@formancy/server 0.2.0 → 0.4.0

package/dist/main.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"main.mjs","names":["dnsLookup","undiciFetch"],"sources":["../src/webhook-url.ts","../src/deliver.ts","../src/outbox-worker.ts","../src/challenge-sweeper.ts","../src/sigv4.ts","../src/s3-file-store.ts","../src/main.ts"],"sourcesContent":["import { isIpLiteral, isPrivateAddress } from '@formancy/server-core'\n\n/**\n * URL-level checks on a webhook destination.\n *\n * Here rather than in @formancy/server-core because it needs `URL`, and that\n * package deliberately has no DOM or Node types — see\n * docs/decisions/0008-layered-packages.md. Hand-rolling a URL parser to keep it\n * there would be the wrong trade: a security check built on an approximate\n * parser is the kind that is quietly wrong.\n *\n * The address classification it calls IS pure and lives there, tested\n * exhaustively.\n */\n\nexport interface WebhookUrlOptions {\n  /**\n   * Allow plain http. Off by default: a signature over a body anybody can read\n   * and rewrite in flight is theatre. A deployment posting to a sidecar on the\n   * same host may reasonably turn it on.\n   */\n  allowHttp?: boolean\n  /**\n   * Allow delivery to a private address.\n   *\n   * OFF by default, and the only reason it exists is the case the design\n   * itself names: a receiver running as a sidecar on the same host or the same\n   * private network. Without it that deployment simply cannot use webhooks,\n   * which is a worse outcome than an escape hatch nobody has to touch.\n   *\n   * Turning it on gives up the confused-deputy protection entirely — the\n   * server will then fetch whatever URL a form author writes, including the\n   * cloud metadata service. A deployment that enables it should also be one\n   * where form authors are trusted.\n   */\n  allowPrivateAddresses?: boolean\n}\n\n/**\n * What is wrong with this webhook URL, or undefined when nothing is.\n *\n * Checked when the URL is saved, so an author finds out immediately rather\n * than through a delivery that silently never works.\n */\nexport function webhookUrlProblem(\n  raw: string,\n  options: WebhookUrlOptions = {},\n): string | undefined {\n  let url: URL\n  try {\n    url = new URL(raw)\n  } catch {\n    return 'That is not a URL.'\n  }\n\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n    return `Only http and https can be delivered to, not ${url.protocol.replace(':', '')}.`\n  }\n\n  if (url.protocol === 'http:' && options.allowHttp !== true) {\n    return 'Use https. A signature over a body that anyone can read and rewrite proves nothing.'\n  }\n\n  if (url.username !== '' || url.password !== '') {\n    return 'Remove the credentials from the URL: they would be sent to whatever the host resolves to, and they end up in logs.'\n  }\n\n  // Only a LITERAL address can be judged here. A hostname is checked after\n  // resolution, at delivery time, by the caller — and running the fail-closed\n  // address check against one would refuse every hostname in the world.\n  if (\n    options.allowPrivateAddresses !== true &&\n    isIpLiteral(url.hostname) &&\n    isPrivateAddress(url.hostname)\n  ) {\n    return `${url.hostname} is not an address this server may be pointed at.`\n  }\n\n  return undefined\n}\n","import { lookup as dnsLookup } from 'node:dns/promises'\n// fetch from undici, NOT the global one. Node's global fetch is undici too,\n// but a DIFFERENT instance, and handing it an Agent from this one fails at\n// connect time with \"invalid onRequestStart method\" — a mismatch no unit test\n// reaches, because none of them get as far as opening a socket.\nimport { Agent, fetch as undiciFetch } from 'undici'\nimport { deliveryHeaders, isPrivateAddress } from '@formancy/server-core'\nimport { webhookUrlProblem } from './webhook-url.js'\n\n/**\n * Delivering one webhook, without letting the server be pointed at itself.\n *\n * The hard part is not checking the address. It is making sure the address\n * that was checked is the address that gets connected to.\n *\n * \"Validate the URL, then fetch it\" is defeated by DNS rebinding: the name\n * resolves to a public address while we check, and to 169.254.169.254 a\n * moment later when fetch resolves it again. The two lookups are independent,\n * and an attacker only has to win the second one. So this resolves the name\n * itself, checks every address that comes back, and then connects to a\n * checked address — while still sending the original Host header and SNI, so\n * TLS and virtual hosting keep working.\n *\n * That difference is the whole feature. Everything else here is hygiene.\n */\n\nexport interface DeliveryResult {\n  ok: boolean\n  status?: number\n  /** Why it failed, for the admin's action log. Never the response body. */\n  error?: string\n}\n\nexport interface DeliveryOptions {\n  /** Hard ceiling on the whole attempt, including connect and read. */\n  timeoutMs?: number\n  /** Plain http, for a sidecar on the same host. Off by default. */\n  allowHttp?: boolean\n  /**\n   * Deliver to a private address. Off by default — see webhook-url.ts. This\n   * gives up the confused-deputy protection, so it is opt-in per deployment\n   * and never per form.\n   */\n  allowPrivateAddresses?: boolean\n  /** Swappable so tests do not depend on the network. */\n  resolve?: (hostname: string) => Promise<string[]>\n}\n\nconst RESPONSE_CAP_BYTES = 64 * 1024\n\nasync function resolveAll(hostname: string): Promise<string[]> {\n  const records = await dnsLookup(hostname, { all: true, verbatim: true })\n  return records.map((record) => record.address)\n}\n\nexport async function deliver(\n  input: {\n    url: string\n    body: string\n    secret: string\n    eventId: string\n    attempt: number\n    nowSeconds: number\n  },\n  options: DeliveryOptions = {},\n): Promise<DeliveryResult> {\n  const problem = webhookUrlProblem(input.url, {\n    allowHttp: options.allowHttp ?? false,\n    allowPrivateAddresses: options.allowPrivateAddresses ?? false,\n  })\n  if (problem !== undefined) return { ok: false, error: problem }\n\n  const url = new URL(input.url)\n  const resolve = options.resolve ?? resolveAll\n\n  let addresses: string[]\n  try {\n    addresses = await resolve(url.hostname)\n  } catch (error) {\n    return { ok: false, error: `Could not resolve ${url.hostname}: ${String(error)}` }\n  }\n\n  if (addresses.length === 0) return { ok: false, error: `${url.hostname} resolved to nothing.` }\n\n  // EVERY address, not the first. A name that returns one public and one\n  // private address is the rebinding attack spelled out, and picking the\n  // public one to validate while the stack might use either is no check at all.\n  const forbidden = options.allowPrivateAddresses === true\n    ? undefined\n    : addresses.find((address) => isPrivateAddress(address))\n  if (forbidden !== undefined) {\n    return { ok: false, error: `${url.hostname} resolves to ${forbidden}, which is not reachable from here.` }\n  }\n\n  const pinned = addresses[0]!\n\n  // The agent connects to the address we checked and nothing else. The\n  // original hostname stays in the Host header and in SNI, so TLS validates\n  // against the certificate the site actually has.\n  const family = pinned.includes(':') ? 6 : 4\n  const agent = new Agent({\n    connect: {\n      // undici calls this with `all: true` and then expects an ARRAY of\n      // { address, family }; the plain `(err, address, family)` form that\n      // node:net uses comes back as \"Invalid IP address: undefined\". Both\n      // shapes are handled because which one arrives depends on undici's\n      // internals, and getting it wrong fails only at connect time — where no\n      // unit test looks.\n      lookup: (_hostname, opts: { all?: boolean | undefined }, callback: (...args: never[]) => void) => {\n        const done = callback as unknown as (\n          error: Error | null,\n          result: string | Array<{ address: string; family: number }>,\n          family?: number,\n        ) => void\n        if (opts.all === true) done(null, [{ address: pinned, family }])\n        else done(null, pinned, family)\n      },\n    },\n  })\n\n  try {\n    const response = await undiciFetch(url, {\n      method: 'POST',\n      headers: deliveryHeaders({\n        eventId: input.eventId,\n        secret: input.secret,\n        body: input.body,\n        timestampSeconds: input.nowSeconds,\n        attempt: input.attempt,\n      }),\n      body: input.body,\n      // A redirect is a second destination that nothing has checked. Following\n      // one would hand an attacker the whole guard back.\n      redirect: 'manual',\n      signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),\n      dispatcher: agent,\n    })\n\n    if (response.status >= 300 && response.status < 400) {\n      return { ok: false, status: response.status, error: 'Redirects are not followed.' }\n    }\n\n    // Read a bounded amount and never interpret it. A receiver's body is not\n    // ours to parse, and an unbounded read is a memory exhaustion the receiver\n    // controls.\n    await drain(response, RESPONSE_CAP_BYTES)\n\n    return response.ok\n      ? { ok: true, status: response.status }\n      : { ok: false, status: response.status, error: `Receiver answered ${String(response.status)}.` }\n  } catch (error) {\n    // `fetch failed` on its own tells an operator nothing. The cause carries\n    // the refused connection, the TLS failure or the timeout.\n    const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : ''\n    return { ok: false, error: `${error instanceof Error ? error.message : String(error)}${cause}` }\n  } finally {\n    await agent.close()\n  }\n}\n\n/** Consume at most `cap` bytes so the connection can be reused, then stop. */\nasync function drain(response: { body?: unknown }, cap: number): Promise<void> {\n  const body = response.body as ReadableStream<Uint8Array> | null | undefined\n  const reader = body?.getReader()\n  if (reader === undefined) return\n\n  let read = 0\n  try {\n    for (;;) {\n      const { done, value } = await reader.read()\n      if (done) break\n      read += value?.byteLength ?? 0\n      if (read >= cap) break\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined)\n  }\n}\n","import { drainOutbox } from '@formancy/server-core'\nimport type { Storage } from '@formancy/server-core'\nimport { deliver } from './deliver.js'\n\n/**\n * Runs the outbox on a timer.\n *\n * Everything that decides anything — whether to retry, when, when to give up —\n * is in @formancy/server-core and tested without a network. This is only the\n * clock and the wiring, which is why it is short.\n *\n * NOT a distributed queue. `claimDueDeliveries` does not lock rows, so two\n * replicas would both pick up the same delivery and send it twice. The event\n * id is stable across attempts precisely so a receiver can dedupe that, but a\n * multi-replica deployment should still run exactly one worker until the claim\n * takes a lock. Said plainly here rather than discovered in production.\n */\nexport interface WorkerHandle {\n  stop: () => void\n}\n\nexport function startOutboxWorker(\n  storage: Storage,\n  options: { intervalMs?: number; allowHttp?: boolean; allowPrivateAddresses?: boolean } = {},\n): WorkerHandle {\n  const interval = options.intervalMs ?? 5_000\n  let stopped = false\n  let running = false\n\n  const tick = async (): Promise<void> => {\n    // One pass at a time. Overlapping passes would let a slow receiver cause\n    // the same delivery to be picked up twice by this very process.\n    if (running || stopped) return\n    running = true\n    try {\n      await drainOutbox({\n        storage,\n        now: () => new Date(),\n        random: () => Math.random(),\n        send: async (delivery, webhook, nowSeconds) =>\n          deliver(\n            {\n              url: webhook.url,\n              body: delivery.body,\n              secret: webhook.secret,\n              eventId: delivery.eventId,\n              attempt: delivery.attempt + 1,\n              nowSeconds,\n            },\n            {\n              allowHttp: options.allowHttp ?? false,\n              allowPrivateAddresses: options.allowPrivateAddresses ?? false,\n            },\n          ),\n      })\n    } catch (error) {\n      // A worker that throws is a worker that stops. Deliveries retry on their\n      // own schedule, so the right response to an unexpected failure is to\n      // complain and come back.\n      console.error('outbox: pass failed', error)\n    } finally {\n      running = false\n    }\n  }\n\n  const timer = setInterval(() => void tick(), interval)\n  // Do not hold the process open: a server whose only remaining work is an\n  // empty poll should be able to exit.\n  timer.unref?.()\n\n  return {\n    stop: () => {\n      stopped = true\n      clearInterval(timer)\n    },\n  }\n}\n","import type { Storage } from '@formancy/server-core'\n\n/**\n * Forgetting challenges that can no longer be replayed anyway.\n *\n * A solved challenge is recorded so it cannot be spent twice. Once it has\n * expired the record is doing nothing: the stateless expiry check refuses the\n * solution before the spend is ever consulted. Keeping the row past that point\n * only grows a table.\n *\n * Its own timer rather than a job on the file collector, because the two are\n * configured independently: a deployment can have public forms and no uploads,\n * and that deployment still accumulates spent challenges. Hanging this off the\n * collector would make sweeping conditional on a setting that has nothing to\n * do with it.\n *\n * The same shape as the collector and the outbox worker: a timer in the\n * process, one pass at a time, and a thrown pass complains and comes back\n * rather than stopping the timer. Also not a distributed job — running two is\n * harmless, because deleting an expired row twice is deleting it once.\n */\nexport interface SweeperHandle {\n  stop: () => void\n}\n\nexport function startChallengeSweeper(\n  storage: Storage,\n  options: { intervalMs?: number } = {},\n): SweeperHandle {\n  // Hourly. The rows expire in ten minutes and are a challenge hash each, so\n  // an hour's worth of them is nothing; sweeping more often would be work\n  // nobody asked for.\n  const interval = options.intervalMs ?? 60 * 60_000\n  let stopped = false\n  let running = false\n\n  const tick = async (): Promise<void> => {\n    if (running || stopped) return\n    running = true\n    try {\n      await storage.forgetExpiredChallenges(new Date().toISOString())\n    } catch (error) {\n      // A sweeper that throws is a sweeper that stops, and a table that grows\n      // for a reason nobody is watching.\n      console.error('challenges: a sweep failed', error)\n    } finally {\n      running = false\n    }\n  }\n\n  const timer = setInterval(() => void tick(), interval)\n  timer.unref?.()\n\n  return {\n    stop: () => {\n      stopped = true\n      clearInterval(timer)\n    },\n  }\n}\n","import { createHash, createHmac } from 'node:crypto'\n\n/**\n * AWS Signature Version 4, for the four requests an object store needs.\n *\n * Ours rather than an SDK: sixty lines against a frozen specification, with the\n * algorithm's own vocabulary in the names so it can be read beside AWS's description of\n * it. It signs requests for **any** S3-compatible endpoint, so Garage, real S3 and\n * Backblaze take the same code path\n * ([0064](../../../docs/decisions/0064-an-object-store-behind-the-same-interface.md)).\n *\n * **What verifies it is a real S3 implementation in a container**, refusing a wrong\n * signature with a 403. The unit tests pin the mechanical properties; they cannot tell\n * whether the canonical request is *right*, only that it is consistent with itself.\n */\n\n/** The SHA-256 of an empty body, which a GET or DELETE carries. */\nexport const EMPTY_PAYLOAD_SHA256 =\n  'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\n\nexport interface SignArgs {\n  readonly method: 'GET' | 'PUT' | 'DELETE' | 'HEAD'\n  readonly url: URL\n  /** Headers to sign and send. `host` is required; casing does not matter. */\n  readonly headers: Readonly<Record<string, string>>\n  /** Hex SHA-256 of the body. S3 sends it as a header as well as signing it. */\n  readonly payloadHash: string\n  readonly service: string\n  readonly region: string\n  readonly accessKeyId: string\n  readonly secretAccessKey: string\n  /** Injected so a test is not a test of the clock. */\n  readonly now: Date\n}\n\n/**\n * The headers to send, including `authorization`.\n *\n * Returns headers rather than mutating a request so that the caller's `fetch`\n * options stay the caller's business, and so the signature is inspectable in a\n * test without a server.\n */\nexport function signRequest(args: SignArgs): Record<string, string> {\n  const { method, url, payloadHash, service, region, accessKeyId, secretAccessKey, now } = args\n\n  // Lowercase every name once, here, so nothing below has to wonder. A header\n  // signed under one casing and sent under another is a 403 with no clue in it.\n  const headers: Record<string, string> = {}\n  for (const [name, value] of Object.entries(args.headers)) {\n    headers[name.toLowerCase()] = value\n  }\n\n  if (headers['host'] === undefined) {\n    // AWS requires host in the signature. Failing here, where the message can\n    // say so, beats a server rejecting it for a reason it will not explain.\n    throw new Error('Refusing to sign a request with no host header.')\n  }\n\n  const amzDate = basicIso8601(now)\n  const dateStamp = amzDate.slice(0, 8)\n\n  headers['x-amz-date'] = amzDate\n  // S3 requires this header and requires it to equal the hash in the canonical\n  // request. Set from the same value rather than computed twice: two routes to\n  // one number is how they come to disagree.\n  headers['x-amz-content-sha256'] = payloadHash\n\n  // Sorted by name, because \"canonical\" means both sides sort identically.\n  const names = Object.keys(headers).sort()\n  const canonicalHeaders = names\n    // Sequential spaces collapse and the value is trimmed, per the spec. A\n    // header a proxy reformatted must still hash to the same bytes.\n    .map((name) => `${name}:${(headers[name] ?? '').trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('')\n  const signedHeaders = names.join(';')\n\n  const canonicalRequest = [\n    method,\n    canonicalPath(url, service),\n    canonicalQuery(url),\n    canonicalHeaders,\n    signedHeaders,\n    payloadHash,\n  ].join('\\n')\n\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`\n  const stringToSign = [\n    'AWS4-HMAC-SHA256',\n    amzDate,\n    scope,\n    sha256Hex(canonicalRequest),\n  ].join('\\n')\n\n  // The key is derived per date, region and service, so a leaked signing key is\n  // useless tomorrow, elsewhere, or for another service. That is the whole\n  // reason for the four-step chain rather than signing with the secret.\n  const dateKey = hmac(`AWS4${secretAccessKey}`, dateStamp)\n  const regionKey = hmac(dateKey, region)\n  const serviceKey = hmac(regionKey, service)\n  const signingKey = hmac(serviceKey, 'aws4_request')\n  const signature = hmac(signingKey, stringToSign).toString('hex')\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`\n\n  return headers\n}\n\n/**\n * `20150830T123600Z` — basic ISO 8601, not the extended form.\n *\n * `toISOString()` gives `2015-08-30T12:36:00.000Z`, which is rejected. Stripping\n * the punctuation is the whole conversion, and the credential scope then wants\n * the same instant as `20150830`, which is why this returns the long one and the\n * caller slices it.\n */\nfunction basicIso8601(at: Date): string {\n  return `${at.toISOString().replace(/[-:]/g, '').split('.')[0] ?? ''}Z`\n}\n\n/**\n * The path, encoded **once** for s3 and twice for everything else.\n *\n * This is the one place where s3 departs from the general rule, and getting it\n * wrong produces a signature that is valid for every other AWS service and\n * refused by the only one we call -- and refused only for keys containing a\n * character that needs encoding, which is the worst possible way to find out.\n */\nfunction canonicalPath(url: URL, service: string): string {\n  // `url.pathname` is already percent-encoded by URL parsing, which is exactly\n  // the single encoding s3 wants.\n  const once = url.pathname === '' ? '/' : url.pathname\n  if (service === 's3') return once\n  return once\n    .split('/')\n    .map((segment) => uriEncode(decodeURIComponent(segment)))\n    .join('/')\n}\n\n/** Sorted by encoded name, values encoded, `=` even when empty. */\nfunction canonicalQuery(url: URL): string {\n  const pairs: Array<readonly [string, string]> = []\n  for (const [name, value] of url.searchParams) pairs.push([uriEncode(name), uriEncode(value)])\n  // Sorted after encoding, per the spec: sorting the raw names orders them\n  // differently whenever an encoded byte changes the comparison.\n  pairs.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))\n  return pairs.map(([name, value]) => `${name}=${value}`).join('&')\n}\n\n/**\n * AWS's `UriEncode`, which is not `encodeURIComponent`.\n *\n * The differences are small and each one is a 403: `!`, `'`, `(`, `)` and `*`\n * are left alone by `encodeURIComponent` and must be encoded, hex digits must be\n * uppercase, and a space is `%20` rather than `+`.\n */\nfunction uriEncode(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n}\n\nfunction sha256Hex(value: string): string {\n  return createHash('sha256').update(value, 'utf8').digest('hex')\n}\n\nfunction hmac(key: string | Buffer, data: string): Buffer {\n  return createHmac('sha256', key).update(data, 'utf8').digest()\n}\n","import { createHash } from 'node:crypto'\nimport { Readable } from 'node:stream'\n\nimport type { FileStore } from './file-store.js'\nimport { EMPTY_PAYLOAD_SHA256, signRequest } from './sigv4.js'\n\n/**\n * Uploaded bytes in an S3-compatible object store.\n *\n * The second implementation of `FileStore`. The local one is right for a single\n * container with a volume and is the ceiling on everything above it: two replicas with\n * two volumes each accept uploads the other cannot serve, so any deployment past one\n * server needs this.\n *\n * **Not tied to Amazon.** The design calls for Garage, which is what the\n * integration test runs and what belongs in the compose file; the same code path\n * serves MinIO, Backblaze, Cloudflare R2 and real S3, because the only thing they\n * need in common is SigV4 and path-style addressing.\n *\n * **Bytes still pass through the server**, so the request body cap is the ceiling on a\n * file. A presigned PUT straight from the browser is the roadmap item that removes the\n * server from the data path; this replaces where the bytes land without touching how\n * they arrive.\n *\n * **No multipart.** A single PUT is one request, so the practical ceiling is whatever\n * the store accepts in one -- 5 GB for S3, and far above `FORMANCY_MAX_FILE_BYTES`.\n */\nexport interface S3FileStoreConfig {\n  /** Base URL of the endpoint, e.g. `http://garage:3900` or an S3 regional URL. */\n  readonly endpoint: string\n  readonly bucket: string\n  /** Garage answers to any region name; real S3 does not. */\n  readonly region: string\n  readonly accessKeyId: string\n  readonly secretAccessKey: string\n  /**\n   * How long one request may take before it is abandoned, in milliseconds.\n   *\n   * An object store that stops answering must not become a server that stops\n   * answering. Defaults to thirty seconds, which is generous for one object and\n   * still bounded.\n   */\n  readonly timeoutMs?: number\n}\n\nexport function createS3FileStore(config: S3FileStoreConfig): FileStore {\n  const endpoint = config.endpoint.replace(/\\/+$/, '')\n  const timeoutMs = config.timeoutMs ?? 30_000\n\n  /**\n   * The object's URL, with the key's slashes kept and everything else encoded.\n   *\n   * A key is a path inside the bucket, so its separators are structural. Every\n   * other character has to be encoded or the request line is invalid -- and a\n   * space encoded as `+`, which is what form encoding would do, names a\n   * different object.\n   */\n  const urlFor = (key: string): URL => {\n    if (key === '' || key.includes('\\\\') || key.split('/').includes('..')) {\n      // Keys are minted by the server today. Checked anyway, because the local\n      // store checks it and the two must not disagree about what is legal.\n      throw new Error(`Refusing a storage key that could address another bucket: ${key}`)\n    }\n    const path = key.split('/').map(encodeSegment).join('/')\n    return new URL(`${endpoint}/${encodeSegment(config.bucket)}/${path}`)\n  }\n\n  const send = async (\n    method: 'GET' | 'PUT' | 'DELETE' | 'HEAD',\n    key: string,\n    body?: Buffer,\n  ): Promise<Response> => {\n    const url = urlFor(key)\n    const payloadHash =\n      body === undefined\n        ? EMPTY_PAYLOAD_SHA256\n        : createHash('sha256').update(body).digest('hex')\n\n    // `content-length` is deliberately neither signed nor set. undici refuses a\n    // manually supplied one -- `InvalidArgumentError: invalid content-length\n    // header` -- and computes its own from the body, so setting it is both\n    // impossible and unnecessary. Nothing is lost by not signing it: AWS requires\n    // only `host` and the `x-amz-*` headers in the signature, and\n    // `x-amz-content-sha256` is a hash of the exact bytes, which constrains the\n    // length far more tightly than a signed length would.\n    const headers = signRequest({\n      method,\n      url,\n      headers: { host: url.host },\n      payloadHash,\n      service: 's3',\n      region: config.region,\n      accessKeyId: config.accessKeyId,\n      secretAccessKey: config.secretAccessKey,\n      now: new Date(),\n    })\n\n    return fetch(url, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: new Uint8Array(body) }),\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n  }\n\n  /**\n   * A status that means \"there is no such object\", as opposed to one that means\n   * the store could not answer.\n   *\n   * The distinction is the whole reason this is a named function. Reading a\n   * could-not-answer as absence makes the collector delete the row for bytes that\n   * still exist and makes a download return nothing for a file the person can see\n   * listed.\n   *\n   * **404 only, and 403 deliberately not.** S3 answers 403 for an object a caller may\n   * not list, but this caller owns the bucket -- so 403 means the credentials are\n   * wrong, and reading that as absence would make a misconfigured deployment look like\n   * one where every file has vanished and have the collector delete every row.\n   */\n  const isAbsent = (response: Response): boolean => response.status === 404\n\n  const failed = (method: string, key: string, response: Response): Error =>\n    new Error(`S3 ${method} of ${key} failed: ${String(response.status)} ${response.statusText}`)\n\n  return {\n    async put(key, bytes) {\n      const response = await send('PUT', key, bytes)\n      if (!response.ok) throw failed('PUT', key, response)\n      // The body is an error document or nothing. Reading it releases the\n      // connection back to the pool, which an undrained response does not.\n      await response.arrayBuffer()\n    },\n\n    async open(key) {\n      const response = await send('GET', key)\n      if (isAbsent(response)) {\n        await response.arrayBuffer()\n        return undefined\n      }\n      if (!response.ok || response.body === null) throw failed('GET', key, response)\n      // Streamed rather than buffered: a large attachment should not be held in\n      // memory on its way to one downloader.\n      return Readable.fromWeb(response.body)\n    },\n\n    async remove(key) {\n      const response = await send('DELETE', key)\n      // Absent is success. A collector that crashed between deleting the bytes\n      // and deleting the row has to be safe to run again.\n      if (response.ok || isAbsent(response)) {\n        await response.arrayBuffer()\n        return\n      }\n      throw failed('DELETE', key, response)\n    },\n\n    async sizeOf(key) {\n      const response = await send('HEAD', key)\n      if (isAbsent(response)) return undefined\n      if (!response.ok) throw failed('HEAD', key, response)\n      const length = response.headers.get('content-length')\n      // A store that answered without a length cannot be used to check that the\n      // bytes match what was promised, and pretending it said zero would fail\n      // that check by declaring the file empty.\n      if (length === null) throw new Error(`S3 HEAD of ${key} returned no content-length.`)\n      return Number(length)\n    },\n  }\n}\n\n/**\n * AWS's `UriEncode` for one path segment.\n *\n * `encodeURIComponent` leaves `!'()*` alone and S3 wants them encoded, and its\n * hex digits are already uppercase. Duplicated from the signer rather than\n * shared, because the signer's copy is about hashing and this one is about the\n * request line: if they ever need to differ, they differ, and a shared helper\n * would make that a conversation instead of an edit.\n */\nfunction encodeSegment(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n}\n","import { randomBytes } from 'node:crypto'\nimport postgres from 'postgres'\nimport { createApp } from './app.js'\nimport { bootstrapSchema } from './db.js'\nimport { createPostgresStorage } from './postgres-storage.js'\nimport { startOutboxWorker } from './outbox-worker.js'\nimport { startFileCollector } from './file-collector.js'\nimport { startChallengeSweeper } from './challenge-sweeper.js'\nimport { createLocalFileStore } from './file-store.js'\nimport type { FileStore } from './file-store.js'\nimport { createS3FileStore } from './s3-file-store.js'\n\n// recheck ships a 23 MB JVM jar and a native binary per platform as OPTIONAL\n// dependencies and falls back to a pure-JavaScript engine without them. For\n// one static analysis at publish time, the jar is a large thing to carry in a\n// self-hosted container and the per-platform binaries are an awkward thing to\n// pin in an SBOM. Choosing the pure engine explicitly also makes the verdict\n// deterministic rather than dependent on what happened to install.\nprocess.env['RECHECK_BACKEND'] ??= 'pure'\n\n/**\n * The runnable server: `node dist/main.mjs` with DATABASE_URL set, or\n * `docker compose up` from the repo root, which supplies both.\n *\n * Bootstraps its own tables on start — a self-hosted skeleton that works five\n * minutes after `git clone` is the adoption funnel; migrations arrive with the\n * lifecycle work.\n */\nconst databaseUrl = process.env['DATABASE_URL']\nif (databaseUrl === undefined || databaseUrl === '') {\n  console.error('DATABASE_URL is required, e.g. postgres://formancy:formancy@localhost:5432/formancy')\n  process.exit(1)\n}\n\nconst port = Number(process.env['PORT'] ?? 4380)\nconst sql = postgres(databaseUrl)\n\nlet authSecret = process.env['FORMANCY_AUTH_SECRET']\nif (authSecret === undefined || authSecret === '') {\n  // A generated secret keeps `docker compose up` working, at the cost of every\n  // session dying on restart. Say so loudly rather than failing dev cold.\n  authSecret = randomBytes(33).toString('base64url')\n  console.warn(\n    'FORMANCY_AUTH_SECRET is not set: generated an ephemeral one, sessions will not survive a restart.',\n  )\n}\n\nconst adminEmail = process.env['FORMANCY_ADMIN_EMAIL']\nconst adminPassword = process.env['FORMANCY_ADMIN_PASSWORD']\n\n/**\n * Where uploaded bytes go.\n *\n * Absent means this deployment accepts no files, and that is a supported\n * state rather than a misconfiguration: a form with a file field still renders\n * and still submits, and the field says plainly that there is nowhere to put\n * one. Turning uploads on is naming a directory, which in a container is\n * naming a volume — and a volume is the one thing a self-hoster has to think\n * about, so it is not defaulted.\n */\nconst filesDirectory = process.env['FORMANCY_FILES_DIR']\nconst s3Endpoint = process.env['FORMANCY_S3_ENDPOINT']\n\nif (filesDirectory !== undefined && s3Endpoint !== undefined) {\n  // Two stores means half the files are in one and half in the other, and\n  // nothing records which -- so a later reader gets \"no such file\" for bytes\n  // that exist in the store it did not ask. Refusing at startup is the only\n  // point at which this is cheap to fix.\n  throw new Error(\n    'Set FORMANCY_FILES_DIR or FORMANCY_S3_ENDPOINT, not both: two stores means ' +\n      'files land in one and are looked for in the other.',\n  )\n}\n\n/**\n * The object store, when one is configured.\n *\n * Every field is required once the endpoint is set, and none is defaulted. A\n * bucket name guessed wrong is a deployment that accepts uploads into nothing;\n * credentials guessed wrong are a deployment where every file reads as missing.\n * Both fail here instead.\n */\nconst s3Store = ((): FileStore | undefined => {\n  if (s3Endpoint === undefined) return undefined\n\n  const required = (name: string): string => {\n    const value = process.env[name]\n    if (value === undefined || value === '') {\n      throw new Error(`${name} is required when FORMANCY_S3_ENDPOINT is set.`)\n    }\n    return value\n  }\n\n  return createS3FileStore({\n    endpoint: s3Endpoint,\n    bucket: required('FORMANCY_S3_BUCKET'),\n    // Part of the credential scope, so a wrong region is a signature the store\n    // computes differently and rejects. Garage answers to any name and real S3\n    // does not, which is why there is no default.\n    region: required('FORMANCY_S3_REGION'),\n    accessKeyId: required('FORMANCY_S3_ACCESS_KEY_ID'),\n    secretAccessKey: required('FORMANCY_S3_SECRET_ACCESS_KEY'),\n  })\n})()\n\nconst fileStore =\n  s3Store ?? (filesDirectory === undefined ? undefined : createLocalFileStore(filesDirectory))\n\nconst maxFileBytes = Number(process.env['FORMANCY_MAX_FILE_BYTES'] ?? 10 * 1024 * 1024)\nif (!Number.isFinite(maxFileBytes) || maxFileBytes <= 0) {\n  throw new Error('FORMANCY_MAX_FILE_BYTES must be a positive number of bytes.')\n}\n\n/**\n * Turns the proof-of-work challenge on for anonymous submissions.\n *\n * Unset is a supported state rather than a misconfiguration: a deployment\n * whose forms all require a session has no anonymous surface to protect, and\n * the challenge route says so with a 404 rather than failing. A deployment\n * with public forms should set it — the other layers are rate limits, an\n * origin allowlist and a body cap, all of which an attacker with a few\n * addresses walks past.\n *\n * Separate from FORMANCY_AUTH_SECRET so that rotating one does not invalidate\n * the other: rotating this one costs an unsolved puzzle, rotating that one\n * costs everybody their session.\n */\nconst challengeSecret = process.env['FORMANCY_CHALLENGE_SECRET']\nif (challengeSecret !== undefined && challengeSecret.length < 32) {\n  throw new Error('FORMANCY_CHALLENGE_SECRET must be at least 32 characters, or unset.')\n}\n\nawait bootstrapSchema(sql)\nconst storage = createPostgresStorage(sql)\nconst app = await createApp(storage, {\n  authSecret,\n  ...(adminEmail !== undefined && adminPassword !== undefined\n    ? { bootstrapAdmin: { email: adminEmail, password: adminPassword } }\n    : {}),\n  ...(fileStore === undefined ? {} : { fileStore }),\n  ...(challengeSecret === undefined ? {} : { challengeSecret }),\n  maxFileBytes,\n})\n\n// Queued deliveries are useless until something sends them.\nconst outbox = startOutboxWorker(storage, {\n  ...(process.env['FORMANCY_WEBHOOK_ALLOW_HTTP'] === 'true' ? { allowHttp: true } : {}),\n  // Gives up the SSRF guard. For a sidecar receiver on a trusted network, and\n  // for nothing else.\n  ...(process.env['FORMANCY_WEBHOOK_ALLOW_PRIVATE'] === 'true'\n    ? { allowPrivateAddresses: true }\n    : {}),\n})\n// Somebody who attaches a file and closes the tab leaves bytes behind. A disk\n// that fills up for a reason nobody is watching is the most tedious outage\n// there is.\nconst collector =\n  fileStore === undefined ? undefined : startFileCollector(storage, fileStore)\n\n// Independent of the collector: a deployment can have public forms and no\n// uploads, and that deployment still accumulates spent challenges.\nconst sweeper = challengeSecret === undefined ? undefined : startChallengeSweeper(storage)\n\nfor (const signal of ['SIGINT', 'SIGTERM'] as const) {\n  process.once(signal, () => {\n    outbox.stop()\n    collector?.stop()\n    sweeper?.stop()\n    void app.close().then(() => process.exit(0))\n  })\n}\n\nawait app.listen({ port, host: process.env['HOST'] ?? '0.0.0.0' })\nconsole.log(`formancy server listening on :${port}`)\n\nfor (const signal of ['SIGINT', 'SIGTERM'] as const) {\n  process.on(signal, () => {\n    void app\n      .close()\n      .then(() => sql.end())\n      .then(() => process.exit(0))\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;AA4CA,SAAgB,kBACd,KACA,UAA6B,CAAC,GACV;CACpB,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,GAAG;CACnB,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAChD,OAAO,gDAAgD,IAAI,SAAS,QAAQ,KAAK,EAAE,EAAE;CAGvF,IAAI,IAAI,aAAa,WAAW,QAAQ,cAAc,MACpD,OAAO;CAGT,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAC1C,OAAO;CAMT,IACE,QAAQ,0BAA0B,QAClC,YAAY,IAAI,QAAQ,KACxB,iBAAiB,IAAI,QAAQ,GAE7B,OAAO,GAAG,IAAI,SAAS;AAI3B;;;AC/BA,MAAM,qBAAqB;AAE3B,eAAe,WAAW,UAAqC;CAE7D,QAAO,MADeA,OAAU,UAAU;EAAE,KAAK;EAAM,UAAU;CAAK,CAAC,EAAA,CACxD,KAAK,WAAW,OAAO,OAAO;AAC/C;AAEA,eAAsB,QACpB,OAQA,UAA2B,CAAC,GACH;CACzB,MAAM,UAAU,kBAAkB,MAAM,KAAK;EAC3C,WAAW,QAAQ,aAAa;EAChC,uBAAuB,QAAQ,yBAAyB;CAC1D,CAAC;CACD,IAAI,YAAY,KAAA,GAAW,OAAO;EAAE,IAAI;EAAO,OAAO;CAAQ;CAE9D,MAAM,MAAM,IAAI,IAAI,MAAM,GAAG;CAC7B,MAAM,UAAU,QAAQ,WAAW;CAEnC,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,QAAQ,IAAI,QAAQ;CACxC,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,qBAAqB,IAAI,SAAS,IAAI,OAAO,KAAK;EAAI;CACnF;CAEA,IAAI,UAAU,WAAW,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI,SAAS;CAAuB;CAK9F,MAAM,YAAY,QAAQ,0BAA0B,OAChD,KAAA,IACA,UAAU,MAAM,YAAY,iBAAiB,OAAO,CAAC;CACzD,IAAI,cAAc,KAAA,GAChB,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI,SAAS,eAAe,UAAU;CAAqC;CAG3G,MAAM,SAAS,UAAU;CAKzB,MAAM,SAAS,OAAO,SAAS,GAAG,IAAI,IAAI;CAC1C,MAAM,QAAQ,IAAI,MAAM,EACtB,SAAS,EAOP,SAAS,WAAW,MAAqC,aAAyC;EAChG,MAAM,OAAO;EAKb,IAAI,KAAK,QAAQ,MAAM,KAAK,MAAM,CAAC;GAAE,SAAS;GAAQ;EAAO,CAAC,CAAC;OAC1D,KAAK,MAAM,QAAQ,MAAM;CAChC,EACF,EACF,CAAC;CAED,IAAI;EACF,MAAM,WAAW,MAAMC,QAAY,KAAK;GACtC,QAAQ;GACR,SAAS,gBAAgB;IACvB,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,MAAM,MAAM;IACZ,kBAAkB,MAAM;IACxB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,MAAM;GAGZ,UAAU;GACV,QAAQ,YAAY,QAAQ,QAAQ,aAAa,GAAM;GACvD,YAAY;EACd,CAAC;EAED,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAC9C,OAAO;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO;EAA8B;EAMpF,MAAM,MAAM,UAAU,kBAAkB;EAExC,OAAO,SAAS,KACZ;GAAE,IAAI;GAAM,QAAQ,SAAS;EAAO,IACpC;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO,qBAAqB,OAAO,SAAS,MAAM,EAAE;EAAG;CACnG,SAAS,OAAO;EAGd,MAAM,QAAQ,iBAAiB,SAAS,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,YAAY;EACpG,OAAO;GAAE,IAAI;GAAO,OAAO,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,IAAI;EAAQ;CACjG,UAAU;EACR,MAAM,MAAM,MAAM;CACpB;AACF;;AAGA,eAAe,MAAM,UAA8B,KAA4B;CAE7E,MAAM,SADO,SAAS,MACD,UAAU;CAC/B,IAAI,WAAW,KAAA,GAAW;CAE1B,IAAI,OAAO;CACX,IAAI;EACF,SAAS;GACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,QAAQ,OAAO,cAAc;GAC7B,IAAI,QAAQ,KAAK;EACnB;CACF,UAAU;EACR,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;CAC7C;AACF;;;AC5JA,SAAgB,kBACd,SACA,UAAyF,CAAC,GAC5E;CACd,MAAM,WAAW,QAAQ,cAAc;CACvC,IAAI,UAAU;CACd,IAAI,UAAU;CAEd,MAAM,OAAO,YAA2B;EAGtC,IAAI,WAAW,SAAS;EACxB,UAAU;EACV,IAAI;GACF,MAAM,YAAY;IAChB;IACA,2BAAW,IAAI,KAAK;IACpB,cAAc,KAAK,OAAO;IAC1B,MAAM,OAAO,UAAU,SAAS,eAC9B,QACE;KACE,KAAK,QAAQ;KACb,MAAM,SAAS;KACf,QAAQ,QAAQ;KAChB,SAAS,SAAS;KAClB,SAAS,SAAS,UAAU;KAC5B;IACF,GACA;KACE,WAAW,QAAQ,aAAa;KAChC,uBAAuB,QAAQ,yBAAyB;IAC1D,CACF;GACJ,CAAC;EACH,SAAS,OAAO;GAId,QAAQ,MAAM,uBAAuB,KAAK;EAC5C,UAAU;GACR,UAAU;EACZ;CACF;CAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,QAAQ;CAGrD,MAAM,QAAQ;CAEd,OAAO,EACL,YAAY;EACV,UAAU;EACV,cAAc,KAAK;CACrB,EACF;AACF;;;ACnDA,SAAgB,sBACd,SACA,UAAmC,CAAC,GACrB;CAIf,MAAM,WAAW,QAAQ,cAAc;CACvC,IAAI,UAAU;CACd,IAAI,UAAU;CAEd,MAAM,OAAO,YAA2B;EACtC,IAAI,WAAW,SAAS;EACxB,UAAU;EACV,IAAI;GACF,MAAM,QAAQ,yCAAwB,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC;EAChE,SAAS,OAAO;GAGd,QAAQ,MAAM,8BAA8B,KAAK;EACnD,UAAU;GACR,UAAU;EACZ;CACF;CAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,QAAQ;CACrD,MAAM,QAAQ;CAEd,OAAO,EACL,YAAY;EACV,UAAU;EACV,cAAc,KAAK;CACrB,EACF;AACF;;;;;;;;;;;;;;;;;AC1CA,MAAa,uBACX;;;;;;;;AAwBF,SAAgB,YAAY,MAAwC;CAClE,MAAM,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,aAAa,iBAAiB,QAAQ;CAIzF,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,GACrD,QAAQ,KAAK,YAAY,KAAK;CAGhC,IAAI,QAAQ,YAAY,KAAA,GAGtB,MAAM,IAAI,MAAM,iDAAiD;CAGnE,MAAM,UAAU,aAAa,GAAG;CAChC,MAAM,YAAY,QAAQ,MAAM,GAAG,CAAC;CAEpC,QAAQ,gBAAgB;CAIxB,QAAQ,0BAA0B;CAGlC,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,mBAAmB,MAGtB,KAAK,SAAS,GAAG,KAAK,IAAI,QAAQ,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,GAAG,CAAC,CAC/E,KAAK,EAAE;CACV,MAAM,gBAAgB,MAAM,KAAK,GAAG;CAEpC,MAAM,mBAAmB;EACvB;EACA,cAAc,KAAK,OAAO;EAC1B,eAAe,GAAG;EAClB;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;CAEX,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EACnB;EACA;EACA;EACA,UAAU,gBAAgB;CAC5B,CAAC,CAAC,KAAK,IAAI;CAWX,QAAQ,mBACN,+BAA+B,YAAY,GAAG,MAAM,kBACnC,cAAc,cAJf,KADC,KADA,KADD,KADF,KAAK,OAAO,mBAAmB,SAClB,GAAG,MACA,GAAG,OACF,GAAG,cACJ,GAAG,YAAY,CAAC,CAAC,SAAS,KAIH;CAEvD,OAAO;AACT;;;;;;;;;AAUA,SAAS,aAAa,IAAkB;CACtC,OAAO,GAAG,GAAG,YAAY,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG;AACtE;;;;;;;;;AAUA,SAAS,cAAc,KAAU,SAAyB;CAGxD,MAAM,OAAO,IAAI,aAAa,KAAK,MAAM,IAAI;CAC7C,IAAI,YAAY,MAAM,OAAO;CAC7B,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY,UAAU,mBAAmB,OAAO,CAAC,CAAC,CAAC,CACxD,KAAK,GAAG;AACb;;AAGA,SAAS,eAAe,KAAkB;CACxC,MAAM,QAA0C,CAAC;CACjD,KAAK,MAAM,CAAC,MAAM,UAAU,IAAI,cAAc,MAAM,KAAK,CAAC,UAAU,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC;CAG5F,MAAM,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;CACrD,OAAO,MAAM,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG;AAClE;;;;;;;;AASA,SAAS,UAAU,OAAuB;CACxC,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;AAEA,SAAS,UAAU,OAAuB;CACxC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,KAAK,KAAsB,MAAsB;CACxD,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,MAAM,MAAM,CAAC,CAAC,OAAO;AAC/D;;;AC7HA,SAAgB,kBAAkB,QAAsC;CACtE,MAAM,WAAW,OAAO,SAAS,QAAQ,QAAQ,EAAE;CACnD,MAAM,YAAY,OAAO,aAAa;;;;;;;;;CAUtC,MAAM,UAAU,QAAqB;EACnC,IAAI,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,GAGlE,MAAM,IAAI,MAAM,6DAA6D,KAAK;EAEpF,MAAM,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG;EACvD,OAAO,IAAI,IAAI,GAAG,SAAS,GAAG,cAAc,OAAO,MAAM,EAAE,GAAG,MAAM;CACtE;CAEA,MAAM,OAAO,OACX,QACA,KACA,SACsB;EACtB,MAAM,MAAM,OAAO,GAAG;EACtB,MAAM,cACJ,SAAS,KAAA,IACL,uBACA,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;EASpD,MAAM,UAAU,YAAY;GAC1B;GACA;GACA,SAAS,EAAE,MAAM,IAAI,KAAK;GAC1B;GACA,SAAS;GACT,QAAQ,OAAO;GACf,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,qBAAK,IAAI,KAAK;EAChB,CAAC;EAED,OAAO,MAAM,KAAK;GAChB;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,IAAI,WAAW,IAAI,EAAE;GAC3D,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;CACH;;;;;;;;;;;;;;;CAgBA,MAAM,YAAY,aAAgC,SAAS,WAAW;CAEtE,MAAM,UAAU,QAAgB,KAAa,6BAC3C,IAAI,MAAM,MAAM,OAAO,MAAM,IAAI,WAAW,OAAO,SAAS,MAAM,EAAE,GAAG,SAAS,YAAY;CAE9F,OAAO;EACL,MAAM,IAAI,KAAK,OAAO;GACpB,MAAM,WAAW,MAAM,KAAK,OAAO,KAAK,KAAK;GAC7C,IAAI,CAAC,SAAS,IAAI,MAAM,OAAO,OAAO,KAAK,QAAQ;GAGnD,MAAM,SAAS,YAAY;EAC7B;EAEA,MAAM,KAAK,KAAK;GACd,MAAM,WAAW,MAAM,KAAK,OAAO,GAAG;GACtC,IAAI,SAAS,QAAQ,GAAG;IACtB,MAAM,SAAS,YAAY;IAC3B;GACF;GACA,IAAI,CAAC,SAAS,MAAM,SAAS,SAAS,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ;GAG7E,OAAO,SAAS,QAAQ,SAAS,IAAI;EACvC;EAEA,MAAM,OAAO,KAAK;GAChB,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG;GAGzC,IAAI,SAAS,MAAM,SAAS,QAAQ,GAAG;IACrC,MAAM,SAAS,YAAY;IAC3B;GACF;GACA,MAAM,OAAO,UAAU,KAAK,QAAQ;EACtC;EAEA,MAAM,OAAO,KAAK;GAChB,MAAM,WAAW,MAAM,KAAK,QAAQ,GAAG;GACvC,IAAI,SAAS,QAAQ,GAAG,OAAO,KAAA;GAC/B,IAAI,CAAC,SAAS,IAAI,MAAM,OAAO,QAAQ,KAAK,QAAQ;GACpD,MAAM,SAAS,SAAS,QAAQ,IAAI,gBAAgB;GAIpD,IAAI,WAAW,MAAM,MAAM,IAAI,MAAM,cAAc,IAAI,6BAA6B;GACpF,OAAO,OAAO,MAAM;EACtB;CACF;AACF;;;;;;;;;;AAWA,SAAS,cAAc,OAAuB;CAC5C,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;;;ACtKA,QAAQ,IAAI,uBAAuB;;;;;;;;;AAUnC,MAAM,cAAc,QAAQ,IAAI;AAChC,IAAI,gBAAgB,KAAA,KAAa,gBAAgB,IAAI;CACnD,QAAQ,MAAM,qFAAqF;CACnG,QAAQ,KAAK,CAAC;AAChB;AAEA,MAAM,OAAO,OAAO,QAAQ,IAAI,WAAW,IAAI;AAC/C,MAAM,MAAM,SAAS,WAAW;AAEhC,IAAI,aAAa,QAAQ,IAAI;AAC7B,IAAI,eAAe,KAAA,KAAa,eAAe,IAAI;CAGjD,aAAa,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACjD,QAAQ,KACN,mGACF;AACF;AAEA,MAAM,aAAa,QAAQ,IAAI;AAC/B,MAAM,gBAAgB,QAAQ,IAAI;;;;;;;;;;;AAYlC,MAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAM,aAAa,QAAQ,IAAI;AAE/B,IAAI,mBAAmB,KAAA,KAAa,eAAe,KAAA,GAKjD,MAAM,IAAI,MACR,+HAEF;AAkCF,MAAM,mBAvBwC;CAC5C,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CAErC,MAAM,YAAY,SAAyB;EACzC,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,MAAM,IAAI,MAAM,GAAG,KAAK,+CAA+C;EAEzE,OAAO;CACT;CAEA,OAAO,kBAAkB;EACvB,UAAU;EACV,QAAQ,SAAS,oBAAoB;EAIrC,QAAQ,SAAS,oBAAoB;EACrC,aAAa,SAAS,2BAA2B;EACjD,iBAAiB,SAAS,+BAA+B;CAC3D,CAAC;AACH,EAAA,CAGQ,MAAM,mBAAmB,KAAA,IAAY,KAAA,IAAY,qBAAqB,cAAc;AAE5F,MAAM,eAAe,OAAO,QAAQ,IAAI,8BAA8B,QAAgB;AACtF,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,GACpD,MAAM,IAAI,MAAM,6DAA6D;;;;;;;;;;;;;;;AAiB/E,MAAM,kBAAkB,QAAQ,IAAI;AACpC,IAAI,oBAAoB,KAAA,KAAa,gBAAgB,SAAS,IAC5D,MAAM,IAAI,MAAM,qEAAqE;AAGvF,MAAM,gBAAgB,GAAG;AACzB,MAAM,UAAU,sBAAsB,GAAG;AACzC,MAAM,MAAM,MAAM,UAAU,SAAS;CACnC;CACA,GAAI,eAAe,KAAA,KAAa,kBAAkB,KAAA,IAC9C,EAAE,gBAAgB;EAAE,OAAO;EAAY,UAAU;CAAc,EAAE,IACjE,CAAC;CACL,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;CAC/C,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;CAC3D;AACF,CAAC;AAGD,MAAM,SAAS,kBAAkB,SAAS;CACxC,GAAI,QAAQ,IAAI,mCAAmC,SAAS,EAAE,WAAW,KAAK,IAAI,CAAC;CAGnF,GAAI,QAAQ,IAAI,sCAAsC,SAClD,EAAE,uBAAuB,KAAK,IAC9B,CAAC;AACP,CAAC;AAID,MAAM,YACJ,cAAc,KAAA,IAAY,KAAA,IAAY,mBAAmB,SAAS,SAAS;AAI7E,MAAM,UAAU,oBAAoB,KAAA,IAAY,KAAA,IAAY,sBAAsB,OAAO;AAEzF,KAAK,MAAM,UAAU,CAAC,UAAU,SAAS,GACvC,QAAQ,KAAK,cAAc;CACzB,OAAO,KAAK;CACZ,WAAW,KAAK;CAChB,SAAS,KAAK;CACd,IAAS,MAAM,CAAC,CAAC,WAAW,QAAQ,KAAK,CAAC,CAAC;AAC7C,CAAC;AAGH,MAAM,IAAI,OAAO;CAAE;CAAM,MAAM,QAAQ,IAAI,WAAW;AAAU,CAAC;AACjE,QAAQ,IAAI,iCAAiC,MAAM;AAEnD,KAAK,MAAM,UAAU,CAAC,UAAU,SAAS,GACvC,QAAQ,GAAG,cAAc;CACvB,IACG,MAAM,CAAC,CACP,WAAW,IAAI,IAAI,CAAC,CAAC,CACrB,WAAW,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"main.mjs","names":["dnsLookup","undiciFetch"],"sources":["../src/webhook-url.ts","../src/deliver.ts","../src/outbox-worker.ts","../src/challenge-sweeper.ts","../src/sigv4.ts","../src/s3-file-store.ts","../src/clamd-scanner.ts","../src/main.ts"],"sourcesContent":["import { isIpLiteral, isPrivateAddress } from '@formancy/server-core'\n\n/**\n * URL-level checks on a webhook destination.\n *\n * Here rather than in @formancy/server-core because it needs `URL`, and that\n * package deliberately has no DOM or Node types — see\n * docs/decisions/0008-layered-packages.md. Hand-rolling a URL parser to keep it\n * there would be the wrong trade: a security check built on an approximate\n * parser is the kind that is quietly wrong.\n *\n * The address classification it calls IS pure and lives there, tested\n * exhaustively.\n */\n\nexport interface WebhookUrlOptions {\n  /**\n   * Allow plain http. Off by default: a signature over a body anybody can read\n   * and rewrite in flight is theatre. A deployment posting to a sidecar on the\n   * same host may reasonably turn it on.\n   */\n  allowHttp?: boolean\n  /**\n   * Allow delivery to a private address.\n   *\n   * OFF by default, and the only reason it exists is the case the design\n   * itself names: a receiver running as a sidecar on the same host or the same\n   * private network. Without it that deployment simply cannot use webhooks,\n   * which is a worse outcome than an escape hatch nobody has to touch.\n   *\n   * Turning it on gives up the confused-deputy protection entirely — the\n   * server will then fetch whatever URL a form author writes, including the\n   * cloud metadata service. A deployment that enables it should also be one\n   * where form authors are trusted.\n   */\n  allowPrivateAddresses?: boolean\n}\n\n/**\n * What is wrong with this webhook URL, or undefined when nothing is.\n *\n * Checked when the URL is saved, so an author finds out immediately rather\n * than through a delivery that silently never works.\n */\nexport function webhookUrlProblem(\n  raw: string,\n  options: WebhookUrlOptions = {},\n): string | undefined {\n  let url: URL\n  try {\n    url = new URL(raw)\n  } catch {\n    return 'That is not a URL.'\n  }\n\n  if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n    return `Only http and https can be delivered to, not ${url.protocol.replace(':', '')}.`\n  }\n\n  if (url.protocol === 'http:' && options.allowHttp !== true) {\n    return 'Use https. A signature over a body that anyone can read and rewrite proves nothing.'\n  }\n\n  if (url.username !== '' || url.password !== '') {\n    return 'Remove the credentials from the URL: they would be sent to whatever the host resolves to, and they end up in logs.'\n  }\n\n  // Only a LITERAL address can be judged here. A hostname is checked after\n  // resolution, at delivery time, by the caller — and running the fail-closed\n  // address check against one would refuse every hostname in the world.\n  if (\n    options.allowPrivateAddresses !== true &&\n    isIpLiteral(url.hostname) &&\n    isPrivateAddress(url.hostname)\n  ) {\n    return `${url.hostname} is not an address this server may be pointed at.`\n  }\n\n  return undefined\n}\n","import { lookup as dnsLookup } from 'node:dns/promises'\n// fetch from undici, NOT the global one. Node's global fetch is undici too,\n// but a DIFFERENT instance, and handing it an Agent from this one fails at\n// connect time with \"invalid onRequestStart method\" — a mismatch no unit test\n// reaches, because none of them get as far as opening a socket.\nimport { Agent, fetch as undiciFetch } from 'undici'\nimport { deliveryHeaders, isPrivateAddress } from '@formancy/server-core'\nimport { webhookUrlProblem } from './webhook-url.js'\n\n/**\n * Delivering one webhook, without letting the server be pointed at itself.\n *\n * The hard part is not checking the address. It is making sure the address\n * that was checked is the address that gets connected to.\n *\n * \"Validate the URL, then fetch it\" is defeated by DNS rebinding: the name\n * resolves to a public address while we check, and to 169.254.169.254 a\n * moment later when fetch resolves it again. The two lookups are independent,\n * and an attacker only has to win the second one. So this resolves the name\n * itself, checks every address that comes back, and then connects to a\n * checked address — while still sending the original Host header and SNI, so\n * TLS and virtual hosting keep working.\n *\n * That difference is the whole feature. Everything else here is hygiene.\n */\n\nexport interface DeliveryResult {\n  ok: boolean\n  status?: number\n  /** Why it failed, for the admin's action log. Never the response body. */\n  error?: string\n}\n\nexport interface DeliveryOptions {\n  /** Hard ceiling on the whole attempt, including connect and read. */\n  timeoutMs?: number\n  /** Plain http, for a sidecar on the same host. Off by default. */\n  allowHttp?: boolean\n  /**\n   * Deliver to a private address. Off by default — see webhook-url.ts. This\n   * gives up the confused-deputy protection, so it is opt-in per deployment\n   * and never per form.\n   */\n  allowPrivateAddresses?: boolean\n  /** Swappable so tests do not depend on the network. */\n  resolve?: (hostname: string) => Promise<string[]>\n}\n\nconst RESPONSE_CAP_BYTES = 64 * 1024\n\nasync function resolveAll(hostname: string): Promise<string[]> {\n  const records = await dnsLookup(hostname, { all: true, verbatim: true })\n  return records.map((record) => record.address)\n}\n\nexport async function deliver(\n  input: {\n    url: string\n    body: string\n    secret: string\n    eventId: string\n    attempt: number\n    nowSeconds: number\n  },\n  options: DeliveryOptions = {},\n): Promise<DeliveryResult> {\n  const problem = webhookUrlProblem(input.url, {\n    allowHttp: options.allowHttp ?? false,\n    allowPrivateAddresses: options.allowPrivateAddresses ?? false,\n  })\n  if (problem !== undefined) return { ok: false, error: problem }\n\n  const url = new URL(input.url)\n  const resolve = options.resolve ?? resolveAll\n\n  let addresses: string[]\n  try {\n    addresses = await resolve(url.hostname)\n  } catch (error) {\n    return { ok: false, error: `Could not resolve ${url.hostname}: ${String(error)}` }\n  }\n\n  if (addresses.length === 0) return { ok: false, error: `${url.hostname} resolved to nothing.` }\n\n  // EVERY address, not the first. A name that returns one public and one\n  // private address is the rebinding attack spelled out, and picking the\n  // public one to validate while the stack might use either is no check at all.\n  const forbidden = options.allowPrivateAddresses === true\n    ? undefined\n    : addresses.find((address) => isPrivateAddress(address))\n  if (forbidden !== undefined) {\n    return { ok: false, error: `${url.hostname} resolves to ${forbidden}, which is not reachable from here.` }\n  }\n\n  const pinned = addresses[0]!\n\n  // The agent connects to the address we checked and nothing else. The\n  // original hostname stays in the Host header and in SNI, so TLS validates\n  // against the certificate the site actually has.\n  const family = pinned.includes(':') ? 6 : 4\n  const agent = new Agent({\n    connect: {\n      // undici calls this with `all: true` and then expects an ARRAY of\n      // { address, family }; the plain `(err, address, family)` form that\n      // node:net uses comes back as \"Invalid IP address: undefined\". Both\n      // shapes are handled because which one arrives depends on undici's\n      // internals, and getting it wrong fails only at connect time — where no\n      // unit test looks.\n      lookup: (_hostname, opts: { all?: boolean | undefined }, callback: (...args: never[]) => void) => {\n        const done = callback as unknown as (\n          error: Error | null,\n          result: string | Array<{ address: string; family: number }>,\n          family?: number,\n        ) => void\n        if (opts.all === true) done(null, [{ address: pinned, family }])\n        else done(null, pinned, family)\n      },\n    },\n  })\n\n  try {\n    const response = await undiciFetch(url, {\n      method: 'POST',\n      headers: deliveryHeaders({\n        eventId: input.eventId,\n        secret: input.secret,\n        body: input.body,\n        timestampSeconds: input.nowSeconds,\n        attempt: input.attempt,\n      }),\n      body: input.body,\n      // A redirect is a second destination that nothing has checked. Following\n      // one would hand an attacker the whole guard back.\n      redirect: 'manual',\n      signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),\n      dispatcher: agent,\n    })\n\n    if (response.status >= 300 && response.status < 400) {\n      return { ok: false, status: response.status, error: 'Redirects are not followed.' }\n    }\n\n    // Read a bounded amount and never interpret it. A receiver's body is not\n    // ours to parse, and an unbounded read is a memory exhaustion the receiver\n    // controls.\n    await drain(response, RESPONSE_CAP_BYTES)\n\n    return response.ok\n      ? { ok: true, status: response.status }\n      : { ok: false, status: response.status, error: `Receiver answered ${String(response.status)}.` }\n  } catch (error) {\n    // `fetch failed` on its own tells an operator nothing. The cause carries\n    // the refused connection, the TLS failure or the timeout.\n    const cause = error instanceof Error && error.cause instanceof Error ? `: ${error.cause.message}` : ''\n    return { ok: false, error: `${error instanceof Error ? error.message : String(error)}${cause}` }\n  } finally {\n    await agent.close()\n  }\n}\n\n/** Consume at most `cap` bytes so the connection can be reused, then stop. */\nasync function drain(response: { body?: unknown }, cap: number): Promise<void> {\n  const body = response.body as ReadableStream<Uint8Array> | null | undefined\n  const reader = body?.getReader()\n  if (reader === undefined) return\n\n  let read = 0\n  try {\n    for (;;) {\n      const { done, value } = await reader.read()\n      if (done) break\n      read += value?.byteLength ?? 0\n      if (read >= cap) break\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined)\n  }\n}\n","import { drainOutbox } from '@formancy/server-core'\nimport type { Storage } from '@formancy/server-core'\nimport { deliver } from './deliver.js'\n\n/**\n * Runs the outbox on a timer.\n *\n * Everything that decides anything — whether to retry, when, when to give up —\n * is in @formancy/server-core and tested without a network. This is only the\n * clock and the wiring, which is why it is short.\n *\n * NOT a distributed queue. `claimDueDeliveries` does not lock rows, so two\n * replicas would both pick up the same delivery and send it twice. The event\n * id is stable across attempts precisely so a receiver can dedupe that, but a\n * multi-replica deployment should still run exactly one worker until the claim\n * takes a lock. Said plainly here rather than discovered in production.\n */\nexport interface WorkerHandle {\n  stop: () => void\n}\n\nexport function startOutboxWorker(\n  storage: Storage,\n  options: { intervalMs?: number; allowHttp?: boolean; allowPrivateAddresses?: boolean } = {},\n): WorkerHandle {\n  const interval = options.intervalMs ?? 5_000\n  let stopped = false\n  let running = false\n\n  const tick = async (): Promise<void> => {\n    // One pass at a time. Overlapping passes would let a slow receiver cause\n    // the same delivery to be picked up twice by this very process.\n    if (running || stopped) return\n    running = true\n    try {\n      await drainOutbox({\n        storage,\n        now: () => new Date(),\n        random: () => Math.random(),\n        send: async (delivery, webhook, nowSeconds) =>\n          deliver(\n            {\n              url: webhook.url,\n              body: delivery.body,\n              secret: webhook.secret,\n              eventId: delivery.eventId,\n              attempt: delivery.attempt + 1,\n              nowSeconds,\n            },\n            {\n              allowHttp: options.allowHttp ?? false,\n              allowPrivateAddresses: options.allowPrivateAddresses ?? false,\n            },\n          ),\n      })\n    } catch (error) {\n      // A worker that throws is a worker that stops. Deliveries retry on their\n      // own schedule, so the right response to an unexpected failure is to\n      // complain and come back.\n      console.error('outbox: pass failed', error)\n    } finally {\n      running = false\n    }\n  }\n\n  const timer = setInterval(() => void tick(), interval)\n  // Do not hold the process open: a server whose only remaining work is an\n  // empty poll should be able to exit.\n  timer.unref?.()\n\n  return {\n    stop: () => {\n      stopped = true\n      clearInterval(timer)\n    },\n  }\n}\n","import type { Storage } from '@formancy/server-core'\n\n/**\n * Forgetting challenges that can no longer be replayed anyway.\n *\n * A solved challenge is recorded so it cannot be spent twice. Once it has\n * expired the record is doing nothing: the stateless expiry check refuses the\n * solution before the spend is ever consulted. Keeping the row past that point\n * only grows a table.\n *\n * Its own timer rather than a job on the file collector, because the two are\n * configured independently: a deployment can have public forms and no uploads,\n * and that deployment still accumulates spent challenges. Hanging this off the\n * collector would make sweeping conditional on a setting that has nothing to\n * do with it.\n *\n * The same shape as the collector and the outbox worker: a timer in the\n * process, one pass at a time, and a thrown pass complains and comes back\n * rather than stopping the timer. Also not a distributed job — running two is\n * harmless, because deleting an expired row twice is deleting it once.\n */\nexport interface SweeperHandle {\n  stop: () => void\n}\n\nexport function startChallengeSweeper(\n  storage: Storage,\n  options: { intervalMs?: number } = {},\n): SweeperHandle {\n  // Hourly. The rows expire in ten minutes and are a challenge hash each, so\n  // an hour's worth of them is nothing; sweeping more often would be work\n  // nobody asked for.\n  const interval = options.intervalMs ?? 60 * 60_000\n  let stopped = false\n  let running = false\n\n  const tick = async (): Promise<void> => {\n    if (running || stopped) return\n    running = true\n    try {\n      await storage.forgetExpiredChallenges(new Date().toISOString())\n    } catch (error) {\n      // A sweeper that throws is a sweeper that stops, and a table that grows\n      // for a reason nobody is watching.\n      console.error('challenges: a sweep failed', error)\n    } finally {\n      running = false\n    }\n  }\n\n  const timer = setInterval(() => void tick(), interval)\n  timer.unref?.()\n\n  return {\n    stop: () => {\n      stopped = true\n      clearInterval(timer)\n    },\n  }\n}\n","import { createHash, createHmac } from 'node:crypto'\n\n/**\n * AWS Signature Version 4, for the four requests an object store needs.\n *\n * Ours rather than an SDK: sixty lines against a frozen specification, with the\n * algorithm's own vocabulary in the names so it can be read beside AWS's description of\n * it. It signs requests for **any** S3-compatible endpoint, so Garage, real S3 and\n * Backblaze take the same code path\n * ([0064](../../../docs/decisions/0064-an-object-store-behind-the-same-interface.md)).\n *\n * **What verifies it is a real S3 implementation in a container**, refusing a wrong\n * signature with a 403. The unit tests pin the mechanical properties; they cannot tell\n * whether the canonical request is *right*, only that it is consistent with itself.\n */\n\n/** The SHA-256 of an empty body, which a GET or DELETE carries. */\nexport const EMPTY_PAYLOAD_SHA256 =\n  'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\n\nexport interface SignArgs {\n  readonly method: 'GET' | 'PUT' | 'DELETE' | 'HEAD'\n  readonly url: URL\n  /** Headers to sign and send. `host` is required; casing does not matter. */\n  readonly headers: Readonly<Record<string, string>>\n  /** Hex SHA-256 of the body. S3 sends it as a header as well as signing it. */\n  readonly payloadHash: string\n  readonly service: string\n  readonly region: string\n  readonly accessKeyId: string\n  readonly secretAccessKey: string\n  /** Injected so a test is not a test of the clock. */\n  readonly now: Date\n}\n\n/**\n * The headers to send, including `authorization`.\n *\n * Returns headers rather than mutating a request so that the caller's `fetch`\n * options stay the caller's business, and so the signature is inspectable in a\n * test without a server.\n */\nexport function signRequest(args: SignArgs): Record<string, string> {\n  const { method, url, payloadHash, service, region, accessKeyId, secretAccessKey, now } = args\n\n  // Lowercase every name once, here, so nothing below has to wonder. A header\n  // signed under one casing and sent under another is a 403 with no clue in it.\n  const headers: Record<string, string> = {}\n  for (const [name, value] of Object.entries(args.headers)) {\n    headers[name.toLowerCase()] = value\n  }\n\n  if (headers['host'] === undefined) {\n    // AWS requires host in the signature. Failing here, where the message can\n    // say so, beats a server rejecting it for a reason it will not explain.\n    throw new Error('Refusing to sign a request with no host header.')\n  }\n\n  const amzDate = basicIso8601(now)\n  const dateStamp = amzDate.slice(0, 8)\n\n  headers['x-amz-date'] = amzDate\n  // S3 requires this header and requires it to equal the hash in the canonical\n  // request. Set from the same value rather than computed twice: two routes to\n  // one number is how they come to disagree.\n  headers['x-amz-content-sha256'] = payloadHash\n\n  // Sorted by name, because \"canonical\" means both sides sort identically.\n  const names = Object.keys(headers).sort()\n  const canonicalHeaders = names\n    // Sequential spaces collapse and the value is trimmed, per the spec. A\n    // header a proxy reformatted must still hash to the same bytes.\n    .map((name) => `${name}:${(headers[name] ?? '').trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('')\n  const signedHeaders = names.join(';')\n\n  const canonicalRequest = [\n    method,\n    canonicalPath(url, service),\n    canonicalQuery(url),\n    canonicalHeaders,\n    signedHeaders,\n    payloadHash,\n  ].join('\\n')\n\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`\n  const stringToSign = [\n    'AWS4-HMAC-SHA256',\n    amzDate,\n    scope,\n    sha256Hex(canonicalRequest),\n  ].join('\\n')\n\n  // The key is derived per date, region and service, so a leaked signing key is\n  // useless tomorrow, elsewhere, or for another service. That is the whole\n  // reason for the four-step chain rather than signing with the secret.\n  const dateKey = hmac(`AWS4${secretAccessKey}`, dateStamp)\n  const regionKey = hmac(dateKey, region)\n  const serviceKey = hmac(regionKey, service)\n  const signingKey = hmac(serviceKey, 'aws4_request')\n  const signature = hmac(signingKey, stringToSign).toString('hex')\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`\n\n  return headers\n}\n\n/**\n * `20150830T123600Z` — basic ISO 8601, not the extended form.\n *\n * `toISOString()` gives `2015-08-30T12:36:00.000Z`, which is rejected. Stripping\n * the punctuation is the whole conversion, and the credential scope then wants\n * the same instant as `20150830`, which is why this returns the long one and the\n * caller slices it.\n */\nfunction basicIso8601(at: Date): string {\n  return `${at.toISOString().replace(/[-:]/g, '').split('.')[0] ?? ''}Z`\n}\n\n/**\n * The path, encoded **once** for s3 and twice for everything else.\n *\n * This is the one place where s3 departs from the general rule, and getting it\n * wrong produces a signature that is valid for every other AWS service and\n * refused by the only one we call -- and refused only for keys containing a\n * character that needs encoding, which is the worst possible way to find out.\n */\nfunction canonicalPath(url: URL, service: string): string {\n  // `url.pathname` is already percent-encoded by URL parsing, which is exactly\n  // the single encoding s3 wants.\n  const once = url.pathname === '' ? '/' : url.pathname\n  if (service === 's3') return once\n  return once\n    .split('/')\n    .map((segment) => uriEncode(decodeURIComponent(segment)))\n    .join('/')\n}\n\n/** Sorted by encoded name, values encoded, `=` even when empty. */\nfunction canonicalQuery(url: URL): string {\n  const pairs: Array<readonly [string, string]> = []\n  for (const [name, value] of url.searchParams) pairs.push([uriEncode(name), uriEncode(value)])\n  // Sorted after encoding, per the spec: sorting the raw names orders them\n  // differently whenever an encoded byte changes the comparison.\n  pairs.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))\n  return pairs.map(([name, value]) => `${name}=${value}`).join('&')\n}\n\n/**\n * AWS's `UriEncode`, which is not `encodeURIComponent`.\n *\n * The differences are small and each one is a 403: `!`, `'`, `(`, `)` and `*`\n * are left alone by `encodeURIComponent` and must be encoded, hex digits must be\n * uppercase, and a space is `%20` rather than `+`.\n */\nfunction uriEncode(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n}\n\nfunction sha256Hex(value: string): string {\n  return createHash('sha256').update(value, 'utf8').digest('hex')\n}\n\nfunction hmac(key: string | Buffer, data: string): Buffer {\n  return createHmac('sha256', key).update(data, 'utf8').digest()\n}\n","import { createHash } from 'node:crypto'\nimport { Readable } from 'node:stream'\n\nimport type { FileStore } from './file-store.js'\nimport { EMPTY_PAYLOAD_SHA256, signRequest } from './sigv4.js'\n\n/**\n * Uploaded bytes in an S3-compatible object store.\n *\n * The second implementation of `FileStore`. The local one is right for a single\n * container with a volume and is the ceiling on everything above it: two replicas with\n * two volumes each accept uploads the other cannot serve, so any deployment past one\n * server needs this.\n *\n * **Not tied to Amazon.** The design calls for Garage, which is what the\n * integration test runs and what belongs in the compose file; the same code path\n * serves MinIO, Backblaze, Cloudflare R2 and real S3, because the only thing they\n * need in common is SigV4 and path-style addressing.\n *\n * **Bytes still pass through the server**, so the request body cap is the ceiling on a\n * file. A presigned PUT straight from the browser is the roadmap item that removes the\n * server from the data path; this replaces where the bytes land without touching how\n * they arrive.\n *\n * **No multipart.** A single PUT is one request, so the practical ceiling is whatever\n * the store accepts in one -- 5 GB for S3, and far above `FORMANCY_MAX_FILE_BYTES`.\n */\nexport interface S3FileStoreConfig {\n  /** Base URL of the endpoint, e.g. `http://garage:3900` or an S3 regional URL. */\n  readonly endpoint: string\n  readonly bucket: string\n  /** Garage answers to any region name; real S3 does not. */\n  readonly region: string\n  readonly accessKeyId: string\n  readonly secretAccessKey: string\n  /**\n   * How long one request may take before it is abandoned, in milliseconds.\n   *\n   * An object store that stops answering must not become a server that stops\n   * answering. Defaults to thirty seconds, which is generous for one object and\n   * still bounded.\n   */\n  readonly timeoutMs?: number\n}\n\nexport function createS3FileStore(config: S3FileStoreConfig): FileStore {\n  const endpoint = config.endpoint.replace(/\\/+$/, '')\n  const timeoutMs = config.timeoutMs ?? 30_000\n\n  /**\n   * The object's URL, with the key's slashes kept and everything else encoded.\n   *\n   * A key is a path inside the bucket, so its separators are structural. Every\n   * other character has to be encoded or the request line is invalid -- and a\n   * space encoded as `+`, which is what form encoding would do, names a\n   * different object.\n   */\n  const urlFor = (key: string): URL => {\n    if (key === '' || key.includes('\\\\') || key.split('/').includes('..')) {\n      // Keys are minted by the server today. Checked anyway, because the local\n      // store checks it and the two must not disagree about what is legal.\n      throw new Error(`Refusing a storage key that could address another bucket: ${key}`)\n    }\n    const path = key.split('/').map(encodeSegment).join('/')\n    return new URL(`${endpoint}/${encodeSegment(config.bucket)}/${path}`)\n  }\n\n  const send = async (\n    method: 'GET' | 'PUT' | 'DELETE' | 'HEAD',\n    key: string,\n    body?: Buffer,\n  ): Promise<Response> => {\n    const url = urlFor(key)\n    const payloadHash =\n      body === undefined\n        ? EMPTY_PAYLOAD_SHA256\n        : createHash('sha256').update(body).digest('hex')\n\n    // `content-length` is deliberately neither signed nor set. undici refuses a\n    // manually supplied one -- `InvalidArgumentError: invalid content-length\n    // header` -- and computes its own from the body, so setting it is both\n    // impossible and unnecessary. Nothing is lost by not signing it: AWS requires\n    // only `host` and the `x-amz-*` headers in the signature, and\n    // `x-amz-content-sha256` is a hash of the exact bytes, which constrains the\n    // length far more tightly than a signed length would.\n    const headers = signRequest({\n      method,\n      url,\n      headers: { host: url.host },\n      payloadHash,\n      service: 's3',\n      region: config.region,\n      accessKeyId: config.accessKeyId,\n      secretAccessKey: config.secretAccessKey,\n      now: new Date(),\n    })\n\n    return fetch(url, {\n      method,\n      headers,\n      ...(body === undefined ? {} : { body: new Uint8Array(body) }),\n      signal: AbortSignal.timeout(timeoutMs),\n    })\n  }\n\n  /**\n   * A status that means \"there is no such object\", as opposed to one that means\n   * the store could not answer.\n   *\n   * The distinction is the whole reason this is a named function. Reading a\n   * could-not-answer as absence makes the collector delete the row for bytes that\n   * still exist and makes a download return nothing for a file the person can see\n   * listed.\n   *\n   * **404 only, and 403 deliberately not.** S3 answers 403 for an object a caller may\n   * not list, but this caller owns the bucket -- so 403 means the credentials are\n   * wrong, and reading that as absence would make a misconfigured deployment look like\n   * one where every file has vanished and have the collector delete every row.\n   */\n  const isAbsent = (response: Response): boolean => response.status === 404\n\n  const failed = (method: string, key: string, response: Response): Error =>\n    new Error(`S3 ${method} of ${key} failed: ${String(response.status)} ${response.statusText}`)\n\n  return {\n    async put(key, bytes) {\n      const response = await send('PUT', key, bytes)\n      if (!response.ok) throw failed('PUT', key, response)\n      // The body is an error document or nothing. Reading it releases the\n      // connection back to the pool, which an undrained response does not.\n      await response.arrayBuffer()\n    },\n\n    async open(key) {\n      const response = await send('GET', key)\n      if (isAbsent(response)) {\n        await response.arrayBuffer()\n        return undefined\n      }\n      if (!response.ok || response.body === null) throw failed('GET', key, response)\n      // Streamed rather than buffered: a large attachment should not be held in\n      // memory on its way to one downloader.\n      return Readable.fromWeb(response.body)\n    },\n\n    async remove(key) {\n      const response = await send('DELETE', key)\n      // Absent is success. A collector that crashed between deleting the bytes\n      // and deleting the row has to be safe to run again.\n      if (response.ok || isAbsent(response)) {\n        await response.arrayBuffer()\n        return\n      }\n      throw failed('DELETE', key, response)\n    },\n\n    async sizeOf(key) {\n      const response = await send('HEAD', key)\n      if (isAbsent(response)) return undefined\n      if (!response.ok) throw failed('HEAD', key, response)\n      const length = response.headers.get('content-length')\n      // A store that answered without a length cannot be used to check that the\n      // bytes match what was promised, and pretending it said zero would fail\n      // that check by declaring the file empty.\n      if (length === null) throw new Error(`S3 HEAD of ${key} returned no content-length.`)\n      return Number(length)\n    },\n  }\n}\n\n/**\n * AWS's `UriEncode` for one path segment.\n *\n * `encodeURIComponent` leaves `!'()*` alone and S3 wants them encoded, and its\n * hex digits are already uppercase. Duplicated from the signer rather than\n * shared, because the signer's copy is about hashing and this one is about the\n * request line: if they ever need to differ, they differ, and a shared helper\n * would make that a conversation instead of an edit.\n */\nfunction encodeSegment(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n}\n","import { connect } from 'node:net'\nimport type { Scanner, ScanVerdict } from '@formancy/server-core'\n\n/** How much is sent per INSTREAM chunk. clamd takes chunks of any size up to its stream limit. */\nconst CHUNK = 64 * 1024\n\n/**\n * clamd's own default `StreamMaxLength`, 100 MiB — as the `clamd.conf` ClamAV 1.5.4 ships\n * says, and as measured against it: a 90 MiB stream was answered, a 110 MiB one refused.\n */\nexport const CLAMD_DEFAULT_MAX_BYTES = 100 * 1024 * 1024\n\n/**\n * ClamAV's daemon, asked over its INSTREAM command\n * ([0131](../../../docs/decisions/0131-an-upload-is-scanned-before-it-is-kept.md)).\n *\n * The protocol is clamd's own and small enough to speak directly — the command, the bytes in\n * length-prefixed chunks, a zero-length chunk to end them, and one line back — so this adds\n * no dependency to the server. Its tests run against a stand-in that speaks the protocol as\n * clamd's manual describes it; it was run once against ClamAV 1.5.4 itself, and the\n * documentation says what that showed and what it did not.\n *\n * **Only `stream: OK` is clean.** A finding is refused by its name. A file over clamd's size\n * limit is refused too, because sending it again changes nothing. Anything else — an answer\n * this does not understand, no answer, no daemon — rejects, which the use-case reads as a\n * scanner that cannot be asked, and refuses the file for.\n *\n * **`maxBytes` is clamd's `StreamMaxLength`, and is checked before a byte is sent.** Past\n * it, clamd says so and closes the connection while bytes may still be arriving. Against the\n * stand-in the bytes in flight reset it and the answer was lost to `ECONNRESET`, which reads\n * as a scanner that is down and would tell the person to try again forever; the real clamd\n * measured here answered intact. Checked first, the outcome does not depend on which.\n * Set it to what clamd is configured with.\n */\nexport function createClamdScanner({\n  host,\n  port,\n  maxBytes = CLAMD_DEFAULT_MAX_BYTES,\n  timeoutMs = 30_000,\n}: {\n  host: string\n  port: number\n  maxBytes?: number\n  timeoutMs?: number\n}): Scanner {\n  return {\n    scan: (_file, bytes) =>\n      new Promise<ScanVerdict>((resolve, reject) => {\n        if (bytes.byteLength > maxBytes) {\n          resolve({\n            clean: false,\n            finding: `could not be scanned: larger than the scanner accepts (${String(maxBytes)} bytes)`,\n          })\n          return\n        }\n        const socket = connect({ host, port })\n        const answer: Buffer[] = []\n        let failure: Error | undefined\n\n        socket.setTimeout(timeoutMs, () =>\n          socket.destroy(\n            new Error(\n              `clamd at ${host}:${String(port)} did not answer within ${String(timeoutMs)} ms`,\n            ),\n          ),\n        )\n        socket.on('connect', () => {\n          socket.write('zINSTREAM\\0')\n          for (let at = 0; at < bytes.byteLength; at += CHUNK) {\n            const piece = bytes.subarray(at, at + CHUNK)\n            const length = Buffer.alloc(4)\n            length.writeUInt32BE(piece.byteLength)\n            socket.write(length)\n            socket.write(piece)\n          }\n          // The zero-length chunk that ends the stream. Written, not `end()`ed: clamd\n          // answers on the same connection and closes it itself.\n          socket.write(Buffer.alloc(4))\n        })\n        socket.on('data', (data) => answer.push(data))\n        // Kept rather than rejected on: clamd past its size limit answers and hangs up\n        // while bytes are still being written, and the answer is what counts.\n        socket.on('error', (error) => {\n          failure = error\n        })\n        socket.on('close', () => {\n          const reply = Buffer.concat(answer).toString('utf8').replace(/\\0+$/, '').trim()\n          if (reply === '') {\n            reject(\n              failure ?? new Error(`clamd at ${host}:${String(port)} closed without answering`),\n            )\n            return\n          }\n          const verdict = verdictOf(reply)\n          if (verdict === undefined)\n            reject(new Error(`clamd answered something unexpected: ${reply}`))\n          else resolve(verdict)\n        })\n      }),\n  }\n}\n\nfunction verdictOf(reply: string): ScanVerdict | undefined {\n  if (reply === 'stream: OK') return { clean: true }\n  const found = /^stream: (.+) FOUND$/.exec(reply)\n  if (found !== null) return { clean: false, finding: found[1]! }\n  if (/size limit exceeded/i.test(reply)) {\n    return { clean: false, finding: `could not be scanned: ${reply.replace(/\\.?\\s*ERROR$/, '')}` }\n  }\n  return undefined\n}\n","import { randomBytes } from 'node:crypto'\nimport postgres from 'postgres'\nimport { createApp } from './app.js'\nimport { bootstrapSchema } from './db.js'\nimport { createPostgresStorage } from './postgres-storage.js'\nimport { startOutboxWorker } from './outbox-worker.js'\nimport { startFileCollector } from './file-collector.js'\nimport { startChallengeSweeper } from './challenge-sweeper.js'\nimport { createLocalFileStore } from './file-store.js'\nimport type { FileStore } from './file-store.js'\nimport { createS3FileStore } from './s3-file-store.js'\nimport { CLAMD_DEFAULT_MAX_BYTES, createClamdScanner } from './clamd-scanner.js'\n\n// recheck ships a 23 MB JVM jar and a native binary per platform as OPTIONAL\n// dependencies and falls back to a pure-JavaScript engine without them. For\n// one static analysis at publish time, the jar is a large thing to carry in a\n// self-hosted container and the per-platform binaries are an awkward thing to\n// pin in an SBOM. Choosing the pure engine explicitly also makes the verdict\n// deterministic rather than dependent on what happened to install.\nprocess.env['RECHECK_BACKEND'] ??= 'pure'\n\n/**\n * The runnable server: `node dist/main.mjs` with DATABASE_URL set, or\n * `docker compose up` from the repo root, which supplies both.\n *\n * Bootstraps its own tables on start — a self-hosted skeleton that works five\n * minutes after `git clone` is the adoption funnel; migrations arrive with the\n * lifecycle work.\n */\nconst databaseUrl = process.env['DATABASE_URL']\nif (databaseUrl === undefined || databaseUrl === '') {\n  console.error('DATABASE_URL is required, e.g. postgres://formancy:formancy@localhost:5432/formancy')\n  process.exit(1)\n}\n\nconst port = Number(process.env['PORT'] ?? 4380)\nconst sql = postgres(databaseUrl)\n\nlet authSecret = process.env['FORMANCY_AUTH_SECRET']\nif (authSecret === undefined || authSecret === '') {\n  // A generated secret keeps `docker compose up` working, at the cost of every\n  // session dying on restart. Say so loudly rather than failing dev cold.\n  authSecret = randomBytes(33).toString('base64url')\n  console.warn(\n    'FORMANCY_AUTH_SECRET is not set: generated an ephemeral one, sessions will not survive a restart.',\n  )\n}\n\nconst adminEmail = process.env['FORMANCY_ADMIN_EMAIL']\nconst adminPassword = process.env['FORMANCY_ADMIN_PASSWORD']\n\n/**\n * Where uploaded bytes go.\n *\n * Absent means this deployment accepts no files, and that is a supported\n * state rather than a misconfiguration: a form with a file field still renders\n * and still submits, and the field says plainly that there is nowhere to put\n * one. Turning uploads on is naming a directory, which in a container is\n * naming a volume — and a volume is the one thing a self-hoster has to think\n * about, so it is not defaulted.\n */\nconst filesDirectory = process.env['FORMANCY_FILES_DIR']\nconst s3Endpoint = process.env['FORMANCY_S3_ENDPOINT']\n\nif (filesDirectory !== undefined && s3Endpoint !== undefined) {\n  // Two stores means half the files are in one and half in the other, and\n  // nothing records which -- so a later reader gets \"no such file\" for bytes\n  // that exist in the store it did not ask. Refusing at startup is the only\n  // point at which this is cheap to fix.\n  throw new Error(\n    'Set FORMANCY_FILES_DIR or FORMANCY_S3_ENDPOINT, not both: two stores means ' +\n      'files land in one and are looked for in the other.',\n  )\n}\n\n/**\n * The object store, when one is configured.\n *\n * Every field is required once the endpoint is set, and none is defaulted. A\n * bucket name guessed wrong is a deployment that accepts uploads into nothing;\n * credentials guessed wrong are a deployment where every file reads as missing.\n * Both fail here instead.\n */\nconst s3Store = ((): FileStore | undefined => {\n  if (s3Endpoint === undefined) return undefined\n\n  const required = (name: string): string => {\n    const value = process.env[name]\n    if (value === undefined || value === '') {\n      throw new Error(`${name} is required when FORMANCY_S3_ENDPOINT is set.`)\n    }\n    return value\n  }\n\n  return createS3FileStore({\n    endpoint: s3Endpoint,\n    bucket: required('FORMANCY_S3_BUCKET'),\n    // Part of the credential scope, so a wrong region is a signature the store\n    // computes differently and rejects. Garage answers to any name and real S3\n    // does not, which is why there is no default.\n    region: required('FORMANCY_S3_REGION'),\n    accessKeyId: required('FORMANCY_S3_ACCESS_KEY_ID'),\n    secretAccessKey: required('FORMANCY_S3_SECRET_ACCESS_KEY'),\n  })\n})()\n\nconst fileStore =\n  s3Store ?? (filesDirectory === undefined ? undefined : createLocalFileStore(filesDirectory))\n\nconst maxFileBytes = Number(process.env['FORMANCY_MAX_FILE_BYTES'] ?? 10 * 1024 * 1024)\nif (!Number.isFinite(maxFileBytes) || maxFileBytes <= 0) {\n  throw new Error('FORMANCY_MAX_FILE_BYTES must be a positive number of bytes.')\n}\n\n/**\n * A ClamAV daemon to ask about every upload before its bytes are kept.\n *\n * Unset is a supported state: no file is scanned, which the documentation says. Set, a\n * file is kept only once clamd has called it clean, and refused when clamd cannot be\n * reached — the point of configuring a scanner is that nothing unscanned gets in\n * ([0131](../../../docs/decisions/0131-an-upload-is-scanned-before-it-is-kept.md)).\n * Not checked at startup: clamd takes minutes to load its signatures, and a server that\n * refused to start until then would turn a slow scanner into an outage of everything.\n */\nconst clamdHost = process.env['FORMANCY_CLAMD_HOST']\nconst clamdPort = Number(process.env['FORMANCY_CLAMD_PORT'] ?? 3310)\nconst clamdMaxBytes = Number(process.env['FORMANCY_CLAMD_MAX_BYTES'] ?? CLAMD_DEFAULT_MAX_BYTES)\nif (!Number.isInteger(clamdPort) || clamdPort <= 0 || clamdPort > 65_535) {\n  throw new Error('FORMANCY_CLAMD_PORT must be a port number.')\n}\nif (!Number.isFinite(clamdMaxBytes) || clamdMaxBytes <= 0) {\n  throw new Error(\"FORMANCY_CLAMD_MAX_BYTES must be a positive number of bytes: clamd's StreamMaxLength.\")\n}\nconst scanner =\n  clamdHost === undefined || clamdHost === ''\n    ? undefined\n    : createClamdScanner({ host: clamdHost, port: clamdPort, maxBytes: clamdMaxBytes })\n\n/**\n * Turns the proof-of-work challenge on for anonymous submissions.\n *\n * Unset is a supported state rather than a misconfiguration: a deployment\n * whose forms all require a session has no anonymous surface to protect, and\n * the challenge route says so with a 404 rather than failing. A deployment\n * with public forms should set it — the other layers are rate limits, an\n * origin allowlist and a body cap, all of which an attacker with a few\n * addresses walks past.\n *\n * Separate from FORMANCY_AUTH_SECRET so that rotating one does not invalidate\n * the other: rotating this one costs an unsolved puzzle, rotating that one\n * costs everybody their session.\n */\nconst challengeSecret = process.env['FORMANCY_CHALLENGE_SECRET']\nif (challengeSecret !== undefined && challengeSecret.length < 32) {\n  throw new Error('FORMANCY_CHALLENGE_SECRET must be at least 32 characters, or unset.')\n}\n\nawait bootstrapSchema(sql)\nconst storage = createPostgresStorage(sql)\nconst app = await createApp(storage, {\n  authSecret,\n  ...(adminEmail !== undefined && adminPassword !== undefined\n    ? { bootstrapAdmin: { email: adminEmail, password: adminPassword } }\n    : {}),\n  ...(fileStore === undefined ? {} : { fileStore }),\n  ...(challengeSecret === undefined ? {} : { challengeSecret }),\n  ...(scanner === undefined ? {} : { scanner }),\n  maxFileBytes,\n})\n\n// Queued deliveries are useless until something sends them.\nconst outbox = startOutboxWorker(storage, {\n  ...(process.env['FORMANCY_WEBHOOK_ALLOW_HTTP'] === 'true' ? { allowHttp: true } : {}),\n  // Gives up the SSRF guard. For a sidecar receiver on a trusted network, and\n  // for nothing else.\n  ...(process.env['FORMANCY_WEBHOOK_ALLOW_PRIVATE'] === 'true'\n    ? { allowPrivateAddresses: true }\n    : {}),\n})\n// Somebody who attaches a file and closes the tab leaves bytes behind. A disk\n// that fills up for a reason nobody is watching is the most tedious outage\n// there is.\nconst collector =\n  fileStore === undefined ? undefined : startFileCollector(storage, fileStore)\n\n// Independent of the collector: a deployment can have public forms and no\n// uploads, and that deployment still accumulates spent challenges.\nconst sweeper = challengeSecret === undefined ? undefined : startChallengeSweeper(storage)\n\nfor (const signal of ['SIGINT', 'SIGTERM'] as const) {\n  process.once(signal, () => {\n    outbox.stop()\n    collector?.stop()\n    sweeper?.stop()\n    void app.close().then(() => process.exit(0))\n  })\n}\n\nawait app.listen({ port, host: process.env['HOST'] ?? '0.0.0.0' })\nconsole.log(`formancy server listening on :${port}`)\n\nfor (const signal of ['SIGINT', 'SIGTERM'] as const) {\n  process.on(signal, () => {\n    void app\n      .close()\n      .then(() => sql.end())\n      .then(() => process.exit(0))\n  })\n}\n"],"mappings":";;;;;;;;;;;;;;;AA4CA,SAAgB,kBACd,KACA,UAA6B,CAAC,GACV;CACpB,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,GAAG;CACnB,QAAQ;EACN,OAAO;CACT;CAEA,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAChD,OAAO,gDAAgD,IAAI,SAAS,QAAQ,KAAK,EAAE,EAAE;CAGvF,IAAI,IAAI,aAAa,WAAW,QAAQ,cAAc,MACpD,OAAO;CAGT,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,IAC1C,OAAO;CAMT,IACE,QAAQ,0BAA0B,QAClC,YAAY,IAAI,QAAQ,KACxB,iBAAiB,IAAI,QAAQ,GAE7B,OAAO,GAAG,IAAI,SAAS;AAI3B;;;AC/BA,MAAM,qBAAqB;AAE3B,eAAe,WAAW,UAAqC;CAE7D,QAAO,MADeA,OAAU,UAAU;EAAE,KAAK;EAAM,UAAU;CAAK,CAAC,EAAA,CACxD,KAAK,WAAW,OAAO,OAAO;AAC/C;AAEA,eAAsB,QACpB,OAQA,UAA2B,CAAC,GACH;CACzB,MAAM,UAAU,kBAAkB,MAAM,KAAK;EAC3C,WAAW,QAAQ,aAAa;EAChC,uBAAuB,QAAQ,yBAAyB;CAC1D,CAAC;CACD,IAAI,YAAY,KAAA,GAAW,OAAO;EAAE,IAAI;EAAO,OAAO;CAAQ;CAE9D,MAAM,MAAM,IAAI,IAAI,MAAM,GAAG;CAC7B,MAAM,UAAU,QAAQ,WAAW;CAEnC,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,QAAQ,IAAI,QAAQ;CACxC,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO,OAAO,qBAAqB,IAAI,SAAS,IAAI,OAAO,KAAK;EAAI;CACnF;CAEA,IAAI,UAAU,WAAW,GAAG,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI,SAAS;CAAuB;CAK9F,MAAM,YAAY,QAAQ,0BAA0B,OAChD,KAAA,IACA,UAAU,MAAM,YAAY,iBAAiB,OAAO,CAAC;CACzD,IAAI,cAAc,KAAA,GAChB,OAAO;EAAE,IAAI;EAAO,OAAO,GAAG,IAAI,SAAS,eAAe,UAAU;CAAqC;CAG3G,MAAM,SAAS,UAAU;CAKzB,MAAM,SAAS,OAAO,SAAS,GAAG,IAAI,IAAI;CAC1C,MAAM,QAAQ,IAAI,MAAM,EACtB,SAAS,EAOP,SAAS,WAAW,MAAqC,aAAyC;EAChG,MAAM,OAAO;EAKb,IAAI,KAAK,QAAQ,MAAM,KAAK,MAAM,CAAC;GAAE,SAAS;GAAQ;EAAO,CAAC,CAAC;OAC1D,KAAK,MAAM,QAAQ,MAAM;CAChC,EACF,EACF,CAAC;CAED,IAAI;EACF,MAAM,WAAW,MAAMC,QAAY,KAAK;GACtC,QAAQ;GACR,SAAS,gBAAgB;IACvB,SAAS,MAAM;IACf,QAAQ,MAAM;IACd,MAAM,MAAM;IACZ,kBAAkB,MAAM;IACxB,SAAS,MAAM;GACjB,CAAC;GACD,MAAM,MAAM;GAGZ,UAAU;GACV,QAAQ,YAAY,QAAQ,QAAQ,aAAa,GAAM;GACvD,YAAY;EACd,CAAC;EAED,IAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAC9C,OAAO;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO;EAA8B;EAMpF,MAAM,MAAM,UAAU,kBAAkB;EAExC,OAAO,SAAS,KACZ;GAAE,IAAI;GAAM,QAAQ,SAAS;EAAO,IACpC;GAAE,IAAI;GAAO,QAAQ,SAAS;GAAQ,OAAO,qBAAqB,OAAO,SAAS,MAAM,EAAE;EAAG;CACnG,SAAS,OAAO;EAGd,MAAM,QAAQ,iBAAiB,SAAS,MAAM,iBAAiB,QAAQ,KAAK,MAAM,MAAM,YAAY;EACpG,OAAO;GAAE,IAAI;GAAO,OAAO,GAAG,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,IAAI;EAAQ;CACjG,UAAU;EACR,MAAM,MAAM,MAAM;CACpB;AACF;;AAGA,eAAe,MAAM,UAA8B,KAA4B;CAE7E,MAAM,SADO,SAAS,MACD,UAAU;CAC/B,IAAI,WAAW,KAAA,GAAW;CAE1B,IAAI,OAAO;CACX,IAAI;EACF,SAAS;GACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,QAAQ,OAAO,cAAc;GAC7B,IAAI,QAAQ,KAAK;EACnB;CACF,UAAU;EACR,MAAM,OAAO,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;CAC7C;AACF;;;AC5JA,SAAgB,kBACd,SACA,UAAyF,CAAC,GAC5E;CACd,MAAM,WAAW,QAAQ,cAAc;CACvC,IAAI,UAAU;CACd,IAAI,UAAU;CAEd,MAAM,OAAO,YAA2B;EAGtC,IAAI,WAAW,SAAS;EACxB,UAAU;EACV,IAAI;GACF,MAAM,YAAY;IAChB;IACA,2BAAW,IAAI,KAAK;IACpB,cAAc,KAAK,OAAO;IAC1B,MAAM,OAAO,UAAU,SAAS,eAC9B,QACE;KACE,KAAK,QAAQ;KACb,MAAM,SAAS;KACf,QAAQ,QAAQ;KAChB,SAAS,SAAS;KAClB,SAAS,SAAS,UAAU;KAC5B;IACF,GACA;KACE,WAAW,QAAQ,aAAa;KAChC,uBAAuB,QAAQ,yBAAyB;IAC1D,CACF;GACJ,CAAC;EACH,SAAS,OAAO;GAId,QAAQ,MAAM,uBAAuB,KAAK;EAC5C,UAAU;GACR,UAAU;EACZ;CACF;CAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,QAAQ;CAGrD,MAAM,QAAQ;CAEd,OAAO,EACL,YAAY;EACV,UAAU;EACV,cAAc,KAAK;CACrB,EACF;AACF;;;ACnDA,SAAgB,sBACd,SACA,UAAmC,CAAC,GACrB;CAIf,MAAM,WAAW,QAAQ,cAAc;CACvC,IAAI,UAAU;CACd,IAAI,UAAU;CAEd,MAAM,OAAO,YAA2B;EACtC,IAAI,WAAW,SAAS;EACxB,UAAU;EACV,IAAI;GACF,MAAM,QAAQ,yCAAwB,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC;EAChE,SAAS,OAAO;GAGd,QAAQ,MAAM,8BAA8B,KAAK;EACnD,UAAU;GACR,UAAU;EACZ;CACF;CAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,QAAQ;CACrD,MAAM,QAAQ;CAEd,OAAO,EACL,YAAY;EACV,UAAU;EACV,cAAc,KAAK;CACrB,EACF;AACF;;;;;;;;;;;;;;;;;AC1CA,MAAa,uBACX;;;;;;;;AAwBF,SAAgB,YAAY,MAAwC;CAClE,MAAM,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,aAAa,iBAAiB,QAAQ;CAIzF,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,GACrD,QAAQ,KAAK,YAAY,KAAK;CAGhC,IAAI,QAAQ,YAAY,KAAA,GAGtB,MAAM,IAAI,MAAM,iDAAiD;CAGnE,MAAM,UAAU,aAAa,GAAG;CAChC,MAAM,YAAY,QAAQ,MAAM,GAAG,CAAC;CAEpC,QAAQ,gBAAgB;CAIxB,QAAQ,0BAA0B;CAGlC,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,mBAAmB,MAGtB,KAAK,SAAS,GAAG,KAAK,IAAI,QAAQ,SAAS,GAAA,CAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,GAAG,CAAC,CAC/E,KAAK,EAAE;CACV,MAAM,gBAAgB,MAAM,KAAK,GAAG;CAEpC,MAAM,mBAAmB;EACvB;EACA,cAAc,KAAK,OAAO;EAC1B,eAAe,GAAG;EAClB;EACA;EACA;CACF,CAAC,CAAC,KAAK,IAAI;CAEX,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EACnB;EACA;EACA;EACA,UAAU,gBAAgB;CAC5B,CAAC,CAAC,KAAK,IAAI;CAWX,QAAQ,mBACN,+BAA+B,YAAY,GAAG,MAAM,kBACnC,cAAc,cAJf,KADC,KADA,KADD,KADF,KAAK,OAAO,mBAAmB,SAClB,GAAG,MACA,GAAG,OACF,GAAG,cACJ,GAAG,YAAY,CAAC,CAAC,SAAS,KAIH;CAEvD,OAAO;AACT;;;;;;;;;AAUA,SAAS,aAAa,IAAkB;CACtC,OAAO,GAAG,GAAG,YAAY,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG;AACtE;;;;;;;;;AAUA,SAAS,cAAc,KAAU,SAAyB;CAGxD,MAAM,OAAO,IAAI,aAAa,KAAK,MAAM,IAAI;CAC7C,IAAI,YAAY,MAAM,OAAO;CAC7B,OAAO,KACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY,UAAU,mBAAmB,OAAO,CAAC,CAAC,CAAC,CACxD,KAAK,GAAG;AACb;;AAGA,SAAS,eAAe,KAAkB;CACxC,MAAM,QAA0C,CAAC;CACjD,KAAK,MAAM,CAAC,MAAM,UAAU,IAAI,cAAc,MAAM,KAAK,CAAC,UAAU,IAAI,GAAG,UAAU,KAAK,CAAC,CAAC;CAG5F,MAAM,MAAM,CAAC,IAAI,CAAC,OAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;CACrD,OAAO,MAAM,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,GAAG;AAClE;;;;;;;;AASA,SAAS,UAAU,OAAuB;CACxC,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;AAEA,SAAS,UAAU,OAAuB;CACxC,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK;AAChE;AAEA,SAAS,KAAK,KAAsB,MAAsB;CACxD,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,MAAM,MAAM,CAAC,CAAC,OAAO;AAC/D;;;AC7HA,SAAgB,kBAAkB,QAAsC;CACtE,MAAM,WAAW,OAAO,SAAS,QAAQ,QAAQ,EAAE;CACnD,MAAM,YAAY,OAAO,aAAa;;;;;;;;;CAUtC,MAAM,UAAU,QAAqB;EACnC,IAAI,QAAQ,MAAM,IAAI,SAAS,IAAI,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,GAGlE,MAAM,IAAI,MAAM,6DAA6D,KAAK;EAEpF,MAAM,OAAO,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG;EACvD,OAAO,IAAI,IAAI,GAAG,SAAS,GAAG,cAAc,OAAO,MAAM,EAAE,GAAG,MAAM;CACtE;CAEA,MAAM,OAAO,OACX,QACA,KACA,SACsB;EACtB,MAAM,MAAM,OAAO,GAAG;EACtB,MAAM,cACJ,SAAS,KAAA,IACL,uBACA,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;EASpD,MAAM,UAAU,YAAY;GAC1B;GACA;GACA,SAAS,EAAE,MAAM,IAAI,KAAK;GAC1B;GACA,SAAS;GACT,QAAQ,OAAO;GACf,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,qBAAK,IAAI,KAAK;EAChB,CAAC;EAED,OAAO,MAAM,KAAK;GAChB;GACA;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,IAAI,WAAW,IAAI,EAAE;GAC3D,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;CACH;;;;;;;;;;;;;;;CAgBA,MAAM,YAAY,aAAgC,SAAS,WAAW;CAEtE,MAAM,UAAU,QAAgB,KAAa,6BAC3C,IAAI,MAAM,MAAM,OAAO,MAAM,IAAI,WAAW,OAAO,SAAS,MAAM,EAAE,GAAG,SAAS,YAAY;CAE9F,OAAO;EACL,MAAM,IAAI,KAAK,OAAO;GACpB,MAAM,WAAW,MAAM,KAAK,OAAO,KAAK,KAAK;GAC7C,IAAI,CAAC,SAAS,IAAI,MAAM,OAAO,OAAO,KAAK,QAAQ;GAGnD,MAAM,SAAS,YAAY;EAC7B;EAEA,MAAM,KAAK,KAAK;GACd,MAAM,WAAW,MAAM,KAAK,OAAO,GAAG;GACtC,IAAI,SAAS,QAAQ,GAAG;IACtB,MAAM,SAAS,YAAY;IAC3B;GACF;GACA,IAAI,CAAC,SAAS,MAAM,SAAS,SAAS,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ;GAG7E,OAAO,SAAS,QAAQ,SAAS,IAAI;EACvC;EAEA,MAAM,OAAO,KAAK;GAChB,MAAM,WAAW,MAAM,KAAK,UAAU,GAAG;GAGzC,IAAI,SAAS,MAAM,SAAS,QAAQ,GAAG;IACrC,MAAM,SAAS,YAAY;IAC3B;GACF;GACA,MAAM,OAAO,UAAU,KAAK,QAAQ;EACtC;EAEA,MAAM,OAAO,KAAK;GAChB,MAAM,WAAW,MAAM,KAAK,QAAQ,GAAG;GACvC,IAAI,SAAS,QAAQ,GAAG,OAAO,KAAA;GAC/B,IAAI,CAAC,SAAS,IAAI,MAAM,OAAO,QAAQ,KAAK,QAAQ;GACpD,MAAM,SAAS,SAAS,QAAQ,IAAI,gBAAgB;GAIpD,IAAI,WAAW,MAAM,MAAM,IAAI,MAAM,cAAc,IAAI,6BAA6B;GACpF,OAAO,OAAO,MAAM;EACtB;CACF;AACF;;;;;;;;;;AAWA,SAAS,cAAc,OAAuB;CAC5C,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,cAAc,IAAI,UAAU,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtE;AACF;;;;ACpLA,MAAM,QAAQ;;;;;AAMd,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;AAwBvC,SAAgB,mBAAmB,EACjC,MACA,MACA,WAAW,yBACX,YAAY,OAMF;CACV,OAAO,EACL,OAAO,OAAO,UACZ,IAAI,SAAsB,SAAS,WAAW;EAC5C,IAAI,MAAM,aAAa,UAAU;GAC/B,QAAQ;IACN,OAAO;IACP,SAAS,0DAA0D,OAAO,QAAQ,EAAE;GACtF,CAAC;GACD;EACF;EACA,MAAM,SAAS,QAAQ;GAAE;GAAM;EAAK,CAAC;EACrC,MAAM,SAAmB,CAAC;EAC1B,IAAI;EAEJ,OAAO,WAAW,iBAChB,OAAO,wBACL,IAAI,MACF,YAAY,KAAK,GAAG,OAAO,IAAI,EAAE,yBAAyB,OAAO,SAAS,EAAE,IAC9E,CACF,CACF;EACA,OAAO,GAAG,iBAAiB;GACzB,OAAO,MAAM,aAAa;GAC1B,KAAK,IAAI,KAAK,GAAG,KAAK,MAAM,YAAY,MAAM,OAAO;IACnD,MAAM,QAAQ,MAAM,SAAS,IAAI,KAAK,KAAK;IAC3C,MAAM,SAAS,OAAO,MAAM,CAAC;IAC7B,OAAO,cAAc,MAAM,UAAU;IACrC,OAAO,MAAM,MAAM;IACnB,OAAO,MAAM,KAAK;GACpB;GAGA,OAAO,MAAM,OAAO,MAAM,CAAC,CAAC;EAC9B,CAAC;EACD,OAAO,GAAG,SAAS,SAAS,OAAO,KAAK,IAAI,CAAC;EAG7C,OAAO,GAAG,UAAU,UAAU;GAC5B,UAAU;EACZ,CAAC;EACD,OAAO,GAAG,eAAe;GACvB,MAAM,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,KAAK;GAC9E,IAAI,UAAU,IAAI;IAChB,OACE,2BAAW,IAAI,MAAM,YAAY,KAAK,GAAG,OAAO,IAAI,EAAE,0BAA0B,CAClF;IACA;GACF;GACA,MAAM,UAAU,UAAU,KAAK;GAC/B,IAAI,YAAY,KAAA,GACd,uBAAO,IAAI,MAAM,wCAAwC,OAAO,CAAC;QAC9D,QAAQ,OAAO;EACtB,CAAC;CACH,CAAC,EACL;AACF;AAEA,SAAS,UAAU,OAAwC;CACzD,IAAI,UAAU,cAAc,OAAO,EAAE,OAAO,KAAK;CACjD,MAAM,QAAQ,uBAAuB,KAAK,KAAK;CAC/C,IAAI,UAAU,MAAM,OAAO;EAAE,OAAO;EAAO,SAAS,MAAM;CAAI;CAC9D,IAAI,uBAAuB,KAAK,KAAK,GACnC,OAAO;EAAE,OAAO;EAAO,SAAS,yBAAyB,MAAM,QAAQ,gBAAgB,EAAE;CAAI;AAGjG;;;AC3FA,QAAQ,IAAI,uBAAuB;;;;;;;;;AAUnC,MAAM,cAAc,QAAQ,IAAI;AAChC,IAAI,gBAAgB,KAAA,KAAa,gBAAgB,IAAI;CACnD,QAAQ,MAAM,qFAAqF;CACnG,QAAQ,KAAK,CAAC;AAChB;AAEA,MAAM,OAAO,OAAO,QAAQ,IAAI,WAAW,IAAI;AAC/C,MAAM,MAAM,SAAS,WAAW;AAEhC,IAAI,aAAa,QAAQ,IAAI;AAC7B,IAAI,eAAe,KAAA,KAAa,eAAe,IAAI;CAGjD,aAAa,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CACjD,QAAQ,KACN,mGACF;AACF;AAEA,MAAM,aAAa,QAAQ,IAAI;AAC/B,MAAM,gBAAgB,QAAQ,IAAI;;;;;;;;;;;AAYlC,MAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAM,aAAa,QAAQ,IAAI;AAE/B,IAAI,mBAAmB,KAAA,KAAa,eAAe,KAAA,GAKjD,MAAM,IAAI,MACR,+HAEF;AAkCF,MAAM,mBAvBwC;CAC5C,IAAI,eAAe,KAAA,GAAW,OAAO,KAAA;CAErC,MAAM,YAAY,SAAyB;EACzC,MAAM,QAAQ,QAAQ,IAAI;EAC1B,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC,MAAM,IAAI,MAAM,GAAG,KAAK,+CAA+C;EAEzE,OAAO;CACT;CAEA,OAAO,kBAAkB;EACvB,UAAU;EACV,QAAQ,SAAS,oBAAoB;EAIrC,QAAQ,SAAS,oBAAoB;EACrC,aAAa,SAAS,2BAA2B;EACjD,iBAAiB,SAAS,+BAA+B;CAC3D,CAAC;AACH,EAAA,CAGQ,MAAM,mBAAmB,KAAA,IAAY,KAAA,IAAY,qBAAqB,cAAc;AAE5F,MAAM,eAAe,OAAO,QAAQ,IAAI,8BAA8B,QAAgB;AACtF,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,GACpD,MAAM,IAAI,MAAM,6DAA6D;;;;;;;;;;;AAa/E,MAAM,YAAY,QAAQ,IAAI;AAC9B,MAAM,YAAY,OAAO,QAAQ,IAAI,0BAA0B,IAAI;AACnE,MAAM,gBAAgB,OAAO,QAAQ,IAAI,+BAAA,SAAsD;AAC/F,IAAI,CAAC,OAAO,UAAU,SAAS,KAAK,aAAa,KAAK,YAAY,OAChE,MAAM,IAAI,MAAM,4CAA4C;AAE9D,IAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,GACtD,MAAM,IAAI,MAAM,uFAAuF;AAEzG,MAAM,UACJ,cAAc,KAAA,KAAa,cAAc,KACrC,KAAA,IACA,mBAAmB;CAAE,MAAM;CAAW,MAAM;CAAW,UAAU;AAAc,CAAC;;;;;;;;;;;;;;;AAgBtF,MAAM,kBAAkB,QAAQ,IAAI;AACpC,IAAI,oBAAoB,KAAA,KAAa,gBAAgB,SAAS,IAC5D,MAAM,IAAI,MAAM,qEAAqE;AAGvF,MAAM,gBAAgB,GAAG;AACzB,MAAM,UAAU,sBAAsB,GAAG;AACzC,MAAM,MAAM,MAAM,UAAU,SAAS;CACnC;CACA,GAAI,eAAe,KAAA,KAAa,kBAAkB,KAAA,IAC9C,EAAE,gBAAgB;EAAE,OAAO;EAAY,UAAU;CAAc,EAAE,IACjE,CAAC;CACL,GAAI,cAAc,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU;CAC/C,GAAI,oBAAoB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB;CAC3D,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ;CAC3C;AACF,CAAC;AAGD,MAAM,SAAS,kBAAkB,SAAS;CACxC,GAAI,QAAQ,IAAI,mCAAmC,SAAS,EAAE,WAAW,KAAK,IAAI,CAAC;CAGnF,GAAI,QAAQ,IAAI,sCAAsC,SAClD,EAAE,uBAAuB,KAAK,IAC9B,CAAC;AACP,CAAC;AAID,MAAM,YACJ,cAAc,KAAA,IAAY,KAAA,IAAY,mBAAmB,SAAS,SAAS;AAI7E,MAAM,UAAU,oBAAoB,KAAA,IAAY,KAAA,IAAY,sBAAsB,OAAO;AAEzF,KAAK,MAAM,UAAU,CAAC,UAAU,SAAS,GACvC,QAAQ,KAAK,cAAc;CACzB,OAAO,KAAK;CACZ,WAAW,KAAK;CAChB,SAAS,KAAK;CACd,IAAS,MAAM,CAAC,CAAC,WAAW,QAAQ,KAAK,CAAC,CAAC;AAC7C,CAAC;AAGH,MAAM,IAAI,OAAO;CAAE;CAAM,MAAM,QAAQ,IAAI,WAAW;AAAU,CAAC;AACjE,QAAQ,IAAI,iCAAiC,MAAM;AAEnD,KAAK,MAAM,UAAU,CAAC,UAAU,SAAS,GACvC,QAAQ,GAAG,cAAc;CACvB,IACG,MAAM,CAAC,CACP,WAAW,IAAI,IAAI,CAAC,CAAC,CACrB,WAAW,QAAQ,KAAK,CAAC,CAAC;AAC/B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@formancy/server",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "The self-hostable formancy backend: Fastify routes and Postgres storage over @formancy/server-core.",
   "license": "Apache-2.0",
   "type": "module",
@@ -17,8 +17,8 @@
   ],
   "dependencies": {
     "@fastify/rate-limit": "^11.2.0",
-    "@formancy/server-core": "0.2.0",
-    "@formancy/spec": "0.2.0",
+    "@formancy/server-core": "0.4.0",
+    "@formancy/spec": "0.4.0",
     "@node-rs/argon2": "^2.2.1",
     "drizzle-orm": "^0.45.2",
     "fastify": "^5.12.5",

package/dist/file-collector-WWc-eo8h.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-collector-WWc-eo8h.mjs","names":["argon2Hash","argon2Verify"],"sources":["../src/auth-runtime.ts","../src/app.ts","../src/db.ts","../src/postgres-storage.ts","../src/file-store.ts","../src/file-collector.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\nimport { hash as argon2Hash, verify as argon2Verify } from '@node-rs/argon2'\nimport { SignJWT, jwtVerify } from 'jose'\nimport type { Actor, Role } from '@formancy/server-core'\n\n/**\n * The real cryptography, confined to the composition root: argon2id for\n * secrets at rest, an HMAC-signed short-lived access token for sessions, and\n * a CSPRNG for API keys. server-core never sees any of this — it is handed\n * hash/verify/random functions and stays deterministic under test.\n *\n * HS256 rather than EdDSA for the session token, deliberately for this phase:\n * one secret in one env var is the self-hosting story a single-container\n * deployment can operate, and the signing scheme is an implementation detail\n * of a token that lives fifteen minutes. Revisit with key rotation.\n */\nexport function realSecretHashing(): {\n  hashSecret(secret: string): Promise<string>\n  verifySecret(secret: string, hash: string): Promise<boolean>\n} {\n  return {\n    hashSecret: (secret) => argon2Hash(secret),\n    verifySecret: async (secret, digest) => {\n      try {\n        return await argon2Verify(digest, secret)\n      } catch {\n        // A malformed digest is a failed verification, not a crash: this runs\n        // on the login path with attacker-influenced timing.\n        return false\n      }\n    },\n  }\n}\n\nexport function realRandomToken(): string {\n  return randomBytes(30).toString('base64url')\n}\n\nconst TOKEN_LIFETIME = '15m'\n\nexport interface SessionTokens {\n  issue(actor: Actor): Promise<string>\n  verify(token: string): Promise<Actor | undefined>\n}\n\nexport function createSessionTokens(secret: string): SessionTokens {\n  if (secret.length < 32) {\n    throw new Error(\n      'FORMANCY_AUTH_SECRET must be at least 32 characters. Generate one: openssl rand -base64 33',\n    )\n  }\n  const key = new TextEncoder().encode(secret)\n\n  return {\n    async issue(actor) {\n      return new SignJWT({ role: actor.role, kind: actor.kind })\n        .setProtectedHeader({ alg: 'HS256' })\n        .setSubject(actor.id)\n        .setIssuedAt()\n        .setExpirationTime(TOKEN_LIFETIME)\n        .sign(key)\n    },\n\n    async verify(token) {\n      try {\n        const { payload } = await jwtVerify(token, key, { algorithms: ['HS256'] })\n        const role = payload['role']\n        const kind = payload['kind']\n        if (\n          typeof payload.sub !== 'string' ||\n          (role !== 'admin' && role !== 'editor' && role !== 'viewer') ||\n          (kind !== 'user' && kind !== 'apiKey')\n        ) {\n          return undefined\n        }\n        return { id: payload.sub, role: role as Role, kind }\n      } catch {\n        return undefined\n      }\n    },\n  }\n}\n","import { randomUUID } from 'node:crypto'\nimport Fastify from 'fastify'\nimport type { FileStore } from './file-store.js'\nimport rateLimit from '@fastify/rate-limit'\nimport type { FastifyInstance, FastifyRequest, preHandlerHookHandler } from 'fastify'\nimport {\n  auditedBy,\n  authenticateApiKey,\n  decodeSolution,\n  mintChallenge,\n  verifySolution,\n  healthOf,\n  replayDelivery,\n  authenticateLocal,\n  can,\n  createApiKey,\n  createLocalUser,\n  createSubmission,\n  exportCsv,\n  listForms,\n  listSubmissions,\n  listVersions,\n  offerUpload,\n  publishForm,\n  resolveForm,\n  resumeDraft,\n  saveDraft,\n  startDraft,\n  setFormAccess,\n} from '@formancy/server-core'\nimport type {\n  Action,\n  Actor,\n  AuditDraft,\n  AuthDeps,\n  Role,\n  ServerDeps,\n  ServerOptionsSources,\n  Storage,\n} from '@formancy/server-core'\nimport { createSessionTokens, realRandomToken, realSecretHashing } from './auth-runtime.js'\n\nexport const SCHEMA_HASH_HEADER = 'x-formancy-schema-hash'\n/** Base64 JSON, the shape an ALTCHA client already produces. */\nexport const CHALLENGE_HEADER = 'x-formancy-challenge'\n\n/** Proves the bearer started this draft. Lower-case: Fastify normalises. */\nconst DRAFT_TOKEN_HEADER = 'x-formancy-draft-token'\nexport const API_KEY_HEADER = 'x-formancy-api-key'\n\nexport interface AppOptions {\n  /** Signs the short-lived session tokens. At least 32 characters. */\n  authSecret: string\n  /**\n   * Created at startup IF no user exists yet — the docker-compose path to a\n   * first login. Ignored once any user exists, so it cannot re-seed an admin\n   * into a running installation.\n   */\n  bootstrapAdmin?: { email: string; password: string }\n  /**\n   * Turns the proof-of-work challenge on, and signs the challenges it mints.\n   *\n   * Absent means anonymous submissions are defended by the rate limits, the\n   * origin allowlist and the body cap alone. That is a supported state rather\n   * than a broken one — a deployment whose forms all require a session has\n   * no anonymous surface to protect — and the challenge route says so with a\n   * 404 rather than failing.\n   */\n  challengeSecret?: string\n  /**\n   * The lists a form document may name with `optionsSource`, and how to check a value\n   * against one.\n   *\n   * Without this the membership check in `server-core` is unreachable, which is how it\n   * shipped: the port existed, the use-case called it, and the HTTP server never passed\n   * anything — so `SAFETY-ANALYSIS.md`'s A7 stated a constraint that could not run.\n   * Found by review before the beta.\n   *\n   * Absent is still a supported state, and it means what A7 says it means: the server\n   * has no vocabulary, so it cannot refuse a publish for naming an unknown list and\n   * cannot check a submitted value. A deployment with no sourced field never needs one.\n   */\n  optionsSources?: ServerOptionsSources\n  /**\n   * Anonymous submissions allowed per IP per minute. Off in tests by setting\n   * it high; a real deployment should leave the default.\n   *\n   * NOTE: @fastify/rate-limit's default store is in-memory and therefore\n   * PER PROCESS. Behind more than one replica this counts a fraction of the\n   * traffic and silently permits N times the limit. A multi-replica\n   * deployment must supply a shared store.\n   */\n  submissionRateLimit?: { max: number; timeWindowMs: number }\n  /** Login attempts per IP per minute. Defaults to 10. */\n  loginRateLimit?: { max: number; timeWindowMs: number }\n  /**\n   * Largest accepted request body, in bytes. A structural cap BEFORE parsing:\n   * the JSON parser should never be handed something enormous in the first\n   * place, whatever the schema says afterwards.\n   */\n  bodyLimitBytes?: number\n  /**\n   * Where uploaded bytes go. Absent means this deployment accepts no files:\n   * a form with a file field still renders and still submits, and the field\n   * says plainly that there is nowhere to put one\n   * ([0055](../../../docs/decisions/0055-files-are-claimed.md)).\n   */\n  fileStore?: FileStore\n  /**\n   * Largest file this deployment will accept, whatever a form says. A form\n   * author sets the per-field limit; this is the operator's ceiling over all\n   * of them, because the disk is theirs. Defaults to 10 MB.\n   */\n  maxFileBytes?: number\n}\n\n/**\n * The HTTP surface, split into two planes.\n *\n * PUBLIC — what a person filling a form needs: resolve, submit, drafts. These\n * stay unauthenticated by design; anonymous-submission hardening is its own\n * upcoming step and is opt-in per form.\n *\n * MANAGEMENT — everything an operator does: publish, catalog, submissions,\n * export, users, keys. Authenticated via a session token (login) or an API\n * key header, authorized through server-core's one-table can().\n *\n * This file is the composition root, so THIS is where ambient reality enters:\n * randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays\n * injected and replayable.\n */\nexport async function createApp(storage: Storage, options: AppOptions): Promise<FastifyInstance> {\n  // 256 kB by default. Large enough for a long form with a repeater, small\n  // enough that a request cannot cost meaningful memory before it is rejected.\n  const app = Fastify({ logger: false, bodyLimit: options.bodyLimitBytes ?? 256 * 1024 })\n\n  const maxFileBytes = options.maxFileBytes ?? 10 * 1024 * 1024\n  const fileStore = options.fileStore\n\n  // Bytes arrive as a body, not as JSON, so the parser is told to hand them\n  // over untouched. Registered for every content type because a file is\n  // whatever the reader had — the form's `accept` list is what decides\n  // whether it is allowed, and that is checked before the upload is offered.\n  app.addContentTypeParser('*', { parseAs: 'buffer', bodyLimit: maxFileBytes }, (_request, body, done) => {\n    done(null, body)\n  })\n\n  const submissionLimit = options.submissionRateLimit ?? { max: 30, timeWindowMs: 60_000 }\n  const loginLimit = options.loginRateLimit ?? { max: 10, timeWindowMs: 60_000 }\n  const challengeSecret = options.challengeSecret\n  await app.register(rateLimit, {\n    global: false, // opted into per route: the management plane is authenticated\n    max: submissionLimit.max,\n    timeWindow: submissionLimit.timeWindowMs,\n  })\n\n  const deps: ServerDeps = {\n    storage,\n    newId: () => randomUUID(),\n    nowIso: () => new Date().toISOString(),\n    // The host's own signing key. A draft token is a server-signed bearer\n    // token, which is what that key is already for, and a separate optional\n    // secret would mean drafts are unprotected whenever nobody set one.\n    draftSecret: options.authSecret,\n    ...(options.optionsSources === undefined ? {} : { optionsSources: options.optionsSources }),\n    capabilities: {\n      now: () => Date.now(),\n      today: () => new Date().toISOString().slice(0, 10),\n      random: () => Math.random(),\n    },\n  }\n\n  const authDeps: AuthDeps = {\n    storage,\n    newId: deps.newId,\n    nowIso: deps.nowIso,\n    randomToken: realRandomToken,\n    ...realSecretHashing(),\n  }\n\n  const sessions = createSessionTokens(options.authSecret)\n\n  if (options.bootstrapAdmin !== undefined) {\n    const alreadyThere = await storage.getUserByEmail(options.bootstrapAdmin.email)\n    if (alreadyThere === undefined) {\n      const outcome = await createLocalUser(authDeps, { ...options.bootstrapAdmin, role: 'admin' })\n      if (!outcome.ok) throw new Error(`Bootstrap admin rejected: ${outcome.message}`)\n    }\n  }\n\n  async function actorOf(request: FastifyRequest): Promise<Actor | undefined> {\n    const bearer = request.headers.authorization\n    if (typeof bearer === 'string' && bearer.startsWith('Bearer ')) {\n      return sessions.verify(bearer.slice('Bearer '.length))\n    }\n    const apiKey = request.headers[API_KEY_HEADER]\n    if (typeof apiKey === 'string' && apiKey !== '') {\n      const outcome = await authenticateApiKey(authDeps, apiKey)\n      return outcome.ok ? outcome.actor : undefined\n    }\n    return undefined\n  }\n\n  /** 401 without an identity, 403 with one that lacks the permission — the\n   *  difference tells a client whether to log in or to give up. */\n  function requires(action: Action): preHandlerHookHandler {\n    return async (request, reply) => {\n      const actor = await actorOf(request)\n      if (actor === undefined) {\n        return reply.code(401).send({ error: 'unauthenticated' })\n      }\n      if (!can(actor, action)) {\n        return reply.code(403).send({ error: 'forbidden', action })\n      }\n      ;(request as FastifyRequest & { actor: Actor }).actor = actor\n    }\n  }\n\n  /**\n   * Append an audit row for something that has already happened.\n   *\n   * Never throws. An export that succeeded and an audit row that did not is\n   * bad; an export that 500s because the audit row failed, after the rows have\n   * already been written to the response, is worse and helps nobody. So the\n   * failure is logged loudly at error level and the request stands.\n   *\n   * For a mutation that HAS a transaction, do not use this — pass the entry\n   * into that call so the two commit together. `insertSubmission` is currently\n   * the only one.\n   */\n  async function audit(request: FastifyRequest, draft: AuditDraft): Promise<void> {\n    const actor = (request as FastifyRequest & { actor?: Actor }).actor\n    try {\n      await deps.storage.recordAudit({\n        id: deps.newId(),\n        at: deps.nowIso(),\n        requestId: request.id,\n        ...auditedBy(actor, draft),\n      })\n    } catch (error) {\n      request.log.error({ err: error, action: draft.action }, 'audit row could not be written')\n    }\n  }\n\n  // -------------------------------------------------------------------- auth\n\n  app.post(\n    '/auth/login',\n    {\n      // Enumeration resistance makes a wrong guess cost a full argon2\n      // verification, which is deliberate — but it also means an unlimited\n      // login endpoint is an unlimited invitation to spend the server's CPU.\n      // Tighter than submission: nobody logs in ten times a minute honestly.\n      config: { rateLimit: { max: loginLimit.max, timeWindow: loginLimit.timeWindowMs } },\n    },\n    async (request, reply) => {\n      const body = request.body as { email?: unknown; password?: unknown } | null\n      if (body === null || typeof body.email !== 'string' || typeof body.password !== 'string') {\n        return reply\n          .code(400)\n          .send({ error: 'bad_request', message: 'Body needs { email, password }.' })\n      }\n      const outcome = await authenticateLocal(authDeps, {\n        email: body.email,\n        password: body.password,\n      })\n      if (!outcome.ok) {\n        // Failures too, and this is the pair that matters: a hundred failures\n        // then one success is the shape of an attack, and recording only the\n        // success hides it. The email is the subject because that is what was\n        // tried — there may be no such user.\n        await audit(request, { action: 'auth.login.failed', subject: body.email })\n        return reply.code(401).send({ error: 'invalid_credentials' })\n      }\n      await audit(request, {\n        action: 'auth.login',\n        subject: body.email,\n        actorKind: 'user',\n        actorId: outcome.actor.id,\n      })\n      return reply.send({ token: await sessions.issue(outcome.actor), role: outcome.actor.role })\n    },\n  )\n\n  app.post('/users', { preHandler: requires('user.create') }, async (request, reply) => {\n    const body = request.body as { email?: unknown; password?: unknown; role?: unknown } | null\n    if (\n      body === null ||\n      typeof body.email !== 'string' ||\n      typeof body.password !== 'string' ||\n      (body.role !== 'admin' && body.role !== 'editor' && body.role !== 'viewer')\n    ) {\n      return reply\n        .code(400)\n        .send({ error: 'bad_request', message: 'Body needs { email, password, role }.' })\n    }\n    const outcome = await createLocalUser(authDeps, {\n      email: body.email,\n      password: body.password,\n      role: body.role as Role,\n    })\n    if (!outcome.ok) return reply.code(422).send({ error: 'rejected', message: outcome.message })\n    return reply.code(201).send({ id: outcome.id })\n  })\n\n  app.post('/api-keys', { preHandler: requires('apiKey.create') }, async (request, reply) => {\n    const body = request.body as { name?: unknown; role?: unknown } | null\n    if (\n      body === null ||\n      typeof body.name !== 'string' ||\n      (body.role !== 'admin' && body.role !== 'editor' && body.role !== 'viewer')\n    ) {\n      return reply.code(400).send({ error: 'bad_request', message: 'Body needs { name, role }.' })\n    }\n    const outcome = await createApiKey(authDeps, { name: body.name, role: body.role as Role })\n    if (!outcome.ok) return reply.code(422).send({ error: 'rejected', message: outcome.message })\n    // The one and only time the secret exists in full outside a hash.\n    return reply.code(201).send({ id: outcome.id, secret: outcome.secret })\n  })\n\n  // -------------------------------------------------------------- management\n\n  app.post('/forms', { preHandler: requires('form.publish') }, async (request, reply) => {\n    const body = request.body as { path?: unknown; schema?: unknown } | null\n    if (body === null || typeof body.path !== 'string' || body.path === '' || body.schema === undefined) {\n      return reply.code(400).send({ error: 'bad_request', message: 'Body needs { path, schema }.' })\n    }\n\n    const outcome = await publishForm(deps, {\n      path: body.path,\n      schema: body.schema,\n      // Passed in so the audit row can be written INSIDE the publish's\n      // transaction. Appended here afterwards, it would record a publish that\n      // half-applied as having happened.\n      actor: (request as FastifyRequest & { actor: Actor }).actor,\n    })\n    if (!outcome.ok) {\n      // A switch rather than a ternary chain, so adding a refusal kind to\n      // PublishOutcome fails to compile here until it is given a shape.\n      switch (outcome.kind) {\n        case 'invalid_schema':\n          return reply.code(422).send({ error: outcome.kind, errors: outcome.errors })\n        case 'unsafe_pattern':\n          // The pattern and its complexity, so the author can see which field\n          // and why rather than being told no.\n          return reply.code(422).send({ error: outcome.kind, patterns: outcome.patterns })\n        case 'invalid_logic':\n          return reply.code(422).send({ error: outcome.kind, message: outcome.message })\n        case 'unknown_options_source':\n          // The names, so an author can see which list this deployment has never\n          // heard of rather than being told no. A published version is frozen\n          // forever, so a form naming an unresolvable list would render a message\n          // instead of a chooser with nothing ever having said so.\n          return reply.code(422).send({ error: outcome.kind, sources: outcome.sources })\n      }\n    }\n    return reply.code(201).send({ version: outcome.version, schemaHash: outcome.schemaHash })\n  })\n\n  app.put('/f/:path/access', { preHandler: requires('form.publish') }, async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const body = request.body as { submit?: unknown; allowedOrigins?: unknown } | null\n\n    const submit = body?.submit\n    if (submit !== 'authenticated' && submit !== 'public') {\n      return reply.code(400).send({\n        error: 'invalid_access',\n        message: 'submit must be \"authenticated\" or \"public\".',\n      })\n    }\n\n    const origins = body?.allowedOrigins\n    if (origins !== undefined && !(Array.isArray(origins) && origins.every((o) => typeof o === 'string'))) {\n      return reply.code(400).send({\n        error: 'invalid_access',\n        message: 'allowedOrigins must be an array of strings, or absent for no allowlist.',\n      })\n    }\n\n    const outcome = await setFormAccess(deps, {\n      path,\n      submit,\n      ...(origins === undefined ? {} : { allowedOrigins: origins as string[] }),\n    })\n    if (!outcome.ok) return reply.code(404).send({ error: 'unknown_form' })\n    // A permission change is the event a security review looks for first.\n    await audit(request, {\n      action: 'form.access.changed',\n      subject: path,\n      detail: { submit, allowedOrigins: origins === undefined ? 'unchanged' : (origins as string[]).join(' ') },\n    })\n    return reply.code(204).send()\n  })\n\n  /**\n   * The log itself.\n   *\n   * Admin only, and reading it is NOT audited. A log that records its own\n   * reads grows without bound from a dashboard that polls it, and the entry\n   * would say nothing an access log does not — the events worth recording\n   * are the ones that touch somebody else's data.\n   */\n  app.get('/audit', { preHandler: requires('user.create') }, async (request, reply) => {\n    const raw = (request.query as { limit?: unknown } | undefined)?.limit\n    const asked = typeof raw === 'string' ? Number.parseInt(raw, 10) : 100\n    const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 500) : 100\n    return reply.send({ entries: await deps.storage.listAudit(limit) })\n  })\n\n  /**\n   * Webhook health, and the deliveries that died.\n   *\n   * The reason the breaker keeps its counters on the row rather than in the\n   * worker's memory. A self-hoster has no operations team watching a\n   * dashboard, so a destination refusing deliveries since Tuesday has to be\n   * answerable from the product — otherwise it is found when somebody asks\n   * why the CRM has no leads this week.\n   */\n  app.get('/webhooks', { preHandler: requires('form.publish') }, async (_request, reply) => {\n    const now = new Date(deps.nowIso())\n    const hooks = await deps.storage.listWebhooks()\n    return reply.send({ webhooks: hooks.map((hook) => healthOf(hook, now)) })\n  })\n\n  app.get('/deliveries/dead', { preHandler: requires('form.publish') }, async (request, reply) => {\n    const raw = (request.query as { limit?: unknown } | undefined)?.limit\n    const asked = typeof raw === 'string' ? Number.parseInt(raw, 10) : 50\n    const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 200) : 50\n    const dead = await deps.storage.deadDeliveries(limit)\n    // Not the body. That is the submission's data in another coat, and this\n    // endpoint answers \"what failed\", not \"what was in it\".\n    return reply.send({\n      deliveries: dead.map((delivery) => ({\n        id: delivery.id,\n        webhookId: delivery.webhookId,\n        submissionId: delivery.submissionId,\n        eventId: delivery.eventId,\n        attempt: delivery.attempt,\n        lastError: delivery.lastError,\n      })),\n    })\n  })\n\n  app.post(\n    '/deliveries/:id/replay',\n    { preHandler: requires('form.publish') },\n    async (request, reply) => {\n      const { id } = request.params as { id: string }\n      const outcome = await replayDelivery(\n        { storage: deps.storage, now: () => new Date(deps.nowIso()) },\n        id,\n      )\n\n      if (!outcome.ok) {\n        return outcome.kind === 'unknown'\n          ? reply.code(404).send({ error: 'unknown_delivery' })\n          : reply.code(409).send({\n              error: 'not_dead',\n              state: outcome.state,\n              message:\n                'Only a dead delivery can be replayed. A pending one is already queued, and a delivered one would be sent twice.',\n            })\n      }\n\n      // Recorded: it sends data to a third party on a person's say-so.\n      await audit(request, {\n        action: 'delivery.replayed',\n        subject: id,\n        detail: { webhookId: outcome.delivery.webhookId },\n      })\n      return reply.code(202).send({ id, state: outcome.delivery.state })\n    },\n  )\n\n  /**\n   * A puzzle for an anonymous visitor to solve before submitting.\n   *\n   * Public because the form is: requiring a session to obtain a challenge for\n   * an unauthenticated submission would be a circle. It is cheap to mint and\n   * stateless, so handing one out costs this server a hash.\n   */\n  app.get(\n    '/f/:path/challenge',\n    {\n      // One per submission attempt is the legitimate rate, so the submission\n      // limit is the right one. The point of a proof of work is that the\n      // ATTACKER pays; handing out unlimited puzzles for free is the one part\n      // of it that costs us instead.\n      config: { rateLimit: { max: submissionLimit.max, timeWindow: submissionLimit.timeWindowMs } },\n    },\n    async (request, reply) => {\n      if (challengeSecret === undefined) {\n        // Not configured is not an error: a deployment may decide its forms are\n        // not public enough to need one, and the field should say so rather\n        // than fail.\n        return reply.code(404).send({ error: 'challenge_not_enabled' })\n      }\n      const { path } = request.params as { path: string }\n      const form = await deps.storage.getFormByPath(path)\n      if (form === undefined) return reply.code(404).send({ error: 'unknown_form' })\n\n      return reply.send(\n        await mintChallenge({\n          secret: challengeSecret,\n          nowSeconds: Math.floor(new Date(deps.nowIso()).getTime() / 1000),\n        }),\n      )\n    },\n  )\n\n  /**\n   * Check a submitted solution, and spend it.\n   *\n   * Returns the refusal to send, or undefined when it passed. The spend is\n   * separate from the verification and comes last: the stateless checks say\n   * the solution is correct, and only the database can say it has not been\n   * used — a correct solution stays correct, so without this one puzzle\n   * would buy a thousand submissions.\n   */\n  async function checkChallenge(\n    request: FastifyRequest,\n  ): Promise<{ error: string; message: string } | undefined> {\n    const header = request.headers[CHALLENGE_HEADER]\n    if (typeof header !== 'string' || header === '') {\n      return {\n        error: 'challenge_required',\n        message: `This form needs a solved challenge. Ask GET /f/:path/challenge for one and return it in ${CHALLENGE_HEADER}.`,\n      }\n    }\n\n    const solution = decodeSolution(header)\n    if (solution === undefined) {\n      return { error: 'challenge_malformed', message: 'The challenge header is not base64 JSON.' }\n    }\n\n    const nowSeconds = Math.floor(new Date(deps.nowIso()).getTime() / 1000)\n    const verified = await verifySolution(challengeSecret!, solution, nowSeconds)\n    if (!verified.ok) {\n      return {\n        error: `challenge_${verified.reason}`,\n        message: 'The challenge was not solved. Ask for a new one and try again.',\n      }\n    }\n\n    // The expiry comes back from verification rather than being parsed out of\n     // the salt a second time — one place reads that format.\n    const spent = await deps.storage.spendChallenge(\n      verified.challenge,\n      new Date(verified.expiresAtSeconds * 1000).toISOString(),\n    )\n    if (!spent) {\n      return {\n        error: 'challenge_spent',\n        message: 'That challenge has already been used. Each one is good for one submission.',\n      }\n    }\n    return undefined\n  }\n\n  app.get('/forms', { preHandler: requires('form.read') }, async (_request, reply) => {\n    return reply.send({ forms: await listForms(deps) })\n  })\n\n  app.get('/f/:path/versions', { preHandler: requires('form.read') }, async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const versions = await listVersions(deps, path)\n    if (versions === undefined) return reply.code(404).send({ error: 'unknown_form' })\n    return reply.send({ versions })\n  })\n\n  app.get(\n    '/f/:path/submissions',\n    { preHandler: requires('submission.read') },\n    async (request, reply) => {\n      const { path } = request.params as { path: string }\n      const listed = await listSubmissions(deps, path)\n      if (listed === undefined) return reply.code(404).send({ error: 'unknown_form' })\n      // The event a data protection officer asks about, and the one an audit\n      // log that covers only mutations cannot answer: who read other people's\n      // answers. The count, never the answers.\n      await audit(request, {\n        action: 'submission.read',\n        subject: path,\n        detail: { count: listed.length },\n      })\n      return reply.send({ submissions: listed })\n    },\n  )\n\n  app.get(\n    '/f/:path/submissions/export.csv',\n    { preHandler: requires('submission.export') },\n    async (request, reply) => {\n      const { path } = request.params as { path: string }\n      const csv = await exportCsv(deps, path)\n      if (csv === undefined) return reply.code(404).send({ error: 'unknown_form' })\n      // An export leaves the building. Bytes rather than rows, because that is\n      // what was actually handed over.\n      await audit(request, {\n        action: 'submission.exported',\n        subject: path,\n        detail: { bytes: Buffer.byteLength(csv, 'utf8') },\n      })\n      return reply\n        .header('content-type', 'text/csv; charset=utf-8')\n        .header('content-disposition', `attachment; filename=\"${path}-submissions.csv\"`)\n        .send(csv)\n    },\n  )\n\n  // ------------------------------------------------------------------ public\n\n  /**\n   * Fetch a published form. The one public route deliberately NOT rate-limited.\n   *\n   * Every other unauthenticated route is: submitting, starting a draft, writing\n   * one, reading one, minting a challenge, asking for an upload target. Those are\n   * writes, or guesses, or work somebody can demand of the server. This is the\n   * read every visitor has to make before they can do anything at all.\n   *\n   * Limiting it by IP would refuse the form to real people sharing an address —\n   * an office, a school, a phone network behind CGNAT — and the failure would\n   * look like the form being broken rather than like a limit. That is a worse\n   * outcome than the cheap read it would prevent, and the read is cached by\n   * `schemaHash` anyway.\n   *\n   * Written down because the asymmetry is deliberate and looks like an omission.\n   */\n  app.get('/f/:path', async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const resolved = await resolveForm(deps, path)\n    if (resolved === undefined) return reply.code(404).send({ error: 'unknown_form' })\n    return reply.send({\n      version: resolved.version,\n      schemaHash: resolved.schemaHash,\n      schema: resolved.schema,\n    })\n  })\n\n  /**\n   * Start a draft, and get the only key to it.\n   *\n   * The public plane is anonymous, so a draft has no account behind it. It was\n   * previously addressed by an id the CALLER chose, with no check on either\n   * route: anybody who knew or guessed an id could read a stranger's part-filled\n   * form, and overwrite it — after which that person submits the substituted\n   * content under their own name and nothing says otherwise\n   * ([0062](../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).\n   *\n   * So the server picks the id and signs it, and the token comes back exactly\n   * once. Losing it means losing the draft, which is the correct trade for the\n   * alternative.\n   */\n  app.post(\n    '/f/:path/drafts',\n    {\n      // Unauthenticated, like the submission route, and every call hands out a\n      // key. Cheap per call, but nothing should be free on the public plane.\n      config: { rateLimit: { max: submissionLimit.max, timeWindow: submissionLimit.timeWindowMs } },\n    },\n    async (request, reply) => {\n      const { path } = request.params as { path: string }\n      const started = await startDraft(deps, { path })\n      if (started === undefined) return reply.code(404).send({ error: 'unknown_form' })\n      return reply.code(201).send(started)\n    },\n  )\n\n  app.put(\n    '/f/:path/drafts/:draftId',\n    {\n      // A database row per request, reachable without an account. The submission\n      // route used to be described as \"the one unauthenticated write in the\n      // product\"; that stopped being true when drafts were exposed here, and\n      // nobody moved the limit across.\n      config: { rateLimit: { max: submissionLimit.max, timeWindow: submissionLimit.timeWindowMs } },\n    },\n    async (request, reply) => {\n      const { path, draftId } = request.params as { path: string; draftId: string }\n      const token = request.headers[DRAFT_TOKEN_HEADER]\n      if (typeof token !== 'string') {\n        return reply.code(401).send({ error: 'draft_token_required' })\n      }\n\n      const saved = await saveDraft(deps, { path, draftId, token, data: request.body ?? {} })\n      if (saved === undefined) return reply.code(404).send({ error: 'unknown_form' })\n      if (!saved.saved) return reply.code(403).send({ error: 'draft_token_invalid' })\n      return reply.send({ version: saved.version })\n    },\n  )\n\n  app.get(\n    '/f/:path/drafts/:draftId',\n    {\n      // Limited because this is where a token would be tried one after another.\n      // An HMAC is not realistically guessable, but limiting the write and\n      // leaving the guess surface open is not a position worth defending.\n      config: { rateLimit: { max: submissionLimit.max, timeWindow: submissionLimit.timeWindowMs } },\n    },\n    async (request, reply) => {\n      const { path, draftId } = request.params as { path: string; draftId: string }\n      const token = request.headers[DRAFT_TOKEN_HEADER]\n      if (typeof token !== 'string') {\n        return reply.code(401).send({ error: 'draft_token_required' })\n      }\n\n      const resumed = await resumeDraft(deps, { path, draftId, token })\n      // 404 for a wrong token as well as a missing draft. Answering differently\n      // would confirm which ids exist, which is the enumeration this closed.\n      if (resumed === undefined) return reply.code(404).send({ error: 'unknown_draft' })\n      return reply.send(resumed)\n    },\n  )\n\n  /**\n   * Ask where to put a file.\n   *\n   * Refusing here, before a byte is sent, is the difference between rejecting\n   * a 2 GB upload and receiving one first. The reply carries the id the\n   * submission will reference and the URL to PUT the bytes to.\n   */\n  app.post('/f/:path/files', {\n    config: { rateLimit: { max: submissionLimit.max, timeWindow: submissionLimit.timeWindowMs } },\n  }, async (request, reply) => {\n    if (fileStore === undefined) {\n      return reply.code(501).send({\n        error: 'uploads_unavailable',\n        message: 'This deployment has no file store configured, so it cannot accept uploads.',\n      })\n    }\n\n    const { path } = request.params as { path: string }\n    const resolved = await resolveForm(deps, path)\n    if (resolved === undefined) return reply.code(404).send({ error: 'unknown_form' })\n\n    const form = await storage.getFormByPath(path)\n    if (form === undefined) return reply.code(404).send({ error: 'unknown_form' })\n\n    const actor = await actorOf(request)\n    const origin = request.headers.origin\n\n    const body = (request.body ?? {}) as {\n      field?: unknown\n      name?: unknown\n      size?: unknown\n      contentType?: unknown\n    }\n    const field = typeof body.field === 'string' ? body.field : undefined\n    const name = typeof body.name === 'string' ? body.name : undefined\n    const size = typeof body.size === 'number' ? body.size : undefined\n    const contentType = typeof body.contentType === 'string' ? body.contentType : 'application/octet-stream'\n\n    if (field === undefined || name === undefined || size === undefined) {\n      return reply.code(400).send({\n        error: 'invalid_request',\n        message: 'Send the field, the name and the size of the file you want to upload.',\n      })\n    }\n\n    if (size > maxFileBytes) {\n      return reply.code(413).send({\n        error: 'too_large',\n        message: `This deployment accepts files up to ${String(maxFileBytes)} bytes.`,\n      })\n    }\n\n    const outcome = await offerUpload(\n      { storage, now: () => new Date(), newId: () => randomUUID() },\n      {\n        schema: resolved.schema,\n        form,\n        actor: actor === undefined ? 'anonymous' : 'authenticated',\n        origin: typeof origin === 'string' ? origin : undefined,\n        field,\n        name,\n        size,\n        contentType,\n      },\n    )\n\n    if (!outcome.ok) {\n      const status =\n        outcome.reason === 'not_allowed' ? 403 : outcome.reason === 'too_large' ? 413 : 400\n      return reply.code(status).send({ error: outcome.reason })\n    }\n\n    return reply.code(201).send({\n      id: outcome.file.id,\n      name: outcome.file.name,\n      size: outcome.file.size,\n      contentType: outcome.file.contentType,\n      storageKey: outcome.file.storageKey,\n      // Where to PUT the bytes. A URL rather than a key so an S3 store can\n      // hand back a presigned one here and the client never learns the\n      // difference.\n      uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`,\n    })\n  })\n\n  /** Receive the bytes for a file that was offered. */\n  app.put('/f/:path/files/:id', async (request, reply) => {\n    if (fileStore === undefined) return reply.code(501).send({ error: 'uploads_unavailable' })\n\n    const { path, id } = request.params as { path: string; id: string }\n    const form = await storage.getFormByPath(path)\n    if (form === undefined) return reply.code(404).send({ error: 'unknown_form' })\n\n    const file = await storage.getFile(id)\n    // Checked against the form in the URL: an id alone must not be enough to\n    // write bytes into a form somebody cannot submit to.\n    if (file === undefined || file.formId !== form.id) {\n      return reply.code(404).send({ error: 'unknown_file' })\n    }\n    if (file.state !== 'offered') {\n      // An upload is once. Re-writing a claimed file would change what a\n      // stored submission says was attached to it.\n      return reply.code(409).send({ error: 'already_uploaded' })\n    }\n\n    const bytes = request.body\n    if (!Buffer.isBuffer(bytes)) return reply.code(400).send({ error: 'no_body' })\n    if (bytes.byteLength > maxFileBytes) return reply.code(413).send({ error: 'too_large' })\n    if (bytes.byteLength !== file.size) {\n      // The offer named a size and the offer is what was checked against the\n      // field's limit. Accepting a different number of bytes would make that\n      // check a suggestion.\n      return reply.code(400).send({\n        error: 'size_mismatch',\n        message: `This upload was offered as ${String(file.size)} bytes and ${String(bytes.byteLength)} arrived.`,\n      })\n    }\n\n    await fileStore.put(file.storageKey, bytes)\n    await storage.updateFile({ ...file, state: 'stored' })\n\n    return reply.code(204).send()\n  })\n\n  /**\n   * Serve a file back.\n   *\n   * Always as an attachment, never inline, and `nosniff` alongside it. Stored\n   * cross-site scripting through an uploaded HTML or SVG file is the most\n   * commonly exploited vulnerability in this product category, and the real\n   * answer is a separate hostname — which a single-container deployment does\n   * not have. Forcing a download is the accommodation, and it is the one place\n   * this deployment model genuinely costs something.\n   */\n  app.get('/f/:path/files/:id', async (request, reply) => {\n    if (fileStore === undefined) return reply.code(501).send({ error: 'uploads_unavailable' })\n\n    const { path, id } = request.params as { path: string; id: string }\n    const actor = await actorOf(request)\n    if (actor === undefined) return reply.code(401).send({ error: 'unauthenticated' })\n\n    const form = await storage.getFormByPath(path)\n    const file = await storage.getFile(id)\n    if (form === undefined || file === undefined || file.formId !== form.id) {\n      return reply.code(404).send({ error: 'unknown_file' })\n    }\n\n    const stream = await fileStore.open(file.storageKey)\n    if (stream === undefined) return reply.code(404).send({ error: 'unknown_file' })\n\n    return reply\n      .header('content-type', 'application/octet-stream')\n      .header('x-content-type-options', 'nosniff')\n      .header('content-security-policy', \"default-src 'none'; sandbox\")\n      // The reader's own name for it, quoted and stripped of anything that\n      // could end the header early.\n      .header('content-disposition', `attachment; filename=\"${file.name.replace(/[\"\\r\\n]/g, '')}\"`)\n      .send(stream)\n  })\n\n  app.post(\n    '/f/:path/submissions',\n    {\n      // The unauthenticated write that matters most, and no longer the only\n      // one: drafts write too, and are limited the same way. Keyed by IP, which\n      // is the only identity an anonymous submitter has.\n      config: { rateLimit: { max: submissionLimit.max, timeWindow: submissionLimit.timeWindowMs } },\n    },\n    async (request, reply) => {\n    const { path } = request.params as { path: string }\n    const declaredSchemaHash = request.headers[SCHEMA_HASH_HEADER]\n    if (typeof declaredSchemaHash !== 'string' || declaredSchemaHash === '') {\n      return reply.code(400).send({\n        error: 'missing_schema_hash',\n        message: `Send the schema hash you rendered in the ${SCHEMA_HASH_HEADER} header.`,\n      })\n    }\n\n    // The public plane is public, so an identity is optional here — but if one\n    // is presented and valid, the access policy does not apply to it. An\n    // invalid credential is treated as no credential rather than as an error:\n    // this route's job is to accept submissions, not to adjudicate logins.\n    const actor = await actorOf(request)\n    const origin = request.headers.origin\n\n    // Before the engine runs, and only for a visitor who is not signed in.\n    // Somebody with a session has already paid a cost the challenge is a\n    // substitute for, and making them solve a puzzle as well would be\n    // ceremony — while an anonymous submission is the surface this exists\n    // to protect.\n    if (challengeSecret !== undefined && actor === undefined) {\n      const refusal = await checkChallenge(request)\n      if (refusal !== undefined) return reply.code(400).send(refusal)\n    }\n\n    const outcome = await createSubmission(deps, {\n      path,\n      declaredSchemaHash,\n      data: request.body ?? {},\n      actor: actor === undefined ? 'anonymous' : 'authenticated',\n      ...(typeof origin === 'string' ? { origin } : {}),\n    })\n\n    if (outcome.ok) return reply.code(201).send({ id: outcome.id, data: outcome.canonicalData })\n\n    switch (outcome.kind) {\n      case 'unknown_form':\n        return reply.code(404).send({ error: 'unknown_form' })\n      case 'version_changed':\n        // 409 carries the CURRENT schema so the client can re-render and\n        // preserve what it can, instead of guessing why it was refused.\n        return reply.code(409).send({\n          error: 'FORM_VERSION_CHANGED',\n          current:\n            outcome.current === undefined\n              ? undefined\n              : {\n                  version: outcome.current.version,\n                  schemaHash: outcome.current.schemaHash,\n                  schema: outcome.current.schema,\n                },\n        })\n      case 'invalid':\n        // The identical error shape the client's engine produces, so server\n        // errors render through the same code path as local ones.\n        return reply.code(422).send({ error: 'invalid', errors: outcome.errors })\n      case 'forbidden':\n        // Deliberately says nothing about WHICH rule refused. \"Not public\" and\n        // \"not from your origin\" are the same answer to someone probing.\n        return reply.code(403).send({ error: 'forbidden' })\n      case 'source_unavailable':\n        // 503 and not 422: nothing about the submission is wrong, a list this\n        // deployment owns could not vouch for it. Retryable, and the draft still\n        // holds the answers — where accepting the value unchecked would store\n        // something nobody can detect afterwards.\n        return reply\n          .code(503)\n          .send({ error: 'source_unavailable', source: outcome.source })\n    }\n    },\n  )\n\n  return app\n}\n","import { jsonb, integer, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core'\nimport type postgres from 'postgres'\n\n/**\n * The thin slice's tables. Three rules from the design spec are enforced HERE,\n * in the database, because application code can be bypassed and these must not\n * be:\n *\n *  - published versions are immutable (a trigger refuses UPDATE),\n *  - a submission binds to its exact version by real foreign key,\n *  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema\n *    that produced it is structurally impossible.\n */\nexport const forms = pgTable('forms', {\n  id: uuid('id').primaryKey(),\n  path: text('path').notNull().unique(),\n  currentVersionId: uuid('current_version_id'),\n  // Defaults to the safe value in the DATABASE as well as in the code, so a\n  // row inserted by a migration or a fixture is private unless it says\n  // otherwise. A default of 'public' one refactor away from being forgotten is\n  // how a private form becomes a public one.\n  accessSubmit: text('access_submit').notNull().default('authenticated'),\n  // NULL means no allowlist is in force. An empty array means nothing is\n  // allowed — a different thing, and the reason this is nullable.\n  allowedOrigins: text('allowed_origins').array(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n})\n\nexport const formVersions = pgTable('form_versions', {\n  id: uuid('id').primaryKey(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  version: integer('version').notNull(),\n  schema: jsonb('schema').notNull(),\n  schemaHash: text('schema_hash').notNull(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),\n})\n\nexport const users = pgTable('users', {\n  id: uuid('id').primaryKey(),\n  email: text('email').notNull().unique(),\n  passwordHash: text('password_hash').notNull(),\n  role: text('role').notNull(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull(),\n})\n\nexport const apiKeys = pgTable('api_keys', {\n  id: uuid('id').primaryKey(),\n  name: text('name').notNull(),\n  prefix: text('prefix').notNull(),\n  secretHash: text('secret_hash').notNull(),\n  role: text('role').notNull(),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull(),\n  revokedAt: timestamp('revoked_at', { withTimezone: true }),\n})\n\nexport const drafts = pgTable('drafts', {\n  id: text('id').notNull(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  formVersionId: uuid('form_version_id')\n    .notNull()\n    .references(() => formVersions.id),\n  data: jsonb('data').notNull(),\n  updatedAt: timestamp('updated_at', { withTimezone: true }).notNull(),\n})\n\nexport const webhooks = pgTable('webhooks', {\n  id: uuid('id').primaryKey(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  url: text('url').notNull(),\n  secret: text('secret').notNull(),\n  consecutiveFailures: integer('consecutive_failures').notNull().default(0),\n  openedAt: timestamp('opened_at', { withTimezone: true }),\n})\n\n/**\n * The outbox. A row here and the submission that caused it are written by the\n * same transaction, which is what makes \"accepted\" and \"will be delivered\" one\n * decision rather than two.\n */\nexport const deliveries = pgTable('deliveries', {\n  id: uuid('id').primaryKey(),\n  webhookId: uuid('webhook_id').notNull(),\n  submissionId: uuid('submission_id').notNull(),\n  eventId: uuid('event_id').notNull(),\n  body: text('body').notNull(),\n  attempt: integer('attempt').notNull().default(0),\n  nextAttemptAt: timestamp('next_attempt_at', { withTimezone: true }).notNull(),\n  state: text('state').notNull().default('pending'),\n  lastError: text('last_error'),\n})\n\nexport const spentChallenges = pgTable('spent_challenges', {\n  challenge: text('challenge').primaryKey(),\n  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),\n})\n\nexport const auditLog = pgTable('audit_log', {\n  id: uuid('id').primaryKey(),\n  at: timestamp('at', { withTimezone: true }).notNull(),\n  action: text('action').notNull(),\n  actorKind: text('actor_kind'),\n  actorId: text('actor_id'),\n  subject: text('subject'),\n  requestId: text('request_id'),\n  detail: jsonb('detail'),\n})\n\nexport const files = pgTable('files', {\n  id: uuid('id').primaryKey(),\n  formId: uuid('form_id').notNull(),\n  name: text('name').notNull(),\n  size: integer('size').notNull(),\n  contentType: text('content_type').notNull(),\n  storageKey: text('storage_key').notNull(),\n  state: text('state').notNull().default('offered'),\n  createdAt: timestamp('created_at', { withTimezone: true }).notNull(),\n  submissionId: uuid('submission_id'),\n})\n\nexport const submissions = pgTable('submissions', {\n  id: uuid('id').primaryKey(),\n  formId: uuid('form_id')\n    .notNull()\n    .references(() => forms.id),\n  formVersionId: uuid('form_version_id')\n    .notNull()\n    .references(() => formVersions.id, { onDelete: 'restrict' }),\n  data: jsonb('data').notNull(),\n  submittedAt: timestamp('submitted_at', { withTimezone: true }).notNull(),\n})\n\n/**\n * Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the\n * lifecycle work; a self-hosted skeleton that creates its own tables on first\n * start is worth more right now than a migration pipeline.\n */\nexport async function bootstrapSchema(sql: postgres.Sql): Promise<void> {\n  await sql`\n    CREATE TABLE IF NOT EXISTS forms (\n      id uuid PRIMARY KEY,\n      path text NOT NULL UNIQUE,\n      current_version_id uuid,\n      -- Private by default in the DATABASE, not only in the code, so a row\n      -- inserted by a migration or a fixture is not accidentally open.\n      access_submit text NOT NULL DEFAULT 'authenticated'\n        CHECK (access_submit IN ('authenticated', 'public')),\n      -- NULL: no allowlist in force. Empty array: nothing allowed. Different\n      -- things, which is why this is nullable rather than defaulting to '{}'.\n      allowed_origins text[],\n      created_at timestamptz NOT NULL DEFAULT now()\n    )`\n  // Existing databases predate the two columns above. Adding them here rather\n  // than in a separate migration keeps bootstrap idempotent for both a fresh\n  // database and one created before access control existed.\n  await sql`\n    ALTER TABLE forms\n      ADD COLUMN IF NOT EXISTS access_submit text NOT NULL DEFAULT 'authenticated'`\n  await sql`ALTER TABLE forms ADD COLUMN IF NOT EXISTS allowed_origins text[]`\n  await sql`\n    CREATE TABLE IF NOT EXISTS form_versions (\n      id uuid PRIMARY KEY,\n      form_id uuid NOT NULL REFERENCES forms(id),\n      version integer NOT NULL,\n      schema jsonb NOT NULL,\n      schema_hash text NOT NULL,\n      created_at timestamptz NOT NULL DEFAULT now(),\n      UNIQUE (form_id, version),\n      UNIQUE (form_id, schema_hash)\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS submissions (\n      id uuid PRIMARY KEY,\n      form_id uuid NOT NULL REFERENCES forms(id),\n      form_version_id uuid NOT NULL REFERENCES form_versions(id) ON DELETE RESTRICT,\n      data jsonb NOT NULL,\n      submitted_at timestamptz NOT NULL\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS webhooks (\n      id uuid PRIMARY KEY,\n      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE CASCADE,\n      url text NOT NULL,\n      secret text NOT NULL\n    )`\n  await sql`\n    ALTER TABLE webhooks\n      ADD COLUMN IF NOT EXISTS consecutive_failures integer NOT NULL DEFAULT 0,\n      -- When the breaker opened, null while the destination is answering. On\n      -- the row rather than in the worker's memory: memory does not survive a\n      -- restart, and a self-hoster with no operations team needs a failing\n      -- webhook to be visible on a screen rather than in a log nobody tails.\n      ADD COLUMN IF NOT EXISTS opened_at timestamptz`\n  await sql`\n    CREATE TABLE IF NOT EXISTS deliveries (\n      id uuid PRIMARY KEY,\n      webhook_id uuid NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,\n      -- RESTRICT, not CASCADE: a delivery is the record that something was\n      -- sent about this submission, and deleting the submission must not\n      -- quietly erase it.\n      submission_id uuid NOT NULL REFERENCES submissions(id) ON DELETE RESTRICT,\n      event_id uuid NOT NULL,\n      body text NOT NULL,\n      attempt integer NOT NULL DEFAULT 0,\n      next_attempt_at timestamptz NOT NULL,\n      state text NOT NULL DEFAULT 'pending'\n        CHECK (state IN ('pending', 'delivered', 'dead')),\n      last_error text\n    )`\n  await sql`\n    CREATE INDEX IF NOT EXISTS deliveries_due\n      ON deliveries (next_attempt_at) WHERE state = 'pending'`\n  await sql`\n    CREATE TABLE IF NOT EXISTS files (\n      id uuid PRIMARY KEY,\n      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE RESTRICT,\n      -- What the reader called it. Display only: the storage key is minted by\n      -- the server, because a key built from a submitted filename is a path\n      -- traversal waiting for somebody to try it.\n      name text NOT NULL,\n      size integer NOT NULL,\n      content_type text NOT NULL,\n      storage_key text NOT NULL,\n      state text NOT NULL DEFAULT 'offered'\n        CHECK (state IN ('offered', 'stored', 'claimed')),\n      created_at timestamptz NOT NULL,\n      -- RESTRICT for the same reason a delivery uses it: the row is the record\n      -- that something was attached, and deleting the submission must not\n      -- quietly erase what it carried.\n      submission_id uuid REFERENCES submissions(id) ON DELETE RESTRICT,\n      -- One file, one submission. Enforced here rather than in application\n      -- code, because two concurrent submissions claiming the same file is\n      -- exactly the race application code loses — and the loser would be a\n      -- submission referencing bytes another submission owns.\n      CONSTRAINT files_one_submission UNIQUE (id, submission_id)\n    )`\n  await sql`\n    CREATE INDEX IF NOT EXISTS files_abandoned\n      ON files (created_at) WHERE state <> 'claimed'`\n  await sql`\n    CREATE TABLE IF NOT EXISTS users (\n      id uuid PRIMARY KEY,\n      email text NOT NULL UNIQUE,\n      password_hash text NOT NULL,\n      role text NOT NULL,\n      created_at timestamptz NOT NULL\n    )`\n  await sql`\n    CREATE TABLE IF NOT EXISTS api_keys (\n      id uuid PRIMARY KEY,\n      name text NOT NULL,\n      prefix text NOT NULL,\n      secret_hash text NOT NULL,\n      role text NOT NULL,\n      created_at timestamptz NOT NULL,\n      revoked_at timestamptz\n    )`\n  await sql`CREATE INDEX IF NOT EXISTS api_keys_prefix ON api_keys (prefix)`\n  await sql`\n    CREATE TABLE IF NOT EXISTS spent_challenges (\n      -- The primary key IS the mechanism. Two requests arriving with one\n      -- solution both pass every stateless check — the signature is ours\n      -- and the hash is right — and only the database can decide which of\n      -- them spends it. A read-then-write would race exactly where somebody\n      -- is looking.\n      challenge text PRIMARY KEY,\n      expires_at timestamptz NOT NULL\n    )`\n  await sql`CREATE INDEX IF NOT EXISTS spent_challenges_expiry ON spent_challenges (expires_at)`\n\n  await sql`\n    CREATE TABLE IF NOT EXISTS audit_log (\n      id uuid PRIMARY KEY,\n      at timestamptz NOT NULL,\n      action text NOT NULL,\n      -- Null for an anonymous public submission, which is an answer rather\n      -- than a gap: the form was open and nobody was signed in.\n      actor_kind text CHECK (actor_kind IN ('user', 'apiKey')),\n      actor_id text,\n      subject text,\n      request_id text,\n      -- Identifiers and counts. NEVER a submission's answers: an audit log is\n      -- read by more people and kept longer than the data it describes, so\n      -- data inside it is a second copy of the thing being protected.\n      detail jsonb\n    )`\n  // Reading the log is the common query and it is always \"recently, and\n  // usually about one thing\".\n  await sql`CREATE INDEX IF NOT EXISTS audit_log_at ON audit_log (at DESC)`\n  await sql`CREATE INDEX IF NOT EXISTS audit_log_subject ON audit_log (subject, at DESC)`\n\n  await sql`\n    CREATE TABLE IF NOT EXISTS drafts (\n      id text NOT NULL,\n      form_id uuid NOT NULL REFERENCES forms(id),\n      form_version_id uuid NOT NULL REFERENCES form_versions(id),\n      data jsonb NOT NULL,\n      updated_at timestamptz NOT NULL,\n      PRIMARY KEY (form_id, id)\n    )`\n  // Immutability lives in the database, not in application discipline: a\n  // published version row can never change, because every submission's audit\n  // story depends on it staying exactly what the user saw.\n  await sql`\n    CREATE OR REPLACE FUNCTION refuse_version_update() RETURNS trigger AS $$\n    BEGIN\n      RAISE EXCEPTION 'form_versions rows are immutable; publish a new version instead';\n    END\n    $$ LANGUAGE plpgsql`\n  await sql`DROP TRIGGER IF EXISTS form_versions_immutable ON form_versions`\n  await sql`\n    CREATE TRIGGER form_versions_immutable\n    BEFORE UPDATE ON form_versions\n    FOR EACH ROW EXECUTE FUNCTION refuse_version_update()`\n\n  // Append-only, in the database rather than by application discipline — for\n  // the same reason the version rows are immutable there. An audit log the\n  // application can rewrite is a log that says whatever the person who got\n  // into the application wants it to say, and the one moment it matters is\n  // exactly the moment somebody has a reason to edit it.\n  //\n  // A deployment should ALSO give the application's role INSERT and SELECT and\n  // nothing else. This trigger is the belt: the grant is the braces, and it is\n  // the one a self-hoster has to do themselves.\n  await sql`\n    CREATE OR REPLACE FUNCTION refuse_audit_change() RETURNS trigger AS $$\n    BEGIN\n      RAISE EXCEPTION 'audit_log is append-only';\n    END\n    $$ LANGUAGE plpgsql`\n  await sql`DROP TRIGGER IF EXISTS audit_log_append_only ON audit_log`\n  await sql`\n    CREATE TRIGGER audit_log_append_only\n    BEFORE UPDATE OR DELETE ON audit_log\n    FOR EACH ROW EXECUTE FUNCTION refuse_audit_change()`\n}\n","import { and, desc, eq, inArray, lt, lte, max, ne } from 'drizzle-orm'\nimport { drizzle } from 'drizzle-orm/postgres-js'\nimport type postgres from 'postgres'\nimport type { FormSchema } from '@formancy/spec'\nimport type { AuditEntry, FileRecord, Role, Storage } from '@formancy/server-core'\nimport { apiKeys, auditLog, spentChallenges, deliveries, drafts, files, forms, formVersions, submissions, webhooks } from './db.js'\nimport { users } from './db.js'\n\n/** The Storage port over Postgres — the mirror of server-core's in-memory one. */\nexport function createPostgresStorage(sql: postgres.Sql): Storage {\n  const db = drizzle(sql)\n\n  return {\n    async getFormByPath(path) {\n      const rows = await db.select().from(forms).where(eq(forms.path, path)).limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        path: row.path,\n        currentVersionId: row.currentVersionId,\n        accessSubmit: row.accessSubmit === 'public' ? 'public' : 'authenticated',\n        allowedOrigins: row.allowedOrigins,\n      }\n    },\n\n    async listForms() {\n      const rows = await db.select().from(forms)\n      return rows.map((row) => ({\n        id: row.id,\n        path: row.path,\n        currentVersionId: row.currentVersionId,\n        accessSubmit: row.accessSubmit === 'public' ? ('public' as const) : ('authenticated' as const),\n        allowedOrigins: row.allowedOrigins,\n      }))\n    },\n\n    async createForm(record) {\n      await db.insert(forms).values({\n        id: record.id,\n        path: record.path,\n        currentVersionId: record.currentVersionId,\n        accessSubmit: record.accessSubmit,\n        allowedOrigins: record.allowedOrigins,\n      })\n    },\n\n    async updateFormAccess(formId, access) {\n      await db\n        .update(forms)\n        .set({ accessSubmit: access.accessSubmit, allowedOrigins: access.allowedOrigins })\n        .where(eq(forms.id, formId))\n    },\n\n    async setCurrentVersion(formId, versionId) {\n      await db.update(forms).set({ currentVersionId: versionId }).where(eq(forms.id, formId))\n    },\n\n    async insertVersion(record) {\n      await db.insert(formVersions).values({\n        id: record.id,\n        formId: record.formId,\n        version: record.version,\n        schema: record.schema,\n        schemaHash: record.schemaHash,\n      })\n    },\n\n    async publishVersion({ form, version, audit }) {\n      // ONE transaction. Three calls left a window where the form row existed\n      // with a null pointer, which is a form that answers its URL and has no\n      // schema to render — present in the list, 404 when opened.\n      await db.transaction(async (tx) => {\n        if (form !== undefined) {\n          await tx.insert(forms).values({\n            id: form.id,\n            path: form.path,\n            currentVersionId: form.currentVersionId,\n            accessSubmit: form.accessSubmit,\n            allowedOrigins: form.allowedOrigins,\n          })\n        }\n\n        await tx.insert(formVersions).values({\n          id: version.id,\n          formId: version.formId,\n          version: version.version,\n          schema: version.schema,\n          schemaHash: version.schemaHash,\n        })\n\n        const pointed = await tx\n          .update(forms)\n          .set({ currentVersionId: version.id })\n          .where(eq(forms.id, version.formId))\n          .returning({ id: forms.id })\n\n        // An UPDATE that matched nothing is not an error in SQL, so it has to\n        // be looked at: without this, publishing to a form that has been\n        // deleted underneath would insert an orphan version and report success.\n        if (pointed.length !== 1) {\n          throw new Error(\n            `Publishing to form ${version.formId} matched no form row. Rolling back, so there is no version pointing at a form that is not there.`,\n          )\n        }\n\n        if (audit !== undefined) await tx.insert(auditLog).values(auditRow(audit))\n      })\n    },\n\n    async getVersionById(id) {\n      const rows = await db.select().from(formVersions).where(eq(formVersions.id, id)).limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        formId: row.formId,\n        version: row.version,\n        schema: row.schema as FormSchema,\n        schemaHash: row.schemaHash,\n      }\n    },\n\n    async findVersionByHash(formId, schemaHash) {\n      const rows = await db\n        .select()\n        .from(formVersions)\n        .where(eq(formVersions.formId, formId))\n      const row = rows.find((candidate) => candidate.schemaHash === schemaHash)\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        formId: row.formId,\n        version: row.version,\n        schema: row.schema as FormSchema,\n        schemaHash: row.schemaHash,\n      }\n    },\n\n    async latestVersionNumber(formId) {\n      const rows = await db\n        .select({ latest: max(formVersions.version) })\n        .from(formVersions)\n        .where(eq(formVersions.formId, formId))\n      return rows[0]?.latest ?? 0\n    },\n\n    async insertSubmission(record, queued, claimFileIds, audit) {\n      // ONE transaction. The submission and the deliveries it triggers commit\n      // together or not at all — the requirement that chose this database\n      // (docs/decisions/0024-postgres-over-mongodb.md).\n      await db.transaction(async (tx) => {\n        await tx.insert(submissions).values({\n          id: record.id,\n          formId: record.formId,\n          formVersionId: record.formVersionId,\n          data: record.data,\n          submittedAt: new Date(record.submittedAt),\n        })\n\n        if (queued !== undefined && queued.length > 0) {\n          await tx.insert(deliveries).values(\n            queued.map((delivery) => ({\n              id: delivery.id,\n              webhookId: delivery.webhookId,\n              submissionId: delivery.submissionId,\n              eventId: delivery.eventId,\n              body: delivery.body,\n              attempt: delivery.attempt,\n              nextAttemptAt: new Date(delivery.nextAttemptAt),\n              state: delivery.state,\n              lastError: delivery.lastError,\n            })),\n          )\n        }\n\n        if (claimFileIds !== undefined && claimFileIds.length > 0) {\n          // In the same transaction, and only from `stored`: two concurrent\n          // submissions naming the same file both pass the check made outside\n          // the transaction, and this is where the second one loses. The row\n          // count is what says it lost — an UPDATE that matched nothing is not\n          // an error in SQL, so it has to be looked at.\n          const claimed = await tx\n            .update(files)\n            .set({ state: 'claimed', submissionId: record.id })\n            .where(and(inArray(files.id, [...claimFileIds]), eq(files.state, 'stored')))\n            .returning({ id: files.id })\n\n          if (claimed.length !== claimFileIds.length) {\n            throw new Error(\n              'A file this submission names was claimed by another one first. Rolling back, so the submission does not reference bytes it does not own.',\n            )\n          }\n        }\n\n        // Last, and inside: a submission that rolled back must leave nothing\n        // behind saying it happened.\n        if (audit !== undefined) await tx.insert(auditLog).values(auditRow(audit))\n      })\n    },\n\n    async spendChallenge(challenge, expiresAtIso) {\n      // `ON CONFLICT DO NOTHING` and look at what came back: the insert is the\n      // claim, and the row count is the answer. Checking first and inserting\n      // second would leave a window between the two.\n      const claimed = await db\n        .insert(spentChallenges)\n        .values({ challenge, expiresAt: new Date(expiresAtIso) })\n        .onConflictDoNothing()\n        .returning({ challenge: spentChallenges.challenge })\n      return claimed.length === 1\n    },\n\n    async forgetExpiredChallenges(beforeIso) {\n      const gone = await db\n        .delete(spentChallenges)\n        .where(lt(spentChallenges.expiresAt, new Date(beforeIso)))\n        .returning({ challenge: spentChallenges.challenge })\n      return gone.length\n    },\n\n    async recordAudit(entry) {\n      await db.insert(auditLog).values(auditRow(entry))\n    },\n\n    async listAudit(limit) {\n      const rows = await db.select().from(auditLog).orderBy(desc(auditLog.at)).limit(limit)\n      return rows.map((row) => ({\n        id: row.id,\n        at: row.at.toISOString(),\n        action: row.action as AuditEntry['action'],\n        ...(row.actorKind === null ? {} : { actorKind: row.actorKind as 'user' | 'apiKey' }),\n        ...(row.actorId === null ? {} : { actorId: row.actorId }),\n        ...(row.subject === null ? {} : { subject: row.subject }),\n        ...(row.requestId === null ? {} : { requestId: row.requestId }),\n        ...(row.detail === null\n          ? {}\n          : { detail: row.detail as NonNullable<AuditEntry['detail']> }),\n      }))\n    },\n\n    async insertFile(record) {\n      await db.insert(files).values({ ...record, createdAt: new Date(record.createdAt) })\n    },\n\n    async getFile(id) {\n      const [row] = await db.select().from(files).where(eq(files.id, id)).limit(1)\n      return row === undefined ? undefined : toFileRecord(row)\n    },\n\n    async updateFile(record) {\n      await db\n        .update(files)\n        .set({ state: record.state, submissionId: record.submissionId })\n        .where(eq(files.id, record.id))\n    },\n\n    async abandonedFiles(beforeIso) {\n      // A claimed file belongs to a submission and is never rubbish, however\n      // old. Age is a reason to collect an unclaimed one, never a claimed one.\n      const rows = await db\n        .select()\n        .from(files)\n        .where(and(ne(files.state, 'claimed'), lt(files.createdAt, new Date(beforeIso))))\n      return rows.map(toFileRecord)\n    },\n\n    async deleteFiles(ids) {\n      if (ids.length === 0) return\n      await db.delete(files).where(inArray(files.id, [...ids]))\n    },\n\n    async webhooksForForm(formId) {\n      const rows = await db.select().from(webhooks).where(eq(webhooks.formId, formId))\n      return rows.map(toWebhookRecord)\n    },\n\n    async insertWebhook(record) {\n      // Spelled out rather than spread: `openedAt` is an ISO string on the\n      // record and a timestamp in the column, and a spread would have passed\n      // the string straight through.\n      await db.insert(webhooks).values({\n        id: record.id,\n        formId: record.formId,\n        url: record.url,\n        secret: record.secret,\n        consecutiveFailures: record.consecutiveFailures,\n        openedAt: record.openedAt === null ? null : new Date(record.openedAt),\n      })\n    },\n\n    async updateWebhook(record) {\n      // Health only. The url and the secret are not the worker's to change,\n      // and a full row update here would let a failed delivery quietly\n      // rewrite where the next one goes.\n      await db\n        .update(webhooks)\n        .set({\n          consecutiveFailures: record.consecutiveFailures,\n          openedAt: record.openedAt === null ? null : new Date(record.openedAt),\n        })\n        .where(eq(webhooks.id, record.id))\n    },\n\n    async listWebhooks() {\n      const rows = await db.select().from(webhooks)\n      return rows.map(toWebhookRecord)\n    },\n\n    async deadDeliveries(limit) {\n      const rows = await db\n        .select()\n        .from(deliveries)\n        .where(eq(deliveries.state, 'dead'))\n        .orderBy(desc(deliveries.nextAttemptAt))\n        .limit(limit)\n      return rows.map(toDeliveryRecord)\n    },\n\n    async getDelivery(id) {\n      const [row] = await db.select().from(deliveries).where(eq(deliveries.id, id)).limit(1)\n      return row === undefined ? undefined : toDeliveryRecord(row)\n    },\n\n    async claimDueDeliveries(nowIso, limit) {\n      const rows = await db\n        .select()\n        .from(deliveries)\n        .where(and(eq(deliveries.state, 'pending'), lte(deliveries.nextAttemptAt, new Date(nowIso))))\n        .orderBy(deliveries.nextAttemptAt)\n        .limit(limit)\n      return rows.map(toDeliveryRecord)\n    },\n\n    async updateDelivery(record) {\n      await db\n        .update(deliveries)\n        .set({\n          attempt: record.attempt,\n          nextAttemptAt: new Date(record.nextAttemptAt),\n          state: record.state,\n          lastError: record.lastError,\n        })\n        .where(eq(deliveries.id, record.id))\n    },\n\n    async listSubmissions() {\n      const rows = await db.select().from(submissions)\n      return rows.map(toSubmissionRecord)\n    },\n\n    async listSubmissionsByForm(formId) {\n      const rows = await db\n        .select()\n        .from(submissions)\n        .where(eq(submissions.formId, formId))\n        .orderBy(desc(submissions.submittedAt), desc(submissions.id))\n      return rows.map(toSubmissionRecord)\n    },\n\n    async listVersionsByForm(formId) {\n      const rows = await db\n        .select()\n        .from(formVersions)\n        .where(eq(formVersions.formId, formId))\n        .orderBy(desc(formVersions.version))\n      return rows.map((row) => ({\n        id: row.id,\n        formId: row.formId,\n        version: row.version,\n        schema: row.schema as FormSchema,\n        schemaHash: row.schemaHash,\n      }))\n    },\n\n    async upsertDraft(record) {\n      await db\n        .insert(drafts)\n        .values({\n          id: record.id,\n          formId: record.formId,\n          formVersionId: record.formVersionId,\n          data: record.data,\n          updatedAt: new Date(record.updatedAt),\n        })\n        .onConflictDoUpdate({\n          target: [drafts.formId, drafts.id],\n          set: {\n            formVersionId: record.formVersionId,\n            data: record.data,\n            updatedAt: new Date(record.updatedAt),\n          },\n        })\n    },\n\n    async getDraft(formId, draftId) {\n      const rows = await db\n        .select()\n        .from(drafts)\n        .where(and(eq(drafts.formId, formId), eq(drafts.id, draftId)))\n        .limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        formId: row.formId,\n        formVersionId: row.formVersionId,\n        data: row.data,\n        updatedAt: row.updatedAt.toISOString(),\n      }\n    },\n\n    async insertUser(record) {\n      await db.insert(users).values({\n        id: record.id,\n        email: record.email,\n        passwordHash: record.passwordHash,\n        role: record.role,\n        createdAt: new Date(record.createdAt),\n      })\n    },\n\n    async getUserByEmail(email) {\n      const rows = await db.select().from(users).where(eq(users.email, email)).limit(1)\n      const row = rows[0]\n      if (row === undefined) return undefined\n      return {\n        id: row.id,\n        email: row.email,\n        passwordHash: row.passwordHash,\n        role: row.role as Role,\n        createdAt: row.createdAt.toISOString(),\n      }\n    },\n\n    async insertApiKey(record) {\n      await db.insert(apiKeys).values({\n        id: record.id,\n        name: record.name,\n        prefix: record.prefix,\n        secretHash: record.secretHash,\n        role: record.role,\n        createdAt: new Date(record.createdAt),\n        revokedAt: record.revokedAt === null ? null : new Date(record.revokedAt),\n      })\n    },\n\n    async listApiKeys() {\n      const rows = await db.select().from(apiKeys)\n      return rows.map(toApiKeyRecord)\n    },\n\n    async findApiKeysByPrefix(prefix) {\n      const rows = await db.select().from(apiKeys).where(eq(apiKeys.prefix, prefix))\n      return rows.map(toApiKeyRecord)\n    },\n\n    async revokeApiKey(id, atIso) {\n      await db.update(apiKeys).set({ revokedAt: new Date(atIso) }).where(eq(apiKeys.id, id))\n    },\n  }\n}\n\nfunction toApiKeyRecord(row: {\n  id: string\n  name: string\n  prefix: string\n  secretHash: string\n  role: string\n  createdAt: Date\n  revokedAt: Date | null\n}) {\n  return {\n    id: row.id,\n    name: row.name,\n    prefix: row.prefix,\n    secretHash: row.secretHash,\n    role: row.role as Role,\n    createdAt: row.createdAt.toISOString(),\n    revokedAt: row.revokedAt === null ? null : row.revokedAt.toISOString(),\n  }\n}\n\nfunction toSubmissionRecord(row: {\n  id: string\n  formId: string\n  formVersionId: string\n  data: unknown\n  submittedAt: Date\n}) {\n  return {\n    id: row.id,\n    formId: row.formId,\n    formVersionId: row.formVersionId,\n    data: row.data,\n    submittedAt: row.submittedAt.toISOString(),\n  }\n}\n\n/** A delivery row as the port describes it. */\nfunction toDeliveryRecord(row: typeof deliveries.$inferSelect) {\n  return {\n    id: row.id,\n    webhookId: row.webhookId,\n    submissionId: row.submissionId,\n    eventId: row.eventId,\n    body: row.body,\n    attempt: row.attempt,\n    nextAttemptAt: row.nextAttemptAt.toISOString(),\n    state: row.state as 'pending' | 'delivered' | 'dead',\n    lastError: row.lastError,\n  }\n}\n\n/** A files row as the port describes it: timestamps as ISO strings. */\nfunction toFileRecord(row: typeof files.$inferSelect): FileRecord {\n  return {\n    id: row.id,\n    formId: row.formId,\n    name: row.name,\n    size: row.size,\n    contentType: row.contentType,\n    storageKey: row.storageKey,\n    state: row.state as FileRecord['state'],\n    createdAt: row.createdAt.toISOString(),\n    submissionId: row.submissionId,\n  }\n}\n\n/** A webhook row as the port describes it, health included. */\nfunction toWebhookRecord(row: typeof webhooks.$inferSelect) {\n  return {\n    id: row.id,\n    formId: row.formId,\n    url: row.url,\n    secret: row.secret,\n    consecutiveFailures: row.consecutiveFailures,\n    openedAt: row.openedAt === null ? null : row.openedAt.toISOString(),\n  }\n}\n\n/**\n * An entry as the table holds it.\n *\n * Absent and null are the same thing here, and the conversion is in one place\n * so two call sites cannot disagree about which they write.\n */\nfunction auditRow(entry: AuditEntry) {\n  return {\n    id: entry.id,\n    at: new Date(entry.at),\n    action: entry.action,\n    actorKind: entry.actorKind ?? null,\n    actorId: entry.actorId ?? null,\n    subject: entry.subject ?? null,\n    requestId: entry.requestId ?? null,\n    detail: entry.detail ?? null,\n  }\n}\n","import { createHash } from 'node:crypto'\nimport { createReadStream } from 'node:fs'\nimport { mkdir, rm, stat, writeFile } from 'node:fs/promises'\nimport { dirname, join, resolve, sep } from 'node:path'\nimport type { Readable } from 'node:stream'\n\n/**\n * Where uploaded bytes live.\n *\n * An interface with one implementation, because the second one is the point:\n * S3 or a customer's own service replaces this file and nothing else. The\n * use-cases in `@formancy/server-core` never see it at all — they decide what\n * is rubbish, and the host deletes it.\n *\n * Local disk is the default because `docker compose up` has to produce\n * something that works, and a self-hoster with one container and one volume is\n * the deployment this product is for. It is genuinely the weakest option: it\n * does not survive more than one replica, and the section below says so rather\n * than leaving somebody to find out.\n */\nexport interface FileStore {\n  /** Write the bytes. The key was minted by the server, never by a client. */\n  put(key: string, bytes: Buffer): Promise<void>\n  /** Read them back, as a stream, so a large file is not held in memory. */\n  open(key: string): Promise<Readable | undefined>\n  /** Remove them. Missing is success: a collector must be safe to re-run. */\n  remove(key: string): Promise<void>\n  /** The size on disk, for checking the bytes match what was promised. */\n  sizeOf(key: string): Promise<number | undefined>\n}\n\n/**\n * Bytes under one directory, one file per key.\n *\n * **Keys are checked, not trusted.** A key is minted by the server from a form\n * id and a file id, so it cannot contain a traversal — but this resolves it\n * and refuses anything landing outside the root regardless. A path check that\n * only runs when the input is untrusted is a path check that stops running the\n * day somebody adds a caller.\n */\nexport function createLocalFileStore(root: string): FileStore {\n  const base = resolve(root)\n\n  const pathFor = (key: string): string => {\n    // Keys use forward slashes on every platform. Reject Windows separators\n    // before native path resolution: POSIX treats them as filename characters.\n    if (key.includes('\\\\')) {\n      throw new Error(`Refusing a storage key that could resolve outside the store: ${key}`)\n    }\n    const full = resolve(join(base, key))\n    // `startsWith(base)` alone matches `/data/formancy-evil` against\n    // `/data/formancy`, so the separator is part of the test.\n    if (full !== base && !full.startsWith(base + sep)) {\n      throw new Error(`Refusing a storage key that resolves outside the store: ${key}`)\n    }\n    return full\n  }\n\n  return {\n    async put(key, bytes) {\n      const full = pathFor(key)\n      await mkdir(dirname(full), { recursive: true })\n      await writeFile(full, bytes)\n    },\n\n    async open(key) {\n      const full = pathFor(key)\n      try {\n        await stat(full)\n      } catch {\n        return undefined\n      }\n      return createReadStream(full)\n    },\n\n    async remove(key) {\n      // `force` so a collector that ran twice, or crashed after deleting the\n      // bytes and before deleting the row, is not an error the second time.\n      await rm(pathFor(key), { force: true })\n    },\n\n    async sizeOf(key) {\n      try {\n        return (await stat(pathFor(key))).size\n      } catch {\n        return undefined\n      }\n    },\n  }\n}\n\n/**\n * The checksum a receiver can compare against.\n *\n * Returned when the bytes are stored and never asked of the client: a checksum\n * the uploader computed is a checksum the uploader can lie about, so this one\n * is only useful for telling a *later* reader that the bytes have not changed.\n */\nexport function sha256(bytes: Buffer): string {\n  return createHash('sha256').update(bytes).digest('hex')\n}\n","import { collectAbandonedFiles } from '@formancy/server-core'\nimport type { Storage } from '@formancy/server-core'\nimport type { FileStore } from './file-store.js'\n\n/**\n * Deleting files nobody claimed.\n *\n * Somebody who attaches a file and then closes the tab leaves bytes behind.\n * Without this they stay forever, and a disk that fills up for a reason nobody\n * is watching is the most tedious kind of outage.\n *\n * **Bytes first, then the row.** A row with no bytes is a broken reference and\n * shows up the moment anybody tries to download it. Bytes with no row are\n * invisible: nothing will ever look for them again, and the disk fills up\n * silently. Of the two ways to be interrupted halfway, the first is the one\n * you find out about.\n *\n * The same shape as the outbox worker, for the same reasons: a timer in the\n * server process rather than a queue library, one pass at a time, and a\n * thrown pass complains and comes back rather than stopping the timer. It is\n * likewise not a distributed job — `abandonedFiles` takes no lock, so two\n * replicas would both try to delete the same file. That is harmless here,\n * unlike a webhook sent twice, because deleting a file twice is deleting it\n * once.\n */\nexport interface CollectorHandle {\n  stop: () => void\n}\n\nexport function startFileCollector(\n  storage: Storage,\n  store: FileStore,\n  options: { intervalMs?: number; afterHours?: number } = {},\n): CollectorHandle {\n  const interval = options.intervalMs ?? 15 * 60_000\n  const afterHours = options.afterHours ?? 24\n  let stopped = false\n  let running = false\n\n  const tick = async (): Promise<void> => {\n    if (running || stopped) return\n    running = true\n    try {\n      const abandoned = await collectAbandonedFiles(storage, new Date(), afterHours)\n      if (abandoned.length === 0) return\n\n      const removed: string[] = []\n      for (const file of abandoned) {\n        // One at a time, and the row only once its bytes are gone. A failure\n        // partway leaves the rest for the next pass rather than losing track\n        // of what was already done.\n        await store.remove(file.storageKey)\n        removed.push(file.id)\n      }\n      await storage.deleteFiles(removed)\n    } catch (error) {\n      // A collector that throws is a collector that stops, and a disk that\n      // fills up. Complain and come back.\n      console.error('files: a collection pass failed', error)\n    } finally {\n      running = false\n    }\n  }\n\n  const timer = setInterval(() => void tick(), interval)\n  timer.unref?.()\n\n  return {\n    stop: () => {\n      stopped = true\n      clearInterval(timer)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,oBAGd;CACA,OAAO;EACL,aAAa,WAAWA,KAAW,MAAM;EACzC,cAAc,OAAO,QAAQ,WAAW;GACtC,IAAI;IACF,OAAO,MAAMC,OAAa,QAAQ,MAAM;GAC1C,QAAQ;IAGN,OAAO;GACT;EACF;CACF;AACF;AAEA,SAAgB,kBAA0B;CACxC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC7C;AAEA,MAAM,iBAAiB;AAOvB,SAAgB,oBAAoB,QAA+B;CACjE,IAAI,OAAO,SAAS,IAClB,MAAM,IAAI,MACR,4FACF;CAEF,MAAM,MAAM,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM;CAE3C,OAAO;EACL,MAAM,MAAM,OAAO;GACjB,OAAO,IAAI,QAAQ;IAAE,MAAM,MAAM;IAAM,MAAM,MAAM;GAAK,CAAC,CAAC,CACvD,mBAAmB,EAAE,KAAK,QAAQ,CAAC,CAAC,CACpC,WAAW,MAAM,EAAE,CAAC,CACpB,YAAY,CAAC,CACb,kBAAkB,cAAc,CAAC,CACjC,KAAK,GAAG;EACb;EAEA,MAAM,OAAO,OAAO;GAClB,IAAI;IACF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,KAAK,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,OAAO,QAAQ;IACrB,MAAM,OAAO,QAAQ;IACrB,IACE,OAAO,QAAQ,QAAQ,YACtB,SAAS,WAAW,SAAS,YAAY,SAAS,YAClD,SAAS,UAAU,SAAS,UAE7B;IAEF,OAAO;KAAE,IAAI,QAAQ;KAAW;KAAc;IAAK;GACrD,QAAQ;IACN;GACF;EACF;CACF;AACF;;;ACvCA,MAAa,qBAAqB;;AAElC,MAAa,mBAAmB;;AAGhC,MAAM,qBAAqB;AAC3B,MAAa,iBAAiB;;;;;;;;;;;;;;;;AAmF9B,eAAsB,UAAU,SAAkB,SAA+C;CAG/F,MAAM,MAAM,QAAQ;EAAE,QAAQ;EAAO,WAAW,QAAQ,kBAAkB;CAAW,CAAC;CAEtF,MAAM,eAAe,QAAQ,gBAAgB;CAC7C,MAAM,YAAY,QAAQ;CAM1B,IAAI,qBAAqB,KAAK;EAAE,SAAS;EAAU,WAAW;CAAa,IAAI,UAAU,MAAM,SAAS;EACtG,KAAK,MAAM,IAAI;CACjB,CAAC;CAED,MAAM,kBAAkB,QAAQ,uBAAuB;EAAE,KAAK;EAAI,cAAc;CAAO;CACvF,MAAM,aAAa,QAAQ,kBAAkB;EAAE,KAAK;EAAI,cAAc;CAAO;CAC7E,MAAM,kBAAkB,QAAQ;CAChC,MAAM,IAAI,SAAS,WAAW;EAC5B,QAAQ;EACR,KAAK,gBAAgB;EACrB,YAAY,gBAAgB;CAC9B,CAAC;CAED,MAAM,OAAmB;EACvB;EACA,aAAa,WAAW;EACxB,+BAAc,IAAI,KAAK,EAAA,CAAE,YAAY;EAIrC,aAAa,QAAQ;EACrB,GAAI,QAAQ,mBAAmB,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;EACzF,cAAc;GACZ,WAAW,KAAK,IAAI;GACpB,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,MAAM,GAAG,EAAE;GACjD,cAAc,KAAK,OAAO;EAC5B;CACF;CAEA,MAAM,WAAqB;EACzB;EACA,OAAO,KAAK;EACZ,QAAQ,KAAK;EACb,aAAa;EACb,GAAG,kBAAkB;CACvB;CAEA,MAAM,WAAW,oBAAoB,QAAQ,UAAU;CAEvD,IAAI,QAAQ,mBAAmB,KAAA,GAEzB;MAAA,MADuB,QAAQ,eAAe,QAAQ,eAAe,KAAK,MACzD,KAAA,GAAW;GAC9B,MAAM,UAAU,MAAM,gBAAgB,UAAU;IAAE,GAAG,QAAQ;IAAgB,MAAM;GAAQ,CAAC;GAC5F,IAAI,CAAC,QAAQ,IAAI,MAAM,IAAI,MAAM,6BAA6B,QAAQ,SAAS;EACjF;;CAGF,eAAe,QAAQ,SAAqD;EAC1E,MAAM,SAAS,QAAQ,QAAQ;EAC/B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,SAAS,GAC3D,OAAO,SAAS,OAAO,OAAO,MAAM,CAAgB,CAAC;EAEvD,MAAM,SAAS,QAAQ,QAAQ;EAC/B,IAAI,OAAO,WAAW,YAAY,WAAW,IAAI;GAC/C,MAAM,UAAU,MAAM,mBAAmB,UAAU,MAAM;GACzD,OAAO,QAAQ,KAAK,QAAQ,QAAQ,KAAA;EACtC;CAEF;;;CAIA,SAAS,SAAS,QAAuC;EACvD,OAAO,OAAO,SAAS,UAAU;GAC/B,MAAM,QAAQ,MAAM,QAAQ,OAAO;GACnC,IAAI,UAAU,KAAA,GACZ,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,kBAAkB,CAAC;GAE1D,IAAI,CAAC,IAAI,OAAO,MAAM,GACpB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO;IAAa;GAAO,CAAC;GAE3D,QAA+C,QAAQ;EAC1D;CACF;;;;;;;;;;;;;CAcA,eAAe,MAAM,SAAyB,OAAkC;EAC9E,MAAM,QAAS,QAA+C;EAC9D,IAAI;GACF,MAAM,KAAK,QAAQ,YAAY;IAC7B,IAAI,KAAK,MAAM;IACf,IAAI,KAAK,OAAO;IAChB,WAAW,QAAQ;IACnB,GAAG,UAAU,OAAO,KAAK;GAC3B,CAAC;EACH,SAAS,OAAO;GACd,QAAQ,IAAI,MAAM;IAAE,KAAK;IAAO,QAAQ,MAAM;GAAO,GAAG,gCAAgC;EAC1F;CACF;CAIA,IAAI,KACF,eACA,EAKE,QAAQ,EAAE,WAAW;EAAE,KAAK,WAAW;EAAK,YAAY,WAAW;CAAa,EAAE,EACpF,GACA,OAAO,SAAS,UAAU;EACxB,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,QAAQ,OAAO,KAAK,UAAU,YAAY,OAAO,KAAK,aAAa,UAC9E,OAAO,MACJ,KAAK,GAAG,CAAC,CACT,KAAK;GAAE,OAAO;GAAe,SAAS;EAAkC,CAAC;EAE9E,MAAM,UAAU,MAAM,kBAAkB,UAAU;GAChD,OAAO,KAAK;GACZ,UAAU,KAAK;EACjB,CAAC;EACD,IAAI,CAAC,QAAQ,IAAI;GAKf,MAAM,MAAM,SAAS;IAAE,QAAQ;IAAqB,SAAS,KAAK;GAAM,CAAC;GACzE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,sBAAsB,CAAC;EAC9D;EACA,MAAM,MAAM,SAAS;GACnB,QAAQ;GACR,SAAS,KAAK;GACd,WAAW;GACX,SAAS,QAAQ,MAAM;EACzB,CAAC;EACD,OAAO,MAAM,KAAK;GAAE,OAAO,MAAM,SAAS,MAAM,QAAQ,KAAK;GAAG,MAAM,QAAQ,MAAM;EAAK,CAAC;CAC5F,CACF;CAEA,IAAI,KAAK,UAAU,EAAE,YAAY,SAAS,aAAa,EAAE,GAAG,OAAO,SAAS,UAAU;EACpF,MAAM,OAAO,QAAQ;EACrB,IACE,SAAS,QACT,OAAO,KAAK,UAAU,YACtB,OAAO,KAAK,aAAa,YACxB,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,SAAS,UAElE,OAAO,MACJ,KAAK,GAAG,CAAC,CACT,KAAK;GAAE,OAAO;GAAe,SAAS;EAAwC,CAAC;EAEpF,MAAM,UAAU,MAAM,gBAAgB,UAAU;GAC9C,OAAO,KAAK;GACZ,UAAU,KAAK;GACf,MAAM,KAAK;EACb,CAAC;EACD,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAY,SAAS,QAAQ;EAAQ,CAAC;EAC5F,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,QAAQ,GAAG,CAAC;CAChD,CAAC;CAED,IAAI,KAAK,aAAa,EAAE,YAAY,SAAS,eAAe,EAAE,GAAG,OAAO,SAAS,UAAU;EACzF,MAAM,OAAO,QAAQ;EACrB,IACE,SAAS,QACT,OAAO,KAAK,SAAS,YACpB,KAAK,SAAS,WAAW,KAAK,SAAS,YAAY,KAAK,SAAS,UAElE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAe,SAAS;EAA6B,CAAC;EAE7F,MAAM,UAAU,MAAM,aAAa,UAAU;GAAE,MAAM,KAAK;GAAM,MAAM,KAAK;EAAa,CAAC;EACzF,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAY,SAAS,QAAQ;EAAQ,CAAC;EAE5F,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,IAAI,QAAQ;GAAI,QAAQ,QAAQ;EAAO,CAAC;CACxE,CAAC;CAID,IAAI,KAAK,UAAU,EAAE,YAAY,SAAS,cAAc,EAAE,GAAG,OAAO,SAAS,UAAU;EACrF,MAAM,OAAO,QAAQ;EACrB,IAAI,SAAS,QAAQ,OAAO,KAAK,SAAS,YAAY,KAAK,SAAS,MAAM,KAAK,WAAW,KAAA,GACxF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,OAAO;GAAe,SAAS;EAA+B,CAAC;EAG/F,MAAM,UAAU,MAAM,YAAY,MAAM;GACtC,MAAM,KAAK;GACX,QAAQ,KAAK;GAIb,OAAQ,QAA8C;EACxD,CAAC;EACD,IAAI,CAAC,QAAQ,IAGX,QAAQ,QAAQ,MAAhB;GACE,KAAK,kBACH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO,QAAQ;IAAM,QAAQ,QAAQ;GAAO,CAAC;GAC7E,KAAK,kBAGH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO,QAAQ;IAAM,UAAU,QAAQ;GAAS,CAAC;GACjF,KAAK,iBACH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO,QAAQ;IAAM,SAAS,QAAQ;GAAQ,CAAC;GAC/E,KAAK,0BAKH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO,QAAQ;IAAM,SAAS,QAAQ;GAAQ,CAAC;EACjF;EAEF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,SAAS,QAAQ;GAAS,YAAY,QAAQ;EAAW,CAAC;CAC1F,CAAC;CAED,IAAI,IAAI,mBAAmB,EAAE,YAAY,SAAS,cAAc,EAAE,GAAG,OAAO,SAAS,UAAU;EAC7F,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,OAAO,QAAQ;EAErB,MAAM,SAAS,MAAM;EACrB,IAAI,WAAW,mBAAmB,WAAW,UAC3C,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS;EACX,CAAC;EAGH,MAAM,UAAU,MAAM;EACtB,IAAI,YAAY,KAAA,KAAa,EAAE,MAAM,QAAQ,OAAO,KAAK,QAAQ,OAAO,MAAM,OAAO,MAAM,QAAQ,IACjG,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS;EACX,CAAC;EAQH,IAAI,EAAC,MALiB,cAAc,MAAM;GACxC;GACA;GACA,GAAI,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,QAAoB;EACzE,CAAC,EAAA,CACY,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAEtE,MAAM,MAAM,SAAS;GACnB,QAAQ;GACR,SAAS;GACT,QAAQ;IAAE;IAAQ,gBAAgB,YAAY,KAAA,IAAY,cAAe,QAAqB,KAAK,GAAG;GAAE;EAC1G,CAAC;EACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;CAC9B,CAAC;;;;;;;;;CAUD,IAAI,IAAI,UAAU,EAAE,YAAY,SAAS,aAAa,EAAE,GAAG,OAAO,SAAS,UAAU;EACnF,MAAM,MAAO,QAAQ,OAA2C;EAChE,MAAM,QAAQ,OAAO,QAAQ,WAAW,OAAO,SAAS,KAAK,EAAE,IAAI;EACnE,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI;EAC3E,OAAO,MAAM,KAAK,EAAE,SAAS,MAAM,KAAK,QAAQ,UAAU,KAAK,EAAE,CAAC;CACpE,CAAC;;;;;;;;;;CAWD,IAAI,IAAI,aAAa,EAAE,YAAY,SAAS,cAAc,EAAE,GAAG,OAAO,UAAU,UAAU;EACxF,MAAM,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC;EAClC,MAAM,QAAQ,MAAM,KAAK,QAAQ,aAAa;EAC9C,OAAO,MAAM,KAAK,EAAE,UAAU,MAAM,KAAK,SAAS,SAAS,MAAM,GAAG,CAAC,EAAE,CAAC;CAC1E,CAAC;CAED,IAAI,IAAI,oBAAoB,EAAE,YAAY,SAAS,cAAc,EAAE,GAAG,OAAO,SAAS,UAAU;EAC9F,MAAM,MAAO,QAAQ,OAA2C;EAChE,MAAM,QAAQ,OAAO,QAAQ,WAAW,OAAO,SAAS,KAAK,EAAE,IAAI;EACnE,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI;EAC3E,MAAM,OAAO,MAAM,KAAK,QAAQ,eAAe,KAAK;EAGpD,OAAO,MAAM,KAAK,EAChB,YAAY,KAAK,KAAK,cAAc;GAClC,IAAI,SAAS;GACb,WAAW,SAAS;GACpB,cAAc,SAAS;GACvB,SAAS,SAAS;GAClB,SAAS,SAAS;GAClB,WAAW,SAAS;EACtB,EAAE,EACJ,CAAC;CACH,CAAC;CAED,IAAI,KACF,0BACA,EAAE,YAAY,SAAS,cAAc,EAAE,GACvC,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,OAAO,QAAQ;EACvB,MAAM,UAAU,MAAM,eACpB;GAAE,SAAS,KAAK;GAAS,WAAW,IAAI,KAAK,KAAK,OAAO,CAAC;EAAE,GAC5D,EACF;EAEA,IAAI,CAAC,QAAQ,IACX,OAAO,QAAQ,SAAS,YACpB,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC,IAClD,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GACnB,OAAO;GACP,OAAO,QAAQ;GACf,SACE;EACJ,CAAC;EAIP,MAAM,MAAM,SAAS;GACnB,QAAQ;GACR,SAAS;GACT,QAAQ,EAAE,WAAW,QAAQ,SAAS,UAAU;EAClD,CAAC;EACD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE;GAAI,OAAO,QAAQ,SAAS;EAAM,CAAC;CACnE,CACF;;;;;;;;CASA,IAAI,IACF,sBACA,EAKE,QAAQ,EAAE,WAAW;EAAE,KAAK,gBAAgB;EAAK,YAAY,gBAAgB;CAAa,EAAE,EAC9F,GACA,OAAO,SAAS,UAAU;EACxB,IAAI,oBAAoB,KAAA,GAItB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,wBAAwB,CAAC;EAEhE,MAAM,EAAE,SAAS,QAAQ;EAEzB,IAAI,MADe,KAAK,QAAQ,cAAc,IAAI,MACrC,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAE7E,OAAO,MAAM,KACX,MAAM,cAAc;GAClB,QAAQ;GACR,YAAY,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAI;EACjE,CAAC,CACH;CACF,CACF;;;;;;;;;;CAWA,eAAe,eACb,SACyD;EACzD,MAAM,SAAS,QAAQ,QAAQ;EAC/B,IAAI,OAAO,WAAW,YAAY,WAAW,IAC3C,OAAO;GACL,OAAO;GACP,SAAS,2FAA2F,iBAAiB;EACvH;EAGF,MAAM,WAAW,eAAe,MAAM;EACtC,IAAI,aAAa,KAAA,GACf,OAAO;GAAE,OAAO;GAAuB,SAAS;EAA2C;EAG7F,MAAM,aAAa,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAI;EACtE,MAAM,WAAW,MAAM,eAAe,iBAAkB,UAAU,UAAU;EAC5E,IAAI,CAAC,SAAS,IACZ,OAAO;GACL,OAAO,aAAa,SAAS;GAC7B,SAAS;EACX;EASF,IAAI,CAAC,MAJe,KAAK,QAAQ,eAC/B,SAAS,4BACT,IAAI,KAAK,SAAS,mBAAmB,GAAI,EAAA,CAAE,YAAY,CACzD,GAEE,OAAO;GACL,OAAO;GACP,SAAS;EACX;CAGJ;CAEA,IAAI,IAAI,UAAU,EAAE,YAAY,SAAS,WAAW,EAAE,GAAG,OAAO,UAAU,UAAU;EAClF,OAAO,MAAM,KAAK,EAAE,OAAO,MAAM,UAAU,IAAI,EAAE,CAAC;CACpD,CAAC;CAED,IAAI,IAAI,qBAAqB,EAAE,YAAY,SAAS,WAAW,EAAE,GAAG,OAAO,SAAS,UAAU;EAC5F,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,WAAW,MAAM,aAAa,MAAM,IAAI;EAC9C,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EACjF,OAAO,MAAM,KAAK,EAAE,SAAS,CAAC;CAChC,CAAC;CAED,IAAI,IACF,wBACA,EAAE,YAAY,SAAS,iBAAiB,EAAE,GAC1C,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,SAAS,MAAM,gBAAgB,MAAM,IAAI;EAC/C,IAAI,WAAW,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAI/E,MAAM,MAAM,SAAS;GACnB,QAAQ;GACR,SAAS;GACT,QAAQ,EAAE,OAAO,OAAO,OAAO;EACjC,CAAC;EACD,OAAO,MAAM,KAAK,EAAE,aAAa,OAAO,CAAC;CAC3C,CACF;CAEA,IAAI,IACF,mCACA,EAAE,YAAY,SAAS,mBAAmB,EAAE,GAC5C,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,MAAM,MAAM,UAAU,MAAM,IAAI;EACtC,IAAI,QAAQ,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAG5E,MAAM,MAAM,SAAS;GACnB,QAAQ;GACR,SAAS;GACT,QAAQ,EAAE,OAAO,OAAO,WAAW,KAAK,MAAM,EAAE;EAClD,CAAC;EACD,OAAO,MACJ,OAAO,gBAAgB,yBAAyB,CAAC,CACjD,OAAO,uBAAuB,yBAAyB,KAAK,kBAAkB,CAAC,CAC/E,KAAK,GAAG;CACb,CACF;;;;;;;;;;;;;;;;;CAoBA,IAAI,IAAI,YAAY,OAAO,SAAS,UAAU;EAC5C,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,WAAW,MAAM,YAAY,MAAM,IAAI;EAC7C,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EACjF,OAAO,MAAM,KAAK;GAChB,SAAS,SAAS;GAClB,YAAY,SAAS;GACrB,QAAQ,SAAS;EACnB,CAAC;CACH,CAAC;;;;;;;;;;;;;;;CAgBD,IAAI,KACF,mBACA,EAGE,QAAQ,EAAE,WAAW;EAAE,KAAK,gBAAgB;EAAK,YAAY,gBAAgB;CAAa,EAAE,EAC9F,GACA,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,UAAU,MAAM,WAAW,MAAM,EAAE,KAAK,CAAC;EAC/C,IAAI,YAAY,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAChF,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;CACrC,CACF;CAEA,IAAI,IACF,4BACA,EAKE,QAAQ,EAAE,WAAW;EAAE,KAAK,gBAAgB;EAAK,YAAY,gBAAgB;CAAa,EAAE,EAC9F,GACA,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,MAAM,YAAY,QAAQ;EAClC,MAAM,QAAQ,QAAQ,QAAQ;EAC9B,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,uBAAuB,CAAC;EAG/D,MAAM,QAAQ,MAAM,UAAU,MAAM;GAAE;GAAM;GAAS;GAAO,MAAM,QAAQ,QAAQ,CAAC;EAAE,CAAC;EACtF,IAAI,UAAU,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAC9E,IAAI,CAAC,MAAM,OAAO,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,sBAAsB,CAAC;EAC9E,OAAO,MAAM,KAAK,EAAE,SAAS,MAAM,QAAQ,CAAC;CAC9C,CACF;CAEA,IAAI,IACF,4BACA,EAIE,QAAQ,EAAE,WAAW;EAAE,KAAK,gBAAgB;EAAK,YAAY,gBAAgB;CAAa,EAAE,EAC9F,GACA,OAAO,SAAS,UAAU;EACxB,MAAM,EAAE,MAAM,YAAY,QAAQ;EAClC,MAAM,QAAQ,QAAQ,QAAQ;EAC9B,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,uBAAuB,CAAC;EAG/D,MAAM,UAAU,MAAM,YAAY,MAAM;GAAE;GAAM;GAAS;EAAM,CAAC;EAGhE,IAAI,YAAY,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,gBAAgB,CAAC;EACjF,OAAO,MAAM,KAAK,OAAO;CAC3B,CACF;;;;;;;;CASA,IAAI,KAAK,kBAAkB,EACzB,QAAQ,EAAE,WAAW;EAAE,KAAK,gBAAgB;EAAK,YAAY,gBAAgB;CAAa,EAAE,EAC9F,GAAG,OAAO,SAAS,UAAU;EAC3B,IAAI,cAAc,KAAA,GAChB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS;EACX,CAAC;EAGH,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,WAAW,MAAM,YAAY,MAAM,IAAI;EAC7C,IAAI,aAAa,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAEjF,MAAM,OAAO,MAAM,QAAQ,cAAc,IAAI;EAC7C,IAAI,SAAS,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAE7E,MAAM,QAAQ,MAAM,QAAQ,OAAO;EACnC,MAAM,SAAS,QAAQ,QAAQ;EAE/B,MAAM,OAAQ,QAAQ,QAAQ,CAAC;EAM/B,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,KAAA;EAC5D,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAA;EACzD,MAAM,OAAO,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAA;EACzD,MAAM,cAAc,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;EAE9E,IAAI,UAAU,KAAA,KAAa,SAAS,KAAA,KAAa,SAAS,KAAA,GACxD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS;EACX,CAAC;EAGH,IAAI,OAAO,cACT,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS,uCAAuC,OAAO,YAAY,EAAE;EACvE,CAAC;EAGH,MAAM,UAAU,MAAM,YACpB;GAAE;GAAS,2BAAW,IAAI,KAAK;GAAG,aAAa,WAAW;EAAE,GAC5D;GACE,QAAQ,SAAS;GACjB;GACA,OAAO,UAAU,KAAA,IAAY,cAAc;GAC3C,QAAQ,OAAO,WAAW,WAAW,SAAS,KAAA;GAC9C;GACA;GACA;GACA;EACF,CACF;EAEA,IAAI,CAAC,QAAQ,IAAI;GACf,MAAM,SACJ,QAAQ,WAAW,gBAAgB,MAAM,QAAQ,WAAW,cAAc,MAAM;GAClF,OAAO,MAAM,KAAK,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC;EAC1D;EAEA,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,IAAI,QAAQ,KAAK;GACjB,MAAM,QAAQ,KAAK;GACnB,MAAM,QAAQ,KAAK;GACnB,aAAa,QAAQ,KAAK;GAC1B,YAAY,QAAQ,KAAK;GAIzB,WAAW,MAAM,mBAAmB,IAAI,EAAE,SAAS,QAAQ,KAAK;EAClE,CAAC;CACH,CAAC;;CAGD,IAAI,IAAI,sBAAsB,OAAO,SAAS,UAAU;EACtD,IAAI,cAAc,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,sBAAsB,CAAC;EAEzF,MAAM,EAAE,MAAM,OAAO,QAAQ;EAC7B,MAAM,OAAO,MAAM,QAAQ,cAAc,IAAI;EAC7C,IAAI,SAAS,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAE7E,MAAM,OAAO,MAAM,QAAQ,QAAQ,EAAE;EAGrC,IAAI,SAAS,KAAA,KAAa,KAAK,WAAW,KAAK,IAC7C,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAEvD,IAAI,KAAK,UAAU,WAGjB,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,mBAAmB,CAAC;EAG3D,MAAM,QAAQ,QAAQ;EACtB,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC;EAC7E,IAAI,MAAM,aAAa,cAAc,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,YAAY,CAAC;EACvF,IAAI,MAAM,eAAe,KAAK,MAI5B,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS,8BAA8B,OAAO,KAAK,IAAI,EAAE,aAAa,OAAO,MAAM,UAAU,EAAE;EACjG,CAAC;EAGH,MAAM,UAAU,IAAI,KAAK,YAAY,KAAK;EAC1C,MAAM,QAAQ,WAAW;GAAE,GAAG;GAAM,OAAO;EAAS,CAAC;EAErD,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;CAC9B,CAAC;;;;;;;;;;;CAYD,IAAI,IAAI,sBAAsB,OAAO,SAAS,UAAU;EACtD,IAAI,cAAc,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,sBAAsB,CAAC;EAEzF,MAAM,EAAE,MAAM,OAAO,QAAQ;EAE7B,IAAI,MADgB,QAAQ,OAAO,MACrB,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,kBAAkB,CAAC;EAEjF,MAAM,OAAO,MAAM,QAAQ,cAAc,IAAI;EAC7C,MAAM,OAAO,MAAM,QAAQ,QAAQ,EAAE;EACrC,IAAI,SAAS,KAAA,KAAa,SAAS,KAAA,KAAa,KAAK,WAAW,KAAK,IACnE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAGvD,MAAM,SAAS,MAAM,UAAU,KAAK,KAAK,UAAU;EACnD,IAAI,WAAW,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;EAE/E,OAAO,MACJ,OAAO,gBAAgB,0BAA0B,CAAC,CAClD,OAAO,0BAA0B,SAAS,CAAC,CAC3C,OAAO,2BAA2B,6BAA6B,CAAC,CAGhE,OAAO,uBAAuB,yBAAyB,KAAK,KAAK,QAAQ,YAAY,EAAE,EAAE,EAAE,CAAC,CAC5F,KAAK,MAAM;CAChB,CAAC;CAED,IAAI,KACF,wBACA,EAIE,QAAQ,EAAE,WAAW;EAAE,KAAK,gBAAgB;EAAK,YAAY,gBAAgB;CAAa,EAAE,EAC9F,GACA,OAAO,SAAS,UAAU;EAC1B,MAAM,EAAE,SAAS,QAAQ;EACzB,MAAM,qBAAqB,QAAQ,QAAQ;EAC3C,IAAI,OAAO,uBAAuB,YAAY,uBAAuB,IACnE,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAC1B,OAAO;GACP,SAAS,4CAA4C,mBAAmB;EAC1E,CAAC;EAOH,MAAM,QAAQ,MAAM,QAAQ,OAAO;EACnC,MAAM,SAAS,QAAQ,QAAQ;EAO/B,IAAI,oBAAoB,KAAA,KAAa,UAAU,KAAA,GAAW;GACxD,MAAM,UAAU,MAAM,eAAe,OAAO;GAC5C,IAAI,YAAY,KAAA,GAAW,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO;EAChE;EAEA,MAAM,UAAU,MAAM,iBAAiB,MAAM;GAC3C;GACA;GACA,MAAM,QAAQ,QAAQ,CAAC;GACvB,OAAO,UAAU,KAAA,IAAY,cAAc;GAC3C,GAAI,OAAO,WAAW,WAAW,EAAE,OAAO,IAAI,CAAC;EACjD,CAAC;EAED,IAAI,QAAQ,IAAI,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;GAAE,IAAI,QAAQ;GAAI,MAAM,QAAQ;EAAc,CAAC;EAE3F,QAAQ,QAAQ,MAAhB;GACE,KAAK,gBACH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,eAAe,CAAC;GACvD,KAAK,mBAGH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAC1B,OAAO;IACP,SACE,QAAQ,YAAY,KAAA,IAChB,KAAA,IACA;KACE,SAAS,QAAQ,QAAQ;KACzB,YAAY,QAAQ,QAAQ;KAC5B,QAAQ,QAAQ,QAAQ;IAC1B;GACR,CAAC;GACH,KAAK,WAGH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK;IAAE,OAAO;IAAW,QAAQ,QAAQ;GAAO,CAAC;GAC1E,KAAK,aAGH,OAAO,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,YAAY,CAAC;GACpD,KAAK,sBAKH,OAAO,MACJ,KAAK,GAAG,CAAC,CACT,KAAK;IAAE,OAAO;IAAsB,QAAQ,QAAQ;GAAO,CAAC;EACnE;CACA,CACF;CAEA,OAAO;AACT;;;;;;;;;;;;;ACh7BA,MAAa,QAAQ,QAAQ,SAAS;CACpC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACpC,kBAAkB,KAAK,oBAAoB;CAK3C,cAAc,KAAK,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,eAAe;CAGrE,gBAAgB,KAAK,iBAAiB,CAAC,CAAC,MAAM;CAC9C,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW;AAClF,CAAC;AAED,MAAa,eAAe,QAAQ,iBAAiB;CACnD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,SAAS,QAAQ,SAAS,CAAC,CAAC,QAAQ;CACpC,QAAQ,MAAM,QAAQ,CAAC,CAAC,QAAQ;CAChC,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,WAAW;AAClF,CAAC;AAED,MAAa,QAAQ,QAAQ,SAAS;CACpC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO;CACtC,cAAc,KAAK,eAAe,CAAC,CAAC,QAAQ;CAC5C,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACrE,CAAC;AAED,MAAa,UAAU,QAAQ,YAAY;CACzC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ;CAC/B,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;CACnE,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC;AAC3D,CAAC;AAED,MAAa,SAAS,QAAQ,UAAU;CACtC,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ;CACvB,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,eAAe,KAAK,iBAAiB,CAAC,CACnC,QAAQ,CAAC,CACT,iBAAiB,aAAa,EAAE;CACnC,MAAM,MAAM,MAAM,CAAC,CAAC,QAAQ;CAC5B,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACrE,CAAC;AAED,MAAa,WAAW,QAAQ,YAAY;CAC1C,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,KAAK,KAAK,KAAK,CAAC,CAAC,QAAQ;CACzB,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ;CAC/B,qBAAqB,QAAQ,sBAAsB,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;CACxE,UAAU,UAAU,aAAa,EAAE,cAAc,KAAK,CAAC;AACzD,CAAC;;;;;;AAOD,MAAa,aAAa,QAAQ,cAAc;CAC9C,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,WAAW,KAAK,YAAY,CAAC,CAAC,QAAQ;CACtC,cAAc,KAAK,eAAe,CAAC,CAAC,QAAQ;CAC5C,SAAS,KAAK,UAAU,CAAC,CAAC,QAAQ;CAClC,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,SAAS,QAAQ,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC;CAC/C,eAAe,UAAU,mBAAmB,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;CAC5E,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,SAAS;CAChD,WAAW,KAAK,YAAY;AAC9B,CAAC;AAED,MAAa,kBAAkB,QAAQ,oBAAoB;CACzD,WAAW,KAAK,WAAW,CAAC,CAAC,WAAW;CACxC,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACrE,CAAC;AAED,MAAa,WAAW,QAAQ,aAAa;CAC3C,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,IAAI,UAAU,MAAM,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;CACpD,QAAQ,KAAK,QAAQ,CAAC,CAAC,QAAQ;CAC/B,WAAW,KAAK,YAAY;CAC5B,SAAS,KAAK,UAAU;CACxB,SAAS,KAAK,SAAS;CACvB,WAAW,KAAK,YAAY;CAC5B,QAAQ,MAAM,QAAQ;AACxB,CAAC;AAED,MAAa,QAAQ,QAAQ,SAAS;CACpC,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CAAC,QAAQ;CAChC,MAAM,KAAK,MAAM,CAAC,CAAC,QAAQ;CAC3B,MAAM,QAAQ,MAAM,CAAC,CAAC,QAAQ;CAC9B,aAAa,KAAK,cAAc,CAAC,CAAC,QAAQ;CAC1C,YAAY,KAAK,aAAa,CAAC,CAAC,QAAQ;CACxC,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,SAAS;CAChD,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;CACnE,cAAc,KAAK,eAAe;AACpC,CAAC;AAED,MAAa,cAAc,QAAQ,eAAe;CAChD,IAAI,KAAK,IAAI,CAAC,CAAC,WAAW;CAC1B,QAAQ,KAAK,SAAS,CAAC,CACpB,QAAQ,CAAC,CACT,iBAAiB,MAAM,EAAE;CAC5B,eAAe,KAAK,iBAAiB,CAAC,CACnC,QAAQ,CAAC,CACT,iBAAiB,aAAa,IAAI,EAAE,UAAU,WAAW,CAAC;CAC7D,MAAM,MAAM,MAAM,CAAC,CAAC,QAAQ;CAC5B,aAAa,UAAU,gBAAgB,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,QAAQ;AACzE,CAAC;;;;;;AAOD,eAAsB,gBAAgB,KAAkC;CACtE,MAAM,GAAG;;;;;;;;;;;;;;CAiBT,MAAM,GAAG;;;CAGT,MAAM,GAAG;CACT,MAAM,GAAG;;;;;;;;;;;CAWT,MAAM,GAAG;;;;;;;;CAQT,MAAM,GAAG;;;;;;;CAOT,MAAM,GAAG;;;;;;;;CAQT,MAAM,GAAG;;;;;;;;;;;;;;;;CAgBT,MAAM,GAAG;;;CAGT,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBT,MAAM,GAAG;;;CAGT,MAAM,GAAG;;;;;;;;CAQT,MAAM,GAAG;;;;;;;;;;CAUT,MAAM,GAAG;CACT,MAAM,GAAG;;;;;;;;;;CAUT,MAAM,GAAG;CAET,MAAM,GAAG;;;;;;;;;;;;;;;;CAkBT,MAAM,GAAG;CACT,MAAM,GAAG;CAET,MAAM,GAAG;;;;;;;;;CAYT,MAAM,GAAG;;;;;;CAMT,MAAM,GAAG;CACT,MAAM,GAAG;;;;CAcT,MAAM,GAAG;;;;;;CAMT,MAAM,GAAG;CACT,MAAM,GAAG;;;;AAIX;;;;AC3UA,SAAgB,sBAAsB,KAA4B;CAChE,MAAM,KAAK,QAAQ,GAAG;CAEtB,OAAO;EACL,MAAM,cAAc,MAAM;GAExB,MAAM,OAAM,MADO,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAA,CAC7D;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,MAAM,IAAI;IACV,kBAAkB,IAAI;IACtB,cAAc,IAAI,iBAAiB,WAAW,WAAW;IACzD,gBAAgB,IAAI;GACtB;EACF;EAEA,MAAM,YAAY;GAEhB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,EAAA,CAC7B,KAAK,SAAS;IACxB,IAAI,IAAI;IACR,MAAM,IAAI;IACV,kBAAkB,IAAI;IACtB,cAAc,IAAI,iBAAiB,WAAY,WAAsB;IACrE,gBAAgB,IAAI;GACtB,EAAE;EACJ;EAEA,MAAM,WAAW,QAAQ;GACvB,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,OAAO;IAC5B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,kBAAkB,OAAO;IACzB,cAAc,OAAO;IACrB,gBAAgB,OAAO;GACzB,CAAC;EACH;EAEA,MAAM,iBAAiB,QAAQ,QAAQ;GACrC,MAAM,GACH,OAAO,KAAK,CAAC,CACb,IAAI;IAAE,cAAc,OAAO;IAAc,gBAAgB,OAAO;GAAe,CAAC,CAAC,CACjF,MAAM,GAAG,MAAM,IAAI,MAAM,CAAC;EAC/B;EAEA,MAAM,kBAAkB,QAAQ,WAAW;GACzC,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,kBAAkB,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,MAAM,CAAC;EACxF;EAEA,MAAM,cAAc,QAAQ;GAC1B,MAAM,GAAG,OAAO,YAAY,CAAC,CAAC,OAAO;IACnC,IAAI,OAAO;IACX,QAAQ,OAAO;IACf,SAAS,OAAO;IAChB,QAAQ,OAAO;IACf,YAAY,OAAO;GACrB,CAAC;EACH;EAEA,MAAM,eAAe,EAAE,MAAM,SAAS,SAAS;GAI7C,MAAM,GAAG,YAAY,OAAO,OAAO;IACjC,IAAI,SAAS,KAAA,GACX,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,OAAO;KAC5B,IAAI,KAAK;KACT,MAAM,KAAK;KACX,kBAAkB,KAAK;KACvB,cAAc,KAAK;KACnB,gBAAgB,KAAK;IACvB,CAAC;IAGH,MAAM,GAAG,OAAO,YAAY,CAAC,CAAC,OAAO;KACnC,IAAI,QAAQ;KACZ,QAAQ,QAAQ;KAChB,SAAS,QAAQ;KACjB,QAAQ,QAAQ;KAChB,YAAY,QAAQ;IACtB,CAAC;IAWD,KAAI,MATkB,GACnB,OAAO,KAAK,CAAC,CACb,IAAI,EAAE,kBAAkB,QAAQ,GAAG,CAAC,CAAC,CACrC,MAAM,GAAG,MAAM,IAAI,QAAQ,MAAM,CAAC,CAAC,CACnC,UAAU,EAAE,IAAI,MAAM,GAAG,CAAC,EAAA,CAKjB,WAAW,GACrB,MAAM,IAAI,MACR,sBAAsB,QAAQ,OAAO,iGACvC;IAGF,IAAI,UAAU,KAAA,GAAW,MAAM,GAAG,OAAO,QAAQ,CAAC,CAAC,OAAO,SAAS,KAAK,CAAC;GAC3E,CAAC;EACH;EAEA,MAAM,eAAe,IAAI;GAEvB,MAAM,OAAM,MADO,GAAG,OAAO,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,MAAM,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAA,CACvE;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;GAClB;EACF;EAEA,MAAM,kBAAkB,QAAQ,YAAY;GAK1C,MAAM,OAAM,MAJO,GAChB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MAAM,GAAG,aAAa,QAAQ,MAAM,CAAC,EAAA,CACvB,MAAM,cAAc,UAAU,eAAe,UAAU;GACxE,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;GAClB;EACF;EAEA,MAAM,oBAAoB,QAAQ;GAKhC,QAAO,MAJY,GAChB,OAAO,EAAE,QAAQ,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC,CAC7C,KAAK,YAAY,CAAC,CAClB,MAAM,GAAG,aAAa,QAAQ,MAAM,CAAC,EAAA,CAC5B,EAAE,EAAE,UAAU;EAC5B;EAEA,MAAM,iBAAiB,QAAQ,QAAQ,cAAc,OAAO;GAI1D,MAAM,GAAG,YAAY,OAAO,OAAO;IACjC,MAAM,GAAG,OAAO,WAAW,CAAC,CAAC,OAAO;KAClC,IAAI,OAAO;KACX,QAAQ,OAAO;KACf,eAAe,OAAO;KACtB,MAAM,OAAO;KACb,aAAa,IAAI,KAAK,OAAO,WAAW;IAC1C,CAAC;IAED,IAAI,WAAW,KAAA,KAAa,OAAO,SAAS,GAC1C,MAAM,GAAG,OAAO,UAAU,CAAC,CAAC,OAC1B,OAAO,KAAK,cAAc;KACxB,IAAI,SAAS;KACb,WAAW,SAAS;KACpB,cAAc,SAAS;KACvB,SAAS,SAAS;KAClB,MAAM,SAAS;KACf,SAAS,SAAS;KAClB,eAAe,IAAI,KAAK,SAAS,aAAa;KAC9C,OAAO,SAAS;KAChB,WAAW,SAAS;IACtB,EAAE,CACJ;IAGF,IAAI,iBAAiB,KAAA,KAAa,aAAa,SAAS,GAYlD;UAAA,MANkB,GACnB,OAAO,KAAK,CAAC,CACb,IAAI;MAAE,OAAO;MAAW,cAAc,OAAO;KAAG,CAAC,CAAC,CAClD,MAAM,IAAI,QAAQ,MAAM,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,GAAG,MAAM,OAAO,QAAQ,CAAC,CAAC,CAAC,CAC3E,UAAU,EAAE,IAAI,MAAM,GAAG,CAAC,EAAA,CAEjB,WAAW,aAAa,QAClC,MAAM,IAAI,MACR,0IACF;IAAA;IAMJ,IAAI,UAAU,KAAA,GAAW,MAAM,GAAG,OAAO,QAAQ,CAAC,CAAC,OAAO,SAAS,KAAK,CAAC;GAC3E,CAAC;EACH;EAEA,MAAM,eAAe,WAAW,cAAc;GAS5C,QAAO,MALe,GACnB,OAAO,eAAe,CAAC,CACvB,OAAO;IAAE;IAAW,WAAW,IAAI,KAAK,YAAY;GAAE,CAAC,CAAC,CACxD,oBAAoB,CAAC,CACrB,UAAU,EAAE,WAAW,gBAAgB,UAAU,CAAC,EAAA,CACtC,WAAW;EAC5B;EAEA,MAAM,wBAAwB,WAAW;GAKvC,QAAO,MAJY,GAChB,OAAO,eAAe,CAAC,CACvB,MAAM,GAAG,gBAAgB,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CACzD,UAAU,EAAE,WAAW,gBAAgB,UAAU,CAAC,EAAA,CACzC;EACd;EAEA,MAAM,YAAY,OAAO;GACvB,MAAM,GAAG,OAAO,QAAQ,CAAC,CAAC,OAAO,SAAS,KAAK,CAAC;EAClD;EAEA,MAAM,UAAU,OAAO;GAErB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAA,CACxE,KAAK,SAAS;IACxB,IAAI,IAAI;IACR,IAAI,IAAI,GAAG,YAAY;IACvB,QAAQ,IAAI;IACZ,GAAI,IAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,UAA+B;IAClF,GAAI,IAAI,YAAY,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,QAAQ;IACvD,GAAI,IAAI,YAAY,OAAO,CAAC,IAAI,EAAE,SAAS,IAAI,QAAQ;IACvD,GAAI,IAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,UAAU;IAC7D,GAAI,IAAI,WAAW,OACf,CAAC,IACD,EAAE,QAAQ,IAAI,OAA4C;GAChE,EAAE;EACJ;EAEA,MAAM,WAAW,QAAQ;GACvB,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,OAAO;IAAE,GAAG;IAAQ,WAAW,IAAI,KAAK,OAAO,SAAS;GAAE,CAAC;EACpF;EAEA,MAAM,QAAQ,IAAI;GAChB,MAAM,CAAC,OAAO,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;GAC3E,OAAO,QAAQ,KAAA,IAAY,KAAA,IAAY,aAAa,GAAG;EACzD;EAEA,MAAM,WAAW,QAAQ;GACvB,MAAM,GACH,OAAO,KAAK,CAAC,CACb,IAAI;IAAE,OAAO,OAAO;IAAO,cAAc,OAAO;GAAa,CAAC,CAAC,CAC/D,MAAM,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;EAClC;EAEA,MAAM,eAAe,WAAW;GAO9B,QAAO,MAJY,GAChB,OAAO,CAAC,CACR,KAAK,KAAK,CAAC,CACX,MAAM,IAAI,GAAG,MAAM,OAAO,SAAS,GAAG,GAAG,MAAM,WAAW,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAA,CACtE,IAAI,YAAY;EAC9B;EAEA,MAAM,YAAY,KAAK;GACrB,IAAI,IAAI,WAAW,GAAG;GACtB,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,MAAM,QAAQ,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;EAC1D;EAEA,MAAM,gBAAgB,QAAQ;GAE5B,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,MAAM,GAAG,SAAS,QAAQ,MAAM,CAAC,EAAA,CACnE,IAAI,eAAe;EACjC;EAEA,MAAM,cAAc,QAAQ;GAI1B,MAAM,GAAG,OAAO,QAAQ,CAAC,CAAC,OAAO;IAC/B,IAAI,OAAO;IACX,QAAQ,OAAO;IACf,KAAK,OAAO;IACZ,QAAQ,OAAO;IACf,qBAAqB,OAAO;IAC5B,UAAU,OAAO,aAAa,OAAO,OAAO,IAAI,KAAK,OAAO,QAAQ;GACtE,CAAC;EACH;EAEA,MAAM,cAAc,QAAQ;GAI1B,MAAM,GACH,OAAO,QAAQ,CAAC,CAChB,IAAI;IACH,qBAAqB,OAAO;IAC5B,UAAU,OAAO,aAAa,OAAO,OAAO,IAAI,KAAK,OAAO,QAAQ;GACtE,CAAC,CAAC,CACD,MAAM,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;EACrC;EAEA,MAAM,eAAe;GAEnB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,QAAQ,EAAA,CAChC,IAAI,eAAe;EACjC;EAEA,MAAM,eAAe,OAAO;GAO1B,QAAO,MANY,GAChB,OAAO,CAAC,CACR,KAAK,UAAU,CAAC,CAChB,MAAM,GAAG,WAAW,OAAO,MAAM,CAAC,CAAC,CACnC,QAAQ,KAAK,WAAW,aAAa,CAAC,CAAC,CACvC,MAAM,KAAK,EAAA,CACF,IAAI,gBAAgB;EAClC;EAEA,MAAM,YAAY,IAAI;GACpB,MAAM,CAAC,OAAO,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;GACrF,OAAO,QAAQ,KAAA,IAAY,KAAA,IAAY,iBAAiB,GAAG;EAC7D;EAEA,MAAM,mBAAmB,QAAQ,OAAO;GAOtC,QAAO,MANY,GAChB,OAAO,CAAC,CACR,KAAK,UAAU,CAAC,CAChB,MAAM,IAAI,GAAG,WAAW,OAAO,SAAS,GAAG,IAAI,WAAW,eAAe,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAC5F,QAAQ,WAAW,aAAa,CAAC,CACjC,MAAM,KAAK,EAAA,CACF,IAAI,gBAAgB;EAClC;EAEA,MAAM,eAAe,QAAQ;GAC3B,MAAM,GACH,OAAO,UAAU,CAAC,CAClB,IAAI;IACH,SAAS,OAAO;IAChB,eAAe,IAAI,KAAK,OAAO,aAAa;IAC5C,OAAO,OAAO;IACd,WAAW,OAAO;GACpB,CAAC,CAAC,CACD,MAAM,GAAG,WAAW,IAAI,OAAO,EAAE,CAAC;EACvC;EAEA,MAAM,kBAAkB;GAEtB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,WAAW,EAAA,CACnC,IAAI,kBAAkB;EACpC;EAEA,MAAM,sBAAsB,QAAQ;GAMlC,QAAO,MALY,GAChB,OAAO,CAAC,CACR,KAAK,WAAW,CAAC,CACjB,MAAM,GAAG,YAAY,QAAQ,MAAM,CAAC,CAAC,CACrC,QAAQ,KAAK,YAAY,WAAW,GAAG,KAAK,YAAY,EAAE,CAAC,EAAA,CAClD,IAAI,kBAAkB;EACpC;EAEA,MAAM,mBAAmB,QAAQ;GAM/B,QAAO,MALY,GAChB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MAAM,GAAG,aAAa,QAAQ,MAAM,CAAC,CAAC,CACtC,QAAQ,KAAK,aAAa,OAAO,CAAC,EAAA,CACzB,KAAK,SAAS;IACxB,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,SAAS,IAAI;IACb,QAAQ,IAAI;IACZ,YAAY,IAAI;GAClB,EAAE;EACJ;EAEA,MAAM,YAAY,QAAQ;GACxB,MAAM,GACH,OAAO,MAAM,CAAC,CACd,OAAO;IACN,IAAI,OAAO;IACX,QAAQ,OAAO;IACf,eAAe,OAAO;IACtB,MAAM,OAAO;IACb,WAAW,IAAI,KAAK,OAAO,SAAS;GACtC,CAAC,CAAC,CACD,mBAAmB;IAClB,QAAQ,CAAC,OAAO,QAAQ,OAAO,EAAE;IACjC,KAAK;KACH,eAAe,OAAO;KACtB,MAAM,OAAO;KACb,WAAW,IAAI,KAAK,OAAO,SAAS;IACtC;GACF,CAAC;EACL;EAEA,MAAM,SAAS,QAAQ,SAAS;GAM9B,MAAM,OAAM,MALO,GAChB,OAAO,CAAC,CACR,KAAK,MAAM,CAAC,CACZ,MAAM,IAAI,GAAG,OAAO,QAAQ,MAAM,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,CAC7D,MAAM,CAAC,EAAA,CACO;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,QAAQ,IAAI;IACZ,eAAe,IAAI;IACnB,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC;EACF;EAEA,MAAM,WAAW,QAAQ;GACvB,MAAM,GAAG,OAAO,KAAK,CAAC,CAAC,OAAO;IAC5B,IAAI,OAAO;IACX,OAAO,OAAO;IACd,cAAc,OAAO;IACrB,MAAM,OAAO;IACb,WAAW,IAAI,KAAK,OAAO,SAAS;GACtC,CAAC;EACH;EAEA,MAAM,eAAe,OAAO;GAE1B,MAAM,OAAM,MADO,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAA,CAC/D;GACjB,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,OAAO;IACL,IAAI,IAAI;IACR,OAAO,IAAI;IACX,cAAc,IAAI;IAClB,MAAM,IAAI;IACV,WAAW,IAAI,UAAU,YAAY;GACvC;EACF;EAEA,MAAM,aAAa,QAAQ;GACzB,MAAM,GAAG,OAAO,OAAO,CAAC,CAAC,OAAO;IAC9B,IAAI,OAAO;IACX,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,YAAY,OAAO;IACnB,MAAM,OAAO;IACb,WAAW,IAAI,KAAK,OAAO,SAAS;IACpC,WAAW,OAAO,cAAc,OAAO,OAAO,IAAI,KAAK,OAAO,SAAS;GACzE,CAAC;EACH;EAEA,MAAM,cAAc;GAElB,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,OAAO,EAAA,CAC/B,IAAI,cAAc;EAChC;EAEA,MAAM,oBAAoB,QAAQ;GAEhC,QAAO,MADY,GAAG,OAAO,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,MAAM,GAAG,QAAQ,QAAQ,MAAM,CAAC,EAAA,CACjE,IAAI,cAAc;EAChC;EAEA,MAAM,aAAa,IAAI,OAAO;GAC5B,MAAM,GAAG,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAC;EACvF;CACF;AACF;AAEA,SAAS,eAAe,KAQrB;CACD,OAAO;EACL,IAAI,IAAI;EACR,MAAM,IAAI;EACV,QAAQ,IAAI;EACZ,YAAY,IAAI;EAChB,MAAM,IAAI;EACV,WAAW,IAAI,UAAU,YAAY;EACrC,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,YAAY;CACvE;AACF;AAEA,SAAS,mBAAmB,KAMzB;CACD,OAAO;EACL,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,eAAe,IAAI;EACnB,MAAM,IAAI;EACV,aAAa,IAAI,YAAY,YAAY;CAC3C;AACF;;AAGA,SAAS,iBAAiB,KAAqC;CAC7D,OAAO;EACL,IAAI,IAAI;EACR,WAAW,IAAI;EACf,cAAc,IAAI;EAClB,SAAS,IAAI;EACb,MAAM,IAAI;EACV,SAAS,IAAI;EACb,eAAe,IAAI,cAAc,YAAY;EAC7C,OAAO,IAAI;EACX,WAAW,IAAI;CACjB;AACF;;AAGA,SAAS,aAAa,KAA4C;CAChE,OAAO;EACL,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,MAAM,IAAI;EACV,MAAM,IAAI;EACV,aAAa,IAAI;EACjB,YAAY,IAAI;EAChB,OAAO,IAAI;EACX,WAAW,IAAI,UAAU,YAAY;EACrC,cAAc,IAAI;CACpB;AACF;;AAGA,SAAS,gBAAgB,KAAmC;CAC1D,OAAO;EACL,IAAI,IAAI;EACR,QAAQ,IAAI;EACZ,KAAK,IAAI;EACT,QAAQ,IAAI;EACZ,qBAAqB,IAAI;EACzB,UAAU,IAAI,aAAa,OAAO,OAAO,IAAI,SAAS,YAAY;CACpE;AACF;;;;;;;AAQA,SAAS,SAAS,OAAmB;CACnC,OAAO;EACL,IAAI,MAAM;EACV,IAAI,IAAI,KAAK,MAAM,EAAE;EACrB,QAAQ,MAAM;EACd,WAAW,MAAM,aAAa;EAC9B,SAAS,MAAM,WAAW;EAC1B,SAAS,MAAM,WAAW;EAC1B,WAAW,MAAM,aAAa;EAC9B,QAAQ,MAAM,UAAU;CAC1B;AACF;;;;;;;;;;;;ACtgBA,SAAgB,qBAAqB,MAAyB;CAC5D,MAAM,OAAO,QAAQ,IAAI;CAEzB,MAAM,WAAW,QAAwB;EAGvC,IAAI,IAAI,SAAS,IAAI,GACnB,MAAM,IAAI,MAAM,gEAAgE,KAAK;EAEvF,MAAM,OAAO,QAAQ,KAAK,MAAM,GAAG,CAAC;EAGpC,IAAI,SAAS,QAAQ,CAAC,KAAK,WAAW,OAAO,GAAG,GAC9C,MAAM,IAAI,MAAM,2DAA2D,KAAK;EAElF,OAAO;CACT;CAEA,OAAO;EACL,MAAM,IAAI,KAAK,OAAO;GACpB,MAAM,OAAO,QAAQ,GAAG;GACxB,MAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;GAC9C,MAAM,UAAU,MAAM,KAAK;EAC7B;EAEA,MAAM,KAAK,KAAK;GACd,MAAM,OAAO,QAAQ,GAAG;GACxB,IAAI;IACF,MAAM,KAAK,IAAI;GACjB,QAAQ;IACN;GACF;GACA,OAAO,iBAAiB,IAAI;EAC9B;EAEA,MAAM,OAAO,KAAK;GAGhB,MAAM,GAAG,QAAQ,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;EACxC;EAEA,MAAM,OAAO,KAAK;GAChB,IAAI;IACF,QAAQ,MAAM,KAAK,QAAQ,GAAG,CAAC,EAAA,CAAG;GACpC,QAAQ;IACN;GACF;EACF;CACF;AACF;;;;;;;;AASA,SAAgB,OAAO,OAAuB;CAC5C,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;;;ACvEA,SAAgB,mBACd,SACA,OACA,UAAwD,CAAC,GACxC;CACjB,MAAM,WAAW,QAAQ,cAAc;CACvC,MAAM,aAAa,QAAQ,cAAc;CACzC,IAAI,UAAU;CACd,IAAI,UAAU;CAEd,MAAM,OAAO,YAA2B;EACtC,IAAI,WAAW,SAAS;EACxB,UAAU;EACV,IAAI;GACF,MAAM,YAAY,MAAM,sBAAsB,yBAAS,IAAI,KAAK,GAAG,UAAU;GAC7E,IAAI,UAAU,WAAW,GAAG;GAE5B,MAAM,UAAoB,CAAC;GAC3B,KAAK,MAAM,QAAQ,WAAW;IAI5B,MAAM,MAAM,OAAO,KAAK,UAAU;IAClC,QAAQ,KAAK,KAAK,EAAE;GACtB;GACA,MAAM,QAAQ,YAAY,OAAO;EACnC,SAAS,OAAO;GAGd,QAAQ,MAAM,mCAAmC,KAAK;EACxD,UAAU;GACR,UAAU;EACZ;CACF;CAEA,MAAM,QAAQ,kBAAkB,KAAK,KAAK,GAAG,QAAQ;CACrD,MAAM,QAAQ;CAEd,OAAO,EACL,YAAY;EACV,UAAU;EACV,cAAc,KAAK;CACrB,EACF;AACF"}