@getquick/content 0.5.1 → 0.6.0

package/dist/{client-ip-cnqPLdDa.js → client-ip-NKt34dBM.js}

@@ -19,8 +19,13 @@ function isSameOrigin(request, origins) {
 }
 /** The body as text, or null once it exceeds `limit` bytes (declared or read). */
 async function readBoundedBody(request, limit) {
+	const bytes = await readBoundedBytes(request, limit);
+	return bytes === null ? null : new TextDecoder().decode(bytes);
+}
+/** The body's bytes, or null once it exceeds `limit` bytes (declared or read). */
+async function readBoundedBytes(request, limit) {
 	if (Number(request.headers.get("Content-Length") ?? "0") > limit) return null;
-	if (!request.body) return "";
+	if (!request.body) return /* @__PURE__ */ new Uint8Array();
 	const reader = request.body.getReader();
 	const chunks = [];
 	let size = 0;
@@ -40,7 +45,7 @@ async function readBoundedBody(request, limit) {
 		bytes.set(chunk, offset);
 		offset += chunk.byteLength;
 	}
-	return new TextDecoder().decode(bytes);
+	return bytes;
 }
 //#endregion
 //#region frontend/src/client-ip.ts
@@ -200,4 +205,4 @@ function rateLimitKey(address) {
 	})}/64`;
 }
 //#endregion
-export { readBoundedBody as i, rateLimitKey as n, isSameOrigin as r, clientAddressResolver as t };
+export { readBoundedBytes as a, readBoundedBody as i, rateLimitKey as n, isSameOrigin as r, clientAddressResolver as t };

package/dist/consent-html.js

@@ -1,6 +1,6 @@
 import { S as SERVICE_CATALOG, T as copyLanguage, c as grantedCategories, d as promptReason, f as readConsentCookie, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as CONSENT_COPY, c as legalRevisions, r as escapeHtml } from "./embeds-CJJemAmE.js";
-import { t as CONSENT_UI_VERSION } from "./version-7v3zP5aF.js";
+import { t as CONSENT_UI_VERSION } from "./version-CcJhZgHO.js";
 import { t as CONSENT_CONFIG_ID } from "./client-config-B3LNSOxl.js";
 import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
 //#region frontend/src/consent/html.ts

package/dist/consent-server.js

@@ -2,7 +2,7 @@ import { t as bearerMatches } from "./bearer-DMOCoSci.js";
 import { i as DECISION_VALIDITY_MS, l as isConsentId, t as CONSENT_ACTIONS, x as OPTIONAL_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as parseConsentRecordRequest, t as MAX_RECORD_BYTES } from "./records-Dumrz759.js";
 import { t as CONSENT_PATH } from "./paths-Cmzzof3v.js";
-import { i as readBoundedBody, n as rateLimitKey, r as isSameOrigin, t as clientAddressResolver } from "./client-ip-cnqPLdDa.js";
+import { i as readBoundedBody, n as rateLimitKey, r as isSameOrigin, t as clientAddressResolver } from "./client-ip-NKt34dBM.js";
 //#region frontend/src/consent/server.ts
 const MAX_RETENTION_DAYS = 1826;
 const DAY_MS = 864e5;

package/dist/consent.js

@@ -1,5 +1,5 @@
 import { C as SERVICE_IDS, D as hostMatches, E as embedService, O as hostService, S as SERVICE_CATALOG, T as copyLanguage, _ as consentConfiguration, a as consentCookie, b as COPY_LANGUAGES, c as grantedCategories, d as promptReason, f as readConsentCookie, g as MEASUREMENT_ID, h as CONSENT_COPY_REVISION, i as DECISION_VALIDITY_MS, k as isServiceId, l as isConsentId, m as serviceGranted, n as CONSENT_COOKIE, o as decide, p as serializeConsentState, r as CONSENT_COOKIE_MAX_AGE_SECONDS, s as denyAll, t as CONSENT_ACTIONS, u as parseConsentState, v as needsBanner, w as catalogService, x as OPTIONAL_CATEGORIES, y as CONSENT_CATEGORIES } from "./state-BYWc5TUB.js";
 import { a as parseConsentRecordRequest, i as isRecordToken, n as consentRecordRequest, r as isLegalRoleName, t as MAX_RECORD_BYTES } from "./records-Dumrz759.js";
 import { a as CONSENT_COPY, c as legalRevisions, i as rewriteEmbeds, l as parseLegalLanguage, n as embedPlaceholder, o as LEGAL_ROLES, r as escapeHtml, s as REQUIRED_LEGAL_ROLES, t as blockedPlaceholder } from "./embeds-CJJemAmE.js";
-import { t as CONSENT_UI_VERSION } from "./version-7v3zP5aF.js";
+import { t as CONSENT_UI_VERSION } from "./version-CcJhZgHO.js";
 export { CONSENT_ACTIONS, CONSENT_CATEGORIES, CONSENT_COOKIE, CONSENT_COOKIE_MAX_AGE_SECONDS, CONSENT_COPY, CONSENT_COPY_REVISION, CONSENT_UI_VERSION, COPY_LANGUAGES, DECISION_VALIDITY_MS, LEGAL_ROLES, MAX_RECORD_BYTES, MEASUREMENT_ID, OPTIONAL_CATEGORIES, REQUIRED_LEGAL_ROLES, SERVICE_CATALOG, SERVICE_IDS, blockedPlaceholder, catalogService, consentConfiguration, consentCookie, consentRecordRequest, copyLanguage, decide, denyAll, embedPlaceholder, embedService, escapeHtml, grantedCategories, hostMatches, hostService, isConsentId, isLegalRoleName, isRecordToken, isServiceId, legalRevisions, needsBanner, parseConsentRecordRequest, parseConsentState, parseLegalLanguage, promptReason, readConsentCookie, rewriteEmbeds, serializeConsentState, serviceGranted };

package/dist/{copy-DLto_bWj.js → copy-CfNr6M73.js}

@@ -21,7 +21,8 @@ const STATUSES = /* @__PURE__ */ new Set([
 	"invalid",
 	"failed",
 	"verification",
-	"too-many"
+	"too-many",
+	"too-large"
 ]);
 /** The Set-Cookie header that carries a form's outcome to the page. */
 function formStateCookie(state, options) {
@@ -118,7 +119,10 @@ const FORMS_COPY = {
 			range: "Enter a number in the allowed range.",
 			url: "Enter a valid web address, starting with https://.",
 			choice: "Choose one of the options.",
-			"too-long": "This is longer than allowed."
+			"too-long": "This is longer than allowed.",
+			"file-type": "Choose files of an accepted type.",
+			"file-size": "A file is larger than allowed.",
+			"file-count": "Too many files."
 		},
 		failed: "Your message couldn't be sent. Please try again later.",
 		verification: "We couldn't verify that you're not a robot. Please try again.",
@@ -128,7 +132,12 @@ const FORMS_COPY = {
 		submit: "Submit",
 		privacyPolicy: "Privacy policy",
 		honeypot: "This field is for validation purposes and should be left unchanged.",
-		needsJavaScript: "This form needs JavaScript to verify you're not a robot."
+		needsJavaScript: "This form needs JavaScript to verify you're not a robot.",
+		fileTypes: "Accepted file types: {types}.",
+		fileSize: "Up to {size} per file.",
+		fileCount: "Up to {count} files.",
+		filesAgain: "Choose your files again.",
+		tooLarge: "The files are too large to send together. Choose fewer or smaller files."
 	},
 	"pt-PT": {
 		required: "obrigatório",
@@ -142,7 +151,10 @@ const FORMS_COPY = {
 			range: "Introduza um número dentro do intervalo permitido.",
 			url: "Introduza um endereço web válido, começado por https://.",
 			choice: "Escolha uma das opções.",
-			"too-long": "Excede o comprimento permitido."
+			"too-long": "Excede o comprimento permitido.",
+			"file-type": "Escolha ficheiros de um tipo aceite.",
+			"file-size": "Um ficheiro excede o tamanho permitido.",
+			"file-count": "Demasiados ficheiros."
 		},
 		failed: "Não foi possível enviar a sua mensagem. Tente novamente mais tarde.",
 		verification: "Não foi possível verificar que não é um robô. Tente novamente.",
@@ -152,7 +164,12 @@ const FORMS_COPY = {
 		submit: "Enviar",
 		privacyPolicy: "Política de privacidade",
 		honeypot: "Este campo serve para validação e deve ser deixado em branco.",
-		needsJavaScript: "Este formulário precisa de JavaScript para verificar que não é um robô."
+		needsJavaScript: "Este formulário precisa de JavaScript para verificar que não é um robô.",
+		fileTypes: "Tipos de ficheiro aceites: {types}.",
+		fileSize: "Até {size} por ficheiro.",
+		fileCount: "Até {count} ficheiros.",
+		filesAgain: "Volte a escolher os ficheiros.",
+		tooLarge: "Os ficheiros são demasiado grandes para enviar em conjunto. Escolha menos ficheiros ou ficheiros mais pequenos."
 	}
 };
 /** The copy language for a page's `lang`: Portuguese for `pt*`, else English. */

package/dist/{descriptor-B-e7gHi1.d.ts → descriptor-BF5Y9a1J.d.ts}

@@ -6,7 +6,7 @@ declare const FORM_DESCRIPTOR_SCHEMA = 1;
 /** The Gravity Forms block a Site's dispatcher routes to the renderer. */
 declare const GRAVITY_FORMS_BLOCK = "gravityforms/form";
 /** Field types this release renders and submits. */
-declare const SUPPORTED_FIELD_TYPES: readonly ["text", "textarea", "email", "phone", "number", "website", "select", "radio", "checkbox", "consent", "name", "hidden", "html", "section"];
+declare const SUPPORTED_FIELD_TYPES: readonly ["text", "textarea", "email", "phone", "number", "website", "select", "radio", "checkbox", "consent", "name", "hidden", "html", "section", "fileupload"];
 type FormFieldType = (typeof SUPPORTED_FIELD_TYPES)[number];
 interface FormChoice {
   text: string;
@@ -34,6 +34,23 @@ interface FormConsent {
   /** Gravity Forms' form revision the text belongs to; submitted with the consent. */
   revisionId: string;
 }
+/**
+ * The extensions an upload field may allow: the formats whose content the form
+ * endpoint verifies (ADR 0010 here). Another extension is a diagnostic.
+ */
+declare const VERIFIABLE_FILE_EXTENSIONS: readonly ["jpg", "jpeg", "png", "gif", "webp", "pdf"];
+type VerifiableFileExtension = (typeof VERIFIABLE_FILE_EXTENSIONS)[number];
+/** A file upload field's public settings, as Gravity Forms enforces them. */
+interface FormUpload {
+  /** Lower case, without dots (`jpg`, `pdf`). Empty: none set, which isn't supported. */
+  allowedExtensions: string[];
+  /** The largest file accepted, in bytes (the field's limit, capped by the CMS's PHP). */
+  maxFileSize: number;
+  /** Whether the field takes several files. */
+  multipleFiles: boolean;
+  /** The most files it takes: 1 for a single file; 0 for several without a maximum (unsupported). */
+  maxFiles: number;
+}
 interface FormField {
   id: number;
   type: FormFieldType;
@@ -61,6 +78,8 @@ interface FormField {
   };
   /** The Site's CSS classes the editor set on the field. */
   cssClass?: string;
+  /** fileupload only. */
+  upload?: FormUpload;
 }
 type FormConfirmation = {
   type: "message";
@@ -114,6 +133,8 @@ declare function blockFormId(attributes: Record<string, unknown> | null | undefi
 declare function findForm(forms: readonly FormDescriptor[] | null | undefined, formId: number): FormDescriptor | null;
 /** The path a form posts to on the Site's own origin. */
 declare const formAction: (formId: number) => string;
+/** Whether a descriptor has an upload field a visitor fills in: its form posts multipart. */
+declare function hasUploads(descriptor: FormDescriptor): boolean;
 /** Everything readiness must fail for: an unavailable form, and each unsupported field or setting. */
 declare function formDiagnostics(descriptor: FormDescriptor): FormDiagnostic[];
 /** The spam controls a Site's forms use. */
@@ -128,16 +149,25 @@ interface FormsReadiness {
     /** Gravity Forms' honeypot is enabled on the form. */
     honeypot: boolean;
   }>;
-  /** Controls the Site declares that no checked form uses (honeypot only). */
+  /**
+   * Controls the Site declares that no checked form uses (honeypot only), and
+   * forms whose largest upload exceeds the Site's `maxUploadBytes`.
+   */
   warnings: string[];
 }
+/** The most a form's visible upload fields can post together (bytes): each field's limit times its files. */
+declare function largestUpload(descriptor: FormDescriptor): number;
 /**
  * Readiness over the forms a Site's published content references: fails for
  * any diagnostic. `spam` is the Site's declared controls; declaring the
  * honeypot for a form that doesn't enable it is reported as a warning.
+ * `maxUploadBytes` is the Site's cap on a post (the form endpoint's): a form
+ * whose files can exceed it together is reported as a warning, since its
+ * largest posts will be refused.
  */
 declare function formsReadiness(descriptors: readonly FormDescriptor[], options?: {
   spam?: readonly FormSpamControl[];
+  maxUploadBytes?: number;
 }): FormsReadiness;
 //#endregion
-export { parseFormDescriptors as S, findForm as _, FormConsent as a, formsReadiness as b, FormDiagnosticCode as c, FormInput as d, FormSpamControl as f, blockFormId as g, SUPPORTED_FIELD_TYPES as h, FormConfirmation as i, FormField as l, GRAVITY_FORMS_BLOCK as m, FORM_DESCRIPTOR_SCHEMA as n, FormDescriptor as o, FormsReadiness as p, FormChoice as r, FormDiagnostic as s, FORMS_PATH as t, FormFieldType as u, formAction as v, parseFormDescriptor as x, formDiagnostics as y };
+export { formsReadiness as C, parseFormDescriptors as D, parseFormDescriptor as E, formDiagnostics as S, largestUpload as T, VERIFIABLE_FILE_EXTENSIONS as _, FormConsent as a, findForm as b, FormDiagnosticCode as c, FormInput as d, FormSpamControl as f, SUPPORTED_FIELD_TYPES as g, GRAVITY_FORMS_BLOCK as h, FormConfirmation as i, FormField as l, FormsReadiness as m, FORM_DESCRIPTOR_SCHEMA as n, FormDescriptor as o, FormUpload as p, FormChoice as r, FormDiagnostic as s, FORMS_PATH as t, FormFieldType as u, VerifiableFileExtension as v, hasUploads as w, formAction as x, blockFormId as y };

package/dist/{descriptor-x8kHFQ79.js → descriptor-DXmLmjEa.js}

@@ -20,7 +20,20 @@ const SUPPORTED_FIELD_TYPES = [
 	"name",
 	"hidden",
 	"html",
-	"section"
+	"section",
+	"fileupload"
+];
+/**
+* The extensions an upload field may allow: the formats whose content the form
+* endpoint verifies (ADR 0010 here). Another extension is a diagnostic.
+*/
+const VERIFIABLE_FILE_EXTENSIONS = [
+	"jpg",
+	"jpeg",
+	"png",
+	"gif",
+	"webp",
+	"pdf"
 ];
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -53,6 +66,20 @@ function parseInput(value) {
 		...optionalText(value.autocomplete) ? { autocomplete: text(value.autocomplete) } : {}
 	};
 }
+const EXTENSION = /^[a-z0-9]{1,16}$/;
+function parseUpload(value) {
+	const record = isRecord(value) ? value : {};
+	const extensions = Array.isArray(record.allowedExtensions) ? record.allowedExtensions : [];
+	const multipleFiles = record.multipleFiles === true;
+	const size = finite(record.maxFileSize);
+	const count = finite(record.maxFiles);
+	return {
+		allowedExtensions: [...new Set(extensions.map((each) => text(each).trim().toLowerCase().replace(/^\./, "")).filter((each) => EXTENSION.test(each)))],
+		maxFileSize: size !== void 0 && size > 0 ? Math.floor(size) : 0,
+		multipleFiles,
+		maxFiles: !multipleFiles ? 1 : count !== void 0 && count > 0 ? Math.floor(count) : 0
+	};
+}
 function parseField(value) {
 	if (!isRecord(value)) return null;
 	const id = value.id;
@@ -93,6 +120,7 @@ function parseField(value) {
 			...max !== void 0 ? { max } : {}
 		};
 	}
+	if (field.type === "fileupload") field.upload = parseUpload(value.upload);
 	return field;
 }
 function parseConfirmation(value) {
@@ -169,22 +197,53 @@ function findForm(forms, formId) {
 }
 /** The path a form posts to on the Site's own origin. */
 const formAction = (formId) => `${FORMS_PATH}/${formId}`;
+/** Whether a descriptor has an upload field a visitor fills in: its form posts multipart. */
+function hasUploads(descriptor) {
+	return descriptor.fields.some((field) => field.type === "fileupload" && field.visibility === "visible");
+}
+/** Why an upload field's settings can't be honoured, or null. */
+function uploadProblem(upload) {
+	if (!upload || upload.allowedExtensions.length === 0) return `Set the field's allowed file extensions (${VERIFIABLE_FILE_EXTENSIONS.join(", ")}).`;
+	const unverifiable = upload.allowedExtensions.filter((each) => !VERIFIABLE_FILE_EXTENSIONS.includes(each));
+	if (unverifiable.length) return `The Frontend can't verify ${unverifiable.join(", ")} files: allow only ${VERIFIABLE_FILE_EXTENSIONS.join(", ")}.`;
+	if (upload.maxFileSize <= 0) return "The field has no file size limit.";
+	if (upload.maxFiles <= 0) return "Set the maximum number of files.";
+	return null;
+}
 /** Everything readiness must fail for: an unavailable form, and each unsupported field or setting. */
 function formDiagnostics(descriptor) {
 	const diagnostics = [...descriptor.diagnostics];
+	for (const field of descriptor.fields) {
+		if (field.type !== "fileupload") continue;
+		const problem = uploadProblem(field.upload);
+		if (problem && !diagnostics.some((each) => each.code === "unsupported-file-upload" && each.fieldId === field.id)) diagnostics.push({
+			code: "unsupported-file-upload",
+			fieldId: field.id,
+			type: "fileupload",
+			message: problem
+		});
+	}
 	if (!descriptor.available && !diagnostics.some((each) => each.code === "unavailable")) diagnostics.unshift({
 		code: "unavailable",
 		message: `Form ${descriptor.id} is missing, inactive or in the trash.`
 	});
 	return diagnostics;
 }
+/** The most a form's visible upload fields can post together (bytes): each field's limit times its files. */
+function largestUpload(descriptor) {
+	return descriptor.fields.filter((field) => field.type === "fileupload" && field.visibility === "visible").reduce((total, field) => total + (field.upload?.maxFileSize ?? 0) * Math.max(field.upload?.maxFiles ?? 0, 1), 0);
+}
 /**
 * Readiness over the forms a Site's published content references: fails for
 * any diagnostic. `spam` is the Site's declared controls; declaring the
 * honeypot for a form that doesn't enable it is reported as a warning.
+* `maxUploadBytes` is the Site's cap on a post (the form endpoint's): a form
+* whose files can exceed it together is reported as a warning, since its
+* largest posts will be refused.
 */
 function formsReadiness(descriptors, options = {}) {
-	const forms = [...new Map(descriptors.map((descriptor) => [descriptor.id, descriptor])).values()].map((descriptor) => {
+	const unique = new Map(descriptors.map((descriptor) => [descriptor.id, descriptor]));
+	const forms = [...unique.values()].map((descriptor) => {
 		const diagnostics = formDiagnostics(descriptor);
 		return {
 			id: descriptor.id,
@@ -195,6 +254,11 @@ function formsReadiness(descriptors, options = {}) {
 		};
 	});
 	const warnings = options.spam?.includes("honeypot") ? forms.filter((form) => !form.honeypot).map((form) => `Form ${form.id} doesn't enable Gravity Forms' anti-spam honeypot.`) : [];
+	const cap = options.maxUploadBytes;
+	if (cap !== void 0) for (const descriptor of unique.values()) {
+		const largest = largestUpload(descriptor);
+		if (largest > cap) warnings.push(`Form ${descriptor.id}'s files can reach ${(largest / 1048576).toFixed(1)} MB together, more than the ${(cap / 1048576).toFixed(1)} MB the Site accepts per post: lower its upload fields' size limits or numbers of files.`);
+	}
 	return {
 		ok: forms.every((form) => form.ok),
 		forms,
@@ -202,4 +266,4 @@ function formsReadiness(descriptors, options = {}) {
 	};
 }
 //#endregion
-export { blockFormId as a, formDiagnostics as c, parseFormDescriptors as d, SUPPORTED_FIELD_TYPES as i, formsReadiness as l, FORM_DESCRIPTOR_SCHEMA as n, findForm as o, GRAVITY_FORMS_BLOCK as r, formAction as s, FORMS_PATH as t, parseFormDescriptor as u };
+export { VERIFIABLE_FILE_EXTENSIONS as a, formAction as c, hasUploads as d, largestUpload as f, SUPPORTED_FIELD_TYPES as i, formDiagnostics as l, parseFormDescriptors as m, FORM_DESCRIPTOR_SCHEMA as n, blockFormId as o, parseFormDescriptor as p, GRAVITY_FORMS_BLOCK as r, findForm as s, FORMS_PATH as t, formsReadiness as u };

package/dist/forms-astro.d.ts

@@ -1,5 +1,5 @@
-import { _ as findForm, g as blockFormId, l as FormField, m as GRAVITY_FORMS_BLOCK, o as FormDescriptor } from "./descriptor-B-e7gHi1.js";
-import { a as clearFormStateCookie, l as readFormState, n as FORM_STATE_PARAM, r as FormState } from "./state-CsMFLUUO.js";
+import { b as findForm, h as GRAVITY_FORMS_BLOCK, l as FormField, o as FormDescriptor, y as blockFormId } from "./descriptor-BF5Y9a1J.js";
+import { a as clearFormStateCookie, l as readFormState, n as FORM_STATE_PARAM, r as FormState } from "./state-Bw-HSBeO.js";
 //#region frontend/src/forms/astro.d.ts
 /** LEGAL-1's links in the page's language (the chrome's `legal`), structurally. */
 export interface FormsLegal {
@@ -33,6 +33,8 @@ export interface GravityFormInput {
 export declare function escapeHtml(value: string): string;
 /** The HTML id of an input (`gq-form-1-input_1_3`). */
 export declare const inputId: (formId: number, name: string) => string;
+/** A file size as visitors read it (5 MB, 512 KB), never more than the limit. */
+export declare function formatFileSize(bytes: number, language: string): string;
 /** Turnstile loads only once the visitor interacts with a form (CONSENT-1, CN-R3). */
 export declare const FORMS_TURNSTILE_SCRIPT = "(()=>{const s=\"https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit\";let l;const load=()=>l??=new Promise((ok,no)=>{const e=document.createElement(\"script\");e.src=s;e.async=true;e.onload=()=>ok(window.turnstile);e.onerror=no;document.head.append(e)});for(const f of document.querySelectorAll(\"form[data-gq-turnstile]\")){const start=()=>{if(f.dataset.gqTurnstileStarted)return;f.dataset.gqTurnstileStarted=\"1\";load().then(t=>t.render(f.querySelector(\"[data-gq-turnstile-widget]\"),{sitekey:f.dataset.gqTurnstile,\"response-field-name\":\"cf-turnstile-response\"}))};f.addEventListener(\"focusin\",start,{once:true});f.addEventListener(\"pointerdown\",start,{once:true})}})();";
 /**

package/dist/forms-astro.js

@@ -1,5 +1,5 @@
-import { a as blockFormId, o as findForm, r as GRAVITY_FORMS_BLOCK, s as formAction } from "./descriptor-x8kHFQ79.js";
-import { a as clearFormStateCookie, i as FORM_STATE_PARAM, l as readFormState, n as formsCopyLanguage, t as FORMS_COPY } from "./copy-DLto_bWj.js";
+import { c as formAction, d as hasUploads, o as blockFormId, r as GRAVITY_FORMS_BLOCK, s as findForm } from "./descriptor-DXmLmjEa.js";
+import { a as clearFormStateCookie, i as FORM_STATE_PARAM, l as readFormState, n as formsCopyLanguage, t as FORMS_COPY } from "./copy-CfNr6M73.js";
 //#region frontend/src/forms/astro.ts
 function escapeHtml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
@@ -41,7 +41,29 @@ function shown(name, field, context) {
 function requiredMark(field, copy) {
 	return field.required ? ` <span class="gq-form__required" aria-hidden="true">*</span><span class="gq-form__visually-hidden"> (${escapeHtml(copy.required)})</span>` : "";
 }
-/** The description and error elements of a field, and the ids that describe its input. */
+/** A file size as visitors read it (5 MB, 512 KB), never more than the limit. */
+function formatFileSize(bytes, language) {
+	let format;
+	try {
+		format = new Intl.NumberFormat(language, { maximumFractionDigits: 1 });
+	} catch {
+		format = new Intl.NumberFormat("en", { maximumFractionDigits: 1 });
+	}
+	const megabytes = bytes / 1048576;
+	if (megabytes >= 1) return `${format.format(Math.floor(megabytes * 10) / 10)} MB`;
+	return `${format.format(Math.max(1, Math.floor(bytes / 1024)))} KB`;
+}
+/** An upload field's hint: the accepted types, the size limit and how many files. */
+function uploadHint(upload, context) {
+	const { copy } = context;
+	const parts = [];
+	if (upload.allowedExtensions.length) parts.push(copy.fileTypes.replace("{types}", upload.allowedExtensions.map((each) => each.toUpperCase()).join(", ")));
+	if (upload.maxFileSize > 0) parts.push(copy.fileSize.replace("{size}", formatFileSize(upload.maxFileSize, context.language)));
+	if (upload.multipleFiles && upload.maxFiles > 1) parts.push(copy.fileCount.replace("{count}", String(upload.maxFiles)));
+	if (context.state && context.state.status !== "sent") parts.push(copy.filesAgain);
+	return parts.join(" ");
+}
+/** The description, hint and error elements of a field, and the ids that describe its input. */
 function annotations(field, context) {
 	const base = `gq-form-${context.formId}-field-${field.id}`;
 	const error = errorText(field, context);
@@ -51,6 +73,11 @@ function annotations(field, context) {
 		ids.push(`${base}-description`);
 		html += `<p class="gq-form__description" id="${base}-description">${escapeHtml(field.description)}</p>`;
 	}
+	const hint = field.upload ? uploadHint(field.upload, context) : "";
+	if (hint) {
+		ids.push(`${base}-hint`);
+		html += `<p class="gq-form__hint" id="${base}-hint">${escapeHtml(hint)}</p>`;
+	}
 	if (error) {
 		ids.push(`${base}-error`);
 		html += `<p class="gq-form__error" id="${base}-error">${escapeHtml(error)}</p>`;
@@ -107,7 +134,10 @@ function renderField(field, context) {
 	const id = inputId(formId, first.name);
 	const common = attribute("placeholder", field.placeholder) + (field.maxLength ? ` maxlength="${field.maxLength}"` : "") + inputAttributes(field, context, notes);
 	let control;
-	if (field.type === "textarea") control = `<textarea id="${id}" name="${escapeHtml(first.name)}" rows="6"${common}>${escapeHtml(shown(first.name, field, context))}</textarea>`;
+	if (field.type === "fileupload") {
+		const accept = (field.upload?.allowedExtensions ?? []).map((each) => `.${each}`).join(",");
+		control = `<input type="file" id="${id}" name="${escapeHtml(first.name)}"${attribute("accept", accept || null)}${field.upload?.multipleFiles ? " multiple" : ""}${inputAttributes(field, context, notes)}>`;
+	} else if (field.type === "textarea") control = `<textarea id="${id}" name="${escapeHtml(first.name)}" rows="6"${common}>${escapeHtml(shown(first.name, field, context))}</textarea>`;
 	else if (field.type === "select") {
 		const value = typed(context) ? shown(first.name, field, context) : null;
 		const choices = field.choices ?? [];
@@ -145,6 +175,7 @@ function renderGravityForm(input) {
 	const policy = input.legal?.roles.find((role) => role.role === "privacy_policy");
 	const context = {
 		formId,
+		language: input.language,
 		copy,
 		state,
 		privacyPolicy: policy ? {
@@ -166,13 +197,15 @@ function renderGravityForm(input) {
 			const target = field.inputs[0];
 			return [`<li><a href="#${!target ? `gq-form-${formId}` : field.type === "radio" || field.type === "checkbox" ? `${inputId(formId, target.name)}-0` : inputId(formId, target.name)}">${escapeHtml(field.label)}: ${escapeHtml(error)}</a></li>`];
 		});
-		status = `<div class="gq-form__errors" role="alert" id="gq-form-${formId}-errors" tabindex="-1"><p>${escapeHtml(state.status === "invalid" ? copy.errorSummary : state.status === "verification" ? copy.verification : state.status === "too-many" ? copy.tooMany : copy.failed)}</p>${problems.length ? `<ul>${problems.join("")}</ul>` : ""}</div>`;
+		status = `<div class="gq-form__errors" role="alert" id="gq-form-${formId}-errors" tabindex="-1"><p>${escapeHtml(state.status === "invalid" ? copy.errorSummary : state.status === "verification" ? copy.verification : state.status === "too-many" ? copy.tooMany : state.status === "too-large" ? copy.tooLarge : copy.failed)}</p>${problems.length ? `<ul>${problems.join("")}</ul>` : ""}</div>`;
 	}
 	const required = descriptor.fields.some((field) => field.required && field.visibility === "visible") ? `<p class="gq-form__legend">${escapeHtml(copy.requiredFields)}</p>` : "";
 	const honeypot = descriptor.honeypot ? `<div class="gq-form__hp" aria-hidden="true" style="position:absolute!important;left:-9999px!important;width:1px;height:1px;overflow:hidden"><label for="${inputId(formId, descriptor.honeypot.name)}">${escapeHtml(copy.honeypot)}</label><input type="text" id="${inputId(formId, descriptor.honeypot.name)}" name="${escapeHtml(descriptor.honeypot.name)}" value="" tabindex="-1" autocomplete="off"></div>` : "";
 	const turnstile = input.turnstile?.siteKey ? `<div class="gq-form__turnstile" data-gq-turnstile-widget></div><noscript><p class="gq-form__status">${escapeHtml(copy.needsJavaScript)}</p></noscript>` : "";
 	const script = input.turnstile?.siteKey ? `<script>${FORMS_TURNSTILE_SCRIPT}<\/script>` : "";
-	return open + status + `<form class="gq-form__form" method="post" action="${formAction(formId)}" novalidate` + (heading ? ` aria-labelledby="${titleId}"` : "") + attribute("data-gq-turnstile", input.turnstile?.siteKey || null) + `><input type="hidden" name="gq_source" value="${escapeHtml(input.source)}">` + required + honeypot + descriptor.fields.map((field) => renderField(field, context)).join("") + turnstile + `<div class="gq-form__actions"><button type="submit" class="gq-form__submit">${escapeHtml(descriptor.submitLabel || copy.submit)}</button></div></form></div>` + script;
+	const uploads = hasUploads(descriptor);
+	const action = uploads ? `${formAction(formId)}?gq_source=${encodeURIComponent(input.source)}` : formAction(formId);
+	return open + status + `<form class="gq-form__form" method="post" action="${escapeHtml(action)}"` + (uploads ? ` enctype="multipart/form-data"` : "") + ` novalidate` + (heading ? ` aria-labelledby="${titleId}"` : "") + attribute("data-gq-turnstile", input.turnstile?.siteKey || null) + `><input type="hidden" name="gq_source" value="${escapeHtml(input.source)}">` + required + honeypot + descriptor.fields.map((field) => renderField(field, context)).join("") + turnstile + `<div class="gq-form__actions"><button type="submit" class="gq-form__submit">${escapeHtml(descriptor.submitLabel || copy.submit)}</button></div></form></div>` + script;
 }
 /**
 * A minimal default stylesheet (layout and states only). Sites usually style
@@ -190,4 +223,4 @@ const FORMS_STYLES = `
 .gq-form :focus-visible{outline:3px solid var(--gq-form-focus,#1a73e8);outline-offset:2px}
 `.trim();
 //#endregion
-export { FORMS_STYLES, FORMS_TURNSTILE_SCRIPT, FORM_STATE_PARAM, GRAVITY_FORMS_BLOCK, blockFormId, clearFormStateCookie, escapeHtml, findForm, inputId, readFormState, renderGravityForm };
+export { FORMS_STYLES, FORMS_TURNSTILE_SCRIPT, FORM_STATE_PARAM, GRAVITY_FORMS_BLOCK, blockFormId, clearFormStateCookie, escapeHtml, findForm, formatFileSize, inputId, readFormState, renderGravityForm };

package/dist/forms-server.d.ts

@@ -1,7 +1,11 @@
-import { o as FormDescriptor, t as FORMS_PATH } from "./descriptor-B-e7gHi1.js";
+import { o as FormDescriptor, t as FORMS_PATH } from "./descriptor-BF5Y9a1J.js";
 //#region frontend/src/forms/server.d.ts
 /** The largest form body accepted (bytes); larger posts are refused unread. */
 export declare const MAX_FORM_BYTES: number;
+/** The largest multipart (upload) body accepted by default (bytes), files included. */
+export declare const MAX_UPLOAD_BYTES: number;
+/** The most `maxUploadBytes` may be: the Worker holds a post in memory. */
+export declare const MAX_UPLOAD_BYTES_LIMIT: number;
 /** Cloudflare's server-side Turnstile verification. */
 export declare const TURNSTILE_SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
 /** The field Turnstile's widget posts its token in. */
@@ -58,7 +62,13 @@ export interface FormsServerConfig {
   trustedProxies?: readonly string[];
   /** The page language for the handler's own messages (`pt-PT`, `en`). */
   language?: string;
-  /** Milliseconds Gravity Forms and Turnstile have to answer (15 s). */
+  /**
+   * The hard cap on a multipart post, files included (bytes; 10 MiB, at most
+   * 32 MiB). Keep it within what the Site's proxies and the CMS's PHP
+   * (`post_max_size`) accept.
+   */
+  maxUploadBytes?: number;
+  /** Milliseconds Gravity Forms and Turnstile have to answer (15 s; 60 s for uploads). */
   timeoutMs?: number;
   fetch?: typeof globalThis.fetch;
 }
@@ -79,6 +89,7 @@ export declare function createFormsServer(config: FormsServerConfig): {
     turnstileSecret: boolean;
     access: string;
     rateLimit: boolean;
+    maxUploadBytes: number;
     ready: boolean;
   }>;
 };