@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/dist/modules/forms/frontend/f/[slug]/page.meta.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/frontend/f/%5Bslug%5D/page.meta.ts"],
+  "sourcesContent": ["import type { PageMetadata } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: PageMetadata = {\n  requireAuth: false,\n  titleKey: 'forms.runner.loading',\n  title: 'Form',\n}\n\nexport default metadata\n"],
+  "mappings": "AAEO,MAAM,WAAyB;AAAA,EACpC,aAAa;AAAA,EACb,UAAU;AAAA,EACV,OAAO;AACT;AAEA,IAAO,oBAAQ;",
+  "names": []
+}

package/dist/modules/forms/frontend/forms/[id]/run/page.js

@@ -0,0 +1,62 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { useParams, useSearchParams } from "next/navigation";
+import { apiCallOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { Alert } from "@open-mercato/ui/primitives/alert";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { LoadingMessage } from "@open-mercato/ui/backend/detail";
+import { FormRunner } from "../../../../runner/FormRunner.js";
+import { pickHiddenFromUrl } from "../../../../runner/tamper-check.js";
+function PublicFormRunnerPage() {
+  const t = useT();
+  const params = useParams();
+  const searchParams = useSearchParams();
+  const formId = String(params?.id ?? "");
+  const [context, setContext] = React.useState(null);
+  const [error, setError] = React.useState(null);
+  React.useEffect(() => {
+    let cancelled = false;
+    if (!formId) return;
+    apiCallOrThrow(`/api/forms/${encodeURIComponent(formId)}/run/context`, { method: "GET" }).then((result) => {
+      if (cancelled) return;
+      if (result.result) setContext(result.result);
+      else setError(t("forms.runner.error.generic"));
+    }).catch(() => {
+      if (!cancelled) setError(t("forms.runner.error.generic"));
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [formId, t]);
+  if (error) {
+    return /* @__PURE__ */ jsx("main", { className: "mx-auto max-w-xl px-4 py-10", children: /* @__PURE__ */ jsx(Alert, { status: "error", style: "light", children: error }) });
+  }
+  if (!context) {
+    return /* @__PURE__ */ jsx("main", { className: "mx-auto max-w-xl px-4 py-10", children: /* @__PURE__ */ jsx(LoadingMessage, { label: t("forms.runner.loading") }) });
+  }
+  const params2 = new URLSearchParams();
+  if (searchParams) {
+    for (const [key, value] of searchParams.entries()) params2.set(key, value);
+  }
+  const hidden = pickHiddenFromUrl(context.schema, params2);
+  const locale = context.form.defaultLocale ?? "en";
+  return /* @__PURE__ */ jsxs("main", { className: "mx-auto max-w-3xl px-4 py-10", children: [
+    /* @__PURE__ */ jsx("header", { className: "mb-4 space-y-1", children: /* @__PURE__ */ jsx("h1", { className: "text-xl font-semibold text-foreground", children: context.form.name }) }),
+    /* @__PURE__ */ jsx(
+      FormRunner,
+      {
+        formId,
+        formVersionId: context.formVersion.id,
+        schema: context.schema,
+        uiSchema: context.uiSchema,
+        hidden,
+        locale
+      }
+    )
+  ] });
+}
+export {
+  PublicFormRunnerPage as default
+};
+//# sourceMappingURL=page.js.map

package/dist/modules/forms/frontend/forms/[id]/run/page.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/frontend/forms/%5Bid%5D/run/page.tsx"],
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { useParams, useSearchParams } from 'next/navigation'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { Alert } from '@open-mercato/ui/primitives/alert'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { LoadingMessage } from '@open-mercato/ui/backend/detail'\nimport { FormRunner } from '../../../../runner/FormRunner'\nimport { pickHiddenFromUrl } from '../../../../runner/tamper-check'\n\ntype ContextResponse = {\n  form: { id: string; key: string; name: string; defaultLocale: string; supportedLocales: string[] }\n  formVersion: { id: string; versionNumber: number; schemaHash: string; registryVersion: string }\n  schema: Record<string, unknown>\n  uiSchema: Record<string, unknown>\n  requiresCustomerAuth: boolean\n}\n\nexport default function PublicFormRunnerPage() {\n  const t = useT()\n  const params = useParams<{ id: string }>()\n  const searchParams = useSearchParams()\n  const formId = String(params?.id ?? '')\n  const [context, setContext] = React.useState<ContextResponse | null>(null)\n  const [error, setError] = React.useState<string | null>(null)\n\n  React.useEffect(() => {\n    let cancelled = false\n    if (!formId) return\n    apiCallOrThrow<ContextResponse>(`/api/forms/${encodeURIComponent(formId)}/run/context`, { method: 'GET' })\n      .then((result) => {\n        if (cancelled) return\n        if (result.result) setContext(result.result)\n        else setError(t('forms.runner.error.generic'))\n      })\n      .catch(() => {\n        if (!cancelled) setError(t('forms.runner.error.generic'))\n      })\n    return () => {\n      cancelled = true\n    }\n  }, [formId, t])\n\n  if (error) {\n    return (\n      <main className=\"mx-auto max-w-xl px-4 py-10\">\n        <Alert status=\"error\" style=\"light\">{error}</Alert>\n      </main>\n    )\n  }\n\n  if (!context) {\n    return (\n      <main className=\"mx-auto max-w-xl px-4 py-10\">\n        <LoadingMessage label={t('forms.runner.loading')} />\n      </main>\n    )\n  }\n\n  const params2 = new URLSearchParams()\n  if (searchParams) {\n    for (const [key, value] of searchParams.entries()) params2.set(key, value)\n  }\n  const hidden = pickHiddenFromUrl(context.schema, params2)\n  const locale = context.form.defaultLocale ?? 'en'\n\n  return (\n    <main className=\"mx-auto max-w-3xl px-4 py-10\">\n      <header className=\"mb-4 space-y-1\">\n        <h1 className=\"text-xl font-semibold text-foreground\">{context.form.name}</h1>\n      </header>\n      <FormRunner\n        formId={formId}\n        formVersionId={context.formVersion.id}\n        schema={context.schema}\n        uiSchema={context.uiSchema}\n        hidden={hidden}\n        locale={locale}\n      />\n    </main>\n  )\n}\n"],
+  "mappings": ";AA+CQ,cAqBJ,YArBI;AA7CR,YAAY,WAAW;AACvB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,sBAAsB;AAC/B,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,sBAAsB;AAC/B,SAAS,kBAAkB;AAC3B,SAAS,yBAAyB;AAUnB,SAAR,uBAAwC;AAC7C,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAA0B;AACzC,QAAM,eAAe,gBAAgB;AACrC,QAAM,SAAS,OAAO,QAAQ,MAAM,EAAE;AACtC,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAiC,IAAI;AACzE,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAE5D,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,QAAI,CAAC,OAAQ;AACb,mBAAgC,cAAc,mBAAmB,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,CAAC,EACtG,KAAK,CAAC,WAAW;AAChB,UAAI,UAAW;AACf,UAAI,OAAO,OAAQ,YAAW,OAAO,MAAM;AAAA,UACtC,UAAS,EAAE,4BAA4B,CAAC;AAAA,IAC/C,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,UAAW,UAAS,EAAE,4BAA4B,CAAC;AAAA,IAC1D,CAAC;AACH,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC,CAAC;AAEd,MAAI,OAAO;AACT,WACE,oBAAC,UAAK,WAAU,+BACd,8BAAC,SAAM,QAAO,SAAQ,OAAM,SAAS,iBAAM,GAC7C;AAAA,EAEJ;AAEA,MAAI,CAAC,SAAS;AACZ,WACE,oBAAC,UAAK,WAAU,+BACd,8BAAC,kBAAe,OAAO,EAAE,sBAAsB,GAAG,GACpD;AAAA,EAEJ;AAEA,QAAM,UAAU,IAAI,gBAAgB;AACpC,MAAI,cAAc;AAChB,eAAW,CAAC,KAAK,KAAK,KAAK,aAAa,QAAQ,EAAG,SAAQ,IAAI,KAAK,KAAK;AAAA,EAC3E;AACA,QAAM,SAAS,kBAAkB,QAAQ,QAAQ,OAAO;AACxD,QAAM,SAAS,QAAQ,KAAK,iBAAiB;AAE7C,SACE,qBAAC,UAAK,WAAU,gCACd;AAAA,wBAAC,YAAO,WAAU,kBAChB,8BAAC,QAAG,WAAU,yCAAyC,kBAAQ,KAAK,MAAK,GAC3E;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC;AAAA,QACA,eAAe,QAAQ,YAAY;AAAA,QACnC,QAAQ,QAAQ;AAAA,QAChB,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA;AAAA;AAAA,IACF;AAAA,KACF;AAEJ;",
+  "names": []
+}

package/dist/modules/forms/frontend/forms/[id]/run/page.meta.js

@@ -0,0 +1,11 @@
+const metadata = {
+  requireAuth: true,
+  titleKey: "forms.runner.loading",
+  title: "Form"
+};
+var page_meta_default = metadata;
+export {
+  page_meta_default as default,
+  metadata
+};
+//# sourceMappingURL=page.meta.js.map

package/dist/modules/forms/frontend/forms/[id]/run/page.meta.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/forms/frontend/forms/%5Bid%5D/run/page.meta.ts"],
+  "sourcesContent": ["import type { PageMetadata } from '@open-mercato/shared/modules/registry'\n\n/**\n * In-app runner for a form addressed by its own id. Authenticated: both API\n * routes it calls (`/api/forms/:id/run/context` and `/run/submissions`) are\n * tenant-scoped, because a form id is not a capability a tenant handed out.\n * Anonymous runs belong on `/f/:slug` or `/i/:token`, which go through the\n * `/api/forms/public/*` lifecycle with its availability, cap, CAPTCHA and\n * rate-limit checks.\n */\nexport const metadata: PageMetadata = {\n  requireAuth: true,\n  titleKey: 'forms.runner.loading',\n  title: 'Form',\n}\n\nexport default metadata\n"],
+  "mappings": "AAUO,MAAM,WAAyB;AAAA,EACpC,aAAa;AAAA,EACb,UAAU;AAAA,EACV,OAAO;AACT;AAEA,IAAO,oBAAQ;",
+  "names": []
+}

package/dist/modules/forms/frontend/i/[token]/page.js

@@ -0,0 +1,12 @@
+"use client";
+import { jsx } from "react/jsx-runtime";
+import { PublicFormRunnerPage } from "../../../ui/public/index.js";
+function PersonalInvitationFormRunnerPage({ params }) {
+  const token = params?.token ?? "";
+  if (!token) return null;
+  return /* @__PURE__ */ jsx(PublicFormRunnerPage, { mode: "personal", token });
+}
+export {
+  PersonalInvitationFormRunnerPage as default
+};
+//# sourceMappingURL=page.js.map

package/dist/modules/forms/frontend/i/[token]/page.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/frontend/i/%5Btoken%5D/page.tsx"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { PublicFormRunnerPage } from '../../../ui/public'\n\nexport default function PersonalInvitationFormRunnerPage({ params }: { params?: { token?: string } }) {\n  const token = params?.token ?? ''\n  if (!token) return null\n  return <PublicFormRunnerPage mode=\"personal\" token={token} />\n}\n"],
+  "mappings": ";AAQS;AALT,SAAS,4BAA4B;AAEtB,SAAR,iCAAkD,EAAE,OAAO,GAAoC;AACpG,QAAM,QAAQ,QAAQ,SAAS;AAC/B,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,oBAAC,wBAAqB,MAAK,YAAW,OAAc;AAC7D;",
+  "names": []
+}

package/dist/modules/forms/frontend/i/[token]/page.meta.js

@@ -0,0 +1,11 @@
+const metadata = {
+  requireAuth: false,
+  titleKey: "forms.runner.loading",
+  title: "Form"
+};
+var page_meta_default = metadata;
+export {
+  page_meta_default as default,
+  metadata
+};
+//# sourceMappingURL=page.meta.js.map

package/dist/modules/forms/frontend/i/[token]/page.meta.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/forms/frontend/i/%5Btoken%5D/page.meta.ts"],
+  "sourcesContent": ["import type { PageMetadata } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: PageMetadata = {\n  requireAuth: false,\n  titleKey: 'forms.runner.loading',\n  title: 'Form',\n}\n\nexport default metadata\n"],
+  "mappings": "AAEO,MAAM,WAAyB;AAAA,EACpC,aAAa;AAAA,EACb,UAAU;AAAA,EACV,OAAO;AACT;AAEA,IAAO,oBAAQ;",
+  "names": []
+}

package/dist/modules/forms/index.js

@@ -0,0 +1,20 @@
+import "./commands/index.js";
+const metadata = {
+  name: "forms",
+  title: "Forms",
+  version: "0.1.0",
+  description: "Audit-grade questionnaire and form primitive \u2014 versioned definitions, append-only submissions, role-sliced rendering.",
+  author: "Open Mercato Team",
+  license: "MIT",
+  // Hard, unconditional imports: `attachments` for theme-logo storage and the
+  // Attachment entity, `customer_accounts` for the portal auth the submission
+  // routes and the runtime principal resolve through. Neither is behind a
+  // `tryResolve`, so both are genuine dependencies rather than optional peers.
+  requires: ["attachments", "customer_accounts"]
+};
+import { features } from "./acl.js";
+export {
+  features,
+  metadata
+};
+//# sourceMappingURL=index.js.map

package/dist/modules/forms/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/forms/index.ts"],
+  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\nimport './commands'\n\nexport const metadata: ModuleInfo = {\n  name: 'forms',\n  title: 'Forms',\n  version: '0.1.0',\n  description: 'Audit-grade questionnaire and form primitive \u2014 versioned definitions, append-only submissions, role-sliced rendering.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n  // Hard, unconditional imports: `attachments` for theme-logo storage and the\n  // Attachment entity, `customer_accounts` for the portal auth the submission\n  // routes and the runtime principal resolve through. Neither is behind a\n  // `tryResolve`, so both are genuine dependencies rather than optional peers.\n  requires: ['attachments', 'customer_accounts'],\n}\n\nexport { features } from './acl'\n"],
+  "mappings": "AACA,OAAO;AAEA,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKT,UAAU,CAAC,eAAe,mBAAmB;AAC/C;AAEA,SAAS,gBAAgB;",
+  "names": []
+}

package/dist/modules/forms/lib/embed-frame-policy.js

@@ -0,0 +1,68 @@
+const LOCAL_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function normalizeEmbedOrigin(candidate) {
+  if (typeof candidate !== "string") return null;
+  const trimmed = candidate.trim();
+  if (!trimmed) return null;
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+  if (url.username || url.password) return null;
+  if (url.search || url.hash) return null;
+  if (url.pathname && url.pathname !== "/") return null;
+  if (!url.hostname) return null;
+  const isLocal = LOCAL_HOSTNAMES.has(url.hostname.toLowerCase());
+  if (url.protocol === "http:" && !isLocal) return null;
+  const portSegment = url.port ? `:${url.port}` : "";
+  return `${url.protocol}//${url.hostname}${portSegment}`;
+}
+function normalizeAllowedDomains(domains) {
+  const origins = [];
+  const invalid = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of domains ?? []) {
+    const normalized = normalizeEmbedOrigin(candidate);
+    if (!normalized) {
+      invalid.push(typeof candidate === "string" ? candidate : String(candidate));
+      continue;
+    }
+    if (seen.has(normalized)) continue;
+    seen.add(normalized);
+    origins.push(normalized);
+  }
+  return { origins, invalid };
+}
+function isEmbedEnabled(embed) {
+  if (!embed || embed.enabled !== true) return false;
+  return normalizeAllowedDomains(embed.allowedDomains).origins.length > 0;
+}
+function buildFrameAncestorsCsp(embed) {
+  if (!embed || embed.enabled !== true) return "frame-ancestors 'none'";
+  const { origins } = normalizeAllowedDomains(embed.allowedDomains);
+  if (origins.length === 0) return "frame-ancestors 'none'";
+  return `frame-ancestors ${origins.join(" ")}`;
+}
+function readEmbedSettings(settings) {
+  if (!settings || typeof settings !== "object" || Array.isArray(settings)) return null;
+  const embed = settings.embed;
+  if (!embed || typeof embed !== "object" || Array.isArray(embed)) return null;
+  const record = embed;
+  const theme = record.theme;
+  return {
+    enabled: record.enabled === true,
+    allowedDomains: Array.isArray(record.allowedDomains) ? record.allowedDomains.filter((entry) => typeof entry === "string") : [],
+    theme: theme === "light" || theme === "dark" || theme === "auto" ? theme : void 0,
+    autoResize: record.autoResize === false ? false : true
+  };
+}
+export {
+  buildFrameAncestorsCsp,
+  isEmbedEnabled,
+  normalizeAllowedDomains,
+  normalizeEmbedOrigin,
+  readEmbedSettings
+};
+//# sourceMappingURL=embed-frame-policy.js.map

package/dist/modules/forms/lib/embed-frame-policy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/lib/embed-frame-policy.ts"],
+  "sourcesContent": ["/**\n * Embed framing policy (spec `2026-05-21-forms-render-surfaces.md`, D6 / R-RS-1).\n *\n * Pure, I/O-free helpers shared by the distribution Zod schema, the embed host\n * page, the embed-eligibility guard, and unit tests. They translate a\n * distribution's opt-in `settings.embed` bag into:\n *   - a normalized allowlist of frame-ancestor origins, and\n *   - the `Content-Security-Policy: frame-ancestors <...>` value that authorizes\n *     ONLY those origins to frame the `/embed/:slug` host page.\n *\n * Security posture:\n *   - Framing is disabled by default. An absent / `enabled: false` embed bag, or\n *     an empty allowlist, yields `frame-ancestors 'none'` \u2014 the page can be\n *     framed by no one (fail-closed).\n *   - Origins are validated to a strict shape: scheme + host (+ optional port),\n *     no path / query / fragment, https-only EXCEPT `localhost` / `127.0.0.1`\n *     (which may use http for local development).\n *   - The CSP value never contains `'self'` for the embed route \u2014 third-party\n *     framing is purely allowlist-driven. The app's global frame protection on\n *     every OTHER route is untouched.\n */\n\nconst LOCAL_HOSTNAMES: ReadonlySet<string> = new Set(['localhost', '127.0.0.1', '[::1]'])\n\n/**\n * Per-distribution embed configuration. Rides on the existing\n * `forms_distribution.settings` JSON column \u2014 no migration. All fields optional;\n * an absent bag means embedding is disabled.\n */\nexport type EmbedSettings = {\n  /** Master switch. Default false. */\n  enabled?: boolean\n  /** Allowlisted frame-ancestor origins (drives `frame-ancestors`). */\n  allowedDomains?: string[]\n  /** Theme applied inside the iframe. */\n  theme?: 'light' | 'dark' | 'auto'\n  /** Whether the host page posts auto-resize messages. Default true. */\n  autoResize?: boolean\n}\n\n/**\n * Normalizes a single origin candidate to its canonical `scheme://host[:port]`\n * form, or returns `null` when it is not an acceptable frame-ancestor origin.\n *\n * Acceptable:\n *   - parseable absolute URL with `http:` or `https:` scheme,\n *   - no path beyond `/`, no query, no fragment, no userinfo,\n *   - https required unless the host is a recognized local hostname.\n */\nexport function normalizeEmbedOrigin(candidate: string): string | null {\n  if (typeof candidate !== 'string') return null\n  const trimmed = candidate.trim()\n  if (!trimmed) return null\n\n  let url: URL\n  try {\n    url = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') return null\n  if (url.username || url.password) return null\n  if (url.search || url.hash) return null\n  if (url.pathname && url.pathname !== '/') return null\n  if (!url.hostname) return null\n\n  const isLocal = LOCAL_HOSTNAMES.has(url.hostname.toLowerCase())\n  if (url.protocol === 'http:' && !isLocal) return null\n\n  const portSegment = url.port ? `:${url.port}` : ''\n  return `${url.protocol}//${url.hostname}${portSegment}`\n}\n\n/**\n * Validates a raw allowlist, returning the de-duplicated, normalized origins.\n * Throws nothing \u2014 invalid entries are reported via `invalid`.\n */\nexport function normalizeAllowedDomains(domains: readonly string[] | null | undefined): {\n  origins: string[]\n  invalid: string[]\n} {\n  const origins: string[] = []\n  const invalid: string[] = []\n  const seen = new Set<string>()\n  for (const candidate of domains ?? []) {\n    const normalized = normalizeEmbedOrigin(candidate)\n    if (!normalized) {\n      invalid.push(typeof candidate === 'string' ? candidate : String(candidate))\n      continue\n    }\n    if (seen.has(normalized)) continue\n    seen.add(normalized)\n    origins.push(normalized)\n  }\n  return { origins, invalid }\n}\n\n/**\n * True only when the embed bag is enabled AND carries at least one valid\n * allowlisted origin. Mirrors the save-time validation (R-RS-1): an enabled bag\n * without a usable allowlist is never considered embeddable.\n */\nexport function isEmbedEnabled(embed: EmbedSettings | null | undefined): boolean {\n  if (!embed || embed.enabled !== true) return false\n  return normalizeAllowedDomains(embed.allowedDomains).origins.length > 0\n}\n\n/**\n * Builds the `Content-Security-Policy: frame-ancestors` value for the\n * `/embed/:slug` host page from a distribution's embed bag.\n *\n * Returns `frame-ancestors 'none'` (fail-closed) whenever embedding is disabled\n * or the allowlist resolves to zero valid origins. Otherwise returns\n * `frame-ancestors <space-separated origins>`.\n */\nexport function buildFrameAncestorsCsp(embed: EmbedSettings | null | undefined): string {\n  if (!embed || embed.enabled !== true) return \"frame-ancestors 'none'\"\n  const { origins } = normalizeAllowedDomains(embed.allowedDomains)\n  if (origins.length === 0) return \"frame-ancestors 'none'\"\n  return `frame-ancestors ${origins.join(' ')}`\n}\n\n/**\n * Reads and shallow-validates an `EmbedSettings` bag out of an untyped\n * `distribution.settings` JSON column. Returns `null` when absent or malformed.\n */\nexport function readEmbedSettings(\n  settings: Record<string, unknown> | null | undefined,\n): EmbedSettings | null {\n  if (!settings || typeof settings !== 'object' || Array.isArray(settings)) return null\n  const embed = (settings as Record<string, unknown>).embed\n  if (!embed || typeof embed !== 'object' || Array.isArray(embed)) return null\n  const record = embed as Record<string, unknown>\n  const theme = record.theme\n  return {\n    enabled: record.enabled === true,\n    allowedDomains: Array.isArray(record.allowedDomains)\n      ? record.allowedDomains.filter((entry): entry is string => typeof entry === 'string')\n      : [],\n    theme: theme === 'light' || theme === 'dark' || theme === 'auto' ? theme : undefined,\n    autoResize: record.autoResize === false ? false : true,\n  }\n}\n"],
+  "mappings": "AAsBA,MAAM,kBAAuC,oBAAI,IAAI,CAAC,aAAa,aAAa,OAAO,CAAC;AA2BjF,SAAS,qBAAqB,WAAkC;AACrE,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,OAAO;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QAAS,QAAO;AAClE,MAAI,IAAI,YAAY,IAAI,SAAU,QAAO;AACzC,MAAI,IAAI,UAAU,IAAI,KAAM,QAAO;AACnC,MAAI,IAAI,YAAY,IAAI,aAAa,IAAK,QAAO;AACjD,MAAI,CAAC,IAAI,SAAU,QAAO;AAE1B,QAAM,UAAU,gBAAgB,IAAI,IAAI,SAAS,YAAY,CAAC;AAC9D,MAAI,IAAI,aAAa,WAAW,CAAC,QAAS,QAAO;AAEjD,QAAM,cAAc,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK;AAChD,SAAO,GAAG,IAAI,QAAQ,KAAK,IAAI,QAAQ,GAAG,WAAW;AACvD;AAMO,SAAS,wBAAwB,SAGtC;AACA,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,WAAW,CAAC,GAAG;AACrC,UAAM,aAAa,qBAAqB,SAAS;AACjD,QAAI,CAAC,YAAY;AACf,cAAQ,KAAK,OAAO,cAAc,WAAW,YAAY,OAAO,SAAS,CAAC;AAC1E;AAAA,IACF;AACA,QAAI,KAAK,IAAI,UAAU,EAAG;AAC1B,SAAK,IAAI,UAAU;AACnB,YAAQ,KAAK,UAAU;AAAA,EACzB;AACA,SAAO,EAAE,SAAS,QAAQ;AAC5B;AAOO,SAAS,eAAe,OAAkD;AAC/E,MAAI,CAAC,SAAS,MAAM,YAAY,KAAM,QAAO;AAC7C,SAAO,wBAAwB,MAAM,cAAc,EAAE,QAAQ,SAAS;AACxE;AAUO,SAAS,uBAAuB,OAAiD;AACtF,MAAI,CAAC,SAAS,MAAM,YAAY,KAAM,QAAO;AAC7C,QAAM,EAAE,QAAQ,IAAI,wBAAwB,MAAM,cAAc;AAChE,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,mBAAmB,QAAQ,KAAK,GAAG,CAAC;AAC7C;AAMO,SAAS,kBACd,UACsB;AACtB,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO;AACjF,QAAM,QAAS,SAAqC;AACpD,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,QAAO;AACxE,QAAM,SAAS;AACf,QAAM,QAAQ,OAAO;AACrB,SAAO;AAAA,IACL,SAAS,OAAO,YAAY;AAAA,IAC5B,gBAAgB,MAAM,QAAQ,OAAO,cAAc,IAC/C,OAAO,eAAe,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAClF,CAAC;AAAA,IACL,OAAO,UAAU,WAAW,UAAU,UAAU,UAAU,SAAS,QAAQ;AAAA,IAC3E,YAAY,OAAO,eAAe,QAAQ,QAAQ;AAAA,EACpD;AACF;",
+  "names": []
+}

package/dist/modules/forms/lib/form-definition-slicing.js

@@ -0,0 +1,38 @@
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sliceFormDefinition(schema, uiSchema, visibleFieldKeys) {
+  const sourceProperties = isRecord(schema.properties) ? schema.properties : {};
+  const propertyKeys = new Set(Object.keys(sourceProperties));
+  const properties = Object.fromEntries(
+    Object.entries(sourceProperties).filter(([fieldKey]) => visibleFieldKeys.has(fieldKey))
+  );
+  const required = Array.isArray(schema.required) ? schema.required.filter(
+    (fieldKey) => typeof fieldKey === "string" && visibleFieldKeys.has(fieldKey)
+  ) : void 0;
+  const sections = Array.isArray(schema["x-om-sections"]) ? schema["x-om-sections"].filter(isRecord).map((section) => ({
+    ...section,
+    fieldKeys: Array.isArray(section.fieldKeys) ? section.fieldKeys.filter(
+      (fieldKey) => typeof fieldKey === "string" && visibleFieldKeys.has(fieldKey)
+    ) : []
+  })).filter((section) => section.fieldKeys.length > 0) : void 0;
+  const slicedSchema = { ...schema, properties };
+  if (required !== void 0) slicedSchema.required = required;
+  if (sections !== void 0) slicedSchema["x-om-sections"] = sections;
+  const slicedUiSchema = Object.fromEntries(
+    Object.entries(uiSchema).filter(
+      ([key]) => !propertyKeys.has(key) || visibleFieldKeys.has(key)
+    )
+  );
+  const order = slicedUiSchema["ui:order"];
+  if (Array.isArray(order)) {
+    slicedUiSchema["ui:order"] = order.filter(
+      (key) => key === "*" || typeof key === "string" && visibleFieldKeys.has(key)
+    );
+  }
+  return { schema: slicedSchema, uiSchema: slicedUiSchema };
+}
+export {
+  sliceFormDefinition
+};
+//# sourceMappingURL=form-definition-slicing.js.map

package/dist/modules/forms/lib/form-definition-slicing.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/lib/form-definition-slicing.ts"],
+  "sourcesContent": ["type JsonRecord = Record<string, unknown>\n\nfunction isRecord(value: unknown): value is JsonRecord {\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n}\n\nexport function sliceFormDefinition(\n  schema: JsonRecord,\n  uiSchema: JsonRecord,\n  visibleFieldKeys: ReadonlySet<string>,\n): { schema: JsonRecord; uiSchema: JsonRecord } {\n  const sourceProperties = isRecord(schema.properties) ? schema.properties : {}\n  const propertyKeys = new Set(Object.keys(sourceProperties))\n  const properties = Object.fromEntries(\n    Object.entries(sourceProperties).filter(([fieldKey]) => visibleFieldKeys.has(fieldKey)),\n  )\n  const required = Array.isArray(schema.required)\n    ? schema.required.filter(\n        (fieldKey): fieldKey is string =>\n          typeof fieldKey === 'string' && visibleFieldKeys.has(fieldKey),\n      )\n    : undefined\n  const sections = Array.isArray(schema['x-om-sections'])\n    ? schema['x-om-sections']\n        .filter(isRecord)\n        .map((section) => ({\n          ...section,\n          fieldKeys: Array.isArray(section.fieldKeys)\n            ? section.fieldKeys.filter(\n                (fieldKey): fieldKey is string =>\n                  typeof fieldKey === 'string' && visibleFieldKeys.has(fieldKey),\n              )\n            : [],\n        }))\n        .filter((section) => section.fieldKeys.length > 0)\n    : undefined\n  const slicedSchema: JsonRecord = { ...schema, properties }\n  if (required !== undefined) slicedSchema.required = required\n  if (sections !== undefined) slicedSchema['x-om-sections'] = sections\n\n  const slicedUiSchema = Object.fromEntries(\n    Object.entries(uiSchema).filter(\n      ([key]) => !propertyKeys.has(key) || visibleFieldKeys.has(key),\n    ),\n  )\n  const order = slicedUiSchema['ui:order']\n  if (Array.isArray(order)) {\n    slicedUiSchema['ui:order'] = order.filter(\n      (key) => key === '*' || (typeof key === 'string' && visibleFieldKeys.has(key)),\n    )\n  }\n\n  return { schema: slicedSchema, uiSchema: slicedUiSchema }\n}\n"],
+  "mappings": "AAEA,SAAS,SAAS,OAAqC;AACrD,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,oBACd,QACA,UACA,kBAC8C;AAC9C,QAAM,mBAAmB,SAAS,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;AAC5E,QAAM,eAAe,IAAI,IAAI,OAAO,KAAK,gBAAgB,CAAC;AAC1D,QAAM,aAAa,OAAO;AAAA,IACxB,OAAO,QAAQ,gBAAgB,EAAE,OAAO,CAAC,CAAC,QAAQ,MAAM,iBAAiB,IAAI,QAAQ,CAAC;AAAA,EACxF;AACA,QAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAC1C,OAAO,SAAS;AAAA,IACd,CAAC,aACC,OAAO,aAAa,YAAY,iBAAiB,IAAI,QAAQ;AAAA,EACjE,IACA;AACJ,QAAM,WAAW,MAAM,QAAQ,OAAO,eAAe,CAAC,IAClD,OAAO,eAAe,EACnB,OAAO,QAAQ,EACf,IAAI,CAAC,aAAa;AAAA,IACjB,GAAG;AAAA,IACH,WAAW,MAAM,QAAQ,QAAQ,SAAS,IACtC,QAAQ,UAAU;AAAA,MAChB,CAAC,aACC,OAAO,aAAa,YAAY,iBAAiB,IAAI,QAAQ;AAAA,IACjE,IACA,CAAC;AAAA,EACP,EAAE,EACD,OAAO,CAAC,YAAY,QAAQ,UAAU,SAAS,CAAC,IACnD;AACJ,QAAM,eAA2B,EAAE,GAAG,QAAQ,WAAW;AACzD,MAAI,aAAa,OAAW,cAAa,WAAW;AACpD,MAAI,aAAa,OAAW,cAAa,eAAe,IAAI;AAE5D,QAAM,iBAAiB,OAAO;AAAA,IAC5B,OAAO,QAAQ,QAAQ,EAAE;AAAA,MACvB,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,IAAI,GAAG,KAAK,iBAAiB,IAAI,GAAG;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,QAAQ,eAAe,UAAU;AACvC,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,mBAAe,UAAU,IAAI,MAAM;AAAA,MACjC,CAAC,QAAQ,QAAQ,OAAQ,OAAO,QAAQ,YAAY,iBAAiB,IAAI,GAAG;AAAA,IAC9E;AAAA,EACF;AAEA,SAAO,EAAE,QAAQ,cAAc,UAAU,eAAe;AAC1D;",
+  "names": []
+}

package/dist/modules/forms/lib/log-redaction.js

@@ -0,0 +1,38 @@
+import { redactSensitive } from "../services/encryption-service.js";
+const SENSITIVE_BODY_KEYS = ["patch", "data", "decoded_data", "decodedData", "payload", "body"];
+function wrapLogger(inner, compiled) {
+  const scrub = (payload) => {
+    if (!payload || typeof payload !== "object") return payload;
+    const out = { ...payload };
+    for (const key of SENSITIVE_BODY_KEYS) {
+      const value = out[key];
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        try {
+          out[key] = redactSensitive(compiled, value);
+        } catch {
+          out[key] = "[REDACTION_FAILED]";
+        }
+      }
+    }
+    return out;
+  };
+  return {
+    info: (payload, message) => inner.info(scrub(payload), message),
+    warn: (payload, message) => inner.warn(scrub(payload), message),
+    error: (payload, message) => inner.error(scrub(payload), message)
+  };
+}
+function buildTamperingMarker(args) {
+  return {
+    event: "forms.security.tampering_marker",
+    submissionId: args.submissionId,
+    userId: args.userId,
+    role: args.role,
+    droppedFieldKeys: args.droppedFieldKeys.slice(0, 50)
+  };
+}
+export {
+  buildTamperingMarker,
+  wrapLogger
+};
+//# sourceMappingURL=log-redaction.js.map

package/dist/modules/forms/lib/log-redaction.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/lib/log-redaction.ts"],
+  "sourcesContent": ["/**\n * Forms-module log redaction helpers \u2014 R1 mitigation.\n *\n * Request bodies for `/api/form-submissions/*` MAY contain sensitive PHI/PII\n * fields (medical history, identifiers, free-text notes). The forms module\n * disables request-body logging on these routes by default; if any operator\n * still needs to capture diagnostic payloads, they MUST run them through\n * `redactSensitive` (in `services/encryption-service.ts`) first.\n *\n * This module exposes a thin `wrapLogger(originalLogger, compiled)` helper:\n * given a structured logger interface and a `CompiledFormVersion`, return a\n * proxy logger that scrubs sensitive field values from object payloads\n * before delegating. Loggers that vary by project should adapt this to\n * their own contract.\n *\n * Tampering-marker logs are the second concern this file documents \u2014 they\n * are emitted by `SubmissionService.save` when patches contain fields outside\n * the actor's editable set. The marker carries `(submission_id, user_id,\n * role, dropped_field_keys)` ONLY \u2014 never the offending values.\n */\n\nimport { redactSensitive } from '../services/encryption-service'\nimport type { CompiledFormVersion } from '../services/form-version-compiler'\n\nexport type StructuredLogger = {\n  info(payload: Record<string, unknown>, message?: string): void\n  warn(payload: Record<string, unknown>, message?: string): void\n  error(payload: Record<string, unknown>, message?: string): void\n}\n\nconst SENSITIVE_BODY_KEYS = ['patch', 'data', 'decoded_data', 'decodedData', 'payload', 'body'] as const\n\n/**\n * Wraps a structured logger so that any payload key likely to contain a\n * form payload (`patch`, `data`, `payload`, `body`, `decoded_data`) is\n * passed through `redactSensitive` against the supplied compiled form\n * version before emission.\n *\n * The wrapper is conservative: it never throws; if it cannot interpret the\n * payload it falls back to the raw logger call. Production loggers should\n * additionally be configured to skip request-body logging entirely on the\n * forms namespace.\n */\nexport function wrapLogger(\n  inner: StructuredLogger,\n  compiled: CompiledFormVersion,\n): StructuredLogger {\n  const scrub = (payload: Record<string, unknown>): Record<string, unknown> => {\n    if (!payload || typeof payload !== 'object') return payload\n    const out: Record<string, unknown> = { ...payload }\n    for (const key of SENSITIVE_BODY_KEYS) {\n      const value = out[key]\n      if (value && typeof value === 'object' && !Array.isArray(value)) {\n        try {\n          out[key] = redactSensitive(compiled, value as Record<string, unknown>)\n        } catch {\n          out[key] = '[REDACTION_FAILED]'\n        }\n      }\n    }\n    return out\n  }\n  return {\n    info: (payload, message) => inner.info(scrub(payload), message),\n    warn: (payload, message) => inner.warn(scrub(payload), message),\n    error: (payload, message) => inner.error(scrub(payload), message),\n  }\n}\n\n/**\n * Build a tampering-marker log entry. Used by `SubmissionService.save` when\n * a patch contained fields outside the active actor role's editable set.\n *\n * Keep payload minimal \u2014 submission_id, user_id, role, and the list of\n * dropped field keys. Never include offending values, never include\n * a stack trace.\n */\nexport function buildTamperingMarker(args: {\n  submissionId: string\n  userId: string\n  role: string\n  droppedFieldKeys: string[]\n}): Record<string, unknown> {\n  return {\n    event: 'forms.security.tampering_marker',\n    submissionId: args.submissionId,\n    userId: args.userId,\n    role: args.role,\n    droppedFieldKeys: args.droppedFieldKeys.slice(0, 50),\n  }\n}\n"],
+  "mappings": "AAqBA,SAAS,uBAAuB;AAShC,MAAM,sBAAsB,CAAC,SAAS,QAAQ,gBAAgB,eAAe,WAAW,MAAM;AAavF,SAAS,WACd,OACA,UACkB;AAClB,QAAM,QAAQ,CAAC,YAA8D;AAC3E,QAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,UAAM,MAA+B,EAAE,GAAG,QAAQ;AAClD,eAAW,OAAO,qBAAqB;AACrC,YAAM,QAAQ,IAAI,GAAG;AACrB,UAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAI;AACF,cAAI,GAAG,IAAI,gBAAgB,UAAU,KAAgC;AAAA,QACvE,QAAQ;AACN,cAAI,GAAG,IAAI;AAAA,QACb;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,MAAM,CAAC,SAAS,YAAY,MAAM,KAAK,MAAM,OAAO,GAAG,OAAO;AAAA,IAC9D,MAAM,CAAC,SAAS,YAAY,MAAM,KAAK,MAAM,OAAO,GAAG,OAAO;AAAA,IAC9D,OAAO,CAAC,SAAS,YAAY,MAAM,MAAM,MAAM,OAAO,GAAG,OAAO;AAAA,EAClE;AACF;AAUO,SAAS,qBAAqB,MAKT;AAC1B,SAAO;AAAA,IACL,OAAO;AAAA,IACP,cAAc,KAAK;AAAA,IACnB,QAAQ,KAAK;AAAA,IACb,MAAM,KAAK;AAAA,IACX,kBAAkB,KAAK,iBAAiB,MAAM,GAAG,EAAE;AAAA,EACrD;AACF;",
+  "names": []
+}

package/dist/modules/forms/lib/navigable-url.js

@@ -0,0 +1,24 @@
+const NAVIGABLE_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function normalizeNavigableUrl(candidate) {
+  if (typeof candidate !== "string") return null;
+  const trimmed = candidate.trim();
+  if (!trimmed) return null;
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (!NAVIGABLE_PROTOCOLS.has(url.protocol)) return null;
+  if (url.username || url.password) return null;
+  if (!url.hostname) return null;
+  return url.toString();
+}
+function isNavigableUrl(candidate) {
+  return normalizeNavigableUrl(candidate) !== null;
+}
+export {
+  isNavigableUrl,
+  normalizeNavigableUrl
+};
+//# sourceMappingURL=navigable-url.js.map

package/dist/modules/forms/lib/navigable-url.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/lib/navigable-url.ts"],
+  "sourcesContent": ["/**\n * Navigable-URL policy.\n *\n * Forms lets a designer configure two post-submission redirect targets \u2014 a\n * distribution's `redirect_url` and an ending section's `x-om-redirect-url` \u2014\n * and both end up assigned to `window.location` by a runner. On the anonymous\n * `/f/:slug` and `/embed/:slug` surfaces that runner executes in the app's own\n * origin, under a CSP that allows `'unsafe-inline'`, so a target the browser is\n * willing to treat as script is stored XSS against every respondent.\n *\n * `z.string().url()` does NOT prevent that. Zod's URL check only asks whether\n * `new URL(value)` parses, and `javascript:alert(1)`, `data:text/html,\u2026` and\n * `vbscript:\u2026` all parse. Verified against the repo's installed zod:\n *\n *   z.string().url().max(2000).safeParse('javascript:alert(1)')  \u2192 success\n *\n * So the scheme has to be checked explicitly. This mirrors\n * `normalizeEmbedOrigin` in `embed-frame-policy.ts` \u2014 same fail-closed shape,\n * same http/https-only rule \u2014 but allows a path, query and fragment, which a\n * redirect target needs and an allowlisted frame-ancestor origin must not have.\n */\n\nconst NAVIGABLE_PROTOCOLS: ReadonlySet<string> = new Set(['http:', 'https:'])\n\n/**\n * Canonical form of a URL that is safe to hand to `window.location`, or `null`\n * when it is not one.\n *\n * Rejects every scheme except `http:` and `https:` \u2014 notably `javascript:`,\n * `data:`, `vbscript:`, `blob:` and `file:` \u2014 plus embedded credentials, which\n * browsers render inconsistently and which are a phishing vector in a redirect\n * a respondent never typed. Scheme comparison is on `URL.protocol`, which is\n * already lowercased, so `JaVaScRiPt:` cannot slip past on case.\n */\nexport function normalizeNavigableUrl(candidate: unknown): string | null {\n  if (typeof candidate !== 'string') return null\n  const trimmed = candidate.trim()\n  if (!trimmed) return null\n\n  let url: URL\n  try {\n    url = new URL(trimmed)\n  } catch {\n    return null\n  }\n\n  if (!NAVIGABLE_PROTOCOLS.has(url.protocol)) return null\n  if (url.username || url.password) return null\n  if (!url.hostname) return null\n\n  return url.toString()\n}\n\n/** True when `candidate` is safe to assign to `window.location`. */\nexport function isNavigableUrl(candidate: unknown): boolean {\n  return normalizeNavigableUrl(candidate) !== null\n}\n"],
+  "mappings": "AAsBA,MAAM,sBAA2C,oBAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;AAYrE,SAAS,sBAAsB,WAAmC;AACvE,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,OAAO;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,oBAAoB,IAAI,IAAI,QAAQ,EAAG,QAAO;AACnD,MAAI,IAAI,YAAY,IAAI,SAAU,QAAO;AACzC,MAAI,CAAC,IAAI,SAAU,QAAO;AAE1B,SAAO,IAAI,SAAS;AACtB;AAGO,SAAS,eAAe,WAA6B;AAC1D,SAAO,sBAAsB,SAAS,MAAM;AAC9C;",
+  "names": []
+}

package/dist/modules/forms/lib/retention.js

@@ -0,0 +1,20 @@
+const MS_PER_DAY = 24 * 60 * 60 * 1e3;
+function decideRetention(input) {
+  const { submission, retentionDays, now } = input;
+  const referenceAt = submission.submittedAt ?? submission.updatedAt;
+  if (retentionDays == null || !Number.isFinite(retentionDays) || retentionDays <= 0) {
+    return { eligible: false, reason: "no_retention_policy", referenceAt };
+  }
+  if (submission.anonymizedAt) {
+    return { eligible: false, reason: "already_anonymized", referenceAt };
+  }
+  const cutoff = now.getTime() - retentionDays * MS_PER_DAY;
+  if (referenceAt.getTime() < cutoff) {
+    return { eligible: true, reason: "expired", referenceAt };
+  }
+  return { eligible: false, reason: "within_window", referenceAt };
+}
+export {
+  decideRetention
+};
+//# sourceMappingURL=retention.js.map

package/dist/modules/forms/lib/retention.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/lib/retention.ts"],
+  "sourcesContent": ["/**\n * W5 (DP-6 / DP-11) \u2014 retention eligibility decision.\n *\n * Pure, I/O-free function so the purge worker and unit tests share one\n * source of truth. The decision answers: given a submission's age and the\n * form's retention window, should the submission be purged (anonymized) now?\n *\n * Rules:\n *  - `retentionDays == null` \u21D2 keep forever \u21D2 never eligible.\n *  - `retentionDays <= 0` \u21D2 invalid / disabled \u21D2 never eligible (treated as\n *    \"keep forever\" so a misconfiguration cannot mass-erase data).\n *  - Already-anonymized submissions are never eligible (idempotency \u2014 the\n *    purge has nothing left to do).\n *  - Age is measured from `submittedAt` for terminal submissions, falling\n *    back to `updatedAt` for drafts / reopened submissions that never reached\n *    a submit. The cutoff is `now - retentionDays`; a submission is eligible\n *    once its reference timestamp is strictly older than the cutoff.\n *\n * Consent / signature submissions are NOT special-cased here: the same window\n * applies. Anonymization preserves the immutable version-pinned signed record\n * (only `x-om-sensitive` answers are tombstoned), which satisfies the legal\n * retention story without retaining patient PII beyond the window.\n */\n\nexport type RetentionSubmissionFacts = {\n  /** When the submission was finalised. `null` for drafts / reopened. */\n  submittedAt: Date | null\n  /** Last write timestamp \u2014 the fallback age anchor for non-submitted rows. */\n  updatedAt: Date\n  /** Already-anonymized submissions are never re-eligible. */\n  anonymizedAt: Date | null\n}\n\nexport type RetentionDecisionInput = {\n  submission: RetentionSubmissionFacts\n  /** Form retention window in days; `null`/`<=0` \u21D2 keep forever. */\n  retentionDays: number | null | undefined\n  /** Evaluation clock. */\n  now: Date\n}\n\nexport type RetentionDecision = {\n  eligible: boolean\n  /** Stable reason code \u2014 handy for structured (PII-free) logs and tests. */\n  reason:\n    | 'no_retention_policy'\n    | 'already_anonymized'\n    | 'within_window'\n    | 'expired'\n  /** The age-anchor timestamp the decision used. */\n  referenceAt: Date\n}\n\nconst MS_PER_DAY = 24 * 60 * 60 * 1000\n\nexport function decideRetention(input: RetentionDecisionInput): RetentionDecision {\n  const { submission, retentionDays, now } = input\n  const referenceAt = submission.submittedAt ?? submission.updatedAt\n\n  if (retentionDays == null || !Number.isFinite(retentionDays) || retentionDays <= 0) {\n    return { eligible: false, reason: 'no_retention_policy', referenceAt }\n  }\n\n  if (submission.anonymizedAt) {\n    return { eligible: false, reason: 'already_anonymized', referenceAt }\n  }\n\n  const cutoff = now.getTime() - retentionDays * MS_PER_DAY\n  if (referenceAt.getTime() < cutoff) {\n    return { eligible: true, reason: 'expired', referenceAt }\n  }\n  return { eligible: false, reason: 'within_window', referenceAt }\n}\n"],
+  "mappings": "AAqDA,MAAM,aAAa,KAAK,KAAK,KAAK;AAE3B,SAAS,gBAAgB,OAAkD;AAChF,QAAM,EAAE,YAAY,eAAe,IAAI,IAAI;AAC3C,QAAM,cAAc,WAAW,eAAe,WAAW;AAEzD,MAAI,iBAAiB,QAAQ,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GAAG;AAClF,WAAO,EAAE,UAAU,OAAO,QAAQ,uBAAuB,YAAY;AAAA,EACvE;AAEA,MAAI,WAAW,cAAc;AAC3B,WAAO,EAAE,UAAU,OAAO,QAAQ,sBAAsB,YAAY;AAAA,EACtE;AAEA,QAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB;AAC/C,MAAI,YAAY,QAAQ,IAAI,QAAQ;AAClC,WAAO,EAAE,UAAU,MAAM,QAAQ,WAAW,YAAY;AAAA,EAC1D;AACA,SAAO,EAAE,UAAU,OAAO,QAAQ,iBAAiB,YAAY;AACjE;",
+  "names": []
+}

package/dist/modules/forms/lib/runtime-principal.js

@@ -0,0 +1,59 @@
+import { getCustomerAuthFromRequest } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
+import { FormSubmission, FormSubmissionActor } from "../data/entities.js";
+import { verifyAccessToken } from "../services/distribution-token.js";
+function readBearerToken(req) {
+  const header = req.headers.get("authorization") ?? req.headers.get("Authorization");
+  if (!header) return null;
+  const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+  if (!match) return null;
+  const token = match[1].trim();
+  return token.length > 0 ? token : null;
+}
+async function resolveRuntimePrincipal(args) {
+  const { req, submissionId, em } = args;
+  const bearer = readBearerToken(req);
+  if (bearer) {
+    const verified = verifyAccessToken(bearer);
+    if (verified.ok && verified.submissionId === submissionId && verified.invitationId) {
+      const submission = await em.findOne(FormSubmission, {
+        id: submissionId,
+        deletedAt: null
+      });
+      if (submission) {
+        return {
+          source: "token",
+          principal: verified.invitationId,
+          role: verified.role ?? null,
+          organizationId: submission.organizationId,
+          tenantId: submission.tenantId,
+          submissionId
+        };
+      }
+    }
+    return null;
+  }
+  const auth = await getCustomerAuthFromRequest(req);
+  if (auth) {
+    const actor = await em.findOne(FormSubmissionActor, {
+      submissionId,
+      organizationId: auth.orgId,
+      userId: auth.sub,
+      revokedAt: null,
+      deletedAt: null
+    });
+    if (!actor) return null;
+    return {
+      source: "customer",
+      principal: auth.sub,
+      role: actor.role,
+      organizationId: auth.orgId,
+      tenantId: auth.tenantId,
+      submissionId
+    };
+  }
+  return null;
+}
+export {
+  resolveRuntimePrincipal
+};
+//# sourceMappingURL=runtime-principal.js.map

package/dist/modules/forms/lib/runtime-principal.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/lib/runtime-principal.ts"],
+  "sourcesContent": ["/**\n * Public runtime principal guard \u2014 phase 2d.\n *\n * Resolves the acting principal for a public-runtime submission request from\n * EITHER a submission access token (`Authorization: Bearer <token>`) OR a\n * portal customer session, in that order.\n *\n * Critical invariant (R-2d-4): when the principal comes from an access token,\n * the org/tenant are NEVER trusted from the token body \u2014 they are re-derived\n * from the persisted `forms_form_submission` row. The token only authorizes a\n * single `(submissionId, invitationId, role)` triple; it asserts the token's\n * submission matches the route's submission before trusting anything.\n */\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { FormSubmission, FormSubmissionActor } from '../data/entities'\nimport { verifyAccessToken } from '../services/distribution-token'\n\nexport type RuntimePrincipal = {\n  source: 'token' | 'customer'\n  principal: string\n  role: string | null\n  organizationId: string\n  tenantId: string\n  submissionId: string\n}\n\nexport type ResolveRuntimePrincipalArgs = {\n  req: Request\n  submissionId: string\n  em: EntityManager\n}\n\nfunction readBearerToken(req: Request): string | null {\n  const header = req.headers.get('authorization') ?? req.headers.get('Authorization')\n  if (!header) return null\n  const match = /^Bearer\\s+(.+)$/i.exec(header.trim())\n  if (!match) return null\n  const token = match[1].trim()\n  return token.length > 0 ? token : null\n}\n\nexport async function resolveRuntimePrincipal(\n  args: ResolveRuntimePrincipalArgs,\n): Promise<RuntimePrincipal | null> {\n  const { req, submissionId, em } = args\n\n  const bearer = readBearerToken(req)\n  if (bearer) {\n    const verified = verifyAccessToken(bearer)\n    if (verified.ok && verified.submissionId === submissionId && verified.invitationId) {\n      const submission = await em.findOne(FormSubmission, {\n        id: submissionId,\n        deletedAt: null,\n      })\n      if (submission) {\n        return {\n          source: 'token',\n          principal: verified.invitationId,\n          role: verified.role ?? null,\n          organizationId: submission.organizationId,\n          tenantId: submission.tenantId,\n          submissionId,\n        }\n      }\n    }\n    // A present-but-invalid bearer token does not fall through to customer\n    // auth \u2014 it is an explicit (failed) authorization attempt.\n    return null\n  }\n\n  const auth = await getCustomerAuthFromRequest(req)\n  if (auth) {\n    // A portal session authenticates the customer; it does not by itself\n    // authorize them on THIS submission. Authorization is the active actor row,\n    // exactly as `SubmissionService.save()` requires \u2014 and the actor's role is\n    // what the read-slice is computed from. Without this lookup the branch\n    // returned `role: null`, which `getCurrent` used to read as \"do not slice\",\n    // so any portal customer could read any submission in their own\n    // organization fully decrypted and unsliced.\n    const actor = await em.findOne(FormSubmissionActor, {\n      submissionId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      revokedAt: null,\n      deletedAt: null,\n    })\n    if (!actor) return null\n    return {\n      source: 'customer',\n      principal: auth.sub,\n      role: actor.role,\n      organizationId: auth.orgId,\n      tenantId: auth.tenantId,\n      submissionId,\n    }\n  }\n\n  return null\n}\n"],
+  "mappings": "AAeA,SAAS,kCAAkC;AAC3C,SAAS,gBAAgB,2BAA2B;AACpD,SAAS,yBAAyB;AAiBlC,SAAS,gBAAgB,KAA6B;AACpD,QAAM,SAAS,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,QAAQ,IAAI,eAAe;AAClF,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,mBAAmB,KAAK,OAAO,KAAK,CAAC;AACnD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,CAAC,EAAE,KAAK;AAC5B,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAEA,eAAsB,wBACpB,MACkC;AAClC,QAAM,EAAE,KAAK,cAAc,GAAG,IAAI;AAElC,QAAM,SAAS,gBAAgB,GAAG;AAClC,MAAI,QAAQ;AACV,UAAM,WAAW,kBAAkB,MAAM;AACzC,QAAI,SAAS,MAAM,SAAS,iBAAiB,gBAAgB,SAAS,cAAc;AAClF,YAAM,aAAa,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAClD,IAAI;AAAA,QACJ,WAAW;AAAA,MACb,CAAC;AACD,UAAI,YAAY;AACd,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,WAAW,SAAS;AAAA,UACpB,MAAM,SAAS,QAAQ;AAAA,UACvB,gBAAgB,WAAW;AAAA,UAC3B,UAAU,WAAW;AAAA,UACrB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,MAAM;AAQR,UAAM,QAAQ,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MAClD;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,MAAO,QAAO;AACnB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,KAAK;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,gBAAgB,KAAK;AAAA,MACrB,UAAU,KAAK;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/forms/migrations/Migration20260508135459_forms.js

@@ -0,0 +1,17 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260508135459_forms extends Migration {
+  up() {
+    this.addSql(`create table "forms_form" ("id" uuid not null default gen_random_uuid(), "organization_id" uuid not null, "tenant_id" uuid not null, "key" text not null, "name" text not null, "description" text null, "status" text not null default 'draft', "current_published_version_id" uuid null, "default_locale" text not null, "supported_locales" text[] not null, "created_by" uuid not null, "archived_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "deleted_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "forms_form_org_tenant_deleted_idx" on "forms_form" ("organization_id", "tenant_id", "deleted_at");`);
+    this.addSql(`create index "forms_form_org_status_idx" on "forms_form" ("organization_id", "status");`);
+    this.addSql(`alter table "forms_form" add constraint "forms_form_org_key_unique" unique ("organization_id", "key");`);
+    this.addSql(`create table "forms_form_version" ("id" uuid not null default gen_random_uuid(), "form_id" uuid not null, "organization_id" uuid not null, "tenant_id" uuid not null, "version_number" int not null, "status" text not null default 'draft', "schema" jsonb not null, "ui_schema" jsonb not null, "roles" jsonb not null, "schema_hash" text not null, "registry_version" text not null, "published_at" timestamptz null, "published_by" uuid null, "changelog" text null, "archived_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "forms_form_version_org_tenant_idx" on "forms_form_version" ("organization_id", "tenant_id");`);
+    this.addSql(`create index "forms_form_version_form_id_status_idx" on "forms_form_version" ("form_id", "status");`);
+    this.addSql(`alter table "forms_form_version" add constraint "forms_form_version_form_id_version_number_unique" unique ("form_id", "version_number");`);
+  }
+}
+export {
+  Migration20260508135459_forms
+};
+//# sourceMappingURL=Migration20260508135459_forms.js.map

package/dist/modules/forms/migrations/Migration20260508135459_forms.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/forms/migrations/Migration20260508135459_forms.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260508135459_forms extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`create table \"forms_form\" (\"id\" uuid not null default gen_random_uuid(), \"organization_id\" uuid not null, \"tenant_id\" uuid not null, \"key\" text not null, \"name\" text not null, \"description\" text null, \"status\" text not null default 'draft', \"current_published_version_id\" uuid null, \"default_locale\" text not null, \"supported_locales\" text[] not null, \"created_by\" uuid not null, \"archived_at\" timestamptz null, \"created_at\" timestamptz not null, \"updated_at\" timestamptz not null, \"deleted_at\" timestamptz null, primary key (\"id\"));`);\n    this.addSql(`create index \"forms_form_org_tenant_deleted_idx\" on \"forms_form\" (\"organization_id\", \"tenant_id\", \"deleted_at\");`);\n    this.addSql(`create index \"forms_form_org_status_idx\" on \"forms_form\" (\"organization_id\", \"status\");`);\n    this.addSql(`alter table \"forms_form\" add constraint \"forms_form_org_key_unique\" unique (\"organization_id\", \"key\");`);\n\n    this.addSql(`create table \"forms_form_version\" (\"id\" uuid not null default gen_random_uuid(), \"form_id\" uuid not null, \"organization_id\" uuid not null, \"tenant_id\" uuid not null, \"version_number\" int not null, \"status\" text not null default 'draft', \"schema\" jsonb not null, \"ui_schema\" jsonb not null, \"roles\" jsonb not null, \"schema_hash\" text not null, \"registry_version\" text not null, \"published_at\" timestamptz null, \"published_by\" uuid null, \"changelog\" text null, \"archived_at\" timestamptz null, \"created_at\" timestamptz not null, \"updated_at\" timestamptz not null, primary key (\"id\"));`);\n    this.addSql(`create index \"forms_form_version_org_tenant_idx\" on \"forms_form_version\" (\"organization_id\", \"tenant_id\");`);\n    this.addSql(`create index \"forms_form_version_form_id_status_idx\" on \"forms_form_version\" (\"form_id\", \"status\");`);\n    this.addSql(`alter table \"forms_form_version\" add constraint \"forms_form_version_form_id_version_number_unique\" unique (\"form_id\", \"version_number\");`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,sCAAsC,UAAU;AAAA,EAElD,KAA2B;AAClC,SAAK,OAAO,uhBAAuhB;AACniB,SAAK,OAAO,kHAAkH;AAC9H,SAAK,OAAO,yFAAyF;AACrG,SAAK,OAAO,wGAAwG;AAEpH,SAAK,OAAO,ukBAAukB;AACnlB,SAAK,OAAO,4GAA4G;AACxH,SAAK,OAAO,qGAAqG;AACjH,SAAK,OAAO,0IAA0I;AAAA,EACxJ;AAEF;",
+  "names": []
+}

package/dist/modules/forms/migrations/Migration20260508140932_forms.js

@@ -0,0 +1,23 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260508140932_forms extends Migration {
+  up() {
+    this.addSql(`create table "forms_form_submission" ("id" uuid not null default gen_random_uuid(), "organization_id" uuid not null, "tenant_id" uuid not null, "form_version_id" uuid not null, "subject_type" text not null, "subject_id" uuid not null, "status" text not null default 'draft', "current_revision_id" uuid null, "started_by" uuid not null, "submitted_by" uuid null, "first_saved_at" timestamptz not null, "submitted_at" timestamptz null, "submit_metadata" jsonb null, "pdf_snapshot_attachment_id" uuid null, "anonymized_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "deleted_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "forms_form_submission_org_version_status_idx" on "forms_form_submission" ("organization_id", "form_version_id", "status");`);
+    this.addSql(`create index "forms_form_submission_subject_idx" on "forms_form_submission" ("subject_type", "subject_id");`);
+    this.addSql(`create index "forms_form_submission_org_submitted_at_idx" on "forms_form_submission" ("organization_id", "submitted_at");`);
+    this.addSql(`create index "forms_form_submission_org_tenant_deleted_idx" on "forms_form_submission" ("organization_id", "tenant_id", "deleted_at");`);
+    this.addSql(`create table "forms_form_submission_actor" ("id" uuid not null default gen_random_uuid(), "submission_id" uuid not null, "organization_id" uuid not null, "user_id" uuid not null, "role" text not null, "assigned_at" timestamptz not null, "revoked_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "deleted_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "forms_form_submission_actor_org_idx" on "forms_form_submission_actor" ("organization_id");`);
+    this.addSql(`create index "forms_form_submission_actor_submission_role_idx" on "forms_form_submission_actor" ("submission_id", "role");`);
+    this.addSql(`create unique index "forms_form_submission_actor_submission_user_active_unique" on "forms_form_submission_actor" ("submission_id", "user_id") where "revoked_at" is null;`);
+    this.addSql(`create table "forms_form_submission_revision" ("id" uuid not null default gen_random_uuid(), "submission_id" uuid not null, "organization_id" uuid not null, "revision_number" int not null, "data" bytea not null, "encryption_key_version" int not null, "saved_at" timestamptz not null, "saved_by" uuid not null, "saved_by_role" text not null, "change_source" text not null default 'user', "changed_field_keys" text[] not null, "change_summary" text null, "anonymized_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`create index "forms_form_submission_revision_submission_idx" on "forms_form_submission_revision" ("submission_id", "revision_number");`);
+    this.addSql(`create index "forms_form_submission_revision_org_saved_idx" on "forms_form_submission_revision" ("organization_id", "saved_at");`);
+    this.addSql(`create table "forms_encryption_key" ("id" uuid not null default gen_random_uuid(), "organization_id" uuid not null, "key_version" int not null, "wrapped_dek" bytea not null, "created_at" timestamptz not null, "retired_at" timestamptz null, primary key ("id"));`);
+    this.addSql(`alter table "forms_encryption_key" add constraint "forms_encryption_key_org_version_unique" unique ("organization_id", "key_version");`);
+  }
+}
+export {
+  Migration20260508140932_forms
+};
+//# sourceMappingURL=Migration20260508140932_forms.js.map