@prenta/core 0.118.0

package/dist/forms/delivery.js

@@ -0,0 +1,477 @@
+/**
+ * Per-submission form delivery attempts (#675).
+ *
+ * Channel contract (fail-open):
+ * - Public submit always persists the lead first; delivery never rolls it back.
+ * - `email_notify` / `email_autoresponder`: best-effort via platform email adapter.
+ *   Missing adapter → `skipped` (not failed). Send errors → `failed` / `retrying`.
+ * - `form_webhook`: best-effort signed POST via safeFetch. SSRF / hard 4xx →
+ *   `failed` immediately; soft failures schedule durable retries.
+ *
+ * Operator alert: one email to the form's notify recipients when an attempt
+ * transitions to permanent `failed` (opt-out by leaving recipients empty).
+ */
+import { getDB } from '../db.js';
+import { resolveEmailSenderAsync } from '../email/resolve.js';
+import { createLogger } from '../diagnostics/logger.js';
+import { getFormById } from './service.js';
+import { sendEmailForDeliveryRetry } from './notify.js';
+import { decryptSubmissionData } from './encryption.js';
+import { deliverFormWebhookById } from './webhooks.js';
+const logger = createLogger('forms-delivery');
+const RETRY_DELAYS_MS = [30_000, 120_000, 600_000];
+const DEFAULT_MAX_ATTEMPTS = 3;
+const MAX_ERROR_LEN = 1000;
+function db() {
+    return getDB();
+}
+function toISO(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === 'string' && value)
+        return value;
+    return null;
+}
+function asChannel(value) {
+    if (value === 'email_notify' || value === 'email_autoresponder' || value === 'form_webhook') {
+        return value;
+    }
+    return 'form_webhook';
+}
+function asStatus(value) {
+    if (value === 'pending' ||
+        value === 'retrying' ||
+        value === 'success' ||
+        value === 'failed' ||
+        value === 'skipped') {
+        return value;
+    }
+    return 'pending';
+}
+function parseRow(row) {
+    return {
+        id: String(row.id),
+        submissionId: String(row.submissionId),
+        formId: String(row.formId),
+        channel: asChannel(String(row.channel)),
+        destination: String(row.destination),
+        webhookId: row.webhookId != null ? String(row.webhookId) : null,
+        status: asStatus(String(row.status)),
+        attempts: Number(row.attempts ?? 0),
+        maxAttempts: Number(row.maxAttempts ?? DEFAULT_MAX_ATTEMPTS),
+        lastAttemptAt: toISO(row.lastAttemptAt),
+        nextRetryAt: toISO(row.nextRetryAt),
+        error: row.error != null ? String(row.error) : null,
+        responseStatus: typeof row.responseStatus === 'number' ? row.responseStatus : null,
+        skippedReason: row.skippedReason != null ? String(row.skippedReason) : null,
+        alertedAt: toISO(row.alertedAt),
+        createdAt: toISO(row.createdAt) ?? new Date().toISOString(),
+        updatedAt: toISO(row.updatedAt) ?? new Date().toISOString(),
+    };
+}
+/** Create a pending delivery attempt row before sending. */
+export async function createDeliveryAttempt(input) {
+    const row = await db().formDeliveryAttempt.create({
+        data: {
+            submissionId: input.submissionId,
+            formId: input.formId,
+            channel: input.channel,
+            destination: input.destination.slice(0, 500),
+            webhookId: input.webhookId ?? null,
+            status: 'pending',
+            attempts: 0,
+            maxAttempts: input.maxAttempts ?? DEFAULT_MAX_ATTEMPTS,
+            payload: input.payload ?? undefined,
+        },
+    });
+    return { id: String(row.id) };
+}
+/** Mark an attempt skipped (e.g. notifications disabled / no email adapter). */
+export async function markDeliverySkipped(attemptId, reason) {
+    try {
+        await db().formDeliveryAttempt.update({
+            where: { id: attemptId },
+            data: {
+                status: 'skipped',
+                skippedReason: reason.slice(0, MAX_ERROR_LEN),
+                lastAttemptAt: new Date(),
+                nextRetryAt: null,
+            },
+        });
+    }
+    catch (err) {
+        logger.error('failed to mark delivery skipped', {
+            attemptId,
+            reason: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/** Mark an attempt successful after a send. */
+export async function markDeliverySuccess(attemptId, opts = {}) {
+    try {
+        const data = {
+            status: 'success',
+            lastAttemptAt: new Date(),
+            nextRetryAt: null,
+            error: null,
+            responseStatus: opts.responseStatus ?? null,
+        };
+        if (typeof opts.attempts === 'number') {
+            data.attempts = opts.attempts;
+        }
+        else {
+            data.attempts = { increment: 1 };
+        }
+        await db().formDeliveryAttempt.update({ where: { id: attemptId }, data });
+    }
+    catch (err) {
+        logger.error('failed to mark delivery success', {
+            attemptId,
+            reason: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+/**
+ * Record a failed send. Schedules durable retry while attempts remain; otherwise
+ * marks permanent failure and fires a one-shot operator alert.
+ */
+export async function markDeliveryFailure(attemptId, opts) {
+    try {
+        const existing = await db().formDeliveryAttempt.findUnique({ where: { id: attemptId } });
+        if (!existing)
+            return;
+        const attempt = typeof opts.attempts === 'number' ? opts.attempts : Number(existing.attempts ?? 0) + 1;
+        const maxAttempts = Number(existing.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+        const permanent = opts.permanent || attempt >= maxAttempts;
+        const error = opts.error.slice(0, MAX_ERROR_LEN);
+        if (permanent) {
+            await db().formDeliveryAttempt.update({
+                where: { id: attemptId },
+                data: {
+                    status: 'failed',
+                    attempts: attempt,
+                    lastAttemptAt: new Date(),
+                    nextRetryAt: null,
+                    error,
+                    responseStatus: opts.responseStatus ?? null,
+                },
+            });
+            await maybeAlertOperator(attemptId).catch(() => { });
+            return;
+        }
+        const delay = RETRY_DELAYS_MS[attempt - 1] ?? RETRY_DELAYS_MS[RETRY_DELAYS_MS.length - 1];
+        await db().formDeliveryAttempt.update({
+            where: { id: attemptId },
+            data: {
+                status: 'retrying',
+                attempts: attempt,
+                lastAttemptAt: new Date(),
+                nextRetryAt: new Date(Date.now() + delay),
+                error,
+                responseStatus: opts.responseStatus ?? null,
+            },
+        });
+    }
+    catch (err) {
+        logger.error('failed to mark delivery failure', {
+            attemptId,
+            reason: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+async function maybeAlertOperator(attemptId) {
+    const row = await db().formDeliveryAttempt.findUnique({ where: { id: attemptId } });
+    if (!row || row.alertedAt || row.status !== 'failed')
+        return;
+    const form = await getFormById(String(row.formId));
+    const recipients = (form?.notificationSettings?.recipients ?? []).filter((r) => typeof r === 'string' && r.includes('@'));
+    if (recipients.length === 0)
+        return;
+    const email = await resolveEmailSenderAsync();
+    if (!email)
+        return;
+    const channelLabel = row.channel === 'email_notify'
+        ? 'admin notification email'
+        : row.channel === 'email_autoresponder'
+            ? 'autoresponder email'
+            : 'form webhook';
+    const subject = `Form delivery failed: ${form?.name ?? row.formId}`;
+    const html = `<div style="font-family:system-ui,sans-serif;color:#111;max-width:640px">
+<p>A form delivery permanently failed after ${row.attempts} attempt(s).</p>
+<ul>
+<li><strong>Form:</strong> ${escapeHtml(form?.name ?? String(row.formId))}</li>
+<li><strong>Channel:</strong> ${escapeHtml(channelLabel)}</li>
+<li><strong>Destination:</strong> ${escapeHtml(String(row.destination))}</li>
+<li><strong>Error:</strong> ${escapeHtml(String(row.error ?? 'unknown'))}</li>
+<li><strong>Submission:</strong> ${escapeHtml(String(row.submissionId))}</li>
+</ul>
+<p>Retry from Admin → Forms → Deliveries without re-submitting the lead.</p>
+</div>`;
+    try {
+        const text = `Form delivery failed (${channelLabel}) to ${row.destination}: ${row.error ?? 'unknown'}`;
+        for (const to of recipients) {
+            await email.send({ to: to.trim(), subject, html, text });
+        }
+        await db().formDeliveryAttempt.update({
+            where: { id: attemptId },
+            data: { alertedAt: new Date() },
+        });
+    }
+    catch (err) {
+        logger.error('operator delivery alert failed', {
+            attemptId,
+            reason: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/** List delivery attempts (defaults to failed + retrying for the admin inbox). */
+export async function listFormDeliveries(params = {}) {
+    const page = Math.max(1, params.page ?? 1);
+    const pageSize = Math.min(100, Math.max(1, params.pageSize ?? 25));
+    const statusFilter = params.status
+        ? Array.isArray(params.status)
+            ? params.status
+            : [params.status]
+        : ['failed', 'retrying'];
+    const where = {
+        status: { in: statusFilter },
+    };
+    if (params.formId)
+        where.formId = params.formId;
+    if (params.submissionId)
+        where.submissionId = params.submissionId;
+    const [rows, total] = await Promise.all([
+        db().formDeliveryAttempt.findMany({
+            where,
+            orderBy: { updatedAt: 'desc' },
+            skip: (page - 1) * pageSize,
+            take: pageSize,
+        }),
+        db().formDeliveryAttempt.count({ where }),
+    ]);
+    const formIds = [...new Set(rows.map((r) => String(r.formId)))];
+    const submissionIds = [
+        ...new Set(rows.map((r) => String(r.submissionId))),
+    ];
+    const [forms, submissions] = await Promise.all([
+        formIds.length
+            ? db().document.findMany({
+                where: { id: { in: formIds }, collection: 'forms', deletedAt: null },
+                select: { id: true, data: true },
+            })
+            : Promise.resolve([]),
+        submissionIds.length
+            ? db().formSubmission.findMany({
+                where: { id: { in: submissionIds } },
+                select: { id: true, entryNumber: true },
+            })
+            : Promise.resolve([]),
+    ]);
+    const formNameById = new Map();
+    for (const f of forms) {
+        const data = f.data && typeof f.data === 'object' ? f.data : {};
+        formNameById.set(f.id, typeof data.name === 'string' ? data.name : f.id);
+    }
+    const entryById = new Map();
+    for (const s of submissions) {
+        entryById.set(s.id, s.entryNumber);
+    }
+    return {
+        docs: rows.map((r) => {
+            const parsed = parseRow(r);
+            return {
+                ...parsed,
+                formName: formNameById.get(parsed.formId) ?? null,
+                entryNumber: entryById.get(parsed.submissionId) ?? null,
+            };
+        }),
+        total,
+        page,
+        pageSize,
+    };
+}
+export class FormDeliveryError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.name = 'FormDeliveryError';
+        this.status = status;
+    }
+}
+/**
+ * Retry a single delivery attempt without re-submitting the form.
+ * Email channels re-send from current form notification settings + submission data.
+ * Webhook channels re-dispatch the stored payload (or rebuild from submission).
+ */
+export async function retryFormDelivery(attemptId) {
+    const row = await db().formDeliveryAttempt.findUnique({ where: { id: attemptId } });
+    if (!row)
+        throw new FormDeliveryError('Delivery attempt not found', 404);
+    const channel = asChannel(String(row.channel));
+    if (channel === 'form_webhook') {
+        await retryWebhookAttempt(row);
+    }
+    else {
+        await retryEmailAttempt(row, channel);
+    }
+    const updated = await db().formDeliveryAttempt.findUnique({ where: { id: attemptId } });
+    if (!updated)
+        throw new FormDeliveryError('Delivery attempt not found', 404);
+    return parseRow(updated);
+}
+async function retryEmailAttempt(row, channel) {
+    const attemptId = String(row.id);
+    const form = await getFormById(String(row.formId));
+    if (!form) {
+        await markDeliveryFailure(attemptId, { error: 'Form not found', permanent: true });
+        return;
+    }
+    const submission = await db().formSubmission.findUnique({
+        where: { id: String(row.submissionId) },
+    });
+    if (!submission) {
+        await markDeliveryFailure(attemptId, { error: 'Submission not found', permanent: true });
+        return;
+    }
+    const fields = (form.fields ?? []);
+    const rawData = submission.data && typeof submission.data === 'object' && !Array.isArray(submission.data)
+        ? submission.data
+        : {};
+    const data = (await decryptSubmissionData(rawData)) ?? {};
+    const emailCtx = {
+        formId: form.id,
+        formName: form.name,
+        entryNumber: submission.entryNumber,
+        submittedAt: submission.submittedAt instanceof Date
+            ? submission.submittedAt.toISOString()
+            : String(submission.submittedAt),
+        fields,
+        data,
+        senderName: submission.senderName,
+        senderEmail: channel === 'email_autoresponder' ? String(row.destination) : submission.senderEmail,
+        attribution: submission.attribution && typeof submission.attribution === 'object'
+            ? submission.attribution
+            : null,
+        submissionId: String(submission.id),
+    };
+    const settings = form.notificationSettings ?? { enabled: true, recipients: [] };
+    const result = await sendEmailForDeliveryRetry({
+        settings,
+        ctx: emailCtx,
+        channel,
+        destination: String(row.destination),
+    });
+    if (result.ok) {
+        await markDeliverySuccess(attemptId, { attempts: Number(row.attempts ?? 0) + 1 });
+    }
+    else if (result.skippedReason) {
+        await markDeliverySkipped(attemptId, result.skippedReason);
+    }
+    else {
+        await markDeliveryFailure(attemptId, {
+            error: result.error ?? 'Send failed',
+            permanent: false,
+        });
+    }
+}
+async function retryWebhookAttempt(row) {
+    const attemptId = String(row.id);
+    const stored = row.payload && typeof row.payload === 'object' && !Array.isArray(row.payload)
+        ? row.payload
+        : null;
+    const submission = await db().formSubmission.findUnique({
+        where: { id: String(row.submissionId) },
+    });
+    if (!submission) {
+        await markDeliveryFailure(attemptId, { error: 'Submission not found', permanent: true });
+        return;
+    }
+    const form = await getFormById(String(row.formId));
+    const webhookId = row.webhookId != null ? String(row.webhookId) : null;
+    if (!webhookId) {
+        await markDeliveryFailure(attemptId, { error: 'Missing webhook id', permanent: true });
+        return;
+    }
+    const payload = {
+        event: (typeof stored?.event === 'string'
+            ? stored.event
+            : 'form.submitted'),
+        formId: String(row.formId),
+        formSlug: typeof stored?.formSlug === 'string' ? stored.formSlug : form?.slug,
+        submissionId: String(row.submissionId),
+        entryNumber: submission.entryNumber,
+        data: stored?.data && typeof stored.data === 'object'
+            ? stored.data
+            : submission.data && typeof submission.data === 'object'
+                ? submission.data
+                : {},
+        attribution: stored?.attribution && typeof stored.attribution === 'object'
+            ? stored.attribution
+            : submission.attribution && typeof submission.attribution === 'object'
+                ? submission.attribution
+                : null,
+    };
+    const result = await deliverFormWebhookById(webhookId, payload);
+    if (result.ok) {
+        await markDeliverySuccess(attemptId, {
+            attempts: Number(row.attempts ?? 0) + 1,
+            responseStatus: result.status,
+        });
+    }
+    else {
+        const hardFail = result.status >= 400 && result.status < 500 && result.status !== 408 && result.status !== 429;
+        await markDeliveryFailure(attemptId, {
+            error: result.error ?? `HTTP ${result.status}`,
+            responseStatus: result.status,
+            permanent: hardFail || Boolean(result.error?.startsWith('SSRF')),
+        });
+    }
+}
+/** Process due `retrying` attempts (cron / admin batch). */
+export async function processFormDeliveryRetries(limit = 50) {
+    const due = await db().formDeliveryAttempt.findMany({
+        where: {
+            status: 'retrying',
+            nextRetryAt: { lte: new Date() },
+        },
+        orderBy: { nextRetryAt: 'asc' },
+        take: Math.min(100, Math.max(1, limit)),
+    });
+    let succeeded = 0;
+    let failed = 0;
+    for (const row of due) {
+        try {
+            const updated = await retryFormDelivery(String(row.id));
+            if (updated.status === 'success')
+                succeeded++;
+            else if (updated.status === 'failed')
+                failed++;
+        }
+        catch (err) {
+            failed++;
+            logger.error('delivery retry failed', {
+                attemptId: row.id,
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return { processed: due.length, succeeded, failed };
+}
+/** Count failed deliveries (for sidebar badge). */
+export async function countFailedFormDeliveries(formId) {
+    return db().formDeliveryAttempt.count({
+        where: {
+            status: 'failed',
+            ...(formId ? { formId } : {}),
+        },
+    });
+}
+//# sourceMappingURL=delivery.js.map

package/dist/forms/delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.js","sourceRoot":"","sources":["../../src/forms/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,yBAAyB,EAA+B,MAAM,aAAa,CAAA;AACpF,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AACvD,OAAO,EAAE,sBAAsB,EAA2B,MAAM,eAAe,CAAA;AAK/E,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AA2B7C,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;AAClD,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAA;AAI1B,SAAS,EAAE;IACT,OAAO,KAAK,EAAM,CAAA;AACpB,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACpD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,qBAAqB,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC5F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,cAAc,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,SAAS,EACnB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,GAA6B;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;QAC/D,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC5D,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;QACvC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACnD,cAAc,EAAE,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAClF,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;QAC3E,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC3D,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC5D,CAAA;AACH,CAAC;AAYD,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAiC;IAEjC,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE;YACJ,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,CAAC;YACX,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,oBAAoB;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;SACpC;KACF,CAAC,CAAA;IACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAA;AAC/B,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YACxB,IAAI,EAAE;gBACJ,MAAM,EAAE,SAAS;gBACjB,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC;gBAC7C,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,WAAW,EAAE,IAAI;aAClB;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,SAAS;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,OAA8D,EAAE;IAEhE,IAAI,CAAC;QACH,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,IAAI,IAAI,EAAE;YACzB,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;SAC5C,CAAA;QACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC/B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,CAAA;QAClC,CAAC;QACD,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,SAAS;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,IAOC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACxF,IAAI,CAAC,QAAQ;YAAE,OAAM;QAErB,MAAM,OAAO,GACX,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACxF,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAA;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI,WAAW,CAAA;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAA;QAEhD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;gBACxB,IAAI,EAAE;oBACJ,MAAM,EAAE,QAAQ;oBAChB,QAAQ,EAAE,OAAO;oBACjB,aAAa,EAAE,IAAI,IAAI,EAAE;oBACzB,WAAW,EAAE,IAAI;oBACjB,KAAK;oBACL,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;aACF,CAAC,CAAA;YACF,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACnD,OAAM;QACR,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;QAC1F,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YACxB,IAAI,EAAE;gBACJ,MAAM,EAAE,UAAU;gBAClB,QAAQ,EAAE,OAAO;gBACjB,aAAa,EAAE,IAAI,IAAI,EAAE;gBACzB,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;gBACzC,KAAK;gBACL,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;aAC5C;SACF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YAC9C,SAAS;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,SAAiB;IACjD,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAM;IAE5D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,oBAAoB,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CACtE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAChD,CAAA;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEnC,MAAM,KAAK,GAAG,MAAM,uBAAuB,EAAE,CAAA;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAM;IAElB,MAAM,YAAY,GAChB,GAAG,CAAC,OAAO,KAAK,cAAc;QAC5B,CAAC,CAAC,0BAA0B;QAC5B,CAAC,CAAC,GAAG,CAAC,OAAO,KAAK,qBAAqB;YACrC,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,cAAc,CAAA;IAEtB,MAAM,OAAO,GAAG,yBAAyB,IAAI,EAAE,IAAI,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;IACnE,MAAM,IAAI,GAAG;8CAC+B,GAAG,CAAC,QAAQ;;6BAE7B,UAAU,CAAC,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gCACzC,UAAU,CAAC,YAAY,CAAC;oCACpB,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;8BACzC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC;mCACrC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;;;OAGhE,CAAA;IAEL,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,yBAAyB,YAAY,QAAQ,GAAG,CAAC,WAAW,KAAK,GAAG,CAAC,KAAK,IAAI,SAAS,EAAE,CAAA;QACtG,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1D,CAAC;QACD,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;YACxB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC7C,SAAS;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACzD,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;AAC3B,CAAC;AAiBD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAmC,EAAE;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAA;IAClE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM;QAChC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,MAAM;YACf,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QACnB,CAAC,CAAE,CAAC,QAAQ,EAAE,UAAU,CAA0B,CAAA;IAEpD,MAAM,KAAK,GAA4B;QACrC,MAAM,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;KAC7B,CAAA;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC/C,IAAI,MAAM,CAAC,YAAY;QAAE,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAA;IAEjE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YAChC,KAAK;YACL,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ;YAC3B,IAAI,EAAE,QAAQ;SACf,CAAC;QACF,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;IACnF,MAAM,aAAa,GAAG;QACpB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAA2B,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;KAC9E,CAAA;IAED,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,OAAO,CAAC,MAAM;YACZ,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACrB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;gBACpE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;aACjC,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,aAAa,CAAC,MAAM;YAClB,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;gBACpC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;aACxC,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;KACxB,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,KAA6C,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5F,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAA;IAClD,KAAK,MAAM,CAAC,IAAI,WAAgE,EAAE,CAAC;QACjF,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAA;IACpC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO;gBACL,GAAG,MAAM;gBACT,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI;gBACjD,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,IAAI;aACxD,CAAA;QACH,CAAC,CAAC;QACF,KAAK;QACL,IAAI;QACJ,QAAQ;KACT,CAAA;AACH,CAAC;AAED,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,MAAM,CAAQ;IACd,YAAY,OAAe,EAAE,MAAM,GAAG,GAAG;QACvC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAA;IAExE,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9C,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;IACvF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,iBAAiB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAA;IAC5E,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAA6B,EAC7B,OAA+C;IAE/C,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,mBAAmB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClF,OAAM;IACR,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;KACxC,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,mBAAmB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAgB,CAAA;IACjD,MAAM,OAAO,GACX,UAAU,CAAC,IAAI,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACvF,CAAC,CAAE,UAAU,CAAC,IAAgC;QAC9C,CAAC,CAAC,EAAE,CAAA;IACR,MAAM,IAAI,GAAG,CAAC,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAEzD,MAAM,QAAQ,GAA2B;QACvC,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,QAAQ,EAAE,IAAI,CAAC,IAAI;QACnB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EACT,UAAU,CAAC,WAAW,YAAY,IAAI;YACpC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,EAAE;YACtC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;QACpC,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,WAAW,EACT,OAAO,KAAK,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;QACtF,WAAW,EACT,UAAU,CAAC,WAAW,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;YAClE,CAAC,CAAE,UAAU,CAAC,WAAuC;YACrD,CAAC,CAAC,IAAI;QACV,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;KACpC,CAAA;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC/E,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;QAC7C,QAAQ;QACR,GAAG,EAAE,QAAQ;QACb,OAAO;QACP,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;KACrC,CAAC,CAAA;IAEF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,mBAAmB,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;SAAM,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QAChC,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,aAAa,CAAC,CAAA;IAC5D,CAAC;SAAM,CAAC;QACN,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,aAAa;YACpC,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,GAA6B;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,MAAM,GACV,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3E,CAAC,CAAE,GAAG,CAAC,OAAmC;QAC1C,CAAC,CAAC,IAAI,CAAA;IAEV,MAAM,UAAU,GAAG,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;KACxC,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,mBAAmB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACxF,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,mBAAmB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACtF,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAA0C;QACrD,KAAK,EAAE,CAAC,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ;YACvC,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,gBAAgB,CAAgC;QACpD,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,OAAO,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI;QAC7E,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACtC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,IAAI,EACF,MAAM,EAAE,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7C,CAAC,CAAE,MAAM,CAAC,IAAgC;YAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ;gBACtD,CAAC,CAAE,UAAU,CAAC,IAAgC;gBAC9C,CAAC,CAAC,EAAE;QACV,WAAW,EACT,MAAM,EAAE,WAAW,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YAC3D,CAAC,CAAE,MAAM,CAAC,WAAuC;YACjD,CAAC,CAAC,UAAU,CAAC,WAAW,IAAI,OAAO,UAAU,CAAC,WAAW,KAAK,QAAQ;gBACpE,CAAC,CAAE,UAAU,CAAC,WAAuC;gBACrD,CAAC,CAAC,IAAI;KACb,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC/D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACnC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;YACvC,cAAc,EAAE,MAAM,CAAC,MAAM;SAC9B,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GACZ,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,CAAA;QAC/F,MAAM,mBAAmB,CAAC,SAAS,EAAE;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE;YAC9C,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,SAAS,EAAE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;SACjE,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAK,GAAG,EAAE;IAEV,MAAM,GAAG,GAAG,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAClD,KAAK,EAAE;YACL,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,EAAE;SACjC;QACD,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;QAC/B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;KACxC,CAAC,CAAA;IAEF,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS,EAAE,CAAA;iBACxC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM,EAAE,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,EAAE,CAAA;YACR,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBACpC,SAAS,EAAE,GAAG,CAAC,EAAE;gBACjB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AACrD,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAe;IAC7D,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B;KACF,CAAC,CAAA;AACJ,CAAC"}

package/dist/forms/encryption.d.ts

@@ -0,0 +1,20 @@
+import type { FormField } from './types.js';
+/** Whether a field's stored value should be encrypted at rest. */
+export declare function fieldShouldEncrypt(field: FormField): boolean;
+/**
+ * Encrypt the sensitive values in a submission data record. Returns a new
+ * object; non-sensitive keys are copied through unchanged. Also returns the set
+ * of keys that were encrypted (useful for masking decisions / auditing).
+ */
+export declare function encryptSubmissionData(fields: FormField[], data: Record<string, unknown>): Promise<{
+    data: Record<string, unknown>;
+    encryptedKeys: string[];
+}>;
+/**
+ * Decrypt any encrypted values in a stored submission data record. Operates on
+ * the `enc:v1:` prefix, so it is safe to call on records that were never
+ * encrypted (plaintext passes through). Throws only if a value is encrypted but
+ * `CMS_ENCRYPTION_KEY` is missing — fail-closed, never silently leak ciphertext.
+ */
+export declare function decryptSubmissionData(data: Record<string, unknown> | null | undefined): Promise<Record<string, unknown> | null>;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/forms/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/forms/encryption.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C,kEAAkE;AAClE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAI5D;AAsBD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EAAE,EACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAYrE;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC"}

package/dist/forms/encryption.js

@@ -0,0 +1,80 @@
+/**
+ * Field-level encryption for form submission values (PII at rest).
+ *
+ * A field is encrypted when it is explicitly flagged `encrypted`, or when the
+ * site enables `forms.encryptSensitiveFields` and the field is classified as
+ * high-risk PII. Values are encrypted with the same `enc:v1:` envelope used for
+ * other secrets (`secret-storage`), so each stored value is self-describing —
+ * the read path decrypts anything carrying the prefix and passes plaintext
+ * through untouched. This keeps legacy/seed rows and key-less dev environments
+ * working without a migration.
+ *
+ * Note: the operational `senderName` / `senderEmail` / `senderPhone` columns and
+ * the `preview` snippet are intentionally derived BEFORE encryption and stored
+ * in plaintext so the submissions inbox can list/search them. Encryption here
+ * protects the full submission `data` / `normalizedData` blobs at rest.
+ */
+import { encryptSecret, decryptSecret, isEncrypted } from '../security/secret-storage.js';
+import { getPrentaConfig } from '../config/runtime.js';
+/** Whether a field's stored value should be encrypted at rest. */
+export function fieldShouldEncrypt(field) {
+    if (field.encrypted)
+        return true;
+    const forms = getPrentaConfig()?.forms;
+    return Boolean(forms?.encryptSensitiveFields) && field.piiClassification === 'high';
+}
+async function encryptValue(value) {
+    if (typeof value === 'string' && value.length > 0)
+        return encryptSecret(value);
+    if (Array.isArray(value)) {
+        return Promise.all(value.map((v) => (typeof v === 'string' && v.length > 0 ? encryptSecret(v) : v)));
+    }
+    return value;
+}
+async function decryptValue(value) {
+    if (typeof value === 'string' && isEncrypted(value))
+        return decryptSecret(value);
+    if (Array.isArray(value)) {
+        return Promise.all(value.map((v) => (typeof v === 'string' && isEncrypted(v) ? decryptSecret(v) : v)));
+    }
+    return value;
+}
+/**
+ * Encrypt the sensitive values in a submission data record. Returns a new
+ * object; non-sensitive keys are copied through unchanged. Also returns the set
+ * of keys that were encrypted (useful for masking decisions / auditing).
+ */
+export async function encryptSubmissionData(fields, data) {
+    const sensitive = new Set(fields.filter(fieldShouldEncrypt).map((f) => f.key));
+    if (sensitive.size === 0)
+        return { data, encryptedKeys: [] };
+    const out = { ...data };
+    const encryptedKeys = [];
+    for (const key of sensitive) {
+        if (!(key in out))
+            continue;
+        out[key] = await encryptValue(out[key]);
+        encryptedKeys.push(key);
+    }
+    return { data: out, encryptedKeys };
+}
+/**
+ * Decrypt any encrypted values in a stored submission data record. Operates on
+ * the `enc:v1:` prefix, so it is safe to call on records that were never
+ * encrypted (plaintext passes through). Throws only if a value is encrypted but
+ * `CMS_ENCRYPTION_KEY` is missing — fail-closed, never silently leak ciphertext.
+ */
+export async function decryptSubmissionData(data) {
+    if (!data)
+        return null;
+    let touched = false;
+    const out = {};
+    for (const [key, value] of Object.entries(data)) {
+        const next = await decryptValue(value);
+        if (next !== value)
+            touched = true;
+        out[key] = next;
+    }
+    return touched ? out : data;
+}
+//# sourceMappingURL=encryption.js.map

package/dist/forms/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/forms/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAGtD,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,KAAK,GAAG,eAAe,EAAE,EAAE,KAAK,CAAA;IACtC,OAAO,OAAO,CAAC,KAAK,EAAE,sBAAsB,CAAC,IAAI,KAAK,CAAC,iBAAiB,KAAK,MAAM,CAAA;AACrF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACjF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;IAChF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACnF,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAmB,EACnB,IAA6B;IAE7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAA;IAE5D,MAAM,GAAG,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAA;IAChD,MAAM,aAAa,GAAa,EAAE,CAAA;IAClC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,SAAQ;QAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACvC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAgD;IAEhD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,GAAG,IAAI,CAAA;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7B,CAAC"}