@usefillo/core 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -39,8 +39,9 @@ interface PhoneField extends BaseField {
     kind: "phone";
     /**
      * Country selected when the form opens (ISO-3166 alpha-2, e.g. "US"). When
-     * unset the renderer falls back to the respondent's browser locale, then the
-     * first country in the list. The respondent can always change it.
+     * unset the renderer falls back to the respondent's browser timezone, browser
+     * locale, then the first country in the list. The respondent can always
+     * change it.
      */
     defaultCountry?: string;
 }
@@ -351,6 +352,7 @@ declare const PHONE_COUNTRIES: PhoneCountry[];
 /** Flag emoji from an ISO-3166 alpha-2 code (regional-indicator letters). */
 declare function flagEmoji(iso2: string): string;
 declare function countryByIso(iso2: string | undefined): PhoneCountry | undefined;
+declare function countryByTimeZone(timeZone: string | undefined): PhoneCountry | undefined;
 /** Country whose dial code is the longest prefix of these digits (no "+"). */
 declare function countryByDialCode(digits: string): PhoneCountry | undefined;
 /** Keep only 0-9 (and a leading "+") from arbitrary input. */
@@ -465,14 +467,19 @@ interface PublishedForm {
     /** Workspace branding state — absent means show the badge (default). */
     branding?: FormBranding;
 }
-interface SubmitResult {
-    ok: boolean;
-    responseId?: string;
+type SubmitResult = {
+    ok: true;
+    responseId: string;
     /** True when the API accepted the request as an already-recorded visitor response. */
     duplicate?: boolean;
+    errors?: undefined;
+} | {
+    ok: false;
     /** fieldId -> message when the server rejects the submission. */
-    errors?: Record<string, string>;
-}
+    errors: Record<string, string>;
+    responseId?: undefined;
+    duplicate?: undefined;
+};
 /** Anti-spam signals collected by the renderer. */
 interface SubmitMeta {
     /** Honeypot value — must be empty for humans. */
@@ -561,6 +568,12 @@ declare class FilloClient {
      * Box; we return the new file id for /complete to verify server-side.
      */
     private boxUpload;
+    /**
+     * Caller signal (if any) combined with a fresh per-request timeout. Created per
+     * fetch so each retry attempt gets its own deadline; the caller's own abort
+     * still drives the resumable-upload cancel semantics.
+     */
+    private uploadSignal;
     /** Retry a request with exponential backoff; never retries an aborted upload. */
     private retry;
     /**
@@ -637,8 +650,9 @@ interface FormControllerOptions {
     /**
      * Embedding surface. "headless" (a bare engine with no Fillo-rendered layout,
      * i.e. createFormController / <FilloProvider>) is a paid capability the server
-     * enforces at submit. The framed renderers (<FilloForm>, renderForm) are
-     * "default". Defaults to "default".
+     * enforces at submit. The framed renderers (<FilloForm>, renderForm) pass
+     * "default" explicitly. Defaults to "headless" — a bare createFormController is
+     * itself the headless gate.
      */
     surface?: "default" | "headless";
 }
@@ -765,4 +779,4 @@ declare class Sha1 {
 }
 declare const sha1Base64: (bytes: Uint8Array) => string;
 
-export { BLOCK_KIND_META, type BaseField, type Block, type BlockKind, CONTENT_KINDS, type CheckboxField, type ChoiceField, type CodeForm, type Condition, type ConditionOp, type ContentBlock, type ContentKind, type CustomField, DRAFT_KINDS, type DateField, type DividerBlock, FILLO_SCHEMA_VERSION, FILLO_SDK_VERSION, type Field, type FieldKind, type FieldSpec, type FieldValue, type FileUploadField, type FileValue, FilloClient, type FilloClientOptions, FilloError, type FormBranding, type FormController, type FormControllerOptions, type FormControllerState, type FormDraftSpec, type FormPage, type FormSchema, type FormSettings, type FormStatus, type FormTheme, type HeadingBlock, type HiddenField, type JsonValue, type LinearScaleField, type MatrixField, type NumberField, PHONE_COUNTRIES, type ParagraphBlock, type ParsedPhone, type PhoneCountry, type PhoneField, type ProvisionWorkspaceResult, type PublishedForm, type RankingField, type RatingField, type ResponseData, type SchemaValidationResult, type SelectOption, Sha1, type SignatureField, type SubmitMeta, type SubmitResult, type SyncedForm, type TextField, type UploadFileOptions, type UploadProgress, type UploadSession, type UploadStatus, type UploadTransport, type ValidationResult, allFields, assembleForm, contentHash, countryByDialCode, countryByIso, createBlock, createClient, createEmptyForm, createFormController, createId, defineForm, digitsOnly, flagEmoji, formatAnswer, formatNational, isBlockVisible, isCodeForm, isField, isPossiblePhone, normalizeFormSchema, normalizeFormTheme, parsePhone, pipeBlock, prefillFromParams, provisionWorkspace, resolveText, sha1Base64, syncCodeForm, toE164, validateField, validateFormSchema, validateResponse, visibleBlocks, visibleFields };
+export { BLOCK_KIND_META, type BaseField, type Block, type BlockKind, CONTENT_KINDS, type CheckboxField, type ChoiceField, type CodeForm, type Condition, type ConditionOp, type ContentBlock, type ContentKind, type CustomField, DRAFT_KINDS, type DateField, type DividerBlock, FILLO_SCHEMA_VERSION, FILLO_SDK_VERSION, type Field, type FieldKind, type FieldSpec, type FieldValue, type FileUploadField, type FileValue, FilloClient, type FilloClientOptions, FilloError, type FormBranding, type FormController, type FormControllerOptions, type FormControllerState, type FormDraftSpec, type FormPage, type FormSchema, type FormSettings, type FormStatus, type FormTheme, type HeadingBlock, type HiddenField, type JsonValue, type LinearScaleField, type MatrixField, type NumberField, PHONE_COUNTRIES, type ParagraphBlock, type ParsedPhone, type PhoneCountry, type PhoneField, type ProvisionWorkspaceResult, type PublishedForm, type RankingField, type RatingField, type ResponseData, type SchemaValidationResult, type SelectOption, Sha1, type SignatureField, type SubmitMeta, type SubmitResult, type SyncedForm, type TextField, type UploadFileOptions, type UploadProgress, type UploadSession, type UploadStatus, type UploadTransport, type ValidationResult, allFields, assembleForm, contentHash, countryByDialCode, countryByIso, countryByTimeZone, createBlock, createClient, createEmptyForm, createFormController, createId, defineForm, digitsOnly, flagEmoji, formatAnswer, formatNational, isBlockVisible, isCodeForm, isField, isPossiblePhone, normalizeFormSchema, normalizeFormTheme, parsePhone, pipeBlock, prefillFromParams, provisionWorkspace, resolveText, sha1Base64, syncCodeForm, toE164, validateField, validateFormSchema, validateResponse, visibleBlocks, visibleFields };

package/dist/index.js

@@ -13,8 +13,16 @@ function isAnswered(value) {
   if (typeof value === "object") return Object.keys(value).length > 0;
   return true;
 }
-function evalCondition(cond, data) {
-  const value = data[cond.fieldId];
+function valueEquals(value, target) {
+  if (value === target) return true;
+  if (typeof value === "number" && typeof target === "string" && target.trim() !== "")
+    return Number(target) === value;
+  if (typeof target === "number" && typeof value === "string" && value.trim() !== "")
+    return Number(value) === target;
+  return false;
+}
+function evalCondition(cond, resolve) {
+  const value = resolve(cond.fieldId);
   switch (cond.op) {
     case "answered":
       return isAnswered(value);
@@ -22,10 +30,11 @@ function evalCondition(cond, data) {
       return !isAnswered(value);
     case "eq":
       if (Array.isArray(value)) return value.some((v) => v === cond.value);
-      return value === cond.value;
+      return valueEquals(value, cond.value);
     case "neq":
+      if (!isAnswered(value)) return false;
       if (Array.isArray(value)) return !value.some((v) => v === cond.value);
-      return value !== cond.value;
+      return !valueEquals(value, cond.value);
     case "contains":
       if (typeof value === "string")
         return value.toLowerCase().includes(String(cond.value ?? "").toLowerCase());
@@ -37,22 +46,45 @@ function evalCondition(cond, data) {
       return typeof value === "number" && value < Number(cond.value);
   }
 }
-function isBlockVisible(block, data) {
+function blockVisibleWith(block, resolve) {
   if (!block.visibleIf || block.visibleIf.length === 0) return true;
-  return block.visibleIf.every((cond) => evalCondition(cond, data));
+  return block.visibleIf.every((cond) => evalCondition(cond, resolve));
+}
+function makeResolver(data, scoped, visible) {
+  return (fieldId) => scoped.has(fieldId) && !visible.has(fieldId) ? void 0 : data[fieldId];
+}
+function visibleFieldIds(fields, data) {
+  const scoped = new Set(fields.map((f) => f.id));
+  let visible = scoped;
+  for (let i = 0; i <= fields.length; i++) {
+    const resolve = makeResolver(data, scoped, visible);
+    const next = /* @__PURE__ */ new Set();
+    for (const f of fields) if (blockVisibleWith(f, resolve)) next.add(f.id);
+    if (next.size === visible.size && [...next].every((id) => visible.has(id))) return next;
+    visible = next;
+  }
+  return visible;
+}
+function isBlockVisible(block, data) {
+  return blockVisibleWith(block, (fieldId) => data[fieldId]);
 }
 function visibleBlocks(page, data) {
-  return page.blocks.filter((b) => isBlockVisible(b, data));
+  const fields = page.blocks.filter(isField);
+  const scoped = new Set(fields.map((f) => f.id));
+  const resolve = makeResolver(data, scoped, visibleFieldIds(fields, data));
+  return page.blocks.filter((b) => blockVisibleWith(b, resolve));
 }
 function allFields(form) {
   return form.pages.flatMap((p) => p.blocks.filter(isField));
 }
 function visibleFields(form, data) {
-  return form.pages.flatMap((p) => visibleBlocks(p, data).filter(isField));
+  const fields = allFields(form);
+  const visible = visibleFieldIds(fields, data);
+  return fields.filter((f) => visible.has(f.id));
 }
 
 // src/validation.ts
-import { z } from "zod";
+import * as z from "zod/mini";
 
 // src/phone.ts
 var C = (iso2, name, dialCode, lengths = [], groups = [], example = "") => ({ iso2, name, dialCode, lengths, groups, example });
@@ -129,6 +161,138 @@ var PHONE_COUNTRIES = [
   C("KW", "Kuwait", "965", [8], [4, 4], "50012345")
 ];
 var byIso = new Map(PHONE_COUNTRIES.map((c) => [c.iso2, c]));
+var timeZoneIso = {
+  "Africa/Cairo": "EG",
+  "Africa/Casablanca": "MA",
+  "Africa/Johannesburg": "ZA",
+  "Africa/Lagos": "NG",
+  "Africa/Nairobi": "KE",
+  "America/Adak": "US",
+  "America/Anchorage": "US",
+  "America/Argentina/Buenos_Aires": "AR",
+  "America/Argentina/Cordoba": "AR",
+  "America/Argentina/Mendoza": "AR",
+  "America/Bahia": "BR",
+  "America/Belem": "BR",
+  "America/Bogota": "CO",
+  "America/Boise": "US",
+  "America/Boa_Vista": "BR",
+  "America/Cancun": "MX",
+  "America/Chicago": "US",
+  "America/Chihuahua": "MX",
+  "America/Campo_Grande": "BR",
+  "America/Costa_Rica": "CR",
+  "America/Cuiaba": "BR",
+  "America/Denver": "US",
+  "America/Detroit": "US",
+  "America/Edmonton": "CA",
+  "America/Fortaleza": "BR",
+  "America/Guayaquil": "EC",
+  "America/Halifax": "CA",
+  "America/Hermosillo": "MX",
+  "America/Indiana/Indianapolis": "US",
+  "America/Indianapolis": "US",
+  "America/Juneau": "US",
+  "America/Kentucky/Louisville": "US",
+  "America/Lima": "PE",
+  "America/Los_Angeles": "US",
+  "America/Maceio": "BR",
+  "America/Manaus": "BR",
+  "America/Matamoros": "MX",
+  "America/Mazatlan": "MX",
+  "America/Merida": "MX",
+  "America/Mexico_City": "MX",
+  "America/Moncton": "CA",
+  "America/Monterrey": "MX",
+  "America/Montevideo": "UY",
+  "America/New_York": "US",
+  "America/Noronha": "BR",
+  "America/Nome": "US",
+  "America/North_Dakota/Center": "US",
+  "America/Ojinaga": "MX",
+  "America/Phoenix": "US",
+  "America/Porto_Velho": "BR",
+  "America/Punta_Arenas": "CL",
+  "America/Recife": "BR",
+  "America/Regina": "CA",
+  "America/Rio_Branco": "BR",
+  "America/Santiago": "CL",
+  "America/Sao_Paulo": "BR",
+  "America/Sitka": "US",
+  "America/St_Johns": "CA",
+  "America/Tijuana": "MX",
+  "America/Toronto": "CA",
+  "America/Vancouver": "CA",
+  "America/Whitehorse": "CA",
+  "America/Winnipeg": "CA",
+  "America/Yakutat": "US",
+  "Asia/Bangkok": "TH",
+  "Asia/Calcutta": "IN",
+  "Asia/Dacca": "BD",
+  "Asia/Dhaka": "BD",
+  "Asia/Dubai": "AE",
+  "Asia/Hong_Kong": "HK",
+  "Asia/Ho_Chi_Minh": "VN",
+  "Asia/Jakarta": "ID",
+  "Asia/Jerusalem": "IL",
+  "Asia/Karachi": "PK",
+  "Asia/Kolkata": "IN",
+  "Asia/Kuala_Lumpur": "MY",
+  "Asia/Kuwait": "KW",
+  "Asia/Manila": "PH",
+  "Asia/Qatar": "QA",
+  "Asia/Riyadh": "SA",
+  "Asia/Seoul": "KR",
+  "Asia/Shanghai": "CN",
+  "Asia/Saigon": "VN",
+  "Asia/Singapore": "SG",
+  "Asia/Taipei": "TW",
+  "Asia/Tel_Aviv": "IL",
+  "Asia/Tokyo": "JP",
+  "Asia/Urumqi": "CN",
+  "Atlantic/Reykjavik": "IS",
+  "Australia/Adelaide": "AU",
+  "Australia/Brisbane": "AU",
+  "Australia/Darwin": "AU",
+  "Australia/Hobart": "AU",
+  "Australia/Melbourne": "AU",
+  "Australia/Perth": "AU",
+  "Australia/Sydney": "AU",
+  "Europe/Amsterdam": "NL",
+  "Europe/Athens": "GR",
+  "Europe/Belgrade": "RS",
+  "Europe/Berlin": "DE",
+  "Europe/Bratislava": "SK",
+  "Europe/Brussels": "BE",
+  "Europe/Bucharest": "RO",
+  "Europe/Budapest": "HU",
+  "Europe/Copenhagen": "DK",
+  "Europe/Dublin": "IE",
+  "Europe/Helsinki": "FI",
+  "Europe/Zagreb": "HR",
+  "Europe/Istanbul": "TR",
+  "Europe/Kiev": "UA",
+  "Europe/Kyiv": "UA",
+  "Europe/Lisbon": "PT",
+  "Europe/Ljubljana": "SI",
+  "Europe/London": "GB",
+  "Europe/Luxembourg": "LU",
+  "Europe/Madrid": "ES",
+  "Europe/Moscow": "RU",
+  "Europe/Oslo": "NO",
+  "Europe/Paris": "FR",
+  "Europe/Prague": "CZ",
+  "Europe/Riga": "LV",
+  "Europe/Rome": "IT",
+  "Europe/Sofia": "BG",
+  "Europe/Stockholm": "SE",
+  "Europe/Tallinn": "EE",
+  "Europe/Vienna": "AT",
+  "Europe/Vilnius": "LT",
+  "Europe/Warsaw": "PL",
+  "Europe/Zurich": "CH",
+  "Pacific/Auckland": "NZ"
+};
 function flagEmoji(iso2) {
   const cc = iso2.toUpperCase();
   if (!/^[A-Z]{2}$/.test(cc)) return "\u{1F3F3}\uFE0F";
@@ -137,6 +301,9 @@ function flagEmoji(iso2) {
 function countryByIso(iso2) {
   return iso2 ? byIso.get(iso2.toUpperCase()) : void 0;
 }
+function countryByTimeZone(timeZone) {
+  return countryByIso(timeZone ? timeZoneIso[timeZone] : void 0);
+}
 function countryByDialCode(digits) {
   let best;
   for (const c of PHONE_COUNTRIES) {
@@ -200,11 +367,11 @@ function isPossiblePhone(value) {
 
 // src/validation.ts
 var fileValueSchema = z.object({
-  fileId: z.string().min(1),
+  fileId: z.string().check(z.minLength(1)),
   name: z.string(),
-  size: z.number().nonnegative(),
+  size: z.number().check(z.nonnegative()),
   mime: z.string(),
-  url: z.string().optional()
+  url: z.optional(z.string())
 });
 function isEmpty(value) {
   if (value === null || value === void 0) return true;
@@ -251,7 +418,7 @@ function validateField(field, value) {
     }
     case "number": {
       const n = typeof value === "string" ? Number(value) : value;
-      if (typeof n !== "number" || Number.isNaN(n)) return "Enter a number";
+      if (typeof n !== "number" || !Number.isFinite(n)) return "Enter a number";
       if (field.min !== void 0 && n < field.min) return `Must be at least ${field.min}`;
       if (field.max !== void 0 && n > field.max) return `Must be at most ${field.max}`;
       return null;
@@ -329,6 +496,10 @@ function validateField(field, value) {
     case "date": {
       if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}$/.test(value))
         return "Enter a valid date";
+      const [y, m, d] = value.split("-").map(Number);
+      const dt = new Date(Date.UTC(y, m - 1, d));
+      if (dt.getUTCFullYear() !== y || dt.getUTCMonth() !== m - 1 || dt.getUTCDate() !== d)
+        return "Enter a valid date";
       return null;
     }
     case "file_upload": {
@@ -362,7 +533,7 @@ function normalizeValue(field, value) {
     const n = Number(value);
     return Number.isNaN(n) ? value : n;
   }
-  if (field.kind === "rating" && typeof value === "string") {
+  if ((field.kind === "rating" || field.kind === "linear_scale") && typeof value === "string") {
     const n = Number(value);
     return Number.isNaN(n) ? value : n;
   }
@@ -371,7 +542,7 @@ function normalizeValue(field, value) {
 }
 
 // src/schema-validation.ts
-import { z as z2 } from "zod";
+import * as z2 from "zod/mini";
 var FIELD_KINDS = [
   "short_text",
   "long_text",
@@ -395,27 +566,31 @@ var FIELD_KINDS = [
 ];
 var CONTENT_KINDS2 = ["heading", "paragraph", "divider"];
 var ALL_KINDS = [...FIELD_KINDS, ...CONTENT_KINDS2];
-var idSchema = z2.string().min(1).max(128);
-var optionSchema = z2.object({ id: idSchema, label: z2.string().max(1e3), icon: z2.unknown().optional() }).passthrough();
-var blockSchema = z2.object({
+var idSchema = z2.string().check(z2.minLength(1), z2.maxLength(128));
+var optionSchema = z2.looseObject({
+  id: idSchema,
+  label: z2.string().check(z2.maxLength(1e3)),
+  icon: z2.optional(z2.unknown())
+});
+var blockSchema = z2.looseObject({
   id: idSchema,
   kind: z2.enum(ALL_KINDS),
-  label: z2.string().max(2e3).optional(),
-  options: z2.array(optionSchema).max(200).optional(),
-  rows: z2.array(optionSchema).max(200).optional(),
-  columns: z2.array(optionSchema).max(200).optional()
-}).passthrough();
+  label: z2.optional(z2.string().check(z2.maxLength(2e3))),
+  options: z2.optional(z2.array(optionSchema).check(z2.maxLength(200))),
+  rows: z2.optional(z2.array(optionSchema).check(z2.maxLength(200))),
+  columns: z2.optional(z2.array(optionSchema).check(z2.maxLength(200)))
+});
 var pageSchema = z2.object({
   id: idSchema,
-  title: z2.string().max(500).optional(),
-  blocks: z2.array(blockSchema).max(500)
+  title: z2.optional(z2.string().check(z2.maxLength(500))),
+  blocks: z2.array(blockSchema).check(z2.maxLength(500))
 });
 var schemaShape = z2.object({
   version: z2.literal(1),
-  title: z2.string().max(2e3).optional().default(""),
-  description: z2.string().max(5e3).optional(),
-  pages: z2.array(pageSchema).min(1).max(50),
-  settings: z2.record(z2.string(), z2.unknown()).optional().default({})
+  title: z2._default(z2.optional(z2.string().check(z2.maxLength(2e3))), ""),
+  description: z2.optional(z2.string().check(z2.maxLength(5e3))),
+  pages: z2.array(pageSchema).check(z2.minLength(1), z2.maxLength(50)),
+  settings: z2._default(z2.optional(z2.record(z2.string(), z2.unknown())), {})
 });
 var MAX_SCHEMA_VERSION = 1;
 var FILLO_SCHEMA_VERSION = 1;
@@ -505,7 +680,7 @@ function normalizeSettings(value) {
     redirectUrl: normalizeUrl(rec.redirectUrl),
     showProgress: bool(rec.showProgress),
     submissionLimit,
-    notifyEmail: z2.email().max(254).safeParse(rec.notifyEmail).success ? rec.notifyEmail : void 0,
+    notifyEmail: z2.email().check(z2.maxLength(254)).safeParse(rec.notifyEmail).success ? rec.notifyEmail : void 0,
     sendReceipt: bool(rec.sendReceipt)
   };
 }
@@ -698,15 +873,20 @@ function formatAnswer(field, value) {
   if (value === null || value === void 0 || value === "") return "";
   switch (field.kind) {
     case "file_upload":
+      if (!Array.isArray(value)) return String(value);
       return value.map((f) => f.name).join(", ");
     case "select":
     case "dropdown":
       return field.options.find((o) => o.id === value)?.label ?? String(value);
     case "multi_select":
+      if (!Array.isArray(value)) return String(value);
       return value.map((id) => field.options.find((o) => o.id === id)?.label ?? id).join(", ");
     case "ranking":
+      if (!Array.isArray(value)) return String(value);
       return value.map((id, i) => `${i + 1}. ${field.options.find((o) => o.id === id)?.label ?? id}`).join(", ");
     case "matrix": {
+      if (typeof value !== "object" || value === null || Array.isArray(value))
+        return String(value);
       const answers = value;
       return field.rows.filter((row) => answers[row.id]).map((row) => `${row.label}: ${field.columns.find((c) => c.id === answers[row.id])?.label ?? ""}`).join(", ");
     }
@@ -1083,6 +1263,15 @@ var FilloError = class extends Error {
   status;
 };
 var MAX_CHUNK_RETRIES = 3;
+var DEFAULT_TIMEOUT_MS = 3e4;
+function isRetryableStatus(status) {
+  return status >= 500 || status === 429 || status === 408;
+}
+function asRequestError(err) {
+  if (err instanceof DOMException && err.name === "TimeoutError")
+    return new FilloError("Request timed out", 0);
+  return err;
+}
 function compareVersions(a, b) {
   const left = a.split(".").map((part) => Number(part) || 0);
   const right = b.split(".").map((part) => Number(part) || 0);
@@ -1137,10 +1326,17 @@ var FilloClient = class {
     return `${this.baseUrl}/api/v1${path}`;
   }
   async json(path, init) {
-    const res = await this.fetch(this.url(path), {
-      ...init,
-      headers: { "Content-Type": "application/json", ...init?.headers }
-    });
+    const headers = init?.body != null ? { "Content-Type": "application/json", ...init?.headers } : init?.headers;
+    let res;
+    try {
+      res = await this.fetch(this.url(path), {
+        ...init,
+        headers,
+        signal: init?.signal ?? AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
+      });
+    } catch (err) {
+      throw asRequestError(err);
+    }
     if (!res.ok) {
       const body = await res.text().catch(() => "");
       throw new FilloError(body || `Request failed: ${res.status}`, res.status);
@@ -1179,11 +1375,17 @@ var FilloClient = class {
   }
   /** Submit a response. Returns per-field errors instead of throwing on validation failure. */
   async submit(formId, data, meta) {
-    const res = await this.fetch(this.url(`/forms/${encodeURIComponent(formId)}/responses`), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ data, meta })
-    });
+    let res;
+    try {
+      res = await this.fetch(this.url(`/forms/${encodeURIComponent(formId)}/responses`), {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ data, meta }),
+        signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
+      });
+    } catch (err) {
+      throw asRequestError(err);
+    }
     if (res.status === 422) {
       const body2 = await res.json();
       return { ok: false, errors: body2.errors };
@@ -1203,7 +1405,8 @@ var FilloClient = class {
       const res = await this.fetch(this.url(`/forms/${encodeURIComponent(formId)}/sessions`), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ pageCount })
+        body: JSON.stringify({ pageCount }),
+        signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
       });
       if (!res.ok) return null;
       const body = await res.json();
@@ -1219,7 +1422,8 @@ var FilloClient = class {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(data),
-        keepalive: true
+        keepalive: true,
+        signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS)
       }).catch(() => {
       });
     } catch {
@@ -1303,10 +1507,17 @@ var FilloClient = class {
         JSON.stringify({ name: transport.fileName, parent: { id: transport.folderId } })
       );
       form.append("file", file, transport.fileName);
-      const res = await this.retry(
-        options2,
-        () => this.fetch(transport.uploadUrl, { method: "POST", headers: auth, body: form, signal: options2.signal })
-      );
+      const res = await this.retry(options2, async () => {
+        const r = await this.fetch(transport.uploadUrl, {
+          method: "POST",
+          headers: auth,
+          body: form,
+          signal: this.uploadSignal(options2)
+        });
+        if (!r.ok && isRetryableStatus(r.status))
+          throw new FilloError(`Box upload failed: ${r.status}`, r.status);
+        return r;
+      });
       if (!res.ok) throw new FilloError(`Box upload failed: ${res.status}`, res.status);
       const body = await res.json();
       report(file.size);
@@ -1318,9 +1529,8 @@ var FilloClient = class {
         400
       );
     }
-    const sessionRes = await this.retry(
-      options2,
-      () => this.fetch(transport.sessionUrl, {
+    const sessionRes = await this.retry(options2, async () => {
+      const r = await this.fetch(transport.sessionUrl, {
         method: "POST",
         headers: { ...auth, "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -1328,9 +1538,12 @@ var FilloClient = class {
           file_size: transport.size,
           file_name: transport.fileName
         }),
-        signal: options2.signal
-      })
-    );
+        signal: this.uploadSignal(options2)
+      });
+      if (!r.ok && isRetryableStatus(r.status))
+        throw new FilloError(`Box session failed: ${r.status}`, r.status);
+      return r;
+    });
     if (!sessionRes.ok) throw new FilloError(`Box session failed: ${sessionRes.status}`, sessionRes.status);
     const session = await sessionRes.json();
     const whole = new Sha1();
@@ -1342,9 +1555,8 @@ var FilloClient = class {
       const bytes = new Uint8Array(await file.slice(offset, end).arrayBuffer());
       whole.update(bytes);
       const partDigest = await digestPartBase64(bytes);
-      const res = await this.retry(
-        options2,
-        () => this.fetch(session.session_endpoints.upload_part, {
+      const res = await this.retry(options2, async () => {
+        const r = await this.fetch(session.session_endpoints.upload_part, {
           method: "PUT",
           headers: {
             ...auth,
@@ -1353,27 +1565,41 @@ var FilloClient = class {
             "Content-Range": `bytes ${offset}-${end - 1}/${file.size}`
           },
           body: bytes,
-          signal: options2.signal
-        })
-      );
+          signal: this.uploadSignal(options2)
+        });
+        if (!r.ok && isRetryableStatus(r.status))
+          throw new FilloError(`Box part failed: ${r.status}`, r.status);
+        return r;
+      });
       if (!res.ok) throw new FilloError(`Box part failed: ${res.status}`, res.status);
       parts.push((await res.json()).part);
       offset = end;
       report(offset);
     }
-    const commitRes = await this.retry(
-      options2,
-      () => this.fetch(session.session_endpoints.commit, {
+    const commitRes = await this.retry(options2, async () => {
+      const r = await this.fetch(session.session_endpoints.commit, {
         method: "POST",
         headers: { ...auth, "Content-Type": "application/json", Digest: `sha=${bytesToBase64(whole.digest())}` },
         body: JSON.stringify({ parts }),
-        signal: options2.signal
-      })
-    );
+        signal: this.uploadSignal(options2)
+      });
+      if (!r.ok && isRetryableStatus(r.status))
+        throw new FilloError(`Box commit failed: ${r.status}`, r.status);
+      return r;
+    });
     if (!commitRes.ok) throw new FilloError(`Box commit failed: ${commitRes.status}`, commitRes.status);
     const committed = await commitRes.json();
     return { providerFileId: committed.entries?.[0]?.id };
   }
+  /**
+   * Caller signal (if any) combined with a fresh per-request timeout. Created per
+   * fetch so each retry attempt gets its own deadline; the caller's own abort
+   * still drives the resumable-upload cancel semantics.
+   */
+  uploadSignal(options2) {
+    const timeout = AbortSignal.timeout(DEFAULT_TIMEOUT_MS);
+    return options2.signal ? AbortSignal.any([options2.signal, timeout]) : timeout;
+  }
   /** Retry a request with exponential backoff; never retries an aborted upload. */
   async retry(options2, fn) {
     let attempt = 0;
@@ -1398,10 +1624,12 @@ var FilloClient = class {
     let offset = session.uploadedBytes;
     const report = makeReporter(file.size, options2);
     report(offset);
+    let stalls = 0;
     while (offset < file.size) {
       options2.signal?.throwIfAborted();
-      const end = Math.min(offset + session.chunkSize, file.size);
-      const chunk = file.slice(offset, end);
+      const startedAt = offset;
+      let end = Math.min(offset + session.chunkSize, file.size);
+      let chunk = file.slice(offset, end);
       let attempt = 0;
       for (; ; ) {
         try {
@@ -1411,7 +1639,7 @@ var FilloClient = class {
               "Content-Range": `bytes ${offset}-${end - 1}/${file.size}`
             },
             body: chunk,
-            signal: options2.signal
+            signal: this.uploadSignal(options2)
           });
           if (res.status === 308) {
             const range = res.headers.get("Range") ?? res.headers.get("range");
@@ -1433,9 +1661,19 @@ var FilloClient = class {
           await new Promise((r) => setTimeout(r, 500 * 2 ** attempt));
           const fresh = await this.getUploadSession(session.id, session.token);
           offset = fresh.uploadedBytes;
+          if (offset >= file.size) break;
+          end = Math.min(offset + session.chunkSize, file.size);
+          chunk = file.slice(offset, end);
         }
       }
       report(offset);
+      if (offset <= startedAt) {
+        if (++stalls >= MAX_CHUNK_RETRIES) {
+          throw new FilloError("Drive upload stalled \u2014 the storage endpoint stopped accepting progress", 0);
+        }
+      } else {
+        stalls = 0;
+      }
     }
   }
   /**
@@ -1452,7 +1690,7 @@ var FilloClient = class {
           method: "PUT",
           headers: { "Content-Type": file.type || "application/octet-stream" },
           body: file,
-          signal: options2.signal
+          signal: this.uploadSignal(options2)
         });
         if (!res.ok) throw new FilloError(`S3 upload failed: ${res.status}`, res.status);
         report(file.size);
@@ -1567,6 +1805,7 @@ function createFormController(options2) {
   const uploadingFields = /* @__PURE__ */ new Set();
   const listeners = /* @__PURE__ */ new Set();
   const mountedAt = Date.now();
+  const idempotencyKey = randomSubmissionKey();
   let sessionId = null;
   let sessionStarted = false;
   function computeSnapshot() {
@@ -1659,7 +1898,8 @@ function createFormController(options2) {
       return;
     }
     if (client && formId) {
-      const submissionKey = form.settings.submissionLimit === "once_per_visitor" ? ensureSubmissionKey(formId) : void 0;
+      const visitorKey = form.settings.submissionLimit === "once_per_visitor" ? ensureSubmissionKey(formId) : void 0;
+      const submissionKey = visitorKey ?? idempotencyKey;
       status = "submitting";
       notify();
       let res;
@@ -1667,7 +1907,7 @@ function createFormController(options2) {
         res = await client.submit(formId, result.data, {
           hp: options2.getHoneypot?.() ?? "",
           elapsedMs: Date.now() - mountedAt,
-          surface: options2.surface ?? "default",
+          surface: options2.surface ?? "headless",
           submissionKey
         });
       } catch (err) {
@@ -1682,7 +1922,7 @@ function createFormController(options2) {
         return;
       }
       if (sessionId) client.reportProgress(sessionId, { completed: true });
-      if (submissionKey) markSubmitted(formId, res.responseId);
+      if (visitorKey) markSubmitted(formId, res.responseId);
       status = "submitted";
       notify();
       emitSubmitted(res.responseId, result.data);
@@ -1765,6 +2005,12 @@ function syncCodeForm(client, form) {
 }
 
 // src/prefill.ts
+function parseDecimal(raw) {
+  const s = raw.trim();
+  if (!/^-?\d*\.?\d+$/.test(s)) return null;
+  const n = Number(s);
+  return Number.isFinite(n) ? n : null;
+}
 function prefillFromParams(form, params) {
   const data = {};
   for (const field of allFields(form)) {
@@ -1772,23 +2018,24 @@ function prefillFromParams(form, params) {
     if (raw === void 0 || raw === "") continue;
     switch (field.kind) {
       case "number": {
-        const n = Number(raw);
-        if (Number.isNaN(n)) break;
+        const n = parseDecimal(raw);
+        if (n === null) break;
         if (field.min !== void 0 && n < field.min) break;
         if (field.max !== void 0 && n > field.max) break;
         data[field.id] = n;
         break;
       }
       case "rating": {
-        const n = Number(raw);
-        if (Number.isInteger(n) && n >= 1 && n <= (field.max ?? 5)) data[field.id] = n;
+        const n = parseDecimal(raw);
+        if (n !== null && Number.isInteger(n) && n >= 1 && n <= (field.max ?? 5))
+          data[field.id] = n;
         break;
       }
       case "linear_scale": {
-        const n = Number(raw);
+        const n = parseDecimal(raw);
         const min = field.min ?? 1;
         const max = field.max ?? 10;
-        if (Number.isInteger(n) && n >= min && n <= max) data[field.id] = n;
+        if (n !== null && Number.isInteger(n) && n >= min && n <= max) data[field.id] = n;
         break;
       }
       case "checkbox":
@@ -1861,6 +2108,7 @@ export {
   contentHash,
   countryByDialCode,
   countryByIso,
+  countryByTimeZone,
   createBlock,
   createClient,
   createEmptyForm,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usefillo/core",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Form schema, validation, logic engine and JS client for Fillo. Framework-agnostic.",
   "license": "MIT",
   "keywords": [