@marktiderman/genesis-forms 0.5.0 → 0.7.0

package/dist/server.cjs

@@ -723,6 +723,7 @@ var structuredFieldTypes = [
 
 // src/photo.ts
 var PHOTO_TYPE = "photo";
+var UPLOAD_FIELD_TYPES = [PHOTO_TYPE];
 var PHOTO_FORMATS = {
   jpeg: ["image/jpeg"],
   png: ["image/png"],
@@ -831,6 +832,65 @@ function summarizeValue(value, field) {
   if (Array.isArray(value)) return value.join(", ");
   return String(value);
 }
+var OPTION_LIMITS = {
+  /** Characters in a description. */
+  description: 500,
+  /** Characters in an image URL. */
+  image: 2048,
+  /** Attributes on one option. */
+  attributes: 20,
+  /** Characters in an attribute's name. */
+  attributeName: 64,
+  /** Characters in one attribute value. */
+  attributeValue: 200,
+  /** Values in one attribute's list. */
+  attributeItems: 50
+};
+function isHttpsUrl(url) {
+  return typeof url === "string" && url.length <= OPTION_LIMITS.image && /^https:\/\/[^\s/?#@\\]+(?:[/?#][^\s]*)?$/i.test(url) && // No control characters anywhere (a line break would end a CSV row or an HTML attribute).
+  ![...url].some((c) => c.charCodeAt(0) < 32 || c.charCodeAt(0) === 127);
+}
+function attributeName(name) {
+  return name.trim() !== "" && name.length <= OPTION_LIMITS.attributeName && !(name in Object.prototype);
+}
+function readAttributes(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const out = {};
+  let count = 0;
+  for (const name of Object.keys(raw)) {
+    if (count >= OPTION_LIMITS.attributes) break;
+    if (!attributeName(name)) continue;
+    const v = raw[name];
+    const fits = (x) => typeof x === "string" && x.length <= OPTION_LIMITS.attributeValue;
+    if (fits(v)) out[name] = v;
+    else if (Array.isArray(v) && v.length <= OPTION_LIMITS.attributeItems && v.every(fits)) out[name] = [...v];
+    else continue;
+    count++;
+  }
+  return count ? out : void 0;
+}
+function readOption(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const o = raw;
+  if (typeof o.value !== "string") return null;
+  const out = { value: o.value };
+  if (typeof o.label === "string") out.label = o.label;
+  if (typeof o.description === "string" && o.description.trim() && o.description.length <= OPTION_LIMITS.description) {
+    out.description = o.description;
+  }
+  if (isHttpsUrl(o.image)) out.image = o.image;
+  const attributes = readAttributes(o.attributes);
+  if (attributes) out.attributes = attributes;
+  return out;
+}
+function optionJson(option) {
+  const out = { value: option.value };
+  if (option.label !== void 0) out.label = option.label;
+  if (option.description !== void 0) out.description = option.description;
+  if (option.image !== void 0) out.image = option.image;
+  if (option.attributes !== void 0) out.attributes = { ...option.attributes };
+  return out;
+}
 var OTHER_MAX_LENGTH = 200;
 function otherOption(field) {
   const other = field.props?.other;
@@ -848,14 +908,21 @@ var typedOther = (field, value) => isOtherValue(field, value) && value.trim() !=
 function choiceOptions(field) {
   const raw = field.props?.options;
   if (!Array.isArray(raw)) return [];
-  return raw.flatMap(
-    (o) => o && typeof o === "object" && !Array.isArray(o) && typeof o.value === "string" ? [{ value: o.value, label: typeof o.label === "string" ? o.label : void 0 }] : []
-  );
+  return raw.flatMap((o) => {
+    const option = readOption(o);
+    return option ? [option] : [];
+  });
 }
 function optionsSource(field) {
   const raw = field.props?.optionsFrom;
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
-  return raw.source === "host" && typeof raw.key === "string" && raw.key ? { source: "host", key: raw.key } : void 0;
+  if (raw.source !== "host" || typeof raw.key !== "string" || !raw.key) return void 0;
+  const out = { source: "host", key: raw.key };
+  const filter = raw.filter;
+  if (filter && typeof filter === "object" && !Array.isArray(filter) && typeof filter.attribute === "string" && filter.attribute && typeof filter.field === "string" && filter.field) {
+    out.filter = { attribute: filter.attribute, field: filter.field };
+  }
+  return out;
 }
 function hostList(hostOptions, key) {
   if (!hostOptions || !Object.prototype.hasOwnProperty.call(hostOptions, key)) return [];
@@ -864,11 +931,10 @@ function hostList(hostOptions, key) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const o of list) {
-    if (!o || typeof o !== "object" || Array.isArray(o)) continue;
-    const { value, label } = o;
-    if (typeof value !== "string" || !value || seen.has(value)) continue;
-    seen.add(value);
-    out.push(typeof label === "string" ? { value, label } : { value });
+    const option = readOption(o);
+    if (!option || !option.value || seen.has(option.value)) continue;
+    seen.add(option.value);
+    out.push(option);
   }
   return out;
 }
@@ -883,7 +949,7 @@ function withHostOptions(definition, hostOptions) {
     const added = hostList(hostOptions, from.key).filter((o) => !taken.has(o.value));
     if (!added.length) return block;
     changed = true;
-    const options = [...own2, ...added].map((o) => o.label === void 0 ? { value: o.value } : { value: o.value, label: o.label });
+    const options = [...own2, ...added].map(optionJson);
     return { ...block, props: { ...block.props, options } };
   });
   return changed ? { ...definition, blocks } : definition;
@@ -1363,6 +1429,205 @@ function fieldMap(def) {
   return map;
 }
 
+// src/options.ts
+var CHOICE_FIELD_TYPES = /* @__PURE__ */ new Set(["single-choice", "multi-choice", "dropdown"]);
+var isChoice = (block) => !!block && block.kind === "field" && CHOICE_FIELD_TYPES.has(block.type);
+function put(record, key, value) {
+  Object.defineProperty(record, key, { value, enumerable: true, writable: true, configurable: true });
+}
+function optionFilter(field) {
+  return optionsSource(field)?.filter;
+}
+function answerValues(answer) {
+  const one = (v) => typeof v === "string" ? [v] : typeof v === "number" || typeof v === "boolean" ? [String(v)] : [];
+  if (answer === void 0 || answer === null) return [];
+  return Array.isArray(answer) ? answer.flatMap(one) : one(answer);
+}
+function optionMatches(option, attribute, answer) {
+  const have = option.attributes && Object.prototype.hasOwnProperty.call(option.attributes, attribute) ? option.attributes[attribute] : void 0;
+  if (have === void 0) return false;
+  const wanted = answerValues(answer);
+  return (Array.isArray(have) ? have : [have]).some((v) => wanted.includes(v));
+}
+function filterSource(definition, key) {
+  return definition.blocks.find((b) => b.kind === "field" && b.key === key);
+}
+function visibleOptions(definition, field, values) {
+  const options = choiceOptions(field);
+  const filter = optionFilter(field);
+  if (!filter) return options;
+  const source = filterSource(definition, filter.field);
+  if (!source || source.id === field.id) return options;
+  const answer = own(values, source.id);
+  if (isEmptyValue(answer, source)) return options;
+  return options.filter((o) => optionMatches(o, filter.attribute, answer));
+}
+function answersOnPath(state) {
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const id of state.path) out[id] = own(state.values, id);
+  return out;
+}
+var OUTSIDE_FILTER = "Choose one of the options.";
+function filteredChoiceError(definition, field, value, values) {
+  if (!optionFilter(field) || isEmptyValue(value, field)) return null;
+  const all = new Set(choiceOptions(field).map((o) => o.value));
+  const shown2 = new Set(visibleOptions(definition, field, values).map((o) => o.value));
+  const picked = answerValues(value);
+  return picked.some((v) => all.has(v) && !shown2.has(v)) ? OUTSIDE_FILTER : null;
+}
+function hasOptionFilters(definition) {
+  return definition.blocks.some((b) => isChoice(b) && optionFilter(b) !== void 0);
+}
+function clearFilteredAnswers(definition, values, changedId) {
+  const changed = definition.blocks.find((b) => b.kind === "field" && b.id === changedId);
+  if (!changed) return values;
+  const keys = /* @__PURE__ */ new Set([changed.key]);
+  let out = values;
+  for (const block of definition.blocks) {
+    if (!isChoice(block)) continue;
+    const filter = optionFilter(block);
+    if (!filter || !keys.has(filter.field)) continue;
+    const value = own(out, block.id);
+    if (value === void 0 || isEmptyValue(value, block)) continue;
+    const all = new Set(choiceOptions(block).map((o) => o.value));
+    const shown2 = new Set(visibleOptions(definition, block, out).map((o) => o.value));
+    const keep = (v) => typeof v !== "string" || !all.has(v) || shown2.has(v);
+    let next = value;
+    if (Array.isArray(value)) {
+      const kept = value.filter(keep);
+      if (kept.length !== value.length) next = kept.length ? kept : void 0;
+    } else if (!keep(value)) next = void 0;
+    if (next === value) continue;
+    if (out === values) out = { ...values };
+    put(out, block.id, next);
+    keys.add(block.key);
+  }
+  return out;
+}
+function fold(text) {
+  return text.normalize("NFD").replace(/[̀-ͯ]/g, "").toLowerCase();
+}
+var MAX_PREFILL_PARAM_LENGTH = 64;
+function isPrefillParam(param) {
+  return typeof param === "string" && param.length <= MAX_PREFILL_PARAM_LENGTH && /^[A-Za-z0-9_.-]+$/.test(param);
+}
+function prefillSetting(field) {
+  if (!CHOICE_FIELD_TYPES.has(field.type)) return void 0;
+  const raw = field.props?.prefill;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw) || !isPrefillParam(raw.param)) return void 0;
+  return { param: raw.param, hideWhenPrefilled: raw.hideWhenPrefilled === true };
+}
+function paramValues(params, name) {
+  let raw;
+  if (typeof params.getAll === "function") {
+    raw = params.getAll(name);
+  } else if (Object.prototype.hasOwnProperty.call(params, name)) {
+    raw = params[name];
+  }
+  const list = Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw];
+  return list.filter((v) => typeof v === "string" && v !== "" && v.length <= MAX_HIDDEN_STRING_LENGTH);
+}
+function prefillFromLink(definition, params, values = {}) {
+  const out = {};
+  if (!params || typeof params !== "object") return out;
+  const seen = {};
+  for (const id of Object.keys(values)) put(seen, id, values[id]);
+  for (const block of definition.blocks) {
+    if (!isChoice(block)) continue;
+    const setting = prefillSetting(block);
+    if (!setting || own(seen, block.id) !== void 0) continue;
+    const raw = paramValues(params, setting.param);
+    if (!raw.length) continue;
+    const shown2 = new Set(visibleOptions(definition, block, seen).map((o) => o.value));
+    let value;
+    if (block.type === "multi-choice") {
+      const picked = [];
+      for (const r of raw) {
+        for (const v of shown2.has(r) ? [r] : r.split(",").map((s) => s.trim())) {
+          if (shown2.has(v) && !picked.includes(v)) picked.push(v);
+        }
+      }
+      if (picked.length) value = picked;
+    } else value = raw.find((v) => shown2.has(v));
+    if (value === void 0) continue;
+    put(out, block.id, value);
+    put(seen, block.id, value);
+  }
+  return out;
+}
+function hiddenByPrefill(definition, state) {
+  const hideable = /* @__PURE__ */ new Set();
+  for (const b of definition.blocks) {
+    if (isChoice(b) && prefillSetting(b)?.hideWhenPrefilled) hideable.add(b.id);
+  }
+  if (!hideable.size) return [];
+  const prefilled = /* @__PURE__ */ new Set();
+  for (const e of state.events) {
+    if (e.type !== "answer" || !hideable.has(e.field)) continue;
+    if (e.source === "prefill") prefilled.add(e.field);
+    else prefilled.delete(e.field);
+  }
+  if (!prefilled.size) return [];
+  const fields = new Map(definition.blocks.map((b) => [b.id, b]));
+  return state.path.filter((id) => {
+    if (!prefilled.has(id) || own(state.errors, id) !== void 0) return false;
+    const field = fields.get(id);
+    return !isEmptyValue(own(state.values, id), field);
+  });
+}
+function snapshotOf(byValue, value) {
+  const option = byValue.get(value);
+  if (option) return { value, label: option.label ?? value };
+  return { value, label: value, other: true };
+}
+function answerSnapshots(definition, answers) {
+  const out = {};
+  for (const block of definition.blocks) {
+    if (!isChoice(block) || !optionsSource(block)) continue;
+    const value = own(answers, block.id);
+    if (isEmptyValue(value, block)) continue;
+    const byValue = new Map(choiceOptions(block).map((o) => [o.value, o]));
+    let snapshot;
+    if (Array.isArray(value)) {
+      const items = value.filter((v) => typeof v === "string").map((v) => snapshotOf(byValue, v));
+      if (items.length) snapshot = items;
+    } else if (typeof value === "string") snapshot = snapshotOf(byValue, value);
+    if (snapshot) put(out, block.id, snapshot);
+  }
+  return out;
+}
+function answersFromSnapshots(definition, snapshots) {
+  const answers = {};
+  const missing = {};
+  for (const block of definition.blocks) {
+    if (!isChoice(block)) continue;
+    const raw = own(snapshots, block.id);
+    const list = (Array.isArray(raw) ? raw : raw === void 0 ? [] : [raw]).flatMap((s) => {
+      const o = readOption(s);
+      if (!o) return [];
+      const label = o.label ?? o.value;
+      return [s.other === true ? { value: o.value, label, other: true } : { value: o.value, label }];
+    });
+    if (!list.length) continue;
+    const options = choiceOptions(block);
+    const byValue = new Set(options.map((o) => o.value));
+    const allowsOther = block.props?.other !== void 0 && block.props?.other !== false;
+    const found = [];
+    const lost = [];
+    for (const s of list) {
+      let value;
+      if (byValue.has(s.value)) value = s.value;
+      else if (s.other) value = allowsOther ? s.value : void 0;
+      else value = options.find((o) => fold(o.label ?? o.value) === fold(s.label))?.value;
+      if (value === void 0) lost.push(s);
+      else if (!found.includes(value)) found.push(value);
+    }
+    if (found.length) put(answers, block.id, block.type === "multi-choice" ? found : found[0]);
+    if (lost.length) put(missing, block.id, lost);
+  }
+  return { answers, missing };
+}
+
 // src/recall.ts
 var TOKEN = /\{\{\s*(field|hidden):([A-Za-z0-9_-]+)\s*(?:\|([^}]*))?\}\}/g;
 function recall(text, scope) {
@@ -1484,16 +1749,34 @@ function build(given, options, replaying = false, budget) {
     return at === void 0 ? event : { ...event, at };
   };
   const isVisibleIn = (s, id) => s.path.includes(id);
+  const filters = hasOptionFilters(definition);
+  const clearFiltered = (values, id) => filters ? clearFilteredAnswers(definition, values, id) : values;
   const errorsFor = (s, ids) => {
     const errors = {};
+    let shown2;
     for (const id of ids) {
       const field = fields.get(id);
       if (!field || !isVisibleIn(s, id)) continue;
-      const message = validateField(field, own(s.values, id), { custom: options.validators?.[id] });
+      const value = own(s.values, id);
+      let message = validateField(field, value, { custom: options.validators?.[id] });
+      if (!message && filters) message = filteredChoiceError(definition, field, value, shown2 ??= answersOnPath(s));
       if (message) errors[id] = message;
     }
     return errors;
   };
+  const skipped = (s) => new Set(hiddenByPrefill(definition, s));
+  const shownFrom = (s, from, skip) => {
+    for (let i = from; i < s.path.length; i++) if (!skip.has(s.path[i])) return s.path[i];
+    return void 0;
+  };
+  const showCurrent = () => {
+    if (!state.current) return;
+    const skip = skipped(state);
+    if (!skip.has(state.current)) return;
+    const at = state.path.indexOf(state.current);
+    const shown2 = at < 0 ? void 0 : shownFrom(state, at, skip);
+    if (shown2) state = { ...state, current: shown2, furthest: state.furthest === state.current ? shown2 : state.furthest };
+  };
   let unsettled = false;
   let formulasStale = false;
   const settleNow = (needValues = true) => {
@@ -1522,13 +1805,13 @@ function build(given, options, replaying = false, budget) {
     const errors = { ...state.errors };
     delete errors[id];
     if (batch) {
-      state.values = { ...state.values, [id]: value };
+      state.values = clearFiltered({ ...state.values, [id]: value }, id);
       state.errors = errors;
       log(event);
       unsettled = true;
       return;
     }
-    const { values, path } = settle({ ...state.values, [id]: value }, state.hidden);
+    const { values, path } = settle(clearFiltered({ ...state.values, [id]: value }, id), state.hidden);
     emit({ ...state, values, path, errors, events: log(event) });
   };
   const engine = {
@@ -1559,7 +1842,7 @@ function build(given, options, replaying = false, budget) {
         return false;
       }
       const at = state.path.indexOf(state.current);
-      const target = state.path[at + 1];
+      const target = shownFrom(state, at + 1, skipped(state));
       if (!target) {
         emit({ ...state, events });
         return true;
@@ -1571,8 +1854,9 @@ function build(given, options, replaying = false, budget) {
     back() {
       if (state.status === "completed") return;
       const history = [...state.history];
+      const skip = skipped(state);
       let previous = history.pop();
-      while (previous && !state.path.includes(previous)) previous = history.pop();
+      while (previous && (!state.path.includes(previous) || skip.has(previous))) previous = history.pop();
       if (!previous) return;
       emit({ ...state, current: previous, history, events: log(stamp({ type: "back" })) });
     },
@@ -1600,15 +1884,18 @@ function build(given, options, replaying = false, budget) {
       return out;
     }
   };
-  if (options.initialValues) {
+  const fromLink = options.linkParams ? prefillFromLink(definition, options.linkParams, options.initialValues) : {};
+  const initialValues = Object.keys(fromLink).length ? { ...fromLink, ...options.initialValues } : options.initialValues;
+  if (initialValues) {
     const wasBatch = batch;
     batch = true;
-    for (const [id, value] of Object.entries(options.initialValues)) {
+    for (const [id, value] of Object.entries(initialValues)) {
       if (!fields.has(id) || value === void 0) continue;
       answer(id, value, stamp({ type: "answer", field: id, value, source: "prefill" }));
     }
     settleNow();
     batch = wasBatch;
+    showCurrent();
   }
   const resumeAt = options.resumeAt;
   if (resumeAt && !replaying && state.path.includes(resumeAt)) {
@@ -1627,18 +1914,22 @@ function build(given, options, replaying = false, budget) {
       }
     } else if (event.type === "next") {
       settleNow(false);
+      showCurrent();
       if (formulasStale && isCalculated(fields.get(state.current ?? ""))) settleNow(true);
       engine.next();
     } else if (event.type === "back") {
       settleNow(false);
+      showCurrent();
       engine.back();
     } else if (event.type === "submit") {
       settleNow();
+      showCurrent();
       engine.submit();
     }
   };
   const finish = () => {
     settleNow();
+    showCurrent();
     batch = false;
     state = { ...state, events: [...state.events] };
   };
@@ -1646,7 +1937,12 @@ function build(given, options, replaying = false, budget) {
 }
 function replayWithin(definition, events, options, maxWork) {
   const budget = maxWork === void 0 ? void 0 : { used: 0, max: maxWork };
-  const { engine, apply, finish } = build(definition, { ...options, initialValues: void 0, clock: () => void 0 }, true, budget);
+  const { engine, apply, finish } = build(
+    definition,
+    { ...options, initialValues: void 0, linkParams: void 0, clock: () => void 0 },
+    true,
+    budget
+  );
   try {
     for (const event of events) apply(event);
     finish();
@@ -1718,6 +2014,31 @@ function parseForm(input) {
   const optionalBoolean = (v, path) => {
     if (v !== void 0 && typeof v !== "boolean") issue(path, "Must be true or false.");
   };
+  const optionDetails = (o, at) => {
+    if (o.description !== void 0 && (typeof o.description !== "string" || o.description.length > OPTION_LIMITS.description)) {
+      issue(`${at}.description`, `Must be text of at most ${OPTION_LIMITS.description} characters.`);
+    }
+    if (o.image !== void 0 && !isHttpsUrl(o.image)) {
+      issue(`${at}.image`, `Must be an https:// link of at most ${OPTION_LIMITS.image} characters.`);
+    }
+    if (o.attributes === void 0) return;
+    const attributes = o.attributes;
+    if (!isObject2(attributes) || Object.keys(attributes).length > OPTION_LIMITS.attributes) {
+      issue(`${at}.attributes`, `Must be an object of at most ${OPTION_LIMITS.attributes} attributes.`);
+      return;
+    }
+    const fits = (x) => typeof x === "string" && x.length <= OPTION_LIMITS.attributeValue;
+    for (const [name2, v] of Object.entries(attributes)) {
+      if (!name2.trim() || name2.length > OPTION_LIMITS.attributeName || RESERVED.has(name2)) {
+        issue(`${at}.attributes`, `${shown(name2)} isn't a usable attribute name (at most ${OPTION_LIMITS.attributeName} characters).`);
+      } else if (!fits(v) && !(Array.isArray(v) && v.length <= OPTION_LIMITS.attributeItems && v.every(fits))) {
+        issue(
+          `${at}.attributes.${name2}`,
+          `Must be text, or a list of at most ${OPTION_LIMITS.attributeItems} texts, each at most ${OPTION_LIMITS.attributeValue} characters.`
+        );
+      }
+    }
+  };
   const name = (v, path, what) => {
     if (typeof v !== "string" || !v) {
       issue(path, `${what} must be a non-empty string.`);
@@ -1890,7 +2211,31 @@ function parseForm(input) {
           } else if (typeof block.type === "string" && !CHOICE_TYPES.has(block.type)) {
             warnings.push({ path: `${path}.props.optionsFrom`, message: "Only single choice, multiple choice and dropdown questions take options from the app." });
           }
+          const filter = isObject2(from) ? from.filter : void 0;
+          if (filter !== void 0) {
+            const at = `${path}.props.optionsFrom.filter`;
+            if (!isObject2(filter) || typeof filter.attribute !== "string" || !filter.attribute || filter.attribute.length > OPTION_LIMITS.attributeName || typeof filter.field !== "string" || !filter.field) {
+              issue(at, `Must be { attribute, field }: an attribute name (at most ${OPTION_LIMITS.attributeName} characters) and an earlier question's key.`);
+            } else if (!keys.has(filter.field)) {
+              issue(`${at}.field`, `"${filter.field}" must be the key of an earlier question.`);
+            }
+          }
         }
+        const prefill = isObject2(block.props) ? block.props.prefill : void 0;
+        if (prefill !== void 0) {
+          if (!isObject2(prefill) || !isPrefillParam(prefill.param)) {
+            issue(
+              `${path}.props.prefill`,
+              `Must be { param, hideWhenPrefilled? }: a link parameter of letters, digits, "_", "-" or "." (at most ${MAX_PREFILL_PARAM_LENGTH} characters).`
+            );
+          } else {
+            optionalBoolean(prefill.hideWhenPrefilled, `${path}.props.prefill.hideWhenPrefilled`);
+            if (typeof block.type === "string" && !CHOICE_TYPES.has(block.type)) {
+              warnings.push({ path: `${path}.props.prefill`, message: "Only single choice, multiple choice and dropdown questions are filled in from a link." });
+            }
+          }
+        }
+        if (isObject2(block.props)) optionalBoolean(block.props.searchable, `${path}.props.searchable`);
         if (!isObject2(block.props) || !isJson(block.props)) issue(`${path}.props`, "Must be a JSON object.");
         else if (block.props.options !== void 0) {
           const options = block.props.options;
@@ -1899,7 +2244,10 @@ function parseForm(input) {
             options.forEach((o, j) => {
               const at = `${path}.props.options[${j}]`;
               if (!isObject2(o) || typeof o.value !== "string") issue(at, "Each option needs a string value.");
-              else optionalText(o.label, `${at}.label`);
+              else {
+                optionalText(o.label, `${at}.label`);
+                optionDetails(o, at);
+              }
             });
             if (from === void 0) {
               choices.set(
@@ -2192,6 +2540,377 @@ function parseForm(input) {
   return issues.length ? fail() : { ok: true, form: input, warnings };
 }
 
+// src/edit-link.ts
+var EDIT_LINK_TTL_SECONDS = 30 * 24 * 60 * 60;
+var MIN_EDIT_SECRET_BYTES = 32;
+var EDIT_LINK_PARAM = "edit";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var NONCE = /^[A-Za-z0-9_-]{16,64}$/;
+var EXPIRES = /^[1-9][0-9]{0,11}$/;
+var SIG = /^[A-Za-z0-9_-]{43}$/;
+var DOMAIN = "edit-link:v2:";
+var MAX_TOKEN_LENGTH = 300;
+var encoder = new TextEncoder();
+function toBase64Url(bytes) {
+  let binary = "";
+  for (const b of bytes) binary += String.fromCharCode(b);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64Url(text) {
+  const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/"));
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function isUsableEditSecret(secret) {
+  return typeof secret === "string" && secret.trim().length > 0 && encoder.encode(secret).length >= MIN_EDIT_SECRET_BYTES;
+}
+function hmacKey(secret, usage) {
+  return crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [usage]);
+}
+var payload = (id, nonce, expiresAt) => encoder.encode(`${DOMAIN}${id}.${nonce}.${expiresAt}`);
+async function signEditToken(link, secret, options = {}) {
+  if (!isUsableEditSecret(secret) || !UUID.test(link.id) || !NONCE.test(link.nonce)) return null;
+  const ttl = options.ttlSeconds ?? EDIT_LINK_TTL_SECONDS;
+  if (!Number.isFinite(ttl) || ttl <= 0) return null;
+  const id = link.id.toLowerCase();
+  const expiresAt = Math.floor((options.now ?? Date.now()) / 1e3) + Math.floor(ttl);
+  const sig = await crypto.subtle.sign("HMAC", await hmacKey(secret, "sign"), payload(id, link.nonce, expiresAt));
+  return `${id}.${link.nonce}.${expiresAt}.${toBase64Url(new Uint8Array(sig))}`;
+}
+async function verifyEditToken(token, secret, options = {}) {
+  if (!isUsableEditSecret(secret) || typeof token !== "string" || token.length > MAX_TOKEN_LENGTH) return null;
+  const parts = token.split(".");
+  if (parts.length !== 4) return null;
+  const [id, nonce, expires, sig] = parts;
+  if (!UUID.test(id) || id !== id.toLowerCase() || !NONCE.test(nonce) || !EXPIRES.test(expires)) return null;
+  if (!SIG.test(sig)) return null;
+  const expiresAt = Number(expires);
+  const now = Math.floor((options.now ?? Date.now()) / 1e3);
+  const ttl = options.ttlSeconds ?? EDIT_LINK_TTL_SECONDS;
+  if (expiresAt <= now || expiresAt > now + ttl) return null;
+  let bytes;
+  try {
+    bytes = fromBase64Url(sig);
+  } catch {
+    return null;
+  }
+  const ok = await crypto.subtle.verify("HMAC", await hmacKey(secret, "verify"), bytes, payload(id, nonce, expiresAt));
+  return ok ? { id, nonce, expiresAt } : null;
+}
+function withEditToken(formUrl, token, param = EDIT_LINK_PARAM) {
+  return `${formUrl}${formUrl.includes("?") ? "&" : "?"}${param}=${encodeURIComponent(token)}`;
+}
+async function editLinkUrl(formUrl, link, secret, options = {}) {
+  const token = await signEditToken(link, secret, options);
+  return token ? withEditToken(formUrl, token, options.param) : null;
+}
+function createEditSecretReader(options) {
+  const { variable } = options;
+  let warned = false;
+  const read = (env, log) => {
+    const secret = env[variable];
+    if (isUsableEditSecret(secret)) return secret;
+    if (!warned) {
+      warned = true;
+      (log ?? options.log ?? ((m) => console.warn(m)))(
+        `${variable} is ${secret ? `shorter than ${MIN_EDIT_SECRET_BYTES} bytes` : "not set"}: edit links are off.`
+      );
+    }
+    return null;
+  };
+  return Object.assign(read, {
+    reset: () => {
+      warned = false;
+    }
+  });
+}
+function isEditLinkRequest(url, options = {}) {
+  const isFormPage = options.isFormPage ?? (() => true);
+  return isFormPage(url) && url.searchParams.has(options.param ?? EDIT_LINK_PARAM);
+}
+function withEditLinkHeaders(request, response, options = {}) {
+  let url;
+  try {
+    url = new URL(request.url);
+  } catch {
+    return response;
+  }
+  if (!isEditLinkRequest(url, options)) return response;
+  const headers = new Headers(response.headers);
+  headers.set("referrer-policy", "no-referrer");
+  headers.set("cache-control", "private, no-store");
+  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+
+// src/rate-limit.ts
+var DEFAULT_TRUSTED_IP_HEADERS = ["x-vercel-forwarded-for", "x-forwarded-for", "x-real-ip"];
+var RATE_LIMIT_DEFAULTS = {
+  submit: { limit: 60, windowSeconds: 600 },
+  progress: { limit: 900, windowSeconds: 600 },
+  upload: { limit: 120, windowSeconds: 600 }
+};
+function clientIp(headers, trusted = DEFAULT_TRUSTED_IP_HEADERS) {
+  for (const name of trusted) {
+    const first = headers.get(name)?.split(",")[0]?.trim();
+    if (first) return first;
+  }
+  return "unknown";
+}
+function addressPrefix(ip) {
+  const bare = ip.replace(/^\[|\](:\d+)?$/g, "").split("%")[0].toLowerCase();
+  if (!bare.includes(":")) return bare;
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(bare);
+  if (mapped) return mapped[1];
+  const [head = "", tail = ""] = bare.split("::");
+  const left = head ? head.split(":") : [];
+  const right = bare.includes("::") && tail ? tail.split(":") : [];
+  const groups = bare.includes("::") ? [...left, ...Array(Math.max(0, 8 - left.length - right.length)).fill("0"), ...right] : left;
+  return `${groups.slice(0, 4).map((g) => (g || "0").replace(/^0+(?=.)/, "")).join(":")}::/64`;
+}
+async function rateLimitKey(input) {
+  const encoder2 = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder2.encode(input.secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder2.encode(addressPrefix(input.ip))));
+  let hex = "";
+  for (const b of mac) hex += b.toString(16).padStart(2, "0");
+  return `${input.kind}:${input.scope}:${hex}`;
+}
+async function allow(store, check, options = {}) {
+  let allowed;
+  try {
+    allowed = await store.hit(check.key, check.limit, check.windowSeconds);
+  } catch {
+    allowed = null;
+  }
+  if (allowed !== null) return allowed;
+  (options.log ?? ((m) => console.warn(m)))(
+    options.message ?? "The rate limit could not be checked; letting the request through."
+  );
+  return true;
+}
+
+// src/uploads.ts
+function uploadFields(definition) {
+  return definition.blocks.filter(
+    (b) => b.kind === "field" && UPLOAD_FIELD_TYPES.includes(b.type)
+  );
+}
+function uploadRules(field) {
+  if (field.type !== PHOTO_TYPE) return null;
+  const limits = photoLimits(field);
+  return {
+    maxFiles: limits.maxFiles,
+    maxBytes: limits.maxBytes,
+    mimeTypes: limits.mimeTypes,
+    typeMessage: photoTypeMessage(field),
+    sizeMessage: photoSizeMessage(field),
+    countMessage: photoCountMessage(field)
+  };
+}
+var NOT_UPLOADED_MESSAGE = "A photo didn't finish uploading. Remove it and add it again.";
+function owns(upload, owner) {
+  if ("attemptHash" in owner) return upload.responseId === null && upload.attemptHash === owner.attemptHash;
+  return upload.responseId === owner.responseId || upload.responseId === null && upload.editOf === owner.responseId;
+}
+async function checkUploads(definition, answers, options) {
+  const asked = uploadFields(definition).filter((f) => photoRefs(answers[f.id]).length > 0);
+  if (!asked.length) return { ok: true, answers };
+  const { store, formId, owner } = options;
+  if (!store) throw new Error("Answers that name uploaded files need an upload store.");
+  const ids = asked.flatMap((f) => photoRefs(answers[f.id]).map((r) => r.id));
+  const stored = new Map((await store.uploadRefs(formId, ids)).map((u) => [u.id, u]));
+  const out = { ...answers };
+  const errors = {};
+  for (const field of asked) {
+    const rules = uploadRules(field);
+    const refs = photoRefs(answers[field.id]);
+    if (refs.length > rules.maxFiles) {
+      errors[field.id] = rules.countMessage;
+      continue;
+    }
+    const checked = [];
+    for (const ref of refs) {
+      const upload = stored.get(ref.id);
+      if (!upload || upload.fieldId !== field.id || !owns(upload, owner) || !upload.stored) {
+        errors[field.id] = NOT_UPLOADED_MESSAGE;
+        break;
+      }
+      const type = (upload.storedType ?? "").toLowerCase();
+      const size = upload.storedSize ?? 0;
+      if (!rules.mimeTypes.includes(type)) {
+        errors[field.id] = rules.typeMessage;
+        break;
+      }
+      if (size < 1 || size > rules.maxBytes) {
+        errors[field.id] = rules.sizeMessage;
+        break;
+      }
+      checked.push({ id: upload.id, name: upload.name, type, size });
+    }
+    out[field.id] = checked;
+  }
+  return Object.keys(errors).length ? { ok: false, errors } : { ok: true, answers: out };
+}
+async function attemptHash(attemptId) {
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(attemptId)));
+  let hex = "";
+  for (const b of digest) hex += b.toString(16).padStart(2, "0");
+  return hex;
+}
+
+// src/upload-protocol.ts
+var MAX_UPLOAD_REQUEST_BYTES = 4e3;
+
+// src/upload-handler.ts
+var UPLOAD_MESSAGES = {
+  notJson: "Send the request as JSON.",
+  tooLong: "That request is too long.",
+  reload: "Reload the page and try again.",
+  unavailable: "This form isn't available.",
+  notOpen: "This form isn't open right now.",
+  notTakingChanges: "This form isn't taking changes now.",
+  badEditLink: "This edit link doesn't work any more. Use the newest one: from your latest confirmation email, or the one shown after your last change.",
+  notUploadField: "This question doesn't take photos.",
+  rateLimited: "Too many photos from here. Try again in a few minutes.",
+  tooMany: "That's as many photos as one response can take.",
+  failed: "That photo couldn't be added. Please try again."
+};
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var json = (body, status = 200) => Response.json(body, { status, headers: { "cache-control": "no-store" } });
+async function readCapped(request, max) {
+  if (!request.body) return "";
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > max) {
+      await reader.cancel().catch(() => {
+      });
+      return null;
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+function createUploadHandler(options) {
+  const say = { ...UPLOAD_MESSAGES, ...options.messages };
+  const log = options.log ?? ((m) => console.error(`[upload] ${m}`));
+  const hash = options.hashAttempt ?? attemptHash;
+  const maxBytes = options.maxRequestBytes ?? MAX_UPLOAD_REQUEST_BYTES;
+  return async (request, params) => {
+    const contentType = (request.headers.get("content-type") ?? "").split(";")[0].trim().toLowerCase();
+    if (contentType !== "application/json") return json({ error: say.notJson }, 415);
+    const text = await readCapped(request, maxBytes);
+    if (text === null) return json({ error: say.tooLong }, 413);
+    let body;
+    try {
+      const parsed = JSON.parse(text);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not an object");
+      body = parsed;
+    } catch {
+      return json({ error: say.notJson }, 400);
+    }
+    const fieldId = typeof body["fieldId"] === "string" ? body["fieldId"] : "";
+    const name = typeof body["name"] === "string" ? body["name"].trim().slice(0, 255) : "";
+    const type = typeof body["type"] === "string" ? body["type"].trim().toLowerCase() : "";
+    const size = body["size"];
+    const editing = body["edit"] !== void 0;
+    const attemptId = body["attemptId"];
+    if (!editing && (typeof attemptId !== "string" || !UUID2.test(attemptId))) {
+      return json({ error: say.reload }, 400);
+    }
+    let form;
+    try {
+      form = await options.resolveForm(request, params);
+    } catch (error) {
+      log(error instanceof Error ? error.message : "Loading the form failed.");
+      return json({ error: say.failed }, 503);
+    }
+    if (!form) return json({ error: say.unavailable }, 404);
+    if (!form.open) {
+      return editing ? json({ error: say.notTakingChanges, code: "closed" }, 409) : json({ error: say.notOpen }, 409);
+    }
+    const block = form.definition.blocks.find((b) => b.kind === "field" && b.id === fieldId);
+    const field = block?.kind === "field" ? block : null;
+    const rules = field ? uploadRules(field) : null;
+    if (!field || !rules) return json({ error: say.notUploadField }, 400);
+    if (!rules.mimeTypes.includes(type)) return json({ error: rules.typeMessage }, 415);
+    if (typeof size !== "number" || !Number.isInteger(size) || size < 1 || size > rules.maxBytes) {
+      return json({ error: rules.sizeMessage }, 413);
+    }
+    let editOf = null;
+    if (editing) {
+      const secret = typeof options.edit?.secret === "function" ? options.edit.secret() : options.edit?.secret;
+      const claims = options.edit ? await verifyEditToken(
+        typeof body["edit"] === "string" ? body["edit"] : null,
+        secret,
+        options.now ? { now: options.now().getTime() } : {}
+      ) : null;
+      if (!claims || form.allowsEdits !== true) return json({ error: say.badEditLink, code: "bad_link" }, 403);
+      let stored;
+      try {
+        stored = await options.edit.response(claims.id, form);
+      } catch {
+        log(`Loading response ${claims.id} for an upload failed.`);
+        return json({ error: say.failed }, 503);
+      }
+      if (!stored || stored.editNonce !== claims.nonce) return json({ error: say.badEditLink, code: "bad_link" }, 403);
+      editOf = stored.id;
+    }
+    if (options.rateLimit) {
+      const limit = options.rateLimit;
+      const key = await rateLimitKey({
+        kind: "upload",
+        scope: form.scope,
+        ip: clientIp(request.headers, limit.trustedIpHeaders ?? DEFAULT_TRUSTED_IP_HEADERS),
+        secret: limit.secret
+      });
+      const allowed = await allow(
+        limit.store,
+        {
+          key,
+          limit: limit.limit ?? RATE_LIMIT_DEFAULTS.upload.limit,
+          windowSeconds: limit.windowSeconds ?? RATE_LIMIT_DEFAULTS.upload.windowSeconds
+        },
+        { log, message: "The upload rate limit could not be checked; letting the upload through." }
+      );
+      if (!allowed) return json({ error: say.rateLimited }, 429);
+    }
+    const fileName = name || "photo";
+    try {
+      const begun = await options.store.beginUpload({
+        formId: form.id,
+        fieldId: field.id,
+        name: fileName,
+        contentType: type,
+        size,
+        attemptHash: editOf ? null : await hash(attemptId),
+        editOf
+      });
+      if ("tooMany" in begun) return json({ error: say.tooMany, code: "too_many_photos" }, 429);
+      const signed = await options.store.signUpload(begun.objectName);
+      return json({ ref: { id: begun.id, name: fileName, type, size }, upload: signed });
+    } catch (error) {
+      log(
+        `Starting an upload on ${form.label ?? form.id} for ${form.scope} failed: ${error instanceof Error ? error.message : "unexpected error"}`
+      );
+      return json({ error: say.failed }, 500);
+    }
+  };
+}
+
 // src/server.ts
 var MAX_EVENTS = 1e4;
 var MAX_SUBMISSION_VALUES = 2e5;
@@ -2329,11 +3048,12 @@ function validateSubmission(published, submission, options = {}) {
     }
   } else {
     const errors = {};
-    for (const [id, value] of Object.entries(engine.answers())) {
+    const kept = engine.answers();
+    for (const [id, value] of Object.entries(kept)) {
       const message = validateField(fields.get(id), value, {
         requireAnswers: false,
         custom: options.validators?.[id]
-      });
+      }) ?? filteredChoiceError(definition, fields.get(id), value, kept);
       if (message) errors[id] = message;
     }
     if (Object.keys(errors).length) return { ok: false, errors };
@@ -2375,11 +3095,39 @@ function publicDefinition(definition) {
   return JSON.parse(JSON.stringify(definition));
 }
 
+exports.DEFAULT_TRUSTED_IP_HEADERS = DEFAULT_TRUSTED_IP_HEADERS;
+exports.EDIT_LINK_PARAM = EDIT_LINK_PARAM;
+exports.EDIT_LINK_TTL_SECONDS = EDIT_LINK_TTL_SECONDS;
 exports.MAX_EVENTS = MAX_EVENTS;
 exports.MAX_REPLAY_WORK = MAX_REPLAY_WORK;
 exports.MAX_SUBMISSION_VALUES = MAX_SUBMISSION_VALUES;
+exports.MAX_UPLOAD_REQUEST_BYTES = MAX_UPLOAD_REQUEST_BYTES;
+exports.MIN_EDIT_SECRET_BYTES = MIN_EDIT_SECRET_BYTES;
+exports.NOT_UPLOADED_MESSAGE = NOT_UPLOADED_MESSAGE;
+exports.RATE_LIMIT_DEFAULTS = RATE_LIMIT_DEFAULTS;
 exports.RAW_EVENTS_PER_EVENT = RAW_EVENTS_PER_EVENT;
+exports.UPLOAD_MESSAGES = UPLOAD_MESSAGES;
+exports.addressPrefix = addressPrefix;
+exports.allow = allow;
+exports.answerSnapshots = answerSnapshots;
+exports.answersFromSnapshots = answersFromSnapshots;
+exports.attemptHash = attemptHash;
+exports.checkUploads = checkUploads;
+exports.clientIp = clientIp;
+exports.createEditSecretReader = createEditSecretReader;
+exports.createUploadHandler = createUploadHandler;
+exports.editLinkUrl = editLinkUrl;
+exports.isEditLinkRequest = isEditLinkRequest;
+exports.isUsableEditSecret = isUsableEditSecret;
 exports.publicDefinition = publicDefinition;
+exports.rateLimitKey = rateLimitKey;
+exports.signEditToken = signEditToken;
+exports.uploadFields = uploadFields;
+exports.uploadRules = uploadRules;
 exports.validateSubmission = validateSubmission;
+exports.verifyEditToken = verifyEditToken;
+exports.withEditLinkHeaders = withEditLinkHeaders;
+exports.withEditToken = withEditToken;
+exports.withHostOptions = withHostOptions;
 //# sourceMappingURL=server.cjs.map
 //# sourceMappingURL=server.cjs.map