@formancy/server 0.7.0 → 0.8.0

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/model-settings.ts","../src/routes/model.ts","../src/file-store.ts","../src/server-log.ts","../src/headers.ts","../src/app.ts","../src/postgres-storage.ts","../src/postgres-rate-limits.ts","../src/db.ts","../src/file-collector.ts","../src/completers.ts"],"mappings":";;;;;;;;;;;;;;;qBASa;;KAGD,wBAAwB;KAExB;WACG;;WAEA;WACA,UAAU;WACV;WACA;;KAGV,cAAc,SAAS;;;;;;;;;;;;;;;wBA8BZ,cAAc,KAAK,cAAc;;;;UCrChC;WACN,UAAU;WACV;WACA,WAAW;;;;;;;;;;;;;;;;;;UCCL;;EAEf,IAAI,aAAa,OAAO,SAAS;;EAEjC,KAAK,cAAc,QAAQ;;EAE3B,OAAO,cAAc;;EAErB,OAAO,cAAc;;;;;;;;;;;wBAYP,qBAAqB,eAAe;;;;;;;;wBA0DpC,OAAO,OAAO;;;;;;;;;;;;;;;;;;;;;;cCzEjB;KACD,mBAAmB;;UAKd;EACf,MAAM;;;UAIS;WACN,MAAM;WACN,OAAO;;;KAoRN,YAAY,KAAK;;;;;;;;;;;qBClThB;;;;;qBASA;;;UCgCI;;EAEf;;;;;;EAMA;IAAmB;IAAe;;;;;;;;;;;EAUlC;;;;;;;;;;;;;;EAcA,iBAAiB;;;;;EAKjB;IAAwB;IAAa;;;;EAGrC,iBAAiB;;EAEjB;IAAmB;IAAa;;;;;;;;EAOhC;;;;;;EAMA;;;;;;;EAOA,YAAY;;;;;;;EAOZ;;EAEA,UAAU;;;;;;EAMV,QAAQ;;EAER;IAAmB;IAAa;;;;;;;EAMhC,MAAM;;;;;;;;;;;;;;;;;wBAkBc,UAAU,SAAS,SAAS,SAAS,aAAa,QAAQ;;;;wBC9IhE,sBAAsB,KAAK,SAAS,MAAM;;;UC2BzC;;WAEN;;WAEA;;;;;;;;WAQA,MAAM;;;UAIA;;WAEN,OAAO;;WAEP,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6BN,6BACd,qBACA,UAAS,2BACR;;;;;;;;wBC8GmB,gBAAgB,KAAK,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;;UC5KzC;EACf;;wBAGc,mBACd,SAAS,SACT,OAAO,WACP;EAAW;EAAqB;EAAqB,MAAM;IAC1D;;;;;;;;;wBCxBa,gBACd,UAAU,QAAQ;EAAiB;IACnC,SAAS,gBAAgB,MAAM,SAAS,OAAO,gBAAgB,QAAQ,YACtE"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/model-settings.ts","../src/routes/model.ts","../src/file-store.ts","../src/server-log.ts","../src/headers.ts","../src/app.ts","../src/postgres-storage.ts","../src/postgres-rate-limits.ts","../src/db.ts","../src/file-collector.ts","../src/completers.ts"],"mappings":";;;;;;;;;;;;;;;qBASa;;KAGD,wBAAwB;KAExB;WACG;;WAEA;WACA,UAAU;WACV;WACA;;KAGV,cAAc,SAAS;;;;;;;;;;;;;;;wBA8BZ,cAAc,KAAK,cAAc;;;;UCrChC;WACN,UAAU;WACV;WACA,WAAW;;;;;;;;;;;;;;;;;;UCCL;;EAEf,IAAI,aAAa,OAAO,SAAS;;EAEjC,KAAK,cAAc,QAAQ;;EAE3B,OAAO,cAAc;;EAErB,OAAO,cAAc;;;;;;;;;;;wBAYP,qBAAqB,eAAe;;;;;;;;wBA0DpC,OAAO,OAAO;;;;;;;;;;;;;;;;;;;;;;cCzEjB;KACD,mBAAmB;;UAKd;EACf,MAAM;;;UAIS;WACN,MAAM;WACN,OAAO;;;KAoRN,YAAY,KAAK;;;;;;;;;;;qBClThB;;;;;qBASA;;;UCiCI;;EAEf;;;;;;EAMA;IAAmB;IAAe;;;;;;;;;;;EAUlC;;;;;;;;;;;;;;EAcA,iBAAiB;;;;;EAKjB;IAAwB;IAAa;;;;EAGrC,iBAAiB;;EAEjB;IAAmB;IAAa;;;;;;;;EAOhC;;;;;;EAMA;;;;;;;EAOA,YAAY;;;;;;;EAOZ;;EAEA,UAAU;;;;;;EAMV,QAAQ;;EAER;IAAmB;IAAa;;;;;;;EAMhC,MAAM;;;;;;;;;;;;;;;;;wBAkBc,UAAU,SAAS,SAAS,SAAS,aAAa,QAAQ;;;;wBC/IhE,sBAAsB,KAAK,SAAS,MAAM;;;UC2BzC;;WAEN;;WAEA;;;;;;;;WAQA,MAAM;;;UAIA;;WAEN,OAAO;;WAEP,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;wBA6BN,6BACd,qBACA,UAAS,2BACR;;;;;;;;wBC8GmB,gBAAgB,KAAK,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;;UC5KzC;EACf;;wBAGc,mBACd,SAAS,SACT,OAAO,WACP;EAAW;EAAqB;EAAqB,MAAM;IAC1D;;;;;;;;;wBCxBa,gBACd,UAAU,QAAQ;EAAiB;IACnC,SAAS,gBAAgB,MAAM,SAAS,OAAO,gBAAgB,QAAQ,YACtE"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { _ as SUBMISSION_TOKEN_HEADER, a as createLocalFileStore, c as createPostgresStorage, g as SCHEMA_HASH_HEADER, i as startFileCollector, l as bootstrapSchema, n as MODEL_PROVIDERS, o as sha256, r as modelSettings, s as createPostgresRateLimitStore, t as createCompleter, u as createApp } from "./completers-C-E2b7Jm.mjs";
+import { _ as SUBMISSION_TOKEN_HEADER, a as createLocalFileStore, c as createPostgresStorage, g as SCHEMA_HASH_HEADER, i as startFileCollector, l as bootstrapSchema, n as MODEL_PROVIDERS, o as sha256, r as modelSettings, s as createPostgresRateLimitStore, t as createCompleter, u as createApp } from "./completers-CQQDS4qr.mjs";
 export { MODEL_PROVIDERS, SCHEMA_HASH_HEADER, SUBMISSION_TOKEN_HEADER, bootstrapSchema, createApp, createCompleter, createLocalFileStore, createPostgresRateLimitStore, createPostgresStorage, modelSettings, sha256, startFileCollector };

package/dist/main.mjs

@@ -1,4 +1,4 @@
-import { a as createLocalFileStore, c as createPostgresStorage, d as LOG_LEVELS, f as createServerLog, h as maxFileBytesFrom, i as startFileCollector, l as bootstrapSchema, m as workerLog, p as databaseNotices, r as modelSettings, s as createPostgresRateLimitStore, t as createCompleter, u as createApp } from "./completers-C-E2b7Jm.mjs";
+import { a as createLocalFileStore, c as createPostgresStorage, d as LOG_LEVELS, f as createServerLog, h as maxFileBytesFrom, i as startFileCollector, l as bootstrapSchema, m as workerLog, p as databaseNotices, r as modelSettings, s as createPostgresRateLimitStore, t as createCompleter, u as createApp } from "./completers-CQQDS4qr.mjs";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { deliveryHeaders, drainOutbox, isIpLiteral, isPrivateAddress } from "@formancy/server-core";
 import postgres from "postgres";
@@ -7,12 +7,6 @@ import { Agent, fetch as fetch$1 } from "undici";
 import { Readable } from "node:stream";
 import { connect, isIP } from "node:net";
 //#region src/webhook-url.ts
-/**
-* What is wrong with this webhook URL, or undefined when nothing is.
-*
-* Checked when the URL is saved, so an author finds out immediately rather
-* than through a delivery that silently never works.
-*/
 function webhookUrlProblem(raw, options = {}) {
 	let url;
 	try {
@@ -112,7 +106,6 @@ async function deliver(input, options = {}) {
 		await agent.close();
 	}
 }
-/** Consume at most `cap` bytes so the connection can be reused, then stop. */
 async function drain(response, cap) {
 	const reader = response.body?.getReader();
 	if (reader === void 0) return;
@@ -201,28 +194,7 @@ function startChallengeSweeper(storage, options = {}) {
 }
 //#endregion
 //#region src/sigv4.ts
-/**
-* AWS Signature Version 4, for the four requests an object store needs.
-*
-* Ours rather than an SDK: sixty lines against a frozen specification, with the
-* algorithm's own vocabulary in the names so it can be read beside AWS's description of
-* it. It signs requests for **any** S3-compatible endpoint, so Garage, real S3 and
-* Backblaze take the same code path
-* ([0064](../../../docs/decisions/0064-an-object-store-behind-the-same-interface.md)).
-*
-* **What verifies it is a real S3 implementation in a container**, refusing a wrong
-* signature with a 403. The unit tests pin the mechanical properties; they cannot tell
-* whether the canonical request is *right*, only that it is consistent with itself.
-*/
-/** The SHA-256 of an empty body, which a GET or DELETE carries. */
 const EMPTY_PAYLOAD_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-/**
-* The headers to send, including `authorization`.
-*
-* Returns headers rather than mutating a request so that the caller's `fetch`
-* options stay the caller's business, and so the signature is inspectable in a
-* test without a server.
-*/
 function signRequest(args) {
 	const { method, url, payloadHash, service, region, accessKeyId, secretAccessKey, now } = args;
 	const headers = {};
@@ -253,44 +225,20 @@ function signRequest(args) {
 	headers["authorization"] = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${hmac(hmac(hmac(hmac(hmac(`AWS4${secretAccessKey}`, dateStamp), region), service), "aws4_request"), stringToSign).toString("hex")}`;
 	return headers;
 }
-/**
-* `20150830T123600Z` — basic ISO 8601, not the extended form.
-*
-* `toISOString()` gives `2015-08-30T12:36:00.000Z`, which is rejected. Stripping
-* the punctuation is the whole conversion, and the credential scope then wants
-* the same instant as `20150830`, which is why this returns the long one and the
-* caller slices it.
-*/
 function basicIso8601(at) {
 	return `${at.toISOString().replace(/[-:]/g, "").split(".")[0] ?? ""}Z`;
 }
-/**
-* The path, encoded **once** for s3 and twice for everything else.
-*
-* This is the one place where s3 departs from the general rule, and getting it
-* wrong produces a signature that is valid for every other AWS service and
-* refused by the only one we call -- and refused only for keys containing a
-* character that needs encoding, which is the worst possible way to find out.
-*/
 function canonicalPath(url, service) {
 	const once = url.pathname === "" ? "/" : url.pathname;
 	if (service === "s3") return once;
 	return once.split("/").map((segment) => uriEncode(decodeURIComponent(segment))).join("/");
 }
-/** Sorted by encoded name, values encoded, `=` even when empty. */
 function canonicalQuery(url) {
 	const pairs = [];
 	for (const [name, value] of url.searchParams) pairs.push([uriEncode(name), uriEncode(value)]);
 	pairs.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
 	return pairs.map(([name, value]) => `${name}=${value}`).join("&");
 }
-/**
-* AWS's `UriEncode`, which is not `encodeURIComponent`.
-*
-* The differences are small and each one is a 403: `!`, `'`, `(`, `)` and `*`
-* are left alone by `encodeURIComponent` and must be encoded, hex digits must be
-* uppercase, and a space is `%20` rather than `+`.
-*/
 function uriEncode(value) {
 	return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
 }
@@ -305,40 +253,11 @@ function hmac(key, data) {
 function createS3FileStore(config) {
 	const endpoint = config.endpoint.replace(/\/+$/, "");
 	const timeoutMs = config.timeoutMs ?? 3e4;
-	/**
-	* The object's URL, with the key's slashes kept and everything else encoded.
-	*
-	* A key is a path inside the bucket, so its separators are structural. Every
-	* other character has to be encoded or the request line is invalid -- and a
-	* space encoded as `+`, which is what form encoding would do, names a
-	* different object.
-	*/
 	const urlFor = (key) => {
 		if (key === "" || key.includes("\\") || key.split("/").includes("..")) throw new Error(`Refusing a storage key that could address another bucket: ${key}`);
 		const path = key.split("/").map(encodeSegment).join("/");
 		return new URL(`${endpoint}/${encodeSegment(config.bucket)}/${path}`);
 	};
-	/**
-	* One request, and the clock that abandons it.
-	*
-	* **The clock measures how long the store keeps us waiting.** It starts when the
-	* request is sent and stops when the headers arrive -- which, for a PUT, is after
-	* the whole body has gone. It starts again at once, because the store now owes the
-	* body, stops when a chunk arrives, and starts again only when the caller asks for
-	* the next one -- so a chunk the caller is still holding costs the store nothing.
-	*
-	* **Not `AbortSignal.timeout`, which is what this replaced.** That bounds the whole
-	* exchange, body included, so a download still streaming when it ran out was cut
-	* off mid-file however steadily it was arriving. And how long a download streams
-	* is set by the person downloading it more than by the store: backpressure carries
-	* a slow connection all the way back to this socket, so a bound on the whole
-	* request was a bound on the downloader's bandwidth.
-	*
-	* The clock restarts at the headers rather than at the first read so that a body
-	* nobody reads -- the error document on a path that throws -- is still abandoned
-	* after `timeoutMs`, rather than holding its connection for however long something
-	* else takes to close it.
-	*/
 	const send = async (method, key, body) => {
 		const url = urlFor(key);
 		const payloadHash = body === void 0 ? EMPTY_PAYLOAD_SHA256 : createHash("sha256").update(body).digest("hex");
@@ -378,20 +297,6 @@ function createS3FileStore(config) {
 			body: timed(response.body, waiting)
 		};
 	};
-	/**
-	* A status that means "there is no such object", as opposed to one that means
-	* the store could not answer.
-	*
-	* The distinction is the whole reason this is a named function. Reading a
-	* could-not-answer as absence makes the collector delete the row for bytes that
-	* still exist and makes a download return nothing for a file the person can see
-	* listed.
-	*
-	* **404 only, and 403 deliberately not.** S3 answers 403 for an object a caller may
-	* not list, but this caller owns the bucket -- so 403 means the credentials are
-	* wrong, and reading that as absence would make a misconfigured deployment look like
-	* one where every file has vanished and have the collector delete every row.
-	*/
 	const isAbsent = (response) => response.status === 404;
 	const failed = (method, key, response) => /* @__PURE__ */ new Error(`S3 ${method} of ${key} failed: ${String(response.status)} ${response.statusText}`);
 	return {
@@ -427,16 +332,6 @@ function createS3FileStore(config) {
 		}
 	};
 }
-/**
-* A clock for one request: started while the store owes something, stopped while it
-* does not, and aborting the request if it ever runs out. `owed` names what the
-* store failed to send, for the error that says so.
-*
-* Unref'd, as `AbortSignal.timeout` was: a deadline is not work. One is left running
-* under every body nobody reads, and a referenced timer would hold the process it
-* lives in for up to `timeoutMs` after everything else had finished. It still fires
-* when it matters: a request still in flight holds the process up by its connection.
-*/
 function clock(timeoutMs, request) {
 	const controller = new AbortController();
 	let timer;
@@ -454,12 +349,6 @@ function clock(timeoutMs, request) {
 		stop
 	};
 }
-/**
-* A body chunk by chunk, with the clock running only while the next chunk is awaited.
-*
-* An abort after the headers errors the body with the clock's reason, so a body the
-* clock ran out on fails rather than ending early and looking complete.
-*/
 async function* timed(stream, waiting) {
 	try {
 		for await (const chunk of stream) {
@@ -471,36 +360,15 @@ async function* timed(stream, waiting) {
 		waiting.stop();
 	}
 }
-/** Reads a body to its end and drops it, which hands the connection back to the pool. */
 async function discard(body) {
 	if (body === null) return;
 	for await (const _chunk of body);
 }
-/**
-* AWS's `UriEncode` for one path segment.
-*
-* `encodeURIComponent` leaves `!'()*` alone and S3 wants them encoded, and its
-* hex digits are already uppercase. Duplicated from the signer rather than
-* shared, because the signer's copy is about hashing and this one is about the
-* request line: if they ever need to differ, they differ, and a shared helper
-* would make that a conversation instead of an edit.
-*/
 function encodeSegment(value) {
 	return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
 }
 //#endregion
 //#region src/file-store-settings.ts
-/**
-* Absent — or empty, see `setting` — means this deployment accepts no files,
-* and that is a supported state rather than a misconfiguration: a form with a
-* file field still renders and still submits, and the field says plainly that
-* there is nowhere to put one. Turning uploads on is naming a directory, which
-* in a container is naming a volume — and a volume is the one thing a
-* self-hoster has to think about, so it is not defaulted here.
-*
-* Throws on a configuration that names two stores, or an object store without
-* everything it needs, so the server refuses to start rather than serving one.
-*/
 function fileStoreSettings(env) {
 	const directory = setting(env, "FORMANCY_FILES_DIR");
 	const endpoint = setting(env, "FORMANCY_S3_ENDPOINT");
@@ -527,57 +395,14 @@ function fileStoreSettings(env) {
 		directory
 	};
 }
-/**
-* A setting, with the empty string read as unset.
-*
-* Because compose cannot remove a variable, only blank it. Both compose files
-* point FORMANCY_FILES_DIR at their volume, and `.env` switching to the object
-* store does so by setting it to `""` — which, read as a directory, is two
-* stores and a server that refuses to start. Read as a path it is no better:
-* `createLocalFileStore('')` resolves to the working directory, which switches
-* uploads on in a directory nobody chose — in the published image, `/app`,
-* which its user cannot write.
-*/
 function setting(env, name) {
 	const value = env[name];
 	return value === "" ? void 0 : value;
 }
 //#endregion
 //#region src/clamd-scanner.ts
-/** How much is sent per INSTREAM chunk. clamd takes chunks of any size up to its stream limit. */
 const CHUNK = 65536;
-/**
-* clamd's own default `StreamMaxLength`, 100 MiB — as the `clamd.conf` ClamAV 1.5.4 ships
-* says, and as measured against it: a 90 MiB stream was answered, a 110 MiB one refused.
-*/
 const CLAMD_DEFAULT_MAX_BYTES = 104857600;
-/**
-* ClamAV's daemon, asked over its INSTREAM command
-* ([0131](../../../docs/decisions/0131-an-upload-is-scanned-before-it-is-kept.md)).
-*
-* The protocol is clamd's own and small enough to speak directly — the command, the bytes in
-* length-prefixed chunks, a zero-length chunk to end them, and one line back — so this adds
-* no dependency to the server. Its tests run against a stand-in that speaks the protocol as
-* clamd's manual describes it; it was run once against ClamAV 1.5.4 itself, and the
-* documentation says what that showed and what it did not.
-*
-* **Only `stream: OK` is clean.** A finding is refused by its name. A file over clamd's size
-* limit is refused too, because sending it again changes nothing. Anything else — an answer
-* this does not understand, no answer, no daemon — rejects, which the use-case reads as a
-* scanner that cannot be asked, and refuses the file for.
-*
-* **`maxBytes` is clamd's `StreamMaxLength`, and is checked before a byte is sent.** Past
-* it, clamd says so and closes the connection while bytes may still be arriving. Against the
-* stand-in the bytes in flight reset it and the answer was lost to `ECONNRESET`, which reads
-* as a scanner that is down and would tell the person to try again forever; the real clamd
-* measured here answered intact. Checked first, the outcome does not depend on which.
-* Set it to what clamd is configured with.
-*
-* **`timeoutMs` is for silence, not for the whole scan.** It is the socket's idle timeout,
-* restarted by any traffic on the connection, so it abandons a clamd that has stopped
-* answering and not a scan that is still moving. Nothing here bounds how long a scan takes,
-* which is why the lease a request holds a file under can be outlasted (0153).
-*/
 function createClamdScanner({ host, port, maxBytes = CLAMD_DEFAULT_MAX_BYTES, timeoutMs = 3e4 }) {
 	return { scan: (_file, bytes) => new Promise((resolve, reject) => {
 		if (bytes.byteLength > maxBytes) {
@@ -636,36 +461,6 @@ function verdictOf(reply) {
 //#endregion
 //#region src/trust-proxy.ts
 const WHAT_TO_WRITE = "Write the address of the reverse proxy in front of this server, e.g. 10.0.0.2, or a comma-separated list of addresses and CIDR ranges, e.g. 10.0.0.2,172.18.0.0/16 — or leave it unset to trust no proxy.";
-/**
-* The proxies whose `X-Forwarded-For` this server believes, read from
-* `FORMANCY_TRUST_PROXY`.
-*
-* Every limit on the public plane counts the client's address. Behind a reverse
-* proxy the socket's address is the proxy's, so trusting nothing gives every
-* respondent one shared budget; trusting the wrong thing lets a client write its
-* own `X-Forwarded-For` and choose a fresh budget per request. So the setting
-* names the proxies, and only addresses and ranges:
-*
-* - **No hop count.** Fastify's option takes a number, and the Fastify this
-*   server depends on treats one as "trust nothing", because a count cannot
-*   tell the proxy from a client that connects directly. Accepting it here
-*   would be a setting that reads as configured and does nothing;
-*   `trust-proxy.test.ts` checks that Fastify still ignores one.
-* - **No `true`,** which Fastify also takes, and which believes anybody.
-* - **No names,** such as `uniquelocal`, which Fastify's `proxy-addr` expands
-*   into ranges nobody reading the setting can see — that one is every private
-*   address, a Docker network's gateway with it, and the gateway is where
-*   Docker hands published-port connections over from. Refused by the address
-*   check below, as a hostname is.
-*
-* Decision 0156 has the reasoning, and what was measured against Docker.
-*
-* Absent or empty returns undefined, which trusts nothing — the behaviour before
-* this setting existed, and the right one with no proxy in front. Anything else
-* that is not an address or a range is refused here, with a sentence saying what
-* to write, rather than left to Fastify's parser, whose TypeError names neither
-* the variable nor the fix.
-*/
 function trustProxyFrom(value) {
 	if (value === void 0 || value.trim() === "") return void 0;
 	const trimmed = value.trim();
@@ -675,14 +470,6 @@ function trustProxyFrom(value) {
 	for (const entry of entries) if (!isAddressOrRange(entry)) throw new Error(`FORMANCY_TRUST_PROXY has "${entry}", which is not an IP address or a CIDR range. ${WHAT_TO_WRITE}`);
 	return entries;
 }
-/**
-* An address, or an address with a prefix length its family allows.
-*
-* A zero prefix is refused, as Fastify's parser refuses it: `/0` is every
-* address, which is `true` spelled differently. A netmask after the slash is
-* refused too, though Fastify reads one — a second spelling of the same thing
-* is a second thing to get wrong, and a prefix length says it.
-*/
 function isAddressOrRange(entry) {
 	const slash = entry.indexOf("/");
 	if (slash === -1) return isIP(entry) !== 0;
@@ -694,18 +481,6 @@ function isAddressOrRange(entry) {
 }
 //#endregion
 //#region src/log-settings.ts
-/**
-* How much the server logs, read from `FORMANCY_LOG_LEVEL`
-* ([0168](../../../docs/decisions/0168-the-log-is-built-from-a-list-of-fields.md)).
-*
-* Unset or empty is `info`: a line per request and per error. The log is on unless somebody
-* turns it off, because off is the state this setting replaced, where nothing said why a
-* request failed. `off` keeps no log at all; anything else that is not one of pino's level
-* names, spelled as pino spells them, stops the server at startup — a server that started
-* anyway would log at a level nobody chose, or not at all while its operator believed it
-* did. Its own module because `main.ts` connects to a database when it is imported, so
-* nothing in it can be tested.
-*/
 function logLevelFrom(env) {
 	const value = env["FORMANCY_LOG_LEVEL"]?.trim() ?? "";
 	if (value === "") return "info";
@@ -717,28 +492,12 @@ function logLevelFrom(env) {
 //#endregion
 //#region src/main.ts
 process.env["RECHECK_BACKEND"] ??= "pure";
-/**
-* The runnable server: `node dist/main.mjs` with DATABASE_URL set, or
-* `docker compose up` from the repo root, which supplies both.
-*
-* Bootstraps its own tables on start — a self-hosted skeleton that works five
-* minutes after `git clone` is the adoption funnel; migrations arrive with the
-* lifecycle work.
-*/
 const databaseUrl = process.env["DATABASE_URL"];
 if (databaseUrl === void 0 || databaseUrl === "") {
 	console.error("DATABASE_URL is required, e.g. postgres://formancy:formancy@localhost:5432/formancy");
 	process.exit(1);
 }
 const port = Number(process.env["PORT"] ?? 4380);
-/**
-* The server's log, on standard output: a JSON line per request and per error, each built
-* from a list of fields, so no body, header, query string, answer or credential has anywhere
-* to go (0168). `info` unless `FORMANCY_LOG_LEVEL` says otherwise; `off` keeps none, and a
-* level the server does not have stops it here. Read first, so the database's notices on the
-* first connection go through it too rather than being printed whole by the driver, and so
-* does the rate limits' counter, which is made before the app whose log it would otherwise use.
-*/
 const logLevel = logLevelFrom(process.env);
 const log = logLevel === "off" ? void 0 : createServerLog(process.stdout, logLevel);
 const sql = postgres(databaseUrl, { onnotice: databaseNotices(log) });
@@ -749,20 +508,9 @@ if (authSecret === void 0 || authSecret === "") {
 }
 const adminEmail = process.env["FORMANCY_ADMIN_EMAIL"];
 const adminPassword = process.env["FORMANCY_ADMIN_PASSWORD"];
-/** Where uploaded bytes go: the rules are in `fileStoreSettings`, which throws. */
 const storeSettings = fileStoreSettings(process.env);
 const fileStore = storeSettings.kind === "s3" ? createS3FileStore(storeSettings.config) : storeSettings.kind === "local" ? createLocalFileStore(storeSettings.directory) : void 0;
 const maxFileBytes = maxFileBytesFrom(process.env);
-/**
-* A ClamAV daemon to ask about every upload before its bytes are kept.
-*
-* Unset is a supported state: no file is scanned, which the documentation says. Set, a
-* file is kept only once clamd has called it clean, and refused when clamd cannot be
-* reached — the point of configuring a scanner is that nothing unscanned gets in
-* ([0131](../../../docs/decisions/0131-an-upload-is-scanned-before-it-is-kept.md)).
-* Not checked at startup: clamd takes minutes to load its signatures, and a server that
-* refused to start until then would turn a slow scanner into an outage of everything.
-*/
 const clamdHost = process.env["FORMANCY_CLAMD_HOST"];
 const clamdPort = Number(process.env["FORMANCY_CLAMD_PORT"] ?? 3310);
 const clamdMaxBytes = Number(process.env["FORMANCY_CLAMD_MAX_BYTES"] ?? 104857600);
@@ -773,37 +521,9 @@ const scanner = clamdHost === void 0 || clamdHost === "" ? void 0 : createClamdS
 	port: clamdPort,
 	maxBytes: clamdMaxBytes
 });
-/**
-* Turns the proof-of-work challenge on for anonymous submissions.
-*
-* Unset is a supported state rather than a misconfiguration: a deployment
-* whose forms all require a session has no anonymous surface to protect, and
-* the challenge route says so with a 404 rather than failing. A deployment
-* with public forms should set it — the other layers are rate limits, an
-* origin allowlist and a body cap, all of which an attacker with a few
-* addresses walks past.
-*
-* Separate from FORMANCY_AUTH_SECRET so that rotating one does not invalidate
-* the other: rotating this one costs an unsolved puzzle, rotating that one
-* costs everybody their session.
-*/
 const challengeSecret = process.env["FORMANCY_CHALLENGE_SECRET"];
 if (challengeSecret !== void 0 && challengeSecret.length < 32) throw new Error("FORMANCY_CHALLENGE_SECRET must be at least 32 characters, or unset.");
-/**
-* The reverse proxies whose X-Forwarded-For names the client. Unset trusts none,
-* which is right with nothing in front and wrong behind a proxy: every
-* respondent would share its one rate-limit budget. Refused at startup when it
-* is not addresses and ranges, since a server that started anyway would count
-* the wrong client and nothing would say so.
-*/
 const trustProxy = trustProxyFrom(process.env["FORMANCY_TRUST_PROXY"]);
-/**
-* The model the builders ask through this server, with its key kept here rather than in a
-* browser (0165). Unset is a supported state and the default: no model, no prompt pane in
-* the admin, and no form sent anywhere. Half a configuration — a key with no provider, a
-* provider with no model — is refused here, because a server that started anyway would
-* have no model while the operator believed it had one. The key is never logged.
-*/
 const modelChoice = modelSettings(process.env);
 const model = modelChoice.kind === "none" ? void 0 : {
 	provider: modelChoice.provider,