@formancy/server 0.3.0 → 0.5.0

package/dist/completers-DCFoZpo3.mjs

@@ -0,0 +1,3110 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { AUDIT_ACTIONS, auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, completeBuilderRequest, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, formToFill, healthOf, keepExamples, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, readExamples, replayDelivery, resolveForm, resumeDraft, saveDraft, screenUpload, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
+import { MODEL_REQUEST_KINDS } from "@formancy/builder-core";
+import Fastify, { LogController } from "fastify";
+import rateLimit from "@fastify/rate-limit";
+import { hash, verify } from "@node-rs/argon2";
+import { SignJWT, jwtVerify } from "jose";
+import { METHODS, STATUS_CODES, validateHeaderName, validateHeaderValue } from "node:http";
+import { and, desc, eq, inArray, isNull, lt, lte, max, ne, or } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/postgres-js";
+import { integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import postgres from "postgres";
+import { createReadStream } from "node:fs";
+import { mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { dirname, join, resolve, sep } from "node:path";
+import Anthropic, { APIError } from "@anthropic-ai/sdk";
+import OpenAI, { APIError as APIError$1 } from "openai";
+//#region src/header-values.ts
+/**
+* A response header's value made from data: a name somebody else chose
+* ([0175](../../../docs/decisions/0175-a-name-goes-into-a-header-encoded.md)).
+*
+* Node writes a header only when every character of its value is a tab, printable ASCII or one
+* of the bytes 0x80 to 0xFF, and throws `ERR_INVALID_CHAR` for anything else — when the reply is
+* written, after the route has answered. Nothing about a file's name or a form's path keeps it
+* inside that: a respondent names a file `日本 €.pdf`, an author publishes a path with a line
+* break in it. And the bytes 0x80 to 0xFF it does accept are no better: the server sent `é` as one
+* byte before a stream and as two, its UTF-8, before a string body, so a client read `café` on a
+* download and `café` on an export.
+*
+* So a value is made here, from the data, in printable ASCII only, and a route writes what this
+* returns rather than a template of its own. `header-values.test.ts` holds every export to
+* every UTF-16 code unit, and reads the server's sources for a header written any other way.
+*/
+/**
+* `content-disposition` for a download, by RFC 6266: `attachment`, and the name twice when
+* ASCII cannot carry it — once readable, once exact.
+*
+* `filename` is a quoted string of printable ASCII, with every character it cannot hold as
+* itself made `_`: anything outside it, the quote that would end it, the backslash a reader may
+* or may not take as an escape, and the percent sign RFC 6266 (appendix D) says some readers
+* decode. `filename*` is RFC 8187's extended value, the name's UTF-8 percent-encoded, which
+* RFC 6266 has a reader prefer when both are there. It is added only when the readable one
+* lost something, so an ordinary name keeps the header it always had.
+*
+* The name is not cleaned of anything: a control character or a path separator goes to the
+* reader's browser encoded, and making a file name its system can hold is the browser's, as it
+* is for every download.
+*/
+function attachment(filename) {
+	const readable = filename.replace(/[^\x20-\x7e]|["\\%]/gu, "_");
+	if (readable === filename) return `attachment; filename="${readable}"`;
+	return `attachment; filename="${readable}"; filename*=UTF-8''${percentEncoded(filename)}`;
+}
+/** RFC 8187's attr-char: what an extended value may hold as itself. */
+const ATTR_CHAR = /^[A-Za-z0-9!#$&+\-.^_`|~]$/;
+/**
+* `text` as UTF-8, each byte that is not an attr-char written `%XX`.
+*
+* Through a `Buffer` rather than `encodeURIComponent`, which leaves `'`, `(`, `)` and `*` as they
+* are — and a `'` ends an extended value's charset — and throws on a lone surrogate, which a
+* JSON body can carry. A `Buffer` writes one as U+FFFD.
+*/
+function percentEncoded(text) {
+	let encoded = "";
+	for (const byte of Buffer.from(text, "utf8")) {
+		const character = String.fromCharCode(byte);
+		encoded += ATTR_CHAR.test(character) ? character : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+	}
+	return encoded;
+}
+//#endregion
+//#region src/rate-limits.ts
+/**
+* A route's `config.rateLimit`.
+*
+* The failure mode is an argument, so no limit can be written without saying it; left to the
+* plugin, it is an error, which a route answers as a 500 nobody chose. And the window is
+* translated here, once: `timeWindowMs` is this app's name for it and the plugin does not
+* read it, which one route found out by silently taking the global window instead.
+*/
+function limited(budget, whenUncounted) {
+	return {
+		max: budget.max,
+		timeWindow: budget.timeWindowMs,
+		skipOnError: whenUncounted === "admit"
+	};
+}
+//#endregion
+//#region src/routes/files.ts
+/**
+* How long one request holds a file while its bytes are scanned and written (0153).
+*
+* A judgement, not a bound the adapters guarantee. The object store this package supplies
+* abandons a PUT after 30 seconds, as a whole; its clamd adapter's 30 seconds are of silence
+* — any traffic on the connection restarts them — so nothing here limits how long a scan
+* takes. Longer makes an overrun rarer, and keeps a PUT of the same file busy for longer
+* after a request that died holding it. A request that does overrun it can still replace a
+* claimed file's bytes, and `docs/architecture/11-risks-and-debt.md` says what that costs.
+*/
+const RECEIVE_LEASE_MS = 12e4;
+/** A request whose lease ran out is not accepted, whichever check found it. */
+const OUTLASTED = {
+	status: 409,
+	body: {
+		error: "busy",
+		message: "This upload took longer than the server holds a file for one request, so it was not accepted. Try again."
+	}
+};
+/**
+* A form's files: offering one, receiving its bytes, and serving it back.
+*
+* One route family per plugin, the seam `app.ts`'s size budget names. It moved when
+* scanning an upload's bytes needed lines that file had no room for.
+*/
+async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }) {
+	const { storage } = deps;
+	const submissionLimit = limit;
+	/**
+	* Ask where to put a file.
+	*
+	* Refusing here, before a byte is sent, is the difference between rejecting
+	* a 2 GB upload and receiving one first. The reply carries the id the
+	* submission will reference and the URL to PUT the bytes to.
+	*/
+	app.post("/f/:path/files", { config: { rateLimit: limited(submissionLimit, "admit") } }, async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({
+			error: "uploads_unavailable",
+			message: "This deployment has no file store configured, so it cannot accept uploads."
+		});
+		const { path } = request.params;
+		const resolved = await resolveForm(deps, path);
+		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const form = await storage.getFormByPath(path);
+		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+		const actor = await actorOf(request);
+		const origin = request.headers.origin;
+		const body = request.body ?? {};
+		const field = typeof body.field === "string" ? body.field : void 0;
+		const name = typeof body.name === "string" ? body.name : void 0;
+		const size = typeof body.size === "number" ? body.size : void 0;
+		const contentType = typeof body.contentType === "string" ? body.contentType : "application/octet-stream";
+		if (field === void 0 || name === void 0 || size === void 0) return reply.code(400).send({
+			error: "invalid_request",
+			message: "Send the field, the name and the size of the file you want to upload."
+		});
+		if (!Number.isSafeInteger(size) || size < 0) return reply.code(400).send({
+			error: "invalid_request",
+			message: "The size of a file is a whole number of bytes, zero or more."
+		});
+		if (size > maxFileBytes) return reply.code(413).send({
+			error: "too_large",
+			message: `This deployment accepts files up to ${String(maxFileBytes)} bytes.`
+		});
+		const outcome = await offerUpload({
+			storage,
+			now: () => /* @__PURE__ */ new Date(),
+			newId: () => randomUUID()
+		}, {
+			schema: resolved.schema,
+			form,
+			actor: actor === void 0 ? "anonymous" : "authenticated",
+			origin: typeof origin === "string" ? origin : void 0,
+			field,
+			name,
+			size,
+			contentType
+		});
+		if (!outcome.ok) {
+			const status = outcome.reason === "not_allowed" ? 403 : outcome.reason === "too_large" ? 413 : 400;
+			return reply.code(status).send({ error: outcome.reason });
+		}
+		return reply.code(201).send({
+			id: outcome.file.id,
+			name: outcome.file.name,
+			size: outcome.file.size,
+			contentType: outcome.file.contentType,
+			storageKey: outcome.file.storageKey,
+			uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`
+		});
+	});
+	/**
+	* Receive the bytes for a file that was offered.
+	*
+	* In a context of its own, with every body parser removed and one put back that hands
+	* any body over as bytes. A file is whatever the reader had — the form's `accept` list
+	* decides whether it is allowed, at the offer — and Fastify parses `text/plain` and
+	* `application/json` itself: a catch-all added beside those only ever saw the types with
+	* no parser of their own, so a `.txt` or `.json` file arrived here as a string or an
+	* object and was refused as no body. Encapsulated, so that no other route is handed raw
+	* bytes, nor a body as large as a file past the request body cap.
+	*/
+	await app.register(async (byteRoutes) => {
+		byteRoutes.removeAllContentTypeParsers();
+		byteRoutes.addContentTypeParser("*", {
+			parseAs: "buffer",
+			bodyLimit: maxFileBytes
+		}, (_request, body, done) => {
+			done(null, body);
+		});
+		byteRoutes.put("/f/:path/files/:id", { config: { rateLimit: limited(submissionLimit, "admit") } }, async (request, reply) => {
+			if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
+			const { path, id } = request.params;
+			const form = await storage.getFormByPath(path);
+			if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+			const file = await storage.getFile(id);
+			if (file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
+			if (file.state !== "offered") return reply.code(409).send({ error: "already_uploaded" });
+			const bytes = request.body;
+			if (!Buffer.isBuffer(bytes)) return reply.code(400).send({ error: "no_body" });
+			if (bytes.byteLength > maxFileBytes) return reply.code(413).send({ error: "too_large" });
+			if (bytes.byteLength !== file.size) return reply.code(400).send({
+				error: "size_mismatch",
+				message: `This upload was offered as ${String(file.size)} bytes and ${String(bytes.byteLength)} arrived.`
+			});
+			const now = deps.nowIso();
+			const lease = new Date(Date.parse(now) + RECEIVE_LEASE_MS).toISOString();
+			if (!await storage.leaseFile(file.id, now, lease)) return reply.code(409).send({
+				error: "busy",
+				message: "Another request is sending this file's bytes, so these were not kept. Try again in a moment."
+			});
+			const answer = await receive(fileStore, file, bytes, lease, request.log).catch(async (error) => {
+				await giveBack(file.id, lease, request.log);
+				throw error;
+			});
+			if (answer.status !== 204) await giveBack(file.id, lease, request.log);
+			return reply.code(answer.status).send(answer.body);
+		});
+	});
+	/**
+	* Give a file back after a request that kept nothing, without letting the release decide
+	* the reply.
+	*
+	* A release that fails is most likely the database the request has already failed on, and
+	* its error would stand in for the one that says why the bytes were not kept — or turn a
+	* scanner's refusal into a 500. The lease runs out on its own, so all a failed release
+	* costs is a `PUT` of this same file being busy until it does.
+	*/
+	async function giveBack(id, lease, log) {
+		await storage.releaseFile(id, lease).catch((cause) => {
+			log.error({
+				event: "upload.unreleased",
+				err: cause
+			});
+		});
+	}
+	/**
+	* Scan a file's bytes, write them and settle its row, for a request holding its lease.
+	*
+	* Returns the answer rather than sending it, so the route can give the lease back first.
+	*/
+	async function receive(store, file, bytes, lease, log) {
+		const screened = await screenUpload(deps.scanner, file, bytes);
+		if (!screened.ok) {
+			if (screened.reason === "refused") {
+				log.warn({ event: "upload.refused" });
+				return {
+					status: 422,
+					body: {
+						error: "refused_by_scanner",
+						message: `This file was refused by the deployment's virus scanner (${screened.finding}).`
+					}
+				};
+			}
+			log.error({ event: "scanner.unreachable" });
+			return {
+				status: 503,
+				body: {
+					error: "scanner_unavailable",
+					message: "This file could not be scanned just now, so it was not kept. Try again."
+				}
+			};
+		}
+		if ((await storage.getFile(file.id))?.receivingUntil !== lease || Date.parse(deps.nowIso()) >= Date.parse(lease)) return OUTLASTED;
+		await store.put(file.storageKey, bytes);
+		if (await storage.settleFile(file.id, lease)) return { status: 204 };
+		return OUTLASTED;
+	}
+	/**
+	* Serve a file back.
+	*
+	* Always as an attachment, never inline, and `nosniff` alongside it. Stored
+	* cross-site scripting through an uploaded HTML or SVG file is the most
+	* commonly exploited vulnerability in this product category, and the real
+	* answer is a separate hostname — which a single-container deployment does
+	* not have. Forcing a download is the accommodation, and it is the one place
+	* this deployment model genuinely costs something.
+	*/
+	app.get("/f/:path/files/:id", async (request, reply) => {
+		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
+		const { path, id } = request.params;
+		if (await actorOf(request) === void 0) return reply.code(401).send({ error: "unauthenticated" });
+		const form = await storage.getFormByPath(path);
+		const file = await storage.getFile(id);
+		if (form === void 0 || file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
+		const stream = await fileStore.open(file.storageKey);
+		if (stream === void 0) return reply.code(404).send({ error: "unknown_file" });
+		return reply.header("content-type", "application/octet-stream").header("x-content-type-options", "nosniff").header("content-security-policy", "default-src 'none'; sandbox").header("content-disposition", attachment(file.name)).send(stream);
+	});
+}
+//#endregion
+//#region src/headers.ts
+/**
+* The header a client declares what it was looking at with.
+*
+* One name, read by the submission route and by the publish plugin: a
+* submission says which version it rendered, and a publish says which version it
+* opened. Two spellings of one header is a bug nobody sees until a client sends
+* the other one.
+*/
+const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
+/** A solved proof-of-work challenge, as base64 JSON: the shape an ALTCHA client already produces. */
+const CHALLENGE_HEADER = "x-formancy-challenge";
+/**
+* The token a response is sent with: handed out with the form, and with a draft, naming the id
+* the response is stored under (0169). Required of an anonymous submission.
+*/
+const SUBMISSION_TOKEN_HEADER = "x-formancy-submission-token";
+//#endregion
+//#region src/routes/publish.ts
+/**
+* Publishing a form, as a plugin of its own.
+*
+* One route family per plugin, which is Fastify's own unit and what `app.ts`'s
+* size budget named as the seam. It moved when the budget refused the next thing
+* added to it rather than letting the number drift.
+*/
+async function publishRoutes(app, { deps, requires }) {
+	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.path !== "string" || body.path === "" || body.schema === void 0) return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { path, schema }."
+		});
+		const basedOn = request.headers[SCHEMA_HASH_HEADER];
+		const outcome = await publishForm(deps, {
+			path: body.path,
+			schema: body.schema,
+			actor: request.actor,
+			requestId: request.id,
+			...typeof basedOn === "string" && basedOn !== "" ? { basedOnSchemaHash: basedOn } : {}
+		});
+		if (!outcome.ok) switch (outcome.kind) {
+			case "invalid_schema": return reply.code(422).send({
+				error: outcome.kind,
+				errors: outcome.errors
+			});
+			case "unsafe_pattern": return reply.code(422).send({
+				error: outcome.kind,
+				patterns: outcome.patterns
+			});
+			case "invalid_logic": return reply.code(422).send({
+				error: outcome.kind,
+				message: outcome.message
+			});
+			case "unknown_options_source": return reply.code(422).send({
+				error: outcome.kind,
+				sources: outcome.sources
+			});
+			case "already_published": return reply.code(409).send({
+				error: outcome.kind,
+				version: outcome.version
+			});
+			case "version_changed": return reply.code(409).send({
+				error: "FORM_VERSION_CHANGED",
+				current: outcome.current === void 0 ? void 0 : {
+					version: outcome.current.version,
+					schemaHash: outcome.current.schemaHash,
+					schema: outcome.current.schema
+				}
+			});
+		}
+		return reply.code(201).send({
+			version: outcome.version,
+			schemaHash: outcome.schemaHash,
+			...outcome.warnings.length > 0 ? { warnings: outcome.warnings } : {}
+		});
+	});
+}
+//#endregion
+//#region src/routes/access.ts
+/**
+* Who may submit a form, and from where: a property of the deployment, not of the document,
+* so changing it mints no version and leaves every client's schema hash standing
+* ([0044](../../../../docs/decisions/0044-access-outside-the-document.md)).
+*
+* One route family per plugin, the seam `app.ts`'s size budget names. It left `app.ts` when
+* the examples kept beside a form needed a plugin registered there (0166).
+*/
+async function accessRoutes(app, { deps, requires, audit }) {
+	app.put("/f/:path/access", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const { path } = request.params;
+		const body = request.body;
+		const submit = body?.submit;
+		if (submit !== "authenticated" && submit !== "public") return reply.code(400).send({
+			error: "invalid_access",
+			message: "submit must be \"authenticated\" or \"public\"."
+		});
+		const origins = body?.allowedOrigins;
+		if (origins !== void 0 && !(Array.isArray(origins) && origins.every((o) => typeof o === "string"))) return reply.code(400).send({
+			error: "invalid_access",
+			message: "allowedOrigins must be an array of strings, or absent for no allowlist."
+		});
+		if (!(await setFormAccess(deps, {
+			path,
+			submit,
+			...origins === void 0 ? {} : { allowedOrigins: origins }
+		})).ok) return reply.code(404).send({ error: "unknown_form" });
+		await audit(request, {
+			action: "form.access.changed",
+			subject: path,
+			detail: {
+				submit,
+				allowedOrigins: origins === void 0 ? "unchanged" : origins.join(" ")
+			}
+		});
+		return reply.code(204).send();
+	});
+}
+//#endregion
+//#region src/routes/examples.ts
+/**
+* A form's examples, and the sample they start from, kept beside the form (0166).
+*
+* `GET /f/:path/examples` answers `{ scenarios, sample? }`, with `unreadable` beside them when
+* something kept is not an example, and `PUT` replaces both with `{ scenarios, sample? }`. The routes authenticate and carry: who may read and change them, what an
+* example is, and what a publish says about them are `server-core`'s, so the 403 here is the
+* use-case's answer and not a `requires` of the route's own. Publishing needs nothing from
+* here — `publishForm` reads the examples itself, and its warnings ride on the `201`.
+*
+* One route family per plugin, the seam `app.ts`'s size budget names.
+*/
+async function exampleRoutes(app, { deps, actorOf }) {
+	app.get("/f/:path/examples", async (request, reply) => {
+		const actor = await actorOf(request);
+		if (actor === void 0) return reply.code(401).send({ error: "unauthenticated" });
+		const { path } = request.params;
+		return answer$1(reply, await readExamples(deps, {
+			path,
+			actor
+		}));
+	});
+	app.put("/f/:path/examples", async (request, reply) => {
+		const actor = await actorOf(request);
+		if (actor === void 0) return reply.code(401).send({ error: "unauthenticated" });
+		const { path } = request.params;
+		return answer$1(reply, await keepExamples(deps, {
+			path,
+			actor,
+			examples: request.body,
+			requestId: request.id
+		}));
+	});
+}
+/** An outcome as a response: the examples as kept, or the refusal, in the plane's shapes. */
+function answer$1(reply, outcome) {
+	if (outcome.ok) return reply.send(outcome.examples);
+	switch (outcome.kind) {
+		case "forbidden": return reply.code(403).send({
+			error: "forbidden",
+			action: "form.publish"
+		});
+		case "unknown_form": return reply.code(404).send({ error: "unknown_form" });
+		case "invalid_examples": return reply.code(422).send({
+			error: outcome.kind,
+			problems: outcome.problems
+		});
+	}
+}
+//#endregion
+//#region src/routes/deliveries.ts
+/**
+* Webhooks as an operator sees them: their health, the deliveries that died, and
+* sending one of those again.
+*
+* One route family per plugin, the seam `app.ts`'s size budget names. It moved
+* when that file needed room to say which proxy it believes about a client.
+*/
+async function deliveryRoutes(app, { deps, requires, audit }) {
+	/**
+	* Webhook health, and the deliveries that died.
+	*
+	* The reason the breaker keeps its counters on the row rather than in the
+	* worker's memory. A self-hoster has no operations team watching a
+	* dashboard, so a destination refusing deliveries since Tuesday has to be
+	* answerable from the product — otherwise it is found when somebody asks
+	* why the CRM has no leads this week.
+	*/
+	app.get("/webhooks", { preHandler: requires("form.publish") }, async (_request, reply) => {
+		const now = new Date(deps.nowIso());
+		const hooks = await deps.storage.listWebhooks();
+		return reply.send({ webhooks: hooks.map((hook) => healthOf(hook, now)) });
+	});
+	app.get("/deliveries/dead", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const raw = request.query?.limit;
+		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 50;
+		const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 200) : 50;
+		const dead = await deps.storage.deadDeliveries(limit);
+		return reply.send({ deliveries: dead.map((delivery) => ({
+			id: delivery.id,
+			webhookId: delivery.webhookId,
+			submissionId: delivery.submissionId,
+			eventId: delivery.eventId,
+			attempt: delivery.attempt,
+			lastError: delivery.lastError
+		})) });
+	});
+	app.post("/deliveries/:id/replay", { preHandler: requires("form.publish") }, async (request, reply) => {
+		const { id } = request.params;
+		const outcome = await replayDelivery({
+			storage: deps.storage,
+			now: () => new Date(deps.nowIso())
+		}, id);
+		if (!outcome.ok) return outcome.kind === "unknown" ? reply.code(404).send({ error: "unknown_delivery" }) : reply.code(409).send({
+			error: "not_dead",
+			state: outcome.state,
+			message: "Only a dead delivery can be replayed. A pending one is already queued, and a delivered one would be sent twice."
+		});
+		await audit(request, {
+			action: "delivery.replayed",
+			subject: id,
+			detail: { webhookId: outcome.delivery.webhookId }
+		});
+		return reply.code(202).send({
+			id,
+			state: outcome.delivery.state
+		});
+	});
+}
+//#endregion
+//#region src/routes/drafts.ts
+/** Proves the bearer started this draft. Lower-case: Fastify normalises. */
+const DRAFT_TOKEN_HEADER = "x-formancy-draft-token";
+/**
+* A respondent's draft: started, written and read back, each with the key only its starter
+* holds ([0062](../../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).
+*
+* One route family per plugin, the seam `app.ts`'s size budget names. It moved when the
+* deployment's model needed lines that file had no room for.
+*/
+async function draftRoutes(app, { deps, limit }) {
+	/**
+	* Start a draft, and get the only key to it.
+	*
+	* The public plane is anonymous, so a draft has no account behind it. It was
+	* previously addressed by an id the CALLER chose, with no check on either
+	* route: anybody who knew or guessed an id could read a stranger's part-filled
+	* form, and overwrite it — after which that person submits the substituted
+	* content under their own name and nothing says otherwise
+	* ([0062](../../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).
+	*
+	* So the server picks the id and signs it, and the token comes back exactly
+	* once. Losing it means losing the draft, which is the correct trade for the
+	* alternative.
+	*/
+	app.post("/f/:path/drafts", { config: { rateLimit: limited(limit, "admit") } }, async (request, reply) => {
+		const { path } = request.params;
+		const started = await startDraft(deps, { path });
+		if (started === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.code(201).send(started);
+	});
+	app.put("/f/:path/drafts/:draftId", { config: { rateLimit: limited(limit, "admit") } }, async (request, reply) => {
+		const { path, draftId } = request.params;
+		const token = request.headers[DRAFT_TOKEN_HEADER];
+		if (typeof token !== "string") return reply.code(401).send({ error: "draft_token_required" });
+		const saved = await saveDraft(deps, {
+			path,
+			draftId,
+			token,
+			data: request.body ?? {}
+		});
+		if (saved === void 0) return reply.code(404).send({ error: "unknown_form" });
+		if (!saved.saved) return reply.code(403).send({ error: "draft_token_invalid" });
+		return reply.send({ version: saved.version });
+	});
+	app.get("/f/:path/drafts/:draftId", { config: { rateLimit: limited(limit, "admit") } }, async (request, reply) => {
+		const { path, draftId } = request.params;
+		const token = request.headers[DRAFT_TOKEN_HEADER];
+		if (typeof token !== "string") return reply.code(401).send({ error: "draft_token_required" });
+		const resumed = await resumeDraft(deps, {
+			path,
+			draftId,
+			token
+		});
+		if (resumed === void 0) return reply.code(404).send({ error: "unknown_draft" });
+		return reply.send(resumed);
+	});
+}
+//#endregion
+//#region src/routes/model.ts
+/**
+* The largest request the route reads, in bytes, set on the route rather than inherited.
+*
+* Every byte is an input token the operator pays for, so the cap is the route's own:
+* raising the server's limit for something else does not raise what an editor can send a
+* model. It has to hold what the builders send about a form the server publishes, and the
+* largest of that is a translation, not the form: each answer's row repeats the question
+* it answers as its context, pretty-printed and escaped again as a string.
+* `model-route.test.ts` sends all three requests about the largest questionnaire the server's
+* default limit publishes, its questions a sentence long, and they are taken. Longer
+* questions over many answers make a translation past this, refused before it is read (0165).
+*/
+const MODEL_BODY_LIMIT_BYTES = 1048576;
+/**
+* The builders' requests to the deployment's model (0165).
+*
+* `GET /model` says whether there is one, and which, to somebody who may edit a form: the
+* admin draws the prompt pane only when there is. `POST /model/complete` takes
+* `{ kind, user }` and answers `{ text }` — the model's answer, for the browser to check
+* — or `{ declined }` when the provider refused, which the admin's `AskModel` hands back as
+* a decline (0158). Everything else is an error with a sentence for the person.
+*
+* One route family per plugin, the seam `app.ts`'s size budget names.
+*/
+async function modelRoutes(app, { model, requires, audit, limit }) {
+	app.get("/model", { preHandler: requires("form.publish") }, async (_request, reply) => {
+		if (model === void 0) return reply.code(404).send({ error: "model_not_configured" });
+		return reply.send({
+			provider: model.provider,
+			model: model.model
+		});
+	});
+	app.post("/model/complete", {
+		preHandler: requires("form.publish"),
+		bodyLimit: MODEL_BODY_LIMIT_BYTES,
+		config: { rateLimit: {
+			...limited(limit, "refuse"),
+			hook: "preHandler",
+			keyGenerator: (request) => {
+				const actor = request.actor;
+				return actor === void 0 ? `ip:${request.ip}` : `${actor.kind}:${actor.id}`;
+			}
+		} }
+	}, async (request, reply) => {
+		if (model === void 0) return reply.code(404).send({ error: "model_not_configured" });
+		const body = request.body ?? {};
+		const outcome = await completeBuilderRequest(model.completer, body, cancelledWith(reply));
+		if (outcome.ok || outcome.failure !== "unknown_kind" && outcome.failure !== "no_user") await audit(request, {
+			action: "model.asked",
+			subject: String(body.kind),
+			detail: {
+				provider: model.provider,
+				model: model.model,
+				characters: String(body.user).length,
+				outcome: outcome.ok ? "answered" : outcome.failure,
+				...!outcome.ok && outcome.failure === "unavailable" && outcome.status !== void 0 ? { status: outcome.status } : {}
+			}
+		});
+		return answer(reply, request, outcome);
+	});
+}
+/**
+* The browser going away, as a cancellation: the response closing before it was written.
+*
+* Every response closes, so one that finished is not a browser that left; only a close
+* with nothing written yet tells the adapter to abandon the request at the provider.
+*
+* A browser can also have gone before the handler ran, while the session or an API key was
+* still being checked. That response has closed already and will not close again, so it
+* is read as gone from the start, and the adapter is told at once — before it sends.
+*/
+function cancelledWith(reply) {
+	let gone = reply.raw.destroyed && !reply.raw.writableFinished;
+	const listeners = [];
+	reply.raw.once("close", () => {
+		if (reply.raw.writableFinished) return;
+		gone = true;
+		for (const listener of listeners.splice(0)) listener();
+	});
+	return { onCancel(listener) {
+		if (gone) listener();
+		else listeners.push(listener);
+	} };
+}
+/** An outcome as a response, every failure with a sentence for the person reading it. */
+function answer(reply, request, outcome) {
+	if (outcome.ok) return reply.send({ text: outcome.text });
+	switch (outcome.failure) {
+		case "unknown_kind": return reply.code(400).send({
+			error: "unknown_kind",
+			message: `kind must be one of ${MODEL_REQUEST_KINDS.join(", ")}: the requests formancy makes of a model.`
+		});
+		case "no_user": return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { kind, user }, user being the text to ask."
+		});
+		case "refused": return reply.send({ declined: outcome.reason });
+		case "truncated": return reply.code(502).send({
+			error: "model_truncated",
+			message: "The model’s answer reached its length limit and was cut off, so it was not used."
+		});
+		case "cancelled": return reply.code(499).send({ error: "cancelled" });
+		case "unavailable":
+			request.log.error({
+				event: "model.unreachable",
+				upstream: outcome.status
+			});
+			return reply.code(502).send({
+				error: "model_unavailable",
+				message: unavailableSentence(outcome.status)
+			});
+	}
+}
+/** What a provider's status means for the person whose turn it ended. */
+function unavailableSentence(status) {
+	if (status === 401 || status === 403) return "The model service refused this server’s key.";
+	if (status === 429) return "The model service is limiting this server’s requests. Try again in a while.";
+	if (status === 400 || status === 404) return "The model service refused the request: the model this server names may not exist, or may not take it.";
+	return "The model service could not be reached, or answered with an error.";
+}
+//#endregion
+//#region src/routes/submissions.ts
+/**
+* What a respondent's browser does with a form: read it, ask for a challenge, and submit it.
+*
+* One route family per plugin, the seam `app.ts`'s size budget names. It moved when the
+* submission token needed lines that file had no room for.
+*/
+async function submissionRoutes(app, { deps, challengeSecret, limit, actorOf }) {
+	const submissionLimit = limit;
+	/**
+	* Fetch a published form. The one public route deliberately NOT rate-limited.
+	*
+	* Every other unauthenticated route is: submitting, starting a draft, writing
+	* one, reading one, minting a challenge, asking for an upload target. Those are
+	* writes, or guesses, or work somebody can demand of the server. This is the
+	* read every visitor has to make before they can do anything at all.
+	*
+	* Limiting it by IP would refuse the form to real people sharing an address —
+	* an office, a school, a phone network behind CGNAT — and the failure would
+	* look like the form being broken rather than like a limit. That is a worse
+	* outcome than the cheap read it would prevent.
+	*
+	* Written down because the asymmetry is deliberate and looks like an omission.
+	*
+	* It also hands out the token the response is sent with, and that changes neither half of
+	* the argument: minting one is an HMAC and writes nothing, and it is not a defence against
+	* anybody who can read the form, so limiting it would buy nothing (0169). What it does change
+	* is that the reply is per reading: `no-store`, because a cache that kept it would hand one
+	* token to everybody behind it, and only the first of them could send a response.
+	*/
+	app.get("/f/:path", async (request, reply) => {
+		const { path } = request.params;
+		const form = await formToFill(deps, path);
+		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.header("cache-control", "no-store").send({
+			version: form.version,
+			schemaHash: form.schemaHash,
+			schema: form.schema,
+			submissionToken: form.submissionToken
+		});
+	});
+	/**
+	* A puzzle for an anonymous visitor to solve before submitting.
+	*
+	* Public because the form is: requiring a session to obtain a challenge for
+	* an unauthenticated submission would be a circle. It is cheap to mint and
+	* stateless, so handing one out costs this server a hash.
+	*/
+	app.get("/f/:path/challenge", { config: { rateLimit: limited(submissionLimit, "admit") } }, async (request, reply) => {
+		if (challengeSecret === void 0) return reply.code(404).send({ error: "challenge_not_enabled" });
+		const { path } = request.params;
+		if (await deps.storage.getFormByPath(path) === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.send(await mintChallenge({
+			secret: challengeSecret,
+			nowSeconds: Math.floor(new Date(deps.nowIso()).getTime() / 1e3)
+		}));
+	});
+	app.post("/f/:path/submissions", { config: { rateLimit: limited(submissionLimit, "admit") } }, async (request, reply) => {
+		const { path } = request.params;
+		const declaredSchemaHash = request.headers[SCHEMA_HASH_HEADER];
+		if (typeof declaredSchemaHash !== "string" || declaredSchemaHash === "") return reply.code(400).send({
+			error: "missing_schema_hash",
+			message: `Send the schema hash you rendered in the ${SCHEMA_HASH_HEADER} header.`
+		});
+		const actor = await actorOf(request);
+		const origin = request.headers.origin;
+		const token = request.headers[SUBMISSION_TOKEN_HEADER];
+		if (challengeSecret !== void 0 && actor === void 0) {
+			const refusal = await checkChallenge(deps, challengeSecret, request);
+			if (refusal !== void 0) return reply.code(400).send(refusal);
+		}
+		const outcome = await createSubmission(deps, {
+			path,
+			declaredSchemaHash,
+			requestId: request.id,
+			data: request.body ?? {},
+			actor: actor === void 0 ? "anonymous" : "authenticated",
+			...typeof origin === "string" ? { origin } : {},
+			...typeof token === "string" ? { token } : {}
+		});
+		if (outcome.ok) return reply.code(201).send({
+			id: outcome.id,
+			data: outcome.canonicalData
+		});
+		switch (outcome.kind) {
+			case "unknown_form": return reply.code(404).send({ error: "unknown_form" });
+			case "version_changed": return reply.code(409).send({
+				error: "FORM_VERSION_CHANGED",
+				current: outcome.current === void 0 ? void 0 : {
+					version: outcome.current.version,
+					schemaHash: outcome.current.schemaHash,
+					schema: outcome.current.schema
+				}
+			});
+			case "invalid": return reply.code(422).send({
+				error: "invalid",
+				errors: outcome.errors
+			});
+			case "forbidden": return reply.code(403).send({ error: "forbidden" });
+			case "source_unavailable": return reply.code(503).send({
+				error: "source_unavailable",
+				source: outcome.source
+			});
+			case "token_required": return reply.code(400).send({
+				error: "submission_token_required",
+				message: `This form was sent without the token it was handed out with. Read the form again and send its submissionToken in ${SUBMISSION_TOKEN_HEADER}.`
+			});
+			case "token_invalid": return reply.code(400).send({
+				error: "submission_token_invalid",
+				message: "This form was sent with a token the server does not recognise. Read the form again for a new one, and send the answers with it."
+			});
+			case "token_spent": return reply.code(409).send({
+				error: "submission_token_spent",
+				id: outcome.id,
+				message: "This response has already been sent, and is stored. It was not stored again."
+			});
+		}
+	});
+}
+/**
+* Check a submitted solution, and spend it.
+*
+* Returns the refusal to send, or undefined when it passed. The spend is
+* separate from the verification and comes last: the stateless checks say
+* the solution is correct, and only the database can say it has not been
+* used — a correct solution stays correct, so without this one puzzle
+* would buy a thousand submissions.
+*/
+async function checkChallenge(deps, challengeSecret, request) {
+	const header = request.headers[CHALLENGE_HEADER];
+	if (typeof header !== "string" || header === "") return {
+		error: "challenge_required",
+		message: `This form needs a solved challenge. Ask GET /f/:path/challenge for one and return it in ${CHALLENGE_HEADER}.`
+	};
+	const solution = decodeSolution(header);
+	if (solution === void 0) return {
+		error: "challenge_malformed",
+		message: "The challenge header is not base64 JSON."
+	};
+	const nowSeconds = Math.floor(new Date(deps.nowIso()).getTime() / 1e3);
+	const verified = await verifySolution(challengeSecret, solution, nowSeconds);
+	if (!verified.ok) return {
+		error: `challenge_${verified.reason}`,
+		message: "The challenge was not solved. Ask for a new one and try again."
+	};
+	if (!await deps.storage.spendChallenge(verified.challenge, (/* @__PURE__ */ new Date(verified.expiresAtSeconds * 1e3)).toISOString())) return {
+		error: "challenge_spent",
+		message: "That challenge has already been used. Each one is good for one submission."
+	};
+}
+//#endregion
+//#region src/auth-runtime.ts
+/**
+* The real cryptography, confined to the composition root: argon2id for
+* secrets at rest, an HMAC-signed short-lived access token for sessions, and
+* a CSPRNG for API keys. server-core never sees any of this — it is handed
+* hash/verify/random functions and stays deterministic under test.
+*
+* HS256 rather than EdDSA for the session token, deliberately for this phase:
+* one secret in one env var is the self-hosting story a single-container
+* deployment can operate, and the signing scheme is an implementation detail
+* of a token that lives fifteen minutes. Revisit with key rotation.
+*/
+function realSecretHashing() {
+	return {
+		hashSecret: (secret) => hash(secret),
+		verifySecret: async (secret, digest) => {
+			try {
+				return await verify(digest, secret);
+			} catch {
+				return false;
+			}
+		}
+	};
+}
+function realRandomToken() {
+	return randomBytes(30).toString("base64url");
+}
+const TOKEN_LIFETIME = "15m";
+function createSessionTokens(secret) {
+	if (secret.length < 32) throw new Error("FORMANCY_AUTH_SECRET must be at least 32 characters. Generate one: openssl rand -base64 33");
+	const key = new TextEncoder().encode(secret);
+	return {
+		async issue(actor) {
+			return new SignJWT({
+				role: actor.role,
+				kind: actor.kind
+			}).setProtectedHeader({ alg: "HS256" }).setSubject(actor.id).setIssuedAt().setExpirationTime(TOKEN_LIFETIME).sign(key);
+		},
+		async verify(token) {
+			try {
+				const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
+				const role = payload["role"];
+				const kind = payload["kind"];
+				if (typeof payload.sub !== "string" || role !== "admin" && role !== "editor" && role !== "viewer" || kind !== "user" && kind !== "apiKey") return;
+				return {
+					id: payload.sub,
+					role,
+					kind
+				};
+			} catch {
+				return;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/upload-settings.ts
+/**
+* How large a file this deployment accepts.
+*
+* Its own module because `main.ts` is a composition root that connects to a database
+* when it is imported, so nothing in it can be tested — and this is a setting whose wrong
+* values all look plausible.
+*/
+/** Ten megabytes: what the documentation and `.env.example` give as the default. */
+const DEFAULT_MAX_FILE_BYTES = 10485760;
+/**
+* The largest ceiling a deployment may set: the largest number `files.size` can hold.
+*
+* That column is a PostgreSQL `integer` (`db.ts`), a signed 32-bit number. Every size an
+* offer accepts is written to it, so a ceiling above this would let an offer through the
+* route and fail it at the insert. Raising it means widening the column first;
+* `server.integration.test.ts` reads the column's precision from the database and fails
+* when this number and the column disagree.
+*/
+const LARGEST_MAX_FILE_BYTES = 2147483647;
+/**
+* `value`, once it is a ceiling the server can honour: a whole number of bytes, at least
+* one, and no more than `files.size` holds. Throws naming `setting`, because the message
+* is all an operator has to go on.
+*/
+function checkedMaxFileBytes(value, setting) {
+	if (!Number.isInteger(value) || value < 1 || value > 2147483647) throw new Error(`${setting} must be a whole number of bytes from 1 to ${String(LARGEST_MAX_FILE_BYTES)}, the largest size the files table holds.`);
+	return value;
+}
+/**
+* The ceiling `FORMANCY_MAX_FILE_BYTES` sets, or the default when it is unset.
+*
+* Empty is refused rather than read as unset: the compose files already substitute the
+* default for an empty value, so an empty one here was set by hand, to something.
+*/
+function maxFileBytesFrom(env) {
+	const raw = env["FORMANCY_MAX_FILE_BYTES"];
+	if (raw === void 0) return DEFAULT_MAX_FILE_BYTES;
+	return checkedMaxFileBytes(Number(raw), "FORMANCY_MAX_FILE_BYTES");
+}
+//#endregion
+//#region src/server-log.ts
+/**
+* The server's log: a JSON line for every request, one for every error that answered one, and
+* one for each thing a route or a background worker has to say
+* ([0168](../../../docs/decisions/0168-the-log-is-built-from-a-list-of-fields.md)).
+*
+* **What keeps everything else out is construction, not a filter over text.** A line is made
+* from the fields `LOG_FIELDS` names, each kept only when its value is of that field's kind,
+* and from nothing else. A key a call hands over that is not on the list is never read, so a
+* body, a header, a query string, an answer, a password, a draft's key or a file's name has no
+* field to go in. The words of a call are never written at all — pino's message argument,
+* Fastify's `error.message`, its `Route GET:/the/raw/url not found` — so neither are the
+* parameters a database error quotes: a line says what happened with an `event` from
+* `LOG_EVENTS`, and a thrown error is written as its kind and its code.
+*
+* Its own logger rather than pino's options, because pino's rule for what to keep would be
+* three hooks — a log formatter, a bindings formatter and a method hook to drop the message —
+* whose order is pino's internals; here it is one function, `written`, and a list.
+*/
+/** Most severe first: `fatal` writes the least, `trace` the most. The names are pino's. */
+const LOG_LEVELS = [
+	"fatal",
+	"error",
+	"warn",
+	"info",
+	"debug",
+	"trace"
+];
+const SEVERITY = {
+	fatal: 60,
+	error: 50,
+	warn: 40,
+	info: 30,
+	debug: 20,
+	trace: 10
+};
+/** What a line can say happened. Anything else is `unlisted`, or not written. */
+const LOG_EVENTS = [
+	"request",
+	"request.abandoned",
+	"request.refused",
+	"request.failed",
+	"audit.unwritten",
+	"upload.refused",
+	"upload.unreleased",
+	"scanner.unreachable",
+	"model.unreachable",
+	"outbox.failed",
+	"collector.failed",
+	"sweeper.failed",
+	"ratelimit.unanswered",
+	"ratelimit.answering",
+	"ratelimit.sweep.failed",
+	"database.notice",
+	"unlisted"
+];
+/**
+* Every field a line can have, in the order it is written, each with the kind of value it
+* holds. A field is kept only when its value is of its kind, so a string in a number's place,
+* or a sentence in an identifier's, is dropped rather than written.
+*/
+const KINDS = {
+	time: (value) => typeof value === "string",
+	level: (value) => LOG_LEVELS.includes(value),
+	event: (value) => LOG_EVENTS.includes(value),
+	reqId: (value) => typeof value === "string" && /^[\w-]{1,64}$/.test(value),
+	method: (value) => typeof value === "string" && METHODS.includes(value),
+	route: (value) => typeof value === "string" && /^\/[\w\-./:*]*$/.test(value),
+	status: isStatus,
+	ms: (value) => typeof value === "number" && Number.isFinite(value) && value >= 0,
+	kind: isIdentifier,
+	code: isCode,
+	action: (value) => AUDIT_ACTIONS.includes(value),
+	upstream: isStatus
+};
+const LOG_FIELDS = Object.keys(KINDS);
+/**
+* The one place a line becomes text: dropped below `level`, and otherwise each listed field
+* whose value is of its kind, in the listed order.
+*/
+function written(sink, level) {
+	const threshold = SEVERITY[level];
+	return (line) => {
+		if (SEVERITY[line.level] < threshold) return;
+		const kept = {};
+		const given = {
+			...line,
+			time: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		for (const field of LOG_FIELDS) if (KINDS[field](given[field])) kept[field] = given[field];
+		sink.write(`${JSON.stringify(kept)}\n`);
+	};
+}
+/** A log whose every line is built by the rule above. What `createApp` hands Fastify. */
+function createServerLog(sink, level) {
+	return logger(written(sink, level), level, void 0);
+}
+/**
+* Fastify's logger interface over the rule: each call contributes its event, its error, and
+* the status, code, action and upstream status a caller may name, and nothing else it was
+* handed. A
+* child keeps the request id it is bound to, which is how Fastify gives a request's lines its
+* id, and nothing else bound beside it.
+*/
+function logger(write, level, reqId) {
+	const at = (lineLevel) => (first) => {
+		const given = first instanceof Error ? { err: first } : isRecord$1(first) ? first : {};
+		const event = given["event"] !== "unlisted" && KINDS.event(given["event"]) ? given["event"] : void 0;
+		if (event === void 0 && SEVERITY[lineLevel] < SEVERITY.warn) return;
+		write({
+			level: lineLevel,
+			event: event ?? "unlisted",
+			reqId,
+			status: given["status"],
+			code: given["code"],
+			...described(given["err"]),
+			action: given["action"],
+			upstream: given["upstream"]
+		});
+	};
+	return {
+		level,
+		fatal: at("fatal"),
+		error: at("error"),
+		warn: at("warn"),
+		info: at("info"),
+		debug: at("debug"),
+		trace: at("trace"),
+		silent: () => void 0,
+		child: (bindings) => logger(write, level, KINDS.reqId(bindings["reqId"]) ? bindings["reqId"] : reqId)
+	};
+}
+/**
+* When Fastify writes about a request, written as this log's lines: Fastify's own extension
+* point for its internal lines, rather than hooks beside a logger that also writes them.
+*
+* One line when a request is answered, not one when it arrives as well — half the lines,
+* and the one that has the status. A route nobody registered gets no line of its own: its
+* request line says 404 and names no route.
+*
+* **Every request, including the ones Fastify answers past its own request line.** Fastify
+* writes that line when an answer has been sent, so three kinds left none: a request whose
+* client went away first, whose answer is never sent; one refused for an unreadable URL or an
+* over-long parameter, answered by hand before routing unless `frameworkErrors` is set; and
+* one that arrives while the server closes, refused with a `503` before routing and said at
+* `info` in words, which this log drops. Each is written here as well.
+*/
+var RequestLines = class extends LogController {
+	#write;
+	constructor(write) {
+		super();
+		this.#write = write;
+	}
+	/**
+	* Nothing written on arrival; but a response that closes before it has finished sending is
+	* a client that left. Read from the response's own `finish`, which a socket and an injected
+	* request both emit, rather than `writableFinished`, which an injected one never sets.
+	*/
+	incomingRequest(request, reply) {
+		let sent = false;
+		reply.raw.once("finish", () => sent = true);
+		reply.raw.once("close", () => {
+			if (sent) return;
+			this.#write({
+				level: "info",
+				event: "request.abandoned",
+				...where(request),
+				ms: Math.round(reply.elapsedTime)
+			});
+		});
+	}
+	routeNotFound() {}
+	/** At `error` for a 5xx, thrown or answered by a route, so a level kept for failures keeps it. */
+	requestCompleted(error, request, reply) {
+		this.#write({
+			level: error != null || reply.statusCode >= 500 ? "error" : "info",
+			event: "request",
+			...where(request),
+			status: reply.statusCode,
+			ms: Math.round(reply.elapsedTime),
+			...described(error)
+		});
+	}
+	/**
+	* A request refused before it was routed, because its URL cannot be decoded or a parameter
+	* is longer than the router takes: answered through the reply, so the error handler names it
+	* as it names any refusal, and its request line written once the answer has gone. Fastify
+	* calls this `frameworkErrors` and starts no clock for it, so `ms` is 0.
+	*/
+	refusedBeforeRouting = (error, request, reply) => {
+		reply.raw.once("finish", () => this.requestCompleted(null, request, reply));
+		reply.send(error);
+	};
+	/** Words and no event from Fastify, so written here: the `503` and the request's id. */
+	serviceUnavailable(logger) {
+		logger.error({
+			event: "request",
+			status: 503
+		});
+	}
+	defaultErrorLog(error, request, reply) {
+		const failed = reply.statusCode >= 500;
+		this.#write({
+			level: failed ? "error" : "info",
+			event: failed ? "request.failed" : "request.refused",
+			...where(request),
+			status: reply.statusCode,
+			...described(error)
+		});
+	}
+};
+function where(request) {
+	return {
+		reqId: request.id,
+		method: request.method,
+		route: request.routeOptions.url
+	};
+}
+/**
+* Fastify's options for a server that keeps this log, or none for one that keeps no log —
+* `createApp` given no `log`, which is how a host embedding it keeps its own output (0115).
+* Without one, Fastify answers what it refuses before routing by hand, as it always has; with
+* one, through the reply so the refusal can be written — the same status and the same fields.
+*/
+function serverLogOptions(log) {
+	if (log === void 0) return {};
+	const write = written(log.sink, log.level);
+	const lines = new RequestLines(write);
+	return {
+		loggerInstance: logger(write, log.level, void 0),
+		logController: lines,
+		frameworkErrors: lines.refusedBeforeRouting
+	};
+}
+/**
+* What a thrown thing is, from what it calls itself: its class, and the first code along its
+* causes — Drizzle wraps PostgreSQL's error, whose SQLSTATE is the useful part. Never its
+* message or its stack, whose first line is the message.
+*/
+function described(error) {
+	if (!(error instanceof Error)) return {};
+	let code;
+	let at = error;
+	for (let depth = 0; code === void 0 && at instanceof Error && depth < 4; depth += 1) {
+		const own = at.code;
+		if (isCode(own)) code = own;
+		at = at.cause;
+	}
+	return {
+		kind: kindOf(error),
+		...code === void 0 ? {} : { code }
+	};
+}
+/** `name`, which most errors set; a class that leaves it as `Error` by its constructor. */
+function kindOf(error) {
+	if (error.name !== "Error" && isIdentifier(error.name)) return error.name;
+	const constructed = error.constructor.name;
+	return isIdentifier(constructed) ? constructed : "Error";
+}
+function isIdentifier(value) {
+	return typeof value === "string" && /^[A-Za-z_$][\w$]{0,63}$/.test(value);
+}
+/**
+* `ECONNREFUSED`, `22P02`, `FST_ERR_CTP_BODY_TOO_LARGE`: capitals, digits and underscores. The
+* one rule for what a code looks like, which the reply to a 5xx keeps a code by as well (0172).
+*/
+function isCode(value) {
+	return typeof value === "string" && /^[A-Z0-9_]{1,64}$/.test(value);
+}
+function isStatus(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 100 && value <= 599;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+/**
+* The log a worker was given, or one writing its failures to standard error by the same rule:
+* where they went before there was a log, and so where a host that starts a worker without
+* one still finds them.
+*/
+function workerLog(given) {
+	return given ?? createServerLog(process.stderr, "error");
+}
+/**
+* What the database says beside its answers, as lines by the same rule: its SQLSTATE, never
+* its words. postgres.js prints each notice whole to standard output unless it is handed
+* somewhere else to put it, and the bootstrap draws one on every start for each table, column
+* and trigger that already exists. Those are `debug`; a `WARNING` is `warn`. With no log,
+* nowhere.
+*/
+function databaseNotices(log) {
+	return (notice) => {
+		if (log === void 0) return;
+		const line = {
+			event: "database.notice",
+			code: notice["code"]
+		};
+		if (notice["severity"] === "WARNING") log.warn(line);
+		else log.debug(line);
+	};
+}
+//#endregion
+//#region src/error-replies.ts
+/**
+* What an error answers its client with
+* ([0172](../../../docs/decisions/0172-a-5xx-says-nothing-of-what-was-thrown.md)).
+*
+* Fastify answers an error with `{ statusCode, code, error, message }`, the message being the
+* error's own. For an error that names its own 4xx that is a sentence written for the client —
+* the body did not parse, the file is too large — and it stays. For a 5xx it is whatever was
+* thrown: a database error's message is the failing query and its parameters, a disk's names
+* the path it could not write. So a 5xx keeps the shape and says only its status: the status's
+* own name as `error` and as `message`, and a `code` only when the error named its own status —
+* made to be answered, as `RATE_LIMIT_UNAVAILABLE` is (0170) — and only in the shape the log
+* keeps a code in. A fault's code, `ENOSPC` or an SQLSTATE, is the operator's, in the log. And a
+* fault answered under a 4xx — Fastify keeps a status of 400 or more that the reply already had
+* — says only that status too (0175): its words were no more written for the client there.
+*
+* **Two hooks rather than an error handler**, because Fastify writes its line about an error —
+* `request.failed` and `request.refused`, with the error's kind and code (`server-log.ts`) —
+* only from its own default handler. One set with `setErrorHandler` replaces it, and the line
+* would go with it. So the default handler still sets the status and writes the line, and the
+* body is replaced on its way out, in `onSend`, where the status is final. `onError` is how
+* `onSend` knows the body is an error's: a route that answers a 5xx itself — no file store, a
+* scanner that could not be asked — chose its words for the person reading them.
+*
+* **An error's reply is written without a header Node cannot write**
+* ([0175](../../../docs/decisions/0175-a-name-goes-into-a-header-encoded.md)). Node checks a
+* header's value when the reply is written, after the route has answered, and throws. Fastify
+* answers that error with the headers the reply already had, so its own reply failed the same
+* way, and Fastify's last resort — which runs no hook — wrote it with Node's code and sentence,
+* under whatever status the reply had. Dropping the header here is what lets this reply be the
+* one that goes out, because no `onSend` hook runs after this one but Fastify's own on a `HEAD`
+* route, which sets only a length — `error-replies.test.ts` puts such a header on a request to
+* every route and reads each answer. A route's own value is built so it cannot be refused
+* (`header-values.ts`); this is for the one that was not.
+*
+* On the root instance, before any route is registered, so every route and every plugin's
+* context has both. Not tied to the log: an app given none withholds the same words.
+*/
+function withholdServerErrors(app) {
+	const thrown = /* @__PURE__ */ new WeakMap();
+	app.addHook("onError", async (_request, reply, error) => {
+		thrown.set(reply, error);
+	});
+	app.addHook("onSend", async (_request, reply, payload) => {
+		if (!thrown.has(reply)) return payload;
+		dropUnwritable(reply);
+		const error = thrown.get(reply);
+		if (reply.statusCode < 500 && answerable(error)) return payload;
+		return JSON.stringify(withheld(reply.statusCode, error));
+	});
+}
+/** Remove every header Node would refuse to write, by its own checks rather than a copy of them. */
+function dropUnwritable(reply) {
+	for (const [name, value] of Object.entries(reply.getHeaders())) if (!writable(name, value)) reply.removeHeader(name);
+}
+/**
+* A header as Node writes it: a number as its digits, and a list one value at a time. Fastify
+* keeps no header without a value — `reply.header` defaults one to `''` — though `getHeaders`
+* is typed as if it might.
+*/
+function writable(name, value) {
+	try {
+		validateHeaderName(name);
+		for (const each of [value ?? []].flat()) validateHeaderValue(name, String(each));
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether an error names its own status: made to be answered, by this server or by Fastify, so
+* its code is part of the answer and, below 500, its sentence too. One that names none is a
+* fault from below, whatever status the reply already had when it was thrown.
+*/
+function answerable(error) {
+	return isRecord(error) && (typeof error["statusCode"] === "number" || typeof error["status"] === "number");
+}
+/** Fastify's shape for an error's reply, with nothing in it the thrown error said. */
+function withheld(status, error) {
+	const name = STATUS_CODES[status] ?? "Server Error";
+	const own = isRecord(error) ? error : {};
+	const code = answerable(own) && isCode(own["code"]) ? own["code"] : void 0;
+	return {
+		statusCode: status,
+		...code === void 0 ? {} : { code },
+		error: name,
+		message: name
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+//#endregion
+//#region src/nul-characters.ts
+/**
+* A body with a NUL character in it is refused as malformed
+* ([0173](../../../docs/decisions/0173-a-nul-character-names-nothing-and-a-body-with-one-is-refused.md)).
+*
+* PostgreSQL holds no U+0000 in `text`, `22021`, nor in `jsonb`, `22P05`, so a string with one
+* can be kept nowhere this server keeps anything: an answer, a draft, a schema, an example, a
+* file's name or type, an origin, an email, a key's name. Each was a `500` where its route
+* wrote it, and a line at `error`. Refused here, once, on the root instance before any route,
+* so every route and every plugin's context has it and a route added later needs nothing of
+* its own.
+*
+* In `preValidation`, which is after the body is parsed — by whichever parser the request's
+* type chose, so a `text/plain` string is looked at as well as JSON — and before any route's
+* own `preHandler`. That makes it what a body that does not parse is: answered by the body
+* alone, whoever sent it and whatever accounts exist, before a session is asked for. A file's
+* bytes arrive as a `Buffer` and are not looked at; a NUL byte is ordinary in a file.
+*
+* The answer is the route plane's shape for a refusal, with the JSON Pointer (RFC 6901) to the
+* string or the member's name the NUL is in, so a client can say which answer to correct.
+*/
+function refuseNulCharacters(app) {
+	app.addHook("preValidation", async (request, reply) => {
+		const pointer = nulAt(request.body);
+		if (pointer === void 0) return;
+		return reply.code(400).send({
+			error: "nul_character",
+			pointer,
+			message: `The NUL character (U+0000) is in no string this server accepts, and this request's body has one at ${pointer === "" ? "the body itself" : pointer}.`
+		});
+	});
+}
+/**
+* The JSON Pointer to the first string or member name in `body` with a NUL in it, in the order
+* the body was written, or `undefined` when there is none.
+*
+* A loop over a stack of its own rather than a recursion: `JSON.parse` takes a body nested
+* deeper than the call stack goes, and a walk that threw on it would make that body a `500` on
+* every route. And every body is walked, so nothing is built for a value on the way — a step
+* for each container, and the pointer only for the string it finds. Building a pointer for
+* every value made the walk of a body at the cap take longer than parsing it.
+*/
+function nulAt(body) {
+	const values = [body];
+	const containers = [void 0];
+	const keys = [void 0];
+	while (values.length > 0) {
+		const value = values.pop();
+		const container = containers.pop();
+		const key = keys.pop();
+		if (typeof value === "string") {
+			if (value.includes("\0")) return pointer(container, key);
+			continue;
+		}
+		const here = key === void 0 ? container : {
+			up: container,
+			key
+		};
+		if (Array.isArray(value)) for (let index = value.length - 1; index >= 0; index -= 1) {
+			values.push(value[index]);
+			containers.push(here);
+			keys.push(index);
+		}
+		else if (isPlainObject(value)) {
+			const names = Object.keys(value);
+			for (let index = names.length - 1; index >= 0; index -= 1) {
+				const name = names[index];
+				values.push(value[name]);
+				containers.push(here);
+				keys.push(name);
+				if (name.includes("\0")) {
+					values.push(name);
+					containers.push(here);
+					keys.push(name);
+				}
+			}
+		}
+	}
+}
+/** RFC 6901's spelling of the place `key` names in `container`: '' for the body itself. */
+function pointer(container, key) {
+	const steps = [];
+	for (let at = key === void 0 ? container : {
+		up: container,
+		key
+	}; at !== void 0; at = at.up) steps.push(at.key);
+	return steps.reverse().map((step) => `/${typeof step === "number" ? String(step) : token(step)}`).join("");
+}
+/** A member's name as one step of a JSON Pointer: `~` and `/` escaped, as RFC 6901 has them. */
+function token(name) {
+	return name.replaceAll("~", "~0").replaceAll("/", "~1");
+}
+/** What a parser makes of a JSON object, and nothing else — not a `Buffer`, not a stream. */
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+//#endregion
+//#region src/audit-trail.ts
+/**
+* Append an audit row for something that has already happened.
+*
+* Never throws. An export that succeeded and an audit row that did not is
+* bad; an export that 500s because the audit row failed, after the rows have
+* already been written to the response, is worse and helps nobody. So the
+* failure is written to the log at error level, as `audit.unwritten` with the
+* row's action and the error's kind — never its subject, which for a failed
+* login is the email somebody tried — and the request stands.
+*
+* For a mutation that HAS a transaction, do not use this — pass the entry
+* into that call so the two commit together. A publish, a change to a form's
+* examples and a submission are those: their use-cases build the row, and
+* the route hands them `request.id` so it names the request as this one does.
+*
+* Its own module because what happens when a row cannot be written is the log's
+* business (0168), and `app.ts` had no room for it.
+*/
+function auditTrail(deps) {
+	return async (request, draft) => {
+		const actor = request.actor;
+		try {
+			await deps.storage.recordAudit({
+				id: deps.newId(),
+				at: deps.nowIso(),
+				requestId: request.id,
+				...auditedBy(actor, draft)
+			});
+		} catch (error) {
+			request.log.error({
+				event: "audit.unwritten",
+				action: draft.action,
+				err: error
+			});
+		}
+	};
+}
+//#endregion
+//#region src/app.ts
+const API_KEY_HEADER = "x-formancy-api-key";
+/**
+* The HTTP surface, split into two planes.
+*
+* PUBLIC — what a person filling a form needs: resolve, submit, drafts. These
+* stay unauthenticated by design; anonymous-submission hardening is its own
+* upcoming step and is opt-in per form.
+*
+* MANAGEMENT — everything an operator does: publish, catalog, submissions,
+* export, users, keys. Authenticated via a session token (login) or an API
+* key header, authorized through server-core's one-table can().
+*
+* This file is the composition root, so THIS is where ambient reality enters:
+* randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays
+* injected and replayable.
+*/
+async function createApp(storage, options) {
+	const app = Fastify({
+		...serverLogOptions(options.log),
+		bodyLimit: options.bodyLimitBytes ?? 262144,
+		trustProxy: options.trustProxy ?? false
+	});
+	withholdServerErrors(app);
+	refuseNulCharacters(app);
+	const maxFileBytes = checkedMaxFileBytes(options.maxFileBytes ?? 10485760, "maxFileBytes");
+	const fileStore = options.fileStore;
+	const submissionLimit = options.submissionRateLimit ?? {
+		max: 30,
+		timeWindowMs: 6e4
+	};
+	const loginLimit = options.loginRateLimit ?? {
+		max: 10,
+		timeWindowMs: 6e4
+	};
+	const challengeSecret = options.challengeSecret;
+	await app.register(rateLimit, {
+		global: false,
+		max: submissionLimit.max,
+		timeWindow: submissionLimit.timeWindowMs,
+		...options.rateLimitStore === void 0 ? {} : { store: options.rateLimitStore }
+	});
+	const deps = {
+		storage,
+		newId: () => randomUUID(),
+		nowIso: () => (/* @__PURE__ */ new Date()).toISOString(),
+		draftSecret: options.authSecret,
+		...options.optionsSources === void 0 ? {} : { optionsSources: options.optionsSources },
+		...options.scanner === void 0 ? {} : { scanner: options.scanner },
+		capabilities: {
+			now: () => Date.now(),
+			today: () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+			random: () => Math.random()
+		}
+	};
+	const authDeps = {
+		storage,
+		newId: deps.newId,
+		nowIso: deps.nowIso,
+		randomToken: realRandomToken,
+		...realSecretHashing()
+	};
+	const sessions = createSessionTokens(options.authSecret);
+	if (options.bootstrapAdmin !== void 0) {
+		if (await storage.getUserByEmail(options.bootstrapAdmin.email) === void 0) {
+			const outcome = await createLocalUser(authDeps, {
+				...options.bootstrapAdmin,
+				role: "admin"
+			});
+			if (!outcome.ok) throw new Error(`Bootstrap admin rejected: ${outcome.message}`);
+		}
+	}
+	async function actorOf(request) {
+		const bearer = request.headers.authorization;
+		if (typeof bearer === "string" && bearer.startsWith("Bearer ")) return sessions.verify(bearer.slice(7));
+		const apiKey = request.headers[API_KEY_HEADER];
+		if (typeof apiKey === "string" && apiKey !== "") {
+			const outcome = await authenticateApiKey(authDeps, apiKey);
+			return outcome.ok ? outcome.actor : void 0;
+		}
+	}
+	/** 401 without an identity, 403 with one that lacks the permission — the
+	*  difference tells a client whether to log in or to give up. */
+	function requires(action) {
+		return async (request, reply) => {
+			const actor = await actorOf(request);
+			if (actor === void 0) return reply.code(401).send({ error: "unauthenticated" });
+			if (!can(actor, action)) return reply.code(403).send({
+				error: "forbidden",
+				action
+			});
+			request.actor = actor;
+		};
+	}
+	const audit = auditTrail(deps);
+	app.post("/auth/login", { config: { rateLimit: limited(loginLimit, "refuse") } }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.email !== "string" || typeof body.password !== "string") return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { email, password }."
+		});
+		const outcome = await authenticateLocal(authDeps, {
+			email: body.email,
+			password: body.password
+		});
+		if (!outcome.ok) {
+			await audit(request, {
+				action: "auth.login.failed",
+				subject: body.email
+			});
+			return reply.code(401).send({ error: "invalid_credentials" });
+		}
+		await audit(request, {
+			action: "auth.login",
+			subject: body.email,
+			actorKind: "user",
+			actorId: outcome.actor.id
+		});
+		return reply.send({
+			token: await sessions.issue(outcome.actor),
+			role: outcome.actor.role
+		});
+	});
+	app.post("/users", { preHandler: requires("user.create") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.email !== "string" || typeof body.password !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { email, password, role }."
+		});
+		const outcome = await createLocalUser(authDeps, {
+			email: body.email,
+			password: body.password,
+			role: body.role
+		});
+		if (!outcome.ok) return reply.code(422).send({
+			error: "rejected",
+			message: outcome.message
+		});
+		return reply.code(201).send({ id: outcome.id });
+	});
+	app.post("/api-keys", { preHandler: requires("apiKey.create") }, async (request, reply) => {
+		const body = request.body;
+		if (body === null || typeof body.name !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
+			error: "bad_request",
+			message: "Body needs { name, role }."
+		});
+		const outcome = await createApiKey(authDeps, {
+			name: body.name,
+			role: body.role
+		});
+		if (!outcome.ok) return reply.code(422).send({
+			error: "rejected",
+			message: outcome.message
+		});
+		return reply.code(201).send({
+			id: outcome.id,
+			secret: outcome.secret
+		});
+	});
+	await app.register(publishRoutes, {
+		deps,
+		requires
+	});
+	await app.register(accessRoutes, {
+		deps,
+		requires,
+		audit
+	});
+	await app.register(exampleRoutes, {
+		deps,
+		actorOf
+	});
+	/**
+	* The log itself.
+	*
+	* Admin only, and reading it is NOT audited. A log that records its own
+	* reads grows without bound from a dashboard that polls it, and the entry
+	* would say nothing an access log does not — the events worth recording
+	* are the ones that touch somebody else's data.
+	*/
+	app.get("/audit", { preHandler: requires("user.create") }, async (request, reply) => {
+		const raw = request.query?.limit;
+		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 100;
+		const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 500) : 100;
+		return reply.send({ entries: await deps.storage.listAudit(limit) });
+	});
+	await app.register(deliveryRoutes, {
+		deps,
+		requires,
+		audit
+	});
+	const modelLimit = options.modelRateLimit ?? {
+		max: 10,
+		timeWindowMs: 6e4
+	};
+	await app.register(modelRoutes, {
+		model: options.model,
+		requires,
+		audit,
+		limit: modelLimit
+	});
+	app.get("/forms", { preHandler: requires("form.read") }, async (_request, reply) => {
+		return reply.send({ forms: await listForms(deps) });
+	});
+	app.get("/f/:path/versions", { preHandler: requires("form.read") }, async (request, reply) => {
+		const { path } = request.params;
+		const versions = await listVersions(deps, path);
+		if (versions === void 0) return reply.code(404).send({ error: "unknown_form" });
+		return reply.send({ versions });
+	});
+	app.get("/f/:path/submissions", { preHandler: requires("submission.read") }, async (request, reply) => {
+		const { path } = request.params;
+		const listed = await listSubmissions(deps, path);
+		if (listed === void 0) return reply.code(404).send({ error: "unknown_form" });
+		await audit(request, {
+			action: "submission.read",
+			subject: path,
+			detail: { count: listed.length }
+		});
+		return reply.send({ submissions: listed });
+	});
+	app.get("/f/:path/submissions/export.csv", { preHandler: requires("submission.export") }, async (request, reply) => {
+		const { path } = request.params;
+		const csv = await exportCsv(deps, path);
+		if (csv === void 0) return reply.code(404).send({ error: "unknown_form" });
+		await audit(request, {
+			action: "submission.exported",
+			subject: path,
+			detail: { bytes: Buffer.byteLength(csv, "utf8") }
+		});
+		return reply.header("content-type", "text/csv; charset=utf-8").header("content-disposition", attachment(`${path}-submissions.csv`)).send(csv);
+	});
+	await app.register(submissionRoutes, {
+		deps,
+		challengeSecret,
+		limit: submissionLimit,
+		actorOf
+	});
+	await app.register(draftRoutes, {
+		deps,
+		limit: submissionLimit
+	});
+	await app.register(fileRoutes, {
+		deps,
+		fileStore,
+		maxFileBytes,
+		limit: submissionLimit,
+		actorOf
+	});
+	return app;
+}
+//#endregion
+//#region src/db.ts
+/**
+* The thin slice's tables. Three rules from the design spec are enforced HERE,
+* in the database, because application code can be bypassed and these must not
+* be:
+*
+*  - published versions are immutable (a trigger refuses UPDATE),
+*  - a submission binds to its exact version by real foreign key,
+*  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema
+*    that produced it is structurally impossible.
+*/
+const forms = pgTable("forms", {
+	id: uuid("id").primaryKey(),
+	path: text("path").notNull().unique(),
+	currentVersionId: uuid("current_version_id"),
+	accessSubmit: text("access_submit").notNull().default("authenticated"),
+	allowedOrigins: text("allowed_origins").array(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+const formVersions = pgTable("form_versions", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	version: integer("version").notNull(),
+	schema: jsonb("schema").notNull(),
+	schemaHash: text("schema_hash").notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+});
+const users = pgTable("users", {
+	id: uuid("id").primaryKey(),
+	email: text("email").notNull().unique(),
+	passwordHash: text("password_hash").notNull(),
+	role: text("role").notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull()
+});
+const apiKeys = pgTable("api_keys", {
+	id: uuid("id").primaryKey(),
+	name: text("name").notNull(),
+	prefix: text("prefix").notNull(),
+	secretHash: text("secret_hash").notNull(),
+	role: text("role").notNull(),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	revokedAt: timestamp("revoked_at", { withTimezone: true })
+});
+const drafts = pgTable("drafts", {
+	id: text("id").notNull(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id),
+	data: jsonb("data").notNull(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+});
+const webhooks = pgTable("webhooks", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	url: text("url").notNull(),
+	secret: text("secret").notNull(),
+	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+	openedAt: timestamp("opened_at", { withTimezone: true })
+});
+/**
+* The outbox. A row here and the submission that caused it are written by the
+* same transaction, which is what makes "accepted" and "will be delivered" one
+* decision rather than two.
+*/
+const deliveries = pgTable("deliveries", {
+	id: uuid("id").primaryKey(),
+	webhookId: uuid("webhook_id").notNull(),
+	submissionId: uuid("submission_id").notNull(),
+	eventId: uuid("event_id").notNull(),
+	body: text("body").notNull(),
+	attempt: integer("attempt").notNull().default(0),
+	nextAttemptAt: timestamp("next_attempt_at", { withTimezone: true }).notNull(),
+	state: text("state").notNull().default("pending"),
+	lastError: text("last_error")
+});
+const spentChallenges = pgTable("spent_challenges", {
+	challenge: text("challenge").primaryKey(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+});
+const auditLog = pgTable("audit_log", {
+	id: uuid("id").primaryKey(),
+	at: timestamp("at", { withTimezone: true }).notNull(),
+	action: text("action").notNull(),
+	actorKind: text("actor_kind"),
+	actorId: text("actor_id"),
+	subject: text("subject"),
+	requestId: text("request_id"),
+	detail: jsonb("detail")
+});
+/**
+* A form's examples and the sample they start from, one row per form, beside it and never in
+* a version (0166). The examples change while the form does not, and a version cannot.
+*/
+const formExamples = pgTable("form_examples", {
+	formId: uuid("form_id").primaryKey().references(() => forms.id),
+	scenarios: jsonb("scenarios").notNull(),
+	sample: jsonb("sample"),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
+});
+/**
+* An audit entry as the table holds it.
+*
+* Absent and null are the same thing here, and the conversion is in one place, beside the
+* table, so the storage's call sites — a publish, a submission, a form's examples — cannot
+* disagree about which they write.
+*/
+function auditRow(entry) {
+	return {
+		id: entry.id,
+		at: new Date(entry.at),
+		action: entry.action,
+		actorKind: entry.actorKind ?? null,
+		actorId: entry.actorId ?? null,
+		subject: entry.subject ?? null,
+		requestId: entry.requestId ?? null,
+		detail: entry.detail ?? null
+	};
+}
+const files = pgTable("files", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull(),
+	name: text("name").notNull(),
+	size: integer("size").notNull(),
+	contentType: text("content_type").notNull(),
+	storageKey: text("storage_key").notNull(),
+	state: text("state").notNull().default("offered"),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
+	submissionId: uuid("submission_id"),
+	receivingUntil: timestamp("receiving_until", { withTimezone: true })
+});
+const submissions = pgTable("submissions", {
+	id: uuid("id").primaryKey(),
+	formId: uuid("form_id").notNull().references(() => forms.id),
+	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id, { onDelete: "restrict" }),
+	data: jsonb("data").notNull(),
+	submittedAt: timestamp("submitted_at", { withTimezone: true }).notNull()
+});
+/**
+* Whether `id` can be compared with a `uuid` column: the hyphenated form every id this server
+* mints has. PostgreSQL refuses anything it cannot read as a uuid with an error, `22P02`, where
+* a `text` column — or the in-memory storage — finds no row; so a lookup by an id from a URL
+* that is not one answers no row without asking (0172). A spelling PostgreSQL would also read,
+* braced or without hyphens, names no row either: no id was handed out in one.
+*/
+function isUuid(id) {
+	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
+}
+/**
+* Whether `value` can be compared with a `text` column: PostgreSQL holds no NUL character in
+* text and refuses one with an error, `22021`, where the in-memory storage finds no row. So a
+* lookup by a value with one — a form's path from a URL, an API key's prefix from a header —
+* answers no row without asking, as `isUuid` does for its column (0173). No row was ever
+* written with one, since no write of one ever succeeded.
+*/
+function fitsText(value) {
+	return !value.includes("\0");
+}
+/**
+* Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the
+* lifecycle work; a self-hosted skeleton that creates its own tables on first
+* start is worth more right now than a migration pipeline.
+*/
+async function bootstrapSchema(sql) {
+	await sql`
+    CREATE TABLE IF NOT EXISTS forms (
+      id uuid PRIMARY KEY,
+      path text NOT NULL UNIQUE,
+      current_version_id uuid,
+      -- Private by default in the DATABASE, not only in the code, so a row
+      -- inserted by a migration or a fixture is not accidentally open.
+      access_submit text NOT NULL DEFAULT 'authenticated'
+        CHECK (access_submit IN ('authenticated', 'public')),
+      -- NULL: no allowlist in force. Empty array: nothing allowed. Different
+      -- things, which is why this is nullable rather than defaulting to '{}'.
+      allowed_origins text[],
+      created_at timestamptz NOT NULL DEFAULT now()
+    )`;
+	await sql`
+    ALTER TABLE forms
+      ADD COLUMN IF NOT EXISTS access_submit text NOT NULL DEFAULT 'authenticated'`;
+	await sql`ALTER TABLE forms ADD COLUMN IF NOT EXISTS allowed_origins text[]`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS form_versions (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id),
+      version integer NOT NULL,
+      schema jsonb NOT NULL,
+      schema_hash text NOT NULL,
+      created_at timestamptz NOT NULL DEFAULT now(),
+      UNIQUE (form_id, version),
+      UNIQUE (form_id, schema_hash)
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS submissions (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id),
+      form_version_id uuid NOT NULL REFERENCES form_versions(id) ON DELETE RESTRICT,
+      data jsonb NOT NULL,
+      submitted_at timestamptz NOT NULL
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS webhooks (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE CASCADE,
+      url text NOT NULL,
+      secret text NOT NULL
+    )`;
+	await sql`
+    ALTER TABLE webhooks
+      ADD COLUMN IF NOT EXISTS consecutive_failures integer NOT NULL DEFAULT 0,
+      -- When the breaker opened, null while the destination is answering. On
+      -- the row rather than in the worker's memory: memory does not survive a
+      -- restart, and a self-hoster with no operations team needs a failing
+      -- webhook to be visible on a screen rather than in a log nobody tails.
+      ADD COLUMN IF NOT EXISTS opened_at timestamptz`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS deliveries (
+      id uuid PRIMARY KEY,
+      webhook_id uuid NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+      -- RESTRICT, not CASCADE: a delivery is the record that something was
+      -- sent about this submission, and deleting the submission must not
+      -- quietly erase it.
+      submission_id uuid NOT NULL REFERENCES submissions(id) ON DELETE RESTRICT,
+      event_id uuid NOT NULL,
+      body text NOT NULL,
+      attempt integer NOT NULL DEFAULT 0,
+      next_attempt_at timestamptz NOT NULL,
+      state text NOT NULL DEFAULT 'pending'
+        CHECK (state IN ('pending', 'delivered', 'dead')),
+      last_error text
+    )`;
+	await sql`
+    CREATE INDEX IF NOT EXISTS deliveries_due
+      ON deliveries (next_attempt_at) WHERE state = 'pending'`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS files (
+      id uuid PRIMARY KEY,
+      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE RESTRICT,
+      -- What the reader called it. Display only: the storage key is minted by
+      -- the server, because a key built from a submitted filename is a path
+      -- traversal waiting for somebody to try it.
+      name text NOT NULL,
+      size integer NOT NULL,
+      content_type text NOT NULL,
+      storage_key text NOT NULL,
+      state text NOT NULL DEFAULT 'offered'
+        CHECK (state IN ('offered', 'stored', 'claimed')),
+      created_at timestamptz NOT NULL,
+      -- RESTRICT for the same reason a delivery uses it: the row is the record
+      -- that something was attached, and deleting the submission must not
+      -- quietly erase what it carried.
+      submission_id uuid REFERENCES submissions(id) ON DELETE RESTRICT,
+      -- One file, one submission. Enforced here rather than in application
+      -- code, because two concurrent submissions claiming the same file is
+      -- exactly the race application code loses — and the loser would be a
+      -- submission referencing bytes another submission owns.
+      CONSTRAINT files_one_submission UNIQUE (id, submission_id)
+    )`;
+	await sql`ALTER TABLE files ADD COLUMN IF NOT EXISTS receiving_until timestamptz`;
+	await sql`
+    CREATE INDEX IF NOT EXISTS files_abandoned
+      ON files (created_at) WHERE state <> 'claimed'`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS users (
+      id uuid PRIMARY KEY,
+      email text NOT NULL UNIQUE,
+      password_hash text NOT NULL,
+      role text NOT NULL,
+      created_at timestamptz NOT NULL
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS api_keys (
+      id uuid PRIMARY KEY,
+      name text NOT NULL,
+      prefix text NOT NULL,
+      secret_hash text NOT NULL,
+      role text NOT NULL,
+      created_at timestamptz NOT NULL,
+      revoked_at timestamptz
+    )`;
+	await sql`CREATE INDEX IF NOT EXISTS api_keys_prefix ON api_keys (prefix)`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS spent_challenges (
+      -- The primary key IS the mechanism. Two requests arriving with one
+      -- solution both pass every stateless check — the signature is ours
+      -- and the hash is right — and only the database can decide which of
+      -- them spends it. A read-then-write would race exactly where somebody
+      -- is looking.
+      challenge text PRIMARY KEY,
+      expires_at timestamptz NOT NULL
+    )`;
+	await sql`CREATE INDEX IF NOT EXISTS spent_challenges_expiry ON spent_challenges (expires_at)`;
+	await sql`
+    CREATE UNLOGGED TABLE IF NOT EXISTS rate_limit_counters (
+      key text PRIMARY KEY,
+      hits integer NOT NULL,
+      resets_at timestamptz NOT NULL
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS audit_log (
+      id uuid PRIMARY KEY,
+      at timestamptz NOT NULL,
+      action text NOT NULL,
+      -- Null for an anonymous public submission, which is an answer rather
+      -- than a gap: the form was open and nobody was signed in.
+      actor_kind text CHECK (actor_kind IN ('user', 'apiKey')),
+      actor_id text,
+      subject text,
+      request_id text,
+      -- Identifiers and counts. NEVER a submission's answers: an audit log is
+      -- read by more people and kept longer than the data it describes, so
+      -- data inside it is a second copy of the thing being protected.
+      detail jsonb
+    )`;
+	await sql`CREATE INDEX IF NOT EXISTS audit_log_at ON audit_log (at DESC)`;
+	await sql`CREATE INDEX IF NOT EXISTS audit_log_subject ON audit_log (subject, at DESC)`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS drafts (
+      id text NOT NULL,
+      form_id uuid NOT NULL REFERENCES forms(id),
+      form_version_id uuid NOT NULL REFERENCES form_versions(id),
+      data jsonb NOT NULL,
+      updated_at timestamptz NOT NULL,
+      PRIMARY KEY (form_id, id)
+    )`;
+	await sql`
+    CREATE TABLE IF NOT EXISTS form_examples (
+      form_id uuid PRIMARY KEY REFERENCES forms(id),
+      scenarios jsonb NOT NULL,
+      sample jsonb,
+      updated_at timestamptz NOT NULL
+    )`;
+	await sql`
+    CREATE OR REPLACE FUNCTION refuse_version_update() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'form_versions rows are immutable; publish a new version instead';
+    END
+    $$ LANGUAGE plpgsql`;
+	await sql`DROP TRIGGER IF EXISTS form_versions_immutable ON form_versions`;
+	await sql`
+    CREATE TRIGGER form_versions_immutable
+    BEFORE UPDATE ON form_versions
+    FOR EACH ROW EXECUTE FUNCTION refuse_version_update()`;
+	await sql`
+    CREATE OR REPLACE FUNCTION refuse_audit_change() RETURNS trigger AS $$
+    BEGIN
+      RAISE EXCEPTION 'audit_log is append-only';
+    END
+    $$ LANGUAGE plpgsql`;
+	await sql`DROP TRIGGER IF EXISTS audit_log_append_only ON audit_log`;
+	await sql`
+    CREATE TRIGGER audit_log_append_only
+    BEFORE UPDATE OR DELETE ON audit_log
+    FOR EACH ROW EXECUTE FUNCTION refuse_audit_change()`;
+}
+//#endregion
+//#region src/postgres-examples.ts
+/**
+* A form's examples over PostgreSQL: one row per form in `form_examples`, replaced whole
+* (0166).
+*
+* Its own file because it changes for its own reason, and because `postgres-storage.ts`
+* would otherwise have crossed the size budget with it.
+*/
+function examplesStorage(db) {
+	return {
+		async getExamples(formId) {
+			const row = (await db.select().from(formExamples).where(eq(formExamples.formId, formId)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				formId: row.formId,
+				scenarios: row.scenarios,
+				sample: row.sample,
+				updatedAt: row.updatedAt.toISOString()
+			};
+		},
+		async keepExamples(record, audit) {
+			await db.transaction(async (tx) => {
+				const row = {
+					formId: record.formId,
+					scenarios: record.scenarios,
+					sample: record.sample,
+					updatedAt: new Date(record.updatedAt)
+				};
+				await tx.insert(formExamples).values(row).onConflictDoUpdate({
+					target: formExamples.formId,
+					set: {
+						scenarios: row.scenarios,
+						sample: row.sample,
+						updatedAt: row.updatedAt
+					}
+				});
+				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
+			});
+		}
+	};
+}
+//#endregion
+//#region src/postgres-identities.ts
+/**
+* Who may use the management plane, over PostgreSQL: users with a password and API keys, each
+* stored as a hash and looked up by what a request presents — an email, a key's prefix.
+*
+* Its own file because it changes for its own reason — the way somebody is let in, not the
+* forms and responses everything else here stores — and because `postgres-storage.ts` would
+* otherwise have crossed the size budget when its lookups learned to find nothing for a NUL
+* (0173).
+*/
+function identitiesStorage(db) {
+	return {
+		async insertUser(record) {
+			await db.insert(users).values({
+				id: record.id,
+				email: record.email,
+				passwordHash: record.passwordHash,
+				role: record.role,
+				createdAt: new Date(record.createdAt)
+			});
+		},
+		async getUserByEmail(email) {
+			if (!fitsText(email)) return void 0;
+			const row = (await db.select().from(users).where(eq(users.email, email)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				email: row.email,
+				passwordHash: row.passwordHash,
+				role: row.role,
+				createdAt: row.createdAt.toISOString()
+			};
+		},
+		async insertApiKey(record) {
+			await db.insert(apiKeys).values({
+				id: record.id,
+				name: record.name,
+				prefix: record.prefix,
+				secretHash: record.secretHash,
+				role: record.role,
+				createdAt: new Date(record.createdAt),
+				revokedAt: record.revokedAt === null ? null : new Date(record.revokedAt)
+			});
+		},
+		async listApiKeys() {
+			return (await db.select().from(apiKeys)).map(toApiKeyRecord);
+		},
+		async findApiKeysByPrefix(prefix) {
+			if (!fitsText(prefix)) return [];
+			return (await db.select().from(apiKeys).where(eq(apiKeys.prefix, prefix))).map(toApiKeyRecord);
+		},
+		async revokeApiKey(id, atIso) {
+			await db.update(apiKeys).set({ revokedAt: new Date(atIso) }).where(eq(apiKeys.id, id));
+		}
+	};
+}
+/** An API key's row as the port describes it: timestamps as ISO strings. */
+function toApiKeyRecord(row) {
+	return {
+		id: row.id,
+		name: row.name,
+		prefix: row.prefix,
+		secretHash: row.secretHash,
+		role: row.role,
+		createdAt: row.createdAt.toISOString(),
+		revokedAt: row.revokedAt === null ? null : row.revokedAt.toISOString()
+	};
+}
+//#endregion
+//#region src/postgres-storage.ts
+/** The Storage port over Postgres — the mirror of server-core's in-memory one. */
+function createPostgresStorage(sql) {
+	const db = drizzle(sql);
+	return {
+		...examplesStorage(db),
+		...identitiesStorage(db),
+		async getFormByPath(path) {
+			if (!fitsText(path)) return void 0;
+			const row = (await db.select().from(forms).where(eq(forms.path, path)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				path: row.path,
+				currentVersionId: row.currentVersionId,
+				accessSubmit: row.accessSubmit === "public" ? "public" : "authenticated",
+				allowedOrigins: row.allowedOrigins
+			};
+		},
+		async listForms() {
+			return (await db.select().from(forms)).map((row) => ({
+				id: row.id,
+				path: row.path,
+				currentVersionId: row.currentVersionId,
+				accessSubmit: row.accessSubmit === "public" ? "public" : "authenticated",
+				allowedOrigins: row.allowedOrigins
+			}));
+		},
+		async createForm(record) {
+			await db.insert(forms).values({
+				id: record.id,
+				path: record.path,
+				currentVersionId: record.currentVersionId,
+				accessSubmit: record.accessSubmit,
+				allowedOrigins: record.allowedOrigins
+			});
+		},
+		async updateFormAccess(formId, access) {
+			await db.update(forms).set({
+				accessSubmit: access.accessSubmit,
+				allowedOrigins: access.allowedOrigins
+			}).where(eq(forms.id, formId));
+		},
+		async setCurrentVersion(formId, versionId) {
+			await db.update(forms).set({ currentVersionId: versionId }).where(eq(forms.id, formId));
+		},
+		async insertVersion(record) {
+			await db.insert(formVersions).values({
+				id: record.id,
+				formId: record.formId,
+				version: record.version,
+				schema: record.schema,
+				schemaHash: record.schemaHash
+			});
+		},
+		async publishVersion({ form, version, audit }) {
+			await db.transaction(async (tx) => {
+				if (form !== void 0) await tx.insert(forms).values({
+					id: form.id,
+					path: form.path,
+					currentVersionId: form.currentVersionId,
+					accessSubmit: form.accessSubmit,
+					allowedOrigins: form.allowedOrigins
+				});
+				await tx.insert(formVersions).values({
+					id: version.id,
+					formId: version.formId,
+					version: version.version,
+					schema: version.schema,
+					schemaHash: version.schemaHash
+				});
+				if ((await tx.update(forms).set({ currentVersionId: version.id }).where(eq(forms.id, version.formId)).returning({ id: forms.id })).length !== 1) throw new Error(`Publishing to form ${version.formId} matched no form row. Rolling back, so there is no version pointing at a form that is not there.`);
+				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
+			});
+		},
+		async getVersionById(id) {
+			const row = (await db.select().from(formVersions).where(eq(formVersions.id, id)).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				formId: row.formId,
+				version: row.version,
+				schema: row.schema,
+				schemaHash: row.schemaHash
+			};
+		},
+		async findVersionByHash(formId, schemaHash) {
+			const row = (await db.select().from(formVersions).where(eq(formVersions.formId, formId))).find((candidate) => candidate.schemaHash === schemaHash);
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				formId: row.formId,
+				version: row.version,
+				schema: row.schema,
+				schemaHash: row.schemaHash
+			};
+		},
+		async latestVersionNumber(formId) {
+			return (await db.select({ latest: max(formVersions.version) }).from(formVersions).where(eq(formVersions.formId, formId)))[0]?.latest ?? 0;
+		},
+		async insertSubmission(record, queued, claimFileIds, audit) {
+			return db.transaction(async (tx) => {
+				if ((await tx.insert(submissions).values({
+					id: record.id,
+					formId: record.formId,
+					formVersionId: record.formVersionId,
+					data: record.data,
+					submittedAt: new Date(record.submittedAt)
+				}).onConflictDoNothing({ target: submissions.id }).returning({ id: submissions.id })).length === 0) return false;
+				if (queued !== void 0 && queued.length > 0) await tx.insert(deliveries).values(queued.map((delivery) => ({
+					id: delivery.id,
+					webhookId: delivery.webhookId,
+					submissionId: delivery.submissionId,
+					eventId: delivery.eventId,
+					body: delivery.body,
+					attempt: delivery.attempt,
+					nextAttemptAt: new Date(delivery.nextAttemptAt),
+					state: delivery.state,
+					lastError: delivery.lastError
+				})));
+				if (claimFileIds !== void 0 && claimFileIds.length > 0) {
+					if ((await tx.update(files).set({
+						state: "claimed",
+						submissionId: record.id
+					}).where(and(inArray(files.id, [...claimFileIds]), eq(files.state, "stored"))).returning({ id: files.id })).length !== claimFileIds.length) throw new Error("A file this submission names was claimed by another one first. Rolling back, so the submission does not reference bytes it does not own.");
+				}
+				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
+				return true;
+			});
+		},
+		async hasSubmission(id) {
+			return (await db.select({ id: submissions.id }).from(submissions).where(eq(submissions.id, id)).limit(1)).length === 1;
+		},
+		async spendChallenge(challenge, expiresAtIso) {
+			return (await db.insert(spentChallenges).values({
+				challenge,
+				expiresAt: new Date(expiresAtIso)
+			}).onConflictDoNothing().returning({ challenge: spentChallenges.challenge })).length === 1;
+		},
+		async forgetExpiredChallenges(beforeIso) {
+			return (await db.delete(spentChallenges).where(lt(spentChallenges.expiresAt, new Date(beforeIso))).returning({ challenge: spentChallenges.challenge })).length;
+		},
+		async recordAudit(entry) {
+			await db.insert(auditLog).values(auditRow(entry));
+		},
+		async listAudit(limit) {
+			return (await db.select().from(auditLog).orderBy(desc(auditLog.at)).limit(limit)).map((row) => ({
+				id: row.id,
+				at: row.at.toISOString(),
+				action: row.action,
+				...row.actorKind === null ? {} : { actorKind: row.actorKind },
+				...row.actorId === null ? {} : { actorId: row.actorId },
+				...row.subject === null ? {} : { subject: row.subject },
+				...row.requestId === null ? {} : { requestId: row.requestId },
+				...row.detail === null ? {} : { detail: row.detail }
+			}));
+		},
+		async insertFile(record) {
+			await db.insert(files).values({
+				...record,
+				createdAt: new Date(record.createdAt),
+				receivingUntil: record.receivingUntil === null ? null : new Date(record.receivingUntil)
+			});
+		},
+		async getFile(id) {
+			if (!isUuid(id)) return void 0;
+			const [row] = await db.select().from(files).where(eq(files.id, id)).limit(1);
+			return row === void 0 ? void 0 : toFileRecord(row);
+		},
+		async leaseFile(id, nowIso, untilIso) {
+			const free = or(isNull(files.receivingUntil), lte(files.receivingUntil, new Date(nowIso)));
+			return (await db.update(files).set({ receivingUntil: new Date(untilIso) }).where(and(eq(files.id, id), eq(files.state, "offered"), free)).returning({ id: files.id })).length === 1;
+		},
+		async settleFile(id, untilIso) {
+			const held = eq(files.receivingUntil, new Date(untilIso));
+			return (await db.update(files).set({
+				state: "stored",
+				receivingUntil: null
+			}).where(and(eq(files.id, id), eq(files.state, "offered"), held)).returning({ id: files.id })).length === 1;
+		},
+		async releaseFile(id, untilIso) {
+			return (await db.update(files).set({ receivingUntil: null }).where(and(eq(files.id, id), eq(files.receivingUntil, new Date(untilIso)))).returning({ id: files.id })).length === 1;
+		},
+		async abandonedFiles(beforeIso) {
+			return (await db.select().from(files).where(and(ne(files.state, "claimed"), lt(files.createdAt, new Date(beforeIso))))).map(toFileRecord);
+		},
+		async deleteFiles(ids) {
+			if (ids.length === 0) return;
+			await db.delete(files).where(inArray(files.id, [...ids]));
+		},
+		async webhooksForForm(formId) {
+			return (await db.select().from(webhooks).where(eq(webhooks.formId, formId))).map(toWebhookRecord);
+		},
+		async insertWebhook(record) {
+			await db.insert(webhooks).values({
+				id: record.id,
+				formId: record.formId,
+				url: record.url,
+				secret: record.secret,
+				consecutiveFailures: record.consecutiveFailures,
+				openedAt: record.openedAt === null ? null : new Date(record.openedAt)
+			});
+		},
+		async updateWebhook(record) {
+			await db.update(webhooks).set({
+				consecutiveFailures: record.consecutiveFailures,
+				openedAt: record.openedAt === null ? null : new Date(record.openedAt)
+			}).where(eq(webhooks.id, record.id));
+		},
+		async listWebhooks() {
+			return (await db.select().from(webhooks)).map(toWebhookRecord);
+		},
+		async deadDeliveries(limit) {
+			return (await db.select().from(deliveries).where(eq(deliveries.state, "dead")).orderBy(desc(deliveries.nextAttemptAt)).limit(limit)).map(toDeliveryRecord);
+		},
+		async getDelivery(id) {
+			if (!isUuid(id)) return void 0;
+			const [row] = await db.select().from(deliveries).where(eq(deliveries.id, id)).limit(1);
+			return row === void 0 ? void 0 : toDeliveryRecord(row);
+		},
+		async claimDueDeliveries(nowIso, limit) {
+			return (await db.select().from(deliveries).where(and(eq(deliveries.state, "pending"), lte(deliveries.nextAttemptAt, new Date(nowIso)))).orderBy(deliveries.nextAttemptAt).limit(limit)).map(toDeliveryRecord);
+		},
+		async updateDelivery(record) {
+			await db.update(deliveries).set({
+				attempt: record.attempt,
+				nextAttemptAt: new Date(record.nextAttemptAt),
+				state: record.state,
+				lastError: record.lastError
+			}).where(eq(deliveries.id, record.id));
+		},
+		async listSubmissions() {
+			return (await db.select().from(submissions)).map(toSubmissionRecord);
+		},
+		async listSubmissionsByForm(formId) {
+			return (await db.select().from(submissions).where(eq(submissions.formId, formId)).orderBy(desc(submissions.submittedAt), desc(submissions.id))).map(toSubmissionRecord);
+		},
+		async listVersionsByForm(formId) {
+			return (await db.select().from(formVersions).where(eq(formVersions.formId, formId)).orderBy(desc(formVersions.version))).map((row) => ({
+				id: row.id,
+				formId: row.formId,
+				version: row.version,
+				schema: row.schema,
+				schemaHash: row.schemaHash
+			}));
+		},
+		async upsertDraft(record) {
+			await db.insert(drafts).values({
+				id: record.id,
+				formId: record.formId,
+				formVersionId: record.formVersionId,
+				data: record.data,
+				updatedAt: new Date(record.updatedAt)
+			}).onConflictDoUpdate({
+				target: [drafts.formId, drafts.id],
+				set: {
+					formVersionId: record.formVersionId,
+					data: record.data,
+					updatedAt: new Date(record.updatedAt)
+				}
+			});
+		},
+		async getDraft(formId, draftId) {
+			if (!fitsText(draftId)) return void 0;
+			const row = (await db.select().from(drafts).where(and(eq(drafts.formId, formId), eq(drafts.id, draftId))).limit(1))[0];
+			if (row === void 0) return void 0;
+			return {
+				id: row.id,
+				formId: row.formId,
+				formVersionId: row.formVersionId,
+				data: row.data,
+				updatedAt: row.updatedAt.toISOString()
+			};
+		}
+	};
+}
+function toSubmissionRecord(row) {
+	return {
+		id: row.id,
+		formId: row.formId,
+		formVersionId: row.formVersionId,
+		data: row.data,
+		submittedAt: row.submittedAt.toISOString()
+	};
+}
+/** A delivery row as the port describes it. */
+function toDeliveryRecord(row) {
+	return {
+		id: row.id,
+		webhookId: row.webhookId,
+		submissionId: row.submissionId,
+		eventId: row.eventId,
+		body: row.body,
+		attempt: row.attempt,
+		nextAttemptAt: row.nextAttemptAt.toISOString(),
+		state: row.state,
+		lastError: row.lastError
+	};
+}
+/** A files row as the port describes it: timestamps as ISO strings. */
+function toFileRecord(row) {
+	return {
+		id: row.id,
+		formId: row.formId,
+		name: row.name,
+		size: row.size,
+		contentType: row.contentType,
+		storageKey: row.storageKey,
+		state: row.state,
+		createdAt: row.createdAt.toISOString(),
+		submissionId: row.submissionId,
+		receivingUntil: row.receivingUntil === null ? null : row.receivingUntil.toISOString()
+	};
+}
+/** A webhook row as the port describes it, health included. */
+function toWebhookRecord(row) {
+	return {
+		id: row.id,
+		formId: row.formId,
+		url: row.url,
+		secret: row.secret,
+		consecutiveFailures: row.consecutiveFailures,
+		openedAt: row.openedAt === null ? null : row.openedAt.toISOString()
+	};
+}
+/**
+* `@fastify/rate-limit`'s store over the PostgreSQL every replica already shares (0170).
+*
+* The plugin's own store keeps its counts in the process, so behind N replicas each limit
+* allowed N times what it said. This one keeps them in `rate_limit_counters`, one row per
+* route and client, and counts with one statement: the upsert takes the row's lock, so two
+* replicas counting the same client at once are counted one after the other and neither
+* increment is lost.
+*
+* A window starts at a key's first request and lasts the route's `timeWindow`, as the plugin's
+* own stores do it, on the database's clock — one clock for every replica, where each
+* process's own would end the window at a different moment on each.
+*
+* It opens its own connections from the database's address rather than taking a pool, because
+* which connections it counts on is what keeps a counter that cannot answer from stopping
+* everything else: handed the pool storage queries on, it would count correctly and bring that
+* outage back. A count that does not come back within the bound is abandoned: one still waiting
+* here to be sent is dropped unsent, and one already sent is ended by the database once it runs,
+* by the `statement_timeout` of these connections, with no cancel request — a connection more —
+* needed for it. The error the plugin is handed says nothing about the database, because a route
+* that refuses without a count sends it to whoever asked; what each route does then is its own
+* declaration (`rate-limits.ts`).
+*
+* The plugin's in-memory store is the second implementation of the same interface, and what
+* `createApp` counts in when it is given none.
+*/
+function createPostgresRateLimitStore(databaseUrl, options = {}) {
+	const timeoutMs = options.timeoutMs ?? 1e3;
+	const sweepEveryMs = options.sweepEveryMs ?? 6e5;
+	const log = options.log;
+	const sql = postgres(databaseUrl, {
+		max: 4,
+		connection: { statement_timeout: timeoutMs },
+		onnotice: databaseNotices(log)
+	});
+	let answering = true;
+	let sweptAt = Date.now();
+	let sweeping = false;
+	let running = 0;
+	const waiting = [];
+	function done() {
+		running--;
+		waiting.shift()?.();
+	}
+	function count(key, windowMs) {
+		return new Promise((resolve, reject) => {
+			const send = () => {
+				running++;
+				sql`
+          INSERT INTO rate_limit_counters AS counter (key, hits, resets_at)
+          VALUES (${key}, 1, now() + ${windowMs}::double precision * interval '1 millisecond')
+          ON CONFLICT (key) DO UPDATE SET
+            hits = CASE WHEN counter.resets_at <= now() THEN 1 ELSE counter.hits + 1 END,
+            resets_at = CASE WHEN counter.resets_at <= now() THEN excluded.resets_at ELSE counter.resets_at END
+          RETURNING hits AS current, ceil(extract(epoch FROM resets_at - now()) * 1000)::integer AS ttl`.then(([row]) => {
+					clearTimeout(timer);
+					if (row === void 0) reject(/* @__PURE__ */ new Error("the count returned no row"));
+					else resolve(row);
+				}, (error) => {
+					clearTimeout(timer);
+					reject(error);
+				}).finally(done);
+			};
+			const timer = setTimeout(() => {
+				const queued = waiting.indexOf(send);
+				if (queued !== -1) waiting.splice(queued, 1);
+				reject(late());
+			}, timeoutMs);
+			if (running < 32) send();
+			else waiting.push(send);
+		});
+	}
+	/** On the back of a count, at most once per interval, one at a time, and never waited for. */
+	function sweep() {
+		const now = Date.now();
+		if (sweeping || running >= 32 || now - sweptAt < sweepEveryMs) return;
+		sweptAt = now;
+		sweeping = true;
+		running++;
+		sql.begin(async (tx) => {
+			await tx`SELECT set_config('statement_timeout', '0', true)`;
+			await tx`DELETE FROM rate_limit_counters WHERE resets_at <= now()`;
+		}).then(() => {}, (error) => log?.error({
+			event: "ratelimit.sweep.failed",
+			err: error
+		})).finally(() => {
+			sweeping = false;
+			done();
+		});
+	}
+	class PostgresRateLimitStore {
+		#route;
+		constructor(_options, route = "") {
+			this.#route = route;
+		}
+		incr(key, callback, timeWindow) {
+			count(`${this.#route}${key}`, timeWindow).then((result) => {
+				if (!answering) {
+					answering = true;
+					log?.error({ event: "ratelimit.answering" });
+				}
+				callback(null, result);
+			}, (error) => {
+				if (answering) {
+					answering = false;
+					log?.error({
+						event: "ratelimit.unanswered",
+						err: error
+					});
+				}
+				callback(uncounted());
+			});
+			sweep();
+		}
+		child(routeOptions) {
+			const { method, url } = routeOptions.routeInfo;
+			return new PostgresRateLimitStore(void 0, `${[method].flat().join(",")} ${url} `);
+		}
+	}
+	return {
+		store: PostgresRateLimitStore,
+		end: () => sql.end({ timeout: timeoutMs / 1e3 })
+	};
+}
+/** What a route that refuses without a count answers: a 503, and nothing about the database. */
+function uncounted() {
+	return Object.assign(/* @__PURE__ */ new Error("This request could not be counted against its limit, so it was not taken. Try again in a moment."), {
+		statusCode: 503,
+		code: "RATE_LIMIT_UNAVAILABLE"
+	});
+}
+/**
+* A count not answered within the bound. Its own code, because the log writes an error's kind
+* and code and nothing else: without one, a database too slow to count — a lock on the table, a
+* flood — reads the same as any other failure, and the operator cannot tell which to look for.
+*/
+function late() {
+	return Object.assign(/* @__PURE__ */ new Error("The count was not answered within its bound."), { code: "RATE_LIMIT_TIMEOUT" });
+}
+//#endregion
+//#region src/file-store.ts
+/**
+* Bytes under one directory, one file per key.
+*
+* **Keys are checked, not trusted.** A key is minted by the server from a form
+* id and a file id, so it cannot contain a traversal — but this resolves it
+* and refuses anything landing outside the root regardless. A path check that
+* only runs when the input is untrusted is a path check that stops running the
+* day somebody adds a caller.
+*/
+function createLocalFileStore(root) {
+	const base = resolve(root);
+	const pathFor = (key) => {
+		if (key.includes("\\")) throw new Error(`Refusing a storage key that could resolve outside the store: ${key}`);
+		const full = resolve(join(base, key));
+		if (full !== base && !full.startsWith(base + sep)) throw new Error(`Refusing a storage key that resolves outside the store: ${key}`);
+		return full;
+	};
+	return {
+		async put(key, bytes) {
+			const full = pathFor(key);
+			await mkdir(dirname(full), { recursive: true });
+			await writeFile(full, bytes);
+		},
+		async open(key) {
+			const full = pathFor(key);
+			try {
+				await stat(full);
+			} catch {
+				return;
+			}
+			return createReadStream(full);
+		},
+		async remove(key) {
+			await rm(pathFor(key), { force: true });
+		},
+		async sizeOf(key) {
+			try {
+				return (await stat(pathFor(key))).size;
+			} catch {
+				return;
+			}
+		}
+	};
+}
+/**
+* The checksum a receiver can compare against.
+*
+* Returned when the bytes are stored and never asked of the client: a checksum
+* the uploader computed is a checksum the uploader can lie about, so this one
+* is only useful for telling a *later* reader that the bytes have not changed.
+*/
+function sha256(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+//#endregion
+//#region src/file-collector.ts
+function startFileCollector(storage, store, options = {}) {
+	const interval = options.intervalMs ?? 9e5;
+	const log = workerLog(options.log);
+	const afterHours = options.afterHours ?? 24;
+	let stopped = false;
+	let running = false;
+	const tick = async () => {
+		if (running || stopped) return;
+		running = true;
+		try {
+			const abandoned = await collectAbandonedFiles(storage, /* @__PURE__ */ new Date(), afterHours);
+			if (abandoned.length === 0) return;
+			const removed = [];
+			for (const file of abandoned) {
+				await store.remove(file.storageKey);
+				removed.push(file.id);
+			}
+			await storage.deleteFiles(removed);
+		} catch (error) {
+			log.error({
+				event: "collector.failed",
+				err: error
+			});
+		} finally {
+			running = false;
+		}
+	};
+	const timer = setInterval(() => void tick(), interval);
+	timer.unref?.();
+	return { stop: () => {
+		stopped = true;
+		clearInterval(timer);
+	} };
+}
+//#endregion
+//#region src/model-settings.ts
+/**
+* Which model the environment names for the builders: none, or a provider, its key and
+* the model.
+*
+* A function of the environment rather than lines in `main.ts`, as `fileStoreSettings` is:
+* the rules are where a deployment goes wrong, and `main.ts` is a composition root no test
+* imports. Constructing the adapter stays in `main.ts`; this only says which
+* ([0165](../../../docs/decisions/0165-a-deployments-model-is-asked-through-its-server.md)).
+*/
+const MODEL_PROVIDERS = [
+	"anthropic",
+	"openai",
+	"xai"
+];
+/**
+* The variable each provider's SDK reads for headers of its own to add to every request.
+*
+* The adapters name the base URL, the organisation, the project, the credential and the log
+* level rather than leave them to the environment; these headers no option undoes. So a
+* server with a model refuses to start while the variable its provider's SDK reads is set.
+* xAI is asked through OpenAI's client, so it is OpenAI's variable.
+*/
+const SDK_HEADERS_VARIABLE = {
+	anthropic: "ANTHROPIC_CUSTOM_HEADERS",
+	openai: "OPENAI_CUSTOM_HEADERS",
+	xai: "OPENAI_CUSTOM_HEADERS"
+};
+/**
+* Absent — all three unset or blank — is a supported state, and the default: this
+* deployment has no model, the server says so to the admin, and no prompt pane is drawn.
+*
+* Throws on anything in between, so the server refuses to start rather than starting
+* without the model the operator thinks they configured: a key or a model with no
+* provider, a provider formancy has no adapter for, or a provider without its key or
+* its model. Throws too when the environment would add headers to every request the
+* provider's SDK sends. **No provider has a default model.** A model id goes stale when
+* the provider retires it, and then every turn fails as a model that could not be
+* reached, after an upgrade nobody made; and which model runs is what the operator pays
+* for. Neither is this file's to decide. The message never repeats a value, because the
+* key is one.
+*/
+function modelSettings(env) {
+	const provider = setting(env, "FORMANCY_MODEL_PROVIDER");
+	const apiKey = setting(env, "FORMANCY_MODEL_API_KEY");
+	const model = setting(env, "FORMANCY_MODEL");
+	if (provider === void 0) {
+		if (apiKey === void 0 && model === void 0) return { kind: "none" };
+		throw new Error("FORMANCY_MODEL_API_KEY or FORMANCY_MODEL is set without FORMANCY_MODEL_PROVIDER: name the provider (anthropic, openai or xai), or unset both to run without a model.");
+	}
+	if (!isProvider(provider)) throw new Error("FORMANCY_MODEL_PROVIDER must be anthropic, openai or xai.");
+	if (apiKey === void 0) throw new Error("FORMANCY_MODEL_API_KEY is required when FORMANCY_MODEL_PROVIDER is set.");
+	if (model === void 0) throw new Error("FORMANCY_MODEL is required when FORMANCY_MODEL_PROVIDER is set: name the model as the provider's documentation does. There is no default.");
+	const headers = SDK_HEADERS_VARIABLE[provider];
+	if (setting(env, headers) !== void 0) throw new Error(`${headers} is set, and the SDK formancy asks ${provider} through would send each line of it as a header with every form. Unset it to run with a model.`);
+	return {
+		kind: "configured",
+		provider,
+		apiKey,
+		model
+	};
+}
+function isProvider(value) {
+	return MODEL_PROVIDERS.includes(value);
+}
+/** A setting, with the empty string read as unset — compose blanks a variable, it cannot drop one. */
+function setting(env, name) {
+	const value = env[name];
+	return value === void 0 || value.trim() === "" ? void 0 : value;
+}
+//#endregion
+//#region src/anthropic-completer.ts
+/**
+* Where the request goes. Named rather than left to the SDK, which would otherwise take
+* `ANTHROPIC_BASE_URL` from the environment: the deployment view says which host a form is
+* sent to, and an ambient variable could change it without anybody reading this file.
+*/
+const ANTHROPIC_BASE_URL = "https://api.anthropic.com";
+/**
+* The most a turn may write, thinking included.
+*
+* Generous on purpose: an answer is a whole form document, and one cut off at the limit is
+* not an answer at all (`truncated`), so a limit too low wastes the turn it stopped.
+* Streamed, so a long answer is not cut off by the HTTP timeout either. It is the ceiling
+* on what one turn can cost — the operator pays per token written, not per token allowed.
+*/
+const ANTHROPIC_MAX_OUTPUT_TOKENS = 64e3;
+/** What a refused turn says when Anthropic gave no explanation. */
+const DECLINED = "The model service declined this request.";
+/**
+* Claude, through Anthropic's official SDK (0165).
+*
+* One system prompt and one user message, with adaptive thinking — the model decides how
+* much to think — streamed and read with the SDK's final-message helper. **The stop reason
+* is read before the content.** A refusal ends the person's run as a decline, with
+* Anthropic's explanation; an answer stopped at the output limit, or by the context
+* window, is `truncated` and never handed over as the first half of a document. Thinking
+* blocks are not part of the answer.
+*
+* Adaptive thinking needs a model that has it — Claude Opus 4.6, Sonnet 4.6 and later. A
+* model without it is refused by Anthropic with a 400, and every turn ends `unavailable`.
+*
+* The SDK retries what it calls temporary failures (a 429, a 5xx, a dropped connection)
+* twice, by its own default.
+*/
+function createAnthropicCompleter(options) {
+	const client = new Anthropic({
+		apiKey: options.apiKey,
+		authToken: null,
+		logLevel: "off",
+		baseURL: ANTHROPIC_BASE_URL,
+		...options.fetch === void 0 ? {} : { fetch: options.fetch }
+	});
+	return { async complete(prompt, cancellation) {
+		const controller = new AbortController();
+		cancellation.onCancel(() => controller.abort());
+		if (controller.signal.aborted) return {
+			ok: false,
+			failure: "cancelled"
+		};
+		let message;
+		try {
+			message = await client.messages.stream({
+				model: options.model,
+				max_tokens: ANTHROPIC_MAX_OUTPUT_TOKENS,
+				thinking: { type: "adaptive" },
+				system: prompt.system,
+				messages: [{
+					role: "user",
+					content: prompt.user
+				}]
+			}, { signal: controller.signal }).finalMessage();
+		} catch (error) {
+			if (controller.signal.aborted) return {
+				ok: false,
+				failure: "cancelled"
+			};
+			return unavailable$1(error);
+		}
+		return read$1(message);
+	} };
+}
+/** A finished message, by its stop reason first. */
+function read$1(message) {
+	switch (message.stop_reason) {
+		case "refusal": {
+			const explanation = message.stop_details?.explanation;
+			return {
+				ok: false,
+				failure: "refused",
+				reason: typeof explanation === "string" && explanation.trim() !== "" ? explanation : DECLINED
+			};
+		}
+		case "max_tokens":
+		case "model_context_window_exceeded": return {
+			ok: false,
+			failure: "truncated"
+		};
+		case "end_turn":
+		case "stop_sequence": return {
+			ok: true,
+			text: message.content.flatMap((block) => block.type === "text" ? [block.text] : []).join("")
+		};
+		default: return {
+			ok: false,
+			failure: "unavailable",
+			cause: `Anthropic stopped for ${String(message.stop_reason)}.`
+		};
+	}
+}
+/** An error from the SDK, as a failure: the status when Anthropic answered, the message for the log. */
+function unavailable$1(error) {
+	const status = error instanceof APIError && typeof error.status === "number" ? error.status : void 0;
+	const cause = error instanceof Error ? error.message : String(error);
+	return {
+		ok: false,
+		failure: "unavailable",
+		...status === void 0 ? {} : { status },
+		cause
+	};
+}
+//#endregion
+//#region src/openai-completer.ts
+/**
+* Where each provider's requests go. Named rather than left to the SDK, which would take
+* `OPENAI_BASE_URL` from the environment and send every form wherever it pointed.
+*/
+const OPENAI_BASE_URL = "https://api.openai.com/v1";
+/**
+* xAI's API, which xAI documents as compatible with OpenAI's SDKs and their Responses API at
+* this base URL. Taken from xAI's documentation as a web search summarised it on
+* 2026-10-10; the pages themselves refused the fetch, and no test here reaches xAI (0165).
+*/
+const XAI_BASE_URL = "https://api.x.ai/v1";
+/**
+* The most a turn may write, reasoning included — as generous as Anthropic's, and for the
+* same reason: an answer cut off at the limit is not an answer (`truncated`).
+*/
+const OPENAI_MAX_OUTPUT_TOKENS = 64e3;
+/** What a withheld answer says: the provider gives no words of its own for a filter. */
+const FILTERED = "The model service withheld its answer to this request.";
+/**
+* OpenAI's models, or xAI's Grok, through OpenAI's official SDK and the Responses API (0165).
+*
+* The briefing as a system message and the request as a user message, streamed and read
+* with the SDK's final-response helper. `store: false`, so the provider keeps no copy of
+* the form for later retrieval; what it keeps under its own terms is not this adapter's
+* to say. **The response's status is read before its text.** Incomplete at the output
+* limit is `truncated`, never half a document; withheld by the provider's filter, or a
+* refusal in the output, ends the person's run as a decline.
+*
+* The SDK would take an organisation and a project from the environment and send them as
+* headers — to xAI as well — so both are set to nothing here. It would take a log level
+* too, and with OPENAI_LOG=debug write a line for every request and response to the
+* console — a second request log, outside the rule the server's own is built by
+* (SAFETY-ANALYSIS C3) — so the level is set. OPENAI_CUSTOM_HEADERS cannot be undone here, so `modelSettings` refuses to start
+* with it.
+*/
+function createOpenAiCompleter(options) {
+	const client = new OpenAI({
+		apiKey: options.apiKey,
+		baseURL: options.baseURL,
+		organization: null,
+		project: null,
+		logLevel: "off",
+		...options.fetch === void 0 ? {} : { fetch: options.fetch }
+	});
+	return { async complete(prompt, cancellation) {
+		const controller = new AbortController();
+		cancellation.onCancel(() => controller.abort());
+		if (controller.signal.aborted) return {
+			ok: false,
+			failure: "cancelled"
+		};
+		let response;
+		try {
+			response = await client.responses.stream({
+				model: options.model,
+				input: [{
+					role: "system",
+					content: prompt.system
+				}, {
+					role: "user",
+					content: prompt.user
+				}],
+				max_output_tokens: OPENAI_MAX_OUTPUT_TOKENS,
+				store: false
+			}, { signal: controller.signal }).finalResponse();
+		} catch (error) {
+			if (controller.signal.aborted) return {
+				ok: false,
+				failure: "cancelled"
+			};
+			return unavailable(error);
+		}
+		return read(response);
+	} };
+}
+/** A finished response, by its status first. */
+function read(response) {
+	if (response.status === "incomplete") {
+		const reason = response.incomplete_details?.reason;
+		if (reason === "max_output_tokens") return {
+			ok: false,
+			failure: "truncated"
+		};
+		if (reason === "content_filter") return {
+			ok: false,
+			failure: "refused",
+			reason: FILTERED
+		};
+		return {
+			ok: false,
+			failure: "unavailable",
+			cause: `The response was incomplete: ${String(reason)}.`
+		};
+	}
+	if (response.status !== "completed") {
+		const said = response.error?.message;
+		return {
+			ok: false,
+			failure: "unavailable",
+			cause: `The response ended ${String(response.status)}${said === void 0 ? "" : `: ${said}`}.`
+		};
+	}
+	const parts = response.output.flatMap((item) => item.type === "message" ? item.content : []);
+	const refusal = parts.find((part) => part.type === "refusal");
+	if (refusal !== void 0) return {
+		ok: false,
+		failure: "refused",
+		reason: refusal.refusal.trim() === "" ? FILTERED : refusal.refusal
+	};
+	return {
+		ok: true,
+		text: parts.flatMap((part) => part.type === "output_text" ? [part.text] : []).join("")
+	};
+}
+/** An error from the SDK, as a failure: the status when the provider answered, the message for the log. */
+function unavailable(error) {
+	const status = error instanceof APIError$1 && typeof error.status === "number" ? error.status : void 0;
+	const cause = error instanceof Error ? error.message : String(error);
+	return {
+		ok: false,
+		failure: "unavailable",
+		...status === void 0 ? {} : { status },
+		cause
+	};
+}
+//#endregion
+//#region src/completers.ts
+/**
+* The adapter for the provider the operator named (0165): Anthropic through its own SDK,
+* OpenAI and xAI through OpenAI's, at each one's base URL.
+*
+* `fetch` is for the tests, which check where each provider's requests go.
+*/
+function createCompleter(settings, fetch) {
+	const { apiKey, model } = settings;
+	const transport = fetch === void 0 ? {} : { fetch };
+	switch (settings.provider) {
+		case "anthropic": return createAnthropicCompleter({
+			apiKey,
+			model,
+			...transport
+		});
+		case "openai": return createOpenAiCompleter({
+			apiKey,
+			model,
+			baseURL: OPENAI_BASE_URL,
+			...transport
+		});
+		case "xai": return createOpenAiCompleter({
+			apiKey,
+			model,
+			baseURL: XAI_BASE_URL,
+			...transport
+		});
+	}
+}
+//#endregion
+export { SUBMISSION_TOKEN_HEADER as _, createLocalFileStore as a, createPostgresStorage as c, LOG_LEVELS as d, createServerLog as f, SCHEMA_HASH_HEADER as g, maxFileBytesFrom as h, startFileCollector as i, bootstrapSchema as l, workerLog as m, MODEL_PROVIDERS as n, sha256 as o, databaseNotices as p, modelSettings as r, createPostgresRateLimitStore as s, createCompleter as t, createApp as u };
+
+//# sourceMappingURL=completers-DCFoZpo3.mjs.map