create-safest-tools 0.2.0

package/template/src/configuration-registry.ts

@@ -0,0 +1,550 @@
+import { canonicalJson } from "./audit";
+import { sha256 } from "./report-crypto";
+import { ApiError } from "./report-http";
+import type { OperatorSession } from "./report-types";
+import { parseRoutingCriteria } from "./report-queue-validation";
+import { assertMappedFieldsAllowed } from "./component-executor";
+import type { JsonValue } from "./workflow-platform-types";
+import { evaluateHardSafeguards, routingCriteriaMatches, type RoutingInput } from "./report-routing";
+
+export type ConfigurationType = "form" | "policy" | "template" | "routing_rules";
+
+interface ValidationIssue { code: string; path?: string; message: string }
+export interface ConfigurationValidation { valid: boolean; errors: ValidationIssue[]; warnings: ValidationIssue[] }
+
+const keyPattern = /^[a-z][a-z0-9-]{1,79}$/u;
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,99}$/u;
+const answerKeyPattern = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/u;
+
+function now(): string { return new Date().toISOString(); }
+
+function object(value: unknown, code = "configuration_content_invalid"): Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new ApiError(400, code, "Configuration content must be an object.");
+  return value as Record<string, unknown>;
+}
+
+function issue(code: string, message: string, path?: string): ValidationIssue {
+  return { code, message, ...(path ? { path } : {}) };
+}
+
+function stringValue(value: unknown, minimum: number, maximum: number): boolean {
+  return typeof value === "string" && value.trim().length >= minimum && value.length <= maximum;
+}
+
+function stringList(value: unknown, maximum = 100): value is string[] {
+  return Array.isArray(value) && value.length <= maximum
+    && value.every((entry) => typeof entry === "string" && identifierPattern.test(entry))
+    && new Set(value).size === value.length;
+}
+
+function intakeEnrichmentEntries(content: Record<string, unknown>): Array<{ componentVersionId: string; inputMapping: Record<string, JsonValue> }> {
+  const result: Array<{ componentVersionId: string; inputMapping: Record<string, JsonValue> }> = [];
+  if (Array.isArray(content.intake_enrichments)) {
+    for (const entry of content.intake_enrichments) {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+      const value = entry as Record<string, unknown>;
+      if (typeof value.component_version_id === "string" && value.input_mapping && typeof value.input_mapping === "object" && !Array.isArray(value.input_mapping)) {
+        result.push({ componentVersionId: value.component_version_id, inputMapping: value.input_mapping as Record<string, JsonValue> });
+      }
+    }
+  }
+  return result;
+}
+
+interface RoutingFixtureResult {
+  name: string;
+  passed: boolean;
+  selectedQueueId: string;
+  expectedQueueId: string;
+  safeguardRequired: boolean;
+  matchedRuleIds: string[];
+}
+
+function routingFixtureResult(content: Record<string, unknown>, fixtureValue: unknown, index: number): RoutingFixtureResult {
+  const fixture = object(fixtureValue, "routing_fixture_invalid");
+  if (Object.keys(fixture).some((field) => !["name", "input", "expected"].includes(field))) throw new Error("Fixture contains an unsupported field.");
+  if (!stringValue(fixture.name, 2, 120)) throw new Error("Fixture name must contain 2 to 120 characters.");
+  const input = object(fixture.input, "routing_fixture_input_invalid");
+  if (Object.keys(input).some((field) => !["reason_code", "source", "target_type", "trusted_facts", "answers", "enrichments", "priority"].includes(field))) throw new Error("Fixture input contains an unsupported field.");
+  if (typeof input.reason_code !== "string" || !identifierPattern.test(input.reason_code)
+    || typeof input.source !== "string" || !identifierPattern.test(input.source)
+    || typeof input.target_type !== "string" || !identifierPattern.test(input.target_type)) throw new Error("Fixture input requires valid reason_code, source, and target_type values.");
+  const trustedFacts = object(input.trusted_facts ?? {}, "routing_fixture_input_invalid");
+  if (Object.values(trustedFacts).some((value) => value !== null && !["string", "number", "boolean"].includes(typeof value))) throw new Error("Fixture trusted facts must be scalar JSON values.");
+  const answers = object(input.answers ?? {}, "routing_fixture_input_invalid");
+  const enrichments = object(input.enrichments ?? {}, "routing_fixture_input_invalid");
+  if (new TextEncoder().encode(canonicalJson({ trustedFacts, answers, enrichments })).byteLength > 65_536) throw new Error("Fixture input exceeds the 64 KiB limit.");
+  if (input.priority !== undefined && (!Number.isInteger(input.priority) || Number(input.priority) < 0 || Number(input.priority) > 100_000)) throw new Error("Fixture priority is invalid.");
+  const expected = object(fixture.expected, "routing_fixture_expected_invalid");
+  if (Object.keys(expected).some((field) => !["queue_id", "safeguard_required", "matched_rule_ids"].includes(field))) throw new Error("Fixture expectation contains an unsupported field.");
+  if (typeof expected.queue_id !== "string" || !identifierPattern.test(expected.queue_id)) throw new Error("Fixture expected.queue_id is required.");
+  if (expected.safeguard_required !== undefined && typeof expected.safeguard_required !== "boolean") throw new Error("Fixture expected.safeguard_required must be boolean.");
+  if (expected.matched_rule_ids !== undefined && !stringList(expected.matched_rule_ids, 100)) throw new Error("Fixture expected.matched_rule_ids is invalid.");
+  const routingInput: RoutingInput = {
+    reasonCode: input.reason_code,
+    source: input.source,
+    targetType: input.target_type,
+    trustedFacts: trustedFacts as RoutingInput["trustedFacts"],
+    answers,
+    enrichments,
+    ...(input.priority === undefined ? {} : { priority: Number(input.priority) }),
+  };
+  const rules = (content.rules as unknown[]).map((ruleValue) => {
+    const rule = object(ruleValue, "routing_rule_invalid");
+    return {
+      id: String(rule.id), queueId: String(rule.queue_id), priority: Number(rule.priority),
+      criteria: parseRoutingCriteria({ match: rule.match, conditions: rule.conditions }),
+    };
+  }).sort((left, right) => right.priority - left.priority || left.id.localeCompare(right.id));
+  const safeguard = evaluateHardSafeguards(routingInput);
+  const matchedRuleIds = safeguard.requiresHuman ? [] : rules.filter((rule) => routingCriteriaMatches(routingInput, rule.criteria)).map((rule) => rule.id);
+  const selectedQueueId = safeguard.requiresHuman
+    ? String(content.safeguard_queue_id)
+    : rules.find((rule) => matchedRuleIds.includes(rule.id))?.queueId ?? String(content.default_queue_id);
+  const expectedRuleIds = expected.matched_rule_ids as string[] | undefined;
+  const passed = selectedQueueId === expected.queue_id
+    && (expected.safeguard_required === undefined || expected.safeguard_required === safeguard.requiresHuman)
+    && (expectedRuleIds === undefined || canonicalJson(expectedRuleIds) === canonicalJson(matchedRuleIds));
+  return {
+    name: String(fixture.name ?? `fixture-${index + 1}`), passed, selectedQueueId,
+    expectedQueueId: expected.queue_id, safeguardRequired: safeguard.requiresHuman, matchedRuleIds,
+  };
+}
+
+function routingFixtureResults(content: Record<string, unknown>): RoutingFixtureResult[] {
+  return Array.isArray(content.fixtures)
+    ? content.fixtures.map((fixture, index) => routingFixtureResult(content, fixture, index)) : [];
+}
+
+export function validateConfiguration(type: ConfigurationType, value: unknown): ConfigurationValidation {
+  const errors: ValidationIssue[] = [];
+  const warnings: ValidationIssue[] = [];
+  let content: Record<string, unknown>;
+  try { content = object(value); } catch (error) {
+    return { valid: false, errors: [issue("configuration_content_invalid", error instanceof Error ? error.message : "Invalid content.")], warnings };
+  }
+  if (type === "form") {
+    const allowed = new Set(["title", "description", "target_types", "reasons", "fields", "consent_notice"]);
+    for (const field of Object.keys(content)) if (!allowed.has(field)) errors.push(issue("form_field_unsupported", `Unsupported form property ${field}.`, field));
+    if (!stringValue(content.title, 3, 160)) errors.push(issue("form_title_invalid", "title must contain 3 to 160 characters.", "title"));
+    if (content.description !== undefined && !stringValue(content.description, 0, 2_000)) errors.push(issue("form_description_invalid", "description is too long.", "description"));
+    if (!stringList(content.target_types, 50) || content.target_types.length === 0) errors.push(issue("form_target_types_invalid", "target_types must be a non-empty unique identifier list.", "target_types"));
+    if (!Array.isArray(content.reasons) || content.reasons.length === 0 || content.reasons.length > 100) {
+      errors.push(issue("form_reasons_invalid", "reasons must contain 1 to 100 entries.", "reasons"));
+    } else {
+      const codes = new Set<string>();
+      content.reasons.forEach((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) return errors.push(issue("form_reason_invalid", "Each reason must be an object.", `reasons.${index}`));
+        const reason = entry as Record<string, unknown>;
+        if (typeof reason.code !== "string" || !identifierPattern.test(reason.code) || codes.has(reason.code)) errors.push(issue("form_reason_code_invalid", "Reason codes must be valid and unique.", `reasons.${index}.code`));
+        else codes.add(reason.code);
+        if (!stringValue(reason.label, 1, 160)) errors.push(issue("form_reason_label_invalid", "Reason labels must contain 1 to 160 characters.", `reasons.${index}.label`));
+      });
+    }
+    const fieldTypes = new Set(["short_text", "long_text", "select", "multi_select", "boolean", "number", "url"]);
+    if (!Array.isArray(content.fields) || content.fields.length > 50) errors.push(issue("form_fields_invalid", "fields must contain at most 50 entries.", "fields"));
+    else {
+      const keys = new Set<string>();
+      content.fields.forEach((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) return errors.push(issue("form_field_invalid", "Each field must be an object.", `fields.${index}`));
+        const field = entry as Record<string, unknown>;
+        const allowedFieldProperties = new Set(["key", "label", "type", "required", "max_length", "help_text", "placeholder", "options", "min_value", "max_value"]);
+        if (Object.keys(field).some((property) => !allowedFieldProperties.has(property))) errors.push(issue("form_field_property_unsupported", "The field contains an unsupported property.", `fields.${index}`));
+        if (typeof field.key !== "string" || !answerKeyPattern.test(field.key) || keys.has(field.key) || ["__proto__", "prototype", "constructor"].includes(field.key)) errors.push(issue("form_field_key_invalid", "Field keys must begin with a letter, use only letters, digits, underscores or hyphens, and be unique.", `fields.${index}.key`));
+        else keys.add(field.key);
+        if (!stringValue(field.label, 1, 160)) errors.push(issue("form_field_label_invalid", "Field labels are required.", `fields.${index}.label`));
+        if (typeof field.type !== "string" || !fieldTypes.has(field.type)) errors.push(issue("form_field_type_invalid", "Field type is unsupported.", `fields.${index}.type`));
+        if (field.required !== undefined && typeof field.required !== "boolean") errors.push(issue("form_field_required_invalid", "required must be boolean.", `fields.${index}.required`));
+        if (field.help_text !== undefined && !stringValue(field.help_text, 0, 500)) errors.push(issue("form_field_help_invalid", "help_text must contain at most 500 characters.", `fields.${index}.help_text`));
+        if (field.placeholder !== undefined && !stringValue(field.placeholder, 0, 300)) errors.push(issue("form_field_placeholder_invalid", "placeholder must contain at most 300 characters.", `fields.${index}.placeholder`));
+        if (field.max_length !== undefined && (!Number.isInteger(field.max_length) || Number(field.max_length) < 1 || Number(field.max_length) > 4_000)) errors.push(issue("form_field_length_invalid", "max_length must be an integer from 1 to 4000.", `fields.${index}.max_length`));
+        if (field.type === "url" && field.max_length !== undefined && Number(field.max_length) > 2_048) errors.push(issue("form_field_length_invalid", "URL fields are limited to 2048 characters.", `fields.${index}.max_length`));
+        if (field.type === "number") {
+          if (field.min_value !== undefined && (typeof field.min_value !== "number" || !Number.isFinite(field.min_value))) errors.push(issue("form_field_number_bound_invalid", "min_value must be a finite number.", `fields.${index}.min_value`));
+          if (field.max_value !== undefined && (typeof field.max_value !== "number" || !Number.isFinite(field.max_value))) errors.push(issue("form_field_number_bound_invalid", "max_value must be a finite number.", `fields.${index}.max_value`));
+          if (typeof field.min_value === "number" && typeof field.max_value === "number" && field.min_value > field.max_value) errors.push(issue("form_field_number_range_invalid", "min_value cannot be greater than max_value.", `fields.${index}`));
+        } else if (field.min_value !== undefined || field.max_value !== undefined) errors.push(issue("form_field_number_bound_invalid", "Only number fields may define numeric bounds.", `fields.${index}`));
+        if (field.type === "select" || field.type === "multi_select") {
+          if (!Array.isArray(field.options) || field.options.length === 0 || field.options.length > 100) errors.push(issue("form_field_options_invalid", "Choice fields must contain 1 to 100 options.", `fields.${index}.options`));
+          else {
+            const optionValues = new Set<string>();
+            field.options.forEach((optionValue, optionIndex) => {
+              if (!optionValue || typeof optionValue !== "object" || Array.isArray(optionValue)) return errors.push(issue("form_field_option_invalid", "Each option must have a value and label.", `fields.${index}.options.${optionIndex}`));
+              const option = optionValue as Record<string, unknown>;
+              if (Object.keys(option).some((property) => !["value", "label"].includes(property))) errors.push(issue("form_field_option_property_unsupported", "An option contains an unsupported property.", `fields.${index}.options.${optionIndex}`));
+              if (typeof option.value !== "string" || !identifierPattern.test(option.value) || optionValues.has(option.value)) errors.push(issue("form_field_option_value_invalid", "Option values must be valid and unique.", `fields.${index}.options.${optionIndex}.value`));
+              else optionValues.add(option.value);
+              if (!stringValue(option.label, 1, 160)) errors.push(issue("form_field_option_label_invalid", "Option labels must contain 1 to 160 characters.", `fields.${index}.options.${optionIndex}.label`));
+            });
+          }
+        } else if (field.options !== undefined) errors.push(issue("form_field_options_invalid", "Only choice fields may define options.", `fields.${index}.options`));
+      });
+    }
+    if (!stringValue(content.consent_notice, 10, 4_000)) errors.push(issue("form_consent_invalid", "consent_notice must contain 10 to 4,000 characters.", "consent_notice"));
+  } else if (type === "policy") {
+    const allowed = new Set(["title", "rules"]);
+    for (const field of Object.keys(content)) if (!allowed.has(field)) errors.push(issue("policy_field_unsupported", `Unsupported policy property ${field}.`, field));
+    if (!stringValue(content.title, 3, 160)) errors.push(issue("policy_title_invalid", "title must contain 3 to 160 characters.", "title"));
+    if (!Array.isArray(content.rules) || content.rules.length === 0 || content.rules.length > 500) errors.push(issue("policy_rules_invalid", "rules must contain 1 to 500 entries.", "rules"));
+    else {
+      const codes = new Set<string>();
+      content.rules.forEach((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) return errors.push(issue("policy_rule_invalid", "Each rule must be an object.", `rules.${index}`));
+        const rule = entry as Record<string, unknown>;
+        if (typeof rule.code !== "string" || !identifierPattern.test(rule.code) || codes.has(rule.code)) errors.push(issue("policy_rule_code_invalid", "Rule codes must be valid and unique.", `rules.${index}.code`));
+        else codes.add(rule.code);
+        if (!stringValue(rule.title, 3, 200)) errors.push(issue("policy_rule_title_invalid", "Rule titles are required.", `rules.${index}.title`));
+      });
+    }
+  } else if (type === "template") {
+    const allowed = new Set(["audience", "purpose", "locale", "body_template", "automation_allowed", "variables_schema"]);
+    for (const field of Object.keys(content)) if (!allowed.has(field)) errors.push(issue("template_field_unsupported", `Unsupported template property ${field}.`, field));
+    if (content.audience !== "reporter" && content.audience !== "affected_user") errors.push(issue("template_audience_invalid", "audience is invalid.", "audience"));
+    if (!["follow_up", "outcome", "affected_user_notice", "appeal_outcome"].includes(String(content.purpose))) errors.push(issue("template_purpose_invalid", "purpose is invalid.", "purpose"));
+    if (typeof content.locale !== "string" || !/^[a-z]{2,3}(?:-[A-Z]{2})?$/u.test(content.locale)) errors.push(issue("template_locale_invalid", "locale is invalid.", "locale"));
+    if (!stringValue(content.body_template, 1, 10_000)) errors.push(issue("template_body_invalid", "body_template must contain 1 to 10,000 characters.", "body_template"));
+    if (content.automation_allowed !== undefined && typeof content.automation_allowed !== "boolean") errors.push(issue("template_automation_invalid", "automation_allowed must be boolean.", "automation_allowed"));
+    if (!content.variables_schema || typeof content.variables_schema !== "object" || Array.isArray(content.variables_schema)) errors.push(issue("template_variables_invalid", "variables_schema must be an object.", "variables_schema"));
+    if (typeof content.body_template === "string") {
+      const schema = content.variables_schema && typeof content.variables_schema === "object" && !Array.isArray(content.variables_schema) ? content.variables_schema as Record<string, unknown> : {};
+      const placeholders = [...content.body_template.matchAll(/\{\{\s*([A-Za-z][A-Za-z0-9_]*)\s*\}\}/gu)].map((match) => match[1]!);
+      if (/\{\{\{|\}\}\}/u.test(content.body_template)) errors.push(issue("template_unescaped_expression", "Only simple double-brace variables are allowed.", "body_template"));
+      for (const placeholder of placeholders) if (!(placeholder in schema)) errors.push(issue("template_variable_undefined", `Variable ${placeholder} is not declared.`, "body_template"));
+    }
+  } else {
+    const allowed = new Set(["rules", "default_queue_id", "safeguard_queue_id", "intake_enrichments", "fixtures"]);
+    for (const field of Object.keys(content)) if (!allowed.has(field)) errors.push(issue("routing_field_unsupported", `Unsupported routing property ${field}.`, field));
+    if (!Array.isArray(content.rules) || content.rules.length > 100) errors.push(issue("routing_rules_invalid", "rules must be an array of at most 100 entries.", "rules"));
+    else {
+      const ids = new Set<string>();
+      const priorities = new Set<number>();
+      content.rules.forEach((entry, index) => {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) return errors.push(issue("routing_rule_invalid", "Each routing rule must be an object.", `rules.${index}`));
+        const rule = entry as Record<string, unknown>;
+        if (Object.keys(rule).some((field) => !["id", "queue_id", "priority", "match", "conditions"].includes(field))) errors.push(issue("routing_rule_field_unsupported", "A routing rule contains an unsupported field.", `rules.${index}`));
+        if (typeof rule.id !== "string" || !identifierPattern.test(rule.id) || ids.has(rule.id)) errors.push(issue("routing_rule_id_invalid", "Routing rule IDs must be valid and unique.", `rules.${index}.id`));
+        else ids.add(rule.id);
+        if (typeof rule.queue_id !== "string" || !identifierPattern.test(rule.queue_id)) errors.push(issue("routing_rule_queue_invalid", "Each rule must target a valid queue ID.", `rules.${index}.queue_id`));
+        if (!Number.isInteger(rule.priority) || Number(rule.priority) < 0 || Number(rule.priority) > 100_000 || priorities.has(Number(rule.priority))) errors.push(issue("routing_rule_priority_invalid", "Rule priorities must be unique integers from 0 to 100000.", `rules.${index}.priority`));
+        else priorities.add(Number(rule.priority));
+        try { parseRoutingCriteria({ match: rule.match, conditions: rule.conditions }); } catch (error) {
+          errors.push(issue("routing_rule_condition_invalid", error instanceof Error ? error.message : "Routing conditions are invalid.", `rules.${index}`));
+        }
+      });
+    }
+    if (typeof content.default_queue_id !== "string" || !identifierPattern.test(content.default_queue_id)) errors.push(issue("routing_default_invalid", "default_queue_id is required.", "default_queue_id"));
+    if (typeof content.safeguard_queue_id !== "string" || !identifierPattern.test(content.safeguard_queue_id)) errors.push(issue("routing_safeguard_invalid", "safeguard_queue_id is required.", "safeguard_queue_id"));
+    if (content.intake_enrichments !== undefined) {
+      if (!Array.isArray(content.intake_enrichments) || content.intake_enrichments.length > 5) {
+        errors.push(issue("routing_enrichments_invalid", "intake_enrichments must contain at most five entries.", "intake_enrichments"));
+      } else {
+        content.intake_enrichments.forEach((entry, index) => {
+          if (!entry || typeof entry !== "object" || Array.isArray(entry)) return errors.push(issue("routing_enrichment_invalid", "Each intake enrichment must be an object.", `intake_enrichments.${index}`));
+          const enrichment = entry as Record<string, unknown>;
+          if (Object.keys(enrichment).some((field) => !["component_version_id", "input_mapping"].includes(field))) errors.push(issue("routing_enrichment_field_unsupported", "An intake enrichment contains an unsupported field.", `intake_enrichments.${index}`));
+          if (typeof enrichment.component_version_id !== "string" || !identifierPattern.test(enrichment.component_version_id)) errors.push(issue("routing_enrichment_component_invalid", "component_version_id must identify an immutable published component version.", `intake_enrichments.${index}.component_version_id`));
+          if (!enrichment.input_mapping || typeof enrichment.input_mapping !== "object" || Array.isArray(enrichment.input_mapping)
+            || Object.keys(enrichment.input_mapping).length > 50 || Object.keys(enrichment.input_mapping).some((key) => !identifierPattern.test(key) || ["__proto__", "prototype", "constructor"].includes(key))) {
+            errors.push(issue("routing_enrichment_mapping_invalid", "input_mapping must be a bounded object with safe output keys.", `intake_enrichments.${index}.input_mapping`));
+          }
+        });
+      }
+    }
+    const intakeIds = intakeEnrichmentEntries(content).map((entry) => entry.componentVersionId);
+    if (intakeIds.length > 5 || new Set(intakeIds).size !== intakeIds.length) errors.push(issue("routing_enrichments_invalid", "At most five distinct intake component versions may be configured.", "intake_enrichments"));
+    if (content.fixtures !== undefined && (!Array.isArray(content.fixtures) || content.fixtures.length > 100)) {
+      errors.push(issue("routing_fixtures_invalid", "fixtures must contain at most 100 entries.", "fixtures"));
+    } else if (Array.isArray(content.fixtures)) {
+      const names = new Set<string>();
+      if (Array.isArray(content.rules) && content.rules.length > 0 && content.fixtures.length === 0) warnings.push(issue("routing_fixtures_missing", "Published routing rules should include deterministic and safeguard fixtures.", "fixtures"));
+      if (!errors.some((entry) => entry.code.startsWith("routing_rule_") || entry.code === "routing_default_invalid" || entry.code === "routing_safeguard_invalid")) {
+        content.fixtures.forEach((fixture, index) => {
+          try {
+            const result = routingFixtureResult(content, fixture, index);
+            if (names.has(result.name)) errors.push(issue("routing_fixture_name_duplicate", "Routing fixture names must be unique.", `fixtures.${index}.name`));
+            names.add(result.name);
+            if (!result.passed) errors.push(issue("routing_fixture_failed", `Fixture ${result.name} selected ${result.selectedQueueId}, not ${result.expectedQueueId}.`, `fixtures.${index}`));
+          } catch (error) {
+            errors.push(issue("routing_fixture_invalid", error instanceof Error ? error.message : "The routing fixture is invalid.", `fixtures.${index}`));
+          }
+        });
+      }
+    }
+  }
+  return { valid: errors.length === 0, errors, warnings };
+}
+
+function tableFor(type: ConfigurationType): string {
+  return type === "form" ? "report_form_versions" : type === "policy" ? "policy_versions" : type === "template" ? "message_template_versions" : "routing_rule_versions";
+}
+
+function parsedConfigurationJson(value: unknown, fallback: unknown): unknown {
+  if (typeof value !== "string") return fallback;
+  try { return JSON.parse(value) as unknown; } catch { return fallback; }
+}
+
+function publishedConfigurationContent(type: ConfigurationType, row: Record<string, unknown>): Record<string, unknown> {
+  if (type === "form") return {
+    title: row.title,
+    description: row.description ?? "",
+    target_types: parsedConfigurationJson(row.target_types_json, []),
+    reasons: parsedConfigurationJson(row.reasons_json, []),
+    fields: parsedConfigurationJson(row.fields_json, []),
+    consent_notice: row.consent_notice,
+  };
+  if (type === "policy") return {
+    title: row.title,
+    rules: parsedConfigurationJson(row.rules_json, []),
+  };
+  if (type === "template") return {
+    audience: row.audience,
+    purpose: row.purpose,
+    locale: row.locale,
+    body_template: row.body_template,
+    automation_allowed: row.automation_allowed === 1,
+    variables_schema: parsedConfigurationJson(row.variables_schema_json, {}),
+  };
+  const content = parsedConfigurationJson(row.rules_json, {});
+  return content && typeof content === "object" && !Array.isArray(content)
+    ? content as Record<string, unknown>
+    : { rules: Array.isArray(content) ? content : [] };
+}
+
+export async function listConfigurations(db: D1Database, type: ConfigurationType): Promise<Record<string, unknown>[]> {
+  const keyColumn = type === "form" ? "form_key" : type === "policy" ? "policy_key" : type === "template" ? "template_key" : "'default'";
+  const published = await db.prepare(`SELECT ${keyColumn} AS configurationKey, MAX(version) AS latestVersion, MAX(published_at) AS latestPublishedAt FROM ${tableFor(type)} WHERE installation_id = 'default' GROUP BY ${keyColumn} ORDER BY ${keyColumn}`).all<Record<string, unknown>>();
+  const drafts = await db.prepare(`SELECT id, configuration_key AS configurationKey, revision, validation_status AS validationStatus, last_published_version_id AS lastPublishedVersionId, updated_at AS updatedAt FROM configuration_drafts WHERE installation_id = 'default' AND configuration_type = ?1 ORDER BY configuration_key`).bind(type).all<Record<string, unknown>>();
+  const byKey = new Map<string, Record<string, unknown>>();
+  for (const row of published.results) byKey.set(String(row.configurationKey), { configurationKey: row.configurationKey, latestVersion: row.latestVersion, latestPublishedAt: row.latestPublishedAt, draft: null });
+  for (const draft of drafts.results) byKey.set(String(draft.configurationKey), { ...(byKey.get(String(draft.configurationKey)) ?? { configurationKey: draft.configurationKey, latestVersion: null, latestPublishedAt: null }), draft });
+  return [...byKey.values()];
+}
+
+export interface PublishedFormSummary {
+  id: string;
+  formKey: string;
+  version: number;
+  title: string;
+  description: string;
+  targetTypes: string[];
+  fieldCount: number;
+  publishedAt: string;
+}
+
+export async function listPublishedForms(db: D1Database): Promise<PublishedFormSummary[]> {
+  const rows = await db.prepare(`
+    SELECT id, form_key AS formKey, version, title, description, target_types_json AS targetTypesJson,
+      fields_json AS fieldsJson, published_at AS publishedAt
+    FROM report_form_versions
+    WHERE installation_id = 'default' AND published_at IS NOT NULL AND retired_at IS NULL
+    ORDER BY published_at DESC, version DESC
+  `).all<{ id: string; formKey: string; version: number; title: string; description: string; targetTypesJson: string; fieldsJson: string; publishedAt: string }>();
+  return rows.results.map((row) => {
+    const targetTypes = parsedConfigurationJson(row.targetTypesJson, []);
+    const fields = parsedConfigurationJson(row.fieldsJson, []);
+    return {
+    id: row.id,
+    formKey: row.formKey,
+    version: row.version,
+    title: row.title,
+    description: row.description,
+    targetTypes: Array.isArray(targetTypes) ? targetTypes.filter((value): value is string => typeof value === "string") : [],
+    fieldCount: Array.isArray(fields) ? fields.length : 0,
+    publishedAt: row.publishedAt,
+    };
+  });
+}
+
+export async function loadConfiguration(db: D1Database, type: ConfigurationType, key: string): Promise<Record<string, unknown> | null> {
+  const draft = await db.prepare(`SELECT id, configuration_key AS configurationKey, content_json AS contentJson, content_digest AS contentDigest, validation_json AS validationJson, validation_status AS validationStatus, revision, last_published_version_id AS lastPublishedVersionId, created_by AS createdBy, updated_by AS updatedBy, created_at AS createdAt, updated_at AS updatedAt FROM configuration_drafts WHERE installation_id = 'default' AND configuration_type = ?1 AND configuration_key = ?2 LIMIT 1`).bind(type, key).first<Record<string, unknown>>();
+  const keyColumn = type === "form" ? "form_key" : type === "policy" ? "policy_key" : type === "template" ? "template_key" : null;
+  const versions = keyColumn
+    ? await db.prepare(`SELECT * FROM ${tableFor(type)} WHERE installation_id = 'default' AND ${keyColumn} = ?1 ORDER BY version DESC, created_at DESC`).bind(key).all<Record<string, unknown>>()
+    : await db.prepare(`SELECT * FROM routing_rule_versions WHERE installation_id = 'default' ORDER BY version DESC`).all<Record<string, unknown>>();
+  if (!draft && versions.results.length === 0) return null;
+  return {
+    draft: draft ? { ...draft, content: JSON.parse(String(draft.contentJson)), validation: JSON.parse(String(draft.validationJson)), contentJson: undefined, validationJson: undefined } : null,
+    versions: versions.results.map((version) => ({ ...version, content: publishedConfigurationContent(type, version) })),
+  };
+}
+
+export async function createConfigurationDraft(
+  db: D1Database,
+  type: ConfigurationType,
+  key: string,
+  contentValue: unknown,
+  session: OperatorSession,
+  idempotencyKey: string,
+): Promise<{ draftId: string; revision: number; validation: ConfigurationValidation; idempotentReplay: boolean }> {
+  if (!keyPattern.test(key)) throw new ApiError(400, "configuration_key_invalid", "Configuration keys must use lowercase letters, digits, and hyphens.");
+  const replay = await db.prepare(`SELECT target_id AS draftId, details_json AS detailsJson FROM audit_events WHERE idempotency_key = ?1 AND action = 'configuration.draft_created' LIMIT 1`).bind(`configuration-draft:${idempotencyKey}`).first<{ draftId: string; detailsJson: string }>();
+  if (replay) return { draftId: replay.draftId, revision: 1, validation: JSON.parse(replay.detailsJson) as ConfigurationValidation, idempotentReplay: true };
+  const content = object(contentValue);
+  const validation = validateConfiguration(type, content);
+  const contentJson = canonicalJson(content);
+  if (new TextEncoder().encode(contentJson).byteLength > 524_288) throw new ApiError(413, "configuration_too_large", "Configuration drafts are limited to 512 KiB.");
+  const draftId = crypto.randomUUID();
+  const timestamp = now();
+  await db.batch([
+    db.prepare(`INSERT INTO configuration_drafts (id, installation_id, configuration_type, configuration_key, content_json, content_digest, validation_json, validation_status, revision, created_by, updated_by, created_at, updated_at) VALUES (?1, 'default', ?2, ?3, ?4, ?5, ?6, ?7, 1, ?8, ?8, ?9, ?9)`)
+      .bind(draftId, type, key, contentJson, `sha256:${await sha256(contentJson)}`, canonicalJson(validation), validation.valid ? "valid" : "invalid", session.actor.id, timestamp),
+    db.prepare(`INSERT INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at) VALUES (?1, ?2, 'configuration.draft_created', ?3, ?4, 'configuration_draft', ?5, ?6, ?7)`)
+      .bind(crypto.randomUUID(), `configuration-draft:${idempotencyKey}`, session.actor.type, session.actor.id, draftId, canonicalJson(validation), timestamp),
+  ]);
+  return { draftId, revision: 1, validation, idempotentReplay: false };
+}
+
+export async function updateConfigurationDraft(
+  db: D1Database,
+  type: ConfigurationType,
+  key: string,
+  contentValue: unknown,
+  expectedRevision: number,
+  session: OperatorSession,
+): Promise<{ draftId: string; revision: number; validation: ConfigurationValidation }> {
+  const content = object(contentValue);
+  const validation = validateConfiguration(type, content);
+  const contentJson = canonicalJson(content);
+  if (new TextEncoder().encode(contentJson).byteLength > 524_288) throw new ApiError(413, "configuration_too_large", "Configuration drafts are limited to 512 KiB.");
+  const timestamp = now();
+  const changed = await db.prepare(`UPDATE configuration_drafts SET content_json = ?4, content_digest = ?5, validation_json = ?6, validation_status = ?7, revision = revision + 1, updated_by = ?8, updated_at = ?9 WHERE installation_id = 'default' AND configuration_type = ?1 AND configuration_key = ?2 AND revision = ?3 RETURNING id, revision`)
+    .bind(type, key, expectedRevision, contentJson, `sha256:${await sha256(contentJson)}`, canonicalJson(validation), validation.valid ? "valid" : "invalid", session.actor.id, timestamp).first<{ id: string; revision: number }>();
+  if (!changed) throw new ApiError(409, "configuration_revision_conflict", "The configuration draft changed after it was loaded.");
+  return { draftId: changed.id, revision: changed.revision, validation };
+}
+
+async function assertRoutingDependencies(db: D1Database, content: Record<string, unknown>): Promise<void> {
+  const queueIds = [String(content.default_queue_id), String(content.safeguard_queue_id), ...((content.rules as Record<string, unknown>[]).map((rule) => String(rule.queue_id)))];
+  const uniqueQueueIds = [...new Set(queueIds)];
+  const placeholders = uniqueQueueIds.map((_, index) => `?${index + 1}`).join(", ");
+  const active = await db.prepare(`
+    SELECT q.id, v.management_mode AS managementMode FROM queue_definitions q
+    JOIN queue_versions v ON v.id = q.active_version_id
+    WHERE q.id IN (${placeholders}) AND q.purpose = 'reports' AND q.status = 'active' AND v.retired_at IS NULL
+  `).bind(...uniqueQueueIds).all<{ id: string; managementMode: string }>();
+  const byId = new Map(active.results.map((queue) => [queue.id, queue]));
+  const missing = uniqueQueueIds.filter((id) => !byId.has(id));
+  if (missing.length) throw new ApiError(422, "routing_queue_unavailable", "Every routing rule and fallback must reference an active report queue.", { missing_queue_ids: missing });
+  if (byId.get(String(content.safeguard_queue_id))?.managementMode !== "human") throw new ApiError(422, "routing_safeguard_not_human", "The safeguard queue must be human-managed.");
+  if (byId.get(String(content.default_queue_id))?.managementMode !== "human") throw new ApiError(422, "routing_default_not_human", "The default fallback queue must be human-managed.");
+  const intake = intakeEnrichmentEntries(content);
+  if (!intake.length) return;
+  const componentIds = intake.map((entry) => entry.componentVersionId);
+  const componentPlaceholders = componentIds.map((_, index) => `?${index + 1}`).join(", ");
+  const components = await db.prepare(`
+    SELECT v.id, v.definition_id AS definitionId,
+      v.allowed_input_fields_json AS allowedInputFieldsJson,
+      v.risk_class AS riskClass, v.timeout_policy_json AS timeoutPolicyJson,
+      v.retry_policy_json AS retryPolicyJson, v.implementation_kind AS implementationKind,
+      d.effect_class AS effectClass, d.status
+    FROM component_versions v JOIN component_definitions d ON d.id = v.definition_id
+    WHERE v.id IN (${componentPlaceholders}) AND v.published_at IS NOT NULL AND v.retired_at IS NULL
+  `).bind(...componentIds).all<{
+    id: string; definitionId: string; allowedInputFieldsJson: string; riskClass: string;
+    timeoutPolicyJson: string; retryPolicyJson: string; implementationKind: string; effectClass: string; status: string;
+  }>();
+  const byComponentId = new Map(components.results.map((component) => [component.id, component]));
+  const unavailable = componentIds.filter((id) => !byComponentId.has(id));
+  if (unavailable.length) throw new ApiError(422, "routing_enrichment_unavailable", "Every intake enrichment must pin an available published component version.", { unavailable_component_version_ids: unavailable });
+  if (new Set(components.results.map((component) => component.definitionId)).size !== components.results.length) {
+    throw new ApiError(422, "routing_enrichment_definition_duplicate", "Only one immutable version of each component may run during intake routing.");
+  }
+  for (const entry of intake) {
+    const component = byComponentId.get(entry.componentVersionId)!;
+    let allowedFields: string[] = [];
+    let timeoutPolicy: Record<string, unknown> = {};
+    let retryPolicy: Record<string, unknown> = {};
+    try {
+      allowedFields = JSON.parse(component.allowedInputFieldsJson) as string[];
+      timeoutPolicy = JSON.parse(component.timeoutPolicyJson) as Record<string, unknown>;
+      retryPolicy = JSON.parse(component.retryPolicyJson) as Record<string, unknown>;
+    } catch {
+      throw new ApiError(422, "routing_enrichment_configuration_invalid", "An intake component contains invalid stored policy JSON.", { component_version_id: component.id });
+    }
+    if (!Array.isArray(allowedFields) || component.effectClass !== "read_only" || component.status !== "active"
+      || component.riskClass !== "low" || component.implementationKind === "workers_ai") {
+      throw new ApiError(422, "routing_enrichment_not_cheap", "Intake routing accepts only active, low-risk, read-only non-generative components.", { component_version_id: component.id });
+    }
+    const timeoutMs = Number(timeoutPolicy.timeout_ms ?? 5_000);
+    const maximumAttempts = Number(retryPolicy.maximum_attempts ?? 1);
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 100 || timeoutMs > 5_000 || maximumAttempts !== 1) {
+      throw new ApiError(422, "routing_enrichment_not_bounded", "Intake components must have a 100-5000ms timeout and exactly one attempt.", { component_version_id: component.id });
+    }
+    try { assertMappedFieldsAllowed(entry.inputMapping, allowedFields); } catch {
+      throw new ApiError(422, "routing_enrichment_field_denied", "An intake input mapping reads a field the component has not allowlisted.", { component_version_id: component.id });
+    }
+  }
+}
+
+export async function validateStoredConfiguration(db: D1Database, type: ConfigurationType, key: string): Promise<ConfigurationValidation> {
+  const draft = await db.prepare(`SELECT id, content_json AS contentJson FROM configuration_drafts WHERE installation_id = 'default' AND configuration_type = ?1 AND configuration_key = ?2 LIMIT 1`).bind(type, key).first<{ id: string; contentJson: string }>();
+  if (!draft) throw new ApiError(404, "configuration_draft_not_found", "The configuration draft does not exist.");
+  const content = object(JSON.parse(draft.contentJson));
+  const validation = validateConfiguration(type, content);
+  if (type === "routing_rules" && validation.valid) {
+    try { await assertRoutingDependencies(db, content); } catch (error) {
+      if (error instanceof ApiError) validation.errors.push(issue(error.code, error.message));
+      else throw error;
+      validation.valid = false;
+    }
+  }
+  await db.prepare(`UPDATE configuration_drafts SET validation_json = ?2, validation_status = ?3, updated_at = ?4 WHERE id = ?1`).bind(draft.id, canonicalJson(validation), validation.valid ? "valid" : "invalid", now()).run();
+  return validation;
+}
+
+export async function publishConfiguration(
+  db: D1Database,
+  type: ConfigurationType,
+  key: string,
+  expectedRevision: number,
+  session: OperatorSession,
+  idempotencyKey: string,
+): Promise<{ versionId: string; version: number; idempotentReplay: boolean }> {
+  const replay = await db.prepare(`SELECT target_id AS versionId, details_json AS detailsJson FROM audit_events WHERE idempotency_key = ?1 AND action = 'configuration.published' LIMIT 1`).bind(`configuration-publish:${idempotencyKey}`).first<{ versionId: string; detailsJson: string }>();
+  if (replay) return { versionId: replay.versionId, version: Number((JSON.parse(replay.detailsJson) as Record<string, unknown>).version), idempotentReplay: true };
+  const draft = await db.prepare(`SELECT id, content_json AS contentJson, revision FROM configuration_drafts WHERE installation_id = 'default' AND configuration_type = ?1 AND configuration_key = ?2 LIMIT 1`).bind(type, key).first<{ id: string; contentJson: string; revision: number }>();
+  if (!draft) throw new ApiError(404, "configuration_draft_not_found", "The configuration draft does not exist.");
+  if (draft.revision !== expectedRevision) throw new ApiError(409, "configuration_revision_conflict", "The configuration draft changed after it was loaded.");
+  const content = object(JSON.parse(draft.contentJson));
+  const validation = validateConfiguration(type, content);
+  if (!validation.valid) throw new ApiError(422, "configuration_invalid", "The configuration draft cannot be published.", { errors: validation.errors });
+  if (type === "routing_rules") await assertRoutingDependencies(db, content);
+  const table = tableFor(type);
+  const next = await db.prepare(`SELECT COALESCE(MAX(version), 0) + 1 AS version FROM ${table} WHERE installation_id = 'default'`).first<{ version: number }>();
+  const version = Number(next?.version ?? 1);
+  const versionId = `${key}-v${version}-${crypto.randomUUID().slice(0, 8)}`;
+  const timestamp = now();
+  let insert: D1PreparedStatement;
+  if (type === "form") insert = db.prepare(`INSERT INTO report_form_versions (id, installation_id, form_key, version, title, description, target_types_json, reasons_json, fields_json, consent_notice, published_at, created_by, created_at) VALUES (?1, 'default', ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?10)`).bind(versionId, key, version, content.title, content.description ?? "", canonicalJson(content.target_types), canonicalJson(content.reasons), canonicalJson(content.fields), content.consent_notice, timestamp, session.actor.id);
+  else if (type === "policy") insert = db.prepare(`INSERT INTO policy_versions (id, installation_id, policy_key, version, title, rules_json, published_at, created_by, created_at) VALUES (?1, 'default', ?2, ?3, ?4, ?5, ?6, ?7, ?6)`).bind(versionId, key, version, content.title, canonicalJson(content.rules), timestamp, session.actor.id);
+  else if (type === "template") insert = db.prepare(`INSERT INTO message_template_versions (id, installation_id, template_key, version, audience, purpose, locale, body_template, published_at, created_by, created_at, automation_allowed, variables_schema_json) VALUES (?1, 'default', ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?8, ?10, ?11)`).bind(versionId, key, version, content.audience, content.purpose, content.locale, content.body_template, timestamp, session.actor.id, content.automation_allowed === true ? 1 : 0, canonicalJson(content.variables_schema));
+  else {
+    const fixtureResults = routingFixtureResults(content);
+    insert = db.prepare(`INSERT INTO routing_rule_versions (id, installation_id, version, rules_json, fixture_results_json, published_at, created_by, created_at) VALUES (?1, 'default', ?2, ?3, ?4, ?5, ?6, ?5)`).bind(
+      versionId, version, canonicalJson(content),
+      canonicalJson({ valid: fixtureResults.every((fixture) => fixture.passed), tested_at: timestamp, fixtures: fixtureResults }),
+      timestamp, session.actor.id,
+    );
+  }
+  await db.batch([
+    insert,
+    db.prepare(`UPDATE configuration_drafts SET last_published_version_id = ?2, updated_at = ?3 WHERE id = ?1 AND revision = ?4`).bind(draft.id, versionId, timestamp, expectedRevision),
+    db.prepare(`INSERT INTO audit_events (id, idempotency_key, action, actor_type, actor_id, target_type, target_id, details_json, created_at) VALUES (?1, ?2, 'configuration.published', ?3, ?4, 'configuration_version', ?5, ?6, ?7)`).bind(crypto.randomUUID(), `configuration-publish:${idempotencyKey}`, session.actor.type, session.actor.id, versionId, canonicalJson({ type, key, version, draftId: draft.id, revision: draft.revision }), timestamp),
+  ]);
+  return { versionId, version, idempotentReplay: false };
+}
+
+export function renderTemplatePreview(contentValue: unknown, variablesValue: unknown): { body: string } {
+  const content = object(contentValue);
+  const validation = validateConfiguration("template", content);
+  if (!validation.valid) throw new ApiError(422, "template_invalid", "The template is invalid.", { errors: validation.errors });
+  const variables = object(variablesValue, "template_variables_invalid");
+  const schema = object(content.variables_schema, "template_variables_invalid");
+  for (const key of Object.keys(variables)) {
+    if (!(key in schema) || ["__proto__", "prototype", "constructor"].includes(key)) throw new ApiError(400, "template_variable_denied", `Variable ${key} is not declared.`);
+    const value = variables[key];
+    if (!["string", "number", "boolean"].includes(typeof value)) throw new ApiError(400, "template_variable_invalid", "Template variables must be scalar values.");
+  }
+  const body = String(content.body_template).replace(/\{\{\s*([A-Za-z][A-Za-z0-9_]*)\s*\}\}/gu, (_match, key: string) => String(variables[key] ?? ""));
+  return { body };
+}