@crvouga/mockingbird-service-formbricks 1.5.1 → 1.6.1

package/CHANGELOG.md

@@ -1,14 +1,29 @@
 # Changelog — @crvouga/mockingbird-service-formbricks
 
-## 1.5.1 (2026-09-30)
+## 1.6.1 (2026-09-30)
 
 ### Fixes and improvements
 
-- keep hosted pages inside narrow hosts and popups ([6512323](https://github.com/crvouga/mockingbird/commit/6512323198cb00b99005f3d2cfa5b9f1e6e321a7))
+- keep admin buttons pressed until the action finishes ([0aabfcb](https://github.com/crvouga/mockingbird/commit/0aabfcb5f392aa51e193f9c3f817d5877d92bc6a))
+- size admin select fields like the text inputs beside them ([0fb3ef2](https://github.com/crvouga/mockingbird/commit/0fb3ef2ddbf43376c93a2ae6d87c6c9bf890dafc))
+- keep admin section tabs wired when boot is renamed ([4eda25e](https://github.com/crvouga/mockingbird/commit/4eda25eacd59da048d196f7cc8369d7a02b47bfc))
+
+## 1.6.0 (2026-09-29)
+
+### Features
+
+- boot Bolt over Socket Mode ([01322df](https://github.com/crvouga/mockingbird/commit/01322df315c66b1f2f5b53094cbbeeeef6d3ae6c))
+- validate every element when a finished response opts in ([a418b5f](https://github.com/crvouga/mockingbird/commit/a418b5f573c69ac52b80334ac59a2347dd00d247))
 
-### Dependencies
+### Fixes and improvements
 
-- `@crvouga/mockingbird-service-sqlite`
+- reject other-option answers longer than 250 characters ([14a86c8](https://github.com/crvouga/mockingbird/commit/14a86c8fac4e6e42d0d5a2647c157e7caa3cfa5d))
+
+## 1.5.1 (2026-09-29)
+
+### Fixes and improvements
+
+- keep hosted pages inside narrow hosts and popups ([6512323](https://github.com/crvouga/mockingbird/commit/6512323198cb00b99005f3d2cfa5b9f1e6e321a7))
 
 ## 1.5.0 (2026-09-29)
 

package/README.md

@@ -55,7 +55,7 @@ resolve to the same workspace.
 | Route | Behaviour |
 | --- | --- |
 | `GET /api/v1/client/{workspace}/environment` | `{data: {data: {surveys, actionClasses, workspace, project}, expiresAt}}` (`project` is upstream's legacy alias of `workspace`). Only `app` surveys `inProgress`, with the SDK's survey fields and `projectOverwrites` mirroring `workspaceOverwrites`. A malformed id is 400 `Invalid ID format`; an unknown one 404 `Workspace not found`. |
-| `POST /api/v2/client/{workspace}/responses` | `{surveyId, finished, data, contactId?, meta?, …}` → `{data: {id, quotaFull: false}}`. An unknown workspace is 404; input errors are 400 `Fields are missing or incorrectly formatted` with zod 4 `details` (`{surveyId: "Invalid cuid2", finished: "Invalid input: expected boolean, received undefined"}`; `userId` is not part of the v2 input and is ignored); a `contactId` while contacts are off is 403 (Enterprise); an unknown survey 404; a survey of another workspace 400 `Survey is part of another workspace`; a survey not `inProgress` 403 `Survey is not accepting submissions`. `data` keeps only element ids and declared hidden fields (`hiddenFields.fieldIds`); other keys are dropped. Element validation checks only the elements present in `data` (finished or not): required → `Please fill out this field`; a choice outside a choice element's options (when it has no "other") → `Please enter a valid format`; openText email / url / phone → `Please enter a valid …`; 400 `Validation failed` with `details: {"response.data.<elementId>": "<messages joined by '; '>"}`. `meta` keeps `source`, `url`, `action` and the auto-captured page / UTM / screen keys, plus `userAgent` and `country` (from `CF-IPCountry`). `language` is canonicalized (`en` → `en-US`); a finished response's `ttc` gains `_total`. |
+| `POST /api/v2/client/{workspace}/responses` | `{surveyId, finished, data, contactId?, meta?, …}` → `{data: {id, quotaFull: false}}`. An unknown workspace is 404; input errors are 400 `Fields are missing or incorrectly formatted` with zod 4 `details` (`{surveyId: "Invalid cuid2", finished: "Invalid input: expected boolean, received undefined"}`; `userId` is not part of the v2 input and is ignored); a `contactId` while contacts are off is 403 (Enterprise); an unknown survey 404; a survey of another workspace 400 `Survey is part of another workspace`; a survey not `inProgress` 403 `Survey is not accepting submissions`. `data` keeps only element ids and declared hidden fields (`hiddenFields.fieldIds`); other keys are dropped. Before element validation, a `multipleChoiceSingle` or `multipleChoiceMulti` value (a string, or any string in an array) that equals no choice label in the response language — the body's `language`, or the label's `default` when it is omitted; `getLocalizedValue` does not fall back — and is longer than 250 characters is 400 `Response exceeds character limit` with `details: {questionId}`, and nothing is stored. An exact label match is not length-checked; an unmatched entry of 250 characters or fewer passes this check. Element validation defaults to the elements present in `data` (finished or not). `validation: "finished-validates-all"` (pre-#7292 Formbricks) checks every element when `finished` is true and only the present ones when it is false; a failure is 400 and stores nothing. Either way: required → `Please fill out this field`; a choice outside a choice element's options (when it has no "other") → `Please enter a valid format`; openText email / url / phone → `Please enter a valid …`; 400 `Validation failed` with `details: {"response.data.<elementId>": "<messages joined by '; '>"}`. `meta` keeps `source`, `url`, `action` and the auto-captured page / UTM / screen keys, plus `userAgent` and `country` (from `CF-IPCountry`). `language` is canonicalized (`en` → `en-US`); a finished response's `ttc` gains `_total`. |
 | `GET /api/v1/management/responses?surveyId=&limit=&skip=` | `{data: [response]}`, newest first; an unknown `surveyId` is 404. |
 | `GET /api/v1/management/responses/{id}` | `{data: response}` or 404. |
 | `GET /api/v1/management/surveys?limit=&offset=` | `{data: [survey]}`, most recently updated first. |
@@ -85,7 +85,7 @@ Retries, `GET /__admin/webhooks`, `…/events`, `…/replay`, `…/flush` and
 | `GET /__admin/responses?surveyId=` | Stored responses, oldest first. |
 | `GET\|PUT /__admin/surveys` | Read, or add / replace surveys (`[{id, name, type?, status?, workspaceId?, blocks?, questions?, …}]`; no `workspaceId` = served by every configured workspace). |
 | `GET\|PUT /__admin/contacts` | Read, or add contacts (`[{id, userId?, attributes?, workspaceId?}]`) for `contactId` responses. |
-| `GET\|PUT /__admin/settings` | `{workspaces?, legacyEnvironmentIds?, apiKeys?, webhookId?, contactsEnabled?}`. |
+| `GET\|PUT /__admin/settings` | `{workspaces?, legacyEnvironmentIds?, apiKeys?, webhookId?, contactsEnabled?, validation?}`. `validation` is `present-only` (default, Formbricks after #7292) or `finished-validates-all` (before #7292: a finished response validates every element). `createRuntime({settings})` accepts the same fields. |
 
 Fault presets (`POST /__admin/faults {"preset": "<name>", "count"?: n}`; `GET /__admin/faults/presets`):
 `rate_limited` (429 `too_many_requests`), `server_error` (500), `missing_response_id` (stored, but
@@ -105,7 +105,7 @@ string), `management_unauthorized`, `connection_drop`, `duplicate` (the next web
 - Displays, contacts / identify, `user` and `storage` routes of the client API (the widget script
   is a no-op, so the SDK never calls them); response updates (`PUT …/responses/{id}`).
 - Quotas (always `quotaFull: false`), single-use links, PIN protection, reCAPTCHA, email
-  verification, file-upload checks, the "other" option length check, custom `validation.rules`,
+  verification, file-upload checks, custom `validation.rules`,
   survey logic, and the full survey schema on create (only the shapes above are checked).
 - The Embedded Data ingest contract beyond its allow-list (locked fields, coercion, size limits),
   `userAgent` parsing (always `{device: "desktop"}`), and language canonicalization beyond common
@@ -124,7 +124,7 @@ string), `management_unauthorized`, `connection_drop`, `duplicate` (the next web
 | `WEBHOOK_PATH` | string | A conventional receiver path for examples, `/webhooks/formbricks`. |
 | `formbricksCredential` | function | The workspace id or API key a request carries. |
 | `formbricksError` | function | Build Formbricks' `{code, message, details}` error response. |
-| `validateResponseData` | function | Upstream's element validation: `(survey, data, language?)` → `{elementId: messages}` or `null`. |
+| `validateResponseData` | function | Upstream's element validation: `(survey, data, language?, {validation?, finished?})` → `{elementId: messages}` or `null`. |
 | `CORPUS_SURVEYS` | value | The synthetic survey corpus every namespace is seeded with. |
 | `WORKSPACE_ID`, `ENVIRONMENT_ID`, `DEFAULT_SETTINGS` | values | The default workspace, its legacy environment id, and the default settings. |
 | `document`, `operationIds`, `supportedOperationIds` | values | The vendored OpenAPI contract and its operation ids. |

package/dist/{chunk-PTHSM46L.js → chunk-6PARZPBY.js}

@@ -1,7 +1,7 @@
 import {
   DEFAULT_SETTINGS,
   createRuntime
-} from "./chunk-24SBIGNG.js";
+} from "./chunk-JAVNDNOU.js";
 
 // ../../adapters/node/dist/cli.js
 import { readFile } from "node:fs/promises";
@@ -236,6 +236,7 @@ var start = async (target, values, config) => {
     onLog: formatLog(config.log)
   });
   const listening = await listen(runtime, { port: config.port, host: config.host });
+  target.listening?.(listening);
   console.log(`${target.name} mock listening on ${listening.url}`);
   console.log(`${target.name} health: GET ${listening.url}/health`);
   console.log(`${target.name} admin: ${listening.url}/__admin (${config.adminKey ? "x-mockingbird-admin-key required" : "open \u2014 pass --admin-key to lock"})`);
@@ -367,4 +368,4 @@ export {
   createServer2 as createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-PTHSM46L.js.map
+//# sourceMappingURL=chunk-6PARZPBY.js.map

package/dist/chunk-6PARZPBY.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../adapters/node/src/cli.ts", "../../../adapters/node/src/serve.ts", "../../../adapters/node/src/listen.ts", "../src/server.ts"],
+  "sourcesContent": ["import { readFile } from \"node:fs/promises\"\nimport { type ParseArgsConfig, parseArgs } from \"node:util\"\nimport type { RequestLog, ServiceInstance, ServiceRuntime } from \"@crvouga/mockingbird-service\"\nimport { type Listening, listen } from \"./listen.js\"\n\nexport type CliOption = {\n  type: \"string\" | \"boolean\"\n  description: string\n  /** Shown in help; the value placeholder, e.g. `<port>`. */\n  value?: string\n  default?: string | boolean\n}\n\nexport type CliValues = Record<string, string | boolean | undefined>\n\nexport type CliCommand = {\n  summary: string\n  usage?: string\n  options?: Record<string, CliOption>\n  /** Resolves to an exit code; a server command resolves only when it stops. */\n  run(values: CliValues, positionals: string[]): Promise<number>\n}\n\nexport type CliSpec = {\n  bin: string\n  description: string\n  commands: Record<string, CliCommand>\n}\n\nconst optionHelp = (options: Record<string, CliOption>): string[] =>\n  Object.entries(options).map(([name, option]) => {\n    const flag = `--${name}${option.type === \"string\" ? ` ${option.value ?? \"<value>\"}` : \"\"}`\n    const fallback = option.default !== undefined ? ` (default: ${String(option.default)})` : \"\"\n    return `  ${flag.padEnd(30)} ${option.description}${fallback}`\n  })\n\nconst help = (spec: CliSpec): string =>\n  [\n    `${spec.bin} \u2014 ${spec.description}`,\n    \"\",\n    \"Usage:\",\n    `  ${spec.bin} <command> [options]`,\n    \"\",\n    \"Commands:\",\n    ...Object.entries(spec.commands).map(([name, c]) => `  ${name.padEnd(30)} ${c.summary}`),\n    \"\",\n    `Run \\`${spec.bin} <command> --help\\` for a command's options.`,\n  ].join(\"\\n\")\n\nconst commandHelp = (spec: CliSpec, name: string, command: CliCommand): string =>\n  [\n    `${spec.bin} ${name} \u2014 ${command.summary}`,\n    \"\",\n    \"Usage:\",\n    `  ${command.usage ?? `${spec.bin} ${name} [options]`}`,\n    ...(command.options ? [\"\", \"Options:\", ...optionHelp(command.options)] : []),\n  ].join(\"\\n\")\n\n/** Parse `argv` against `spec` and run the chosen command. Resolves to an exit code. */\nexport const runCli = async (spec: CliSpec, argv: string[]): Promise<number> => {\n  // Two-word commands (`corpus pull`) win over one-word ones.\n  const pair = argv.length >= 2 ? `${argv[0]} ${argv[1]}` : undefined\n  const words = pair !== undefined && spec.commands[pair] ? 2 : 1\n  const name = words === 2 ? pair : argv[0]\n  const rest = argv.slice(words)\n  if (name === undefined || name === \"--help\" || name === \"-h\" || name === \"help\") {\n    console.log(help(spec))\n    return 0\n  }\n  const command = spec.commands[name]\n  if (!command) {\n    console.error(`${spec.bin}: unknown command ${JSON.stringify(name)}\\n\\n${help(spec)}`)\n    return 2\n  }\n  if (rest.includes(\"--help\") || rest.includes(\"-h\")) {\n    console.log(commandHelp(spec, name, command))\n    return 0\n  }\n  let parsed: { values: CliValues; positionals: string[] }\n  try {\n    parsed = parseArgs({\n      args: rest,\n      allowPositionals: true,\n      strict: true,\n      options: Object.fromEntries(\n        Object.entries(command.options ?? {}).map(([key, option]) => [\n          key,\n          {\n            type: option.type,\n            ...(option.default !== undefined ? { default: option.default } : {}),\n          },\n        ]),\n      ) as ParseArgsConfig[\"options\"],\n    }) as { values: CliValues; positionals: string[] }\n  } catch (error) {\n    console.error(\n      `${spec.bin} ${name}: ${error instanceof Error ? error.message : String(error)}\\n\\n${commandHelp(spec, name, command)}`,\n    )\n    return 2\n  }\n  return command.run(parsed.values, parsed.positionals)\n}\n\n// \u2500\u2500 serve \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport type LogFormat = \"pretty\" | \"json\" | \"off\"\n\nexport type CommonServeOptions = {\n  adminKey: string | undefined\n  seed: string | undefined\n  onLog: ((entry: RequestLog) => void) | undefined\n}\n\n/**\n * What a service contributes to `serve`: how to build its runtime from CLI flags,\n * and what to say at startup. Every service's `./server` entry exports one as\n * `serveTarget`, which is also how `serve --config` finds services by name.\n */\nexport type ServeTarget = {\n  name: string\n  defaultPort: number\n  /** Serve flags beyond the common ones. */\n  options?: Record<string, CliOption>\n  create(\n    values: CliValues,\n    common: CommonServeOptions,\n  ): Promise<ServiceRuntime<ServiceInstance>> | ServiceRuntime<ServiceInstance>\n  /** Startup lines after the listen address, e.g. the loaded corpus version. */\n  banner?(runtime: ServiceRuntime<ServiceInstance>): string[]\n  /** After the HTTP server is bound. A service that speaks more than HTTP attaches it here. */\n  listening?(server: Listening): void\n}\n\nconst COMMON_SERVE_OPTIONS: Record<string, CliOption> = {\n  port: { type: \"string\", value: \"<port>\", description: \"Port to listen on\" },\n  host: { type: \"string\", value: \"<host>\", description: \"Interface to bind\", default: \"127.0.0.1\" },\n  \"admin-key\": {\n    type: \"string\",\n    value: \"<key>\",\n    description: \"Require x-mockingbird-admin-key on /__admin/* (env MOCKINGBIRD_ADMIN_KEY)\",\n  },\n  seed: { type: \"string\", value: \"<seed>\", description: \"Seed for every random choice\" },\n  log: {\n    type: \"string\",\n    value: \"<pretty|json|off>\",\n    description: \"Request log format\",\n    default: \"pretty\",\n  },\n  \"log-requests\": {\n    type: \"boolean\",\n    description:\n      \"One JSON line per request: namespace, operationId, status, ids touched (never bodies). Same as --log json\",\n  },\n  config: {\n    type: \"string\",\n    value: \"<file>\",\n    description: \"Serve every service in a mockingbird.json config instead\",\n  },\n}\n\nconst formatLog = (format: LogFormat) => {\n  if (format === \"off\") return undefined\n  if (format === \"json\") return (entry: RequestLog) => console.log(JSON.stringify(entry))\n  return (entry: RequestLog) => {\n    const op = entry.operationId ?? (entry.unmatched ? \"UNMATCHED\" : \"-\")\n    const ns = entry.namespace === \"default\" ? \"\" : ` [${entry.namespace}]`\n    const fault = entry.faultId ? ` fault=${entry.faultId}` : \"\"\n    const adopted = entry.adopted ? \" adopted\" : \"\"\n    // A rejection says what arrived (never the body) and why the service refused it.\n    const received = entry.request\n      ? ` received=${entry.request.bodyBytes === null ? \"?\" : `${entry.request.bodyBytes}B`} ct=${entry.request.contentType ?? \"-\"}${\n          entry.request.transferEncoding ? ` te=${entry.request.transferEncoding}` : \"\"\n        }`\n      : \"\"\n    const issues = entry.issues?.length\n      ? ` issues=${entry.issues\n          .slice(0, 3)\n          .map((issue) => `${issue.path || \"$\"}: ${issue.message}`)\n          .join(\"; \")}${entry.issues.length > 3 ? ` (+${entry.issues.length - 3})` : \"\"}`\n      : \"\"\n    console.log(\n      `${entry.service} ${entry.method} ${entry.path} ${entry.status} ${op} ${entry.durationMs}ms${ns}${fault}${adopted}${received}${issues}`,\n    )\n  }\n}\n\nconst asString = (value: string | boolean | undefined): string | undefined =>\n  typeof value === \"string\" ? value : undefined\n\n/** A service entry in `mockingbird.json`. */\nexport type ConfigService = {\n  port?: number\n  host?: string\n  adminKey?: string\n  seed?: string\n  /** Service-specific serve flags, by long name: `{ \"webhook-url\": \"\u2026\" }`. */\n  options?: Record<string, string | boolean>\n}\n\nexport type MockingbirdConfig = {\n  /** Keyed by service name: `junction` loads `@crvouga/mockingbird-service-junction`. */\n  services: Record<string, ConfigService>\n  log?: LogFormat\n}\n\nconst loadTarget = async (name: string, own: ServeTarget): Promise<ServeTarget> => {\n  if (name === own.name) return own\n  const specifier = `@crvouga/mockingbird-service-${name}/server`\n  try {\n    const mod = (await import(specifier)) as { serveTarget?: ServeTarget }\n    if (!mod.serveTarget) throw new Error(`${specifier} exports no serveTarget`)\n    return mod.serveTarget\n  } catch (error) {\n    const reason = error instanceof Error ? error.message : String(error)\n    throw new Error(\n      `cannot load service \"${name}\": ${reason}. Install @crvouga/mockingbird-service-${name}.`,\n    )\n  }\n}\n\nconst start = async (\n  target: ServeTarget,\n  values: CliValues,\n  config: { port: number; host: string; adminKey?: string; seed?: string; log: LogFormat },\n): Promise<Listening> => {\n  const runtime = await target.create(values, {\n    adminKey: config.adminKey,\n    seed: config.seed,\n    onLog: formatLog(config.log),\n  })\n  const listening = await listen(runtime, { port: config.port, host: config.host })\n  target.listening?.(listening)\n  console.log(`${target.name} mock listening on ${listening.url}`)\n  console.log(`${target.name} health: GET ${listening.url}/health`)\n  console.log(\n    `${target.name} admin: ${listening.url}/__admin (${config.adminKey ? \"x-mockingbird-admin-key required\" : \"open \u2014 pass --admin-key to lock\"})`,\n  )\n  console.log(`${target.name} admin ui: ${listening.url}/__admin/ui`)\n  for (const line of target.banner?.(runtime) ?? []) console.log(`${target.name} ${line}`)\n  return listening\n}\n\nconst untilSignal = async (servers: Listening[]): Promise<number> =>\n  new Promise((resolve) => {\n    const stop = async () => {\n      await Promise.allSettled(servers.map((s) => s.close()))\n      resolve(0)\n    }\n    process.once(\"SIGINT\", stop)\n    process.once(\"SIGTERM\", stop)\n  })\n\n/** The standard `serve` command for a service, including multi-service `--config`. */\nexport const serveCommand = (target: ServeTarget): CliCommand => ({\n  summary: `Serve the ${target.name} mock over HTTP`,\n  options: { ...COMMON_SERVE_OPTIONS, ...target.options },\n  async run(values) {\n    const log = (\n      values[\"log-requests\"] === true ? \"json\" : (asString(values.log) ?? \"pretty\")\n    ) as LogFormat\n    if (![\"pretty\", \"json\", \"off\"].includes(log)) {\n      console.error(`--log must be pretty, json or off (got ${log})`)\n      return 2\n    }\n    const configPath = asString(values.config)\n    if (configPath !== undefined) {\n      const config = JSON.parse(await readFile(configPath, \"utf8\")) as MockingbirdConfig\n      const servers: Listening[] = []\n      try {\n        for (const [name, entry] of Object.entries(config.services ?? {})) {\n          const each = await loadTarget(name, target)\n          servers.push(\n            await start(each, entry.options ?? {}, {\n              port: entry.port ?? each.defaultPort,\n              host: entry.host ?? \"127.0.0.1\",\n              ...(entry.adminKey !== undefined ? { adminKey: entry.adminKey } : {}),\n              ...(entry.seed !== undefined ? { seed: entry.seed } : {}),\n              log: config.log ?? log,\n            }),\n          )\n        }\n      } catch (error) {\n        await Promise.allSettled(servers.map((s) => s.close()))\n        console.error(error instanceof Error ? error.message : String(error))\n        return 1\n      }\n      return untilSignal(servers)\n    }\n    const port = asString(values.port)\n    const adminKey = asString(values[\"admin-key\"]) ?? process.env.MOCKINGBIRD_ADMIN_KEY\n    const seed = asString(values.seed)\n    let listening: Listening\n    try {\n      listening = await start(target, values, {\n        port: port === undefined ? target.defaultPort : Number.parseInt(port, 10),\n        host: asString(values.host) ?? \"127.0.0.1\",\n        ...(adminKey !== undefined ? { adminKey } : {}),\n        ...(seed !== undefined ? { seed } : {}),\n        log,\n      })\n    } catch (error) {\n      console.error(error instanceof Error ? error.message : String(error))\n      return 1\n    }\n    return untilSignal([listening])\n  },\n})\n", "import { createServer } from \"node:http\"\nimport type { FetchAPI } from \"@crvouga/mockingbird-core\"\n\n/** Options for {@link serve}. */\nexport type NodeServeOptions = {\n  port?: number\n  host?: string\n}\n\n/**\n * Serve any Mockingbird {@link FetchAPI} over `node:http`.\n * Port defaults to `0`, so the OS assigns an ephemeral port (read from `server.address()`).\n */\nexport const serve = async (api: FetchAPI, options: NodeServeOptions = {}) => {\n  const server = createServer(async (req, res) => {\n    const chunks: Buffer[] = []\n    for await (const chunk of req) {\n      chunks.push(Buffer.from(chunk))\n    }\n    const body = Buffer.concat(chunks)\n    const address = server.address()\n    const port = typeof address === \"object\" && address !== null ? address.port : undefined\n    const base = `http://${req.headers.host ?? `localhost:${port ?? 80}`}`\n    const raw = req.url ?? \"/\"\n    const url = new URL(raw.replace(/^\\/+/, \"/\"), base)\n    const method = req.method ?? \"GET\"\n    const init: RequestInit = { method, headers: req.headers as Record<string, string> }\n    if (method !== \"GET\" && method !== \"HEAD\" && body.length > 0) {\n      init.body = body\n    }\n    const aborted = new AbortController()\n    res.once(\"close\", () => {\n      if (!res.writableFinished) aborted.abort()\n    })\n    init.signal = aborted.signal\n    const request = new Request(url, init)\n    let response: Response\n    try {\n      response = await api.fetch(request)\n    } catch (error) {\n      // A `drop` fault: destroy the socket so the client sees the connection die.\n      if ((error as { code?: string }).code === \"MOCKINGBIRD_DROP\") {\n        req.socket.destroy()\n        return\n      }\n      res.writeHead(500, { \"content-type\": \"application/json\" })\n      res.end(\n        JSON.stringify({\n          error: {\n            type: \"mockingbird_internal\",\n            message: error instanceof Error ? error.message : String(error),\n          },\n        }),\n      )\n      return\n    }\n    // Headers#entries() joins repeated headers; Set-Cookie must stay one header per cookie.\n    const headers: Record<string, string | string[]> = Object.fromEntries(response.headers)\n    const cookies = response.headers.getSetCookie()\n    if (cookies.length > 0) headers[\"set-cookie\"] = cookies\n    if (!response.body) {\n      res.writeHead(response.status, headers)\n      res.end()\n      return\n    }\n    // Stream the body chunk by chunk: event streams and long-polls must not be buffered.\n    res.writeHead(response.status, headers)\n    res.flushHeaders()\n    const reader = response.body.getReader()\n    try {\n      for (;;) {\n        const { done, value } = await reader.read()\n        if (done) break\n        if (!res.write(value)) await new Promise<void>((resolve) => res.once(\"drain\", resolve))\n      }\n      res.end()\n    } catch {\n      res.destroy()\n    } finally {\n      reader.releaseLock()\n    }\n  })\n  await new Promise<void>((resolve, reject) => {\n    server.once(\"error\", reject)\n    server.listen(options.port ?? 0, options.host, resolve)\n  })\n  return server\n}\n", "import type { Server } from \"node:http\"\nimport type { FetchAPI } from \"@crvouga/mockingbird-core\"\nimport { serve } from \"./serve.js\"\n\nexport type ListenOptions = {\n  /** Default `0`: the OS picks a free port. */\n  port?: number\n  /** Default `127.0.0.1`: a mock should not be reachable off the machine by accident. */\n  host?: string\n}\n\n/** A running server, with the address it actually bound. */\nexport type Listening = {\n  url: string\n  port: number\n  host: string\n  server: Server\n  close(): Promise<void>\n}\n\nexport const listen = async (api: FetchAPI, options: ListenOptions = {}): Promise<Listening> => {\n  const host = options.host ?? \"127.0.0.1\"\n  const server = await serve(api, { port: options.port ?? 0, host })\n  const address = server.address()\n  const port = typeof address === \"object\" && address !== null ? address.port : (options.port ?? 0)\n  const shown = host.includes(\":\") ? `[${host}]` : host\n  return {\n    url: `http://${shown}:${port}`,\n    port,\n    host,\n    server,\n    close: () =>\n      new Promise<void>((resolve, reject) => {\n        // Stop accepting first, then drop keep-alive sockets so close() can finish.\n        server.close((error) => {\n          if (error && (error as { code?: string }).code !== \"ERR_SERVER_NOT_RUNNING\") reject(error)\n          else resolve()\n        })\n        server.closeAllConnections?.()\n      }),\n  }\n}\n", "/// <reference types=\"node\" />\nimport { type Listening, listen, type ServeTarget } from \"@crvouga/mockingbird-adapter-node\"\nimport { createRuntime, type FormbricksRuntime, type FormbricksRuntimeOptions } from \"./runtime.js\"\nimport { DEFAULT_SETTINGS } from \"./state.js\"\n\n/** Port `mockingbird-formbricks serve` listens on when none is given. */\nexport const DEFAULT_PORT = 8813\n\nexport type FormbricksServerOptions = FormbricksRuntimeOptions & {\n  /** Default `0`: the OS picks a free port. */\n  port?: number\n  /** Default `127.0.0.1`. */\n  host?: string\n}\n\nexport type FormbricksServer = Listening & { runtime: FormbricksRuntime }\n\n/** Serve the Formbricks mock over `node:http`. */\nexport const createServer = async (\n  options: FormbricksServerOptions = {},\n): Promise<FormbricksServer> => {\n  const { port, host, ...rest } = options\n  const runtime = createRuntime(rest)\n  const listening = await listen(runtime, {\n    port: port ?? 0,\n    ...(host !== undefined ? { host } : {}),\n  })\n  return { ...listening, runtime }\n}\n\nconst text = (value: string | boolean | undefined) =>\n  typeof value === \"string\" ? value : undefined\n\n/** How `serve` (and `serve --config`) builds the Formbricks mock from flags. */\nexport const serveTarget: ServeTarget = {\n  name: \"formbricks\",\n  defaultPort: DEFAULT_PORT,\n  options: {\n    \"webhook-url\": {\n      type: \"string\",\n      value: \"<url>\",\n      description: \"Deliver webhooks here (e.g. http://127.0.0.1:3000/webhooks/formbricks)\",\n    },\n    \"webhook-token\": {\n      type: \"string\",\n      value: \"<token>\",\n      description: \"Appended to the webhook url as ?token= (for receivers that check one)\",\n    },\n    \"webhook-secret\": {\n      type: \"string\",\n      value: \"<whsec_\u2026>\",\n      description: \"Standard Webhooks key that signs webhook-signature (optional)\",\n    },\n    \"workspace-id\": {\n      type: \"string\",\n      value: \"<id>\",\n      description: \"An extra workspace id that serves the survey corpus\",\n    },\n  },\n  create: (values, common) => {\n    const url = text(values[\"webhook-url\"])\n    const token = text(values[\"webhook-token\"])\n    const secret = text(values[\"webhook-secret\"])\n    const workspace = text(values[\"workspace-id\"])\n    const target =\n      url && token\n        ? `${url}${url.includes(\"?\") ? \"&\" : \"?\"}token=${encodeURIComponent(token)}`\n        : url\n    return createRuntime({\n      ...(target ? { webhooks: { url: target, ...(secret ? { secret } : {}) } } : {}),\n      ...(workspace\n        ? { settings: { workspaces: [workspace, ...DEFAULT_SETTINGS.workspaces] } }\n        : {}),\n      ...(common.adminKey !== undefined ? { adminKey: common.adminKey } : {}),\n      ...(common.seed !== undefined ? { seed: common.seed } : {}),\n      ...(common.onLog ? { onLog: common.onLog } : {}),\n    })\n  },\n  banner: () => [\n    `point the SDK's appUrl at this url; workspace ${DEFAULT_SETTINGS.workspaces[0]} (legacy environment ${Object.keys(DEFAULT_SETTINGS.legacyEnvironmentIds)[0]}) serves the survey corpus`,\n    \"management API: x-api-key <any>; namespaces: x-mockingbird-namespace, /ns/<name>/\u2026, or PUT /__admin/credentials {<workspace id | api key>: <ns>}\",\n  ],\n}\n"],
+  "mappings": ";;;;;;AAAA,SAAS,gBAAgB;AACzB,SAA+B,iBAAiB;;;ACDhD,SAAS,oBAAoB;AAatB,IAAM,QAAQ,OAAO,KAAe,UAA4B,CAAA,MAAM;AAC3E,QAAM,SAAS,aAAa,OAAO,KAAK,QAAO;AAC7C,UAAM,SAAmB,CAAA;AACzB,qBAAiB,SAAS,KAAK;AAC7B,aAAO,KAAK,OAAO,KAAK,KAAK,CAAC;IAChC;AACA,UAAM,OAAO,OAAO,OAAO,MAAM;AACjC,UAAM,UAAU,OAAO,QAAO;AAC9B,UAAM,OAAO,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAO;AAC9E,UAAM,OAAO,UAAU,IAAI,QAAQ,QAAQ,aAAa,QAAQ,EAAE,EAAE;AACpE,UAAM,MAAM,IAAI,OAAO;AACvB,UAAM,MAAM,IAAI,IAAI,IAAI,QAAQ,QAAQ,GAAG,GAAG,IAAI;AAClD,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,OAAoB,EAAE,QAAQ,SAAS,IAAI,QAAiC;AAClF,QAAI,WAAW,SAAS,WAAW,UAAU,KAAK,SAAS,GAAG;AAC5D,WAAK,OAAO;IACd;AACA,UAAM,UAAU,IAAI,gBAAe;AACnC,QAAI,KAAK,SAAS,MAAK;AACrB,UAAI,CAAC,IAAI;AAAkB,gBAAQ,MAAK;IAC1C,CAAC;AACD,SAAK,SAAS,QAAQ;AACtB,UAAM,UAAU,IAAI,QAAQ,KAAK,IAAI;AACrC,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,IAAI,MAAM,OAAO;IACpC,SAAS,OAAO;AAEd,UAAK,MAA4B,SAAS,oBAAoB;AAC5D,YAAI,OAAO,QAAO;AAClB;MACF;AACA,UAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAkB,CAAE;AACzD,UAAI,IACF,KAAK,UAAU;QACb,OAAO;UACL,MAAM;UACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;;OAEjE,CAAC;AAEJ;IACF;AAEA,UAAM,UAA6C,OAAO,YAAY,SAAS,OAAO;AACtF,UAAM,UAAU,SAAS,QAAQ,aAAY;AAC7C,QAAI,QAAQ,SAAS;AAAG,cAAQ,YAAY,IAAI;AAChD,QAAI,CAAC,SAAS,MAAM;AAClB,UAAI,UAAU,SAAS,QAAQ,OAAO;AACtC,UAAI,IAAG;AACP;IACF;AAEA,QAAI,UAAU,SAAS,QAAQ,OAAO;AACtC,QAAI,aAAY;AAChB,UAAM,SAAS,SAAS,KAAK,UAAS;AACtC,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,MAAM,MAAK,IAAK,MAAM,OAAO,KAAI;AACzC,YAAI;AAAM;AACV,YAAI,CAAC,IAAI,MAAM,KAAK;AAAG,gBAAM,IAAI,QAAc,CAAC,YAAY,IAAI,KAAK,SAAS,OAAO,CAAC;MACxF;AACA,UAAI,IAAG;IACT,QAAQ;AACN,UAAI,QAAO;IACb;AACE,aAAO,YAAW;IACpB;EACF,CAAC;AACD,QAAM,IAAI,QAAc,CAAC,SAAS,WAAU;AAC1C,WAAO,KAAK,SAAS,MAAM;AAC3B,WAAO,OAAO,QAAQ,QAAQ,GAAG,QAAQ,MAAM,OAAO;EACxD,CAAC;AACD,SAAO;AACT;;;ACnEO,IAAM,SAAS,OAAO,KAAe,UAAyB,CAAA,MAA0B;AAC7F,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,SAAS,MAAM,MAAM,KAAK,EAAE,MAAM,QAAQ,QAAQ,GAAG,KAAI,CAAE;AACjE,QAAM,UAAU,OAAO,QAAO;AAC9B,QAAM,OAAO,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAQ,QAAQ,QAAQ;AAC/F,QAAM,QAAQ,KAAK,SAAS,GAAG,IAAI,IAAI,IAAI,MAAM;AACjD,SAAO;IACL,KAAK,UAAU,KAAK,IAAI,IAAI;IAC5B;IACA;IACA;IACA,OAAO,MACL,IAAI,QAAc,CAAC,SAAS,WAAU;AAEpC,aAAO,MAAM,CAAC,UAAS;AACrB,YAAI,SAAU,MAA4B,SAAS;AAA0B,iBAAO,KAAK;;AACpF,kBAAO;MACd,CAAC;AACD,aAAO,sBAAqB;IAC9B,CAAC;;AAEP;;;AFZA,IAAM,aAAa,CAAC,YAClB,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,MAAK;AAC7C,QAAM,OAAO,KAAK,IAAI,GAAG,OAAO,SAAS,WAAW,IAAI,OAAO,SAAS,SAAS,KAAK,EAAE;AACxF,QAAM,WAAW,OAAO,YAAY,SAAY,cAAc,OAAO,OAAO,OAAO,CAAC,MAAM;AAC1F,SAAO,KAAK,KAAK,OAAO,EAAE,CAAC,IAAI,OAAO,WAAW,GAAG,QAAQ;AAC9D,CAAC;AAEH,IAAM,OAAO,CAAC,SACZ;EACE,GAAG,KAAK,GAAG,WAAM,KAAK,WAAW;EACjC;EACA;EACA,KAAK,KAAK,GAAG;EACb;EACA;EACA,GAAG,OAAO,QAAQ,KAAK,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE;EACvF;EACA,SAAS,KAAK,GAAG;EACjB,KAAK,IAAI;AAEb,IAAM,cAAc,CAAC,MAAe,MAAc,YAChD;EACE,GAAG,KAAK,GAAG,IAAI,IAAI,WAAM,QAAQ,OAAO;EACxC;EACA;EACA,KAAK,QAAQ,SAAS,GAAG,KAAK,GAAG,IAAI,IAAI,YAAY;EACrD,GAAI,QAAQ,UAAU,CAAC,IAAI,YAAY,GAAG,WAAW,QAAQ,OAAO,CAAC,IAAI,CAAA;EACzE,KAAK,IAAI;AAGN,IAAM,SAAS,OAAO,MAAe,SAAmC;AAE7E,QAAM,OAAO,KAAK,UAAU,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK;AAC1D,QAAM,QAAQ,SAAS,UAAa,KAAK,SAAS,IAAI,IAAI,IAAI;AAC9D,QAAM,OAAO,UAAU,IAAI,OAAO,KAAK,CAAC;AACxC,QAAM,OAAO,KAAK,MAAM,KAAK;AAC7B,MAAI,SAAS,UAAa,SAAS,YAAY,SAAS,QAAQ,SAAS,QAAQ;AAC/E,YAAQ,IAAI,KAAK,IAAI,CAAC;AACtB,WAAO;EACT;AACA,QAAM,UAAU,KAAK,SAAS,IAAI;AAClC,MAAI,CAAC,SAAS;AACZ,YAAQ,MAAM,GAAG,KAAK,GAAG,qBAAqB,KAAK,UAAU,IAAI,CAAC;;EAAO,KAAK,IAAI,CAAC,EAAE;AACrF,WAAO;EACT;AACA,MAAI,KAAK,SAAS,QAAQ,KAAK,KAAK,SAAS,IAAI,GAAG;AAClD,YAAQ,IAAI,YAAY,MAAM,MAAM,OAAO,CAAC;AAC5C,WAAO;EACT;AACA,MAAI;AACJ,MAAI;AACF,aAAS,UAAU;MACjB,MAAM;MACN,kBAAkB;MAClB,QAAQ;MACR,SAAS,OAAO,YACd,OAAO,QAAQ,QAAQ,WAAW,CAAA,CAAE,EAAE,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM;QAC3D;QACA;UACE,MAAM,OAAO;UACb,GAAI,OAAO,YAAY,SAAY,EAAE,SAAS,OAAO,QAAO,IAAK,CAAA;;OAEpE,CAAC;KAEL;EACH,SAAS,OAAO;AACd,YAAQ,MACN,GAAG,KAAK,GAAG,IAAI,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;;EAAO,YAAY,MAAM,MAAM,OAAO,CAAC,EAAE;AAEzH,WAAO;EACT;AACA,SAAO,QAAQ,IAAI,OAAO,QAAQ,OAAO,WAAW;AACtD;AAgCA,IAAM,uBAAkD;EACtD,MAAM,EAAE,MAAM,UAAU,OAAO,UAAU,aAAa,oBAAmB;EACzE,MAAM,EAAE,MAAM,UAAU,OAAO,UAAU,aAAa,qBAAqB,SAAS,YAAW;EAC/F,aAAa;IACX,MAAM;IACN,OAAO;IACP,aAAa;;EAEf,MAAM,EAAE,MAAM,UAAU,OAAO,UAAU,aAAa,+BAA8B;EACpF,KAAK;IACH,MAAM;IACN,OAAO;IACP,aAAa;IACb,SAAS;;EAEX,gBAAgB;IACd,MAAM;IACN,aACE;;EAEJ,QAAQ;IACN,MAAM;IACN,OAAO;IACP,aAAa;;;AAIjB,IAAM,YAAY,CAAC,WAAqB;AACtC,MAAI,WAAW;AAAO,WAAO;AAC7B,MAAI,WAAW;AAAQ,WAAO,CAAC,UAAsB,QAAQ,IAAI,KAAK,UAAU,KAAK,CAAC;AACtF,SAAO,CAAC,UAAqB;AAC3B,UAAM,KAAK,MAAM,gBAAgB,MAAM,YAAY,cAAc;AACjE,UAAM,KAAK,MAAM,cAAc,YAAY,KAAK,KAAK,MAAM,SAAS;AACpE,UAAM,QAAQ,MAAM,UAAU,UAAU,MAAM,OAAO,KAAK;AAC1D,UAAM,UAAU,MAAM,UAAU,aAAa;AAE7C,UAAM,WAAW,MAAM,UACnB,aAAa,MAAM,QAAQ,cAAc,OAAO,MAAM,GAAG,MAAM,QAAQ,SAAS,GAAG,OAAO,MAAM,QAAQ,eAAe,GAAG,GACxH,MAAM,QAAQ,mBAAmB,OAAO,MAAM,QAAQ,gBAAgB,KAAK,EAC7E,KACA;AACJ,UAAM,SAAS,MAAM,QAAQ,SACzB,WAAW,MAAM,OACd,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,UAAU,GAAG,MAAM,QAAQ,GAAG,KAAK,MAAM,OAAO,EAAE,EACvD,KAAK,IAAI,CAAC,GAAG,MAAM,OAAO,SAAS,IAAI,MAAM,MAAM,OAAO,SAAS,CAAC,MAAM,EAAE,KAC/E;AACJ,YAAQ,IACN,GAAG,MAAM,OAAO,IAAI,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,MAAM,IAAI,EAAE,IAAI,MAAM,UAAU,KAAK,EAAE,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,EAAE;EAE3I;AACF;AAEA,IAAM,WAAW,CAAC,UAChB,OAAO,UAAU,WAAW,QAAQ;AAkBtC,IAAM,aAAa,OAAO,MAAc,QAA0C;AAChF,MAAI,SAAS,IAAI;AAAM,WAAO;AAC9B,QAAM,YAAY,gCAAgC,IAAI;AACtD,MAAI;AACF,UAAM,MAAO,MAAM,OAAO;AAC1B,QAAI,CAAC,IAAI;AAAa,YAAM,IAAI,MAAM,GAAG,SAAS,yBAAyB;AAC3E,WAAO,IAAI;EACb,SAAS,OAAO;AACd,UAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACpE,UAAM,IAAI,MACR,wBAAwB,IAAI,MAAM,MAAM,0CAA0C,IAAI,GAAG;EAE7F;AACF;AAEA,IAAM,QAAQ,OACZ,QACA,QACA,WACsB;AACtB,QAAM,UAAU,MAAM,OAAO,OAAO,QAAQ;IAC1C,UAAU,OAAO;IACjB,MAAM,OAAO;IACb,OAAO,UAAU,OAAO,GAAG;GAC5B;AACD,QAAM,YAAY,MAAM,OAAO,SAAS,EAAE,MAAM,OAAO,MAAM,MAAM,OAAO,KAAI,CAAE;AAChF,SAAO,YAAY,SAAS;AAC5B,UAAQ,IAAI,GAAG,OAAO,IAAI,sBAAsB,UAAU,GAAG,EAAE;AAC/D,UAAQ,IAAI,GAAG,OAAO,IAAI,gBAAgB,UAAU,GAAG,SAAS;AAChE,UAAQ,IACN,GAAG,OAAO,IAAI,WAAW,UAAU,GAAG,aAAa,OAAO,WAAW,qCAAqC,sCAAiC,GAAG;AAEhJ,UAAQ,IAAI,GAAG,OAAO,IAAI,cAAc,UAAU,GAAG,aAAa;AAClE,aAAW,QAAQ,OAAO,SAAS,OAAO,KAAK,CAAA;AAAI,YAAQ,IAAI,GAAG,OAAO,IAAI,IAAI,IAAI,EAAE;AACvF,SAAO;AACT;AAEA,IAAM,cAAc,OAAO,YACzB,IAAI,QAAQ,CAAC,YAAW;AACtB,QAAM,OAAO,YAAW;AACtB,UAAM,QAAQ,WAAW,QAAQ,IAAI,CAAC,MAAM,EAAE,MAAK,CAAE,CAAC;AACtD,YAAQ,CAAC;EACX;AACA,UAAQ,KAAK,UAAU,IAAI;AAC3B,UAAQ,KAAK,WAAW,IAAI;AAC9B,CAAC;AAGI,IAAM,eAAe,CAAC,YAAqC;EAChE,SAAS,aAAa,OAAO,IAAI;EACjC,SAAS,EAAE,GAAG,sBAAsB,GAAG,OAAO,QAAO;EACrD,MAAM,IAAI,QAAM;AACd,UAAM,MACJ,OAAO,cAAc,MAAM,OAAO,SAAU,SAAS,OAAO,GAAG,KAAK;AAEtE,QAAI,CAAC,CAAC,UAAU,QAAQ,KAAK,EAAE,SAAS,GAAG,GAAG;AAC5C,cAAQ,MAAM,0CAA0C,GAAG,GAAG;AAC9D,aAAO;IACT;AACA,UAAM,aAAa,SAAS,OAAO,MAAM;AACzC,QAAI,eAAe,QAAW;AAC5B,YAAM,SAAS,KAAK,MAAM,MAAM,SAAS,YAAY,MAAM,CAAC;AAC5D,YAAM,UAAuB,CAAA;AAC7B,UAAI;AACF,mBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,YAAY,CAAA,CAAE,GAAG;AACjE,gBAAM,OAAO,MAAM,WAAW,MAAM,MAAM;AAC1C,kBAAQ,KACN,MAAM,MAAM,MAAM,MAAM,WAAW,CAAA,GAAI;YACrC,MAAM,MAAM,QAAQ,KAAK;YACzB,MAAM,MAAM,QAAQ;YACpB,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAQ,IAAK,CAAA;YAClE,GAAI,MAAM,SAAS,SAAY,EAAE,MAAM,MAAM,KAAI,IAAK,CAAA;YACtD,KAAK,OAAO,OAAO;WACpB,CAAC;QAEN;MACF,SAAS,OAAO;AACd,cAAM,QAAQ,WAAW,QAAQ,IAAI,CAAC,MAAM,EAAE,MAAK,CAAE,CAAC;AACtD,gBAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACpE,eAAO;MACT;AACA,aAAO,YAAY,OAAO;IAC5B;AACA,UAAM,OAAO,SAAS,OAAO,IAAI;AACjC,UAAM,WAAW,SAAS,OAAO,WAAW,CAAC,KAAK,QAAQ,IAAI;AAC9D,UAAM,OAAO,SAAS,OAAO,IAAI;AACjC,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,MAAM,QAAQ,QAAQ;QACtC,MAAM,SAAS,SAAY,OAAO,cAAc,OAAO,SAAS,MAAM,EAAE;QACxE,MAAM,SAAS,OAAO,IAAI,KAAK;QAC/B,GAAI,aAAa,SAAY,EAAE,SAAQ,IAAK,CAAA;QAC5C,GAAI,SAAS,SAAY,EAAE,KAAI,IAAK,CAAA;QACpC;OACD;IACH,SAAS,OAAO;AACd,cAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AACpE,aAAO;IACT;AACA,WAAO,YAAY,CAAC,SAAS,CAAC;EAChC;;;;AG3SK,IAAM,eAAe;AAYrB,IAAMA,gBAAe,OAC1B,UAAmC,CAAC,MACN;AAC9B,QAAM,EAAE,MAAM,MAAM,GAAG,KAAK,IAAI;AAChC,QAAM,UAAU,cAAc,IAAI;AAClC,QAAM,YAAY,MAAM,OAAO,SAAS;AAAA,IACtC,MAAM,QAAQ;AAAA,IACd,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,EACvC,CAAC;AACD,SAAO,EAAE,GAAG,WAAW,QAAQ;AACjC;AAEA,IAAM,OAAO,CAAC,UACZ,OAAO,UAAU,WAAW,QAAQ;AAG/B,IAAM,cAA2B;AAAA,EACtC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,SAAS;AAAA,IACP,eAAe;AAAA,MACb,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,IACA,iBAAiB;AAAA,MACf,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,IACA,kBAAkB;AAAA,MAChB,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,IACA,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN,OAAO;AAAA,MACP,aAAa;AAAA,IACf;AAAA,EACF;AAAA,EACA,QAAQ,CAAC,QAAQ,WAAW;AAC1B,UAAM,MAAM,KAAK,OAAO,aAAa,CAAC;AACtC,UAAM,QAAQ,KAAK,OAAO,eAAe,CAAC;AAC1C,UAAM,SAAS,KAAK,OAAO,gBAAgB,CAAC;AAC5C,UAAM,YAAY,KAAK,OAAO,cAAc,CAAC;AAC7C,UAAM,SACJ,OAAO,QACH,GAAG,GAAG,GAAG,IAAI,SAAS,GAAG,IAAI,MAAM,GAAG,SAAS,mBAAmB,KAAK,CAAC,KACxE;AACN,WAAO,cAAc;AAAA,MACnB,GAAI,SAAS,EAAE,UAAU,EAAE,KAAK,QAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,EAAE,IAAI,CAAC;AAAA,MAC7E,GAAI,YACA,EAAE,UAAU,EAAE,YAAY,CAAC,WAAW,GAAG,iBAAiB,UAAU,EAAE,EAAE,IACxE,CAAC;AAAA,MACL,GAAI,OAAO,aAAa,SAAY,EAAE,UAAU,OAAO,SAAS,IAAI,CAAC;AAAA,MACrE,GAAI,OAAO,SAAS,SAAY,EAAE,MAAM,OAAO,KAAK,IAAI,CAAC;AAAA,MACzD,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAChD,CAAC;AAAA,EACH;AAAA,EACA,QAAQ,MAAM;AAAA,IACZ,iDAAiD,iBAAiB,WAAW,CAAC,CAAC,wBAAwB,OAAO,KAAK,iBAAiB,oBAAoB,EAAE,CAAC,CAAC;AAAA,IAC5J;AAAA,EACF;AACF;",
+  "names": ["createServer"]
+}

package/dist/{chunk-24SBIGNG.js → chunk-JAVNDNOU.js}

@@ -2107,6 +2107,50 @@ function bootAdmin(config) {
     if (render)
       await render();
   }
+  const delay = (ms) => new Promise((resolve) => {
+    window.setTimeout(resolve, ms);
+  });
+  const confirmAction = async (button, pending, done, work) => {
+    if (button.dataset.pending === "1")
+      return;
+    const label = button.textContent ?? "";
+    const width = button.offsetWidth;
+    button.dataset.pending = "1";
+    button.classList.add("pressed");
+    button.setAttribute("aria-busy", "true");
+    button.style.minWidth = `${width}px`;
+    button.textContent = pending;
+    try {
+      await work();
+      button.textContent = done;
+      await delay(1e3);
+    } catch (error2) {
+      showError(error2);
+    } finally {
+      button.textContent = label;
+      button.style.minWidth = "";
+      button.classList.remove("pressed");
+      button.removeAttribute("aria-busy");
+      delete button.dataset.pending;
+    }
+  };
+  document.addEventListener("click", (event) => {
+    const target = event.target;
+    if (!(target instanceof Element))
+      return;
+    const button = target.closest("button");
+    if (!(button instanceof HTMLButtonElement) || button.dataset.pending === "1")
+      return;
+    button.classList.add("pressed");
+    const token = String(Date.now());
+    button.dataset.press = token;
+    window.setTimeout(() => {
+      if (button.dataset.press !== token || button.dataset.pending === "1")
+        return;
+      button.classList.remove("pressed");
+      delete button.dataset.press;
+    }, 450);
+  });
   el("namespace", HTMLSelectElement).addEventListener("change", () => {
     state.namespace = el("namespace", HTMLSelectElement).value;
     refresh().catch(showError);
@@ -2117,7 +2161,7 @@ function bootAdmin(config) {
     refresh().catch(showError);
   });
   el("refresh", HTMLButtonElement).addEventListener("click", () => {
-    refresh().catch(showError);
+    confirmAction(el("refresh", HTMLButtonElement), "Refreshing...", "Updated", () => refresh()).catch(showError);
   });
   el("collections", HTMLElement).addEventListener("click", (event) => {
     const target = event.target;
@@ -2240,10 +2284,10 @@ function bootAdmin(config) {
     }).then(() => renderFaults()).catch(showError);
   });
   el("fault-clear", HTMLButtonElement).addEventListener("click", () => {
-    api("DELETE", "/faults").then(() => renderFaults()).catch(showError);
+    confirmAction(el("fault-clear", HTMLButtonElement), "Clearing...", "Cleared", () => api("DELETE", "/faults").then(() => renderFaults())).catch(showError);
   });
   el("journal-clear", HTMLButtonElement).addEventListener("click", () => {
-    api("DELETE", "/requests").then(() => renderJournal()).catch(showError);
+    confirmAction(el("journal-clear", HTMLButtonElement), "Clearing...", "Cleared", () => api("DELETE", "/requests").then(() => renderJournal())).catch(showError);
   });
   el("route-list", HTMLElement).addEventListener("click", (event) => {
     const target = event.target;
@@ -2358,9 +2402,13 @@ function bootAdmin(config) {
 var clientPrelude = [isRecord2, mountAdminBrand, startAdminBrand, faultPresetList, bootAdmin].map((fn) => fn.toString()).join("\n");
 var adminClientSource = (config) => {
   const payload = JSON.stringify(config).replace(/</g, "\\u003c");
+  const entry = bootAdmin.name;
+  if (!/^[A-Za-z_$][\w$]*$/.test(entry)) {
+    throw new Error("admin client cannot call its boot function");
+  }
   return `<script>
 ${clientPrelude}
-bootAdmin(${payload});
+${entry}(${payload});
 </script>`;
 };
 
@@ -2574,9 +2622,24 @@ var renderAdminDocument = (service) => {
   .controls { display: flex; flex-wrap: wrap; gap: 8px; align-items: center; }
   label.field { display: flex; flex-direction: column; gap: 2px; font-size: 11px; color: var(--faint); }
   label.field input, label.field select, .controls input[type="password"] {
-    background: var(--bg-inset); border: 1px solid var(--line); border-radius: 8px;
-    padding: 7px 8px; min-height: 36px;
-  }
+    background-color: var(--bg-inset); border: 1px solid var(--line); border-radius: 8px;
+    padding: 7px 8px; min-height: 36px; line-height: 1.2;
+  }
+  /* A native menu ignores min-height, so Preset rendered about half as tall as
+     the text fields in the same form. Paint it like those fields. */
+  label.field select {
+    -webkit-appearance: none; appearance: none;
+    padding-right: 28px;
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='12' height='12' viewBox='0 0 12 12'%3E%3Cpath fill='none' stroke='%2371717a' stroke-width='1.5' stroke-linecap='round' stroke-linejoin='round' d='M2.5 4.5 6 8l3.5-3.5'/%3E%3C/svg%3E");
+    background-repeat: no-repeat; background-position: right 10px center; background-size: 12px 12px;
+  }
+  .stack > .field > input,
+  .stack > .field > select,
+  .stack > .field > textarea,
+  dialog .field > input,
+  dialog .field > select,
+  dialog .field > textarea { width: 100%; }
+  .icon-btn, .btn, .btn-primary, .btn-quiet, .btn-danger, nav.side button { cursor: pointer; }
   .icon-btn, .btn, .btn-primary, .btn-quiet, .btn-danger {
     border-radius: 9px; min-height: 36px; padding: 0 12px; border: 1px solid var(--line);
     background: var(--bg-elev);
@@ -2584,6 +2647,14 @@ var renderAdminDocument = (service) => {
   .btn-primary { background: var(--accent); color: var(--accent-ink); border-color: transparent; }
   .btn-quiet { background: transparent; }
   .btn-danger { color: var(--err); }
+  /* Held after mouseup. Clearing an empty journal changes nothing on screen,
+     so the press itself has to stay visible. */
+  .icon-btn:active, .btn:active, .btn-quiet:active, .btn-danger:active, nav.side button:active,
+  .icon-btn.pressed, .btn.pressed, .btn-quiet.pressed, .btn-danger.pressed, nav.side button.pressed {
+    background: var(--bg-inset); border-color: var(--line-strong); color: var(--ink);
+  }
+  .btn-danger:active, .btn-danger.pressed { background: var(--err-soft); color: var(--err); }
+  .btn-primary:active, .btn-primary.pressed { filter: brightness(0.88); color: var(--accent-ink); }
   /* minmax(0, 1fr): a 1fr column will not shrink below its content, so a long
      record or the full nav row would widen the page past the viewport. */
   .layout {
@@ -2672,8 +2743,16 @@ var renderAdminDocument = (service) => {
     input, select, textarea { font-size: 16px; }
     .brand, .vendor, .controls { width: 100%; }
     label.field, label.field select, label.field input { flex: 1; min-width: 0; }
-    .layout { grid-template-columns: minmax(0, 1fr); }
+    /* The layout fills the screen. A single-column grid stretches every auto
+       row, so the tab bar grew with the leftover height and the buttons floated
+       in the middle of it. The bar stays one row; the page below takes the rest. */
+    .layout {
+      grid-template-columns: minmax(0, 1fr);
+      grid-template-rows: auto minmax(0, 1fr);
+      align-content: start;
+    }
     nav.side {
+      align-self: start; height: auto;
       flex-direction: row; align-items: center; overflow-x: auto; min-width: 0;
       border-right: 0; border-bottom: 1px solid var(--line);
       padding: 8px;
@@ -3467,7 +3546,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "1.5.1" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "1.6.1" : UNRELEASED_VERSION;
 
 // ../core/dist/signing.js
 var encoder = new TextEncoder();
@@ -5232,7 +5311,8 @@ var DEFAULT_SETTINGS = {
   legacyEnvironmentIds: { [ENVIRONMENT_ID]: WORKSPACE_ID },
   apiKeys: [],
   webhookId: "cwebhook00000000000000001",
-  contactsEnabled: false
+  contactsEnabled: false,
+  validation: "present-only"
 };
 var CORPUS_SURVEYS = surveys_default.surveys;
 var workspaceSettings = (workspaceId) => ({
@@ -5367,10 +5447,40 @@ var invalidOption = (element, value, language) => {
   const submitted = Array.isArray(value) ? value : [value];
   return submitted.some((v) => v !== "" && (typeof v !== "string" || !known.has(v)));
 };
-var validateResponseData = (survey, data, language = "en") => {
-  const present = surveyElements(survey).filter((e) => Object.keys(data).includes(e.id));
+var MAX_OTHER_OPTION_LENGTH = 250;
+var isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var localizedLabel = (label, language) => {
+  if (!isRecord6(label) || !Object.hasOwn(label, "default")) return "";
+  const text = label[language];
+  return typeof text === "string" && text !== "" ? text : "";
+};
+var matchesChoiceLabel = (choices, value, language) => choices.some(
+  (choice) => isRecord6(choice) && isRecord6(choice.label) && localizedLabel(choice.label, language) === value
+);
+var entryOverLimit = (value, choices, language) => !matchesChoiceLabel(choices, value, language) && value.length > MAX_OTHER_OPTION_LENGTH;
+var answerOverLimit = (answer, choices, language) => {
+  if (typeof answer === "string") return entryOverLimit(answer, choices, language);
+  if (!Array.isArray(answer)) return false;
+  return answer.some((item) => typeof item === "string" && entryOverLimit(item, choices, language));
+};
+var otherOptionOverLimit = (survey, data, language) => {
+  const responseLanguage = language ?? "default";
+  for (const [questionId, answer] of Object.entries(data)) {
+    const question = surveyElements(survey).find((element) => element.id === questionId);
+    if (!question?.choices) continue;
+    if (question.type !== "multipleChoiceSingle" && question.type !== "multipleChoiceMulti") {
+      continue;
+    }
+    if (answerOverLimit(answer, question.choices, responseLanguage)) return questionId;
+  }
+  return void 0;
+};
+var validateResponseData = (survey, data, language = "en", options = {}) => {
+  const elements = surveyElements(survey);
+  const presentIds = new Set(Object.keys(data));
+  const selected = options.validation === "finished-validates-all" && options.finished === true ? elements : elements.filter((element) => presentIds.has(element.id));
   const errors = {};
-  for (const element of present) {
+  for (const element of selected) {
     const value = data[element.id];
     const messages = [];
     if (requiredError(element, value)) messages.push(REQUIRED);
@@ -5467,7 +5577,7 @@ var FORMBRICKS_PRESETS = {
 };
 var json5 = (status, body) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
 var adminError4 = (status, message) => json5(status, { error: { type: "mockingbird_admin", message } });
-var isRecord6 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var adminRoutes = (runtime) => ({
   "GET /responses": ({ url, namespace }) => {
     const surveyId = url.searchParams.get("surveyId");
@@ -5477,11 +5587,11 @@ var adminRoutes = (runtime) => ({
   },
   "GET /surveys": ({ namespace }) => json5(200, { surveys: runtime.instance(namespace).state.allSurveys() }),
   "PUT /surveys": ({ body, namespace }) => {
-    const list = Array.isArray(body) ? body : isRecord6(body) ? body.surveys : void 0;
+    const list = Array.isArray(body) ? body : isRecord7(body) ? body.surveys : void 0;
     if (!Array.isArray(list)) return adminError4(400, "expected [survey] or {surveys: [survey]}");
     const state = runtime.instance(namespace).state;
     for (const [index, survey] of list.entries()) {
-      if (!isRecord6(survey) || typeof survey.id !== "string" || typeof survey.name !== "string") {
+      if (!isRecord7(survey) || typeof survey.id !== "string" || typeof survey.name !== "string") {
         return adminError4(400, `surveys[${index}]: id and name are required`);
       }
     }
@@ -5501,16 +5611,16 @@ var adminRoutes = (runtime) => ({
     contacts: runtime.instance(namespace).state.contacts.list({ order: "oldest" }).map((row) => row.value)
   }),
   "PUT /contacts": ({ body, namespace }) => {
-    const list = Array.isArray(body) ? body : isRecord6(body) ? body.contacts : void 0;
+    const list = Array.isArray(body) ? body : isRecord7(body) ? body.contacts : void 0;
     if (!Array.isArray(list)) return adminError4(400, "expected [contact] or {contacts: [contact]}");
     const state = runtime.instance(namespace).state;
     for (const [index, contact] of list.entries()) {
-      if (!isRecord6(contact) || typeof contact.id !== "string") {
+      if (!isRecord7(contact) || typeof contact.id !== "string") {
         return adminError4(400, `contacts[${index}]: id is required`);
       }
     }
     for (const contact of list) {
-      const attributes = isRecord6(contact.attributes) ? Object.fromEntries(Object.entries(contact.attributes).map(([k, v]) => [k, String(v)])) : {};
+      const attributes = isRecord7(contact.attributes) ? Object.fromEntries(Object.entries(contact.attributes).map(([k, v]) => [k, String(v)])) : {};
       if (typeof contact.userId === "string") attributes.userId = contact.userId;
       state.contacts.insert(contact.id, {
         id: contact.id,
@@ -5522,10 +5632,10 @@ var adminRoutes = (runtime) => ({
   },
   "GET /settings": ({ namespace }) => json5(200, runtime.instance(namespace).state.current()),
   "PUT /settings": ({ body, namespace }) => {
-    if (!isRecord6(body)) return adminError4(400, "expected a JSON object");
+    if (!isRecord7(body)) return adminError4(400, "expected a JSON object");
     const patch = {};
     if (Array.isArray(body.workspaces)) patch.workspaces = body.workspaces.map(String);
-    if (isRecord6(body.legacyEnvironmentIds)) {
+    if (isRecord7(body.legacyEnvironmentIds)) {
       patch.legacyEnvironmentIds = Object.fromEntries(
         Object.entries(body.legacyEnvironmentIds).map(([k, v]) => [k, String(v)])
       );
@@ -5533,6 +5643,12 @@ var adminRoutes = (runtime) => ({
     if (Array.isArray(body.apiKeys)) patch.apiKeys = body.apiKeys.map(String);
     if (typeof body.webhookId === "string") patch.webhookId = body.webhookId;
     if (typeof body.contactsEnabled === "boolean") patch.contactsEnabled = body.contactsEnabled;
+    const validation = body.validation;
+    if (validation === "present-only" || validation === "finished-validates-all") {
+      patch.validation = validation;
+    } else if (validation !== void 0) {
+      return adminError4(400, 'validation must be "present-only" or "finished-validates-all"');
+    }
     return json5(200, runtime.instance(namespace).state.update(patch));
   }
 });
@@ -5964,11 +6080,18 @@ var FormbricksAPI = class {
         surveyId: survey.id
       });
     }
-    const errors = validateResponseData(
-      survey,
-      data,
-      typeof body.language === "string" ? body.language : "en"
-    );
+    const finished = body.finished;
+    const responseLanguage = typeof body.language === "string" ? body.language : void 0;
+    const tooLong = otherOptionOverLimit(survey, data, responseLanguage);
+    if (tooLong) {
+      return formbricksError(400, "bad_request", "Response exceeds character limit", {
+        questionId: tooLong
+      });
+    }
+    const errors = validateResponseData(survey, data, responseLanguage ?? "en", {
+      validation: this.state.current().validation ?? "present-only",
+      finished
+    });
     if (errors) {
       const details = {};
       for (const [elementId, messages] of Object.entries(errors)) {
@@ -5977,7 +6100,6 @@ var FormbricksAPI = class {
       return formbricksError(400, "bad_request", "Validation failed", details);
     }
     const now = this.iso();
-    const finished = body.finished;
     const input = body.meta ?? {};
     const contact = contactId ? this.state.contactOf(contactId, workspaceId) : void 0;
     const ttcIn = body.ttc ?? {};
@@ -6200,4 +6322,4 @@ export {
   formbricksError,
   FormbricksAPI
 };
-//# sourceMappingURL=chunk-24SBIGNG.js.map
+//# sourceMappingURL=chunk-JAVNDNOU.js.map