@formancy/server 0.6.0 → 0.8.0

package/dist/{completers-C-E2b7Jm.mjs → completers-CQQDS4qr.mjs}

@@ -1,5 +1,5 @@
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { AUDIT_ACTIONS, auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, completeBuilderRequest, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, formToFill, healthOf, keepExamples, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, readExamples, replayDelivery, resolveForm, resumeDraft, saveDraft, screenUpload, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
+import { AUDIT_ACTIONS, auditedBy, authenticateApiKey, authenticateLocal, can, collectAbandonedFiles, completeBuilderRequest, createApiKey, createLocalUser, createSubmission, decodeSolution, exportCsv, formToFill, formVersion, healthOf, keepExamples, listForms, listSubmissions, listVersions, mintChallenge, offerUpload, publishForm, readExamples, replayDelivery, resolveForm, resumeDraft, saveDraft, screenUpload, setFormAccess, startDraft, verifySolution } from "@formancy/server-core";
 import { MODEL_REQUEST_KINDS } from "@formancy/builder-core";
 import Fastify, { LogController } from "fastify";
 import rateLimit from "@fastify/rate-limit";
@@ -16,51 +16,12 @@ import { dirname, join, resolve, sep } from "node:path";
 import Anthropic, { APIError } from "@anthropic-ai/sdk";
 import OpenAI, { APIError as APIError$1 } from "openai";
 //#region src/header-values.ts
-/**
-* A response header's value made from data: a name somebody else chose
-* ([0175](../../../docs/decisions/0175-a-name-goes-into-a-header-encoded.md)).
-*
-* Node writes a header only when every character of its value is a tab, printable ASCII or one
-* of the bytes 0x80 to 0xFF, and throws `ERR_INVALID_CHAR` for anything else — when the reply is
-* written, after the route has answered. Nothing about a file's name or a form's path keeps it
-* inside that: a respondent names a file `日本 €.pdf`, an author publishes a path with a line
-* break in it. And the bytes 0x80 to 0xFF it does accept are no better: the server sent `é` as one
-* byte before a stream and as two, its UTF-8, before a string body, so a client read `café` on a
-* download and `café` on an export.
-*
-* So a value is made here, from the data, in printable ASCII only, and a route writes what this
-* returns rather than a template of its own. `header-values.test.ts` holds every export to
-* every UTF-16 code unit, and reads the server's sources for a header written any other way.
-*/
-/**
-* `content-disposition` for a download, by RFC 6266: `attachment`, and the name twice when
-* ASCII cannot carry it — once readable, once exact.
-*
-* `filename` is a quoted string of printable ASCII, with every character it cannot hold as
-* itself made `_`: anything outside it, the quote that would end it, the backslash a reader may
-* or may not take as an escape, and the percent sign RFC 6266 (appendix D) says some readers
-* decode. `filename*` is RFC 8187's extended value, the name's UTF-8 percent-encoded, which
-* RFC 6266 has a reader prefer when both are there. It is added only when the readable one
-* lost something, so an ordinary name keeps the header it always had.
-*
-* The name is not cleaned of anything: a control character or a path separator goes to the
-* reader's browser encoded, and making a file name its system can hold is the browser's, as it
-* is for every download.
-*/
 function attachment(filename) {
 	const readable = filename.replace(/[^\x20-\x7e]|["\\%]/gu, "_");
 	if (readable === filename) return `attachment; filename="${readable}"`;
 	return `attachment; filename="${readable}"; filename*=UTF-8''${percentEncoded(filename)}`;
 }
-/** RFC 8187's attr-char: what an extended value may hold as itself. */
 const ATTR_CHAR = /^[A-Za-z0-9!#$&+\-.^_`|~]$/;
-/**
-* `text` as UTF-8, each byte that is not an attr-char written `%XX`.
-*
-* Through a `Buffer` rather than `encodeURIComponent`, which leaves `'`, `(`, `)` and `*` as they
-* are — and a `'` ends an extended value's charset — and throws on a lone surrogate, which a
-* JSON body can carry. A `Buffer` writes one as U+FFFD.
-*/
 function percentEncoded(text) {
 	let encoded = "";
 	for (const byte of Buffer.from(text, "utf8")) {
@@ -71,14 +32,6 @@ function percentEncoded(text) {
 }
 //#endregion
 //#region src/rate-limits.ts
-/**
-* A route's `config.rateLimit`.
-*
-* The failure mode is an argument, so no limit can be written without saying it; left to the
-* plugin, it is an error, which a route answers as a 500 nobody chose. And the window is
-* translated here, once: `timeWindowMs` is this app's name for it and the plugin does not
-* read it, which one route found out by silently taking the global window instead.
-*/
 function limited(budget, whenUncounted) {
 	return {
 		max: budget.max,
@@ -88,18 +41,7 @@ function limited(budget, whenUncounted) {
 }
 //#endregion
 //#region src/routes/files.ts
-/**
-* How long one request holds a file while its bytes are scanned and written (0153).
-*
-* A judgement, not a bound the adapters guarantee. The object store this package supplies
-* abandons a PUT after 30 seconds, as a whole; its clamd adapter's 30 seconds are of silence
-* — any traffic on the connection restarts them — so nothing here limits how long a scan
-* takes. Longer makes an overrun rarer, and keeps a PUT of the same file busy for longer
-* after a request that died holding it. A request that does overrun it can still replace a
-* claimed file's bytes, and `docs/architecture/11-risks-and-debt.md` says what that costs.
-*/
 const RECEIVE_LEASE_MS = 12e4;
-/** A request whose lease ran out is not accepted, whichever check found it. */
 const OUTLASTED = {
 	status: 409,
 	body: {
@@ -107,22 +49,9 @@ const OUTLASTED = {
 		message: "This upload took longer than the server holds a file for one request, so it was not accepted. Try again."
 	}
 };
-/**
-* A form's files: offering one, receiving its bytes, and serving it back.
-*
-* One route family per plugin, the seam `app.ts`'s size budget names. It moved when
-* scanning an upload's bytes needed lines that file had no room for.
-*/
 async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }) {
 	const { storage } = deps;
 	const submissionLimit = limit;
-	/**
-	* Ask where to put a file.
-	*
-	* Refusing here, before a byte is sent, is the difference between rejecting
-	* a 2 GB upload and receiving one first. The reply carries the id the
-	* submission will reference and the URL to PUT the bytes to.
-	*/
 	app.post("/f/:path/files", { config: { rateLimit: limited(submissionLimit, "admit") } }, async (request, reply) => {
 		if (fileStore === void 0) return reply.code(501).send({
 			error: "uploads_unavailable",
@@ -179,17 +108,6 @@ async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }
 			uploadUrl: `/f/${encodeURIComponent(path)}/files/${outcome.file.id}`
 		});
 	});
-	/**
-	* Receive the bytes for a file that was offered.
-	*
-	* In a context of its own, with every body parser removed and one put back that hands
-	* any body over as bytes. A file is whatever the reader had — the form's `accept` list
-	* decides whether it is allowed, at the offer — and Fastify parses `text/plain` and
-	* `application/json` itself: a catch-all added beside those only ever saw the types with
-	* no parser of their own, so a `.txt` or `.json` file arrived here as a string or an
-	* object and was refused as no body. Encapsulated, so that no other route is handed raw
-	* bytes, nor a body as large as a file past the request body cap.
-	*/
 	await app.register(async (byteRoutes) => {
 		byteRoutes.removeAllContentTypeParsers();
 		byteRoutes.addContentTypeParser("*", {
@@ -227,15 +145,6 @@ async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }
 			return reply.code(answer.status).send(answer.body);
 		});
 	});
-	/**
-	* Give a file back after a request that kept nothing, without letting the release decide
-	* the reply.
-	*
-	* A release that fails is most likely the database the request has already failed on, and
-	* its error would stand in for the one that says why the bytes were not kept — or turn a
-	* scanner's refusal into a 500. The lease runs out on its own, so all a failed release
-	* costs is a `PUT` of this same file being busy until it does.
-	*/
 	async function giveBack(id, lease, log) {
 		await storage.releaseFile(id, lease).catch((cause) => {
 			log.error({
@@ -244,11 +153,6 @@ async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }
 			});
 		});
 	}
-	/**
-	* Scan a file's bytes, write them and settle its row, for a request holding its lease.
-	*
-	* Returns the answer rather than sending it, so the route can give the lease back first.
-	*/
 	async function receive(store, file, bytes, lease, log) {
 		const screened = await screenUpload(deps.scanner, file, bytes);
 		if (!screened.ok) {
@@ -276,16 +180,6 @@ async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }
 		if (await storage.settleFile(file.id, lease)) return { status: 204 };
 		return OUTLASTED;
 	}
-	/**
-	* Serve a file back.
-	*
-	* Always as an attachment, never inline, and `nosniff` alongside it. Stored
-	* cross-site scripting through an uploaded HTML or SVG file is the most
-	* commonly exploited vulnerability in this product category, and the real
-	* answer is a separate hostname — which a single-container deployment does
-	* not have. Forcing a download is the accommodation, and it is the one place
-	* this deployment model genuinely costs something.
-	*/
 	app.get("/f/:path/files/:id", async (request, reply) => {
 		if (fileStore === void 0) return reply.code(501).send({ error: "uploads_unavailable" });
 		const { path, id } = request.params;
@@ -300,31 +194,11 @@ async function fileRoutes(app, { deps, fileStore, maxFileBytes, limit, actorOf }
 }
 //#endregion
 //#region src/headers.ts
-/**
-* The header a client declares what it was looking at with.
-*
-* One name, read by the submission route and by the publish plugin: a
-* submission says which version it rendered, and a publish says which version it
-* opened. Two spellings of one header is a bug nobody sees until a client sends
-* the other one.
-*/
 const SCHEMA_HASH_HEADER = "x-formancy-schema-hash";
-/** A solved proof-of-work challenge, as base64 JSON: the shape an ALTCHA client already produces. */
 const CHALLENGE_HEADER = "x-formancy-challenge";
-/**
-* The token a response is sent with: handed out with the form, and with a draft, naming the id
-* the response is stored under (0169). Required of an anonymous submission.
-*/
 const SUBMISSION_TOKEN_HEADER = "x-formancy-submission-token";
 //#endregion
 //#region src/routes/publish.ts
-/**
-* Publishing a form, as a plugin of its own.
-*
-* One route family per plugin, which is Fastify's own unit and what `app.ts`'s
-* size budget named as the seam. It moved when the budget refused the next thing
-* added to it rather than letting the number drift.
-*/
 async function publishRoutes(app, { deps, requires }) {
 	app.post("/forms", { preHandler: requires("form.publish") }, async (request, reply) => {
 		const body = request.body;
@@ -379,14 +253,6 @@ async function publishRoutes(app, { deps, requires }) {
 }
 //#endregion
 //#region src/routes/access.ts
-/**
-* Who may submit a form, and from where: a property of the deployment, not of the document,
-* so changing it mints no version and leaves every client's schema hash standing
-* ([0044](../../../../docs/decisions/0044-access-outside-the-document.md)).
-*
-* One route family per plugin, the seam `app.ts`'s size budget names. It left `app.ts` when
-* the examples kept beside a form needed a plugin registered there (0166).
-*/
 async function accessRoutes(app, { deps, requires, audit }) {
 	app.put("/f/:path/access", { preHandler: requires("form.publish") }, async (request, reply) => {
 		const { path } = request.params;
@@ -419,17 +285,6 @@ async function accessRoutes(app, { deps, requires, audit }) {
 }
 //#endregion
 //#region src/routes/examples.ts
-/**
-* A form's examples, and the sample they start from, kept beside the form (0166).
-*
-* `GET /f/:path/examples` answers `{ scenarios, sample? }`, with `unreadable` beside them when
-* something kept is not an example, and `PUT` replaces both with `{ scenarios, sample? }`. The routes authenticate and carry: who may read and change them, what an
-* example is, and what a publish says about them are `server-core`'s, so the 403 here is the
-* use-case's answer and not a `requires` of the route's own. Publishing needs nothing from
-* here — `publishForm` reads the examples itself, and its warnings ride on the `201`.
-*
-* One route family per plugin, the seam `app.ts`'s size budget names.
-*/
 async function exampleRoutes(app, { deps, actorOf }) {
 	app.get("/f/:path/examples", async (request, reply) => {
 		const actor = await actorOf(request);
@@ -452,7 +307,6 @@ async function exampleRoutes(app, { deps, actorOf }) {
 		}));
 	});
 }
-/** An outcome as a response: the examples as kept, or the refusal, in the plane's shapes. */
 function answer$1(reply, outcome) {
 	if (outcome.ok) return reply.send(outcome.examples);
 	switch (outcome.kind) {
@@ -469,23 +323,7 @@ function answer$1(reply, outcome) {
 }
 //#endregion
 //#region src/routes/deliveries.ts
-/**
-* Webhooks as an operator sees them: their health, the deliveries that died, and
-* sending one of those again.
-*
-* One route family per plugin, the seam `app.ts`'s size budget names. It moved
-* when that file needed room to say which proxy it believes about a client.
-*/
 async function deliveryRoutes(app, { deps, requires, audit }) {
-	/**
-	* Webhook health, and the deliveries that died.
-	*
-	* The reason the breaker keeps its counters on the row rather than in the
-	* worker's memory. A self-hoster has no operations team watching a
-	* dashboard, so a destination refusing deliveries since Tuesday has to be
-	* answerable from the product — otherwise it is found when somebody asks
-	* why the CRM has no leads this week.
-	*/
 	app.get("/webhooks", { preHandler: requires("form.publish") }, async (_request, reply) => {
 		const now = new Date(deps.nowIso());
 		const hooks = await deps.storage.listWebhooks();
@@ -529,30 +367,8 @@ async function deliveryRoutes(app, { deps, requires, audit }) {
 }
 //#endregion
 //#region src/routes/drafts.ts
-/** Proves the bearer started this draft. Lower-case: Fastify normalises. */
 const DRAFT_TOKEN_HEADER = "x-formancy-draft-token";
-/**
-* A respondent's draft: started, written and read back, each with the key only its starter
-* holds ([0062](../../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).
-*
-* One route family per plugin, the seam `app.ts`'s size budget names. It moved when the
-* deployment's model needed lines that file had no room for.
-*/
 async function draftRoutes(app, { deps, limit }) {
-	/**
-	* Start a draft, and get the only key to it.
-	*
-	* The public plane is anonymous, so a draft has no account behind it. It was
-	* previously addressed by an id the CALLER chose, with no check on either
-	* route: anybody who knew or guessed an id could read a stranger's part-filled
-	* form, and overwrite it — after which that person submits the substituted
-	* content under their own name and nothing says otherwise
-	* ([0062](../../../../docs/decisions/0062-a-draft-carries-its-own-key.md)).
-	*
-	* So the server picks the id and signs it, and the token comes back exactly
-	* once. Losing it means losing the draft, which is the correct trade for the
-	* alternative.
-	*/
 	app.post("/f/:path/drafts", { config: { rateLimit: limited(limit, "admit") } }, async (request, reply) => {
 		const { path } = request.params;
 		const started = await startDraft(deps, { path });
@@ -588,31 +404,7 @@ async function draftRoutes(app, { deps, limit }) {
 }
 //#endregion
 //#region src/routes/model.ts
-/**
-* The largest request the route reads, in bytes, set on the route rather than inherited.
-*
-* Every byte is an input token the operator pays for, so the cap is the route's own:
-* raising the server's limit for something else does not raise what an editor can send a
-* model. It has to hold what the builders send about a form the server publishes, and the
-* largest of that is a translation, not the form: each answer's row repeats the question
-* it answers as its context, pretty-printed and escaped again as a string.
-* `model-route.test.ts` sends all three requests about the largest questionnaire the server's
-* default limit publishes, its questions a sentence long, and they are taken. Longer
-* questions over many answers make a translation past this, refused before it is read (0165).
-*/
 const MODEL_BODY_LIMIT_BYTES = 1048576;
-/**
-* The builders' requests to the deployment's model (0165).
-*
-* `GET /model` says whether there is one, and which, to somebody who may edit a form —
-* `{ provider, model }`, both `null` when there is none (0183) — and the admin draws the
-* prompt pane only when there is. `POST /model/complete` takes
-* `{ kind, user }` and answers `{ text }` — the model's answer, for the browser to check
-* — or `{ declined }` when the provider refused, which the admin's `AskModel` hands back as
-* a decline (0158). Everything else is an error with a sentence for the person.
-*
-* One route family per plugin, the seam `app.ts`'s size budget names.
-*/
 async function modelRoutes(app, { model, requires, audit, limit }) {
 	app.get("/model", { preHandler: requires("form.publish") }, async (_request, reply) => reply.send(model === void 0 ? {
 		provider: null,
@@ -650,16 +442,6 @@ async function modelRoutes(app, { model, requires, audit, limit }) {
 		return answer(reply, request, outcome);
 	});
 }
-/**
-* The browser going away, as a cancellation: the response closing before it was written.
-*
-* Every response closes, so one that finished is not a browser that left; only a close
-* with nothing written yet tells the adapter to abandon the request at the provider.
-*
-* A browser can also have gone before the handler ran, while the session or an API key was
-* still being checked. That response has closed already and will not close again, so it
-* is read as gone from the start, and the adapter is told at once — before it sends.
-*/
 function cancelledWith(reply) {
 	let gone = reply.raw.destroyed && !reply.raw.writableFinished;
 	const listeners = [];
@@ -673,7 +455,6 @@ function cancelledWith(reply) {
 		else listeners.push(listener);
 	} };
 }
-/** An outcome as a response, every failure with a sentence for the person reading it. */
 function answer(reply, request, outcome) {
 	if (outcome.ok) return reply.send({ text: outcome.text });
 	switch (outcome.failure) {
@@ -702,7 +483,6 @@ function answer(reply, request, outcome) {
 			});
 	}
 }
-/** What a provider's status means for the person whose turn it ended. */
 function unavailableSentence(status) {
 	if (status === 401 || status === 403) return "The model service refused this server’s key.";
 	if (status === 429) return "The model service is limiting this server’s requests. Try again in a while.";
@@ -711,35 +491,8 @@ function unavailableSentence(status) {
 }
 //#endregion
 //#region src/routes/submissions.ts
-/**
-* What a respondent's browser does with a form: read it, ask for a challenge, and submit it.
-*
-* One route family per plugin, the seam `app.ts`'s size budget names. It moved when the
-* submission token needed lines that file had no room for.
-*/
 async function submissionRoutes(app, { deps, challengeSecret, limit, actorOf }) {
 	const submissionLimit = limit;
-	/**
-	* Fetch a published form. The one public route deliberately NOT rate-limited.
-	*
-	* Every other unauthenticated route is: submitting, starting a draft, writing
-	* one, reading one, minting a challenge, asking for an upload target. Those are
-	* writes, or guesses, or work somebody can demand of the server. This is the
-	* read every visitor has to make before they can do anything at all.
-	*
-	* Limiting it by IP would refuse the form to real people sharing an address —
-	* an office, a school, a phone network behind CGNAT — and the failure would
-	* look like the form being broken rather than like a limit. That is a worse
-	* outcome than the cheap read it would prevent.
-	*
-	* Written down because the asymmetry is deliberate and looks like an omission.
-	*
-	* It also hands out the token the response is sent with, and that changes neither half of
-	* the argument: minting one is an HMAC and writes nothing, and it is not a defence against
-	* anybody who can read the form, so limiting it would buy nothing (0169). What it does change
-	* is that the reply is per reading: `no-store`, because a cache that kept it would hand one
-	* token to everybody behind it, and only the first of them could send a response.
-	*/
 	app.get("/f/:path", async (request, reply) => {
 		const { path } = request.params;
 		const form = await formToFill(deps, path);
@@ -751,13 +504,6 @@ async function submissionRoutes(app, { deps, challengeSecret, limit, actorOf })
 			submissionToken: form.submissionToken
 		});
 	});
-	/**
-	* A puzzle for an anonymous visitor to solve before submitting.
-	*
-	* Public because the form is: requiring a session to obtain a challenge for
-	* an unauthenticated submission would be a circle. It is cheap to mint and
-	* stateless, so handing one out costs this server a hash.
-	*/
 	app.get("/f/:path/challenge", { config: { rateLimit: limited(submissionLimit, "admit") } }, async (request, reply) => {
 		if (challengeSecret === void 0) return reply.code(404).send({ error: "challenge_not_enabled" });
 		const { path } = request.params;
@@ -829,15 +575,6 @@ async function submissionRoutes(app, { deps, challengeSecret, limit, actorOf })
 		}
 	});
 }
-/**
-* Check a submitted solution, and spend it.
-*
-* Returns the refusal to send, or undefined when it passed. The spend is
-* separate from the verification and comes last: the stateless checks say
-* the solution is correct, and only the database can say it has not been
-* used — a correct solution stays correct, so without this one puzzle
-* would buy a thousand submissions.
-*/
 async function checkChallenge(deps, challengeSecret, request) {
 	const header = request.headers[CHALLENGE_HEADER];
 	if (typeof header !== "string" || header === "") return {
@@ -862,17 +599,6 @@ async function checkChallenge(deps, challengeSecret, request) {
 }
 //#endregion
 //#region src/auth-runtime.ts
-/**
-* The real cryptography, confined to the composition root: argon2id for
-* secrets at rest, an HMAC-signed short-lived access token for sessions, and
-* a CSPRNG for API keys. server-core never sees any of this — it is handed
-* hash/verify/random functions and stays deterministic under test.
-*
-* HS256 rather than EdDSA for the session token, deliberately for this phase:
-* one secret in one env var is the self-hosting story a single-container
-* deployment can operate, and the signing scheme is an implementation detail
-* of a token that lives fifteen minutes. Revisit with key rotation.
-*/
 function realSecretHashing() {
 	return {
 		hashSecret: (secret) => hash(secret),
@@ -918,40 +644,12 @@ function createSessionTokens(secret) {
 }
 //#endregion
 //#region src/upload-settings.ts
-/**
-* How large a file this deployment accepts.
-*
-* Its own module because `main.ts` is a composition root that connects to a database
-* when it is imported, so nothing in it can be tested — and this is a setting whose wrong
-* values all look plausible.
-*/
-/** Ten megabytes: what the documentation and `.env.example` give as the default. */
 const DEFAULT_MAX_FILE_BYTES = 10485760;
-/**
-* The largest ceiling a deployment may set: the largest number `files.size` can hold.
-*
-* That column is a PostgreSQL `integer` (`db.ts`), a signed 32-bit number. Every size an
-* offer accepts is written to it, so a ceiling above this would let an offer through the
-* route and fail it at the insert. Raising it means widening the column first;
-* `server.integration.test.ts` reads the column's precision from the database and fails
-* when this number and the column disagree.
-*/
 const LARGEST_MAX_FILE_BYTES = 2147483647;
-/**
-* `value`, once it is a ceiling the server can honour: a whole number of bytes, at least
-* one, and no more than `files.size` holds. Throws naming `setting`, because the message
-* is all an operator has to go on.
-*/
 function checkedMaxFileBytes(value, setting) {
 	if (!Number.isInteger(value) || value < 1 || value > 2147483647) throw new Error(`${setting} must be a whole number of bytes from 1 to ${String(LARGEST_MAX_FILE_BYTES)}, the largest size the files table holds.`);
 	return value;
 }
-/**
-* The ceiling `FORMANCY_MAX_FILE_BYTES` sets, or the default when it is unset.
-*
-* Empty is refused rather than read as unset: the compose files already substitute the
-* default for an empty value, so an empty one here was set by hand, to something.
-*/
 function maxFileBytesFrom(env) {
 	const raw = env["FORMANCY_MAX_FILE_BYTES"];
 	if (raw === void 0) return DEFAULT_MAX_FILE_BYTES;
@@ -959,25 +657,6 @@ function maxFileBytesFrom(env) {
 }
 //#endregion
 //#region src/server-log.ts
-/**
-* The server's log: a JSON line for every request, one for every error that answered one, and
-* one for each thing a route or a background worker has to say
-* ([0168](../../../docs/decisions/0168-the-log-is-built-from-a-list-of-fields.md)).
-*
-* **What keeps everything else out is construction, not a filter over text.** A line is made
-* from the fields `LOG_FIELDS` names, each kept only when its value is of that field's kind,
-* and from nothing else. A key a call hands over that is not on the list is never read, so a
-* body, a header, a query string, an answer, a password, a draft's key or a file's name has no
-* field to go in. The words of a call are never written at all — pino's message argument,
-* Fastify's `error.message`, its `Route GET:/the/raw/url not found` — so neither are the
-* parameters a database error quotes: a line says what happened with an `event` from
-* `LOG_EVENTS`, and a thrown error is written as its kind and its code.
-*
-* Its own logger rather than pino's options, because pino's rule for what to keep would be
-* three hooks — a log formatter, a bindings formatter and a method hook to drop the message —
-* whose order is pino's internals; here it is one function, `written`, and a list.
-*/
-/** Most severe first: `fatal` writes the least, `trace` the most. The names are pino's. */
 const LOG_LEVELS = [
 	"fatal",
 	"error",
@@ -994,7 +673,6 @@ const SEVERITY = {
 	debug: 20,
 	trace: 10
 };
-/** What a line can say happened. Anything else is `unlisted`, or not written. */
 const LOG_EVENTS = [
 	"request",
 	"request.abandoned",
@@ -1014,11 +692,6 @@ const LOG_EVENTS = [
 	"database.notice",
 	"unlisted"
 ];
-/**
-* Every field a line can have, in the order it is written, each with the kind of value it
-* holds. A field is kept only when its value is of its kind, so a string in a number's place,
-* or a sentence in an identifier's, is dropped rather than written.
-*/
 const KINDS = {
 	time: (value) => typeof value === "string",
 	level: (value) => LOG_LEVELS.includes(value),
@@ -1034,10 +707,6 @@ const KINDS = {
 	upstream: isStatus
 };
 const LOG_FIELDS = Object.keys(KINDS);
-/**
-* The one place a line becomes text: dropped below `level`, and otherwise each listed field
-* whose value is of its kind, in the listed order.
-*/
 function written(sink, level) {
 	const threshold = SEVERITY[level];
 	return (line) => {
@@ -1051,17 +720,9 @@ function written(sink, level) {
 		sink.write(`${JSON.stringify(kept)}\n`);
 	};
 }
-/** A log whose every line is built by the rule above. What `createApp` hands Fastify. */
 function createServerLog(sink, level) {
 	return logger(written(sink, level), level, void 0);
 }
-/**
-* Fastify's logger interface over the rule: each call contributes its event, its error, and
-* the status, code, action and upstream status a caller may name, and nothing else it was
-* handed. A
-* child keeps the request id it is bound to, which is how Fastify gives a request's lines its
-* id, and nothing else bound beside it.
-*/
 function logger(write, level, reqId) {
 	const at = (lineLevel) => (first) => {
 		const given = first instanceof Error ? { err: first } : isRecord$1(first) ? first : {};
@@ -1090,32 +751,12 @@ function logger(write, level, reqId) {
 		child: (bindings) => logger(write, level, KINDS.reqId(bindings["reqId"]) ? bindings["reqId"] : reqId)
 	};
 }
-/**
-* When Fastify writes about a request, written as this log's lines: Fastify's own extension
-* point for its internal lines, rather than hooks beside a logger that also writes them.
-*
-* One line when a request is answered, not one when it arrives as well — half the lines,
-* and the one that has the status. A route nobody registered gets no line of its own: its
-* request line says 404 and names no route.
-*
-* **Every request, including the ones Fastify answers past its own request line.** Fastify
-* writes that line when an answer has been sent, so three kinds left none: a request whose
-* client went away first, whose answer is never sent; one refused for an unreadable URL or an
-* over-long parameter, answered by hand before routing unless `frameworkErrors` is set; and
-* one that arrives while the server closes, refused with a `503` before routing and said at
-* `info` in words, which this log drops. Each is written here as well.
-*/
 var RequestLines = class extends LogController {
 	#write;
 	constructor(write) {
 		super();
 		this.#write = write;
 	}
-	/**
-	* Nothing written on arrival; but a response that closes before it has finished sending is
-	* a client that left. Read from the response's own `finish`, which a socket and an injected
-	* request both emit, rather than `writableFinished`, which an injected one never sets.
-	*/
 	incomingRequest(request, reply) {
 		let sent = false;
 		reply.raw.once("finish", () => sent = true);
@@ -1130,7 +771,6 @@ var RequestLines = class extends LogController {
 		});
 	}
 	routeNotFound() {}
-	/** At `error` for a 5xx, thrown or answered by a route, so a level kept for failures keeps it. */
 	requestCompleted(error, request, reply) {
 		this.#write({
 			level: error != null || reply.statusCode >= 500 ? "error" : "info",
@@ -1141,17 +781,10 @@ var RequestLines = class extends LogController {
 			...described(error)
 		});
 	}
-	/**
-	* A request refused before it was routed, because its URL cannot be decoded or a parameter
-	* is longer than the router takes: answered through the reply, so the error handler names it
-	* as it names any refusal, and its request line written once the answer has gone. Fastify
-	* calls this `frameworkErrors` and starts no clock for it, so `ms` is 0.
-	*/
 	refusedBeforeRouting = (error, request, reply) => {
 		reply.raw.once("finish", () => this.requestCompleted(null, request, reply));
 		reply.send(error);
 	};
-	/** Words and no event from Fastify, so written here: the `503` and the request's id. */
 	serviceUnavailable(logger) {
 		logger.error({
 			event: "request",
@@ -1176,12 +809,6 @@ function where(request) {
 		route: request.routeOptions.url
 	};
 }
-/**
-* Fastify's options for a server that keeps this log, or none for one that keeps no log —
-* `createApp` given no `log`, which is how a host embedding it keeps its own output (0115).
-* Without one, Fastify answers what it refuses before routing by hand, as it always has; with
-* one, through the reply so the refusal can be written — the same status and the same fields.
-*/
 function serverLogOptions(log) {
 	if (log === void 0) return {};
 	const write = written(log.sink, log.level);
@@ -1192,11 +819,6 @@ function serverLogOptions(log) {
 		frameworkErrors: lines.refusedBeforeRouting
 	};
 }
-/**
-* What a thrown thing is, from what it calls itself: its class, and the first code along its
-* causes — Drizzle wraps PostgreSQL's error, whose SQLSTATE is the useful part. Never its
-* message or its stack, whose first line is the message.
-*/
 function described(error) {
 	if (!(error instanceof Error)) return {};
 	let code;
@@ -1211,7 +833,6 @@ function described(error) {
 		...code === void 0 ? {} : { code }
 	};
 }
-/** `name`, which most errors set; a class that leaves it as `Error` by its constructor. */
 function kindOf(error) {
 	if (error.name !== "Error" && isIdentifier(error.name)) return error.name;
 	const constructed = error.constructor.name;
@@ -1220,10 +841,6 @@ function kindOf(error) {
 function isIdentifier(value) {
 	return typeof value === "string" && /^[A-Za-z_$][\w$]{0,63}$/.test(value);
 }
-/**
-* `ECONNREFUSED`, `22P02`, `FST_ERR_CTP_BODY_TOO_LARGE`: capitals, digits and underscores. The
-* one rule for what a code looks like, which the reply to a 5xx keeps a code by as well (0172).
-*/
 function isCode(value) {
 	return typeof value === "string" && /^[A-Z0-9_]{1,64}$/.test(value);
 }
@@ -1233,21 +850,9 @@ function isStatus(value) {
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null;
 }
-/**
-* The log a worker was given, or one writing its failures to standard error by the same rule:
-* where they went before there was a log, and so where a host that starts a worker without
-* one still finds them.
-*/
 function workerLog(given) {
 	return given ?? createServerLog(process.stderr, "error");
 }
-/**
-* What the database says beside its answers, as lines by the same rule: its SQLSTATE, never
-* its words. postgres.js prints each notice whole to standard output unless it is handed
-* somewhere else to put it, and the bootstrap draws one on every start for each table, column
-* and trigger that already exists. Those are `debug`; a `WARNING` is `warn`. With no log,
-* nowhere.
-*/
 function databaseNotices(log) {
 	return (notice) => {
 		if (log === void 0) return;
@@ -1261,43 +866,6 @@ function databaseNotices(log) {
 }
 //#endregion
 //#region src/error-replies.ts
-/**
-* What an error answers its client with
-* ([0172](../../../docs/decisions/0172-a-5xx-says-nothing-of-what-was-thrown.md)).
-*
-* Fastify answers an error with `{ statusCode, code, error, message }`, the message being the
-* error's own. For an error that names its own 4xx that is a sentence written for the client —
-* the body did not parse, the file is too large — and it stays. For a 5xx it is whatever was
-* thrown: a database error's message is the failing query and its parameters, a disk's names
-* the path it could not write. So a 5xx keeps the shape and says only its status: the status's
-* own name as `error` and as `message`, and a `code` only when the error named its own status —
-* made to be answered, as `RATE_LIMIT_UNAVAILABLE` is (0170) — and only in the shape the log
-* keeps a code in. A fault's code, `ENOSPC` or an SQLSTATE, is the operator's, in the log. And a
-* fault answered under a 4xx — Fastify keeps a status of 400 or more that the reply already had
-* — says only that status too (0175): its words were no more written for the client there.
-*
-* **Two hooks rather than an error handler**, because Fastify writes its line about an error —
-* `request.failed` and `request.refused`, with the error's kind and code (`server-log.ts`) —
-* only from its own default handler. One set with `setErrorHandler` replaces it, and the line
-* would go with it. So the default handler still sets the status and writes the line, and the
-* body is replaced on its way out, in `onSend`, where the status is final. `onError` is how
-* `onSend` knows the body is an error's: a route that answers a 5xx itself — no file store, a
-* scanner that could not be asked — chose its words for the person reading them.
-*
-* **An error's reply is written without a header Node cannot write**
-* ([0175](../../../docs/decisions/0175-a-name-goes-into-a-header-encoded.md)). Node checks a
-* header's value when the reply is written, after the route has answered, and throws. Fastify
-* answers that error with the headers the reply already had, so its own reply failed the same
-* way, and Fastify's last resort — which runs no hook — wrote it with Node's code and sentence,
-* under whatever status the reply had. Dropping the header here is what lets this reply be the
-* one that goes out, because no `onSend` hook runs after this one but Fastify's own on a `HEAD`
-* route, which sets only a length — `error-replies.test.ts` puts such a header on a request to
-* every route and reads each answer. A route's own value is built so it cannot be refused
-* (`header-values.ts`); this is for the one that was not.
-*
-* On the root instance, before any route is registered, so every route and every plugin's
-* context has both. Not tied to the log: an app given none withholds the same words.
-*/
 function withholdServerErrors(app) {
 	const thrown = /* @__PURE__ */ new WeakMap();
 	app.addHook("onError", async (_request, reply, error) => {
@@ -1311,15 +879,9 @@ function withholdServerErrors(app) {
 		return JSON.stringify(withheld(reply.statusCode, error));
 	});
 }
-/** Remove every header Node would refuse to write, by its own checks rather than a copy of them. */
 function dropUnwritable(reply) {
 	for (const [name, value] of Object.entries(reply.getHeaders())) if (!writable(name, value)) reply.removeHeader(name);
 }
-/**
-* A header as Node writes it: a number as its digits, and a list one value at a time. Fastify
-* keeps no header without a value — `reply.header` defaults one to `''` — though `getHeaders`
-* is typed as if it might.
-*/
 function writable(name, value) {
 	try {
 		validateHeaderName(name);
@@ -1329,15 +891,9 @@ function writable(name, value) {
 		return false;
 	}
 }
-/**
-* Whether an error names its own status: made to be answered, by this server or by Fastify, so
-* its code is part of the answer and, below 500, its sentence too. One that names none is a
-* fault from below, whatever status the reply already had when it was thrown.
-*/
 function answerable(error) {
 	return isRecord(error) && (typeof error["statusCode"] === "number" || typeof error["status"] === "number");
 }
-/** Fastify's shape for an error's reply, with nothing in it the thrown error said. */
 function withheld(status, error) {
 	const name = STATUS_CODES[status] ?? "Server Error";
 	const own = isRecord(error) ? error : {};
@@ -1354,26 +910,6 @@ function isRecord(value) {
 }
 //#endregion
 //#region src/nul-characters.ts
-/**
-* A body with a NUL character in it is refused as malformed
-* ([0173](../../../docs/decisions/0173-a-nul-character-names-nothing-and-a-body-with-one-is-refused.md)).
-*
-* PostgreSQL holds no U+0000 in `text`, `22021`, nor in `jsonb`, `22P05`, so a string with one
-* can be kept nowhere this server keeps anything: an answer, a draft, a schema, an example, a
-* file's name or type, an origin, an email, a key's name. Each was a `500` where its route
-* wrote it, and a line at `error`. Refused here, once, on the root instance before any route,
-* so every route and every plugin's context has it and a route added later needs nothing of
-* its own.
-*
-* In `preValidation`, which is after the body is parsed — by whichever parser the request's
-* type chose, so a `text/plain` string is looked at as well as JSON — and before any route's
-* own `preHandler`. That makes it what a body that does not parse is: answered by the body
-* alone, whoever sent it and whatever accounts exist, before a session is asked for. A file's
-* bytes arrive as a `Buffer` and are not looked at; a NUL byte is ordinary in a file.
-*
-* The answer is the route plane's shape for a refusal, with the JSON Pointer (RFC 6901) to the
-* string or the member's name the NUL is in, so a client can say which answer to correct.
-*/
 function refuseNulCharacters(app) {
 	app.addHook("preValidation", async (request, reply) => {
 		const pointer = nulAt(request.body);
@@ -1385,16 +921,6 @@ function refuseNulCharacters(app) {
 		});
 	});
 }
-/**
-* The JSON Pointer to the first string or member name in `body` with a NUL in it, in the order
-* the body was written, or `undefined` when there is none.
-*
-* A loop over a stack of its own rather than a recursion: `JSON.parse` takes a body nested
-* deeper than the call stack goes, and a walk that threw on it would make that body a `500` on
-* every route. And every body is walked, so nothing is built for a value on the way — a step
-* for each container, and the pointer only for the string it finds. Building a pointer for
-* every value made the walk of a body at the cap take longer than parsing it.
-*/
 function nulAt(body) {
 	const values = [body];
 	const containers = [void 0];
@@ -1432,7 +958,6 @@ function nulAt(body) {
 		}
 	}
 }
-/** RFC 6901's spelling of the place `key` names in `container`: '' for the body itself. */
 function pointer(container, key) {
 	const steps = [];
 	for (let at = key === void 0 ? container : {
@@ -1441,11 +966,9 @@ function pointer(container, key) {
 	}; at !== void 0; at = at.up) steps.push(at.key);
 	return steps.reverse().map((step) => `/${typeof step === "number" ? String(step) : token(step)}`).join("");
 }
-/** A member's name as one step of a JSON Pointer: `~` and `/` escaped, as RFC 6901 has them. */
 function token(name) {
 	return name.replaceAll("~", "~0").replaceAll("/", "~1");
 }
-/** What a parser makes of a JSON object, and nothing else — not a `Buffer`, not a stream. */
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const prototype = Object.getPrototypeOf(value);
@@ -1453,24 +976,6 @@ function isPlainObject(value) {
 }
 //#endregion
 //#region src/audit-trail.ts
-/**
-* Append an audit row for something that has already happened.
-*
-* Never throws. An export that succeeded and an audit row that did not is
-* bad; an export that 500s because the audit row failed, after the rows have
-* already been written to the response, is worse and helps nobody. So the
-* failure is written to the log at error level, as `audit.unwritten` with the
-* row's action and the error's kind — never its subject, which for a failed
-* login is the email somebody tried — and the request stands.
-*
-* For a mutation that HAS a transaction, do not use this — pass the entry
-* into that call so the two commit together. A publish, a change to a form's
-* examples and a submission are those: their use-cases build the row, and
-* the route hands them `request.id` so it names the request as this one does.
-*
-* Its own module because what happens when a row cannot be written is the log's
-* business (0168), and `app.ts` had no room for it.
-*/
 function auditTrail(deps) {
 	return async (request, draft) => {
 		const actor = request.actor;
@@ -1493,21 +998,6 @@ function auditTrail(deps) {
 //#endregion
 //#region src/app.ts
 const API_KEY_HEADER = "x-formancy-api-key";
-/**
-* The HTTP surface, split into two planes.
-*
-* PUBLIC — what a person filling a form needs: resolve, submit, drafts. These
-* stay unauthenticated by design; anonymous-submission hardening is its own
-* upcoming step and is opt-in per form.
-*
-* MANAGEMENT — everything an operator does: publish, catalog, submissions,
-* export, users, keys. Authenticated via a session token (login) or an API
-* key header, authorized through server-core's one-table can().
-*
-* This file is the composition root, so THIS is where ambient reality enters:
-* randomUUID, the real clock, argon2 and the CSPRNG. Everything below stays
-* injected and replayable.
-*/
 async function createApp(storage, options) {
 	const app = Fastify({
 		...serverLogOptions(options.log),
@@ -1572,8 +1062,6 @@ async function createApp(storage, options) {
 			return outcome.ok ? outcome.actor : void 0;
 		}
 	}
-	/** 401 without an identity, 403 with one that lacks the permission — the
-	*  difference tells a client whether to log in or to give up. */
 	function requires(action) {
 		return async (request, reply) => {
 			const actor = await actorOf(request);
@@ -1663,14 +1151,6 @@ async function createApp(storage, options) {
 		deps,
 		actorOf
 	});
-	/**
-	* The log itself.
-	*
-	* Admin only, and reading it is NOT audited. A log that records its own
-	* reads grows without bound from a dashboard that polls it, and the entry
-	* would say nothing an access log does not — the events worth recording
-	* are the ones that touch somebody else's data.
-	*/
 	app.get("/audit", { preHandler: requires("user.create") }, async (request, reply) => {
 		const raw = request.query?.limit;
 		const asked = typeof raw === "string" ? Number.parseInt(raw, 10) : 100;
@@ -1701,6 +1181,16 @@ async function createApp(storage, options) {
 		if (versions === void 0) return reply.code(404).send({ error: "unknown_form" });
 		return reply.send({ versions });
 	});
+	app.get("/f/:path/versions/:version", { preHandler: requires("form.read") }, async (request, reply) => {
+		const { path, version } = request.params;
+		const found = await formVersion(deps, path, version);
+		if (!found.ok) return reply.code(404).send({ error: found.kind });
+		return reply.send({
+			version: found.version,
+			schemaHash: found.schemaHash,
+			schema: found.schema
+		});
+	});
 	app.get("/f/:path/submissions", { preHandler: requires("submission.read") }, async (request, reply) => {
 		const { path } = request.params;
 		const listed = await listSubmissions(deps, path);
@@ -1744,16 +1234,6 @@ async function createApp(storage, options) {
 }
 //#endregion
 //#region src/db.ts
-/**
-* The thin slice's tables. Three rules from the design spec are enforced HERE,
-* in the database, because application code can be bypassed and these must not
-* be:
-*
-*  - published versions are immutable (a trigger refuses UPDATE),
-*  - a submission binds to its exact version by real foreign key,
-*  - that key is ON DELETE RESTRICT, so orphaning a submission from the schema
-*    that produced it is structurally impossible.
-*/
 const forms = pgTable("forms", {
 	id: uuid("id").primaryKey(),
 	path: text("path").notNull().unique(),
@@ -1801,11 +1281,6 @@ const webhooks = pgTable("webhooks", {
 	consecutiveFailures: integer("consecutive_failures").notNull().default(0),
 	openedAt: timestamp("opened_at", { withTimezone: true })
 });
-/**
-* The outbox. A row here and the submission that caused it are written by the
-* same transaction, which is what makes "accepted" and "will be delivered" one
-* decision rather than two.
-*/
 const deliveries = pgTable("deliveries", {
 	id: uuid("id").primaryKey(),
 	webhookId: uuid("webhook_id").notNull(),
@@ -1831,23 +1306,12 @@ const auditLog = pgTable("audit_log", {
 	requestId: text("request_id"),
 	detail: jsonb("detail")
 });
-/**
-* A form's examples and the sample they start from, one row per form, beside it and never in
-* a version (0166). The examples change while the form does not, and a version cannot.
-*/
 const formExamples = pgTable("form_examples", {
 	formId: uuid("form_id").primaryKey().references(() => forms.id),
 	scenarios: jsonb("scenarios").notNull(),
 	sample: jsonb("sample"),
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
 });
-/**
-* An audit entry as the table holds it.
-*
-* Absent and null are the same thing here, and the conversion is in one place, beside the
-* table, so the storage's call sites — a publish, a submission, a form's examples — cannot
-* disagree about which they write.
-*/
 function auditRow(entry) {
 	return {
 		id: entry.id,
@@ -1879,31 +1343,12 @@ const submissions = pgTable("submissions", {
 	data: jsonb("data").notNull(),
 	submittedAt: timestamp("submitted_at", { withTimezone: true }).notNull()
 });
-/**
-* Whether `id` can be compared with a `uuid` column: the hyphenated form every id this server
-* mints has. PostgreSQL refuses anything it cannot read as a uuid with an error, `22P02`, where
-* a `text` column — or the in-memory storage — finds no row; so a lookup by an id from a URL
-* that is not one answers no row without asking (0172). A spelling PostgreSQL would also read,
-* braced or without hyphens, names no row either: no id was handed out in one.
-*/
 function isUuid(id) {
 	return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id);
 }
-/**
-* Whether `value` can be compared with a `text` column: PostgreSQL holds no NUL character in
-* text and refuses one with an error, `22021`, where the in-memory storage finds no row. So a
-* lookup by a value with one — a form's path from a URL, an API key's prefix from a header —
-* answers no row without asking, as `isUuid` does for its column (0173). No row was ever
-* written with one, since no write of one ever succeeded.
-*/
 function fitsText(value) {
 	return !value.includes("\0");
 }
-/**
-* Bootstrap DDL for the thin slice — drizzle-kit migrations arrive with the
-* lifecycle work; a self-hosted skeleton that creates its own tables on first
-* start is worth more right now than a migration pipeline.
-*/
 async function bootstrapSchema(sql) {
 	await sql`
     CREATE TABLE IF NOT EXISTS forms (
@@ -2099,13 +1544,6 @@ async function bootstrapSchema(sql) {
 }
 //#endregion
 //#region src/postgres-examples.ts
-/**
-* A form's examples over PostgreSQL: one row per form in `form_examples`, replaced whole
-* (0166).
-*
-* Its own file because it changes for its own reason, and because `postgres-storage.ts`
-* would otherwise have crossed the size budget with it.
-*/
 function examplesStorage(db) {
 	return {
 		async getExamples(formId) {
@@ -2141,15 +1579,6 @@ function examplesStorage(db) {
 }
 //#endregion
 //#region src/postgres-identities.ts
-/**
-* Who may use the management plane, over PostgreSQL: users with a password and API keys, each
-* stored as a hash and looked up by what a request presents — an email, a key's prefix.
-*
-* Its own file because it changes for its own reason — the way somebody is let in, not the
-* forms and responses everything else here stores — and because `postgres-storage.ts` would
-* otherwise have crossed the size budget when its lookups learned to find nothing for a NUL
-* (0173).
-*/
 function identitiesStorage(db) {
 	return {
 		async insertUser(record) {
@@ -2196,7 +1625,6 @@ function identitiesStorage(db) {
 		}
 	};
 }
-/** An API key's row as the port describes it: timestamps as ISO strings. */
 function toApiKeyRecord(row) {
 	return {
 		id: row.id,
@@ -2210,7 +1638,6 @@ function toApiKeyRecord(row) {
 }
 //#endregion
 //#region src/postgres-storage.ts
-/** The Storage port over Postgres — the mirror of server-core's in-memory one. */
 function createPostgresStorage(sql) {
 	const db = drizzle(sql);
 	return {
@@ -2494,7 +1921,6 @@ function toSubmissionRecord(row) {
 		submittedAt: row.submittedAt.toISOString()
 	};
 }
-/** A delivery row as the port describes it. */
 function toDeliveryRecord(row) {
 	return {
 		id: row.id,
@@ -2508,7 +1934,6 @@ function toDeliveryRecord(row) {
 		lastError: row.lastError
 	};
 }
-/** A files row as the port describes it: timestamps as ISO strings. */
 function toFileRecord(row) {
 	return {
 		id: row.id,
@@ -2523,7 +1948,6 @@ function toFileRecord(row) {
 		receivingUntil: row.receivingUntil === null ? null : row.receivingUntil.toISOString()
 	};
 }
-/** A webhook row as the port describes it, health included. */
 function toWebhookRecord(row) {
 	return {
 		id: row.id,
@@ -2534,32 +1958,6 @@ function toWebhookRecord(row) {
 		openedAt: row.openedAt === null ? null : row.openedAt.toISOString()
 	};
 }
-/**
-* `@fastify/rate-limit`'s store over the PostgreSQL every replica already shares (0170).
-*
-* The plugin's own store keeps its counts in the process, so behind N replicas each limit
-* allowed N times what it said. This one keeps them in `rate_limit_counters`, one row per
-* route and client, and counts with one statement: the upsert takes the row's lock, so two
-* replicas counting the same client at once are counted one after the other and neither
-* increment is lost.
-*
-* A window starts at a key's first request and lasts the route's `timeWindow`, as the plugin's
-* own stores do it, on the database's clock — one clock for every replica, where each
-* process's own would end the window at a different moment on each.
-*
-* It opens its own connections from the database's address rather than taking a pool, because
-* which connections it counts on is what keeps a counter that cannot answer from stopping
-* everything else: handed the pool storage queries on, it would count correctly and bring that
-* outage back. A count that does not come back within the bound is abandoned: one still waiting
-* here to be sent is dropped unsent, and one already sent is ended by the database once it runs,
-* by the `statement_timeout` of these connections, with no cancel request — a connection more —
-* needed for it. The error the plugin is handed says nothing about the database, because a route
-* that refuses without a count sends it to whoever asked; what each route does then is its own
-* declaration (`rate-limits.ts`).
-*
-* The plugin's in-memory store is the second implementation of the same interface, and what
-* `createApp` counts in when it is given none.
-*/
 function createPostgresRateLimitStore(databaseUrl, options = {}) {
 	const timeoutMs = options.timeoutMs ?? 1e3;
 	const sweepEveryMs = options.sweepEveryMs ?? 6e5;
@@ -2606,7 +2004,6 @@ function createPostgresRateLimitStore(databaseUrl, options = {}) {
 			else waiting.push(send);
 		});
 	}
-	/** On the back of a count, at most once per interval, one at a time, and never waited for. */
 	function sweep() {
 		const now = Date.now();
 		if (sweeping || running >= 32 || now - sweptAt < sweepEveryMs) return;
@@ -2658,32 +2055,17 @@ function createPostgresRateLimitStore(databaseUrl, options = {}) {
 		end: () => sql.end({ timeout: timeoutMs / 1e3 })
 	};
 }
-/** What a route that refuses without a count answers: a 503, and nothing about the database. */
 function uncounted() {
 	return Object.assign(/* @__PURE__ */ new Error("This request could not be counted against its limit, so it was not taken. Try again in a moment."), {
 		statusCode: 503,
 		code: "RATE_LIMIT_UNAVAILABLE"
 	});
 }
-/**
-* A count not answered within the bound. Its own code, because the log writes an error's kind
-* and code and nothing else: without one, a database too slow to count — a lock on the table, a
-* flood — reads the same as any other failure, and the operator cannot tell which to look for.
-*/
 function late() {
 	return Object.assign(/* @__PURE__ */ new Error("The count was not answered within its bound."), { code: "RATE_LIMIT_TIMEOUT" });
 }
 //#endregion
 //#region src/file-store.ts
-/**
-* Bytes under one directory, one file per key.
-*
-* **Keys are checked, not trusted.** A key is minted by the server from a form
-* id and a file id, so it cannot contain a traversal — but this resolves it
-* and refuses anything landing outside the root regardless. A path check that
-* only runs when the input is untrusted is a path check that stops running the
-* day somebody adds a caller.
-*/
 function createLocalFileStore(root) {
 	const base = resolve(root);
 	const pathFor = (key) => {
@@ -2719,13 +2101,6 @@ function createLocalFileStore(root) {
 		}
 	};
 }
-/**
-* The checksum a receiver can compare against.
-*
-* Returned when the bytes are stored and never asked of the client: a checksum
-* the uploader computed is a checksum the uploader can lie about, so this one
-* is only useful for telling a *later* reader that the bytes have not changed.
-*/
 function sha256(bytes) {
 	return createHash("sha256").update(bytes).digest("hex");
 }
@@ -2767,47 +2142,16 @@ function startFileCollector(storage, store, options = {}) {
 }
 //#endregion
 //#region src/model-settings.ts
-/**
-* Which model the environment names for the builders: none, or a provider, its key and
-* the model.
-*
-* A function of the environment rather than lines in `main.ts`, as `fileStoreSettings` is:
-* the rules are where a deployment goes wrong, and `main.ts` is a composition root no test
-* imports. Constructing the adapter stays in `main.ts`; this only says which
-* ([0165](../../../docs/decisions/0165-a-deployments-model-is-asked-through-its-server.md)).
-*/
 const MODEL_PROVIDERS = [
 	"anthropic",
 	"openai",
 	"xai"
 ];
-/**
-* The variable each provider's SDK reads for headers of its own to add to every request.
-*
-* The adapters name the base URL, the organisation, the project, the credential and the log
-* level rather than leave them to the environment; these headers no option undoes. So a
-* server with a model refuses to start while the variable its provider's SDK reads is set.
-* xAI is asked through OpenAI's client, so it is OpenAI's variable.
-*/
 const SDK_HEADERS_VARIABLE = {
 	anthropic: "ANTHROPIC_CUSTOM_HEADERS",
 	openai: "OPENAI_CUSTOM_HEADERS",
 	xai: "OPENAI_CUSTOM_HEADERS"
 };
-/**
-* Absent — all three unset or blank — is a supported state, and the default: this
-* deployment has no model, the server says so to the admin, and no prompt pane is drawn.
-*
-* Throws on anything in between, so the server refuses to start rather than starting
-* without the model the operator thinks they configured: a key or a model with no
-* provider, a provider formancy has no adapter for, or a provider without its key or
-* its model. Throws too when the environment would add headers to every request the
-* provider's SDK sends. **No provider has a default model.** A model id goes stale when
-* the provider retires it, and then every turn fails as a model that could not be
-* reached, after an upgrade nobody made; and which model runs is what the operator pays
-* for. Neither is this file's to decide. The message never repeats a value, because the
-* key is one.
-*/
 function modelSettings(env) {
 	const provider = setting(env, "FORMANCY_MODEL_PROVIDER");
 	const apiKey = setting(env, "FORMANCY_MODEL_API_KEY");
@@ -2831,46 +2175,15 @@ function modelSettings(env) {
 function isProvider(value) {
 	return MODEL_PROVIDERS.includes(value);
 }
-/** A setting, with the empty string read as unset — compose blanks a variable, it cannot drop one. */
 function setting(env, name) {
 	const value = env[name];
 	return value === void 0 || value.trim() === "" ? void 0 : value;
 }
 //#endregion
 //#region src/anthropic-completer.ts
-/**
-* Where the request goes. Named rather than left to the SDK, which would otherwise take
-* `ANTHROPIC_BASE_URL` from the environment: the deployment view says which host a form is
-* sent to, and an ambient variable could change it without anybody reading this file.
-*/
 const ANTHROPIC_BASE_URL = "https://api.anthropic.com";
-/**
-* The most a turn may write, thinking included.
-*
-* Generous on purpose: an answer is a whole form document, and one cut off at the limit is
-* not an answer at all (`truncated`), so a limit too low wastes the turn it stopped.
-* Streamed, so a long answer is not cut off by the HTTP timeout either. It is the ceiling
-* on what one turn can cost — the operator pays per token written, not per token allowed.
-*/
 const ANTHROPIC_MAX_OUTPUT_TOKENS = 64e3;
-/** What a refused turn says when Anthropic gave no explanation. */
 const DECLINED = "The model service declined this request.";
-/**
-* Claude, through Anthropic's official SDK (0165).
-*
-* One system prompt and one user message, with adaptive thinking — the model decides how
-* much to think — streamed and read with the SDK's final-message helper. **The stop reason
-* is read before the content.** A refusal ends the person's run as a decline, with
-* Anthropic's explanation; an answer stopped at the output limit, or by the context
-* window, is `truncated` and never handed over as the first half of a document. Thinking
-* blocks are not part of the answer.
-*
-* Adaptive thinking needs a model that has it — Claude Opus 4.6, Sonnet 4.6 and later. A
-* model without it is refused by Anthropic with a 400, and every turn ends `unavailable`.
-*
-* The SDK retries what it calls temporary failures (a 429, a 5xx, a dropped connection)
-* twice, by its own default.
-*/
 function createAnthropicCompleter(options) {
 	const client = new Anthropic({
 		apiKey: options.apiKey,
@@ -2908,7 +2221,6 @@ function createAnthropicCompleter(options) {
 		return read$1(message);
 	} };
 }
-/** A finished message, by its stop reason first. */
 function read$1(message) {
 	switch (message.stop_reason) {
 		case "refusal": {
@@ -2936,7 +2248,6 @@ function read$1(message) {
 		};
 	}
 }
-/** An error from the SDK, as a failure: the status when Anthropic answered, the message for the log. */
 function unavailable$1(error) {
 	const status = error instanceof APIError && typeof error.status === "number" ? error.status : void 0;
 	const cause = error instanceof Error ? error.message : String(error);
@@ -2949,41 +2260,10 @@ function unavailable$1(error) {
 }
 //#endregion
 //#region src/openai-completer.ts
-/**
-* Where each provider's requests go. Named rather than left to the SDK, which would take
-* `OPENAI_BASE_URL` from the environment and send every form wherever it pointed.
-*/
 const OPENAI_BASE_URL = "https://api.openai.com/v1";
-/**
-* xAI's API, which xAI documents as compatible with OpenAI's SDKs and their Responses API at
-* this base URL. Taken from xAI's documentation as a web search summarised it on
-* 2026-10-10; the pages themselves refused the fetch, and no test here reaches xAI (0165).
-*/
 const XAI_BASE_URL = "https://api.x.ai/v1";
-/**
-* The most a turn may write, reasoning included — as generous as Anthropic's, and for the
-* same reason: an answer cut off at the limit is not an answer (`truncated`).
-*/
 const OPENAI_MAX_OUTPUT_TOKENS = 64e3;
-/** What a withheld answer says: the provider gives no words of its own for a filter. */
 const FILTERED = "The model service withheld its answer to this request.";
-/**
-* OpenAI's models, or xAI's Grok, through OpenAI's official SDK and the Responses API (0165).
-*
-* The briefing as a system message and the request as a user message, streamed and read
-* with the SDK's final-response helper. `store: false`, so the provider keeps no copy of
-* the form for later retrieval; what it keeps under its own terms is not this adapter's
-* to say. **The response's status is read before its text.** Incomplete at the output
-* limit is `truncated`, never half a document; withheld by the provider's filter, or a
-* refusal in the output, ends the person's run as a decline.
-*
-* The SDK would take an organisation and a project from the environment and send them as
-* headers — to xAI as well — so both are set to nothing here. It would take a log level
-* too, and with OPENAI_LOG=debug write a line for every request and response to the
-* console — a second request log, outside the rule the server's own is built by
-* (SAFETY-ANALYSIS C3) — so the level is set. OPENAI_CUSTOM_HEADERS cannot be undone here, so `modelSettings` refuses to start
-* with it.
-*/
 function createOpenAiCompleter(options) {
 	const client = new OpenAI({
 		apiKey: options.apiKey,
@@ -3024,7 +2304,6 @@ function createOpenAiCompleter(options) {
 		return read(response);
 	} };
 }
-/** A finished response, by its status first. */
 function read(response) {
 	if (response.status === "incomplete") {
 		const reason = response.incomplete_details?.reason;
@@ -3063,7 +2342,6 @@ function read(response) {
 		text: parts.flatMap((part) => part.type === "output_text" ? [part.text] : []).join("")
 	};
 }
-/** An error from the SDK, as a failure: the status when the provider answered, the message for the log. */
 function unavailable(error) {
 	const status = error instanceof APIError$1 && typeof error.status === "number" ? error.status : void 0;
 	const cause = error instanceof Error ? error.message : String(error);
@@ -3076,12 +2354,6 @@ function unavailable(error) {
 }
 //#endregion
 //#region src/completers.ts
-/**
-* The adapter for the provider the operator named (0165): Anthropic through its own SDK,
-* OpenAI and xAI through OpenAI's, at each one's base URL.
-*
-* `fetch` is for the tests, which check where each provider's requests go.
-*/
 function createCompleter(settings, fetch) {
 	const { apiKey, model } = settings;
 	const transport = fetch === void 0 ? {} : { fetch };
@@ -3108,4 +2380,4 @@ function createCompleter(settings, fetch) {
 //#endregion
 export { SUBMISSION_TOKEN_HEADER as _, createLocalFileStore as a, createPostgresStorage as c, LOG_LEVELS as d, createServerLog as f, SCHEMA_HASH_HEADER as g, maxFileBytesFrom as h, startFileCollector as i, bootstrapSchema as l, workerLog as m, MODEL_PROVIDERS as n, sha256 as o, databaseNotices as p, modelSettings as r, createPostgresRateLimitStore as s, createCompleter as t, createApp as u };
 
-//# sourceMappingURL=completers-C-E2b7Jm.mjs.map
+//# sourceMappingURL=completers-CQQDS4qr.mjs.map