@getquick/content 0.5.0 → 0.6.0

package/dist/forms.d.ts

@@ -1,5 +1,43 @@
-import { S as parseFormDescriptors, _ as findForm, a as FormConsent, b as formsReadiness, c as FormDiagnosticCode, d as FormInput, f as FormSpamControl, g as blockFormId, h as SUPPORTED_FIELD_TYPES, i as FormConfirmation, l as FormField, m as GRAVITY_FORMS_BLOCK, n as FORM_DESCRIPTOR_SCHEMA, o as FormDescriptor, p as FormsReadiness, r as FormChoice, s as FormDiagnostic, t as FORMS_PATH, u as FormFieldType, v as formAction, x as parseFormDescriptor, y as formDiagnostics } from "./descriptor-B-e7gHi1.js";
-import { a as clearFormStateCookie, c as formStateLocation, d as FormErrorCode, f as FormsCopy, i as FormStatus, l as readFormState, m as formsCopyLanguage, n as FORM_STATE_PARAM, o as formStateCookie, p as FormsCopyLanguage, r as FormState, s as formStateCookieName, t as FORM_STATE_MAX_AGE, u as FORMS_COPY } from "./state-CsMFLUUO.js";
+import { C as formsReadiness, D as parseFormDescriptors, E as parseFormDescriptor, S as formDiagnostics, T as largestUpload, _ as VERIFIABLE_FILE_EXTENSIONS, a as FormConsent, b as findForm, c as FormDiagnosticCode, d as FormInput, f as FormSpamControl, g as SUPPORTED_FIELD_TYPES, h as GRAVITY_FORMS_BLOCK, i as FormConfirmation, l as FormField, m as FormsReadiness, n as FORM_DESCRIPTOR_SCHEMA, o as FormDescriptor, p as FormUpload, r as FormChoice, s as FormDiagnostic, t as FORMS_PATH, u as FormFieldType, v as VerifiableFileExtension, w as hasUploads, x as formAction, y as blockFormId } from "./descriptor-BF5Y9a1J.js";
+import { a as clearFormStateCookie, c as formStateLocation, d as FormErrorCode, f as FormsCopy, i as FormStatus, l as readFormState, m as formsCopyLanguage, n as FORM_STATE_PARAM, o as formStateCookie, p as FormsCopyLanguage, r as FormState, s as formStateCookieName, t as FORM_STATE_MAX_AGE, u as FORMS_COPY } from "./state-Bw-HSBeO.js";
+//#region frontend/src/forms/uploads.d.ts
+/** The format each allowed extension's content must prove, as a MIME type. */
+export declare const FILE_TYPES: Readonly<Record<VerifiableFileExtension, string>>;
+/** The format a file's first bytes prove (a MIME type of FILE_TYPES), or null. */
+export declare function sniffFileType(bytes: Uint8Array): string | null;
+/** A posted file (a `File` from `FormData`): a Blob with the visitor's file name. */
+type SubmittedFile = Blob & {
+  readonly name: string;
+};
+/** What the visitor posted: a multipart body's entries by name (`FormData`). */
+interface SubmittedFiles {
+  getAll(name: string): ReadonlyArray<unknown>;
+}
+/** A checked file, as it is sent to Gravity Forms. */
+interface CheckedFile {
+  /** The name it is posted under: `input_<field>`, or `input_<field>[]` for several. */
+  name: string;
+  file: SubmittedFile;
+  /** The visitor's file name, without any path or control characters. */
+  filename: string;
+  /** The format its content proves; never the client's. */
+  type: string;
+}
+interface UploadCheck {
+  files: CheckedFile[];
+  /** Field errors, by field id. */
+  errors: Record<number, FormErrorCode>;
+}
+/** The file name without a path, quotes or control characters, keeping its end (the extension). */
+export declare function uploadFilename(name: string): string;
+/**
+ * Checks each visible upload field's files: a required field has one, a field
+ * takes at most its maximum, and each file has an allowed extension, fits the
+ * field's size limit and is what its extension names. Files posted under any
+ * other name are ignored. An empty part (no file chosen) isn't a file.
+ */
+export declare function validateUploads(descriptor: FormDescriptor, posted: SubmittedFiles): Promise<UploadCheck>;
+//#endregion
 //#region frontend/src/forms/validate.d.ts
 /** No single value is longer (characters). */
 export declare const MAX_VALUE_LENGTH = 10000;
@@ -22,4 +60,4 @@ export declare function validateSubmission(descriptor: FormDescriptor, values: S
 /** Whether the honeypot was filled in: a bot. Such a submission never reaches the CMS. */
 export declare function honeypotFilled(descriptor: FormDescriptor, values: SubmittedValues): boolean;
 //#endregion
-export { FORMS_COPY, FORMS_PATH, FORM_DESCRIPTOR_SCHEMA, FORM_STATE_MAX_AGE, FORM_STATE_PARAM, type FormChoice, type FormConfirmation, type FormConsent, type FormDescriptor, type FormDiagnostic, type FormDiagnosticCode, type FormErrorCode, type FormField, type FormFieldType, type FormInput, type FormSpamControl, type FormState, type FormStatus, type FormsCopy, type FormsCopyLanguage, type FormsReadiness, GRAVITY_FORMS_BLOCK, SUPPORTED_FIELD_TYPES, type SubmissionCheck, type SubmittedValues, blockFormId, clearFormStateCookie, findForm, formAction, formDiagnostics, formStateCookie, formStateCookieName, formStateLocation, formsCopyLanguage, formsReadiness, parseFormDescriptor, parseFormDescriptors, readFormState };
+export { type CheckedFile, FORMS_COPY, FORMS_PATH, FORM_DESCRIPTOR_SCHEMA, FORM_STATE_MAX_AGE, FORM_STATE_PARAM, type FormChoice, type FormConfirmation, type FormConsent, type FormDescriptor, type FormDiagnostic, type FormDiagnosticCode, type FormErrorCode, type FormField, type FormFieldType, type FormInput, type FormSpamControl, type FormState, type FormStatus, type FormUpload, type FormsCopy, type FormsCopyLanguage, type FormsReadiness, GRAVITY_FORMS_BLOCK, SUPPORTED_FIELD_TYPES, type SubmissionCheck, type SubmittedFile, type SubmittedFiles, type SubmittedValues, type UploadCheck, VERIFIABLE_FILE_EXTENSIONS, type VerifiableFileExtension, blockFormId, clearFormStateCookie, findForm, formAction, formDiagnostics, formStateCookie, formStateCookieName, formStateLocation, formsCopyLanguage, formsReadiness, hasUploads, largestUpload, parseFormDescriptor, parseFormDescriptors, readFormState };

package/dist/forms.js

@@ -1,4 +1,4 @@
-import { a as blockFormId, c as formDiagnostics, d as parseFormDescriptors, i as SUPPORTED_FIELD_TYPES, l as formsReadiness, n as FORM_DESCRIPTOR_SCHEMA, o as findForm, r as GRAVITY_FORMS_BLOCK, s as formAction, t as FORMS_PATH, u as parseFormDescriptor } from "./descriptor-x8kHFQ79.js";
-import { n as honeypotFilled, r as validateSubmission, t as MAX_VALUE_LENGTH } from "./validate-wRgYUNxN.js";
-import { a as clearFormStateCookie, c as formStateLocation, i as FORM_STATE_PARAM, l as readFormState, n as formsCopyLanguage, o as formStateCookie, r as FORM_STATE_MAX_AGE, s as formStateCookieName, t as FORMS_COPY } from "./copy-DLto_bWj.js";
-export { FORMS_COPY, FORMS_PATH, FORM_DESCRIPTOR_SCHEMA, FORM_STATE_MAX_AGE, FORM_STATE_PARAM, GRAVITY_FORMS_BLOCK, MAX_VALUE_LENGTH, SUPPORTED_FIELD_TYPES, blockFormId, clearFormStateCookie, findForm, formAction, formDiagnostics, formStateCookie, formStateCookieName, formStateLocation, formsCopyLanguage, formsReadiness, honeypotFilled, parseFormDescriptor, parseFormDescriptors, readFormState, validateSubmission };
+import { a as VERIFIABLE_FILE_EXTENSIONS, c as formAction, d as hasUploads, f as largestUpload, i as SUPPORTED_FIELD_TYPES, l as formDiagnostics, m as parseFormDescriptors, n as FORM_DESCRIPTOR_SCHEMA, o as blockFormId, p as parseFormDescriptor, r as GRAVITY_FORMS_BLOCK, s as findForm, t as FORMS_PATH, u as formsReadiness } from "./descriptor-DXmLmjEa.js";
+import { a as sniffFileType, i as FILE_TYPES, n as honeypotFilled, o as uploadFilename, r as validateSubmission, s as validateUploads, t as MAX_VALUE_LENGTH } from "./validate-CqP_F0bk.js";
+import { a as clearFormStateCookie, c as formStateLocation, i as FORM_STATE_PARAM, l as readFormState, n as formsCopyLanguage, o as formStateCookie, r as FORM_STATE_MAX_AGE, s as formStateCookieName, t as FORMS_COPY } from "./copy-CfNr6M73.js";
+export { FILE_TYPES, FORMS_COPY, FORMS_PATH, FORM_DESCRIPTOR_SCHEMA, FORM_STATE_MAX_AGE, FORM_STATE_PARAM, GRAVITY_FORMS_BLOCK, MAX_VALUE_LENGTH, SUPPORTED_FIELD_TYPES, VERIFIABLE_FILE_EXTENSIONS, blockFormId, clearFormStateCookie, findForm, formAction, formDiagnostics, formStateCookie, formStateCookieName, formStateLocation, formsCopyLanguage, formsReadiness, hasUploads, honeypotFilled, largestUpload, parseFormDescriptor, parseFormDescriptors, readFormState, sniffFileType, uploadFilename, validateSubmission, validateUploads };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as Delivery, A as SqlDatabase, At as DesignThemeOverrides, B as DesignBlockRenderer, Bt as DesignPreloadedPosts, C as Moved, Ct as PresentationTheme, D as SearchPage, Dt as presentationStyleSheet, E as SearchItem, Et as presentationModel, F as isLanguageHome, Ft as DesignFonts, G as escapeHtml, Gt as designQueryItems, H as DesignRenderContext, Ht as DesignQueryRenderContext, I as languageSubject, It as DesignTextStyles, J as Archives, Jt as renderDesignQuery, K as parseDesignBlocks, Kt as preloadDesignQueryPosts, L as routeLanguage, Lt as ResolvedLogoImage, M as SiteLanguage, Mt as designThemeVariables, N as WordPressLanguages, Nt as resolveDesignTheme, O as SearchQuery, Ot as presentationVariables, P as htmlLang, Pt as resolvePresentationToken, Q as CollectionTerm, R as siteLanguages, Rt as DesignPostContext, S as HomePublication, St as PresentationTargets, T as SearchDelivery, Tt as createPresentationModel, U as DesignRenderOptions, Ut as DesignQueryResolverOptions, V as DesignPattern, Vt as DesignQueryItem, W as designMenuItems, Wt as designPostContext, X as CmsFailureReason, Xt as renderDesignText, Y as CmsFailure, Yt as DesignTextContext, Z as CollectionMembership, Zt as safeDesignRichText, _ as EntryDelivery, _t as designFontsHead, a as ContentExtension, at as Missing, b as HomeDelivery, bt as PresentationBreakpoint, ct as Translation, d as CollectionListing, dt as WordPressMenuItem, et as DesignPresets, f as CollectionPage, ft as WordPressPost, g as DeliveryFailureReason, gt as designFontStyleSheet, h as CollectionTermListing, ht as designFontPreloads, i as ContentConsentConfig, it as HomeContent, j as SqlStatement, jt as designThemeStyleSheet, k as ContentBindings, kt as DesignTheme, l as Alternate, lt as Unavailable, m as CollectionTermCount, mt as DesignTypography, n as CollectionConfig, nt as Extended, o as ContentRuntime, ot as PublishedEntry, p as CollectionQuery, pt as WordPressSettings, q as renderDesignPattern, qt as renderDesignPostBlock, r as ContentConfig, rt as Found, s as ExtensionNode, st as SiteChrome, t as WordPressClient, tt as EntryContent, u as CollectionItem, ut as WordPressImage, v as EntryPage, vt as designTextStyleSheet, w as NotServed, wt as Property, x as HomePage, xt as PresentationModel, y as EntryPublication, yt as Presentation, z as DesignBlock, zt as DesignPostRecord } from "./wordpress-OWJxnbAF.js";
+import { $ as Delivery, A as SqlDatabase, At as DesignThemeOverrides, B as DesignBlockRenderer, Bt as DesignPreloadedPosts, C as Moved, Ct as PresentationTheme, D as SearchPage, Dt as presentationStyleSheet, E as SearchItem, Et as presentationModel, F as isLanguageHome, Ft as DesignFonts, G as escapeHtml, Gt as designQueryItems, H as DesignRenderContext, Ht as DesignQueryRenderContext, I as languageSubject, It as DesignTextStyles, J as Archives, Jt as renderDesignQuery, K as parseDesignBlocks, Kt as preloadDesignQueryPosts, L as routeLanguage, Lt as ResolvedLogoImage, M as SiteLanguage, Mt as designThemeVariables, N as WordPressLanguages, Nt as resolveDesignTheme, O as SearchQuery, Ot as presentationVariables, P as htmlLang, Pt as resolvePresentationToken, Q as CollectionTerm, R as siteLanguages, Rt as DesignPostContext, S as HomePublication, St as PresentationTargets, T as SearchDelivery, Tt as createPresentationModel, U as DesignRenderOptions, Ut as DesignQueryResolverOptions, V as DesignPattern, Vt as DesignQueryItem, W as designMenuItems, Wt as designPostContext, X as CmsFailureReason, Xt as renderDesignText, Y as CmsFailure, Yt as DesignTextContext, Z as CollectionMembership, Zt as safeDesignRichText, _ as EntryDelivery, _t as designFontsHead, a as ContentExtension, at as Missing, b as HomeDelivery, bt as PresentationBreakpoint, ct as Translation, d as CollectionListing, dt as WordPressMenuItem, et as DesignPresets, f as CollectionPage, ft as WordPressPost, g as DeliveryFailureReason, gt as designFontStyleSheet, h as CollectionTermListing, ht as designFontPreloads, i as ContentConsentConfig, it as HomeContent, j as SqlStatement, jt as designThemeStyleSheet, k as ContentBindings, kt as DesignTheme, l as Alternate, lt as Unavailable, m as CollectionTermCount, mt as DesignTypography, n as CollectionConfig, nt as Extended, o as ContentRuntime, ot as PublishedEntry, p as CollectionQuery, pt as WordPressSettings, q as renderDesignPattern, qt as renderDesignPostBlock, r as ContentConfig, rt as Found, s as ExtensionNode, st as SiteChrome, t as WordPressClient, tt as EntryContent, u as CollectionItem, ut as WordPressImage, v as EntryPage, vt as designTextStyleSheet, w as NotServed, wt as Property, x as HomePage, xt as PresentationModel, y as EntryPublication, yt as Presentation, z as DesignBlock, zt as DesignPostRecord } from "./wordpress-CZ4JCdXF.js";
 //#region frontend/src/cover-video-html.d.ts
 /** Native decorative Cover video must not start before motion preferences are
  * known. Retain every source, poster, child and independent video attribute. */

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as VIDEO_HERO_BLOCK, A as formatDate, B as renderDesignPostBlock, C as siteLanguages, D as renderDesignPattern, E as parseDesignBlocks, F as uriPath, G as renderWordPressBlocks, H as hasDesignCarousel, I as renderDesignCover, J as DESIGN_CAROUSEL_ITEM, K as designGridStyle, L as designPostContext, M as responseStatus, N as routeOf, O as cmsTime, P as stripHtml, Q as renderDesignCarouselItem, R as designQueryItems, S as routeLanguage, T as escapeHtml, U as hasVideoHero, V as renderDesignQuery, W as parseWordPressBlocks, X as designCarouselStyle, Y as DESIGN_CAROUSEL_NAVIGATION, Z as renderDesignCarousel, _t as selectSiteLogo, a as designTextStyleSheet, at as enhanceDesignNavigationHtml, b as isLanguageHome, ct as presentationHtml, dt as presentationStyleSheet, et as renderDesignVideoHero, ft as presentationVariables, gt as resolvePresentationToken, ht as resolveDesignTheme, it as safeDesignRichText, j as menuItemHref, k as decodeEntities, lt as createPresentationModel, mt as designThemeVariables, n as designFontStyleSheet, nt as renderDesignImage, ot as navigationStyleSheet, pt as designThemeStyleSheet, q as DESIGN_CAROUSEL, r as designFontsHead, rt as renderDesignText, st as renderDesignNavigation, t as designFontPreloads, tt as youtubeVideoId, ut as presentationModel, w as designMenuItems, x as languageSubject, y as htmlLang, yt as enhanceDesignCoverVideosHtml, z as preloadDesignQueryPosts } from "./design-fonts-B0ts54vY.js";
+import { $ as VIDEO_HERO_BLOCK, A as formatDate, B as renderDesignPostBlock, C as siteLanguages, D as renderDesignPattern, E as parseDesignBlocks, F as uriPath, G as renderWordPressBlocks, H as hasDesignCarousel, I as renderDesignCover, J as DESIGN_CAROUSEL_ITEM, K as designGridStyle, L as designPostContext, M as responseStatus, N as routeOf, O as cmsTime, P as stripHtml, Q as renderDesignCarouselItem, R as designQueryItems, S as routeLanguage, T as escapeHtml, U as hasVideoHero, V as renderDesignQuery, W as parseWordPressBlocks, X as designCarouselStyle, Y as DESIGN_CAROUSEL_NAVIGATION, Z as renderDesignCarousel, _t as selectSiteLogo, a as designTextStyleSheet, at as enhanceDesignNavigationHtml, b as isLanguageHome, ct as presentationHtml, dt as presentationStyleSheet, et as renderDesignVideoHero, ft as presentationVariables, gt as resolvePresentationToken, ht as resolveDesignTheme, it as safeDesignRichText, j as menuItemHref, k as decodeEntities, lt as createPresentationModel, mt as designThemeVariables, n as designFontStyleSheet, nt as renderDesignImage, ot as navigationStyleSheet, pt as designThemeStyleSheet, q as DESIGN_CAROUSEL, r as designFontsHead, rt as renderDesignText, st as renderDesignNavigation, t as designFontPreloads, tt as youtubeVideoId, ut as presentationModel, w as designMenuItems, x as languageSubject, y as htmlLang, yt as enhanceDesignCoverVideosHtml, z as preloadDesignQueryPosts } from "./design-fonts-tbvMfxXU.js";
 import { n as videoHeroStyleSheet, t as videoHeroFrameGeometry } from "./video-hero-D8AcMR4q.js";
 //#region frontend/src/wp-block-styles.ts
 const validSlug = (slug) => /^[a-z0-9][a-z0-9-]*$/.test(slug);

package/dist/server.d.ts

@@ -1,2 +1,2 @@
-import { a as ContentExtension, c as createContentRuntime, i as ContentConsentConfig, k as ContentBindings, n as CollectionConfig, o as ContentRuntime, r as ContentConfig, s as ExtensionNode, t as WordPressClient } from "./wordpress-OWJxnbAF.js";
+import { a as ContentExtension, c as createContentRuntime, i as ContentConsentConfig, k as ContentBindings, n as CollectionConfig, o as ContentRuntime, r as ContentConfig, s as ExtensionNode, t as WordPressClient } from "./wordpress-CZ4JCdXF.js";
 export { CollectionConfig, type ContentBindings, ContentConfig, ContentConsentConfig, ContentExtension, ContentRuntime, ExtensionNode, type WordPressClient, createContentRuntime };

package/dist/server.js

@@ -1,6 +1,6 @@
 import { n as parseFragment } from "./dist-5jNKLmbn.js";
-import { C as siteLanguages, D as renderDesignPattern, E as parseDesignBlocks, F as uriPath, G as renderWordPressBlocks, H as hasDesignCarousel, N as routeOf, O as cmsTime, P as stripHtml, S as routeLanguage, U as hasVideoHero, W as parseWordPressBlocks, _ as unionType, at as enhanceDesignNavigationHtml, b as isLanguageHome, bt as safeContentUrl, c as arrayType, d as lazyType, f as literalType, g as stringType, h as recordType, ht as resolveDesignTheme, i as designFontsSchema, j as menuItemHref, k as decodeEntities, l as booleanType, m as objectType, o as designTextStylesSchema, p as numberType, s as NEVER, u as enumType, v as unknownType, vt as assertDesignBlocks, x as languageSubject, yt as enhanceDesignCoverVideosHtml, z as preloadDesignQueryPosts } from "./design-fonts-B0ts54vY.js";
-import { d as parseFormDescriptors, o as findForm } from "./descriptor-x8kHFQ79.js";
+import { C as siteLanguages, D as renderDesignPattern, E as parseDesignBlocks, F as uriPath, G as renderWordPressBlocks, H as hasDesignCarousel, N as routeOf, O as cmsTime, P as stripHtml, S as routeLanguage, U as hasVideoHero, W as parseWordPressBlocks, _ as unionType, at as enhanceDesignNavigationHtml, b as isLanguageHome, bt as safeContentUrl, c as arrayType, d as lazyType, f as literalType, g as stringType, h as recordType, ht as resolveDesignTheme, i as designFontsSchema, j as menuItemHref, k as decodeEntities, l as booleanType, m as objectType, o as designTextStylesSchema, p as numberType, s as NEVER, u as enumType, v as unknownType, vt as assertDesignBlocks, x as languageSubject, yt as enhanceDesignCoverVideosHtml, z as preloadDesignQueryPosts } from "./design-fonts-tbvMfxXU.js";
+import { m as parseFormDescriptors, s as findForm } from "./descriptor-DXmLmjEa.js";
 import { t as bearerMatches } from "./bearer-DMOCoSci.js";
 import { _ as consentConfiguration } from "./state-BYWc5TUB.js";
 import { i as rewriteEmbeds, l as parseLegalLanguage } from "./embeds-CJJemAmE.js";

package/dist/{state-CsMFLUUO.d.ts → state-Bw-HSBeO.d.ts}

@@ -1,6 +1,6 @@
 //#region frontend/src/forms/copy.d.ts
 type FormsCopyLanguage = "en" | "pt-PT";
-type FormErrorCode = "required" | "email" | "email-mismatch" | "number" | "range" | "url" | "choice" | "too-long";
+type FormErrorCode = "required" | "email" | "email-mismatch" | "number" | "range" | "url" | "choice" | "too-long" | "file-type" | "file-size" | "file-count";
 interface FormsCopy {
   required: string;
   requiredFields: string;
@@ -20,13 +20,23 @@ interface FormsCopy {
   honeypot: string;
   /** With Turnstile and no JavaScript. */
   needsJavaScript: string;
+  /** An upload field's hint: `{types}` is the list of extensions. */
+  fileTypes: string;
+  /** `{size}` is the per-file limit (5 MB). */
+  fileSize: string;
+  /** `{count}` is the most files a field takes, when more than one. */
+  fileCount: string;
+  /** After a post that came back: browsers can't keep chosen files. */
+  filesAgain: string;
+  /** The whole post was larger than the Site accepts. */
+  tooLarge: string;
 }
 declare const FORMS_COPY: Record<FormsCopyLanguage, FormsCopy>;
 /** The copy language for a page's `lang`: Portuguese for `pt*`, else English. */
 declare function formsCopyLanguage(language: string | null | undefined): FormsCopyLanguage;
 //#endregion
 //#region frontend/src/forms/state.d.ts
-type FormStatus = "sent" | "invalid" | "failed" | "verification" | "too-many";
+type FormStatus = "sent" | "invalid" | "failed" | "verification" | "too-many" | "too-large";
 interface FormState {
   formId: number;
   status: FormStatus;

package/dist/{validate-wRgYUNxN.js → validate-CqP_F0bk.js}

@@ -1,3 +1,110 @@
+//#region frontend/src/forms/uploads.ts
+/** The format each allowed extension's content must prove, as a MIME type. */
+const FILE_TYPES = {
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	png: "image/png",
+	gif: "image/gif",
+	webp: "image/webp",
+	pdf: "application/pdf"
+};
+/** Bytes read from the start of a file to identify it. */
+const SIGNATURE_BYTES = 12;
+const ascii = (text) => new TextEncoder().encode(text);
+const JPEG = [
+	255,
+	216,
+	255
+];
+const PNG = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+const GIF87 = ascii("GIF87a");
+const GIF89 = ascii("GIF89a");
+const RIFF = ascii("RIFF");
+const WEBP = ascii("WEBP");
+const PDF = ascii("%PDF-");
+function startsWith(bytes, offset, expected) {
+	for (let index = 0; index < expected.length; index++) if (bytes[offset + index] !== expected[index]) return false;
+	return true;
+}
+/** The format a file's first bytes prove (a MIME type of FILE_TYPES), or null. */
+function sniffFileType(bytes) {
+	if (startsWith(bytes, 0, JPEG)) return "image/jpeg";
+	if (startsWith(bytes, 0, PNG)) return "image/png";
+	if (startsWith(bytes, 0, GIF87) || startsWith(bytes, 0, GIF89)) return "image/gif";
+	if (startsWith(bytes, 0, RIFF) && startsWith(bytes, 8, WEBP)) return "image/webp";
+	if (startsWith(bytes, 0, PDF)) return "application/pdf";
+	return null;
+}
+const isFile = (value) => value instanceof Blob && typeof value.name === "string";
+/** The file name without a path, quotes or control characters, keeping its end (the extension). */
+function uploadFilename(name) {
+	const base = name.split(/[\\/]/).pop() ?? "";
+	return Array.from(base.replace(/[\u0000-\u001f\u007f"]/g, "").trim()).slice(-200).join("");
+}
+const extensionOf = (filename) => /\.([^.]+)$/.exec(filename)?.[1]?.toLowerCase() ?? "";
+/**
+* Checks each visible upload field's files: a required field has one, a field
+* takes at most its maximum, and each file has an allowed extension, fits the
+* field's size limit and is what its extension names. Files posted under any
+* other name are ignored. An empty part (no file chosen) isn't a file.
+*/
+async function validateUploads(descriptor, posted) {
+	const files = [];
+	const errors = {};
+	for (const field of descriptor.fields) {
+		const input = field.inputs[0];
+		const upload = field.upload;
+		if (field.type !== "fileupload" || field.visibility !== "visible" || !input || !upload) continue;
+		const chosen = posted.getAll(input.name).filter(isFile).filter((file) => file.size > 0 || file.name !== "");
+		if (chosen.length === 0) {
+			if (field.required) errors[field.id] = "required";
+			continue;
+		}
+		if (chosen.length > Math.max(upload.maxFiles, 1)) {
+			errors[field.id] = "file-count";
+			continue;
+		}
+		const checked = [];
+		for (const file of chosen) {
+			const filename = uploadFilename(file.name);
+			const extension = extensionOf(filename);
+			const expected = upload.allowedExtensions.includes(extension) ? FILE_TYPES[extension] : void 0;
+			if (!expected || file.size === 0) {
+				errors[field.id] = "file-type";
+				break;
+			}
+			if (file.size > upload.maxFileSize) {
+				errors[field.id] = "file-size";
+				break;
+			}
+			if (sniffFileType(new Uint8Array(await file.slice(0, SIGNATURE_BYTES).arrayBuffer())) !== expected) {
+				errors[field.id] = "file-type";
+				break;
+			}
+			checked.push({
+				name: upload.multipleFiles ? `${input.name}[]` : input.name,
+				file,
+				filename,
+				type: expected
+			});
+		}
+		if (!errors[field.id]) files.push(...checked);
+	}
+	return {
+		files,
+		errors
+	};
+}
+//#endregion
 //#region frontend/src/forms/validate.ts
 /** No single value is longer (characters). */
 const MAX_VALUE_LENGTH = 1e4;
@@ -38,7 +145,8 @@ function check(field, values, input, shown) {
 	const first = field.inputs[0];
 	switch (field.type) {
 		case "html":
-		case "section": return null;
+		case "section":
+		case "fileupload": return null;
 		case "hidden": {
 			if (!first) return null;
 			const value = values.get(first.name) === null ? field.defaultValue ?? "" : take(first.name);
@@ -127,4 +235,4 @@ function honeypotFilled(descriptor, values) {
 	return descriptor.honeypot !== null && (values.get(descriptor.honeypot.name) ?? "") !== "";
 }
 //#endregion
-export { honeypotFilled as n, validateSubmission as r, MAX_VALUE_LENGTH as t };
+export { sniffFileType as a, FILE_TYPES as i, honeypotFilled as n, uploadFilename as o, validateSubmission as r, validateUploads as s, MAX_VALUE_LENGTH as t };

package/dist/{version-CmdZGJvZ.js → version-CcJhZgHO.js}

@@ -1,6 +1,6 @@
 //#endregion
 //#region frontend/src/consent/version.ts
 /** The UI/adapter version recorded with each decision (CN-R7). */
-const CONSENT_UI_VERSION = `gq-content@0.5.0`;
+const CONSENT_UI_VERSION = `gq-content@0.6.0`;
 //#endregion
 export { CONSENT_UI_VERSION as t };

package/dist/{wordpress-OWJxnbAF.d.ts → wordpress-CZ4JCdXF.d.ts}

@@ -1,6 +1,6 @@
 import { r as ConsentConfiguration, t as AnalyticsSettings } from "./configuration-C_JGygQI.js";
 import { r as LegalLanguage } from "./legal-C5Xiq59W.js";
-import { o as FormDescriptor } from "./descriptor-B-e7gHi1.js";
+import { o as FormDescriptor } from "./descriptor-BF5Y9a1J.js";
 //#endregion
 //#region frontend/src/design-text.d.ts
 /** Already loaded, authorized values. No lookup, fetching or query selection.
@@ -313,9 +313,9 @@ interface DesignTypography {
 /**
  * The `@font-face` rules (Site faces with `font-display` as delivered, and the
  * metric-matched fallback faces) and the assigned slots' `--gqd-font-*` stacks.
- * The stacks are set on `:root` and again on the content root: the theme
- * stylesheet declares the system stacks on that root, which would otherwise
- * shadow the assignment inside Design content.
+ * GQ Design sets the stacks on `:root` and, with doubled specificity, on the
+ * content root: the theme stylesheet declares the system stacks on that root,
+ * which would otherwise shadow the assignment inside Design content.
  */
 declare function designFontStyleSheet(fonts?: DesignFonts | null, root?: string): string;
 /** At most two WOFF2 preloads GQ Design marks (the text styles' primary Latin faces). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getquick/content",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "license": "UNLICENSED",
   "files": [
     "dist",