@marktiderman/genesis-forms 0.6.0 → 0.8.0

package/dist/server.d.cts

@@ -1,6 +1,8 @@
-import { F as FieldValidator, H as HostOptions } from './validate-B5WKHbst.cjs';
-export { A as AnswerSnapshot, d as OptionSnapshot, f as RestoredAnswers, h as answerSnapshots, i as answersFromSnapshots, $ as withHostOptions } from './validate-B5WKHbst.cjs';
-import { J as Json, e as FormEvent, F as FormDefinition } from './types-oAckGR_Z.cjs';
+import { F as FieldValidator, H as HostOptions } from './validate-irIPubxc.cjs';
+export { A as AnswerSnapshot, d as OptionSnapshot, f as RestoredAnswers, h as answerSnapshots, i as answersFromSnapshots, $ as withHostOptions } from './validate-irIPubxc.cjs';
+import { J as Json, F as FormDefinition, a as FieldBlock, e as FormEvent } from './types-jqDKcmP4.cjs';
+import { S as SignedUpload } from './upload-protocol-BOe018kL.cjs';
+export { f as MAX_UPLOAD_REQUEST_BYTES, j as UploadGrant, k as UploadRefusal, l as UploadRequest } from './upload-protocol-BOe018kL.cjs';
 
 /**
  * Edit links for a sent response: `<id>.<nonce>.<expires>.<sig>`, where sig is the
@@ -18,7 +20,7 @@ import { J as Json, e as FormEvent, F as FormDefinition } from './types-oAckGR_Z
  * edit links: signing returns null and every token fails to verify.
  *
  * Web Crypto only, no storage: the app keeps the nonce and checks it. Moved up from
- * Breakthrough's src/lib/forms/edit-link.ts unchanged, so links it signed still verify.
+ * The host app's src/lib/forms/edit-link.ts unchanged, so links it signed still verify.
  */
 /** How long a new edit link works: 30 days. */
 declare const EDIT_LINK_TTL_SECONDS: number;
@@ -120,7 +122,7 @@ declare function withEditLinkHeaders(request: Request, response: Response, optio
  * and a check that fails open. The counter itself is the app's (`RateLimitStore`), so
  * every server instance can share it (a row in Postgres, a key in Redis).
  *
- * Web Crypto only. Moved up from Breakthrough's src/lib/feedback/rate-limit.server.ts;
+ * Web Crypto only. Moved up from the host app's src/lib/feedback/rate-limit.server.ts;
  * keys made here equal the ones it made, so a deploy doesn't reset anyone's count.
  */
 /**
@@ -191,6 +193,197 @@ declare function allow(store: RateLimitStore, check: {
     message?: string | undefined;
 }): Promise<boolean>;
 
+/** What the store records when an upload begins. */
+interface BeginUploadInput {
+    formId: string;
+    fieldId: string;
+    name: string;
+    contentType: string;
+    size: number;
+    /** A new response's attempt (`attemptHash` of its attempt id), or… */
+    attemptHash: string | null;
+    /** …the id of the sent response an edit link is changing. Exactly one of the two. */
+    editOf: string | null;
+}
+/** One upload as the store reads it back, with what storage holds for it. */
+interface StoredUpload {
+    id: string;
+    fieldId: string;
+    attemptHash: string | null;
+    editOf: string | null;
+    /** The response that took it, once one did. */
+    responseId: string | null;
+    name: string;
+    contentType: string;
+    size: number;
+    /** Whether the file is in storage (the respondent's browser finished sending it). */
+    stored: boolean;
+    /** The type and size storage holds, which are trusted over what the browser said. */
+    storedType: string | null;
+    storedSize: number | null;
+}
+/** What uploads need from the app's database and storage; the app's service-role client, say. */
+interface UploadStore {
+    /**
+     * Records one upload and names its object in storage; `{ tooMany: true }` once the
+     * attempt or edit has as many as the app allows (the host app: 20).
+     */
+    beginUpload(input: BeginUploadInput): Promise<{
+        id: string;
+        objectName: string;
+    } | {
+        tooMany: true;
+    }>;
+    /** Signs an upload of that object, sent to the browser as `upload` (`SignedUpload`). */
+    signUpload(objectName: string): Promise<SignedUpload>;
+    /** This form's uploads with these ids; others are left out. */
+    uploadRefs(formId: string, ids: string[]): Promise<StoredUpload[]>;
+}
+/** Who may use an upload: a new response's attempt, or an edit of a sent response. */
+type UploadOwner = {
+    attemptHash: string;
+} | {
+    responseId: string;
+};
+/** The form's upload fields (`UPLOAD_FIELD_TYPES`: photo). */
+declare function uploadFields(definition: FormDefinition): FieldBlock[];
+/** An upload field type's limits and its words for a file it doesn't take. */
+interface UploadRules {
+    maxFiles: number;
+    maxBytes: number;
+    mimeTypes: readonly string[];
+    typeMessage: string;
+    sizeMessage: string;
+    countMessage: string;
+}
+/** The rules for an upload field, or null when the field doesn't take files. */
+declare function uploadRules(field: FieldBlock): UploadRules | null;
+/** Said when a reference isn't a file this respondent finished uploading here. */
+declare const NOT_UPLOADED_MESSAGE = "A photo didn't finish uploading. Remove it and add it again.";
+interface CheckUploadsOptions {
+    /** The form's id, as the store keys its uploads. */
+    formId: string;
+    owner: UploadOwner;
+    /** Needed only when the answers name a file. */
+    store?: Pick<UploadStore, "uploadRefs"> | undefined;
+}
+type CheckedUploads = {
+    ok: true;
+    answers: Record<string, Json>;
+} | {
+    ok: false;
+    errors: Record<string, string>;
+};
+/**
+ * Checks every file the answers name: uploaded by this attempt (or for this edit) to this
+ * form's field, in storage, of a type and size the field takes, and no more files than it
+ * takes. The stored name, type and size replace what the browser sent. Answers without
+ * files are returned as they are, without asking the store. Errors are keyed by field id;
+ * a store that throws throws (answer 503: nothing can be checked).
+ */
+declare function checkUploads(definition: FormDefinition, answers: Record<string, Json>, options: CheckUploadsOptions): Promise<CheckedUploads>;
+/**
+ * The stored hash of a visit's attempt id: hex SHA-256 (Web Crypto). It equals
+ * The host app's `resumeTokenHash`, so uploads recorded before the move still match.
+ */
+declare function attemptHash(attemptId: string): Promise<string>;
+
+/** The form an upload is for, as the app found it from the request. */
+interface UploadForm {
+    /** The form's id, as the store keys uploads. */
+    id: string;
+    /** The published definition respondents answer. */
+    definition: FormDefinition;
+    /** Whether it takes responses now (not paused, closed, full…). */
+    open: boolean;
+    /** Whose rate-limit count this is: a practice, an account. */
+    scope: string;
+    /** Whether its edit links work. Default false: no uploads for an edit. */
+    allowsEdits?: boolean | undefined;
+    /** Names the form in logs, such as its slug. */
+    label?: string | undefined;
+}
+/** A sent response an edit link may change, as the app loads it. */
+interface EditableResponse {
+    id: string;
+    /** The response's current nonce: only a link made with it works. */
+    editNonce: string;
+}
+/** The handler's words; each default is what the host app said. */
+interface UploadMessages {
+    /** 415 / 400: not a JSON object. */
+    notJson: string;
+    /** 413: past `maxRequestBytes`. */
+    tooLong: string;
+    /** 400: no attempt id, or not a UUID. */
+    reload: string;
+    /** 404: `resolveForm` found no form. */
+    unavailable: string;
+    /** 409: the form isn't open. */
+    notOpen: string;
+    /** 409 (`code: "closed"`): an edit while the form isn't open. */
+    notTakingChanges: string;
+    /** 403 (`code: "bad_link"`): an edit link that doesn't check out, or a form without edits. */
+    badEditLink: string;
+    /** 400: the field isn't an upload field of this form. */
+    notUploadField: string;
+    /** 429: the rate limit. */
+    rateLimited: string;
+    /** 429 (`code: "too_many_photos"`): the store has as many uploads for this attempt or edit as it allows. */
+    tooMany: string;
+    /** 503 / 500: something failed on the server; nothing more is said. */
+    failed: string;
+}
+declare const UPLOAD_MESSAGES: UploadMessages;
+type Secret = string | null | undefined;
+interface UploadHandlerOptions<P = void> {
+    /**
+     * The form the request is for (from its host, path or `params`), or null (404). A throw
+     * answers 503 and logs the error's message.
+     */
+    resolveForm(request: Request, params: P): Promise<UploadForm | null>;
+    store: UploadStore;
+    /**
+     * Uploads for an edit link (`edit` in the request). Without it, or without a usable
+     * secret, every edit link is refused (403).
+     */
+    edit?: {
+        /** The edit-link secret, or a reader of it (`createEditSecretReader`). */
+        secret: Secret | (() => Secret);
+        /**
+         * The sent response with this id, of this form (and its scope), or null (403).
+         * A throw answers 503.
+         */
+        response(id: string, form: UploadForm): Promise<EditableResponse | null>;
+    } | undefined;
+    /** Counted per scope and client address, as `kind: "upload"`. Without it, nothing is counted. */
+    rateLimit?: {
+        store: RateLimitStore;
+        /** The server secret the address is hashed with (`rateLimitKey`). */
+        secret: string;
+        /** Default `RATE_LIMIT_DEFAULTS.upload`: 120 per 600 seconds. */
+        limit?: number | undefined;
+        windowSeconds?: number | undefined;
+        /** Default `DEFAULT_TRUSTED_IP_HEADERS`. */
+        trustedIpHeaders?: readonly string[] | undefined;
+    } | undefined;
+    /** The stored hash of an attempt id. Default `attemptHash` (hex SHA-256). */
+    hashAttempt?: ((attemptId: string) => string | Promise<string>) | undefined;
+    /** Default `MAX_UPLOAD_REQUEST_BYTES` (4,000). */
+    maxRequestBytes?: number | undefined;
+    /** The current time (tests): edit links expire. */
+    now?: (() => Date) | undefined;
+    /** Where failures are said; `console.error` with an `[upload]` prefix by default. Never sent to the browser. */
+    log?: ((message: string) => void) | undefined;
+    messages?: Partial<UploadMessages> | undefined;
+}
+/**
+ * The upload endpoint: `(request, params) => Response`, for a POST route. `params` is
+ * whatever the route has (a form slug, say), passed to `resolveForm`. See the README's
+ * "Uploads" for the JSON and every status.
+ */
+declare function createUploadHandler<P = void>(options: UploadHandlerOptions<P>): (request: Request, params: P) => Promise<Response>;
+
 interface SubmissionInput {
     /** Answers keyed by field id. Ignored when `events` is given. */
     answers?: Record<string, Json> | undefined;
@@ -278,4 +471,4 @@ declare function validateSubmission(published: FormDefinition, submission: Submi
  */
 declare function publicDefinition(definition: FormDefinition): FormDefinition;
 
-export { type CheckedSubmission, DEFAULT_TRUSTED_IP_HEADERS, EDIT_LINK_PARAM, EDIT_LINK_TTL_SECONDS, type EditLinkClaims, type EditLinkOptions, type EditLinkRequestOptions, type EditLinkUrlOptions, type EditSecretLog, type EditSecretReader, HostOptions, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, MIN_EDIT_SECRET_BYTES, RATE_LIMIT_DEFAULTS, RAW_EVENTS_PER_EVENT, type RateLimitStore, type SubmissionInput, type SubmissionOptions, type SubmissionResult, addressPrefix, allow, clientIp, createEditSecretReader, editLinkUrl, isEditLinkRequest, isUsableEditSecret, publicDefinition, rateLimitKey, signEditToken, validateSubmission, verifyEditToken, withEditLinkHeaders, withEditToken };
+export { type BeginUploadInput, type CheckUploadsOptions, type CheckedSubmission, type CheckedUploads, DEFAULT_TRUSTED_IP_HEADERS, EDIT_LINK_PARAM, EDIT_LINK_TTL_SECONDS, type EditLinkClaims, type EditLinkOptions, type EditLinkRequestOptions, type EditLinkUrlOptions, type EditSecretLog, type EditSecretReader, type EditableResponse, HostOptions, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, MIN_EDIT_SECRET_BYTES, NOT_UPLOADED_MESSAGE, RATE_LIMIT_DEFAULTS, RAW_EVENTS_PER_EVENT, type RateLimitStore, SignedUpload, type StoredUpload, type SubmissionInput, type SubmissionOptions, type SubmissionResult, UPLOAD_MESSAGES, type UploadForm, type UploadHandlerOptions, type UploadMessages, type UploadOwner, type UploadRules, type UploadStore, addressPrefix, allow, attemptHash, checkUploads, clientIp, createEditSecretReader, createUploadHandler, editLinkUrl, isEditLinkRequest, isUsableEditSecret, publicDefinition, rateLimitKey, signEditToken, uploadFields, uploadRules, validateSubmission, verifyEditToken, withEditLinkHeaders, withEditToken };

package/dist/server.d.ts

@@ -1,6 +1,8 @@
-import { F as FieldValidator, H as HostOptions } from './validate-GpTXPwyl.js';
-export { A as AnswerSnapshot, d as OptionSnapshot, f as RestoredAnswers, h as answerSnapshots, i as answersFromSnapshots, $ as withHostOptions } from './validate-GpTXPwyl.js';
-import { J as Json, e as FormEvent, F as FormDefinition } from './types-oAckGR_Z.js';
+import { F as FieldValidator, H as HostOptions } from './validate-DvfQHYnu.js';
+export { A as AnswerSnapshot, d as OptionSnapshot, f as RestoredAnswers, h as answerSnapshots, i as answersFromSnapshots, $ as withHostOptions } from './validate-DvfQHYnu.js';
+import { J as Json, F as FormDefinition, a as FieldBlock, e as FormEvent } from './types-jqDKcmP4.js';
+import { S as SignedUpload } from './upload-protocol-BUO74WkS.js';
+export { f as MAX_UPLOAD_REQUEST_BYTES, j as UploadGrant, k as UploadRefusal, l as UploadRequest } from './upload-protocol-BUO74WkS.js';
 
 /**
  * Edit links for a sent response: `<id>.<nonce>.<expires>.<sig>`, where sig is the
@@ -18,7 +20,7 @@ import { J as Json, e as FormEvent, F as FormDefinition } from './types-oAckGR_Z
  * edit links: signing returns null and every token fails to verify.
  *
  * Web Crypto only, no storage: the app keeps the nonce and checks it. Moved up from
- * Breakthrough's src/lib/forms/edit-link.ts unchanged, so links it signed still verify.
+ * The host app's src/lib/forms/edit-link.ts unchanged, so links it signed still verify.
  */
 /** How long a new edit link works: 30 days. */
 declare const EDIT_LINK_TTL_SECONDS: number;
@@ -120,7 +122,7 @@ declare function withEditLinkHeaders(request: Request, response: Response, optio
  * and a check that fails open. The counter itself is the app's (`RateLimitStore`), so
  * every server instance can share it (a row in Postgres, a key in Redis).
  *
- * Web Crypto only. Moved up from Breakthrough's src/lib/feedback/rate-limit.server.ts;
+ * Web Crypto only. Moved up from the host app's src/lib/feedback/rate-limit.server.ts;
  * keys made here equal the ones it made, so a deploy doesn't reset anyone's count.
  */
 /**
@@ -191,6 +193,197 @@ declare function allow(store: RateLimitStore, check: {
     message?: string | undefined;
 }): Promise<boolean>;
 
+/** What the store records when an upload begins. */
+interface BeginUploadInput {
+    formId: string;
+    fieldId: string;
+    name: string;
+    contentType: string;
+    size: number;
+    /** A new response's attempt (`attemptHash` of its attempt id), or… */
+    attemptHash: string | null;
+    /** …the id of the sent response an edit link is changing. Exactly one of the two. */
+    editOf: string | null;
+}
+/** One upload as the store reads it back, with what storage holds for it. */
+interface StoredUpload {
+    id: string;
+    fieldId: string;
+    attemptHash: string | null;
+    editOf: string | null;
+    /** The response that took it, once one did. */
+    responseId: string | null;
+    name: string;
+    contentType: string;
+    size: number;
+    /** Whether the file is in storage (the respondent's browser finished sending it). */
+    stored: boolean;
+    /** The type and size storage holds, which are trusted over what the browser said. */
+    storedType: string | null;
+    storedSize: number | null;
+}
+/** What uploads need from the app's database and storage; the app's service-role client, say. */
+interface UploadStore {
+    /**
+     * Records one upload and names its object in storage; `{ tooMany: true }` once the
+     * attempt or edit has as many as the app allows (the host app: 20).
+     */
+    beginUpload(input: BeginUploadInput): Promise<{
+        id: string;
+        objectName: string;
+    } | {
+        tooMany: true;
+    }>;
+    /** Signs an upload of that object, sent to the browser as `upload` (`SignedUpload`). */
+    signUpload(objectName: string): Promise<SignedUpload>;
+    /** This form's uploads with these ids; others are left out. */
+    uploadRefs(formId: string, ids: string[]): Promise<StoredUpload[]>;
+}
+/** Who may use an upload: a new response's attempt, or an edit of a sent response. */
+type UploadOwner = {
+    attemptHash: string;
+} | {
+    responseId: string;
+};
+/** The form's upload fields (`UPLOAD_FIELD_TYPES`: photo). */
+declare function uploadFields(definition: FormDefinition): FieldBlock[];
+/** An upload field type's limits and its words for a file it doesn't take. */
+interface UploadRules {
+    maxFiles: number;
+    maxBytes: number;
+    mimeTypes: readonly string[];
+    typeMessage: string;
+    sizeMessage: string;
+    countMessage: string;
+}
+/** The rules for an upload field, or null when the field doesn't take files. */
+declare function uploadRules(field: FieldBlock): UploadRules | null;
+/** Said when a reference isn't a file this respondent finished uploading here. */
+declare const NOT_UPLOADED_MESSAGE = "A photo didn't finish uploading. Remove it and add it again.";
+interface CheckUploadsOptions {
+    /** The form's id, as the store keys its uploads. */
+    formId: string;
+    owner: UploadOwner;
+    /** Needed only when the answers name a file. */
+    store?: Pick<UploadStore, "uploadRefs"> | undefined;
+}
+type CheckedUploads = {
+    ok: true;
+    answers: Record<string, Json>;
+} | {
+    ok: false;
+    errors: Record<string, string>;
+};
+/**
+ * Checks every file the answers name: uploaded by this attempt (or for this edit) to this
+ * form's field, in storage, of a type and size the field takes, and no more files than it
+ * takes. The stored name, type and size replace what the browser sent. Answers without
+ * files are returned as they are, without asking the store. Errors are keyed by field id;
+ * a store that throws throws (answer 503: nothing can be checked).
+ */
+declare function checkUploads(definition: FormDefinition, answers: Record<string, Json>, options: CheckUploadsOptions): Promise<CheckedUploads>;
+/**
+ * The stored hash of a visit's attempt id: hex SHA-256 (Web Crypto). It equals
+ * The host app's `resumeTokenHash`, so uploads recorded before the move still match.
+ */
+declare function attemptHash(attemptId: string): Promise<string>;
+
+/** The form an upload is for, as the app found it from the request. */
+interface UploadForm {
+    /** The form's id, as the store keys uploads. */
+    id: string;
+    /** The published definition respondents answer. */
+    definition: FormDefinition;
+    /** Whether it takes responses now (not paused, closed, full…). */
+    open: boolean;
+    /** Whose rate-limit count this is: a practice, an account. */
+    scope: string;
+    /** Whether its edit links work. Default false: no uploads for an edit. */
+    allowsEdits?: boolean | undefined;
+    /** Names the form in logs, such as its slug. */
+    label?: string | undefined;
+}
+/** A sent response an edit link may change, as the app loads it. */
+interface EditableResponse {
+    id: string;
+    /** The response's current nonce: only a link made with it works. */
+    editNonce: string;
+}
+/** The handler's words; each default is what the host app said. */
+interface UploadMessages {
+    /** 415 / 400: not a JSON object. */
+    notJson: string;
+    /** 413: past `maxRequestBytes`. */
+    tooLong: string;
+    /** 400: no attempt id, or not a UUID. */
+    reload: string;
+    /** 404: `resolveForm` found no form. */
+    unavailable: string;
+    /** 409: the form isn't open. */
+    notOpen: string;
+    /** 409 (`code: "closed"`): an edit while the form isn't open. */
+    notTakingChanges: string;
+    /** 403 (`code: "bad_link"`): an edit link that doesn't check out, or a form without edits. */
+    badEditLink: string;
+    /** 400: the field isn't an upload field of this form. */
+    notUploadField: string;
+    /** 429: the rate limit. */
+    rateLimited: string;
+    /** 429 (`code: "too_many_photos"`): the store has as many uploads for this attempt or edit as it allows. */
+    tooMany: string;
+    /** 503 / 500: something failed on the server; nothing more is said. */
+    failed: string;
+}
+declare const UPLOAD_MESSAGES: UploadMessages;
+type Secret = string | null | undefined;
+interface UploadHandlerOptions<P = void> {
+    /**
+     * The form the request is for (from its host, path or `params`), or null (404). A throw
+     * answers 503 and logs the error's message.
+     */
+    resolveForm(request: Request, params: P): Promise<UploadForm | null>;
+    store: UploadStore;
+    /**
+     * Uploads for an edit link (`edit` in the request). Without it, or without a usable
+     * secret, every edit link is refused (403).
+     */
+    edit?: {
+        /** The edit-link secret, or a reader of it (`createEditSecretReader`). */
+        secret: Secret | (() => Secret);
+        /**
+         * The sent response with this id, of this form (and its scope), or null (403).
+         * A throw answers 503.
+         */
+        response(id: string, form: UploadForm): Promise<EditableResponse | null>;
+    } | undefined;
+    /** Counted per scope and client address, as `kind: "upload"`. Without it, nothing is counted. */
+    rateLimit?: {
+        store: RateLimitStore;
+        /** The server secret the address is hashed with (`rateLimitKey`). */
+        secret: string;
+        /** Default `RATE_LIMIT_DEFAULTS.upload`: 120 per 600 seconds. */
+        limit?: number | undefined;
+        windowSeconds?: number | undefined;
+        /** Default `DEFAULT_TRUSTED_IP_HEADERS`. */
+        trustedIpHeaders?: readonly string[] | undefined;
+    } | undefined;
+    /** The stored hash of an attempt id. Default `attemptHash` (hex SHA-256). */
+    hashAttempt?: ((attemptId: string) => string | Promise<string>) | undefined;
+    /** Default `MAX_UPLOAD_REQUEST_BYTES` (4,000). */
+    maxRequestBytes?: number | undefined;
+    /** The current time (tests): edit links expire. */
+    now?: (() => Date) | undefined;
+    /** Where failures are said; `console.error` with an `[upload]` prefix by default. Never sent to the browser. */
+    log?: ((message: string) => void) | undefined;
+    messages?: Partial<UploadMessages> | undefined;
+}
+/**
+ * The upload endpoint: `(request, params) => Response`, for a POST route. `params` is
+ * whatever the route has (a form slug, say), passed to `resolveForm`. See the README's
+ * "Uploads" for the JSON and every status.
+ */
+declare function createUploadHandler<P = void>(options: UploadHandlerOptions<P>): (request: Request, params: P) => Promise<Response>;
+
 interface SubmissionInput {
     /** Answers keyed by field id. Ignored when `events` is given. */
     answers?: Record<string, Json> | undefined;
@@ -278,4 +471,4 @@ declare function validateSubmission(published: FormDefinition, submission: Submi
  */
 declare function publicDefinition(definition: FormDefinition): FormDefinition;
 
-export { type CheckedSubmission, DEFAULT_TRUSTED_IP_HEADERS, EDIT_LINK_PARAM, EDIT_LINK_TTL_SECONDS, type EditLinkClaims, type EditLinkOptions, type EditLinkRequestOptions, type EditLinkUrlOptions, type EditSecretLog, type EditSecretReader, HostOptions, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, MIN_EDIT_SECRET_BYTES, RATE_LIMIT_DEFAULTS, RAW_EVENTS_PER_EVENT, type RateLimitStore, type SubmissionInput, type SubmissionOptions, type SubmissionResult, addressPrefix, allow, clientIp, createEditSecretReader, editLinkUrl, isEditLinkRequest, isUsableEditSecret, publicDefinition, rateLimitKey, signEditToken, validateSubmission, verifyEditToken, withEditLinkHeaders, withEditToken };
+export { type BeginUploadInput, type CheckUploadsOptions, type CheckedSubmission, type CheckedUploads, DEFAULT_TRUSTED_IP_HEADERS, EDIT_LINK_PARAM, EDIT_LINK_TTL_SECONDS, type EditLinkClaims, type EditLinkOptions, type EditLinkRequestOptions, type EditLinkUrlOptions, type EditSecretLog, type EditSecretReader, type EditableResponse, HostOptions, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, MIN_EDIT_SECRET_BYTES, NOT_UPLOADED_MESSAGE, RATE_LIMIT_DEFAULTS, RAW_EVENTS_PER_EVENT, type RateLimitStore, SignedUpload, type StoredUpload, type SubmissionInput, type SubmissionOptions, type SubmissionResult, UPLOAD_MESSAGES, type UploadForm, type UploadHandlerOptions, type UploadMessages, type UploadOwner, type UploadRules, type UploadStore, addressPrefix, allow, attemptHash, checkUploads, clientIp, createEditSecretReader, createUploadHandler, editLinkUrl, isEditLinkRequest, isUsableEditSecret, publicDefinition, rateLimitKey, signEditToken, uploadFields, uploadRules, validateSubmission, verifyEditToken, withEditLinkHeaders, withEditToken };