@getquick/content 0.3.2 → 0.4.0

package/dist/forms-testing.js

@@ -0,0 +1,334 @@
+import { u as parseFormDescriptor } from "./descriptor-x8kHFQ79.js";
+//#region frontend/src/forms/testing.ts
+/** A contact form like Nomia's form 1: name, email, subject, message and privacy consent. */
+const CONTACT_FORM = {
+	schema: 1,
+	id: 1,
+	available: true,
+	title: "Contactos",
+	description: "Envie-nos uma mensagem.",
+	submitLabel: "Enviar",
+	fields: [
+		{
+			id: 1,
+			type: "name",
+			label: "Nome",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [{
+				id: "1.3",
+				name: "input_1_3",
+				label: "Nome próprio",
+				autocomplete: "given-name"
+			}, {
+				id: "1.6",
+				name: "input_1_6",
+				label: "Apelido",
+				autocomplete: "family-name"
+			}]
+		},
+		{
+			id: 2,
+			type: "email",
+			label: "Email",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [{
+				id: "2",
+				name: "input_2",
+				label: "Email"
+			}]
+		},
+		{
+			id: 3,
+			type: "text",
+			label: "Assunto",
+			description: "",
+			required: false,
+			visibility: "visible",
+			maxLength: 120,
+			inputs: [{
+				id: "3",
+				name: "input_3",
+				label: "Assunto"
+			}]
+		},
+		{
+			id: 4,
+			type: "textarea",
+			label: "Mensagem",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [{
+				id: "4",
+				name: "input_4",
+				label: "Mensagem"
+			}]
+		},
+		{
+			id: 5,
+			type: "consent",
+			label: "Privacidade",
+			description: "",
+			required: true,
+			visibility: "visible",
+			inputs: [
+				{
+					id: "5.1",
+					name: "input_5_1",
+					label: "Consentimento"
+				},
+				{
+					id: "5.2",
+					name: "input_5_2",
+					label: "Texto"
+				},
+				{
+					id: "5.3",
+					name: "input_5_3",
+					label: "Descrição"
+				}
+			],
+			consent: {
+				checkboxLabel: "Aceito o tratamento dos meus dados para responder a este contacto.",
+				description: "Os dados são usados apenas para responder à sua mensagem.",
+				revisionId: "7"
+			}
+		}
+	],
+	honeypot: { name: "input_6" },
+	confirmation: {
+		type: "message",
+		message: "Obrigado pelo seu contacto."
+	},
+	diagnostics: []
+};
+/** A form readiness must fail: Gravity Forms' CAPTCHA, a file upload, a payment field and a page break. */
+const UNSUPPORTED_FORM = {
+	...CONTACT_FORM,
+	id: 2,
+	title: "Candidatura",
+	fields: CONTACT_FORM.fields.slice(0, 2),
+	diagnostics: [
+		{
+			code: "unsupported-captcha",
+			fieldId: 10,
+			type: "captcha",
+			message: "CAPTCHA"
+		},
+		{
+			code: "unsupported-file-upload",
+			fieldId: 11,
+			type: "fileupload",
+			message: "File upload"
+		},
+		{
+			code: "unsupported-payment",
+			fieldId: 12,
+			type: "product",
+			message: "Payment"
+		},
+		{
+			code: "unsupported-multi-page",
+			fieldId: 13,
+			type: "page",
+			message: "Multi-page"
+		}
+	]
+};
+/** A referenced form that is missing, inactive or trashed. */
+const UNAVAILABLE_FORM = {
+	...CONTACT_FORM,
+	id: 3,
+	available: false,
+	fields: [],
+	honeypot: null,
+	diagnostics: [{
+		code: "unavailable",
+		message: "Form 3 is inactive."
+	}]
+};
+/** Keys that must never appear anywhere in a delivered descriptor. */
+const PRIVATE_FORM_KEYS = [
+	"notifications",
+	"notification",
+	"confirmations",
+	"entries",
+	"entry",
+	"entry_id",
+	"feeds",
+	"feed",
+	"settings",
+	"personalData",
+	"routing",
+	"to",
+	"bcc",
+	"from",
+	"fromName",
+	"replyTo",
+	"save",
+	"limitEntries",
+	"scheduleForm",
+	"requireLogin",
+	"consumer_key",
+	"consumer_secret"
+];
+function keysOf(value, path = "", found = []) {
+	if (Array.isArray(value)) value.forEach((each, index) => keysOf(each, `${path}[${index}]`, found));
+	else if (typeof value === "object" && value !== null) for (const [key, each] of Object.entries(value)) {
+		found.push(`${path}.${key}`);
+		keysOf(each, `${path}.${key}`, found);
+	}
+	return found;
+}
+/**
+* Throws unless a delivered descriptor is public: it parses, and nothing in it
+* is a notification, entry, feed or admin setting (by key, at any depth).
+*/
+function assertPublicDescriptor(value) {
+	const descriptor = parseFormDescriptor(value);
+	if (!descriptor) throw new Error("Not a form descriptor");
+	const forbidden = keysOf(value).filter((path) => PRIVATE_FORM_KEYS.includes(path.slice(path.lastIndexOf(".") + 1)));
+	if (forbidden.length) throw new Error(`The descriptor carries private form data: ${forbidden.join(", ")}`);
+	return descriptor;
+}
+/**
+* Throws unless rendered form HTML is accessible: every visible control has a
+* label (`for`) or is in a labelled fieldset, every `aria-describedby` id
+* exists, invalid controls are described by their error, an error summary is
+* an alert and a confirmation is a status.
+*/
+function assertAccessibleForm(html) {
+	const ids = new Set([...html.matchAll(/\sid="([^"]+)"/g)].map((match) => match[1]));
+	const labelled = new Set([...html.matchAll(/<label[^>]*\sfor="([^"]+)"/g)].map((m) => m[1]));
+	const problems = [];
+	for (const match of html.matchAll(/<(input|select|textarea)\b([^>]*)>/g)) {
+		const attributes = match[2];
+		if (/\stype="hidden"/.test(attributes)) continue;
+		const id = /\sid="([^"]+)"/.exec(attributes)?.[1];
+		if (!id || !labelled.has(id)) problems.push(`a ${match[1]} without a label (${id ?? "no id"})`);
+		const describedBy = /\saria-describedby="([^"]+)"/.exec(attributes)?.[1];
+		for (const reference of describedBy?.split(/\s+/) ?? []) if (!ids.has(reference)) problems.push(`${id} is described by a missing #${reference}`);
+		if (/\saria-invalid="true"/.test(attributes) && !/-error\b/.test(describedBy ?? "")) problems.push(`${id} is invalid without its error in aria-describedby`);
+	}
+	if (/gq-form__errors/.test(html) && !/class="gq-form__errors" role="alert"/.test(html)) problems.push("the error summary isn't an alert");
+	if (/gq-form__status--sent/.test(html) && !/gq-form__status--sent" role="status"/.test(html)) problems.push("the confirmation isn't a status message");
+	if (/<form\b/.test(html) && !/<button type="submit"/.test(html)) problems.push("the form has no submit button");
+	if (problems.length) throw new Error(`Inaccessible form: ${problems.join("; ")}`);
+}
+/**
+* A stand-in for Gravity Forms' REST API on a CMS: `POST
+* /wp-json/gf/v2/forms/<id>/submissions` as Gravity Forms 3.2 answers it,
+* validating required fields and storing entries for the given descriptors.
+* A filled honeypot is stored as spam, Gravity Forms' default honeypot
+* action. Anything else is a 404. `requests` records every request.
+*/
+function gravityFormsStub(forms) {
+	const entries = [];
+	const requests = [];
+	async function handle(request) {
+		const url = new URL(request.url);
+		let body = null;
+		try {
+			body = request.method === "POST" ? await request.json() : null;
+		} catch {
+			body = null;
+		}
+		requests.push({
+			method: request.method,
+			url: url.pathname + url.search,
+			headers: Object.fromEntries(request.headers),
+			body
+		});
+		const match = /^\/wp-json\/gf\/v2\/forms\/(\d+)\/submissions$/.exec(url.pathname);
+		const form = match && forms.find((each) => each.id === Number(match[1]));
+		if (!match || request.method !== "POST") return Response.json({ code: "rest_no_route" }, { status: 404 });
+		if (!form || !form.available) return Response.json({
+			code: "form_not_found",
+			message: "Your form could not be found"
+		}, { status: 400 });
+		const values = body ?? {};
+		const messages = {};
+		for (const field of form.fields) {
+			if (!field.required) continue;
+			if ((field.type === "consent" ? [field.inputs[0].name] : field.inputs.map((input) => input.name)).every((name) => !values[name])) messages[field.id] = "This field is required.";
+		}
+		if (Object.keys(messages).length) return Response.json({
+			is_valid: false,
+			validation_messages: messages,
+			page_number: 1,
+			source_page_number: 1
+		}, { status: 400 });
+		const spam = Boolean(form.honeypot && values[form.honeypot.name]);
+		entries.push({
+			formId: form.id,
+			values,
+			spam
+		});
+		return Response.json({
+			is_valid: true,
+			page_number: 0,
+			source_page_number: 1,
+			confirmation_type: "message",
+			confirmation_message: `<div id='gform_confirmation_wrapper_${form.id}' class='gform_confirmation_wrapper '><div id='gform_confirmation_message_${form.id}' class='gform_confirmation_message_${form.id} gform_confirmation_message'>${form.confirmation.type === "message" ? form.confirmation.message : ""}</div></div>`,
+			is_spam: spam
+		});
+	}
+	return {
+		entries,
+		requests,
+		handle,
+		/** A `fetch` that answers the CMS's requests at `origin` and refuses any other. */
+		fetchFor(origin) {
+			return async (input, init) => {
+				const request = new Request(input, init);
+				if (new URL(request.url).origin !== origin) throw new TypeError(`Unexpected request to ${new URL(request.url).origin}`);
+				return handle(request);
+			};
+		}
+	};
+}
+/** Throws if any request asked for entries, or carried a Gravity Forms credential. */
+function assertNoEntryReadsOrCredentials(requests) {
+	for (const request of requests) {
+		if (/\/entries\b/.test(request.url)) throw new Error(`An entry read reached the CMS: ${request.method} ${request.url}`);
+		if (request.headers.authorization) throw new Error(`A credential reached the CMS: ${request.method} ${request.url}`);
+		if (/consumer_(key|secret)|oauth_/i.test(request.url)) throw new Error(`A consumer key reached the CMS: ${request.method} ${request.url}`);
+	}
+}
+/** Throws if a module exports anything that reads entries (by name; these assertions aside). */
+function assertNoEntryExports(module) {
+	const names = Object.keys(module).filter((name) => /entr(y|ies)/i.test(name) && !name.startsWith("assertNo"));
+	if (names.length) throw new Error(`Exports that read entries: ${names.join(", ")}`);
+}
+/** A form body as a browser posts it (application/x-www-form-urlencoded). */
+function formBody(values) {
+	return new URLSearchParams(values).toString();
+}
+/** A filled-in, valid submission of CONTACT_FORM from `source`. */
+function contactSubmission(source = "/contactos/") {
+	return {
+		gq_source: source,
+		input_1_3: "Ana",
+		input_1_6: "Silva",
+		input_2: "ana@example.com",
+		input_3: "Pergunta",
+		input_4: "Olá, gostava de saber mais.",
+		input_5_1: "1",
+		input_6: ""
+	};
+}
+/** Cloudflare's Turnstile test keys: always pass, always fail. */
+const TURNSTILE_TEST_KEYS = {
+	passingSiteKey: "1x00000000000000000000AA",
+	failingSiteKey: "2x00000000000000000000AB",
+	passingSecretKey: "1x0000000000000000000000000000000AA",
+	failingSecretKey: "2x0000000000000000000000000000000AA",
+	/** The token the test site keys produce. */
+	dummyToken: "XXXX.DUMMY.TOKEN.XXXX"
+};
+//#endregion
+export { CONTACT_FORM, PRIVATE_FORM_KEYS, TURNSTILE_TEST_KEYS, UNAVAILABLE_FORM, UNSUPPORTED_FORM, assertAccessibleForm, assertNoEntryExports, assertNoEntryReadsOrCredentials, assertPublicDescriptor, contactSubmission, formBody, gravityFormsStub };

package/dist/forms.d.ts

@@ -0,0 +1,25 @@
+import { S as parseFormDescriptors, _ as findForm, a as FormConsent, b as formsReadiness, c as FormDiagnosticCode, d as FormInput, f as FormSpamControl, g as blockFormId, h as SUPPORTED_FIELD_TYPES, i as FormConfirmation, l as FormField, m as GRAVITY_FORMS_BLOCK, n as FORM_DESCRIPTOR_SCHEMA, o as FormDescriptor, p as FormsReadiness, r as FormChoice, s as FormDiagnostic, t as FORMS_PATH, u as FormFieldType, v as formAction, x as parseFormDescriptor, y as formDiagnostics } from "./descriptor-B-e7gHi1.js";
+import { a as clearFormStateCookie, c as formStateLocation, d as FormErrorCode, f as FormsCopy, i as FormStatus, l as readFormState, m as formsCopyLanguage, n as FORM_STATE_PARAM, o as formStateCookie, p as FormsCopyLanguage, r as FormState, s as formStateCookieName, t as FORM_STATE_MAX_AGE, u as FORMS_COPY } from "./state-CsMFLUUO.js";
+//#region frontend/src/forms/validate.d.ts
+/** No single value is longer (characters). */
+export declare const MAX_VALUE_LENGTH = 10000;
+/** What the visitor posted: a form body's values by name. */
+type SubmittedValues = Pick<URLSearchParams, "get">;
+interface SubmissionCheck {
+  /** Each input's value, by Gravity Forms' input name, for the CMS. */
+  input: Record<string, string>;
+  /** Field errors, by field id. */
+  errors: Record<number, FormErrorCode>;
+  /** What to show again in the form after errors (visible fields only). */
+  values: Record<string, string>;
+}
+/**
+ * Checks a submission against the descriptor: required fields, formats,
+ * choices and lengths. Only the descriptor's inputs are kept; the honeypot is
+ * passed through, empty, for Gravity Forms' own check.
+ */
+export declare function validateSubmission(descriptor: FormDescriptor, values: SubmittedValues): SubmissionCheck;
+/** Whether the honeypot was filled in: a bot. Such a submission never reaches the CMS. */
+export declare function honeypotFilled(descriptor: FormDescriptor, values: SubmittedValues): boolean;
+//#endregion
+export { FORMS_COPY, FORMS_PATH, FORM_DESCRIPTOR_SCHEMA, FORM_STATE_MAX_AGE, FORM_STATE_PARAM, type FormChoice, type FormConfirmation, type FormConsent, type FormDescriptor, type FormDiagnostic, type FormDiagnosticCode, type FormErrorCode, type FormField, type FormFieldType, type FormInput, type FormSpamControl, type FormState, type FormStatus, type FormsCopy, type FormsCopyLanguage, type FormsReadiness, GRAVITY_FORMS_BLOCK, SUPPORTED_FIELD_TYPES, type SubmissionCheck, type SubmittedValues, blockFormId, clearFormStateCookie, findForm, formAction, formDiagnostics, formStateCookie, formStateCookieName, formStateLocation, formsCopyLanguage, formsReadiness, parseFormDescriptor, parseFormDescriptors, readFormState };

package/dist/forms.js

@@ -0,0 +1,4 @@
+import { a as blockFormId, c as formDiagnostics, d as parseFormDescriptors, i as SUPPORTED_FIELD_TYPES, l as formsReadiness, n as FORM_DESCRIPTOR_SCHEMA, o as findForm, r as GRAVITY_FORMS_BLOCK, s as formAction, t as FORMS_PATH, u as parseFormDescriptor } from "./descriptor-x8kHFQ79.js";
+import { n as honeypotFilled, r as validateSubmission, t as MAX_VALUE_LENGTH } from "./validate-wRgYUNxN.js";
+import { a as clearFormStateCookie, c as formStateLocation, i as FORM_STATE_PARAM, l as readFormState, n as formsCopyLanguage, o as formStateCookie, r as FORM_STATE_MAX_AGE, s as formStateCookieName, t as FORMS_COPY } from "./copy-DLto_bWj.js";
+export { FORMS_COPY, FORMS_PATH, FORM_DESCRIPTOR_SCHEMA, FORM_STATE_MAX_AGE, FORM_STATE_PARAM, GRAVITY_FORMS_BLOCK, MAX_VALUE_LENGTH, SUPPORTED_FIELD_TYPES, blockFormId, clearFormStateCookie, findForm, formAction, formDiagnostics, formStateCookie, formStateCookieName, formStateLocation, formsCopyLanguage, formsReadiness, honeypotFilled, parseFormDescriptor, parseFormDescriptors, readFormState, validateSubmission };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as Found, A as htmlLang, At as DesignQueryRenderContext, B as designMenuItems, C as Moved, Ct as designThemeVariables, D as SqlStatement, Dt as DesignPostRecord, E as SqlDatabase, Et as DesignPostContext, F as DesignBlock, Ft as renderDesignPostBlock, G as CmsFailure, H as parseDesignBlocks, I as DesignBlockRenderer, It as renderDesignQuery, J as CollectionTerm, K as CmsFailureReason, L as DesignPattern, Lt as DesignTextContext, M as languageSubject, Mt as designPostContext, N as routeLanguage, Nt as designQueryItems, O as SiteLanguage, Ot as DesignPreloadedPosts, P as siteLanguages, Pt as preloadDesignQueryPosts, Q as Extended, R as DesignRenderContext, Rt as renderDesignText, S as HomePublication, St as designThemeStyleSheet, T as ContentBindings, Tt as resolvePresentationToken, U as renderDesignPattern, V as escapeHtml, W as Archives, X as DesignPresets, Y as Delivery, Z as EntryContent, _ as EntryDelivery, _t as presentationModel, a as ContentExtension, at as Unavailable, b as HomeDelivery, bt as DesignTheme, ct as WordPressPost, d as CollectionListing, dt as PresentationBreakpoint, et as HomeContent, f as CollectionPage, ft as PresentationModel, g as DeliveryFailureReason, gt as createPresentationModel, h as CollectionTermListing, ht as Property, i as ContentConsentConfig, it as Translation, j as isLanguageHome, jt as DesignQueryResolverOptions, k as WordPressLanguages, kt as DesignQueryItem, l as Alternate, lt as WordPressSettings, m as CollectionTermCount, mt as PresentationTheme, n as CollectionConfig, nt as PublishedEntry, o as ContentRuntime, ot as WordPressImage, p as CollectionQuery, pt as PresentationTargets, q as CollectionMembership, r as ContentConfig, rt as SiteChrome, s as ExtensionNode, st as WordPressMenuItem, t as WordPressClient, tt as Missing, u as CollectionItem, ut as Presentation, v as EntryPage, vt as presentationStyleSheet, w as NotServed, wt as resolveDesignTheme, x as HomePage, xt as DesignThemeOverrides, y as EntryPublication, yt as presentationVariables, z as DesignRenderOptions, zt as safeDesignRichText } from "./wordpress-C1xs3xHN.js";
+import { $ as Delivery, A as SqlDatabase, At as DesignPostContext, B as DesignBlockRenderer, Bt as renderDesignQuery, C as Moved, Ct as presentationVariables, D as SearchPage, Dt as designThemeVariables, E as SearchItem, Et as designThemeStyleSheet, F as isLanguageHome, Ft as DesignQueryResolverOptions, G as escapeHtml, H as DesignRenderContext, Ht as renderDesignText, I as languageSubject, It as designPostContext, J as Archives, K as parseDesignBlocks, L as routeLanguage, Lt as designQueryItems, M as SiteLanguage, Mt as DesignPreloadedPosts, N as WordPressLanguages, Nt as DesignQueryItem, O as SearchQuery, Ot as resolveDesignTheme, P as htmlLang, Pt as DesignQueryRenderContext, Q as CollectionTerm, R as siteLanguages, Rt as preloadDesignQueryPosts, S as HomePublication, St as presentationStyleSheet, T as SearchDelivery, Tt as DesignThemeOverrides, U as DesignRenderOptions, Ut as safeDesignRichText, V as DesignPattern, Vt as DesignTextContext, W as designMenuItems, X as CmsFailureReason, Y as CmsFailure, Z as CollectionMembership, _ as EntryDelivery, _t as PresentationTargets, a as ContentExtension, at as Missing, b as HomeDelivery, bt as createPresentationModel, ct as Translation, d as CollectionListing, dt as WordPressMenuItem, et as DesignPresets, f as CollectionPage, ft as WordPressPost, g as DeliveryFailureReason, gt as PresentationModel, h as CollectionTermListing, ht as PresentationBreakpoint, i as ContentConsentConfig, it as HomeContent, j as SqlStatement, jt as DesignPostRecord, k as ContentBindings, kt as resolvePresentationToken, l as Alternate, lt as Unavailable, m as CollectionTermCount, mt as Presentation, n as CollectionConfig, nt as Extended, o as ContentRuntime, ot as PublishedEntry, p as CollectionQuery, pt as WordPressSettings, q as renderDesignPattern, r as ContentConfig, rt as Found, s as ExtensionNode, st as SiteChrome, t as WordPressClient, tt as EntryContent, u as CollectionItem, ut as WordPressImage, v as EntryPage, vt as PresentationTheme, w as NotServed, wt as DesignTheme, x as HomePage, xt as presentationModel, y as EntryPublication, yt as Property, z as DesignBlock, zt as renderDesignPostBlock } from "./wordpress-BvkTDMA0.js";
 //#region frontend/src/cover-video-html.d.ts
 /** Native decorative Cover video must not start before motion preferences are
  * known. Retain every source, poster, child and independent video attribute. */
@@ -201,4 +201,4 @@ export declare function renderDesignNavigation(name: string, attrs: Attributes,
 /** Interaction styles only. Include canonical presentationStyleSheet separately. */
 export declare function navigationStyleSheet(theme?: DesignThemeOverrides): string;
 //#endregion
-export { Alternate, Archives, CmsFailure, CmsFailureReason, type CollectionConfig, CollectionItem, CollectionListing, CollectionMembership, CollectionPage, CollectionQuery, CollectionTerm, CollectionTermCount, CollectionTermListing, ContentBindings, type ContentConfig, type ContentConsentConfig, type ContentExtension, type ContentRuntime, Delivery, DeliveryFailureReason, DesignBlock, DesignBlockRenderer, DesignPattern, type DesignPostContext, type DesignPostRecord, type DesignPreloadedPosts, DesignPresets, type DesignQueryItem, type DesignQueryRenderContext, type DesignQueryResolverOptions, DesignRenderContext, DesignRenderOptions, type DesignTextContext, type DesignTheme, type DesignThemeOverrides, EntryContent, EntryDelivery, EntryPage, EntryPublication, Extended, type ExtensionNode, Found, HomeContent, HomeDelivery, HomePage, HomePublication, Missing, Moved, NotServed, type Presentation, type PresentationBreakpoint, type PresentationModel, type Property as PresentationProperty, type PresentationTargets, type PresentationTheme, PublishedEntry, SiteChrome, SiteLanguage, SqlDatabase, SqlStatement, Translation, Unavailable, type VideoHeroFit, type VideoHeroPosition, type WordPressClient, WordPressImage, WordPressLanguages, WordPressMenuItem, WordPressPost, WordPressSettings, createPresentationModel, designMenuItems, designPostContext, designQueryItems, designThemeStyleSheet, designThemeVariables, escapeHtml, htmlLang, isLanguageHome, languageSubject, parseDesignBlocks, preloadDesignQueryPosts, presentationModel, presentationStyleSheet, presentationVariables, renderDesignPattern, renderDesignPostBlock, renderDesignQuery, renderDesignText, resolveDesignTheme, resolvePresentationToken, routeLanguage, safeDesignRichText, siteLanguages };
+export { Alternate, Archives, CmsFailure, CmsFailureReason, type CollectionConfig, CollectionItem, CollectionListing, CollectionMembership, CollectionPage, CollectionQuery, CollectionTerm, CollectionTermCount, CollectionTermListing, ContentBindings, type ContentConfig, type ContentConsentConfig, type ContentExtension, type ContentRuntime, Delivery, DeliveryFailureReason, DesignBlock, DesignBlockRenderer, DesignPattern, type DesignPostContext, type DesignPostRecord, type DesignPreloadedPosts, DesignPresets, type DesignQueryItem, type DesignQueryRenderContext, type DesignQueryResolverOptions, DesignRenderContext, DesignRenderOptions, type DesignTextContext, type DesignTheme, type DesignThemeOverrides, EntryContent, EntryDelivery, EntryPage, EntryPublication, Extended, type ExtensionNode, Found, HomeContent, HomeDelivery, HomePage, HomePublication, Missing, Moved, NotServed, type Presentation, type PresentationBreakpoint, type PresentationModel, type Property as PresentationProperty, type PresentationTargets, type PresentationTheme, PublishedEntry, SearchDelivery, SearchItem, SearchPage, SearchQuery, SiteChrome, SiteLanguage, SqlDatabase, SqlStatement, Translation, Unavailable, type VideoHeroFit, type VideoHeroPosition, type WordPressClient, WordPressImage, WordPressLanguages, WordPressMenuItem, WordPressPost, WordPressSettings, createPresentationModel, designMenuItems, designPostContext, designQueryItems, designThemeStyleSheet, designThemeVariables, escapeHtml, htmlLang, isLanguageHome, languageSubject, parseDesignBlocks, preloadDesignQueryPosts, presentationModel, presentationStyleSheet, presentationVariables, renderDesignPattern, renderDesignPostBlock, renderDesignQuery, renderDesignText, resolveDesignTheme, resolvePresentationToken, routeLanguage, safeDesignRichText, siteLanguages };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as selectSiteLogo, A as DESIGN_CAROUSEL_ITEM, B as safeDesignRichText, C as renderDesignQuery, D as renderWordPressBlocks, E as parseWordPressBlocks, F as VIDEO_HERO_BLOCK, G as createPresentationModel, H as navigationStyleSheet, I as renderDesignVideoHero, J as presentationVariables, K as presentationModel, L as youtubeVideoId, M as designCarouselStyle, N as renderDesignCarousel, O as designGridStyle, P as renderDesignCarouselItem, Q as resolvePresentationToken, R as renderDesignImage, S as renderDesignPostBlock, T as hasVideoHero, U as renderDesignNavigation, V as enhanceDesignNavigationHtml, W as presentationHtml, X as designThemeVariables, Y as designThemeStyleSheet, Z as resolveDesignTheme, _ as uriPath, a as siteLanguages, b as designQueryItems, c as parseDesignBlocks, d as decodeEntities, f as formatDate, g as stripHtml, h as routeOf, i as routeLanguage, j as DESIGN_CAROUSEL_NAVIGATION, k as DESIGN_CAROUSEL, l as renderDesignPattern, m as responseStatus, n as isLanguageHome, o as designMenuItems, p as menuItemHref, q as presentationStyleSheet, r as languageSubject, s as escapeHtml, t as htmlLang, tt as enhanceDesignCoverVideosHtml, u as cmsTime, v as renderDesignCover, w as hasDesignCarousel, x as preloadDesignQueryPosts, y as designPostContext, z as renderDesignText } from "./site-language-BcPac0Ia.js";
+import { $ as selectSiteLogo, A as DESIGN_CAROUSEL_ITEM, B as safeDesignRichText, C as renderDesignQuery, D as renderWordPressBlocks, E as parseWordPressBlocks, F as VIDEO_HERO_BLOCK, G as createPresentationModel, H as navigationStyleSheet, I as renderDesignVideoHero, J as presentationVariables, K as presentationModel, L as youtubeVideoId, M as designCarouselStyle, N as renderDesignCarousel, O as designGridStyle, P as renderDesignCarouselItem, Q as resolvePresentationToken, R as renderDesignImage, S as renderDesignPostBlock, T as hasVideoHero, U as renderDesignNavigation, V as enhanceDesignNavigationHtml, W as presentationHtml, X as designThemeVariables, Y as designThemeStyleSheet, Z as resolveDesignTheme, _ as uriPath, a as siteLanguages, b as designQueryItems, c as parseDesignBlocks, d as decodeEntities, f as formatDate, g as stripHtml, h as routeOf, i as routeLanguage, j as DESIGN_CAROUSEL_NAVIGATION, k as DESIGN_CAROUSEL, l as renderDesignPattern, m as responseStatus, n as isLanguageHome, o as designMenuItems, p as menuItemHref, q as presentationStyleSheet, r as languageSubject, s as escapeHtml, t as htmlLang, tt as enhanceDesignCoverVideosHtml, u as cmsTime, v as renderDesignCover, w as hasDesignCarousel, x as preloadDesignQueryPosts, y as designPostContext, z as renderDesignText } from "./site-language-BCGjkpWY.js";
 import { n as videoHeroStyleSheet, t as videoHeroFrameGeometry } from "./video-hero-D8AcMR4q.js";
 //#region frontend/src/wp-block-styles.ts
 const validSlug = (slug) => /^[a-z0-9][a-z0-9-]*$/.test(slug);

package/dist/request-guards-BUPr_vA4.js

@@ -0,0 +1,46 @@
+//#region frontend/src/request-guards.ts
+/**
+* Whether a browser posted from the Site itself. A cross-site post carries
+* its Origin (and Sec-Fetch-Site); `origins` are the Site's public origins
+* when the Worker sees another (a proxy). The request's own origin is always
+* accepted.
+*/
+function isSameOrigin(request, origins) {
+	const origin = request.headers.get("Origin");
+	const site = request.headers.get("Sec-Fetch-Site");
+	if (site && site !== "same-origin") return false;
+	if (!origin) return false;
+	if (origin === new URL(request.url).origin || origins.has(origin)) return true;
+	try {
+		return new URL(origin).host === request.headers.get("Host");
+	} catch {
+		return false;
+	}
+}
+/** The body as text, or null once it exceeds `limit` bytes (declared or read). */
+async function readBoundedBody(request, limit) {
+	if (Number(request.headers.get("Content-Length") ?? "0") > limit) return null;
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.byteLength;
+		if (size > limit) {
+			await reader.cancel();
+			return null;
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(bytes);
+}
+//#endregion
+export { readBoundedBody as n, isSameOrigin as t };

package/dist/server.d.ts

@@ -1,2 +1,2 @@
-import { T as ContentBindings, a as ContentExtension, c as createContentRuntime, i as ContentConsentConfig, n as CollectionConfig, o as ContentRuntime, r as ContentConfig, s as ExtensionNode, t as WordPressClient } from "./wordpress-C1xs3xHN.js";
+import { a as ContentExtension, c as createContentRuntime, i as ContentConsentConfig, k as ContentBindings, n as CollectionConfig, o as ContentRuntime, r as ContentConfig, s as ExtensionNode, t as WordPressClient } from "./wordpress-BvkTDMA0.js";
 export { CollectionConfig, type ContentBindings, ContentConfig, ContentConsentConfig, ContentExtension, ContentRuntime, ExtensionNode, type WordPressClient, createContentRuntime };