@formancy/server 0.1.0 → 0.2.0

package/dist/file-collector-WWc-eo8h.mjs

@@ -0,0 +1,1464 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import Fastify from "fastify";
+import rateLimit from "@fastify/rate-limit";
+import { auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, healthOf, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, saveDraft, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
+import { hash, verify } from "@node-rs/argon2";
+import { SignJWT, jwtVerify } from "jose";
+import { and, desc, eq, inArray, lt, lte, max, ne } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/postgres-js";
+import { integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import { createReadStream } from "node:fs";
+import { mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+//#region src/auth-runtime.ts
+/**
+* The real cryptography, confined to the composition root: argon2id for
+* secrets at rest, an HMAC-signed short-lived access token for sessions, and
+* a CSPRNG for API keys. server-core never sees any of this — it is handed
+* hash/verify/random functions and stays deterministic under test.
+*
+* HS256 rather than EdDSA for the session token, deliberately for this phase:
+* one secret in one env var is the self-hosting story a single-container
+* deployment can operate, and the signing scheme is an implementation detail
+* of a token that lives fifteen minutes. Revisit with key rotation.
+*/
+function realSecretHashing() {
+	return {
+		hashSecret: (secret) => hash(secret),
+		verifySecret: async (secret, digest) => {
+			try {
+				return await verify(digest, secret);
+			} catch {
+				return false;
+			}
+		}
+	};
+}
+function realRandomToken() {
+	return randomBytes(30).toString("base64url");
+}
+const TOKEN_LIFETIME = "15m";
+function createSessionTokens(secret) {
+	if (secret.length < 32) throw new Error("FORMANCY_AUTH_SECRET must be at least 32 characters. Generate one: openssl rand -base64 33");
+	const key = new TextEncoder().encode(secret);
+	return {
+		async issue(actor) {
+			return new SignJWT({
+				role: actor.role,
+				kind: actor.kind
+			}).setProtectedHeader({ alg: "HS256" }).setSubject(actor.id).setIssuedAt().setExpirationTime(TOKEN_LIFETIME).sign(key);
+		},
+		async verify(token) {
+			try {
+				const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+				const role = payload["role"];
+				const kind = payload["kind"];
+				if (typeof payload.sub !== "string" || role !== "admin" && role !== "editor" && role !== "viewer" || kind !== "user" && kind !== "apiKey") return;
+				return {
+					id: payload.sub,
+					role,
+					kind
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/app.ts
+const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
+/** Base64 JSON, the shape an ALTCHA client already produces. */
+const CHALLENGE_HEADER = "x-formancy-challenge";
+/** Proves the bearer started this draft. Lower-case: Fastify normalises. */
+const DRAFT_TOKEN_HEADER = "x-formancy-draft-token";
+const API_KEY_HEADER = "x-formancy-api-key";
+/**
+* The HTTP surface, split into two planes.
+*
+* PUBLIC — what a person filling a form needs: resolve, submit, drafts. These
+* stay unauthenticated by design; anonymous-submission hardening is its own
+* upcoming step and is opt-in per form.
+*
+* MANAGEMENT — everything an operator does: publish, catalog, submissions,
+* export, users, keys. Authenticated via a session token (login) or an API
+* key header, authorized through server-core's one-table can().
+*
+* This file is the composition root, so THIS is where ambient reality enters:
+* randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays
+* injected and replayable.
+*/
+async function createApp(storage, options) {
+	const app = Fastify({
+		logger: false,
+		bodyLimit: options.bodyLimitBytes ?? 262144
+	});
+	const maxFileBytes = options.maxFileBytes ?? 10485760;
+	const fileStore = options.fileStore;
+	app.addContentTypeParser("*", {
+		parseAs: "buffer",
+		bodyLimit: maxFileBytes
+	}, (_request, body, done) => {
+		done(null, body);
+	});
+	const submissionLimit = options.submissionRateLimit ?? {
+		max: 30,
+		timeWindowMs: 6e4
+	};
+	const loginLimit = options.loginRateLimit ?? {
+		max: 10,
+		timeWindowMs: 6e4
+	};
+	const challengeSecret = options.challengeSecret;
+	await app.register(rateLimit, {
+		global: false,
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	});
+	const deps = {
+		storage,
+		newId: () => randomUUID(),
+		nowIso: () => (/* @__PURE__ */ new Date()).toISOString(),
+		draftSecret: options.authSecret,
+		...options.optionsSources === void 0 ? {} : { optionsSources: options.optionsSources },
+		capabilities: {
+			now: () => Date.now(),
+			today: () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+			random: () => Math.random()
+		}
+	};
+	const authDeps = {
+		storage,
+		newId: deps.newId,
+		nowIso: deps.nowIso,
+		randomToken: realRandomToken,
+		...realSecretHashing()
+	};
+	const sessions = createSessionTokens(options.authSecret);
+	if (options.bootstrapAdmin !== void 0) {
+		if (await storage.getUserByEmail(options.bootstrapAdmin.email) === void 0) {
+			const outcome = await createLocalUser(authDeps, {
+				...options.bootstrapAdmin,
+				role: "admin"
+			});
+			if (!outcome.ok) throw new Error(`Bootstrap admin rejected: ${outcome.message}`);
+		}
+	}
+	async function actorOf(request) {
+		const bearer = request.headers.authorization;
+		if (typeof bearer === "string" && bearer.startsWith("Bearer ")) return sessions.verify(bearer.slice(7));
+		const apiKey = request.headers[API_KEY_HEADER];
+		if (typeof apiKey === "string" && apiKey !== "") {
+			const outcome = await authenticateApiKey(authDeps, apiKey);
+			return outcome.ok ? outcome.actor : void 0;
+		}
+	}
+	/** 401 without an identity, 403 with one that lacks the permission — the
+	*  difference tells a client whether to log in or to give up. */
+	function requires(action) {
+		return async (request, reply) => {
+			const actor = await actorOf(request);
+			if (actor === void 0) return reply.code(401).send({ error: "unauthenticated" });
+			if (!can(actor, action)) return reply.code(403).send({
+				error: "forbidden",
+				action
+			});
+			request.actor = actor;
+		};
+	}
+	/**
+	* Append an audit row for something that has already happened.
+	*
+	* Never throws. An export that succeeded and an audit row that did not is
+	* bad; an export that 500s because the audit row failed, after the rows have
+	* already been written to the response, is worse and helps nobody. So the
+	* failure is logged loudly at error level and the request stands.
+	*
+	* For a mutation that HAS a transaction, do not use this — pass the entry
+	* into that call so the two commit together. `insertSubmission` is currently
+	* the only one.
+	*/
+	async function audit(request, draft) {
+		const actor = request.actor;
+		try {
+			await deps.storage.recordAudit({
+				id: deps.newId(),
+				at: deps.nowIso(),
+				requestId: request.id,
+				...auditedBy(actor, draft)
+			});
+		} catch (error) {
+			request.log.error({
+				err: error,
+				action: draft.action
+			}, "audit row could not be written");
+		}
+	}
+	app.post("/auth/login", { config: { rateLimit: {
+		max: loginLimit.max,
+		timeWindow: loginLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.email !== "string" || typeof body.password !== "string") return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { email, password }."
+		});
+		const outcome = await authenticateLocal(authDeps, {
+			email: body.email,
+			password: body.password
+		});
+		if (!outcome.ok) {
+			await audit(request, {
+				action: "auth.login.failed",
+				subject: body.email
+			});
+			return reply.code(401).send({ error: "invalid_credentials" });
+		}
+		await audit(request, {
+			action: "auth.login",
+			subject: body.email,
+			actorKind: "user",
+			actorId: outcome.actor.id
+		});
+		return reply.send({
+			token: await sessions.issue(outcome.actor),
+			role: outcome.actor.role
+		});
+	});
+	app.post("/users", { preHandler: requires("user.create") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.email !== "string" || typeof body.password !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { email, password, role }."
+		});
+		const outcome = await createLocalUser(authDeps, {
+			email: body.email,
+			password: body.password,
+			role: body.role
+		});
+		if (!outcome.ok) return reply.code(422).send({
+			error: "rejected",
+			message: outcome.message
+		});
+		return reply.code(201).send({ id: outcome.id });
+	});
+	app.post("/api-keys", { preHandler: requires("apiKey.create") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.name !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { name, role }."
+		});
+		const outcome = await createApiKey(authDeps, {
+			name: body.name,
+			role: body.role
+		});
+		if (!outcome.ok) return reply.code(422).send({
+			error: "rejected",
+			message: outcome.message
+		});
+		return reply.code(201).send({
+			id: outcome.id,
+			secret: outcome.secret
+		});
+	});
+	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.path !== "string" || body.path === "" || body.schema === void 0) return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { path, schema }."
+		});
+		const outcome = await publishForm(deps, {
+			path: body.path,
+			schema: body.schema,
+			actor: request.actor
+		});
+		if (!outcome.ok) switch (outcome.kind) {
+			case "invalid_schema": return reply.code(422).send({
+				error: outcome.kind,
+				errors: outcome.errors
+			});
+			case "unsafe_pattern": return reply.code(422).send({
+				error: outcome.kind,
+				patterns: outcome.patterns
+			});
+			case "invalid_logic": return reply.code(422).send({
+				error: outcome.kind,
+				message: outcome.message
+			});
+			case "unknown_options_source": return reply.code(422).send({
+				error: outcome.kind,
+				sources: outcome.sources
+			});
+		}
+		return reply.code(201).send({
+			version: outcome.version,
+			schemaHash: outcome.schemaHash
+		});
+	});
+	app.put("/f/:path/access", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const { path } = request.params;
+		const body = request.body;
+		const submit = body?.submit;
+		if (submit !== "authenticated" && submit !== "public") return reply.code(400).send({
+			error: "invalid_access",
+			message: "submit must be \"authenticated\" or \"public\"."
+		});
+		const origins = body?.allowedOrigins;
+		if (origins !== void 0 && !(Array.isArray(origins) && origins.every((o) => typeof o === "string"))) return reply.code(400).send({
+			error: "invalid_access",
+			message: "allowedOrigins must be an array of strings, or absent for no allowlist."
+		});
+		if (!(await setFormAccess(deps, {
+			path,
+			submit,
+			...origins === void 0 ? {} : { allowedOrigins: origins }
+		})).ok) return reply.code(404).send({ error: "unknown_form" });
+		await audit(request, {
+			action: "form.access.changed",
+			subject: path,
+			detail: {
+				submit,
+				allowedOrigins: origins === void 0 ? "unchanged" : origins.join(" ")
+			}
+		});
+		return reply.code(204).send();
+	});
+	/**
+	* The log itself.
+	*
+	* Admin only, and reading it is NOT audited. A log that records its own
+	* reads grows without bound from a dashboard that polls it, and the entry
+	* would say nothing an access log does not — the events worth recording
+	* are the ones that touch somebody else's data.
+	*/
+	app.get("/audit", { preHandler: requires("user.create") }, async (request, reply) => {
+		const raw = request.query?.limit;
+		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 100;
+		const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 500) : 100;
+		return reply.send({ entries: await deps.storage.listAudit(limit) });
+	});
+	/**
+	* Webhook health, and the deliveries that died.
+	*
+	* The reason the breaker keeps its counters on the row rather than in the
+	* worker's memory. A self-hoster has no operations team watching a
+	* dashboard, so a destination refusing deliveries since Tuesday has to be
+	* answerable from the product — otherwise it is found when somebody asks
+	* why the CRM has no leads this week.
+	*/
+	app.get("/webhooks", { preHandler: requires("form.publish") }, async (_request, reply) => {
+		const now = new Date(deps.nowIso());
+		const hooks = await deps.storage.listWebhooks();
+		return reply.send({ webhooks: hooks.map((hook) => healthOf(hook, now)) });
+	});
+	app.get("/deliveries/dead", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const raw = request.query?.limit;
+		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 50;
+		const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 200) : 50;
+		const dead = await deps.storage.deadDeliveries(limit);
+		return reply.send({ deliveries: dead.map((delivery) => ({
+			id: delivery.id,
+			webhookId: delivery.webhookId,
+			submissionId: delivery.submissionId,
+			eventId: delivery.eventId,
+			attempt: delivery.attempt,
+			lastError: delivery.lastError
+		})) });
+	});
+	app.post("/deliveries/:id/replay", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const { id } = request.params;
+		const outcome = await replayDelivery({
+			storage: deps.storage,
+			now: () => new Date(deps.nowIso())
+		}, id);
+		if (!outcome.ok) return outcome.kind === "unknown" ? reply.code(404).send({ error: "unknown_delivery" }) : reply.code(409).send({
+			error: "not_dead",
+			state: outcome.state,
+			message: "Only a dead delivery can be replayed. A pending one is already queued, and a delivered one would be sent twice."
+		});
+		await audit(request, {
+			action: "delivery.replayed",
+			subject: id,
+			detail: { webhookId: outcome.delivery.webhookId }
+		});
+		return reply.code(202).send({
+			id,
+			state: outcome.delivery.state
+		});
+	});
+	/**
+	* A puzzle for an anonymous visitor to solve before submitting.
+	*
+	* Public because the form is: requiring a session to obtain a challenge for
+	* an unauthenticated submission would be a circle. It is cheap to mint and
+	* stateless, so handing one out costs this server a hash.
+	*/
+	app.get("/f/:path/challenge", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		if (challengeSecret === void 0) return reply.code(404).send({ error: "challenge_not_enabled" });
+		const { path } = request.params;
+		if (await deps.storage.getFormByPath(path) === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.send(await mintChallenge({
+			secret: challengeSecret,
+			nowSeconds: Math.floor(new Date(deps.nowIso()).getTime() / 1e3)
+		}));
+	});
+	/**
+	* Check a submitted solution, and spend it.
+	*
+	* Returns the refusal to send, or undefined when it passed. The spend is
+	* separate from the verification and comes last: the stateless checks say
+	* the solution is correct, and only the database can say it has not been
+	* used — a correct solution stays correct, so without this one puzzle
+	* would buy a thousand submissions.
+	*/
+	async function checkChallenge(request) {
+		const header = request.headers[CHALLENGE_HEADER];
+		if (typeof header !== "string" || header === "") return {
+			error: "challenge_required",
+			message: `This form needs a solved challenge. Ask GET /f/:path/challenge for one and return it in ${CHALLENGE_HEADER}.`
+		};
+		const solution = decodeSolution(header);
+		if (solution === void 0) return {
+			error: "challenge_malformed",
+			message: "The challenge header is not base64 JSON."
+		};
+		const nowSeconds = Math.floor(new Date(deps.nowIso()).getTime() / 1e3);
+		const verified = await verifySolution(challengeSecret, solution, nowSeconds);
+		if (!verified.ok) return {
+			error: `challenge_${verified.reason}`,
+			message: "The challenge was not solved. Ask for a new one and try again."
+		};
+		if (!await deps.storage.spendChallenge(verified.challenge, (/* @__PURE__ */ new Date(verified.expiresAtSeconds * 1e3)).toISOString())) return {
+			error: "challenge_spent",
+			message: "That challenge has already been used. Each one is good for one submission."
+		};
+	}
+	app.get("/forms", { preHandler: requires("form.read") }, async (_request, reply) => {
+		return reply.send({ forms: await listForms(deps) });
+	});
+	app.get("/f/:path/versions", { preHandler: requires("form.read") }, async (request, reply) => {
+		const { path } = request.params;
+		const versions = await listVersions(deps, path);
+		if (versions === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.send({ versions });
+	});
+	app.get("/f/:path/submissions", { preHandler: requires("submission.read") }, async (request, reply) => {
+		const { path } = request.params;
+		const listed = await listSubmissions(deps, path);
+		if (listed === void 0) return reply.code(404).send({ error: "unknown_form" });
+		await audit(request, {
+			action: "submission.read",
+			subject: path,
+			detail: { count: listed.length }
+		});
+		return reply.send({ submissions: listed });
+	});
+	app.get("/f/:path/submissions/export.csv", { preHandler: requires("submission.export") }, async (request, reply) => {
+		const { path } = request.params;
+		const csv = await exportCsv(deps, path);
+		if (csv === void 0) return reply.code(404).send({ error: "unknown_form" });
+		await audit(request, {
+			action: "submission.exported",
+			subject: path,
+			detail: { bytes: Buffer.byteLength(csv, "utf8") }
+		});
+		return reply.header("content-type", "text/csv; charset=utf-8").header("content-disposition", `attachment; filename="${path}-submissions.csv"`).send(csv);
+	});
+	/**
+	* Fetch a published form. The one public route deliberately NOT rate-limited.
+	*
+	* Every other unauthenticated route is: submitting, starting a draft, writing
+	* one, reading one, minting a challenge, asking for an upload target. Those are
+	* writes, or guesses, or work somebody can demand of the server. This is the
+	* read every visitor has to make before they can do anything at all.
+	*
+	* Limiting it by IP would refuse the form to real people sharing an address —
+	* an office, a school, a phone network behind CGNAT — and the failure would
+	* look like the form being broken rather than like a limit. That is a worse
+	* outcome than the cheap read it would prevent, and the read is cached by
+	* `schemaHash` anyway.
+	*
+	* Written down because the asymmetry is deliberate and looks like an omission.
+	*/
+	app.get("/f/:path", async (request, reply) => {
+		const { path } = request.params;
+		const resolved = await resolveForm(deps, path);
+		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.send({
+			version: resolved.version,
+			schemaHash: resolved.schemaHash,
+			schema: resolved.schema
+		});
+	});
+	/**
+	* Start a draft, and get the only key to it.
+	*
+	* The public plane is anonymous, so a draft has no account behind it. It was
+	* previously addressed by an id the CALLER chose, with no check on either
+	* route: anybody who knew or guessed an id could read a stranger's part-filled
+	* form, and overwrite it — after which that person submits the substituted
+	* content under their own name and nothing says otherwise
+	* ([0062](../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).
+	*
+	* So the server picks the id and signs it, and the token comes back exactly
+	* once. Losing it means losing the draft, which is the correct trade for the
+	* alternative.
+	*/
+	app.post("/f/:path/drafts", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		const { path } = request.params;
+		const started = await startDraft(deps, { path });
+		if (started === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.code(201).send(started);
+	});
+	app.put("/f/:path/drafts/:draftId", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		const { path, draftId } = request.params;
+		const token = request.headers[DRAFT_TOKEN_HEADER];
+		if (typeof token !== "string") return reply.code(401).send({ error: "draft_token_required" });
+		const saved = await saveDraft(deps, {
+			path,
+			draftId,
+			token,
+			data: request.body ?? {}
+		});
+		if (saved === void 0) return reply.code(404).send({ error: "unknown_form" });
+		if (!saved.saved) return reply.code(403).send({ error: "draft_token_invalid" });
+		return reply.send({ version: saved.version });
+	});
+	app.get("/f/:path/drafts/:draftId", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		const { path, draftId } = request.params;
+		const token = request.headers[DRAFT_TOKEN_HEADER];
+		if (typeof token !== "string") return reply.code(401).send({ error: "draft_token_required" });
+		const resumed = await resumeDraft(deps, {
+			path,
+			draftId,
+			token
+		});
+		if (resumed === void 0) return reply.code(404).send({ error: "unknown_draft" });
+		return reply.send(resumed);
+	});
+	/**
+	* Ask where to put a file.
+	*
+	* Refusing here, before a byte is sent, is the difference between rejecting
+	* a 2 GB upload and receiving one first. The reply carries the id the
+	* submission will reference and the URL to PUT the bytes to.
+	*/
+	app.post("/f/:path/files", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({
+			error: "uploads_unavailable",
+			message: "This deployment has no file store configured, so it cannot accept uploads."
+		});
+		const { path } = request.params;
+		const resolved = await resolveForm(deps, path);
+		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const form = await storage.getFormByPath(path);
+		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const actor = await actorOf(request);
+		const origin = request.headers.origin;
+		const body = request.body ?? {};
+		const field = typeof body.field === "string" ? body.field : void 0;
+		const name = typeof body.name === "string" ? body.name : void 0;
+		const size = typeof body.size === "number" ? body.size : void 0;
+		const contentType = typeof body.contentType === "string" ? body.contentType : "application/octet-stream";
+		if (field === void 0 || name === void 0 || size === void 0) return reply.code(400).send({
+			error: "invalid_request",
+			message: "Send the field, the name and the size of the file you want to upload."
+		});
+		if (size > maxFileBytes) return reply.code(413).send({
+			error: "too_large",
+			message: `This deployment accepts files up to ${String(maxFileBytes)} bytes.`
+		});
+		const outcome = await offerUpload({
+			storage,
+			now: () => /* @__PURE__ */ new Date(),
+			newId: () => randomUUID()
+		}, {
+			schema: resolved.schema,
+			form,
+			actor: actor === void 0 ? "anonymous" : "authenticated",
+			origin: typeof origin === "string" ? origin : void 0,
+			field,
+			name,
+			size,
+			contentType
+		});
+		if (!outcome.ok) {
+			const status = outcome.reason === "not_allowed" ? 403 : outcome.reason === "too_large" ? 413 : 400;
+			return reply.code(status).send({ error: outcome.reason });
+		}
+		return reply.code(201).send({
+			id: outcome.file.id,
+			name: outcome.file.name,
+			size: outcome.file.size,
+			contentType: outcome.file.contentType,
+			storageKey: outcome.file.storageKey,
+			uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`
+		});
+	});
+	/** Receive the bytes for a file that was offered. */
+	app.put("/f/:path/files/:id", async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
+		const { path, id } = request.params;
+		const form = await storage.getFormByPath(path);
+		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const file = await storage.getFile(id);
+		if (file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
+		if (file.state !== "offered") return reply.code(409).send({ error: "already_uploaded" });
+		const bytes = request.body;
+		if (!Buffer.isBuffer(bytes)) return reply.code(400).send({ error: "no_body" });
+		if (bytes.byteLength > maxFileBytes) return reply.code(413).send({ error: "too_large" });
+		if (bytes.byteLength !== file.size) return reply.code(400).send({
+			error: "size_mismatch",
+			message: `This upload was offered as ${String(file.size)} bytes and ${String(bytes.byteLength)} arrived.`
+		});
+		await fileStore.put(file.storageKey, bytes);
+		await storage.updateFile({
+			...file,
+			state: "stored"
+		});
+		return reply.code(204).send();
+	});
+	/**
+	* Serve a file back.
+	*
+	* Always as an attachment, never inline, and `nosniff` alongside it. Stored
+	* cross-site scripting through an uploaded HTML or SVG file is the most
+	* commonly exploited vulnerability in this product category, and the real
+	* answer is a separate hostname — which a single-container deployment does
+	* not have. Forcing a download is the accommodation, and it is the one place
+	* this deployment model genuinely costs something.
+	*/
+	app.get("/f/:path/files/:id", async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
+		const { path, id } = request.params;
+		if (await actorOf(request) === void 0) return reply.code(401).send({ error: "unauthenticated" });
+		const form = await storage.getFormByPath(path);
+		const file = await storage.getFile(id);
+		if (form === void 0 || file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
+		const stream = await fileStore.open(file.storageKey);
+		if (stream === void 0) return reply.code(404).send({ error: "unknown_file" });
+		return reply.header("content-type", "application/octet-stream").header("x-content-type-options", "nosniff").header("content-security-policy", "default-src 'none'; sandbox").header("content-disposition", `attachment; filename="${file.name.replace(/["\r\n]/g, "")}"`).send(stream);
+	});
+	app.post("/f/:path/submissions", { config: { rateLimit: {
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs
+	} } }, async (request, reply) => {
+		const { path } = request.params;
+		const declaredSchemaHash = request.headers[SCHEMA_HASH_HEADER];
+		if (typeof declaredSchemaHash !== "string" || declaredSchemaHash === "") return reply.code(400).send({
+			error: "missing_schema_hash",
+			message: `Send the schema hash you rendered in the ${SCHEMA_HASH_HEADER} header.`
+		});
+		const actor = await actorOf(request);
+		const origin = request.headers.origin;
+		if (challengeSecret !== void 0 && actor === void 0) {
+			const refusal = await checkChallenge(request);
+			if (refusal !== void 0) return reply.code(400).send(refusal);
+		}
+		const outcome = await createSubmission(deps, {
+			path,
+			declaredSchemaHash,
+			data: request.body ?? {},
+			actor: actor === void 0 ? "anonymous" : "authenticated",
+			...typeof origin === "string" ? { origin } : {}
+		});
+		if (outcome.ok) return reply.code(201).send({
+			id: outcome.id,
+			data: outcome.canonicalData
+		});
+		switch (outcome.kind) {
+			case "unknown_form": return reply.code(404).send({ error: "unknown_form" });
+			case "version_changed": return reply.code(409).send({
+				error: "FORM_VERSION_CHANGED",
+				current: outcome.current === void 0 ? void 0 : {
+					version: outcome.current.version,
+					schemaHash: outcome.current.schemaHash,
+					schema: outcome.current.schema
+				}
+			});
+			case "invalid": return reply.code(422).send({
+				error: "invalid",
+				errors: outcome.errors
+			});
+			case "forbidden": return reply.code(403).send({ error: "forbidden" });
+			case "source_unavailable": return reply.code(503).send({
+				error: "source_unavailable",
+				source: outcome.source
+			});
+		}
+	});
+	return app;
+}
+//#endregion
+//#region src/db.ts
+/**
+* The thin slice's tables. Three rules from the design spec are enforced HERE,
+* in the database, because application code can be bypassed and these must not
+* be:
+*
+*  - published versions are immutable (a trigger refuses UPDATE),
+*  - a submission binds to its exact version by real foreign key,
+*  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema
+*    that produced it is structurally impossible.
+*/
+const forms = pgTable("forms", {
+	id: uuid("id").primaryKey(),
+	path: text("path").notNull().unique(),
+	currentVersionId: uuid("current_version_id"),
+	accessSubmit: text("access_submit").notNull().default("authenticated"),
+	allowedOrigins: text("allowed_origins").array(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+const formVersions = pgTable("form_versions", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	version: integer("version").notNull(),
+	schema: jsonb("schema").notNull(),
+	schemaHash: text("schema_hash").notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+const users = pgTable("users", {
+	id: uuid("id").primaryKey(),
+	email: text("email").notNull().unique(),
+	passwordHash: text("password_hash").notNull(),
+	role: text("role").notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull()
+});
+const apiKeys = pgTable("api_keys", {
+	id: uuid("id").primaryKey(),
+	name: text("name").notNull(),
+	prefix: text("prefix").notNull(),
+	secretHash: text("secret_hash").notNull(),
+	role: text("role").notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	revokedAt: timestamp("revoked_at", { withTimezone: true })
+});
+const drafts = pgTable("drafts", {
+	id: text("id").notNull(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id),
+	data: jsonb("data").notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+});
+const webhooks = pgTable("webhooks", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	url: text("url").notNull(),
+	secret: text("secret").notNull(),
+	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+	openedAt: timestamp("opened_at", { withTimezone: true })
+});
+/**
+* The outbox. A row here and the submission that caused it are written by the
+* same transaction, which is what makes "accepted" and "will be delivered" one
+* decision rather than two.
+*/
+const deliveries = pgTable("deliveries", {
+	id: uuid("id").primaryKey(),
+	webhookId: uuid("webhook_id").notNull(),
+	submissionId: uuid("submission_id").notNull(),
+	eventId: uuid("event_id").notNull(),
+	body: text("body").notNull(),
+	attempt: integer("attempt").notNull().default(0),
+	nextAttemptAt: timestamp("next_attempt_at", { withTimezone: true }).notNull(),
+	state: text("state").notNull().default("pending"),
+	lastError: text("last_error")
+});
+const spentChallenges = pgTable("spent_challenges", {
+	challenge: text("challenge").primaryKey(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+});
+const auditLog = pgTable("audit_log", {
+	id: uuid("id").primaryKey(),
+	at: timestamp("at", { withTimezone: true }).notNull(),
+	action: text("action").notNull(),
+	actorKind: text("actor_kind"),
+	actorId: text("actor_id"),
+	subject: text("subject"),
+	requestId: text("request_id"),
+	detail: jsonb("detail")
+});
+const files = pgTable("files", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull(),
+	name: text("name").notNull(),
+	size: integer("size").notNull(),
+	contentType: text("content_type").notNull(),
+	storageKey: text("storage_key").notNull(),
+	state: text("state").notNull().default("offered"),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	submissionId: uuid("submission_id")
+});
+const submissions = pgTable("submissions", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id, { onDelete: "restrict" }),
+	data: jsonb("data").notNull(),
+	submittedAt: timestamp("submitted_at", { withTimezone: true }).notNull()
+});
+/**
+* Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the
+* lifecycle work; a self-hosted skeleton that creates its own tables on first
+* start is worth more right now than a migration pipeline.
+*/
+async function bootstrapSchema(sql) {
+	await sql`
+    CREATE TABLE IF NOT EXISTS forms (
+      id uuid PRIMARY KEY,
+      path text NOT NULL UNIQUE,
+      current_version_id uuid,
+      -- Private by default in the DATABASE, not only in the code, so a row
+      -- inserted by a migration or a fixture is not accidentally open.
+      access_submit text NOT NULL DEFAULT 'authenticated'
+        CHECK (access_submit IN ('authenticated', 'public')),
+      -- NULL: no allowlist in force. Empty array: nothing allowed. Different
+      -- things, which is why this is nullable rather than defaulting to '{}'.
+      allowed_origins text[],
+      created_at timestamptz NOT NULL DEFAULT now()
+    )`;
+	await sql`
+    ALTER TABLE forms
+      ADD COLUMN IF NOT EXISTS access_submit text NOT NULL DEFAULT 'authenticated'`;
+	await sql`ALTER TABLE forms ADD COLUMN IF NOT EXISTS allowed_origins text[]`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS form_versions (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id),
+      version integer NOT NULL,
+      schema jsonb NOT NULL,
+      schema_hash text NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (form_id, version),
+      UNIQUE (form_id, schema_hash)
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS submissions (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id),
+      form_version_id uuid NOT NULL REFERENCES form_versions(id) ON DELETE RESTRICT,
+      data jsonb NOT NULL,
+      submitted_at timestamptz NOT NULL
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS webhooks (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE CASCADE,
+      url text NOT NULL,
+      secret text NOT NULL
+    )`;
+	await sql`
+    ALTER TABLE webhooks
+      ADD COLUMN IF NOT EXISTS consecutive_failures integer NOT NULL DEFAULT 0,
+      -- When the breaker opened, null while the destination is answering. On
+      -- the row rather than in the worker's memory: memory does not survive a
+      -- restart, and a self-hoster with no operations team needs a failing
+      -- webhook to be visible on a screen rather than in a log nobody tails.
+      ADD COLUMN IF NOT EXISTS opened_at timestamptz`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS deliveries (
+      id uuid PRIMARY KEY,
+      webhook_id uuid NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+      -- RESTRICT, not CASCADE: a delivery is the record that something was
+      -- sent about this submission, and deleting the submission must not
+      -- quietly erase it.
+      submission_id uuid NOT NULL REFERENCES submissions(id) ON DELETE RESTRICT,
+      event_id uuid NOT NULL,
+      body text NOT NULL,
+      attempt integer NOT NULL DEFAULT 0,
+      next_attempt_at timestamptz NOT NULL,
+      state text NOT NULL DEFAULT 'pending'
+        CHECK (state IN ('pending', 'delivered', 'dead')),
+      last_error text
+    )`;
+	await sql`
+    CREATE INDEX IF NOT EXISTS deliveries_due
+      ON deliveries (next_attempt_at) WHERE state = 'pending'`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS files (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE RESTRICT,
+      -- What the reader called it. Display only: the storage key is minted by
+      -- the server, because a key built from a submitted filename is a path
+      -- traversal waiting for somebody to try it.
+      name text NOT NULL,
+      size integer NOT NULL,
+      content_type text NOT NULL,
+      storage_key text NOT NULL,
+      state text NOT NULL DEFAULT 'offered'
+        CHECK (state IN ('offered', 'stored', 'claimed')),
+      created_at timestamptz NOT NULL,
+      -- RESTRICT for the same reason a delivery uses it: the row is the record
+      -- that something was attached, and deleting the submission must not
+      -- quietly erase what it carried.
+      submission_id uuid REFERENCES submissions(id) ON DELETE RESTRICT,
+      -- One file, one submission. Enforced here rather than in application
+      -- code, because two concurrent submissions claiming the same file is
+      -- exactly the race application code loses — and the loser would be a
+      -- submission referencing bytes another submission owns.
+      CONSTRAINT files_one_submission UNIQUE (id, submission_id)
+    )`;
+	await sql`
+    CREATE INDEX IF NOT EXISTS files_abandoned
+      ON files (created_at) WHERE state <> 'claimed'`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS users (
+      id uuid PRIMARY KEY,
+      email text NOT NULL UNIQUE,
+      password_hash text NOT NULL,
+      role text NOT NULL,
+      created_at timestamptz NOT NULL
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS api_keys (
+      id uuid PRIMARY KEY,
+      name text NOT NULL,
+      prefix text NOT NULL,
+      secret_hash text NOT NULL,
+      role text NOT NULL,
+      created_at timestamptz NOT NULL,
+      revoked_at timestamptz
+    )`;
+	await sql`CREATE INDEX IF NOT EXISTS api_keys_prefix ON api_keys (prefix)`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS spent_challenges (
+      -- The primary key IS the mechanism. Two requests arriving with one
+      -- solution both pass every stateless check — the signature is ours
+      -- and the hash is right — and only the database can decide which of
+      -- them spends it. A read-then-write would race exactly where somebody
+      -- is looking.
+      challenge text PRIMARY KEY,
+      expires_at timestamptz NOT NULL
+    )`;
+	await sql`CREATE INDEX IF NOT EXISTS spent_challenges_expiry ON spent_challenges (expires_at)`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS audit_log (
+      id uuid PRIMARY KEY,
+      at timestamptz NOT NULL,
+      action text NOT NULL,
+      -- Null for an anonymous public submission, which is an answer rather
+      -- than a gap: the form was open and nobody was signed in.
+      actor_kind text CHECK (actor_kind IN ('user', 'apiKey')),
+      actor_id text,
+      subject text,
+      request_id text,
+      -- Identifiers and counts. NEVER a submission's answers: an audit log is
+      -- read by more people and kept longer than the data it describes, so
+      -- data inside it is a second copy of the thing being protected.
+      detail jsonb
+    )`;
+	await sql`CREATE INDEX IF NOT EXISTS audit_log_at ON audit_log (at DESC)`;
+	await sql`CREATE INDEX IF NOT EXISTS audit_log_subject ON audit_log (subject, at DESC)`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS drafts (
+      id text NOT NULL,
+      form_id uuid NOT NULL REFERENCES forms(id),
+      form_version_id uuid NOT NULL REFERENCES form_versions(id),
+      data jsonb NOT NULL,
+      updated_at timestamptz NOT NULL,
+      PRIMARY KEY (form_id, id)
+    )`;
+	await sql`
+    CREATE OR REPLACE FUNCTION refuse_version_update() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'form_versions rows are immutable; publish a new version instead';
+    END
+    $$ LANGUAGE plpgsql`;
+	await sql`DROP TRIGGER IF EXISTS form_versions_immutable ON form_versions`;
+	await sql`
+    CREATE TRIGGER form_versions_immutable
+    BEFORE UPDATE ON form_versions
+    FOR EACH ROW EXECUTE FUNCTION refuse_version_update()`;
+	await sql`
+    CREATE OR REPLACE FUNCTION refuse_audit_change() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'audit_log is append-only';
+    END
+    $$ LANGUAGE plpgsql`;
+	await sql`DROP TRIGGER IF EXISTS audit_log_append_only ON audit_log`;
+	await sql`
+    CREATE TRIGGER audit_log_append_only
+    BEFORE UPDATE OR DELETE ON audit_log
+    FOR EACH ROW EXECUTE FUNCTION refuse_audit_change()`;
+}
+//#endregion
+//#region src/postgres-storage.ts
+/** The Storage port over Postgres — the mirror of server-core's in-memory one. */
+function createPostgresStorage(sql) {
+	const db = drizzle(sql);
+	return {
+		async getFormByPath(path) {
+			const row = (await db.select().from(forms).where(eq(forms.path, path)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				path: row.path,
+				currentVersionId: row.currentVersionId,
+				accessSubmit: row.accessSubmit === "public" ? "public" : "authenticated",
+				allowedOrigins: row.allowedOrigins
+			};
+		},
+		async listForms() {
+			return (await db.select().from(forms)).map((row) => ({
+				id: row.id,
+				path: row.path,
+				currentVersionId: row.currentVersionId,
+				accessSubmit: row.accessSubmit === "public" ? "public" : "authenticated",
+				allowedOrigins: row.allowedOrigins
+			}));
+		},
+		async createForm(record) {
+			await db.insert(forms).values({
+				id: record.id,
+				path: record.path,
+				currentVersionId: record.currentVersionId,
+				accessSubmit: record.accessSubmit,
+				allowedOrigins: record.allowedOrigins
+			});
+		},
+		async updateFormAccess(formId, access) {
+			await db.update(forms).set({
+				accessSubmit: access.accessSubmit,
+				allowedOrigins: access.allowedOrigins
+			}).where(eq(forms.id, formId));
+		},
+		async setCurrentVersion(formId, versionId) {
+			await db.update(forms).set({ currentVersionId: versionId }).where(eq(forms.id, formId));
+		},
+		async insertVersion(record) {
+			await db.insert(formVersions).values({
+				id: record.id,
+				formId: record.formId,
+				version: record.version,
+				schema: record.schema,
+				schemaHash: record.schemaHash
+			});
+		},
+		async publishVersion({ form, version, audit }) {
+			await db.transaction(async (tx) => {
+				if (form !== void 0) await tx.insert(forms).values({
+					id: form.id,
+					path: form.path,
+					currentVersionId: form.currentVersionId,
+					accessSubmit: form.accessSubmit,
+					allowedOrigins: form.allowedOrigins
+				});
+				await tx.insert(formVersions).values({
+					id: version.id,
+					formId: version.formId,
+					version: version.version,
+					schema: version.schema,
+					schemaHash: version.schemaHash
+				});
+				if ((await tx.update(forms).set({ currentVersionId: version.id }).where(eq(forms.id, version.formId)).returning({ id: forms.id })).length !== 1) throw new Error(`Publishing to form ${version.formId} matched no form row. Rolling back, so there is no version pointing at a form that is not there.`);
+				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
+			});
+		},
+		async getVersionById(id) {
+			const row = (await db.select().from(formVersions).where(eq(formVersions.id, id)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				formId: row.formId,
+				version: row.version,
+				schema: row.schema,
+				schemaHash: row.schemaHash
+			};
+		},
+		async findVersionByHash(formId, schemaHash) {
+			const row = (await db.select().from(formVersions).where(eq(formVersions.formId, formId))).find((candidate) => candidate.schemaHash === schemaHash);
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				formId: row.formId,
+				version: row.version,
+				schema: row.schema,
+				schemaHash: row.schemaHash
+			};
+		},
+		async latestVersionNumber(formId) {
+			return (await db.select({ latest: max(formVersions.version) }).from(formVersions).where(eq(formVersions.formId, formId)))[0]?.latest ?? 0;
+		},
+		async insertSubmission(record, queued, claimFileIds, audit) {
+			await db.transaction(async (tx) => {
+				await tx.insert(submissions).values({
+					id: record.id,
+					formId: record.formId,
+					formVersionId: record.formVersionId,
+					data: record.data,
+					submittedAt: new Date(record.submittedAt)
+				});
+				if (queued !== void 0 && queued.length > 0) await tx.insert(deliveries).values(queued.map((delivery) => ({
+					id: delivery.id,
+					webhookId: delivery.webhookId,
+					submissionId: delivery.submissionId,
+					eventId: delivery.eventId,
+					body: delivery.body,
+					attempt: delivery.attempt,
+					nextAttemptAt: new Date(delivery.nextAttemptAt),
+					state: delivery.state,
+					lastError: delivery.lastError
+				})));
+				if (claimFileIds !== void 0 && claimFileIds.length > 0) {
+					if ((await tx.update(files).set({
+						state: "claimed",
+						submissionId: record.id
+					}).where(and(inArray(files.id, [...claimFileIds]), eq(files.state, "stored"))).returning({ id: files.id })).length !== claimFileIds.length) throw new Error("A file this submission names was claimed by another one first. Rolling back, so the submission does not reference bytes it does not own.");
+				}
+				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
+			});
+		},
+		async spendChallenge(challenge, expiresAtIso) {
+			return (await db.insert(spentChallenges).values({
+				challenge,
+				expiresAt: new Date(expiresAtIso)
+			}).onConflictDoNothing().returning({ challenge: spentChallenges.challenge })).length === 1;
+		},
+		async forgetExpiredChallenges(beforeIso) {
+			return (await db.delete(spentChallenges).where(lt(spentChallenges.expiresAt, new Date(beforeIso))).returning({ challenge: spentChallenges.challenge })).length;
+		},
+		async recordAudit(entry) {
+			await db.insert(auditLog).values(auditRow(entry));
+		},
+		async listAudit(limit) {
+			return (await db.select().from(auditLog).orderBy(desc(auditLog.at)).limit(limit)).map((row) => ({
+				id: row.id,
+				at: row.at.toISOString(),
+				action: row.action,
+				...row.actorKind === null ? {} : { actorKind: row.actorKind },
+				...row.actorId === null ? {} : { actorId: row.actorId },
+				...row.subject === null ? {} : { subject: row.subject },
+				...row.requestId === null ? {} : { requestId: row.requestId },
+				...row.detail === null ? {} : { detail: row.detail }
+			}));
+		},
+		async insertFile(record) {
+			await db.insert(files).values({
+				...record,
+				createdAt: new Date(record.createdAt)
+			});
+		},
+		async getFile(id) {
+			const [row] = await db.select().from(files).where(eq(files.id, id)).limit(1);
+			return row === void 0 ? void 0 : toFileRecord(row);
+		},
+		async updateFile(record) {
+			await db.update(files).set({
+				state: record.state,
+				submissionId: record.submissionId
+			}).where(eq(files.id, record.id));
+		},
+		async abandonedFiles(beforeIso) {
+			return (await db.select().from(files).where(and(ne(files.state, "claimed"), lt(files.createdAt, new Date(beforeIso))))).map(toFileRecord);
+		},
+		async deleteFiles(ids) {
+			if (ids.length === 0) return;
+			await db.delete(files).where(inArray(files.id, [...ids]));
+		},
+		async webhooksForForm(formId) {
+			return (await db.select().from(webhooks).where(eq(webhooks.formId, formId))).map(toWebhookRecord);
+		},
+		async insertWebhook(record) {
+			await db.insert(webhooks).values({
+				id: record.id,
+				formId: record.formId,
+				url: record.url,
+				secret: record.secret,
+				consecutiveFailures: record.consecutiveFailures,
+				openedAt: record.openedAt === null ? null : new Date(record.openedAt)
+			});
+		},
+		async updateWebhook(record) {
+			await db.update(webhooks).set({
+				consecutiveFailures: record.consecutiveFailures,
+				openedAt: record.openedAt === null ? null : new Date(record.openedAt)
+			}).where(eq(webhooks.id, record.id));
+		},
+		async listWebhooks() {
+			return (await db.select().from(webhooks)).map(toWebhookRecord);
+		},
+		async deadDeliveries(limit) {
+			return (await db.select().from(deliveries).where(eq(deliveries.state, "dead")).orderBy(desc(deliveries.nextAttemptAt)).limit(limit)).map(toDeliveryRecord);
+		},
+		async getDelivery(id) {
+			const [row] = await db.select().from(deliveries).where(eq(deliveries.id, id)).limit(1);
+			return row === void 0 ? void 0 : toDeliveryRecord(row);
+		},
+		async claimDueDeliveries(nowIso, limit) {
+			return (await db.select().from(deliveries).where(and(eq(deliveries.state, "pending"), lte(deliveries.nextAttemptAt, new Date(nowIso)))).orderBy(deliveries.nextAttemptAt).limit(limit)).map(toDeliveryRecord);
+		},
+		async updateDelivery(record) {
+			await db.update(deliveries).set({
+				attempt: record.attempt,
+				nextAttemptAt: new Date(record.nextAttemptAt),
+				state: record.state,
+				lastError: record.lastError
+			}).where(eq(deliveries.id, record.id));
+		},
+		async listSubmissions() {
+			return (await db.select().from(submissions)).map(toSubmissionRecord);
+		},
+		async listSubmissionsByForm(formId) {
+			return (await db.select().from(submissions).where(eq(submissions.formId, formId)).orderBy(desc(submissions.submittedAt), desc(submissions.id))).map(toSubmissionRecord);
+		},
+		async listVersionsByForm(formId) {
+			return (await db.select().from(formVersions).where(eq(formVersions.formId, formId)).orderBy(desc(formVersions.version))).map((row) => ({
+				id: row.id,
+				formId: row.formId,
+				version: row.version,
+				schema: row.schema,
+				schemaHash: row.schemaHash
+			}));
+		},
+		async upsertDraft(record) {
+			await db.insert(drafts).values({
+				id: record.id,
+				formId: record.formId,
+				formVersionId: record.formVersionId,
+				data: record.data,
+				updatedAt: new Date(record.updatedAt)
+			}).onConflictDoUpdate({
+				target: [drafts.formId, drafts.id],
+				set: {
+					formVersionId: record.formVersionId,
+					data: record.data,
+					updatedAt: new Date(record.updatedAt)
+				}
+			});
+		},
+		async getDraft(formId, draftId) {
+			const row = (await db.select().from(drafts).where(and(eq(drafts.formId, formId), eq(drafts.id, draftId))).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				formId: row.formId,
+				formVersionId: row.formVersionId,
+				data: row.data,
+				updatedAt: row.updatedAt.toISOString()
+			};
+		},
+		async insertUser(record) {
+			await db.insert(users).values({
+				id: record.id,
+				email: record.email,
+				passwordHash: record.passwordHash,
+				role: record.role,
+				createdAt: new Date(record.createdAt)
+			});
+		},
+		async getUserByEmail(email) {
+			const row = (await db.select().from(users).where(eq(users.email, email)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				email: row.email,
+				passwordHash: row.passwordHash,
+				role: row.role,
+				createdAt: row.createdAt.toISOString()
+			};
+		},
+		async insertApiKey(record) {
+			await db.insert(apiKeys).values({
+				id: record.id,
+				name: record.name,
+				prefix: record.prefix,
+				secretHash: record.secretHash,
+				role: record.role,
+				createdAt: new Date(record.createdAt),
+				revokedAt: record.revokedAt === null ? null : new Date(record.revokedAt)
+			});
+		},
+		async listApiKeys() {
+			return (await db.select().from(apiKeys)).map(toApiKeyRecord);
+		},
+		async findApiKeysByPrefix(prefix) {
+			return (await db.select().from(apiKeys).where(eq(apiKeys.prefix, prefix))).map(toApiKeyRecord);
+		},
+		async revokeApiKey(id, atIso) {
+			await db.update(apiKeys).set({ revokedAt: new Date(atIso) }).where(eq(apiKeys.id, id));
+		}
+	};
+}
+function toApiKeyRecord(row) {
+	return {
+		id: row.id,
+		name: row.name,
+		prefix: row.prefix,
+		secretHash: row.secretHash,
+		role: row.role,
+		createdAt: row.createdAt.toISOString(),
+		revokedAt: row.revokedAt === null ? null : row.revokedAt.toISOString()
+	};
+}
+function toSubmissionRecord(row) {
+	return {
+		id: row.id,
+		formId: row.formId,
+		formVersionId: row.formVersionId,
+		data: row.data,
+		submittedAt: row.submittedAt.toISOString()
+	};
+}
+/** A delivery row as the port describes it. */
+function toDeliveryRecord(row) {
+	return {
+		id: row.id,
+		webhookId: row.webhookId,
+		submissionId: row.submissionId,
+		eventId: row.eventId,
+		body: row.body,
+		attempt: row.attempt,
+		nextAttemptAt: row.nextAttemptAt.toISOString(),
+		state: row.state,
+		lastError: row.lastError
+	};
+}
+/** A files row as the port describes it: timestamps as ISO strings. */
+function toFileRecord(row) {
+	return {
+		id: row.id,
+		formId: row.formId,
+		name: row.name,
+		size: row.size,
+		contentType: row.contentType,
+		storageKey: row.storageKey,
+		state: row.state,
+		createdAt: row.createdAt.toISOString(),
+		submissionId: row.submissionId
+	};
+}
+/** A webhook row as the port describes it, health included. */
+function toWebhookRecord(row) {
+	return {
+		id: row.id,
+		formId: row.formId,
+		url: row.url,
+		secret: row.secret,
+		consecutiveFailures: row.consecutiveFailures,
+		openedAt: row.openedAt === null ? null : row.openedAt.toISOString()
+	};
+}
+/**
+* An entry as the table holds it.
+*
+* Absent and null are the same thing here, and the conversion is in one place
+* so two call sites cannot disagree about which they write.
+*/
+function auditRow(entry) {
+	return {
+		id: entry.id,
+		at: new Date(entry.at),
+		action: entry.action,
+		actorKind: entry.actorKind ?? null,
+		actorId: entry.actorId ?? null,
+		subject: entry.subject ?? null,
+		requestId: entry.requestId ?? null,
+		detail: entry.detail ?? null
+	};
+}
+//#endregion
+//#region src/file-store.ts
+/**
+* Bytes under one directory, one file per key.
+*
+* **Keys are checked, not trusted.** A key is minted by the server from a form
+* id and a file id, so it cannot contain a traversal — but this resolves it
+* and refuses anything landing outside the root regardless. A path check that
+* only runs when the input is untrusted is a path check that stops running the
+* day somebody adds a caller.
+*/
+function createLocalFileStore(root) {
+	const base = resolve(root);
+	const pathFor = (key) => {
+		if (key.includes("\\")) throw new Error(`Refusing a storage key that could resolve outside the store: ${key}`);
+		const full = resolve(join(base, key));
+		if (full !== base && !full.startsWith(base + sep)) throw new Error(`Refusing a storage key that resolves outside the store: ${key}`);
+		return full;
+	};
+	return {
+		async put(key, bytes) {
+			const full = pathFor(key);
+			await mkdir(dirname(full), { recursive: true });
+			await writeFile(full, bytes);
+		},
+		async open(key) {
+			const full = pathFor(key);
+			try {
+				await stat(full);
+			} catch {
+				return;
+			}
+			return createReadStream(full);
+		},
+		async remove(key) {
+			await rm(pathFor(key), { force: true });
+		},
+		async sizeOf(key) {
+			try {
+				return (await stat(pathFor(key))).size;
+			} catch {
+				return;
+			}
+		}
+	};
+}
+/**
+* The checksum a receiver can compare against.
+*
+* Returned when the bytes are stored and never asked of the client: a checksum
+* the uploader computed is a checksum the uploader can lie about, so this one
+* is only useful for telling a *later* reader that the bytes have not changed.
+*/
+function sha256(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+//#endregion
+//#region src/file-collector.ts
+function startFileCollector(storage, store, options = {}) {
+	const interval = options.intervalMs ?? 9e5;
+	const afterHours = options.afterHours ?? 24;
+	let stopped = false;
+	let running = false;
+	const tick = async () => {
+		if (running || stopped) return;
+		running = true;
+		try {
+			const abandoned = await collectAbandonedFiles(storage, /* @__PURE__ */ new Date(), afterHours);
+			if (abandoned.length === 0) return;
+			const removed = [];
+			for (const file of abandoned) {
+				await store.remove(file.storageKey);
+				removed.push(file.id);
+			}
+			await storage.deleteFiles(removed);
+		} catch (error) {
+			console.error("files: a collection pass failed", error);
+		} finally {
+			running = false;
+		}
+	};
+	const timer = setInterval(() => void tick(), interval);
+	timer.unref?.();
+	return { stop: () => {
+		stopped = true;
+		clearInterval(timer);
+	} };
+}
+//#endregion
+export { bootstrapSchema as a, createPostgresStorage as i, createLocalFileStore as n, SCHEMA_HASH_HEADER as o, sha256 as r, createApp as s, startFileCollector as t };
+
+//# sourceMappingURL=file-collector-WWc-eo8h.mjs.map