@crombolo/server 0.10.0 → 0.12.1

package/src/server.ts

@@ -6,8 +6,15 @@
  * API, the SPA shells, then the front-end site.
  */
 
+import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { createManagementApiRouter, hasSection, type Principal } from '@crombolo/api-management'
+import { createDeliveryApi, resolveDeliveryApiSettings } from '@crombolo/api-delivery'
+import {
+  type ClientAddress,
+  createManagementApiRouter,
+  hasSection,
+  type Principal,
+} from '@crombolo/api-management'
 import {
   AuthService,
   AuthStore,
@@ -31,7 +38,10 @@ import {
   serveStaticFile,
 } from '@crombolo/backoffice-host'
 import {
+  CHOICE_SOURCE_KINDS,
+  type ChoiceSourceKind,
   DEFAULT_UPLOAD_SETTINGS,
+  DELIVERY_API_PREFIX,
   FormPermissions,
   hasAccessToSensitiveData,
   localReturnUrl,
@@ -45,8 +55,11 @@ import {
   type Db,
   FormEntryRepository,
   FormWorkflowRepository,
+  PublicAccessRepository,
   RedirectRepository,
+  readLedger,
   readReport,
+  readUrlOptions,
   TransferRunRepository,
   type WritesPaused,
 } from '@crombolo/data'
@@ -59,20 +72,25 @@ import {
   PublishedCache,
   Renderer,
   type SnapshotStatus,
+  setFormFieldTypes,
   setFormTokenSigner,
   ViewSnapshots,
 } from '@crombolo/render'
 import type { SyncReport } from '@crombolo/schema'
+import { choicesFor } from '@crombolo/transfer'
 import type { Server } from 'bun'
 import { createNodeLookup, loadAccess } from './access.ts'
+import { createAuditHost, createAuditSink, pluginAuditPlan, recordAudit } from './adapters/audit.ts'
 import { readCreatedBundlePackage, writeCreatedBundlePackage } from './adapters/bundles.ts'
 import { createPublishedContentSource, loadDraftNode } from './adapters/documents.ts'
 import { createSchemaProposals } from './adapters/schema-proposals.ts'
-import { installBundleContent } from './bundle-install.ts'
+import { CommandError, installBundleContent } from './bundle-install.ts'
 import { bundleChains, bundleTablesReport } from './bundle-tables.ts'
 import { createBundleRedirects, createServerBundles, validateServerBundles } from './bundles.ts'
+import { busyResponse } from './busy.ts'
 import { type CromboloConfig, loadConfig, type ServerRole, VERSION } from './config.ts'
 import { attachDatabase, bootstrapDatabase } from './database.ts'
+import { createDeliveryMemberSecurity } from './delivery-members.ts'
 import { createDiagnostics } from './diagnostics.ts'
 import { syncDomainsFile } from './domains.ts'
 import { editorTypeLibs, siteJsxImportSource } from './editor-types.ts'
@@ -90,6 +108,7 @@ import {
   wantsJson,
   writeFlash,
 } from './form-submit.ts'
+import { describeFormTypes, formTypesFor, formTypesOf } from './form-types.ts'
 import { createWorkflowRunner } from './form-workflows.ts'
 import {
   entriesCsv,
@@ -108,7 +127,18 @@ import { mediaStoreFromEnvironment } from './media-store.ts'
 import { createMemberAuth, MEMBER_ROUTE_PREFIX } from './member-auth.ts'
 import { noNodesPage } from './no-nodes.ts'
 import { NotImplementedLog } from './not-implemented.ts'
-import { createDeps, resolveUserLinkSender } from './ports.ts'
+import { createDeps, PREVIEW_COOKIE, resolveUserLinkSender } from './ports.ts'
+import { createRedirectTracker } from './redirects.ts'
+import { handleTransferAction, pendingTransfers } from './transfer-dashboard.ts'
+import {
+  changeUrlOptions,
+  redirectAfterUrlChange,
+  type UrlChangeContext,
+  urlSettingEditable,
+} from './url-settings.ts'
+
+export { PREVIEW_COOKIE }
+
 import { syncConfiguredRedirects } from './redirects.ts'
 import {
   bootSchema,
@@ -125,7 +155,10 @@ import {
   type HubSocketData,
   type ServerEventHub,
 } from './server-events.ts'
+import { createSetupRoutes } from './setup.ts'
+import { summariseUpgrades } from './upgrade-summary.ts'
 import { assertViewRuntime } from './view-runtime.ts'
+import { bundleEventProblems, createWebhookService, webhookStoreView } from './webhooks.ts'
 
 const CONTRACT_PATH = Bun.resolveSync('@crombolo/contracts/OpenApi.json', import.meta.dir)
 
@@ -177,9 +210,6 @@ export interface ServerHandle {
   close(): Promise<void>
 }
 
-/** Umbraco's preview cookie; with a signed-in editor it turns on draft rendering. */
-export const PREVIEW_COOKIE = 'UMB_PREVIEW'
-
 export async function createServer(config: CromboloConfig = loadConfig()): Promise<ServerHandle> {
   configureLogging({
     logsDir: config.logsDir,
@@ -203,6 +233,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     }
   }
   const domainLog = logger('domains')
+  const apiLog = logger('management-api')
   // Extensions are the site's own npm dependencies (`docs/bundles.md`).
   // Uncached in development so an author editing one sees a reload pick it up.
   const extensions = createExtensionRegistry(config.siteDir, { cache: !config.development })
@@ -217,7 +248,16 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       (await new TransferRunRepository(db).appliedForPackage(packageName))?.packageVersion ?? null,
     applyContentOnInstall: config.applyBundleContentOnInstall,
     applyContent: async (packageName) => {
-      const result = await installBundleContent(db, config, { bundle: packageName })
+      // A package from the marketplace is for anyone, so nothing in it can be
+      // sealed; one that is is refused rather than half applied.
+      const result = await installBundleContent(db, config, { bundle: packageName }).catch(
+        (error: unknown) => {
+          if (error instanceof CommandError) return error
+          throw error
+        },
+      )
+      if (result instanceof CommandError)
+        return { applied: false, message: `Its content was not applied: ${result.message}` }
       if (!result.runId) {
         const reasons = [
           ...result.problems,
@@ -225,7 +265,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         ]
         return {
           applied: false,
-          message: `Its content was not applied: ${reasons.join('; ') || 'the check refused it'}. Resolve that, then run \`crombolo bundle install ${packageName}\`.`,
+          message: `Its content was not applied: ${reasons.join('; ') || 'the check refused it'}. Answer what it needs in Settings, under Changes, and import it from there.`,
         }
       }
       // The content landed under a cache this process had already constructed.
@@ -241,12 +281,20 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
   const owns = config.role !== 'web'
   // Bundles are checked before the database is touched, because a bundle that
   // owns tables is migrated at boot, and a bad declaration must not get that far.
-  const bundlePackages = servesBackOffice ? extensions.bundles().bundles : []
-  if (servesBackOffice) {
-    const problems = validateServerBundles(config.bundles, bundlePackages, VERSION)
+  // On every role: a bundle's form types are needed wherever forms render and
+  // submit. Its routes and tables stay with the nodes that serve the backoffice.
+  const bundlePackages = extensions.bundles().bundles
+  const formTypes = formTypesOf(config)
+  {
+    const problems = [
+      ...validateServerBundles(config.bundles, bundlePackages, VERSION),
+      ...formTypes.problems,
+      ...bundleEventProblems(config.bundles),
+    ]
     if (problems.length > 0)
       throw new Error(`The configured bundles cannot be mounted:\n- ${problems.join('\n- ')}`)
   }
+  setFormFieldTypes(formTypes.types, formTypes.renderers)
   const chains = servesBackOffice ? bundleChains(config.bundles, bundlePackages) : []
   const { db, seededAdminPassword } = owns
     ? await bootstrapDatabase(config, chains)
@@ -270,10 +318,40 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
   const auth = new AuthService(new AuthStore(db))
   const cookies = { siteName: config.siteName, securePrefix: config.secureCookies }
   const names = cookieNames(cookies)
+  // The socket's peer for each request in flight, which only `Bun.serve` knows;
+  // a request that came some other way (a test, the assistant) has none.
+  const peers = new WeakMap<Request, string>()
+  const clientAddress = (request: Request): ClientAddress => ({
+    ipAddress: peers.get(request) ?? null,
+    forwardedFor: request.headers.get('x-forwarded-for'),
+  })
+  // The global cap behind the per-caller one is what holds when a forwarded
+  // address is spoofed to dodge it.
+  const setup = createSetupRoutes({
+    db,
+    setupCode: config.setupCode,
+    siteName: config.siteName,
+    backOfficePath: paths.backOfficePath,
+    clientKey: (request) =>
+      peers.get(request) ?? request.headers.get('x-forwarded-for') ?? 'unknown',
+  })
   const authRoutes = createAuthRoutes({
     backOfficePath: paths.backOfficePath,
     service: auth,
     cookies,
+    onAudit: (event, request) =>
+      recordAudit(db, {
+        category: 'sign-in',
+        action: event.action,
+        source: 'request',
+        userKey: event.user?.key ?? null,
+        userName: event.user?.userName ?? event.login ?? null,
+        entityType: event.user ? 'User' : null,
+        entityKey: event.user?.key ?? null,
+        entityName: event.user?.userName ?? null,
+        detail: event.detail ?? null,
+        ...clientAddress(request),
+      }),
   })
 
   /**
@@ -307,15 +385,39 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
 
   // Form definitions are files, so they are re-read rather than cached with the
   // content: nothing about a publish tells this node that a form changed.
-  const forms = createFormRegistry(config.schemaDir)
+  const forms = createFormRegistry(config.schemaDir, { formTypes: formTypes.types })
   // Every form this node renders carries a token signed with the site's key, so
   // the timing guard cannot be bypassed by posting a made-up render time.
   const formSecret = await formSigningSecret(db)
   setFormTokenSigner((formKey, renderedAt) => signFormToken(formSecret, formKey, renderedAt))
-  const cache = new PublishedCache(
-    createPublishedContentSource(db, { nodeState: schema.nodeState, nodeId: schema.nodeId }),
-    { form: (key) => forms.byKey(key) },
-  )
+  const publishedSource = createPublishedContentSource(db, {
+    nodeState: schema.nodeState,
+    nodeId: schema.nodeId,
+  })
+  const cacheOptions = { form: (key: string) => forms.byKey(key) }
+  const cache = new PublishedCache(publishedSource, cacheOptions)
+  // A sync or a Settings change that alters how URLs are built moves every URL:
+  // the old ones redirect, as a rename's do.
+  const urlChange: UrlChangeContext = {
+    db,
+    config,
+    source: publishedSource,
+    cacheOptions,
+    cache,
+    tracker: createRedirectTracker({
+      cache,
+      redirects: new RedirectRepository(db),
+      enabled: config.trackRedirects,
+    }),
+  }
+  const afterSync = async (report: SyncReport | undefined) => {
+    if (!report?.urls) return
+    await redirectAfterUrlChange(urlChange, report.urls.before)
+    log.info('Page addresses now {mode} the top-level page; old addresses redirect', {
+      mode: report.urls.after.hideTopLevel ? 'leave out' : 'include',
+    })
+  }
+  await afterSync(schema.report)
   // A snapshot of the views, so a template edited anywhere — the backoffice, a
   // deploy, a bucket synced underneath — is picked up without restarting this
   // node. `assertViewRuntime` first, because a cache directory the JSX runtime
@@ -436,6 +538,11 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
           { nodeId: schema.nodeId, revision: config.schemaRevision },
           (report: SyncReport) => {
             cache.invalidate()
+            void afterSync(report).catch((error: unknown) =>
+              schemaLog.error('Recording redirects after an address change failed: {error}', {
+                error: String(error),
+              }),
+            )
             if (report.action === 'refused')
               schemaLog.error('Schema change refused: {reason}', {
                 reason:
@@ -460,6 +567,26 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     nodeState: schema.nodeState,
     nodeId: schema.nodeId,
   })
+  const deliverySettings = resolveDeliveryApiSettings(config.deliveryApi)
+  const deliveryPrefix = DELIVERY_API_PREFIX
+  const deliveryMembers = createDeliveryMemberSecurity({
+    db,
+    settings: deliverySettings,
+    members,
+  })
+  for (const problem of deliveryMembers.problems)
+    log.warning('Delivery API: {problem}', { problem })
+  const deliveryApi =
+    config.role === 'api'
+      ? undefined
+      : createDeliveryApi({
+          settings: deliverySettings,
+          cache,
+          prefix: deliveryPrefix,
+          protection: () => new PublicAccessRepository(db).allRules(),
+          member: (token) => deliveryMembers.member(token),
+          security: (request, action) => deliveryMembers.handle(request, action),
+        })
 
   /** A document's latest saved version, as preview shows it, in the published tree's context. */
   async function draftModel(key: string, requested: string | null) {
@@ -505,12 +632,6 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       ...entry,
     })
   })
-  const previewPort = {
-    enter: () => [
-      serializeCookie({ name: PREVIEW_COOKIE, value: 'preview', secure: config.secureCookies }),
-    ],
-    exit: () => [expireCookie(PREVIEW_COOKIE, config.secureCookies)],
-  }
   // The site's config may name a store; without one the environment decides,
   // and that falls back to the media directory on this disk.
   const mediaStore = config.mediaStore ?? (await mediaStoreFromEnvironment(config.mediaDir))
@@ -524,6 +645,18 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
   const canSendUserLinks = Boolean(resolveUserLinkSender(config, email))
   const mediaFiles = new MediaFileStore(mediaStore)
   const images = new ImageProcessor(mediaStore)
+  const webhooks = createWebhookService({
+    db,
+    schemaDir: config.schemaDir,
+    filesWritable: config.schemaWritable,
+    secretKey: config.secretKey,
+    bundles: config.bundles,
+    onFilesChanged: config.schemaStore
+      ? async () => {
+          await publishSchema(config.schemaStore as SchemaStore, config.schemaDir)
+        }
+      : undefined,
+  })
   const api = createManagementApiRouter({
     deps: {
       ...createDeps({
@@ -531,10 +664,12 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         paths,
         extensions,
         db,
+        webhooks,
         cache,
         schema,
         mediaFiles,
         email,
+        onSearchQueued: () => jobs.kickSearchIndexing(),
         // This node looks again at once; the others are told to. The write has
         // already landed wherever `componentsDir` points, so there is nothing to
         // distribute — only the fact that it happened.
@@ -552,16 +687,28 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
           })
         },
       }),
-      preview: previewPort,
     },
     authenticate,
     nodes: createNodeLookup(db),
     allowLocalLogin: config.allowLocalLogin,
+    audit: createAuditSink(db),
+    clientAddress,
+    onError: (error) => {
+      const answered = busyResponse(error)
+      if (answered) apiLog.warn('A write gave up waiting for another: {error}', { error })
+      return answered
+    },
     onNotImplemented: config.development
       ? (operation, request) => notImplemented.record(operation, request)
       : undefined,
+    // Queued after the response, so a slow receiver never holds an editor up.
+    onWebhookEvent: (event) => {
+      void webhooks.raise(event)
+    },
     onServerEvent: (event) => {
       events.broadcast('notify', [event])
+      // Saves, deletes and moves all announce themselves; whatever they queued gets indexed now.
+      jobs.kickSearchIndexing()
       // An open preview of the document reloads when it changes.
       if (event.eventSource === 'Umbraco:CMS:Document' && event.eventType !== 'Deleted')
         previewHub.broadcast('refreshed', [event.key])
@@ -606,9 +753,11 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     nodeState: schema.nodeState,
     nodeId: schema.nodeId,
     versionCleanup: config.versionCleanup,
+    auditRetentionDays: config.auditRetentionDays,
     mediaFiles,
     // The workflow queue drains here rather than in the request: a submission is
     // stored first, and an e-mail that cannot be sent yet must not cost it.
+    webhooks,
     formWorkflows: createWorkflowRunner({
       db,
       forms,
@@ -617,6 +766,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       nodeState: schema.nodeState,
       nodeId: schema.nodeId,
       onContentChanged: () => cache.invalidate(),
+      bundleWorkflows: formTypes.workflows,
     }),
     onDocumentChanged: (key) =>
       events.broadcast('notify', [
@@ -635,6 +785,9 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
   // App_Plugins is gone (`docs/bundles.md`). Saying so beats a site whose
   // extensions silently stopped loading after an upgrade; remove at 1.0.
   warnAboutAppPlugins(config.siteDir, log)
+  // Named, never shown: the value is the one thing this must not print.
+  if (config.setupCode && (await setup.pending()) === false)
+    log.warning('CROMBOLO_SETUP_CODE is still set, but the site is set up. Remove the setting.')
   noticeAboutEmail(emailStatus, logger('email'), { development: config.development })
   const hubPath = SERVER_EVENT_HUB_PATH
   const previewHubPath = PREVIEW_HUB_PATH
@@ -648,7 +801,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
           module.createAssistantHost({
             config: config.assistant as NonNullable<typeof config.assistant>,
             db,
-            schema: createSchemaProposals({ db, config, boot: schema }),
+            schema: createSchemaProposals({ db, config, boot: schema, afterSync }),
             siteName: config.siteName,
             version: VERSION,
             dispatch: (inner) => api.dispatch(inner),
@@ -680,6 +833,9 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
 
   // Imported only when configured, like the assistant: an unconfigured site has no
   // git route and no credentials anywhere near it.
+  const auditPath = `${paths.pluginPath}/api/audit`
+  const auditHost = createAuditHost(db, config.auditRetentionDays)
+
   const gitPath = `${paths.pluginPath}/api/git`
   const git =
     config.git && servesBackOffice
@@ -712,9 +868,19 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     // `web` node falls straight through to the public site, so the backoffice,
     // the Management API and the sign-in routes are not merely unauthorised
     // there — they are not routes at all, and 404 like any other unknown path.
+    // Umbraco's Delivery API, below the backoffice path but served wherever the
+    // site is, from the published cache: it scales with rendering.
+    if (deliveryApi && pathname.startsWith(`${deliveryPrefix}/`)) {
+      const response = await deliveryApi.handle(request)
+      if (response) return response
+    }
+
     if (servesBackOffice) {
       const response = await serveBackOffice(request, url)
-      if (response) return response
+      if (response) {
+        if (response.ok) await auditPluginWrite(request, pathname)
+        return response
+      }
     }
 
     if (pathname.startsWith(`${MEMBER_ROUTE_PREFIX}/`)) {
@@ -749,6 +915,27 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     return renderSite(request, pathname, url.host)
   }
 
+  /**
+   * The audit entry for a successful write to one of Crombolo's own endpoints,
+   * which the contract router does not see. The assistant's are left out: what it
+   * changes goes through the router, and is recorded there. docs/audit-log.md.
+   */
+  async function auditPluginWrite(request: Request, pathname: string): Promise<void> {
+    const prefix = `${paths.pluginPath}/api/`
+    if (request.method === 'GET' || request.method === 'HEAD') return
+    if (!pathname.startsWith(prefix) || pathname.startsWith(`${assistantPath}/`)) return
+    const principal = await authenticate(request)
+    if (!principal) return
+    const plan = pluginAuditPlan(request.method, pathname.slice(prefix.length))
+    await recordAudit(db, {
+      ...plan,
+      source: 'request',
+      userKey: principal.id,
+      userName: principal.name,
+      ...clientAddress(request),
+    })
+  }
+
   /**
    * The backoffice, the Management API and everything that serves an editor.
    *
@@ -760,6 +947,16 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
   async function serveBackOffice(request: Request, url: URL): Promise<Response | undefined> {
     const { pathname } = url
 
+    if (pathname === setup.path) return setup.handle(request)
+    // Until the first administrator exists there is nobody to sign in as.
+    if (
+      request.method === 'GET' &&
+      (pathname === `${paths.backOfficePath}/login` ||
+        isSpaRoute(paths.backOfficePath, pathname)) &&
+      (await setup.pending())
+    )
+      return new Response(null, { status: 303, headers: { location: setup.path } })
+
     // Non-contract, signed-in: the assistant's chat, review and MCP endpoints.
     // Absent configuration there is no `assistant`, so these paths 404 like any
     // other unknown route.
@@ -809,6 +1006,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       }
       const dryRun = request.method === 'GET'
       const result = await importSchema(db, config, schema, { dryRun })
+      if (!dryRun) await afterSync(result.report)
       if (!dryRun) {
         log.info('{user} imported the schema: {action}, {classification}', {
           user: principal.userName,
@@ -840,7 +1038,10 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       if (!principal) return new Response('Unauthorized', { status: 401 })
       if (request.method !== 'GET') return new Response('Method Not Allowed', { status: 405 })
       const body = JSON.stringify({
-        libs: await editorTypeLibs({ schemaDir: config.schemaDir }),
+        libs: await editorTypeLibs({
+          schemaDir: config.schemaDir,
+          formTypes: formTypesFor(config),
+        }),
         jsxImportSource: siteJsxImportSource(config.siteDir),
       })
       // Revalidated on every open rather than kept: the generated types follow
@@ -967,6 +1168,33 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
      * files are the truth, the backoffice may have just rewritten one, and a
      * picker that disagreed with what a render uses would be worse than slow.
      */
+    // Non-contract, Settings: the "Where it's kept" panel on a webhook's screen.
+    const kept = new RegExp(`^${paths.pluginPath}/api/webhooks/([0-9a-fA-F-]{36})/store$`).exec(
+      pathname,
+    )
+    if (kept) {
+      const principal = await authenticate(request)
+      if (!principal) return new Response('Unauthorized', { status: 401 })
+      if (!hasSection(principal, 'settings')) return new Response('Forbidden', { status: 403 })
+      const key = (kept[1] as string).toLowerCase()
+      if (request.method === 'PUT') {
+        const body = (await request.json().catch(() => ({}))) as { store?: unknown }
+        if (body.store !== 'files' && body.store !== 'database')
+          return Response.json({ reason: 'Choose files or database.' }, { status: 400 })
+        const moved = await webhooks.move(key, body.store)
+        return moved.ok
+          ? Response.json({ ok: true })
+          : Response.json(
+              { reason: moved.reason, problems: moved.problems ?? [] },
+              { status: moved.status },
+            )
+      }
+      if (request.method !== 'GET') return new Response('Method Not Allowed', { status: 405 })
+      const webhook = await webhooks.get(key)
+      if (!webhook) return new Response('Not Found', { status: 404 })
+      return Response.json(webhookStoreView(webhook.store, webhooks.stores()))
+    }
+
     if (pathname.startsWith(`${paths.pluginPath}/api/forms`)) {
       const principal = await authenticate(request)
       if (!principal) return new Response('Unauthorized', { status: 401 })
@@ -978,7 +1206,12 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       // A definition is structure, like a content type: anyone who may open the
       // section may read it, and the picker needs it in the Content section too.
       if (action === '' && request.method === 'GET')
-        return Response.json({ items: definitions.map(formSummary) })
+        return Response.json({
+          items: definitions.map((form) => formSummary(form, formTypes.types)),
+        })
+      // Hyphenated, so no form alias (letters and digits) can be mistaken for it.
+      if (action === 'available-types' && request.method === 'GET')
+        return Response.json(describeFormTypes(formTypes.types))
 
       const entries = new FormEntryRepository(db)
       const byKey = formsByKey(definitions)
@@ -989,6 +1222,7 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       const formFiles = {
         schemaDir: config.schemaDir,
         writable: config.schemaWritable,
+        formTypes: formTypes.types,
         onChanged: config.schemaStore
           ? async () => {
               await publishSchema(config.schemaStore as SchemaStore, config.schemaDir)
@@ -1065,7 +1299,10 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         const form = byKey.get(key)
         if (!form) return new Response('Not Found', { status: 404 })
         const page = await entries.list({ formKey: key, take: 10_000 })
-        const result = entriesCsv(form, page.items, { includeSensitive: maySeeSensitive })
+        const result = entriesCsv(form, page.items, {
+          includeSensitive: maySeeSensitive,
+          types: formTypes.types,
+        })
         if (!result.ok)
           return new Response(result.reason, {
             status: 403,
@@ -1112,6 +1349,25 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         return Response.json({ ...formDetail(form), definition: form })
       }
 
+      // What a choice source offers now, in the default language, for the
+      // designer to show beside the source it is editing.
+      if (action === 'choices' && request.method === 'POST') {
+        if (!may(FormPermissions.Manage)) return new Response('Forbidden', { status: 403 })
+        const body = (await request.json().catch(() => ({}))) as { source?: unknown }
+        const source = body.source as { kind?: unknown; parent?: unknown } | undefined
+        if (
+          !source ||
+          !CHOICE_SOURCE_KINDS.includes(source.kind as ChoiceSourceKind) ||
+          typeof source.parent !== 'string'
+        )
+          return new Response('Bad Request', { status: 400 })
+        const options = await cache.choiceOptions({
+          kind: source.kind as ChoiceSourceKind,
+          parent: source.parent,
+        })
+        return Response.json({ options })
+      }
+
       // Designing a form is a developer's job, so it is its own verb rather
       // than something an entry reader can do.
       if (request.method === 'POST' || request.method === 'PUT') {
@@ -1166,6 +1422,70 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
     // and no explanation. The findings name documents and the properties that are
     // unfilled: that is the Settings dashboard's material, and the dashboard's own
     // manifest is already `Umb.Condition.SectionAlias` on Settings.
+    // Non-contract, Settings: the audit log dashboard's reads. Settings, as the
+    // dashboard is: it names who signed in from where, and every change made.
+    if (pathname === auditPath || pathname.startsWith(`${auditPath}/`)) {
+      const principal = await authenticate(request)
+      if (!principal) return new Response('Unauthorized', { status: 401 })
+      if (!hasSection(principal, 'settings')) return new Response('Forbidden', { status: 403 })
+      const response = await auditHost.handle(request, pathname.slice(auditPath.length))
+      if (response) return response
+    }
+
+    // Non-contract, Settings: how page addresses are built (story 110).
+    if (pathname === `${paths.pluginPath}/api/url-options`) {
+      const principal = await authenticate(request)
+      if (!principal) return new Response('Unauthorized', { status: 401 })
+      if (!hasSection(principal, 'settings')) return new Response('Forbidden', { status: 403 })
+      if (request.method === 'GET')
+        return Response.json({
+          ...(await readUrlOptions(db)),
+          editable: urlSettingEditable(config, existsSync(config.schemaDir)),
+        })
+      if (request.method !== 'PUT') return new Response('Method Not Allowed', { status: 405 })
+      const body = (await request.json().catch(() => ({}))) as { hideTopLevel?: unknown }
+      if (typeof body.hideTopLevel !== 'boolean')
+        return Response.json(
+          { ok: false, message: 'Say whether to hide the top-level page.' },
+          { status: 400 },
+        )
+      const outcome = await changeUrlOptions(urlChange, { hideTopLevel: body.hideTopLevel })
+      log.info('{user} set page addresses to {mode} the top-level page: {outcome}', {
+        user: principal.email,
+        mode: body.hideTopLevel ? 'leave out' : 'include',
+        outcome: outcome.ok ? 'ok' : outcome.message,
+      })
+      return outcome.ok
+        ? Response.json({ ok: true, ...outcome.options })
+        : Response.json({ ok: false, message: outcome.message }, { status: outcome.status })
+    }
+
+    // Non-contract, Packages: answering a content import's conflicts and running
+    // it, from the Changes dashboard. Packages, because installing is.
+    if (pathname.startsWith(`${paths.pluginPath}/api/transfers/`)) {
+      const principal = await authenticate(request)
+      if (!principal) return new Response('Unauthorized', { status: 401 })
+      if (!hasSection(principal, 'packages')) return new Response('Forbidden', { status: 403 })
+      const action = pathname.slice(`${paths.pluginPath}/api/transfers/`.length)
+      const response = await handleTransferAction(request, action, {
+        db,
+        config,
+        user: principal.email,
+        onApplied: () => cache.invalidate(),
+      })
+      if (response) {
+        if (request.method === 'POST')
+          log.info('{user} {verb} for the content bundle {bundle}: {status}', {
+            user: principal.email,
+            verb: action.split('/').pop(),
+            bundle: action.split('/')[0],
+            status: response.status,
+          })
+        return response
+      }
+      return new Response('Not Found', { status: 404 })
+    }
+
     if (pathname === `${paths.pluginPath}/api/change-report`) {
       const principal = await authenticate(request)
       if (!principal) return new Response('Unauthorized', { status: 401 })
@@ -1185,7 +1505,24 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       // A bundle's tables are part of what an upgrade changes, so the dashboard
       // that shows an upgrade's findings shows their steps too.
       const bundles = await bundleTablesReport(db, chains)
-      return Response.json({ health: health(), counts, bySource, findings, bundles })
+      const upgrades = summariseUpgrades(await readLedger(db), VERSION)
+      // The answers a finding can be given, offered only to those who may import.
+      const mayImport = hasSection(principal, 'packages')
+      const offered = findings.map((f) =>
+        f.source === 'transfer' && f.status === 'open' && mayImport
+          ? { ...f, choices: choicesFor(f) }
+          : f,
+      )
+      return Response.json({
+        health: health(),
+        counts,
+        bySource,
+        findings: offered,
+        bundles,
+        upgrades,
+        transfers: await pendingTransfers(db),
+        mayImport,
+      })
     }
 
     const staticMatch = resolveStaticFile(paths, pathname, {
@@ -1402,6 +1739,21 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
         mediaFiles,
         uploads: DEFAULT_UPLOAD_SETTINGS,
         urlOf: async (contentKey) => (await cache.byKey(contentKey))?.url,
+        // The page it was sent from names the culture; the keys a source offers
+        // are the same in every culture, so only the stored labels depend on it.
+        resolveForm: async (form) => {
+          const referer = request.headers.get('referer')
+          let culture: string | null = null
+          try {
+            if (referer) {
+              const url = new URL(referer)
+              culture = await cache.cultureFor(url.host, url.pathname)
+            }
+          } catch {
+            culture = null
+          }
+          return cache.resolveForm(form, culture)
+        },
       },
       request,
       key,
@@ -1438,6 +1790,11 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
           ? Response.json({ ok: false, error: message }, { status: 409 })
           : plain(message, 409)
       }
+      // Only the script checks a page, so this always answers in JSON.
+      case 'checked':
+        return outcome.errors.length > 0
+          ? Response.json({ ok: false, errors: outcome.errors }, { status: 422 })
+          : Response.json({ ok: true })
       case 'invalid':
         return json
           ? Response.json({ ok: false, errors: outcome.state.errors }, { status: 422 })
@@ -1605,6 +1962,8 @@ export async function createServer(config: CromboloConfig = loadConfig()): Promi
       port: config.port,
       maxRequestBodySize: config.maxRequestBodyBytes,
       fetch: diagnostics.wrap(async (request, bunServer: Server<HubSocketData>) => {
+        const peer = bunServer.requestIP(request)?.address
+        if (peer) peers.set(request, peer)
         const pathname = new URL(request.url).pathname
         if (pathname === hubPath || pathname === previewHubPath) {
           const principal = await authenticate(request)