@marktiderman/genesis-forms 0.8.0 → 0.9.1

package/dist/destinations.js

@@ -4,9 +4,12 @@ var DeliveryError = class extends Error {
   retryable;
   retryAfterSeconds;
   status;
+  /** The receiver asked to be switched off (`DeliveryFailure.disable`); never retryable. */
+  disable;
   constructor(message, options = {}) {
     super(message);
-    this.retryable = options.retryable ?? false;
+    this.disable = options.disable ?? false;
+    this.retryable = !this.disable && (options.retryable ?? false);
     this.retryAfterSeconds = options.retryAfterSeconds;
     this.status = options.status;
   }
@@ -47,7 +50,8 @@ function deliveryFailure(error) {
       retryable: error.retryable,
       error: error.message.slice(0, 500),
       ...error.retryAfterSeconds !== void 0 ? { retryAfterSeconds: error.retryAfterSeconds } : {},
-      ...error.status !== void 0 ? { status: error.status } : {}
+      ...error.status !== void 0 ? { status: error.status } : {},
+      ...error.disable ? { disable: true } : {}
     };
   }
   const name = error instanceof Error ? error.name : "";
@@ -112,6 +116,12 @@ async function sha256Hex(text) {
   return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
 }
 
+// src/props-check.ts
+new Set(Object.getOwnPropertyNames(Object.prototype));
+var isPlainRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+var isWholeNumber = (v) => typeof v === "number" && Number.isInteger(v);
+var isFiniteNumber = (v) => typeof v === "number" && Number.isFinite(v);
+
 // src/calculated.ts
 var CALCULATED_TYPE = "calculated";
 var MAX_CALCULATED_DECIMALS = 10;
@@ -140,6 +150,17 @@ var calculatedFieldType = {
   value: { json: true },
   operators: numberOps,
   a11y: { semantics: "control" },
+  // A number, unless the format says text; without a format it can hold either, so it isn't known.
+  literal: (props) => props.format === "text" ? "string" : props.format === "number" || props.format === "percent" ? "number" : void 0,
+  // The formula itself is checked once every key is known (`parseForm`).
+  checkProps: (props, check) => {
+    if (props.format !== void 0 && props.format !== "number" && props.format !== "percent" && props.format !== "text") {
+      check.issue("format", "Must be number, percent or text.");
+    }
+    if (props.decimals !== void 0 && !(isWholeNumber(props.decimals) && props.decimals >= 0 && props.decimals <= MAX_CALCULATED_DECIMALS)) {
+      check.issue("decimals", `Must be a whole number from 0 to ${MAX_CALCULATED_DECIMALS}.`);
+    }
+  },
   // The engine works the value out; any number, text or true / false it made is valid.
   validate: (value) => typeof value === "number" || typeof value === "string" || typeof value === "boolean" ? null : "This value is worked out from other answers.",
   summarize: (value, field) => formatCalculated(value, field)
@@ -163,6 +184,7 @@ function listLimits(field) {
   return { min: optionalIntProp(field, "min") ?? 0, max: intProp(field, "max", 10), itemMaxLength: intProp(field, "itemMaxLength", 500) };
 }
 var listItems = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string" && v.trim() !== "") : [];
+var MAX_TABLE_COLUMNS = 6;
 var MAX_TABLE_CELL_LENGTH = 2e3;
 function tableColumns(field) {
   const raw = field.props?.columns;
@@ -196,12 +218,42 @@ var MAX_HIGHLIGHT_NOTE_LENGTH = 1e3;
 var MAX_HIGHLIGHT_QUOTE_LENGTH = 2e3;
 var HIGHLIGHT_NOTE_MESSAGE = "Add a note to each highlight.";
 var sourceText = (field) => typeof field.props?.text === "string" && field.props.text ? field.props.text : void 0;
+var listProps = (props, check) => {
+  check.optionalInt(props.min, "min", 0);
+  check.optionalInt(props.max, "max", 1);
+  check.optionalInt(props.itemMaxLength, "itemMaxLength", 1);
+  check.optionalText(props.placeholder, "placeholder");
+  check.ordered(props.min, props.max ?? 10, "min", "most items");
+};
+var tableProps = (props, check) => {
+  const columns = props.columns;
+  if (!Array.isArray(columns) || columns.length < 1 || columns.length > MAX_TABLE_COLUMNS) {
+    check.issue("columns", `Must be a list of 1 to ${MAX_TABLE_COLUMNS} columns.`);
+  } else {
+    const seen = /* @__PURE__ */ new Set();
+    columns.forEach((c, j) => {
+      const at = `columns[${j}]`;
+      if (!isPlainRecord(c)) return check.issue(at, "Each column needs a key and a label.");
+      if (check.name(c.key, `${at}.key`, "A column key")) {
+        if (seen.has(c.key)) check.issue(`${at}.key`, `Duplicate column key "${c.key}".`);
+        seen.add(c.key);
+      }
+      check.text(c.label, `${at}.label`);
+      check.optionalBoolean(c.long, `${at}.long`);
+    });
+  }
+  check.optionalInt(props.minRows, "minRows", 0);
+  check.optionalInt(props.maxRows, "maxRows", 1);
+  check.ordered(props.minRows, props.maxRows ?? 3, "minRows", "most rows");
+};
 var structuredFieldTypes = [
   {
     type: "list",
     label: "List",
     category: "text",
     value: { json: true },
+    literal: "string",
+    checkProps: listProps,
     // logic.ts `contains` on an array is exact item equality, same as multi-choice, so it is offered.
     operators: ["contains", "answered", "empty"],
     a11y: { semantics: "group" },
@@ -227,6 +279,7 @@ var structuredFieldTypes = [
     label: "Table",
     category: "advanced",
     value: { json: true },
+    checkProps: tableProps,
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, (r) => isObject(r) && Object.values(r).every(blankText)),
@@ -270,6 +323,10 @@ var structuredFieldTypes = [
     label: "Notes at moments",
     category: "media",
     value: { json: true },
+    checkProps: (props, check) => {
+      check.optionalInt(props.maxNotes, "maxNotes", 1);
+      check.optionalInt(props.textMaxLength, "textMaxLength", 1);
+    },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, (n) => isObject(n) && blankText(n.text)),
@@ -293,6 +350,10 @@ var structuredFieldTypes = [
     label: "Highlights",
     category: "media",
     value: { json: true },
+    checkProps: (props, check) => {
+      check.optionalText(props.text, "text");
+      check.optionalInt(props.maxHighlights, "maxHighlights", 1);
+    },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
     isEmpty: (value) => emptyList(value, () => false),
@@ -342,6 +403,7 @@ var DEFAULT_PHOTO_SIZE_MB = 10;
 var MAX_PHOTO_SIZE_MB = 25;
 var MAX_PHOTO_ID_LENGTH = 200;
 var MAX_PHOTO_NAME_LENGTH = 255;
+var isPhotoFormat = (v) => typeof v === "string" && Object.prototype.hasOwnProperty.call(PHOTO_FORMATS, v);
 var wholeIn = (v, min, max) => typeof v === "number" && Number.isInteger(v) && v >= min && v <= max;
 function photoLimits(field) {
   const maxFiles = wholeIn(field.props?.maxFiles, 1, MAX_PHOTO_FILES) ? field.props.maxFiles : DEFAULT_PHOTO_FILES;
@@ -383,6 +445,22 @@ var photoFieldType = {
   value: { json: true },
   operators: ["answered", "empty"],
   a11y: { semantics: "group" },
+  checkProps: (props, check) => {
+    if (props.maxFiles !== void 0 && !(isWholeNumber(props.maxFiles) && props.maxFiles >= 1 && props.maxFiles <= MAX_PHOTO_FILES)) {
+      check.issue("maxFiles", `Must be a whole number from 1 to ${MAX_PHOTO_FILES}.`);
+    }
+    if (props.maxSizeMb !== void 0 && !(isWholeNumber(props.maxSizeMb) && props.maxSizeMb >= 1 && props.maxSizeMb <= MAX_PHOTO_SIZE_MB)) {
+      check.issue("maxSizeMb", `Must be a whole number from 1 to ${MAX_PHOTO_SIZE_MB}.`);
+    }
+    if (props.formats !== void 0) {
+      const formats = props.formats;
+      if (!Array.isArray(formats) || formats.length === 0 || !formats.every(isPhotoFormat)) {
+        check.issue("formats", "Must be a list of one or more of jpeg, png, heic and webp.");
+      } else if (new Set(formats).size !== formats.length) {
+        check.issue("formats", "Name each format once.");
+      }
+    }
+  },
   isEmpty: (value) => value === void 0 || value === null || Array.isArray(value) && value.length === 0,
   validate: (value, field) => {
     if (!Array.isArray(value) || !value.every(isPhotoRef)) return "Add a photo.";
@@ -400,22 +478,37 @@ var photoFieldType = {
 };
 
 // src/fields.ts
-var REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/field-types");
+var REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/field-types@2");
+var BUILT_IN = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/built-in-field-types@2");
 var globalScope = globalThis;
 var registry = globalScope[REGISTRY] ??= /* @__PURE__ */ new Map();
-function registerFieldType(manifest) {
-  if (!manifest.type) throw new Error("registerFieldType: a field type needs a `type`.");
-  const value = manifest.value;
-  if (!value.json && (typeof value.serialize !== "function" || typeof value.deserialize !== "function")) {
-    throw new Error(
-      `registerFieldType: "${manifest.type}" stores a non-JSON value, so it must provide both serialize and deserialize.`
-    );
+var builtIn = globalScope[BUILT_IN] ??= /* @__PURE__ */ new Set();
+var freezeRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? Object.freeze({ ...v }) : v;
+function frozen(manifest) {
+  const copy = { ...manifest };
+  for (const key of ["choice", "a11y", "value"]) if (key in copy) copy[key] = freezeRecord(copy[key]);
+  if (Array.isArray(copy.operators)) {
+    const operators = Object.freeze([...copy.operators]);
+    Object.defineProperty(copy, "operators", { get: () => [...operators], enumerable: true });
   }
-  registry.set(manifest.type, manifest);
+  return Object.freeze(copy);
+}
+function registerBuiltIn(manifest) {
+  builtIn.add(manifest.type);
+  if (!registry.has(manifest.type)) registry.set(manifest.type, frozen(manifest));
 }
 function getFieldType(type) {
   return registry.get(type);
 }
+var CONTENT_REGISTRY = /* @__PURE__ */ Symbol.for("@marktiderman/genesis-forms/content-types@1");
+var contentScope = globalThis;
+var contentRegistry = contentScope[CONTENT_REGISTRY] ??= /* @__PURE__ */ new Map();
+for (const manifest of [
+  { type: "heading", label: "Heading" },
+  { type: "text", label: "Text" }
+]) {
+  if (!contentRegistry.has(manifest.type)) contentRegistry.set(manifest.type, frozen(manifest));
+}
 function isEmptyValue(value, field) {
   const manifest = field ? registry.get(field.type) : void 0;
   if (manifest?.isEmpty) return manifest.isEmpty(value);
@@ -548,6 +641,18 @@ function isPhoneNumber(value) {
   }
   return digits >= 7 && digits <= 15;
 }
+var oneOptionValidate = (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.";
+var oneOptionSummary = (value, field) => optionLabel(field, String(value));
+var optionsValidate = (value, field) => {
+  const allowed = new Set(choiceOptions(field).map((o) => o.value));
+  const others = Array.isArray(value) ? value.filter((v) => typeof v === "string" && !allowed.has(v)) : [];
+  return Array.isArray(value) && new Set(value).size === value.length && value.every((v) => typeof v === "string") && (others.length === 0 || others.length === 1 && typedOther(field, others[0])) ? null : "Choose from the options.";
+};
+var optionsSummary = (value, field) => Array.isArray(value) ? value.map((v) => optionLabel(field, String(v))).join(", ") : String(value);
+var scaleProps = (props, check) => {
+  check.optionalText(props.lowLabel, "lowLabel");
+  check.optionalText(props.highLabel, "highLabel");
+};
 var builtins = [
   {
     type: "short-text",
@@ -556,6 +661,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control" },
+    literal: "string",
     validate: textValidate(500)
   },
   {
@@ -565,6 +671,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control" },
+    literal: "string",
     validate: textValidate(5e3)
   },
   {
@@ -574,6 +681,7 @@ var builtins = [
     value: { json: true },
     operators: textOps,
     a11y: { semantics: "control", autocomplete: "email", inputMode: "email" },
+    literal: "string",
     validate: (value) => typeof value === "string" && isEmailAddress(value.trim()) ? null : "Enter an email address like name@example.com.",
     normalize: (value) => typeof value === "string" ? value.trim() : value
   },
@@ -584,6 +692,7 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "control", autocomplete: "tel", inputMode: "tel" },
+    literal: "string",
     validate: (value) => typeof value === "string" && isPhoneNumber(value.trim()) ? null : "Enter a phone number with 7 to 15 digits.",
     normalize: (value) => typeof value === "string" ? value.trim() : value,
     summarize: (value) => String(value)
@@ -595,6 +704,13 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "group" },
+    literal: "number",
+    checkProps: (props, check) => {
+      scaleProps(props, check);
+      if (props.display !== void 0 && props.display !== "numbers" && props.display !== "stars") {
+        check.issue("display", "Must be numbers or stars.");
+      }
+    },
     validate: (value, field) => {
       const { min, max } = intRange(field, 1, 5);
       return Number.isInteger(value) && value >= min && value <= max ? null : `Choose a rating from ${min} to ${max}.`;
@@ -612,6 +728,8 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "group" },
+    literal: "number",
+    checkProps: scaleProps,
     validate: (value) => Number.isInteger(value) && value >= 0 && value <= 10 ? null : "Choose a score from 0 to 10.",
     summarize: (value, field) => {
       const end = scaleEndLabel(field, value, 0, 10);
@@ -625,8 +743,10 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "in", "answered", "empty"],
     a11y: { semantics: "group" },
-    validate: (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.",
-    summarize: (value, field) => optionLabel(field, String(value))
+    literal: "string",
+    choice: { multiple: false },
+    validate: oneOptionValidate,
+    summarize: oneOptionSummary
   },
   {
     type: "multi-choice",
@@ -635,12 +755,10 @@ var builtins = [
     value: { json: true },
     operators: ["contains", "answered", "empty"],
     a11y: { semantics: "group" },
-    validate: (value, field) => {
-      const allowed = new Set(choiceOptions(field).map((o) => o.value));
-      const others = Array.isArray(value) ? value.filter((v) => typeof v === "string" && !allowed.has(v)) : [];
-      return Array.isArray(value) && new Set(value).size === value.length && value.every((v) => typeof v === "string") && (others.length === 0 || others.length === 1 && typedOther(field, others[0])) ? null : "Choose from the options.";
-    },
-    summarize: (value, field) => Array.isArray(value) ? value.map((v) => optionLabel(field, String(v))).join(", ") : String(value)
+    literal: "string",
+    choice: { multiple: true },
+    validate: optionsValidate,
+    summarize: optionsSummary
   },
   {
     type: "yes-no",
@@ -649,6 +767,7 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "group" },
+    literal: "boolean",
     validate: (value) => typeof value === "boolean" ? null : "Choose yes or no.",
     summarize: (value) => value ? "Yes" : "No"
   },
@@ -659,8 +778,10 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "in", "answered", "empty"],
     a11y: { semantics: "control" },
-    validate: (value, field) => typeof value === "string" && (choiceOptions(field).some((o) => o.value === value) || typedOther(field, value)) ? null : "Choose one of the options.",
-    summarize: (value, field) => optionLabel(field, String(value))
+    literal: "string",
+    choice: { multiple: false },
+    validate: oneOptionValidate,
+    summarize: oneOptionSummary
   },
   {
     type: "number",
@@ -669,6 +790,16 @@ var builtins = [
     value: { json: true },
     operators: numberOps2,
     a11y: { semantics: "control", inputMode: "decimal" },
+    literal: "number",
+    checkProps: (props, check) => {
+      for (const k of ["min", "max", "step"]) {
+        if (props[k] !== void 0 && !isFiniteNumber(props[k])) check.issue(k, "Must be a number.");
+      }
+      if (isFiniteNumber(props.step) && props.step <= 0) check.issue("step", "Must be above 0.");
+      if (isFiniteNumber(props.min) && isFiniteNumber(props.max) && props.min > props.max) {
+        check.issue("min", "Can't be more than the largest number.");
+      }
+    },
     validate: (value, field) => {
       if (typeof value !== "number" || !Number.isFinite(value)) return "Enter a number.";
       const { min, max, step } = numberLimits(field);
@@ -695,6 +826,17 @@ var builtins = [
     value: { json: true },
     operators: ["eq", "neq", "answered", "empty"],
     a11y: { semantics: "control" },
+    literal: "string",
+    checkProps: (props, check) => {
+      for (const k of ["min", "max"]) {
+        if (props[k] !== void 0 && !(typeof props[k] === "string" && isIsoDate(props[k]))) {
+          check.issue(k, "Must be a date like 2026-10-22.");
+        }
+      }
+      if (typeof props.min === "string" && typeof props.max === "string" && isIsoDate(props.min) && isIsoDate(props.max) && props.min > props.max) {
+        check.issue("min", "Can't be after the latest date.");
+      }
+    },
     validate: (value, field) => {
       if (typeof value !== "string" || !isIsoDate(value.trim())) return "Enter a date like 2026-10-22.";
       const date = value.trim();
@@ -717,6 +859,8 @@ var builtins = [
     value: { json: true },
     operators: ["answered", "empty"],
     a11y: { semantics: "group" },
+    literal: "boolean",
+    checkProps: (props, check) => check.optionalText(props.text, "text"),
     // Unchecked is unanswered, so a required consent must be checked.
     isEmpty: (value) => value === void 0 || value === null || value === false,
     validate: (value) => value === true ? null : "Check the box to agree.",
@@ -766,7 +910,7 @@ function dateLimits(field) {
   if (typeof max === "string" && isIsoDate(max)) out.max = max;
   return out;
 }
-for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldType, photoFieldType]) registerFieldType(manifest);
+for (const manifest of [...builtins, ...structuredFieldTypes, calculatedFieldType, photoFieldType]) registerBuiltIn(manifest);
 
 // src/logic.ts
 function own(record, key) {
@@ -1527,7 +1671,7 @@ function hookHost(url) {
 }
 
 // src/destinations/webhook.ts
-var MIN_SECRET_BYTES = 16;
+var MIN_WEBHOOK_SECRET_BYTES = 24;
 var STRICT_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
 function secretKey(secret) {
   const encoded = secret.startsWith("whsec_") ? secret.slice(6) : secret;
@@ -1537,7 +1681,9 @@ function secretKey(secret) {
     );
   }
   const bytes = fromBase64(encoded);
-  if (bytes.length < MIN_SECRET_BYTES) throw new DeliveryError(`The webhook secret is shorter than ${MIN_SECRET_BYTES} bytes`);
+  if (bytes.length < MIN_WEBHOOK_SECRET_BYTES) {
+    throw new DeliveryError(`The webhook secret is shorter than ${MIN_WEBHOOK_SECRET_BYTES} bytes`);
+  }
   return bytes;
 }
 async function hmacKey(secret, usage) {
@@ -1547,9 +1693,15 @@ function newWebhookSecret() {
   return `whsec_${base64(crypto.getRandomValues(new Uint8Array(32)))}`;
 }
 async function signWebhook(secret, id, timestamp, body) {
-  const key = await hmacKey(secret, "sign");
-  const mac = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${id}.${timestamp}.${body}`));
-  return `v1,${base64(new Uint8Array(mac))}`;
+  const secrets = typeof secret === "string" ? [secret] : secret;
+  if (secrets.length === 0) throw new DeliveryError("The webhook secret is not set");
+  const data = new TextEncoder().encode(`${id}.${timestamp}.${body}`);
+  const signatures = [];
+  for (const one of secrets) {
+    const key = await hmacKey(one, "sign");
+    signatures.push(`v1,${base64(new Uint8Array(await crypto.subtle.sign("HMAC", key, data)))}`);
+  }
+  return signatures.join(" ");
 }
 async function verifyWebhook(input) {
   const header = (name) => {
@@ -1563,12 +1715,14 @@ async function verifyWebhook(input) {
   if (!id || !/^\d{1,12}$/.test(timestamp) || !signatures) return false;
   const now = Math.floor((input.now?.() ?? Date.now()) / 1e3);
   if (Math.abs(now - Number(timestamp)) > (input.toleranceSeconds ?? 300)) return false;
-  let key;
-  try {
-    key = await hmacKey(input.secret, "verify");
-  } catch {
-    return false;
+  const keys = [];
+  for (const secret of typeof input.secret === "string" ? [input.secret] : input.secret) {
+    try {
+      keys.push(await hmacKey(secret, "verify"));
+    } catch {
+    }
   }
+  if (keys.length === 0) return false;
   const data = new TextEncoder().encode(`${id}.${timestamp}.${input.body}`);
   for (const part of signatures.split(" ")) {
     const [version, value] = part.split(",", 2);
@@ -1579,7 +1733,7 @@ async function verifyWebhook(input) {
     } catch {
       continue;
     }
-    if (await crypto.subtle.verify("HMAC", key, mac, data)) return true;
+    for (const key of keys) if (await crypto.subtle.verify("HMAC", key, mac, data)) return true;
   }
   return false;
 }
@@ -1644,9 +1798,10 @@ function webhookPayload(submission, definition, options = {}) {
     for (const [name, value] of Object.entries(source ?? {})) if (own(allowed, name) !== void 0) out[name] = value;
     return out;
   };
+  const happened = submission.submittedAt ? Date.parse(submission.submittedAt) : Number.NaN;
   return {
     type: options.type ?? "form.submitted",
-    timestamp: new Date(options.now ?? Date.now()).toISOString(),
+    timestamp: new Date(Number.isNaN(happened) ? options.now ?? Date.now() : happened).toISOString(),
     data: {
       form: { id: definition.id, title: definition.title },
       submission: {
@@ -1673,7 +1828,7 @@ function webhookDestination(options) {
         const url = checkWebhookUrl(typeof raw === "string" ? raw.trim() : "", options);
         if (options.resolveHost && !options.allowPrivateHosts) await checkHookHost(url, options.resolveHost);
         const secret = await resolveOption("The webhook secret", options.secret, config, context);
-        if (!secret) throw new DeliveryError("The webhook secret is not set");
+        if (!secret || secret.length === 0) throw new DeliveryError("The webhook secret is not set");
         const now = options.now?.() ?? Date.now();
         const id = deliveryOptions.deliveryId ?? submission.id;
         const timestamp = Math.floor(now / 1e3);
@@ -1698,6 +1853,9 @@ function webhookDestination(options) {
         );
         discard(response);
         if (response.status >= 200 && response.status < 300) return { ok: true };
+        if (response.status === 410) {
+          throw new DeliveryError("Webhook answered 410: the endpoint is gone; disable the destination", { status: 410, disable: true });
+        }
         if (response.status === 0 || response.status >= 300 && response.status < 400) {
           throw new DeliveryError(`Webhook answered ${response.status || "a redirect"}: redirects are not followed`, {
             ...response.status ? { status: response.status } : {}
@@ -1900,11 +2058,12 @@ function secretKeyBytes(key) {
   if (bytes.length !== 32) throw new DeliveryError("The encryption key must be 32 bytes");
   return bytes;
 }
-async function deriveSecretKey(key, info) {
+async function deriveSecretKey(key, info, options = {}) {
   if (!info) throw new DeliveryError("A sealing key needs its purpose (info)");
+  const salt = typeof options.salt === "string" ? enc.encode(options.salt) : new Uint8Array(options.salt ?? new Uint8Array(0));
   const base = await crypto.subtle.importKey("raw", secretKeyBytes(key), "HKDF", false, ["deriveKey"]);
   return crypto.subtle.deriveKey(
-    { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(0), info: enc.encode(info) },
+    { name: "HKDF", hash: "SHA-256", salt, info: enc.encode(info) },
     base,
     { name: "AES-GCM", length: 256 },
     false,
@@ -1934,16 +2093,22 @@ function padded(text) {
   return fromBase64(text + "=".repeat((4 - text.length % 4) % 4));
 }
 
-// src/destinations/runner.ts
+// ../notifications/src/runner/index.ts
 var DEFAULT_MAX_ATTEMPTS = 8;
 var DEFAULT_MAX_DEFERRALS = 24;
 var DEFAULT_BATCH_SIZE = 25;
-function defaultBackoff(attempt) {
-  return Math.min(6 * 3600, 60 * 2 ** Math.max(0, attempt - 1));
-}
-function deliveryOutcome(result, attempt, options = {}) {
-  if (result.ok) return result.notSent ? { status: "skipped", reason: result.notSent.slice(0, 500) } : { status: "sent" };
+function defaultBackoff(attempt, random) {
+  const nominal = Math.min(24 * 3600, 300 * 4 ** Math.max(0, attempt - 1));
+  const r = typeof random === "function" ? random() : Math.random();
+  return Math.round(nominal * (0.8 + 0.4 * Math.min(1, Math.max(0, r))));
+}
+function jobOutcome(result, attempt, options = {}) {
+  if (result.ok) {
+    if (result.notSent) return { status: "skipped", reason: result.notSent.slice(0, 500) };
+    return result.alreadyThere ? { status: "sent", alreadyThere: true } : { status: "sent" };
+  }
   const http = result.status !== void 0 ? { httpStatus: result.status } : {};
+  if (result.disable) return { status: "failed", error: result.error, ...http, disable: true };
   if (!result.retryable) return { status: "failed", error: result.error, ...http };
   const now = options.now ?? Date.now();
   if (result.retryAfterSeconds !== void 0 && (options.deferrals ?? 0) < (options.maxDeferrals ?? DEFAULT_MAX_DEFERRALS)) {
@@ -1955,14 +2120,109 @@ function deliveryOutcome(result, attempt, options = {}) {
   const seconds = Math.max(1, Math.ceil((options.backoff ?? defaultBackoff)(attempt)));
   return { status: "retry", error: result.error, retryAt: new Date(now + seconds * 1e3), retryAfterSeconds: seconds, counted: true, ...http };
 }
-function createDeliveryRunner(options) {
+function failureOf(error) {
+  const e = error;
+  if (e && typeof e === "object" && typeof e.retryable === "boolean" && typeof e.message === "string") {
+    return {
+      ok: false,
+      retryable: e.disable === true ? false : e.retryable,
+      error: e.message.slice(0, 500),
+      ...typeof e.retryAfterSeconds === "number" ? { retryAfterSeconds: e.retryAfterSeconds } : {},
+      ...typeof e.status === "number" ? { status: e.status } : {},
+      ...e.disable === true ? { disable: true } : {}
+    };
+  }
+  const timeout = e && typeof e === "object" && (e.name === "TimeoutError" || e.name === "AbortError");
+  return { ok: false, retryable: true, error: timeout ? "Timed out" : "Unexpected error" };
+}
+function createRunner(options) {
   const log = (message) => {
     try {
       options.log?.(message);
     } catch {
     }
   };
+  const label = (job) => options.label?.(job) ?? `Job ${job.id}`;
+  const recordLabel = (job) => options.recordLabel?.(job) ?? `job ${job.id}`;
   const now = () => options.now?.() ?? Date.now();
+  return {
+    async run(runOptions = {}) {
+      const report = { claimed: 0, sent: 0, filtered: 0, skipped: 0, retrying: 0, deferred: 0, failed: 0, stale: 0, unrecorded: 0 };
+      const limit = runOptions.limit ?? options.batchSize ?? DEFAULT_BATCH_SIZE;
+      const claimed = await options.claim({ limit, filter: runOptions.filter });
+      report.claimed = claimed.length;
+      const groups = /* @__PURE__ */ new Map();
+      claimed.forEach((job, i) => {
+        const key = options.group ? options.group(job) : `\0${i}`;
+        const list = groups.get(key) ?? [];
+        list.push(job);
+        groups.set(key, list);
+      });
+      await Promise.all(
+        [...groups.values()].map(async (group) => {
+          let results;
+          try {
+            results = await options.send(group, { signal: runOptions.signal });
+            if (results.length !== group.length) throw new Error("send answered the wrong number of results");
+          } catch (error) {
+            const failure = failureOf(error);
+            results = group.map(() => failure);
+          }
+          const at = now();
+          await Promise.all(
+            group.map(async (job, i) => {
+              const result = results[i];
+              const outcome = result === "filtered" ? { status: "filtered" } : jobOutcome(result, job.attempt, {
+                now: at,
+                maxAttempts: options.maxAttempts,
+                backoff: options.backoff,
+                deferrals: job.deferrals,
+                maxDeferrals: options.maxDeferrals
+              });
+              if (outcome.status === "failed" || outcome.status === "retry") {
+                log(`${label(job)} ${outcome.status === "failed" ? "failed" : "will be retried"}: ${outcome.error}`);
+              } else if (outcome.status === "skipped") {
+                log(`${label(job)} skipped: ${outcome.reason}`);
+              }
+              let recorded;
+              try {
+                recorded = await options.record(job, outcome);
+              } catch {
+                report.unrecorded++;
+                log(`Recording ${recordLabel(job)} failed`);
+                return;
+              }
+              if (recorded === false) report.stale++;
+              else if (outcome.status === "sent") report.sent++;
+              else if (outcome.status === "filtered") report.filtered++;
+              else if (outcome.status === "skipped") report.skipped++;
+              else if (outcome.status === "failed") report.failed++;
+              else if (outcome.counted) report.retrying++;
+              else report.deferred++;
+            })
+          );
+        })
+      );
+      return report;
+    }
+  };
+}
+
+// src/destinations/runner.ts
+var DEFAULT_MAX_ATTEMPTS2 = DEFAULT_MAX_ATTEMPTS;
+var DEFAULT_MAX_DEFERRALS2 = DEFAULT_MAX_DEFERRALS;
+var DEFAULT_BATCH_SIZE2 = DEFAULT_BATCH_SIZE;
+var defaultBackoff2 = defaultBackoff;
+function deliveryOutcome(result, attempt, options = {}) {
+  return jobOutcome(result.ok ? { ok: true, notSent: result.notSent } : result, attempt, options);
+}
+function createDeliveryRunner(options) {
+  const log = (message) => {
+    try {
+      options.log?.(message);
+    } catch {
+    }
+  };
   async function send(group, signal) {
     const first = group[0];
     const destination = options.destinations[first.kind];
@@ -2023,74 +2283,30 @@ function createDeliveryRunner(options) {
     let next = 0;
     return results.map((r) => r ?? sent[next++]);
   }
-  return {
-    async run(runOptions = {}) {
-      const report = {
-        claimed: 0,
-        sent: 0,
-        filtered: 0,
-        skipped: 0,
-        retrying: 0,
-        deferred: 0,
-        failed: 0,
-        stale: 0,
-        unrecorded: 0
-      };
-      const limit = runOptions.limit ?? options.batchSize ?? DEFAULT_BATCH_SIZE;
-      const claimed = await options.claim({ limit, filter: runOptions.filter });
-      report.claimed = claimed.length;
-      const groups = /* @__PURE__ */ new Map();
-      for (const delivery of claimed) {
-        const list = groups.get(delivery.destinationId) ?? [];
-        list.push(delivery);
-        groups.set(delivery.destinationId, list);
-      }
-      await Promise.all(
-        [...groups.values()].map(async (group) => {
-          const results = await send(group, runOptions.signal);
-          const at = now();
-          await Promise.all(
-            group.map(async (delivery, i) => {
-              const result = results[i];
-              const outcome = result === "filtered" ? { status: "filtered" } : deliveryOutcome(result, delivery.attempt, {
-                now: at,
-                maxAttempts: options.maxAttempts,
-                backoff: options.backoff,
-                deferrals: delivery.deferrals,
-                maxDeferrals: options.maxDeferrals
-              });
-              if (outcome.status === "sent" && result !== "filtered" && result.ok && result.skipped?.includes(delivery.submission.id)) {
-                outcome.alreadyThere = true;
-              }
-              if (outcome.status === "failed" || outcome.status === "retry") {
-                log(`Delivery ${delivery.id} (${delivery.kind}) ${outcome.status === "failed" ? "failed" : "will be retried"}: ${outcome.error}`);
-              } else if (outcome.status === "skipped") {
-                log(`Delivery ${delivery.id} (${delivery.kind}) skipped: ${outcome.reason}`);
-              }
-              let recorded;
-              try {
-                recorded = await options.record(delivery, outcome);
-              } catch {
-                report.unrecorded++;
-                log(`Recording delivery ${delivery.id} failed`);
-                return;
-              }
-              if (recorded === false) report.stale++;
-              else if (outcome.status === "sent") report.sent++;
-              else if (outcome.status === "filtered") report.filtered++;
-              else if (outcome.status === "skipped") report.skipped++;
-              else if (outcome.status === "failed") report.failed++;
-              else if (outcome.counted) report.retrying++;
-              else report.deferred++;
-            })
-          );
-        })
-      );
-      return report;
-    }
-  };
+  return createRunner({
+    claim: options.claim,
+    // One group per destination: a sheet gets one append for all its rows.
+    group: (delivery) => delivery.destinationId,
+    async send(group, { signal }) {
+      const results = await send(group, signal);
+      return results.map((result, i) => {
+        if (result === "filtered") return result;
+        if (!result.ok) return result;
+        return { ok: true, notSent: result.notSent, alreadyThere: result.skipped?.includes(group[i].submission.id) && !result.notSent };
+      });
+    },
+    record: options.record,
+    now: options.now,
+    log: options.log,
+    label: (delivery) => `Delivery ${delivery.id} (${delivery.kind})`,
+    recordLabel: (delivery) => `delivery ${delivery.id}`,
+    batchSize: options.batchSize,
+    maxAttempts: options.maxAttempts,
+    maxDeferrals: options.maxDeferrals,
+    backoff: options.backoff
+  });
 }
 
-export { DEDUPE_WINDOW, DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, GOOGLE_TOKEN_URL, HEADER_SCAN_ROWS, HookUrlError, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, REQUEST_TIMEOUT_MS, RESEND_API, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
+export { DEDUPE_WINDOW, DEFAULT_BATCH_SIZE2 as DEFAULT_BATCH_SIZE, DEFAULT_MAX_ATTEMPTS2 as DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_DEFERRALS2 as DEFAULT_MAX_DEFERRALS, DEFAULT_SHEET_NAME, DRIVE_FILE_SCOPE, DeliveryError, GOOGLE_TOKEN_URL, HEADER_SCAN_ROWS, HookUrlError, MAX_CONDITION_DEPTH, MAX_HOOK_URL_LENGTH, MAX_RECIPIENTS, MIN_WEBHOOK_SECRET_BYTES, REQUEST_TIMEOUT_MS, RESEND_API, SENSITIVE_MASK, SHEETS_API, SHEETS_SCOPE, SLACK_HOSTS, SLACK_VALUE_LIMIT, answerCell, checkHookHost, checkWebhookUrl, clearGoogleOAuthTokenCache, clearGoogleTokenCache, columnLetter, conditionOf, createDeliveryRunner, defaultBackoff2 as defaultBackoff, deliveryFailure, deliveryOutcome, deriveSecretKey, emailBody, emailDestination, escapeFormula, escapeHtml, escapeSlack, googleAccessToken, googleOAuthAccessToken, headerSafe, hookHost, httpError, idempotencyKey, isCondition, isPrivateHost, isPublicAddress, isRetryableStatus, isSafeAddress, isSafeFrom, mergeHeader, newWebhookSecret, openSecret, parseHookUrl, passesCondition, refreshGoogleAccessToken, renderEmail, resendProvider, responseRow, retryAfterSeconds, rowFor, sealSecret, secretKeyBytes, sheetsDestination, signJwt, signWebhook, slackDestination, slackMessage, verifyWebhook, visibleInputs, webhookDestination, webhookPayload };
 //# sourceMappingURL=destinations.js.map
 //# sourceMappingURL=destinations.js.map