@marktiderman/genesis-forms 0.1.1 → 0.2.0

package/README.md

@@ -45,15 +45,19 @@ const version = afterClass.hash();         // content fingerprint for publishing
   `eq`, `in` and `contains` and passes `neq`: `eq null` is never true for a cleared field.
 - **Hidden inputs are typed and sourced.** `url` and `host` inputs are untrusted; `server` inputs are
   never read from the client. `coerceHidden(definition, raw)` types them, in `createForm` and on the
-  server alike: only string, number and boolean primitives, `""` is not a number, strings at most
-  1000 characters.
+  server alike: only string, number and boolean primitives, a number string must be a plain decimal
+  (`"12"`, `"-2.5"`; not `""`, `" 12 "` or `"0x1A"`), strings at most 1000 characters.
+- **Empty answers are not stored.** `engine.answers()` and the server leave out blank text, `""` and
+  empty lists; a required field with one still fails as unanswered.
 - **Everything is in the event log.** `initialValues` are logged as leading `answer` events with
   `source: "prefill"`, so `replay` and the server see them.
 - **Anonymous forms withhold identifying fields.** `settings.anonymous` is a per-form admin
   setting, off by default. When it is true, fields marked `identifying: true` are treated as hidden
   (off the path, not validated, cleared on submit), the server drops client-sent values for them and
-  lists them in `ignored`, and events carry no `at` timestamps whatever clock is passed. Fields not
-  marked `identifying` are unaffected.
+  lists them in `ignored`, and events carry no `at` timestamps whatever clock is passed. Hidden
+  inputs marked `identifying: true` (`f.hidden.string({ source: "server", identifying: true })`) are
+  left out of the stored `hidden` and `context`; logic still reads them. Fields not marked
+  `identifying` are unaffected.
 - **Definitions are checked.** `defineForm` runs `parseForm` and throws with every issue;
   `validateSubmission` refuses a definition that does not parse. Ids, keys, hidden names and ending
   ids may not be `Object.prototype` names (`constructor`, `__proto__`…).

package/dist/{engine-LsPRTzt3.d.cts → engine-Bj8-mMVb.d.cts}

@@ -1,4 +1,4 @@
-import { f as FormEvent, J as Json, e as FieldValidator, a as FormDefinition, F as FieldBlock, B as Block } from './validate-j8Z188mF.cjs';
+import { f as FormEvent, J as Json, e as FieldValidator, a as FormDefinition, F as FieldBlock, B as Block } from './validate-BbackAjB.cjs';
 
 /** Guards and helpers for event logs and other untrusted JSON. No dependencies. */
 
@@ -36,12 +36,12 @@ interface FormState {
 }
 interface CreateFormOptions {
     /** Prefilled answers by field id. Logged as leading `answer` events with `source: "prefill"`. */
-    initialValues?: Record<string, Json>;
+    initialValues?: Record<string, Json> | undefined;
     /** Hidden inputs by name. Declared ones are typed with `coerceHidden`, as the server types them. */
-    hidden?: Record<string, Json | undefined>;
-    validators?: Record<string, FieldValidator>;
+    hidden?: Record<string, Json | undefined> | undefined;
+    validators?: Record<string, FieldValidator> | undefined;
     /** Timestamps on events. Pass `() => undefined` to record none (anonymous forms). */
-    clock?: () => number | undefined;
+    clock?: (() => number | undefined) | undefined;
 }
 interface FormEngine {
     readonly definition: FormDefinition;
@@ -65,7 +65,7 @@ interface FormEngine {
     submit(): boolean;
     /** Text with `{{recall}}` tokens resolved. */
     text(template: string): string;
-    /** Visible field values only, keyed by id: what a submit stores. */
+    /** Visible, non-empty field values only, keyed by id: what a submit stores. */
     answers(): Record<string, Json>;
 }
 declare function createForm(definition: FormDefinition, options?: CreateFormOptions): FormEngine;

package/dist/{engine-Cp5t2_Am.d.ts → engine-Coc-gQIB.d.ts}

@@ -1,4 +1,4 @@
-import { f as FormEvent, J as Json, e as FieldValidator, a as FormDefinition, F as FieldBlock, B as Block } from './validate-j8Z188mF.js';
+import { f as FormEvent, J as Json, e as FieldValidator, a as FormDefinition, F as FieldBlock, B as Block } from './validate-BbackAjB.js';
 
 /** Guards and helpers for event logs and other untrusted JSON. No dependencies. */
 
@@ -36,12 +36,12 @@ interface FormState {
 }
 interface CreateFormOptions {
     /** Prefilled answers by field id. Logged as leading `answer` events with `source: "prefill"`. */
-    initialValues?: Record<string, Json>;
+    initialValues?: Record<string, Json> | undefined;
     /** Hidden inputs by name. Declared ones are typed with `coerceHidden`, as the server types them. */
-    hidden?: Record<string, Json | undefined>;
-    validators?: Record<string, FieldValidator>;
+    hidden?: Record<string, Json | undefined> | undefined;
+    validators?: Record<string, FieldValidator> | undefined;
     /** Timestamps on events. Pass `() => undefined` to record none (anonymous forms). */
-    clock?: () => number | undefined;
+    clock?: (() => number | undefined) | undefined;
 }
 interface FormEngine {
     readonly definition: FormDefinition;
@@ -65,7 +65,7 @@ interface FormEngine {
     submit(): boolean;
     /** Text with `{{recall}}` tokens resolved. */
     text(template: string): string;
-    /** Visible field values only, keyed by id: what a submit stores. */
+    /** Visible, non-empty field values only, keyed by id: what a submit stores. */
     answers(): Record<string, Json>;
 }
 declare function createForm(definition: FormDefinition, options?: CreateFormOptions): FormEngine;

package/dist/index.cjs

@@ -399,7 +399,30 @@ function recallRefs(text) {
 }
 
 // src/parse.ts
+function shown(v) {
+  let text;
+  try {
+    text = JSON.stringify(v);
+  } catch {
+    text = void 0;
+  }
+  text ??= typeof v === "bigint" ? `${v}n` : typeof v;
+  return text.length > 60 ? `${text.slice(0, 57)}...` : text;
+}
 var isObject = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isInt = (v) => typeof v === "number" && Number.isInteger(v);
+var LITERAL_TYPE = {
+  "short-text": "string",
+  "long-text": "string",
+  email: "string",
+  phone: "string",
+  rating: "number",
+  nps: "number",
+  "single-choice": "string",
+  "multi-choice": "string",
+  "yes-no": "boolean"
+};
+var ORDERING = /* @__PURE__ */ new Set(["lt", "lte", "gt", "gte"]);
 var OPERATORS = /* @__PURE__ */ new Set([
   "eq",
   "neq",
@@ -472,6 +495,7 @@ function parseForm(input) {
   const keys = /* @__PURE__ */ new Map();
   const fieldTypes = /* @__PURE__ */ new Map();
   const order = /* @__PURE__ */ new Map();
+  const choices = /* @__PURE__ */ new Map();
   input.blocks.forEach((block, i) => {
     const path = `blocks[${i}]`;
     if (!isObject(block) || typeof block.id !== "string" || !block.id) {
@@ -505,8 +529,19 @@ function parseForm(input) {
               if (!isObject(o) || typeof o.value !== "string") issue(at, "Each option needs a string value.");
               else optionalText(o.label, `${at}.label`);
             });
+            choices.set(
+              block.id,
+              new Set(options.flatMap((o) => isObject(o) && typeof o.value === "string" ? [o.value] : []))
+            );
           }
         }
+        const { max, maxLength: maxLength2 } = isObject(block.props) ? block.props : {};
+        if (block.type === "rating" && max !== void 0 && !(isInt(max) && max >= 2 && max <= 10)) {
+          issue(`${path}.props.max`, "Must be a whole number from 2 to 10.");
+        }
+        if (maxLength2 !== void 0 && !(isInt(maxLength2) && maxLength2 > 0)) {
+          issue(`${path}.props.maxLength`, "Must be a whole number above 0.");
+        }
       }
       if (validKey) {
         if (keys.has(block.key)) issue(`${path}.key`, `Duplicate key "${String(block.key)}".`);
@@ -523,6 +558,7 @@ function parseForm(input) {
     }
   });
   const hiddenNames = /* @__PURE__ */ new Set();
+  const hiddenTypes = /* @__PURE__ */ new Map();
   if (input.hidden !== void 0 && !Array.isArray(input.hidden)) issue("hidden", "Must be an array.");
   (Array.isArray(input.hidden) ? input.hidden : []).forEach((h, i) => {
     if (!isObject(h) || typeof h.name !== "string" || !h.name) {
@@ -538,7 +574,9 @@ function parseForm(input) {
       issue(`hidden[${i}].type`, "Must be string, number or boolean.");
     }
     optionalBoolean(h.sensitive, `hidden[${i}].sensitive`);
+    optionalBoolean(h.identifying, `hidden[${i}].identifying`);
     hiddenNames.add(h.name);
+    if (typeof h.type === "string") hiddenTypes.set(h.name, h.type);
   });
   const endingIds = /* @__PURE__ */ new Set();
   if (input.endings !== void 0 && !Array.isArray(input.endings)) issue("endings", "Must be an array.");
@@ -587,8 +625,45 @@ function parseForm(input) {
     if (typeof c.left.field === "string") {
       const manifest = getFieldType(fieldTypes.get(c.left.field) ?? "");
       if (manifest && OPERATORS.has(c.op) && !manifest.operators.includes(c.op)) {
-        issue(`${path}.op`, `"${c.op}" does not apply to a ${manifest.type} field.`);
+        return issue(`${path}.op`, `"${c.op}" does not apply to a ${manifest.type} field.`);
+      }
+    }
+    checkLiterals(c.op, c.left, c.right, path);
+  };
+  const checkLiterals = (op, left, right, path) => {
+    if (op === "answered" || op === "empty" || !OPERATORS.has(op)) return;
+    const literal = isObject(right) && "value" in right;
+    if (right !== void 0 && !literal) return;
+    let what = "the left side";
+    let type;
+    let options;
+    if (typeof left.field === "string" && fieldTypes.has(left.field)) {
+      const fieldType = fieldTypes.get(left.field);
+      what = `"${keyOf(left.field)}"`;
+      type = LITERAL_TYPE[fieldType];
+      if (fieldType === "single-choice" || fieldType === "multi-choice") options = choices.get(left.field);
+    } else if (typeof left.hidden === "string" && hiddenTypes.has(left.hidden)) {
+      what = `hidden input "${left.hidden}"`;
+      type = hiddenTypes.get(left.hidden);
+    }
+    const outcome = op === "neq" ? "always true" : "never true";
+    let values;
+    if (op === "in") {
+      if (!literal || !Array.isArray(right.value)) {
+        return void warnings.push({ path: `${path}.right`, message: "`in` needs a list of values; it never matches." });
+      }
+      values = right.value;
+    } else if (!literal) return;
+    else values = [right.value];
+    if (ORDERING.has(op)) {
+      if (type !== void 0 && type !== "number") {
+        return void warnings.push({ path: `${path}.op`, message: `"${op}" compares numbers, but ${what} holds a ${type}; it is never true.` });
       }
+      type = "number";
+    }
+    for (const v of values) {
+      const message = type !== void 0 && typeof v !== type ? `${what} holds a ${type}, but ${shown(v)} is not one; this comparison is ${outcome}.` : options && typeof v === "string" && !options.has(v) ? `${shown(v)} is not an option of ${what}; this comparison is ${outcome}.` : null;
+      if (message) warnings.push({ path: `${path}.right`, message });
     }
   };
   const keyOf = (id) => [...keys].find(([, v]) => v === id)?.[0] ?? id;
@@ -665,6 +740,18 @@ function parseForm(input) {
       }
     }
   });
+  const extra = [["description", input.description]];
+  (Array.isArray(input.endings) ? input.endings : []).forEach((e, i) => {
+    if (isObject(e)) extra.push([`endings[${i}]`, e.title], [`endings[${i}]`, e.description]);
+  });
+  for (const [path, t] of extra) {
+    if (typeof t !== "string") continue;
+    for (const ref of recallRefs(t)) {
+      if (ref.kind === "hidden" ? !hiddenNames.has(ref.name) : !keys.has(ref.name)) {
+        warnings.push({ path, message: `Recalls unknown ${ref.kind === "hidden" ? "hidden input" : "field"} "${ref.name}"; it shows its fallback text.` });
+      }
+    }
+  }
   return issues.length ? fail() : { ok: true, form: input, warnings };
 }
 
@@ -691,7 +778,8 @@ var choiceProps = (options) => ({
 var hiddenSpec = (type, o) => ({
   type,
   source: o.source ?? "url",
-  ...o.sensitive ? { sensitive: true } : {}
+  ...o.sensitive ? { sensitive: true } : {},
+  ...o.identifying ? { identifying: true } : {}
 });
 var f = {
   shortText: (key, o) => field("short-text", key, o, o.maxLength ? { maxLength: o.maxLength } : void 0),
@@ -786,7 +874,8 @@ function defineForm(input) {
       name,
       type: spec.type,
       source: spec.source,
-      ...spec.sensitive ? { sensitive: true } : {}
+      ...spec.sensitive ? { sensitive: true } : {},
+      ...spec.identifying ? { identifying: true } : {}
     }));
   }
   if (input.logic?.length) definition.logic = input.logic.map((rule, i) => rule.build(resolve2, `r${i + 1}`));
@@ -811,6 +900,7 @@ ${list}`);
 
 // src/hidden.ts
 var MAX_HIDDEN_STRING_LENGTH = 1e3;
+var DECIMAL = /^-?\d+(\.\d+)?$/;
 function coerceHiddenValue(value, type) {
   if (typeof value === "string" && value.length > MAX_HIDDEN_STRING_LENGTH) return void 0;
   if (type === "string") {
@@ -820,7 +910,7 @@ function coerceHiddenValue(value, type) {
   }
   if (type === "number") {
     if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-    if (typeof value !== "string" || value.trim() === "") return void 0;
+    if (typeof value !== "string" || !DECIMAL.test(value)) return void 0;
     const n = Number(value);
     return Number.isFinite(n) ? n : void 0;
   }
@@ -1001,7 +1091,7 @@ function build(definition, options, replaying = false) {
       for (const id of state.path) {
         const field2 = fields.get(id);
         const value = own(state.values, id);
-        if (field2 && value !== void 0) out[id] = normalizeValue(value, field2);
+        if (field2 && !isEmptyValue(value, field2)) out[id] = normalizeValue(value, field2);
       }
       return out;
     }