@marktiderman/genesis-forms 0.7.0 → 0.8.0

package/dist/destinations.js

@@ -72,10 +72,10 @@ async function timedFetch(deps, url, init, signal) {
     throw error;
   }
 }
-async function resolveOption(what, option, config) {
+async function resolveOption(what, option, config, context = {}) {
   if (typeof option !== "function") return option;
   try {
-    return await option(config);
+    return await option(config, context);
   } catch (error) {
     if (error instanceof DeliveryError) throw error;
     throw new DeliveryError(`${what} could not be resolved`);
@@ -772,6 +772,53 @@ for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldTyp
 function own(record, key) {
   return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : void 0;
 }
+function resolve(operand, scope) {
+  if ("field" in operand) return own(scope.values, operand.field);
+  if ("hidden" in operand) return own(scope.hidden, operand.hidden);
+  return operand.value;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  return false;
+}
+function evaluate(condition, scope) {
+  if ("all" in condition) return condition.all.every((c) => evaluate(c, scope));
+  if ("any" in condition) return condition.any.some((c) => evaluate(c, scope));
+  if ("not" in condition) return !evaluate(condition.not, scope);
+  const left = resolve(condition.left, scope);
+  const right = condition.right ? resolve(condition.right, scope) : void 0;
+  const field = "field" in condition.left ? scope.fields.get(condition.left.field) : void 0;
+  const unanswered = isEmptyValue(left, field);
+  switch (condition.op) {
+    case "answered":
+      return !unanswered;
+    case "empty":
+      return unanswered;
+    case "eq":
+      return !unanswered && deepEqual(left, right);
+    case "neq":
+      return unanswered || !deepEqual(left, right);
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte": {
+      if (typeof left !== "number" || typeof right !== "number") return false;
+      if (condition.op === "lt") return left < right;
+      if (condition.op === "lte") return left <= right;
+      if (condition.op === "gt") return left > right;
+      return left >= right;
+    }
+    case "in":
+      return !unanswered && Array.isArray(right) && right.some((r) => deepEqual(r, left));
+    case "contains":
+      if (unanswered) return false;
+      if (Array.isArray(left)) return left.some((l) => deepEqual(l, right));
+      return typeof left === "string" && typeof right === "string" && left.toLowerCase().includes(right.toLowerCase());
+  }
+}
 function withheld(def, field) {
   return def.settings?.anonymous === true && field?.identifying === true;
 }
@@ -1139,9 +1186,20 @@ function sheetsDestination(options) {
   async function run(items, config, deliveryOptions) {
     if (!items.length) return { ok: true };
     const { spreadsheetId, sheetName } = configOf(config);
-    const account = await resolveOption("The sheet destination's account", options.account, config);
     const signal = deliveryOptions.signal;
-    const token = await googleAccessToken(account, { ...options, signal });
+    const context = { destinationId: deliveryOptions.destinationId };
+    let account = null;
+    let token;
+    if (options.accessToken) {
+      token = await resolveOption("The sheet destination's access token", options.accessToken, config, context);
+      if (typeof token !== "string" || !token) throw new DeliveryError("The sheet destination has no access token");
+    } else if (options.account) {
+      account = await resolveOption("The sheet destination's account", options.account, config, context);
+      token = await googleAccessToken(account, { ...options, signal });
+    } else {
+      throw new DeliveryError("The sheet destination has neither an account nor an access token");
+    }
+    const sharedWith = account ? `is the sheet shared with ${account.clientEmail}?` : "is the sheet still connected to its Google account?";
     const base = `${SHEETS_API}/${encodeURIComponent(spreadsheetId)}`;
     const escape = options.escapeFormulas === true;
     const call = async (what, url, init = {}) => {
@@ -1153,12 +1211,12 @@ function sheetsDestination(options) {
       );
       if (!response.ok) {
         discard(response);
-        if (what === "append" && (response.status === 400 || response.status === 404)) {
+        if ((what === "append" || what === "update rows") && (response.status === 400 || response.status === 404)) {
           throw new StaleSheetError(`Google Sheets append answered ${response.status}`, { status: response.status });
         }
         if (response.status === 403 || response.status === 404) {
           throw new DeliveryError(
-            `Google Sheets ${what} answered ${response.status}: is the sheet shared with ${account.clientEmail}?`,
+            `Google Sheets ${what} answered ${response.status}: ${sharedWith}`,
             { status: response.status }
           );
         }
@@ -1254,14 +1312,45 @@ function sheetsDestination(options) {
     }
     let skipped = [];
     async function append(state2) {
-      let pending = items.map((item, i) => ({ id: item.submission.id, row: rows[i].row }));
-      if (deliveryOptions.redelivery) {
+      const byId = /* @__PURE__ */ new Map();
+      items.forEach((item, i) => {
+        const id = item.submission.id;
+        const update = (item.update ?? deliveryOptions.update) === true || byId.get(id)?.update === true;
+        byId.delete(id);
+        byId.set(id, { id, row: rows[i].row, update });
+      });
+      let pending = [...byId.values()];
+      const updating = pending.some((p) => p.update);
+      const overwrite = [];
+      skipped = [];
+      if (deliveryOptions.redelivery || updating) {
         const column = columnLetter(state2.header.indexOf("id"));
-        const from = state2.last_row > 0 ? Math.max(2, state2.last_row - DEDUPE_WINDOW) : 2;
+        const from = !updating && state2.last_row > 0 ? Math.max(2, state2.last_row - DEDUPE_WINDOW) : 2;
         const ids = await call("read ids", range(`${column}${from}:${column}`));
-        const present = new Set((ids.values ?? []).map((r) => String(r?.[0] ?? "")));
-        skipped = pending.filter((p) => present.has(p.id)).map((p) => p.id);
-        pending = pending.filter((p) => !present.has(p.id));
+        const rowOf = /* @__PURE__ */ new Map();
+        (ids.values ?? []).forEach((r, i) => {
+          const id = String(r?.[0] ?? "");
+          if (id && !rowOf.has(id)) rowOf.set(id, from + i);
+        });
+        pending = pending.filter((p) => {
+          const at = rowOf.get(p.id);
+          if (at === void 0) return true;
+          if (p.update) overwrite.push({ at, row: p.row });
+          else skipped.push(p.id);
+          return false;
+        });
+      }
+      if (overwrite.length) {
+        await call("update rows", `${base}/values:batchUpdate`, {
+          method: "POST",
+          body: JSON.stringify({
+            valueInputOption: "RAW",
+            data: overwrite.map((o) => ({
+              range: `${quoteSheet(sheetName)}!A${o.at}`,
+              values: [rowFor(state2.header, o.row, escape)]
+            }))
+          })
+        });
       }
       if (!pending.length) return state2;
       const result = await call(
@@ -1296,11 +1385,147 @@ function sheetsDestination(options) {
   };
   return {
     kind: "sheet",
-    deliver: (submission, definition, config, deliveryOptions = {}) => guarded([{ submission, definition, deliveryId: deliveryOptions.deliveryId }], config, deliveryOptions),
+    deliver: (submission, definition, config, deliveryOptions = {}) => guarded(
+      [{ submission, definition, deliveryId: deliveryOptions.deliveryId, update: deliveryOptions.update }],
+      config,
+      deliveryOptions
+    ),
     deliverBatch: (items, config, deliveryOptions = {}) => guarded(items, config, deliveryOptions)
   };
 }
 
+// src/destinations/hook-url.ts
+var MAX_HOOK_URL_LENGTH = 2048;
+var SLACK_HOSTS = /* @__PURE__ */ new Set(["hooks.slack.com"]);
+var HookUrlError = class extends DeliveryError {
+  name = "HookUrlError";
+};
+var NOT_PUBLIC = "The address must be on the public internet.";
+var INTERNAL_SUFFIXES = [".localhost", ".local", ".internal", ".intranet", ".lan", ".home.arpa"];
+function ipv4Bytes(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = parts.map((p) => /^\d{1,3}$/.test(p) ? Number(p) : NaN);
+  return bytes.every((b) => Number.isInteger(b) && b >= 0 && b <= 255) ? bytes : null;
+}
+function publicIpv4(b) {
+  const [a, c] = [b[0], b[1]];
+  if (a === 0 || a === 10 || a === 127) return false;
+  if (a === 100 && c >= 64 && c <= 127) return false;
+  if (a === 169 && c === 254) return false;
+  if (a === 172 && c >= 16 && c <= 31) return false;
+  if (a === 192 && c === 168) return false;
+  if (a === 192 && c === 0 && (b[2] === 0 || b[2] === 2)) return false;
+  if (a === 198 && (c === 18 || c === 19)) return false;
+  if (a === 198 && c === 51 && b[2] === 100) return false;
+  if (a === 203 && c === 0 && b[2] === 113) return false;
+  if (a >= 224) return false;
+  return true;
+}
+function ipv6Bytes(ip) {
+  let text = ip.replace(/^\[|\]$/g, "").toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  let tail = [];
+  const lastColon = text.lastIndexOf(":");
+  if (text.slice(lastColon + 1).includes(".")) {
+    const v4 = ipv4Bytes(text.slice(lastColon + 1));
+    if (!v4) return null;
+    tail = v4;
+    text = text.slice(0, lastColon + 1) + "0:0";
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const groups = (s) => s === "" ? [] : s.split(":");
+  const head = groups(halves[0]);
+  const rest = halves.length === 2 ? groups(halves[1]) : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 1 ? missing !== 0 : missing < 1) return null;
+  const all = [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest];
+  const bytes = [];
+  for (const g of all) {
+    if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+    const n = parseInt(g, 16);
+    bytes.push(n >> 8, n & 255);
+  }
+  if (tail.length) bytes.splice(12, 4, ...tail);
+  return bytes;
+}
+function publicIpv6(b) {
+  const zeros = (from, to) => b.slice(from, to).every((x) => x === 0);
+  if (zeros(0, 16)) return false;
+  if (zeros(0, 15) && b[15] === 1) return false;
+  if (zeros(0, 10) && b[10] === 255 && b[11] === 255) return publicIpv4(b.slice(12));
+  if (zeros(0, 12)) return publicIpv4(b.slice(12));
+  if (b[0] === 0 && b[1] === 100 && b[2] === 255 && b[3] === 155 && zeros(4, 12)) return publicIpv4(b.slice(12));
+  if ((b[0] & 254) === 252) return false;
+  if (b[0] === 254 && (b[1] & 192) === 128) return false;
+  if (b[0] === 254 && (b[1] & 192) === 192) return false;
+  if (b[0] === 255) return false;
+  if (b[0] === 32 && b[1] === 1 && b[2] === 13 && b[3] === 184) return false;
+  if (b[0] === 32 && b[1] === 1 && b[2] === 0 && b[3] === 0) return false;
+  if (b[0] === 32 && b[1] === 2) return publicIpv4(b.slice(2, 6));
+  if (b[0] === 1 && zeros(1, 8)) return false;
+  return true;
+}
+function isPublicAddress(ip) {
+  const v4 = ipv4Bytes(ip);
+  if (v4) return publicIpv4(v4);
+  const v6 = ipv6Bytes(ip);
+  return v6 ? publicIpv6(v6) : false;
+}
+function isIpLiteral(host) {
+  return ipv4Bytes(host) !== null || host.startsWith("[");
+}
+function parseHookUrl(raw, kind = "webhook") {
+  const text = raw.trim();
+  if (!text) throw new HookUrlError("Paste the address to send responses to.");
+  if (text.length > MAX_HOOK_URL_LENGTH) throw new HookUrlError("That address is too long.");
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new HookUrlError("That doesn't look like a web address.");
+  }
+  if (url.protocol !== "https:") throw new HookUrlError("The address must start with https://.");
+  if (url.username || url.password) throw new HookUrlError("The address can't include a user name or password.");
+  if (url.port && url.port !== "443") throw new HookUrlError("The address must use the standard https port.");
+  url.hash = "";
+  const host = url.hostname.replace(/\.$/, "");
+  if (kind === "slack") {
+    if (!SLACK_HOSTS.has(host) || !url.pathname.startsWith("/services/")) {
+      throw new HookUrlError("Use a Slack incoming webhook address, which starts with https://hooks.slack.com/services/.");
+    }
+    return url;
+  }
+  if (isIpLiteral(host)) {
+    if (!isPublicAddress(host)) throw new HookUrlError(NOT_PUBLIC);
+    return url;
+  }
+  if (!host.includes(".") || host === "localhost" || INTERNAL_SUFFIXES.some((suffix) => host.endsWith(suffix))) {
+    throw new HookUrlError(NOT_PUBLIC);
+  }
+  return url;
+}
+async function checkHookHost(url, resolve2) {
+  const host = url.hostname.replace(/\.$/, "");
+  if (isIpLiteral(host)) {
+    if (!isPublicAddress(host)) throw new HookUrlError(NOT_PUBLIC);
+    return;
+  }
+  let addresses;
+  try {
+    addresses = await resolve2(host);
+  } catch {
+    throw new HookUrlError(`${host} couldn't be found`, { retryable: true });
+  }
+  if (!addresses.length) throw new HookUrlError(`${host} couldn't be found`, { retryable: true });
+  if (!addresses.every(isPublicAddress)) throw new HookUrlError(NOT_PUBLIC);
+}
+function hookHost(url) {
+  return url.hostname.replace(/\.$/, "").toLowerCase();
+}
+
 // src/destinations/webhook.ts
 var MIN_SECRET_BYTES = 16;
 var STRICT_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
@@ -1318,6 +1543,9 @@ function secretKey(secret) {
 async function hmacKey(secret, usage) {
   return crypto.subtle.importKey("raw", secretKey(secret), { name: "HMAC", hash: "SHA-256" }, false, [usage]);
 }
+function newWebhookSecret() {
+  return `whsec_${base64(crypto.getRandomValues(new Uint8Array(32)))}`;
+}
 async function signWebhook(secret, id, timestamp, body) {
   const key = await hmacKey(secret, "sign");
   const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${id}.${timestamp}.${body}`));
@@ -1440,15 +1668,17 @@ function webhookDestination(options) {
     kind: "webhook",
     async deliver(submission, definition, config, deliveryOptions = {}) {
       try {
-        const url = checkWebhookUrl(configString(config, "url"), options);
-        const secret = await resolveOption("The webhook secret", options.secret, config);
+        const context = { destinationId: deliveryOptions.destinationId };
+        const raw = options.url ? await resolveOption("The webhook url", options.url, config, context) : configString(config, "url");
+        const url = checkWebhookUrl(typeof raw === "string" ? raw.trim() : "", options);
+        if (options.resolveHost && !options.allowPrivateHosts) await checkHookHost(url, options.resolveHost);
+        const secret = await resolveOption("The webhook secret", options.secret, config, context);
         if (!secret) throw new DeliveryError("The webhook secret is not set");
         const now = options.now?.() ?? Date.now();
         const id = deliveryOptions.deliveryId ?? submission.id;
         const timestamp = Math.floor(now / 1e3);
-        const body = JSON.stringify(
-          webhookPayload(submission, definition, { sensitive: options.sensitive, type: options.type, now })
-        );
+        const type = options.type ?? (deliveryOptions.update ? "form.updated" : void 0);
+        const body = JSON.stringify(webhookPayload(submission, definition, { sensitive: options.sensitive, type, now }));
         const response = await timedFetch(
           options,
           url.toString(),
@@ -1481,6 +1711,386 @@ function webhookDestination(options) {
   };
 }
 
-export { DEDUPE_WINDOW, DEFAULT_SHEET_NAME, DeliveryError, GOOGLE_TOKEN_URL, HEADER_SCAN_ROWS, MAX_RECIPIENTS, REQUEST_TIMEOUT_MS, RESEND_API, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, answerCell, checkWebhookUrl, clearGoogleTokenCache, columnLetter, deliveryFailure, emailBody, emailDestination, escapeFormula, escapeHtml, googleAccessToken, headerSafe, httpError, idempotencyKey, isPrivateHost, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sheetsDestination, signJwt, signWebhook, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
+// src/destinations/slack.ts
+var SLACK_VALUE_LIMIT = 1500;
+function escapeSlack(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var cut = (text) => text.length > SLACK_VALUE_LIMIT ? `${text.slice(0, SLACK_VALUE_LIMIT)}\u2026` : text;
+function slackMessage(submission, definition, options = {}) {
+  const title = definition.title || definition.id;
+  const heading = options.heading ?? `${options.update ? "Updated response" : "New response"}: ${title}`;
+  const lines = [`*${escapeSlack(heading)}*`];
+  for (const [label, value] of options.lines ?? []) {
+    if (value.trim()) lines.push(`*${escapeSlack(label)}*: ${escapeSlack(cut(value))}`);
+  }
+  const { row, labels } = responseRow(submission, definition, { sensitive: options.sensitive ?? "mask" });
+  const omit = new Set(options.omit ?? []);
+  let answered = 0;
+  for (const [key, label] of Object.entries(labels)) {
+    const text = String(row[key] ?? "");
+    if (!text || omit.has(key)) continue;
+    answered++;
+    lines.push(`*${escapeSlack(label || key)}*: ${escapeSlack(cut(text))}`);
+  }
+  if (!answered) lines.push("_No answers._");
+  const when = submission.submittedAt ? ` \xB7 ${escapeSlack(submission.submittedAt)}` : "";
+  const link = options.link;
+  lines.push(
+    link && /^https?:\/\//i.test(link.url) ? `<${link.url.replace(/[<>|]/g, "")}|${escapeSlack(link.text ?? "Open the response").replace(/[|]/g, "")}>${when}` : `Response ${escapeSlack(submission.id)}${when}`
+  );
+  return { text: lines.join("\n") };
+}
+function slackDestination(options = {}) {
+  return {
+    kind: "slack",
+    async deliver(submission, definition, config, deliveryOptions = {}) {
+      try {
+        const context = { destinationId: deliveryOptions.destinationId };
+        const raw = options.url ? await resolveOption("The Slack webhook url", options.url, config, context) : configString(config, "url");
+        if (typeof raw !== "string" || !raw.trim()) throw new DeliveryError("The Slack destination has no url");
+        const url = parseHookUrl(raw, "slack");
+        if (options.resolveHost) await checkHookHost(url, options.resolveHost);
+        const update = deliveryOptions.update === true;
+        const messageOptions = options.message ? await resolveOption(
+          "The Slack message",
+          () => options.message({ submission, definition, config, update, destinationId: deliveryOptions.destinationId }),
+          config
+        ) : {};
+        const body = JSON.stringify(slackMessage(submission, definition, { update, ...messageOptions }));
+        const response = await timedFetch(
+          options,
+          url.toString(),
+          {
+            method: "POST",
+            redirect: "manual",
+            headers: { "content-type": "application/json", "user-agent": "genesis-forms-slack/1" },
+            body
+          },
+          deliveryOptions.signal
+        );
+        discard(response);
+        if (response.status >= 200 && response.status < 300) return { ok: true };
+        if (response.status === 0 || response.status >= 300 && response.status < 400) {
+          throw new DeliveryError(`Slack answered ${response.status || "a redirect"}: redirects are not followed`, {
+            ...response.status ? { status: response.status } : {}
+          });
+        }
+        throw httpError("Slack", response);
+      } catch (error) {
+        return deliveryFailure(error);
+      }
+    }
+  };
+}
+
+// src/destinations/condition.ts
+var OPERATORS = /* @__PURE__ */ new Set(["eq", "neq", "lt", "lte", "gt", "gte", "in", "contains", "answered", "empty"]);
+var MAX_CONDITION_DEPTH = 10;
+var isObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function isOperand(v) {
+  if (!isObject2(v)) return false;
+  const keys = Object.keys(v);
+  if (keys.length !== 1) return false;
+  if (keys[0] === "field" || keys[0] === "hidden") return typeof v[keys[0]] === "string";
+  return keys[0] === "value";
+}
+function isCondition(v, depth = 0) {
+  if (!isObject2(v) || depth > MAX_CONDITION_DEPTH) return false;
+  if ("all" in v) return Array.isArray(v["all"]) && v["all"].every((c) => isCondition(c, depth + 1));
+  if ("any" in v) return Array.isArray(v["any"]) && v["any"].every((c) => isCondition(c, depth + 1));
+  if ("not" in v) return isCondition(v["not"], depth + 1);
+  return typeof v["op"] === "string" && OPERATORS.has(v["op"]) && isOperand(v["left"]) && (v["right"] === void 0 || isOperand(v["right"]));
+}
+function conditionOf(config) {
+  const when = config["when"];
+  if (when === void 0 || when === null) return null;
+  if (!isCondition(when)) throw new DeliveryError("The destination's condition can't be read");
+  return when;
+}
+function passesCondition(submission, definition, config) {
+  const condition = conditionOf(config);
+  if (!condition) return true;
+  const fields = /* @__PURE__ */ new Map();
+  for (const block of definition.blocks) if (block.kind === "field") fields.set(block.id, block);
+  const hidden = /* @__PURE__ */ Object.create(null);
+  for (const source of [submission.hidden, submission.context]) {
+    for (const name of Object.keys(source ?? {})) {
+      const value = own(source, name);
+      if (value !== void 0) hidden[name] = value;
+    }
+  }
+  return evaluate(condition, { values: submission.answers, hidden, fields });
+}
+
+// src/destinations/google-oauth.ts
+var DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+async function refreshGoogleAccessToken(client, refreshToken, options = {}) {
+  if (!client.clientId || !client.clientSecret) throw new DeliveryError("The Google OAuth client id or secret is not set");
+  if (!refreshToken) throw new DeliveryError("This sheet's Google connection is gone. Connect the sheet again.");
+  const response = await timedFetch(
+    options,
+    GOOGLE_TOKEN_URL,
+    {
+      method: "POST",
+      // The body holds the refresh token and client secret: never follow a redirect with it.
+      redirect: "error",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: client.clientId,
+        client_secret: client.clientSecret
+      }).toString()
+    },
+    options.signal
+  );
+  if (!response.ok) {
+    const body2 = jsonObject(await response.json().catch(() => null));
+    if (response.status === 400 && body2.error === "invalid_grant") {
+      throw new DeliveryError("Google access to this sheet was removed. Connect the sheet again.", { status: 400 });
+    }
+    discard(response);
+    throw httpError("Google token endpoint", response);
+  }
+  const body = jsonObject(await response.json().catch(() => null));
+  if (typeof body.access_token !== "string" || !body.access_token) {
+    throw new DeliveryError("Google token endpoint returned no access token", { retryable: true });
+  }
+  return {
+    accessToken: body.access_token,
+    expiresIn: typeof body.expires_in === "number" && body.expires_in > 0 ? body.expires_in : 3600,
+    scope: typeof body.scope === "string" ? body.scope : DRIVE_FILE_SCOPE
+  };
+}
+function jsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+var cache2 = /* @__PURE__ */ new Map();
+function clearGoogleOAuthTokenCache() {
+  cache2.clear();
+}
+async function googleOAuthAccessToken(client, refreshToken, options = {}) {
+  if (!refreshToken) throw new DeliveryError("This sheet's Google connection is gone. Connect the sheet again.");
+  const now = options.now?.() ?? Date.now();
+  const key = await sha256Hex(`${client.clientId}
+${refreshToken}`);
+  const hit = cache2.get(key);
+  if (hit && hit.expiresAt - 6e4 > now) return hit.token;
+  const fresh = await refreshGoogleAccessToken(client, refreshToken, options);
+  cache2.set(key, { token: fresh.accessToken, expiresAt: now + fresh.expiresIn * 1e3 });
+  return fresh.accessToken;
+}
+
+// src/destinations/secret-box.ts
+var enc = new TextEncoder();
+function secretKeyBytes(key) {
+  if (typeof key !== "string") {
+    if (key.length !== 32) throw new DeliveryError("The encryption key must be 32 bytes");
+    return new Uint8Array(key);
+  }
+  const text = key.trim().replace(/=+$/, "");
+  if (!text) throw new DeliveryError("The encryption key is not set");
+  let bytes;
+  try {
+    bytes = fromBase64(text + "=".repeat((4 - text.length % 4) % 4));
+  } catch {
+    throw new DeliveryError("The encryption key is not base64");
+  }
+  if (bytes.length !== 32) throw new DeliveryError("The encryption key must be 32 bytes");
+  return bytes;
+}
+async function deriveSecretKey(key, info) {
+  if (!info) throw new DeliveryError("A sealing key needs its purpose (info)");
+  const base = await crypto.subtle.importKey("raw", secretKeyBytes(key), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc.encode(info) },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function sealSecret(key, plaintext, aad) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const sealed = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: enc.encode(aad) }, key, enc.encode(plaintext));
+  return `v1.${base64url(iv)}.${base64url(new Uint8Array(sealed))}`;
+}
+async function openSecret(key, sealed, aad) {
+  const [version, iv, body, extra] = sealed.split(".");
+  if (version !== "v1" || !iv || !body || extra !== void 0) throw new DeliveryError("The stored secret is not in a known format");
+  try {
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: padded(iv), additionalData: enc.encode(aad) },
+      key,
+      padded(body)
+    );
+    return new TextDecoder().decode(plain);
+  } catch {
+    throw new DeliveryError("The stored secret could not be decrypted");
+  }
+}
+function padded(text) {
+  return fromBase64(text + "=".repeat((4 - text.length % 4) % 4));
+}
+
+// src/destinations/runner.ts
+var DEFAULT_MAX_ATTEMPTS = 8;
+var DEFAULT_MAX_DEFERRALS = 24;
+var DEFAULT_BATCH_SIZE = 25;
+function defaultBackoff(attempt) {
+  return Math.min(6 * 3600, 60 * 2 ** Math.max(0, attempt - 1));
+}
+function deliveryOutcome(result, attempt, options = {}) {
+  if (result.ok) return result.notSent ? { status: "skipped", reason: result.notSent.slice(0, 500) } : { status: "sent" };
+  const http = result.status !== void 0 ? { httpStatus: result.status } : {};
+  if (!result.retryable) return { status: "failed", error: result.error, ...http };
+  const now = options.now ?? Date.now();
+  if (result.retryAfterSeconds !== void 0 && (options.deferrals ?? 0) < (options.maxDeferrals ?? DEFAULT_MAX_DEFERRALS)) {
+    const seconds2 = Math.max(1, Math.ceil(result.retryAfterSeconds));
+    return { status: "retry", error: result.error, retryAt: new Date(now + seconds2 * 1e3), retryAfterSeconds: seconds2, counted: false, ...http };
+  }
+  const max = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  if (attempt >= max) return { status: "failed", error: `${result.error} (gave up after ${attempt} attempts)`.slice(0, 500), ...http };
+  const seconds = Math.max(1, Math.ceil((options.backoff ?? defaultBackoff)(attempt)));
+  return { status: "retry", error: result.error, retryAt: new Date(now + seconds * 1e3), retryAfterSeconds: seconds, counted: true, ...http };
+}
+function createDeliveryRunner(options) {
+  const log = (message) => {
+    try {
+      options.log?.(message);
+    } catch {
+    }
+  };
+  const now = () => options.now?.() ?? Date.now();
+  async function send(group, signal) {
+    const first = group[0];
+    const destination = options.destinations[first.kind];
+    if (!destination) {
+      return group.map(() => ({ ok: false, retryable: false, error: `No destination for kind ${first.kind}` }));
+    }
+    const results = group.map((d) => {
+      try {
+        return passesCondition(d.submission, d.definition, d.config) ? null : "filtered";
+      } catch (error) {
+        return deliveryFailure(error);
+      }
+    });
+    const due = group.filter((_, i) => results[i] === null);
+    let state = first.state;
+    const keep = (result) => {
+      if (result.ok && result.state) state = result.state;
+    };
+    const guard = async (call) => {
+      try {
+        return await call();
+      } catch (error) {
+        return deliveryFailure(error);
+      }
+    };
+    const base = { state, signal, destinationId: first.destinationId };
+    let sent;
+    if (due.length > 1 && destination.deliverBatch) {
+      const items = due.map((d) => ({ submission: d.submission, definition: d.definition, deliveryId: d.id, update: d.update }));
+      const result = await guard(
+        () => destination.deliverBatch(items, first.config, { ...base, redelivery: due.some((d) => d.redelivery) })
+      );
+      keep(result);
+      sent = due.map(() => result);
+    } else {
+      sent = [];
+      for (const d of due) {
+        const result = await guard(
+          () => destination.deliver(d.submission, d.definition, d.config, {
+            ...base,
+            state,
+            deliveryId: d.id,
+            redelivery: d.redelivery,
+            update: d.update
+          })
+        );
+        keep(result);
+        sent.push(result);
+      }
+    }
+    if (state !== first.state && state && options.saveState) {
+      try {
+        await options.saveState(first.destinationId, state);
+      } catch {
+        log(`Saving destination ${first.destinationId}'s state failed`);
+      }
+    }
+    let next = 0;
+    return results.map((r) => r ?? sent[next++]);
+  }
+  return {
+    async run(runOptions = {}) {
+      const report = {
+        claimed: 0,
+        sent: 0,
+        filtered: 0,
+        skipped: 0,
+        retrying: 0,
+        deferred: 0,
+        failed: 0,
+        stale: 0,
+        unrecorded: 0
+      };
+      const limit = runOptions.limit ?? options.batchSize ?? DEFAULT_BATCH_SIZE;
+      const claimed = await options.claim({ limit, filter: runOptions.filter });
+      report.claimed = claimed.length;
+      const groups = /* @__PURE__ */ new Map();
+      for (const delivery of claimed) {
+        const list = groups.get(delivery.destinationId) ?? [];
+        list.push(delivery);
+        groups.set(delivery.destinationId, list);
+      }
+      await Promise.all(
+        [...groups.values()].map(async (group) => {
+          const results = await send(group, runOptions.signal);
+          const at = now();
+          await Promise.all(
+            group.map(async (delivery, i) => {
+              const result = results[i];
+              const outcome = result === "filtered" ? { status: "filtered" } : deliveryOutcome(result, delivery.attempt, {
+                now: at,
+                maxAttempts: options.maxAttempts,
+                backoff: options.backoff,
+                deferrals: delivery.deferrals,
+                maxDeferrals: options.maxDeferrals
+              });
+              if (outcome.status === "sent" && result !== "filtered" && result.ok && result.skipped?.includes(delivery.submission.id)) {
+                outcome.alreadyThere = true;
+              }
+              if (outcome.status === "failed" || outcome.status === "retry") {
+                log(`Delivery ${delivery.id} (${delivery.kind}) ${outcome.status === "failed" ? "failed" : "will be retried"}: ${outcome.error}`);
+              } else if (outcome.status === "skipped") {
+                log(`Delivery ${delivery.id} (${delivery.kind}) skipped: ${outcome.reason}`);
+              }
+              let recorded;
+              try {
+                recorded = await options.record(delivery, outcome);
+              } catch {
+                report.unrecorded++;
+                log(`Recording delivery ${delivery.id} failed`);
+                return;
+              }
+              if (recorded === false) report.stale++;
+              else if (outcome.status === "sent") report.sent++;
+              else if (outcome.status === "filtered") report.filtered++;
+              else if (outcome.status === "skipped") report.skipped++;
+              else if (outcome.status === "failed") report.failed++;
+              else if (outcome.counted) report.retrying++;
+              else report.deferred++;
+            })
+          );
+        })
+      );
+      return report;
+    }
+  };
+}
+
+export { DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, GOOGLE_TOKEN_URL, HEADER_SCAN_ROWS, HookUrlError, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, REQUEST_TIMEOUT_MS, RESEND_API, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
 //# sourceMappingURL=destinations.js.map
 //# sourceMappingURL=destinations.js.map