@marktiderman/genesis-forms 0.4.1 → 0.4.2

package/dist/server.d.cts

@@ -15,8 +15,26 @@ interface SubmissionOptions {
     /** `false` checks a draft: formats only, nothing required. Default true. */
     complete?: boolean | undefined;
     validators?: Record<string, FieldValidator> | undefined;
-    /** Most events accepted, counted after `compactEvents`. Default 10 000. */
+    /**
+     * Most events accepted, counted after `compactEvents`. Default `MAX_EVENTS`
+     * (10,000). At most `RAW_EVENTS_PER_EVENT` (10) times as many may be sent.
+     */
     maxEvents?: number | undefined;
+    /**
+     * Most JSON values in the answers, answer events and hidden inputs
+     * together (each number, text, true / false, list item, row and cell
+     * counts one; a run of answers to one field, as typing in a table sends,
+     * counts its last only). Default `MAX_SUBMISSION_VALUES` (200,000).
+     */
+    maxValues?: number | undefined;
+    /**
+     * Most work replaying the events may take: one unit per block each time
+     * the path is walked, one per calculated field each time the answers
+     * settle, and a formula's size (its numbers, answers and operators) each
+     * time it is worked out. Default `MAX_REPLAY_WORK` (1,000,000). Only the
+     * replay counts: the submit that follows it does not.
+     */
+    maxReplayWork?: number | undefined;
 }
 interface CheckedSubmission {
     status: "draft" | "completed";
@@ -43,6 +61,15 @@ type SubmissionResult = {
 };
 /** Default for `SubmissionOptions.maxEvents`. */
 declare const MAX_EVENTS = 10000;
+/** Default for `SubmissionOptions.maxValues`. */
+declare const MAX_SUBMISSION_VALUES = 200000;
+/** Default for `SubmissionOptions.maxReplayWork`. */
+declare const MAX_REPLAY_WORK = 1000000;
+/**
+ * Most events sent, before compaction, as a multiple of `maxEvents`: a
+ * keystroke log compacts to far fewer, but every event sent is looked at.
+ */
+declare const RAW_EVENTS_PER_EVENT = 10;
 /**
  * Check a submission against the published definition. Never throws on a
  * malformed submission: it returns `{ ok: false, errors: { "": … } }`.
@@ -54,4 +81,4 @@ declare function validateSubmission(definition: FormDefinition, submission: Subm
  */
 declare function publicDefinition(definition: FormDefinition): FormDefinition;
 
-export { type CheckedSubmission, MAX_EVENTS, type SubmissionInput, type SubmissionOptions, type SubmissionResult, publicDefinition, validateSubmission };
+export { type CheckedSubmission, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, RAW_EVENTS_PER_EVENT, type SubmissionInput, type SubmissionOptions, type SubmissionResult, publicDefinition, validateSubmission };

package/dist/server.d.ts

@@ -15,8 +15,26 @@ interface SubmissionOptions {
     /** `false` checks a draft: formats only, nothing required. Default true. */
     complete?: boolean | undefined;
     validators?: Record<string, FieldValidator> | undefined;
-    /** Most events accepted, counted after `compactEvents`. Default 10 000. */
+    /**
+     * Most events accepted, counted after `compactEvents`. Default `MAX_EVENTS`
+     * (10,000). At most `RAW_EVENTS_PER_EVENT` (10) times as many may be sent.
+     */
     maxEvents?: number | undefined;
+    /**
+     * Most JSON values in the answers, answer events and hidden inputs
+     * together (each number, text, true / false, list item, row and cell
+     * counts one; a run of answers to one field, as typing in a table sends,
+     * counts its last only). Default `MAX_SUBMISSION_VALUES` (200,000).
+     */
+    maxValues?: number | undefined;
+    /**
+     * Most work replaying the events may take: one unit per block each time
+     * the path is walked, one per calculated field each time the answers
+     * settle, and a formula's size (its numbers, answers and operators) each
+     * time it is worked out. Default `MAX_REPLAY_WORK` (1,000,000). Only the
+     * replay counts: the submit that follows it does not.
+     */
+    maxReplayWork?: number | undefined;
 }
 interface CheckedSubmission {
     status: "draft" | "completed";
@@ -43,6 +61,15 @@ type SubmissionResult = {
 };
 /** Default for `SubmissionOptions.maxEvents`. */
 declare const MAX_EVENTS = 10000;
+/** Default for `SubmissionOptions.maxValues`. */
+declare const MAX_SUBMISSION_VALUES = 200000;
+/** Default for `SubmissionOptions.maxReplayWork`. */
+declare const MAX_REPLAY_WORK = 1000000;
+/**
+ * Most events sent, before compaction, as a multiple of `maxEvents`: a
+ * keystroke log compacts to far fewer, but every event sent is looked at.
+ */
+declare const RAW_EVENTS_PER_EVENT = 10;
 /**
  * Check a submission against the published definition. Never throws on a
  * malformed submission: it returns `{ ok: false, errors: { "": … } }`.
@@ -54,4 +81,4 @@ declare function validateSubmission(definition: FormDefinition, submission: Subm
  */
 declare function publicDefinition(definition: FormDefinition): FormDefinition;
 
-export { type CheckedSubmission, MAX_EVENTS, type SubmissionInput, type SubmissionOptions, type SubmissionResult, publicDefinition, validateSubmission };
+export { type CheckedSubmission, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, RAW_EVENTS_PER_EVENT, type SubmissionInput, type SubmissionOptions, type SubmissionResult, publicDefinition, validateSubmission };

package/dist/server.js

@@ -352,8 +352,7 @@ var round = (n, decimals) => {
   const r = Number(n.toFixed(decimals));
   return Object.is(r, -0) ? 0 : r;
 };
-function calculatedValue(result, field) {
-  const { format, decimals } = calculatedProps(field);
+function valueAs(result, { format, decimals }) {
   if (result === null || Array.isArray(result)) return void 0;
   if (format === "number" || format === "percent") {
     const n = formulaNumber(result);
@@ -380,19 +379,6 @@ var extract = (value, column) => column !== void 0 ? value.flatMap((row) => {
   const cell = row[column];
   return typeof cell === "string" || typeof cell === "number" ? [cell] : [];
 }) : value.flatMap((v) => typeof v === "string" || typeof v === "number" || typeof v === "boolean" ? [v] : []);
-var extracted = /* @__PURE__ */ new WeakMap();
-function cachedList(value, column) {
-  let byColumn = extracted.get(value);
-  if (!byColumn) extracted.set(value, byColumn = /* @__PURE__ */ new Map());
-  const key = column ?? "";
-  let list = byColumn.get(key);
-  if (!list) byColumn.set(key, list = ownFormulaList(extract(value, column)));
-  return list;
-}
-function readAnswer(value, column) {
-  if (Array.isArray(value)) return cachedList(value, column);
-  return column !== void 0 ? null : formulaInput(value);
-}
 function formulaInput(value, column) {
   if (value === void 0 || value === null) return null;
   if (Array.isArray(value) && value.length > MAX_FORMULA_ITEMS) return null;
@@ -407,9 +393,28 @@ function refNodes(node, out = []) {
   else if (node.kind === "call") for (const a of node.args) refNodes(a, out);
   return out;
 }
+function formulaSize(node) {
+  if (node.kind === "unary") return 1 + formulaSize(node.arg);
+  if (node.kind === "binary") return 1 + formulaSize(node.left) + formulaSize(node.right);
+  if (node.kind === "if") return 1 + formulaSize(node.test) + formulaSize(node.then) + formulaSize(node.else);
+  if (node.kind === "call") return node.args.reduce((n, a) => n + formulaSize(a), 1);
+  return 1;
+}
+var ReplayWorkExceeded = class extends Error {
+  constructor(limit) {
+    super(`Replaying the response would take more than ${limit} steps of work.`);
+    this.limit = limit;
+  }
+  limit;
+};
+function spend(budget, amount) {
+  if (!budget) return;
+  budget.used += amount;
+  if (budget.used > budget.max) throw new ReplayWorkExceeded(budget.max);
+}
 var UNREAD = /* @__PURE__ */ Symbol("unread");
 var OVER = /* @__PURE__ */ Symbol("over");
-function calculator(definition) {
+function calculator(definition, work) {
   const compiled = [];
   const idByKey = /* @__PURE__ */ new Map();
   for (const block of definition.blocks) {
@@ -418,7 +423,8 @@ function calculator(definition) {
   }
   for (const block of definition.blocks) {
     if (block.kind !== "field" || !isCalculated(block)) continue;
-    const parsed = parseFormula(calculatedProps(block).formula);
+    const props = calculatedProps(block);
+    const parsed = parseFormula(props.formula);
     const reads = [];
     const slots = /* @__PURE__ */ new Map();
     const byKey = /* @__PURE__ */ new Map();
@@ -432,33 +438,65 @@ function calculator(definition) {
       }
       slots.set(ref, slot);
     }
-    compiled.push({ field: block, ast: parsed.ok ? parsed.ast : null, reads, slots, last: null });
+    compiled.push({ field: block, props, ast: parsed.ok ? parsed.ast : null, size: parsed.ok ? formulaSize(parsed.ast) : 0, reads, slots, last: null });
   }
+  const extracted = /* @__PURE__ */ new WeakMap();
+  const cachedList = (value, column) => {
+    let byColumn = extracted.get(value);
+    if (!byColumn) extracted.set(value, byColumn = /* @__PURE__ */ new Map());
+    const key = column ?? "";
+    let list = byColumn.get(key);
+    if (!list) {
+      byColumn.set(key, list = ownFormulaList(extract(value, column)));
+    }
+    return list;
+  };
+  const readAnswer = (value, column) => {
+    if (Array.isArray(value)) return cachedList(value, column);
+    return column !== void 0 ? null : formulaInput(value);
+  };
+  const forget = (value) => {
+    if (!value || typeof value !== "object") return;
+    if (Array.isArray(value)) extracted.delete(value);
+    for (const entry of compiled) if (entry.last?.inputs.includes(value)) entry.last = null;
+  };
   const withCalculated = (values, path) => {
     if (!compiled.length) return values;
     const visible = new Set(path);
     let next = values;
+    let copied = false;
     let budget = MAX_SETTLE_ITEMS;
     const within = /* @__PURE__ */ new Map();
-    const input = ({ id, key }) => {
+    const input = ({ id }) => {
       if (id === void 0 || !visible.has(id) || !Object.prototype.hasOwnProperty.call(next, id)) return UNREAD;
       const value = next[id];
       if (!Array.isArray(value)) return value;
-      let ok = within.get(key);
+      let ok = within.get(id);
       if (ok === void 0) {
         ok = value.length <= MAX_FORMULA_ITEMS && value.length <= budget;
         if (ok) budget -= value.length;
-        within.set(key, ok);
+        within.set(id, ok);
       }
       return ok ? value : OVER;
     };
     for (const entry of compiled) {
       const { field, ast } = entry;
-      const inputs = entry.reads.map(input);
+      const { reads } = entry;
+      spend(work, 1);
+      const inputs = new Array(reads.length);
+      let over = false;
+      let same = entry.last !== null;
+      for (let i = 0; i < reads.length; i++) {
+        const v = input(reads[i]);
+        inputs[i] = v;
+        if (v === OVER) over = true;
+        if (same && entry.last.inputs[i] !== v) same = false;
+      }
       let value;
-      if (entry.last && entry.last.inputs.length === inputs.length && entry.last.inputs.every((v, i) => v === inputs[i])) {
+      if (same) {
         value = entry.last.value;
       } else {
+        spend(work, entry.size);
         const resolved = new Array(inputs.length);
         const read = (ref) => {
           const slot = entry.slots.get(ref);
@@ -466,19 +504,25 @@ function calculator(definition) {
           let v = resolved[slot];
           if (v === void 0) {
             const raw = inputs[slot];
-            v = resolved[slot] = raw === UNREAD ? null : readAnswer(raw, entry.reads[slot].column);
+            v = resolved[slot] = raw === UNREAD ? null : readAnswer(raw, reads[slot].column);
           }
           return v;
         };
-        value = ast && !inputs.includes(OVER) ? calculatedValue(evaluateFormula(ast, read), field) : void 0;
+        value = ast && !over ? valueAs(evaluateFormula(ast, read), entry.props) : void 0;
         entry.last = { inputs, value };
       }
       const current = Object.prototype.hasOwnProperty.call(next, field.id) ? next[field.id] : void 0;
-      if (current !== value) next = { ...next, [field.id]: value };
+      if (current !== value) {
+        if (!copied) {
+          next = { ...next };
+          copied = true;
+        }
+        next[field.id] = value;
+      }
     }
     return next;
   };
-  return { active: compiled.length > 0, withCalculated };
+  return { active: compiled.length > 0, ids: new Set(compiled.map((c) => c.field.id)), withCalculated, forget };
 }
 var numberOps = ["eq", "neq", "lt", "lte", "gt", "gte", "in", "answered", "empty"];
 var calculatedFieldType = {
@@ -1135,8 +1179,8 @@ function rulesAllow(def, blockId, scope) {
 }
 function walkPath(def, scope) {
   const list = steps(def);
-  const index = new Map(list.map((b, i2) => [b.id, i2]));
-  const position = new Map(def.blocks.map((b, i2) => [b.id, i2]));
+  let index;
+  let position;
   const jumps = (def.logic ?? []).filter(
     (r) => r.effect === "jump"
   );
@@ -1160,6 +1204,7 @@ function walkPath(def, scope) {
         ending = jump.to.ending;
         break;
       }
+      index ??= new Map(list.map((b, at) => [b.id, at]));
       const target = index.get(jump.to);
       if (target !== void 0 && target > i) {
         i = nextVisible(target);
@@ -1169,6 +1214,7 @@ function walkPath(def, scope) {
     i = nextVisible(i + 1);
   }
   const scopeAt = (blockId, inclusive = false) => {
+    position ??= new Map(def.blocks.map((b, i2) => [b.id, i2]));
     const at = position.get(blockId) ?? -1;
     const values = /* @__PURE__ */ Object.create(null);
     for (const id of path) {
@@ -1231,10 +1277,19 @@ function validateField(field, value, options = {}) {
 }
 
 // src/engine.ts
+function readsAny(node, ids) {
+  if (Array.isArray(node)) return node.some((n) => readsAny(n, ids));
+  if (!node || typeof node !== "object") return false;
+  for (const [k, v] of Object.entries(node)) {
+    if (k === "field" && typeof v === "string" && ids.has(v)) return true;
+    if (typeof v === "object" && readsAny(v, ids)) return true;
+  }
+  return false;
+}
 function createForm(definition, options = {}) {
   return build(definition, options).engine;
 }
-function build(definition, options, replaying = false) {
+function build(definition, options, replaying = false, budget) {
   const fields = fieldMap(definition);
   const byKey = new Map([...fields.values()].map((f) => [f.key, f]));
   const blocks = new Map(definition.blocks.map((b) => [b.id, b]));
@@ -1252,15 +1307,24 @@ function build(definition, options, replaying = false) {
     if (!declared.has(name)) initialHidden[name] = value;
   }
   Object.assign(initialHidden, coerceHidden(definition, options.hidden).values);
-  const calc = calculator(definition);
+  const calc = calculator(definition, budget);
+  const pathOf = (values, hidden) => {
+    spend(budget, definition.blocks.length);
+    return computePath(definition, scopeOf(values, hidden));
+  };
+  const logicReadsCalculated = calc.active && readsAny(definition.logic, calc.ids);
   const settle = (values, hidden) => {
-    let { path } = computePath(definition, scopeOf(values, hidden));
+    let { path } = pathOf(values, hidden);
     if (!calc.active) return { values, path };
+    if (!logicReadsCalculated) return { values: calc.withCalculated(values, path), path };
     for (let round2 = 0; round2 < 4; round2++) {
       const next = calc.withCalculated(values, path);
       if (next === values) break;
       values = next;
-      path = computePath(definition, scopeOf(values, hidden)).path;
+      const again = pathOf(values, hidden).path;
+      const same = again.length === path.length && again.every((id, i) => id === path[i]);
+      path = again;
+      if (same) break;
     }
     return { values, path };
   };
@@ -1302,14 +1366,30 @@ function build(definition, options, replaying = false) {
     return errors;
   };
   let unsettled = false;
-  const settleNow = () => {
-    if (!unsettled) return;
-    unsettled = false;
-    const { values, path } = settle(state.values, state.hidden);
-    state = { ...state, values, path };
+  let formulasStale = false;
+  const settleNow = (needValues = true) => {
+    if (unsettled && calc.active && !logicReadsCalculated && !needValues) {
+      unsettled = false;
+      formulasStale = true;
+      state = { ...state, path: pathOf(state.values, state.hidden).path };
+      return;
+    }
+    if (unsettled) {
+      unsettled = false;
+      formulasStale = false;
+      const { values, path } = settle(state.values, state.hidden);
+      state = { ...state, values, path };
+    } else if (formulasStale && needValues) {
+      formulasStale = false;
+      state = { ...state, values: calc.withCalculated(state.values, state.path) };
+    }
   };
   const answer = (id, value, event) => {
-    if (state.status === "completed" || own(state.values, id) === value || isCalculated(fields.get(id))) return;
+    if (state.status === "completed" || isCalculated(fields.get(id))) return;
+    if (own(state.values, id) === value) {
+      if (value === null || typeof value !== "object") return;
+      calc.forget(value);
+    }
     const errors = { ...state.errors };
     delete errors[id];
     if (batch) {
@@ -1375,7 +1455,7 @@ function build(definition, options, replaying = false) {
         emit({ ...state, errors, current: firstError, events });
         return false;
       }
-      const { ending } = computePath(definition, scopeOf(state.values, state.hidden));
+      const { ending } = pathOf(state.values, state.hidden);
       emit({ ...state, errors: {}, status: "completed", ending, events });
       return true;
     },
@@ -1407,10 +1487,11 @@ function build(definition, options, replaying = false) {
         answer(event.field, event.value, logged);
       }
     } else if (event.type === "next") {
-      settleNow();
+      settleNow(false);
+      if (formulasStale && isCalculated(fields.get(state.current ?? ""))) settleNow(true);
       engine.next();
     } else if (event.type === "back") {
-      settleNow();
+      settleNow(false);
       engine.back();
     } else if (event.type === "submit") {
       settleNow();
@@ -1424,10 +1505,16 @@ function build(definition, options, replaying = false) {
   };
   return { engine, apply, finish };
 }
-function replay(definition, events, options = {}) {
-  const { engine, apply, finish } = build(definition, { ...options, initialValues: void 0, clock: () => void 0 }, true);
-  for (const event of events) apply(event);
-  finish();
+function replayWithin(definition, events, options, maxWork) {
+  const budget = maxWork === void 0 ? void 0 : { used: 0, max: maxWork };
+  const { engine, apply, finish } = build(definition, { ...options, initialValues: void 0, clock: () => void 0 }, true, budget);
+  try {
+    for (const event of events) apply(event);
+    finish();
+  } finally {
+    if (budget) budget.used;
+  }
+  if (budget) budget.max = Infinity;
   return engine;
 }
 
@@ -1931,6 +2018,41 @@ function parseForm(input) {
 
 // src/server.ts
 var MAX_EVENTS = 1e4;
+var MAX_SUBMISSION_VALUES = 2e5;
+var MAX_REPLAY_WORK = 1e6;
+var RAW_EVENTS_PER_EVENT = 10;
+function countValues(value, limit) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length && count <= limit) {
+    const v = stack.pop();
+    if (v === void 0) continue;
+    count++;
+    if (Array.isArray(v)) for (const item of v) stack.push(item);
+    else if (v !== null && typeof v === "object") for (const k in v) stack.push(v[k]);
+  }
+  return count;
+}
+var answerTo = (e) => isPlainObject(e) && e.type === "answer" && typeof e.field === "string" ? e.field : void 0;
+function leanEvents(events) {
+  const out = [];
+  for (let i = 0; i < events.length; i++) {
+    const field = answerTo(events[i]);
+    if (field !== void 0 && answerTo(events[i + 1]) === field) continue;
+    out.push(events[i]);
+  }
+  return out;
+}
+function submissionValues(input, limit) {
+  let count = countValues(input.hidden, limit);
+  if (Array.isArray(input.events)) {
+    for (const e of input.events) {
+      if (count > limit) break;
+      if (answerTo(e) !== void 0) count += countValues(e.value, limit - count);
+    }
+  } else count += countValues(input.answers, limit - count);
+  return count;
+}
 var MALFORMED = { ok: false, errors: { "": "Malformed submission." } };
 var parsedDefinitions = /* @__PURE__ */ new WeakMap();
 function checkDefinition(definition) {
@@ -1960,7 +2082,24 @@ function wellFormed(input) {
 function validateSubmission(definition, submission, options = {}) {
   const invalid = checkDefinition(definition);
   if (invalid) return { ok: false, errors: { "": invalid } };
-  const input = wellFormed(submission);
+  if (!isPlainObject(submission)) return MALFORMED;
+  const maxEvents = options.maxEvents ?? MAX_EVENTS;
+  let sent = submission;
+  if (Array.isArray(submission.events)) {
+    const maxRaw = maxEvents * RAW_EVENTS_PER_EVENT;
+    if (submission.events.length > maxRaw) {
+      return { ok: false, errors: { "": `Too many events: ${submission.events.length} sent; the limit is ${maxRaw} before compaction.` } };
+    }
+    sent = { ...submission, events: leanEvents(submission.events) };
+  }
+  const maxValues = options.maxValues ?? MAX_SUBMISSION_VALUES;
+  if (submissionValues(sent, maxValues) > maxValues) {
+    return {
+      ok: false,
+      errors: { "": `Too much data: the answers hold more than ${maxValues} values (items, rows and cells); the limit is ${maxValues}.` }
+    };
+  }
+  const input = wellFormed(sent);
   if (!input) return MALFORMED;
   const ignored = /* @__PURE__ */ new Set();
   const client = coerceHidden(definition, input.hidden, { sources: ["url", "host"] });
@@ -1979,12 +2118,20 @@ function validateSubmission(definition, submission, options = {}) {
   let engine;
   if (input.events) {
     const events = compactEvents(input.events);
-    const max = options.maxEvents ?? MAX_EVENTS;
-    if (events.length > max) {
-      return { ok: false, errors: { "": `Too many events: ${events.length} after compaction; the limit is ${max}.` } };
+    if (events.length > maxEvents) {
+      return { ok: false, errors: { "": `Too many events: ${events.length} after compaction; the limit is ${maxEvents}.` } };
     }
     const kept = events.filter((e) => e.type !== "answer" || accept(e.field) !== false);
-    engine = replay(definition, kept, { hidden: engineHidden, validators: options.validators });
+    const maxWork = options.maxReplayWork ?? MAX_REPLAY_WORK;
+    try {
+      engine = replayWithin(definition, kept, { hidden: engineHidden, validators: options.validators }, maxWork);
+    } catch (e) {
+      if (!(e instanceof ReplayWorkExceeded)) throw e;
+      return {
+        ok: false,
+        errors: { "": `Too much work: replaying these events (the path and calculated fields) would take more than ${maxWork} steps; the limit is ${maxWork}.` }
+      };
+    }
   } else {
     const answers2 = {};
     for (const id of Object.keys(input.answers ?? {})) {
@@ -2051,6 +2198,6 @@ function publicDefinition(definition) {
   return JSON.parse(JSON.stringify(definition));
 }
 
-export { MAX_EVENTS, publicDefinition, validateSubmission };
+export { MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, RAW_EVENTS_PER_EVENT, publicDefinition, validateSubmission };
 //# sourceMappingURL=server.js.map
 //# sourceMappingURL=server.js.map