@marktiderman/genesis-forms 0.8.0 → 0.9.0

package/dist/server.d.ts

@@ -1,474 +1,3 @@
-import { F as FieldValidator, H as HostOptions } from './validate-DvfQHYnu.js';
-export { A as AnswerSnapshot, d as OptionSnapshot, f as RestoredAnswers, h as answerSnapshots, i as answersFromSnapshots, $ as withHostOptions } from './validate-DvfQHYnu.js';
-import { J as Json, F as FormDefinition, a as FieldBlock, e as FormEvent } from './types-jqDKcmP4.js';
-import { S as SignedUpload } from './upload-protocol-BUO74WkS.js';
-export { f as MAX_UPLOAD_REQUEST_BYTES, j as UploadGrant, k as UploadRefusal, l as UploadRequest } from './upload-protocol-BUO74WkS.js';
-
-/**
- * Edit links for a sent response: `<id>.<nonce>.<expires>.<sig>`, where sig is the
- * base64url HMAC-SHA256 of `edit-link:v2:<id>.<nonce>.<expires>` under a server-only
- * secret of at least 32 bytes.
- *
- * - id: the response's uuid.
- * - nonce: the response's current edit nonce, kept by the app. The app refuses a link
- *   whose nonce is no longer the response's, so changing the nonce revokes every link
- *   made before (change it after each edit: only the newest link works).
- * - expires: when the link stops working, in Unix seconds, about 30 days after it was
- *   made (`EDIT_LINK_TTL_SECONDS`).
- *
- * Without a usable secret (missing, or shorter than `MIN_EDIT_SECRET_BYTES`) there are no
- * edit links: signing returns null and every token fails to verify.
- *
- * Web Crypto only, no storage: the app keeps the nonce and checks it. Moved up from
- * The host app's src/lib/forms/edit-link.ts unchanged, so links it signed still verify.
- */
-/** How long a new edit link works: 30 days. */
-declare const EDIT_LINK_TTL_SECONDS: number;
-/** The shortest secret edit links are signed with: 32 bytes (UTF-8), as long as the HMAC. */
-declare const MIN_EDIT_SECRET_BYTES = 32;
-/** The query parameter an edit link's token travels in: `?edit=<token>`. */
-declare const EDIT_LINK_PARAM = "edit";
-/** Whether `secret` can sign edit links: a string of at least `MIN_EDIT_SECRET_BYTES` bytes. */
-declare function isUsableEditSecret(secret: string | null | undefined): secret is string;
-/** What an edit link says: the response, its nonce when the link was made, and when it stops working. */
-interface EditLinkClaims {
-    /** The response's id, in lower case. */
-    id: string;
-    nonce: string;
-    /** Unix seconds. */
-    expiresAt: number;
-}
-interface EditLinkOptions {
-    /** The current time in milliseconds (tests); `Date.now()` by default. */
-    now?: number | undefined;
-    /** How long the link works, in seconds; `EDIT_LINK_TTL_SECONDS` by default. */
-    ttlSeconds?: number | undefined;
-}
-/**
- * The edit token for a response and its current nonce, working for `ttlSeconds` from
- * now; null when there is no usable secret (no edit links) or the id or nonce is malformed.
- */
-declare function signEditToken(link: {
-    id: string;
-    nonce: string;
-}, secret: string | null | undefined, options?: EditLinkOptions): Promise<string | null>;
-/**
- * What a token says, or null when it is malformed, its signature does not match, it has
- * expired (or claims to last longer than `ttlSeconds` from now), or there is no usable
- * secret. Whether the nonce is still the response's is the caller's check. The
- * comparison is Web Crypto's HMAC verify, which runs in constant time.
- */
-declare function verifyEditToken(token: string | null | undefined, secret: string | null | undefined, options?: EditLinkOptions): Promise<EditLinkClaims | null>;
-/**
- * A form link with the edit token added: `<formUrl>?edit=<token>` (or `&edit=` when it
- * has a query). `param` names the parameter; `EDIT_LINK_PARAM` by default.
- */
-declare function withEditToken(formUrl: string, token: string, param?: string): string;
-interface EditLinkUrlOptions extends EditLinkOptions {
-    /** The query parameter; `EDIT_LINK_PARAM` by default. */
-    param?: string | undefined;
-}
-/**
- * The link that reopens a response for editing: `formUrl` (the page that shows the form,
- * with any query it needs) plus a token signed for the response's current nonce. Null
- * when there are no edit links (no usable secret) or the id or nonce is malformed.
- */
-declare function editLinkUrl(formUrl: string, link: {
-    id: string;
-    nonce: string;
-}, secret: string | null | undefined, options?: EditLinkUrlOptions): Promise<string | null>;
-/** Where the edit-secret reader reports a missing or short secret. */
-type EditSecretLog = (message: string) => void;
-/** Reads the edit-link secret from an environment, warning once when there is none. */
-interface EditSecretReader {
-    /** The secret, or null (no edit links) when it is missing or too short; warns once, never with the secret. */
-    (env: Record<string, string | undefined>, log?: EditSecretLog): string | null;
-    /** Tests only: warn again. */
-    reset(): void;
-}
-/**
- * A reader for the environment variable that holds the edit-link secret (such as
- * `FEEDBACK_EDIT_SECRET`). Without one of at least `MIN_EDIT_SECRET_BYTES` bytes there are
- * no edit links, and the first read says so through `log` (the call's, else the
- * reader's, else `console.warn`); later reads stay quiet until `reset()`.
- */
-declare function createEditSecretReader(options: {
-    variable: string;
-    log?: EditSecretLog | undefined;
-}): EditSecretReader;
-interface EditLinkRequestOptions {
-    /** The query parameter; `EDIT_LINK_PARAM` by default. */
-    param?: string | undefined;
-    /**
-     * Whether the URL is a page that shows a form (an edit link is only honoured there,
-     * such as `/f/<slug>`). Every URL by default.
-     */
-    isFormPage?: ((url: URL) => boolean) | undefined;
-}
-/** Whether this request is a form page opened with an edit link (the parameter present, even empty). */
-declare function isEditLinkRequest(url: URL, options?: EditLinkRequestOptions): boolean;
-/**
- * The response, with `Referrer-Policy: no-referrer` and `Cache-Control: private, no-store`
- * added when the request carried an edit link; otherwise the same response, untouched.
- * The link is a credential, so it never leaves in a Referer header (an HTTP header, not
- * only the page's meta tag, so it holds before the page has parsed and for every request
- * the page makes), and the page, prefilled with the response, is never cached.
- */
-declare function withEditLinkHeaders(request: Request, response: Response, options?: EditLinkRequestOptions): Response;
-
-/**
- * The pieces of a submit endpoint's rate limit that aren't storage: the client's
- * address, the part of it that names one client, a key that never holds the address,
- * and a check that fails open. The counter itself is the app's (`RateLimitStore`), so
- * every server instance can share it (a row in Postgres, a key in Redis).
- *
- * Web Crypto only. Moved up from the host app's src/lib/feedback/rate-limit.server.ts;
- * keys made here equal the ones it made, so a deploy doesn't reset anyone's count.
- */
-/**
- * The headers a proxy reports the client's address in, most trusted first. Trust only
- * headers your proxy sets (and overwrites): a client can send any of them itself.
- */
-declare const DEFAULT_TRUSTED_IP_HEADERS: readonly string[];
-/**
- * How many submits, saves as they go and photo uploads one client may make per scope
- * (a practice, an account) in a window.
- *
- * - submit: 60 responses per 10 minutes: a class at one gym's Wi-Fi fits.
- * - progress: saving answers as they go. A visit counts once, against `submit`, at its
- *   first save; its later saves (each Next, the send, a reload picking up where it was)
- *   count here, in the same window: 60 people answering 10 questions each on one Wi-Fi fit.
- * - upload: 120 photos per 10 minutes: that class, a couple of photos each.
- */
-declare const RATE_LIMIT_DEFAULTS: {
-    readonly submit: {
-        readonly limit: 60;
-        readonly windowSeconds: 600;
-    };
-    readonly progress: {
-        readonly limit: 900;
-        readonly windowSeconds: 600;
-    };
-    readonly upload: {
-        readonly limit: 120;
-        readonly windowSeconds: 600;
-    };
-};
-/**
- * The client's address as the proxy reports it, used only as a rate-limit key: the first
- * entry of the first of `trusted` that is set, trimmed, else `"unknown"`.
- */
-declare function clientIp(headers: Pick<Headers, "get">, trusted?: readonly string[]): string;
-/** The part of an address that names one client: an IPv4 address whole, an IPv6 address by its /64. */
-declare function addressPrefix(ip: string): string;
-/**
- * The stored key, `<kind>:<scope>:<hex HMAC-SHA256 of the address prefix>`: what is
- * counted (such as `submit`, `progress`, `upload`), whose count it is (a practice id),
- * and the client, which is never stored as its address. `secret` is a server secret.
- */
-declare function rateLimitKey(input: {
-    kind: string;
-    scope: string;
-    ip: string;
-    secret: string;
-}): Promise<string>;
-/** The app's shared counter. */
-interface RateLimitStore {
-    /**
-     * Count one hit on `key` in its current `windowSeconds` window: true while the count is
-     * within `limit`, false past it, null when it could not count.
-     */
-    hit(key: string, limit: number, windowSeconds: number): Promise<boolean | null>;
-}
-/**
- * True when the request may go on. Fails open: when the store can't count (it answers
- * null or throws) the request goes on and `log` says so with `message`.
- */
-declare function allow(store: RateLimitStore, check: {
-    key: string;
-    limit: number;
-    windowSeconds: number;
-}, options?: {
-    log?: ((message: string) => void) | undefined;
-    message?: string | undefined;
-}): Promise<boolean>;
-
-/** What the store records when an upload begins. */
-interface BeginUploadInput {
-    formId: string;
-    fieldId: string;
-    name: string;
-    contentType: string;
-    size: number;
-    /** A new response's attempt (`attemptHash` of its attempt id), or… */
-    attemptHash: string | null;
-    /** …the id of the sent response an edit link is changing. Exactly one of the two. */
-    editOf: string | null;
-}
-/** One upload as the store reads it back, with what storage holds for it. */
-interface StoredUpload {
-    id: string;
-    fieldId: string;
-    attemptHash: string | null;
-    editOf: string | null;
-    /** The response that took it, once one did. */
-    responseId: string | null;
-    name: string;
-    contentType: string;
-    size: number;
-    /** Whether the file is in storage (the respondent's browser finished sending it). */
-    stored: boolean;
-    /** The type and size storage holds, which are trusted over what the browser said. */
-    storedType: string | null;
-    storedSize: number | null;
-}
-/** What uploads need from the app's database and storage; the app's service-role client, say. */
-interface UploadStore {
-    /**
-     * Records one upload and names its object in storage; `{ tooMany: true }` once the
-     * attempt or edit has as many as the app allows (the host app: 20).
-     */
-    beginUpload(input: BeginUploadInput): Promise<{
-        id: string;
-        objectName: string;
-    } | {
-        tooMany: true;
-    }>;
-    /** Signs an upload of that object, sent to the browser as `upload` (`SignedUpload`). */
-    signUpload(objectName: string): Promise<SignedUpload>;
-    /** This form's uploads with these ids; others are left out. */
-    uploadRefs(formId: string, ids: string[]): Promise<StoredUpload[]>;
-}
-/** Who may use an upload: a new response's attempt, or an edit of a sent response. */
-type UploadOwner = {
-    attemptHash: string;
-} | {
-    responseId: string;
-};
-/** The form's upload fields (`UPLOAD_FIELD_TYPES`: photo). */
-declare function uploadFields(definition: FormDefinition): FieldBlock[];
-/** An upload field type's limits and its words for a file it doesn't take. */
-interface UploadRules {
-    maxFiles: number;
-    maxBytes: number;
-    mimeTypes: readonly string[];
-    typeMessage: string;
-    sizeMessage: string;
-    countMessage: string;
-}
-/** The rules for an upload field, or null when the field doesn't take files. */
-declare function uploadRules(field: FieldBlock): UploadRules | null;
-/** Said when a reference isn't a file this respondent finished uploading here. */
-declare const NOT_UPLOADED_MESSAGE = "A photo didn't finish uploading. Remove it and add it again.";
-interface CheckUploadsOptions {
-    /** The form's id, as the store keys its uploads. */
-    formId: string;
-    owner: UploadOwner;
-    /** Needed only when the answers name a file. */
-    store?: Pick<UploadStore, "uploadRefs"> | undefined;
-}
-type CheckedUploads = {
-    ok: true;
-    answers: Record<string, Json>;
-} | {
-    ok: false;
-    errors: Record<string, string>;
-};
-/**
- * Checks every file the answers name: uploaded by this attempt (or for this edit) to this
- * form's field, in storage, of a type and size the field takes, and no more files than it
- * takes. The stored name, type and size replace what the browser sent. Answers without
- * files are returned as they are, without asking the store. Errors are keyed by field id;
- * a store that throws throws (answer 503: nothing can be checked).
- */
-declare function checkUploads(definition: FormDefinition, answers: Record<string, Json>, options: CheckUploadsOptions): Promise<CheckedUploads>;
-/**
- * The stored hash of a visit's attempt id: hex SHA-256 (Web Crypto). It equals
- * The host app's `resumeTokenHash`, so uploads recorded before the move still match.
- */
-declare function attemptHash(attemptId: string): Promise<string>;
-
-/** The form an upload is for, as the app found it from the request. */
-interface UploadForm {
-    /** The form's id, as the store keys uploads. */
-    id: string;
-    /** The published definition respondents answer. */
-    definition: FormDefinition;
-    /** Whether it takes responses now (not paused, closed, full…). */
-    open: boolean;
-    /** Whose rate-limit count this is: a practice, an account. */
-    scope: string;
-    /** Whether its edit links work. Default false: no uploads for an edit. */
-    allowsEdits?: boolean | undefined;
-    /** Names the form in logs, such as its slug. */
-    label?: string | undefined;
-}
-/** A sent response an edit link may change, as the app loads it. */
-interface EditableResponse {
-    id: string;
-    /** The response's current nonce: only a link made with it works. */
-    editNonce: string;
-}
-/** The handler's words; each default is what the host app said. */
-interface UploadMessages {
-    /** 415 / 400: not a JSON object. */
-    notJson: string;
-    /** 413: past `maxRequestBytes`. */
-    tooLong: string;
-    /** 400: no attempt id, or not a UUID. */
-    reload: string;
-    /** 404: `resolveForm` found no form. */
-    unavailable: string;
-    /** 409: the form isn't open. */
-    notOpen: string;
-    /** 409 (`code: "closed"`): an edit while the form isn't open. */
-    notTakingChanges: string;
-    /** 403 (`code: "bad_link"`): an edit link that doesn't check out, or a form without edits. */
-    badEditLink: string;
-    /** 400: the field isn't an upload field of this form. */
-    notUploadField: string;
-    /** 429: the rate limit. */
-    rateLimited: string;
-    /** 429 (`code: "too_many_photos"`): the store has as many uploads for this attempt or edit as it allows. */
-    tooMany: string;
-    /** 503 / 500: something failed on the server; nothing more is said. */
-    failed: string;
-}
-declare const UPLOAD_MESSAGES: UploadMessages;
-type Secret = string | null | undefined;
-interface UploadHandlerOptions<P = void> {
-    /**
-     * The form the request is for (from its host, path or `params`), or null (404). A throw
-     * answers 503 and logs the error's message.
-     */
-    resolveForm(request: Request, params: P): Promise<UploadForm | null>;
-    store: UploadStore;
-    /**
-     * Uploads for an edit link (`edit` in the request). Without it, or without a usable
-     * secret, every edit link is refused (403).
-     */
-    edit?: {
-        /** The edit-link secret, or a reader of it (`createEditSecretReader`). */
-        secret: Secret | (() => Secret);
-        /**
-         * The sent response with this id, of this form (and its scope), or null (403).
-         * A throw answers 503.
-         */
-        response(id: string, form: UploadForm): Promise<EditableResponse | null>;
-    } | undefined;
-    /** Counted per scope and client address, as `kind: "upload"`. Without it, nothing is counted. */
-    rateLimit?: {
-        store: RateLimitStore;
-        /** The server secret the address is hashed with (`rateLimitKey`). */
-        secret: string;
-        /** Default `RATE_LIMIT_DEFAULTS.upload`: 120 per 600 seconds. */
-        limit?: number | undefined;
-        windowSeconds?: number | undefined;
-        /** Default `DEFAULT_TRUSTED_IP_HEADERS`. */
-        trustedIpHeaders?: readonly string[] | undefined;
-    } | undefined;
-    /** The stored hash of an attempt id. Default `attemptHash` (hex SHA-256). */
-    hashAttempt?: ((attemptId: string) => string | Promise<string>) | undefined;
-    /** Default `MAX_UPLOAD_REQUEST_BYTES` (4,000). */
-    maxRequestBytes?: number | undefined;
-    /** The current time (tests): edit links expire. */
-    now?: (() => Date) | undefined;
-    /** Where failures are said; `console.error` with an `[upload]` prefix by default. Never sent to the browser. */
-    log?: ((message: string) => void) | undefined;
-    messages?: Partial<UploadMessages> | undefined;
-}
-/**
- * The upload endpoint: `(request, params) => Response`, for a POST route. `params` is
- * whatever the route has (a form slug, say), passed to `resolveForm`. See the README's
- * "Uploads" for the JSON and every status.
- */
-declare function createUploadHandler<P = void>(options: UploadHandlerOptions<P>): (request: Request, params: P) => Promise<Response>;
-
-interface SubmissionInput {
-    /** Answers keyed by field id. Ignored when `events` is given. */
-    answers?: Record<string, Json> | undefined;
-    /** The respondent's event log. Replayed instead of trusting `answers`. */
-    events?: FormEvent[] | undefined;
-    /** URL and host inputs sent by the client. Server inputs here are ignored. */
-    hidden?: Record<string, Json> | undefined;
-}
-interface SubmissionOptions {
-    /** Values for `source: "server"` inputs, resolved by the server (account id, location, user id…). */
-    context?: Record<string, Json> | undefined;
-    /** `false` checks a draft: formats only, nothing required. Default true. */
-    complete?: boolean | undefined;
-    validators?: Record<string, FieldValidator> | undefined;
-    /**
-     * Most events accepted, counted after `compactEvents`. Default `MAX_EVENTS`
-     * (10,000). At most `RAW_EVENTS_PER_EVENT` (10) times as many may be sent.
-     */
-    maxEvents?: number | undefined;
-    /**
-     * Most JSON values in the answers, answer events and hidden inputs
-     * together (each number, text, true / false, list item, row and cell
-     * counts one; a run of answers to one field, as typing in a table sends,
-     * counts its last only). Default `MAX_SUBMISSION_VALUES` (200,000).
-     */
-    maxValues?: number | undefined;
-    /**
-     * Most work replaying the events may take: one unit per block each time
-     * the path is walked, one per calculated field each time the answers
-     * settle, and a formula's size (its numbers, answers and operators) each
-     * time it is worked out. Default `MAX_REPLAY_WORK` (1,000,000). Only the
-     * replay counts: the submit that follows it does not.
-     */
-    maxReplayWork?: number | undefined;
-    /**
-     * The option lists the app supplies for `optionsFrom: { source: "host" }`
-     * choice fields, loaded here on the server (never taken from the client):
-     * an answer must be one of the field's own options or of these. Pass what
-     * the form was shown with, loaded afresh, such as the current staff.
-     */
-    hostOptions?: HostOptions | undefined;
-}
-interface CheckedSubmission {
-    status: "draft" | "completed";
-    /**
-     * Visible answers only, keyed by field id (kept hidden answers too, with
-     * `clearHiddenValues: false`). Calculated fields hold the value worked out
-     * here from these answers.
-     */
-    answers: Record<string, Json>;
-    /** Untrusted URL and host inputs, coerced to their declared types. Identifying ones are left out on anonymous forms. */
-    hidden: Record<string, Json>;
-    /** Trusted server inputs. Identifying ones are left out on anonymous forms. */
-    context: Record<string, Json>;
-    ending: string | null;
-    /** Client-sent keys that were dropped, each once: unknown fields, server inputs, undeclared or withheld hidden names. */
-    ignored: string[];
-}
-type SubmissionResult = {
-    ok: true;
-    submission: CheckedSubmission;
-} | {
-    ok: false;
-    errors: Record<string, string>;
-};
-/** Default for `SubmissionOptions.maxEvents`. */
-declare const MAX_EVENTS = 10000;
-/** Default for `SubmissionOptions.maxValues`. */
-declare const MAX_SUBMISSION_VALUES = 200000;
-/** Default for `SubmissionOptions.maxReplayWork`. */
-declare const MAX_REPLAY_WORK = 1000000;
-/**
- * Most events sent, before compaction, as a multiple of `maxEvents`: a
- * keystroke log compacts to far fewer, but every event sent is looked at.
- */
-declare const RAW_EVENTS_PER_EVENT = 10;
-/**
- * Check a submission against the published definition. Never throws on a
- * malformed submission: it returns `{ ok: false, errors: { "": … } }`.
- */
-declare function validateSubmission(published: FormDefinition, submission: SubmissionInput, options?: SubmissionOptions): SubmissionResult;
-/**
- * The definition as respondents may see it. R1 forms hold nothing secret;
- * assessment answer keys (R4) will be stripped here.
- */
-declare function publicDefinition(definition: FormDefinition): FormDefinition;
-
-export { type BeginUploadInput, type CheckUploadsOptions, type CheckedSubmission, type CheckedUploads, DEFAULT_TRUSTED_IP_HEADERS, EDIT_LINK_PARAM, EDIT_LINK_TTL_SECONDS, type EditLinkClaims, type EditLinkOptions, type EditLinkRequestOptions, type EditLinkUrlOptions, type EditSecretLog, type EditSecretReader, type EditableResponse, HostOptions, MAX_EVENTS, MAX_REPLAY_WORK, MAX_SUBMISSION_VALUES, MIN_EDIT_SECRET_BYTES, NOT_UPLOADED_MESSAGE, RATE_LIMIT_DEFAULTS, RAW_EVENTS_PER_EVENT, type RateLimitStore, SignedUpload, type StoredUpload, type SubmissionInput, type SubmissionOptions, type SubmissionResult, UPLOAD_MESSAGES, type UploadForm, type UploadHandlerOptions, type UploadMessages, type UploadOwner, type UploadRules, type UploadStore, addressPrefix, allow, attemptHash, checkUploads, clientIp, createEditSecretReader, createUploadHandler, editLinkUrl, isEditLinkRequest, isUsableEditSecret, publicDefinition, rateLimitKey, signEditToken, uploadFields, uploadRules, validateSubmission, verifyEditToken, withEditLinkHeaders, withEditToken };
+export { A as AnswerSnapshot, H as HostOptions, f as OptionSnapshot, k as RestoredAnswers, m as answerSnapshots, n as answersFromSnapshots, ac as withHostOptions } from './validate-DpmBssFk.js';
+import './types-C0pUfew3.js';
+export { F as BeginUploadInput, G as CheckUploadsOptions, H as CheckedSubmission, J as CheckedUploads, K as ClientIpOptions, L as DEFAULT_TRUSTED_IP_HEADERS, N as EDIT_LINK_PARAM, O as EDIT_LINK_TTL_SECONDS, Q as EditLinkClaims, R as EditLinkOptions, T as EditLinkRequestOptions, V as EditLinkUrlOptions, W as EditSecretLog, X as EditSecretReader, Y as EditableResponse, I as IDEMPOTENCY_KEY_PATTERN, Z as MAX_EVENTS, _ as MAX_REPLAY_WORK, $ as MAX_SUBMISSION_VALUES, i as MAX_UPLOAD_REQUEST_BYTES, a0 as MIN_EDIT_SECRET_BYTES, j as MergeOptions, a1 as NOT_UPLOADED_MESSAGE, a2 as RATE_LIMIT_DEFAULTS, a3 as RAW_EVENTS_PER_EVENT, a4 as RateLimitAnswer, a5 as RateLimitStore, n as SignedUpload, a6 as StoredSubmissionRef, a7 as StoredUpload, S as SubmissionInput, a8 as SubmissionOptions, a9 as SubmissionRecord, aa as SubmissionResult, ab as SubmissionStore, c as SubmitFailureReason, o as SubmitOutcome, b as SubmitRequest, ac as SubmitResponseOptions, d as SubmitResult, ad as UPLOAD_MESSAGES, ae as UploadForm, p as UploadGrant, af as UploadHandlerOptions, ag as UploadMessages, ah as UploadOwner, q as UploadRefusal, r as UploadRequest, ai as UploadRules, aj as UploadStore, ak as addressPrefix, al as allow, am as attemptHash, an as checkUploads, ao as clientIp, ap as createEditSecretReader, aq as createUploadHandler, ar as editLinkUrl, as as isEditLinkRequest, s as isIdempotencyKey, v as isSubmitResult, at as isUsableEditSecret, w as mergeResponses, au as publicDefinition, av as rateLimitKey, aw as signEditToken, E as submitOutcome, ax as submitResponse, ay as uploadFields, az as uploadRules, aA as validateSubmission, aB as verifyEditToken, aC as withEditLinkHeaders, aD as withEditToken } from './submit-protocol-CFi-0Qd0.js';