@formancy/data-server 0.0.0-stage → 0.1.0

package/dist/drivers-DtJsZ_HW.mjs

@@ -0,0 +1,3328 @@
+import { t as resolveSecret } from "./secrets-DhKHG-Y9.mjs";
+import rateLimit from "@fastify/rate-limit";
+import { CROSS_ORIGIN_REQUEST_HEADERS, DEFAULT_LOOKUP_DEADLINE_MS, GENERATED_SPEC_VERSION, MAX_LOOKUP_DEADLINE_MS, NOTHING_LEFT, READ_REFUSED, WRITE_ID_HEADER, applyPresentation, authorizeOperation, bindingsVersionProblem, buildLookupConfig, checkSubmittedFields, createSnapshot, deleteEffects, deleteProblems, describeReassigned, diffSnapshots, driftRefusal, findObject, formMenu, generateForm, grantedOperations, grantsOnKey, intendedRecord, isDatabaseKind, listColumns, listable, lookupRowFilter, menuForm, planCreate, planDelete, planList, planRead, planUpdate, presentationShapeProblems, readableFields, reassignedKeys, rebasePresentation, recordPage, recordToken, rejectedSelection, rowFilterColumnProblem, runtimeOperations, scopeRowFilters, throughProblems, toFormAnswers, validateListQuery, validateLookupQuery, validatePolicy } from "@formancy/data-core";
+import Fastify, { LogController } from "fastify";
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import { link, mkdir, open, readFile, readdir, rm, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { canonicalize } from "@formancy/spec";
+import { validateSchema } from "@formancy/spec/validate";
+import { connectPostgres, createPostgresAdapter, createPostgresLookups, createPostgresRecords } from "@formancy/data-postgres";
+import { connectSqlServer, createSqlServerAdapter, createSqlServerLookups, createSqlServerRecords } from "@formancy/data-sqlserver";
+//#region src/config-store.ts
+/** What `read` throws for a version that exists and does not parse. Its message names the file. */
+var UnparsableVersionError = class extends Error {
+	name = "UnparsableVersionError";
+};
+const CONFIGURATION_ID = new RegExp(`^[a-z0-9][a-z0-9._-]{0,${String(127)}}$`);
+const VERSION_FILE = /^([1-9][0-9]*)\.json$/;
+function assertId(id) {
+	if (!CONFIGURATION_ID.test(id)) throw new Error(`${JSON.stringify(id)} is not a configuration id`);
+}
+function isCode(error, code) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+/**
+* A configuration store on a directory — a persistent volume in a container.
+*
+* Layout: `<root>/<id>/<version>.json`, pretty-printed, one file per version,
+* so an export is a copy of the directory and a review is a diff.
+*
+* **Compare-and-swap without a lock.** A version is written to a temporary file,
+* flushed, and then hard-linked to its final name. `link` fails if the name
+* exists, atomically, so of two writers that both read version 3 as the newest,
+* exactly one creates 4.json and the other gets a conflict. Nobody ever sees a
+* half-written version, because the final name only appears once the bytes are
+* on disk. A crash leaves a temporary file that nothing reads.
+*
+* On a local filesystem — ext4, xfs, NTFS — `link` is atomic. Over NFS it is
+* atomic on the server but the error a client sees after a retransmission can
+* be wrong, which is why the plan limits this store to a single-instance pilot.
+*/
+function createFileConfigurationStore(root) {
+	/**
+	* Whether the root does not exist yet — a fresh volume, an empty store — and
+	* a loud failure if it exists and is not a directory.
+	*
+	* Asked whenever something under the root is missing, because "missing"
+	* means two different things. On Windows a path through a FILE reports
+	* ENOENT, not ENOTDIR, so a volume path that names a file would otherwise
+	* make every published form look unpublished.
+	*/
+	async function rootIsMissing() {
+		try {
+			if (!(await stat(root)).isDirectory()) throw new Error(`${root} is not a directory; the configuration store needs one`);
+			return false;
+		} catch (error) {
+			if (isCode(error, "ENOENT")) return true;
+			throw error;
+		}
+	}
+	async function versions(id) {
+		assertId(id);
+		let names;
+		try {
+			names = await readdir(join(root, id));
+		} catch (error) {
+			if (!isCode(error, "ENOENT") && !isCode(error, "ENOTDIR")) throw error;
+			await rootIsMissing();
+			return [];
+		}
+		const found = [];
+		for (const name of names) {
+			const match = VERSION_FILE.exec(name);
+			if (match?.[1] !== void 0) found.push(Number(match[1]));
+		}
+		return found.sort((a, b) => a - b);
+	}
+	async function latest(id) {
+		return (await versions(id)).at(-1) ?? null;
+	}
+	return {
+		latest,
+		versions,
+		async read(id, version) {
+			assertId(id);
+			if (!Number.isSafeInteger(version) || version < 1) throw new Error(`${String(version)} is not a version`);
+			const path = join(root, id, `${String(version)}.json`);
+			let text;
+			try {
+				text = await readFile(path, "utf8");
+			} catch (error) {
+				if (!isCode(error, "ENOENT") && !isCode(error, "ENOTDIR")) throw error;
+				await rootIsMissing();
+				return;
+			}
+			try {
+				return JSON.parse(text);
+			} catch {
+				throw new UnparsableVersionError(`${path} is not valid JSON; a published version must never be edited`);
+			}
+		},
+		async publish(id, expectedBase, value) {
+			const current = await latest(id);
+			if (current !== expectedBase) return {
+				ok: false,
+				reason: "conflict",
+				current
+			};
+			const directory = join(root, id);
+			await mkdir(directory, { recursive: true });
+			const next = (current ?? 0) + 1;
+			const temporary = join(directory, `.publishing-${randomUUID()}`);
+			const handle = await open(temporary, "wx");
+			try {
+				await handle.writeFile(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+				await handle.sync();
+			} finally {
+				await handle.close();
+			}
+			try {
+				await link(temporary, join(directory, `${String(next)}.json`));
+				return {
+					ok: true,
+					version: next
+				};
+			} catch (error) {
+				if (isCode(error, "EEXIST")) return {
+					ok: false,
+					reason: "conflict",
+					current: await latest(id)
+				};
+				throw error;
+			} finally {
+				await rm(temporary, { force: true });
+			}
+		},
+		async list() {
+			if (await rootIsMissing()) return [];
+			const names = await readdir(root);
+			const ids = [];
+			for (const name of names) if (CONFIGURATION_ID.test(name) && await latest(name) !== null) ids.push(name);
+			return ids.sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		}
+	};
+}
+//#endregion
+//#region src/audit.ts
+/** Events as structured log lines, one per request. */
+function logAuditSink(log) {
+	return (event) => {
+		log.info({ audit: event }, "audit");
+	};
+}
+/**
+* A form id as the trail records it, on either plane: the text addressed when
+* it has the store's shape for a form id, otherwise `null`. A path parameter
+* is anything a caller types, token or no token, up to the router's limit; a
+* form id's shape holds no `:`, `;`, `@`, `=` or `/`, so no connection
+* string, and names something the store could hold (0033). It does hold an
+* IP address, a host name, or a lower-case word that is somebody's password:
+* those are form ids, and are recorded as typed.
+*/
+function auditedForm(id) {
+	return typeof id === "string" && CONFIGURATION_ID.test(id) ? id : null;
+}
+/** The keyed hash a record is named by: the first 32 hex characters of HMAC-SHA-256. */
+function recordReference(key, token) {
+	if (key === void 0 || token === void 0 || token === "") return null;
+	return createHmac("sha256", key).update(token, "utf8").digest("hex").slice(0, 32);
+}
+/** `METHOD url`, with HEAD as the GET it answers for. */
+function routeKey$1(method, url) {
+	const verb = method.toUpperCase();
+	return `${verb === "HEAD" ? "GET" : verb} ${url}`;
+}
+/**
+* One event per request, for every route of the plane it is called on, from
+* one set of hooks both planes share — so the two cannot disagree on what an
+* outcome is, or on whether a refusal is audited (0023, 0033).
+*
+* Called before the plane registers a route: from then on a route in that
+* context with no audit name stops the registration, whether or not a sink is
+* configured. `onRoute` sees only the routes registered after it, so a route
+* registered in the context before this call is refused on every request
+* instead, before its handler runs, and the log names it: either way a route
+* without a name never answers unaudited.
+*
+* The event is built once the reply is decided, from the response itself:
+* every ending — success, refusal, a database out of reach — without each
+* branch remembering to say so.
+*
+* Exactly once for a request that reaches a route, whichever way it ends,
+* measured against Fastify 5.12.5 on Node 22. `onResponse` runs only when the
+* response finishes. One whose client left while the route still ran never
+* finishes: the handler completes and its write commits, `onSend` runs with
+* the response already destroyed, and neither `onResponse` nor
+* `onRequestAbort` runs, the latter because the body had been read. One
+* pipelined behind another answer on its connection has no socket of its own
+* until that answer is written; if the connection goes first it emits
+* neither `finish` nor `close`, and is never destroyed. So the event is also
+* written from `onSend` when the response or its connection is already gone,
+* and otherwise from the connection's `close` if it comes before the event
+* is written: a response whose socket goes after `onSend` goes with its
+* connection, and a pipelined one has nothing else to say so. Whichever
+* comes first writes it, and the others find it written. A connection holds
+* one listener while any answer waits on it, however many requests a client
+* pipelined, and none once the last is written.
+*/
+function auditRequests(app, options) {
+	const { names, sink, describe } = options;
+	app.addHook("onRoute", (route) => {
+		for (const method of [route.method].flat()) {
+			const key = routeKey$1(method, route.url);
+			if (!Object.hasOwn(names, key)) throw new Error(`${key} has no audit name (0023, 0033)`);
+		}
+	});
+	app.addHook("onRequest", async (request, reply) => {
+		const key = routeKey$1(request.method, request.routeOptions.url ?? "");
+		if (Object.hasOwn(names, key)) return void 0;
+		request.log.error(`${key} has no audit name (0023, 0033)`);
+		return reply.code(500).send({
+			code: "unaudited-route",
+			message: "This route has no audit name, and does not answer."
+		});
+	});
+	if (sink === void 0) return;
+	const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const codes = /* @__PURE__ */ new WeakMap();
+	const written = /* @__PURE__ */ new WeakSet();
+	/** Per connection, the requests whose answers wait on it, and its one `close` listener for all of them. */
+	const waiting = /* @__PURE__ */ new WeakMap();
+	/** Until its event is written, a request's connection going writes it. */
+	const wait = (request, reply) => {
+		const connection = request.raw.socket;
+		let entry = waiting.get(connection);
+		if (entry === void 0) {
+			const requests = /* @__PURE__ */ new Map();
+			entry = {
+				requests,
+				close: () => {
+					for (const [each, answer] of requests) emit(each, answer);
+				}
+			};
+			waiting.set(connection, entry);
+			connection.once("close", entry.close);
+		}
+		entry.requests.set(request, reply);
+	};
+	/** Written: the connection need not say so, and holds no listener once nothing on it waits. */
+	const settle = (request) => {
+		const connection = request.raw.socket;
+		const entry = waiting.get(connection);
+		if (entry === void 0 || !entry.requests.delete(request) || entry.requests.size > 0) return;
+		connection.off("close", entry.close);
+		waiting.delete(connection);
+	};
+	const emit = async (request, reply) => {
+		if (written.has(request)) return;
+		written.add(request);
+		settle(request);
+		const operation = names[routeKey$1(request.method, request.routeOptions.url ?? "")];
+		if (operation === void 0) return;
+		const status = reply.statusCode;
+		try {
+			const base = {
+				at: now(),
+				actor: request.identity?.actor.id ?? null,
+				operation,
+				status,
+				outcome: status < 400 ? "ok" : codes.get(request) ?? `http-${String(status)}`
+			};
+			await sink(describe(request, base));
+		} catch (error) {
+			request.log.error({ error: error.message }, "an audit event could not be written");
+		}
+	};
+	app.addHook("onSend", async (request, reply, payload) => {
+		if (reply.statusCode >= 400 && typeof payload === "string") try {
+			const code = JSON.parse(payload).code;
+			if (typeof code === "string") codes.set(request, code);
+		} catch {}
+		if (reply.raw.destroyed || request.raw.socket.destroyed) {
+			await emit(request, reply);
+			return payload;
+		}
+		wait(request, reply);
+		return payload;
+	});
+	app.addHook("onResponse", async (request, reply) => {
+		await emit(request, reply);
+	});
+}
+//#endregion
+//#region src/lookup-deadline.ts
+/** What is wrong with `ms` as a deadline, said of `name`, or undefined: a whole number from 1 to the longest a Node timer holds. */
+function lookupDeadlineProblem(name, ms, written = String(ms)) {
+	if (Number.isSafeInteger(ms) && ms >= 1 && ms <= MAX_LOOKUP_DEADLINE_MS) return void 0;
+	return `${name} is a whole number of milliseconds from 1 to ${String(MAX_LOOKUP_DEADLINE_MS)}; it is ${written}.`;
+}
+/**
+* `FORMANCY_DATA_LOOKUP_DEADLINE_MS` as written: unset is the measured
+* default; otherwise decimal digits only, no sign, fraction, exponent or
+* space, from 1 to the longest a Node timer holds. The refusal quotes what
+* was written, which is a number of milliseconds and never a secret.
+*/
+function lookupDeadlineSetting(text) {
+	if (text === void 0) return {
+		ok: true,
+		ms: DEFAULT_LOOKUP_DEADLINE_MS
+	};
+	const ms = /^[0-9]+$/.test(text) ? Number(text) : NaN;
+	const problem = lookupDeadlineProblem("FORMANCY_DATA_LOOKUP_DEADLINE_MS", ms, JSON.stringify(text));
+	return problem === void 0 ? {
+		ok: true,
+		ms
+	} : {
+		ok: false,
+		problem
+	};
+}
+/**
+* A signal that aborts when `ms` have passed, with a TimeoutError, or when
+* `within` aborts, with `within`'s own reason (0061).
+*
+* A timer of its own rather than `AbortSignal.any` over
+* `AbortSignal.timeout`: a timeout signal cannot be cleared, and the
+* composite stayed reachable from it until it fired -- about 730 bytes a
+* request, for up to 24.8 days at the longest deadline (2026-10-15 review,
+* Node 24.21.0). `clear()` stops the timer and the listening, so a lookup
+* that answered holds nothing. The timer is unreferenced, as a timeout
+* signal's is: a deadline never keeps the process alive.
+*/
+function lookupDeadline(ms, within) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(new DOMException(`The lookup passed its deadline of ${String(ms)} ms.`, "TimeoutError")), ms);
+	if (typeof timer === "object") timer.unref();
+	const left = () => controller.abort(within?.reason);
+	if (within?.aborted === true) controller.abort(within.reason);
+	else within?.addEventListener("abort", left, { once: true });
+	return {
+		signal: controller.signal,
+		clear() {
+			clearTimeout(timer);
+			within?.removeEventListener("abort", left);
+		}
+	};
+}
+//#endregion
+//#region src/generation.ts
+function isRecord$10(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function lookupChoices(value) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) return void 0;
+	const choices = [];
+	for (const entry of value) {
+		if (!isRecord$10(entry) || typeof entry["foreignKey"] !== "string") return void 0;
+		const display = entry["display"];
+		if (!Array.isArray(display) || !display.every((column) => typeof column === "string")) return void 0;
+		choices.push({
+			foreignKey: entry["foreignKey"],
+			display: [...display]
+		});
+	}
+	return choices;
+}
+/**
+* One reading of a generation request, for the proposal route and for the
+* bundle check (0030), so what a proposal was generated from and what a
+* bundle says it was generated from are read by the same rules.
+*
+* Normalised: `lookups` and `pinned` are always lists, and `versionColumn` is
+* present only when it is a string. Other properties are not carried, so a
+* stored request that is not equal to its own reading holds something this
+* reading would not have produced.
+*/
+function readGeneration(value) {
+	if (!isRecord$10(value)) return {
+		ok: false,
+		problems: ["a generation request is an object"]
+	};
+	const problems = [];
+	const { connection, root, formId, title, versionColumn, pinned } = value;
+	if (typeof connection !== "string") problems.push("connection must name a connection");
+	if (!isRecord$10(root) || typeof root["schema"] !== "string" || typeof root["name"] !== "string") problems.push("root must be { schema, name }");
+	if (typeof formId !== "string" || !CONFIGURATION_ID.test(formId)) problems.push("formId must be a lower-case form id");
+	if (typeof title !== "string") problems.push("title must be text");
+	const lookups = lookupChoices(value["lookups"]);
+	if (lookups === void 0) problems.push("lookups must be a list of { foreignKey, display: [columns] }");
+	const pinnedColumns = pinned === void 0 ? [] : Array.isArray(pinned) && pinned.every((name) => typeof name === "string") ? [...pinned] : void 0;
+	if (pinnedColumns === void 0) problems.push("pinned must be a list of columns");
+	if (versionColumn !== void 0 && typeof versionColumn !== "string") problems.push("versionColumn must name a column");
+	if (problems.length > 0 || lookups === void 0 || pinnedColumns === void 0 || !isRecord$10(root)) return {
+		ok: false,
+		problems
+	};
+	return {
+		ok: true,
+		generation: {
+			connection,
+			root: {
+				schema: root["schema"],
+				name: root["name"]
+			},
+			formId,
+			title,
+			lookups,
+			pinned: pinnedColumns,
+			...typeof versionColumn === "string" ? { versionColumn } : {}
+		}
+	};
+}
+//#endregion
+//#region src/served-schema.ts
+function isRecord$9(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* A stored form or base as this server serves one: a document formancy's
+* validator accepts, in the spec version the generator writes (0042), or
+* every reason it is not, each beginning with `label`.
+*
+* The version is this server's question as well as the validator's, because
+* the validator accepts every version its release speaks, and that grows
+* with the release: from `@formancy/spec` 0.4.0 on a spec 4 document is valid,
+* and a host page whose renderer is at 0.3.0 refuses it outright. Another
+* version is refused whole, since what the validator would add is about a
+* version this server does not serve. A construct of a later version in a
+* document that says the generator's is refused with the same reason, by
+* the validator's code, rather than with its advice to move the document to
+* that version, which this server would then refuse.
+*/
+function servedSchema(label, document) {
+	const only = `and this server publishes and serves only spec ${JSON.stringify(GENERATED_SPEC_VERSION)}, the version it generates (0042)`;
+	const declared = isRecord$9(document) ? document["specVersion"] : void 0;
+	if (typeof declared === "string" && declared !== GENERATED_SPEC_VERSION) return {
+		valid: false,
+		problems: [`${label}: is spec ${JSON.stringify(declared)}, ${only}`]
+	};
+	const checked = validateSchema(document);
+	if (checked.valid) return checked;
+	return {
+		valid: false,
+		problems: checked.errors.map((error) => error.code.startsWith("version.") ? `${label}: ${error.path} needs spec ${JSON.stringify(String(error.values["version"]))}, ${only}` : `${label}: ${error.message}`)
+	};
+}
+//#endregion
+//#region src/bundle-format2.ts
+function isRecord$8(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* What format 2 adds (0030): a generation request in the form the proposal
+* route reads one, for this bundle's connection and form; a base formancy
+* accepts, in the generator's spec version (`servedSchema`); and a
+* presentation that applies to that base and gives exactly the stored form.
+* Not whether the generator would write that base — that is
+* `generatedProblems`, at publish only.
+*/
+function format2Problems(document, form, bindings, snapshot) {
+	const problems = [];
+	const read = readGeneration(document["generation"]);
+	const base = servedSchema("base", document["base"]);
+	if (!read.ok) problems.push(...read.problems.map((problem) => `generation: ${problem}`));
+	else if (canonicalize(read.generation) !== canonicalize(document["generation"])) problems.push("generation: is not in its normalised form (lookups and pinned as lists, versionColumn only when given, nothing else)");
+	else {
+		if (read.generation.connection !== document["connection"]) problems.push(`generation: names connection ${read.generation.connection}, and the bundle is bound to ${String(document["connection"])}`);
+		if (base.valid && read.generation.formId !== base.schema.id) problems.push(`generation: names form ${read.generation.formId}, and the base is ${base.schema.id}`);
+		if (base.valid) problems.push(...requestProblems(read.generation, base.schema, bindings, snapshot));
+	}
+	if (!base.valid) problems.push(...base.problems);
+	const shape = presentationShapeProblems(document["presentation"]);
+	if (shape.length > 0) return [...problems, ...shape.map((problem) => `presentation: ${problem}`)];
+	if (!base.valid) return problems;
+	const applied = applyPresentation(base.schema, document["presentation"], bindings);
+	if (!applied.ok) problems.push(...applied.problems.map((problem) => `presentation: ${problem}`));
+	else if (canonicalize(applied.form) !== canonicalize(form)) problems.push("form: is not the base with its presentation applied; the form, the base or the presentation was edited");
+	return problems;
+}
+/**
+* What the stored request alone decides, against the base and bindings it is
+* said to have produced (0030): the title, the root, a confirmed version
+* column, the pins and the lookups. A regeneration generates from this
+* request and its draft is checked at publish against the same request, so
+* an edit to it alone would reach the next version unannounced. None of
+* these asks the generator, so a later release cannot fail a stored version
+* on them.
+*
+* Not caught: a pin taken out by hand. A field written by no operation could
+* be pinned, generated, unwritable by the account or from a view, and only
+* the generator tells them apart. The policy still decides what is written
+* and which rows are reached; what such an edit changes is the next draft's
+* form.
+*/
+function requestProblems(generation, base, bindings, snapshot) {
+	const problems = [];
+	const tableOf = (ref) => `${ref.schema}.${ref.name}`;
+	if (generation.title !== base.title) problems.push(`generation: is titled ${JSON.stringify(generation.title)}, and the base ${JSON.stringify(base.title)}`);
+	if (!isRecord$8(bindings.root) || generation.root.schema !== bindings.root.schema || generation.root.name !== bindings.root.name) problems.push(`generation: names root ${tableOf(generation.root)}, and the bindings ${isRecord$8(bindings.root) ? tableOf(bindings.root) : "none"}`);
+	const concurrency = isRecord$8(bindings.concurrency) ? bindings.concurrency : null;
+	const confirmed = concurrency?.kind === "version-column" && concurrency.confirmed === true ? concurrency.column : void 0;
+	const rowversion = concurrency?.kind === "rowversion" || hasRowversion(snapshot, bindings.root);
+	if (generation.versionColumn !== void 0 && !rowversion && generation.versionColumn !== confirmed) problems.push(`generation: confirms version column ${generation.versionColumn}, and the bindings use ${confirmed ?? "none"}`);
+	if (generation.versionColumn === void 0 && confirmed !== void 0) problems.push(`generation: confirms no version column, and the bindings use ${confirmed} as a confirmed one`);
+	for (const column of generation.pinned ?? []) {
+		const field = bindings.fields.find((binding) => binding.kind === "column" && binding.column === column);
+		if (field !== void 0 && (field.writes.create || field.writes.update)) problems.push(`generation: pins ${column}, and its field ${field.field} is written by the form`);
+	}
+	const same = (left) => (right) => left.foreignKey === right.foreignKey && canonicalize(left.display) === canonicalize(right.display);
+	const shown = (lookup) => `${lookup.foreignKey} showing ${lookup.display.join(", ")}`;
+	const bound = bindings.fields.flatMap((binding) => binding.kind === "lookup" ? [binding] : []);
+	for (const lookup of generation.lookups) if (!bound.some(same(lookup))) problems.push(`generation: chooses a lookup over ${shown(lookup)}, which the bindings do not have`);
+	for (const lookup of bound) if (!generation.lookups.some(same(lookup))) problems.push(`generation: the bindings have a lookup over ${shown(lookup)}, which it does not choose`);
+	return problems;
+}
+/** Whether the snapshot's root has a rowversion column; false for a snapshot no catalog could produce. */
+function hasRowversion(snapshot, root) {
+	if (snapshot === null || !isRecord$8(root)) return false;
+	return findObject(snapshot, root)?.columns.some((column) => column.type.kind === "rowversion") ?? false;
+}
+/**
+* Whether this server's generator writes the bundle's base and bindings from
+* its snapshot and generation request (0030). Asked at publish, so a base
+* somebody edited — a relaxed maxLength, a dropped `required` — is never
+* stored as if the database had said so. Not asked on read: a later release
+* whose generator writes something else must not make every version stored
+* before it "corrupt".
+*/
+function generatedProblems(bundle) {
+	let generated;
+	try {
+		generated = generateForm(bundle.snapshot, bundle.generation);
+	} catch (error) {
+		return [`generation: ${error.message}`];
+	}
+	const problems = [];
+	if (canonicalize(generated.form) !== canonicalize(bundle.base)) problems.push("base: is not what this server generates from the stored snapshot and generation request");
+	if (canonicalize(generated.bindings) !== canonicalize(bundle.bindings)) problems.push("bindings: are not what this server generates from the stored snapshot and generation request");
+	return problems;
+}
+//#endregion
+//#region src/bundle.ts
+function isRecord$7(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Whether a document can be served as a published form, with every reason it
+* cannot.
+*
+* Run on publish and again on every read from the store, because the store is
+* files on a volume and a file can be edited by hand (0013). Each check is one
+* a hand edit could break silently:
+*
+* - the form must be one formancy's own validator accepts, in the spec
+*   version the generator writes (`servedSchema`, 0042) -- the validator
+*   alone accepts every version its release speaks;
+* - the snapshot must still hash to its own fingerprint — an edited column
+*   type would otherwise reach the planner, which trusts it;
+* - the bindings must have been generated from that snapshot;
+* - the bindings must be a version this release reads — one published before
+*   0027 cannot say which operation a field is written on, and is republished;
+* - every bound field must exist in the form, and the policy must fit the
+*   bindings and the snapshot (`policyProblems`), so a rule nobody enforces
+*   cannot be published;
+* - in format 2 (0030), the form must be its base with its presentation
+*   applied, and the generation request the one this server would store and
+*   the one its base and bindings say they came from (`bundle-format2.ts`).
+*
+* Format 1 is still read, so every version published before 0030 is served.
+*
+* It never throws. A part of another shape than a check reads -- a hand
+* edit's `null` where the bindings' fields belong -- is one more reason the
+* version is not served: thrown, it would reach the server's default 500,
+* which answers with the exception's message, and the menu of forms (0045)
+* would have to tell it from a store that cannot be read.
+*/
+function validateBundle(document) {
+	try {
+		return checkedBundle(document);
+	} catch (error) {
+		return {
+			ok: false,
+			problems: [`the bundle has a part of another shape than it should: ${error.message}`]
+		};
+	}
+}
+function checkedBundle(document) {
+	if (!isRecord$7(document)) return {
+		ok: false,
+		problems: ["a bundle is an object"]
+	};
+	const problems = [];
+	const format = document["format"];
+	if (format !== 1 && format !== 2) problems.push("format must be 1 or 2");
+	if (typeof document["connection"] !== "string" || document["connection"] === "") problems.push("connection must name a connection");
+	const form = servedSchema("form", document["form"]);
+	if (!form.valid) problems.push(...form.problems);
+	const snapshot = document["snapshot"];
+	const bindings = document["bindings"];
+	const policy = document["policy"];
+	if (!isRecord$7(snapshot) || !isRecord$7(bindings) || !isRecord$7(policy)) {
+		problems.push("snapshot, bindings and policy must all be present");
+		return {
+			ok: false,
+			problems
+		};
+	}
+	let wellFormed = false;
+	try {
+		const { fingerprint, ...rest } = snapshot;
+		if (createSnapshot(rest).fingerprint !== fingerprint) problems.push("the snapshot does not hash to its own fingerprint: it was edited after it was taken");
+		wellFormed = true;
+	} catch (error) {
+		problems.push(`the snapshot is not one a catalog could produce: ${error.message}`);
+	}
+	const version = bindingsVersionProblem(bindings.version);
+	if (version !== null) {
+		problems.push(version);
+		return {
+			ok: false,
+			problems
+		};
+	}
+	if (bindings.snapshotFingerprint !== snapshot.fingerprint) problems.push("the bindings were not generated from this snapshot");
+	if (form.valid && Array.isArray(bindings.fields)) {
+		const keys = new Set(form.schema.model.fields.map((field) => field.key));
+		for (const binding of bindings.fields) if (!keys.has(binding.field)) problems.push(`the bindings name ${binding.field}, which the form does not have`);
+	}
+	if (wellFormed) problems.push(...policyProblems(snapshot, bindings, policy));
+	else problems.push(...fitProblems(policy, bindings));
+	if (format === 2 && form.valid && Array.isArray(bindings.fields)) problems.push(...format2Problems(document, form.schema, bindings, wellFormed ? snapshot : null));
+	return problems.length === 0 ? {
+		ok: true,
+		bundle: document
+	} : {
+		ok: false,
+		problems
+	};
+}
+/**
+* Everything a policy does not fit: the bindings (`validatePolicy`), the
+* snapshot's columns a row filter compares (`unfilterableColumns`), what
+* the snapshot says of each lookup a through names (`throughProblems`, 0043),
+* and what a delete it grants would also do to other tables
+* (`deleteProblems`, 0050) -- each of which the planner asks too. One
+* function for the bundle check, on publish and on every read, and for the
+* regeneration route's report, so the three cannot disagree about one policy.
+*/
+function policyProblems(snapshot, bindings, policy) {
+	return [
+		...fitProblems(policy, bindings),
+		...unfilterableColumns(snapshot, bindings, policy),
+		...throughProblems(snapshot, bindings, policy).map((problem) => `policy: ${problem}`),
+		...isRecord$7(bindings.root) ? deleteProblems(snapshot, bindings, policy).map((problem) => `policy: ${problem}`) : []
+	];
+}
+function fitProblems(policy, bindings) {
+	const fitted = validatePolicy(policy, bindings);
+	return fitted.ok ? [] : fitted.problems.map((problem) => `policy: ${problem}`);
+}
+/** The filter rules of a policy as stored, whatever shape a hand edit left them in; `validatePolicy` reports a bad shape. */
+function rulesOf(value) {
+	return Array.isArray(value) ? value.filter((rule) => isRecord$7(rule) && typeof rule["column"] === "string") : [];
+}
+/**
+* Row filter columns a filter cannot compare, as `rowFilterColumnProblem`
+* names them: absent, not readable by the snapshot's account (0027), or of a
+* kind with no spelling both engines compare alike — a boolean, a float, a
+* time or a timestamp (0028). The root's filter is the WHERE of every read
+* and update and is written on every create; a lookup's is the WHERE of every
+* search on its target. Either way the planner refuses every request it
+* scopes, so saying so at publish is cheaper than at every request. A root
+* filter column the account may not INSERT refuses every create in the same
+* way, so it is a problem while the form offers create.
+*/
+function unfilterableColumns(snapshot, bindings, policy) {
+	const problems = [];
+	const unfilterable = (where, ref, rules) => {
+		const object = findObject(snapshot, ref);
+		if (object === void 0) return;
+		for (const { column } of rules) {
+			const problem = rowFilterColumnProblem(object, column);
+			if (problem !== null) problems.push(`policy: ${where} ${problem}`);
+		}
+	};
+	unfilterable("rowFilters", bindings.root, rulesOf(policy.rowFilters));
+	if (isRecord$7(bindings.operations) && bindings.operations.create === true) {
+		const root = findObject(snapshot, bindings.root);
+		for (const { column } of rulesOf(policy.rowFilters)) if (root?.columns.find((candidate) => candidate.name === column)?.access.insert === false) problems.push(`policy: rowFilters ${column} is a column this connection's account may not insert, and every create writes it`);
+	}
+	const lookups = isRecord$7(policy.lookups) ? policy.lookups : {};
+	for (const binding of Array.isArray(bindings.fields) ? bindings.fields : []) if (binding.kind === "lookup") unfilterable(`lookups.${binding.field}`, binding.target.table, rulesOf(lookups[binding.field]));
+	return problems;
+}
+//#endregion
+//#region src/published.ts
+/** A form id is a configuration id: lower case, so it means one thing on every filesystem (0013). */
+const FORM_ID = CONFIGURATION_ID;
+/**
+* The newest published version of a form, validated again on the way out of
+* the store (0019). One function for both planes, because "a hand-edited
+* version is never served" is one decision and two copies of it could drift.
+*
+* The problems go to the operator's log; the caller learns only that the
+* version is not served.
+*/
+async function loadPublished(store, id, log) {
+	const unknown = {
+		ok: false,
+		status: 404,
+		code: "unknown-form",
+		message: `No form is called ${id}.`
+	};
+	if (!FORM_ID.test(id)) return unknown;
+	const version = await store.latest(id);
+	if (version === null) return unknown;
+	return checked(store, id, version, log);
+}
+/**
+* One published version of a form, by number, validated as `loadPublished`
+* validates the newest (0030): the versions list and a restore read through
+* here, so an older version edited by hand is never served or restored.
+*/
+async function loadVersion(store, id, version, log) {
+	if (!FORM_ID.test(id) || await store.latest(id) === null) return {
+		ok: false,
+		status: 404,
+		code: "unknown-form",
+		message: `No form is called ${id}.`
+	};
+	return checked(store, id, version, log);
+}
+async function checked(store, id, version, log) {
+	const document = await store.read(id, version);
+	if (document === void 0) return {
+		ok: false,
+		status: 404,
+		code: "unknown-version",
+		message: `${id} has no version ${String(version)}.`
+	};
+	const validation = validateBundle(document);
+	if (!validation.ok) {
+		log.error({
+			form: id,
+			version,
+			problems: validation.problems
+		}, "a published bundle failed validation");
+		return {
+			ok: false,
+			status: 500,
+			code: "corrupt-bundle",
+			message: `Version ${String(version)} of ${id} no longer validates and is not served.`
+		};
+	}
+	return {
+		ok: true,
+		version,
+		bundle: validation.bundle
+	};
+}
+//#endregion
+//#region src/routes/runtime-errors.ts
+/**
+* A planner or policy refusal as an HTTP answer.
+*
+* Access refusals are 403 and say which rule, never which value: the policy's
+* own messages name keys, columns and attributes only (0011).
+*/
+function planRefusal(code, message) {
+	switch (code) {
+		case "operation-denied":
+		case "field-denied":
+		case "missing-attribute":
+		case "over-posting":
+		case "unknown-lookup":
+		case "operation-unavailable": return {
+			status: 403,
+			body: {
+				code,
+				message
+			}
+		};
+		case "drift": return {
+			status: 409,
+			body: {
+				code,
+				message
+			}
+		};
+		case "invalid-context": return {
+			status: 403,
+			body: {
+				code,
+				message
+			}
+		};
+		case "invalid-policy":
+		case "invalid-bindings": return {
+			status: 500,
+			body: {
+				code,
+				message: "This form is published with a configuration the server cannot apply."
+			}
+		};
+		case "invalid-request":
+		case "invalid-record-token":
+		case "invalid-version":
+		case "nothing-to-update":
+		case "not-sortable":
+		case "not-searchable": return {
+			status: 400,
+			body: {
+				code,
+				message
+			}
+		};
+		case "record-not-read": return {
+			status: 409,
+			body: {
+				code,
+				message: "This update could not be compared with the record as read. Nothing was saved."
+			}
+		};
+	}
+}
+/** The form field a column is bound to, directly or through a lookup, for a field error. */
+function fieldOf(bindings, column) {
+	if (column === void 0) return void 0;
+	for (const binding of bindings.fields) {
+		if (binding.kind === "column" && binding.column === column) return binding.field;
+		if (binding.kind === "lookup" && binding.columns.includes(column)) return binding.field;
+	}
+}
+/**
+* A database's refusal as an HTTP answer (0015).
+*
+* Constraint failures become a field error where the engine names a column the
+* form binds, so a person sees the message beside the field. `refused` is
+* 422, because sending it again will be refused the same way; `unavailable`
+* is 503, because it may not be. `unknown-outcome` is not answered here: only
+* a write has one, and the write routes answer it with `unknownOutcome`, which
+* names what was addressed. A read that reported one would be an adapter's
+* bug, and is thrown -- a 500 -- rather than told to a person as "may have
+* been saved" (0031).
+*/
+function recordFailure(bindings, failure) {
+	const field = fieldOf(bindings, failure.column);
+	const withField = (status, code, message) => ({
+		status,
+		body: field === void 0 ? {
+			code,
+			message
+		} : {
+			code,
+			message,
+			fieldErrors: [{
+				field,
+				code,
+				message
+			}]
+		}
+	});
+	switch (failure.code) {
+		case "not-found": return {
+			status: 404,
+			body: {
+				code: "not-found",
+				message: "No such record."
+			}
+		};
+		case "stale": return {
+			status: 409,
+			body: {
+				code: "stale",
+				message: "The record changed since it was read. Reload it, review the changes, and save again."
+			}
+		};
+		case "unique-violation": return withField(422, "unique-violation", "Another record already has this value.");
+		case "foreign-key-violation": return withField(422, "foreign-key-violation", "This refers to a record that does not exist, or is still referred to.");
+		case "not-null-violation": return withField(422, "not-null-violation", "A value is required.");
+		case "check-violation": return withField(422, "check-violation", "The database does not accept this value.");
+		case "too-long": return withField(422, "too-long", "This value is longer than the database stores.");
+		case "out-of-range": return withField(422, "out-of-range", "This value is outside the range the database stores.");
+		case "permission-denied": return {
+			status: 403,
+			body: {
+				code: "permission-denied",
+				message: "The database connection is not allowed to do this."
+			}
+		};
+		case "schema-changed": return {
+			status: 409,
+			body: {
+				code: "schema-changed",
+				message: "The database changed since this form was published."
+			}
+		};
+		case "refused": return withField(422, "refused", "The database refused this request, and nothing was saved. Sending it again will be refused the same way.");
+		case "unavailable": return {
+			status: 503,
+			body: {
+				code: "unavailable",
+				message: "The database could not complete this now. Nothing was saved."
+			}
+		};
+		case "unknown-outcome": throw new Error("only a write has an unknown outcome; the write routes answer it with unknownOutcome");
+	}
+}
+/**
+* A delete's refusal by the database as an HTTP answer (0050), in a
+* delete's words: nothing was deleted, never "nothing was saved". Never a
+* field error: a delete writes no field, and the column a constraint names
+* is another table's. A key that still refers to the record is
+* `referenced`, said without the table, the key or how many rows -- the
+* route logs the key's name (runtime-deletes.ts) -- though the answer
+* itself tells the person that something refers to the record, which any
+* refusal would.
+* `unknown-outcome` is the route's to answer with `unknownOutcome`, which
+* names what was addressed; here it is a bug, as for a read.
+*/
+function deleteFailure(failure) {
+	const refused = {
+		status: 422,
+		body: {
+			code: "refused",
+			message: "The database refused this request, and nothing was deleted. Sending it again will be refused the same way."
+		}
+	};
+	switch (failure.code) {
+		case "not-found": return {
+			status: 404,
+			body: {
+				code: "not-found",
+				message: "No such record."
+			}
+		};
+		case "stale": return {
+			status: 409,
+			body: {
+				code: "stale",
+				message: "The record changed since it was read. Reload it and review the changes before deleting it."
+			}
+		};
+		case "foreign-key-violation": return {
+			status: 422,
+			body: {
+				code: "referenced",
+				message: "Other records still refer to this one, so the database keeps it. Nothing was deleted."
+			}
+		};
+		case "unique-violation":
+		case "not-null-violation":
+		case "check-violation":
+		case "too-long":
+		case "out-of-range":
+		case "refused": return refused;
+		case "permission-denied": return {
+			status: 403,
+			body: {
+				code: "permission-denied",
+				message: "The database connection is not allowed to do this."
+			}
+		};
+		case "schema-changed": return {
+			status: 409,
+			body: {
+				code: "schema-changed",
+				message: "The database changed since this form was published."
+			}
+		};
+		case "unavailable": return {
+			status: 503,
+			body: {
+				code: "unavailable",
+				message: "The database could not complete this now. Nothing was deleted."
+			}
+		};
+		case "unknown-outcome": throw new Error("only a write has an unknown outcome; the delete route answers it with unknownOutcome");
+	}
+}
+/**
+* A write that was sent and whose answer was lost, as an HTTP answer (0031):
+* 502, because something between this server and the database failed, and in
+* words that say it may have been saved. Nothing here sends it again.
+*
+* The sentence never names a value (0011): what was addressed travels in
+* `record` and `version`, for the host to reconcile with. Each sentence says
+* what is safe next. An update and a delete are protected by their version
+* (0015, 0050). A create
+* whose key the insert named can be read by it. A create whose key the
+* database numbers cannot be found by anything here.
+*/
+function unknownOutcome(operation, record, version) {
+	let message;
+	if (operation === "delete") message = "The connection to the database failed after the deletion was sent. It may have been deleted. Deleting again with the same version deletes nothing else: if it was deleted, that is answered as not found.";
+	else if (operation === "update") message = "The connection to the database failed after the change was sent. It may have been saved. Saving again with the same version is safe: it is stored at most once.";
+	else if (record !== null) message = "The connection to the database failed after the record was sent. It may have been saved: read it before entering it again.";
+	else message = "The connection to the database failed after the record was sent. It may have been saved, and the database numbers new records, so only a search of your own can tell.";
+	return {
+		status: 502,
+		body: {
+			code: "unknown-outcome",
+			message,
+			operation,
+			record,
+			version
+		}
+	};
+}
+//#endregion
+//#region src/routes/write-once.ts
+/**
+* How long a sending's answer is kept for a resend, and how much is kept.
+*
+* Measured on 2026-10-09 by the host page's browser gate
+* (apps/host/scripts/browser-test.mjs, "Create resent by Chromium"), with
+* Playwright's Chromium against the real server on PostgreSQL, six runs: the
+* resend reached the server 5 to 6 ms after the connection closed -- the
+* gate polls every 5 ms, so that is its resolution -- and the order form's
+* create answer was 234 to 236 bytes as JSON. Ten minutes is a margin over
+* those milliseconds for a slower client, not a measurement of one; ten
+* thousand such answers are about 2.4 MB, and the byte cap is there for a
+* form whose records are large. Oldest dropped first, so a person sending
+* large records under fresh ids cannot make this server hold more: a resend
+* that arrives after its answer was dropped is applied again.
+*/
+const KEEP_MS = 6e5;
+/** What a write id must look like: the client's are 32 hex characters; anything of 16 to 64 URL-safe characters is taken. */
+const WRITE_ID = /^[A-Za-z0-9_-]{16,64}$/;
+/** The request's write id; undefined when it has none; null when it has one that is not one. */
+function writeId(request) {
+	const value = request.headers[WRITE_ID_HEADER];
+	if (value === void 0) return void 0;
+	return typeof value === "string" && WRITE_ID.test(value) ? value : null;
+}
+/** The refusal of a malformed id, or of an id that came back with another write. Nothing was sent. */
+const INVALID_WRITE_ID = {
+	status: 400,
+	body: {
+		code: "invalid-request",
+		message: `The ${WRITE_ID_HEADER} header is not one write's id. Nothing was saved.`
+	}
+};
+const REUSED_WRITE_ID = {
+	status: 400,
+	body: {
+		code: "invalid-request",
+		message: "This write id was sent before with a different write. Nothing was saved."
+	}
+};
+function createWriteOnce(now = Date.now) {
+	const kept = /* @__PURE__ */ new Map();
+	let bytes = 0;
+	/** Drops what has expired, and the oldest past either bound. Insertion order is expiry order. */
+	function prune() {
+		for (const [key, entry] of kept) {
+			if (entry.until > now() && kept.size <= 1e4 && bytes <= 33554432) break;
+			kept.delete(key);
+			bytes -= entry.bytes;
+		}
+	}
+	return { 
+	/**
+	* `perform`'s answer, the first time this id is sent for this write; the
+	* same answer, with `repeated`, every later time within KEEP_MS. The
+	* check and the claim are one synchronous step, so two sendings that
+	* arrive together cannot both perform.
+	*/
+async once(scope, perform) {
+		prune();
+		const key = JSON.stringify([
+			scope.actor,
+			scope.form,
+			scope.operation,
+			scope.id
+		]);
+		const digest = createHash("sha256").update(JSON.stringify(scope.body) ?? "").digest("hex");
+		const earlier = kept.get(key);
+		if (earlier !== void 0) {
+			if (earlier.digest !== digest) return {
+				...REUSED_WRITE_ID,
+				repeated: false
+			};
+			return {
+				...await earlier.answer,
+				repeated: true
+			};
+		}
+		const answer = perform();
+		const entry = {
+			digest,
+			until: now() + KEEP_MS,
+			answer,
+			bytes: 0
+		};
+		kept.set(key, entry);
+		answer.then((settled) => {
+			if (kept.get(key) !== entry) return;
+			entry.bytes = Buffer.byteLength(JSON.stringify(settled.body) ?? "", "utf8");
+			bytes += entry.bytes;
+		}, () => {});
+		return {
+			...await answer,
+			repeated: false
+		};
+	} };
+}
+//#endregion
+//#region src/routes/runtime-deletes.ts
+function isRecord$6(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* One delete, from the description it is decided over to the statement,
+* answered rather than sent: the route runs it once per sending, so a write
+* id that arrives again is answered with this answer and asks the database
+* nothing (0031).
+*
+* The policy is asked first, before any statement (0041); then the root is
+* described, and the delete is planned over that description and sent with
+* its definition. The answer names the row the statement deleted, by the
+* token its key makes as the database held it -- which under a
+* case-insensitive key may be spelled otherwise than the token sent (0028)
+* -- and holds no value of it, so a resend's kept answer holds none either.
+*/
+async function deleted(steps, request, bundle, open, record, version) {
+	const actor = steps.context(request);
+	const authorized = authorizeOperation(bundle.policy, actor, "delete");
+	if (!authorized.ok) return planRefusal(authorized.code, authorized.message);
+	const root = await open.records.describe(bundle.bindings.root);
+	if (!root.ok) return deleteFailure(root);
+	const plan = planDelete(bundle.snapshot, bundle.bindings, bundle.policy, actor, record, version, root.described);
+	if (!plan.ok) return steps.refusal(request, "delete", plan);
+	const outcome = await open.records.delete(plan.request);
+	if (!outcome.ok && outcome.code === "unknown-outcome") return steps.lost(request, "delete", record, version, outcome.message);
+	if (!outcome.ok && outcome.code === "foreign-key-violation") request.log.info({
+		form: request.params.id,
+		constraint: outcome.constraint ?? null
+	}, "a delete was refused: other records still refer to this one");
+	if (!outcome.ok) return deleteFailure(outcome);
+	const token = recordToken(plan.request.target.identity.map((column) => column.name), outcome.deleted.values);
+	const removed = token.ok ? token.token : record;
+	return {
+		status: 200,
+		body: {
+			record: removed,
+			deleted: true
+		},
+		record: removed
+	};
+}
+/**
+* `POST /v1/forms/:id/records/delete` (0050): one record, by its token and
+* the version its person read, under the form's policy. A POST with a
+* body, as every runtime write is: a token in a DELETE's URL would land in
+* every proxy's log (0044), and RFC 9110 gives a DELETE's body no meaning.
+*
+* The body is checked first and the audit trail names the record; then the
+* write id, as an update's (0031). A 200 with `{ record, deleted: true }`,
+* never a 204: a client counts a write done only when the answer says what
+* happened to it. Every refusal is a delete's (`deleteFailure`), and none
+* carries a field error. The audit names the operation `delete` and the
+* record by its keyed hash, the only trace of which record went (0023).
+*/
+function registerDeleteRoute(app, steps) {
+	app.post("/v1/forms/:id/records/delete", async (request, reply) => {
+		const body = request.body;
+		if (!isRecord$6(body) || typeof body["record"] !== "string" || typeof body["version"] !== "string") return reply.code(400).send({
+			code: "invalid-request",
+			message: "Expected { record, version }."
+		});
+		if (request.auditTrail !== void 0) request.auditTrail.record = body["record"];
+		const id = writeId(request);
+		if (id === null) return steps.answered(reply, INVALID_WRITE_ID);
+		const bundle = await steps.published(request.params.id, reply);
+		if (bundle === void 0) return reply;
+		const open = await steps.connection(bundle, reply);
+		if (open === void 0) return reply;
+		const { record, version } = body;
+		return steps.answered(reply, await steps.sendOnce(request, "delete", id, () => deleted(steps, request, bundle, open, record, version)));
+	});
+}
+//#endregion
+//#region src/routes/runtime-lists.ts
+/**
+* `POST /v1/forms/:id/records/list` (0044): one page of the records this
+* person may read, each exactly what `records/read` returns for its token,
+* in a total order, with whether more follow and no total.
+*
+* A POST, so the search never appears in a URL a proxy logs. The body is
+* checked first, as the read route checks its token; then the planner asks
+* the policy -- a list is a read, under the read filter and every through,
+* with no grant of its own -- before any statement. The page and the table
+* it was read from come from one statement, and the page is decided over
+* that description after it ran, as a read is (0041), and also refused
+* when the table no longer holds the key to a total order: refused, its
+* rows are discarded and never reach the body, and the log says `list`, as
+* the audit does. The audit names the operation `list` and no record, never
+* the search, the sort or the parent (0023).
+*
+* An adapter that answered `unknown-outcome` for a list -- which writes
+* nothing -- is a bug, and is answered 500, as for a read (0031).
+*/
+function registerListRoute(app, steps) {
+	app.post("/v1/forms/:id/records/list", async (request, reply) => {
+		const query = validateListQuery(request.body === void 0 ? {} : request.body);
+		if (!query.ok) return reply.code(400).send({
+			code: query.code,
+			message: query.message
+		});
+		const bundle = await steps.published(request.params.id, reply);
+		if (bundle === void 0) return reply;
+		const plan = planList(bundle.snapshot, bundle.bindings, bundle.policy, steps.context(request), query.query);
+		if (!plan.ok) return steps.answered(reply, planRefusal(plan.code, plan.message));
+		const open = await steps.connection(bundle, reply);
+		if (open === void 0) return reply;
+		const outcome = await open.records.list(plan.request);
+		if (!outcome.ok) return steps.answered(reply, await steps.unread(request, bundle, open, outcome, "list"));
+		const drifted = steps.undecided(request, bundle, outcome.described, "list");
+		if (drifted !== void 0) return steps.answered(reply, drifted);
+		return recordPage(bundle.bindings, plan.fields, outcome.rows, query.query.limit);
+	});
+}
+//#endregion
+//#region src/routes/abandoned.ts
+/** What the signal is aborted with: an AbortError, so a route tells it from a database's failure by identity. */
+const LEFT = "The client closed the connection before the answer.";
+/**
+* Whether the browser gave up on this request before it was answered (0061).
+*
+* Two events say so, measured on Fastify 5.12.5 with Node 24 and Node 22 on
+* 2026-10-14: the response's `close` before it finished writing, and the
+* socket's `close`. The socket is needed for a request pipelined behind
+* another, whose response has no socket of its own until the answer before
+* it is written: on Node 22 such a response emits no `close` when the
+* connection goes (on Node 24 it does), as audit.ts found for its event. Two
+* events that look as if they say so do not: the request's `close` fires as
+* soon as its body is read, and Fastify's `onRequestAbort` never runs once
+* it was. A socket already destroyed has gone already.
+*
+* `settle()` removes both listeners: a keep-alive socket carries request
+* after request, and would otherwise gather one per request.
+*/
+function abandonment(request, reply) {
+	const controller = new AbortController();
+	const response = reply.raw;
+	const socket = request.raw.socket;
+	const gone = () => {
+		if (!response.writableFinished) controller.abort(new DOMException(LEFT, "AbortError"));
+	};
+	response.once("close", gone);
+	socket.once("close", gone);
+	if (socket.destroyed) gone();
+	return {
+		signal: controller.signal,
+		settle() {
+			response.off("close", gone);
+			socket.off("close", gone);
+		}
+	};
+}
+const OPERATIONS = /* @__PURE__ */ new Set([
+	"read",
+	"create",
+	"update"
+]);
+function isRecord$5(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The lookup field a source name stands for, its config and the actor's filter for it — or a reply already sent. */
+async function lookupFor(steps, request, reply, operation) {
+	if (typeof operation !== "string" || !OPERATIONS.has(operation)) {
+		await reply.code(400).send({
+			code: "invalid-request",
+			message: "Say which operation the form is open for: read, create or update."
+		});
+		return;
+	}
+	const bundle = await steps.published(request.params.id, reply);
+	if (bundle === void 0) return void 0;
+	const binding = bundle.bindings.fields.find((entry) => entry.kind === "lookup" && entry.source === request.params.source);
+	if (binding === void 0) {
+		await reply.code(404).send({
+			code: "unknown-lookup",
+			message: `This form has no lookup called ${request.params.source}.`
+		});
+		return;
+	}
+	const filter = lookupRowFilter(bundle.policy, steps.context(request), bundle.bindings, operation, binding.field);
+	if (!filter.ok) {
+		const refusal = planRefusal(filter.code, filter.message);
+		await reply.code(refusal.status).send(refusal.body);
+		return;
+	}
+	const config = buildLookupConfig(bundle.bindings, binding.field, { snapshot: bundle.snapshot });
+	const scoped = scopeRowFilters(findObject(bundle.snapshot, config.target), filter.filter, `lookups.${binding.field}`);
+	if (!scoped.ok) {
+		const refusal = planRefusal(scoped.code, scoped.message);
+		await reply.code(refusal.status).send(refusal.body);
+		return;
+	}
+	const open = await steps.connection(bundle, reply);
+	if (open === void 0) return void 0;
+	return {
+		open,
+		config,
+		filters: scoped.filters
+	};
+}
+/** What each lookup says when it fails, or its resolve passes its deadline: `unavailable`, which invites another try. */
+const UNAVAILABLE = {
+	search: "The options could not be loaded.",
+	resolve: "The selected options could not be loaded."
+};
+/**
+* One lookup statement under the request's signal, answered (0061).
+*
+* The signal aborts when the client leaves before the answer, or when the
+* deadline passes. The deadline starts when the adapter is asked, so a wait
+* for a pooled connection, inside the driver, counts, and reading the form
+* and opening its connection do not: a deadline that passed there would be
+* answered as a statement stopped when none was sent. The adapter stops the
+* statement and rejects with the signal's reason, untranslated; anything
+* else it throws is the database's.
+*
+* A search past the deadline is `503 lookup-timeout`, not `unavailable`,
+* because 0028 says a refusal says whether trying again helps, and a
+* contains search that timed out reads the same rows again. A resolve reads
+* by key, at most a row a token, so one past the deadline waited rather
+* than read too much, and trying again helps: it is `unavailable`, and the
+* log names the deadline. A client that left is answered `499 abandoned`:
+* nobody reads it, and it exists so the audit trail's event for the request
+* says what happened (0023, 0033). The person reads the renderer's own
+* sentence, "could not be loaded"; at formancy 0.5.0 a source's message has
+* nowhere else to go.
+*/
+async function answer(steps, request, reply, kind, run, operation) {
+	const abandoned = abandonment(request, reply);
+	try {
+		const found = await lookupFor(steps, request, reply, operation);
+		if (found === void 0) return reply;
+		const deadline = lookupDeadline(steps.lookupDeadlineMs, abandoned.signal);
+		const { signal } = deadline;
+		try {
+			return await run(found.open, found.config, found.filters, signal);
+		} catch (error) {
+			if (signal.aborted && error === signal.reason) return stopped(steps, request, reply, kind, signal.reason === abandoned.signal.reason);
+			request.log.warn({ error: error.message }, kind === "search" ? "a lookup search failed" : "a lookup resolve failed");
+			return reply.code(503).send({
+				code: "unavailable",
+				message: UNAVAILABLE[kind]
+			});
+		} finally {
+			deadline.clear();
+		}
+	} finally {
+		abandoned.settle();
+	}
+}
+/** A lookup the adapter stopped at the signal: its client left, or its deadline passed. */
+function stopped(steps, request, reply, kind, left) {
+	if (left) {
+		request.log.info({ lookup: kind }, "a lookup was abandoned by its client; the database was told to stop it");
+		return reply.code(499).send({
+			code: "abandoned",
+			message: "The client closed the connection before the answer; the database was told to stop the statement."
+		});
+	}
+	const ms = steps.lookupDeadlineMs;
+	request.log.warn({
+		lookup: kind,
+		deadlineMs: ms
+	}, "a lookup passed its deadline; the database was told to stop it");
+	if (kind === "resolve") return reply.code(503).send({
+		code: "unavailable",
+		message: UNAVAILABLE.resolve
+	});
+	return reply.code(503).send({
+		code: "lookup-timeout",
+		message: `The search took longer than this server allows (${String(ms)} ms), and the database was told to stop it. The same search will take as long again.`
+	});
+}
+/**
+* `POST /v1/forms/:id/lookups/:source/query` and `…/resolve`: one page of a
+* lookup's options, or the labels of tokens a form holds, for the operation
+* the form is open for and under the actor's filter for that lookup (0012).
+* Each runs one statement that stops when its request is abandoned or its
+* deadline passes (0061); one that completes is answered exactly as before.
+*/
+function registerLookupRoutes(app, steps) {
+	app.post("/v1/forms/:id/lookups/:source/query", async (request, reply) => {
+		const body = isRecord$5(request.body) ? request.body : {};
+		return answer(steps, request, reply, "search", async (open, config, filters, signal) => {
+			const query = validateLookupQuery(config, {
+				search: body["search"] ?? "",
+				offset: body["offset"] ?? 0,
+				limit: body["limit"] ?? config.maxPageSize
+			});
+			if (!query.ok) return reply.code(400).send({
+				code: query.code,
+				message: query.message
+			});
+			return open.lookups.search(config, query.query, filters, signal);
+		}, body["operation"]);
+	});
+	app.post("/v1/forms/:id/lookups/:source/resolve", async (request, reply) => {
+		const body = isRecord$5(request.body) ? request.body : {};
+		const tokens = body["tokens"];
+		if (!Array.isArray(tokens) || tokens.length > 100 || !tokens.every((token) => typeof token === "string")) return reply.code(400).send({
+			code: "invalid-request",
+			message: `Expected { operation, tokens } with at most ${String(100)} tokens.`
+		});
+		return answer(steps, request, reply, "resolve", async (open, config, filters, signal) => ({ rows: await open.lookups.resolve(config, tokens, filters, signal) }), body["operation"]);
+	});
+}
+//#endregion
+//#region src/routes/runtime-menu.ts
+/** What the menu answers when the store cannot list its forms: nothing it was told, no path. */
+const STORE_UNAVAILABLE = {
+	code: "store-unavailable",
+	message: "The forms cannot be listed now."
+};
+/**
+* The newest version of `id` as this person's menu reads it, or `undefined`
+* when it is not served -- validated as every read is (0019), bound to a
+* connection the allowlist has, and read alone (`menuForm`). Whatever stops
+* one form -- a version that no longer validates, does not parse or cannot
+* be read, a connection the allowlist does not have, bindings a hand edit
+* left in a shape the check passes and the menu cannot read -- leaves that
+* form out, and the log says which and why; never a 500, which would let one
+* damaged file hide every form from everybody, and answer with what the
+* error said.
+*/
+async function entry(store, allowed, id, context, log) {
+	try {
+		const loaded = await loadPublished(store, id, log);
+		if (!loaded.ok) return void 0;
+		const { bundle } = loaded;
+		if (!allowed.includes(bundle.connection)) {
+			log.error({
+				form: id,
+				connection: bundle.connection
+			}, "a published form names a connection the allowlist does not have, and is not served");
+			return;
+		}
+		return menuForm({
+			id,
+			title: bundle.form.title,
+			connection: bundle.connection,
+			snapshot: bundle.snapshot,
+			bindings: bundle.bindings,
+			policy: bundle.policy
+		}, context);
+	} catch (error) {
+		log.error({
+			form: id,
+			error: error.message
+		}, "a published form cannot be read, and is not served");
+		return;
+	}
+}
+/**
+* `GET /v1/forms` (0045): the published forms this person may read, in
+* codepoint order of their ids, each with its title, the operations the
+* policy grants them of what it offers as published, and the children a
+* page may show under one of its records -- and nothing about any other
+* form, so the answer is the same to the byte whatever else is published.
+*
+* Every request reads and validates every published form's newest version,
+* and asks the policy of each (0019, 0022): nothing is cached. It asks no
+* database. Opening a form asks what the database as it is now allows
+* (`GET /v1/forms/:id`, 0041); the menu, over every form, would otherwise
+* be a statement per form, and one database out of reach would hide forms
+* on every other. A store that cannot list its forms is a 500 that says
+* only that. The audit names the operation `form-list`, and no form.
+*/
+function registerMenuRoute(app, steps) {
+	app.get("/v1/forms", async (request, reply) => {
+		let ids;
+		try {
+			ids = await steps.store.list();
+		} catch (error) {
+			request.log.error({ error: error.message }, "the configuration store cannot list its forms");
+			return reply.code(500).send(STORE_UNAVAILABLE);
+		}
+		const context = steps.context(request);
+		const allowed = steps.connections();
+		const forms = [];
+		for (const id of ids) {
+			const read = await entry(steps.store, allowed, id, context, request.log);
+			if (read !== void 0) forms.push(read);
+		}
+		return formMenu(forms);
+	});
+}
+//#endregion
+//#region src/routes/runtime.ts
+/**
+* The audit name of each runtime route, keyed `METHOD url`; a route without
+* one stops the server, or never answers (0033). `admin-audit.test.ts` sends
+* every route the router holds and fails on an entry no route has. Exported
+* from the package: the host page's suite reads the runtime plane's routes
+* here rather than keeping a list of its own (0047).
+*/
+const ROUTE_OPERATIONS = {
+	"GET /v1/forms": "form-list",
+	"GET /v1/forms/:id": "form",
+	"POST /v1/forms/:id/records/read": "read",
+	"POST /v1/forms/:id/records/list": "list",
+	"POST /v1/forms/:id/records/create": "create",
+	"POST /v1/forms/:id/records/update": "update",
+	"POST /v1/forms/:id/records/delete": "delete",
+	"POST /v1/forms/:id/lookups/:source/query": "lookup-query",
+	"POST /v1/forms/:id/lookups/:source/resolve": "lookup-resolve"
+};
+/** A read that found no record inside the filters, as the port's failure, for the answers that need one. */
+const NOT_FOUND = {
+	ok: false,
+	code: "not-found",
+	message: "No such record exists inside the filters."
+};
+function isRecord$4(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function contextOf(identity) {
+	return {
+		actor: {
+			id: identity.actor.id,
+			roles: [...identity.actor.roles]
+		},
+		attributes: { ...identity.attributes }
+	};
+}
+/**
+* The answers a renderer submits, minus the fields it echoed back that this
+* actor may not write.
+*
+* A formancy renderer submits every field, disabled ones included, and the
+* policy calls a submitted field the actor may not write over-posting (0011).
+* Whether the actor may write a field is the policy's decision, so it is asked
+* — one key at a time, through `checkSubmittedFields` — rather than restated
+* here: a defaulted column the generator left writable can still be one the
+* policy grants nobody. The echo is removed on create when it is empty, and on
+* update when it equals what the record holds. Anything else in such a field
+* still reaches the planner and is refused: a changed value there is tampering
+* or a stale client, and either way is not saved (0022). An unedited instant
+* or time the actor may write is the planner's to remove, against the same
+* read (0040).
+*/
+function withoutEchoes(bundle, actor, operation, answers, current) {
+	if (!isRecord$4(answers)) return answers;
+	const kept = { ...answers };
+	for (const binding of bundle.bindings.fields) {
+		if (!Object.hasOwn(kept, binding.field)) continue;
+		if (checkSubmittedFields(bundle.policy, actor, bundle.bindings, operation, [binding.field]).ok) continue;
+		const value = kept[binding.field];
+		if (current === void 0 ? value === null || value === void 0 || value === "" : Object.hasOwn(current, binding.field) && canonicalize(value ?? null) === canonicalize(current[binding.field] ?? null)) delete kept[binding.field];
+	}
+	return kept;
+}
+/**
+* The runtime plane: a published form, its records and its lookups, for the
+* host application's people (plan section 13). Every route needs a verified
+* host token; every decision about what that person may do is the published
+* policy's, through the planner (0018), and every database answer is the
+* adapter's, through the ports (0015).
+*/
+async function runtimeRoutes(app, options) {
+	const { registry, store } = options;
+	const writes = createWriteOnce();
+	app.addHook("onRequest", async (request) => {
+		request.auditTrail = { formVersion: null };
+	});
+	const key = options.audit?.key;
+	auditRequests(app, {
+		names: ROUTE_OPERATIONS,
+		sink: options.audit?.sink,
+		now: options.audit?.now,
+		describe: (request, base) => {
+			const trail = request.auditTrail ?? { formVersion: null };
+			return {
+				at: base.at,
+				plane: "runtime",
+				actor: base.actor,
+				operation: base.operation,
+				form: auditedForm(request.params.id),
+				formVersion: trail.formVersion,
+				status: base.status,
+				outcome: trail.repeated === true ? "repeated" : base.outcome,
+				record: recordReference(key, trail.record)
+			};
+		}
+	});
+	app.addHook("preHandler", async (request, reply) => {
+		const identity = await options.authenticate(request);
+		if (identity === void 0) return reply.code(401).header("www-authenticate", "Bearer").send({
+			code: "unauthenticated",
+			message: "A valid host token is required."
+		});
+		request.identity = identity;
+	});
+	const context = (request) => {
+		if (request.identity === void 0) throw new Error("the preHandler sets the identity before any route runs");
+		return contextOf(request.identity);
+	};
+	async function published(id, reply) {
+		const loaded = await loadPublished(store, id, reply.log);
+		if (loaded.ok) {
+			if (reply.request.auditTrail !== void 0) reply.request.auditTrail.formVersion = loaded.version;
+			return loaded.bundle;
+		}
+		await reply.code(loaded.status).send({
+			code: loaded.code,
+			message: loaded.message
+		});
+	}
+	async function connection(bundle, reply) {
+		try {
+			const open = await registry.open(bundle.connection);
+			if (open !== void 0) return open;
+			reply.log.error({ connection: bundle.connection }, "a published form names a connection the allowlist does not have");
+			await reply.code(500).send({
+				code: "unknown-connection",
+				message: "This form is published against a connection this server does not have."
+			});
+		} catch (error) {
+			reply.log.warn({
+				connection: bundle.connection,
+				error: error.message
+			}, "connection could not be opened");
+			await reply.code(503).send({
+				code: "unavailable",
+				message: "The database cannot be reached. Nothing was saved."
+			});
+		}
+	}
+	/**
+	* A write that was sent and whose answer was lost (0031): said once in the
+	* log, with the adapter's sentence, which names no value; answered with what
+	* was addressed; and never sent again -- each route asks the adapter once.
+	*/
+	function lost(request, operation, record, version, failure) {
+		request.log.warn({
+			form: request.params.id,
+			operation,
+			failure
+		}, "a write was sent and its answer lost; it is not retried");
+		return {
+			...unknownOutcome(operation, record, version),
+			record: record ?? void 0
+		};
+	}
+	/**
+	* Sends a write to the database once per sending (write-once.ts): `perform`
+	* runs the first time its write id arrives, and a later arrival is answered
+	* with that answer. A request without an id is performed every time.
+	*/
+	async function sendOnce(request, operation, id, perform) {
+		const actor = request.identity?.actor.id;
+		if (id === void 0 || actor === void 0) return perform();
+		return writes.once({
+			actor,
+			form: request.params.id,
+			operation,
+			id,
+			body: request.body
+		}, perform);
+	}
+	/**
+	* A drift refusal of the database as it is now (0041), said once in the
+	* log with what blocks, by kind and the fields it affects -- never a value,
+	* and never the change's message, which names columns and types the person
+	* is not told -- and answered with the planner's sentence.
+	*/
+	function driftAnswer(request, operation, changes, message) {
+		request.log.warn({
+			form: request.params.id,
+			version: request.auditTrail?.formVersion ?? null,
+			operation,
+			changes: (changes ?? []).map((change) => ({
+				kind: change.kind,
+				affects: change.affects
+			}))
+		}, "refused: the database no longer fits this form as published");
+		return planRefusal("drift", message);
+	}
+	/** A planner's refusal as the answer, its drift said in the log first, under the operation the audit names. */
+	function refusal(request, operation, plan) {
+		return plan.code === "drift" && plan.drift !== void 0 ? driftAnswer(request, operation, plan.drift, plan.message) : planRefusal(plan.code, plan.message);
+	}
+	/** The root as the catalog describes it now, or the answer when it cannot be described: 503 when the database cannot say, 409 when the table is not one it describes. */
+	async function describedRoot(bundle, open) {
+		const found = await open.records.describe(bundle.bindings.root);
+		return found.ok ? {
+			ok: true,
+			described: found.described
+		} : {
+			ok: false,
+			answer: recordFailure(bundle.bindings, found)
+		};
+	}
+	/** A write's answer, sent, with what the audit names: its record, and whether it was a repeat. */
+	async function answered(reply, answer) {
+		const trail = reply.request.auditTrail;
+		if (trail !== void 0 && answer.record !== void 0) trail.record = answer.record;
+		if (trail !== void 0 && answer.repeated === true) trail.repeated = true;
+		return reply.code(answer.status).send(answer.body);
+	}
+	/**
+	* Runs every membership check: undefined when every selection is a member,
+	* otherwise the refusal to answer. Answered rather than sent, so an
+	* update's checks run inside the sending they belong to (0031).
+	*
+	* Each check has a lookup deadline of its own, counted from when the
+	* adapter is asked for it, and nothing else (0061): a write goes on after
+	* its client leaves (0031), so no abandonment stops it. A check
+	* past its deadline keeps the answer every failed check has, nothing
+	* saved, and the log says the deadline passed.
+	*/
+	async function memberships(open, checks, log) {
+		const errors = [];
+		for (const check of checks) {
+			const deadline = lookupDeadline(options.lookupDeadlineMs);
+			try {
+				if ((await open.lookups.rejects(check.config, check.tokens, check.filters, deadline.signal)).length > 0) errors.push(rejectedSelection(check.field));
+			} catch (error) {
+				if (deadline.signal.aborted && error === deadline.signal.reason) log.warn({
+					field: check.field,
+					deadlineMs: options.lookupDeadlineMs
+				}, "a lookup could not vouch for a selection: it passed its deadline, and the database was told to stop it");
+				else log.warn({
+					field: check.field,
+					error: error.message
+				}, "a lookup could not vouch for a selection");
+				return {
+					status: 503,
+					body: {
+						code: "unavailable",
+						message: "A selection could not be checked. Nothing was saved."
+					}
+				};
+			} finally {
+				deadline.clear();
+			}
+		}
+		return errors.length === 0 ? void 0 : {
+			status: 422,
+			body: {
+				code: "invalid-values",
+				message: "A selection is not one of the options.",
+				fieldErrors: errors
+			}
+		};
+	}
+	/**
+	* One create, from the description it is decided over to the insert,
+	* answered rather than sent: the create route runs it once per sending, so
+	* a write id that arrives again is answered with this answer and asks the
+	* database nothing (0031). The mirror of `updated`.
+	*
+	* The policy is asked before any statement, so an actor it refuses reaches
+	* none (0041). Then the root is described, the one statement before the
+	* planner: a create the description stops is refused there, with no
+	* membership check and no insert sent, and the insert carries the
+	* definition it was decided over.
+	*/
+	async function created(request, bundle, open, answers) {
+		const actor = context(request);
+		const authorized = authorizeOperation(bundle.policy, actor, "create");
+		if (!authorized.ok) return planRefusal(authorized.code, authorized.message);
+		const root = await describedRoot(bundle, open);
+		if (!root.ok) return root.answer;
+		const plan = planCreate(bundle.snapshot, bundle.bindings, bundle.policy, actor, withoutEchoes(bundle, actor, "create", answers), root.described);
+		if (!plan.ok) {
+			if (plan.code === "invalid-values") return {
+				status: 422,
+				body: {
+					code: plan.code,
+					message: plan.message,
+					fieldErrors: plan.fieldErrors
+				}
+			};
+			return refusal(request, "create", plan);
+		}
+		const refused = await memberships(open, plan.memberships, request.log);
+		if (refused !== void 0) return refused;
+		const outcome = await open.records.insert(plan.request);
+		if (!outcome.ok && outcome.code === "unknown-outcome") return lost(request, "create", intendedRecord(plan.request), null, outcome.message);
+		if (!outcome.ok) return recordFailure(bundle.bindings, outcome);
+		const done = toFormAnswers(bundle.bindings, plan.fields, outcome);
+		return {
+			status: 201,
+			body: done,
+			record: done.record ?? void 0
+		};
+	}
+	/**
+	* One update, from the read that tells an echo from a change to the write,
+	* answered rather than sent: the update route runs it once per sending, so
+	* a write id that arrives again is answered with this answer and asks the
+	* database nothing, its read included (0031).
+	*
+	* The policy is asked first, before any statement (0041). The record as it
+	* stands is read next, and the read carries the table's description, which
+	* the update is decided over. Against the record 0022 removes an unchanged
+	* echo of a field the actor may not write, and the planner one of an
+	* instant or a time they may (0040). An actor who may update and not read
+	* gets no echo removed, and the planner needs no read for them: the table
+	* is described for them in a statement of its own, as it is after a read
+	* that failed. When the planner cannot tell an echo from a change because
+	* the read failed, whatever the failure, that failure is the answer: sent
+	* anyway, a read that failed and a write that did not would store the cut
+	* value.
+	*/
+	async function updated(request, bundle, open, record, version, answers) {
+		const actor = context(request);
+		const authorized = authorizeOperation(bundle.policy, actor, "update");
+		if (!authorized.ok) return planRefusal(authorized.code, authorized.message);
+		let current;
+		let unread;
+		let described;
+		const reading = planRead(bundle.snapshot, bundle.bindings, bundle.policy, actor, record);
+		if (reading.ok) {
+			const stored = await open.records.read(reading.request);
+			if (!stored.ok) unread = stored;
+			else {
+				described = stored.described;
+				if (stored.record === null) unread = NOT_FOUND;
+				else current = toFormAnswers(bundle.bindings, reading.fields, {
+					ok: true,
+					...stored.record
+				});
+			}
+		}
+		if (described === void 0) {
+			const root = await describedRoot(bundle, open);
+			if (!root.ok) return root.answer;
+			described = root.described;
+		}
+		const plan = planUpdate(bundle.snapshot, bundle.bindings, bundle.policy, actor, record, version, withoutEchoes(bundle, actor, "update", answers, current?.answers), current, described);
+		if (!plan.ok) {
+			if (plan.code === "invalid-values") return {
+				status: 422,
+				body: {
+					code: plan.code,
+					message: plan.message,
+					fieldErrors: plan.fieldErrors
+				}
+			};
+			if (plan.code === "record-not-read" && unread !== void 0) return recordFailure(bundle.bindings, unread);
+			return refusal(request, "update", plan);
+		}
+		const refused = await memberships(open, plan.memberships, request.log);
+		if (refused !== void 0) return refused;
+		const outcome = await open.records.update(plan.request);
+		if (!outcome.ok && outcome.code === "unknown-outcome") return lost(request, "update", record, version, outcome.message);
+		if (!outcome.ok) return recordFailure(bundle.bindings, outcome);
+		return {
+			status: 200,
+			body: toFormAnswers(bundle.bindings, plan.fields, outcome)
+		};
+	}
+	/**
+	* A read the database refused, a record's or a page's: one that names a
+	* column that is gone -- `schema-changed` -- returned no description, so
+	* the table is described once more and the read decided over that, and a
+	* form drift stops is answered as drift whichever statement found it out
+	* (0041). Any other failure is the database's. A page is decided as a
+	* list (0044), and said in the log as one.
+	*/
+	async function unread(request, bundle, open, failure, operation) {
+		const root = failure.code === "schema-changed" ? await describedRoot(bundle, open) : void 0;
+		const refused = root?.ok === true ? driftRefusal(bundle.snapshot, bundle.bindings, bundle.policy, root.described, operation) : void 0;
+		return refused === void 0 ? recordFailure(bundle.bindings, failure) : refusal(request, operation, refused);
+	}
+	/**
+	* A read decided over the description its own statement carried (0041):
+	* the refusal when drift stops reading this form -- or, for a page, when
+	* the table no longer holds its key to a total order (0044) -- or
+	* `undefined`.
+	*/
+	function undecided(request, bundle, described, operation) {
+		const refused = driftRefusal(bundle.snapshot, bundle.bindings, bundle.policy, described, operation);
+		return refused === void 0 ? void 0 : refusal(request, operation, refused);
+	}
+	registerMenuRoute(app, {
+		store,
+		connections: () => registry.ids(),
+		context
+	});
+	/**
+	* The form, what this person may do with it now, and which fields they may
+	* see. The policy first, before any statement; then the root is described,
+	* and only what the database as it is now still allows is offered (0041):
+	* a form whose records it can no longer show faithfully is refused, and so
+	* is one that leaves this person nothing. Opening a form therefore asks the
+	* database, and one that cannot be reached is 503.
+	*/
+	app.get("/v1/forms/:id", async (request, reply) => {
+		const bundle = await published(request.params.id, reply);
+		if (bundle === void 0) return reply;
+		const actor = context(request);
+		const allowed = grantedOperations(bundle.bindings, bundle.policy, actor);
+		if (allowed.length === 0) return reply.code(403).send({
+			code: "operation-denied",
+			message: "This form is not available to you."
+		});
+		const open = await connection(bundle, reply);
+		if (open === void 0) return reply;
+		const root = await describedRoot(bundle, open);
+		if (!root.ok) return answered(reply, root.answer);
+		const decided = runtimeOperations(bundle.snapshot, bundle.bindings, bundle.policy, root.described);
+		if (!decided.ok) return answered(reply, planRefusal(decided.code, decided.message));
+		const { verdict } = decided;
+		if (!verdict.readable) return answered(reply, driftAnswer(request, "form", decided.drift, READ_REFUSED));
+		const operations = allowed.filter((operation) => operation === "read" || verdict.writable[operation]);
+		if (operations.length === 0) return answered(reply, driftAnswer(request, "form", decided.drift, NOTHING_LEFT));
+		const readable = readableFields(bundle.policy, actor, bundle.bindings);
+		const listed = listable(bundle.snapshot, bundle.bindings, bundle.policy, actor);
+		const list = listed.ok && driftRefusal(bundle.snapshot, bundle.bindings, bundle.policy, root.described, "list") === void 0 ? listColumns(bundle.bindings, listed.fields) : null;
+		const deleting = operations.includes("delete") ? deleteEffects(bundle.snapshot, bundle.bindings.root, bundle.policy) : null;
+		return {
+			form: bundle.form,
+			operations,
+			readable: readable.ok ? readable.fields : [],
+			list,
+			deleting
+		};
+	});
+	/**
+	* One record. The policy and the token are decided before any statement;
+	* the read statement returns the table's description beside the record,
+	* and the read is decided over it after it ran (0041): refused, its values
+	* are discarded and never reach the body. A read the database refused as
+	* `schema-changed` -- it names a column that is gone -- returned no
+	* description, so the table is described once more and the read decided
+	* over that: a form drift stops is answered as drift, whichever statement
+	* found it out.
+	*/
+	app.post("/v1/forms/:id/records/read", async (request, reply) => {
+		const body = request.body;
+		if (!isRecord$4(body) || typeof body["record"] !== "string") return reply.code(400).send({
+			code: "invalid-request",
+			message: "Expected { record }."
+		});
+		if (request.auditTrail !== void 0) request.auditTrail.record = body["record"];
+		const bundle = await published(request.params.id, reply);
+		if (bundle === void 0) return reply;
+		const plan = planRead(bundle.snapshot, bundle.bindings, bundle.policy, context(request), body["record"]);
+		if (!plan.ok) return answered(reply, planRefusal(plan.code, plan.message));
+		const open = await connection(bundle, reply);
+		if (open === void 0) return reply;
+		const outcome = await open.records.read(plan.request);
+		if (!outcome.ok) return answered(reply, await unread(request, bundle, open, outcome, "read"));
+		const drifted = undecided(request, bundle, outcome.described, "read");
+		if (drifted !== void 0) return answered(reply, drifted);
+		if (outcome.record === null) return answered(reply, recordFailure(bundle.bindings, NOT_FOUND));
+		return toFormAnswers(bundle.bindings, plan.fields, {
+			ok: true,
+			...outcome.record
+		});
+	});
+	registerListRoute(app, {
+		published,
+		connection,
+		context,
+		unread,
+		undecided,
+		answered
+	});
+	app.post("/v1/forms/:id/records/create", async (request, reply) => {
+		const body = request.body;
+		if (!isRecord$4(body) || !isRecord$4(body["answers"])) return reply.code(400).send({
+			code: "invalid-request",
+			message: "Expected { answers }."
+		});
+		const id = writeId(request);
+		if (id === null) return answered(reply, INVALID_WRITE_ID);
+		const bundle = await published(request.params.id, reply);
+		if (bundle === void 0) return reply;
+		const open = await connection(bundle, reply);
+		if (open === void 0) return reply;
+		const answers = body["answers"];
+		return answered(reply, await sendOnce(request, "create", id, () => created(request, bundle, open, answers)));
+	});
+	app.post("/v1/forms/:id/records/update", async (request, reply) => {
+		const body = request.body;
+		if (!isRecord$4(body) || typeof body["record"] !== "string" || typeof body["version"] !== "string" || !isRecord$4(body["answers"])) return reply.code(400).send({
+			code: "invalid-request",
+			message: "Expected { record, version, answers }."
+		});
+		if (request.auditTrail !== void 0) request.auditTrail.record = body["record"];
+		const id = writeId(request);
+		if (id === null) return answered(reply, INVALID_WRITE_ID);
+		const bundle = await published(request.params.id, reply);
+		if (bundle === void 0) return reply;
+		const open = await connection(bundle, reply);
+		if (open === void 0) return reply;
+		const { record, version, answers } = body;
+		return answered(reply, await sendOnce(request, "update", id, () => updated(request, bundle, open, record, version, answers)));
+	});
+	registerDeleteRoute(app, {
+		published,
+		connection,
+		context,
+		sendOnce,
+		lost,
+		refusal,
+		answered
+	});
+	registerLookupRoutes(app, {
+		published,
+		connection,
+		context,
+		lookupDeadlineMs: options.lookupDeadlineMs
+	});
+}
+/** The answer to a refused preflight, and to a token-bearing request refused across origins: a code and a sentence, and nothing of the request. */
+const CROSS_ORIGIN_REFUSED = {
+	code: "cross-origin-refused",
+	message: "Across origins this server answers only the runtime plane’s routes, from an origin its operator lists, and this request is not one of those, so it was refused before any work."
+};
+const SETTING = "FORMANCY_DATA_CORS_ORIGINS";
+/** Plain HTTP is accepted on these hosts only, where a developer's page is: never across a network (0060). */
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/** One label of a host name as a browser's URL parser leaves it: lower case, digits, `-` and `_`. Anchored, one class, so linear (CodeQL). */
+const LABEL = /^[a-z0-9_-]+$/;
+/**
+* Why `entry` is not an origin this server lists, as the end of a sentence
+* that never repeats it, or `undefined`. An origin is accepted only when
+* the URL parser gives it back unchanged as its origin -- so lower case, no
+* path, no trailing slash, no default port, no user information, a punycode
+* name -- with a host that is a DNS name or an IP address, over `https:`, or
+* `http:` on loopback.
+*/
+function originProblem(entry) {
+	if (typeof entry !== "string") return "is not a string";
+	if (entry === "*" || entry === "null") return "is a wildcard or the opaque origin, which is never listed: each origin is named exactly";
+	let url;
+	try {
+		url = new URL(entry);
+	} catch {
+		return "is not an origin: a scheme, a host and, where it is not the default, a port";
+	}
+	if (url.protocol !== "https:" && url.protocol !== "http:") return "is not an https: origin";
+	if (url.origin !== entry) return "is not written as a browser sends Origin: lower case, a punycode name, no path or trailing slash, no default port and no user information";
+	const host = url.hostname;
+	if (!(host.startsWith("[") || host.split(".").every((label) => LABEL.test(label)))) return "names a pattern or a host that is no DNS name or IP address";
+	if (url.protocol === "http:" && !LOOPBACK.has(host)) return "is plain HTTP on a host other than localhost, 127.0.0.1 or [::1]: anything else is listed as https:";
+}
+/**
+* `FORMANCY_DATA_CORS_ORIGINS` as written: origins separated by commas,
+* space around each ignored. Unset, empty, or nothing but commas and space
+* is no origin -- Compose passes `""` for a variable it was not given. Any
+* entry that is not an origin refuses the whole setting, named by its place
+* and never quoted; and a list needs the runtime plane, whose routes are all
+* it grants.
+*/
+function corsOriginsSetting(text, plane) {
+	const entries = (text ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
+	for (const [index, entry] of entries.entries()) {
+		const problem = originProblem(entry);
+		if (problem !== void 0) return {
+			ok: false,
+			problem: `${SETTING}: entry ${String(index + 1)} ${problem}.`
+		};
+	}
+	if (entries.length > 0 && !plane.runtime) return {
+		ok: false,
+		problem: `${SETTING} lists origins, and the runtime plane is off: set FORMANCY_DATA_STORE_DIR and FORMANCY_DATA_CONNECTIONS, or leave it empty.`
+	};
+	return {
+		ok: true,
+		origins: [...new Set(entries)]
+	};
+}
+/** What is wrong with `runtime.origins` as an embedder passed it, by place, or `undefined`: the setting's rule, with no trimming. */
+function originsProblem(origins) {
+	if (!Array.isArray(origins)) return "runtime.origins is not a list of origins.";
+	for (const [index, entry] of origins.entries()) {
+		const problem = originProblem(entry);
+		if (problem !== void 0) return `runtime.origins[${String(index)}] ${problem}.`;
+	}
+}
+/** `existing` Vary with `name` added once, by its token case-insensitively; `*` stays `*`. */
+function varyWith(existing, name) {
+	const tokens = [existing ?? []].flat().flatMap((value) => String(value).split(",")).map((token) => token.trim()).filter((token) => token !== "");
+	if (tokens.includes("*")) return "*";
+	return tokens.some((token) => token.toLowerCase() === name.toLowerCase()) ? tokens.join(", ") : [...tokens, name].join(", ");
+}
+/**
+* The origin as a log line may name it: only when the URL parser gives it
+* back unchanged and it is no longer than an origin can be (`https://`, a
+* 253-character name and a port). Such an origin holds no user information,
+* path or query, so nothing a caller pasted into a URL rides into the log
+* with it, and it is what the operator would add to the list (0060).
+* Anything else is logged with no origin at all.
+*/
+function loggable(origin) {
+	if (typeof origin !== "string" || origin.length > 267) return {};
+	try {
+		return new URL(origin).origin === origin ? { origin } : {};
+	} catch {
+		return {};
+	}
+}
+/** `METHOD url` as the runtime table keys it: HEAD is HEAD, and the table names none, so it is never offered across origins. */
+const routeKey = (request) => `${request.method} ${request.routeOptions.url ?? ""}`;
+const OFFERED = new Set(Object.keys(ROUTE_OPERATIONS));
+/** A segment of a pattern: a plain `:name`, static text, or something the overlap rule does not model. */
+function segmentKind(segment) {
+	if (/^:[A-Za-z0-9_]+$/.test(segment)) return "parameter";
+	return segment.includes(":") || segment.includes("*") ? "unmodelled" : "static";
+}
+/** Whether a path exists that both patterns, each of plain segments, match: the same number of segments, each equal static text or a parameter on either side. */
+function overlap(a, b) {
+	return a.length === b.length && a.every((segment, index) => segment === b[index] || segmentKind(segment) === "parameter" || segmentKind(String(b[index])) === "parameter");
+}
+/**
+* The methods a browser sends on a URL's grant without asking again, whatever
+* method the grant named: the Fetch standard asks again only for another
+* method or for a header the grant does not name, and a grant names its
+* headers by URL. Measured in Chromium and WebKit, not Firefox (0060).
+*/
+const SAFELISTED = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"POST"
+]);
+/**
+* What stops a server with origins at ready, as sentences: a route outside
+* the runtime table whose pattern could match a path a runtime pattern
+* matches -- any runtime pattern for a GET, HEAD or POST, which ride the
+* grant of whatever method was granted at that URL, and one of the same
+* method otherwise. Those are the requests a grant for the runtime route
+* would let a browser send to the other, and the case Fastify's parameters
+* cannot tell apart. OPTIONS routes are this file's, and a HEAD at a
+* runtime GET's own pattern is the one Fastify adds for it: no other can
+* be registered there. Any route whose pattern holds a regex parameter, a
+* wildcard or two parameters in one segment, or that has a constraint,
+* stops it too: the rule does not model those, and refuses rather than
+* guesses.
+*/
+function routeProblems(routes) {
+	const problems = [];
+	const runtime = [...OFFERED].map((key) => ({
+		key,
+		method: key.slice(0, key.indexOf(" ")),
+		segments: key.slice(key.indexOf(" ") + 1).split("/")
+	}));
+	for (const route of routes) {
+		const segments = route.url.split("/");
+		if (typeof route.constraints === "object" && route.constraints !== null && Object.keys(route.constraints).length > 0 || segments.some((segment) => segmentKind(segment) === "unmodelled")) {
+			problems.push(`${route.method} ${route.url} has a pattern or a constraint the check that keeps the planes apart across origins does not model`);
+			continue;
+		}
+		const key = `${route.method} ${route.url}`;
+		if (route.method === "OPTIONS" || OFFERED.has(key) || route.method === "HEAD" && OFFERED.has(`GET ${route.url}`)) continue;
+		for (const pattern of runtime) if ((SAFELISTED.has(route.method) || pattern.method === route.method) && overlap(segments, pattern.segments)) problems.push(`${key} could answer a path the runtime route ${pattern.key} answers`);
+	}
+	return problems;
+}
+/** Whether two routers' parameters are the same names with the same values, in any order. */
+function sameParameters(a, b) {
+	const names = Object.keys(a);
+	return names.length === Object.keys(b).length && names.every((name) => Object.hasOwn(b, name) && a[name] === b[name]);
+}
+/**
+* Called by createDataServer on every server, after the path-not-plain
+* refusal and before any route, so its hooks cover every route registered
+* after it.
+*/
+function crossOrigin(app, options) {
+	const listed = new Set(options.origins);
+	app.addHook("preHandler", async (request, reply) => {
+		if (request.routeOptions.url === void 0 || request.headers.authorization === void 0) return void 0;
+		const site = request.headers["sec-fetch-site"];
+		if (site !== "cross-site" && site !== "same-site") return void 0;
+		const origin = request.headers.origin;
+		const fromListed = typeof origin === "string" && listed.has(origin);
+		if (fromListed && OFFERED.has(routeKey(request))) return void 0;
+		request.log.info({
+			reason: fromListed ? "route not offered across origins" : "origin not listed",
+			...loggable(origin)
+		}, "cross-origin request refused");
+		return reply.code(403).send(CROSS_ORIGIN_REFUSED);
+	});
+	if (listed.size === 0) return;
+	const routes = [];
+	app.addHook("onRoute", (route) => {
+		for (const method of [route.method].flat()) routes.push({
+			method,
+			url: route.url,
+			constraints: route.constraints
+		});
+	});
+	app.addHook("onReady", async () => {
+		const problems = routeProblems(routes);
+		if (problems.length > 0) throw new Error(`With origins listed, the server does not start beside a route another plane could answer at a runtime path (0060): ${problems.join("; ")}.`);
+	});
+	app.addHook("onSend", async (request, reply, payload) => {
+		if (!OFFERED.has(routeKey(request))) return payload;
+		reply.header("vary", varyWith(reply.getHeader("vary"), "Origin"));
+		const origin = request.headers.origin;
+		if (typeof origin === "string" && listed.has(origin)) reply.header("access-control-allow-origin", origin);
+		return payload;
+	});
+	/** A preflight at `pattern`, decided: the origin, the method the runtime table names here and the router takes to the same parameters, and only the headers the server reads. */
+	const decide = (request, pattern) => {
+		const origin = request.headers.origin;
+		const method = request.headers["access-control-request-method"];
+		if (typeof origin !== "string" || typeof method !== "string") return {
+			granted: false,
+			reason: "not a preflight"
+		};
+		if (!listed.has(origin)) return {
+			granted: false,
+			reason: "origin not listed"
+		};
+		if (!OFFERED.has(`${method} ${pattern}`)) return {
+			granted: false,
+			reason: "method not offered on this route"
+		};
+		const reached = app.findRoute({
+			method,
+			url: request.url
+		});
+		if (reached === null || !sameParameters(reached.params, request.params)) return {
+			granted: false,
+			reason: "method reaches another route"
+		};
+		if (!String(request.headers["access-control-request-headers"] ?? "").split(",").map((name) => name.trim().toLowerCase()).filter((name) => name !== "").every((name) => CROSS_ORIGIN_REQUEST_HEADERS.includes(name))) return {
+			granted: false,
+			reason: "header not allowed"
+		};
+		return {
+			granted: true,
+			origin,
+			method
+		};
+	};
+	const vary = "Origin, Access-Control-Request-Method, Access-Control-Request-Headers";
+	for (const pattern of new Set([...OFFERED].map((key) => key.slice(key.indexOf(" ") + 1)))) app.options(pattern, { config: { rateLimit: false } }, async (request, reply) => {
+		const decided = decide(request, pattern);
+		if (!decided.granted) {
+			request.log.info({
+				reason: decided.reason,
+				...loggable(request.headers.origin)
+			}, "preflight refused");
+			return reply.code(403).header("vary", vary).send(CROSS_ORIGIN_REFUSED);
+		}
+		return reply.code(204).headers({
+			"access-control-allow-origin": decided.origin,
+			"access-control-allow-methods": decided.method,
+			"access-control-allow-headers": CROSS_ORIGIN_REQUEST_HEADERS.join(", "),
+			"access-control-max-age": String(600),
+			vary
+		}).send();
+	});
+}
+//#endregion
+//#region src/paths.ts
+/**
+* The paths this server routes (0037).
+*
+* A proxy in front of the server may choose where to forward a request by its
+* path after decoding it, resolving its `.` and `..` segments and collapsing
+* its slashes. cloudflared 2026.10.0 was measured doing all three, so that
+* `/v1/forms/a/versions/..%2F..%2Fb` matched a door meant for the runtime
+* route `/v1/forms/b`, while Fastify, which routes the path as sent, ran the
+* administrator's version-read for it. Rather than model anybody's
+* normalisation, the server routes only a path in which there is nothing to
+* normalise, and refuses every other before any route's work.
+*
+* No name the server accepts needs more. A form id and a connection id start
+* with a lower-case letter or digit and hold only those, `.`, `-` and `_`; a
+* version is digits or `latest`; a lookup source is formancy's option-source
+* name, lower case, digits and hyphens. None can be `.` or `..`, and
+* `encodeURIComponent`, which the studio and data-client send names through,
+* leaves each as it is. paths.test.ts derives that for form and connection
+* ids from the store's and the allowlist's own checks; for versions and
+* sources it holds a sample.
+*/
+/** One segment: RFC 3986's unreserved characters, its sub-delims, `:` and `@`. No `%`, no `\`, nothing outside ASCII. */
+const SEGMENT = /^[A-Za-z0-9\-._~!$&'()*+,;=:@]+$/;
+/**
+* Whether a request target is a plain path: before any `?`, a `/` and then
+* one or more segments, each non-empty, neither `.` nor `..`, and made only of
+* characters a path carries as themselves. So no escape, no backslash, no
+* empty segment (a doubled or trailing slash, or `/` alone), no dot segment
+* and no `#`. The query is not looked at: neither the router nor a door
+* routes by it.
+*/
+function plainPath(target) {
+	const query = target.indexOf("?");
+	const path = query === -1 ? target : target.slice(0, query);
+	if (!path.startsWith("/")) return false;
+	return path.slice(1).split("/").every((segment) => segment !== "." && segment !== ".." && SEGMENT.test(segment));
+}
+/** The answer to a path that is not plain, with 400: a code and a sentence, and nothing of the path, which is whatever the caller typed. */
+const PATH_NOT_PLAIN = {
+	code: "path-not-plain",
+	message: "This path holds an encoded character, an empty or a dot segment, or a character a path does not carry as itself. No name here is written that way, and a proxy in front of this server may read such a path differently, so it was not routed to any route's work."
+};
+//#endregion
+//#region src/rate-limit.ts
+/**
+* The per-address request limit, and the setting that changes it.
+*
+* `FORMANCY_DATA_RATE_LIMIT` is read by the composition root (main.ts) and
+* parsed here, so the rule is tested without starting a process.
+*/
+/** Requests per client address per window, unless the operator says otherwise: 600 a minute, as every earlier release had. */
+const DEFAULT_RATE_LIMIT = {
+	max: 600,
+	timeWindowMs: 6e4
+};
+/** What main.ts prints, and stops, when the setting is anything but a whole number of at least one. */
+const RATE_LIMIT_REFUSAL = "FORMANCY_DATA_RATE_LIMIT is a whole number of requests a minute per client address, at least 1.";
+/**
+* `FORMANCY_DATA_RATE_LIMIT` as written: unset is the default; otherwise
+* decimal digits only, no sign, no fraction, no exponent, no space, and a
+* value a JavaScript number holds exactly. The window is always a minute, so
+* the number an operator writes is the number of requests.
+*/
+function rateLimitSetting(text) {
+	if (text === void 0) return {
+		ok: true,
+		rateLimit: { ...DEFAULT_RATE_LIMIT }
+	};
+	const max = /^[0-9]+$/.test(text) ? Number(text) : NaN;
+	if (!Number.isSafeInteger(max) || max < 1) return {
+		ok: false,
+		problem: RATE_LIMIT_REFUSAL
+	};
+	return {
+		ok: true,
+		rateLimit: {
+			max,
+			timeWindowMs: DEFAULT_RATE_LIMIT.timeWindowMs
+		}
+	};
+}
+//#endregion
+//#region src/reassigned.ts
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function anchorOf(value) {
+	if (!isRecord$3(value)) return void 0;
+	if (value["kind"] === "column" && typeof value["column"] === "string") return {
+		kind: "column",
+		column: value["column"]
+	};
+	if (value["kind"] === "lookup" && typeof value["foreignKey"] === "string") return {
+		kind: "lookup",
+		foreignKey: value["foreignKey"]
+	};
+}
+/**
+* A publish's `keysConfirmed`: absent is none, and anything but a list of
+* `{ field, was, now }`, each anchor a column or a lookup's foreign key, is
+* `undefined`. Each entry is rebuilt from what it names, so nothing else a
+* client sent is carried.
+*/
+function readKeysConfirmed(value) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) return void 0;
+	const keys = [];
+	for (const entry of value) {
+		if (!isRecord$3(entry) || typeof entry["field"] !== "string") return void 0;
+		const was = anchorOf(entry["was"]);
+		const now = anchorOf(entry["now"]);
+		if (was === void 0 || now === void 0) return void 0;
+		keys.push({
+			field: entry["field"],
+			was,
+			now
+		});
+	}
+	return keys;
+}
+const sameAnchor = (left, right) => left.kind === "column" ? right.kind === "column" && left.column === right.column : right.kind === "lookup" && left.foreignKey === right.foreignKey;
+/**
+* The keys `replaced` bound to another column or lookup than `published`
+* does, that `published`'s policy grants on -- a role on the key's field or
+* a through that names it (0043), `grantsOnKey`, the function the studio
+* asks with -- and that `confirmed` does not name exactly as reassigned: the
+* same key, the column or lookup it stood for, and the one it stands for
+* now. A confirmation matched by key
+* alone would carry a decision to a column nobody was shown -- a studio
+* draft generated again after its keys were decided can renumber one again.
+* One for a key that was not reassigned grants nothing, and is ignored.
+*
+* An anchor is a column's or a foreign key's name, not its table's: a
+* publish that moves the form to another root or connection is compared by
+* name, and its grants follow their keys unasked (0039's costs).
+*/
+function unconfirmedKeys(replaced, published, confirmed) {
+	return reassignedKeys(replaced, published.bindings).filter((key) => grantsOnKey(published.policy, key.field) && !confirmed.some((entry) => entry.field === key.field && sameAnchor(entry.was, key.was) && sameAnchor(entry.now, key.now)));
+}
+//#endregion
+//#region src/publishing.ts
+const INVALID = "The bundle cannot be published.";
+/**
+* Whether `document` may be written as a version of form `id`, in the order
+* the publish route has always asked: it validates (0019); it is format 2,
+* which keeps its generation request (0030); its form is `id`; its
+* connection is one `allowlisted` knows; and this server's generator writes
+* its base and bindings from its snapshot and request (0030) -- asked here,
+* at the write, and never on read, so a later generator cannot make a stored
+* version corrupt.
+*
+* `unknown` is the sentence for a connection the allowlist does not know:
+* the import says why a name has to match across deployments.
+*/
+function storable(document, id, allowlisted, unknown = (connection) => `No connection is called ${connection}.`) {
+	const checked = validateBundle(document);
+	if (!checked.ok) return {
+		ok: false,
+		refusal: {
+			status: 422,
+			code: "invalid-bundle",
+			message: INVALID,
+			extra: { problems: checked.problems }
+		}
+	};
+	const bundle = checked.bundle;
+	const refused = (message, extra) => ({
+		ok: false,
+		refusal: {
+			status: 422,
+			code: "invalid-bundle",
+			message,
+			...extra === void 0 ? {} : { extra }
+		},
+		connection: bundle.connection
+	});
+	if (bundle.format === 1) return refused(INVALID, { problems: ["publish format 2: since 0030 a version keeps its generation request, generated base and presentation"] });
+	if (bundle.form.id !== id) return refused(`The form's id is ${bundle.form.id}, not ${id}.`);
+	if (!allowlisted(bundle.connection)) return refused(unknown(bundle.connection));
+	const generated = generatedProblems(bundle);
+	if (generated.length > 0) return refused(INVALID, { problems: generated });
+	return {
+		ok: true,
+		bundle
+	};
+}
+/**
+* The keys a write over `expectedBase` grants on that the version it
+* replaces bound to something else, and that it does not confirm (0039).
+* Nothing to compare for a first version, or for a base that is not there
+* -- below 1, or past the newest -- which the store's compare-and-swap
+* refuses; nor for a version that does not validate, or whose file does
+* not parse, which is not served (0019), so none of its grants is in
+* effect -- and publishing over it is how it is replaced. Any other
+* failure to read the base throws: a check that cannot answer refuses.
+*/
+async function unconfirmedAgainst(store, id, expectedBase, bundle, confirmed, log) {
+	if (expectedBase === null || expectedBase < 1) return [];
+	let replaced;
+	try {
+		replaced = await loadVersion(store, id, expectedBase, log);
+	} catch (error) {
+		if (!(error instanceof UnparsableVersionError)) throw error;
+		log.error({
+			form: id,
+			version: expectedBase
+		}, "a published version does not parse, and is not compared");
+		return [];
+	}
+	return replaced.ok ? unconfirmedKeys(replaced.bundle.bindings, bundle, confirmed) : [];
+}
+/** The conflict a compare-and-swap answers with: somebody wrote `current` first. */
+function conflictOver(current) {
+	return {
+		status: 409,
+		code: "conflict",
+		message: "Somebody published first. Rebase on the current version and try again.",
+		extra: { current }
+	};
+}
+/**
+* The refusal for a write over `expectedBase` whose keys are not all
+* confirmed (0039), or `undefined` when there is none. Compared with a
+* version somebody has replaced, the keys may say something else, so the
+* conflict is the answer then.
+*/
+async function keysRefusal(store, id, expectedBase, bundle, confirmed, log) {
+	const keys = await unconfirmedAgainst(store, id, expectedBase, bundle, confirmed, log);
+	if (keys.length === 0) return void 0;
+	const current = await store.latest(id);
+	if (current !== expectedBase) return conflictOver(current);
+	return {
+		status: 422,
+		code: "keys-reassigned",
+		message: `Version ${String(expectedBase)} bound ${keys.map((key) => key.field).join(", ")} to other columns or lookups: confirm the grants on each for what it stands for now, or remove them. A grant is a role on the key's field, or a through that scopes this form's rows by it.`,
+		extra: {
+			keys,
+			problems: keys.map(describeReassigned)
+		}
+	};
+}
+/**
+* Whether the database as `current` describes it can serve `bundle`, by
+* drift's rules (0010): a blocking change refuses, and a change to review or
+* note is reported and allowed. One gate for a restore and an import, which
+* both put a version already reviewed in front of a database it was not
+* generated from.
+*
+* Another engine is asked first, as its own answer: drift does not compare
+* across engines, and a connection pointed at another engine is the
+* administrator's to put right, not the server's failure. `diffSnapshots`
+* throws for nothing else a validated bundle can hold; anything it does
+* throw is the caller's 500.
+*/
+function servable(bundle, current) {
+	if (bundle.snapshot.kind !== current.kind) return {
+		ok: false,
+		code: "other-engine",
+		bound: bundle.snapshot.kind,
+		database: current.kind
+	};
+	const drift = diffSnapshots(bundle.snapshot, current, bundle.bindings, bundle.policy);
+	if (drift.blocking) return {
+		ok: false,
+		code: "incompatible",
+		changes: drift.changes.filter((change) => change.severity === "blocking")
+	};
+	return {
+		ok: true,
+		drift
+	};
+}
+//#endregion
+//#region src/routes/admin-audit.ts
+/**
+* The audit name of every administrator route, keyed `METHOD url` (0033).
+* A route registered on the plane without an entry here stops the server
+* from starting; `admin-audit.test.ts` sends every route the router holds
+* and fails on an entry no route has.
+*/
+const ADMIN_OPERATIONS = {
+	"GET /v1/connections": "connection-list",
+	"POST /v1/connections/:id/test": "connection-test",
+	"GET /v1/connections/:id/metadata": "discovery",
+	"POST /v1/form-proposals": "proposal",
+	"POST /v1/forms/:id/versions": "publish",
+	"GET /v1/forms/:id/versions": "version-list",
+	"GET /v1/forms/:id/versions/latest": "version-latest",
+	"GET /v1/forms/:id/versions/:version": "version-read",
+	"POST /v1/forms/:id/drift": "drift",
+	"POST /v1/forms/:id/regenerations": "regeneration",
+	"POST /v1/forms/:id/restorations": "restore",
+	"POST /v1/forms/:id/imports": "import"
+};
+/** The request's trail, begun on first use: a refusal before any route ran has none, and needs none. */
+function adminTrail(request) {
+	request.adminAudit ??= {};
+	return request.adminAudit;
+}
+/**
+* The administrator's event: the shared base, the trail, and the path's own
+* names, each recorded only once it is known to be a name.
+*
+* A connection, from the path, a body or a stored bundle, is recorded only
+* when `known` -- the allowlist -- has it: a connection id is a name, never an
+* address (0019), and a connection string pasted where a name goes, with a
+* token or without, would otherwise put a host and a password in the trail.
+* Checked here, where every event is made, so no route can forget it.
+*/
+function describeAdmin(known) {
+	return (request, base) => {
+		const trail = request.adminAudit ?? {};
+		const url = request.routeOptions.url ?? "";
+		const id = request.params.id;
+		const path = typeof id === "string" ? id : void 0;
+		const connection = trail.connection ?? (url.startsWith("/v1/connections/:id") ? path : void 0);
+		return {
+			at: base.at,
+			plane: "admin",
+			actor: base.actor,
+			operation: base.operation,
+			connection: connection !== void 0 && known(connection) ? connection : null,
+			form: auditedForm(trail.form ?? (url.startsWith("/v1/forms/:id") ? path : void 0)),
+			formVersion: trail.formVersion ?? null,
+			expectedBase: trail.expectedBase ?? null,
+			restoredFrom: trail.restoredFrom ?? null,
+			status: base.status,
+			outcome: base.outcome
+		};
+	};
+}
+//#endregion
+//#region src/routes/admin-evolution.ts
+/** A version in a path or a body: a whole number from 1, at most sixteen digits, as the store names its files. */
+const VERSION = /^[1-9][0-9]{0,15}$/;
+function versionOf(text) {
+	if (!VERSION.test(text)) return void 0;
+	const version = Number(text);
+	return Number.isSafeInteger(version) ? version : void 0;
+}
+function isVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 1;
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* The form generated again from the stored request against the database as
+* it is now, keeping each lookup the runtime would still build.
+*
+* First without lookups: a failure there is not a lookup's — the root, a
+* pinned or version column — and nothing can be generated. Then each lookup
+* alone, put through `buildLookupConfig` exactly as the runtime builds it
+* (0028), which refuses more than the generator does: a display column with
+* no text form, a float key. A lookup either refuses is left out with the
+* sentence that refused it, which names only approved metadata.
+*/
+function regenerate(bundle, current) {
+	const attempt = (lookups) => generateForm(current, {
+		...bundle.generation,
+		lookups
+	});
+	try {
+		attempt([]);
+	} catch (error) {
+		return {
+			ok: false,
+			message: error.message
+		};
+	}
+	const kept = [];
+	const dropped = [];
+	for (const choice of bundle.generation.lookups) try {
+		const trial = attempt([choice]);
+		const field = trial.bindings.fields.find((binding) => binding.kind === "lookup" && binding.foreignKey === choice.foreignKey);
+		if (field === void 0) throw new Error(`${choice.foreignKey} was not generated as a lookup`);
+		buildLookupConfig(trial.bindings, field.field, { snapshot: current });
+		kept.push(choice);
+	} catch (error) {
+		dropped.push({
+			foreignKey: choice.foreignKey,
+			message: error.message
+		});
+	}
+	const generation = {
+		...bundle.generation,
+		lookups: kept
+	};
+	try {
+		return {
+			ok: true,
+			generated: generateForm(current, generation),
+			generation,
+			dropped
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			message: error.message
+		};
+	}
+}
+/**
+* Versions, regeneration and restore (0030), on the administrator plane:
+* registered by `adminRoutes` after its role check, so the check covers them.
+*/
+function evolutionRoutes(app, { store, discover, refuse }) {
+	/** Something that cannot happen for a stored, validated bundle: logged for the operator, 500 for the caller. */
+	function internal(reply, id, error) {
+		reply.log.error({
+			form: id,
+			error: error.message
+		}, "a regeneration or restore failed where it cannot");
+		return refuse(reply, 500, "internal", "This could not be completed; the operator's log says why.");
+	}
+	app.get("/v1/forms/:id/versions", async (request, reply) => {
+		const id = request.params.id;
+		const versions = FORM_ID.test(id) ? await store.versions(id) : [];
+		if (versions.length === 0) return refuse(reply, 404, "unknown-form", `No form is called ${id}.`);
+		return { versions };
+	});
+	app.get("/v1/forms/:id/versions/:version", async (request, reply) => {
+		const version = versionOf(request.params.version);
+		if (version === void 0) return refuse(reply, 400, "invalid-request", "A version is a whole number from 1.");
+		const loaded = await loadVersion(store, request.params.id, version, reply.log);
+		if (!loaded.ok) return refuse(reply, loaded.status, loaded.code, loaded.message);
+		const trail = adminTrail(request);
+		trail.formVersion = version;
+		trail.connection = loaded.bundle.connection;
+		return {
+			version,
+			bundle: loaded.bundle
+		};
+	});
+	app.post("/v1/forms/:id/regenerations", async (request, reply) => {
+		const id = request.params.id;
+		const loaded = await loadPublished(store, id, reply.log);
+		if (!loaded.ok) return refuse(reply, loaded.status, loaded.code, loaded.message);
+		const bundle = loaded.bundle;
+		const trail = adminTrail(request);
+		trail.formVersion = loaded.version;
+		trail.connection = bundle.connection;
+		if (bundle.format === 1) return refuse(reply, 409, "published-before-0030", `Version ${String(loaded.version)} was published before 0030 and kept no generation request: propose the form again.`);
+		const current = await discover(bundle.connection, reply);
+		if (current === void 0) return reply;
+		let drift;
+		try {
+			drift = diffSnapshots(bundle.snapshot, current, bundle.bindings, bundle.policy);
+		} catch (error) {
+			return internal(reply, id, error);
+		}
+		const outcome = regenerate(bundle, current);
+		if (!outcome.ok) return refuse(reply, 422, "cannot-generate", outcome.message, { drift });
+		const { generated, generation, dropped } = outcome;
+		let carried;
+		try {
+			carried = rebasePresentation({
+				base: bundle.base,
+				presentation: bundle.presentation,
+				bindings: bundle.bindings
+			}, {
+				base: generated.form,
+				bindings: generated.bindings
+			});
+		} catch (error) {
+			return internal(reply, id, error);
+		}
+		const valid = validateSchema(carried.form);
+		if (!valid.valid) return internal(reply, id, /* @__PURE__ */ new Error(`the carried form is not one formancy accepts: ${valid.errors.map((entry) => entry.message).join("; ")}`));
+		return {
+			version: loaded.version,
+			drift,
+			generation,
+			base: generated.form,
+			bindings: generated.bindings,
+			notes: generated.notes,
+			snapshot: current,
+			policy: bundle.policy,
+			policyProblems: policyProblems(current, generated.bindings, bundle.policy),
+			presentation: carried.presentation,
+			form: carried.form,
+			conflicts: carried.conflicts,
+			lookupsDropped: dropped,
+			keysReassigned: reassignedKeys(bundle.bindings, generated.bindings)
+		};
+	});
+	app.post("/v1/forms/:id/restorations", async (request, reply) => {
+		const id = request.params.id;
+		const body = request.body;
+		if (!isRecord$2(body) || !isVersion(body["version"]) || !isVersion(body["expectedBase"])) return refuse(reply, 400, "invalid-request", "Expected { version: the version to restore, expectedBase: the newest version you saw }.");
+		const version = body["version"];
+		const trail = adminTrail(request);
+		trail.restoredFrom = version;
+		trail.expectedBase = body["expectedBase"];
+		const loaded = await loadVersion(store, id, version, reply.log);
+		if (!loaded.ok) return refuse(reply, loaded.status, loaded.code, loaded.message);
+		trail.connection = loaded.bundle.connection;
+		const current = await discover(loaded.bundle.connection, reply);
+		if (current === void 0) return reply;
+		let served;
+		try {
+			served = servable(loaded.bundle, current);
+		} catch (error) {
+			return internal(reply, id, error);
+		}
+		if (!served.ok && served.code === "other-engine") return refuse(reply, 422, "other-engine", `Version ${String(version)} cannot be restored: connection ${loaded.bundle.connection} is a ${served.database} database now, and the version is bound to ${served.bound}. A form's bindings belong to one engine.`);
+		if (!served.ok) return refuse(reply, 409, "incompatible", `Version ${String(version)} cannot be restored: the database has changed in a way it cannot serve.`, { changes: served.changes });
+		const drift = served.drift;
+		const outcome = await store.publish(id, body["expectedBase"], loaded.bundle);
+		if (!outcome.ok) return refuse(reply, 409, "conflict", "Somebody published first. Look at the current version and try again.", { current: outcome.current });
+		trail.formVersion = outcome.version;
+		const restoration = {
+			version: outcome.version,
+			restoredFrom: version,
+			drift
+		};
+		return reply.code(201).send(restoration);
+	});
+}
+//#endregion
+//#region src/routes/admin-promotion.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* A published version moved between deployments (0062): the version file
+* another deployment's store wrote -- read there as `GET
+* /v1/forms/:id/versions/:version`, the export -- written here as a new
+* version, after the checks a publish makes and the gate a restore passes.
+* Registered by `adminRoutes` after its role check, so the check covers it.
+*
+* The bundle is written as it came, snapshot and all: what was reviewed
+* there is what runs here, and the runtime's root check (0041) and this
+* deployment's drift compare against that snapshot until a regeneration
+* replaces it. Nothing is renamed: the connection and the form keep their
+* names, because a lookup's source name is made from the connection's, so
+* a renamed connection is another generated base.
+*/
+function promotionRoutes(app, { store, allowlisted, discover, refuse }) {
+	const send = (reply, refusal) => refuse(reply, refusal.status, refusal.code, refusal.message, refusal.extra);
+	app.post("/v1/forms/:id/imports", async (request, reply) => {
+		const id = request.params.id;
+		const body = request.body;
+		if (!FORM_ID.test(id)) return refuse(reply, 400, "invalid-request", "A form id is lower-case letters, digits, dot, hyphen or underscore.");
+		const shape = "Expected { expectedBase: the newest version here, or null for the first, bundle: the version file, keysConfirmed? }.";
+		if (!isRecord$1(body) || !("expectedBase" in body) || !(body["expectedBase"] === null || Number.isSafeInteger(body["expectedBase"])) || !isRecord$1(body["bundle"])) return refuse(reply, 400, "invalid-request", shape);
+		const expectedBase = body["expectedBase"];
+		const trail = adminTrail(request);
+		trail.expectedBase = expectedBase;
+		const confirmed = readKeysConfirmed(body["keysConfirmed"]);
+		if (confirmed === void 0) return refuse(reply, 400, "invalid-request", "Expected keysConfirmed, when sent, to list { field, was, now } as an import refused 422 keys-reassigned lists them in keys.");
+		const checked = storable(body["bundle"], id, allowlisted, (name) => `No connection is called ${name} in this deployment: an import keeps the connection's name, which each deployment's allowlist resolves to its own database.`);
+		if (!checked.ok) {
+			if (checked.connection !== void 0) trail.connection = checked.connection;
+			return send(reply, checked.refusal);
+		}
+		const bundle = checked.bundle;
+		trail.connection = bundle.connection;
+		const current = await discover(bundle.connection, reply);
+		if (current === void 0) return reply;
+		let served;
+		try {
+			served = servable(bundle, current);
+		} catch (error) {
+			reply.log.error({
+				form: id,
+				error: error.message
+			}, "an import failed where it cannot");
+			return refuse(reply, 500, "internal", "This could not be completed; the operator's log says why.");
+		}
+		if (!served.ok && served.code === "other-engine") return refuse(reply, 422, "other-engine", `This version cannot be imported: connection ${bundle.connection} is a ${served.database} database here, and the version is bound to ${served.bound}. A form's bindings belong to one engine.`);
+		if (!served.ok) return refuse(reply, 409, "incompatible", "This version cannot be imported: this deployment's database differs from the one it was published from in a way it cannot serve.", { changes: served.changes });
+		const keys = await keysRefusal(store, id, expectedBase, bundle, confirmed, reply.log);
+		if (keys !== void 0) return send(reply, keys);
+		const outcome = await store.publish(id, expectedBase, bundle);
+		if (!outcome.ok) return send(reply, conflictOver(outcome.current));
+		trail.formVersion = outcome.version;
+		const importation = {
+			version: outcome.version,
+			drift: served.drift
+		};
+		return reply.code(201).send(importation);
+	});
+}
+//#endregion
+//#region src/routes/admin.ts
+function refuse(reply, status, code, message, extra = {}) {
+	return reply.code(status).send({
+		code,
+		message,
+		...extra
+	});
+}
+/** Sends a refusal `publishing.ts` decided. */
+function send(reply, refusal) {
+	return refuse(reply, refusal.status, refusal.code, refusal.message, refusal.extra);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* The administrator's plane: connections, discovery, proposals, publication,
+* drift, and since 0030 versions, regeneration and restore (plan section 13).
+* Every route requires a host identity holding one of `adminRoles` —
+* publishing a form and writing a business record are
+* different permissions, and nothing here touches a record.
+*
+* A database that cannot be reached is 503 with no detail: a driver's message
+* names hosts and ports, which is the operator's business and not the caller's.
+*
+* Every request is audited, one event each (0033), by hooks installed before
+* any route, so a route added here without an audit name stops the server.
+*/
+async function adminRoutes(app, options) {
+	const { registry, store } = options;
+	const admins = new Set(options.adminRoles);
+	if (typeof options.audit?.sink !== "function") throw new Error("The administrator's plane needs an audit sink: audit: { sink } (0033).");
+	auditRequests(app, {
+		names: ADMIN_OPERATIONS,
+		sink: options.audit.sink,
+		now: options.audit.now,
+		describe: describeAdmin((id) => registry.scope(id) !== void 0)
+	});
+	app.addHook("preHandler", async (request, reply) => {
+		const identity = await options.authenticate(request);
+		if (identity === void 0) return reply.code(401).header("www-authenticate", "Bearer").send({
+			code: "unauthenticated",
+			message: "A valid host token is required."
+		});
+		request.identity = identity;
+		if (!identity.actor.roles.some((role) => admins.has(role))) return refuse(reply, 403, "forbidden", "This action needs an administrator role.");
+	});
+	/** The connection's ports, or a reply already sent. */
+	async function connection(id, reply) {
+		let open;
+		try {
+			open = await registry.open(id);
+		} catch (error) {
+			reply.log.warn({
+				connection: id,
+				error: error.message
+			}, "connection could not be opened");
+			await refuse(reply, 503, "unavailable", `Connection ${id} cannot be reached.`);
+			return;
+		}
+		if (open === void 0) await refuse(reply, 404, "unknown-connection", `No connection is called ${id}.`);
+		return open;
+	}
+	async function discover(id, reply) {
+		const scope = registry.scope(id);
+		const open = await connection(id, reply);
+		if (open === void 0 || scope === void 0) return void 0;
+		try {
+			return await open.adapter.discover(scope);
+		} catch (error) {
+			reply.log.warn({
+				connection: id,
+				error: error.message
+			}, "discovery failed");
+			await refuse(reply, 503, "unavailable", `Connection ${id} could not be read.`);
+			return;
+		}
+	}
+	app.get("/v1/connections", async () => ({ connections: registry.ids() }));
+	app.post("/v1/connections/:id/test", async (request, reply) => {
+		const open = await connection(request.params.id, reply);
+		if (open === void 0) return reply;
+		try {
+			return await open.adapter.ping();
+		} catch {
+			return refuse(reply, 503, "unavailable", `Connection ${request.params.id} did not answer.`);
+		}
+	});
+	app.get("/v1/connections/:id/metadata", async (request, reply) => {
+		return await discover(request.params.id, reply) ?? reply;
+	});
+	app.post("/v1/form-proposals", async (request, reply) => {
+		const body = request.body;
+		if (!isRecord(body)) return refuse(reply, 400, "invalid-request", "Expected a JSON object.");
+		const read = readGeneration(body);
+		if (!read.ok) return refuse(reply, 400, "invalid-request", "Expected connection, root { schema, name }, a lower-case formId, title, and optional lookups, versionColumn and pinned columns.");
+		const trail = adminTrail(request);
+		trail.form = read.generation.formId;
+		trail.connection = read.generation.connection;
+		const snapshot = await discover(read.generation.connection, reply);
+		if (snapshot === void 0) return reply;
+		try {
+			return {
+				...generateForm(snapshot, read.generation),
+				snapshot,
+				generation: read.generation
+			};
+		} catch (error) {
+			return refuse(reply, 422, "cannot-generate", error.message);
+		}
+	});
+	app.post("/v1/forms/:id/versions", async (request, reply) => {
+		const id = request.params.id;
+		const body = request.body;
+		if (!FORM_ID.test(id)) return refuse(reply, 400, "invalid-request", "A form id is lower-case letters, digits, dot, hyphen or underscore.");
+		if (!isRecord(body) || !("expectedBase" in body) || !(body["expectedBase"] === null || Number.isSafeInteger(body["expectedBase"]))) return refuse(reply, 400, "invalid-request", "Expected { expectedBase: the version you edited, or null for the first, bundle }.");
+		const expectedBase = body["expectedBase"];
+		const trail = adminTrail(request);
+		trail.expectedBase = expectedBase;
+		const confirmed = readKeysConfirmed(body["keysConfirmed"]);
+		if (confirmed === void 0) return refuse(reply, 400, "invalid-request", "Expected keysConfirmed, when sent, to list { field, was, now } as a regeneration reports them in keysReassigned.");
+		const checked = storable(body["bundle"], id, (name) => registry.scope(name) !== void 0);
+		if (!checked.ok) {
+			if (checked.connection !== void 0) trail.connection = checked.connection;
+			return send(reply, checked.refusal);
+		}
+		const bundle = checked.bundle;
+		trail.connection = bundle.connection;
+		const keys = await keysRefusal(store, id, expectedBase, bundle, confirmed, reply.log);
+		if (keys !== void 0) return send(reply, keys);
+		const outcome = await store.publish(id, expectedBase, bundle);
+		if (!outcome.ok) return send(reply, conflictOver(outcome.current));
+		trail.formVersion = outcome.version;
+		return reply.code(201).send({ version: outcome.version });
+	});
+	/** The newest published bundle, re-validated, or a reply already sent. */
+	async function latest(id, reply) {
+		const loaded = await loadPublished(store, id, reply.log);
+		if (loaded.ok) {
+			const trail = adminTrail(reply.request);
+			trail.formVersion = loaded.version;
+			trail.connection = loaded.bundle.connection;
+			return {
+				version: loaded.version,
+				bundle: loaded.bundle
+			};
+		}
+		await refuse(reply, loaded.status, loaded.code, loaded.message);
+	}
+	app.get("/v1/forms/:id/versions/latest", async (request, reply) => {
+		return await latest(request.params.id, reply) ?? reply;
+	});
+	app.post("/v1/forms/:id/drift", async (request, reply) => {
+		const published = await latest(request.params.id, reply);
+		if (published === void 0) return reply;
+		const current = await discover(published.bundle.connection, reply);
+		if (current === void 0) return reply;
+		return {
+			version: published.version,
+			...diffSnapshots(published.bundle.snapshot, current, published.bundle.bindings, published.bundle.policy)
+		};
+	});
+	evolutionRoutes(app, {
+		store,
+		discover,
+		refuse
+	});
+	promotionRoutes(app, {
+		store,
+		allowlisted: (name) => registry.scope(name) !== void 0,
+		discover,
+		refuse
+	});
+}
+//#endregion
+//#region src/app.ts
+/**
+* The largest request body accepted. A record is a form's worth of fields; a
+* megabyte is generous for that and small enough that a request cannot be used
+* to make the server buffer something large.
+*/
+const BODY_LIMIT = 1048576;
+/**
+* A request as the log names it: its method and the route that answered it,
+* never the path, the query or the Host header it was sent with. Those are
+* whatever a caller typed, token or none -- a connection string pasted where
+* a connection's name goes, a password in a query -- and the log is the
+* stream the audit trail is written to, read by whoever runs the collector
+* (0033). Fastify's default writes the URL and the Host as sent.
+*/
+function requestForLog(request) {
+	const port = request.socket.remotePort;
+	return {
+		method: request.method,
+		route: request.routeOptions.url ?? null,
+		remoteAddress: request.ip,
+		...port === void 0 ? {} : { remotePort: port }
+	};
+}
+/** Fastify's request lines, but for its 404 line, which names the path it was sent: here, a 404 is named by its method. */
+var RouteOnlyLog = class extends LogController {
+	routeNotFound(request) {
+		if (this.isLogDisabled(request)) return;
+		request.log.info({ req: request }, "no route matches");
+	}
+};
+function bearer(request) {
+	const header = request.headers.authorization;
+	if (header === void 0) return void 0;
+	return /^Bearer ([A-Za-z0-9._~+/=-]+)$/.exec(header)?.[1];
+}
+/**
+* The HTTP surface, as far as it exists.
+*
+* The administrator's plane is registered when the server is given a store,
+* a connection registry and the roles that administer. The record and lookup
+* routes arrive with the operations they call: a route that answered before
+* the adapters behind it could would be a documented-but-inert endpoint, which
+* is the failure this repository refuses.
+*
+* `GET /v1/whoami` is for the person wiring a host application in: it returns
+* exactly the identity the server derived from the host's token, so a wrong
+* issuer, audience or claim mapping is visible before any form depends on it.
+*/
+async function createDataServer(options) {
+	const given = options.runtime?.origins ?? [];
+	const origins = Array.isArray(given) ? Object.freeze([...given]) : given;
+	const refused = originsProblem(origins);
+	if (refused !== void 0) throw new Error(refused);
+	const lookupDeadlineMs = options.runtime?.lookupDeadlineMs ?? DEFAULT_LOOKUP_DEADLINE_MS;
+	const deadlineRefused = lookupDeadlineProblem("runtime.lookupDeadlineMs", lookupDeadlineMs);
+	if (deadlineRefused !== void 0) throw new Error(deadlineRefused);
+	const logger = options.logger ?? false;
+	const app = Fastify({
+		logger: logger === false ? false : {
+			serializers: { req: requestForLog },
+			...logger === true ? {} : { stream: logger.stream }
+		},
+		logController: new RouteOnlyLog(),
+		bodyLimit: BODY_LIMIT,
+		routerOptions: { maxParamLength: 128 }
+	});
+	app.addHook("onSend", async (_request, reply, payload) => {
+		reply.header("cache-control", "no-store");
+		return payload;
+	});
+	const limit = options.rateLimit ?? DEFAULT_RATE_LIMIT;
+	await app.register(rateLimit, {
+		global: true,
+		max: limit.max,
+		timeWindow: limit.timeWindowMs
+	});
+	const counted = app.rateLimit();
+	app.addHook("onRequest", async (request, reply) => {
+		if (plainPath(request.url)) return void 0;
+		await counted.call(app, request, reply);
+		return reply.code(400).send(PATH_NOT_PLAIN);
+	});
+	crossOrigin(app, { origins });
+	const authenticate = async (request) => {
+		const token = bearer(request);
+		if (token === void 0) return void 0;
+		const outcome = await options.verifyIdentity(token);
+		if (!outcome.ok) {
+			request.log.info({ reason: outcome.reason }, "host identity refused");
+			return;
+		}
+		return outcome.identity;
+	};
+	app.get("/health", { config: { rateLimit: false } }, async () => ({ status: "ok" }));
+	app.get("/v1/whoami", async (request, reply) => {
+		const identity = await authenticate(request);
+		if (identity === void 0) return reply.code(401).header("www-authenticate", "Bearer").send({
+			code: "unauthenticated",
+			message: "A valid host token is required."
+		});
+		return identity;
+	});
+	if (options.admin !== void 0) await app.register(adminRoutes, {
+		...options.admin,
+		authenticate
+	});
+	if (options.runtime !== void 0) {
+		const { origins: _offered, lookupDeadlineMs: _checked, ...runtime } = options.runtime;
+		await app.register(runtimeRoutes, {
+			...runtime,
+			authenticate,
+			lookupDeadlineMs
+		});
+	}
+	return app;
+}
+//#endregion
+//#region src/connections.ts
+const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+/**
+* The allowlist, checked: every problem at once, so an operator fixes the file
+* in one pass rather than one restart per mistake.
+*/
+function parseConnections(document) {
+	if (!Array.isArray(document)) return {
+		ok: false,
+		problems: ["the connections file is a list"]
+	};
+	const problems = [];
+	const seen = /* @__PURE__ */ new Set();
+	const connections = [];
+	document.forEach((entry, index) => {
+		const where = `connections[${String(index)}]`;
+		if (typeof entry !== "object" || entry === null) {
+			problems.push(`${where} is not an object`);
+			return;
+		}
+		const value = entry;
+		const id = value["id"];
+		const before = problems.length;
+		if (typeof id !== "string" || !ID.test(id)) problems.push(`${where}.id must be lower-case letters, digits, dot, hyphen or underscore`);
+		else if (seen.has(id)) problems.push(`${where}.id ${id} is used twice`);
+		if (!isDatabaseKind(value["kind"])) problems.push(`${where}.kind must be postgres or sqlserver`);
+		for (const field of [
+			"host",
+			"database",
+			"user"
+		]) if (typeof value[field] !== "string" || value[field] === "") problems.push(`${where}.${field} is required`);
+		const port = value["port"];
+		if (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535) problems.push(`${where}.port must be a port number`);
+		const password = value["password"];
+		if (typeof password !== "string" || !(password.startsWith("env:") || password.startsWith("file:"))) problems.push(`${where}.password must be a secret reference, env:NAME or file:/path`);
+		const schemas = value["schemas"];
+		if (!Array.isArray(schemas) || schemas.length === 0 || !schemas.every((schema) => typeof schema === "string" && schema !== "")) problems.push(`${where}.schemas must list at least one approved schema`);
+		if (problems.length === before && typeof id === "string") {
+			seen.add(id);
+			connections.push(entry);
+		}
+	});
+	return problems.length === 0 ? {
+		ok: true,
+		connections
+	} : {
+		ok: false,
+		problems
+	};
+}
+/**
+* The allowlisted connections, opened lazily through the composition root's
+* factories. A form names a connection; this is the only place that name
+* becomes a database, so a form cannot reach a database the operator did not
+* list.
+*/
+function createConnectionRegistry(connections, factories, secrets) {
+	const byId = new Map(connections.map((connection) => [connection.id, connection]));
+	const opening = /* @__PURE__ */ new Map();
+	return {
+		ids: () => [...byId.keys()].sort((a, b) => a < b ? -1 : a > b ? 1 : 0),
+		scope(id) {
+			const config = byId.get(id);
+			return config === void 0 ? void 0 : { schemas: [...config.schemas] };
+		},
+		async open(id) {
+			const config = byId.get(id);
+			if (config === void 0) return void 0;
+			let pending = opening.get(id);
+			if (pending === void 0) {
+				const factory = factories[config.kind];
+				if (factory === void 0) throw new Error(`no driver is configured for ${config.kind} connections`);
+				pending = resolveSecret(config.password, secrets).then((password) => factory(config, password));
+				opening.set(id, pending);
+				pending.catch(() => opening.delete(id));
+			}
+			return pending;
+		},
+		async close() {
+			const open = [...opening.values()];
+			opening.clear();
+			await Promise.allSettled(open.map(async (pending) => (await pending).adapter.close()));
+		}
+	};
+}
+//#endregion
+//#region src/drivers.ts
+/** TLS unless the operator turned it off, and certificates checked unless the operator trusts the server's. */
+function tls(config) {
+	return {
+		enabled: config.tls?.enabled ?? true,
+		trust: config.tls?.trustServerCertificate ?? false
+	};
+}
+/** The application name the lookups' client gives PostgreSQL, so a DBA tells it from the records' in pg_stat_activity (0061). */
+const POSTGRES_LOOKUPS_APPLICATION = "formancy-data lookups";
+/**
+* PostgreSQL. Pinged before it is handed out, so an allowlisted connection that
+* cannot be reached fails here, where the registry retries it next time,
+* rather than on the first record a person saves.
+*
+* Two clients (0061). Lookups run on one of their own, because PostgreSQL
+* delivers a cancel on a connection of its own, and a cancel that arrives
+* after its statement finished stops whatever that backend runs next: in the
+* 2026-10-14 probe a lookup's late cancel stopped the statement pipelined
+* behind it on a shared pool of one. On their own client a late cancel can
+* stop only another lookup -- which the adapter runs once more -- and never a
+* record read or write, which 0015 never retries. The cost is up to twice the
+* connections per allowlisted database, each pool at the driver's default.
+* The ping runs on the records' client; a failure ends both. Closing the
+* adapter closes both, each as the adapter closes its own.
+*/
+const openPostgres = async (config, password) => {
+	const { enabled, trust } = tls(config);
+	const options = {
+		host: config.host,
+		port: config.port,
+		database: config.database,
+		user: config.user,
+		password,
+		tls: {
+			enabled,
+			rejectUnauthorized: !trust
+		}
+	};
+	const sql = connectPostgres(options);
+	const lookupSql = connectPostgres({
+		...options,
+		applicationName: POSTGRES_LOOKUPS_APPLICATION
+	});
+	const records = createPostgresAdapter(sql);
+	const lookups = createPostgresAdapter(lookupSql);
+	const adapter = {
+		...records,
+		close: async () => {
+			await Promise.all([records.close(), lookups.close()]);
+		}
+	};
+	try {
+		await adapter.ping();
+	} catch (error) {
+		await Promise.all([sql.end({ timeout: 1 }), lookupSql.end({ timeout: 1 })]);
+		throw error;
+	}
+	return {
+		adapter,
+		lookups: createPostgresLookups(lookupSql),
+		records: createPostgresRecords(sql)
+	};
+};
+/** SQL Server: no native module, no ODBC. */
+const openSqlServer = async (config, password) => {
+	const { enabled, trust } = tls(config);
+	const pool = await connectSqlServer({
+		host: config.host,
+		port: config.port,
+		database: config.database,
+		user: config.user,
+		password,
+		encrypt: enabled,
+		trustServerCertificate: trust
+	});
+	return {
+		adapter: createSqlServerAdapter(pool),
+		lookups: createSqlServerLookups(pool),
+		records: createSqlServerRecords(pool)
+	};
+};
+/**
+* The drivers, one factory per engine. Each adapter package opens its own
+* connections (`connectPostgres`, `connectSqlServer`), so a connection and the
+* code that binds values on it always come from one copy of the driver — the
+* server imports no driver at all, and the end-to-end suite is what found why
+* that matters.
+*/
+const DRIVER_FACTORIES = {
+	postgres: openPostgres,
+	sqlserver: openSqlServer
+};
+//#endregion
+export { rateLimitSetting as a, validateBundle as c, recordReference as d, UnparsableVersionError as f, createDataServer as i, lookupDeadlineSetting as l, createConnectionRegistry as n, corsOriginsSetting as o, createFileConfigurationStore as p, parseConnections as r, ROUTE_OPERATIONS as s, DRIVER_FACTORIES as t, logAuditSink as u };
+
+//# sourceMappingURL=drivers-DtJsZ_HW.mjs.map