@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/dist/modules/forms/api/form-submissions/[id]/resume-token/route.js

@@ -0,0 +1,110 @@
+import { NextResponse } from "next/server";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import { FormSubmission, FormSubmissionActor } from "../../../../data/entities.js";
+const DEFAULT_TTL_S = (() => {
+  const raw = process.env.FORMS_RESUME_TOKEN_TTL_S;
+  if (!raw) return 3600;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 3600;
+})();
+function getSecret() {
+  const secret = process.env.FORMS_RESUME_TOKEN_SECRET ?? process.env.JWT_SECRET ?? "";
+  if (!secret) {
+    throw new Error("FORMS_RESUME_TOKEN_SECRET (or JWT_SECRET fallback) must be set.");
+  }
+  return secret;
+}
+function buildResumeToken(args) {
+  const payload = `${args.submissionId}|${args.userId}|${args.expiresAtSeconds}`;
+  const hmac = createHmac("sha256", getSecret()).update(payload).digest("hex");
+  return `${args.submissionId}.${args.userId}.${args.expiresAtSeconds}.${hmac}`;
+}
+function verifyResumeToken(token) {
+  const parts = token.split(".");
+  if (parts.length !== 4) return { ok: false, reason: "malformed" };
+  const [submissionId, userId, expRaw, hmac] = parts;
+  const exp = Number.parseInt(expRaw, 10);
+  if (!Number.isFinite(exp)) return { ok: false, reason: "malformed_exp" };
+  if (Math.floor(Date.now() / 1e3) > exp) return { ok: false, reason: "expired" };
+  const expected = createHmac("sha256", getSecret()).update(`${submissionId}|${userId}|${exp}`).digest("hex");
+  const expectedBuf = Buffer.from(expected, "hex");
+  const actualBuf = Buffer.from(hmac, "hex");
+  if (expectedBuf.length !== actualBuf.length) return { ok: false, reason: "signature" };
+  if (!timingSafeEqual(expectedBuf, actualBuf)) return { ok: false, reason: "signature" };
+  return { ok: true, submissionId, userId };
+}
+const metadata = {
+  GET: { requireAuth: false }
+};
+async function GET(req, context) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.id);
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
+  const submission = await em.findOne(FormSubmission, {
+    id: submissionId,
+    organizationId: auth.orgId,
+    tenantId: auth.tenantId,
+    deletedAt: null
+  });
+  if (!submission) {
+    return NextResponse.json({ error: "NOT_FOUND" }, { status: 404 });
+  }
+  const actor = await em.findOne(FormSubmissionActor, {
+    submissionId: submission.id,
+    organizationId: auth.orgId,
+    userId: auth.sub,
+    revokedAt: null,
+    deletedAt: null
+  });
+  if (!actor) {
+    return NextResponse.json({ error: "NO_ACTOR" }, { status: 403 });
+  }
+  const exp = Math.floor(Date.now() / 1e3) + DEFAULT_TTL_S;
+  let token;
+  try {
+    token = buildResumeToken({ submissionId, userId: auth.sub, expiresAtSeconds: exp });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown error";
+    return NextResponse.json({ error: "INTERNAL_ERROR", message }, { status: 500 });
+  }
+  return NextResponse.json({ token, expiresAt: new Date(exp * 1e3).toISOString() });
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional()
+});
+const responseSchema = z.object({
+  token: z.string(),
+  expiresAt: z.string()
+});
+const getMethodDoc = {
+  summary: "Issue a resume token for a submission",
+  description: "Returns a signed token that another device can use to resume the submission. TTL governed by FORMS_RESUME_TOKEN_TTL_S.",
+  tags: ["Forms Runtime"],
+  responses: [{ status: 200, description: "Resume token issued", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 403, description: "No active actor row for user", schema: errorSchema },
+    { status: 404, description: "Submission not found", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Resume token issuance",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  buildResumeToken,
+  metadata,
+  openApi,
+  verifyResumeToken
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/form-submissions/[id]/resume-token/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/form-submissions/%5Bid%5D/resume-token/route.ts"],
+  "sourcesContent": ["/**\n * Runtime API \u2014 GET /api/form-submissions/:id/resume-token\n *\n * Issues a signed cross-device resume token for the calling user on the\n * supplied submission. Returns 403 if the caller has no active actor row.\n *\n * Token format (compact, no JWT to avoid header cookie collisions):\n *   `${submissionId}.${userId}.${exp}.${hmac}`\n * where `hmac = HMAC-SHA256(secret, \"${submissionId}|${userId}|${exp}\")`.\n *\n * The validator/consumer for this token lives in the renderer (phase 1d).\n * `verifyResumeToken` is exported here to keep both sides honest.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { createHmac, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { FormSubmission, FormSubmissionActor } from '../../../../data/entities'\n\nconst DEFAULT_TTL_S = (() => {\n  const raw = process.env.FORMS_RESUME_TOKEN_TTL_S\n  if (!raw) return 3600\n  const parsed = Number.parseInt(raw, 10)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : 3600\n})()\n\nfunction getSecret(): string {\n  const secret = process.env.FORMS_RESUME_TOKEN_SECRET ?? process.env.JWT_SECRET ?? ''\n  if (!secret) {\n    throw new Error('FORMS_RESUME_TOKEN_SECRET (or JWT_SECRET fallback) must be set.')\n  }\n  return secret\n}\n\nexport function buildResumeToken(args: { submissionId: string; userId: string; expiresAtSeconds: number }): string {\n  const payload = `${args.submissionId}|${args.userId}|${args.expiresAtSeconds}`\n  const hmac = createHmac('sha256', getSecret()).update(payload).digest('hex')\n  return `${args.submissionId}.${args.userId}.${args.expiresAtSeconds}.${hmac}`\n}\n\nexport function verifyResumeToken(token: string): {\n  ok: boolean\n  submissionId?: string\n  userId?: string\n  reason?: string\n} {\n  const parts = token.split('.')\n  if (parts.length !== 4) return { ok: false, reason: 'malformed' }\n  const [submissionId, userId, expRaw, hmac] = parts\n  const exp = Number.parseInt(expRaw, 10)\n  if (!Number.isFinite(exp)) return { ok: false, reason: 'malformed_exp' }\n  if (Math.floor(Date.now() / 1000) > exp) return { ok: false, reason: 'expired' }\n  const expected = createHmac('sha256', getSecret())\n    .update(`${submissionId}|${userId}|${exp}`)\n    .digest('hex')\n  const expectedBuf = Buffer.from(expected, 'hex')\n  const actualBuf = Buffer.from(hmac, 'hex')\n  if (expectedBuf.length !== actualBuf.length) return { ok: false, reason: 'signature' }\n  if (!timingSafeEqual(expectedBuf, actualBuf)) return { ok: false, reason: 'signature' }\n  return { ok: true, submissionId, userId }\n}\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const submission = await em.findOne(FormSubmission, {\n    id: submissionId,\n    organizationId: auth.orgId,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!submission) {\n    return NextResponse.json({ error: 'NOT_FOUND' }, { status: 404 })\n  }\n  const actor = await em.findOne(FormSubmissionActor, {\n    submissionId: submission.id,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n    revokedAt: null,\n    deletedAt: null,\n  })\n  if (!actor) {\n    return NextResponse.json({ error: 'NO_ACTOR' }, { status: 403 })\n  }\n\n  const exp = Math.floor(Date.now() / 1000) + DEFAULT_TTL_S\n  let token: string\n  try {\n    token = buildResumeToken({ submissionId, userId: auth.sub, expiresAtSeconds: exp })\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown error'\n    return NextResponse.json({ error: 'INTERNAL_ERROR', message }, { status: 500 })\n  }\n  return NextResponse.json({ token, expiresAt: new Date(exp * 1000).toISOString() })\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n})\n\nconst responseSchema = z.object({\n  token: z.string(),\n  expiresAt: z.string(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Issue a resume token for a submission',\n  description: 'Returns a signed token that another device can use to resume the submission. TTL governed by FORMS_RESUME_TOKEN_TTL_S.',\n  tags: ['Forms Runtime'],\n  responses: [{ status: 200, description: 'Resume token issued', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'No active actor row for user', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Resume token issuance',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AAcA,SAAS,oBAAsC;AAC/C,SAAS,YAAY,uBAAuB;AAC5C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,gBAAgB,2BAA2B;AAEpD,MAAM,iBAAiB,MAAM;AAC3B,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,SAAS,KAAK,EAAE;AACtC,SAAO,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AAC1D,GAAG;AAEH,SAAS,YAAoB;AAC3B,QAAM,SAAS,QAAQ,IAAI,6BAA6B,QAAQ,IAAI,cAAc;AAClF,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,MAAkF;AACjH,QAAM,UAAU,GAAG,KAAK,YAAY,IAAI,KAAK,MAAM,IAAI,KAAK,gBAAgB;AAC5E,QAAM,OAAO,WAAW,UAAU,UAAU,CAAC,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC3E,SAAO,GAAG,KAAK,YAAY,IAAI,KAAK,MAAM,IAAI,KAAK,gBAAgB,IAAI,IAAI;AAC7E;AAEO,SAAS,kBAAkB,OAKhC;AACA,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AAChE,QAAM,CAAC,cAAc,QAAQ,QAAQ,IAAI,IAAI;AAC7C,QAAM,MAAM,OAAO,SAAS,QAAQ,EAAE;AACtC,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB;AACvE,MAAI,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,IAAK,QAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAC/E,QAAM,WAAW,WAAW,UAAU,UAAU,CAAC,EAC9C,OAAO,GAAG,YAAY,IAAI,MAAM,IAAI,GAAG,EAAE,EACzC,OAAO,KAAK;AACf,QAAM,cAAc,OAAO,KAAK,UAAU,KAAK;AAC/C,QAAM,YAAY,OAAO,KAAK,MAAM,KAAK;AACzC,MAAI,YAAY,WAAW,UAAU,OAAQ,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACrF,MAAI,CAAC,gBAAgB,aAAa,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,YAAY;AACtF,SAAO,EAAE,IAAI,MAAM,cAAc,OAAO;AAC1C;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,IAClD,IAAI;AAAA,IACJ,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,QAAM,QAAQ,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IAClD,cAAc,WAAW;AAAA,IACzB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,OAAO;AACV,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE;AAEA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAC5C,MAAI;AACJ,MAAI;AACF,YAAQ,iBAAiB,EAAE,cAAc,QAAQ,KAAK,KAAK,kBAAkB,IAAI,CAAC;AAAA,EACpF,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,SAAO,aAAa,KAAK,EAAE,OAAO,WAAW,IAAI,KAAK,MAAM,GAAI,EAAE,YAAY,EAAE,CAAC;AACnF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,eAAe,CAAC;AAAA,EACvF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,IAChF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,EAC1E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/form-submissions/[id]/route.js

@@ -0,0 +1,146 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import { FormSubmissionActor } from "../../../data/entities.js";
+import { submissionSaveInputSchema } from "../../../data/validators.js";
+import { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from "../../runtime-helpers.js";
+const metadata = {
+  GET: { requireAuth: false },
+  PATCH: { requireAuth: false }
+};
+async function GET(req, context) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.id);
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  const em = container.resolve("em");
+  try {
+    const role = await resolveActiveRole(em, {
+      submissionId,
+      organizationId: auth.orgId,
+      userId: auth.sub
+    });
+    const view = await service.getCurrent({
+      submissionId,
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      viewerRole: role,
+      viewerUserId: auth.sub
+    });
+    return NextResponse.json({
+      submission: serializeSubmission(view.submission),
+      revision: serializeRevision(view.revision),
+      decoded_data: view.decodedData,
+      actors: view.actors.map(serializeActor)
+    });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+async function PATCH(req, context) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.id);
+  let raw;
+  try {
+    raw = await readJsonBody(req);
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+  const parsed = submissionSaveInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", details: parsed.error.flatten() },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  try {
+    const outcome = await service.save({
+      submissionId,
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      baseRevisionId: parsed.data.base_revision_id,
+      patch: parsed.data.patch,
+      changeSummary: parsed.data.change_summary ?? null,
+      savedBy: auth.sub,
+      changeSource: "user"
+    });
+    return NextResponse.json({
+      revision: serializeRevision(outcome.revision),
+      coalesced: outcome.coalesced
+    });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+async function resolveActiveRole(em, args) {
+  const actor = await em.findOne(FormSubmissionActor, {
+    submissionId: args.submissionId,
+    organizationId: args.organizationId,
+    userId: args.userId,
+    revokedAt: null,
+    deletedAt: null
+  });
+  return actor?.role ?? null;
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const getResponseSchema = z.object({
+  submission: z.record(z.string(), z.unknown()),
+  revision: z.record(z.string(), z.unknown()),
+  decoded_data: z.record(z.string(), z.unknown()),
+  actors: z.array(z.record(z.string(), z.unknown()))
+});
+const patchResponseSchema = z.object({
+  revision: z.record(z.string(), z.unknown()),
+  coalesced: z.boolean()
+});
+const getMethodDoc = {
+  summary: "Get current submission state (role-sliced)",
+  description: "Returns the current revision payload sliced to the calling user's active actor role.",
+  tags: ["Forms Runtime"],
+  responses: [{ status: 200, description: "Submission state", schema: getResponseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Submission not found", schema: errorSchema }
+  ]
+};
+const patchMethodDoc = {
+  summary: "Save (autosave) a submission revision",
+  description: "Appends a revision when the supplied base_revision_id matches; rate-limited to FORMS_AUTOSAVE_INTERVAL_MS / 2.",
+  tags: ["Forms Runtime"],
+  requestBody: { schema: submissionSaveInputSchema },
+  responses: [{ status: 200, description: "Revision saved", schema: patchResponseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 403, description: "No active actor row for user", schema: errorSchema },
+    { status: 404, description: "Submission not found", schema: errorSchema },
+    { status: 409, description: "Stale base_revision_id", schema: errorSchema },
+    { status: 422, description: "Validation failed", schema: errorSchema },
+    { status: 429, description: "Save rate limit exceeded", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Form submission state and autosave",
+  methods: { GET: getMethodDoc, PATCH: patchMethodDoc }
+};
+export {
+  GET,
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/form-submissions/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/api/form-submissions/%5Bid%5D/route.ts"],
+  "sourcesContent": ["/**\n * Runtime API \u2014 GET/PATCH /api/form-submissions/:id\n *\n * GET returns the role-sliced current state for the calling user.\n * PATCH appends a revision (autosave) \u2014 body shape `{ base_revision_id, patch }`.\n *\n * Customer auth required. Cross-tenant attempts return 404 (the underlying\n * service filters by organizationId+tenantId).\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../../services/submission-service'\nimport { FormSubmissionActor } from '../../../data/entities'\nimport { submissionSaveInputSchema } from '../../../data/validators'\nimport { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from '../../runtime-helpers'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n  PATCH: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n  const em = container.resolve('em') as EntityManager\n\n  try {\n    const role = await resolveActiveRole(em, {\n      submissionId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n    })\n    const view = await service.getCurrent({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      viewerRole: role,\n      viewerUserId: auth.sub,\n    })\n    return NextResponse.json({\n      submission: serializeSubmission(view.submission),\n      revision: serializeRevision(view.revision),\n      decoded_data: view.decodedData,\n      actors: view.actors.map(serializeActor),\n    })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nexport async function PATCH(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionSaveInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const outcome = await service.save({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      baseRevisionId: parsed.data.base_revision_id,\n      patch: parsed.data.patch,\n      changeSummary: parsed.data.change_summary ?? null,\n      savedBy: auth.sub,\n      changeSource: 'user',\n    })\n    return NextResponse.json({\n      revision: serializeRevision(outcome.revision),\n      coalesced: outcome.coalesced,\n    })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nasync function resolveActiveRole(\n  em: EntityManager,\n  args: { submissionId: string; organizationId: string; userId: string },\n): Promise<string | null> {\n  const actor = await em.findOne(FormSubmissionActor, {\n    submissionId: args.submissionId,\n    organizationId: args.organizationId,\n    userId: args.userId,\n    revokedAt: null,\n    deletedAt: null,\n  })\n  return actor?.role ?? null\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst getResponseSchema = z.object({\n  submission: z.record(z.string(), z.unknown()),\n  revision: z.record(z.string(), z.unknown()),\n  decoded_data: z.record(z.string(), z.unknown()),\n  actors: z.array(z.record(z.string(), z.unknown())),\n})\n\nconst patchResponseSchema = z.object({\n  revision: z.record(z.string(), z.unknown()),\n  coalesced: z.boolean(),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get current submission state (role-sliced)',\n  description: 'Returns the current revision payload sliced to the calling user\\'s active actor role.',\n  tags: ['Forms Runtime'],\n  responses: [{ status: 200, description: 'Submission state', schema: getResponseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n  ],\n}\n\nconst patchMethodDoc: OpenApiMethodDoc = {\n  summary: 'Save (autosave) a submission revision',\n  description: 'Appends a revision when the supplied base_revision_id matches; rate-limited to FORMS_AUTOSAVE_INTERVAL_MS / 2.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionSaveInputSchema },\n  responses: [{ status: 200, description: 'Revision saved', schema: patchResponseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'No active actor row for user', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n    { status: 409, description: 'Stale base_revision_id', schema: errorSchema },\n    { status: 422, description: 'Validation failed', schema: errorSchema },\n    { status: 429, description: 'Save rate limit exceeded', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Form submission state and autosave',\n  methods: { GET: getMethodDoc, PATCH: patchMethodDoc },\n}\n"],
+  "mappings": "AAUA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C,SAAS,2BAA2B;AACpC,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB,cAAc,gBAAgB,mBAAmB,2BAA2B;AAElG,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAAA,EAC1B,OAAO,EAAE,aAAa,MAAM;AAC9B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,MAAI;AACF,UAAM,OAAO,MAAM,kBAAkB,IAAI;AAAA,MACvC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,IACf,CAAC;AACD,UAAM,OAAO,MAAM,QAAQ,WAAW;AAAA,MACpC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,YAAY;AAAA,MACZ,cAAc,KAAK;AAAA,IACrB,CAAC;AACD,WAAO,aAAa,KAAK;AAAA,MACvB,YAAY,oBAAoB,KAAK,UAAU;AAAA,MAC/C,UAAU,kBAAkB,KAAK,QAAQ;AAAA,MACzC,cAAc,KAAK;AAAA,MACnB,QAAQ,KAAK,OAAO,IAAI,cAAc;AAAA,IACxC,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,eAAsB,MACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,0BAA0B,UAAU,GAAG;AACtD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,KAAK;AAAA,MACjC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO,KAAK;AAAA,MAC5B,OAAO,OAAO,KAAK;AAAA,MACnB,eAAe,OAAO,KAAK,kBAAkB;AAAA,MAC7C,SAAS,KAAK;AAAA,MACd,cAAc;AAAA,IAChB,CAAC;AACD,WAAO,aAAa,KAAK;AAAA,MACvB,UAAU,kBAAkB,QAAQ,QAAQ;AAAA,MAC5C,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,eAAe,kBACb,IACA,MACwB;AACxB,QAAM,QAAQ,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IAClD,cAAc,KAAK;AAAA,IACnB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,SAAO,OAAO,QAAQ;AACxB;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC9C,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,kBAAkB,CAAC;AAAA,EACvF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,EAC1E;AACF;AAEA,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,0BAA0B;AAAA,EACjD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,oBAAoB,CAAC;AAAA,EACvF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,IAChF,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,cAAc,OAAO,eAAe;AACtD;",
+  "names": []
+}

package/dist/modules/forms/api/form-submissions/[id]/submit/route.js

@@ -0,0 +1,74 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import { submissionSubmitInputSchema } from "../../../../data/validators.js";
+import { buildSubmitMetadata, mapSubmissionError, readJsonBody, serializeSubmission } from "../../../runtime-helpers.js";
+const metadata = {
+  POST: { requireAuth: false }
+};
+async function POST(req, context) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  const params = await Promise.resolve(context.params);
+  const submissionId = String(params.id);
+  let raw;
+  try {
+    raw = await readJsonBody(req);
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+  const parsed = submissionSubmitInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", details: parsed.error.flatten() },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  try {
+    const submission = await service.submit({
+      submissionId,
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      baseRevisionId: parsed.data.base_revision_id,
+      submittedBy: auth.sub,
+      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata)
+    });
+    return NextResponse.json({ submission: serializeSubmission(submission) });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const responseSchema = z.object({ submission: z.record(z.string(), z.unknown()) });
+const postMethodDoc = {
+  summary: "Submit a form submission",
+  description: "Final submission of a draft submission. Verifies base_revision_id and stores the submit metadata.",
+  tags: ["Forms Runtime"],
+  requestBody: { schema: submissionSubmitInputSchema },
+  responses: [{ status: 200, description: "Submission submitted", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Submission not found", schema: errorSchema },
+    { status: 409, description: "Stale base_revision_id", schema: errorSchema },
+    { status: 422, description: "Submission already in terminal state", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Submit a form submission",
+  methods: { POST: postMethodDoc }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/form-submissions/[id]/submit/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/api/form-submissions/%5Bid%5D/submit/route.ts"],
+  "sourcesContent": ["/**\n * Runtime API \u2014 POST /api/form-submissions/:id/submit\n *\n * Final submit. Body: `{ base_revision_id, submit_metadata? }`. Sets\n * status = submitted, captures `submit_metadata` (locale, IP, UA), emits\n * `forms.submission.submitted`. Idempotency hardening lands in 1d once the\n * client renderer is in place; phase 1c rejects double-submits with 422.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../../../services/submission-service'\nimport { submissionSubmitInputSchema } from '../../../../data/validators'\nimport { buildSubmitMetadata, mapSubmissionError, readJsonBody, serializeSubmission } from '../../../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(\n  req: NextRequest,\n  context: { params: { id: string } | Promise<{ id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const submissionId = String(params.id)\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionSubmitInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n\n  try {\n    const submission = await service.submit({\n      submissionId,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      baseRevisionId: parsed.data.base_revision_id,\n      submittedBy: auth.sub,\n      submitMetadata: buildSubmitMetadata(req, parsed.data.submit_metadata),\n    })\n    return NextResponse.json({ submission: serializeSubmission(submission) })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst responseSchema = z.object({ submission: z.record(z.string(), z.unknown()) })\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Submit a form submission',\n  description: 'Final submission of a draft submission. Verifies base_revision_id and stores the submit metadata.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionSubmitInputSchema },\n  responses: [{ status: 200, description: 'Submission submitted', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Submission not found', schema: errorSchema },\n    { status: 409, description: 'Stale base_revision_id', schema: errorSchema },\n    { status: 422, description: 'Submission already in terminal state', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Submit a form submission',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AASA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB,oBAAoB,cAAc,2BAA2B;AAEpF,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,eAAe,OAAO,OAAO,EAAE;AAErC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,4BAA4B,UAAU,GAAG;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAE1D,MAAI;AACF,UAAM,aAAa,MAAM,QAAQ,OAAO;AAAA,MACtC;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,gBAAgB,OAAO,KAAK;AAAA,MAC5B,aAAa,KAAK;AAAA,MAClB,gBAAgB,oBAAoB,KAAK,OAAO,KAAK,eAAe;AAAA,IACtE,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,YAAY,oBAAoB,UAAU,EAAE,CAAC;AAAA,EAC1E,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;AAEjF,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,4BAA4B;AAAA,EACnD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,eAAe,CAAC;AAAA,EACxF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,IACxE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,EAC1F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "names": []
+}

package/dist/modules/forms/api/form-submissions/by-subject/[subject_type]/[subject_id]/route.js

@@ -0,0 +1,76 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import { FormSubmissionActor } from "../../../../../data/entities.js";
+import { mapSubmissionError, serializeSubmission } from "../../../../runtime-helpers.js";
+const metadata = {
+  GET: { requireAuth: false }
+};
+async function GET(req, context) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  const params = await Promise.resolve(context.params);
+  const subjectType = String(params.subject_type);
+  const subjectId = String(params.subject_id);
+  if (!subjectId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(subjectId)) {
+    return NextResponse.json({ error: "VALIDATION_FAILED", message: "subject_id must be a UUID." }, { status: 422 });
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  const em = container.resolve("em");
+  try {
+    const submissions = await service.listSubmissionsBySubject({
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      subjectType,
+      subjectId
+    });
+    if (submissions.length === 0) return NextResponse.json({ items: [] });
+    const submissionIds = submissions.map((entry) => entry.id);
+    const actors = await em.find(
+      FormSubmissionActor,
+      {
+        submissionId: { $in: submissionIds },
+        organizationId: auth.orgId,
+        userId: auth.sub,
+        revokedAt: null,
+        deletedAt: null
+      }
+    );
+    const allowedSet = new Set(actors.map((entry) => entry.submissionId));
+    const visible = submissions.filter((entry) => allowedSet.has(entry.id));
+    return NextResponse.json({ items: visible.map(serializeSubmission) });
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional()
+});
+const responseSchema = z.object({
+  items: z.array(z.record(z.string(), z.unknown()))
+});
+const getMethodDoc = {
+  summary: "List submissions for a subject",
+  description: "Returns submissions accessible to the caller for the supplied (subject_type, subject_id).",
+  tags: ["Forms Runtime"],
+  responses: [{ status: 200, description: "Submission list", schema: responseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 422, description: "Bad subject identifier", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "List submissions by subject",
+  methods: { GET: getMethodDoc }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/form-submissions/by-subject/[subject_type]/[subject_id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/forms/api/form-submissions/by-subject/%5Bsubject_type%5D/%5Bsubject_id%5D/route.ts"],
+  "sourcesContent": ["/**\n * Runtime API \u2014 GET /api/form-submissions/by-subject/:subject_type/:subject_id\n *\n * Lists submissions for a given subject visible to the calling user. The\n * caller must have an active actor row on each returned submission;\n * submissions where they have no actor row are filtered out. Customer auth\n * required.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../../../../services/submission-service'\nimport { FormSubmissionActor } from '../../../../../data/entities'\nimport { mapSubmissionError, serializeSubmission } from '../../../../runtime-helpers'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: { subject_type: string; subject_id: string } | Promise<{ subject_type: string; subject_id: string }> },\n) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n  const params = await Promise.resolve(context.params)\n  const subjectType = String(params.subject_type)\n  const subjectId = String(params.subject_id)\n  if (!subjectId || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(subjectId)) {\n    return NextResponse.json({ error: 'VALIDATION_FAILED', message: 'subject_id must be a UUID.' }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n  const em = container.resolve('em') as EntityManager\n\n  try {\n    const submissions = await service.listSubmissionsBySubject({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      subjectType,\n      subjectId,\n    })\n    if (submissions.length === 0) return NextResponse.json({ items: [] })\n    const submissionIds = submissions.map((entry) => entry.id)\n    const actors = await em.find(\n      FormSubmissionActor,\n      {\n        submissionId: { $in: submissionIds },\n        organizationId: auth.orgId,\n        userId: auth.sub,\n        revokedAt: null,\n        deletedAt: null,\n      } as never,\n    )\n    const allowedSet = new Set(actors.map((entry: FormSubmissionActor) => entry.submissionId))\n    const visible = submissions.filter((entry) => allowedSet.has(entry.id))\n    return NextResponse.json({ items: visible.map(serializeSubmission) })\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n})\n\nconst responseSchema = z.object({\n  items: z.array(z.record(z.string(), z.unknown())),\n})\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'List submissions for a subject',\n  description: 'Returns submissions accessible to the caller for the supplied (subject_type, subject_id).',\n  tags: ['Forms Runtime'],\n  responses: [{ status: 200, description: 'Submission list', schema: responseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 422, description: 'Bad subject identifier', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'List submissions by subject',\n  methods: { GET: getMethodDoc },\n}\n"],
+  "mappings": "AASA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C,SAAS,2BAA2B;AACpC,SAAS,oBAAoB,2BAA2B;AAEjD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,MAAM,QAAQ,QAAQ,QAAQ,MAAM;AACnD,QAAM,cAAc,OAAO,OAAO,YAAY;AAC9C,QAAM,YAAY,OAAO,OAAO,UAAU;AAC1C,MAAI,CAAC,aAAa,CAAC,kEAAkE,KAAK,SAAS,GAAG;AACpG,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,MAAI;AACF,UAAM,cAAc,MAAM,QAAQ,yBAAyB;AAAA,MACzD,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,YAAY,WAAW,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AACpE,UAAM,gBAAgB,YAAY,IAAI,CAAC,UAAU,MAAM,EAAE;AACzD,UAAM,SAAS,MAAM,GAAG;AAAA,MACtB;AAAA,MACA;AAAA,QACE,cAAc,EAAE,KAAK,cAAc;AAAA,QACnC,gBAAgB,KAAK;AAAA,QACrB,QAAQ,KAAK;AAAA,QACb,WAAW;AAAA,QACX,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAM,aAAa,IAAI,IAAI,OAAO,IAAI,CAAC,UAA+B,MAAM,YAAY,CAAC;AACzF,UAAM,UAAU,YAAY,OAAO,CAAC,UAAU,WAAW,IAAI,MAAM,EAAE,CAAC;AACtE,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,IAAI,mBAAmB,EAAE,CAAC;AAAA,EACtE,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAC/B,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,eAAe,CAAC;AAAA,EACnF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,EAC5E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,KAAK,aAAa;AAC/B;",
+  "names": []
+}

package/dist/modules/forms/api/form-submissions/route.js

@@ -0,0 +1,113 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import {
+  resolvePrefillSeed
+} from "../../services/prefill-resolver.js";
+import { submissionStartInputSchema } from "../../data/validators.js";
+import { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from "../runtime-helpers.js";
+const metadata = {
+  POST: { requireAuth: false }
+};
+async function POST(req) {
+  const auth = await getCustomerAuthFromRequest(req);
+  if (!auth) {
+    return NextResponse.json({ error: "Authentication required" }, { status: 401 });
+  }
+  let raw;
+  try {
+    raw = await readJsonBody(req);
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+  const parsed = submissionStartInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: "VALIDATION_FAILED", details: parsed.error.flatten() },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("formsSubmissionService");
+  const prefillResolver = container.resolve("formsPrefillResolver");
+  try {
+    let prefill = null;
+    try {
+      const { compiled } = await service.getActiveFormVersionByKey({
+        organizationId: auth.orgId,
+        tenantId: auth.tenantId,
+        formKey: parsed.data.form_key
+      });
+      const seed = await resolvePrefillSeed({
+        compiled,
+        resolver: prefillResolver,
+        principal: {
+          sub: auth.sub,
+          tenantId: auth.tenantId,
+          organizationId: auth.orgId,
+          email: auth.email,
+          displayName: auth.displayName,
+          customerEntityId: auth.customerEntityId ?? null,
+          personEntityId: auth.personEntityId ?? null
+        }
+      });
+      if (Object.keys(seed).length > 0) prefill = seed;
+    } catch {
+      prefill = null;
+    }
+    const view = await service.start({
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      formKey: parsed.data.form_key,
+      subjectType: parsed.data.subject_type,
+      subjectId: parsed.data.subject_id,
+      startedBy: auth.sub,
+      prefill
+    });
+    return NextResponse.json(
+      {
+        submission: serializeSubmission(view.submission),
+        revision: serializeRevision(view.revision),
+        decoded_data: view.decodedData,
+        actors: view.actors.map(serializeActor)
+      },
+      { status: 201 }
+    );
+  } catch (error) {
+    return mapSubmissionError(error);
+  }
+}
+const errorSchema = z.object({
+  error: z.string(),
+  message: z.string().optional(),
+  details: z.unknown().optional()
+});
+const submissionResponseSchema = z.object({
+  submission: z.record(z.string(), z.unknown()),
+  revision: z.record(z.string(), z.unknown()),
+  decoded_data: z.record(z.string(), z.unknown()),
+  actors: z.array(z.record(z.string(), z.unknown()))
+});
+const postMethodDoc = {
+  summary: "Start a new form submission",
+  description: "Starts a submission for the active version of a form, auto-assigning the starter to the default actor role.",
+  tags: ["Forms Runtime"],
+  requestBody: { schema: submissionStartInputSchema },
+  responses: [{ status: 201, description: "Submission started", schema: submissionResponseSchema }],
+  errors: [
+    { status: 401, description: "Not authenticated", schema: errorSchema },
+    { status: 404, description: "Form not found", schema: errorSchema },
+    { status: 422, description: "Validation or form-state error", schema: errorSchema }
+  ]
+};
+const openApi = {
+  summary: "Form submission lifecycle",
+  methods: { POST: postMethodDoc }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/forms/api/form-submissions/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/forms/api/form-submissions/route.ts"],
+  "sourcesContent": ["/**\n * Runtime API \u2014 POST /api/form-submissions\n *\n * Starts a new submission for the active version of a form. Customer auth is\n * required. The starter is auto-assigned the form version's\n * `x-om-default-actor-role` (or first declared role) \u2014 admin assignment of\n * additional actors is the admin route.\n */\n\nimport { NextResponse, type NextRequest } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { SubmissionService } from '../../services/submission-service'\nimport {\n  resolvePrefillSeed,\n  type PrefillResolver,\n} from '../../services/prefill-resolver'\nimport { submissionStartInputSchema } from '../../data/validators'\nimport { mapSubmissionError, readJsonBody, serializeActor, serializeRevision, serializeSubmission } from '../runtime-helpers'\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nexport async function POST(req: NextRequest) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ error: 'Authentication required' }, { status: 401 })\n  }\n\n  let raw: unknown\n  try {\n    raw = await readJsonBody(req)\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n  const parsed = submissionStartInputSchema.safeParse(raw)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: 'VALIDATION_FAILED', details: parsed.error.flatten() },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('formsSubmissionService') as SubmissionService\n  const prefillResolver = container.resolve('formsPrefillResolver') as PrefillResolver\n\n  try {\n    // Resolve prefill values (W8 / FD-1) for fields declaring `x-om-prefill`.\n    // No declarations \u21D2 no resolver call. Seeds are role-filtered + AJV-validated\n    // inside `start`; resolution failures are non-fatal (submission opens empty).\n    let prefill: Record<string, unknown> | null = null\n    try {\n      const { compiled } = await service.getActiveFormVersionByKey({\n        organizationId: auth.orgId,\n        tenantId: auth.tenantId,\n        formKey: parsed.data.form_key,\n      })\n      const seed = await resolvePrefillSeed({\n        compiled,\n        resolver: prefillResolver,\n        principal: {\n          sub: auth.sub,\n          tenantId: auth.tenantId,\n          organizationId: auth.orgId,\n          email: auth.email,\n          displayName: auth.displayName,\n          customerEntityId: auth.customerEntityId ?? null,\n          personEntityId: auth.personEntityId ?? null,\n        },\n      })\n      if (Object.keys(seed).length > 0) prefill = seed\n    } catch {\n      // Prefill is best-effort \u2014 fall through to start with no seed.\n      prefill = null\n    }\n\n    const view = await service.start({\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      formKey: parsed.data.form_key,\n      subjectType: parsed.data.subject_type,\n      subjectId: parsed.data.subject_id,\n      startedBy: auth.sub,\n      prefill,\n    })\n    return NextResponse.json(\n      {\n        submission: serializeSubmission(view.submission),\n        revision: serializeRevision(view.revision),\n        decoded_data: view.decodedData,\n        actors: view.actors.map(serializeActor),\n      },\n      { status: 201 },\n    )\n  } catch (error) {\n    return mapSubmissionError(error)\n  }\n}\n\nconst errorSchema = z.object({\n  error: z.string(),\n  message: z.string().optional(),\n  details: z.unknown().optional(),\n})\n\nconst submissionResponseSchema = z.object({\n  submission: z.record(z.string(), z.unknown()),\n  revision: z.record(z.string(), z.unknown()),\n  decoded_data: z.record(z.string(), z.unknown()),\n  actors: z.array(z.record(z.string(), z.unknown())),\n})\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Start a new form submission',\n  description: 'Starts a submission for the active version of a form, auto-assigning the starter to the default actor role.',\n  tags: ['Forms Runtime'],\n  requestBody: { schema: submissionStartInputSchema },\n  responses: [{ status: 201, description: 'Submission started', schema: submissionResponseSchema }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 404, description: 'Form not found', schema: errorSchema },\n    { status: 422, description: 'Validation or form-state error', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Form submission lifecycle',\n  methods: { POST: postMethodDoc },\n}\n"],
+  "mappings": "AASA,SAAS,oBAAsC;AAC/C,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,OAEK;AACP,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB,cAAc,gBAAgB,mBAAmB,2BAA2B;AAElG,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,eAAsB,KAAK,KAAkB;AAC3C,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,aAAa,GAAG;AAAA,EAC9B,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACA,QAAM,SAAS,2BAA2B,UAAU,GAAG;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,QAAM,kBAAkB,UAAU,QAAQ,sBAAsB;AAEhE,MAAI;AAIF,QAAI,UAA0C;AAC9C,QAAI;AACF,YAAM,EAAE,SAAS,IAAI,MAAM,QAAQ,0BAA0B;AAAA,QAC3D,gBAAgB,KAAK;AAAA,QACrB,UAAU,KAAK;AAAA,QACf,SAAS,OAAO,KAAK;AAAA,MACvB,CAAC;AACD,YAAM,OAAO,MAAM,mBAAmB;AAAA,QACpC;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,UACT,KAAK,KAAK;AAAA,UACV,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,OAAO,KAAK;AAAA,UACZ,aAAa,KAAK;AAAA,UAClB,kBAAkB,KAAK,oBAAoB;AAAA,UAC3C,gBAAgB,KAAK,kBAAkB;AAAA,QACzC;AAAA,MACF,CAAC;AACD,UAAI,OAAO,KAAK,IAAI,EAAE,SAAS,EAAG,WAAU;AAAA,IAC9C,QAAQ;AAEN,gBAAU;AAAA,IACZ;AAEA,UAAM,OAAO,MAAM,QAAQ,MAAM;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf,SAAS,OAAO,KAAK;AAAA,MACrB,aAAa,OAAO,KAAK;AAAA,MACzB,WAAW,OAAO,KAAK;AAAA,MACvB,WAAW,KAAK;AAAA,MAChB;AAAA,IACF,CAAC;AACD,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,YAAY,oBAAoB,KAAK,UAAU;AAAA,QAC/C,UAAU,kBAAkB,KAAK,QAAQ;AAAA,QACzC,cAAc,KAAK;AAAA,QACnB,QAAQ,KAAK,OAAO,IAAI,cAAc;AAAA,MACxC;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,OAAO;AACd,WAAO,mBAAmB,KAAK;AAAA,EACjC;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAED,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC1C,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC9C,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,eAAe;AAAA,EACtB,aAAa,EAAE,QAAQ,2BAA2B;AAAA,EAClD,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,yBAAyB,CAAC;AAAA,EAChG,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,YAAY;AAAA,EACpF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,cAAc;AACjC;",
+  "names": []
+}