@ydtb/tk-scope-capture 0.22.0

package/dist/src/server/api/router.js

@@ -0,0 +1,903 @@
+import { ORPCError } from "@orpc/server";
+import { getHooks, getLayer } from "@ydtb/core-server";
+import "@ydtb/core-layer-postgres";
+import { and, desc, eq, gte, isNull, sql } from "@ydtb/tk-scope-db/schema";
+import { base, requirePermission, scopeAuthed } from "@ydtb/tk-scope-extension/orpc";
+import { z } from "zod";
+import { captureActionRuns, captureAnswers, captureDefinitions, capturePublications, captureSubmissions, } from "../../shared/db/schema.js";
+import { getVisibleCaptureFields } from "../../shared/conditions.js";
+import { REFERENCE_CAPTURE_FIELD_TYPES, normalizeCaptureAnswer, validateCaptureAnswer } from "../../shared/field-types.js";
+import { evaluateQuizOutcome } from "../../shared/scoring.js";
+import { emailActionAdapter, emailActionConfigSchema, executeWorkflowAction, workflowActionAdapter, workflowActionConfigSchema } from "./action-adapters.js";
+function getDb() {
+    return getLayer("database").db;
+}
+const fieldTypeSchema = z.string().min(1).max(80);
+const answerValueSchema = z.union([
+    z.string(),
+    z.number(),
+    z.boolean(),
+    z.null(),
+    z.array(z.string()),
+]);
+const conditionSchema = z.object({
+    fieldId: z.string().min(1).max(80),
+    fieldKey: z.string().min(1).max(80),
+    operator: z.enum(["equals", "notEquals", "isEmpty", "isNotEmpty"]),
+    value: answerValueSchema.optional(),
+});
+const fieldSchema = z.object({
+    id: z.string().min(1).max(80),
+    key: z.string().min(1).max(80),
+    label: z.string().min(1).max(160),
+    type: fieldTypeSchema,
+    required: z.boolean().default(false),
+    options: z.array(z.string().min(1).max(120)).optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+    visibleWhen: conditionSchema.optional(),
+});
+const contactsActionConfigSchema = z.object({
+    enabled: z.boolean().default(false),
+    nameFieldKey: z.string().optional(),
+    emailFieldKey: z.string().optional(),
+    phoneFieldKey: z.string().optional(),
+    customFieldMappings: z.record(z.string().min(1), z.string().min(1)).default({}),
+});
+const quizScoringConfigSchema = z.object({
+    enabled: z.boolean().default(false),
+    version: z.number().int().min(1).default(1),
+    outcomes: z.array(z.object({
+        id: z.string().min(1),
+        key: z.string().min(1),
+        label: z.string().min(1),
+        description: z.string().optional(),
+        bucket: z.string().optional(),
+        minScore: z.number().optional(),
+    })).default([]),
+    rules: z.array(z.object({
+        id: z.string().min(1),
+        fieldKey: z.string().min(1),
+        equals: answerValueSchema,
+        score: z.number().optional(),
+        outcomeKey: z.string().optional(),
+    })).default([]),
+});
+const actionConfigSchema = z.object({
+    contacts: contactsActionConfigSchema.optional(),
+    email: emailActionConfigSchema.optional(),
+    workflow: workflowActionConfigSchema.optional(),
+    quiz: quizScoringConfigSchema.optional(),
+});
+const publicationSecuritySchema = z.object({
+    allowedOrigins: z.array(z.string().min(1)).optional(),
+    minSubmitSeconds: z.number().int().min(0).max(3600).optional(),
+    honeypotFieldName: z.string().min(1).max(80).optional(),
+    rateLimit: z.object({ maxSubmissions: z.number().int().min(1).max(100), windowSeconds: z.number().int().min(1).max(86400) }).optional(),
+    repeatPolicy: z.enum(["allow", "block", "update"]).optional(),
+});
+const defaultPublicationSecurity = {
+    minSubmitSeconds: 2,
+    honeypotFieldName: "website",
+    rateLimit: { maxSubmissions: 5, windowSeconds: 600 },
+    repeatPolicy: "allow",
+};
+const answersSchema = z.record(z.string().min(1), answerValueSchema);
+function slugify(value) {
+    const slug = value
+        .toLowerCase()
+        .trim()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 64);
+    return slug || "form";
+}
+function summarizeDefinition(row) {
+    return {
+        id: row.id,
+        surface: row.surface,
+        name: row.name,
+        slug: row.slug,
+        status: row.status,
+        fieldCount: row.fields.length,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+        publicationSlug: row.publicationSlug ?? undefined,
+    };
+}
+async function ensureDefinitionInScope(args) {
+    const db = getDb();
+    const [row] = await db
+        .select()
+        .from(captureDefinitions)
+        .where(and(eq(captureDefinitions.id, args.id), eq(captureDefinitions.scope, args.scope), eq(captureDefinitions.scopeId, args.scopeId)))
+        .limit(1);
+    if (!row) {
+        throw new ORPCError("NOT_FOUND", { message: "Capture form not found" });
+    }
+    return row;
+}
+const listDefinitions = scopeAuthed.handler(async ({ context }) => {
+    const db = getDb();
+    const rows = await db
+        .select({
+        id: captureDefinitions.id,
+        scope: captureDefinitions.scope,
+        scopeId: captureDefinitions.scopeId,
+        surface: captureDefinitions.surface,
+        name: captureDefinitions.name,
+        slug: captureDefinitions.slug,
+        status: captureDefinitions.status,
+        fields: captureDefinitions.fields,
+        createdAt: captureDefinitions.createdAt,
+        updatedAt: captureDefinitions.updatedAt,
+        publicationSlug: capturePublications.slug,
+    })
+        .from(captureDefinitions)
+        .leftJoin(capturePublications, eq(capturePublications.definitionId, captureDefinitions.id))
+        .where(and(eq(captureDefinitions.scope, context.scopeType), eq(captureDefinitions.scopeId, context.scopeId)))
+        .orderBy(desc(captureDefinitions.createdAt));
+    return rows.map(summarizeDefinition);
+});
+const createDefinition = scopeAuthed
+    .input(z.object({ name: z.string().min(1).max(160).default("Untitled form") }))
+    .handler(async ({ context, input }) => {
+    const db = getDb();
+    const baseSlug = slugify(input.name);
+    const slug = `${baseSlug}-${Date.now().toString(36)}`;
+    const [row] = await db
+        .insert(captureDefinitions)
+        .values({
+        scope: context.scopeType,
+        scopeId: context.scopeId,
+        surface: "form",
+        name: input.name,
+        slug,
+        status: "draft",
+        fields: [],
+        actionConfig: {},
+    })
+        .returning();
+    if (!row) {
+        throw new ORPCError("INTERNAL_SERVER_ERROR", { message: "Failed to create Capture form" });
+    }
+    return row;
+});
+const getDefinition = scopeAuthed
+    .input(z.object({ id: z.string().min(1) }))
+    .handler(async ({ context, input }) => {
+    const definition = await ensureDefinitionInScope({
+        id: input.id,
+        scope: context.scopeType,
+        scopeId: context.scopeId,
+    });
+    const db = getDb();
+    const [publication] = await db
+        .select()
+        .from(capturePublications)
+        .where(eq(capturePublications.definitionId, definition.id))
+        .limit(1);
+    return { ...definition, publicationSlug: publication?.slug ?? null };
+});
+const updateDefinition = scopeAuthed
+    .input(z.object({
+    id: z.string().min(1),
+    name: z.string().min(1).max(160),
+    fields: z.array(fieldSchema).max(50),
+    actionConfig: actionConfigSchema.default({}),
+}))
+    .handler(async ({ context, input }) => {
+    await ensureDefinitionInScope({ id: input.id, scope: context.scopeType, scopeId: context.scopeId });
+    const db = getDb();
+    const [row] = await db
+        .update(captureDefinitions)
+        .set({ name: input.name, fields: input.fields, actionConfig: input.actionConfig, updatedAt: new Date() })
+        .where(eq(captureDefinitions.id, input.id))
+        .returning();
+    if (!row) {
+        throw new ORPCError("INTERNAL_SERVER_ERROR", { message: "Failed to update Capture form" });
+    }
+    return row;
+});
+const publishDefinition = scopeAuthed
+    .input(z.object({ id: z.string().min(1) }))
+    .handler(async ({ context, input }) => {
+    const definition = await ensureDefinitionInScope({
+        id: input.id,
+        scope: context.scopeType,
+        scopeId: context.scopeId,
+    });
+    if (definition.fields.length === 0) {
+        throw new ORPCError("BAD_REQUEST", { message: "Add at least one field before publishing" });
+    }
+    const db = getDb();
+    const [existing] = await db
+        .select()
+        .from(capturePublications)
+        .where(eq(capturePublications.definitionId, definition.id))
+        .limit(1);
+    if (existing) {
+        const [updated] = await db
+            .update(capturePublications)
+            .set({ status: "active", slug: definition.slug, revokedAt: null, security: existing.security ?? defaultPublicationSecurity, updatedAt: new Date() })
+            .where(eq(capturePublications.id, existing.id))
+            .returning();
+        await db.update(captureDefinitions).set({ status: "published", updatedAt: new Date() }).where(eq(captureDefinitions.id, definition.id));
+        return updated;
+    }
+    const [publication] = await db
+        .insert(capturePublications)
+        .values({
+        scope: context.scopeType,
+        scopeId: context.scopeId,
+        definitionId: definition.id,
+        slug: definition.slug,
+        status: "active",
+        security: defaultPublicationSecurity,
+    })
+        .returning();
+    await db.update(captureDefinitions).set({ status: "published", updatedAt: new Date() }).where(eq(captureDefinitions.id, definition.id));
+    if (!publication) {
+        throw new ORPCError("INTERNAL_SERVER_ERROR", { message: "Failed to publish Capture form" });
+    }
+    return publication;
+});
+const updatePublication = scopeAuthed
+    .input(z.object({
+    definitionId: z.string().min(1),
+    status: z.enum(["active", "disabled", "revoked"]),
+    security: publicationSecuritySchema.default(defaultPublicationSecurity),
+}))
+    .handler(async ({ context, input }) => {
+    const definition = await ensureDefinitionInScope({
+        id: input.definitionId,
+        scope: context.scopeType,
+        scopeId: context.scopeId,
+    });
+    const db = getDb();
+    const [publication] = await db
+        .update(capturePublications)
+        .set({
+        status: input.status,
+        security: input.security,
+        revokedAt: input.status === "revoked" ? new Date() : null,
+        updatedAt: new Date(),
+    })
+        .where(eq(capturePublications.definitionId, definition.id))
+        .returning();
+    if (!publication) {
+        throw new ORPCError("NOT_FOUND", { message: "Publication not found" });
+    }
+    return publication;
+});
+function asRecord(value) {
+    return value !== null && typeof value === "object" ? value : null;
+}
+function summarizeWorkflowTriggers(graph) {
+    const record = asRecord(graph);
+    const nodes = Array.isArray(record?.nodes) ? record.nodes : [];
+    const triggerNodes = nodes.flatMap((node) => {
+        const nodeRecord = asRecord(node);
+        const type = typeof nodeRecord?.type === "string" ? nodeRecord.type : null;
+        const id = typeof nodeRecord?.id === "string" ? nodeRecord.id : null;
+        return type && id && type.endsWith("-trigger") ? [{ id, type }] : [];
+    });
+    const apiTrigger = triggerNodes.find((node) => node.type === "api-trigger");
+    const triggerTypes = [...new Set(triggerNodes.map((node) => node.type))];
+    return {
+        triggerTypes,
+        apiTriggerNodeId: apiTrigger?.id,
+        compatible: Boolean(apiTrigger),
+        summary: apiTrigger
+            ? `API trigger ready (${apiTrigger.id})`
+            : triggerTypes.length > 0
+                ? `No API trigger; found ${triggerTypes.join(", ")}`
+                : "No trigger node found",
+    };
+}
+function parseWorkflowRows(rows) {
+    if (!Array.isArray(rows))
+        return [];
+    return rows.flatMap((row) => {
+        const record = asRecord(row);
+        if (!record)
+            return [];
+        const id = typeof record.id === "string" ? record.id : null;
+        const name = typeof record.name === "string" ? record.name : null;
+        const status = typeof record.status === "string" ? record.status : "unknown";
+        const currentVersion = typeof record.currentVersion === "number" ? record.currentVersion : Number(record.currentVersion ?? 0);
+        if (!id || !name)
+            return [];
+        return [{ id, name, status, currentVersion, ...summarizeWorkflowTriggers(record.graph) }];
+    });
+}
+const listWorkflowDefinitions = scopeAuthed
+    .input(z.object({}))
+    .handler(async ({ context }) => {
+    try {
+        const rows = await getDb().execute(sql `
+        SELECT
+          d.id,
+          d.name,
+          d.status,
+          d."currentVersion" AS "currentVersion",
+          COALESCE(v.graph, d."draftGraph") AS graph
+        FROM workflow_definitions d
+        LEFT JOIN workflow_definition_versions v
+          ON v."definitionId" = d.id AND v.version = d."currentVersion"
+        WHERE d.scope = ${context.scopeType} AND d."scopeId" = ${context.scopeId}
+        ORDER BY d.name ASC
+      `);
+        return parseWorkflowRows(rows);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (message.includes("workflow_definitions") || message.includes("workflow_definition_versions")) {
+            return [];
+        }
+        throw error;
+    }
+});
+const listSubmissions = scopeAuthed.handler(async ({ context }) => {
+    const db = getDb();
+    const rows = await db
+        .select({
+        id: captureSubmissions.id,
+        definitionId: captureSubmissions.definitionId,
+        definitionName: captureDefinitions.name,
+        submittedAt: captureSubmissions.submittedAt,
+        snapshot: captureSubmissions.snapshot,
+        actionStatus: captureActionRuns.status,
+        contactId: captureActionRuns.contactId,
+    })
+        .from(captureSubmissions)
+        .innerJoin(captureDefinitions, eq(captureDefinitions.id, captureSubmissions.definitionId))
+        .leftJoin(captureActionRuns, eq(captureActionRuns.submissionId, captureSubmissions.id))
+        .where(and(eq(captureSubmissions.scope, context.scopeType), eq(captureSubmissions.scopeId, context.scopeId)))
+        .orderBy(desc(captureSubmissions.submittedAt));
+    return rows.map((row) => ({
+        id: row.id,
+        definitionId: row.definitionId,
+        definitionName: row.definitionName,
+        submittedAt: row.submittedAt,
+        answers: row.snapshot.answers,
+        outcome: row.snapshot.outcome,
+        actionStatus: row.actionStatus ?? undefined,
+        contactId: row.contactId ?? undefined,
+    }));
+});
+const getSubmission = scopeAuthed
+    .input(z.object({ id: z.string().min(1) }))
+    .handler(async ({ context, input }) => {
+    const db = getDb();
+    const [row] = await db
+        .select({
+        id: captureSubmissions.id,
+        scope: captureSubmissions.scope,
+        scopeId: captureSubmissions.scopeId,
+        definitionId: captureSubmissions.definitionId,
+        definitionName: captureDefinitions.name,
+        publicationId: captureSubmissions.publicationId,
+        publicationSlug: capturePublications.slug,
+        source: captureSubmissions.source,
+        snapshot: captureSubmissions.snapshot,
+        respondent: captureSubmissions.respondent,
+        submittedAt: captureSubmissions.submittedAt,
+    })
+        .from(captureSubmissions)
+        .innerJoin(captureDefinitions, eq(captureDefinitions.id, captureSubmissions.definitionId))
+        .leftJoin(capturePublications, eq(capturePublications.id, captureSubmissions.publicationId))
+        .where(and(eq(captureSubmissions.id, input.id), eq(captureSubmissions.scope, context.scopeType), eq(captureSubmissions.scopeId, context.scopeId)))
+        .limit(1);
+    if (!row) {
+        throw new ORPCError("NOT_FOUND", { message: "Submission not found" });
+    }
+    const [normalizedAnswers, actionRuns] = await Promise.all([
+        db
+            .select({
+            id: captureAnswers.id,
+            fieldId: captureAnswers.fieldId,
+            fieldKey: captureAnswers.fieldKey,
+            value: captureAnswers.value,
+        })
+            .from(captureAnswers)
+            .where(eq(captureAnswers.submissionId, row.id)),
+        db
+            .select({
+            id: captureActionRuns.id,
+            actionType: captureActionRuns.actionType,
+            status: captureActionRuns.status,
+            contactId: captureActionRuns.contactId,
+            result: captureActionRuns.result,
+            error: captureActionRuns.error,
+            manualAttempts: captureActionRuns.manualAttempts,
+            createdAt: captureActionRuns.createdAt,
+            updatedAt: captureActionRuns.updatedAt,
+        })
+            .from(captureActionRuns)
+            .where(eq(captureActionRuns.submissionId, row.id))
+            .orderBy(desc(captureActionRuns.createdAt)),
+    ]);
+    return {
+        id: row.id,
+        definitionId: row.definitionId,
+        definitionName: row.definitionName,
+        submittedAt: row.submittedAt,
+        source: row.source,
+        publicationId: row.publicationId,
+        publicationSlug: row.publicationSlug,
+        respondent: row.respondent,
+        snapshot: row.snapshot,
+        answers: row.snapshot.answers,
+        normalizedAnswers,
+        actionRuns: actionRuns.map((run) => ({
+            id: run.id,
+            actionType: run.actionType,
+            status: run.status,
+            contactId: run.contactId ?? undefined,
+            result: run.result,
+            error: run.error,
+            manualAttempts: run.manualAttempts,
+            createdAt: run.createdAt,
+            updatedAt: run.updatedAt,
+        })),
+        actionStatus: actionRuns[0]?.status,
+        contactId: actionRuns[0]?.contactId ?? undefined,
+    };
+});
+const retryActionRun = scopeAuthed
+    .use(requirePermission("capture.actions.retry"))
+    .input(z.object({
+    actionRunId: z.string().min(1),
+    mode: z.enum(["retry", "replay"]).default("retry"),
+    reason: z.string().min(1).max(500),
+    confirmReplay: z.boolean().default(false),
+}))
+    .handler(async ({ context, input }) => {
+    if (input.mode === "replay" && !input.confirmReplay) {
+        throw new ORPCError("BAD_REQUEST", { message: "Replay requires explicit confirmation" });
+    }
+    const db = getDb();
+    const [row] = await db
+        .select({
+        run: captureActionRuns,
+        submission: captureSubmissions,
+        definition: captureDefinitions,
+    })
+        .from(captureActionRuns)
+        .innerJoin(captureSubmissions, eq(captureSubmissions.id, captureActionRuns.submissionId))
+        .innerJoin(captureDefinitions, eq(captureDefinitions.id, captureActionRuns.definitionId))
+        .where(and(eq(captureActionRuns.id, input.actionRunId), eq(captureActionRuns.scope, context.scopeType), eq(captureActionRuns.scopeId, context.scopeId)))
+        .limit(1);
+    if (!row)
+        throw new ORPCError("NOT_FOUND", { message: "Action run not found" });
+    if (!["failed", "skipped"].includes(row.run.status)) {
+        throw new ORPCError("BAD_REQUEST", { message: "Only failed or skipped action runs can be retried" });
+    }
+    const idempotencyKeyMode = input.mode === "replay" ? "new" : "same";
+    const baseAudit = {
+        actorUserId: context.user.id,
+        attemptedAt: new Date().toISOString(),
+        reason: input.reason,
+        mode: input.mode,
+        idempotencyKeyMode,
+        configSnapshot: row.definition.actionConfig,
+    };
+    const actionContext = {
+        scope: row.definition.scope,
+        scopeId: row.definition.scopeId,
+        definitionId: row.definition.id,
+        definitionName: row.definition.name,
+        submissionId: row.submission.id,
+        fields: row.definition.fields,
+        answers: withOutcomeAnswers(row.submission.snapshot.answers, row.submission.snapshot.outcome),
+        outcome: row.submission.snapshot.outcome,
+    };
+    const attemptResult = await recordActionRun({
+        context: actionContext,
+        actionType: row.run.actionType,
+        manualAttempts: [baseAudit],
+        execute: () => executeConfiguredActionByType({
+            actionType: row.run.actionType,
+            config: row.definition.actionConfig,
+            definition: row.definition,
+            context: actionContext,
+            idempotencyKeyMode,
+        }),
+    });
+    const completedAudit = {
+        ...baseAudit,
+        actionRunId: attemptResult?.runId,
+        result: attemptResult?.result,
+        error: attemptResult?.error,
+    };
+    await db
+        .update(captureActionRuns)
+        .set({
+        manualAttempts: [...row.run.manualAttempts, completedAudit],
+        updatedAt: new Date(),
+    })
+        .where(eq(captureActionRuns.id, row.run.id));
+    if (attemptResult?.runId) {
+        await db
+            .update(captureActionRuns)
+            .set({ manualAttempts: [completedAudit], updatedAt: new Date() })
+            .where(eq(captureActionRuns.id, attemptResult.runId));
+    }
+    return {
+        ok: true,
+        actionRunId: attemptResult?.runId,
+        status: attemptResult?.status,
+        result: attemptResult?.result,
+        error: attemptResult?.error,
+    };
+});
+function originFromHeaders(headers) {
+    const origin = headers.get("origin");
+    if (origin)
+        return origin;
+    const referer = headers.get("referer");
+    if (!referer)
+        return null;
+    try {
+        return new URL(referer).origin;
+    }
+    catch {
+        return null;
+    }
+}
+function enforceOrigin(headers, security) {
+    const allowedOrigins = security.allowedOrigins ?? [];
+    if (allowedOrigins.length === 0)
+        return;
+    const requestOrigin = originFromHeaders(headers);
+    if (!requestOrigin || !allowedOrigins.includes(requestOrigin)) {
+        throw new ORPCError("FORBIDDEN", { message: "Form origin is not allowed" });
+    }
+}
+const publicFormLookupSchema = z.object({
+    slug: z.string().min(1).optional(),
+    publishId: z.string().min(1).optional(),
+});
+function publicFormWhere(input) {
+    const identifier = input.publishId
+        ? eq(capturePublications.id, input.publishId)
+        : eq(capturePublications.slug, input.slug ?? "");
+    return and(identifier, eq(capturePublications.status, "active"), isNull(capturePublications.revokedAt));
+}
+async function loadPublicForm(input, headers) {
+    if (!input.slug && !input.publishId) {
+        throw new ORPCError("BAD_REQUEST", { message: "Missing form identifier" });
+    }
+    const db = getDb();
+    const [row] = await db
+        .select({
+        publication: capturePublications,
+        definition: captureDefinitions,
+    })
+        .from(capturePublications)
+        .innerJoin(captureDefinitions, eq(captureDefinitions.id, capturePublications.definitionId))
+        .where(publicFormWhere(input))
+        .limit(1);
+    if (!row) {
+        throw new ORPCError("NOT_FOUND", { message: "Form not found" });
+    }
+    enforceOrigin(headers, row.publication.security);
+    return row;
+}
+const getPublicForm = base
+    .input(publicFormLookupSchema)
+    .handler(async ({ context, input }) => {
+    const row = await loadPublicForm(input, context.headers);
+    return {
+        id: row.definition.id,
+        publicationId: row.publication.id,
+        title: row.definition.name,
+        slug: row.publication.slug,
+        fields: row.definition.fields,
+        security: {
+            minSubmitSeconds: row.publication.security.minSubmitSeconds ?? defaultPublicationSecurity.minSubmitSeconds,
+            honeypotFieldName: row.publication.security.honeypotFieldName ?? defaultPublicationSecurity.honeypotFieldName,
+            repeatPolicy: row.publication.security.repeatPolicy ?? defaultPublicationSecurity.repeatPolicy,
+        },
+    };
+});
+function answerToContactString(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (Array.isArray(value))
+        return value.join(", ");
+    const stringValue = String(value).trim();
+    return stringValue.length > 0 ? stringValue : undefined;
+}
+function withOutcomeAnswers(answers, outcome) {
+    if (!outcome)
+        return answers;
+    return {
+        ...answers,
+        "outcome.id": outcome.id,
+        "outcome.key": outcome.key,
+        "outcome.label": outcome.label,
+        "outcome.bucket": outcome.bucket,
+        "outcome.score": outcome.scoreSummary.score,
+        "outcome.maxScore": outcome.scoreSummary.maxScore,
+    };
+}
+function resolveContactsActionInput(args) {
+    const customFields = {};
+    for (const [contactFieldKey, answerFieldKey] of Object.entries(args.config.customFieldMappings ?? {})) {
+        const value = answerToContactString(args.answers[answerFieldKey]);
+        if (value)
+            customFields[contactFieldKey] = value;
+    }
+    return {
+        scope: args.scope,
+        scopeId: args.scopeId,
+        name: answerToContactString(args.answers[args.config.nameFieldKey ?? ""]) ?? "Form respondent",
+        email: answerToContactString(args.answers[args.config.emailFieldKey ?? ""]),
+        phone: answerToContactString(args.answers[args.config.phoneFieldKey ?? ""]),
+        source: "capture.form",
+        customFields,
+    };
+}
+async function recordActionRun(args) {
+    const db = getDb();
+    const [run] = await db
+        .insert(captureActionRuns)
+        .values({
+        scope: args.context.scope,
+        scopeId: args.context.scopeId,
+        submissionId: args.context.submissionId,
+        definitionId: args.context.definitionId,
+        actionType: args.actionType,
+        status: "running",
+        manualAttempts: args.manualAttempts ?? [],
+    })
+        .returning({ id: captureActionRuns.id });
+    if (!run)
+        return undefined;
+    try {
+        const result = await args.execute();
+        await db
+            .update(captureActionRuns)
+            .set({
+            status: "succeeded",
+            contactId: result.contactId,
+            result,
+            updatedAt: new Date(),
+        })
+            .where(eq(captureActionRuns.id, run.id));
+        return { runId: run.id, status: "succeeded", result };
+    }
+    catch (error) {
+        const actionError = { message: error instanceof Error ? error.message : `${args.actionType} failed` };
+        await db
+            .update(captureActionRuns)
+            .set({
+            status: "failed",
+            error: actionError,
+            updatedAt: new Date(),
+        })
+            .where(eq(captureActionRuns.id, run.id));
+        return { runId: run.id, status: "failed", error: actionError };
+    }
+}
+async function executeConfiguredActionByType(args) {
+    if (args.actionType === "contacts.findOrCreate") {
+        const contactsConfig = args.config.contacts;
+        if (!contactsConfig?.enabled)
+            throw new Error("Contacts action is not enabled");
+        const input = resolveContactsActionInput({
+            config: contactsConfig,
+            answers: args.context.answers,
+            scope: args.definition.scope,
+            scopeId: args.definition.scopeId,
+        });
+        const result = await getHooks().doAction("contacts:findOrCreate", input);
+        return { contactId: result.contact.id, created: result.created };
+    }
+    if (args.actionType === emailActionAdapter.type) {
+        const emailConfig = args.config.email;
+        if (!emailConfig || !emailActionAdapter.isEnabled(emailConfig))
+            throw new Error("Email action is not enabled");
+        const parsedConfig = emailActionAdapter.configSchema.parse(emailConfig);
+        return emailActionAdapter.execute({ config: parsedConfig, context: args.context });
+    }
+    if (args.actionType === workflowActionAdapter.type) {
+        const workflowConfig = args.config.workflow;
+        if (!workflowConfig || !workflowActionAdapter.isEnabled(workflowConfig))
+            throw new Error("Workflow action is not enabled");
+        const parsedConfig = workflowActionAdapter.configSchema.parse(workflowConfig);
+        const idempotencyKeyOverride = args.idempotencyKeyMode === "new"
+            ? `capture:${args.context.submissionId}:workflow:${parsedConfig.workflowDefinitionId}:replay:${crypto.randomUUID()}`
+            : undefined;
+        return executeWorkflowAction({ config: parsedConfig, context: args.context, idempotencyKeyOverride });
+    }
+    throw new Error(`Unsupported action type: ${args.actionType}`);
+}
+async function runConfiguredActions(args) {
+    const context = {
+        scope: args.definition.scope,
+        scopeId: args.definition.scopeId,
+        definitionId: args.definition.id,
+        definitionName: args.definition.name,
+        submissionId: args.submissionId,
+        fields: args.definition.fields,
+        answers: withOutcomeAnswers(args.answers, args.outcome),
+        outcome: args.outcome,
+    };
+    const contactsConfig = args.config.contacts;
+    if (contactsConfig?.enabled) {
+        await recordActionRun({
+            context,
+            actionType: "contacts.findOrCreate",
+            execute: () => executeConfiguredActionByType({
+                actionType: "contacts.findOrCreate",
+                config: args.config,
+                definition: args.definition,
+                context,
+            }),
+        });
+    }
+    const emailConfig = args.config.email;
+    if (emailConfig && emailActionAdapter.isEnabled(emailConfig)) {
+        const parsedConfig = emailActionAdapter.configSchema.parse(emailConfig);
+        await recordActionRun({
+            context,
+            actionType: emailActionAdapter.type,
+            execute: () => emailActionAdapter.execute({ config: parsedConfig, context }),
+        });
+    }
+    const workflowConfig = args.config.workflow;
+    if (workflowConfig && workflowActionAdapter.isEnabled(workflowConfig)) {
+        const parsedConfig = workflowActionAdapter.configSchema.parse(workflowConfig);
+        await recordActionRun({
+            context,
+            actionType: workflowActionAdapter.type,
+            execute: () => workflowActionAdapter.execute({ config: parsedConfig, context }),
+        });
+    }
+}
+async function enforcePublicSubmitGuards(args) {
+    const security = { ...defaultPublicationSecurity, ...args.publication.security };
+    if (security.honeypotFieldName && args.honeypot && args.honeypot.trim().length > 0) {
+        throw new ORPCError("BAD_REQUEST", { message: "Unable to submit form" });
+    }
+    if (security.minSubmitSeconds && args.startedAt) {
+        const startedAtMs = Date.parse(args.startedAt);
+        if (Number.isFinite(startedAtMs) && Date.now() - startedAtMs < security.minSubmitSeconds * 1000) {
+            throw new ORPCError("BAD_REQUEST", { message: "Unable to submit form" });
+        }
+    }
+    if (security.rateLimit) {
+        const windowStart = new Date(Date.now() - security.rateLimit.windowSeconds * 1000);
+        const recent = await getDb()
+            .select({ id: captureSubmissions.id })
+            .from(captureSubmissions)
+            .where(and(eq(captureSubmissions.publicationId, args.publication.id), eq(captureSubmissions.respondentKey, args.respondentKey), gte(captureSubmissions.submittedAt, windowStart)))
+            .limit(security.rateLimit.maxSubmissions);
+        if (recent.length >= security.rateLimit.maxSubmissions) {
+            throw new ORPCError("TOO_MANY_REQUESTS", { message: "Please wait before submitting again" });
+        }
+    }
+}
+const submitPublicForm = base
+    .input(publicFormLookupSchema.extend({
+    answers: answersSchema,
+    respondentKey: z.string().min(1).max(160).optional(),
+    startedAt: z.string().optional(),
+    honeypot: z.string().optional(),
+    source: z.enum(["hosted", "embed", "quiz"]).default("hosted"),
+}))
+    .handler(async ({ context, input }) => {
+    const { publication, definition } = await loadPublicForm(input, context.headers);
+    const security = { ...defaultPublicationSecurity, ...publication.security };
+    const respondentKey = input.respondentKey ?? `anon:${crypto.randomUUID()}`;
+    await enforcePublicSubmitGuards({
+        publication,
+        respondentKey,
+        startedAt: input.startedAt,
+        honeypot: input.honeypot,
+    });
+    const normalizedAnswers = {};
+    const visibleFields = getVisibleCaptureFields(definition.fields, input.answers);
+    for (const field of visibleFields) {
+        const value = normalizeCaptureAnswer(field, input.answers[field.key], REFERENCE_CAPTURE_FIELD_TYPES);
+        const validationError = validateCaptureAnswer(field, value, REFERENCE_CAPTURE_FIELD_TYPES);
+        if (validationError) {
+            throw new ORPCError("BAD_REQUEST", { message: validationError });
+        }
+        normalizedAnswers[field.key] = value;
+    }
+    const outcome = input.source === "quiz" ? evaluateQuizOutcome(definition.actionConfig.quiz, normalizedAnswers) : undefined;
+    const db = getDb();
+    const snapshot = {
+        definitionId: definition.id,
+        title: definition.name,
+        fields: definition.fields,
+        answers: normalizedAnswers,
+        ...(outcome ? { outcome } : {}),
+    };
+    const respondent = {
+        respondentKey,
+        origin: originFromHeaders(context.headers),
+        userAgent: context.headers.get("user-agent") ?? undefined,
+        publicSource: input.source,
+        publishId: publication.id,
+    };
+    const repeatPolicy = security.repeatPolicy ?? "allow";
+    const [existingSubmission] = await db
+        .select({ id: captureSubmissions.id })
+        .from(captureSubmissions)
+        .where(and(eq(captureSubmissions.publicationId, publication.id), eq(captureSubmissions.respondentKey, respondentKey)))
+        .limit(1);
+    if (existingSubmission && repeatPolicy === "block") {
+        throw new ORPCError("CONFLICT", { message: "This form has already been submitted" });
+    }
+    const [submission] = existingSubmission && repeatPolicy === "update"
+        ? await db
+            .update(captureSubmissions)
+            .set({ source: `public:${input.source}:update`, snapshot, respondent, submittedAt: new Date() })
+            .where(eq(captureSubmissions.id, existingSubmission.id))
+            .returning({ id: captureSubmissions.id })
+        : await db
+            .insert(captureSubmissions)
+            .values({
+            scope: definition.scope,
+            scopeId: definition.scopeId,
+            definitionId: definition.id,
+            publicationId: publication.id,
+            source: `public:${input.source}`,
+            snapshot,
+            respondent,
+            respondentKey,
+        })
+            .returning({ id: captureSubmissions.id });
+    if (!submission) {
+        throw new ORPCError("INTERNAL_SERVER_ERROR", { message: "Failed to submit form" });
+    }
+    if (existingSubmission && repeatPolicy === "update") {
+        await db.delete(captureAnswers).where(eq(captureAnswers.submissionId, submission.id));
+    }
+    const answerRows = visibleFields.map((field) => ({
+        scope: definition.scope,
+        scopeId: definition.scopeId,
+        submissionId: submission.id,
+        definitionId: definition.id,
+        fieldId: field.id,
+        fieldKey: field.key,
+        value: normalizedAnswers[field.key] ?? null,
+    }));
+    if (answerRows.length > 0) {
+        await db.insert(captureAnswers).values(answerRows);
+    }
+    await runConfiguredActions({
+        config: definition.actionConfig,
+        definition,
+        submissionId: submission.id,
+        answers: normalizedAnswers,
+        outcome,
+    });
+    return { ok: true, submissionId: submission.id, updated: existingSubmission ? repeatPolicy === "update" : undefined, outcome };
+});
+const captureRouter = {
+    definitions: {
+        list: listDefinitions,
+        create: createDefinition,
+        get: getDefinition,
+        update: updateDefinition,
+        publish: publishDefinition,
+        updatePublication,
+        listWorkflows: listWorkflowDefinitions,
+    },
+    submissions: {
+        list: listSubmissions,
+        get: getSubmission,
+        retryAction: retryActionRun,
+    },
+    public: {
+        getForm: getPublicForm,
+        submit: submitPublicForm,
+    },
+};
+export default captureRouter;
+//# sourceMappingURL=router.js.map