@growth-labs/cms 0.8.20 → 0.8.24

package/src/routes/machine-context.ts

@@ -0,0 +1,24 @@
+// The Foundry machine marker (M3-18 hardening). Internal: deliberately NOT
+// exported from the package entry or any subpath, so only code inside this
+// package can mark a context.
+//
+// routes/foundry-publish.ts marks the native contexts it builds, and only after
+// the request's Foundry HMAC has verified. A context derived from a session
+// (an editor in the admin UI, an API key) is never marked, whatever subject or
+// userId it carries, so "is this the machine?" cannot be answered by a string
+// a person could hold.
+
+import type { RouteContext } from './context.js'
+
+const FOUNDRY_MACHINE_CONTEXTS = new WeakSet<RouteContext>()
+
+/** Mark a context the HMAC-verified Foundry route built. Returns it, for chaining. */
+export function markFoundryMachineContext(ctx: RouteContext): RouteContext {
+	FOUNDRY_MACHINE_CONTEXTS.add(ctx)
+	return ctx
+}
+
+/** True only for a context the HMAC-verified Foundry route marked. */
+export function isFoundryMachineContext(ctx: RouteContext): boolean {
+	return FOUNDRY_MACHINE_CONTEXTS.has(ctx)
+}

package/src/routes/surveys.ts

@@ -1,24 +1,59 @@
+import { z } from 'zod'
+import type { D1Database } from '../engine/d1.js'
 import { nullProviders } from '../providers/null.js'
-import { type CmsProviders, ProviderHttpError } from '../providers/types.js'
+import { type CmsProviders, type LlmDispatch, ProviderHttpError } from '../providers/types.js'
+import { canLabelSurveyAnswers } from '../surveys/access.js'
+import {
+	containsPersonalDetails,
+	SURVEY_AUTO_LABEL_BATCH_LIMIT,
+	type SurveyAutoLabelAttemptStore,
+	type SurveyAutoLabelCandidate,
+	scheduleSurveyAutoLabel,
+} from '../surveys/auto-label.js'
 import {
 	SURVEY_ERROR_CODE_HEADER,
 	SURVEY_ERROR_DEFINITIONS,
 	type SurveyErrorCode,
 	surveyErrorBody,
 } from '../surveys/errors.js'
-import { SurveyCsvResultSchema, SurveyIdSchema, SurveyResultsSchema } from '../surveys/schema.js'
-import type { Authz, Capability, RouteContext } from './context.js'
+import {
+	BoundedRecordIdSchema,
+	type SurveyAnswerLabel,
+	SurveyCsvResultSchema,
+	SurveyIdSchema,
+	SurveyQuestionIdSchema,
+	type SurveyResults,
+	SurveyResultsSchema,
+} from '../surveys/schema.js'
+import type { Authz, Capability, CmsUser, RouteContext } from './context.js'
 
 export interface SurveyRouteConfig {
 	authz: Authz
 	providers?: Partial<CmsProviders>
+	/**
+	 * Opt-in automatic labeling of unlabeled written answers (integration
+	 * option `surveys.autoLabel`). The host adapter supplies its LlmDispatch
+	 * and the attempt/backoff store here only when the option is on; absent
+	 * means no dispatch ever runs.
+	 */
+	autoLabel?: { llm: LlmDispatch; attempts: SurveyAutoLabelAttemptStore }
 }
 
 export interface SurveyRouteHandlers {
 	results(ctx: RouteContext): Promise<Response>
 	csv(ctx: RouteContext): Promise<Response>
+	/** Owner-only classification of one written answer (technical/general). */
+	label(ctx: RouteContext): Promise<Response>
 }
 
+const SurveyAnswerLabelRequestSchema = z
+	.object({
+		responseId: BoundedRecordIdSchema,
+		questionId: SurveyQuestionIdSchema,
+		label: z.enum(['technical', 'general']),
+	})
+	.strict()
+
 export function createSurveyRoutes(config: SurveyRouteConfig): SurveyRouteHandlers {
 	const providers: CmsProviders = { ...nullProviders, ...(config.providers ?? {}) }
 
@@ -37,7 +72,23 @@ export function createSurveyRoutes(config: SurveyRouteConfig): SurveyRouteHandle
 				if (!parsed.success || parsed.data.survey.id !== surveyId) {
 					return surveyErrorResponse('survey_provider_malformed')
 				}
-				return responseJson(parsed.data)
+				const caller = await resolveSurveyCaller(config.authz, ctx)
+				// Both roles share one path: any written answer on the page needs
+				// the label index — the owner view decorates with it, the non-owner
+				// view withholds by it, and auto-labeling (when enabled) schedules
+				// against it after the response is built. The unlabeled set is
+				// computed once: the scheduler dispatches (a bounded slice of) it,
+				// and the owner payload counts it.
+				if (!hasWrittenAnswers(parsed.data)) return responseJson(parsed.data)
+				const labels = await loadAnswerLabelsOrFail(ctx.db, surveyId)
+				if (labels instanceof Response) return labels
+				const unlabeled = unlabeledWrittenAnswers(parsed.data, labels)
+				scheduleAutoLabelIfEnabled(ctx, config, surveyId, unlabeled)
+				return responseJson(
+					canLabelSurveyAnswers(caller?.role)
+						? withOwnerLabelCounts(withOwnerLabels(parsed.data, labels), unlabeled)
+						: withholdNonGeneralAnswers(parsed.data, labels),
+				)
 			} catch (error) {
 				return providerFailure(error)
 			}
@@ -53,17 +104,59 @@ export function createSurveyRoutes(config: SurveyRouteConfig): SurveyRouteHandle
 					await providers.surveys?.getCsv({ surveyId }),
 				)
 				if (!parsed.success) return surveyErrorResponse('survey_provider_malformed')
-				return new Response(parsed.data.content, {
-					headers: {
-						'Cache-Control': 'no-store',
-						'Content-Disposition': `attachment; filename="${safeCsvFilename(parsed.data.filename)}"`,
-						'Content-Type': 'text/csv; charset=utf-8',
-					},
-				})
+				const caller = await resolveSurveyCaller(config.authz, ctx)
+				// The owner exports byte-identical provider bytes; every other role
+				// gets text cells redacted before the bytes leave the Worker.
+				if (!canLabelSurveyAnswers(caller?.role)) {
+					const redacted = await redactCsvForNonOwner(providers, ctx, surveyId, parsed.data.content)
+					if (redacted instanceof Response) return redacted
+					return csvResponse({ filename: parsed.data.filename, content: redacted })
+				}
+				return csvResponse(parsed.data)
 			} catch (error) {
 				return providerFailure(error)
 			}
 		},
+
+		async label(ctx) {
+			const denied = await requireSurveyAccess(config.authz, ctx)
+			if (denied) return withNoStoreAuthFailure(denied)
+			const caller = await resolveSurveyCaller(config.authz, ctx)
+			if (!canLabelSurveyAnswers(caller?.role)) return surveyErrorResponse('survey_forbidden')
+			const surveyId = parseSurveyId(ctx)
+			if (!surveyId) return surveyErrorResponse('survey_invalid_request')
+			let body: unknown
+			try {
+				body = await ctx.request.json()
+			} catch {
+				return surveyErrorResponse('survey_invalid_request')
+			}
+			const parsed = SurveyAnswerLabelRequestSchema.safeParse(body)
+			if (!parsed.success) return surveyErrorResponse('survey_invalid_request')
+			try {
+				await ctx.db
+					.prepare(
+						`INSERT INTO survey_answer_labels
+						 (survey_id, response_id, question_id, label, source, labeled_by, labeled_at)
+						 VALUES (?, ?, ?, ?, 'owner', ?, ?)
+						 ON CONFLICT(survey_id, response_id, question_id) DO UPDATE SET
+						 label = excluded.label, source = 'owner',
+						 labeled_by = excluded.labeled_by, labeled_at = excluded.labeled_at`,
+					)
+					.bind(
+						surveyId,
+						parsed.data.responseId,
+						parsed.data.questionId,
+						parsed.data.label,
+						caller?.subject ?? null,
+						Date.now(),
+					)
+					.run()
+			} catch {
+				return surveyErrorResponse('survey_internal_failure')
+			}
+			return responseJson({ surveyId, ...parsed.data })
+		},
 	}
 }
 
@@ -72,6 +165,488 @@ async function requireSurveyAccess(authz: Authz, ctx: RouteContext): Promise<Res
 	return authz.requireRole('view_survey_responses' satisfies Capability, ctx)
 }
 
+/**
+ * The caller's CMS role, resolved server-side from the injected authz seam.
+ * A host that has not wired `getUser` gets null — which every label decision
+ * reads as "not the owner", so an unwired seam withholds rather than leaks.
+ */
+async function resolveSurveyCaller(authz: Authz, ctx: RouteContext): Promise<CmsUser | null> {
+	if (!authz.getUser) return null
+	try {
+		return await authz.getUser(ctx)
+	} catch {
+		return null
+	}
+}
+
+type AnswerLabelIndex = Map<string, { label: SurveyAnswerLabel; source: string }>
+
+function answerLabelKey(responseId: string, questionId: string): string {
+	return `${responseId}\u0000${questionId}`
+}
+
+async function loadAnswerLabels(db: D1Database, surveyId: string): Promise<AnswerLabelIndex> {
+	const result = await db
+		.prepare(
+			'SELECT response_id, question_id, label, source FROM survey_answer_labels WHERE survey_id = ?',
+		)
+		.bind(surveyId)
+		.all<{ response_id: string; question_id: string; label: string; source: string }>()
+	const labels: AnswerLabelIndex = new Map()
+	for (const row of result.results ?? []) {
+		if (row.label === 'technical' || row.label === 'general') {
+			labels.set(answerLabelKey(row.response_id, row.question_id), {
+				label: row.label,
+				source: row.source,
+			})
+		}
+	}
+	return labels
+}
+
+/**
+ * Label-store reads fail loudly (500), never by degrading to an unfiltered
+ * payload: a silent empty read would hand technical comments to non-owners.
+ */
+async function loadAnswerLabelsOrFail(
+	db: D1Database,
+	surveyId: string,
+): Promise<AnswerLabelIndex | Response> {
+	try {
+		return await loadAnswerLabels(db, surveyId)
+	} catch {
+		return surveyErrorResponse('survey_internal_failure')
+	}
+}
+
+type SurveyAnswer = NonNullable<SurveyResults['responses'][number]['answers']>[number]
+
+type QuestionIndex = {
+	textQuestionIds: Set<string>
+	allQuestionIds: Set<string>
+	/** Declared option values per choice question — the only choice values that are not written text. */
+	choiceOptions: Map<string, Set<string>>
+}
+
+function questionIndex(data: SurveyResults): QuestionIndex {
+	const choiceOptions = new Map<string, Set<string>>()
+	for (const question of data.questions) {
+		if (question.kind === 'single_choice' || question.kind === 'multi_choice') {
+			choiceOptions.set(question.id, new Set(question.options))
+		}
+	}
+	return {
+		textQuestionIds: new Set(
+			data.questions.filter((question) => question.kind === 'text').map((question) => question.id),
+		),
+		allQuestionIds: new Set(data.questions.map((question) => question.id)),
+		choiceOptions,
+	}
+}
+
+function emptyQuestionIndex(): QuestionIndex {
+	return { textQuestionIds: new Set(), allQuestionIds: new Set(), choiceOptions: new Map() }
+}
+
+function hasWrittenAnswers(data: SurveyResults): boolean {
+	if (data.freeText.length > 0) return true
+	const questions = questionIndex(data)
+	return data.responses.some((response) =>
+		(response.answers ?? []).some((answer) => isWrittenAnswer(answer, questions)),
+	)
+}
+
+/**
+ * A written (potentially technical) answer: one attached to a text question,
+ * a choice value the question never declared ("Other: …" free text,
+ * sec-review publishing #22), or a string or array answer to a question the
+ * payload no longer knows — a retired text question stays withheld rather
+ * than leaking. Declared choice selections and scale numbers are never
+ * written answers.
+ */
+function isWrittenAnswer(answer: SurveyAnswer, questions: QuestionIndex): boolean {
+	if (questions.textQuestionIds.has(answer.questionId)) return true
+	const options = questions.choiceOptions.get(answer.questionId)
+	if (!options) return typeof answer.value !== 'number'
+	if (typeof answer.value === 'string') return !options.has(answer.value)
+	if (Array.isArray(answer.value)) return answer.value.some((value) => !options.has(value))
+	return false
+}
+
+/**
+ * The non-owner view is an allow-list, not a block-list (operator ruling
+ * 2026-10-02, restated in the packet addendum): only answers labeled 'general'
+ * pass. Technical AND unlabeled answers are withheld — a new comment is
+ * owner-only until it is explicitly labeled general. Declared choice
+ * selections and scale values are not written answers, so they are unaffected;
+ * a free-typed choice value is written text and is withheld.
+ */
+function withholdNonGeneralAnswers(data: SurveyResults, labels: AnswerLabelIndex): SurveyResults {
+	const questions = questionIndex(data)
+	return {
+		...data,
+		freeText: data.freeText.filter(
+			(entry) =>
+				labels.get(answerLabelKey(entry.responseId, entry.questionId))?.label === 'general',
+		),
+		responses: data.responses.map((response) => ({
+			...response,
+			answers: (response.answers ?? []).flatMap((answer) => {
+				const kept = nonOwnerAnswer(answer, response.id, questions, labels)
+				return kept === null ? [] : [kept]
+			}),
+		})),
+	}
+}
+
+/**
+ * One answer as a non-owner may see it, or null to withhold it: 'general'
+ * passes untouched; a wholly written answer is withheld; a multi-choice that
+ * mixes declared selections with free-typed values keeps only the declared
+ * ones, so a declared selection never carries its sibling "Other: …" out.
+ */
+function nonOwnerAnswer(
+	answer: SurveyAnswer,
+	responseId: string,
+	questions: QuestionIndex,
+	labels: AnswerLabelIndex,
+): SurveyAnswer | null {
+	if (labels.get(answerLabelKey(responseId, answer.questionId))?.label === 'general') return answer
+	if (questions.textQuestionIds.has(answer.questionId)) return null
+	const options = questions.choiceOptions.get(answer.questionId)
+	if (!options) {
+		// A question the payload no longer knows: strings and arrays stay
+		// withheld (fail closed); numbers pass as scale-like.
+		return typeof answer.value === 'number' ? answer : null
+	}
+	if (typeof answer.value === 'string') return options.has(answer.value) ? answer : null
+	if (Array.isArray(answer.value)) {
+		const declared = answer.value.filter((value) => options.has(value))
+		if (declared.length === answer.value.length) return answer
+		return declared.length > 0 ? { ...answer, value: declared } : null
+	}
+	return answer
+}
+
+/**
+ * The owner sees everything, with each written answer's current label and its
+ * provenance (`labelSource`: who labeled it, so the screen can badge the
+ * automatic ones). Non-owner payloads are never decorated — they pass through
+ * withholdNonGeneralAnswers untouched.
+ */
+function withOwnerLabels(data: SurveyResults, labels: AnswerLabelIndex): SurveyResults {
+	return {
+		...data,
+		freeText: data.freeText.map((entry) => {
+			const row = labels.get(answerLabelKey(entry.responseId, entry.questionId))
+			if (row === undefined) return entry
+			const labelSource = isAnswerLabelSource(row.source) ? row.source : undefined
+			return labelSource === undefined
+				? { ...entry, label: row.label }
+				: { ...entry, label: row.label, labelSource }
+		}),
+	}
+}
+
+function isAnswerLabelSource(value: string): value is 'owner' | 'auto' | 'import' {
+	return value === 'owner' || value === 'auto' || value === 'import'
+}
+
+/**
+ * The owner payload also says how many written answers on this page are still
+ * unlabeled — the whole team-hidden set, plus the subset the personal-details
+ * pre-filter will never dispatch (owner labels those by hand). Attached only
+ * when non-zero; non-owner payloads are never decorated.
+ */
+function withOwnerLabelCounts(
+	data: SurveyResults,
+	unlabeled: SurveyAutoLabelCandidate[],
+): SurveyResults {
+	const personalDetails = unlabeled.filter((candidate) =>
+		containsPersonalDetails(candidate.answerText),
+	).length
+	return {
+		...data,
+		...(unlabeled.length > 0 ? { unlabeledCount: unlabeled.length } : {}),
+		...(personalDetails > 0 ? { personalDetailsCount: personalDetails } : {}),
+	}
+}
+
+/**
+ * Hand the current page's unlabeled written answers to the background
+ * labeler (surveys.autoLabel). A no-op unless the option is on, the host
+ * wired LlmDispatch and the attempt store, and the request carries a
+ * waitUntil seam; scheduling is synchronous, so the results response is
+ * already on its way.
+ */
+function scheduleAutoLabelIfEnabled(
+	ctx: RouteContext,
+	config: SurveyRouteConfig,
+	surveyId: string,
+	unlabeled: SurveyAutoLabelCandidate[],
+): void {
+	if (!config.autoLabel?.llm || !ctx.waitUntil) return
+	const batch = unlabeled.slice(0, SURVEY_AUTO_LABEL_BATCH_LIMIT)
+	if (batch.length === 0) return
+	scheduleSurveyAutoLabel(
+		{
+			surveyId,
+			db: ctx.db,
+			llm: config.autoLabel.llm,
+			attempts: config.autoLabel.attempts,
+			waitUntil: ctx.waitUntil,
+		},
+		batch,
+	)
+}
+
+/**
+ * Every unlabeled written answer on the current page, in payload order
+ * (freeText first, then free-typed choice values inside responses).
+ * Already-labeled answers — owner or import — are never returned; the auto
+ * INSERT's ON CONFLICT DO NOTHING is the second guard when the in-memory
+ * index is stale. The scheduler caps its dispatch slice at
+ * SURVEY_AUTO_LABEL_BATCH_LIMIT; the owner's unlabeledCount uses the full set.
+ */
+function unlabeledWrittenAnswers(
+	data: SurveyResults,
+	labels: AnswerLabelIndex,
+): SurveyAutoLabelCandidate[] {
+	if (data.freeText.length === 0 && data.responses.length === 0) return []
+	const questions = questionIndex(data)
+	const promptById = new Map(data.questions.map((question) => [question.id, question.prompt]))
+	const candidates: SurveyAutoLabelCandidate[] = []
+	const seen = new Set<string>()
+	const consider = (responseId: string, questionId: string, answerText: string) => {
+		const key = answerLabelKey(responseId, questionId)
+		if (seen.has(key) || labels.has(key)) return
+		seen.add(key)
+		candidates.push({
+			responseId,
+			questionId,
+			questionPrompt: promptById.get(questionId) ?? '',
+			answerText,
+		})
+	}
+	for (const entry of data.freeText) {
+		consider(entry.responseId, entry.questionId, entry.value)
+	}
+	for (const response of data.responses) {
+		for (const answer of response.answers ?? []) {
+			if (!isWrittenAnswer(answer, questions)) continue
+			if (typeof answer.value === 'string') {
+				consider(response.id, answer.questionId, answer.value)
+			} else if (Array.isArray(answer.value)) {
+				// A multi-choice mixing declared selections with free-typed values:
+				// only the free-typed part is written text.
+				const options = questions.choiceOptions.get(answer.questionId)
+				const written = answer.value.filter((value) => !options?.has(value))
+				if (written.length > 0) {
+					consider(response.id, answer.questionId, written.join(' '))
+				}
+			}
+		}
+	}
+	return candidates
+}
+
+/**
+ * Redacts the CSV for a non-owner: every cell that holds written text (a text
+ * answer, an unknown question's answer, or a choice value the question never
+ * declared) is blanked or reduced to its declared selections unless labeled
+ * 'general', and every cell beyond the header width is dropped — an overlong
+ * row is an unknown shape whose extras never pass through (sec-review
+ * publishing #22). Returns the redacted CSV text, or a Response when the shape
+ * is unrecognised (loud 500 — passing provider bytes through unrecognised
+ * would leak them) or a dependency failed. Byte-identical passthrough when
+ * nothing needs changing.
+ */
+async function redactCsvForNonOwner(
+	providers: CmsProviders,
+	ctx: RouteContext,
+	surveyId: string,
+	content: string,
+): Promise<string | Response> {
+	const rows = parseCsvRows(content)
+	if (!rows || rows.length === 0) return surveyErrorResponse('survey_internal_failure')
+	const header = rows[0]
+	const answerColumns = header.reduce<number[]>((columns, column, index) => {
+		if (column.startsWith('answer:')) columns.push(index)
+		return columns
+	}, [])
+	const overlong = rows.some((row) => row.length > header.length)
+	if (answerColumns.length === 0 && !overlong) return content
+
+	// Which cells can hold written text: the question kinds come from the
+	// provider's own results payload. A column whose question is unknown is
+	// treated as text — an answer that cannot be proven non-text is withheld
+	// when it cannot be proven 'general'.
+	let questions = emptyQuestionIndex()
+	if (answerColumns.length > 0) {
+		try {
+			const results = SurveyResultsSchema.safeParse(
+				await providers.surveys?.getResults({ surveyId, offset: 0 }),
+			)
+			if (!results.success || results.data.survey.id !== surveyId) {
+				return surveyErrorResponse('survey_provider_malformed')
+			}
+			questions = questionIndex(results.data)
+		} catch (error) {
+			return providerFailure(error)
+		}
+	}
+
+	let labels: AnswerLabelIndex = new Map()
+	if (answerColumns.length > 0) {
+		const loaded = await loadAnswerLabelsOrFail(ctx.db, surveyId)
+		if (loaded instanceof Response) return loaded
+		labels = loaded
+	}
+
+	const responseIdIndex = header.indexOf('response_id')
+	let blanked = 0
+	for (const row of rows.slice(1)) {
+		if (row.length > header.length) row.length = header.length
+		const responseId = responseIdIndex >= 0 ? row[responseIdIndex] : null
+		for (const column of answerColumns) {
+			const questionId = header[column].slice('answer:'.length)
+			if (
+				responseId !== null &&
+				responseId !== '' &&
+				labels.get(answerLabelKey(responseId, questionId))?.label === 'general'
+			) {
+				continue
+			}
+			const cell = row[column] ?? ''
+			if (cell === '' || !cellIsWritten(cell, questionId, questions)) continue
+			row[column] = declaredSelections(cell, questions.choiceOptions.get(questionId))
+			blanked += 1
+		}
+	}
+	if (blanked === 0 && !overlong) return content
+	const terminator = content.includes('\r\n') ? '\r\n' : '\n'
+	return `${rows.map((row) => row.map(csvField).join(',')).join(terminator)}${terminator}`
+}
+
+/** A CSV answer cell holds written text unless it is a declared choice selection. */
+function cellIsWritten(cell: string, questionId: string, questions: QuestionIndex): boolean {
+	if (questions.textQuestionIds.has(questionId) || !questions.allQuestionIds.has(questionId)) {
+		return true
+	}
+	const options = questions.choiceOptions.get(questionId)
+	// A scale cell is an integer or empty; anything else is written text (the
+	// JSON path withholds a non-integer scale value the same way).
+	if (!options) return cell.trim() !== '' && !/^-?\d+$/.test(cell.trim())
+	if (options.has(cell)) return false
+	// A multi-choice cell serializes its selections comma-separated; the cell
+	// is written text unless every selection is a declared option.
+	return !cell.split(',').every((token) => options.has(token.trim()))
+}
+
+/** Only the declared selections of a choice cell (or '' when none or not a choice). */
+function declaredSelections(cell: string, options: Set<string> | undefined): string {
+	if (!options) return ''
+	return cell
+		.split(',')
+		.filter((token) => options.has(token.trim()))
+		.map((token) => token.trim())
+		.join(', ')
+}
+
+/**
+ * Full RFC4180 row parse (quoted fields, escaped quotes, newlines inside
+ * quotes, CRLF or LF terminators). Null when the shape is unrecognised —
+ * an unclosed quote or junk after a closing quote. Blank lines are skipped.
+ */
+function parseCsvRows(content: string): string[][] | null {
+	const source = content.startsWith('\uFEFF') ? content.slice(1) : content
+	const rows: string[][] = []
+	let row: string[] = []
+	let field = ''
+	let inQuotes = false
+	let closedQuote = false
+	let atFieldStart = true
+
+	const endField = () => {
+		row.push(field)
+		field = ''
+		closedQuote = false
+		atFieldStart = true
+	}
+	const endRow = () => {
+		if (row.length > 0 || field !== '') rows.push([...row, field])
+		row = []
+		field = ''
+		closedQuote = false
+		atFieldStart = true
+	}
+
+	for (let index = 0; index < source.length; index += 1) {
+		const char = source[index]
+		if (inQuotes) {
+			if (char !== '"') {
+				field += char
+				continue
+			}
+			if (source[index + 1] === '"') {
+				field += '"'
+				index += 1
+				continue
+			}
+			inQuotes = false
+			closedQuote = true
+			continue
+		}
+		if (closedQuote) {
+			if (char === ',') {
+				endField()
+				continue
+			}
+			if (char === '\n' || char === '\r') {
+				endRow()
+				if (char === '\r' && source[index + 1] === '\n') index += 1
+				continue
+			}
+			return null
+		}
+		if (atFieldStart && char === '"') {
+			inQuotes = true
+			atFieldStart = false
+			continue
+		}
+		if (char === '"') return null
+		if (char === ',') {
+			endField()
+			continue
+		}
+		if (char === '\n' || char === '\r') {
+			if (field === '' && row.length === 0) continue // blank line
+			endRow()
+			if (char === '\r' && source[index + 1] === '\n') index += 1
+			continue
+		}
+		field += char
+		atFieldStart = false
+	}
+	if (inQuotes) return null
+	if (field !== '' || row.length > 0) rows.push([...row, field])
+	return rows
+}
+
+function csvField(value: string): string {
+	return /[",\r\n]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value
+}
+
+function csvResponse(data: { filename: string; content: string }): Response {
+	return new Response(data.content, {
+		headers: {
+			'Cache-Control': 'no-store',
+			'Content-Disposition': `attachment; filename="${safeCsvFilename(data.filename)}"`,
+			'Content-Type': 'text/csv; charset=utf-8',
+		},
+	})
+}
+
 function parseOffset(ctx: RouteContext): number | null {
 	const raw = new URL(ctx.request.url).searchParams.get('offset')
 	if (raw === null) return 0
@@ -94,7 +669,7 @@ function safeCsvFilename(value: string): string {
 	const safe = basename
 		.replace(/[^A-Za-z0-9._-]+/g, '-')
 		.replace(/^\.+/, '')
-		.replace(/-+/g, '-')
+		.replace('-+', '-')
 		.slice(0, 180)
 	return safe.endsWith('.csv') ? safe : `${safe || 'survey-responses'}.csv`
 }

package/src/schema/migrations.ts

@@ -921,6 +921,21 @@ ALTER TABLE content_insight_runs ADD COLUMN publication_run_id TEXT;
 ALTER TABLE content_insight_runs ADD COLUMN payload_sha256 TEXT;
 	`,
 	},
+	{
+		id: '0033_survey_answer_labels',
+		sql: `
+CREATE TABLE survey_answer_labels (
+  survey_id TEXT NOT NULL,
+  response_id TEXT NOT NULL,
+  question_id TEXT NOT NULL,
+  label TEXT NOT NULL CHECK (label IN ('technical','general')),
+  source TEXT NOT NULL CHECK (source IN ('owner','auto','import')),
+  labeled_by TEXT,
+  labeled_at INTEGER NOT NULL,
+  PRIMARY KEY (survey_id, response_id, question_id)
+);
+	`,
+	},
 ]
 
 /**