@marktiderman/genesis-forms 0.7.0 → 0.9.0

package/dist/destinations.js

@@ -4,9 +4,12 @@ var DeliveryError = class extends Error {
   retryable;
   retryAfterSeconds;
   status;
+  /** The receiver asked to be switched off (`DeliveryFailure.disable`); never retryable. */
+  disable;
   constructor(message, options = {}) {
     super(message);
-    this.retryable = options.retryable ?? false;
+    this.disable = options.disable ?? false;
+    this.retryable = !this.disable && (options.retryable ?? false);
     this.retryAfterSeconds = options.retryAfterSeconds;
     this.status = options.status;
   }
@@ -47,7 +50,8 @@ function deliveryFailure(error) {
       retryable: error.retryable,
       error: error.message.slice(0, 500),
       ...error.retryAfterSeconds !== void 0 ? { retryAfterSeconds: error.retryAfterSeconds } : {},
-      ...error.status !== void 0 ? { status: error.status } : {}
+      ...error.status !== void 0 ? { status: error.status } : {},
+      ...error.disable ? { disable: true } : {}
     };
   }
   const name = error instanceof Error ? error.name : "";
@@ -72,10 +76,10 @@ async function timedFetch(deps, url, init, signal) {
     throw error;
   }
 }
-async function resolveOption(what, option, config) {
+async function resolveOption(what, option, config, context = {}) {
   if (typeof option !== "function") return option;
   try {
-    return await option(config);
+    return await option(config, context);
   } catch (error) {
     if (error instanceof DeliveryError) throw error;
     throw new DeliveryError(`${what} could not be resolved`);
@@ -112,6 +116,12 @@ async function sha256Hex(text) {
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
+// src/props-check.ts
+new Set(Object.getOwnPropertyNames(Object.prototype));
+var isPlainRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isWholeNumber = (v) => typeof v === "number" && Number.isInteger(v);
+var isFiniteNumber = (v) => typeof v === "number" && Number.isFinite(v);
+
 // src/calculated.ts
 var CALCULATED_TYPE = "calculated";
 var MAX_CALCULATED_DECIMALS = 10;
@@ -140,6 +150,17 @@ var calculatedFieldType = {
   value: { json: true },
   operators: numberOps,
   a11y: { semantics: "control" },
+  // A number, unless the format says text; without a format it can hold either, so it isn't known.
+  literal: (props) => props.format === "text" ? "string" : props.format === "number" || props.format === "percent" ? "number" : void 0,
+  // The formula itself is checked once every key is known (`parseForm`).
+  checkProps: (props, check) => {
+    if (props.format !== void 0 && props.format !== "number" && props.format !== "percent" && props.format !== "text") {
+      check.issue("format", "Must be number, percent or text.");
+    }
+    if (props.decimals !== void 0 && !(isWholeNumber(props.decimals) && props.decimals >= 0 && props.decimals <= MAX_CALCULATED_DECIMALS)) {
+      check.issue("decimals", `Must be a whole number from 0 to ${MAX_CALCULATED_DECIMALS}.`);
+    }
+  },
   // The engine works the value out; any number, text or true / false it made is valid.
   validate: (value) => typeof value === "number" || typeof value === "string" || typeof value === "boolean" ? null : "This value is worked out from other answers.",
   summarize: (value, field) => formatCalculated(value, field)
@@ -163,6 +184,7 @@ function listLimits(field) {
   return { min: optionalIntProp(field, "min") ?? 0, max: intProp(field, "max", 10), itemMaxLength: intProp(field, "itemMaxLength", 500) };
 }
 var listItems = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.trim() !== "") : [];
+var MAX_TABLE_COLUMNS = 6;
 var MAX_TABLE_CELL_LENGTH = 2e3;
 function tableColumns(field) {
   const raw = field.props?.columns;
@@ -196,12 +218,42 @@ var MAX_HIGHLIGHT_NOTE_LENGTH = 1e3;
 var MAX_HIGHLIGHT_QUOTE_LENGTH = 2e3;
 var HIGHLIGHT_NOTE_MESSAGE = "Add a note to each highlight.";
 var sourceText = (field) => typeof field.props?.text === "string" && field.props.text ? field.props.text : void 0;
+var listProps = (props, check) => {
+  check.optionalInt(props.min, "min", 0);
+  check.optionalInt(props.max, "max", 1);
+  check.optionalInt(props.itemMaxLength, "itemMaxLength", 1);
+  check.optionalText(props.placeholder, "placeholder");
+  check.ordered(props.min, props.max ?? 10, "min", "most items");
+};
+var tableProps = (props, check) => {
+  const columns = props.columns;
+  if (!Array.isArray(columns) || columns.length < 1 || columns.length > MAX_TABLE_COLUMNS) {
+    check.issue("columns", `Must be a list of 1 to ${MAX_TABLE_COLUMNS} columns.`);
+  } else {
+    const seen = /* @__PURE__ */ new Set();
+    columns.forEach((c, j) => {
+      const at = `columns[${j}]`;
+      if (!isPlainRecord(c)) return check.issue(at, "Each column needs a key and a label.");
+      if (check.name(c.key, `${at}.key`, "A column key")) {
+        if (seen.has(c.key)) check.issue(`${at}.key`, `Duplicate column key "${c.key}".`);
+        seen.add(c.key);
+      }
+      check.text(c.label, `${at}.label`);
+      check.optionalBoolean(c.long, `${at}.long`);
+    });
+  }
+  check.optionalInt(props.minRows, "minRows", 0);
+  check.optionalInt(props.maxRows, "maxRows", 1);
+  check.ordered(props.minRows, props.maxRows ?? 3, "minRows", "most rows");
+};
 var structuredFieldTypes = [
   {
     type: "list",
     label: "List",
     category: "text",
     value: { json: true },
+    literal: "string",
+    checkProps: listProps,
     // logic.ts `contains` on an array is exact item equality, same as multi-choice, so it is offered.
     operators: ["contains", "answered", "empty"],
     a11y: { semantics: "group" },
@@ -227,6 +279,7 @@ var structuredFieldTypes = [
     label: "Table",
     category: "advanced",
     value: { json: true },
+    checkProps: tableProps,
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, (r) => isObject(r) && Object.values(r).every(blankText)),
@@ -270,6 +323,10 @@ var structuredFieldTypes = [
     label: "Notes at moments",
     category: "media",
     value: { json: true },
+    checkProps: (props, check) => {
+      check.optionalInt(props.maxNotes, "maxNotes", 1);
+      check.optionalInt(props.textMaxLength, "textMaxLength", 1);
+    },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, (n) => isObject(n) && blankText(n.text)),
@@ -293,6 +350,10 @@ var structuredFieldTypes = [
     label: "Highlights",
     category: "media",
     value: { json: true },
+    checkProps: (props, check) => {
+      check.optionalText(props.text, "text");
+      check.optionalInt(props.maxHighlights, "maxHighlights", 1);
+    },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, () => false),
@@ -342,6 +403,7 @@ var DEFAULT_PHOTO_SIZE_MB = 10;
 var MAX_PHOTO_SIZE_MB = 25;
 var MAX_PHOTO_ID_LENGTH = 200;
 var MAX_PHOTO_NAME_LENGTH = 255;
+var isPhotoFormat = (v) => typeof v === "string" && Object.prototype.hasOwnProperty.call(PHOTO_FORMATS, v);
 var wholeIn = (v, min, max) => typeof v === "number" && Number.isInteger(v) && v >= min && v <= max;
 function photoLimits(field) {
   const maxFiles = wholeIn(field.props?.maxFiles, 1, MAX_PHOTO_FILES) ? field.props.maxFiles : DEFAULT_PHOTO_FILES;
@@ -383,6 +445,22 @@ var photoFieldType = {
   value: { json: true },
   operators: ["answered", "empty"],
   a11y: { semantics: "group" },
+  checkProps: (props, check) => {
+    if (props.maxFiles !== void 0 && !(isWholeNumber(props.maxFiles) && props.maxFiles >= 1 && props.maxFiles <= MAX_PHOTO_FILES)) {
+      check.issue("maxFiles", `Must be a whole number from 1 to ${MAX_PHOTO_FILES}.`);
+    }
+    if (props.maxSizeMb !== void 0 && !(isWholeNumber(props.maxSizeMb) && props.maxSizeMb >= 1 && props.maxSizeMb <= MAX_PHOTO_SIZE_MB)) {
+      check.issue("maxSizeMb", `Must be a whole number from 1 to ${MAX_PHOTO_SIZE_MB}.`);
+    }
+    if (props.formats !== void 0) {
+      const formats = props.formats;
+      if (!Array.isArray(formats) || formats.length === 0 || !formats.every(isPhotoFormat)) {
+        check.issue("formats", "Must be a list of one or more of jpeg, png, heic and webp.");
+      } else if (new Set(formats).size !== formats.length) {
+        check.issue("formats", "Name each format once.");
+      }
+    }
+  },
   isEmpty: (value) => value === void 0 || value === null || Array.isArray(value) && value.length === 0,
   validate: (value, field) => {
     if (!Array.isArray(value) || !value.every(isPhotoRef)) return "Add a photo.";
@@ -400,22 +478,37 @@ var photoFieldType = {
 };
 
 // src/fields.ts
-var REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/field-types");
+var REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/field-types@2");
+var BUILT_IN = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/built-in-field-types@2");
 var globalScope = globalThis;
 var registry = globalScope[REGISTRY] ??= /* @__PURE__ */ new Map();
-function registerFieldType(manifest) {
-  if (!manifest.type) throw new Error("registerFieldType: a field type needs a `type`.");
-  const value = manifest.value;
-  if (!value.json && (typeof value.serialize !== "function" || typeof value.deserialize !== "function")) {
-    throw new Error(
-      `registerFieldType: "${manifest.type}" stores a non-JSON value, so it must provide both serialize and deserialize.`
-    );
+var builtIn = globalScope[BUILT_IN] ??= /* @__PURE__ */ new Set();
+var freezeRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? Object.freeze({ ...v }) : v;
+function frozen(manifest) {
+  const copy = { ...manifest };
+  for (const key of ["choice", "a11y", "value"]) if (key in copy) copy[key] = freezeRecord(copy[key]);
+  if (Array.isArray(copy.operators)) {
+    const operators = Object.freeze([...copy.operators]);
+    Object.defineProperty(copy, "operators", { get: () => [...operators], enumerable: true });
   }
-  registry.set(manifest.type, manifest);
+  return Object.freeze(copy);
+}
+function registerBuiltIn(manifest) {
+  builtIn.add(manifest.type);
+  if (!registry.has(manifest.type)) registry.set(manifest.type, frozen(manifest));
 }
 function getFieldType(type) {
   return registry.get(type);
 }
+var CONTENT_REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/content-types@1");
+var contentScope = globalThis;
+var contentRegistry = contentScope[CONTENT_REGISTRY] ??= /* @__PURE__ */ new Map();
+for (const manifest of [
+  { type: "heading", label: "Heading" },
+  { type: "text", label: "Text" }
+]) {
+  if (!contentRegistry.has(manifest.type)) contentRegistry.set(manifest.type, frozen(manifest));
+}
 function isEmptyValue(value, field) {
   const manifest = field ? registry.get(field.type) : void 0;
   if (manifest?.isEmpty) return manifest.isEmpty(value);
@@ -548,6 +641,18 @@ function isPhoneNumber(value) {
   }
   return digits >= 7 && digits <= 15;
 }
+var oneOptionValidate = (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.";
+var oneOptionSummary = (value, field) => optionLabel(field, String(value));
+var optionsValidate = (value, field) => {
+  const allowed = new Set(choiceOptions(field).map((o) => o.value));
+  const others = Array.isArray(value) ? value.filter((v) => typeof v === "string" && !allowed.has(v)) : [];
+  return Array.isArray(value) && new Set(value).size === value.length && value.every((v) => typeof v === "string") && (others.length === 0 || others.length === 1 && typedOther(field, others[0])) ? null : "Choose from the options.";
+};
+var optionsSummary = (value, field) => Array.isArray(value) ? value.map((v) => optionLabel(field, String(v))).join(", ") : String(value);
+var scaleProps = (props, check) => {
+  check.optionalText(props.lowLabel, "lowLabel");
+  check.optionalText(props.highLabel, "highLabel");
+};
 var builtins = [
   {
     type: "short-text",
@@ -556,6 +661,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control" },
+    literal: "string",
     validate: textValidate(500)
   },
   {
@@ -565,6 +671,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control" },
+    literal: "string",
     validate: textValidate(5e3)
   },
   {
@@ -574,6 +681,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control", autocomplete: "email", inputMode: "email" },
+    literal: "string",
     validate: (value) => typeof value === "string" && isEmailAddress(value.trim()) ? null : "Enter an email address like name@example.com.",
     normalize: (value) => typeof value === "string" ? value.trim() : value
   },
@@ -584,6 +692,7 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "control", autocomplete: "tel", inputMode: "tel" },
+    literal: "string",
     validate: (value) => typeof value === "string" && isPhoneNumber(value.trim()) ? null : "Enter a phone number with 7 to 15 digits.",
     normalize: (value) => typeof value === "string" ? value.trim() : value,
     summarize: (value) => String(value)
@@ -595,6 +704,13 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "group" },
+    literal: "number",
+    checkProps: (props, check) => {
+      scaleProps(props, check);
+      if (props.display !== void 0 && props.display !== "numbers" && props.display !== "stars") {
+        check.issue("display", "Must be numbers or stars.");
+      }
+    },
     validate: (value, field) => {
       const { min, max } = intRange(field, 1, 5);
       return Number.isInteger(value) && value >= min && value <= max ? null : `Choose a rating from ${min} to ${max}.`;
@@ -612,6 +728,8 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "group" },
+    literal: "number",
+    checkProps: scaleProps,
     validate: (value) => Number.isInteger(value) && value >= 0 && value <= 10 ? null : "Choose a score from 0 to 10.",
     summarize: (value, field) => {
       const end = scaleEndLabel(field, value, 0, 10);
@@ -625,8 +743,10 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "in", "answered", "empty"],
     a11y: { semantics: "group" },
-    validate: (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.",
-    summarize: (value, field) => optionLabel(field, String(value))
+    literal: "string",
+    choice: { multiple: false },
+    validate: oneOptionValidate,
+    summarize: oneOptionSummary
   },
   {
     type: "multi-choice",
@@ -635,12 +755,10 @@ var builtins = [
     value: { json: true },
     operators: ["contains", "answered", "empty"],
     a11y: { semantics: "group" },
-    validate: (value, field) => {
-      const allowed = new Set(choiceOptions(field).map((o) => o.value));
-      const others = Array.isArray(value) ? value.filter((v) => typeof v === "string" && !allowed.has(v)) : [];
-      return Array.isArray(value) && new Set(value).size === value.length && value.every((v) => typeof v === "string") && (others.length === 0 || others.length === 1 && typedOther(field, others[0])) ? null : "Choose from the options.";
-    },
-    summarize: (value, field) => Array.isArray(value) ? value.map((v) => optionLabel(field, String(v))).join(", ") : String(value)
+    literal: "string",
+    choice: { multiple: true },
+    validate: optionsValidate,
+    summarize: optionsSummary
   },
   {
     type: "yes-no",
@@ -649,6 +767,7 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "group" },
+    literal: "boolean",
     validate: (value) => typeof value === "boolean" ? null : "Choose yes or no.",
     summarize: (value) => value ? "Yes" : "No"
   },
@@ -659,8 +778,10 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "in", "answered", "empty"],
     a11y: { semantics: "control" },
-    validate: (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.",
-    summarize: (value, field) => optionLabel(field, String(value))
+    literal: "string",
+    choice: { multiple: false },
+    validate: oneOptionValidate,
+    summarize: oneOptionSummary
   },
   {
     type: "number",
@@ -669,6 +790,16 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "control", inputMode: "decimal" },
+    literal: "number",
+    checkProps: (props, check) => {
+      for (const k of ["min", "max", "step"]) {
+        if (props[k] !== void 0 && !isFiniteNumber(props[k])) check.issue(k, "Must be a number.");
+      }
+      if (isFiniteNumber(props.step) && props.step <= 0) check.issue("step", "Must be above 0.");
+      if (isFiniteNumber(props.min) && isFiniteNumber(props.max) && props.min > props.max) {
+        check.issue("min", "Can't be more than the largest number.");
+      }
+    },
     validate: (value, field) => {
       if (typeof value !== "number" || !Number.isFinite(value)) return "Enter a number.";
       const { min, max, step } = numberLimits(field);
@@ -695,6 +826,17 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "control" },
+    literal: "string",
+    checkProps: (props, check) => {
+      for (const k of ["min", "max"]) {
+        if (props[k] !== void 0 && !(typeof props[k] === "string" && isIsoDate(props[k]))) {
+          check.issue(k, "Must be a date like 2026-10-22.");
+        }
+      }
+      if (typeof props.min === "string" && typeof props.max === "string" && isIsoDate(props.min) && isIsoDate(props.max) && props.min > props.max) {
+        check.issue("min", "Can't be after the latest date.");
+      }
+    },
     validate: (value, field) => {
       if (typeof value !== "string" || !isIsoDate(value.trim())) return "Enter a date like 2026-10-22.";
       const date = value.trim();
@@ -717,6 +859,8 @@ var builtins = [
     value: { json: true },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
+    literal: "boolean",
+    checkProps: (props, check) => check.optionalText(props.text, "text"),
     // Unchecked is unanswered, so a required consent must be checked.
     isEmpty: (value) => value === void 0 || value === null || value === false,
     validate: (value) => value === true ? null : "Check the box to agree.",
@@ -766,12 +910,59 @@ function dateLimits(field) {
   if (typeof max === "string" && isIsoDate(max)) out.max = max;
   return out;
 }
-for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldType, photoFieldType]) registerFieldType(manifest);
+for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldType, photoFieldType]) registerBuiltIn(manifest);
 
 // src/logic.ts
 function own(record, key) {
   return Object.prototype.hasOwnProperty.call(record, key) ? record[key] : void 0;
 }
+function resolve(operand, scope) {
+  if ("field" in operand) return own(scope.values, operand.field);
+  if ("hidden" in operand) return own(scope.hidden, operand.hidden);
+  return operand.value;
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) {
+    return a.length === b.length && a.every((v, i) => deepEqual(v, b[i]));
+  }
+  return false;
+}
+function evaluate(condition, scope) {
+  if ("all" in condition) return condition.all.every((c) => evaluate(c, scope));
+  if ("any" in condition) return condition.any.some((c) => evaluate(c, scope));
+  if ("not" in condition) return !evaluate(condition.not, scope);
+  const left = resolve(condition.left, scope);
+  const right = condition.right ? resolve(condition.right, scope) : void 0;
+  const field = "field" in condition.left ? scope.fields.get(condition.left.field) : void 0;
+  const unanswered = isEmptyValue(left, field);
+  switch (condition.op) {
+    case "answered":
+      return !unanswered;
+    case "empty":
+      return unanswered;
+    case "eq":
+      return !unanswered && deepEqual(left, right);
+    case "neq":
+      return unanswered || !deepEqual(left, right);
+    case "lt":
+    case "lte":
+    case "gt":
+    case "gte": {
+      if (typeof left !== "number" || typeof right !== "number") return false;
+      if (condition.op === "lt") return left < right;
+      if (condition.op === "lte") return left <= right;
+      if (condition.op === "gt") return left > right;
+      return left >= right;
+    }
+    case "in":
+      return !unanswered && Array.isArray(right) && right.some((r) => deepEqual(r, left));
+    case "contains":
+      if (unanswered) return false;
+      if (Array.isArray(left)) return left.some((l) => deepEqual(l, right));
+      return typeof left === "string" && typeof right === "string" && left.toLowerCase().includes(right.toLowerCase());
+  }
+}
 function withheld(def, field) {
   return def.settings?.anonymous === true && field?.identifying === true;
 }
@@ -1139,9 +1330,20 @@ function sheetsDestination(options) {
   async function run(items, config, deliveryOptions) {
     if (!items.length) return { ok: true };
     const { spreadsheetId, sheetName } = configOf(config);
-    const account = await resolveOption("The sheet destination's account", options.account, config);
     const signal = deliveryOptions.signal;
-    const token = await googleAccessToken(account, { ...options, signal });
+    const context = { destinationId: deliveryOptions.destinationId };
+    let account = null;
+    let token;
+    if (options.accessToken) {
+      token = await resolveOption("The sheet destination's access token", options.accessToken, config, context);
+      if (typeof token !== "string" || !token) throw new DeliveryError("The sheet destination has no access token");
+    } else if (options.account) {
+      account = await resolveOption("The sheet destination's account", options.account, config, context);
+      token = await googleAccessToken(account, { ...options, signal });
+    } else {
+      throw new DeliveryError("The sheet destination has neither an account nor an access token");
+    }
+    const sharedWith = account ? `is the sheet shared with ${account.clientEmail}?` : "is the sheet still connected to its Google account?";
     const base = `${SHEETS_API}/${encodeURIComponent(spreadsheetId)}`;
     const escape = options.escapeFormulas === true;
     const call = async (what, url, init = {}) => {
@@ -1153,12 +1355,12 @@ function sheetsDestination(options) {
       );
       if (!response.ok) {
         discard(response);
-        if (what === "append" && (response.status === 400 || response.status === 404)) {
+        if ((what === "append" || what === "update rows") && (response.status === 400 || response.status === 404)) {
           throw new StaleSheetError(`Google Sheets append answered ${response.status}`, { status: response.status });
         }
         if (response.status === 403 || response.status === 404) {
           throw new DeliveryError(
-            `Google Sheets ${what} answered ${response.status}: is the sheet shared with ${account.clientEmail}?`,
+            `Google Sheets ${what} answered ${response.status}: ${sharedWith}`,
             { status: response.status }
           );
         }
@@ -1254,14 +1456,45 @@ function sheetsDestination(options) {
     }
     let skipped = [];
     async function append(state2) {
-      let pending = items.map((item, i) => ({ id: item.submission.id, row: rows[i].row }));
-      if (deliveryOptions.redelivery) {
+      const byId = /* @__PURE__ */ new Map();
+      items.forEach((item, i) => {
+        const id = item.submission.id;
+        const update = (item.update ?? deliveryOptions.update) === true || byId.get(id)?.update === true;
+        byId.delete(id);
+        byId.set(id, { id, row: rows[i].row, update });
+      });
+      let pending = [...byId.values()];
+      const updating = pending.some((p) => p.update);
+      const overwrite = [];
+      skipped = [];
+      if (deliveryOptions.redelivery || updating) {
         const column = columnLetter(state2.header.indexOf("id"));
-        const from = state2.last_row > 0 ? Math.max(2, state2.last_row - DEDUPE_WINDOW) : 2;
+        const from = !updating && state2.last_row > 0 ? Math.max(2, state2.last_row - DEDUPE_WINDOW) : 2;
         const ids = await call("read ids", range(`${column}${from}:${column}`));
-        const present = new Set((ids.values ?? []).map((r) => String(r?.[0] ?? "")));
-        skipped = pending.filter((p) => present.has(p.id)).map((p) => p.id);
-        pending = pending.filter((p) => !present.has(p.id));
+        const rowOf = /* @__PURE__ */ new Map();
+        (ids.values ?? []).forEach((r, i) => {
+          const id = String(r?.[0] ?? "");
+          if (id && !rowOf.has(id)) rowOf.set(id, from + i);
+        });
+        pending = pending.filter((p) => {
+          const at = rowOf.get(p.id);
+          if (at === void 0) return true;
+          if (p.update) overwrite.push({ at, row: p.row });
+          else skipped.push(p.id);
+          return false;
+        });
+      }
+      if (overwrite.length) {
+        await call("update rows", `${base}/values:batchUpdate`, {
+          method: "POST",
+          body: JSON.stringify({
+            valueInputOption: "RAW",
+            data: overwrite.map((o) => ({
+              range: `${quoteSheet(sheetName)}!A${o.at}`,
+              values: [rowFor(state2.header, o.row, escape)]
+            }))
+          })
+        });
       }
       if (!pending.length) return state2;
       const result = await call(
@@ -1296,13 +1529,149 @@ function sheetsDestination(options) {
   };
   return {
     kind: "sheet",
-    deliver: (submission, definition, config, deliveryOptions = {}) => guarded([{ submission, definition, deliveryId: deliveryOptions.deliveryId }], config, deliveryOptions),
+    deliver: (submission, definition, config, deliveryOptions = {}) => guarded(
+      [{ submission, definition, deliveryId: deliveryOptions.deliveryId, update: deliveryOptions.update }],
+      config,
+      deliveryOptions
+    ),
     deliverBatch: (items, config, deliveryOptions = {}) => guarded(items, config, deliveryOptions)
   };
 }
 
+// src/destinations/hook-url.ts
+var MAX_HOOK_URL_LENGTH = 2048;
+var SLACK_HOSTS = /* @__PURE__ */ new Set(["hooks.slack.com"]);
+var HookUrlError = class extends DeliveryError {
+  name = "HookUrlError";
+};
+var NOT_PUBLIC = "The address must be on the public internet.";
+var INTERNAL_SUFFIXES = [".localhost", ".local", ".internal", ".intranet", ".lan", ".home.arpa"];
+function ipv4Bytes(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = parts.map((p) => /^\d{1,3}$/.test(p) ? Number(p) : NaN);
+  return bytes.every((b) => Number.isInteger(b) && b >= 0 && b <= 255) ? bytes : null;
+}
+function publicIpv4(b) {
+  const [a, c] = [b[0], b[1]];
+  if (a === 0 || a === 10 || a === 127) return false;
+  if (a === 100 && c >= 64 && c <= 127) return false;
+  if (a === 169 && c === 254) return false;
+  if (a === 172 && c >= 16 && c <= 31) return false;
+  if (a === 192 && c === 168) return false;
+  if (a === 192 && c === 0 && (b[2] === 0 || b[2] === 2)) return false;
+  if (a === 198 && (c === 18 || c === 19)) return false;
+  if (a === 198 && c === 51 && b[2] === 100) return false;
+  if (a === 203 && c === 0 && b[2] === 113) return false;
+  if (a >= 224) return false;
+  return true;
+}
+function ipv6Bytes(ip) {
+  let text = ip.replace(/^\[|\]$/g, "").toLowerCase();
+  const zone = text.indexOf("%");
+  if (zone >= 0) text = text.slice(0, zone);
+  let tail = [];
+  const lastColon = text.lastIndexOf(":");
+  if (text.slice(lastColon + 1).includes(".")) {
+    const v4 = ipv4Bytes(text.slice(lastColon + 1));
+    if (!v4) return null;
+    tail = v4;
+    text = text.slice(0, lastColon + 1) + "0:0";
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const groups = (s) => s === "" ? [] : s.split(":");
+  const head = groups(halves[0]);
+  const rest = halves.length === 2 ? groups(halves[1]) : [];
+  const missing = 8 - head.length - rest.length;
+  if (halves.length === 1 ? missing !== 0 : missing < 1) return null;
+  const all = [...head, ...Array(halves.length === 2 ? missing : 0).fill("0"), ...rest];
+  const bytes = [];
+  for (const g of all) {
+    if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+    const n = parseInt(g, 16);
+    bytes.push(n >> 8, n & 255);
+  }
+  if (tail.length) bytes.splice(12, 4, ...tail);
+  return bytes;
+}
+function publicIpv6(b) {
+  const zeros = (from, to) => b.slice(from, to).every((x) => x === 0);
+  if (zeros(0, 16)) return false;
+  if (zeros(0, 15) && b[15] === 1) return false;
+  if (zeros(0, 10) && b[10] === 255 && b[11] === 255) return publicIpv4(b.slice(12));
+  if (zeros(0, 12)) return publicIpv4(b.slice(12));
+  if (b[0] === 0 && b[1] === 100 && b[2] === 255 && b[3] === 155 && zeros(4, 12)) return publicIpv4(b.slice(12));
+  if ((b[0] & 254) === 252) return false;
+  if (b[0] === 254 && (b[1] & 192) === 128) return false;
+  if (b[0] === 254 && (b[1] & 192) === 192) return false;
+  if (b[0] === 255) return false;
+  if (b[0] === 32 && b[1] === 1 && b[2] === 13 && b[3] === 184) return false;
+  if (b[0] === 32 && b[1] === 1 && b[2] === 0 && b[3] === 0) return false;
+  if (b[0] === 32 && b[1] === 2) return publicIpv4(b.slice(2, 6));
+  if (b[0] === 1 && zeros(1, 8)) return false;
+  return true;
+}
+function isPublicAddress(ip) {
+  const v4 = ipv4Bytes(ip);
+  if (v4) return publicIpv4(v4);
+  const v6 = ipv6Bytes(ip);
+  return v6 ? publicIpv6(v6) : false;
+}
+function isIpLiteral(host) {
+  return ipv4Bytes(host) !== null || host.startsWith("[");
+}
+function parseHookUrl(raw, kind = "webhook") {
+  const text = raw.trim();
+  if (!text) throw new HookUrlError("Paste the address to send responses to.");
+  if (text.length > MAX_HOOK_URL_LENGTH) throw new HookUrlError("That address is too long.");
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new HookUrlError("That doesn't look like a web address.");
+  }
+  if (url.protocol !== "https:") throw new HookUrlError("The address must start with https://.");
+  if (url.username || url.password) throw new HookUrlError("The address can't include a user name or password.");
+  if (url.port && url.port !== "443") throw new HookUrlError("The address must use the standard https port.");
+  url.hash = "";
+  const host = url.hostname.replace(/\.$/, "");
+  if (kind === "slack") {
+    if (!SLACK_HOSTS.has(host) || !url.pathname.startsWith("/services/")) {
+      throw new HookUrlError("Use a Slack incoming webhook address, which starts with https://hooks.slack.com/services/.");
+    }
+    return url;
+  }
+  if (isIpLiteral(host)) {
+    if (!isPublicAddress(host)) throw new HookUrlError(NOT_PUBLIC);
+    return url;
+  }
+  if (!host.includes(".") || host === "localhost" || INTERNAL_SUFFIXES.some((suffix) => host.endsWith(suffix))) {
+    throw new HookUrlError(NOT_PUBLIC);
+  }
+  return url;
+}
+async function checkHookHost(url, resolve2) {
+  const host = url.hostname.replace(/\.$/, "");
+  if (isIpLiteral(host)) {
+    if (!isPublicAddress(host)) throw new HookUrlError(NOT_PUBLIC);
+    return;
+  }
+  let addresses;
+  try {
+    addresses = await resolve2(host);
+  } catch {
+    throw new HookUrlError(`${host} couldn't be found`, { retryable: true });
+  }
+  if (!addresses.length) throw new HookUrlError(`${host} couldn't be found`, { retryable: true });
+  if (!addresses.every(isPublicAddress)) throw new HookUrlError(NOT_PUBLIC);
+}
+function hookHost(url) {
+  return url.hostname.replace(/\.$/, "").toLowerCase();
+}
+
 // src/destinations/webhook.ts
-var MIN_SECRET_BYTES = 16;
+var MIN_WEBHOOK_SECRET_BYTES = 24;
 var STRICT_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 function secretKey(secret) {
   const encoded = secret.startsWith("whsec_") ? secret.slice(6) : secret;
@@ -1312,16 +1681,27 @@ function secretKey(secret) {
     );
   }
   const bytes = fromBase64(encoded);
-  if (bytes.length < MIN_SECRET_BYTES) throw new DeliveryError(`The webhook secret is shorter than ${MIN_SECRET_BYTES} bytes`);
+  if (bytes.length < MIN_WEBHOOK_SECRET_BYTES) {
+    throw new DeliveryError(`The webhook secret is shorter than ${MIN_WEBHOOK_SECRET_BYTES} bytes`);
+  }
   return bytes;
 }
 async function hmacKey(secret, usage) {
   return crypto.subtle.importKey("raw", secretKey(secret), { name: "HMAC", hash: "SHA-256" }, false, [usage]);
 }
+function newWebhookSecret() {
+  return `whsec_${base64(crypto.getRandomValues(new Uint8Array(32)))}`;
+}
 async function signWebhook(secret, id, timestamp, body) {
-  const key = await hmacKey(secret, "sign");
-  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${id}.${timestamp}.${body}`));
-  return `v1,${base64(new Uint8Array(mac))}`;
+  const secrets = typeof secret === "string" ? [secret] : secret;
+  if (secrets.length === 0) throw new DeliveryError("The webhook secret is not set");
+  const data = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
+  const signatures = [];
+  for (const one of secrets) {
+    const key = await hmacKey(one, "sign");
+    signatures.push(`v1,${base64(new Uint8Array(await crypto.subtle.sign("HMAC", key, data)))}`);
+  }
+  return signatures.join(" ");
 }
 async function verifyWebhook(input) {
   const header = (name) => {
@@ -1335,12 +1715,14 @@ async function verifyWebhook(input) {
   if (!id || !/^\d{1,12}$/.test(timestamp) || !signatures) return false;
   const now = Math.floor((input.now?.() ?? Date.now()) / 1e3);
   if (Math.abs(now - Number(timestamp)) > (input.toleranceSeconds ?? 300)) return false;
-  let key;
-  try {
-    key = await hmacKey(input.secret, "verify");
-  } catch {
-    return false;
+  const keys = [];
+  for (const secret of typeof input.secret === "string" ? [input.secret] : input.secret) {
+    try {
+      keys.push(await hmacKey(secret, "verify"));
+    } catch {
+    }
   }
+  if (keys.length === 0) return false;
   const data = new TextEncoder().encode(`${id}.${timestamp}.${input.body}`);
   for (const part of signatures.split(" ")) {
     const [version, value] = part.split(",", 2);
@@ -1351,7 +1733,7 @@ async function verifyWebhook(input) {
     } catch {
       continue;
     }
-    if (await crypto.subtle.verify("HMAC", key, mac, data)) return true;
+    for (const key of keys) if (await crypto.subtle.verify("HMAC", key, mac, data)) return true;
   }
   return false;
 }
@@ -1416,9 +1798,10 @@ function webhookPayload(submission, definition, options = {}) {
     for (const [name, value] of Object.entries(source ?? {})) if (own(allowed, name) !== void 0) out[name] = value;
     return out;
   };
+  const happened = submission.submittedAt ? Date.parse(submission.submittedAt) : Number.NaN;
   return {
     type: options.type ?? "form.submitted",
-    timestamp: new Date(options.now ?? Date.now()).toISOString(),
+    timestamp: new Date(Number.isNaN(happened) ? options.now ?? Date.now() : happened).toISOString(),
     data: {
       form: { id: definition.id, title: definition.title },
       submission: {
@@ -1440,15 +1823,17 @@ function webhookDestination(options) {
     kind: "webhook",
     async deliver(submission, definition, config, deliveryOptions = {}) {
       try {
-        const url = checkWebhookUrl(configString(config, "url"), options);
-        const secret = await resolveOption("The webhook secret", options.secret, config);
-        if (!secret) throw new DeliveryError("The webhook secret is not set");
+        const context = { destinationId: deliveryOptions.destinationId };
+        const raw = options.url ? await resolveOption("The webhook url", options.url, config, context) : configString(config, "url");
+        const url = checkWebhookUrl(typeof raw === "string" ? raw.trim() : "", options);
+        if (options.resolveHost && !options.allowPrivateHosts) await checkHookHost(url, options.resolveHost);
+        const secret = await resolveOption("The webhook secret", options.secret, config, context);
+        if (!secret || secret.length === 0) throw new DeliveryError("The webhook secret is not set");
         const now = options.now?.() ?? Date.now();
         const id = deliveryOptions.deliveryId ?? submission.id;
         const timestamp = Math.floor(now / 1e3);
-        const body = JSON.stringify(
-          webhookPayload(submission, definition, { sensitive: options.sensitive, type: options.type, now })
-        );
+        const type = options.type ?? (deliveryOptions.update ? "form.updated" : void 0);
+        const body = JSON.stringify(webhookPayload(submission, definition, { sensitive: options.sensitive, type, now }));
         const response = await timedFetch(
           options,
           url.toString(),
@@ -1468,6 +1853,9 @@ function webhookDestination(options) {
         );
         discard(response);
         if (response.status >= 200 && response.status < 300) return { ok: true };
+        if (response.status === 410) {
+          throw new DeliveryError("Webhook answered 410: the endpoint is gone; disable the destination", { status: 410, disable: true });
+        }
         if (response.status === 0 || response.status >= 300 && response.status < 400) {
           throw new DeliveryError(`Webhook answered ${response.status || "a redirect"}: redirects are not followed`, {
             ...response.status ? { status: response.status } : {}
@@ -1481,6 +1869,390 @@ function webhookDestination(options) {
   };
 }
 
-export { DEDUPE_WINDOW, DEFAULT_SHEET_NAME, DeliveryError, GOOGLE_TOKEN_URL, HEADER_SCAN_ROWS, MAX_RECIPIENTS, REQUEST_TIMEOUT_MS, RESEND_API, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, answerCell, checkWebhookUrl, clearGoogleTokenCache, columnLetter, deliveryFailure, emailBody, emailDestination, escapeFormula, escapeHtml, googleAccessToken, headerSafe, httpError, idempotencyKey, isPrivateHost, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sheetsDestination, signJwt, signWebhook, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
+// src/destinations/slack.ts
+var SLACK_VALUE_LIMIT = 1500;
+function escapeSlack(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+var cut = (text) => text.length > SLACK_VALUE_LIMIT ? `${text.slice(0, SLACK_VALUE_LIMIT)}\u2026` : text;
+function slackMessage(submission, definition, options = {}) {
+  const title = definition.title || definition.id;
+  const heading = options.heading ?? `${options.update ? "Updated response" : "New response"}: ${title}`;
+  const lines = [`*${escapeSlack(heading)}*`];
+  for (const [label, value] of options.lines ?? []) {
+    if (value.trim()) lines.push(`*${escapeSlack(label)}*: ${escapeSlack(cut(value))}`);
+  }
+  const { row, labels } = responseRow(submission, definition, { sensitive: options.sensitive ?? "mask" });
+  const omit = new Set(options.omit ?? []);
+  let answered = 0;
+  for (const [key, label] of Object.entries(labels)) {
+    const text = String(row[key] ?? "");
+    if (!text || omit.has(key)) continue;
+    answered++;
+    lines.push(`*${escapeSlack(label || key)}*: ${escapeSlack(cut(text))}`);
+  }
+  if (!answered) lines.push("_No answers._");
+  const when = submission.submittedAt ? ` \xB7 ${escapeSlack(submission.submittedAt)}` : "";
+  const link = options.link;
+  lines.push(
+    link && /^https?:\/\//i.test(link.url) ? `<${link.url.replace(/[<>|]/g, "")}|${escapeSlack(link.text ?? "Open the response").replace(/[|]/g, "")}>${when}` : `Response ${escapeSlack(submission.id)}${when}`
+  );
+  return { text: lines.join("\n") };
+}
+function slackDestination(options = {}) {
+  return {
+    kind: "slack",
+    async deliver(submission, definition, config, deliveryOptions = {}) {
+      try {
+        const context = { destinationId: deliveryOptions.destinationId };
+        const raw = options.url ? await resolveOption("The Slack webhook url", options.url, config, context) : configString(config, "url");
+        if (typeof raw !== "string" || !raw.trim()) throw new DeliveryError("The Slack destination has no url");
+        const url = parseHookUrl(raw, "slack");
+        if (options.resolveHost) await checkHookHost(url, options.resolveHost);
+        const update = deliveryOptions.update === true;
+        const messageOptions = options.message ? await resolveOption(
+          "The Slack message",
+          () => options.message({ submission, definition, config, update, destinationId: deliveryOptions.destinationId }),
+          config
+        ) : {};
+        const body = JSON.stringify(slackMessage(submission, definition, { update, ...messageOptions }));
+        const response = await timedFetch(
+          options,
+          url.toString(),
+          {
+            method: "POST",
+            redirect: "manual",
+            headers: { "content-type": "application/json", "user-agent": "genesis-forms-slack/1" },
+            body
+          },
+          deliveryOptions.signal
+        );
+        discard(response);
+        if (response.status >= 200 && response.status < 300) return { ok: true };
+        if (response.status === 0 || response.status >= 300 && response.status < 400) {
+          throw new DeliveryError(`Slack answered ${response.status || "a redirect"}: redirects are not followed`, {
+            ...response.status ? { status: response.status } : {}
+          });
+        }
+        throw httpError("Slack", response);
+      } catch (error) {
+        return deliveryFailure(error);
+      }
+    }
+  };
+}
+
+// src/destinations/condition.ts
+var OPERATORS = /* @__PURE__ */ new Set(["eq", "neq", "lt", "lte", "gt", "gte", "in", "contains", "answered", "empty"]);
+var MAX_CONDITION_DEPTH = 10;
+var isObject2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function isOperand(v) {
+  if (!isObject2(v)) return false;
+  const keys = Object.keys(v);
+  if (keys.length !== 1) return false;
+  if (keys[0] === "field" || keys[0] === "hidden") return typeof v[keys[0]] === "string";
+  return keys[0] === "value";
+}
+function isCondition(v, depth = 0) {
+  if (!isObject2(v) || depth > MAX_CONDITION_DEPTH) return false;
+  if ("all" in v) return Array.isArray(v["all"]) && v["all"].every((c) => isCondition(c, depth + 1));
+  if ("any" in v) return Array.isArray(v["any"]) && v["any"].every((c) => isCondition(c, depth + 1));
+  if ("not" in v) return isCondition(v["not"], depth + 1);
+  return typeof v["op"] === "string" && OPERATORS.has(v["op"]) && isOperand(v["left"]) && (v["right"] === void 0 || isOperand(v["right"]));
+}
+function conditionOf(config) {
+  const when = config["when"];
+  if (when === void 0 || when === null) return null;
+  if (!isCondition(when)) throw new DeliveryError("The destination's condition can't be read");
+  return when;
+}
+function passesCondition(submission, definition, config) {
+  const condition = conditionOf(config);
+  if (!condition) return true;
+  const fields = /* @__PURE__ */ new Map();
+  for (const block of definition.blocks) if (block.kind === "field") fields.set(block.id, block);
+  const hidden = /* @__PURE__ */ Object.create(null);
+  for (const source of [submission.hidden, submission.context]) {
+    for (const name of Object.keys(source ?? {})) {
+      const value = own(source, name);
+      if (value !== void 0) hidden[name] = value;
+    }
+  }
+  return evaluate(condition, { values: submission.answers, hidden, fields });
+}
+
+// src/destinations/google-oauth.ts
+var DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+async function refreshGoogleAccessToken(client, refreshToken, options = {}) {
+  if (!client.clientId || !client.clientSecret) throw new DeliveryError("The Google OAuth client id or secret is not set");
+  if (!refreshToken) throw new DeliveryError("This sheet's Google connection is gone. Connect the sheet again.");
+  const response = await timedFetch(
+    options,
+    GOOGLE_TOKEN_URL,
+    {
+      method: "POST",
+      // The body holds the refresh token and client secret: never follow a redirect with it.
+      redirect: "error",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: client.clientId,
+        client_secret: client.clientSecret
+      }).toString()
+    },
+    options.signal
+  );
+  if (!response.ok) {
+    const body2 = jsonObject(await response.json().catch(() => null));
+    if (response.status === 400 && body2.error === "invalid_grant") {
+      throw new DeliveryError("Google access to this sheet was removed. Connect the sheet again.", { status: 400 });
+    }
+    discard(response);
+    throw httpError("Google token endpoint", response);
+  }
+  const body = jsonObject(await response.json().catch(() => null));
+  if (typeof body.access_token !== "string" || !body.access_token) {
+    throw new DeliveryError("Google token endpoint returned no access token", { retryable: true });
+  }
+  return {
+    accessToken: body.access_token,
+    expiresIn: typeof body.expires_in === "number" && body.expires_in > 0 ? body.expires_in : 3600,
+    scope: typeof body.scope === "string" ? body.scope : DRIVE_FILE_SCOPE
+  };
+}
+function jsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
+}
+var cache2 = /* @__PURE__ */ new Map();
+function clearGoogleOAuthTokenCache() {
+  cache2.clear();
+}
+async function googleOAuthAccessToken(client, refreshToken, options = {}) {
+  if (!refreshToken) throw new DeliveryError("This sheet's Google connection is gone. Connect the sheet again.");
+  const now = options.now?.() ?? Date.now();
+  const key = await sha256Hex(`${client.clientId}
+${refreshToken}`);
+  const hit = cache2.get(key);
+  if (hit && hit.expiresAt - 6e4 > now) return hit.token;
+  const fresh = await refreshGoogleAccessToken(client, refreshToken, options);
+  cache2.set(key, { token: fresh.accessToken, expiresAt: now + fresh.expiresIn * 1e3 });
+  return fresh.accessToken;
+}
+
+// src/destinations/secret-box.ts
+var enc = new TextEncoder();
+function secretKeyBytes(key) {
+  if (typeof key !== "string") {
+    if (key.length !== 32) throw new DeliveryError("The encryption key must be 32 bytes");
+    return new Uint8Array(key);
+  }
+  const text = key.trim().replace(/=+$/, "");
+  if (!text) throw new DeliveryError("The encryption key is not set");
+  let bytes;
+  try {
+    bytes = fromBase64(text + "=".repeat((4 - text.length % 4) % 4));
+  } catch {
+    throw new DeliveryError("The encryption key is not base64");
+  }
+  if (bytes.length !== 32) throw new DeliveryError("The encryption key must be 32 bytes");
+  return bytes;
+}
+async function deriveSecretKey(key, info, options = {}) {
+  if (!info) throw new DeliveryError("A sealing key needs its purpose (info)");
+  const salt = typeof options.salt === "string" ? enc.encode(options.salt) : new Uint8Array(options.salt ?? new Uint8Array(0));
+  const base = await crypto.subtle.importKey("raw", secretKeyBytes(key), "HKDF", false, ["deriveKey"]);
+  return crypto.subtle.deriveKey(
+    { name: "HKDF", hash: "SHA-256", salt, info: enc.encode(info) },
+    base,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function sealSecret(key, plaintext, aad) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const sealed = await crypto.subtle.encrypt({ name: "AES-GCM", iv, additionalData: enc.encode(aad) }, key, enc.encode(plaintext));
+  return `v1.${base64url(iv)}.${base64url(new Uint8Array(sealed))}`;
+}
+async function openSecret(key, sealed, aad) {
+  const [version, iv, body, extra] = sealed.split(".");
+  if (version !== "v1" || !iv || !body || extra !== void 0) throw new DeliveryError("The stored secret is not in a known format");
+  try {
+    const plain = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv: padded(iv), additionalData: enc.encode(aad) },
+      key,
+      padded(body)
+    );
+    return new TextDecoder().decode(plain);
+  } catch {
+    throw new DeliveryError("The stored secret could not be decrypted");
+  }
+}
+function padded(text) {
+  return fromBase64(text + "=".repeat((4 - text.length % 4) % 4));
+}
+
+// src/destinations/runner.ts
+var DEFAULT_MAX_ATTEMPTS = 8;
+var DEFAULT_MAX_DEFERRALS = 24;
+var DEFAULT_BATCH_SIZE = 25;
+function defaultBackoff(attempt, random) {
+  const nominal = Math.min(24 * 3600, 300 * 4 ** Math.max(0, attempt - 1));
+  const r = typeof random === "function" ? random() : Math.random();
+  return Math.round(nominal * (0.8 + 0.4 * Math.min(1, Math.max(0, r))));
+}
+function deliveryOutcome(result, attempt, options = {}) {
+  if (result.ok) return result.notSent ? { status: "skipped", reason: result.notSent.slice(0, 500) } : { status: "sent" };
+  const http = result.status !== void 0 ? { httpStatus: result.status } : {};
+  if (result.disable) return { status: "failed", error: result.error, ...http, disable: true };
+  if (!result.retryable) return { status: "failed", error: result.error, ...http };
+  const now = options.now ?? Date.now();
+  if (result.retryAfterSeconds !== void 0 && (options.deferrals ?? 0) < (options.maxDeferrals ?? DEFAULT_MAX_DEFERRALS)) {
+    const seconds2 = Math.max(1, Math.ceil(result.retryAfterSeconds));
+    return { status: "retry", error: result.error, retryAt: new Date(now + seconds2 * 1e3), retryAfterSeconds: seconds2, counted: false, ...http };
+  }
+  const max = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  if (attempt >= max) return { status: "failed", error: `${result.error} (gave up after ${attempt} attempts)`.slice(0, 500), ...http };
+  const seconds = Math.max(1, Math.ceil((options.backoff ?? defaultBackoff)(attempt)));
+  return { status: "retry", error: result.error, retryAt: new Date(now + seconds * 1e3), retryAfterSeconds: seconds, counted: true, ...http };
+}
+function createDeliveryRunner(options) {
+  const log = (message) => {
+    try {
+      options.log?.(message);
+    } catch {
+    }
+  };
+  const now = () => options.now?.() ?? Date.now();
+  async function send(group, signal) {
+    const first = group[0];
+    const destination = options.destinations[first.kind];
+    if (!destination) {
+      return group.map(() => ({ ok: false, retryable: false, error: `No destination for kind ${first.kind}` }));
+    }
+    const results = group.map((d) => {
+      try {
+        return passesCondition(d.submission, d.definition, d.config) ? null : "filtered";
+      } catch (error) {
+        return deliveryFailure(error);
+      }
+    });
+    const due = group.filter((_, i) => results[i] === null);
+    let state = first.state;
+    const keep = (result) => {
+      if (result.ok && result.state) state = result.state;
+    };
+    const guard = async (call) => {
+      try {
+        return await call();
+      } catch (error) {
+        return deliveryFailure(error);
+      }
+    };
+    const base = { state, signal, destinationId: first.destinationId };
+    let sent;
+    if (due.length > 1 && destination.deliverBatch) {
+      const items = due.map((d) => ({ submission: d.submission, definition: d.definition, deliveryId: d.id, update: d.update }));
+      const result = await guard(
+        () => destination.deliverBatch(items, first.config, { ...base, redelivery: due.some((d) => d.redelivery) })
+      );
+      keep(result);
+      sent = due.map(() => result);
+    } else {
+      sent = [];
+      for (const d of due) {
+        const result = await guard(
+          () => destination.deliver(d.submission, d.definition, d.config, {
+            ...base,
+            state,
+            deliveryId: d.id,
+            redelivery: d.redelivery,
+            update: d.update
+          })
+        );
+        keep(result);
+        sent.push(result);
+      }
+    }
+    if (state !== first.state && state && options.saveState) {
+      try {
+        await options.saveState(first.destinationId, state);
+      } catch {
+        log(`Saving destination ${first.destinationId}'s state failed`);
+      }
+    }
+    let next = 0;
+    return results.map((r) => r ?? sent[next++]);
+  }
+  return {
+    async run(runOptions = {}) {
+      const report = {
+        claimed: 0,
+        sent: 0,
+        filtered: 0,
+        skipped: 0,
+        retrying: 0,
+        deferred: 0,
+        failed: 0,
+        stale: 0,
+        unrecorded: 0
+      };
+      const limit = runOptions.limit ?? options.batchSize ?? DEFAULT_BATCH_SIZE;
+      const claimed = await options.claim({ limit, filter: runOptions.filter });
+      report.claimed = claimed.length;
+      const groups = /* @__PURE__ */ new Map();
+      for (const delivery of claimed) {
+        const list = groups.get(delivery.destinationId) ?? [];
+        list.push(delivery);
+        groups.set(delivery.destinationId, list);
+      }
+      await Promise.all(
+        [...groups.values()].map(async (group) => {
+          const results = await send(group, runOptions.signal);
+          const at = now();
+          await Promise.all(
+            group.map(async (delivery, i) => {
+              const result = results[i];
+              const outcome = result === "filtered" ? { status: "filtered" } : deliveryOutcome(result, delivery.attempt, {
+                now: at,
+                maxAttempts: options.maxAttempts,
+                backoff: options.backoff,
+                deferrals: delivery.deferrals,
+                maxDeferrals: options.maxDeferrals
+              });
+              if (outcome.status === "sent" && result !== "filtered" && result.ok && result.skipped?.includes(delivery.submission.id)) {
+                outcome.alreadyThere = true;
+              }
+              if (outcome.status === "failed" || outcome.status === "retry") {
+                log(`Delivery ${delivery.id} (${delivery.kind}) ${outcome.status === "failed" ? "failed" : "will be retried"}: ${outcome.error}`);
+              } else if (outcome.status === "skipped") {
+                log(`Delivery ${delivery.id} (${delivery.kind}) skipped: ${outcome.reason}`);
+              }
+              let recorded;
+              try {
+                recorded = await options.record(delivery, outcome);
+              } catch {
+                report.unrecorded++;
+                log(`Recording delivery ${delivery.id} failed`);
+                return;
+              }
+              if (recorded === false) report.stale++;
+              else if (outcome.status === "sent") report.sent++;
+              else if (outcome.status === "filtered") report.filtered++;
+              else if (outcome.status === "skipped") report.skipped++;
+              else if (outcome.status === "failed") report.failed++;
+              else if (outcome.counted) report.retrying++;
+              else report.deferred++;
+            })
+          );
+        })
+      );
+      return report;
+    }
+  };
+}
+
+export { DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, GOOGLE_TOKEN_URL, HEADER_SCAN_ROWS, HookUrlError, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, MIN_WEBHOOK_SECRET_BYTES, REQUEST_TIMEOUT_MS, RESEND_API, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
 //# sourceMappingURL=destinations.js.map
 //# sourceMappingURL=destinations.js.map