@formancy/server-core 0.1.0 → 0.2.0

package/dist/index.mjs

@@ -1,6 +1,666 @@
-import { diffSchemas, schemaHash } from "@formancy/spec";
+import { CHALLENGE_TTL_SECONDS, DEFAULT_MAX_NUMBER, decodeSolution, encodeSolution, hashOf, mintChallenge, solveChallenge, verifySolution } from "@formancy/challenge";
+import { hmac } from "@noble/hashes/hmac.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
+import { diffSchemas, modelDataPaths, schemaHash } from "@formancy/spec";
 import { validateSchema } from "@formancy/spec/validate";
-import { createFormEngine } from "@formancy/core";
+import { createFormEngine, expressionProblems } from "@formancy/core";
+import { check } from "recheck";
+//#region src/options-membership.ts
+/**
+* Every sourced answer in a submission, as `path → { source, value }`.
+*
+* Walked from the SCHEMA over the value, never from the value's own shape — the
+* same way `referencedFileIds` does it. A walk driven by what arrived would let a
+* client dodge the check by omitting a property, and hidden branches have already
+* been stripped by the engine before this runs.
+*/
+function sourcedAnswers(schema, value) {
+	const found = [];
+	const walk = (fields, data, prefix) => {
+		if (typeof data !== "object" || data === null) return;
+		const record = data;
+		for (const field of fields) {
+			const at = prefix === "" ? field.key : `${prefix}.${field.key}`;
+			const held = record[field.key];
+			if (field.fields !== void 0) {
+				if (Array.isArray(held)) for (const [index, row] of held.entries()) walk(field.fields, row, `${at}[${String(index)}]`);
+				else walk(field.fields, held, at);
+				continue;
+			}
+			if (field.optionsSource === void 0) continue;
+			if (typeof held !== "string" || held === "") continue;
+			found.push({
+				path: at,
+				source: field.optionsSource,
+				value: held
+			});
+		}
+	};
+	walk(schema.model.fields, value, "");
+	return found;
+}
+/**
+* Ask each source about the values submitted for it.
+*
+* One call per source rather than per answer, so a deployment sees `IN (…)` and not
+* a query per row.
+*/
+async function checkMembership(schema, value, sources) {
+	const answers = sourcedAnswers(schema, value);
+	if (answers.length === 0 || sources === void 0) return { ok: true };
+	const bySource = /* @__PURE__ */ new Map();
+	for (const answer of answers) {
+		const group = bySource.get(answer.source) ?? [];
+		group.push({
+			path: answer.path,
+			value: answer.value
+		});
+		bySource.set(answer.source, group);
+	}
+	const errors = {};
+	for (const [name, group] of bySource) {
+		const source = sources[name];
+		if (source === void 0) return {
+			ok: false,
+			kind: "source_unavailable",
+			source: name
+		};
+		if (source.members === void 0) continue;
+		let rejected;
+		try {
+			rejected = await source.members(group.map((entry) => entry.value));
+		} catch {
+			return {
+				ok: false,
+				kind: "source_unavailable",
+				source: name
+			};
+		}
+		const refused = new Set(rejected);
+		for (const entry of group) {
+			if (!refused.has(entry.value)) continue;
+			errors[entry.path] = [...errors[entry.path] ?? [], "option"];
+		}
+	}
+	return Object.keys(errors).length === 0 ? { ok: true } : {
+		ok: false,
+		kind: "invalid",
+		errors
+	};
+}
+/**
+* The source names a document uses, for the publish-time vocabulary check.
+*
+* Walked over the schema rather than over any data, because publishing has none.
+*/
+function sourceNamesIn(schema) {
+	const names = /* @__PURE__ */ new Set();
+	const walk = (fields) => {
+		for (const field of fields) {
+			if (field.optionsSource !== void 0) names.add(field.optionsSource);
+			if (field.fields !== void 0) walk(field.fields);
+		}
+	};
+	walk(schema.model.fields);
+	return [...names];
+}
+//#endregion
+//#region src/audit.ts
+/**
+* Who did what, to which thing, and when.
+*
+* **Reads and exports are recorded as well as mutations** — `submission.read` and
+* `submission.exported` — which is what lets a self-hoster answer who downloaded four
+* thousand people's answers ([0057](../../../docs/decisions/0057-the-audit-log-records-reads.md)).
+*
+* **A row joins the mutation's transaction where there is one.** `insertSubmission` and
+* `publishVersion` both commit their audit row with the change it describes, so a
+* rollback leaves no trace saying it happened. A read has nothing to be atomic with, so
+* its row is appended after the rows are handed over and a failure to write it is logged
+* loudly rather than swallowed.
+*
+* **`detail` carries identifiers and counts, never submission content.** An audit log is
+* read by more people, kept longer and exported more freely than the data it describes.
+*/
+/**
+* Every auditable action, as a closed list.
+*
+* Closed so a new route cannot invent its own spelling: an audit log where one event is
+* called two things is one nobody can query.
+*/
+const AUDIT_ACTIONS = [
+	"auth.login",
+	"auth.login.failed",
+	"form.published",
+	"form.access.changed",
+	"submission.created",
+	"submission.read",
+	"submission.exported",
+	"file.downloaded",
+	"user.created",
+	"apiKey.created",
+	"apiKey.revoked",
+	"delivery.replayed"
+];
+/**
+* An entry from an actor, with the fields spread the way the record stores
+* them.
+*
+* A helper rather than a convention, because `actorKind` and `actorId` being
+* set together is exactly the sort of thing eleven call sites get wrong once.
+*/
+function auditedBy(actor, draft) {
+	return actor === void 0 ? draft : {
+		...draft,
+		actorKind: actor.kind,
+		actorId: actor.id
+	};
+}
+//#endregion
+//#region src/webhook.ts
+/**
+* What a webhook delivery looks like on the wire.
+*
+* The signature scheme is Stripe's, deliberately: receivers already have code
+* for it, and a scheme somebody has to implement from scratch is a scheme most
+* receivers will skip. Adopting a familiar one is the difference between a
+* verified webhook and a verified-in-principle one.
+*/
+const EVENT_ID_HEADER = "x-formancy-event-id";
+const SIGNATURE_HEADER = "x-formancy-signature";
+/**
+* The signed payload is `timestamp.body`, not `body`.
+*
+* Without the timestamp inside the signature, a signature captured once stays
+* valid forever and can be replayed. With it, a receiver can reject anything
+* older than its tolerance, and the signature covers the timestamp it is
+* checking — so the timestamp cannot be edited either.
+*/
+function signedPayload(timestampSeconds, body) {
+	return `${String(timestampSeconds)}.${body}`;
+}
+/** Hex HMAC-SHA256 over the signed payload. */
+function signBody(secret, timestampSeconds, body) {
+	return bytesToHex(hmac(sha256, utf8ToBytes(secret), utf8ToBytes(signedPayload(timestampSeconds, body))));
+}
+/**
+* The headers for one delivery attempt.
+*
+* The event id is stable across retries, which is what makes the receiver able
+* to be idempotent. Generating a fresh one per attempt would turn our retry
+* into their duplicate.
+*/
+function deliveryHeaders(input) {
+	return {
+		"content-type": "application/json",
+		[EVENT_ID_HEADER]: input.eventId,
+		[SIGNATURE_HEADER]: `t=${String(input.timestampSeconds)},v1=${signBody(input.secret, input.timestampSeconds, input.body)}`,
+		"x-formancy-attempt": String(input.attempt)
+	};
+}
+/**
+* Verify a delivery the way a receiver would.
+*
+* Exported because a scheme nobody can check is a scheme nobody does check —
+* this is the reference implementation, and the test for our own signing.
+*/
+function verifySignature(input) {
+	const parts = new Map(input.header.split(",").map((part) => {
+		const at = part.indexOf("=");
+		return [part.slice(0, at).trim(), part.slice(at + 1).trim()];
+	}));
+	const timestamp = Number(parts.get("t"));
+	const provided = parts.get("v1");
+	if (!Number.isFinite(timestamp) || provided === void 0) return false;
+	const tolerance = input.toleranceSeconds ?? 300;
+	if (Math.abs(input.nowSeconds - timestamp) > tolerance) return false;
+	return timingSafeEqual(signBody(input.secret, timestamp, input.body), provided);
+}
+/**
+* Compare without leaking where the first difference is.
+*
+* `a === b` on a hex string returns as soon as two characters differ, and the
+* time it takes says how many leading characters were right — enough, over
+* many attempts, to recover a signature a byte at a time.
+*/
+function timingSafeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let difference = 0;
+	for (let index = 0; index < a.length; index += 1) difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
+	return difference === 0;
+}
+/**
+* How long to wait before attempt n, in milliseconds.
+*
+* Exponential, capped, with jitter. The jitter is the part that matters at
+* scale: without it every delivery queued by the same outage retries at the
+* same instant, and the receiver coming back up is knocked over by the
+* thundering herd of everyone's retries.
+*/
+function retryDelayMs(attempt, random) {
+	const base = Math.min(3e4 * 2 ** (attempt - 1), 216e5);
+	return Math.floor(base * random());
+}
+/** Eight attempts reach roughly 24 hours with this schedule. */
+const MAX_ATTEMPTS = 8;
+//#endregion
+//#region src/breaker.ts
+/**
+* Stopping, when a destination has plainly stopped listening.
+*
+* Failure is counted per WEBHOOK as well as per delivery. Enough consecutive failures
+* and the breaker opens: nothing is attempted for that webhook until a cool-down passes,
+* then exactly one delivery goes through as a probe. It succeeds and the breaker closes;
+* it fails and the cool-down starts again.
+*
+* `consecutiveFailures` and `openedAt` live on the RECORD rather than in the worker's
+* memory, so the state survives a restart and can be shown on a screen — a self-hoster
+* has no operations team watching a dashboard
+* ([0058](../../../docs/decisions/0058-a-breaker-per-destination.md)).
+*
+* Everything here is a pure function of a record and a clock: decisions tangled into
+* network code can only be tested by making requests.
+*/
+/**
+* How many consecutive failures open the breaker.
+*
+* Three, not one. A single failure is a bad minute — a deploy, a timeout, a
+* receiver restarting — and opening on it would make every routine blip a
+* visible outage. Three in a row is a destination that is not coming back on
+* its own.
+*/
+const BREAKER_THRESHOLD = 3;
+/**
+* How long the breaker stays shut before one probe is allowed through.
+*
+* Five minutes: long enough that a restarting receiver is finished, short
+* enough that nobody notices the delay once it recovers. The retry schedule
+* handles patience within a delivery; this handles patience about a
+* destination.
+*/
+const BREAKER_COOLDOWN_MS = 3e5;
+function breakerState(webhook, now) {
+	if (webhook.consecutiveFailures < 3) return "closed";
+	if (webhook.openedAt === null) return "closed";
+	return now.getTime() - new Date(webhook.openedAt).getTime() >= 3e5 ? "half-open" : "open";
+}
+/** Whether a delivery for this webhook may be attempted now. */
+function mayAttempt(webhook, now) {
+	return breakerState(webhook, now) !== "open";
+}
+/**
+* The webhook's health after one attempt against it.
+*
+* A success always closes the breaker completely. Decaying the count instead
+* would leave a destination that fails twice for every success permanently
+* one blip from opening, and that destination is working.
+*/
+function afterWebhookAttempt(webhook, ok, now) {
+	if (ok) return {
+		...webhook,
+		consecutiveFailures: 0,
+		openedAt: null
+	};
+	const consecutiveFailures = webhook.consecutiveFailures + 1;
+	const opening = consecutiveFailures >= 3;
+	return {
+		...webhook,
+		consecutiveFailures,
+		openedAt: opening ? now.toISOString() : webhook.openedAt
+	};
+}
+function healthOf(webhook, now) {
+	return {
+		id: webhook.id,
+		url: webhook.url,
+		state: breakerState(webhook, now),
+		consecutiveFailures: webhook.consecutiveFailures,
+		failingSince: webhook.openedAt
+	};
+}
+//#endregion
+//#region src/outbox.ts
+function afterAttempt(delivery, outcome, now, random) {
+	const attempt = delivery.attempt + 1;
+	if (outcome.ok) return {
+		...delivery,
+		attempt,
+		state: "delivered",
+		lastError: null
+	};
+	const reason = outcome.error ?? `Receiver answered ${String(outcome.status ?? 0)}.`;
+	if (attempt >= 8) return {
+		...delivery,
+		attempt,
+		state: "dead",
+		lastError: reason
+	};
+	return {
+		...delivery,
+		attempt,
+		state: "pending",
+		nextAttemptAt: new Date(now.getTime() + retryDelayMs(attempt, random)).toISOString(),
+		lastError: reason
+	};
+}
+/**
+* Drain one batch of due deliveries.
+*
+* Returns how many were attempted, so a caller can decide whether to come back
+* immediately or wait. Deliberately one batch rather than a loop that runs
+* forever: the thing that decides *when* to run belongs to the host, and a
+* function that never returns cannot be tested.
+*/
+/**
+* Returns how many were ATTEMPTED — deliveries skipped because their
+* destination's breaker is open do not count, so a caller polling until the
+* queue is quiet does not spin on a dead endpoint.
+*/
+async function drainOutbox(deps, limit = 20) {
+	const now = deps.now();
+	const due = await deps.storage.claimDueDeliveries(now.toISOString(), limit);
+	let skipped = 0;
+	for (const delivery of due) {
+		const webhook = await findWebhook(deps.storage, delivery.webhookId);
+		if (webhook === void 0) {
+			await deps.storage.updateDelivery({
+				...delivery,
+				state: "dead",
+				lastError: "The webhook it was queued for no longer exists."
+			});
+			continue;
+		}
+		if (!mayAttempt(webhook, now)) {
+			skipped += 1;
+			await deps.storage.updateDelivery({
+				...delivery,
+				nextAttemptAt: new Date(now.getTime() + BREAKER_COOLDOWN_MS).toISOString()
+			});
+			continue;
+		}
+		let outcome;
+		try {
+			outcome = await deps.send(delivery, webhook, Math.floor(now.getTime() / 1e3));
+		} catch (error) {
+			outcome = {
+				ok: false,
+				error: error instanceof Error ? error.message : String(error)
+			};
+		}
+		await deps.storage.updateDelivery(afterAttempt(delivery, outcome, now, deps.random));
+		await deps.storage.updateWebhook(afterWebhookAttempt(webhook, outcome.ok, now));
+	}
+	return due.length - skipped;
+}
+async function findWebhook(storage, id) {
+	const forms = await storage.listForms();
+	for (const form of forms) {
+		const found = (await storage.webhooksForForm(form.id)).find((hook) => hook.id === id);
+		if (found !== void 0) return found;
+	}
+}
+async function replayDelivery(deps, id) {
+	const delivery = await deps.storage.getDelivery(id);
+	if (delivery === void 0) return {
+		ok: false,
+		kind: "unknown"
+	};
+	if (delivery.state !== "dead") return {
+		ok: false,
+		kind: "not-dead",
+		state: delivery.state
+	};
+	const revived = {
+		...delivery,
+		attempt: 0,
+		state: "pending",
+		nextAttemptAt: deps.now().toISOString()
+	};
+	await deps.storage.updateDelivery(revived);
+	return {
+		ok: true,
+		delivery: revived
+	};
+}
+//#endregion
+//#region src/access.ts
+/**
+* Whether this caller may submit this form at all, before any of the work.
+*
+* Every branch that is not an explicit permission returns false. An allowlist
+* that exists but does not name the origin refuses; an origin header that is
+* absent refuses, because absent is not the same as allowed; an empty
+* allowlist refuses everything, because a list of no origins is a list.
+*/
+function maySubmit(form, actor, origin) {
+	if (actor === "authenticated") return true;
+	if (form.accessSubmit !== "public") return false;
+	const allowed = form.allowedOrigins;
+	if (allowed === null) return true;
+	if (origin === void 0) return false;
+	return allowed.includes(origin);
+}
+//#endregion
+//#region src/uploads.ts
+/**
+* Agree where a file will go, and refuse it before a byte is sent.
+*
+* Checking here rather than after the upload is the difference between
+* refusing a 2 GB file and receiving one first. The browser's own `accept` and
+* size limits are a convenience for the person filling the form in; these are
+* the rule, because somebody posting to the endpoint directly has neither.
+*/
+async function offerUpload(deps, input) {
+	if (!maySubmit(input.form, input.actor, input.origin)) return {
+		ok: false,
+		reason: "not_allowed"
+	};
+	const def = fileFieldAt(input.schema, input.field);
+	if (def === void 0) return {
+		ok: false,
+		reason: "unknown_field"
+	};
+	if (def.type !== "file") return {
+		ok: false,
+		reason: "not_a_file_field"
+	};
+	if (def.maxFileSize !== void 0 && input.size > def.maxFileSize) return {
+		ok: false,
+		reason: "too_large"
+	};
+	if (!accepted(def.accept, input.name, input.contentType)) return {
+		ok: false,
+		reason: "not_accepted"
+	};
+	const id = deps.newId();
+	const file = {
+		id,
+		formId: input.form.id,
+		name: input.name,
+		size: input.size,
+		contentType: input.contentType,
+		storageKey: `${input.form.id}/${id}`,
+		state: "offered",
+		createdAt: deps.now().toISOString(),
+		submissionId: null
+	};
+	await deps.storage.insertFile(file);
+	return {
+		ok: true,
+		file
+	};
+}
+/**
+* Which files a submission may claim, checked but not yet claimed.
+*
+* The claiming itself is `insertSubmission`'s job, in the same call that
+* stores the submission, so one COMMIT decides both — the same reasoning
+* that put the webhook queue there. A submission exists if and only if the
+* files it names belong to it. Claiming separately gives the two failures
+* nobody can debug: a rolled-back submission leaving files claimed against
+* nothing, or an accepted submission referencing bytes the collector is about
+* to delete.
+*
+* Refuses rather than skips. A submission naming a file that does not exist,
+* belongs to another form, or is already claimed is not a submission to fix up
+* quietly: the first is a bug or somebody guessing ids; the second is how an
+* id from a form you may submit to would let you attach a file from one you
+* may not; the third would make deleting a submission either leak bytes or
+* break a different one.
+*/
+async function filesToClaim(storage, input) {
+	const ids = referencedFileIds(input.schema, input.data);
+	if (ids.length === 0) return {
+		ok: true,
+		ids: []
+	};
+	const unknown = [];
+	const claimable = [];
+	for (const id of ids) {
+		const file = await storage.getFile(id);
+		if (file === void 0 || file.formId !== input.formId || file.state !== "stored") {
+			unknown.push(id);
+			continue;
+		}
+		claimable.push(file);
+	}
+	if (unknown.length > 0) return {
+		ok: false,
+		unknown
+	};
+	return {
+		ok: true,
+		ids: claimable.map((file) => file.id)
+	};
+}
+/**
+* Files nobody claimed, old enough that nobody is going to.
+*
+* Returns the rows rather than deleting anything: the host removes the bytes
+* and then the rows, in that order, because a row without bytes is a broken
+* reference and bytes without a row are invisible rubbish. Of the two, the
+* second is the one you never find out about.
+*/
+async function collectAbandonedFiles(storage, now, afterHours) {
+	const before = (/* @__PURE__ */ new Date(now.getTime() - afterHours * 36e5)).toISOString();
+	return storage.abandonedFiles(before);
+}
+/** The field at a data path, with `[]` treated as "inside this repeater". */
+function fileFieldAt(schema, path) {
+	const segments = path.replace(/\[\]/g, "").split(".").filter((segment) => segment !== "");
+	let fields = flattenPages(schema.model.fields);
+	let found;
+	for (const segment of segments) {
+		found = fields.find((field) => field.key === segment);
+		if (found === void 0) return void 0;
+		fields = flattenPages(found.fields ?? []);
+	}
+	return found;
+}
+/** A page contributes no segment to a data path. */
+function flattenPages(fields) {
+	const out = [];
+	for (const field of fields) if (field.type === "page") out.push(...flattenPages(field.fields ?? []));
+	else out.push(field);
+	return out;
+}
+/** The HTML `accept` grammar, as the engine reads it. */
+function accepted(accept, name, contentType) {
+	if (accept === void 0 || accept.length === 0) return true;
+	const lowerName = name.toLowerCase();
+	const lowerType = contentType.toLowerCase();
+	return accept.some((raw) => {
+		const rule = raw.trim().toLowerCase();
+		if (rule === "") return false;
+		if (rule.startsWith(".")) return lowerName.endsWith(rule);
+		if (rule.endsWith("/*")) return lowerType.startsWith(rule.slice(0, -1));
+		return lowerType === rule;
+	});
+}
+/**
+* Every file id a submission references.
+*
+* Driven by the SCHEMA, not by the shape of the values. Recognising an
+* attachment by "an object with an id" would let a client omit a property and
+* have its reference quietly not claimed — the submission would be accepted
+* carrying a dangling file id, and the collector would delete the bytes a day
+* later. Reading only the paths the model says are file fields cannot be
+* fooled that way, and a text answer that happens to look like a file is not
+* one.
+*
+* A repeater contributes rows the schema cannot know about, so the walk
+* expands over whatever rows the data actually has.
+*/
+function referencedFileIds(schema, data) {
+	const ids = [];
+	const walk = (fields, value) => {
+		if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+		const record = value;
+		for (const field of flattenPages(fields)) {
+			const held = record[field.key];
+			if (held === void 0) continue;
+			if (field.type === "file") {
+				if (!Array.isArray(held)) continue;
+				for (const entry of held) {
+					const id = entry?.["id"];
+					if (typeof id === "string") ids.push(id);
+				}
+				continue;
+			}
+			if (field.type === "group") {
+				walk(field.fields ?? [], held);
+				continue;
+			}
+			if (field.type === "repeater" && Array.isArray(held)) for (const row of held) walk(field.fields ?? [], row);
+		}
+	};
+	walk(schema.model.fields, data);
+	return ids;
+}
+/** Re-exported so a host can see which paths a schema's file fields live at. */
+function fileFieldPaths(schema) {
+	return modelDataPaths(schema.model).filter((path) => fileFieldAt(schema, path)?.type === "file");
+}
+//#endregion
+//#region src/redos.ts
+/** Every `pattern` in the model, with the data path of the field it sits on. */
+function patternsIn(fields, prefix) {
+	const found = [];
+	for (const field of fields) {
+		const path = field.type === "page" ? prefix : field.type === "repeater" ? `${prefix}${field.key}[].` : field.type === "group" ? `${prefix}${field.key}.` : `${prefix}${field.key}`;
+		if (typeof field.pattern === "string" && field.pattern !== "") found.push({
+			path,
+			pattern: field.pattern
+		});
+		if (field.fields !== void 0) found.push(...patternsIn(field.fields, path));
+	}
+	return found;
+}
+/**
+* The patterns in this schema that an attacker could exploit, or an empty array
+* when there are none.
+*
+* A pattern `recheck` cannot decide about is ACCEPTED. Refusing on `unknown`
+* would make publishing depend on an analysis timeout, which is a worse failure
+* than the one being prevented — an author whose legitimate form stops
+* publishing intermittently has no way to act on that.
+*/
+async function unsafePatterns(schema) {
+	const unsafe = [];
+	for (const { path, pattern } of patternsIn(schema.model.fields, "")) {
+		const diagnostics = await check(`^(?:${pattern})$`, "");
+		if (diagnostics.status !== "vulnerable") continue;
+		const complexity = diagnostics.complexity;
+		unsafe.push({
+			path,
+			pattern,
+			complexity: complexity === void 0 ? "unknown" : complexity.type === "polynomial" ? `polynomial degree ${String(complexity.degree)}` : complexity.type
+		});
+	}
+	return unsafe;
+}
+//#endregion
 //#region src/use-cases.ts
 /**
 * Publish a schema as a form's next version.
@@ -31,6 +691,26 @@ async function publishForm(deps, input) {
 			message: error instanceof Error ? error.message : String(error)
 		};
 	}
+	const problems = expressionProblems(schema);
+	if (problems.length > 0) return {
+		ok: false,
+		kind: "invalid_logic",
+		message: problems.map((problem) => problem.message).join("\n")
+	};
+	const unsafe = await unsafePatterns(schema);
+	if (unsafe.length > 0) return {
+		ok: false,
+		kind: "unsafe_pattern",
+		patterns: unsafe
+	};
+	if (deps.optionsSources !== void 0) {
+		const unknown = sourceNamesIn(schema).filter((name) => deps.optionsSources?.[name] === void 0);
+		if (unknown.length > 0) return {
+			ok: false,
+			kind: "unknown_options_source",
+			sources: unknown
+		};
+	}
 	const hash = schemaHash(schema);
 	const existing = await deps.storage.getFormByPath(input.path);
 	if (existing !== void 0) {
@@ -44,14 +724,21 @@ async function publishForm(deps, input) {
 		};
 		const version = await deps.storage.latestVersionNumber(existing.id) + 1;
 		const versionId = deps.newId();
-		await deps.storage.insertVersion({
-			id: versionId,
-			formId: existing.id,
-			version,
-			schema,
-			schemaHash: hash
+		await deps.storage.publishVersion({
+			version: {
+				id: versionId,
+				formId: existing.id,
+				version,
+				schema,
+				schemaHash: hash
+			},
+			audit: publishAudit(deps, input, {
+				path: input.path,
+				version,
+				hash,
+				sources: sourceNamesIn(schema)
+			})
 		});
-		await deps.storage.setCurrentVersion(existing.id, versionId);
 		return {
 			ok: true,
 			formId: existing.id,
@@ -62,19 +749,28 @@ async function publishForm(deps, input) {
 	}
 	const formId = deps.newId();
 	const versionId = deps.newId();
-	await deps.storage.createForm({
-		id: formId,
-		path: input.path,
-		currentVersionId: null
-	});
-	await deps.storage.insertVersion({
-		id: versionId,
-		formId,
-		version: 1,
-		schema,
-		schemaHash: hash
+	await deps.storage.publishVersion({
+		form: {
+			id: formId,
+			path: input.path,
+			currentVersionId: null,
+			accessSubmit: "authenticated",
+			allowedOrigins: null
+		},
+		version: {
+			id: versionId,
+			formId,
+			version: 1,
+			schema,
+			schemaHash: hash
+		},
+		audit: publishAudit(deps, input, {
+			path: input.path,
+			version: 1,
+			hash,
+			sources: sourceNamesIn(schema)
+		})
 	});
-	await deps.storage.setCurrentVersion(formId, versionId);
 	return {
 		ok: true,
 		formId,
@@ -83,6 +779,31 @@ async function publishForm(deps, input) {
 		schemaHash: hash
 	};
 }
+/**
+* The audit row for a publish, built here so it can travel INSIDE the
+* transaction rather than being appended after it.
+*
+* Before this it was written by the route once all three storage calls had
+* returned, which meant a publish could half-apply and still be recorded as
+* having happened. Now it rolls back with everything else.
+*/
+function publishAudit(deps, input, about) {
+	return {
+		id: deps.newId(),
+		at: deps.nowIso(),
+		action: "form.published",
+		subject: about.path,
+		...input.actor === void 0 ? {} : {
+			actorKind: input.actor.kind,
+			actorId: input.actor.id
+		},
+		detail: {
+			version: about.version,
+			schemaHash: about.hash,
+			...about.sources.length === 0 ? {} : { optionsSources: [...about.sources].sort().join(", ") }
+		}
+	};
+}
 async function resolveForm(deps, path) {
 	const form = await deps.storage.getFormByPath(path);
 	if (form === void 0 || form.currentVersionId === null) return void 0;
@@ -105,7 +826,32 @@ async function resolveForm(deps, path) {
 * are stripped, so a client cannot smuggle data by lying about what was shown.
 * Client validation is UX; this is truth.
 */
+/**
+* Change who may submit a form, and from where.
+*
+* Separate from publishing on purpose: access is a property of the deployment,
+* and changing it must not mint a new immutable form version or invalidate the
+* schema hash every client is holding.
+*/
+async function setFormAccess(deps, input) {
+	const form = await deps.storage.getFormByPath(input.path);
+	if (form === void 0) return { ok: false };
+	await deps.storage.updateFormAccess(form.id, {
+		accessSubmit: input.submit,
+		allowedOrigins: input.allowedOrigins ?? null
+	});
+	return { ok: true };
+}
 async function createSubmission(deps, input) {
+	const form = await deps.storage.getFormByPath(input.path);
+	if (form === void 0) return {
+		ok: false,
+		kind: "unknown_form"
+	};
+	if (!maySubmit(form, input.actor ?? "anonymous", input.origin)) return {
+		ok: false,
+		kind: "forbidden"
+	};
 	const current = await resolveForm(deps, input.path);
 	if (current === void 0) return {
 		ok: false,
@@ -127,13 +873,61 @@ async function createSubmission(deps, input) {
 		kind: "invalid",
 		errors: outcome.errors
 	};
+	const membership = await checkMembership(current.schema, engine.value(), deps.optionsSources);
+	if (!membership.ok) return membership.kind === "invalid" ? {
+		ok: false,
+		kind: "invalid",
+		errors: membership.errors
+	} : {
+		ok: false,
+		kind: "source_unavailable",
+		source: membership.source
+	};
 	const id = deps.newId();
+	const hooks = await deps.storage.webhooksForForm(current.formId);
+	const body = JSON.stringify({
+		id,
+		form: input.path,
+		data: engine.value()
+	});
+	const queued = hooks.map((hook) => ({
+		id: deps.newId(),
+		webhookId: hook.id,
+		submissionId: id,
+		eventId: deps.newId(),
+		body,
+		attempt: 0,
+		nextAttemptAt: deps.nowIso(),
+		state: "pending",
+		lastError: null
+	}));
+	const claimable = await filesToClaim(deps.storage, {
+		schema: current.schema,
+		formId: current.formId,
+		data: engine.value()
+	});
+	if (!claimable.ok) return {
+		ok: false,
+		kind: "invalid",
+		errors: { _files: [`unknown_file:${claimable.unknown.join(",")}`] }
+	};
+	const at = deps.nowIso();
 	await deps.storage.insertSubmission({
 		id,
 		formId: current.formId,
 		formVersionId: current.versionId,
 		data: engine.value(),
-		submittedAt: deps.nowIso()
+		submittedAt: at
+	}, queued, claimable.ids, {
+		id: deps.newId(),
+		at,
+		action: "submission.created",
+		subject: input.path,
+		detail: {
+			submissionId: id,
+			version: current.version,
+			authenticated: input.actor === "authenticated"
+		}
 	});
 	return {
 		ok: true,
@@ -223,9 +1017,54 @@ function csvCell(value) {
 }
 /** Save (or re-save) a partial form, bound to the CURRENT version. Undefined
 *  for an unknown form. */
+/**
+* The token that proves the bearer started this draft.
+*
+* HMAC over the form and the draft id, the same stateless shape the
+* proof-of-work challenge uses
+* ([0059](../../../docs/decisions/0059-proof-of-work-not-a-captcha.md)): no
+* second table, and no lookup before the check. Bound to the FORM as well as the
+* id so a token cannot be carried to a draft of another form that happens to
+* share an id.
+*/
+function draftToken(secret, formId, draftId) {
+	return bytesToHex(hmac(sha256, utf8ToBytes(secret), utf8ToBytes(`${formId}:${draftId}`)));
+}
+/**
+* Compared in constant time.
+*
+* A byte-at-a-time comparison that returns early leaks how much of a guess was
+* right, and a token is guessed one byte at a time by exactly that signal.
+*/
+function sameToken(a, b) {
+	if (a.length !== b.length) return false;
+	let differences = 0;
+	for (let at = 0; at < a.length; at += 1) differences |= a.charCodeAt(at) ^ b.charCodeAt(at);
+	return differences === 0;
+}
+/**
+* Start a draft: the server picks the id, and signs it.
+*
+* The id is the server's because an id a caller supplies is an id a caller can
+* enumerate — and enumerating them was enough to read other people's
+* part-filled answers.
+*/
+async function startDraft(deps, input) {
+	const current = await resolveForm(deps, input.path);
+	if (current === void 0) return void 0;
+	const draftId = deps.newId();
+	return {
+		draftId,
+		token: draftToken(deps.draftSecret, current.formId, draftId)
+	};
+}
 async function saveDraft(deps, input) {
 	const current = await resolveForm(deps, input.path);
 	if (current === void 0) return void 0;
+	if (!sameToken(input.token, draftToken(deps.draftSecret, current.formId, input.draftId))) return {
+		version: current.version,
+		saved: false
+	};
 	await deps.storage.upsertDraft({
 		id: input.draftId,
 		formId: current.formId,
@@ -233,7 +1072,10 @@ async function saveDraft(deps, input) {
 		data: input.data,
 		updatedAt: deps.nowIso()
 	});
-	return { version: current.version };
+	return {
+		version: current.version,
+		saved: true
+	};
 }
 /**
 * Resume a draft — and migrate it LAZILY if the form was republished since,
@@ -250,6 +1092,7 @@ async function saveDraft(deps, input) {
 async function resumeDraft(deps, input) {
 	const current = await resolveForm(deps, input.path);
 	if (current === void 0) return void 0;
+	if (!sameToken(input.token, draftToken(deps.draftSecret, current.formId, input.draftId))) return;
 	const draft = await deps.storage.getDraft(current.formId, input.draftId);
 	if (draft === void 0) return void 0;
 	if (draft.formVersionId === current.versionId) return {
@@ -389,14 +1232,26 @@ async function listVersions(deps, path) {
 */
 function createMemoryStorage() {
 	const forms = /* @__PURE__ */ new Map();
+	const webhooks = /* @__PURE__ */ new Map();
+	const deliveries = /* @__PURE__ */ new Map();
 	const versions = /* @__PURE__ */ new Map();
 	const submissions = [];
+	const audits = [];
+	const spentChallenges = /* @__PURE__ */ new Map();
 	const drafts = /* @__PURE__ */ new Map();
 	const users = /* @__PURE__ */ new Map();
 	const apiKeys = /* @__PURE__ */ new Map();
+	const files = /* @__PURE__ */ new Map();
 	return {
 		getFormByPath: async (path) => [...forms.values()].find((form) => form.path === path),
 		listForms: async () => [...forms.values()].map((form) => ({ ...form })),
+		updateFormAccess: async (formId, access) => {
+			const form = forms.get(formId);
+			if (form !== void 0) forms.set(formId, {
+				...form,
+				...access
+			});
+		},
 		createForm: async (record) => {
 			forms.set(record.id, { ...record });
 		},
@@ -408,12 +1263,78 @@ function createMemoryStorage() {
 		insertVersion: async (record) => {
 			versions.set(record.id, { ...record });
 		},
+		publishVersion: async ({ form, version, audit }) => {
+			if (form !== void 0) forms.set(form.id, { ...form });
+			const target = forms.get(version.formId);
+			if (target === void 0) throw new Error(`No form "${version.formId}"`);
+			versions.set(version.id, { ...version });
+			target.currentVersionId = version.id;
+			if (audit !== void 0) audits.push({ ...audit });
+		},
 		getVersionById: async (id) => versions.get(id),
 		findVersionByHash: async (formId, hash) => [...versions.values()].find((version) => version.formId === formId && version.schemaHash === hash),
 		latestVersionNumber: async (formId) => Math.max(0, ...[...versions.values()].filter((version) => version.formId === formId).map((version) => version.version)),
-		insertSubmission: async (record) => {
+		webhooksForForm: async (formId) => [...webhooks.values()].filter((hook) => hook.formId === formId).map((hook) => ({ ...hook })),
+		insertWebhook: async (record) => {
+			webhooks.set(record.id, { ...record });
+		},
+		updateWebhook: async (record) => {
+			webhooks.set(record.id, { ...record });
+		},
+		listWebhooks: async () => [...webhooks.values()].map((w) => ({ ...w })),
+		deadDeliveries: async (limit) => [...deliveries.values()].filter((delivery) => delivery.state === "dead").slice(0, limit).map((delivery) => ({ ...delivery })),
+		getDelivery: async (id) => {
+			const found = deliveries.get(id);
+			return found === void 0 ? void 0 : { ...found };
+		},
+		claimDueDeliveries: async (nowIso, limit) => [...deliveries.values()].filter((entry) => entry.state === "pending" && entry.nextAttemptAt <= nowIso).sort((a, b) => a.nextAttemptAt.localeCompare(b.nextAttemptAt)).slice(0, limit).map((entry) => ({ ...entry })),
+		updateDelivery: async (record) => {
+			deliveries.set(record.id, { ...record });
+		},
+		insertFile: async (record) => {
+			files.set(record.id, { ...record });
+		},
+		getFile: async (id) => {
+			const found = files.get(id);
+			return found === void 0 ? void 0 : { ...found };
+		},
+		updateFile: async (record) => {
+			files.set(record.id, { ...record });
+		},
+		abandonedFiles: async (beforeIso) => [...files.values()].filter((file) => file.state !== "claimed" && file.createdAt < beforeIso).map((file) => ({ ...file })),
+		deleteFiles: async (ids) => {
+			for (const id of ids) files.delete(id);
+		},
+		insertSubmission: async (record, queued, claimFileIds, audit) => {
 			submissions.push({ ...record });
+			for (const delivery of queued ?? []) deliveries.set(delivery.id, { ...delivery });
+			for (const id of claimFileIds ?? []) {
+				const file = files.get(id);
+				if (file !== void 0) files.set(id, {
+					...file,
+					state: "claimed",
+					submissionId: record.id
+				});
+			}
+			if (audit !== void 0) audits.push({ ...audit });
+		},
+		spendChallenge: async (challenge, expiresAtIso) => {
+			if (spentChallenges.has(challenge)) return false;
+			spentChallenges.set(challenge, expiresAtIso);
+			return true;
+		},
+		forgetExpiredChallenges: async (beforeIso) => {
+			let dropped = 0;
+			for (const [challenge, expires] of [...spentChallenges]) if (expires < beforeIso) {
+				spentChallenges.delete(challenge);
+				dropped += 1;
+			}
+			return dropped;
+		},
+		recordAudit: async (entry) => {
+			audits.push({ ...entry });
 		},
+		listAudit: async (limit) => [...audits].reverse().slice(0, limit),
 		listSubmissions: async () => [...submissions],
 		listSubmissionsByForm: async (formId) => submissions.filter((record) => record.formId === formId).reverse(),
 		listVersionsByForm: async (formId) => [...versions.values()].filter((version) => version.formId === formId).sort((a, b) => b.version - a.version),
@@ -541,6 +1462,87 @@ function can(actor, action) {
 	return PERMISSIONS[actor.role].has(action);
 }
 //#endregion
-export { authenticateApiKey, authenticateLocal, can, createApiKey, createLocalUser, createMemoryStorage, createSubmission, exportCsv, listForms, listSubmissions, listVersions, publishForm, resolveForm, resumeDraft, saveDraft };
+//#region src/address.ts
+/**
+* Deciding whether an address is somewhere this server may fetch from.
+*
+* A self-hosted formancy sits inside somebody's private network and webhook
+* URLs are written by whoever can edit a form, which makes the server a
+* confused deputy: it can reach the database, the metadata service and every
+* internal admin panel, and it will fetch whatever it is told to.
+*
+* This half is pure — given an address, is it private — so it lives here and is
+* tested exhaustively. The rest lives in @formancy/server, because it cannot be
+* pure: parsing a URL needs `URL`, and resolving a hostname then connecting to
+* the address that was checked, rather than re-resolving, needs Node's DNS and
+* a custom agent. This package has no @types/node by design, and hand-rolling
+* a URL parser for a security check is how such a check gets quietly wrong.
+* All three parts are necessary. Validating a URL and then handing it to fetch is defeated by DNS
+* rebinding — the name resolves to a public address for the check and a private
+* one for the request — and that is the difference between a mitigation and
+* theatre.
+*/
+/** Everything before the first dot, as four octets, or undefined. */
+function ipv4Octets(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return void 0;
+	const octets = parts.map((part) => {
+		if (!/^\d{1,3}$/.test(part)) return NaN;
+		return Number(part);
+	});
+	if (octets.some((octet) => Number.isNaN(octet) || octet > 255)) return void 0;
+	return octets;
+}
+/**
+* Whether this address is one the server must not be pointed at.
+*
+* Unparseable input counts as private. An address this cannot classify is one
+* it cannot vouch for, and the safe direction is refusing to fetch.
+*/
+function isPrivateAddress(address) {
+	const trimmed = address.trim().toLowerCase();
+	if (trimmed === "") return true;
+	const bare = trimmed.replace(/^\[|\]$/g, "").split("%")[0] ?? "";
+	const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(bare);
+	if (mapped?.[1] !== void 0) return isPrivateAddress(mapped[1]);
+	const octets = ipv4Octets(bare);
+	if (octets !== void 0) {
+		const [a, b] = octets;
+		if (a === 0) return true;
+		if (a === 10) return true;
+		if (a === 127) return true;
+		if (a === 169 && b === 254) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 100 && b >= 64 && b <= 127) return true;
+		if (a === 192 && b === 0) return true;
+		if (a === 198 && (b === 18 || b === 19)) return true;
+		if (a >= 224) return true;
+		return false;
+	}
+	if (bare.includes(":")) {
+		if (bare === "::" || bare === "::1") return true;
+		if (/^f[cd]/.test(bare)) return true;
+		if (/^fe[89ab]/.test(bare)) return true;
+		if (/^ff/.test(bare)) return true;
+		return false;
+	}
+	return true;
+}
+/**
+* Whether this is a literal IP address rather than a hostname.
+*
+* The two need different treatment and conflating them breaks the check in
+* both directions: `isPrivateAddress` fails closed on anything it cannot
+* parse, which is correct for an address that came back from DNS and wrong for
+* `example.ch`, where it would refuse every hostname in the world.
+*/
+function isIpLiteral(host) {
+	const bare = host.trim().replace(/^\[|\]$/g, "");
+	if (/^\d{1,3}(\.\d{1,3}){3}$/.test(bare)) return true;
+	return bare.includes(":");
+}
+//#endregion
+export { AUDIT_ACTIONS, BREAKER_COOLDOWN_MS, BREAKER_THRESHOLD, CHALLENGE_TTL_SECONDS, DEFAULT_MAX_NUMBER, EVENT_ID_HEADER, MAX_ATTEMPTS, SIGNATURE_HEADER, afterAttempt, afterWebhookAttempt, auditedBy, authenticateApiKey, authenticateLocal, breakerState, can, checkMembership, collectAbandonedFiles, createApiKey, createLocalUser, createMemoryStorage, createSubmission, decodeSolution, deliveryHeaders, drainOutbox, encodeSolution, exportCsv, fileFieldPaths, filesToClaim, hashOf, healthOf, isIpLiteral, isPrivateAddress, listForms, listSubmissions, listVersions, mayAttempt, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, retryDelayMs, saveDraft, setFormAccess, signBody, signedPayload, solveChallenge, sourceNamesIn, sourcedAnswers, startDraft, unsafePatterns, verifySignature, verifySolution };
 
 //# sourceMappingURL=index.mjs.map