@formancy/server 0.3.0 → 0.5.0

package/dist/file-collector-LmfD8Y_d.mjs

@@ -1,1504 +0,0 @@
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, healthOf, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, replayDelivery, resolveForm, resumeDraft, saveDraft, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
-import Fastify from "fastify";
-import rateLimit from "@fastify/rate-limit";
-import { hash, verify } from "@node-rs/argon2";
-import { SignJWT, jwtVerify } from "jose";
-import { and, desc, eq, inArray, lt, lte, max, ne } from "drizzle-orm";
-import { drizzle } from "drizzle-orm/postgres-js";
-import { integer, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
-import { createReadStream } from "node:fs";
-import { mkdir, rm, stat, writeFile } from "node:fs/promises";
-import { dirname, join, resolve, sep } from "node:path";
-//#region src/headers.ts
-/**
-* The header a client declares what it was looking at with.
-*
-* One name, read by the submission route and by the publish plugin: a
-* submission says which version it rendered, and a publish says which version it
-* opened. Two spellings of one header is a bug nobody sees until a client sends
-* the other one.
-*/
-const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
-//#endregion
-//#region src/routes/publish.ts
-/**
-* Publishing a form, as a plugin of its own.
-*
-* One route family per plugin, which is Fastify's own unit and what `app.ts`'s
-* size budget named as the seam. It moved when the budget refused the next thing
-* added to it rather than letting the number drift.
-*/
-async function publishRoutes(app, { deps, requires }) {
-	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.path !== "string" || body.path === "" || body.schema === void 0) return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { path, schema }."
-		});
-		const basedOn = request.headers[SCHEMA_HASH_HEADER];
-		const outcome = await publishForm(deps, {
-			path: body.path,
-			schema: body.schema,
-			actor: request.actor,
-			...typeof basedOn === "string" && basedOn !== "" ? { basedOnSchemaHash: basedOn } : {}
-		});
-		if (!outcome.ok) switch (outcome.kind) {
-			case "invalid_schema": return reply.code(422).send({
-				error: outcome.kind,
-				errors: outcome.errors
-			});
-			case "unsafe_pattern": return reply.code(422).send({
-				error: outcome.kind,
-				patterns: outcome.patterns
-			});
-			case "invalid_logic": return reply.code(422).send({
-				error: outcome.kind,
-				message: outcome.message
-			});
-			case "unknown_options_source": return reply.code(422).send({
-				error: outcome.kind,
-				sources: outcome.sources
-			});
-			case "already_published": return reply.code(409).send({
-				error: outcome.kind,
-				version: outcome.version
-			});
-			case "version_changed": return reply.code(409).send({
-				error: "FORM_VERSION_CHANGED",
-				current: outcome.current === void 0 ? void 0 : {
-					version: outcome.current.version,
-					schemaHash: outcome.current.schemaHash,
-					schema: outcome.current.schema
-				}
-			});
-		}
-		return reply.code(201).send({
-			version: outcome.version,
-			schemaHash: outcome.schemaHash,
-			...outcome.warnings.length > 0 ? { warnings: outcome.warnings } : {}
-		});
-	});
-}
-//#endregion
-//#region src/auth-runtime.ts
-/**
-* The real cryptography, confined to the composition root: argon2id for
-* secrets at rest, an HMAC-signed short-lived access token for sessions, and
-* a CSPRNG for API keys. server-core never sees any of this — it is handed
-* hash/verify/random functions and stays deterministic under test.
-*
-* HS256 rather than EdDSA for the session token, deliberately for this phase:
-* one secret in one env var is the self-hosting story a single-container
-* deployment can operate, and the signing scheme is an implementation detail
-* of a token that lives fifteen minutes. Revisit with key rotation.
-*/
-function realSecretHashing() {
-	return {
-		hashSecret: (secret) => hash(secret),
-		verifySecret: async (secret, digest) => {
-			try {
-				return await verify(digest, secret);
-			} catch {
-				return false;
-			}
-		}
-	};
-}
-function realRandomToken() {
-	return randomBytes(30).toString("base64url");
-}
-const TOKEN_LIFETIME = "15m";
-function createSessionTokens(secret) {
-	if (secret.length < 32) throw new Error("FORMANCY_AUTH_SECRET must be at least 32 characters. Generate one: openssl rand -base64 33");
-	const key = new TextEncoder().encode(secret);
-	return {
-		async issue(actor) {
-			return new SignJWT({
-				role: actor.role,
-				kind: actor.kind
-			}).setProtectedHeader({ alg: "HS256" }).setSubject(actor.id).setIssuedAt().setExpirationTime(TOKEN_LIFETIME).sign(key);
-		},
-		async verify(token) {
-			try {
-				const { payload } = await jwtVerify(token, key, { algorithms: ["HS256"] });
-				const role = payload["role"];
-				const kind = payload["kind"];
-				if (typeof payload.sub !== "string" || role !== "admin" && role !== "editor" && role !== "viewer" || kind !== "user" && kind !== "apiKey") return;
-				return {
-					id: payload.sub,
-					role,
-					kind
-				};
-			} catch {
-				return;
-			}
-		}
-	};
-}
-//#endregion
-//#region src/app.ts
-/** Base64 JSON, the shape an ALTCHA client already produces. */
-const CHALLENGE_HEADER = "x-formancy-challenge";
-/** Proves the bearer started this draft. Lower-case: Fastify normalises. */
-const DRAFT_TOKEN_HEADER = "x-formancy-draft-token";
-const API_KEY_HEADER = "x-formancy-api-key";
-/**
-* The HTTP surface, split into two planes.
-*
-* PUBLIC — what a person filling a form needs: resolve, submit, drafts. These
-* stay unauthenticated by design; anonymous-submission hardening is its own
-* upcoming step and is opt-in per form.
-*
-* MANAGEMENT — everything an operator does: publish, catalog, submissions,
-* export, users, keys. Authenticated via a session token (login) or an API
-* key header, authorized through server-core's one-table can().
-*
-* This file is the composition root, so THIS is where ambient reality enters:
-* randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays
-* injected and replayable.
-*/
-async function createApp(storage, options) {
-	const app = Fastify({
-		logger: false,
-		bodyLimit: options.bodyLimitBytes ?? 262144
-	});
-	const maxFileBytes = options.maxFileBytes ?? 10485760;
-	const fileStore = options.fileStore;
-	app.addContentTypeParser("*", {
-		parseAs: "buffer",
-		bodyLimit: maxFileBytes
-	}, (_request, body, done) => {
-		done(null, body);
-	});
-	const submissionLimit = options.submissionRateLimit ?? {
-		max: 30,
-		timeWindowMs: 6e4
-	};
-	const loginLimit = options.loginRateLimit ?? {
-		max: 10,
-		timeWindowMs: 6e4
-	};
-	const challengeSecret = options.challengeSecret;
-	await app.register(rateLimit, {
-		global: false,
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	});
-	const deps = {
-		storage,
-		newId: () => randomUUID(),
-		nowIso: () => (/* @__PURE__ */ new Date()).toISOString(),
-		draftSecret: options.authSecret,
-		...options.optionsSources === void 0 ? {} : { optionsSources: options.optionsSources },
-		capabilities: {
-			now: () => Date.now(),
-			today: () => (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
-			random: () => Math.random()
-		}
-	};
-	const authDeps = {
-		storage,
-		newId: deps.newId,
-		nowIso: deps.nowIso,
-		randomToken: realRandomToken,
-		...realSecretHashing()
-	};
-	const sessions = createSessionTokens(options.authSecret);
-	if (options.bootstrapAdmin !== void 0) {
-		if (await storage.getUserByEmail(options.bootstrapAdmin.email) === void 0) {
-			const outcome = await createLocalUser(authDeps, {
-				...options.bootstrapAdmin,
-				role: "admin"
-			});
-			if (!outcome.ok) throw new Error(`Bootstrap admin rejected: ${outcome.message}`);
-		}
-	}
-	async function actorOf(request) {
-		const bearer = request.headers.authorization;
-		if (typeof bearer === "string" && bearer.startsWith("Bearer ")) return sessions.verify(bearer.slice(7));
-		const apiKey = request.headers[API_KEY_HEADER];
-		if (typeof apiKey === "string" && apiKey !== "") {
-			const outcome = await authenticateApiKey(authDeps, apiKey);
-			return outcome.ok ? outcome.actor : void 0;
-		}
-	}
-	/** 401 without an identity, 403 with one that lacks the permission — the
-	*  difference tells a client whether to log in or to give up. */
-	function requires(action) {
-		return async (request, reply) => {
-			const actor = await actorOf(request);
-			if (actor === void 0) return reply.code(401).send({ error: "unauthenticated" });
-			if (!can(actor, action)) return reply.code(403).send({
-				error: "forbidden",
-				action
-			});
-			request.actor = actor;
-		};
-	}
-	/**
-	* Append an audit row for something that has already happened.
-	*
-	* Never throws. An export that succeeded and an audit row that did not is
-	* bad; an export that 500s because the audit row failed, after the rows have
-	* already been written to the response, is worse and helps nobody. So the
-	* failure is logged loudly at error level and the request stands.
-	*
-	* For a mutation that HAS a transaction, do not use this — pass the entry
-	* into that call so the two commit together. `insertSubmission` is currently
-	* the only one.
-	*/
-	async function audit(request, draft) {
-		const actor = request.actor;
-		try {
-			await deps.storage.recordAudit({
-				id: deps.newId(),
-				at: deps.nowIso(),
-				requestId: request.id,
-				...auditedBy(actor, draft)
-			});
-		} catch (error) {
-			request.log.error({
-				err: error,
-				action: draft.action
-			}, "audit row could not be written");
-		}
-	}
-	app.post("/auth/login", { config: { rateLimit: {
-		max: loginLimit.max,
-		timeWindow: loginLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.email !== "string" || typeof body.password !== "string") return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { email, password }."
-		});
-		const outcome = await authenticateLocal(authDeps, {
-			email: body.email,
-			password: body.password
-		});
-		if (!outcome.ok) {
-			await audit(request, {
-				action: "auth.login.failed",
-				subject: body.email
-			});
-			return reply.code(401).send({ error: "invalid_credentials" });
-		}
-		await audit(request, {
-			action: "auth.login",
-			subject: body.email,
-			actorKind: "user",
-			actorId: outcome.actor.id
-		});
-		return reply.send({
-			token: await sessions.issue(outcome.actor),
-			role: outcome.actor.role
-		});
-	});
-	app.post("/users", { preHandler: requires("user.create") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.email !== "string" || typeof body.password !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { email, password, role }."
-		});
-		const outcome = await createLocalUser(authDeps, {
-			email: body.email,
-			password: body.password,
-			role: body.role
-		});
-		if (!outcome.ok) return reply.code(422).send({
-			error: "rejected",
-			message: outcome.message
-		});
-		return reply.code(201).send({ id: outcome.id });
-	});
-	app.post("/api-keys", { preHandler: requires("apiKey.create") }, async (request, reply) => {
-		const body = request.body;
-		if (body === null || typeof body.name !== "string" || body.role !== "admin" && body.role !== "editor" && body.role !== "viewer") return reply.code(400).send({
-			error: "bad_request",
-			message: "Body needs { name, role }."
-		});
-		const outcome = await createApiKey(authDeps, {
-			name: body.name,
-			role: body.role
-		});
-		if (!outcome.ok) return reply.code(422).send({
-			error: "rejected",
-			message: outcome.message
-		});
-		return reply.code(201).send({
-			id: outcome.id,
-			secret: outcome.secret
-		});
-	});
-	await app.register(publishRoutes, {
-		deps,
-		requires
-	});
-	app.put("/f/:path/access", { preHandler: requires("form.publish") }, async (request, reply) => {
-		const { path } = request.params;
-		const body = request.body;
-		const submit = body?.submit;
-		if (submit !== "authenticated" && submit !== "public") return reply.code(400).send({
-			error: "invalid_access",
-			message: "submit must be \"authenticated\" or \"public\"."
-		});
-		const origins = body?.allowedOrigins;
-		if (origins !== void 0 && !(Array.isArray(origins) && origins.every((o) => typeof o === "string"))) return reply.code(400).send({
-			error: "invalid_access",
-			message: "allowedOrigins must be an array of strings, or absent for no allowlist."
-		});
-		if (!(await setFormAccess(deps, {
-			path,
-			submit,
-			...origins === void 0 ? {} : { allowedOrigins: origins }
-		})).ok) return reply.code(404).send({ error: "unknown_form" });
-		await audit(request, {
-			action: "form.access.changed",
-			subject: path,
-			detail: {
-				submit,
-				allowedOrigins: origins === void 0 ? "unchanged" : origins.join(" ")
-			}
-		});
-		return reply.code(204).send();
-	});
-	/**
-	* The log itself.
-	*
-	* Admin only, and reading it is NOT audited. A log that records its own
-	* reads grows without bound from a dashboard that polls it, and the entry
-	* would say nothing an access log does not — the events worth recording
-	* are the ones that touch somebody else's data.
-	*/
-	app.get("/audit", { preHandler: requires("user.create") }, async (request, reply) => {
-		const raw = request.query?.limit;
-		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 100;
-		const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 500) : 100;
-		return reply.send({ entries: await deps.storage.listAudit(limit) });
-	});
-	/**
-	* Webhook health, and the deliveries that died.
-	*
-	* The reason the breaker keeps its counters on the row rather than in the
-	* worker's memory. A self-hoster has no operations team watching a
-	* dashboard, so a destination refusing deliveries since Tuesday has to be
-	* answerable from the product — otherwise it is found when somebody asks
-	* why the CRM has no leads this week.
-	*/
-	app.get("/webhooks", { preHandler: requires("form.publish") }, async (_request, reply) => {
-		const now = new Date(deps.nowIso());
-		const hooks = await deps.storage.listWebhooks();
-		return reply.send({ webhooks: hooks.map((hook) => healthOf(hook, now)) });
-	});
-	app.get("/deliveries/dead", { preHandler: requires("form.publish") }, async (request, reply) => {
-		const raw = request.query?.limit;
-		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 50;
-		const limit = Number.isFinite(asked) ? Math.min(Math.max(asked, 1), 200) : 50;
-		const dead = await deps.storage.deadDeliveries(limit);
-		return reply.send({ deliveries: dead.map((delivery) => ({
-			id: delivery.id,
-			webhookId: delivery.webhookId,
-			submissionId: delivery.submissionId,
-			eventId: delivery.eventId,
-			attempt: delivery.attempt,
-			lastError: delivery.lastError
-		})) });
-	});
-	app.post("/deliveries/:id/replay", { preHandler: requires("form.publish") }, async (request, reply) => {
-		const { id } = request.params;
-		const outcome = await replayDelivery({
-			storage: deps.storage,
-			now: () => new Date(deps.nowIso())
-		}, id);
-		if (!outcome.ok) return outcome.kind === "unknown" ? reply.code(404).send({ error: "unknown_delivery" }) : reply.code(409).send({
-			error: "not_dead",
-			state: outcome.state,
-			message: "Only a dead delivery can be replayed. A pending one is already queued, and a delivered one would be sent twice."
-		});
-		await audit(request, {
-			action: "delivery.replayed",
-			subject: id,
-			detail: { webhookId: outcome.delivery.webhookId }
-		});
-		return reply.code(202).send({
-			id,
-			state: outcome.delivery.state
-		});
-	});
-	/**
-	* A puzzle for an anonymous visitor to solve before submitting.
-	*
-	* Public because the form is: requiring a session to obtain a challenge for
-	* an unauthenticated submission would be a circle. It is cheap to mint and
-	* stateless, so handing one out costs this server a hash.
-	*/
-	app.get("/f/:path/challenge", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		if (challengeSecret === void 0) return reply.code(404).send({ error: "challenge_not_enabled" });
-		const { path } = request.params;
-		if (await deps.storage.getFormByPath(path) === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send(await mintChallenge({
-			secret: challengeSecret,
-			nowSeconds: Math.floor(new Date(deps.nowIso()).getTime() / 1e3)
-		}));
-	});
-	/**
-	* Check a submitted solution, and spend it.
-	*
-	* Returns the refusal to send, or undefined when it passed. The spend is
-	* separate from the verification and comes last: the stateless checks say
-	* the solution is correct, and only the database can say it has not been
-	* used — a correct solution stays correct, so without this one puzzle
-	* would buy a thousand submissions.
-	*/
-	async function checkChallenge(request) {
-		const header = request.headers[CHALLENGE_HEADER];
-		if (typeof header !== "string" || header === "") return {
-			error: "challenge_required",
-			message: `This form needs a solved challenge. Ask GET /f/:path/challenge for one and return it in ${CHALLENGE_HEADER}.`
-		};
-		const solution = decodeSolution(header);
-		if (solution === void 0) return {
-			error: "challenge_malformed",
-			message: "The challenge header is not base64 JSON."
-		};
-		const nowSeconds = Math.floor(new Date(deps.nowIso()).getTime() / 1e3);
-		const verified = await verifySolution(challengeSecret, solution, nowSeconds);
-		if (!verified.ok) return {
-			error: `challenge_${verified.reason}`,
-			message: "The challenge was not solved. Ask for a new one and try again."
-		};
-		if (!await deps.storage.spendChallenge(verified.challenge, (/* @__PURE__ */ new Date(verified.expiresAtSeconds * 1e3)).toISOString())) return {
-			error: "challenge_spent",
-			message: "That challenge has already been used. Each one is good for one submission."
-		};
-	}
-	app.get("/forms", { preHandler: requires("form.read") }, async (_request, reply) => {
-		return reply.send({ forms: await listForms(deps) });
-	});
-	app.get("/f/:path/versions", { preHandler: requires("form.read") }, async (request, reply) => {
-		const { path } = request.params;
-		const versions = await listVersions(deps, path);
-		if (versions === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send({ versions });
-	});
-	app.get("/f/:path/submissions", { preHandler: requires("submission.read") }, async (request, reply) => {
-		const { path } = request.params;
-		const listed = await listSubmissions(deps, path);
-		if (listed === void 0) return reply.code(404).send({ error: "unknown_form" });
-		await audit(request, {
-			action: "submission.read",
-			subject: path,
-			detail: { count: listed.length }
-		});
-		return reply.send({ submissions: listed });
-	});
-	app.get("/f/:path/submissions/export.csv", { preHandler: requires("submission.export") }, async (request, reply) => {
-		const { path } = request.params;
-		const csv = await exportCsv(deps, path);
-		if (csv === void 0) return reply.code(404).send({ error: "unknown_form" });
-		await audit(request, {
-			action: "submission.exported",
-			subject: path,
-			detail: { bytes: Buffer.byteLength(csv, "utf8") }
-		});
-		return reply.header("content-type", "text/csv; charset=utf-8").header("content-disposition", `attachment; filename="${path}-submissions.csv"`).send(csv);
-	});
-	/**
-	* Fetch a published form. The one public route deliberately NOT rate-limited.
-	*
-	* Every other unauthenticated route is: submitting, starting a draft, writing
-	* one, reading one, minting a challenge, asking for an upload target. Those are
-	* writes, or guesses, or work somebody can demand of the server. This is the
-	* read every visitor has to make before they can do anything at all.
-	*
-	* Limiting it by IP would refuse the form to real people sharing an address —
-	* an office, a school, a phone network behind CGNAT — and the failure would
-	* look like the form being broken rather than like a limit. That is a worse
-	* outcome than the cheap read it would prevent, and the read is cached by
-	* `schemaHash` anyway.
-	*
-	* Written down because the asymmetry is deliberate and looks like an omission.
-	*/
-	app.get("/f/:path", async (request, reply) => {
-		const { path } = request.params;
-		const resolved = await resolveForm(deps, path);
-		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.send({
-			version: resolved.version,
-			schemaHash: resolved.schemaHash,
-			schema: resolved.schema
-		});
-	});
-	/**
-	* Start a draft, and get the only key to it.
-	*
-	* The public plane is anonymous, so a draft has no account behind it. It was
-	* previously addressed by an id the CALLER chose, with no check on either
-	* route: anybody who knew or guessed an id could read a stranger's part-filled
-	* form, and overwrite it — after which that person submits the substituted
-	* content under their own name and nothing says otherwise
-	* ([0062](../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).
-	*
-	* So the server picks the id and signs it, and the token comes back exactly
-	* once. Losing it means losing the draft, which is the correct trade for the
-	* alternative.
-	*/
-	app.post("/f/:path/drafts", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		const { path } = request.params;
-		const started = await startDraft(deps, { path });
-		if (started === void 0) return reply.code(404).send({ error: "unknown_form" });
-		return reply.code(201).send(started);
-	});
-	app.put("/f/:path/drafts/:draftId", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		const { path, draftId } = request.params;
-		const token = request.headers[DRAFT_TOKEN_HEADER];
-		if (typeof token !== "string") return reply.code(401).send({ error: "draft_token_required" });
-		const saved = await saveDraft(deps, {
-			path,
-			draftId,
-			token,
-			data: request.body ?? {}
-		});
-		if (saved === void 0) return reply.code(404).send({ error: "unknown_form" });
-		if (!saved.saved) return reply.code(403).send({ error: "draft_token_invalid" });
-		return reply.send({ version: saved.version });
-	});
-	app.get("/f/:path/drafts/:draftId", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		const { path, draftId } = request.params;
-		const token = request.headers[DRAFT_TOKEN_HEADER];
-		if (typeof token !== "string") return reply.code(401).send({ error: "draft_token_required" });
-		const resumed = await resumeDraft(deps, {
-			path,
-			draftId,
-			token
-		});
-		if (resumed === void 0) return reply.code(404).send({ error: "unknown_draft" });
-		return reply.send(resumed);
-	});
-	/**
-	* Ask where to put a file.
-	*
-	* Refusing here, before a byte is sent, is the difference between rejecting
-	* a 2 GB upload and receiving one first. The reply carries the id the
-	* submission will reference and the URL to PUT the bytes to.
-	*/
-	app.post("/f/:path/files", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		if (fileStore === void 0) return reply.code(501).send({
-			error: "uploads_unavailable",
-			message: "This deployment has no file store configured, so it cannot accept uploads."
-		});
-		const { path } = request.params;
-		const resolved = await resolveForm(deps, path);
-		if (resolved === void 0) return reply.code(404).send({ error: "unknown_form" });
-		const form = await storage.getFormByPath(path);
-		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
-		const actor = await actorOf(request);
-		const origin = request.headers.origin;
-		const body = request.body ?? {};
-		const field = typeof body.field === "string" ? body.field : void 0;
-		const name = typeof body.name === "string" ? body.name : void 0;
-		const size = typeof body.size === "number" ? body.size : void 0;
-		const contentType = typeof body.contentType === "string" ? body.contentType : "application/octet-stream";
-		if (field === void 0 || name === void 0 || size === void 0) return reply.code(400).send({
-			error: "invalid_request",
-			message: "Send the field, the name and the size of the file you want to upload."
-		});
-		if (size > maxFileBytes) return reply.code(413).send({
-			error: "too_large",
-			message: `This deployment accepts files up to ${String(maxFileBytes)} bytes.`
-		});
-		const outcome = await offerUpload({
-			storage,
-			now: () => /* @__PURE__ */ new Date(),
-			newId: () => randomUUID()
-		}, {
-			schema: resolved.schema,
-			form,
-			actor: actor === void 0 ? "anonymous" : "authenticated",
-			origin: typeof origin === "string" ? origin : void 0,
-			field,
-			name,
-			size,
-			contentType
-		});
-		if (!outcome.ok) {
-			const status = outcome.reason === "not_allowed" ? 403 : outcome.reason === "too_large" ? 413 : 400;
-			return reply.code(status).send({ error: outcome.reason });
-		}
-		return reply.code(201).send({
-			id: outcome.file.id,
-			name: outcome.file.name,
-			size: outcome.file.size,
-			contentType: outcome.file.contentType,
-			storageKey: outcome.file.storageKey,
-			uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`
-		});
-	});
-	/** Receive the bytes for a file that was offered. */
-	app.put("/f/:path/files/:id", async (request, reply) => {
-		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
-		const { path, id } = request.params;
-		const form = await storage.getFormByPath(path);
-		if (form === void 0) return reply.code(404).send({ error: "unknown_form" });
-		const file = await storage.getFile(id);
-		if (file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
-		if (file.state !== "offered") return reply.code(409).send({ error: "already_uploaded" });
-		const bytes = request.body;
-		if (!Buffer.isBuffer(bytes)) return reply.code(400).send({ error: "no_body" });
-		if (bytes.byteLength > maxFileBytes) return reply.code(413).send({ error: "too_large" });
-		if (bytes.byteLength !== file.size) return reply.code(400).send({
-			error: "size_mismatch",
-			message: `This upload was offered as ${String(file.size)} bytes and ${String(bytes.byteLength)} arrived.`
-		});
-		await fileStore.put(file.storageKey, bytes);
-		await storage.updateFile({
-			...file,
-			state: "stored"
-		});
-		return reply.code(204).send();
-	});
-	/**
-	* Serve a file back.
-	*
-	* Always as an attachment, never inline, and `nosniff` alongside it. Stored
-	* cross-site scripting through an uploaded HTML or SVG file is the most
-	* commonly exploited vulnerability in this product category, and the real
-	* answer is a separate hostname — which a single-container deployment does
-	* not have. Forcing a download is the accommodation, and it is the one place
-	* this deployment model genuinely costs something.
-	*/
-	app.get("/f/:path/files/:id", async (request, reply) => {
-		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
-		const { path, id } = request.params;
-		if (await actorOf(request) === void 0) return reply.code(401).send({ error: "unauthenticated" });
-		const form = await storage.getFormByPath(path);
-		const file = await storage.getFile(id);
-		if (form === void 0 || file === void 0 || file.formId !== form.id) return reply.code(404).send({ error: "unknown_file" });
-		const stream = await fileStore.open(file.storageKey);
-		if (stream === void 0) return reply.code(404).send({ error: "unknown_file" });
-		return reply.header("content-type", "application/octet-stream").header("x-content-type-options", "nosniff").header("content-security-policy", "default-src 'none'; sandbox").header("content-disposition", `attachment; filename="${file.name.replace(/["\r\n]/g, "")}"`).send(stream);
-	});
-	app.post("/f/:path/submissions", { config: { rateLimit: {
-		max: submissionLimit.max,
-		timeWindow: submissionLimit.timeWindowMs
-	} } }, async (request, reply) => {
-		const { path } = request.params;
-		const declaredSchemaHash = request.headers[SCHEMA_HASH_HEADER];
-		if (typeof declaredSchemaHash !== "string" || declaredSchemaHash === "") return reply.code(400).send({
-			error: "missing_schema_hash",
-			message: `Send the schema hash you rendered in the ${SCHEMA_HASH_HEADER} header.`
-		});
-		const actor = await actorOf(request);
-		const origin = request.headers.origin;
-		if (challengeSecret !== void 0 && actor === void 0) {
-			const refusal = await checkChallenge(request);
-			if (refusal !== void 0) return reply.code(400).send(refusal);
-		}
-		const outcome = await createSubmission(deps, {
-			path,
-			declaredSchemaHash,
-			data: request.body ?? {},
-			actor: actor === void 0 ? "anonymous" : "authenticated",
-			...typeof origin === "string" ? { origin } : {}
-		});
-		if (outcome.ok) return reply.code(201).send({
-			id: outcome.id,
-			data: outcome.canonicalData
-		});
-		switch (outcome.kind) {
-			case "unknown_form": return reply.code(404).send({ error: "unknown_form" });
-			case "version_changed": return reply.code(409).send({
-				error: "FORM_VERSION_CHANGED",
-				current: outcome.current === void 0 ? void 0 : {
-					version: outcome.current.version,
-					schemaHash: outcome.current.schemaHash,
-					schema: outcome.current.schema
-				}
-			});
-			case "invalid": return reply.code(422).send({
-				error: "invalid",
-				errors: outcome.errors
-			});
-			case "forbidden": return reply.code(403).send({ error: "forbidden" });
-			case "source_unavailable": return reply.code(503).send({
-				error: "source_unavailable",
-				source: outcome.source
-			});
-		}
-	});
-	return app;
-}
-//#endregion
-//#region src/db.ts
-/**
-* The thin slice's tables. Three rules from the design spec are enforced HERE,
-* in the database, because application code can be bypassed and these must not
-* be:
-*
-*  - published versions are immutable (a trigger refuses UPDATE),
-*  - a submission binds to its exact version by real foreign key,
-*  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema
-*    that produced it is structurally impossible.
-*/
-const forms = pgTable("forms", {
-	id: uuid("id").primaryKey(),
-	path: text("path").notNull().unique(),
-	currentVersionId: uuid("current_version_id"),
-	accessSubmit: text("access_submit").notNull().default("authenticated"),
-	allowedOrigins: text("allowed_origins").array(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-});
-const formVersions = pgTable("form_versions", {
-	id: uuid("id").primaryKey(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	version: integer("version").notNull(),
-	schema: jsonb("schema").notNull(),
-	schemaHash: text("schema_hash").notNull(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
-});
-const users = pgTable("users", {
-	id: uuid("id").primaryKey(),
-	email: text("email").notNull().unique(),
-	passwordHash: text("password_hash").notNull(),
-	role: text("role").notNull(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull()
-});
-const apiKeys = pgTable("api_keys", {
-	id: uuid("id").primaryKey(),
-	name: text("name").notNull(),
-	prefix: text("prefix").notNull(),
-	secretHash: text("secret_hash").notNull(),
-	role: text("role").notNull(),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
-	revokedAt: timestamp("revoked_at", { withTimezone: true })
-});
-const drafts = pgTable("drafts", {
-	id: text("id").notNull(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id),
-	data: jsonb("data").notNull(),
-	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
-});
-const webhooks = pgTable("webhooks", {
-	id: uuid("id").primaryKey(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	url: text("url").notNull(),
-	secret: text("secret").notNull(),
-	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
-	openedAt: timestamp("opened_at", { withTimezone: true })
-});
-/**
-* The outbox. A row here and the submission that caused it are written by the
-* same transaction, which is what makes "accepted" and "will be delivered" one
-* decision rather than two.
-*/
-const deliveries = pgTable("deliveries", {
-	id: uuid("id").primaryKey(),
-	webhookId: uuid("webhook_id").notNull(),
-	submissionId: uuid("submission_id").notNull(),
-	eventId: uuid("event_id").notNull(),
-	body: text("body").notNull(),
-	attempt: integer("attempt").notNull().default(0),
-	nextAttemptAt: timestamp("next_attempt_at", { withTimezone: true }).notNull(),
-	state: text("state").notNull().default("pending"),
-	lastError: text("last_error")
-});
-const spentChallenges = pgTable("spent_challenges", {
-	challenge: text("challenge").primaryKey(),
-	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
-});
-const auditLog = pgTable("audit_log", {
-	id: uuid("id").primaryKey(),
-	at: timestamp("at", { withTimezone: true }).notNull(),
-	action: text("action").notNull(),
-	actorKind: text("actor_kind"),
-	actorId: text("actor_id"),
-	subject: text("subject"),
-	requestId: text("request_id"),
-	detail: jsonb("detail")
-});
-const files = pgTable("files", {
-	id: uuid("id").primaryKey(),
-	formId: uuid("form_id").notNull(),
-	name: text("name").notNull(),
-	size: integer("size").notNull(),
-	contentType: text("content_type").notNull(),
-	storageKey: text("storage_key").notNull(),
-	state: text("state").notNull().default("offered"),
-	createdAt: timestamp("created_at", { withTimezone: true }).notNull(),
-	submissionId: uuid("submission_id")
-});
-const submissions = pgTable("submissions", {
-	id: uuid("id").primaryKey(),
-	formId: uuid("form_id").notNull().references(() => forms.id),
-	formVersionId: uuid("form_version_id").notNull().references(() => formVersions.id, { onDelete: "restrict" }),
-	data: jsonb("data").notNull(),
-	submittedAt: timestamp("submitted_at", { withTimezone: true }).notNull()
-});
-/**
-* Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the
-* lifecycle work; a self-hosted skeleton that creates its own tables on first
-* start is worth more right now than a migration pipeline.
-*/
-async function bootstrapSchema(sql) {
-	await sql`
-    CREATE TABLE IF NOT EXISTS forms (
-      id uuid PRIMARY KEY,
-      path text NOT NULL UNIQUE,
-      current_version_id uuid,
-      -- Private by default in the DATABASE, not only in the code, so a row
-      -- inserted by a migration or a fixture is not accidentally open.
-      access_submit text NOT NULL DEFAULT 'authenticated'
-        CHECK (access_submit IN ('authenticated', 'public')),
-      -- NULL: no allowlist in force. Empty array: nothing allowed. Different
-      -- things, which is why this is nullable rather than defaulting to '{}'.
-      allowed_origins text[],
-      created_at timestamptz NOT NULL DEFAULT now()
-    )`;
-	await sql`
-    ALTER TABLE forms
-      ADD COLUMN IF NOT EXISTS access_submit text NOT NULL DEFAULT 'authenticated'`;
-	await sql`ALTER TABLE forms ADD COLUMN IF NOT EXISTS allowed_origins text[]`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS form_versions (
-      id uuid PRIMARY KEY,
-      form_id uuid NOT NULL REFERENCES forms(id),
-      version integer NOT NULL,
-      schema jsonb NOT NULL,
-      schema_hash text NOT NULL,
-      created_at timestamptz NOT NULL DEFAULT now(),
-      UNIQUE (form_id, version),
-      UNIQUE (form_id, schema_hash)
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS submissions (
-      id uuid PRIMARY KEY,
-      form_id uuid NOT NULL REFERENCES forms(id),
-      form_version_id uuid NOT NULL REFERENCES form_versions(id) ON DELETE RESTRICT,
-      data jsonb NOT NULL,
-      submitted_at timestamptz NOT NULL
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS webhooks (
-      id uuid PRIMARY KEY,
-      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE CASCADE,
-      url text NOT NULL,
-      secret text NOT NULL
-    )`;
-	await sql`
-    ALTER TABLE webhooks
-      ADD COLUMN IF NOT EXISTS consecutive_failures integer NOT NULL DEFAULT 0,
-      -- When the breaker opened, null while the destination is answering. On
-      -- the row rather than in the worker's memory: memory does not survive a
-      -- restart, and a self-hoster with no operations team needs a failing
-      -- webhook to be visible on a screen rather than in a log nobody tails.
-      ADD COLUMN IF NOT EXISTS opened_at timestamptz`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS deliveries (
-      id uuid PRIMARY KEY,
-      webhook_id uuid NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
-      -- RESTRICT, not CASCADE: a delivery is the record that something was
-      -- sent about this submission, and deleting the submission must not
-      -- quietly erase it.
-      submission_id uuid NOT NULL REFERENCES submissions(id) ON DELETE RESTRICT,
-      event_id uuid NOT NULL,
-      body text NOT NULL,
-      attempt integer NOT NULL DEFAULT 0,
-      next_attempt_at timestamptz NOT NULL,
-      state text NOT NULL DEFAULT 'pending'
-        CHECK (state IN ('pending', 'delivered', 'dead')),
-      last_error text
-    )`;
-	await sql`
-    CREATE INDEX IF NOT EXISTS deliveries_due
-      ON deliveries (next_attempt_at) WHERE state = 'pending'`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS files (
-      id uuid PRIMARY KEY,
-      form_id uuid NOT NULL REFERENCES forms(id) ON DELETE RESTRICT,
-      -- What the reader called it. Display only: the storage key is minted by
-      -- the server, because a key built from a submitted filename is a path
-      -- traversal waiting for somebody to try it.
-      name text NOT NULL,
-      size integer NOT NULL,
-      content_type text NOT NULL,
-      storage_key text NOT NULL,
-      state text NOT NULL DEFAULT 'offered'
-        CHECK (state IN ('offered', 'stored', 'claimed')),
-      created_at timestamptz NOT NULL,
-      -- RESTRICT for the same reason a delivery uses it: the row is the record
-      -- that something was attached, and deleting the submission must not
-      -- quietly erase what it carried.
-      submission_id uuid REFERENCES submissions(id) ON DELETE RESTRICT,
-      -- One file, one submission. Enforced here rather than in application
-      -- code, because two concurrent submissions claiming the same file is
-      -- exactly the race application code loses — and the loser would be a
-      -- submission referencing bytes another submission owns.
-      CONSTRAINT files_one_submission UNIQUE (id, submission_id)
-    )`;
-	await sql`
-    CREATE INDEX IF NOT EXISTS files_abandoned
-      ON files (created_at) WHERE state <> 'claimed'`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS users (
-      id uuid PRIMARY KEY,
-      email text NOT NULL UNIQUE,
-      password_hash text NOT NULL,
-      role text NOT NULL,
-      created_at timestamptz NOT NULL
-    )`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS api_keys (
-      id uuid PRIMARY KEY,
-      name text NOT NULL,
-      prefix text NOT NULL,
-      secret_hash text NOT NULL,
-      role text NOT NULL,
-      created_at timestamptz NOT NULL,
-      revoked_at timestamptz
-    )`;
-	await sql`CREATE INDEX IF NOT EXISTS api_keys_prefix ON api_keys (prefix)`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS spent_challenges (
-      -- The primary key IS the mechanism. Two requests arriving with one
-      -- solution both pass every stateless check — the signature is ours
-      -- and the hash is right — and only the database can decide which of
-      -- them spends it. A read-then-write would race exactly where somebody
-      -- is looking.
-      challenge text PRIMARY KEY,
-      expires_at timestamptz NOT NULL
-    )`;
-	await sql`CREATE INDEX IF NOT EXISTS spent_challenges_expiry ON spent_challenges (expires_at)`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS audit_log (
-      id uuid PRIMARY KEY,
-      at timestamptz NOT NULL,
-      action text NOT NULL,
-      -- Null for an anonymous public submission, which is an answer rather
-      -- than a gap: the form was open and nobody was signed in.
-      actor_kind text CHECK (actor_kind IN ('user', 'apiKey')),
-      actor_id text,
-      subject text,
-      request_id text,
-      -- Identifiers and counts. NEVER a submission's answers: an audit log is
-      -- read by more people and kept longer than the data it describes, so
-      -- data inside it is a second copy of the thing being protected.
-      detail jsonb
-    )`;
-	await sql`CREATE INDEX IF NOT EXISTS audit_log_at ON audit_log (at DESC)`;
-	await sql`CREATE INDEX IF NOT EXISTS audit_log_subject ON audit_log (subject, at DESC)`;
-	await sql`
-    CREATE TABLE IF NOT EXISTS drafts (
-      id text NOT NULL,
-      form_id uuid NOT NULL REFERENCES forms(id),
-      form_version_id uuid NOT NULL REFERENCES form_versions(id),
-      data jsonb NOT NULL,
-      updated_at timestamptz NOT NULL,
-      PRIMARY KEY (form_id, id)
-    )`;
-	await sql`
-    CREATE OR REPLACE FUNCTION refuse_version_update() RETURNS trigger AS $$
-    BEGIN
-      RAISE EXCEPTION 'form_versions rows are immutable; publish a new version instead';
-    END
-    $$ LANGUAGE plpgsql`;
-	await sql`DROP TRIGGER IF EXISTS form_versions_immutable ON form_versions`;
-	await sql`
-    CREATE TRIGGER form_versions_immutable
-    BEFORE UPDATE ON form_versions
-    FOR EACH ROW EXECUTE FUNCTION refuse_version_update()`;
-	await sql`
-    CREATE OR REPLACE FUNCTION refuse_audit_change() RETURNS trigger AS $$
-    BEGIN
-      RAISE EXCEPTION 'audit_log is append-only';
-    END
-    $$ LANGUAGE plpgsql`;
-	await sql`DROP TRIGGER IF EXISTS audit_log_append_only ON audit_log`;
-	await sql`
-    CREATE TRIGGER audit_log_append_only
-    BEFORE UPDATE OR DELETE ON audit_log
-    FOR EACH ROW EXECUTE FUNCTION refuse_audit_change()`;
-}
-//#endregion
-//#region src/postgres-storage.ts
-/** The Storage port over Postgres — the mirror of server-core's in-memory one. */
-function createPostgresStorage(sql) {
-	const db = drizzle(sql);
-	return {
-		async getFormByPath(path) {
-			const row = (await db.select().from(forms).where(eq(forms.path, path)).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				path: row.path,
-				currentVersionId: row.currentVersionId,
-				accessSubmit: row.accessSubmit === "public" ? "public" : "authenticated",
-				allowedOrigins: row.allowedOrigins
-			};
-		},
-		async listForms() {
-			return (await db.select().from(forms)).map((row) => ({
-				id: row.id,
-				path: row.path,
-				currentVersionId: row.currentVersionId,
-				accessSubmit: row.accessSubmit === "public" ? "public" : "authenticated",
-				allowedOrigins: row.allowedOrigins
-			}));
-		},
-		async createForm(record) {
-			await db.insert(forms).values({
-				id: record.id,
-				path: record.path,
-				currentVersionId: record.currentVersionId,
-				accessSubmit: record.accessSubmit,
-				allowedOrigins: record.allowedOrigins
-			});
-		},
-		async updateFormAccess(formId, access) {
-			await db.update(forms).set({
-				accessSubmit: access.accessSubmit,
-				allowedOrigins: access.allowedOrigins
-			}).where(eq(forms.id, formId));
-		},
-		async setCurrentVersion(formId, versionId) {
-			await db.update(forms).set({ currentVersionId: versionId }).where(eq(forms.id, formId));
-		},
-		async insertVersion(record) {
-			await db.insert(formVersions).values({
-				id: record.id,
-				formId: record.formId,
-				version: record.version,
-				schema: record.schema,
-				schemaHash: record.schemaHash
-			});
-		},
-		async publishVersion({ form, version, audit }) {
-			await db.transaction(async (tx) => {
-				if (form !== void 0) await tx.insert(forms).values({
-					id: form.id,
-					path: form.path,
-					currentVersionId: form.currentVersionId,
-					accessSubmit: form.accessSubmit,
-					allowedOrigins: form.allowedOrigins
-				});
-				await tx.insert(formVersions).values({
-					id: version.id,
-					formId: version.formId,
-					version: version.version,
-					schema: version.schema,
-					schemaHash: version.schemaHash
-				});
-				if ((await tx.update(forms).set({ currentVersionId: version.id }).where(eq(forms.id, version.formId)).returning({ id: forms.id })).length !== 1) throw new Error(`Publishing to form ${version.formId} matched no form row. Rolling back, so there is no version pointing at a form that is not there.`);
-				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
-			});
-		},
-		async getVersionById(id) {
-			const row = (await db.select().from(formVersions).where(eq(formVersions.id, id)).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				formId: row.formId,
-				version: row.version,
-				schema: row.schema,
-				schemaHash: row.schemaHash
-			};
-		},
-		async findVersionByHash(formId, schemaHash) {
-			const row = (await db.select().from(formVersions).where(eq(formVersions.formId, formId))).find((candidate) => candidate.schemaHash === schemaHash);
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				formId: row.formId,
-				version: row.version,
-				schema: row.schema,
-				schemaHash: row.schemaHash
-			};
-		},
-		async latestVersionNumber(formId) {
-			return (await db.select({ latest: max(formVersions.version) }).from(formVersions).where(eq(formVersions.formId, formId)))[0]?.latest ?? 0;
-		},
-		async insertSubmission(record, queued, claimFileIds, audit) {
-			await db.transaction(async (tx) => {
-				await tx.insert(submissions).values({
-					id: record.id,
-					formId: record.formId,
-					formVersionId: record.formVersionId,
-					data: record.data,
-					submittedAt: new Date(record.submittedAt)
-				});
-				if (queued !== void 0 && queued.length > 0) await tx.insert(deliveries).values(queued.map((delivery) => ({
-					id: delivery.id,
-					webhookId: delivery.webhookId,
-					submissionId: delivery.submissionId,
-					eventId: delivery.eventId,
-					body: delivery.body,
-					attempt: delivery.attempt,
-					nextAttemptAt: new Date(delivery.nextAttemptAt),
-					state: delivery.state,
-					lastError: delivery.lastError
-				})));
-				if (claimFileIds !== void 0 && claimFileIds.length > 0) {
-					if ((await tx.update(files).set({
-						state: "claimed",
-						submissionId: record.id
-					}).where(and(inArray(files.id, [...claimFileIds]), eq(files.state, "stored"))).returning({ id: files.id })).length !== claimFileIds.length) throw new Error("A file this submission names was claimed by another one first. Rolling back, so the submission does not reference bytes it does not own.");
-				}
-				if (audit !== void 0) await tx.insert(auditLog).values(auditRow(audit));
-			});
-		},
-		async spendChallenge(challenge, expiresAtIso) {
-			return (await db.insert(spentChallenges).values({
-				challenge,
-				expiresAt: new Date(expiresAtIso)
-			}).onConflictDoNothing().returning({ challenge: spentChallenges.challenge })).length === 1;
-		},
-		async forgetExpiredChallenges(beforeIso) {
-			return (await db.delete(spentChallenges).where(lt(spentChallenges.expiresAt, new Date(beforeIso))).returning({ challenge: spentChallenges.challenge })).length;
-		},
-		async recordAudit(entry) {
-			await db.insert(auditLog).values(auditRow(entry));
-		},
-		async listAudit(limit) {
-			return (await db.select().from(auditLog).orderBy(desc(auditLog.at)).limit(limit)).map((row) => ({
-				id: row.id,
-				at: row.at.toISOString(),
-				action: row.action,
-				...row.actorKind === null ? {} : { actorKind: row.actorKind },
-				...row.actorId === null ? {} : { actorId: row.actorId },
-				...row.subject === null ? {} : { subject: row.subject },
-				...row.requestId === null ? {} : { requestId: row.requestId },
-				...row.detail === null ? {} : { detail: row.detail }
-			}));
-		},
-		async insertFile(record) {
-			await db.insert(files).values({
-				...record,
-				createdAt: new Date(record.createdAt)
-			});
-		},
-		async getFile(id) {
-			const [row] = await db.select().from(files).where(eq(files.id, id)).limit(1);
-			return row === void 0 ? void 0 : toFileRecord(row);
-		},
-		async updateFile(record) {
-			await db.update(files).set({
-				state: record.state,
-				submissionId: record.submissionId
-			}).where(eq(files.id, record.id));
-		},
-		async abandonedFiles(beforeIso) {
-			return (await db.select().from(files).where(and(ne(files.state, "claimed"), lt(files.createdAt, new Date(beforeIso))))).map(toFileRecord);
-		},
-		async deleteFiles(ids) {
-			if (ids.length === 0) return;
-			await db.delete(files).where(inArray(files.id, [...ids]));
-		},
-		async webhooksForForm(formId) {
-			return (await db.select().from(webhooks).where(eq(webhooks.formId, formId))).map(toWebhookRecord);
-		},
-		async insertWebhook(record) {
-			await db.insert(webhooks).values({
-				id: record.id,
-				formId: record.formId,
-				url: record.url,
-				secret: record.secret,
-				consecutiveFailures: record.consecutiveFailures,
-				openedAt: record.openedAt === null ? null : new Date(record.openedAt)
-			});
-		},
-		async updateWebhook(record) {
-			await db.update(webhooks).set({
-				consecutiveFailures: record.consecutiveFailures,
-				openedAt: record.openedAt === null ? null : new Date(record.openedAt)
-			}).where(eq(webhooks.id, record.id));
-		},
-		async listWebhooks() {
-			return (await db.select().from(webhooks)).map(toWebhookRecord);
-		},
-		async deadDeliveries(limit) {
-			return (await db.select().from(deliveries).where(eq(deliveries.state, "dead")).orderBy(desc(deliveries.nextAttemptAt)).limit(limit)).map(toDeliveryRecord);
-		},
-		async getDelivery(id) {
-			const [row] = await db.select().from(deliveries).where(eq(deliveries.id, id)).limit(1);
-			return row === void 0 ? void 0 : toDeliveryRecord(row);
-		},
-		async claimDueDeliveries(nowIso, limit) {
-			return (await db.select().from(deliveries).where(and(eq(deliveries.state, "pending"), lte(deliveries.nextAttemptAt, new Date(nowIso)))).orderBy(deliveries.nextAttemptAt).limit(limit)).map(toDeliveryRecord);
-		},
-		async updateDelivery(record) {
-			await db.update(deliveries).set({
-				attempt: record.attempt,
-				nextAttemptAt: new Date(record.nextAttemptAt),
-				state: record.state,
-				lastError: record.lastError
-			}).where(eq(deliveries.id, record.id));
-		},
-		async listSubmissions() {
-			return (await db.select().from(submissions)).map(toSubmissionRecord);
-		},
-		async listSubmissionsByForm(formId) {
-			return (await db.select().from(submissions).where(eq(submissions.formId, formId)).orderBy(desc(submissions.submittedAt), desc(submissions.id))).map(toSubmissionRecord);
-		},
-		async listVersionsByForm(formId) {
-			return (await db.select().from(formVersions).where(eq(formVersions.formId, formId)).orderBy(desc(formVersions.version))).map((row) => ({
-				id: row.id,
-				formId: row.formId,
-				version: row.version,
-				schema: row.schema,
-				schemaHash: row.schemaHash
-			}));
-		},
-		async upsertDraft(record) {
-			await db.insert(drafts).values({
-				id: record.id,
-				formId: record.formId,
-				formVersionId: record.formVersionId,
-				data: record.data,
-				updatedAt: new Date(record.updatedAt)
-			}).onConflictDoUpdate({
-				target: [drafts.formId, drafts.id],
-				set: {
-					formVersionId: record.formVersionId,
-					data: record.data,
-					updatedAt: new Date(record.updatedAt)
-				}
-			});
-		},
-		async getDraft(formId, draftId) {
-			const row = (await db.select().from(drafts).where(and(eq(drafts.formId, formId), eq(drafts.id, draftId))).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				formId: row.formId,
-				formVersionId: row.formVersionId,
-				data: row.data,
-				updatedAt: row.updatedAt.toISOString()
-			};
-		},
-		async insertUser(record) {
-			await db.insert(users).values({
-				id: record.id,
-				email: record.email,
-				passwordHash: record.passwordHash,
-				role: record.role,
-				createdAt: new Date(record.createdAt)
-			});
-		},
-		async getUserByEmail(email) {
-			const row = (await db.select().from(users).where(eq(users.email, email)).limit(1))[0];
-			if (row === void 0) return void 0;
-			return {
-				id: row.id,
-				email: row.email,
-				passwordHash: row.passwordHash,
-				role: row.role,
-				createdAt: row.createdAt.toISOString()
-			};
-		},
-		async insertApiKey(record) {
-			await db.insert(apiKeys).values({
-				id: record.id,
-				name: record.name,
-				prefix: record.prefix,
-				secretHash: record.secretHash,
-				role: record.role,
-				createdAt: new Date(record.createdAt),
-				revokedAt: record.revokedAt === null ? null : new Date(record.revokedAt)
-			});
-		},
-		async listApiKeys() {
-			return (await db.select().from(apiKeys)).map(toApiKeyRecord);
-		},
-		async findApiKeysByPrefix(prefix) {
-			return (await db.select().from(apiKeys).where(eq(apiKeys.prefix, prefix))).map(toApiKeyRecord);
-		},
-		async revokeApiKey(id, atIso) {
-			await db.update(apiKeys).set({ revokedAt: new Date(atIso) }).where(eq(apiKeys.id, id));
-		}
-	};
-}
-function toApiKeyRecord(row) {
-	return {
-		id: row.id,
-		name: row.name,
-		prefix: row.prefix,
-		secretHash: row.secretHash,
-		role: row.role,
-		createdAt: row.createdAt.toISOString(),
-		revokedAt: row.revokedAt === null ? null : row.revokedAt.toISOString()
-	};
-}
-function toSubmissionRecord(row) {
-	return {
-		id: row.id,
-		formId: row.formId,
-		formVersionId: row.formVersionId,
-		data: row.data,
-		submittedAt: row.submittedAt.toISOString()
-	};
-}
-/** A delivery row as the port describes it. */
-function toDeliveryRecord(row) {
-	return {
-		id: row.id,
-		webhookId: row.webhookId,
-		submissionId: row.submissionId,
-		eventId: row.eventId,
-		body: row.body,
-		attempt: row.attempt,
-		nextAttemptAt: row.nextAttemptAt.toISOString(),
-		state: row.state,
-		lastError: row.lastError
-	};
-}
-/** A files row as the port describes it: timestamps as ISO strings. */
-function toFileRecord(row) {
-	return {
-		id: row.id,
-		formId: row.formId,
-		name: row.name,
-		size: row.size,
-		contentType: row.contentType,
-		storageKey: row.storageKey,
-		state: row.state,
-		createdAt: row.createdAt.toISOString(),
-		submissionId: row.submissionId
-	};
-}
-/** A webhook row as the port describes it, health included. */
-function toWebhookRecord(row) {
-	return {
-		id: row.id,
-		formId: row.formId,
-		url: row.url,
-		secret: row.secret,
-		consecutiveFailures: row.consecutiveFailures,
-		openedAt: row.openedAt === null ? null : row.openedAt.toISOString()
-	};
-}
-/**
-* An entry as the table holds it.
-*
-* Absent and null are the same thing here, and the conversion is in one place
-* so two call sites cannot disagree about which they write.
-*/
-function auditRow(entry) {
-	return {
-		id: entry.id,
-		at: new Date(entry.at),
-		action: entry.action,
-		actorKind: entry.actorKind ?? null,
-		actorId: entry.actorId ?? null,
-		subject: entry.subject ?? null,
-		requestId: entry.requestId ?? null,
-		detail: entry.detail ?? null
-	};
-}
-//#endregion
-//#region src/file-store.ts
-/**
-* Bytes under one directory, one file per key.
-*
-* **Keys are checked, not trusted.** A key is minted by the server from a form
-* id and a file id, so it cannot contain a traversal — but this resolves it
-* and refuses anything landing outside the root regardless. A path check that
-* only runs when the input is untrusted is a path check that stops running the
-* day somebody adds a caller.
-*/
-function createLocalFileStore(root) {
-	const base = resolve(root);
-	const pathFor = (key) => {
-		if (key.includes("\\")) throw new Error(`Refusing a storage key that could resolve outside the store: ${key}`);
-		const full = resolve(join(base, key));
-		if (full !== base && !full.startsWith(base + sep)) throw new Error(`Refusing a storage key that resolves outside the store: ${key}`);
-		return full;
-	};
-	return {
-		async put(key, bytes) {
-			const full = pathFor(key);
-			await mkdir(dirname(full), { recursive: true });
-			await writeFile(full, bytes);
-		},
-		async open(key) {
-			const full = pathFor(key);
-			try {
-				await stat(full);
-			} catch {
-				return;
-			}
-			return createReadStream(full);
-		},
-		async remove(key) {
-			await rm(pathFor(key), { force: true });
-		},
-		async sizeOf(key) {
-			try {
-				return (await stat(pathFor(key))).size;
-			} catch {
-				return;
-			}
-		}
-	};
-}
-/**
-* The checksum a receiver can compare against.
-*
-* Returned when the bytes are stored and never asked of the client: a checksum
-* the uploader computed is a checksum the uploader can lie about, so this one
-* is only useful for telling a *later* reader that the bytes have not changed.
-*/
-function sha256(bytes) {
-	return createHash("sha256").update(bytes).digest("hex");
-}
-//#endregion
-//#region src/file-collector.ts
-function startFileCollector(storage, store, options = {}) {
-	const interval = options.intervalMs ?? 9e5;
-	const afterHours = options.afterHours ?? 24;
-	let stopped = false;
-	let running = false;
-	const tick = async () => {
-		if (running || stopped) return;
-		running = true;
-		try {
-			const abandoned = await collectAbandonedFiles(storage, /* @__PURE__ */ new Date(), afterHours);
-			if (abandoned.length === 0) return;
-			const removed = [];
-			for (const file of abandoned) {
-				await store.remove(file.storageKey);
-				removed.push(file.id);
-			}
-			await storage.deleteFiles(removed);
-		} catch (error) {
-			console.error("files: a collection pass failed", error);
-		} finally {
-			running = false;
-		}
-	};
-	const timer = setInterval(() => void tick(), interval);
-	timer.unref?.();
-	return { stop: () => {
-		stopped = true;
-		clearInterval(timer);
-	} };
-}
-//#endregion
-export { bootstrapSchema as a, createPostgresStorage as i, createLocalFileStore as n, createApp as o, sha256 as r, SCHEMA_HASH_HEADER as s, startFileCollector as t };
-
-//# sourceMappingURL=file-collector-LmfD8Y_d.mjs.map