@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/forms/widgets/injection/access-audit-panel/widget.js

@@ -0,0 +1,100 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { History } from "lucide-react";
+import { Spinner } from "@open-mercato/ui/primitives/spinner";
+import { Tag } from "@open-mercato/ui/primitives/tag";
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import {
+  FORMS_DRAWER_REFRESH_EVENT
+} from "../context.js";
+import {
+  formatAuditRows
+} from "../audit-format.js";
+const PURPOSE_VARIANT = {
+  view: "info",
+  export: "success",
+  revert: "warning",
+  reopen: "warning",
+  anonymize: "error"
+};
+function AccessAuditPanelWidget({ context }) {
+  const t = useT();
+  const submissionId = typeof context?.submissionId === "string" ? context.submissionId : null;
+  const [rows, setRows] = React.useState([]);
+  const [isLoading, setIsLoading] = React.useState(true);
+  const load = React.useCallback(async () => {
+    if (!submissionId) {
+      setRows([]);
+      setIsLoading(false);
+      return;
+    }
+    setIsLoading(true);
+    const resp = await apiCall(
+      `/api/forms/submissions/${encodeURIComponent(submissionId)}/access-audit`
+    );
+    setRows(resp.ok && resp.result ? formatAuditRows(resp.result.items) : []);
+    setIsLoading(false);
+  }, [submissionId]);
+  React.useEffect(() => {
+    void load();
+  }, [load]);
+  React.useEffect(() => {
+    if (typeof window === "undefined") return;
+    const handler = () => {
+      void load();
+    };
+    window.addEventListener(FORMS_DRAWER_REFRESH_EVENT, handler);
+    return () => window.removeEventListener(FORMS_DRAWER_REFRESH_EVENT, handler);
+  }, [load]);
+  if (!submissionId) return null;
+  return /* @__PURE__ */ jsxs(
+    "section",
+    {
+      "aria-label": t("forms.compliance.audit.title", { fallback: "Access audit" }),
+      className: "flex flex-col gap-2 rounded-md border border-border bg-card p-3",
+      "data-forms-access-audit-panel": "",
+      children: [
+        /* @__PURE__ */ jsxs("header", { className: "flex items-center gap-2", children: [
+          /* @__PURE__ */ jsx(History, { className: "h-4 w-4 text-muted-foreground", "aria-hidden": "true" }),
+          /* @__PURE__ */ jsx("h3", { className: "text-xs font-semibold uppercase tracking-wide text-muted-foreground", children: t("forms.compliance.audit.title", { fallback: "Access audit" }) })
+        ] }),
+        isLoading ? /* @__PURE__ */ jsx("div", { className: "flex items-center justify-center py-4", children: /* @__PURE__ */ jsx(Spinner, { className: "h-4 w-4" }) }) : rows.length === 0 ? /* @__PURE__ */ jsx("p", { className: "rounded-md border border-dashed border-border p-3 text-xs text-muted-foreground", children: t("forms.compliance.audit.empty", { fallback: "No access events recorded yet." }) }) : /* @__PURE__ */ jsx("ul", { className: "flex flex-col gap-1", children: rows.map((row) => /* @__PURE__ */ jsxs(
+          "li",
+          {
+            className: "flex items-center justify-between gap-2 rounded-md border border-border px-2 py-1.5 text-xs",
+            children: [
+              /* @__PURE__ */ jsxs("div", { className: "flex min-w-0 flex-col", children: [
+                /* @__PURE__ */ jsx("span", { className: "truncate font-mono text-muted-foreground", children: row.actorShort }),
+                row.timestampMs != null ? /* @__PURE__ */ jsx("time", { className: "text-muted-foreground", dateTime: new Date(row.timestampMs).toISOString(), children: new Date(row.timestampMs).toLocaleString() }) : null
+              ] }),
+              /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
+                row.ip ? /* @__PURE__ */ jsx("span", { className: "font-mono text-muted-foreground", children: row.ip }) : null,
+                /* @__PURE__ */ jsx(Tag, { variant: PURPOSE_VARIANT[row.purpose], dot: true, children: t(row.purposeKey, { fallback: row.purpose }) })
+              ] })
+            ]
+          },
+          row.id
+        )) })
+      ]
+    }
+  );
+}
+const widget = {
+  metadata: {
+    id: "forms.injection.access-audit-panel",
+    title: "Forms Submission Access Audit Panel",
+    description: "Lists the access-audit trail (who/when/purpose/IP) for a submission inside the drawer; reloads on the drawer refresh event.",
+    features: ["forms.view"],
+    priority: 100,
+    enabled: true
+  },
+  Widget: AccessAuditPanelWidget
+};
+var widget_default = widget;
+export {
+  AccessAuditPanelWidget,
+  widget_default as default
+};
+//# sourceMappingURL=widget.js.map

package/dist/modules/forms/widgets/injection/access-audit-panel/widget.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/widgets/injection/access-audit-panel/widget.tsx"],
+  "sourcesContent": ["\"use client\"\n\n/**\n * Phase 2b \u2014 AccessAuditPanel injection widget.\n *\n * Mounts into the submission drawer's `submission-drawer:access-audit` spot.\n * Fetches the access-audit trail for the submission from\n * `GET /api/forms/submissions/:submissionId/access-audit` and renders each row\n * (actor / when / purpose / IP). Shows an empty state when no rows exist.\n *\n * Read-only \u2014 no mutation, so it does not need `useGuardedMutation`. Uses\n * `apiCall` (never raw fetch). Feature-gated behind `forms.view` to match the\n * server route. Re-fetches when the host drawer fires the shared refresh event\n * (e.g. after anonymization changes the trail).\n */\n\nimport * as React from 'react'\nimport { History } from 'lucide-react'\nimport type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { Tag } from '@open-mercato/ui/primitives/tag'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport {\n  FORMS_DRAWER_REFRESH_EVENT,\n  type FormsDrawerWidgetContext,\n} from '../context'\nimport {\n  formatAuditRows,\n  type AccessAuditApiRow,\n  type AccessAuditPurpose,\n  type FormattedAuditRow,\n} from '../audit-format'\n\ntype AccessAuditPanelProps = {\n  context: FormsDrawerWidgetContext\n}\n\nconst PURPOSE_VARIANT: Record<AccessAuditPurpose, 'info' | 'success' | 'warning' | 'error' | 'neutral'> = {\n  view: 'info',\n  export: 'success',\n  revert: 'warning',\n  reopen: 'warning',\n  anonymize: 'error',\n}\n\nexport function AccessAuditPanelWidget({ context }: AccessAuditPanelProps) {\n  const t = useT()\n  const submissionId = typeof context?.submissionId === 'string' ? context.submissionId : null\n  const [rows, setRows] = React.useState<FormattedAuditRow[]>([])\n  const [isLoading, setIsLoading] = React.useState(true)\n\n  const load = React.useCallback(async () => {\n    if (!submissionId) {\n      setRows([])\n      setIsLoading(false)\n      return\n    }\n    setIsLoading(true)\n    const resp = await apiCall<{ items: AccessAuditApiRow[] }>(\n      `/api/forms/submissions/${encodeURIComponent(submissionId)}/access-audit`,\n    )\n    setRows(resp.ok && resp.result ? formatAuditRows(resp.result.items) : [])\n    setIsLoading(false)\n  }, [submissionId])\n\n  React.useEffect(() => {\n    void load()\n  }, [load])\n\n  React.useEffect(() => {\n    if (typeof window === 'undefined') return\n    const handler = () => {\n      void load()\n    }\n    window.addEventListener(FORMS_DRAWER_REFRESH_EVENT, handler)\n    return () => window.removeEventListener(FORMS_DRAWER_REFRESH_EVENT, handler)\n  }, [load])\n\n  if (!submissionId) return null\n\n  return (\n    <section\n      aria-label={t('forms.compliance.audit.title', { fallback: 'Access audit' })}\n      className=\"flex flex-col gap-2 rounded-md border border-border bg-card p-3\"\n      data-forms-access-audit-panel=\"\"\n    >\n      <header className=\"flex items-center gap-2\">\n        <History className=\"h-4 w-4 text-muted-foreground\" aria-hidden=\"true\" />\n        <h3 className=\"text-xs font-semibold uppercase tracking-wide text-muted-foreground\">\n          {t('forms.compliance.audit.title', { fallback: 'Access audit' })}\n        </h3>\n      </header>\n      {isLoading ? (\n        <div className=\"flex items-center justify-center py-4\">\n          <Spinner className=\"h-4 w-4\" />\n        </div>\n      ) : rows.length === 0 ? (\n        <p className=\"rounded-md border border-dashed border-border p-3 text-xs text-muted-foreground\">\n          {t('forms.compliance.audit.empty', { fallback: 'No access events recorded yet.' })}\n        </p>\n      ) : (\n        <ul className=\"flex flex-col gap-1\">\n          {rows.map((row) => (\n            <li\n              key={row.id}\n              className=\"flex items-center justify-between gap-2 rounded-md border border-border px-2 py-1.5 text-xs\"\n            >\n              <div className=\"flex min-w-0 flex-col\">\n                <span className=\"truncate font-mono text-muted-foreground\">{row.actorShort}</span>\n                {row.timestampMs != null ? (\n                  <time className=\"text-muted-foreground\" dateTime={new Date(row.timestampMs).toISOString()}>\n                    {new Date(row.timestampMs).toLocaleString()}\n                  </time>\n                ) : null}\n              </div>\n              <div className=\"flex items-center gap-2\">\n                {row.ip ? <span className=\"font-mono text-muted-foreground\">{row.ip}</span> : null}\n                <Tag variant={PURPOSE_VARIANT[row.purpose]} dot>\n                  {t(row.purposeKey, { fallback: row.purpose })}\n                </Tag>\n              </div>\n            </li>\n          ))}\n        </ul>\n      )}\n    </section>\n  )\n}\n\nconst widget: InjectionWidgetModule<FormsDrawerWidgetContext> = {\n  metadata: {\n    id: 'forms.injection.access-audit-panel',\n    title: 'Forms Submission Access Audit Panel',\n    description:\n      'Lists the access-audit trail (who/when/purpose/IP) for a submission inside the drawer; reloads on the drawer refresh event.',\n    features: ['forms.view'],\n    priority: 100,\n    enabled: true,\n  },\n  Widget: AccessAuditPanelWidget,\n}\n\nexport default widget\n"],
+  "mappings": ";AAuFM,SACE,KADF;AAvEN,YAAY,WAAW;AACvB,SAAS,eAAe;AAExB,SAAS,eAAe;AACxB,SAAS,WAAW;AACpB,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,OAEK;AACP;AAAA,EACE;AAAA,OAIK;AAMP,MAAM,kBAAoG;AAAA,EACxG,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,WAAW;AACb;AAEO,SAAS,uBAAuB,EAAE,QAAQ,GAA0B;AACzE,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,OAAO,SAAS,iBAAiB,WAAW,QAAQ,eAAe;AACxF,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA8B,CAAC,CAAC;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AAErD,QAAM,OAAO,MAAM,YAAY,YAAY;AACzC,QAAI,CAAC,cAAc;AACjB,cAAQ,CAAC,CAAC;AACV,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,iBAAa,IAAI;AACjB,UAAM,OAAO,MAAM;AAAA,MACjB,0BAA0B,mBAAmB,YAAY,CAAC;AAAA,IAC5D;AACA,YAAQ,KAAK,MAAM,KAAK,SAAS,gBAAgB,KAAK,OAAO,KAAK,IAAI,CAAC,CAAC;AACxE,iBAAa,KAAK;AAAA,EACpB,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,UAAU,MAAM;AACpB,SAAK,KAAK;AAAA,EACZ,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,UAAU,MAAM;AACpB,QAAI,OAAO,WAAW,YAAa;AACnC,UAAM,UAAU,MAAM;AACpB,WAAK,KAAK;AAAA,IACZ;AACA,WAAO,iBAAiB,4BAA4B,OAAO;AAC3D,WAAO,MAAM,OAAO,oBAAoB,4BAA4B,OAAO;AAAA,EAC7E,GAAG,CAAC,IAAI,CAAC;AAET,MAAI,CAAC,aAAc,QAAO;AAE1B,SACE;AAAA,IAAC;AAAA;AAAA,MACC,cAAY,EAAE,gCAAgC,EAAE,UAAU,eAAe,CAAC;AAAA,MAC1E,WAAU;AAAA,MACV,iCAA8B;AAAA,MAE9B;AAAA,6BAAC,YAAO,WAAU,2BAChB;AAAA,8BAAC,WAAQ,WAAU,iCAAgC,eAAY,QAAO;AAAA,UACtE,oBAAC,QAAG,WAAU,uEACX,YAAE,gCAAgC,EAAE,UAAU,eAAe,CAAC,GACjE;AAAA,WACF;AAAA,QACC,YACC,oBAAC,SAAI,WAAU,yCACb,8BAAC,WAAQ,WAAU,WAAU,GAC/B,IACE,KAAK,WAAW,IAClB,oBAAC,OAAE,WAAU,mFACV,YAAE,gCAAgC,EAAE,UAAU,iCAAiC,CAAC,GACnF,IAEA,oBAAC,QAAG,WAAU,uBACX,eAAK,IAAI,CAAC,QACT;AAAA,UAAC;AAAA;AAAA,YAEC,WAAU;AAAA,YAEV;AAAA,mCAAC,SAAI,WAAU,yBACb;AAAA,oCAAC,UAAK,WAAU,4CAA4C,cAAI,YAAW;AAAA,gBAC1E,IAAI,eAAe,OAClB,oBAAC,UAAK,WAAU,yBAAwB,UAAU,IAAI,KAAK,IAAI,WAAW,EAAE,YAAY,GACrF,cAAI,KAAK,IAAI,WAAW,EAAE,eAAe,GAC5C,IACE;AAAA,iBACN;AAAA,cACA,qBAAC,SAAI,WAAU,2BACZ;AAAA,oBAAI,KAAK,oBAAC,UAAK,WAAU,mCAAmC,cAAI,IAAG,IAAU;AAAA,gBAC9E,oBAAC,OAAI,SAAS,gBAAgB,IAAI,OAAO,GAAG,KAAG,MAC5C,YAAE,IAAI,YAAY,EAAE,UAAU,IAAI,QAAQ,CAAC,GAC9C;AAAA,iBACF;AAAA;AAAA;AAAA,UAhBK,IAAI;AAAA,QAiBX,CACD,GACH;AAAA;AAAA;AAAA,EAEJ;AAEJ;AAEA,MAAM,SAA0D;AAAA,EAC9D,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,UAAU,CAAC,YAAY;AAAA,IACvB,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,QAAQ;AACV;AAEA,IAAO,iBAAQ;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection/anonymize-button/widget.js

@@ -0,0 +1,148 @@
+"use client";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { Trash2 } from "lucide-react";
+import { Button } from "@open-mercato/ui/primitives/button";
+import { Input } from "@open-mercato/ui/primitives/input";
+import { FormField } from "@open-mercato/ui/primitives/form-field";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle
+} from "@open-mercato/ui/primitives/dialog";
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { flash } from "@open-mercato/ui/backend/FlashMessages";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import {
+  FORMS_DRAWER_REFRESH_EVENT
+} from "../context.js";
+const CONFIRM_TOKEN = "DELETE";
+function AnonymizeButtonWidget({ context }) {
+  const t = useT();
+  const submissionId = typeof context?.submissionId === "string" ? context.submissionId : null;
+  const isAnonymized = context?.isAnonymized === true;
+  const [open, setOpen] = React.useState(false);
+  const [confirmText, setConfirmText] = React.useState("");
+  const [isLoading, setIsLoading] = React.useState(false);
+  const { runMutation } = useGuardedMutation({ contextId: "forms.submission.anonymize" });
+  const canSubmit = confirmText === CONFIRM_TOKEN && !isLoading && !!submissionId;
+  const handleSubmit = React.useCallback(async () => {
+    if (!submissionId || confirmText !== CONFIRM_TOKEN) return;
+    setIsLoading(true);
+    try {
+      await runMutation({
+        operation: () => apiCall(`/api/forms/submissions/${encodeURIComponent(submissionId)}/anonymize`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ confirm: CONFIRM_TOKEN })
+        }),
+        context: { submissionId },
+        mutationPayload: { confirm: CONFIRM_TOKEN }
+      }).then((resp) => {
+        if (!resp.ok) {
+          throw new Error("forms.compliance.anonymize.failed");
+        }
+      });
+      flash(t("forms.compliance.anonymize.success", { fallback: "Submission anonymized." }), "success");
+      setOpen(false);
+      setConfirmText("");
+      if (typeof window !== "undefined") {
+        window.dispatchEvent(new CustomEvent(FORMS_DRAWER_REFRESH_EVENT, { detail: { submissionId } }));
+      }
+    } catch {
+      flash(t("forms.compliance.anonymize.failed", { fallback: "Failed to anonymize submission." }), "error");
+    } finally {
+      setIsLoading(false);
+    }
+  }, [confirmText, runMutation, submissionId, t]);
+  const onKeyDown = React.useCallback(
+    (event) => {
+      if ((event.metaKey || event.ctrlKey) && event.key === "Enter") {
+        event.preventDefault();
+        if (canSubmit) void handleSubmit();
+      } else if (event.key === "Escape") {
+        event.preventDefault();
+        setOpen(false);
+      }
+    },
+    [canSubmit, handleSubmit]
+  );
+  if (!submissionId || isAnonymized) return null;
+  return /* @__PURE__ */ jsxs(Fragment, { children: [
+    /* @__PURE__ */ jsxs(
+      Button,
+      {
+        type: "button",
+        variant: "outline",
+        size: "sm",
+        onClick: () => setOpen(true),
+        "data-forms-anonymize-trigger": "",
+        children: [
+          /* @__PURE__ */ jsx(Trash2, { className: "mr-1 h-4 w-4 text-destructive", "aria-hidden": "true" }),
+          t("forms.compliance.anonymize.action", { fallback: "Anonymize" })
+        ]
+      }
+    ),
+    /* @__PURE__ */ jsx(Dialog, { open, onOpenChange: setOpen, children: /* @__PURE__ */ jsxs(DialogContent, { onKeyDown, "data-forms-anonymize-dialog": "", children: [
+      /* @__PURE__ */ jsxs(DialogHeader, { children: [
+        /* @__PURE__ */ jsx(DialogTitle, { children: t("forms.compliance.anonymize.title", { fallback: "Anonymize submission" }) }),
+        /* @__PURE__ */ jsx(DialogDescription, { children: t("forms.compliance.anonymize.warning", {
+          fallback: "This is irreversible. All sensitive answers will be replaced with a tombstone token. Audit rows and actor assignments survive."
+        }) })
+      ] }),
+      /* @__PURE__ */ jsx(
+        FormField,
+        {
+          label: t("forms.compliance.anonymize.typed_confirmation", { fallback: "Type DELETE to confirm" }),
+          required: true,
+          children: /* @__PURE__ */ jsx(
+            Input,
+            {
+              value: confirmText,
+              onChange: (event) => setConfirmText(event.target.value),
+              placeholder: CONFIRM_TOKEN,
+              autoComplete: "off",
+              "data-forms-anonymize-confirm": ""
+            }
+          )
+        }
+      ),
+      /* @__PURE__ */ jsxs(DialogFooter, { children: [
+        /* @__PURE__ */ jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: () => setOpen(false), children: t("forms.actor.cancel", { fallback: "Cancel" }) }),
+        /* @__PURE__ */ jsx(
+          Button,
+          {
+            type: "button",
+            variant: "destructive",
+            size: "sm",
+            disabled: !canSubmit,
+            onClick: handleSubmit,
+            "data-forms-anonymize-submit": "",
+            children: t("forms.compliance.anonymize.action", { fallback: "Anonymize" })
+          }
+        )
+      ] })
+    ] }) })
+  ] });
+}
+const widget = {
+  metadata: {
+    id: "forms.injection.anonymize-button",
+    title: "Forms Submission Anonymize Button",
+    description: "Typed-confirmation anonymize action mounted in the submission drawer; POSTs to the anonymize endpoint and refreshes the drawer on success.",
+    features: ["forms.submissions.anonymize"],
+    priority: 100,
+    enabled: true
+  },
+  Widget: AnonymizeButtonWidget
+};
+var widget_default = widget;
+export {
+  AnonymizeButtonWidget,
+  widget_default as default
+};
+//# sourceMappingURL=widget.js.map

package/dist/modules/forms/widgets/injection/anonymize-button/widget.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/widgets/injection/anonymize-button/widget.tsx"],
+  "sourcesContent": ["\"use client\"\n\n/**\n * Phase 2b \u2014 AnonymizeButton injection widget.\n *\n * Mounts into the submission drawer's `submission-drawer:anonymize-action`\n * spot. Renders a destructive \"Anonymize\" button that opens a typed-confirmation\n * dialog (the operator types `DELETE`) and then POSTs to\n * `/api/forms/submissions/:submissionId/anonymize` with `{ confirm: 'DELETE' }`.\n *\n * - Feature-gated behind `forms.submissions.anonymize` (declared in metadata;\n *   the API route enforces it server-side too \u2014 fail-closed).\n * - Hidden once the submission is already anonymized (irreversible; no re-run).\n * - Writes go through `useGuardedMutation(...).runMutation(...)` per the\n *   non-CrudForm mutation contract, with `apiCall` (never raw fetch).\n * - On success flashes and asks the host drawer to refresh via a DOM event so\n *   the drawer reloads the now-anonymized state.\n */\n\nimport * as React from 'react'\nimport { Trash2 } from 'lucide-react'\nimport type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { FormField } from '@open-mercato/ui/primitives/form-field'\nimport {\n  Dialog,\n  DialogContent,\n  DialogDescription,\n  DialogFooter,\n  DialogHeader,\n  DialogTitle,\n} from '@open-mercato/ui/primitives/dialog'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport {\n  FORMS_DRAWER_REFRESH_EVENT,\n  type FormsDrawerWidgetContext,\n} from '../context'\n\nconst CONFIRM_TOKEN = 'DELETE'\n\ntype AnonymizeButtonProps = {\n  context: FormsDrawerWidgetContext\n}\n\nexport function AnonymizeButtonWidget({ context }: AnonymizeButtonProps) {\n  const t = useT()\n  const submissionId = typeof context?.submissionId === 'string' ? context.submissionId : null\n  const isAnonymized = context?.isAnonymized === true\n  const [open, setOpen] = React.useState(false)\n  const [confirmText, setConfirmText] = React.useState('')\n  const [isLoading, setIsLoading] = React.useState(false)\n  const { runMutation } = useGuardedMutation({ contextId: 'forms.submission.anonymize' })\n\n  const canSubmit = confirmText === CONFIRM_TOKEN && !isLoading && !!submissionId\n\n  const handleSubmit = React.useCallback(async () => {\n    if (!submissionId || confirmText !== CONFIRM_TOKEN) return\n    setIsLoading(true)\n    try {\n      await runMutation({\n        operation: () =>\n          apiCall(`/api/forms/submissions/${encodeURIComponent(submissionId)}/anonymize`, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ confirm: CONFIRM_TOKEN }),\n          }),\n        context: { submissionId },\n        mutationPayload: { confirm: CONFIRM_TOKEN },\n      }).then((resp) => {\n        if (!resp.ok) {\n          throw new Error('forms.compliance.anonymize.failed')\n        }\n      })\n      flash(t('forms.compliance.anonymize.success', { fallback: 'Submission anonymized.' }), 'success')\n      setOpen(false)\n      setConfirmText('')\n      if (typeof window !== 'undefined') {\n        window.dispatchEvent(new CustomEvent(FORMS_DRAWER_REFRESH_EVENT, { detail: { submissionId } }))\n      }\n    } catch {\n      flash(t('forms.compliance.anonymize.failed', { fallback: 'Failed to anonymize submission.' }), 'error')\n    } finally {\n      setIsLoading(false)\n    }\n  }, [confirmText, runMutation, submissionId, t])\n\n  const onKeyDown = React.useCallback(\n    (event: React.KeyboardEvent) => {\n      if ((event.metaKey || event.ctrlKey) && event.key === 'Enter') {\n        event.preventDefault()\n        if (canSubmit) void handleSubmit()\n      } else if (event.key === 'Escape') {\n        event.preventDefault()\n        setOpen(false)\n      }\n    },\n    [canSubmit, handleSubmit],\n  )\n\n  if (!submissionId || isAnonymized) return null\n\n  return (\n    <>\n      <Button\n        type=\"button\"\n        variant=\"outline\"\n        size=\"sm\"\n        onClick={() => setOpen(true)}\n        data-forms-anonymize-trigger=\"\"\n      >\n        <Trash2 className=\"mr-1 h-4 w-4 text-destructive\" aria-hidden=\"true\" />\n        {t('forms.compliance.anonymize.action', { fallback: 'Anonymize' })}\n      </Button>\n      <Dialog open={open} onOpenChange={setOpen}>\n        <DialogContent onKeyDown={onKeyDown} data-forms-anonymize-dialog=\"\">\n          <DialogHeader>\n            <DialogTitle>\n              {t('forms.compliance.anonymize.title', { fallback: 'Anonymize submission' })}\n            </DialogTitle>\n            <DialogDescription>\n              {t('forms.compliance.anonymize.warning', {\n                fallback:\n                  'This is irreversible. All sensitive answers will be replaced with a tombstone token. Audit rows and actor assignments survive.',\n              })}\n            </DialogDescription>\n          </DialogHeader>\n          <FormField\n            label={t('forms.compliance.anonymize.typed_confirmation', { fallback: 'Type DELETE to confirm' })}\n            required\n          >\n            <Input\n              value={confirmText}\n              onChange={(event) => setConfirmText(event.target.value)}\n              placeholder={CONFIRM_TOKEN}\n              autoComplete=\"off\"\n              data-forms-anonymize-confirm=\"\"\n            />\n          </FormField>\n          <DialogFooter>\n            <Button type=\"button\" variant=\"ghost\" size=\"sm\" onClick={() => setOpen(false)}>\n              {t('forms.actor.cancel', { fallback: 'Cancel' })}\n            </Button>\n            <Button\n              type=\"button\"\n              variant=\"destructive\"\n              size=\"sm\"\n              disabled={!canSubmit}\n              onClick={handleSubmit}\n              data-forms-anonymize-submit=\"\"\n            >\n              {t('forms.compliance.anonymize.action', { fallback: 'Anonymize' })}\n            </Button>\n          </DialogFooter>\n        </DialogContent>\n      </Dialog>\n    </>\n  )\n}\n\nconst widget: InjectionWidgetModule<FormsDrawerWidgetContext> = {\n  metadata: {\n    id: 'forms.injection.anonymize-button',\n    title: 'Forms Submission Anonymize Button',\n    description:\n      'Typed-confirmation anonymize action mounted in the submission drawer; POSTs to the anonymize endpoint and refreshes the drawer on success.',\n    features: ['forms.submissions.anonymize'],\n    priority: 100,\n    enabled: true,\n  },\n  Widget: AnonymizeButtonWidget,\n}\n\nexport default widget\n"],
+  "mappings": ";AA0GI,mBAQI,KAPF,YADF;AAvFJ,YAAY,WAAW;AACvB,SAAS,cAAc;AAEvB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,OAEK;AAEP,MAAM,gBAAgB;AAMf,SAAS,sBAAsB,EAAE,QAAQ,GAAyB;AACvE,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,OAAO,SAAS,iBAAiB,WAAW,QAAQ,eAAe;AACxF,QAAM,eAAe,SAAS,iBAAiB;AAC/C,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,EAAE,YAAY,IAAI,mBAAmB,EAAE,WAAW,6BAA6B,CAAC;AAEtF,QAAM,YAAY,gBAAgB,iBAAiB,CAAC,aAAa,CAAC,CAAC;AAEnE,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,gBAAgB,gBAAgB,cAAe;AACpD,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,MACT,QAAQ,0BAA0B,mBAAmB,YAAY,CAAC,cAAc;AAAA,UAC9E,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,cAAc,CAAC;AAAA,QACjD,CAAC;AAAA,QACH,SAAS,EAAE,aAAa;AAAA,QACxB,iBAAiB,EAAE,SAAS,cAAc;AAAA,MAC5C,CAAC,EAAE,KAAK,CAAC,SAAS;AAChB,YAAI,CAAC,KAAK,IAAI;AACZ,gBAAM,IAAI,MAAM,mCAAmC;AAAA,QACrD;AAAA,MACF,CAAC;AACD,YAAM,EAAE,sCAAsC,EAAE,UAAU,yBAAyB,CAAC,GAAG,SAAS;AAChG,cAAQ,KAAK;AACb,qBAAe,EAAE;AACjB,UAAI,OAAO,WAAW,aAAa;AACjC,eAAO,cAAc,IAAI,YAAY,4BAA4B,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;AAAA,MAChG;AAAA,IACF,QAAQ;AACN,YAAM,EAAE,qCAAqC,EAAE,UAAU,kCAAkC,CAAC,GAAG,OAAO;AAAA,IACxG,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,aAAa,aAAa,cAAc,CAAC,CAAC;AAE9C,QAAM,YAAY,MAAM;AAAA,IACtB,CAAC,UAA+B;AAC9B,WAAK,MAAM,WAAW,MAAM,YAAY,MAAM,QAAQ,SAAS;AAC7D,cAAM,eAAe;AACrB,YAAI,UAAW,MAAK,aAAa;AAAA,MACnC,WAAW,MAAM,QAAQ,UAAU;AACjC,cAAM,eAAe;AACrB,gBAAQ,KAAK;AAAA,MACf;AAAA,IACF;AAAA,IACA,CAAC,WAAW,YAAY;AAAA,EAC1B;AAEA,MAAI,CAAC,gBAAgB,aAAc,QAAO;AAE1C,SACE,iCACE;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,SAAS,MAAM,QAAQ,IAAI;AAAA,QAC3B,gCAA6B;AAAA,QAE7B;AAAA,8BAAC,UAAO,WAAU,iCAAgC,eAAY,QAAO;AAAA,UACpE,EAAE,qCAAqC,EAAE,UAAU,YAAY,CAAC;AAAA;AAAA;AAAA,IACnE;AAAA,IACA,oBAAC,UAAO,MAAY,cAAc,SAChC,+BAAC,iBAAc,WAAsB,+BAA4B,IAC/D;AAAA,2BAAC,gBACC;AAAA,4BAAC,eACE,YAAE,oCAAoC,EAAE,UAAU,uBAAuB,CAAC,GAC7E;AAAA,QACA,oBAAC,qBACE,YAAE,sCAAsC;AAAA,UACvC,UACE;AAAA,QACJ,CAAC,GACH;AAAA,SACF;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,OAAO,EAAE,iDAAiD,EAAE,UAAU,yBAAyB,CAAC;AAAA,UAChG,UAAQ;AAAA,UAER;AAAA,YAAC;AAAA;AAAA,cACC,OAAO;AAAA,cACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,cACtD,aAAa;AAAA,cACb,cAAa;AAAA,cACb,gCAA6B;AAAA;AAAA,UAC/B;AAAA;AAAA,MACF;AAAA,MACA,qBAAC,gBACC;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,MAAK,MAAK,SAAS,MAAM,QAAQ,KAAK,GACzE,YAAE,sBAAsB,EAAE,UAAU,SAAS,CAAC,GACjD;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,SAAQ;AAAA,YACR,MAAK;AAAA,YACL,UAAU,CAAC;AAAA,YACX,SAAS;AAAA,YACT,+BAA4B;AAAA,YAE3B,YAAE,qCAAqC,EAAE,UAAU,YAAY,CAAC;AAAA;AAAA,QACnE;AAAA,SACF;AAAA,OACF,GACF;AAAA,KACF;AAEJ;AAEA,MAAM,SAA0D;AAAA,EAC9D,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,UAAU,CAAC,6BAA6B;AAAA,IACxC,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,QAAQ;AACV;AAEA,IAAO,iBAAQ;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection/audit-format.js

@@ -0,0 +1,33 @@
+const PURPOSES = /* @__PURE__ */ new Set(["view", "export", "revert", "anonymize", "reopen"]);
+function shortenActor(accessedBy) {
+  if (typeof accessedBy !== "string" || accessedBy.length === 0) return "system";
+  return accessedBy.length > 8 ? `${accessedBy.slice(0, 8)}\u2026` : accessedBy;
+}
+function parseTimestamp(value) {
+  const ms = Date.parse(value);
+  return Number.isNaN(ms) ? null : ms;
+}
+function isAccessAuditPurpose(value) {
+  return typeof value === "string" && PURPOSES.has(value);
+}
+function formatAuditRow(row) {
+  const purpose = isAccessAuditPurpose(row.accessPurpose) ? row.accessPurpose : "view";
+  return {
+    id: row.id,
+    actorShort: shortenActor(row.accessedBy),
+    purpose,
+    purposeKey: `forms.compliance.audit.purpose.${purpose}`,
+    timestampMs: typeof row.accessedAt === "string" ? parseTimestamp(row.accessedAt) : null,
+    ip: typeof row.ip === "string" && row.ip.length > 0 ? row.ip : null
+  };
+}
+function formatAuditRows(rows) {
+  if (!Array.isArray(rows)) return [];
+  return rows.map(formatAuditRow);
+}
+export {
+  formatAuditRow,
+  formatAuditRows,
+  isAccessAuditPurpose
+};
+//# sourceMappingURL=audit-format.js.map

package/dist/modules/forms/widgets/injection/audit-format.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/forms/widgets/injection/audit-format.ts"],
+  "sourcesContent": ["/**\n * Phase 2b \u2014 pure formatting helpers for the AccessAuditPanel injection widget.\n *\n * Kept dependency-free (no React, no I/O) so the row-shaping logic is unit\n * testable in isolation. The panel renders the access-audit trail returned by\n * `GET /api/forms/submissions/:submissionId/access-audit`.\n */\n\nexport type AccessAuditPurpose = 'view' | 'export' | 'revert' | 'anonymize' | 'reopen'\n\nexport type AccessAuditApiRow = {\n  id: string\n  accessedBy: string\n  accessedAt: string\n  accessPurpose: AccessAuditPurpose\n  ip: string | null\n  revisionId: string | null\n}\n\nexport type FormattedAuditRow = {\n  id: string\n  actorShort: string\n  purpose: AccessAuditPurpose\n  purposeKey: string\n  timestampMs: number | null\n  ip: string | null\n}\n\nconst PURPOSES: ReadonlySet<string> = new Set(['view', 'export', 'revert', 'anonymize', 'reopen'])\n\nfunction shortenActor(accessedBy: string): string {\n  if (typeof accessedBy !== 'string' || accessedBy.length === 0) return 'system'\n  return accessedBy.length > 8 ? `${accessedBy.slice(0, 8)}\u2026` : accessedBy\n}\n\nfunction parseTimestamp(value: string): number | null {\n  const ms = Date.parse(value)\n  return Number.isNaN(ms) ? null : ms\n}\n\nexport function isAccessAuditPurpose(value: unknown): value is AccessAuditPurpose {\n  return typeof value === 'string' && PURPOSES.has(value)\n}\n\nexport function formatAuditRow(row: AccessAuditApiRow): FormattedAuditRow {\n  const purpose: AccessAuditPurpose = isAccessAuditPurpose(row.accessPurpose) ? row.accessPurpose : 'view'\n  return {\n    id: row.id,\n    actorShort: shortenActor(row.accessedBy),\n    purpose,\n    purposeKey: `forms.compliance.audit.purpose.${purpose}`,\n    timestampMs: typeof row.accessedAt === 'string' ? parseTimestamp(row.accessedAt) : null,\n    ip: typeof row.ip === 'string' && row.ip.length > 0 ? row.ip : null,\n  }\n}\n\nexport function formatAuditRows(rows: AccessAuditApiRow[]): FormattedAuditRow[] {\n  if (!Array.isArray(rows)) return []\n  return rows.map(formatAuditRow)\n}\n"],
+  "mappings": "AA4BA,MAAM,WAAgC,oBAAI,IAAI,CAAC,QAAQ,UAAU,UAAU,aAAa,QAAQ,CAAC;AAEjG,SAAS,aAAa,YAA4B;AAChD,MAAI,OAAO,eAAe,YAAY,WAAW,WAAW,EAAG,QAAO;AACtE,SAAO,WAAW,SAAS,IAAI,GAAG,WAAW,MAAM,GAAG,CAAC,CAAC,WAAM;AAChE;AAEA,SAAS,eAAe,OAA8B;AACpD,QAAM,KAAK,KAAK,MAAM,KAAK;AAC3B,SAAO,OAAO,MAAM,EAAE,IAAI,OAAO;AACnC;AAEO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,OAAO,UAAU,YAAY,SAAS,IAAI,KAAK;AACxD;AAEO,SAAS,eAAe,KAA2C;AACxE,QAAM,UAA8B,qBAAqB,IAAI,aAAa,IAAI,IAAI,gBAAgB;AAClG,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,YAAY,aAAa,IAAI,UAAU;AAAA,IACvC;AAAA,IACA,YAAY,kCAAkC,OAAO;AAAA,IACrD,aAAa,OAAO,IAAI,eAAe,WAAW,eAAe,IAAI,UAAU,IAAI;AAAA,IACnF,IAAI,OAAO,IAAI,OAAO,YAAY,IAAI,GAAG,SAAS,IAAI,IAAI,KAAK;AAAA,EACjE;AACF;AAEO,SAAS,gBAAgB,MAAgD;AAC9E,MAAI,CAAC,MAAM,QAAQ,IAAI,EAAG,QAAO,CAAC;AAClC,SAAO,KAAK,IAAI,cAAc;AAChC;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection/context.js

@@ -0,0 +1,5 @@
+import { FORMS_DRAWER_REFRESH_EVENT } from "../../backend/forms/[id]/submissions/components/SubmissionDrawer.js";
+export {
+  FORMS_DRAWER_REFRESH_EVENT
+};
+//# sourceMappingURL=context.js.map

package/dist/modules/forms/widgets/injection/context.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/forms/widgets/injection/context.ts"],
+  "sourcesContent": ["/**\n * Phase 2b \u2014 shared types + constants for the submission-drawer injection\n * widgets (AnonymizeButton, AccessAuditPanel, SelfAuditFooter,\n * PdfDownloadButton).\n *\n * The host drawer (`SubmissionDrawer.tsx`) passes a `DrawerInjectionContext`\n * into every spot. The injection runtime additionally merges a `sharedState`\n * bag into the context object, so widgets accept the host shape plus that\n * optional field \u2014 never `any`.\n */\n\nimport type { DrawerInjectionContext } from '../../backend/forms/[id]/submissions/components/SubmissionDrawer'\n\nexport type FormsDrawerWidgetContext = DrawerInjectionContext & {\n  sharedState?: Record<string, unknown>\n}\n\n/**\n * DOM event the widgets fire after a successful mutation so the host drawer can\n * reload. The drawer listens for it and re-fetches the submission detail. The\n * canonical string lives on the drawer module (single source of truth); it is\n * re-exported here so the widgets stay decoupled from the drawer's internals.\n */\nexport { FORMS_DRAWER_REFRESH_EVENT } from '../../backend/forms/[id]/submissions/components/SubmissionDrawer'\n"],
+  "mappings": "AAuBA,SAAS,kCAAkC;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection/embedded-form/widget.js

@@ -0,0 +1,52 @@
+"use client";
+import { jsx } from "react/jsx-runtime";
+import { EmbeddedForm } from "../../../ui/public/index.js";
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function narrowSource(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value;
+  if (candidate.kind === "portal") {
+    if (isNonEmptyString(candidate.formKey) && isNonEmptyString(candidate.subjectType) && isNonEmptyString(candidate.subjectId)) {
+      return {
+        kind: "portal",
+        formKey: candidate.formKey,
+        subjectType: candidate.subjectType,
+        subjectId: candidate.subjectId
+      };
+    }
+    return null;
+  }
+  if (candidate.kind === "distribution") {
+    return isNonEmptyString(candidate.slug) ? { kind: "distribution", slug: candidate.slug } : null;
+  }
+  if (candidate.kind === "invitation") {
+    return isNonEmptyString(candidate.token) ? { kind: "invitation", token: candidate.token } : null;
+  }
+  return null;
+}
+function EmbeddedFormWidget({ context }) {
+  const source = narrowSource(context?.source);
+  if (!source) return null;
+  const onReturnHome = typeof context?.onReturnHome === "function" ? context.onReturnHome : void 0;
+  const className = isNonEmptyString(context?.className) ? context.className : void 0;
+  return /* @__PURE__ */ jsx(EmbeddedForm, { source, onReturnHome, className });
+}
+const widget = {
+  metadata: {
+    id: "forms.injection.embedded-form",
+    title: "Forms Embedded Form",
+    description: "Generic, parameterized widget that renders a runnable form anywhere via the shared <EmbeddedForm> primitive. The host supplies an EmbeddedFormSource through the injection context.",
+    features: ["forms.view"],
+    priority: 100,
+    enabled: true
+  },
+  Widget: EmbeddedFormWidget
+};
+var widget_default = widget;
+export {
+  EmbeddedFormWidget,
+  widget_default as default
+};
+//# sourceMappingURL=widget.js.map

package/dist/modules/forms/widgets/injection/embedded-form/widget.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/widgets/injection/embedded-form/widget.tsx"],
+  "sourcesContent": ["\"use client\"\n\n/**\n * Surface S3 \u2014 generic, parameterized form-embed injection widget\n * (spec `2026-05-21-forms-render-surfaces.md`, D3).\n *\n * Mounts the shared `<EmbeddedForm>` rendering primitive into ANY spot a host\n * module declares it against, so a runnable form can be dropped onto a customer\n * record, a deal page, a portal screen, etc. \u2014 without forking `<FormRunner>`.\n *\n * Host prop contract (passed through the `<InjectionSpot>` context bag):\n *\n *   context.source       (required) \u2014 an `EmbeddedFormSource` discriminator:\n *     \u2022 { kind: 'portal', formKey, subjectType, subjectId }  \u2192 authenticated\n *       in-app / portal placement (uses the auth runtime client).\n *     \u2022 { kind: 'distribution', slug }                       \u2192 anonymous open\n *       link (uses the anonymous runtime client).\n *     \u2022 { kind: 'invitation', token }                        \u2192 anonymous\n *       personal invite.\n *   context.onReturnHome (optional) \u2014 forwarded to the completion screen.\n *   context.className    (optional) \u2014 wrapper class for the mounted runner.\n *\n * Props are validated defensively at runtime (no `any`): a malformed or absent\n * `source` renders nothing (returns `null`) rather than crashing the host page.\n * The widget itself adds no feature gate beyond `forms.view`; the host page's\n * own guard governs who can place/see it (spec \u00A7 Security S3-admin).\n */\n\nimport * as React from 'react'\nimport type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'\nimport { EmbeddedForm } from '../../../ui/public'\nimport type { EmbeddedFormSource } from '../../../ui/public'\n\nexport type EmbeddedFormWidgetContext = {\n  source?: unknown\n  onReturnHome?: unknown\n  className?: unknown\n  sharedState?: Record<string, unknown>\n}\n\nfunction isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0\n}\n\nfunction narrowSource(value: unknown): EmbeddedFormSource | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = value as Record<string, unknown>\n  if (candidate.kind === 'portal') {\n    if (\n      isNonEmptyString(candidate.formKey) &&\n      isNonEmptyString(candidate.subjectType) &&\n      isNonEmptyString(candidate.subjectId)\n    ) {\n      return {\n        kind: 'portal',\n        formKey: candidate.formKey,\n        subjectType: candidate.subjectType,\n        subjectId: candidate.subjectId,\n      }\n    }\n    return null\n  }\n  if (candidate.kind === 'distribution') {\n    return isNonEmptyString(candidate.slug) ? { kind: 'distribution', slug: candidate.slug } : null\n  }\n  if (candidate.kind === 'invitation') {\n    return isNonEmptyString(candidate.token) ? { kind: 'invitation', token: candidate.token } : null\n  }\n  return null\n}\n\ntype EmbeddedFormWidgetProps = {\n  context: EmbeddedFormWidgetContext\n}\n\nexport function EmbeddedFormWidget({ context }: EmbeddedFormWidgetProps) {\n  const source = narrowSource(context?.source)\n  if (!source) return null\n\n  const onReturnHome =\n    typeof context?.onReturnHome === 'function'\n      ? (context.onReturnHome as () => void)\n      : undefined\n  const className = isNonEmptyString(context?.className) ? context.className : undefined\n\n  return <EmbeddedForm source={source} onReturnHome={onReturnHome} className={className} />\n}\n\nconst widget: InjectionWidgetModule<EmbeddedFormWidgetContext> = {\n  metadata: {\n    id: 'forms.injection.embedded-form',\n    title: 'Forms Embedded Form',\n    description:\n      'Generic, parameterized widget that renders a runnable form anywhere via the shared <EmbeddedForm> primitive. The host supplies an EmbeddedFormSource through the injection context.',\n    features: ['forms.view'],\n    priority: 100,\n    enabled: true,\n  },\n  Widget: EmbeddedFormWidget,\n}\n\nexport default widget\n"],
+  "mappings": ";AAqFS;AAvDT,SAAS,oBAAoB;AAU7B,SAAS,iBAAiB,OAAiC;AACzD,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,aAAa,OAA2C;AAC/D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAY;AAClB,MAAI,UAAU,SAAS,UAAU;AAC/B,QACE,iBAAiB,UAAU,OAAO,KAClC,iBAAiB,UAAU,WAAW,KACtC,iBAAiB,UAAU,SAAS,GACpC;AACA,aAAO;AAAA,QACL,MAAM;AAAA,QACN,SAAS,UAAU;AAAA,QACnB,aAAa,UAAU;AAAA,QACvB,WAAW,UAAU;AAAA,MACvB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,UAAU,SAAS,gBAAgB;AACrC,WAAO,iBAAiB,UAAU,IAAI,IAAI,EAAE,MAAM,gBAAgB,MAAM,UAAU,KAAK,IAAI;AAAA,EAC7F;AACA,MAAI,UAAU,SAAS,cAAc;AACnC,WAAO,iBAAiB,UAAU,KAAK,IAAI,EAAE,MAAM,cAAc,OAAO,UAAU,MAAM,IAAI;AAAA,EAC9F;AACA,SAAO;AACT;AAMO,SAAS,mBAAmB,EAAE,QAAQ,GAA4B;AACvE,QAAM,SAAS,aAAa,SAAS,MAAM;AAC3C,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,eACJ,OAAO,SAAS,iBAAiB,aAC5B,QAAQ,eACT;AACN,QAAM,YAAY,iBAAiB,SAAS,SAAS,IAAI,QAAQ,YAAY;AAE7E,SAAO,oBAAC,gBAAa,QAAgB,cAA4B,WAAsB;AACzF;AAEA,MAAM,SAA2D;AAAA,EAC/D,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,UAAU,CAAC,YAAY;AAAA,IACvB,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,QAAQ;AACV;AAEA,IAAO,iBAAQ;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection/pdf-download-button/widget.js

@@ -0,0 +1,83 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { Download } from "lucide-react";
+import { Button } from "@open-mercato/ui/primitives/button";
+import { SimpleTooltip } from "@open-mercato/ui/primitives/tooltip";
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { flash } from "@open-mercato/ui/backend/FlashMessages";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+function parseFilename(disposition, fallback) {
+  if (!disposition) return fallback;
+  const match = /filename="?([^"]+)"?/i.exec(disposition);
+  return match?.[1] ?? fallback;
+}
+function PdfDownloadButtonWidget({ context }) {
+  const t = useT();
+  const submissionId = typeof context?.submissionId === "string" ? context.submissionId : null;
+  const isSubmitted = context?.status === "submitted";
+  const [isLoading, setIsLoading] = React.useState(false);
+  const handleDownload = React.useCallback(async () => {
+    if (!submissionId) return;
+    setIsLoading(true);
+    try {
+      const resp = await apiCall(`/api/forms/submissions/${encodeURIComponent(submissionId)}/pdf`);
+      if (!resp.ok) {
+        flash(t("forms.compliance.pdf.unavailable", { fallback: "PDF snapshot is being generated." }), "error");
+        return;
+      }
+      const blob = await resp.response.blob();
+      const filename = parseFilename(
+        resp.response.headers.get("content-disposition"),
+        `submission-${submissionId}.pdf`
+      );
+      const url = URL.createObjectURL(blob);
+      const anchor = document.createElement("a");
+      anchor.href = url;
+      anchor.download = filename;
+      document.body.appendChild(anchor);
+      anchor.click();
+      anchor.remove();
+      URL.revokeObjectURL(url);
+    } catch {
+      flash(t("forms.compliance.pdf.unavailable", { fallback: "PDF snapshot is being generated." }), "error");
+    } finally {
+      setIsLoading(false);
+    }
+  }, [submissionId, t]);
+  if (!submissionId) return null;
+  const button = /* @__PURE__ */ jsxs(
+    Button,
+    {
+      type: "button",
+      variant: "outline",
+      size: "sm",
+      disabled: !isSubmitted || isLoading,
+      onClick: handleDownload,
+      "data-forms-pdf-download": "",
+      children: [
+        /* @__PURE__ */ jsx(Download, { className: "mr-1 h-4 w-4", "aria-hidden": "true" }),
+        t("forms.compliance.pdf.download", { fallback: "Download PDF" })
+      ]
+    }
+  );
+  if (isSubmitted) return button;
+  return /* @__PURE__ */ jsx(SimpleTooltip, { content: t("forms.compliance.pdf.unavailable", { fallback: "PDF snapshot is being generated." }), children: /* @__PURE__ */ jsx("span", { "data-forms-pdf-download-disabled": "", children: button }) });
+}
+const widget = {
+  metadata: {
+    id: "forms.injection.pdf-download-button",
+    title: "Forms Submission PDF Download",
+    description: "Downloads the signed PDF snapshot for a submitted submission from the drawer header; disabled with a tooltip until the form is submitted.",
+    features: ["forms.view"],
+    priority: 100,
+    enabled: true
+  },
+  Widget: PdfDownloadButtonWidget
+};
+var widget_default = widget;
+export {
+  PdfDownloadButtonWidget,
+  widget_default as default
+};
+//# sourceMappingURL=widget.js.map

package/dist/modules/forms/widgets/injection/pdf-download-button/widget.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/widgets/injection/pdf-download-button/widget.tsx"],
+  "sourcesContent": ["\"use client\"\n\n/**\n * Phase 2b \u2014 PdfDownloadButton injection widget.\n *\n * Mounts into the submission drawer's `submission-drawer:header-actions` spot.\n * Downloads the immutable signed PDF snapshot via\n * `GET /api/forms/submissions/:submissionId/pdf`. The route lazily generates\n * the snapshot on first request for a submitted form, so the button generally\n * works post-submit. It is disabled (with a tooltip) for non-submitted\n * submissions, where no snapshot can exist yet.\n *\n * Read-only fetch (no state mutation), so `useGuardedMutation` is not required;\n * uses `apiCall` (never raw fetch) and reads the streamed bytes from the shared\n * response object. Feature-gated behind `forms.view` to match the route.\n */\n\nimport * as React from 'react'\nimport { Download } from 'lucide-react'\nimport type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { SimpleTooltip } from '@open-mercato/ui/primitives/tooltip'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FormsDrawerWidgetContext } from '../context'\n\ntype PdfDownloadButtonProps = {\n  context: FormsDrawerWidgetContext\n}\n\nfunction parseFilename(disposition: string | null, fallback: string): string {\n  if (!disposition) return fallback\n  const match = /filename=\"?([^\"]+)\"?/i.exec(disposition)\n  return match?.[1] ?? fallback\n}\n\nexport function PdfDownloadButtonWidget({ context }: PdfDownloadButtonProps) {\n  const t = useT()\n  const submissionId = typeof context?.submissionId === 'string' ? context.submissionId : null\n  const isSubmitted = context?.status === 'submitted'\n  const [isLoading, setIsLoading] = React.useState(false)\n\n  const handleDownload = React.useCallback(async () => {\n    if (!submissionId) return\n    setIsLoading(true)\n    try {\n      const resp = await apiCall(`/api/forms/submissions/${encodeURIComponent(submissionId)}/pdf`)\n      if (!resp.ok) {\n        flash(t('forms.compliance.pdf.unavailable', { fallback: 'PDF snapshot is being generated.' }), 'error')\n        return\n      }\n      const blob = await resp.response.blob()\n      const filename = parseFilename(\n        resp.response.headers.get('content-disposition'),\n        `submission-${submissionId}.pdf`,\n      )\n      const url = URL.createObjectURL(blob)\n      const anchor = document.createElement('a')\n      anchor.href = url\n      anchor.download = filename\n      document.body.appendChild(anchor)\n      anchor.click()\n      anchor.remove()\n      URL.revokeObjectURL(url)\n    } catch {\n      flash(t('forms.compliance.pdf.unavailable', { fallback: 'PDF snapshot is being generated.' }), 'error')\n    } finally {\n      setIsLoading(false)\n    }\n  }, [submissionId, t])\n\n  if (!submissionId) return null\n\n  const button = (\n    <Button\n      type=\"button\"\n      variant=\"outline\"\n      size=\"sm\"\n      disabled={!isSubmitted || isLoading}\n      onClick={handleDownload}\n      data-forms-pdf-download=\"\"\n    >\n      <Download className=\"mr-1 h-4 w-4\" aria-hidden=\"true\" />\n      {t('forms.compliance.pdf.download', { fallback: 'Download PDF' })}\n    </Button>\n  )\n\n  if (isSubmitted) return button\n\n  return (\n    <SimpleTooltip content={t('forms.compliance.pdf.unavailable', { fallback: 'PDF snapshot is being generated.' })}>\n      <span data-forms-pdf-download-disabled=\"\">{button}</span>\n    </SimpleTooltip>\n  )\n}\n\nconst widget: InjectionWidgetModule<FormsDrawerWidgetContext> = {\n  metadata: {\n    id: 'forms.injection.pdf-download-button',\n    title: 'Forms Submission PDF Download',\n    description:\n      'Downloads the signed PDF snapshot for a submitted submission from the drawer header; disabled with a tooltip until the form is submitted.',\n    features: ['forms.view'],\n    priority: 100,\n    enabled: true,\n  },\n  Widget: PdfDownloadButtonWidget,\n}\n\nexport default widget\n"],
+  "mappings": ";AA2EI,SAQE,KARF;AA1DJ,YAAY,WAAW;AACvB,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAS,YAAY;AAOrB,SAAS,cAAc,aAA4B,UAA0B;AAC3E,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,QAAQ,wBAAwB,KAAK,WAAW;AACtD,SAAO,QAAQ,CAAC,KAAK;AACvB;AAEO,SAAS,wBAAwB,EAAE,QAAQ,GAA2B;AAC3E,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,OAAO,SAAS,iBAAiB,WAAW,QAAQ,eAAe;AACxF,QAAM,cAAc,SAAS,WAAW;AACxC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AAEtD,QAAM,iBAAiB,MAAM,YAAY,YAAY;AACnD,QAAI,CAAC,aAAc;AACnB,iBAAa,IAAI;AACjB,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,0BAA0B,mBAAmB,YAAY,CAAC,MAAM;AAC3F,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,EAAE,oCAAoC,EAAE,UAAU,mCAAmC,CAAC,GAAG,OAAO;AACtG;AAAA,MACF;AACA,YAAM,OAAO,MAAM,KAAK,SAAS,KAAK;AACtC,YAAM,WAAW;AAAA,QACf,KAAK,SAAS,QAAQ,IAAI,qBAAqB;AAAA,QAC/C,cAAc,YAAY;AAAA,MAC5B;AACA,YAAM,MAAM,IAAI,gBAAgB,IAAI;AACpC,YAAM,SAAS,SAAS,cAAc,GAAG;AACzC,aAAO,OAAO;AACd,aAAO,WAAW;AAClB,eAAS,KAAK,YAAY,MAAM;AAChC,aAAO,MAAM;AACb,aAAO,OAAO;AACd,UAAI,gBAAgB,GAAG;AAAA,IACzB,QAAQ;AACN,YAAM,EAAE,oCAAoC,EAAE,UAAU,mCAAmC,CAAC,GAAG,OAAO;AAAA,IACxG,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,cAAc,CAAC,CAAC;AAEpB,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,SACJ;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,UAAU,CAAC,eAAe;AAAA,MAC1B,SAAS;AAAA,MACT,2BAAwB;AAAA,MAExB;AAAA,4BAAC,YAAS,WAAU,gBAAe,eAAY,QAAO;AAAA,QACrD,EAAE,iCAAiC,EAAE,UAAU,eAAe,CAAC;AAAA;AAAA;AAAA,EAClE;AAGF,MAAI,YAAa,QAAO;AAExB,SACE,oBAAC,iBAAc,SAAS,EAAE,oCAAoC,EAAE,UAAU,mCAAmC,CAAC,GAC5G,8BAAC,UAAK,oCAAiC,IAAI,kBAAO,GACpD;AAEJ;AAEA,MAAM,SAA0D;AAAA,EAC9D,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,UAAU,CAAC,YAAY;AAAA,IACvB,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,QAAQ;AACV;AAEA,IAAO,iBAAQ;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection/self-audit-footer/widget.js

@@ -0,0 +1,38 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { ShieldCheck } from "lucide-react";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+function SelfAuditFooterWidget({ context }) {
+  const t = useT();
+  if (!context?.submissionId) return null;
+  return /* @__PURE__ */ jsxs(
+    "p",
+    {
+      className: "mt-1 flex items-center gap-1.5 text-xs text-muted-foreground",
+      "data-forms-self-audit-footer": "",
+      children: [
+        /* @__PURE__ */ jsx(ShieldCheck, { className: "h-3.5 w-3.5", "aria-hidden": "true" }),
+        /* @__PURE__ */ jsx("span", { children: t("forms.drawer.audit_note", {
+          fallback: "This view is being written to the access audit log \u2014 purpose: view."
+        }) })
+      ]
+    }
+  );
+}
+const widget = {
+  metadata: {
+    id: "forms.injection.self-audit-footer",
+    title: "Forms Submission Self-Audit Footer",
+    description: 'Static "this view is logged" note mounted in the submission drawer footer (purpose: view).',
+    features: ["forms.view"],
+    priority: 100,
+    enabled: true
+  },
+  Widget: SelfAuditFooterWidget
+};
+var widget_default = widget;
+export {
+  SelfAuditFooterWidget,
+  widget_default as default
+};
+//# sourceMappingURL=widget.js.map

package/dist/modules/forms/widgets/injection/self-audit-footer/widget.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/widgets/injection/self-audit-footer/widget.tsx"],
+  "sourcesContent": ["\"use client\"\n\n/**\n * Phase 2b \u2014 SelfAuditFooter injection widget.\n *\n * Mounts into the submission drawer's `submission-drawer:footer` spot. Renders\n * the static informational note that opening this drawer is itself written to\n * the access-audit log (purpose: view). Purely informational \u2014 no I/O, no\n * mutation. Reuses the existing `forms.drawer.audit_note` i18n key.\n *\n * Feature-gated behind `forms.view` to match every other admin submission\n * surface.\n */\n\nimport * as React from 'react'\nimport { ShieldCheck } from 'lucide-react'\nimport type { InjectionWidgetModule } from '@open-mercato/shared/modules/widgets/injection'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { FormsDrawerWidgetContext } from '../context'\n\ntype SelfAuditFooterProps = {\n  context: FormsDrawerWidgetContext\n}\n\nexport function SelfAuditFooterWidget({ context }: SelfAuditFooterProps) {\n  const t = useT()\n  if (!context?.submissionId) return null\n  return (\n    <p\n      className=\"mt-1 flex items-center gap-1.5 text-xs text-muted-foreground\"\n      data-forms-self-audit-footer=\"\"\n    >\n      <ShieldCheck className=\"h-3.5 w-3.5\" aria-hidden=\"true\" />\n      <span>\n        {t('forms.drawer.audit_note', {\n          fallback: 'This view is being written to the access audit log \u2014 purpose: view.',\n        })}\n      </span>\n    </p>\n  )\n}\n\nconst widget: InjectionWidgetModule<FormsDrawerWidgetContext> = {\n  metadata: {\n    id: 'forms.injection.self-audit-footer',\n    title: 'Forms Submission Self-Audit Footer',\n    description:\n      'Static \"this view is logged\" note mounted in the submission drawer footer (purpose: view).',\n    features: ['forms.view'],\n    priority: 100,\n    enabled: true,\n  },\n  Widget: SelfAuditFooterWidget,\n}\n\nexport default widget\n"],
+  "mappings": ";AA4BI,SAIE,KAJF;AAbJ,SAAS,mBAAmB;AAE5B,SAAS,YAAY;AAOd,SAAS,sBAAsB,EAAE,QAAQ,GAAyB;AACvE,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,SAAS,aAAc,QAAO;AACnC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAU;AAAA,MACV,gCAA6B;AAAA,MAE7B;AAAA,4BAAC,eAAY,WAAU,eAAc,eAAY,QAAO;AAAA,QACxD,oBAAC,UACE,YAAE,2BAA2B;AAAA,UAC5B,UAAU;AAAA,QACZ,CAAC,GACH;AAAA;AAAA;AAAA,EACF;AAEJ;AAEA,MAAM,SAA0D;AAAA,EAC9D,UAAU;AAAA,IACR,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,aACE;AAAA,IACF,UAAU,CAAC,YAAY;AAAA,IACvB,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,QAAQ;AACV;AAEA,IAAO,iBAAQ;",
+  "names": []
+}

package/dist/modules/forms/widgets/injection-table.js

@@ -0,0 +1,32 @@
+const injectionTable = {
+  "submission-drawer:header-actions": [
+    {
+      widgetId: "forms.injection.pdf-download-button",
+      priority: 100
+    }
+  ],
+  "submission-drawer:anonymize-action": [
+    {
+      widgetId: "forms.injection.anonymize-button",
+      priority: 100
+    }
+  ],
+  "submission-drawer:access-audit": [
+    {
+      widgetId: "forms.injection.access-audit-panel",
+      priority: 100
+    }
+  ],
+  "submission-drawer:footer": [
+    {
+      widgetId: "forms.injection.self-audit-footer",
+      priority: 100
+    }
+  ]
+};
+var injection_table_default = injectionTable;
+export {
+  injection_table_default as default,
+  injectionTable
+};
+//# sourceMappingURL=injection-table.js.map