSubmission } from "../data/entities.js";
+import { evaluateUploadGate, resolveMaxUploadBytes } from "./upload-validation.js";
+const ATTACHMENT_SERVICE_ERROR_MARKER = /* @__PURE__ */ Symbol.for("@open-mercato/forms/AttachmentServiceError");
+class AttachmentServiceError extends (_b = Error, _a = ATTACHMENT_SERVICE_ERROR_MARKER, _b) {
+  constructor(code, message, httpStatus) {
+    super(message);
+    this[_a] = true;
+    this.name = "AttachmentServiceError";
+    this.code = code;
+    this.httpStatus = httpStatus;
+  }
+}
+class AttachmentService {
+  constructor(options) {
+    this.emFactory = options.emFactory;
+    this.encryption = options.encryptionService;
+    this.scanner = options.scanner;
+    this.hardCeilingBytes = options.hardCeilingBytes ?? resolveMaxUploadBytes(process.env);
+  }
+  /**
+   * Validates, scans, encrypts, and persists an upload. Returns the reference
+   * the renderer puts into the field value. The submission scope is re-derived
+   * from the persisted row; a scope mismatch is reported as NOT_FOUND.
+   */
+  async storeUpload(args) {
+    const em = this.emFactory();
+    const submission = await this.findScopedSubmission(em, args);
+    const sizeBytes = args.bytes.length;
+    const gate = evaluateUploadGate({
+      contentType: args.contentType,
+      sizeBytes,
+      accept: args.accept ?? null,
+      fieldMaxSizeBytes: args.fieldMaxSizeBytes ?? null,
+      hardCeilingBytes: this.hardCeilingBytes
+    });
+    if (!gate.ok) {
+      throw new AttachmentServiceError(gate.code, gate.message, gate.status);
+    }
+    const scan = await this.scanner.scan({
+      bytes: args.bytes,
+      contentType: args.contentType,
+      filename: args.filename
+    });
+    if (!scan.clean) {
+      throw new AttachmentServiceError(
+        "SCAN_REJECTED",
+        scan.reason && scan.reason.length > 0 ? scan.reason : "Upload rejected by malware scan.",
+        422
+      );
+    }
+    const ciphertext = await this.encryption.encrypt(submission.organizationId, args.bytes);
+    const attachment = em.create(FormAttachment, {
+      submissionId: submission.id,
+      organizationId: submission.organizationId,
+      fieldKey: args.fieldKey,
+      kind: "user_upload",
+      payloadInline: ciphertext,
+      contentType: args.contentType,
+      filename: args.filename,
+      sizeBytes,
+      uploadedBy: args.uploadedBy ?? null,
+      uploadedAt: /* @__PURE__ */ new Date()
+    });
+    em.persist(attachment);
+    await em.flush();
+    return {
+      id: attachment.id,
+      filename: args.filename,
+      contentType: args.contentType,
+      sizeBytes
+    };
+  }
+  /**
+   * Reads and decrypts an attachment scoped to the submission's org/tenant.
+   * Returns NOT_FOUND for cross-tenant ids, removed rows, snapshot/generated
+   * kinds, or inline-less rows.
+   */
+  async readUpload(args) {
+    const em = this.emFactory();
+    const submission = await this.findScopedSubmission(em, args);
+    const attachment = await em.findOne(FormAttachment, {
+      id: args.attachmentId,
+      submissionId: submission.id,
+      organizationId: submission.organizationId,
+      kind: "user_upload",
+      removedAt: null
+    });
+    if (!attachment || !attachment.payloadInline) {
+      throw new AttachmentServiceError("NOT_FOUND", "Attachment not found.", 404);
+    }
+    const ciphertext = Buffer.isBuffer(attachment.payloadInline) ? attachment.payloadInline : Buffer.from(attachment.payloadInline);
+    const bytes = await this.encryption.decrypt(submission.organizationId, ciphertext);
+    return {
+      id: attachment.id,
+      filename: attachment.filename ?? "",
+      contentType: attachment.contentType ?? "application/octet-stream",
+      sizeBytes: attachment.sizeBytes ?? bytes.length,
+      bytes
+    };
+  }
+  async findScopedSubmission(em, args) {
+    const submission = await em.findOne(FormSubmission, {
+      id: args.submissionId,
+      organizationId: args.organizationId,
+      tenantId: args.tenantId,
+      deletedAt: null
+    });
+    if (!submission) {
+      throw new AttachmentServiceError("NOT_FOUND", "Submission not found.", 404);
+    }
+    return submission;
+  }
+}
+function isAttachmentServiceError(error) {
+  return typeof error === "object" && error !== null && ATTACHMENT_SERVICE_ERROR_MARKER in error;
+}
+export {
+  AttachmentService,
+  AttachmentServiceError,
+  isAttachmentServiceError
+};
+//# sourceMappingURL=attachment-service.js.map

package/dist/modules/forms/services/attachment-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/attachment-service.ts"],
+  "sourcesContent": ["/**\n * Form attachment service \u2014 W4 (FA-4 file + SEC-4).\n *\n * Stores participant uploads as `forms_form_attachment` rows\n * (`kind = 'user_upload'`) and reads them back. The raw bytes are encrypted at\n * rest with the per-tenant `EncryptionService` (DP-1: file bytes are PHI) and\n * persisted in `payload_inline`; the true `content_type` / `filename` /\n * `size_bytes` are recorded verbatim alongside.\n *\n * Tenant isolation: every query is scoped by BOTH `organization_id` AND\n * `tenant_id`. Callers MUST derive scope from the persisted submission row\n * (never the client). The submission row is re-fetched here and its scope is\n * compared with the caller's resolved scope; a mismatch is treated as\n * not-found (no cross-tenant leakage, no enumeration signal).\n *\n * Enforcement (server-authoritative):\n *   - empty / oversize \u2192 413, disallowed MIME \u2192 422 (`evaluateUploadGate`)\n *   - virus-scan hook \u2192 not-clean rejects with 422 (`UploadScanner`)\n */\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FormAttachment, FormSubmission } from '../data/entities'\nimport type { EncryptionService } from './encryption-service'\nimport type { UploadScanner } from './upload-scanner'\nimport { evaluateUploadGate, resolveMaxUploadBytes } from './upload-validation'\n\nexport type AttachmentServiceErrorCode =\n  | 'NOT_FOUND'\n  | 'EMPTY'\n  | 'TOO_LARGE'\n  | 'DISALLOWED_TYPE'\n  | 'SCAN_REJECTED'\n\n/**\n * `Symbol.for` so the brand survives module duplication across bundle\n * boundaries. `instanceof` does NOT: Next can load this module in more than\n * one chunk, and once a second copy of the class exists an error thrown\n * through one copy fails `instanceof` against the other \u2014 silently\n * downgrading a mapped domain error to a 500. Mirrors `CrudHttpError`.\n */\nconst ATTACHMENT_SERVICE_ERROR_MARKER = Symbol.for('@open-mercato/forms/AttachmentServiceError')\n\nexport class AttachmentServiceError extends Error {\n  readonly [ATTACHMENT_SERVICE_ERROR_MARKER] = true\n  readonly code: AttachmentServiceErrorCode\n  readonly httpStatus: number\n\n  constructor(code: AttachmentServiceErrorCode, message: string, httpStatus: number) {\n    super(message)\n    this.name = 'AttachmentServiceError'\n    this.code = code\n    this.httpStatus = httpStatus\n  }\n}\n\ntype Scope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type StoreUploadArgs = Scope & {\n  submissionId: string\n  fieldKey: string\n  filename: string\n  contentType: string\n  bytes: Buffer\n  uploadedBy: string | null\n  /** Field-configured MIME allowlist (`x-om-accept`). */\n  accept?: string[] | null\n  /** Field-configured max size (`x-om-max-size-bytes`). */\n  fieldMaxSizeBytes?: number | null\n}\n\nexport type StoredAttachment = {\n  id: string\n  filename: string\n  contentType: string\n  sizeBytes: number\n}\n\nexport type ReadAttachmentArgs = Scope & {\n  submissionId: string\n  attachmentId: string\n}\n\nexport type ReadAttachmentResult = {\n  id: string\n  filename: string\n  contentType: string\n  sizeBytes: number\n  bytes: Buffer\n}\n\nexport type AttachmentServiceOptions = {\n  emFactory: () => EntityManager\n  encryptionService: EncryptionService\n  scanner: UploadScanner\n  /** Override the env-resolved hard ceiling (tests). */\n  hardCeilingBytes?: number\n}\n\nexport class AttachmentService {\n  private readonly emFactory: () => EntityManager\n  private readonly encryption: EncryptionService\n  private readonly scanner: UploadScanner\n  private readonly hardCeilingBytes: number\n\n  constructor(options: AttachmentServiceOptions) {\n    this.emFactory = options.emFactory\n    this.encryption = options.encryptionService\n    this.scanner = options.scanner\n    this.hardCeilingBytes = options.hardCeilingBytes ?? resolveMaxUploadBytes(process.env)\n  }\n\n  /**\n   * Validates, scans, encrypts, and persists an upload. Returns the reference\n   * the renderer puts into the field value. The submission scope is re-derived\n   * from the persisted row; a scope mismatch is reported as NOT_FOUND.\n   */\n  async storeUpload(args: StoreUploadArgs): Promise<StoredAttachment> {\n    const em = this.emFactory()\n    const submission = await this.findScopedSubmission(em, args)\n\n    const sizeBytes = args.bytes.length\n    const gate = evaluateUploadGate({\n      contentType: args.contentType,\n      sizeBytes,\n      accept: args.accept ?? null,\n      fieldMaxSizeBytes: args.fieldMaxSizeBytes ?? null,\n      hardCeilingBytes: this.hardCeilingBytes,\n    })\n    if (!gate.ok) {\n      throw new AttachmentServiceError(gate.code, gate.message, gate.status)\n    }\n\n    const scan = await this.scanner.scan({\n      bytes: args.bytes,\n      contentType: args.contentType,\n      filename: args.filename,\n    })\n    if (!scan.clean) {\n      throw new AttachmentServiceError(\n        'SCAN_REJECTED',\n        scan.reason && scan.reason.length > 0 ? scan.reason : 'Upload rejected by malware scan.',\n        422,\n      )\n    }\n\n    const ciphertext = await this.encryption.encrypt(submission.organizationId, args.bytes)\n    const attachment = em.create(FormAttachment, {\n      submissionId: submission.id,\n      organizationId: submission.organizationId,\n      fieldKey: args.fieldKey,\n      kind: 'user_upload',\n      payloadInline: ciphertext,\n      contentType: args.contentType,\n      filename: args.filename,\n      sizeBytes,\n      uploadedBy: args.uploadedBy ?? null,\n      uploadedAt: new Date(),\n    })\n    em.persist(attachment)\n    await em.flush()\n\n    return {\n      id: attachment.id,\n      filename: args.filename,\n      contentType: args.contentType,\n      sizeBytes,\n    }\n  }\n\n  /**\n   * Reads and decrypts an attachment scoped to the submission's org/tenant.\n   * Returns NOT_FOUND for cross-tenant ids, removed rows, snapshot/generated\n   * kinds, or inline-less rows.\n   */\n  async readUpload(args: ReadAttachmentArgs): Promise<ReadAttachmentResult> {\n    const em = this.emFactory()\n    const submission = await this.findScopedSubmission(em, args)\n\n    const attachment = await em.findOne(FormAttachment, {\n      id: args.attachmentId,\n      submissionId: submission.id,\n      organizationId: submission.organizationId,\n      kind: 'user_upload',\n      removedAt: null,\n    })\n    if (!attachment || !attachment.payloadInline) {\n      throw new AttachmentServiceError('NOT_FOUND', 'Attachment not found.', 404)\n    }\n\n    const ciphertext = Buffer.isBuffer(attachment.payloadInline)\n      ? attachment.payloadInline\n      : Buffer.from(attachment.payloadInline as Uint8Array)\n    const bytes = await this.encryption.decrypt(submission.organizationId, ciphertext)\n    return {\n      id: attachment.id,\n      filename: attachment.filename ?? '',\n      contentType: attachment.contentType ?? 'application/octet-stream',\n      sizeBytes: attachment.sizeBytes ?? bytes.length,\n      bytes,\n    }\n  }\n\n  private async findScopedSubmission(em: EntityManager, args: Scope & { submissionId: string }): Promise<FormSubmission> {\n    const submission = await em.findOne(FormSubmission, {\n      id: args.submissionId,\n      organizationId: args.organizationId,\n      tenantId: args.tenantId,\n      deletedAt: null,\n    })\n    if (!submission) {\n      throw new AttachmentServiceError('NOT_FOUND', 'Submission not found.', 404)\n    }\n    return submission\n  }\n}\n\n/** Brand check for AttachmentServiceError \u2014 use instead of `instanceof`. */\nexport function isAttachmentServiceError(error: unknown): error is AttachmentServiceError {\n  return typeof error === 'object' && error !== null && (ATTACHMENT_SERVICE_ERROR_MARKER in error)\n}\n"],
+  "mappings": "AAAA;AAqBA,SAAS,gBAAgB,sBAAsB;AAG/C,SAAS,oBAAoB,6BAA6B;AAgB1D,MAAM,kCAAkC,uBAAO,IAAI,4CAA4C;AAExF,MAAM,gCAA+B,YAChC,sCADgC,IAAM;AAAA,EAKhD,YAAY,MAAkC,SAAiB,YAAoB;AACjF,UAAM,OAAO;AALf,SAAU,MAAmC;AAM3C,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAgDO,MAAM,kBAAkB;AAAA,EAM7B,YAAY,SAAmC;AAC7C,SAAK,YAAY,QAAQ;AACzB,SAAK,aAAa,QAAQ;AAC1B,SAAK,UAAU,QAAQ;AACvB,SAAK,mBAAmB,QAAQ,oBAAoB,sBAAsB,QAAQ,GAAG;AAAA,EACvF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAY,MAAkD;AAClE,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,KAAK,qBAAqB,IAAI,IAAI;AAE3D,UAAM,YAAY,KAAK,MAAM;AAC7B,UAAM,OAAO,mBAAmB;AAAA,MAC9B,aAAa,KAAK;AAAA,MAClB;AAAA,MACA,QAAQ,KAAK,UAAU;AAAA,MACvB,mBAAmB,KAAK,qBAAqB;AAAA,MAC7C,kBAAkB,KAAK;AAAA,IACzB,CAAC;AACD,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,IAAI,uBAAuB,KAAK,MAAM,KAAK,SAAS,KAAK,MAAM;AAAA,IACvE;AAEA,UAAM,OAAO,MAAM,KAAK,QAAQ,KAAK;AAAA,MACnC,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,KAAK,OAAO;AACf,YAAM,IAAI;AAAA,QACR;AAAA,QACA,KAAK,UAAU,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAAA,QACtD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,KAAK,WAAW,QAAQ,WAAW,gBAAgB,KAAK,KAAK;AACtF,UAAM,aAAa,GAAG,OAAO,gBAAgB;AAAA,MAC3C,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,MAC3B,UAAU,KAAK;AAAA,MACf,MAAM;AAAA,MACN,eAAe;AAAA,MACf,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf;AAAA,MACA,YAAY,KAAK,cAAc;AAAA,MAC/B,YAAY,oBAAI,KAAK;AAAA,IACvB,CAAC;AACD,OAAG,QAAQ,UAAU;AACrB,UAAM,GAAG,MAAM;AAEf,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,UAAU,KAAK;AAAA,MACf,aAAa,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW,MAAyD;AACxE,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,aAAa,MAAM,KAAK,qBAAqB,IAAI,IAAI;AAE3D,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,cAAc,WAAW;AAAA,MACzB,gBAAgB,WAAW;AAAA,MAC3B,MAAM;AAAA,MACN,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,cAAc,CAAC,WAAW,eAAe;AAC5C,YAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,IAC5E;AAEA,UAAM,aAAa,OAAO,SAAS,WAAW,aAAa,IACvD,WAAW,gBACX,OAAO,KAAK,WAAW,aAA2B;AACtD,UAAM,QAAQ,MAAM,KAAK,WAAW,QAAQ,WAAW,gBAAgB,UAAU;AACjF,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,UAAU,WAAW,YAAY;AAAA,MACjC,aAAa,WAAW,eAAe;AAAA,MACvC,WAAW,WAAW,aAAa,MAAM;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,IAAmB,MAAiE;AACrH,UAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,MAClD,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI,uBAAuB,aAAa,yBAAyB,GAAG;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AACF;AAGO,SAAS,yBAAyB,OAAiD;AACxF,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,mCAAmC;AAC5F;",
+  "names": []
+}

package/dist/modules/forms/services/captcha-verifier.js

@@ -0,0 +1,76 @@
+const PROVIDER_ENDPOINTS = {
+  turnstile: "https://challenges.cloudflare.com/turnstile/v0/siteverify",
+  recaptcha: "https://www.google.com/recaptcha/api/siteverify"
+};
+const DEFAULT_TIMEOUT_MS = 5e3;
+class NoopCaptchaVerifier {
+  async verify() {
+    return { success: false, reason: "provider_unavailable" };
+  }
+}
+function isSiteverifyResponse(value) {
+  return typeof value === "object" && value !== null && typeof value.success === "boolean";
+}
+class ProviderCaptchaVerifier {
+  constructor(options) {
+    this.provider = options.provider;
+    this.secret = options.secret;
+    this.endpoint = PROVIDER_ENDPOINTS[options.provider];
+    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async verify(input) {
+    if (!input.token) return { success: false, reason: "missing_token" };
+    const body = new URLSearchParams();
+    body.set("secret", this.secret);
+    body.set("response", input.token);
+    if (this.provider === "turnstile" && input.remoteIp) {
+      body.set("remoteip", input.remoteIp);
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body,
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        return { success: false, reason: `http_${response.status}` };
+      }
+      const parsed = await response.json();
+      if (!isSiteverifyResponse(parsed)) {
+        return { success: false, reason: "malformed_response" };
+      }
+      return parsed.success ? { success: true } : { success: false, reason: "rejected" };
+    } catch (error) {
+      const reason = error instanceof Error && error.name === "AbortError" ? "timeout" : "network_error";
+      return { success: false, reason };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+function parseProvider(value) {
+  if (value === "turnstile" || value === "recaptcha") return value;
+  return null;
+}
+function resolveCaptchaVerifier(env) {
+  const provider = parseProvider(env.FORMS_CAPTCHA_PROVIDER);
+  const secret = env.FORMS_CAPTCHA_SECRET;
+  if (provider && secret) {
+    return new ProviderCaptchaVerifier({ provider, secret });
+  }
+  return new NoopCaptchaVerifier();
+}
+function isCaptchaProviderConfigured(env) {
+  return parseProvider(env.FORMS_CAPTCHA_PROVIDER) !== null && Boolean(env.FORMS_CAPTCHA_SECRET);
+}
+export {
+  NoopCaptchaVerifier,
+  ProviderCaptchaVerifier,
+  isCaptchaProviderConfigured,
+  resolveCaptchaVerifier
+};
+//# sourceMappingURL=captcha-verifier.js.map

package/dist/modules/forms/services/captcha-verifier.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/captcha-verifier.ts"],
+  "sourcesContent": ["/**\n * Pluggable CAPTCHA verification \u2014 T5 (replaces the forms-2d stub).\n *\n * A distribution may require a CAPTCHA via `distribution.settings.captcha`.\n * The start route resolves a `CaptchaVerifier` from DI (`formsCaptchaVerifier`)\n * and verifies the participant's token before bootstrapping a submission.\n *\n * Two implementations ship:\n *\n *  - `ProviderCaptchaVerifier` \u2014 verifies a token against a provider's\n *    siteverify HTTP endpoint (Cloudflare Turnstile or Google reCAPTCHA).\n *    Configured by env (`FORMS_CAPTCHA_PROVIDER` + `FORMS_CAPTCHA_SECRET`).\n *    Fail-closed: any network / parse error resolves to `{ success: false }`.\n *\n *  - `NoopCaptchaVerifier` \u2014 fail-closed sentinel used when no provider is\n *    configured. CAPTCHA-enabled distributions must never silently accept a\n *    token that was not verified.\n *\n * Operators inject a custom verifier by overriding `formsCaptchaVerifier`.\n *\n * SECURITY: never log the secret or the participant token.\n */\n\nexport type CaptchaVerifyInput = {\n  token: string\n  remoteIp?: string\n}\n\nexport type CaptchaVerifyResult = {\n  success: boolean\n  /** Optional machine-readable reason surfaced when `success === false`. */\n  reason?: string\n}\n\nexport interface CaptchaVerifier {\n  verify(input: CaptchaVerifyInput): Promise<CaptchaVerifyResult>\n}\n\nexport type CaptchaProvider = 'turnstile' | 'recaptcha'\n\nconst PROVIDER_ENDPOINTS: Record<CaptchaProvider, string> = {\n  turnstile: 'https://challenges.cloudflare.com/turnstile/v0/siteverify',\n  recaptcha: 'https://www.google.com/recaptcha/api/siteverify',\n}\n\nconst DEFAULT_TIMEOUT_MS = 5_000\n\n/**\n * Missing-provider verifier. The historical class name is retained because it\n * is an exported surface, but it deliberately fails closed.\n */\nexport class NoopCaptchaVerifier implements CaptchaVerifier {\n  async verify(): Promise<CaptchaVerifyResult> {\n    return { success: false, reason: 'provider_unavailable' }\n  }\n}\n\nexport type ProviderCaptchaVerifierOptions = {\n  provider: CaptchaProvider\n  secret: string\n  timeoutMs?: number\n  /** Injectable for tests \u2014 defaults to the global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\nfunction isSiteverifyResponse(value: unknown): value is { success: boolean } {\n  return (\n    typeof value === 'object' &&\n    value !== null &&\n    typeof (value as { success?: unknown }).success === 'boolean'\n  )\n}\n\n/**\n * Verifies a CAPTCHA token against a provider's siteverify endpoint.\n *\n * Fail-closed: when a provider is configured, any transport or parse failure\n * MUST reject (`{ success: false, reason }`) rather than silently passing.\n */\nexport class ProviderCaptchaVerifier implements CaptchaVerifier {\n  private readonly provider: CaptchaProvider\n  private readonly secret: string\n  private readonly endpoint: string\n  private readonly timeoutMs: number\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: ProviderCaptchaVerifierOptions) {\n    this.provider = options.provider\n    this.secret = options.secret\n    this.endpoint = PROVIDER_ENDPOINTS[options.provider]\n    this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS\n    this.fetchImpl = options.fetchImpl ?? fetch\n  }\n\n  async verify(input: CaptchaVerifyInput): Promise<CaptchaVerifyResult> {\n    if (!input.token) return { success: false, reason: 'missing_token' }\n\n    const body = new URLSearchParams()\n    body.set('secret', this.secret)\n    body.set('response', input.token)\n    if (this.provider === 'turnstile' && input.remoteIp) {\n      body.set('remoteip', input.remoteIp)\n    }\n\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs)\n    try {\n      const response = await this.fetchImpl(this.endpoint, {\n        method: 'POST',\n        headers: { 'content-type': 'application/x-www-form-urlencoded' },\n        body,\n        signal: controller.signal,\n      })\n      if (!response.ok) {\n        return { success: false, reason: `http_${response.status}` }\n      }\n      const parsed: unknown = await response.json()\n      if (!isSiteverifyResponse(parsed)) {\n        return { success: false, reason: 'malformed_response' }\n      }\n      return parsed.success ? { success: true } : { success: false, reason: 'rejected' }\n    } catch (error) {\n      const reason = error instanceof Error && error.name === 'AbortError' ? 'timeout' : 'network_error'\n      return { success: false, reason }\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n}\n\nfunction parseProvider(value: string | undefined): CaptchaProvider | null {\n  if (value === 'turnstile' || value === 'recaptcha') return value\n  return null\n}\n\n/**\n * Selects a verifier from the environment:\n *  - `FORMS_CAPTCHA_PROVIDER` (`turnstile` | `recaptcha`) + `FORMS_CAPTCHA_SECRET`\n *    both set \u21D2 `ProviderCaptchaVerifier` (real verification, fail-closed).\n *  - otherwise \u21D2 fail-closed `NoopCaptchaVerifier` sentinel.\n */\nexport function resolveCaptchaVerifier(env: NodeJS.ProcessEnv): CaptchaVerifier {\n  const provider = parseProvider(env.FORMS_CAPTCHA_PROVIDER)\n  const secret = env.FORMS_CAPTCHA_SECRET\n  if (provider && secret) {\n    return new ProviderCaptchaVerifier({ provider, secret })\n  }\n  return new NoopCaptchaVerifier()\n}\n\n/**\n * True when a real provider is configured.\n */\nexport function isCaptchaProviderConfigured(env: NodeJS.ProcessEnv): boolean {\n  return parseProvider(env.FORMS_CAPTCHA_PROVIDER) !== null && Boolean(env.FORMS_CAPTCHA_SECRET)\n}\n"],
+  "mappings": "AAwCA,MAAM,qBAAsD;AAAA,EAC1D,WAAW;AAAA,EACX,WAAW;AACb;AAEA,MAAM,qBAAqB;AAMpB,MAAM,oBAA+C;AAAA,EAC1D,MAAM,SAAuC;AAC3C,WAAO,EAAE,SAAS,OAAO,QAAQ,uBAAuB;AAAA,EAC1D;AACF;AAUA,SAAS,qBAAqB,OAA+C;AAC3E,SACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAAgC,YAAY;AAExD;AAQO,MAAM,wBAAmD;AAAA,EAO9D,YAAY,SAAyC;AACnD,SAAK,WAAW,QAAQ;AACxB,SAAK,SAAS,QAAQ;AACtB,SAAK,WAAW,mBAAmB,QAAQ,QAAQ;AACnD,SAAK,YAAY,QAAQ,aAAa;AACtC,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,OAAyD;AACpE,QAAI,CAAC,MAAM,MAAO,QAAO,EAAE,SAAS,OAAO,QAAQ,gBAAgB;AAEnE,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,UAAU,KAAK,MAAM;AAC9B,SAAK,IAAI,YAAY,MAAM,KAAK;AAChC,QAAI,KAAK,aAAa,eAAe,MAAM,UAAU;AACnD,WAAK,IAAI,YAAY,MAAM,QAAQ;AAAA,IACrC;AAEA,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AACjE,QAAI;AACF,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACnD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D;AAAA,QACA,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO,EAAE,SAAS,OAAO,QAAQ,QAAQ,SAAS,MAAM,GAAG;AAAA,MAC7D;AACA,YAAM,SAAkB,MAAM,SAAS,KAAK;AAC5C,UAAI,CAAC,qBAAqB,MAAM,GAAG;AACjC,eAAO,EAAE,SAAS,OAAO,QAAQ,qBAAqB;AAAA,MACxD;AACA,aAAO,OAAO,UAAU,EAAE,SAAS,KAAK,IAAI,EAAE,SAAS,OAAO,QAAQ,WAAW;AAAA,IACnF,SAAS,OAAO;AACd,YAAM,SAAS,iBAAiB,SAAS,MAAM,SAAS,eAAe,YAAY;AACnF,aAAO,EAAE,SAAS,OAAO,OAAO;AAAA,IAClC,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,cAAc,OAAmD;AACxE,MAAI,UAAU,eAAe,UAAU,YAAa,QAAO;AAC3D,SAAO;AACT;AAQO,SAAS,uBAAuB,KAAyC;AAC9E,QAAM,WAAW,cAAc,IAAI,sBAAsB;AACzD,QAAM,SAAS,IAAI;AACnB,MAAI,YAAY,QAAQ;AACtB,WAAO,IAAI,wBAAwB,EAAE,UAAU,OAAO,CAAC;AAAA,EACzD;AACA,SAAO,IAAI,oBAAoB;AACjC;AAKO,SAAS,4BAA4B,KAAiC;AAC3E,SAAO,cAAc,IAAI,sBAAsB,MAAM,QAAQ,QAAQ,IAAI,oBAAoB;AAC/F;",
+  "names": []
+}

package/dist/modules/forms/services/consent-record-service.js

@@ -0,0 +1,96 @@
+import { FormConsentRecord } from "../data/entities.js";
+import { SIGNATURE_TYPE_KEY } from "../schema/signature-field.js";
+const SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/;
+function readSignatureValue(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  if (candidate.mode !== "drawn" && candidate.mode !== "typed") return null;
+  if (typeof candidate.clauseSha256 !== "string" || !SHA256_HEX_PATTERN.test(candidate.clauseSha256)) return null;
+  if (typeof candidate.signedAt !== "string" || Number.isNaN(Date.parse(candidate.signedAt))) return null;
+  return candidate;
+}
+class ConsentRecordService {
+  constructor(deps) {
+    this.emFactory = deps.emFactory;
+    this.compiler = deps.compiler;
+    this.loadSubmission = deps.loadSubmission;
+    this.now = deps.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  /**
+   * Projects every signed signature field on the submission into the consent
+   * aggregate. Returns the records created (empty when there are no signature
+   * fields, no signed values, or every clause is already recorded).
+   */
+  async projectFromSubmission(args) {
+    const loaded = await this.loadSubmission(args);
+    if (!loaded) return [];
+    const { submission, formVersion, decodedData } = loaded;
+    if (submission.status !== "submitted") return [];
+    const compiled = this.compiler.compile({
+      id: formVersion.id,
+      updatedAt: formVersion.updatedAt,
+      schema: formVersion.schema,
+      uiSchema: formVersion.uiSchema
+    });
+    const signatureFieldKeys = Object.values(compiled.fieldIndex).filter((descriptor) => descriptor.type === SIGNATURE_TYPE_KEY).map((descriptor) => descriptor.key);
+    if (signatureFieldKeys.length === 0) return [];
+    const em = this.emFactory();
+    const created = [];
+    for (const consentFieldKey of signatureFieldKeys) {
+      const signature = readSignatureValue(decodedData[consentFieldKey]);
+      if (!signature) continue;
+      const existing = await em.findOne(FormConsentRecord, {
+        submissionId: submission.id,
+        organizationId: args.organizationId,
+        consentFieldKey
+      });
+      if (existing) continue;
+      const nowDate = this.now();
+      const record = em.create(FormConsentRecord, {
+        organizationId: args.organizationId,
+        tenantId: args.tenantId,
+        subjectType: submission.subjectType,
+        subjectId: submission.subjectId,
+        formId: formVersion.formId,
+        formVersionId: formVersion.id,
+        versionNumber: formVersion.versionNumber,
+        submissionId: submission.id,
+        consentFieldKey,
+        clauseSha256: signature.clauseSha256,
+        signedAt: new Date(signature.signedAt),
+        status: "active",
+        supersededByRecordId: null,
+        supersededAt: null,
+        createdAt: nowDate,
+        updatedAt: nowDate
+      });
+      em.persist(record);
+      const priorActive = await em.find(FormConsentRecord, {
+        organizationId: args.organizationId,
+        tenantId: args.tenantId,
+        subjectType: submission.subjectType,
+        subjectId: submission.subjectId,
+        formId: formVersion.formId,
+        consentFieldKey,
+        status: "active"
+      });
+      for (const prior of priorActive) {
+        if (prior === record) continue;
+        prior.status = "superseded";
+        prior.supersededByRecordId = record.id;
+        prior.supersededAt = nowDate;
+        prior.updatedAt = nowDate;
+        em.persist(prior);
+      }
+      created.push(record);
+    }
+    if (created.length > 0) {
+      await em.flush();
+    }
+    return created;
+  }
+}
+export {
+  ConsentRecordService
+};
+//# sourceMappingURL=consent-record-service.js.map

package/dist/modules/forms/services/consent-record-service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/services/consent-record-service.ts"],
+  "sourcesContent": ["/**\n * Consent-record projector service \u2014 Phase 3 Track D.\n *\n * Projects signed `signature`-typed field answers into the\n * `forms_consent_record` aggregate: a per-subject, per-clause history of\n * consent with supersession tracking. The projection is PII-free \u2014 it records\n * only the consent-clause SHA-256, the signed-at timestamp, and ids. It never\n * stores the signature image, typed name, or any answer value.\n *\n * Invariants:\n *  - Idempotent: at most one record per `(submission_id, consent_field_key)`.\n *    Re-delivery of `forms.submission.submitted` is a no-op (backed by a\n *    unique index as the second line of defence).\n *  - Supersession: creating a new `active` record marks any prior `active`\n *    record for the same `(organization_id, subject_type, subject_id,\n *    form_id, consent_field_key)` as `superseded` with a back-pointer.\n *  - Tenant-scoped: every read filters by `organization_id` AND `tenant_id`.\n *  - Fail-soft is the SUBSCRIBER's responsibility \u2014 this service throws on\n *    real errors so they surface in tests; the subscriber swallows them so a\n *    projection failure never breaks the submit pipeline.\n */\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { FormConsentRecord } from '../data/entities'\nimport type { FormVersion, FormSubmission } from '../data/entities'\nimport type { FormVersionCompiler } from './form-version-compiler'\nimport { SIGNATURE_TYPE_KEY, type SignatureValue } from '../schema/signature-field'\n\nexport type ConsentProjectionLoad = {\n  submission: Pick<FormSubmission, 'id' | 'organizationId' | 'subjectType' | 'subjectId' | 'status'>\n  formVersion: Pick<FormVersion, 'id' | 'formId' | 'versionNumber' | 'schema' | 'uiSchema' | 'updatedAt'>\n  decodedData: Record<string, unknown>\n}\n\nexport type ConsentProjectionLoader = (args: {\n  submissionId: string\n  organizationId: string\n  tenantId: string\n}) => Promise<ConsentProjectionLoad | null>\n\nexport type ConsentRecordServiceDeps = {\n  emFactory: () => EntityManager\n  compiler: Pick<FormVersionCompiler, 'compile'>\n  loadSubmission: ConsentProjectionLoader\n  now?: () => Date\n}\n\nconst SHA256_HEX_PATTERN = /^[a-f0-9]{64}$/\n\nfunction readSignatureValue(value: unknown): SignatureValue | null {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) return null\n  const candidate = value as Record<string, unknown>\n  if (candidate.mode !== 'drawn' && candidate.mode !== 'typed') return null\n  if (typeof candidate.clauseSha256 !== 'string' || !SHA256_HEX_PATTERN.test(candidate.clauseSha256)) return null\n  if (typeof candidate.signedAt !== 'string' || Number.isNaN(Date.parse(candidate.signedAt))) return null\n  return candidate as unknown as SignatureValue\n}\n\nexport class ConsentRecordService {\n  private readonly emFactory: () => EntityManager\n  private readonly compiler: Pick<FormVersionCompiler, 'compile'>\n  private readonly loadSubmission: ConsentProjectionLoader\n  private readonly now: () => Date\n\n  constructor(deps: ConsentRecordServiceDeps) {\n    this.emFactory = deps.emFactory\n    this.compiler = deps.compiler\n    this.loadSubmission = deps.loadSubmission\n    this.now = deps.now ?? (() => new Date())\n  }\n\n  /**\n   * Projects every signed signature field on the submission into the consent\n   * aggregate. Returns the records created (empty when there are no signature\n   * fields, no signed values, or every clause is already recorded).\n   */\n  async projectFromSubmission(args: {\n    submissionId: string\n    organizationId: string\n    tenantId: string\n  }): Promise<FormConsentRecord[]> {\n    const loaded = await this.loadSubmission(args)\n    if (!loaded) return []\n    const { submission, formVersion, decodedData } = loaded\n    if (submission.status !== 'submitted') return []\n\n    const compiled = this.compiler.compile({\n      id: formVersion.id,\n      updatedAt: formVersion.updatedAt,\n      schema: formVersion.schema,\n      uiSchema: formVersion.uiSchema,\n    })\n\n    const signatureFieldKeys = Object.values(compiled.fieldIndex)\n      .filter((descriptor) => descriptor.type === SIGNATURE_TYPE_KEY)\n      .map((descriptor) => descriptor.key)\n    if (signatureFieldKeys.length === 0) return []\n\n    const em = this.emFactory()\n    const created: FormConsentRecord[] = []\n\n    for (const consentFieldKey of signatureFieldKeys) {\n      const signature = readSignatureValue(decodedData[consentFieldKey])\n      if (!signature) continue\n\n      // Idempotency: never project the same (submission, field) twice.\n      const existing = await em.findOne(FormConsentRecord, {\n        submissionId: submission.id,\n        organizationId: args.organizationId,\n        consentFieldKey,\n      })\n      if (existing) continue\n\n      const nowDate = this.now()\n      const record = em.create(FormConsentRecord, {\n        organizationId: args.organizationId,\n        tenantId: args.tenantId,\n        subjectType: submission.subjectType,\n        subjectId: submission.subjectId,\n        formId: formVersion.formId,\n        formVersionId: formVersion.id,\n        versionNumber: formVersion.versionNumber,\n        submissionId: submission.id,\n        consentFieldKey,\n        clauseSha256: signature.clauseSha256,\n        signedAt: new Date(signature.signedAt),\n        status: 'active',\n        supersededByRecordId: null,\n        supersededAt: null,\n        createdAt: nowDate,\n        updatedAt: nowDate,\n      })\n      em.persist(record)\n\n      // Supersede any prior active record for the same subject + form + clause.\n      const priorActive = await em.find(FormConsentRecord, {\n        organizationId: args.organizationId,\n        tenantId: args.tenantId,\n        subjectType: submission.subjectType,\n        subjectId: submission.subjectId,\n        formId: formVersion.formId,\n        consentFieldKey,\n        status: 'active',\n      })\n      for (const prior of priorActive) {\n        if (prior === record) continue\n        prior.status = 'superseded'\n        prior.supersededByRecordId = record.id\n        prior.supersededAt = nowDate\n        prior.updatedAt = nowDate\n        em.persist(prior)\n      }\n\n      created.push(record)\n    }\n\n    if (created.length > 0) {\n      await em.flush()\n    }\n    return created\n  }\n}\n"],
+  "mappings": "AAuBA,SAAS,yBAAyB;AAGlC,SAAS,0BAA+C;AAqBxD,MAAM,qBAAqB;AAE3B,SAAS,mBAAmB,OAAuC;AACjE,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,YAAY;AAClB,MAAI,UAAU,SAAS,WAAW,UAAU,SAAS,QAAS,QAAO;AACrE,MAAI,OAAO,UAAU,iBAAiB,YAAY,CAAC,mBAAmB,KAAK,UAAU,YAAY,EAAG,QAAO;AAC3G,MAAI,OAAO,UAAU,aAAa,YAAY,OAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,CAAC,EAAG,QAAO;AACnG,SAAO;AACT;AAEO,MAAM,qBAAqB;AAAA,EAMhC,YAAY,MAAgC;AAC1C,SAAK,YAAY,KAAK;AACtB,SAAK,WAAW,KAAK;AACrB,SAAK,iBAAiB,KAAK;AAC3B,SAAK,MAAM,KAAK,QAAQ,MAAM,oBAAI,KAAK;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,sBAAsB,MAIK;AAC/B,UAAM,SAAS,MAAM,KAAK,eAAe,IAAI;AAC7C,QAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,UAAM,EAAE,YAAY,aAAa,YAAY,IAAI;AACjD,QAAI,WAAW,WAAW,YAAa,QAAO,CAAC;AAE/C,UAAM,WAAW,KAAK,SAAS,QAAQ;AAAA,MACrC,IAAI,YAAY;AAAA,MAChB,WAAW,YAAY;AAAA,MACvB,QAAQ,YAAY;AAAA,MACpB,UAAU,YAAY;AAAA,IACxB,CAAC;AAED,UAAM,qBAAqB,OAAO,OAAO,SAAS,UAAU,EACzD,OAAO,CAAC,eAAe,WAAW,SAAS,kBAAkB,EAC7D,IAAI,CAAC,eAAe,WAAW,GAAG;AACrC,QAAI,mBAAmB,WAAW,EAAG,QAAO,CAAC;AAE7C,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,UAA+B,CAAC;AAEtC,eAAW,mBAAmB,oBAAoB;AAChD,YAAM,YAAY,mBAAmB,YAAY,eAAe,CAAC;AACjE,UAAI,CAAC,UAAW;AAGhB,YAAM,WAAW,MAAM,GAAG,QAAQ,mBAAmB;AAAA,QACnD,cAAc,WAAW;AAAA,QACzB,gBAAgB,KAAK;AAAA,QACrB;AAAA,MACF,CAAC;AACD,UAAI,SAAU;AAEd,YAAM,UAAU,KAAK,IAAI;AACzB,YAAM,SAAS,GAAG,OAAO,mBAAmB;AAAA,QAC1C,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,aAAa,WAAW;AAAA,QACxB,WAAW,WAAW;AAAA,QACtB,QAAQ,YAAY;AAAA,QACpB,eAAe,YAAY;AAAA,QAC3B,eAAe,YAAY;AAAA,QAC3B,cAAc,WAAW;AAAA,QACzB;AAAA,QACA,cAAc,UAAU;AAAA,QACxB,UAAU,IAAI,KAAK,UAAU,QAAQ;AAAA,QACrC,QAAQ;AAAA,QACR,sBAAsB;AAAA,QACtB,cAAc;AAAA,QACd,WAAW;AAAA,QACX,WAAW;AAAA,MACb,CAAC;AACD,SAAG,QAAQ,MAAM;AAGjB,YAAM,cAAc,MAAM,GAAG,KAAK,mBAAmB;AAAA,QACnD,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,aAAa,WAAW;AAAA,QACxB,WAAW,WAAW;AAAA,QACtB,QAAQ,YAAY;AAAA,QACpB;AAAA,QACA,QAAQ;AAAA,MACV,CAAC;AACD,iBAAW,SAAS,aAAa;AAC/B,YAAI,UAAU,OAAQ;AACtB,cAAM,SAAS;AACf,cAAM,uBAAuB,OAAO;AACpC,cAAM,eAAe;AACrB,cAAM,YAAY;AAClB,WAAG,QAAQ,KAAK;AAAA,MAClB;AAEA,cAAQ,KAAK,MAAM;AAAA,IACrB;AAEA,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,GAAG,MAAM;AAAA,IACjB;AACA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}