@usefillo/core 0.6.2 → 0.8.0

package/dist/index.d.ts

@@ -67,6 +67,8 @@ interface RatingField extends BaseField {
     kind: "rating";
     /** Number of steps, default 5. */
     max?: number;
+    /** Optional analysis meaning. CSAT requires a 1–5 rating. */
+    insightsMetric?: "csat";
 }
 interface DateField extends BaseField {
     kind: "date";
@@ -79,6 +81,8 @@ interface LinearScaleField extends BaseField {
     max?: number;
     minLabel?: string;
     maxLabel?: string;
+    /** Optional analysis meaning. NPS requires 0–10; CSAT requires 1–5. */
+    insightsMetric?: "csat" | "nps";
 }
 interface RankingField extends BaseField {
     kind: "ranking";
@@ -148,6 +152,39 @@ interface FormPage {
     title?: string;
     blocks: Block[];
 }
+/**
+ * Limit repeat responses. Absent = no limit (submit as often as you like).
+ */
+interface ResponseLimit {
+    /**
+     * Who counts as the same responder:
+     * - "browser": same device, anonymous — the SDK remembers this browser
+     *   answered and sends a de-duplication key (ratings, polls, "was this
+     *   helpful").
+     * - "field": the person self-identifies by answering `field` (an email or
+     *   phone field). A self-claim — unverified, soft dedup — so the hosted link
+     *   and anonymous embeds can still dedupe.
+     * - "identify": the identify() respondent (HMAC-verifiable). The strong
+     *   path; only embedded surfaces that call identify() are recognized.
+     */
+    by: "browser" | "field" | "identify";
+    /** The email/phone field whose answer identifies the person. `by: "field"` only. */
+    field?: string;
+    /**
+     * Optionally sub-scope the limit by a field's answer (usually a hidden
+     * article/product/order id): "one response per responder PER that value" —
+     * e.g. one 👍 per visitor per article from a single shared form.
+     */
+    scopeField?: string;
+    /**
+     * A repeat from the same responder: "keep" answers with the standing
+     * response (the first answer stands); "update" edits it in place (re-anchored
+     * to the current schema, `response.updated` webhook, previous answers
+     * prefilled for a verified respondent). "update" applies to `by: "identify"`
+     * only — a self-claim/browser must not overwrite another person's response.
+     */
+    onRepeat: "keep" | "update";
+}
 interface FormSettings {
     /**
      * Default "button": respondents submit with the footer button. "auto" hides
@@ -160,17 +197,49 @@ interface FormSettings {
     successMessage?: string;
     redirectUrl?: string;
     showProgress?: boolean;
-    /**
-     * Default "multiple": a browser can submit as often as it wants. Use
-     * "once_per_visitor" for tiny docs/article feedback where the SDK should
-     * remember this browser has already answered and send a server-side
-     * de-duplication key with the response.
-     */
-    submissionLimit?: "multiple" | "once_per_visitor";
+    /** Limit repeat responses (who counts as the same responder, and what a
+     *  repeat does). Absent = no limit. See {@link ResponseLimit}. */
+    responseLimit?: ResponseLimit;
     /** Notify this address on every submission. */
     notifyEmail?: string;
     /** Send respondents a receipt (to the first answered email field). */
     sendReceipt?: boolean;
+    /**
+     * Save respondents' in-progress answers to Fillo (default off). The SDK
+     * autosaves as they type and restores on return, so long forms survive
+     * reloads and tab closes. Off by default because it stores answers before
+     * the respondent chooses to submit — the form owner opts in.
+     */
+    saveProgress?: boolean;
+    /**
+     * Let workspace members read the answers a respondent has typed but not yet
+     * submitted (default off; requires saveProgress). This exposes pre-submission
+     * content to the owner's team, so it's a separate opt-in with its own consent
+     * framing — disclose it in your privacy policy. Respondents still see the
+     * "progress saved" notice. The content is visible only in the authenticated
+     * dashboard; the draft token stays the only public read capability.
+     */
+    draftAnswersVisible?: boolean;
+    /**
+     * Email a respondent one "pick up where you left off" link when they leave a
+     * form idle (default off; requires saveProgress). Sent at most once per
+     * draft, to an address they entered or their verified account email — never
+     * with any answer content. Owner opt-in.
+     */
+    resumeEmails?: boolean;
+    /**
+     * Where a resume link should land for an embedded form (http(s) only). The
+     * draft reference travels in the URL fragment, which the SDK adopts on load;
+     * defaults to the hosted /f page when unset.
+     */
+    resumeUrl?: string;
+    /**
+     * Email the form's notification address a daily digest of who dropped off —
+     * abandoned and open draft counts, where people stalled, and verified
+     * respondents by name (default off; requires notifyEmail). Never any answer
+     * content or resume links.
+     */
+    draftDigest?: boolean;
 }
 interface FormSchema {
     version: 1;
@@ -226,6 +295,10 @@ type UploadStatus = "pending" | "uploading" | "complete" | "aborted";
  * - "gdrive": direct to a Google Drive resumable session URL (Content-Range
  *   protocol).
  * - "s3-put": a single PUT to a presigned S3/R2 URL — straight to the bucket.
+ *   Retained for sessions created by older Fillo servers.
+ * - "s3-multipart": resumable S3/R2 multipart upload. The client asks Fillo
+ *   for one short-lived UploadPart URL at a time; only the server can assemble
+ *   the parts into an object.
  * - "box": direct to Box with a folder-scoped upload token — small files via a
  *   single multipart POST, large files via Box's chunked session (the client
  *   computes the SHA-1 digests Box requires). The server commits/verifies in the
@@ -237,6 +310,8 @@ type UploadTransport = {
 } | {
     type: "s3-put";
     uploadUrl: string;
+} | {
+    type: "s3-multipart";
 } | {
     type: "box";
     mode: "simple";
@@ -279,8 +354,30 @@ interface UploadSession {
 /** All conditions must hold (AND). No conditions = visible. */
 declare function isBlockVisible(block: Block, data: ResponseData): boolean;
 declare function visibleBlocks(page: FormPage, data: ResponseData): Block[];
+/**
+ * Blocks to render on `page`, resolved against the WHOLE-FORM visibility
+ * fixpoint rather than just this page's own fields. A field whose `visibleIf`
+ * references an answer on another page must appear/validate here exactly when
+ * the server would keep that answer — and the server (validateResponse →
+ * visibleFields) uses the whole-form fixpoint, hiding any controlling field
+ * that is itself logic-hidden. Scoping per page instead reads a stale answer
+ * behind a hidden cross-page trigger as still-answered, so the client would
+ * render (and validate) a field whose answer the server then silently drops.
+ * Use this for anything that must agree with validateResponse; the per-page
+ * `visibleBlocks` remains for callers holding only a single page.
+ */
+declare function visiblePageBlocks(form: FormSchema, page: FormPage, data: ResponseData): Block[];
 /** Every field in the form (across pages), in order. */
 declare function allFields(form: FormSchema): Field[];
+/**
+ * The scope key for a response limit: the string form of the answer to
+ * `settings.responseLimit.scopeField`, or null when there is no scope field or the
+ * answer is not a usable scalar. A non-scalar answer (checkbox boolean,
+ * multi_select/ranking array, matrix object) means "no scope" — the limit
+ * spans the whole form rather than silently mis-bucketing. Shared by the SDK's
+ * per-visitor key and the server's per-person dedup so both scope identically.
+ */
+declare function responseScopeValue(settings: FormSettings, data: ResponseData): string | null;
 /** Fields currently visible given the response data — the set that gets validated. */
 declare function visibleFields(form: FormSchema, data: ResponseData): Field[];
 
@@ -302,6 +399,17 @@ declare function validateResponse(form: FormSchema, data: ResponseData): Validat
 declare const FILLO_SCHEMA_VERSION: 1;
 /** Injected from package.json at build time (tsup define) — never hand-edited. */
 declare const FILLO_SDK_VERSION: string;
+/**
+ * The oldest published @usefillo/* SDK that can still render a form the current
+ * server serves. This is a DELIBERATE floor — bump it BY HAND only when a
+ * genuinely wire-breaking change ships (a new required request/response field an
+ * old SDK can't produce or read). It must never be tied to FILLO_SDK_VERSION:
+ * the server used to serve its own build version as the min, so every release
+ * 426'd every customer still on an older pinned SDK. Field-kind/schema-shape
+ * breaks are gated separately by FILLO_SCHEMA_VERSION, so this floor stays low.
+ */
+declare const FILLO_MIN_SDK_VERSION = "0.4.0";
+declare function normalizeSettings(value: unknown): FormSettings;
 interface SchemaValidationResult {
     ok: boolean;
     /** Present when ok — a normalized, structurally-valid schema. */
@@ -382,6 +490,18 @@ declare function parsePhone(value: string, fallback?: PhoneCountry): ParsedPhone
  * validation. `country` (when known) tightens the accepted lengths.
  */
 declare function isPossiblePhone(value: string): boolean;
+/** Whether the country-picker popover opens below or above its trigger. */
+type PhonePopoverPlacement = "below" | "above";
+/** Minimum gap kept between the popover and the viewport edge, in px. */
+declare const PHONE_POPOVER_VIEWPORT_GAP = 8;
+/**
+ * Decide whether the country-picker popover should open below or above its
+ * anchor and size it to fit the viewport, writing the result to CSS custom
+ * properties on the popover. Pure DOM math with no framework assumptions, so
+ * the React and vanilla renderers share one implementation instead of drifting
+ * copies. Returns "below" when there is nothing to position (SSR / detached).
+ */
+declare function positionPhonePopover(anchor: HTMLElement | null, popover: HTMLElement | null): PhonePopoverPlacement;
 
 /** Display metadata for every block kind — drives the builder palette. */
 declare const BLOCK_KIND_META: Record<BlockKind, {
@@ -416,6 +536,7 @@ interface FieldSpec {
     max?: number;
     minLabel?: string;
     maxLabel?: string;
+    insightsMetric?: "csat" | "nps";
     rows?: string[];
     columns?: string[];
     placeholder?: string;
@@ -478,6 +599,8 @@ type SubmitResult = {
     responseId: string;
     /** True when the API accepted the request as an already-recorded visitor response. */
     duplicate?: boolean;
+    /** True when an update-in-place limit (responseLimit onRepeat "update") updated the person's living response. */
+    updated?: boolean;
     errors?: undefined;
 } | {
     ok: false;
@@ -496,9 +619,74 @@ interface SubmitMeta {
     surface?: "default" | "headless";
     /**
      * Browser-scoped de-duplication key sent when a form opts into
-     * settings.submissionLimit = "once_per_visitor".
+     * settings.responseLimit.by = "browser".
      */
     submissionKey?: string;
+    /**
+     * Saved-progress draft this submission completes (forms with
+     * settings.saveProgress). The server deletes the draft with the response
+     * commit so it can't be resumed after submitting.
+     */
+    draft?: {
+        id: string;
+        token: string;
+    };
+    /**
+     * Host-app account context for this respondent (identify()). Recorded with
+     * the response and shown in the dashboard/webhooks as a CLAIM from the
+     * embedding page — it is metadata, not authentication. `id` is your own
+     * stable user/account id.
+     */
+    respondent?: FilloRespondent;
+}
+/**
+ * The host app's account context for the person filling the form. Passed as
+ * the `respondent` option on FilloForm / FilloProvider / renderForm /
+ * createFormController; Fillo keys responses to it so the dashboard,
+ * webhooks, and integrations can say WHO answered.
+ */
+interface FilloRespondent {
+    /** Your stable user/account id — the identity key within your workspace. */
+    id: string;
+    email?: string;
+    name?: string;
+    /** Small primitive facts (plan, role, region…) — not a data warehouse. */
+    traits?: Record<string, string | number | boolean>;
+    /**
+     * Identity verification (optional): hex HMAC-SHA256 of `id`, computed on
+     * YOUR server with the workspace identity secret from Fillo settings. Once
+     * the workspace holds a secret, Fillo records identity only with a valid
+     * hash — never compute this in the browser or the secret leaks.
+     */
+    hash?: string;
+}
+/** Wire shape of a saved-progress draft (settings.saveProgress forms). */
+interface ResponseDraft {
+    id: string;
+    formId: string;
+    /** Partial answers exactly as last saved — validated only at submit. */
+    data: ResponseData;
+    /** 0-based page the respondent was on when the draft was last saved. */
+    page: number;
+    /** A freshly rotated bearer, returned only when adopting a resume link — the
+     *  URL token is spent, so this is what future saves must use. */
+    token?: string;
+}
+interface CreatedDraft {
+    id: string;
+    /**
+     * Per-draft bearer, returned once at creation; sent back as
+     * X-Fillo-Draft-Token on every read/save/delete of this draft.
+     */
+    token: string;
+    /** ISO timestamp; the server slides it forward on every save. */
+    expiresAt?: string;
+    /**
+     * True when a VERIFIED identity picked up its existing draft from another
+     * device — the token was rotated to this caller, and the draft's answers
+     * were left untouched (fetch them with getDraft to restore).
+     */
+    existing?: boolean;
 }
 interface UploadProgress {
     uploadedBytes: number;
@@ -514,14 +702,23 @@ interface UploadFileOptions {
     sessionId?: string;
     /** Ownership token for the resumed session (from the original create call). */
     uploadToken?: string;
+    /** Persist this handle if the host wants reload-safe resumability. */
+    onSession?: (handle: {
+        sessionId: string;
+        uploadToken?: string;
+    }) => void;
 }
 declare class FilloError extends Error {
     status?: number | undefined;
     /** Server-suggested wait (from a 429's Retry-After header), seconds. */
     retryAfterSec?: number | undefined;
+    /** Stable machine-readable API error code, when the server provides one. */
+    code?: string | undefined;
     constructor(message: string, status?: number | undefined, 
     /** Server-suggested wait (from a 429's Retry-After header), seconds. */
-    retryAfterSec?: number | undefined);
+    retryAfterSec?: number | undefined, 
+    /** Stable machine-readable API error code, when the server provides one. */
+    code?: string | undefined);
 }
 /** Duck-typed — `instanceof` breaks when two SDK copies end up in one bundle. */
 declare function isFilloError(err: unknown): err is FilloError;
@@ -533,6 +730,17 @@ interface SyncFormResult {
     status?: "draft" | "published";
     /** Changes were staged as a draft for a human to publish. */
     staged?: boolean;
+    /**
+     * Server-authoritative live snapshot. Present when the incoming code schema
+     * is not the version respondents may submit against yet.
+     */
+    resolvedSchema?: FormSchema;
+    resolvedTheme?: FormTheme | null;
+    /** Non-fatal integration problem; the resolved live snapshot remains usable. */
+    syncError?: {
+        code: string;
+        message: string;
+    };
     warning?: string;
 }
 declare class FilloClient {
@@ -547,12 +755,30 @@ declare class FilloClient {
     /** Fetch a published form definition by id or slug. */
     getForm(idOrSlug: string): Promise<PublishedForm>;
     /**
-     * Upsert a code-defined form into the workspace identified by the client's
-     * publishable key. Returns the canonical form id used for submissions.
+     * Resolve a code-defined form through the workspace identified by the
+     * client's publishable key. Depending on workspace policy, changed content
+     * may be staged for review or resolved to the authoritative live snapshot.
+     * Returns the canonical form id used for submissions.
      */
     syncForm(handle: string, schema: FormSchema, theme?: FormTheme | null): Promise<SyncFormResult>;
     /** Submit a response. Returns per-field errors instead of throwing on validation failure. */
     submit(formId: string, data: ResponseData, meta?: SubmitMeta): Promise<SubmitResult>;
+    /**
+     * The identified person's own living response on an upsert-mode form —
+     * used to prefill their answers for editing. Requires a VERIFIED identity
+     * ({id, hash}); anything else 404s (returned as null), because an
+     * unverified read would hand anyone's answers to any page script.
+     *
+     * `scopeValue` scopes the lookup for forms whose response limit is keyed to
+     * a field (responseLimit.scopeField) — e.g. one response per article. When
+     * the form is scoped, the server returns 404 unless the matching scope value
+     * is sent, so a page loaded for article B never prefills article A's answers.
+     * Optional and back-compatible: omit it for unscoped forms.
+     */
+    fetchOwnResponse(formId: string, respondent: FilloRespondent, scopeValue?: string): Promise<{
+        responseId: string;
+        data: ResponseData;
+    } | null>;
     /**
      * Open a respondent session for funnel analysis. Fire-and-forget: returns the
      * session id, or null if tracking is unavailable (never blocks the form).
@@ -563,14 +789,40 @@ declare class FilloClient {
         furthestPage?: number;
         completed?: boolean;
     }): void;
+    /**
+     * Create a saved-progress draft (forms with settings.saveProgress). Returns
+     * the draft id and its ownership token — the token is shown only once.
+     */
+    createDraft(formId: string, body: {
+        data: ResponseData;
+        page?: number;
+        respondent?: FilloRespondent;
+    }): Promise<CreatedDraft>;
+    /** Fetch a draft to restore. 404s once expired, consumed, or deleted. When
+     *  `adopt` is set (resume-link adoption), the server rotates the bearer and
+     *  returns the new `token` — the URL token becomes single-use. */
+    getDraft(draftId: string, token: string, adopt?: boolean): Promise<ResponseDraft>;
+    /**
+     * Overwrite a draft's answers/page and slide its expiry. `keepalive` lets a
+     * tab-close flush outlive the page; browsers reject keepalive bodies over
+     * ~64KB, in which case this save is simply lost — the debounced autosaves
+     * every few keystrokes are the real persistence, the flush is a bonus.
+     */
+    saveDraft(draftId: string, token: string, body: {
+        data: ResponseData;
+        page?: number;
+    }, opts?: {
+        keepalive?: boolean;
+    }): Promise<void>;
+    /** Discard a draft (the "Start over" path). */
+    deleteDraft(draftId: string, token: string): Promise<void>;
     /** Current state of an upload session — used to resume after interruption. */
-    getUploadSession(sessionId: string, token?: string): Promise<UploadSession>;
+    getUploadSession(sessionId: string, token?: string, signal?: AbortSignal): Promise<UploadSession>;
     /**
-     * Resumable chunked upload. Creates (or resumes) a session, streams the file
-     * chunk by chunk with progress callbacks, and finalizes into a FileValue that
-     * goes into the response data. Survives flaky connections: each chunk is
-     * retried, and on repeated failure the true offset is re-queried so no byte
-     * is sent twice or skipped.
+     * Provider-aware browser-direct upload. Creates a session, uses the storage
+     * transport selected by the server, reports progress, and finalizes into a
+     * FileValue. Resumable providers can continue an existing session; one-shot
+     * transports are retried according to their own safe semantics.
      *
      * Depending on the form's storage settings the server picks a transport:
      * direct-to-Google-Drive resumable
@@ -589,7 +841,7 @@ declare class FilloClient {
     /**
      * Caller signal (if any) combined with a fresh per-request timeout. Created per
      * fetch so each retry attempt gets its own deadline; the caller's own abort
-     * still drives the resumable-upload cancel semantics.
+     * still drives upload cancellation across every provider transport.
      */
     private uploadSignal;
     /** Retry a request with exponential backoff; never retries an aborted upload. */
@@ -601,6 +853,13 @@ declare class FilloClient {
      * queries Drive for the authoritative offset).
      */
     private driveUploadLoop;
+    /**
+     * S3-compatible multipart protocol. Fillo owns the provider upload id and is
+     * the only party allowed to complete it; the browser receives only narrowly
+     * scoped UploadPart URLs. That keeps uploads resumable and means an old or
+     * slow browser request cannot materialize an object after server-side abort.
+     */
+    private s3MultipartUploadLoop;
     /**
      * S3-compatible single PUT to a presigned URL — bytes go straight to the
      * bucket. Not resumable (S3 single PUT is atomic), but retried on failure.
@@ -612,13 +871,13 @@ interface ProvisionWorkspaceResult {
     /** Publishable key (pk_…) for the new workspace. Pass to createClient({ key }). */
     key: string;
     organizationId: string;
-    /** A claim link was emailed here so the owner can take ownership later. */
+    /** The private workspace link is emailed directly; `url` stays null. */
     claim: {
         url: string | null;
         email: string | null;
         sent: boolean;
     };
-    /** Caps applied until the workspace is claimed. */
+    /** Caps applied until the workspace is saved to an account. */
     limits: {
         responses: number;
         expiresAt: string;
@@ -626,9 +885,9 @@ interface ProvisionWorkspaceResult {
 }
 /**
  * Provision a Fillo workspace from an email — no signup — and get a publishable
- * key back, so a form can collect real responses immediately. A claim link is
- * emailed to `email`; until someone claims it the workspace runs as a capped
- * preview (limited responses, for a limited time). Built for setup automation,
+ * key back, so a form can collect real responses immediately. A private
+ * workspace link is emailed to `email`; until someone saves it to an account,
+ * the workspace runs as a capped preview (limited responses, for a limited time). Built for setup automation,
  * e.g. a coding agent wiring Fillo into an app during integration.
  *
  *   const { key } = await provisionWorkspace({ email: "you@co.com" });
@@ -674,12 +933,19 @@ interface FormControllerOptions {
      */
     surface?: "default" | "headless";
     /**
-     * Resolve the submission target at submit time when `formId` is still
-     * unset — e.g. re-run a code-form sync that failed at mount. Answers are
-     * held (never dropped) while it runs; failure sets `submitError` and the
-     * respondent can retry.
+     * Resolve/verify the submission target immediately before submit. Code-form
+     * renderers use this to recover a missing target and to detect a live schema
+     * change after a cached mount. Answers are held (never dropped) while it
+     * runs; failure sets `submitError` and the respondent can retry.
      */
     resolveFormId?: () => Promise<string>;
+    /**
+     * Host-app account context (identify()): who is filling this form, by your
+     * own user id. Sent with the submission and recorded as an unverified
+     * claim — it changes what the dashboard/webhooks can tell you, never what
+     * the respondent can do.
+     */
+    respondent?: FilloRespondent;
 }
 interface FormControllerState {
     data: ResponseData;
@@ -697,6 +963,48 @@ interface FormControllerState {
     uploading: boolean;
     /** Human-readable message for the last failed submit; cleared on edit/retry. */
     submitError?: string;
+    /**
+     * True when `status` is "submitted" because the once-per-visitor gate
+     * restored a previous visit's response, not because a submit happened in
+     * this controller instance. Renderers use it to skip one-time "just
+     * submitted" reactions (moving focus to the success screen, redirecting) —
+     * otherwise every remount of an already-answered form replays them.
+     */
+    restoredSubmission: boolean;
+    /**
+     * True when a saved-progress draft (settings.saveProgress) was restored
+     * into this fill — answers and/or page position came from a previous
+     * visit. Renderers use it to show a "continuing where you left off"
+     * notice with a Start over action (resetDraft).
+     */
+    resumedDraft: boolean;
+    /**
+     * True when an update-in-place limit prefilled the VERIFIED respondent's own
+     * previous answers — submitting updates that response in place. Renderers
+     * show an "updating your earlier response" notice.
+     */
+    editingPrevious: boolean;
+    /**
+     * True when the last submit was accepted as an already-recorded response
+     * rather than a new one (the server returns this only for a VERIFIED
+     * identify() repeat on a keep-mode form). Renderers show an "already
+     * answered" message on the success screen instead of implying a fresh
+     * submission — otherwise a repeat visitor's new answers look saved when the
+     * server kept the original.
+     */
+    duplicateSubmission: boolean;
+    /**
+     * True when the last submit UPDATED the person's existing response in place
+     * (responseLimit onRepeat "update"), rather than creating a new one.
+     */
+    updatedSubmission: boolean;
+    /**
+     * True when a resume link (#fillo-draft=…) could not be adopted because it
+     * was expired, already used, or not this browser's — so no progress was
+     * restored. Renderers surface a "that link expired — start again" notice
+     * instead of showing a silently blank form.
+     */
+    resumeLinkFailed: boolean;
 }
 interface FormController {
     /** Stable snapshot — same reference until something changes (safe for useSyncExternalStore). */
@@ -721,7 +1029,21 @@ interface FormController {
         form?: FormSchema;
         formId?: string;
         client?: FilloClient;
+        /** Late-bind identify() context — host sessions often resolve after mount. */
+        respondent?: FilloRespondent;
     }): void;
+    /**
+     * Persist any unsaved draft progress right now (settings.saveProgress
+     * forms). Renderers call this on pagehide/visibility-hidden so the last
+     * keystrokes survive a tab close; a no-op when there's nothing to save.
+     */
+    flushDraft(): void;
+    /**
+     * Discard the saved draft and reset to a fresh fill: answers back to
+     * initialData + URL prefill, first page, errors cleared. The "Start over"
+     * action next to the resume notice.
+     */
+    resetDraft(): void;
     /** Drop all listeners. */
     destroy(): void;
 }
@@ -753,7 +1075,7 @@ declare function shouldAutoSubmit(field: Field, value: FieldValue, ctx: AutoSubm
  * (Tailwind `data-[invalid]:…`) can react to it. Slot names and attribute
  * names are public API — renames are breaking; additions are minors.
  */
-declare const FILLO_SLOTS: readonly ["root", "header", "title", "description", "pageTitle", "progress", "progressFill", "blocks", "field", "label", "fieldDescription", "control", "options", "option", "optionLabel", "error", "footer", "button", "success"];
+declare const FILLO_SLOTS: readonly ["root", "header", "title", "description", "pageTitle", "progress", "progressFill", "blocks", "field", "label", "fieldDescription", "control", "options", "option", "optionLabel", "error", "footer", "button", "success", "resume"];
 type FilloSlot = (typeof FILLO_SLOTS)[number];
 /** data-* names emitted alongside the stable fillo-* classes. */
 declare const FILLO_DATA_ATTRS: {
@@ -840,10 +1162,23 @@ declare const FILLO_THEME_VARS: readonly [{
 }];
 
 /**
- * Every visitor-facing string the default renderers emit, overridable as a
- * unit so a localized site never shows stray English at the submit moment.
+ * The default English validation message for a required field left empty.
+ * `validateField` returns this exact sentinel (core has no strings context),
+ * and the React render layer swaps it for `strings.required` so a localized
+ * site can translate it. Keep it identical to `DEFAULT_FIELD_STRINGS.required`.
+ */
+declare const REQUIRED_FIELD_MESSAGE = "This field is required";
+/**
+ * The form-chrome strings the default renderers emit, overridable as a unit so
+ * a localized site never shows stray English at the submit moment.
  * Schema-authored text (labels, descriptions, success copy set in settings)
  * always wins over these defaults.
+ *
+ * Field-level and validation copy (required message, upload field, duplicate/
+ * resume notices) lives in {@link FilloFieldStrings} — split out so this
+ * documented, all-`string` surface stays stable while parametrized field
+ * strings can be functions. The renderers resolve both together
+ * ({@link FilloRendererStrings}); the `strings` prop overrides either.
  */
 interface FilloStrings {
     back: string;
@@ -870,9 +1205,53 @@ interface FilloStrings {
     loadFailedNetwork: string;
     loadFailed: string;
     renderFailed: string;
+    /** Saved-progress notice when a draft restored earlier answers. */
+    resumeNotice: string;
+    /** Upsert-mode notice when the person's previous response was prefilled. */
+    editNotice: string;
+    /** The discard action next to the resume notice. */
+    resumeStartOver: string;
 }
 declare const DEFAULT_STRINGS: FilloStrings;
-declare function resolveStrings(overrides?: Partial<FilloStrings>): FilloStrings;
+/**
+ * Field-level and validation strings the default renderers emit. Kept apart
+ * from {@link FilloStrings} so parametrized entries can be functions (a
+ * translation places the value where its grammar needs it) without widening
+ * the documented all-`string` chrome surface.
+ */
+interface FilloFieldStrings {
+    /** Validation: a required field was left empty. Mirrors REQUIRED_FIELD_MESSAGE. */
+    required: string;
+    /** Notice when a spent/expired resume link couldn't restore progress. */
+    resumeLinkExpired: string;
+    /** Success-screen message when a verified identity re-submits and the form
+     *  keeps the first answer (a visible duplicate, not a fresh response). */
+    alreadyAnswered: string;
+    /** Retry control on a failed upload row. */
+    uploadRetry: string;
+    /** Dropzone copy when uploads can't run (no client / preview). */
+    uploadsDisabled: string;
+    /** An upload attempt failed with no actionable server message. */
+    uploadFailed: string;
+    /** Dropzone call to action; `multiple` is true when several files are allowed. */
+    dropzoneTitle: (multiple: boolean) => string;
+    /** Dropzone hint stating the per-file size limit in MB. */
+    dropzoneHint: (maxMb: number) => string;
+    /** A file exceeded the per-file MB limit before upload started. */
+    fileTooLarge: (maxMb: number) => string;
+    /** Screen-reader status: N uploads in progress. */
+    filesUploading: (count: number) => string;
+    /** Screen-reader status: N uploads failed. */
+    uploadsFailed: (count: number) => string;
+    /** Screen-reader status: N uploads completed. */
+    filesUploaded: (count: number) => string;
+}
+declare const DEFAULT_FIELD_STRINGS: FilloFieldStrings;
+/** Everything the default renderers can localize — chrome + field/validation. */
+type FilloRendererStrings = FilloStrings & FilloFieldStrings;
+/** Merge overrides over the built-in chrome + field defaults. Accepts a partial
+ *  of the full renderer surface so the `strings` prop can override either set. */
+declare function resolveStrings(overrides?: Partial<FilloRendererStrings>): FilloRendererStrings;
 
 /** Result of syncing a code-defined form: its canonical id, slug, and branding. */
 interface SyncedForm {
@@ -883,12 +1262,21 @@ interface SyncedForm {
     status?: "draft" | "published";
     /** Changes were staged as a draft for a human to publish. */
     staged?: boolean;
+    /** Server-authoritative live snapshot when local code is not live yet. */
+    resolvedSchema?: FormSchema;
+    resolvedTheme?: FormTheme | null;
+    /** Non-fatal integration problem; resolvedSchema remains safe to render. */
+    syncError?: {
+        code: string;
+        message: string;
+    };
     warning?: string;
 }
 /**
- * A form whose structure lives in user code. Framework renderers can show it
- * immediately, then sync it into a Fillo workspace when a publishable key is
- * present so responses, uploads, webhooks, and exports work normally.
+ * A form whose structure lives in user code. Development and explicit
+ * render-only usage can show it immediately; production renderers with a
+ * publishable key first resolve the canonical form from Fillo so responses,
+ * uploads, webhooks, and exports stay bound to the published version.
  */
 interface CodeForm {
     /** Stable handle, unique in the workspace. */
@@ -909,10 +1297,16 @@ declare function isCodeForm(form: unknown): form is CodeForm;
 /** Stable djb2 hash of a string — used to key code-form sync by content. */
 declare function contentHash(input: string): string;
 /**
- * Sync a code-defined form into a workspace at most once per session for the
- * same client, handle, schema, and theme. `bypassCache` forces the network —
- * used by submit-time resolution, where a stale cached formId must not be
- * trusted over a fresh sync.
+ * Compare normalized schema JSON while ignoring object-key order (Postgres
+ * jsonb and custom API proxies may reorder keys). Array order remains part of
+ * the form definition because it controls pages, blocks, and options.
+ */
+declare function formSchemasEqual(left: FormSchema, right: FormSchema): boolean;
+/**
+ * Resolve a code-defined form with in-flight dedupe and bounded stable-result
+ * caching (published 1h, draft 60s). Staged/live-fallback results are evicted
+ * once settled so an SPA can observe publication without a hard reload.
+ * `bypassCache` forces the network for submit-time compatibility checks.
  */
 declare function syncCodeForm(client: FilloClient, form: CodeForm, opts?: {
     bypassCache?: boolean;
@@ -1036,4 +1430,4 @@ declare class Sha1 {
 }
 declare const sha1Base64: (bytes: Uint8Array) => string;
 
-export { type AutoSubmitContext, BLOCK_KIND_META, type BaseField, type Block, type BlockKind, CONTENT_KINDS, type CheckboxField, type ChoiceField, type CodeForm, type Condition, type ConditionOp, type ContentBlock, type ContentKind, type CustomField, DEFAULT_STRINGS, DRAFT_KINDS, type DateField, type DividerBlock, FILLO_DATA_ATTRS, FILLO_SCHEMA_VERSION, FILLO_SDK_VERSION, FILLO_SLOTS, FILLO_THEME_VARS, type Field, type FieldKind, type FieldSpec, type FieldValue, type FileUploadField, type FileValue, type FilloAppearance, FilloClient, type FilloClientOptions, FilloError, FilloJsxError, type FilloSlot, type FilloStrings, type FormBranding, type FormController, type FormControllerOptions, type FormControllerState, type FormDraftSpec, type FormPage, type FormSchema, type FormSettings, type FormStatus, type FormTheme, type HeadingBlock, type HiddenField, JSX_BLOCK_COMPONENTS, JSX_BLOCK_SPECS, type JsonValue, type JsxFormMeta, type LinearScaleField, type MatrixField, type NumberField, PHONE_COUNTRIES, type ParagraphBlock, type ParsedPhone, type PhoneCountry, type PhoneField, type ProvisionWorkspaceResult, type PublishedForm, type RankingField, type RatingField, type ResponseData, type SchemaValidationResult, type SelectOption, Sha1, type SignatureField, type SlotClass, type SlotState, type SubmitMeta, type SubmitResult, type SyncFormResult, type SyncedForm, type TextField, type UploadFileOptions, type UploadProgress, type UploadSession, type UploadStatus, type UploadTransport, type ValidationResult, type WhenBuilder, allFields, assembleForm, codeFormFromJsx, contentHash, countryByDialCode, countryByIso, countryByTimeZone, createBlock, createClient, createEmptyForm, createFormController, createId, defineForm, digitsOnly, flagEmoji, formatAnswer, formatNational, isAutoSubmitBlock, isBlockVisible, isCodeForm, isField, isFilloError, isPossiblePhone, needsExplicitSubmit, normalizeFormSchema, normalizeFormTheme, parsePhone, pipeBlock, prefillFromParams, provisionWorkspace, resolveSlotClass, resolveStrings, resolveText, schemaFromJsx, sha1Base64, shouldAutoSubmit, slotClass, syncCodeForm, toE164, validateField, validateFormSchema, validateResponse, visibleBlocks, visibleFields, when };
+export { type AutoSubmitContext, BLOCK_KIND_META, type BaseField, type Block, type BlockKind, CONTENT_KINDS, type CheckboxField, type ChoiceField, type CodeForm, type Condition, type ConditionOp, type ContentBlock, type ContentKind, type CreatedDraft, type CustomField, DEFAULT_FIELD_STRINGS, DEFAULT_STRINGS, DRAFT_KINDS, type DateField, type DividerBlock, FILLO_DATA_ATTRS, FILLO_MIN_SDK_VERSION, FILLO_SCHEMA_VERSION, FILLO_SDK_VERSION, FILLO_SLOTS, FILLO_THEME_VARS, type Field, type FieldKind, type FieldSpec, type FieldValue, type FileUploadField, type FileValue, type FilloAppearance, FilloClient, type FilloClientOptions, FilloError, type FilloFieldStrings, FilloJsxError, type FilloRendererStrings, type FilloRespondent, type FilloSlot, type FilloStrings, type FormBranding, type FormController, type FormControllerOptions, type FormControllerState, type FormDraftSpec, type FormPage, type FormSchema, type FormSettings, type FormStatus, type FormTheme, type HeadingBlock, type HiddenField, JSX_BLOCK_COMPONENTS, JSX_BLOCK_SPECS, type JsonValue, type JsxFormMeta, type LinearScaleField, type MatrixField, type NumberField, PHONE_COUNTRIES, PHONE_POPOVER_VIEWPORT_GAP, type ParagraphBlock, type ParsedPhone, type PhoneCountry, type PhoneField, type PhonePopoverPlacement, type ProvisionWorkspaceResult, type PublishedForm, REQUIRED_FIELD_MESSAGE, type RankingField, type RatingField, type ResponseData, type ResponseDraft, type ResponseLimit, type SchemaValidationResult, type SelectOption, Sha1, type SignatureField, type SlotClass, type SlotState, type SubmitMeta, type SubmitResult, type SyncFormResult, type SyncedForm, type TextField, type UploadFileOptions, type UploadProgress, type UploadSession, type UploadStatus, type UploadTransport, type ValidationResult, type WhenBuilder, allFields, assembleForm, codeFormFromJsx, contentHash, countryByDialCode, countryByIso, countryByTimeZone, createBlock, createClient, createEmptyForm, createFormController, createId, defineForm, digitsOnly, flagEmoji, formSchemasEqual, formatAnswer, formatNational, isAutoSubmitBlock, isBlockVisible, isCodeForm, isField, isFilloError, isPossiblePhone, needsExplicitSubmit, normalizeFormSchema, normalizeFormTheme, normalizeSettings, parsePhone, pipeBlock, positionPhonePopover, prefillFromParams, provisionWorkspace, resolveSlotClass, resolveStrings, resolveText, responseScopeValue, schemaFromJsx, sha1Base64, shouldAutoSubmit, slotClass, syncCodeForm, toE164, validateField, validateFormSchema, validateResponse, visibleBlocks, visibleFields, visiblePageBlocks, when };