@marktiderman/genesis-forms 0.8.0 → 0.9.1

package/dist/destinations.cjs

@@ -6,9 +6,12 @@ var DeliveryError = class extends Error {
   retryable;
   retryAfterSeconds;
   status;
+  /** The receiver asked to be switched off (`DeliveryFailure.disable`); never retryable. */
+  disable;
   constructor(message, options = {}) {
     super(message);
-    this.retryable = options.retryable ?? false;
+    this.disable = options.disable ?? false;
+    this.retryable = !this.disable && (options.retryable ?? false);
     this.retryAfterSeconds = options.retryAfterSeconds;
     this.status = options.status;
   }
@@ -49,7 +52,8 @@ function deliveryFailure(error) {
       retryable: error.retryable,
       error: error.message.slice(0, 500),
       ...error.retryAfterSeconds !== void 0 ? { retryAfterSeconds: error.retryAfterSeconds } : {},
-      ...error.status !== void 0 ? { status: error.status } : {}
+      ...error.status !== void 0 ? { status: error.status } : {},
+      ...error.disable ? { disable: true } : {}
     };
   }
   const name = error instanceof Error ? error.name : "";
@@ -114,6 +118,12 @@ async function sha256Hex(text) {
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
+// src/props-check.ts
+new Set(Object.getOwnPropertyNames(Object.prototype));
+var isPlainRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isWholeNumber = (v) => typeof v === "number" && Number.isInteger(v);
+var isFiniteNumber = (v) => typeof v === "number" && Number.isFinite(v);
+
 // src/calculated.ts
 var CALCULATED_TYPE = "calculated";
 var MAX_CALCULATED_DECIMALS = 10;
@@ -142,6 +152,17 @@ var calculatedFieldType = {
   value: { json: true },
   operators: numberOps,
   a11y: { semantics: "control" },
+  // A number, unless the format says text; without a format it can hold either, so it isn't known.
+  literal: (props) => props.format === "text" ? "string" : props.format === "number" || props.format === "percent" ? "number" : void 0,
+  // The formula itself is checked once every key is known (`parseForm`).
+  checkProps: (props, check) => {
+    if (props.format !== void 0 && props.format !== "number" && props.format !== "percent" && props.format !== "text") {
+      check.issue("format", "Must be number, percent or text.");
+    }
+    if (props.decimals !== void 0 && !(isWholeNumber(props.decimals) && props.decimals >= 0 && props.decimals <= MAX_CALCULATED_DECIMALS)) {
+      check.issue("decimals", `Must be a whole number from 0 to ${MAX_CALCULATED_DECIMALS}.`);
+    }
+  },
   // The engine works the value out; any number, text or true / false it made is valid.
   validate: (value) => typeof value === "number" || typeof value === "string" || typeof value === "boolean" ? null : "This value is worked out from other answers.",
   summarize: (value, field) => formatCalculated(value, field)
@@ -165,6 +186,7 @@ function listLimits(field) {
   return { min: optionalIntProp(field, "min") ?? 0, max: intProp(field, "max", 10), itemMaxLength: intProp(field, "itemMaxLength", 500) };
 }
 var listItems = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.trim() !== "") : [];
+var MAX_TABLE_COLUMNS = 6;
 var MAX_TABLE_CELL_LENGTH = 2e3;
 function tableColumns(field) {
   const raw = field.props?.columns;
@@ -198,12 +220,42 @@ var MAX_HIGHLIGHT_NOTE_LENGTH = 1e3;
 var MAX_HIGHLIGHT_QUOTE_LENGTH = 2e3;
 var HIGHLIGHT_NOTE_MESSAGE = "Add a note to each highlight.";
 var sourceText = (field) => typeof field.props?.text === "string" && field.props.text ? field.props.text : void 0;
+var listProps = (props, check) => {
+  check.optionalInt(props.min, "min", 0);
+  check.optionalInt(props.max, "max", 1);
+  check.optionalInt(props.itemMaxLength, "itemMaxLength", 1);
+  check.optionalText(props.placeholder, "placeholder");
+  check.ordered(props.min, props.max ?? 10, "min", "most items");
+};
+var tableProps = (props, check) => {
+  const columns = props.columns;
+  if (!Array.isArray(columns) || columns.length < 1 || columns.length > MAX_TABLE_COLUMNS) {
+    check.issue("columns", `Must be a list of 1 to ${MAX_TABLE_COLUMNS} columns.`);
+  } else {
+    const seen = /* @__PURE__ */ new Set();
+    columns.forEach((c, j) => {
+      const at = `columns[${j}]`;
+      if (!isPlainRecord(c)) return check.issue(at, "Each column needs a key and a label.");
+      if (check.name(c.key, `${at}.key`, "A column key")) {
+        if (seen.has(c.key)) check.issue(`${at}.key`, `Duplicate column key "${c.key}".`);
+        seen.add(c.key);
+      }
+      check.text(c.label, `${at}.label`);
+      check.optionalBoolean(c.long, `${at}.long`);
+    });
+  }
+  check.optionalInt(props.minRows, "minRows", 0);
+  check.optionalInt(props.maxRows, "maxRows", 1);
+  check.ordered(props.minRows, props.maxRows ?? 3, "minRows", "most rows");
+};
 var structuredFieldTypes = [
   {
     type: "list",
     label: "List",
     category: "text",
     value: { json: true },
+    literal: "string",
+    checkProps: listProps,
     // logic.ts `contains` on an array is exact item equality, same as multi-choice, so it is offered.
     operators: ["contains", "answered", "empty"],
     a11y: { semantics: "group" },
@@ -229,6 +281,7 @@ var structuredFieldTypes = [
     label: "Table",
     category: "advanced",
     value: { json: true },
+    checkProps: tableProps,
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, (r) => isObject(r) && Object.values(r).every(blankText)),
@@ -272,6 +325,10 @@ var structuredFieldTypes = [
     label: "Notes at moments",
     category: "media",
     value: { json: true },
+    checkProps: (props, check) => {
+      check.optionalInt(props.maxNotes, "maxNotes", 1);
+      check.optionalInt(props.textMaxLength, "textMaxLength", 1);
+    },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, (n) => isObject(n) && blankText(n.text)),
@@ -295,6 +352,10 @@ var structuredFieldTypes = [
     label: "Highlights",
     category: "media",
     value: { json: true },
+    checkProps: (props, check) => {
+      check.optionalText(props.text, "text");
+      check.optionalInt(props.maxHighlights, "maxHighlights", 1);
+    },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, () => false),
@@ -344,6 +405,7 @@ var DEFAULT_PHOTO_SIZE_MB = 10;
 var MAX_PHOTO_SIZE_MB = 25;
 var MAX_PHOTO_ID_LENGTH = 200;
 var MAX_PHOTO_NAME_LENGTH = 255;
+var isPhotoFormat = (v) => typeof v === "string" && Object.prototype.hasOwnProperty.call(PHOTO_FORMATS, v);
 var wholeIn = (v, min, max) => typeof v === "number" && Number.isInteger(v) && v >= min && v <= max;
 function photoLimits(field) {
   const maxFiles = wholeIn(field.props?.maxFiles, 1, MAX_PHOTO_FILES) ? field.props.maxFiles : DEFAULT_PHOTO_FILES;
@@ -385,6 +447,22 @@ var photoFieldType = {
   value: { json: true },
   operators: ["answered", "empty"],
   a11y: { semantics: "group" },
+  checkProps: (props, check) => {
+    if (props.maxFiles !== void 0 && !(isWholeNumber(props.maxFiles) && props.maxFiles >= 1 && props.maxFiles <= MAX_PHOTO_FILES)) {
+      check.issue("maxFiles", `Must be a whole number from 1 to ${MAX_PHOTO_FILES}.`);
+    }
+    if (props.maxSizeMb !== void 0 && !(isWholeNumber(props.maxSizeMb) && props.maxSizeMb >= 1 && props.maxSizeMb <= MAX_PHOTO_SIZE_MB)) {
+      check.issue("maxSizeMb", `Must be a whole number from 1 to ${MAX_PHOTO_SIZE_MB}.`);
+    }
+    if (props.formats !== void 0) {
+      const formats = props.formats;
+      if (!Array.isArray(formats) || formats.length === 0 || !formats.every(isPhotoFormat)) {
+        check.issue("formats", "Must be a list of one or more of jpeg, png, heic and webp.");
+      } else if (new Set(formats).size !== formats.length) {
+        check.issue("formats", "Name each format once.");
+      }
+    }
+  },
   isEmpty: (value) => value === void 0 || value === null || Array.isArray(value) && value.length === 0,
   validate: (value, field) => {
     if (!Array.isArray(value) || !value.every(isPhotoRef)) return "Add a photo.";
@@ -402,22 +480,37 @@ var photoFieldType = {
 };
 
 // src/fields.ts
-var REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/field-types");
+var REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/field-types@2");
+var BUILT_IN = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/built-in-field-types@2");
 var globalScope = globalThis;
 var registry = globalScope[REGISTRY] ??= /* @__PURE__ */ new Map();
-function registerFieldType(manifest) {
-  if (!manifest.type) throw new Error("registerFieldType: a field type needs a `type`.");
-  const value = manifest.value;
-  if (!value.json && (typeof value.serialize !== "function" || typeof value.deserialize !== "function")) {
-    throw new Error(
-      `registerFieldType: "${manifest.type}" stores a non-JSON value, so it must provide both serialize and deserialize.`
-    );
+var builtIn = globalScope[BUILT_IN] ??= /* @__PURE__ */ new Set();
+var freezeRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? Object.freeze({ ...v }) : v;
+function frozen(manifest) {
+  const copy = { ...manifest };
+  for (const key of ["choice", "a11y", "value"]) if (key in copy) copy[key] = freezeRecord(copy[key]);
+  if (Array.isArray(copy.operators)) {
+    const operators = Object.freeze([...copy.operators]);
+    Object.defineProperty(copy, "operators", { get: () => [...operators], enumerable: true });
   }
-  registry.set(manifest.type, manifest);
+  return Object.freeze(copy);
+}
+function registerBuiltIn(manifest) {
+  builtIn.add(manifest.type);
+  if (!registry.has(manifest.type)) registry.set(manifest.type, frozen(manifest));
 }
 function getFieldType(type) {
   return registry.get(type);
 }
+var CONTENT_REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/content-types@1");
+var contentScope = globalThis;
+var contentRegistry = contentScope[CONTENT_REGISTRY] ??= /* @__PURE__ */ new Map();
+for (const manifest of [
+  { type: "heading", label: "Heading" },
+  { type: "text", label: "Text" }
+]) {
+  if (!contentRegistry.has(manifest.type)) contentRegistry.set(manifest.type, frozen(manifest));
+}
 function isEmptyValue(value, field) {
   const manifest = field ? registry.get(field.type) : void 0;
   if (manifest?.isEmpty) return manifest.isEmpty(value);
@@ -550,6 +643,18 @@ function isPhoneNumber(value) {
   }
   return digits >= 7 && digits <= 15;
 }
+var oneOptionValidate = (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.";
+var oneOptionSummary = (value, field) => optionLabel(field, String(value));
+var optionsValidate = (value, field) => {
+  const allowed = new Set(choiceOptions(field).map((o) => o.value));
+  const others = Array.isArray(value) ? value.filter((v) => typeof v === "string" && !allowed.has(v)) : [];
+  return Array.isArray(value) && new Set(value).size === value.length && value.every((v) => typeof v === "string") && (others.length === 0 || others.length === 1 && typedOther(field, others[0])) ? null : "Choose from the options.";
+};
+var optionsSummary = (value, field) => Array.isArray(value) ? value.map((v) => optionLabel(field, String(v))).join(", ") : String(value);
+var scaleProps = (props, check) => {
+  check.optionalText(props.lowLabel, "lowLabel");
+  check.optionalText(props.highLabel, "highLabel");
+};
 var builtins = [
   {
     type: "short-text",
@@ -558,6 +663,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control" },
+    literal: "string",
     validate: textValidate(500)
   },
   {
@@ -567,6 +673,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control" },
+    literal: "string",
     validate: textValidate(5e3)
   },
   {
@@ -576,6 +683,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control", autocomplete: "email", inputMode: "email" },
+    literal: "string",
     validate: (value) => typeof value === "string" && isEmailAddress(value.trim()) ? null : "Enter an email address like name@example.com.",
     normalize: (value) => typeof value === "string" ? value.trim() : value
   },
@@ -586,6 +694,7 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "control", autocomplete: "tel", inputMode: "tel" },
+    literal: "string",
     validate: (value) => typeof value === "string" && isPhoneNumber(value.trim()) ? null : "Enter a phone number with 7 to 15 digits.",
     normalize: (value) => typeof value === "string" ? value.trim() : value,
     summarize: (value) => String(value)
@@ -597,6 +706,13 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "group" },
+    literal: "number",
+    checkProps: (props, check) => {
+      scaleProps(props, check);
+      if (props.display !== void 0 && props.display !== "numbers" && props.display !== "stars") {
+        check.issue("display", "Must be numbers or stars.");
+      }
+    },
     validate: (value, field) => {
       const { min, max } = intRange(field, 1, 5);
       return Number.isInteger(value) && value >= min && value <= max ? null : `Choose a rating from ${min} to ${max}.`;
@@ -614,6 +730,8 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "group" },
+    literal: "number",
+    checkProps: scaleProps,
     validate: (value) => Number.isInteger(value) && value >= 0 && value <= 10 ? null : "Choose a score from 0 to 10.",
     summarize: (value, field) => {
       const end = scaleEndLabel(field, value, 0, 10);
@@ -627,8 +745,10 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "in", "answered", "empty"],
     a11y: { semantics: "group" },
-    validate: (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.",
-    summarize: (value, field) => optionLabel(field, String(value))
+    literal: "string",
+    choice: { multiple: false },
+    validate: oneOptionValidate,
+    summarize: oneOptionSummary
   },
   {
     type: "multi-choice",
@@ -637,12 +757,10 @@ var builtins = [
     value: { json: true },
     operators: ["contains", "answered", "empty"],
     a11y: { semantics: "group" },
-    validate: (value, field) => {
-      const allowed = new Set(choiceOptions(field).map((o) => o.value));
-      const others = Array.isArray(value) ? value.filter((v) => typeof v === "string" && !allowed.has(v)) : [];
-      return Array.isArray(value) && new Set(value).size === value.length && value.every((v) => typeof v === "string") && (others.length === 0 || others.length === 1 && typedOther(field, others[0])) ? null : "Choose from the options.";
-    },
-    summarize: (value, field) => Array.isArray(value) ? value.map((v) => optionLabel(field, String(v))).join(", ") : String(value)
+    literal: "string",
+    choice: { multiple: true },
+    validate: optionsValidate,
+    summarize: optionsSummary
   },
   {
     type: "yes-no",
@@ -651,6 +769,7 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "group" },
+    literal: "boolean",
     validate: (value) => typeof value === "boolean" ? null : "Choose yes or no.",
     summarize: (value) => value ? "Yes" : "No"
   },
@@ -661,8 +780,10 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "in", "answered", "empty"],
     a11y: { semantics: "control" },
-    validate: (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.",
-    summarize: (value, field) => optionLabel(field, String(value))
+    literal: "string",
+    choice: { multiple: false },
+    validate: oneOptionValidate,
+    summarize: oneOptionSummary
   },
   {
     type: "number",
@@ -671,6 +792,16 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "control", inputMode: "decimal" },
+    literal: "number",
+    checkProps: (props, check) => {
+      for (const k of ["min", "max", "step"]) {
+        if (props[k] !== void 0 && !isFiniteNumber(props[k])) check.issue(k, "Must be a number.");
+      }
+      if (isFiniteNumber(props.step) && props.step <= 0) check.issue("step", "Must be above 0.");
+      if (isFiniteNumber(props.min) && isFiniteNumber(props.max) && props.min > props.max) {
+        check.issue("min", "Can't be more than the largest number.");
+      }
+    },
     validate: (value, field) => {
       if (typeof value !== "number" || !Number.isFinite(value)) return "Enter a number.";
       const { min, max, step } = numberLimits(field);
@@ -697,6 +828,17 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "control" },
+    literal: "string",
+    checkProps: (props, check) => {
+      for (const k of ["min", "max"]) {
+        if (props[k] !== void 0 && !(typeof props[k] === "string" && isIsoDate(props[k]))) {
+          check.issue(k, "Must be a date like 2026-10-22.");
+        }
+      }
+      if (typeof props.min === "string" && typeof props.max === "string" && isIsoDate(props.min) && isIsoDate(props.max) && props.min > props.max) {
+        check.issue("min", "Can't be after the latest date.");
+      }
+    },
     validate: (value, field) => {
       if (typeof value !== "string" || !isIsoDate(value.trim())) return "Enter a date like 2026-10-22.";
       const date = value.trim();
@@ -719,6 +861,8 @@ var builtins = [
     value: { json: true },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
+    literal: "boolean",
+    checkProps: (props, check) => check.optionalText(props.text, "text"),
     // Unchecked is unanswered, so a required consent must be checked.
     isEmpty: (value) => value === void 0 || value === null || value === false,
     validate: (value) => value === true ? null : "Check the box to agree.",
@@ -768,7 +912,7 @@ function dateLimits(field) {
   if (typeof max === "string" && isIsoDate(max)) out.max = max;
   return out;
 }
-for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldType, photoFieldType]) registerFieldType(manifest);
+for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldType, photoFieldType]) registerBuiltIn(manifest);
 
 // src/logic.ts
 function own(record, key) {
@@ -1529,7 +1673,7 @@ function hookHost(url) {
 }
 
 // src/destinations/webhook.ts
-var MIN_SECRET_BYTES = 16;
+var MIN_WEBHOOK_SECRET_BYTES = 24;
 var STRICT_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 function secretKey(secret) {
   const encoded = secret.startsWith("whsec_") ? secret.slice(6) : secret;
@@ -1539,7 +1683,9 @@ function secretKey(secret) {
     );
   }
   const bytes = fromBase64(encoded);
-  if (bytes.length < MIN_SECRET_BYTES) throw new DeliveryError(`The webhook secret is shorter than ${MIN_SECRET_BYTES} bytes`);
+  if (bytes.length < MIN_WEBHOOK_SECRET_BYTES) {
+    throw new DeliveryError(`The webhook secret is shorter than ${MIN_WEBHOOK_SECRET_BYTES} bytes`);
+  }
   return bytes;
 }
 async function hmacKey(secret, usage) {
@@ -1549,9 +1695,15 @@ function newWebhookSecret() {
   return `whsec_${base64(crypto.getRandomValues(new Uint8Array(32)))}`;
 }
 async function signWebhook(secret, id, timestamp, body) {
-  const key = await hmacKey(secret, "sign");
-  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${id}.${timestamp}.${body}`));
-  return `v1,${base64(new Uint8Array(mac))}`;
+  const secrets = typeof secret === "string" ? [secret] : secret;
+  if (secrets.length === 0) throw new DeliveryError("The webhook secret is not set");
+  const data = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
+  const signatures = [];
+  for (const one of secrets) {
+    const key = await hmacKey(one, "sign");
+    signatures.push(`v1,${base64(new Uint8Array(await crypto.subtle.sign("HMAC", key, data)))}`);
+  }
+  return signatures.join(" ");
 }
 async function verifyWebhook(input) {
   const header = (name) => {
@@ -1565,12 +1717,14 @@ async function verifyWebhook(input) {
   if (!id || !/^\d{1,12}$/.test(timestamp) || !signatures) return false;
   const now = Math.floor((input.now?.() ?? Date.now()) / 1e3);
   if (Math.abs(now - Number(timestamp)) > (input.toleranceSeconds ?? 300)) return false;
-  let key;
-  try {
-    key = await hmacKey(input.secret, "verify");
-  } catch {
-    return false;
+  const keys = [];
+  for (const secret of typeof input.secret === "string" ? [input.secret] : input.secret) {
+    try {
+      keys.push(await hmacKey(secret, "verify"));
+    } catch {
+    }
   }
+  if (keys.length === 0) return false;
   const data = new TextEncoder().encode(`${id}.${timestamp}.${input.body}`);
   for (const part of signatures.split(" ")) {
     const [version, value] = part.split(",", 2);
@@ -1581,7 +1735,7 @@ async function verifyWebhook(input) {
     } catch {
       continue;
     }
-    if (await crypto.subtle.verify("HMAC", key, mac, data)) return true;
+    for (const key of keys) if (await crypto.subtle.verify("HMAC", key, mac, data)) return true;
   }
   return false;
 }
@@ -1646,9 +1800,10 @@ function webhookPayload(submission, definition, options = {}) {
     for (const [name, value] of Object.entries(source ?? {})) if (own(allowed, name) !== void 0) out[name] = value;
     return out;
   };
+  const happened = submission.submittedAt ? Date.parse(submission.submittedAt) : Number.NaN;
   return {
     type: options.type ?? "form.submitted",
-    timestamp: new Date(options.now ?? Date.now()).toISOString(),
+    timestamp: new Date(Number.isNaN(happened) ? options.now ?? Date.now() : happened).toISOString(),
     data: {
       form: { id: definition.id, title: definition.title },
       submission: {
@@ -1675,7 +1830,7 @@ function webhookDestination(options) {
         const url = checkWebhookUrl(typeof raw === "string" ? raw.trim() : "", options);
         if (options.resolveHost && !options.allowPrivateHosts) await checkHookHost(url, options.resolveHost);
         const secret = await resolveOption("The webhook secret", options.secret, config, context);
-        if (!secret) throw new DeliveryError("The webhook secret is not set");
+        if (!secret || secret.length === 0) throw new DeliveryError("The webhook secret is not set");
         const now = options.now?.() ?? Date.now();
         const id = deliveryOptions.deliveryId ?? submission.id;
         const timestamp = Math.floor(now / 1e3);
@@ -1700,6 +1855,9 @@ function webhookDestination(options) {
         );
         discard(response);
         if (response.status >= 200 && response.status < 300) return { ok: true };
+        if (response.status === 410) {
+          throw new DeliveryError("Webhook answered 410: the endpoint is gone; disable the destination", { status: 410, disable: true });
+        }
         if (response.status === 0 || response.status >= 300 && response.status < 400) {
           throw new DeliveryError(`Webhook answered ${response.status || "a redirect"}: redirects are not followed`, {
             ...response.status ? { status: response.status } : {}
@@ -1902,11 +2060,12 @@ function secretKeyBytes(key) {
   if (bytes.length !== 32) throw new DeliveryError("The encryption key must be 32 bytes");
   return bytes;
 }
-async function deriveSecretKey(key, info) {
+async function deriveSecretKey(key, info, options = {}) {
   if (!info) throw new DeliveryError("A sealing key needs its purpose (info)");
+  const salt = typeof options.salt === "string" ? enc.encode(options.salt) : new Uint8Array(options.salt ?? new Uint8Array(0));
   const base = await crypto.subtle.importKey("raw", secretKeyBytes(key), "HKDF", false, ["deriveKey"]);
   return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc.encode(info) },
+    { name: "HKDF", hash: "SHA-256", salt, info: enc.encode(info) },
     base,
     { name: "AES-GCM", length: 256 },
     false,
@@ -1936,16 +2095,22 @@ function padded(text) {
   return fromBase64(text + "=".repeat((4 - text.length % 4) % 4));
 }
 
-// src/destinations/runner.ts
+// ../notifications/src/runner/index.ts
 var DEFAULT_MAX_ATTEMPTS = 8;
 var DEFAULT_MAX_DEFERRALS = 24;
 var DEFAULT_BATCH_SIZE = 25;
-function defaultBackoff(attempt) {
-  return Math.min(6 * 3600, 60 * 2 ** Math.max(0, attempt - 1));
-}
-function deliveryOutcome(result, attempt, options = {}) {
-  if (result.ok) return result.notSent ? { status: "skipped", reason: result.notSent.slice(0, 500) } : { status: "sent" };
+function defaultBackoff(attempt, random) {
+  const nominal = Math.min(24 * 3600, 300 * 4 ** Math.max(0, attempt - 1));
+  const r = typeof random === "function" ? random() : Math.random();
+  return Math.round(nominal * (0.8 + 0.4 * Math.min(1, Math.max(0, r))));
+}
+function jobOutcome(result, attempt, options = {}) {
+  if (result.ok) {
+    if (result.notSent) return { status: "skipped", reason: result.notSent.slice(0, 500) };
+    return result.alreadyThere ? { status: "sent", alreadyThere: true } : { status: "sent" };
+  }
   const http = result.status !== void 0 ? { httpStatus: result.status } : {};
+  if (result.disable) return { status: "failed", error: result.error, ...http, disable: true };
   if (!result.retryable) return { status: "failed", error: result.error, ...http };
   const now = options.now ?? Date.now();
   if (result.retryAfterSeconds !== void 0 && (options.deferrals ?? 0) < (options.maxDeferrals ?? DEFAULT_MAX_DEFERRALS)) {
@@ -1957,14 +2122,109 @@ function deliveryOutcome(result, attempt, options = {}) {
   const seconds = Math.max(1, Math.ceil((options.backoff ?? defaultBackoff)(attempt)));
   return { status: "retry", error: result.error, retryAt: new Date(now + seconds * 1e3), retryAfterSeconds: seconds, counted: true, ...http };
 }
-function createDeliveryRunner(options) {
+function failureOf(error) {
+  const e = error;
+  if (e && typeof e === "object" && typeof e.retryable === "boolean" && typeof e.message === "string") {
+    return {
+      ok: false,
+      retryable: e.disable === true ? false : e.retryable,
+      error: e.message.slice(0, 500),
+      ...typeof e.retryAfterSeconds === "number" ? { retryAfterSeconds: e.retryAfterSeconds } : {},
+      ...typeof e.status === "number" ? { status: e.status } : {},
+      ...e.disable === true ? { disable: true } : {}
+    };
+  }
+  const timeout = e && typeof e === "object" && (e.name === "TimeoutError" || e.name === "AbortError");
+  return { ok: false, retryable: true, error: timeout ? "Timed out" : "Unexpected error" };
+}
+function createRunner(options) {
   const log = (message) => {
     try {
       options.log?.(message);
     } catch {
     }
   };
+  const label = (job) => options.label?.(job) ?? `Job ${job.id}`;
+  const recordLabel = (job) => options.recordLabel?.(job) ?? `job ${job.id}`;
   const now = () => options.now?.() ?? Date.now();
+  return {
+    async run(runOptions = {}) {
+      const report = { claimed: 0, sent: 0, filtered: 0, skipped: 0, retrying: 0, deferred: 0, failed: 0, stale: 0, unrecorded: 0 };
+      const limit = runOptions.limit ?? options.batchSize ?? DEFAULT_BATCH_SIZE;
+      const claimed = await options.claim({ limit, filter: runOptions.filter });
+      report.claimed = claimed.length;
+      const groups = /* @__PURE__ */ new Map();
+      claimed.forEach((job, i) => {
+        const key = options.group ? options.group(job) : `\0${i}`;
+        const list = groups.get(key) ?? [];
+        list.push(job);
+        groups.set(key, list);
+      });
+      await Promise.all(
+        [...groups.values()].map(async (group) => {
+          let results;
+          try {
+            results = await options.send(group, { signal: runOptions.signal });
+            if (results.length !== group.length) throw new Error("send answered the wrong number of results");
+          } catch (error) {
+            const failure = failureOf(error);
+            results = group.map(() => failure);
+          }
+          const at = now();
+          await Promise.all(
+            group.map(async (job, i) => {
+              const result = results[i];
+              const outcome = result === "filtered" ? { status: "filtered" } : jobOutcome(result, job.attempt, {
+                now: at,
+                maxAttempts: options.maxAttempts,
+                backoff: options.backoff,
+                deferrals: job.deferrals,
+                maxDeferrals: options.maxDeferrals
+              });
+              if (outcome.status === "failed" || outcome.status === "retry") {
+                log(`${label(job)} ${outcome.status === "failed" ? "failed" : "will be retried"}: ${outcome.error}`);
+              } else if (outcome.status === "skipped") {
+                log(`${label(job)} skipped: ${outcome.reason}`);
+              }
+              let recorded;
+              try {
+                recorded = await options.record(job, outcome);
+              } catch {
+                report.unrecorded++;
+                log(`Recording ${recordLabel(job)} failed`);
+                return;
+              }
+              if (recorded === false) report.stale++;
+              else if (outcome.status === "sent") report.sent++;
+              else if (outcome.status === "filtered") report.filtered++;
+              else if (outcome.status === "skipped") report.skipped++;
+              else if (outcome.status === "failed") report.failed++;
+              else if (outcome.counted) report.retrying++;
+              else report.deferred++;
+            })
+          );
+        })
+      );
+      return report;
+    }
+  };
+}
+
+// src/destinations/runner.ts
+var DEFAULT_MAX_ATTEMPTS2 = DEFAULT_MAX_ATTEMPTS;
+var DEFAULT_MAX_DEFERRALS2 = DEFAULT_MAX_DEFERRALS;
+var DEFAULT_BATCH_SIZE2 = DEFAULT_BATCH_SIZE;
+var defaultBackoff2 = defaultBackoff;
+function deliveryOutcome(result, attempt, options = {}) {
+  return jobOutcome(result.ok ? { ok: true, notSent: result.notSent } : result, attempt, options);
+}
+function createDeliveryRunner(options) {
+  const log = (message) => {
+    try {
+      options.log?.(message);
+    } catch {
+    }
+  };
   async function send(group, signal) {
     const first = group[0];
     const destination = options.destinations[first.kind];
@@ -2025,78 +2285,34 @@ function createDeliveryRunner(options) {
     let next = 0;
     return results.map((r) => r ?? sent[next++]);
   }
-  return {
-    async run(runOptions = {}) {
-      const report = {
-        claimed: 0,
-        sent: 0,
-        filtered: 0,
-        skipped: 0,
-        retrying: 0,
-        deferred: 0,
-        failed: 0,
-        stale: 0,
-        unrecorded: 0
-      };
-      const limit = runOptions.limit ?? options.batchSize ?? DEFAULT_BATCH_SIZE;
-      const claimed = await options.claim({ limit, filter: runOptions.filter });
-      report.claimed = claimed.length;
-      const groups = /* @__PURE__ */ new Map();
-      for (const delivery of claimed) {
-        const list = groups.get(delivery.destinationId) ?? [];
-        list.push(delivery);
-        groups.set(delivery.destinationId, list);
-      }
-      await Promise.all(
-        [...groups.values()].map(async (group) => {
-          const results = await send(group, runOptions.signal);
-          const at = now();
-          await Promise.all(
-            group.map(async (delivery, i) => {
-              const result = results[i];
-              const outcome = result === "filtered" ? { status: "filtered" } : deliveryOutcome(result, delivery.attempt, {
-                now: at,
-                maxAttempts: options.maxAttempts,
-                backoff: options.backoff,
-                deferrals: delivery.deferrals,
-                maxDeferrals: options.maxDeferrals
-              });
-              if (outcome.status === "sent" && result !== "filtered" && result.ok && result.skipped?.includes(delivery.submission.id)) {
-                outcome.alreadyThere = true;
-              }
-              if (outcome.status === "failed" || outcome.status === "retry") {
-                log(`Delivery ${delivery.id} (${delivery.kind}) ${outcome.status === "failed" ? "failed" : "will be retried"}: ${outcome.error}`);
-              } else if (outcome.status === "skipped") {
-                log(`Delivery ${delivery.id} (${delivery.kind}) skipped: ${outcome.reason}`);
-              }
-              let recorded;
-              try {
-                recorded = await options.record(delivery, outcome);
-              } catch {
-                report.unrecorded++;
-                log(`Recording delivery ${delivery.id} failed`);
-                return;
-              }
-              if (recorded === false) report.stale++;
-              else if (outcome.status === "sent") report.sent++;
-              else if (outcome.status === "filtered") report.filtered++;
-              else if (outcome.status === "skipped") report.skipped++;
-              else if (outcome.status === "failed") report.failed++;
-              else if (outcome.counted) report.retrying++;
-              else report.deferred++;
-            })
-          );
-        })
-      );
-      return report;
-    }
-  };
+  return createRunner({
+    claim: options.claim,
+    // One group per destination: a sheet gets one append for all its rows.
+    group: (delivery) => delivery.destinationId,
+    async send(group, { signal }) {
+      const results = await send(group, signal);
+      return results.map((result, i) => {
+        if (result === "filtered") return result;
+        if (!result.ok) return result;
+        return { ok: true, notSent: result.notSent, alreadyThere: result.skipped?.includes(group[i].submission.id) && !result.notSent };
+      });
+    },
+    record: options.record,
+    now: options.now,
+    log: options.log,
+    label: (delivery) => `Delivery ${delivery.id} (${delivery.kind})`,
+    recordLabel: (delivery) => `delivery ${delivery.id}`,
+    batchSize: options.batchSize,
+    maxAttempts: options.maxAttempts,
+    maxDeferrals: options.maxDeferrals,
+    backoff: options.backoff
+  });
 }
 
 exports.DEDUPE_WINDOW = DEDUPE_WINDOW;
-exports.DEFAULT_BATCH_SIZE = DEFAULT_BATCH_SIZE;
-exports.DEFAULT_MAX_ATTEMPTS = DEFAULT_MAX_ATTEMPTS;
-exports.DEFAULT_MAX_DEFERRALS = DEFAULT_MAX_DEFERRALS;
+exports.DEFAULT_BATCH_SIZE = DEFAULT_BATCH_SIZE2;
+exports.DEFAULT_MAX_ATTEMPTS = DEFAULT_MAX_ATTEMPTS2;
+exports.DEFAULT_MAX_DEFERRALS = DEFAULT_MAX_DEFERRALS2;
 exports.DEFAULT_SHEET_NAME = DEFAULT_SHEET_NAME;
 exports.DRIVE_FILE_SCOPE = DRIVE_FILE_SCOPE;
 exports.DeliveryError = DeliveryError;
@@ -2106,6 +2322,7 @@ exports.HookUrlError = HookUrlError;
 exports.MAX_CONDITION_DEPTH = MAX_CONDITION_DEPTH;
 exports.MAX_HOOK_URL_LENGTH = MAX_HOOK_URL_LENGTH;
 exports.MAX_RECIPIENTS = MAX_RECIPIENTS;
+exports.MIN_WEBHOOK_SECRET_BYTES = MIN_WEBHOOK_SECRET_BYTES;
 exports.REQUEST_TIMEOUT_MS = REQUEST_TIMEOUT_MS;
 exports.RESEND_API = RESEND_API;
 exports.SENSITIVE_MASK = SENSITIVE_MASK;
@@ -2121,7 +2338,7 @@ exports.clearGoogleTokenCache = clearGoogleTokenCache;
 exports.columnLetter = columnLetter;
 exports.conditionOf = conditionOf;
 exports.createDeliveryRunner = createDeliveryRunner;
-exports.defaultBackoff = defaultBackoff;
+exports.defaultBackoff = defaultBackoff2;
 exports.deliveryFailure = deliveryFailure;
 exports.deliveryOutcome = deliveryOutcome;
 exports.deriveSecretKey = deriveSecretKey;