@particle-academy/fancy-connector-core 0.10.1 → 0.11.0

package/dist/index.d.cts

@@ -2282,6 +2282,50 @@ type MimeMessage = {
 };
 declare function parseMime(raw: Uint8Array | string): MimeMessage;
 
+/**
+ * A form-encoded body whose one named field holds JSON, decoded: the payload
+ * TRANSFORM Slack's interactivity callbacks need (`payload=<json>`).
+ *
+ * ONE implementation in two runtimes (`php/src/FormFieldJson.php` is the
+ * twin), held to the authored corpus under `fixtures/form-field-json/`. It
+ * runs AFTER signature verification, over the same raw bytes: the provider
+ * signed the form body as sent, so nothing here may be re-encoded before
+ * verifying.
+ *
+ * The decisions, each pinned by a case:
+ *
+ * - `+` and `%20` are both a space; `%XX` decodes to a byte, and the result
+ *   must be valid UTF-8.
+ * - The WHOLE body is decoded strictly. A `%` not followed by two hex digits,
+ *   anywhere, is `bad-encoding`. `decodeURIComponent` throws on `%zz` while
+ *   PHP's `urldecode` keeps it, so neither built-in is used.
+ * - The field absent is `missing-field`; present twice is `duplicate-field`,
+ *   because first-wins and last-wins are both conventions and two runtimes
+ *   choosing differently would route one click two ways.
+ * - A value that is not JSON is `not-json`, never the raw string.
+ */
+declare const FORM_FIELD_JSON_REASONS: readonly ["missing-field", "duplicate-field", "bad-encoding", "not-json"];
+type FormFieldJsonReason = (typeof FORM_FIELD_JSON_REASONS)[number];
+/** Refused BY NAME; `reason` is the same string PHP's exception carries. */
+declare class FormFieldJsonError extends Error {
+    readonly reason: FormFieldJsonReason;
+    readonly field: string;
+    constructor(reason: FormFieldJsonReason, field: string, message: string);
+}
+declare function decodeFormFieldJson(raw: Uint8Array | string, field: string): unknown;
+/**
+ * How a verified delivery is read, when its body is not plain JSON. Declared
+ * on the trigger (`TriggerDescriptor.decode`); a host verifies the raw bytes,
+ * then calls `decodeDelivery` with the declaration, then starts the run.
+ * Shipped as data too, for a host mirroring the union across a JSON boundary.
+ */
+declare const DELIVERY_DECODE_KINDS: readonly ["form-field-json"];
+type DeliveryDecode = {
+    kind: (typeof DELIVERY_DECODE_KINDS)[number];
+    field: string;
+};
+declare function decodeDelivery(decode: DeliveryDecode, raw: Uint8Array | string): unknown;
+
 /**
  * Dry-verify — proving the transport with a credential that cannot work.
  *
@@ -2604,6 +2648,13 @@ type TriggerDescriptor = {
     lease?: LeaseDeclaration;
     /** For `webhook` / `subscription`: how a delivery is authenticated. */
     verification?: WebhookVerificationSpec;
+    /**
+     * For `webhook`: how the VERIFIED body is read when it is not plain JSON —
+     * Slack's interactivity is `payload=<json>`. Absent means the host reads the
+     * body as it always has. Present means the host calls `decodeDelivery` with
+     * it, over the same raw bytes the signature was checked against.
+     */
+    decode?: DeliveryDecode;
     /** For `poll`: the provider's smallest sane interval, in seconds. */
     minPollSeconds?: number;
     /** A faked sample event, so the node is runnable before any of the above. */
@@ -2677,4 +2728,4 @@ declare function verifyDelivery(trigger: TriggerDescriptor, delivery: InboundDel
  */
 declare function triggerEvent(trigger: TriggerDescriptor, connection: ResolvedConnection, injected: unknown, config: Record<string, unknown>): unknown;
 
-export { AMBIGUOUS_REFUSAL, type ApiContract, type Attempt, type Attendee, type ByteRange, CANONICAL_METRICS, CONNECTOR_API_VERSION, CONNECTOR_MODES, CREDENTIAL_SCOPES, type CallOptions, type CallResult, type Capabilities, type Catalogue, type ChainLinks, type ChainOutcome, type ChainRef, type ChallengeHandshake, type Citation, type Classified, type ConnectionCredentials, type ConnectionHost, type ConnectionSpec, type Connector, ConnectorAmbiguous, ConnectorApiMismatch, ConnectorAuthError, ConnectorConfigError, ConnectorError, type ConnectorErrorContext, type ConnectorFaker, ConnectorIdempotencyExpiredError, type ConnectorMode, ConnectorModeError, ConnectorRateLimited, type ConnectorRequest, ConnectorRequestError, type ConnectorResult, ConnectorTransient, ConnectorUnreachable, type ContractOperation, type CredentialField, type CredentialScope, DEFAULT_IDEMPOTENCY_WINDOW_SECONDS, DEFAULT_RETRY, type DeliveryDeclaration, type DeliveryMechanism, type DeliveryOutcome, type DriftFinding, type DriftReport, EXPIRES_AT_UNITS, type ExpiresAtUnit, FAKE_EPOCH, type FailureKind, type FakeRequest, type FakeValues, type HmacScheme, type HmacVerificationSpec, type HostEnvironment, type IdempotencyOptions, type InboundDelivery, type Invite, type InviteMethod, type JoinTarget, type JoinTargetKind, type LeaseAction, type LeaseDeclaration, type LeaseState, MAX_IDEMPOTENCY_KEY_LENGTH, type MetricDescriptor, type MetricSample, type MimeAttachment, type MimeHeader, type MimeMessage, type MimePart, type ModeInputs, NO_IDEMPOTENCY_KEY_WARNING, PROBLEM_SEVERITIES, type PreparedRequest, type ProbeOutcome, type ProbeReport, type ProbeResult, type ProbeSpec, type Problem, type ProviderAdapter, RENDERER_VERSION, REVIEW_STALE_DAYS, type RecordedShape, type RecurrenceRule, type RenderRules, type RenderedPayload, type RequestedMode, type ResolveOptions, type ResolvedConnection, type RetryPolicy, type RunIdentity, SANDBOX_KINDS, SUPPORTED_CONNECTOR_API, type SandboxKind, type Segment, type ServiceDescriptor, type SetupStep, type ShapeMismatch, type SharedTokenScheme, type SharedTokenVerificationSpec, type SpecSource, type SubscriptionLease, type TextUnit, type Transport, type TransportResponse, type TriggerDescriptor, type VerifyResult, type WebhookVerification, type WebhookVerificationSpec, assertConnectorApi, byteRangeOf, callConnector, capabilityProblems, checkAgainstOpenApi, checkAgainstRecordedShape, classifyError, classifyHttp, classifyStatus, classifyThrown, compareShape, connectionsFor, constantTimeEquals, deliver, fakeRequest, fakeValues, getConnectionHost, graphemes, handshakeResponse, header, hmac, httpFailure, idempotencyKeyFor, isEmptyPayload, isRemote, isSharedTokenScheme, isSharedTokenSpec, isUnconditionallyRetryable, joinTargets, leaseAction, leaseFromResponse, leaseRenewAt, leaseState, linkRanges, measure, nextOccurrence, parseInvite, parseMime, payloadHash, postChain, probe, providerProblems, providerSandboxIsSelectable, registerConnectionHost, registerTransport, render, reported, resetRateState, resolveConnection, resolveConnectorMode, respectRate, runIdentityFrom, runKeyFrom, runProbes, sandboxIsSelectable, sandboxRefusal, satisfiesMinimum, secretKeyBytes, seedFrom, shapeOf, shouldRetry, sliceByteRange, splitToFit, subscriptionLease, triggerEvent, unchecked, utf8Length, verifyDelivery, verifyHmac, verifySharedToken, withResolvedLimit };
+export { AMBIGUOUS_REFUSAL, type ApiContract, type Attempt, type Attendee, type ByteRange, CANONICAL_METRICS, CONNECTOR_API_VERSION, CONNECTOR_MODES, CREDENTIAL_SCOPES, type CallOptions, type CallResult, type Capabilities, type Catalogue, type ChainLinks, type ChainOutcome, type ChainRef, type ChallengeHandshake, type Citation, type Classified, type ConnectionCredentials, type ConnectionHost, type ConnectionSpec, type Connector, ConnectorAmbiguous, ConnectorApiMismatch, ConnectorAuthError, ConnectorConfigError, ConnectorError, type ConnectorErrorContext, type ConnectorFaker, ConnectorIdempotencyExpiredError, type ConnectorMode, ConnectorModeError, ConnectorRateLimited, type ConnectorRequest, ConnectorRequestError, type ConnectorResult, ConnectorTransient, ConnectorUnreachable, type ContractOperation, type CredentialField, type CredentialScope, DEFAULT_IDEMPOTENCY_WINDOW_SECONDS, DEFAULT_RETRY, DELIVERY_DECODE_KINDS, type DeliveryDeclaration, type DeliveryDecode, type DeliveryMechanism, type DeliveryOutcome, type DriftFinding, type DriftReport, EXPIRES_AT_UNITS, type ExpiresAtUnit, FAKE_EPOCH, FORM_FIELD_JSON_REASONS, type FailureKind, type FakeRequest, type FakeValues, FormFieldJsonError, type FormFieldJsonReason, type HmacScheme, type HmacVerificationSpec, type HostEnvironment, type IdempotencyOptions, type InboundDelivery, type Invite, type InviteMethod, type JoinTarget, type JoinTargetKind, type LeaseAction, type LeaseDeclaration, type LeaseState, MAX_IDEMPOTENCY_KEY_LENGTH, type MetricDescriptor, type MetricSample, type MimeAttachment, type MimeHeader, type MimeMessage, type MimePart, type ModeInputs, NO_IDEMPOTENCY_KEY_WARNING, PROBLEM_SEVERITIES, type PreparedRequest, type ProbeOutcome, type ProbeReport, type ProbeResult, type ProbeSpec, type Problem, type ProviderAdapter, RENDERER_VERSION, REVIEW_STALE_DAYS, type RecordedShape, type RecurrenceRule, type RenderRules, type RenderedPayload, type RequestedMode, type ResolveOptions, type ResolvedConnection, type RetryPolicy, type RunIdentity, SANDBOX_KINDS, SUPPORTED_CONNECTOR_API, type SandboxKind, type Segment, type ServiceDescriptor, type SetupStep, type ShapeMismatch, type SharedTokenScheme, type SharedTokenVerificationSpec, type SpecSource, type SubscriptionLease, type TextUnit, type Transport, type TransportResponse, type TriggerDescriptor, type VerifyResult, type WebhookVerification, type WebhookVerificationSpec, assertConnectorApi, byteRangeOf, callConnector, capabilityProblems, checkAgainstOpenApi, checkAgainstRecordedShape, classifyError, classifyHttp, classifyStatus, classifyThrown, compareShape, connectionsFor, constantTimeEquals, decodeDelivery, decodeFormFieldJson, deliver, fakeRequest, fakeValues, getConnectionHost, graphemes, handshakeResponse, header, hmac, httpFailure, idempotencyKeyFor, isEmptyPayload, isRemote, isSharedTokenScheme, isSharedTokenSpec, isUnconditionallyRetryable, joinTargets, leaseAction, leaseFromResponse, leaseRenewAt, leaseState, linkRanges, measure, nextOccurrence, parseInvite, parseMime, payloadHash, postChain, probe, providerProblems, providerSandboxIsSelectable, registerConnectionHost, registerTransport, render, reported, resetRateState, resolveConnection, resolveConnectorMode, respectRate, runIdentityFrom, runKeyFrom, runProbes, sandboxIsSelectable, sandboxRefusal, satisfiesMinimum, secretKeyBytes, seedFrom, shapeOf, shouldRetry, sliceByteRange, splitToFit, subscriptionLease, triggerEvent, unchecked, utf8Length, verifyDelivery, verifyHmac, verifySharedToken, withResolvedLimit };

package/dist/index.d.ts

@@ -2282,6 +2282,50 @@ type MimeMessage = {
 };
 declare function parseMime(raw: Uint8Array | string): MimeMessage;
 
+/**
+ * A form-encoded body whose one named field holds JSON, decoded: the payload
+ * TRANSFORM Slack's interactivity callbacks need (`payload=<json>`).
+ *
+ * ONE implementation in two runtimes (`php/src/FormFieldJson.php` is the
+ * twin), held to the authored corpus under `fixtures/form-field-json/`. It
+ * runs AFTER signature verification, over the same raw bytes: the provider
+ * signed the form body as sent, so nothing here may be re-encoded before
+ * verifying.
+ *
+ * The decisions, each pinned by a case:
+ *
+ * - `+` and `%20` are both a space; `%XX` decodes to a byte, and the result
+ *   must be valid UTF-8.
+ * - The WHOLE body is decoded strictly. A `%` not followed by two hex digits,
+ *   anywhere, is `bad-encoding`. `decodeURIComponent` throws on `%zz` while
+ *   PHP's `urldecode` keeps it, so neither built-in is used.
+ * - The field absent is `missing-field`; present twice is `duplicate-field`,
+ *   because first-wins and last-wins are both conventions and two runtimes
+ *   choosing differently would route one click two ways.
+ * - A value that is not JSON is `not-json`, never the raw string.
+ */
+declare const FORM_FIELD_JSON_REASONS: readonly ["missing-field", "duplicate-field", "bad-encoding", "not-json"];
+type FormFieldJsonReason = (typeof FORM_FIELD_JSON_REASONS)[number];
+/** Refused BY NAME; `reason` is the same string PHP's exception carries. */
+declare class FormFieldJsonError extends Error {
+    readonly reason: FormFieldJsonReason;
+    readonly field: string;
+    constructor(reason: FormFieldJsonReason, field: string, message: string);
+}
+declare function decodeFormFieldJson(raw: Uint8Array | string, field: string): unknown;
+/**
+ * How a verified delivery is read, when its body is not plain JSON. Declared
+ * on the trigger (`TriggerDescriptor.decode`); a host verifies the raw bytes,
+ * then calls `decodeDelivery` with the declaration, then starts the run.
+ * Shipped as data too, for a host mirroring the union across a JSON boundary.
+ */
+declare const DELIVERY_DECODE_KINDS: readonly ["form-field-json"];
+type DeliveryDecode = {
+    kind: (typeof DELIVERY_DECODE_KINDS)[number];
+    field: string;
+};
+declare function decodeDelivery(decode: DeliveryDecode, raw: Uint8Array | string): unknown;
+
 /**
  * Dry-verify — proving the transport with a credential that cannot work.
  *
@@ -2604,6 +2648,13 @@ type TriggerDescriptor = {
     lease?: LeaseDeclaration;
     /** For `webhook` / `subscription`: how a delivery is authenticated. */
     verification?: WebhookVerificationSpec;
+    /**
+     * For `webhook`: how the VERIFIED body is read when it is not plain JSON —
+     * Slack's interactivity is `payload=<json>`. Absent means the host reads the
+     * body as it always has. Present means the host calls `decodeDelivery` with
+     * it, over the same raw bytes the signature was checked against.
+     */
+    decode?: DeliveryDecode;
     /** For `poll`: the provider's smallest sane interval, in seconds. */
     minPollSeconds?: number;
     /** A faked sample event, so the node is runnable before any of the above. */
@@ -2677,4 +2728,4 @@ declare function verifyDelivery(trigger: TriggerDescriptor, delivery: InboundDel
  */
 declare function triggerEvent(trigger: TriggerDescriptor, connection: ResolvedConnection, injected: unknown, config: Record<string, unknown>): unknown;
 
-export { AMBIGUOUS_REFUSAL, type ApiContract, type Attempt, type Attendee, type ByteRange, CANONICAL_METRICS, CONNECTOR_API_VERSION, CONNECTOR_MODES, CREDENTIAL_SCOPES, type CallOptions, type CallResult, type Capabilities, type Catalogue, type ChainLinks, type ChainOutcome, type ChainRef, type ChallengeHandshake, type Citation, type Classified, type ConnectionCredentials, type ConnectionHost, type ConnectionSpec, type Connector, ConnectorAmbiguous, ConnectorApiMismatch, ConnectorAuthError, ConnectorConfigError, ConnectorError, type ConnectorErrorContext, type ConnectorFaker, ConnectorIdempotencyExpiredError, type ConnectorMode, ConnectorModeError, ConnectorRateLimited, type ConnectorRequest, ConnectorRequestError, type ConnectorResult, ConnectorTransient, ConnectorUnreachable, type ContractOperation, type CredentialField, type CredentialScope, DEFAULT_IDEMPOTENCY_WINDOW_SECONDS, DEFAULT_RETRY, type DeliveryDeclaration, type DeliveryMechanism, type DeliveryOutcome, type DriftFinding, type DriftReport, EXPIRES_AT_UNITS, type ExpiresAtUnit, FAKE_EPOCH, type FailureKind, type FakeRequest, type FakeValues, type HmacScheme, type HmacVerificationSpec, type HostEnvironment, type IdempotencyOptions, type InboundDelivery, type Invite, type InviteMethod, type JoinTarget, type JoinTargetKind, type LeaseAction, type LeaseDeclaration, type LeaseState, MAX_IDEMPOTENCY_KEY_LENGTH, type MetricDescriptor, type MetricSample, type MimeAttachment, type MimeHeader, type MimeMessage, type MimePart, type ModeInputs, NO_IDEMPOTENCY_KEY_WARNING, PROBLEM_SEVERITIES, type PreparedRequest, type ProbeOutcome, type ProbeReport, type ProbeResult, type ProbeSpec, type Problem, type ProviderAdapter, RENDERER_VERSION, REVIEW_STALE_DAYS, type RecordedShape, type RecurrenceRule, type RenderRules, type RenderedPayload, type RequestedMode, type ResolveOptions, type ResolvedConnection, type RetryPolicy, type RunIdentity, SANDBOX_KINDS, SUPPORTED_CONNECTOR_API, type SandboxKind, type Segment, type ServiceDescriptor, type SetupStep, type ShapeMismatch, type SharedTokenScheme, type SharedTokenVerificationSpec, type SpecSource, type SubscriptionLease, type TextUnit, type Transport, type TransportResponse, type TriggerDescriptor, type VerifyResult, type WebhookVerification, type WebhookVerificationSpec, assertConnectorApi, byteRangeOf, callConnector, capabilityProblems, checkAgainstOpenApi, checkAgainstRecordedShape, classifyError, classifyHttp, classifyStatus, classifyThrown, compareShape, connectionsFor, constantTimeEquals, deliver, fakeRequest, fakeValues, getConnectionHost, graphemes, handshakeResponse, header, hmac, httpFailure, idempotencyKeyFor, isEmptyPayload, isRemote, isSharedTokenScheme, isSharedTokenSpec, isUnconditionallyRetryable, joinTargets, leaseAction, leaseFromResponse, leaseRenewAt, leaseState, linkRanges, measure, nextOccurrence, parseInvite, parseMime, payloadHash, postChain, probe, providerProblems, providerSandboxIsSelectable, registerConnectionHost, registerTransport, render, reported, resetRateState, resolveConnection, resolveConnectorMode, respectRate, runIdentityFrom, runKeyFrom, runProbes, sandboxIsSelectable, sandboxRefusal, satisfiesMinimum, secretKeyBytes, seedFrom, shapeOf, shouldRetry, sliceByteRange, splitToFit, subscriptionLease, triggerEvent, unchecked, utf8Length, verifyDelivery, verifyHmac, verifySharedToken, withResolvedLimit };
+export { AMBIGUOUS_REFUSAL, type ApiContract, type Attempt, type Attendee, type ByteRange, CANONICAL_METRICS, CONNECTOR_API_VERSION, CONNECTOR_MODES, CREDENTIAL_SCOPES, type CallOptions, type CallResult, type Capabilities, type Catalogue, type ChainLinks, type ChainOutcome, type ChainRef, type ChallengeHandshake, type Citation, type Classified, type ConnectionCredentials, type ConnectionHost, type ConnectionSpec, type Connector, ConnectorAmbiguous, ConnectorApiMismatch, ConnectorAuthError, ConnectorConfigError, ConnectorError, type ConnectorErrorContext, type ConnectorFaker, ConnectorIdempotencyExpiredError, type ConnectorMode, ConnectorModeError, ConnectorRateLimited, type ConnectorRequest, ConnectorRequestError, type ConnectorResult, ConnectorTransient, ConnectorUnreachable, type ContractOperation, type CredentialField, type CredentialScope, DEFAULT_IDEMPOTENCY_WINDOW_SECONDS, DEFAULT_RETRY, DELIVERY_DECODE_KINDS, type DeliveryDeclaration, type DeliveryDecode, type DeliveryMechanism, type DeliveryOutcome, type DriftFinding, type DriftReport, EXPIRES_AT_UNITS, type ExpiresAtUnit, FAKE_EPOCH, FORM_FIELD_JSON_REASONS, type FailureKind, type FakeRequest, type FakeValues, FormFieldJsonError, type FormFieldJsonReason, type HmacScheme, type HmacVerificationSpec, type HostEnvironment, type IdempotencyOptions, type InboundDelivery, type Invite, type InviteMethod, type JoinTarget, type JoinTargetKind, type LeaseAction, type LeaseDeclaration, type LeaseState, MAX_IDEMPOTENCY_KEY_LENGTH, type MetricDescriptor, type MetricSample, type MimeAttachment, type MimeHeader, type MimeMessage, type MimePart, type ModeInputs, NO_IDEMPOTENCY_KEY_WARNING, PROBLEM_SEVERITIES, type PreparedRequest, type ProbeOutcome, type ProbeReport, type ProbeResult, type ProbeSpec, type Problem, type ProviderAdapter, RENDERER_VERSION, REVIEW_STALE_DAYS, type RecordedShape, type RecurrenceRule, type RenderRules, type RenderedPayload, type RequestedMode, type ResolveOptions, type ResolvedConnection, type RetryPolicy, type RunIdentity, SANDBOX_KINDS, SUPPORTED_CONNECTOR_API, type SandboxKind, type Segment, type ServiceDescriptor, type SetupStep, type ShapeMismatch, type SharedTokenScheme, type SharedTokenVerificationSpec, type SpecSource, type SubscriptionLease, type TextUnit, type Transport, type TransportResponse, type TriggerDescriptor, type VerifyResult, type WebhookVerification, type WebhookVerificationSpec, assertConnectorApi, byteRangeOf, callConnector, capabilityProblems, checkAgainstOpenApi, checkAgainstRecordedShape, classifyError, classifyHttp, classifyStatus, classifyThrown, compareShape, connectionsFor, constantTimeEquals, decodeDelivery, decodeFormFieldJson, deliver, fakeRequest, fakeValues, getConnectionHost, graphemes, handshakeResponse, header, hmac, httpFailure, idempotencyKeyFor, isEmptyPayload, isRemote, isSharedTokenScheme, isSharedTokenSpec, isUnconditionallyRetryable, joinTargets, leaseAction, leaseFromResponse, leaseRenewAt, leaseState, linkRanges, measure, nextOccurrence, parseInvite, parseMime, payloadHash, postChain, probe, providerProblems, providerSandboxIsSelectable, registerConnectionHost, registerTransport, render, reported, resetRateState, resolveConnection, resolveConnectorMode, respectRate, runIdentityFrom, runKeyFrom, runProbes, sandboxIsSelectable, sandboxRefusal, satisfiesMinimum, secretKeyBytes, seedFrom, shapeOf, shouldRetry, sliceByteRange, splitToFit, subscriptionLease, triggerEvent, unchecked, utf8Length, verifyDelivery, verifyHmac, verifySharedToken, withResolvedLimit };

package/dist/index.js

@@ -1666,6 +1666,77 @@ function parseMime(raw) {
   };
 }
 
+// src/form-field-json.ts
+var FORM_FIELD_JSON_REASONS = ["missing-field", "duplicate-field", "bad-encoding", "not-json"];
+var FormFieldJsonError = class extends Error {
+  constructor(reason, field, message) {
+    super(message);
+    this.reason = reason;
+    this.field = field;
+    this.name = "FormFieldJsonError";
+  }
+  reason;
+  field;
+};
+var UTF8 = new TextDecoder("utf-8", { fatal: true });
+var HEX = /^[0-9A-Fa-f]{2}$/;
+function decodeFormFieldJson(raw, field) {
+  const text = typeof raw === "string" ? raw : latin12(raw);
+  const found = [];
+  for (const pair of text.split("&")) {
+    if (pair === "") continue;
+    const eq = pair.indexOf("=");
+    const name = component(eq === -1 ? pair : pair.slice(0, eq), field);
+    const value2 = component(eq === -1 ? "" : pair.slice(eq + 1), field);
+    if (name === field) found.push(value2);
+  }
+  if (found.length === 0) {
+    throw new FormFieldJsonError("missing-field", field, `the body has no "${field}" field`);
+  }
+  if (found.length > 1) {
+    throw new FormFieldJsonError("duplicate-field", field, `the body has "${field}" ${found.length} times`);
+  }
+  const [value] = found;
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    throw new FormFieldJsonError("not-json", field, `"${field}" is not JSON: ${error.message}`);
+  }
+}
+function component(encoded, field) {
+  const bytes = [];
+  for (let i = 0; i < encoded.length; i++) {
+    const char = encoded[i];
+    if (char === "+") {
+      bytes.push(32);
+    } else if (char === "%") {
+      const hex = encoded.slice(i + 1, i + 3);
+      if (!HEX.test(hex)) {
+        throw new FormFieldJsonError("bad-encoding", field, `a "%" at byte ${i} is not followed by two hex digits`);
+      }
+      bytes.push(parseInt(hex, 16));
+      i += 2;
+    } else {
+      bytes.push(encoded.charCodeAt(i) & 255);
+    }
+  }
+  try {
+    return UTF8.decode(new Uint8Array(bytes));
+  } catch {
+    throw new FormFieldJsonError("bad-encoding", field, "the decoded bytes are not valid UTF-8");
+  }
+}
+var DELIVERY_DECODE_KINDS = ["form-field-json"];
+function decodeDelivery(decode, raw) {
+  if (decode.kind === "form-field-json") return decodeFormFieldJson(raw, decode.field);
+  throw new Error(`unknown decode kind ${JSON.stringify(decode.kind)}`);
+}
+function latin12(bytes) {
+  let out = "";
+  for (const byte of bytes) out += String.fromCharCode(byte);
+  return out;
+}
+
 // src/probe.ts
 async function probe(spec) {
   let response;
@@ -2087,8 +2158,11 @@ export {
   ConnectorUnreachable,
   DEFAULT_IDEMPOTENCY_WINDOW_SECONDS,
   DEFAULT_RETRY,
+  DELIVERY_DECODE_KINDS,
   EXPIRES_AT_UNITS,
   FAKE_EPOCH,
+  FORM_FIELD_JSON_REASONS,
+  FormFieldJsonError,
   MAX_IDEMPOTENCY_KEY_LENGTH,
   NO_IDEMPOTENCY_KEY_WARNING,
   PROBLEM_SEVERITIES,
@@ -2109,6 +2183,8 @@ export {
   compareShape,
   connectionsFor,
   constantTimeEquals,
+  decodeDelivery,
+  decodeFormFieldJson,
   deliver,
   fakeRequest,
   fakeValues,