@getquick/content 0.3.2 → 0.4.0

package/README.md

@@ -1,5 +1,11 @@
 # @getquick/content
 
+The runtime's public `search({ search, page?, perPage?, language? })` searches
+delivered pages, posts, declared collections and the language's front page
+from the publication store alone. It returns a `found.content` page with
+`items`, `total`, `page`, `perPage`, `totalPages`, or `unavailable.failure`.
+See the [search contract and adoption guide](../docs/search.md).
+
 The configured content runtime for WordPress HTML and WPGraphQL. This slice
 provides pure helpers, the configured WordPress client, durable delivery and
 installed SQL migrations, and event/refresh HTTP handlers. It is released as a

package/dist/consent-astro.js

@@ -1,6 +1,6 @@
 import { S as SERVICE_CATALOG, T as copyLanguage, c as grantedCategories, d as promptReason, f as readConsentCookie, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as CONSENT_COPY, c as legalRevisions, r as escapeHtml } from "./embeds-CJJemAmE.js";
-import { t as CONSENT_UI_VERSION } from "./version-DkpQm85L.js";
+import { t as CONSENT_UI_VERSION } from "./version-D81MsCZU.js";
 import { t as CONSENT_CONFIG_ID } from "./client-config-B3LNSOxl.js";
 import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
 //#region frontend/src/consent/astro.ts

package/dist/consent-server.js

@@ -1,7 +1,8 @@
 import { t as bearerMatches } from "./bearer-DMOCoSci.js";
 import { i as DECISION_VALIDITY_MS, l as isConsentId, t as CONSENT_ACTIONS, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
-import { a as parseConsentRecordRequest } from "./records-Dumrz759.js";
+import { a as parseConsentRecordRequest, t as MAX_RECORD_BYTES } from "./records-Dumrz759.js";
 import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
+import { n as readBoundedBody, t as isSameOrigin } from "./request-guards-BUPr_vA4.js";
 //#region frontend/src/consent/server.ts
 const MAX_RETENTION_DAYS = 1826;
 const DAY_MS = 864e5;
@@ -73,42 +74,8 @@ function createConsentServer(config) {
 	const now = config.now ?? Date.now;
 	const origins = new Set((config.siteOrigins ?? []).map((origin) => new URL(origin).origin));
 	/** CN-R9: same-origin only. A browser's cross-site post carries its Origin. */
-	function sameOrigin(request) {
-		const origin = request.headers.get("Origin");
-		const site = request.headers.get("Sec-Fetch-Site");
-		if (site && site !== "same-origin") return false;
-		if (!origin) return false;
-		if (origin === new URL(request.url).origin || origins.has(origin)) return true;
-		try {
-			return new URL(origin).host === request.headers.get("Host");
-		} catch {
-			return false;
-		}
-	}
-	async function readBody(request) {
-		if (Number(request.headers.get("Content-Length") ?? "0") > 2048) return null;
-		if (!request.body) return "";
-		const reader = request.body.getReader();
-		const chunks = [];
-		let size = 0;
-		for (;;) {
-			const { done, value } = await reader.read();
-			if (done) break;
-			size += value.byteLength;
-			if (size > 2048) {
-				await reader.cancel();
-				return null;
-			}
-			chunks.push(value);
-		}
-		const bytes = new Uint8Array(size);
-		let offset = 0;
-		for (const chunk of chunks) {
-			bytes.set(chunk, offset);
-			offset += chunk.byteLength;
-		}
-		return new TextDecoder().decode(bytes);
-	}
+	const sameOrigin = (request) => isSameOrigin(request, origins);
+	const readBody = (request) => readBoundedBody(request, MAX_RECORD_BYTES);
 	async function insert(db, request) {
 		const recordedAt = now();
 		return (await db.prepare(`INSERT OR IGNORE INTO consent_records (consent_id, site_id, recorded_at, decided_at, expires_at,

package/dist/consent.js

@@ -1,5 +1,5 @@
 import { C as SERVICE_IDS, D as hostMatches, E as embedService, O as hostService, S as SERVICE_CATALOG, T as copyLanguage, _ as consentConfiguration, a as consentCookie, b as COPY_LANGUAGES, c as grantedCategories, d as promptReason, f as readConsentCookie, g as MEASUREMENT_ID, h as CONSENT_COPY_REVISION, i as DECISION_VALIDITY_MS, k as isServiceId, l as isConsentId, m as serviceGranted, n as CONSENT_COOKIE, o as decide, p as serializeConsentState, r as CONSENT_COOKIE_MAX_AGE_SECONDS, s as denyAll, t as CONSENT_ACTIONS, u as parseConsentState, v as needsBanner, w as catalogService, x as OPTIONAL_CATEGORIES, y as CONSENT_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as parseConsentRecordRequest, i as isRecordToken, n as consentRecordRequest, r as isLegalRoleName, t as MAX_RECORD_BYTES } from "./records-Dumrz759.js";
 import { a as CONSENT_COPY, c as legalRevisions, i as rewriteEmbeds, l as parseLegalLanguage, n as embedPlaceholder, o as LEGAL_ROLES, r as escapeHtml, s as REQUIRED_LEGAL_ROLES, t as blockedPlaceholder } from "./embeds-CJJemAmE.js";
-import { t as CONSENT_UI_VERSION } from "./version-DkpQm85L.js";
+import { t as CONSENT_UI_VERSION } from "./version-D81MsCZU.js";
 export { CONSENT_ACTIONS, CONSENT_CATEGORIES, CONSENT_COOKIE, CONSENT_COOKIE_MAX_AGE_SECONDS, CONSENT_COPY, CONSENT_COPY_REVISION, CONSENT_UI_VERSION, COPY_LANGUAGES, DECISION_VALIDITY_MS, LEGAL_ROLES, MAX_RECORD_BYTES, MEASUREMENT_ID, OPTIONAL_CATEGORIES, REQUIRED_LEGAL_ROLES, SERVICE_CATALOG, SERVICE_IDS, blockedPlaceholder, catalogService, consentConfiguration, consentCookie, consentRecordRequest, copyLanguage, decide, denyAll, embedPlaceholder, embedService, escapeHtml, grantedCategories, hostMatches, hostService, isConsentId, isLegalRoleName, isRecordToken, isServiceId, legalRevisions, needsBanner, parseConsentRecordRequest, parseConsentState, parseLegalLanguage, promptReason, readConsentCookie, rewriteEmbeds, serializeConsentState, serviceGranted };

package/dist/copy-DLto_bWj.js

@@ -0,0 +1,163 @@
+//#region frontend/src/forms/state.ts
+/** The query parameter that marks the redirect back after a post. */
+const FORM_STATE_PARAM = "gq-form";
+/** Seconds the outcome is kept for the page after the redirect. */
+const FORM_STATE_MAX_AGE = 300;
+/** Cookies over this many bytes drop the typed values, then Gravity Forms' messages. */
+const MAX_COOKIE_BYTES = 3800;
+const formStateCookieName = (formId) => `gq-form-${formId}`;
+function encode(value) {
+	const bytes = new TextEncoder().encode(JSON.stringify(value));
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function decode(value) {
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+	return JSON.parse(new TextDecoder().decode(Uint8Array.from(binary, (char) => char.charCodeAt(0))));
+}
+const STATUSES = /* @__PURE__ */ new Set([
+	"sent",
+	"invalid",
+	"failed",
+	"verification",
+	"too-many"
+]);
+/** The Set-Cookie header that carries a form's outcome to the page. */
+function formStateCookie(state, options) {
+	const attempts = [
+		{
+			s: state.status,
+			e: state.errors,
+			m: state.messages,
+			v: state.values,
+			c: state.confirmation
+		},
+		{
+			s: state.status,
+			e: state.errors,
+			m: state.messages,
+			c: state.confirmation
+		},
+		{
+			s: state.status,
+			e: state.errors
+		}
+	];
+	let value = "";
+	for (const attempt of attempts) {
+		value = encode(attempt);
+		if (value.length <= MAX_COOKIE_BYTES) break;
+	}
+	return `${formStateCookieName(state.formId)}=${value}; Path=/; Max-Age=300; HttpOnly; SameSite=Lax` + (options.secure ? "; Secure" : "");
+}
+/** The Set-Cookie header that removes a form's outcome once the page has shown it. */
+function clearFormStateCookie(formId, options) {
+	return `${formStateCookieName(formId)}=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax` + (options.secure ? "; Secure" : "");
+}
+function cookieValue(header, name) {
+	for (const part of (header ?? "").split(";")) {
+		const index = part.indexOf("=");
+		if (index > 0 && part.slice(0, index).trim() === name) return part.slice(index + 1).trim();
+	}
+	return null;
+}
+const stringRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string")) : {};
+const byField = (value) => Object.fromEntries(Object.entries(stringRecord(value)).flatMap(([key, each]) => /^\d+$/.test(key) ? [[Number(key), each]] : []));
+/**
+* A form's outcome for the page: present only on the redirect back after a
+* post to it (`?gq-form=<id>`), from its cookie. Null otherwise.
+*/
+function readFormState(request, formId) {
+	let url;
+	try {
+		url = new URL(request.url);
+	} catch {
+		return null;
+	}
+	if (url.searchParams.get("gq-form") !== String(formId)) return null;
+	const raw = cookieValue(request.cookie, formStateCookieName(formId));
+	if (!raw) return null;
+	let value;
+	try {
+		value = decode(raw);
+	} catch {
+		return null;
+	}
+	if (typeof value !== "object" || value === null) return null;
+	const record = value;
+	if (!STATUSES.has(record.s)) return null;
+	return {
+		formId,
+		status: record.s,
+		errors: byField(record.e),
+		messages: byField(record.m),
+		values: stringRecord(record.v),
+		...typeof record.c === "string" && record.c ? { confirmation: record.c } : {}
+	};
+}
+/** Where the handler sends the visitor back to: the page, marked for the form. */
+function formStateLocation(source, formId) {
+	const url = new URL(source, "https://site.invalid");
+	url.searchParams.set(FORM_STATE_PARAM, String(formId));
+	url.hash = `gq-form-${formId}`;
+	return `${url.pathname}${url.search}${url.hash}`;
+}
+//#endregion
+//#region frontend/src/forms/copy.ts
+const FORMS_COPY = {
+	en: {
+		required: "required",
+		requiredFields: "Fields marked with * are required.",
+		errorSummary: "There was a problem with your submission. Please review the fields below.",
+		errors: {
+			required: "This field is required.",
+			email: "Enter a valid email address.",
+			"email-mismatch": "The email addresses don't match.",
+			number: "Enter a number.",
+			range: "Enter a number in the allowed range.",
+			url: "Enter a valid web address, starting with https://.",
+			choice: "Choose one of the options.",
+			"too-long": "This is longer than allowed."
+		},
+		failed: "Your message couldn't be sent. Please try again later.",
+		verification: "We couldn't verify that you're not a robot. Please try again.",
+		tooMany: "Too many submissions. Please try again later.",
+		sent: "Thank you. Your message has been sent.",
+		unavailable: "This form isn't available.",
+		submit: "Submit",
+		privacyPolicy: "Privacy policy",
+		honeypot: "This field is for validation purposes and should be left unchanged.",
+		needsJavaScript: "This form needs JavaScript to verify you're not a robot."
+	},
+	"pt-PT": {
+		required: "obrigatório",
+		requiredFields: "Os campos assinalados com * são obrigatórios.",
+		errorSummary: "Houve um problema com o envio. Reveja os campos abaixo.",
+		errors: {
+			required: "Este campo é obrigatório.",
+			email: "Introduza um endereço de email válido.",
+			"email-mismatch": "Os endereços de email não coincidem.",
+			number: "Introduza um número.",
+			range: "Introduza um número dentro do intervalo permitido.",
+			url: "Introduza um endereço web válido, começado por https://.",
+			choice: "Escolha uma das opções.",
+			"too-long": "Excede o comprimento permitido."
+		},
+		failed: "Não foi possível enviar a sua mensagem. Tente novamente mais tarde.",
+		verification: "Não foi possível verificar que não é um robô. Tente novamente.",
+		tooMany: "Demasiados envios. Tente novamente mais tarde.",
+		sent: "Obrigado. A sua mensagem foi enviada.",
+		unavailable: "Este formulário não está disponível.",
+		submit: "Enviar",
+		privacyPolicy: "Política de privacidade",
+		honeypot: "Este campo serve para validação e deve ser deixado em branco.",
+		needsJavaScript: "Este formulário precisa de JavaScript para verificar que não é um robô."
+	}
+};
+/** The copy language for a page's `lang`: Portuguese for `pt*`, else English. */
+function formsCopyLanguage(language) {
+	return /^pt\b/i.test(language ?? "") ? "pt-PT" : "en";
+}
+//#endregion
+export { clearFormStateCookie as a, formStateLocation as c, FORM_STATE_PARAM as i, readFormState as l, formsCopyLanguage as n, formStateCookie as o, FORM_STATE_MAX_AGE as r, formStateCookieName as s, FORMS_COPY as t };

package/dist/descriptor-B-e7gHi1.d.ts

@@ -0,0 +1,143 @@
+//#region frontend/src/forms/descriptor.d.ts
+/** The Site path the forms handler answers under: `/gq/forms/<formId>`. */
+declare const FORMS_PATH = "/gq/forms";
+/** The descriptor's wire version; another version doesn't parse. */
+declare const FORM_DESCRIPTOR_SCHEMA = 1;
+/** The Gravity Forms block a Site's dispatcher routes to the renderer. */
+declare const GRAVITY_FORMS_BLOCK = "gravityforms/form";
+/** Field types this release renders and submits. */
+declare const SUPPORTED_FIELD_TYPES: readonly ["text", "textarea", "email", "phone", "number", "website", "select", "radio", "checkbox", "consent", "name", "hidden", "html", "section"];
+type FormFieldType = (typeof SUPPORTED_FIELD_TYPES)[number];
+interface FormChoice {
+  text: string;
+  value: string;
+  selected: boolean;
+}
+/** One HTML input of a field: Gravity Forms' `input_<field>` or `input_<field>_<n>`. */
+interface FormInput {
+  /** Gravity Forms' input id (`1`, `1.3`). */
+  id: string;
+  /** The name it is posted as. */
+  name: string;
+  label: string;
+  /** For a checkbox input, the choice's value. */
+  value?: string;
+  placeholder?: string;
+  /** Name sub-inputs: autocomplete token (given-name, family-name…). */
+  autocomplete?: string;
+}
+interface FormConsent {
+  /** The text next to the checkbox. */
+  checkboxLabel: string;
+  /** The consent's longer text, as plain text. */
+  description: string;
+  /** Gravity Forms' form revision the text belongs to; submitted with the consent. */
+  revisionId: string;
+}
+interface FormField {
+  id: number;
+  type: FormFieldType;
+  label: string;
+  /** Plain text. */
+  description: string;
+  required: boolean;
+  /** A hidden field is submitted, not shown; a `hidden` visibility field is too. */
+  visibility: "visible" | "hidden";
+  placeholder?: string;
+  maxLength?: number;
+  defaultValue?: string;
+  /** select, radio, checkbox. */
+  choices?: FormChoice[];
+  /** The inputs it posts (one for most fields). */
+  inputs: FormInput[];
+  /** consent only. */
+  consent?: FormConsent;
+  /** html only: sanitized by WordPress (wp_kses_post) on the CMS. */
+  content?: string;
+  /** number only. */
+  range?: {
+    min?: number;
+    max?: number;
+  };
+  /** The Site's CSS classes the editor set on the field. */
+  cssClass?: string;
+}
+type FormConfirmation = {
+  type: "message";
+  message: string;
+} | {
+  type: "redirect";
+  url: string;
+};
+/** Why a form can't be offered as it is; readiness reports each one as a failure. */
+type FormDiagnosticCode = "unavailable" | "unsupported-captcha" | "unsupported-file-upload" | "unsupported-payment" | "unsupported-multi-page" | "unsupported-field" | "unsupported-conditional-logic" | "requires-login";
+interface FormDiagnostic {
+  code: FormDiagnosticCode;
+  fieldId?: number;
+  /** Gravity Forms' field type, for a field diagnostic. */
+  type?: string;
+  message: string;
+}
+interface FormDescriptor {
+  schema: typeof FORM_DESCRIPTOR_SCHEMA;
+  id: number;
+  /** False when the form is missing, inactive or trashed: it renders as unavailable. */
+  available: boolean;
+  title: string;
+  /** Plain text. */
+  description: string;
+  submitLabel: string;
+  fields: FormField[];
+  /** Gravity Forms' honeypot input, when the form enables it. */
+  honeypot: {
+    name: string;
+  } | null;
+  /** The default confirmation. */
+  confirmation: FormConfirmation;
+  /** Set by the CMS for fields and settings this release doesn't support. */
+  diagnostics: FormDiagnostic[];
+}
+/**
+ * A descriptor as the CMS delivered it, keeping only the public fields above,
+ * or null when it isn't one. Fields of a type this release doesn't support
+ * are left out; the CMS reports them as diagnostics.
+ */
+declare function parseFormDescriptor(value: unknown): FormDescriptor | null;
+/**
+ * The descriptors a publication carries (the CMS's `getquickForms`, as JSON
+ * text or data), dropping any that don't parse. Undefined for no value.
+ */
+declare function parseFormDescriptors(value: unknown): FormDescriptor[] | undefined;
+/** The form a `gravityforms/form` block shows, from its attributes (`formId`). */
+declare function blockFormId(attributes: Record<string, unknown> | null | undefined): number | null;
+/** A form's descriptor among a publication's, or null. */
+declare function findForm(forms: readonly FormDescriptor[] | null | undefined, formId: number): FormDescriptor | null;
+/** The path a form posts to on the Site's own origin. */
+declare const formAction: (formId: number) => string;
+/** Everything readiness must fail for: an unavailable form, and each unsupported field or setting. */
+declare function formDiagnostics(descriptor: FormDescriptor): FormDiagnostic[];
+/** The spam controls a Site's forms use. */
+type FormSpamControl = "honeypot" | "turnstile";
+interface FormsReadiness {
+  ok: boolean;
+  forms: Array<{
+    id: number;
+    title: string;
+    ok: boolean;
+    diagnostics: FormDiagnostic[];
+    /** Gravity Forms' honeypot is enabled on the form. */
+    honeypot: boolean;
+  }>;
+  /** Controls the Site declares that no checked form uses (honeypot only). */
+  warnings: string[];
+}
+/**
+ * Readiness over the forms a Site's published content references: fails for
+ * any diagnostic. `spam` is the Site's declared controls; declaring the
+ * honeypot for a form that doesn't enable it is reported as a warning.
+ */
+declare function formsReadiness(descriptors: readonly FormDescriptor[], options?: {
+  spam?: readonly FormSpamControl[];
+}): FormsReadiness;
+//#endregion
+export { parseFormDescriptors as S, findForm as _, FormConsent as a, formsReadiness as b, FormDiagnosticCode as c, FormInput as d, FormSpamControl as f, blockFormId as g, SUPPORTED_FIELD_TYPES as h, FormConfirmation as i, FormField as l, GRAVITY_FORMS_BLOCK as m, FORM_DESCRIPTOR_SCHEMA as n, FormDescriptor as o, FormsReadiness as p, FormChoice as r, FormDiagnostic as s, FORMS_PATH as t, FormFieldType as u, formAction as v, parseFormDescriptor as x, formDiagnostics as y };

package/dist/descriptor-x8kHFQ79.js

@@ -0,0 +1,205 @@
+//#region frontend/src/forms/descriptor.ts
+/** The Site path the forms handler answers under: `/gq/forms/<formId>`. */
+const FORMS_PATH = "/gq/forms";
+/** The descriptor's wire version; another version doesn't parse. */
+const FORM_DESCRIPTOR_SCHEMA = 1;
+/** The Gravity Forms block a Site's dispatcher routes to the renderer. */
+const GRAVITY_FORMS_BLOCK = "gravityforms/form";
+/** Field types this release renders and submits. */
+const SUPPORTED_FIELD_TYPES = [
+	"text",
+	"textarea",
+	"email",
+	"phone",
+	"number",
+	"website",
+	"select",
+	"radio",
+	"checkbox",
+	"consent",
+	"name",
+	"hidden",
+	"html",
+	"section"
+];
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const text = (value) => typeof value === "string" ? value : "";
+const optionalText = (value) => typeof value === "string" && value !== "" ? value : void 0;
+const finite = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+const INPUT_NAME = /^input_\d+(?:_\d+)?$/;
+const DIAGNOSTIC_CODES = /* @__PURE__ */ new Set([
+	"unavailable",
+	"unsupported-captcha",
+	"unsupported-file-upload",
+	"unsupported-payment",
+	"unsupported-multi-page",
+	"unsupported-field",
+	"unsupported-conditional-logic",
+	"requires-login"
+]);
+function parseInput(value) {
+	if (!isRecord(value)) return null;
+	const id = text(value.id);
+	const name = text(value.name);
+	if (!/^\d+(?:\.\d+)?$/.test(id) || !INPUT_NAME.test(name)) return null;
+	return {
+		id,
+		name,
+		label: text(value.label),
+		...typeof value.value === "string" ? { value: value.value } : {},
+		...optionalText(value.placeholder) ? { placeholder: text(value.placeholder) } : {},
+		...optionalText(value.autocomplete) ? { autocomplete: text(value.autocomplete) } : {}
+	};
+}
+function parseField(value) {
+	if (!isRecord(value)) return null;
+	const id = value.id;
+	const type = value.type;
+	if (typeof id !== "number" || !Number.isInteger(id) || id < 1) return null;
+	if (!SUPPORTED_FIELD_TYPES.includes(type)) return null;
+	const inputs = Array.isArray(value.inputs) ? value.inputs.map(parseInput).filter((input) => input !== null) : [];
+	const field = {
+		id,
+		type,
+		label: text(value.label),
+		description: text(value.description),
+		required: value.required === true,
+		visibility: value.visibility === "hidden" ? "hidden" : "visible",
+		inputs
+	};
+	if (optionalText(value.placeholder)) field.placeholder = text(value.placeholder);
+	const maxLength = finite(value.maxLength);
+	if (maxLength !== void 0 && maxLength > 0) field.maxLength = Math.floor(maxLength);
+	if (typeof value.defaultValue === "string") field.defaultValue = value.defaultValue;
+	if (optionalText(value.cssClass)) field.cssClass = text(value.cssClass);
+	if (Array.isArray(value.choices)) field.choices = value.choices.filter(isRecord).map((choice) => ({
+		text: text(choice.text),
+		value: text(choice.value),
+		selected: choice.selected === true
+	}));
+	if (isRecord(value.consent)) field.consent = {
+		checkboxLabel: text(value.consent.checkboxLabel),
+		description: text(value.consent.description),
+		revisionId: text(value.consent.revisionId)
+	};
+	if (typeof value.content === "string") field.content = value.content;
+	if (isRecord(value.range)) {
+		const min = finite(value.range.min);
+		const max = finite(value.range.max);
+		field.range = {
+			...min !== void 0 ? { min } : {},
+			...max !== void 0 ? { max } : {}
+		};
+	}
+	return field;
+}
+function parseConfirmation(value) {
+	if (isRecord(value) && value.type === "redirect" && typeof value.url === "string") try {
+		const url = new URL(value.url);
+		if (url.protocol === "https:" || url.protocol === "http:") return {
+			type: "redirect",
+			url: url.href
+		};
+	} catch {}
+	return {
+		type: "message",
+		message: isRecord(value) ? text(value.message) : ""
+	};
+}
+/**
+* A descriptor as the CMS delivered it, keeping only the public fields above,
+* or null when it isn't one. Fields of a type this release doesn't support
+* are left out; the CMS reports them as diagnostics.
+*/
+function parseFormDescriptor(value) {
+	if (!isRecord(value) || value.schema !== 1) return null;
+	const id = value.id;
+	if (typeof id !== "number" || !Number.isInteger(id) || id < 1) return null;
+	const fields = Array.isArray(value.fields) ? value.fields.map(parseField).filter((field) => field !== null) : [];
+	const honeypotName = isRecord(value.honeypot) ? text(value.honeypot.name) : "";
+	const diagnostics = Array.isArray(value.diagnostics) ? value.diagnostics.filter(isRecord).flatMap((diagnostic) => {
+		const code = diagnostic.code;
+		if (!DIAGNOSTIC_CODES.has(code)) return [];
+		const fieldId = finite(diagnostic.fieldId);
+		return [{
+			code,
+			...fieldId !== void 0 ? { fieldId } : {},
+			...optionalText(diagnostic.type) ? { type: text(diagnostic.type) } : {},
+			message: text(diagnostic.message)
+		}];
+	}) : [];
+	return {
+		schema: 1,
+		id,
+		available: value.available === true,
+		title: text(value.title),
+		description: text(value.description),
+		submitLabel: text(value.submitLabel),
+		fields,
+		honeypot: INPUT_NAME.test(honeypotName) ? { name: honeypotName } : null,
+		confirmation: parseConfirmation(value.confirmation),
+		diagnostics
+	};
+}
+/**
+* The descriptors a publication carries (the CMS's `getquickForms`, as JSON
+* text or data), dropping any that don't parse. Undefined for no value.
+*/
+function parseFormDescriptors(value) {
+	let parsed = value;
+	if (typeof parsed === "string") try {
+		parsed = JSON.parse(parsed);
+	} catch {
+		return;
+	}
+	if (!Array.isArray(parsed)) return void 0;
+	return parsed.map(parseFormDescriptor).filter((descriptor) => descriptor !== null);
+}
+/** The form a `gravityforms/form` block shows, from its attributes (`formId`). */
+function blockFormId(attributes) {
+	const raw = attributes?.formId;
+	const id = typeof raw === "string" ? Number(raw) : raw;
+	return typeof id === "number" && Number.isInteger(id) && id > 0 ? id : null;
+}
+/** A form's descriptor among a publication's, or null. */
+function findForm(forms, formId) {
+	return forms?.find((form) => form.id === formId) ?? null;
+}
+/** The path a form posts to on the Site's own origin. */
+const formAction = (formId) => `${FORMS_PATH}/${formId}`;
+/** Everything readiness must fail for: an unavailable form, and each unsupported field or setting. */
+function formDiagnostics(descriptor) {
+	const diagnostics = [...descriptor.diagnostics];
+	if (!descriptor.available && !diagnostics.some((each) => each.code === "unavailable")) diagnostics.unshift({
+		code: "unavailable",
+		message: `Form ${descriptor.id} is missing, inactive or in the trash.`
+	});
+	return diagnostics;
+}
+/**
+* Readiness over the forms a Site's published content references: fails for
+* any diagnostic. `spam` is the Site's declared controls; declaring the
+* honeypot for a form that doesn't enable it is reported as a warning.
+*/
+function formsReadiness(descriptors, options = {}) {
+	const forms = [...new Map(descriptors.map((descriptor) => [descriptor.id, descriptor])).values()].map((descriptor) => {
+		const diagnostics = formDiagnostics(descriptor);
+		return {
+			id: descriptor.id,
+			title: descriptor.title,
+			ok: diagnostics.length === 0,
+			diagnostics,
+			honeypot: descriptor.honeypot !== null
+		};
+	});
+	const warnings = options.spam?.includes("honeypot") ? forms.filter((form) => !form.honeypot).map((form) => `Form ${form.id} doesn't enable Gravity Forms' anti-spam honeypot.`) : [];
+	return {
+		ok: forms.every((form) => form.ok),
+		forms,
+		warnings
+	};
+}
+//#endregion
+export { blockFormId as a, formDiagnostics as c, parseFormDescriptors as d, SUPPORTED_FIELD_TYPES as i, formsReadiness as l, FORM_DESCRIPTOR_SCHEMA as n, findForm as o, GRAVITY_FORMS_BLOCK as r, formAction as s, FORMS_PATH as t, parseFormDescriptor as u };

package/dist/forms-astro.d.ts

@@ -0,0 +1,50 @@
+import { _ as findForm, g as blockFormId, l as FormField, m as GRAVITY_FORMS_BLOCK, o as FormDescriptor } from "./descriptor-B-e7gHi1.js";
+import { a as clearFormStateCookie, l as readFormState, n as FORM_STATE_PARAM, r as FormState } from "./state-CsMFLUUO.js";
+//#region frontend/src/forms/astro.d.ts
+/** LEGAL-1's links in the page's language (the chrome's `legal`), structurally. */
+export interface FormsLegal {
+  roles: ReadonlyArray<{
+    role: string;
+    url: string;
+    title?: string | null;
+  }>;
+}
+export interface GravityFormInput {
+  /** The form's descriptor from the publication (`findForm(page.forms, blockFormId(attributes))`). */
+  descriptor: FormDescriptor | null;
+  /** The page's path: the handler sends the visitor back to it. */
+  source: string;
+  /** The page's `lang` (BCP 47). */
+  language: string;
+  /** The page language's Legal Contract: the consent links to its privacy policy. */
+  legal?: FormsLegal | null;
+  /** The outcome on the redirect back after a post (`readFormState`). */
+  state?: FormState | null;
+  /** Turnstile's site key, when the Site uses Turnstile. */
+  turnstile?: {
+    siteKey: string;
+  } | null;
+  /** The block's `title` and `description` attributes: show the form's title and description. */
+  showTitle?: boolean;
+  showDescription?: boolean;
+  /** The heading level of the form's title (2 by default). */
+  headingLevel?: 2 | 3 | 4 | 5 | 6;
+}
+export declare function escapeHtml(value: string): string;
+/** The HTML id of an input (`gq-form-1-input_1_3`). */
+export declare const inputId: (formId: number, name: string) => string;
+/** Turnstile loads only once the visitor interacts with a form (CONSENT-1, CN-R3). */
+export declare const FORMS_TURNSTILE_SCRIPT = "(()=>{const s=\"https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit\";let l;const load=()=>l??=new Promise((ok,no)=>{const e=document.createElement(\"script\");e.src=s;e.async=true;e.onload=()=>ok(window.turnstile);e.onerror=no;document.head.append(e)});for(const f of document.querySelectorAll(\"form[data-gq-turnstile]\")){const start=()=>{if(f.dataset.gqTurnstileStarted)return;f.dataset.gqTurnstileStarted=\"1\";load().then(t=>t.render(f.querySelector(\"[data-gq-turnstile-widget]\"),{sitekey:f.dataset.gqTurnstile,\"response-field-name\":\"cf-turnstile-response\"}))};f.addEventListener(\"focusin\",start,{once:true});f.addEventListener(\"pointerdown\",start,{once:true})}})();";
+/**
+ * A `gravityforms/form` block's HTML. Without a descriptor (the CMS hasn't
+ * delivered one) or for an unavailable form, a status message instead of a
+ * form that can't be sent.
+ */
+export declare function renderGravityForm(input: GravityFormInput): string;
+/**
+ * A minimal default stylesheet (layout and states only). Sites usually style
+ * the `gq-form*` classes with their own tokens instead.
+ */
+export declare const FORMS_STYLES: string;
+//#endregion
+export { FORM_STATE_PARAM, type FormDescriptor, type FormField, type FormState, GRAVITY_FORMS_BLOCK, blockFormId, clearFormStateCookie, findForm, readFormState };