@getquick/content 0.3.2 → 0.4.0

package/dist/forms-astro.js

@@ -0,0 +1,193 @@
+import { a as blockFormId, o as findForm, r as GRAVITY_FORMS_BLOCK, s as formAction } from "./descriptor-x8kHFQ79.js";
+import { a as clearFormStateCookie, i as FORM_STATE_PARAM, l as readFormState, n as formsCopyLanguage, t as FORMS_COPY } from "./copy-DLto_bWj.js";
+//#region frontend/src/forms/astro.ts
+function escapeHtml(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+}
+/** Text without tags: Gravity Forms allows HTML in a consent's checkbox label. */
+const tagless = (value) => value.replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+const attribute = (name, value) => value === null || value === void 0 ? "" : ` ${name}="${escapeHtml(value)}"`;
+/** The HTML id of an input (`gq-form-1-input_1_3`). */
+const inputId = (formId, name) => `gq-form-${formId}-${name}`;
+const AUTOCOMPLETE = {
+	email: "email",
+	phone: "tel",
+	website: "url"
+};
+const INPUT_TYPE = {
+	text: "text",
+	email: "email",
+	phone: "tel",
+	website: "url",
+	number: "text"
+};
+function errorText(field, context) {
+	const message = context.state?.messages[field.id];
+	if (message) return message;
+	const code = context.state?.errors[field.id];
+	return code ? context.copy.errors[code] : null;
+}
+/** The value to show: what the visitor typed, after a failed post, else the field's default. */
+/** What the visitor typed, when the outcome kept it; otherwise the form shows its defaults. */
+function typed(context) {
+	const state = context.state;
+	return state && state.status !== "sent" && Object.keys(state.values).length ? state.values : null;
+}
+function shown(name, field, context) {
+	const values = typed(context);
+	if (values) return values[name] ?? "";
+	return field.defaultValue ?? "";
+}
+function requiredMark(field, copy) {
+	return field.required ? ` <span class="gq-form__required" aria-hidden="true">*</span><span class="gq-form__visually-hidden"> (${escapeHtml(copy.required)})</span>` : "";
+}
+/** The description and error elements of a field, and the ids that describe its input. */
+function annotations(field, context) {
+	const base = `gq-form-${context.formId}-field-${field.id}`;
+	const error = errorText(field, context);
+	const ids = [];
+	let html = "";
+	if (field.description) {
+		ids.push(`${base}-description`);
+		html += `<p class="gq-form__description" id="${base}-description">${escapeHtml(field.description)}</p>`;
+	}
+	if (error) {
+		ids.push(`${base}-error`);
+		html += `<p class="gq-form__error" id="${base}-error">${escapeHtml(error)}</p>`;
+	}
+	return {
+		html,
+		describedBy: ids.length ? ids.join(" ") : null,
+		invalid: Boolean(error),
+		base
+	};
+}
+function inputAttributes(field, context, notes) {
+	return attribute("aria-describedby", notes.describedBy) + (notes.invalid ? " aria-invalid=\"true\"" : "") + (field.required ? " required aria-required=\"true\"" : "");
+}
+function fieldClass(field, invalid, extra = "") {
+	return `gq-form__field gq-form__field--${field.type}${extra}` + (invalid ? " gq-form__field--invalid" : "") + (field.cssClass ? ` ${field.cssClass}` : "");
+}
+function renderField(field, context) {
+	const { formId, copy } = context;
+	if (field.type === "html") return `<div class="gq-form__html${field.cssClass ? ` ${escapeHtml(field.cssClass)}` : ""}">${field.content ?? ""}</div>`;
+	if (field.type === "section") return `<div class="gq-form__section"><h3 class="gq-form__section-title">${escapeHtml(field.label)}</h3>` + (field.description ? `<p class="gq-form__description">${escapeHtml(field.description)}</p>` : "") + `</div>`;
+	if (field.type === "hidden" || field.visibility === "hidden") return field.inputs.map((input) => `<input type="hidden" name="${escapeHtml(input.name)}" value="${escapeHtml(field.defaultValue ?? "")}">`).join("");
+	const notes = annotations(field, context);
+	const first = field.inputs[0];
+	if (!first) return "";
+	const classes = escapeHtml(fieldClass(field, notes.invalid));
+	const label = escapeHtml(field.label) + requiredMark(field, copy);
+	if (field.type === "radio" || field.type === "checkbox") {
+		const options = (field.choices ?? []).map((choice, index) => {
+			const input = field.type === "checkbox" ? field.inputs[index] : first;
+			if (!input) return "";
+			const id = `${inputId(formId, input.name)}-${index}`;
+			const values = typed(context);
+			const checked = values ? values[input.name] === choice.value : choice.selected;
+			return `<div class="gq-form__choice"><input type="${field.type}" id="${id}" name="${escapeHtml(input.name)}" value="${escapeHtml(choice.value)}"${checked ? " checked" : ""}${attribute("aria-describedby", notes.describedBy)}${notes.invalid ? " aria-invalid=\"true\"" : ""}><label for="${id}">${escapeHtml(choice.text)}</label></div>`;
+		});
+		return `<fieldset class="${classes}"${field.required ? " aria-required=\"true\"" : ""}><legend class="gq-form__label">${label}</legend>` + notes.html + options.join("") + `</fieldset>`;
+	}
+	if (field.type === "consent") {
+		const id = inputId(formId, first.name);
+		const checked = shown(first.name, field, context) === "1";
+		const policy = context.privacyPolicy ? ` <a class="gq-form__policy" href="${escapeHtml(context.privacyPolicy.url)}">${escapeHtml(context.privacyPolicy.title)}</a>` : "";
+		const consentText = field.consent?.description ? `<p class="gq-form__description gq-form__consent-text" id="${notes.base}-text">${escapeHtml(field.consent.description)}</p>` : "";
+		const describedBy = [notes.describedBy, consentText ? `${notes.base}-text` : null].filter(Boolean).join(" ");
+		return `<fieldset class="${classes}"><legend class="gq-form__label">${label}</legend>` + notes.html + consentText + `<div class="gq-form__choice"><input type="checkbox" id="${id}" name="${escapeHtml(first.name)}" value="1"${checked ? " checked" : ""}${attribute("aria-describedby", describedBy || null)}${notes.invalid ? " aria-invalid=\"true\"" : ""}${field.required ? " required aria-required=\"true\"" : ""}><label for="${id}">${escapeHtml(tagless(field.consent?.checkboxLabel ?? "") || field.label)}</label>${policy}</div></fieldset>`;
+	}
+	if (field.type === "name" && field.inputs.length > 1) {
+		const parts = field.inputs.map((input) => {
+			const id = inputId(formId, input.name);
+			return `<div class="gq-form__name-part"><label for="${id}">${escapeHtml(input.label)}</label><input type="text" id="${id}" name="${escapeHtml(input.name)}" value="${escapeHtml(shown(input.name, field, context))}"${attribute("autocomplete", input.autocomplete)}${attribute("placeholder", input.placeholder)}${attribute("aria-describedby", notes.describedBy)}${notes.invalid ? " aria-invalid=\"true\"" : ""}></div>`;
+		});
+		return `<fieldset class="${classes}"${field.required ? " aria-required=\"true\"" : ""}><legend class="gq-form__label">${label}</legend>` + notes.html + parts.join("") + `</fieldset>`;
+	}
+	const id = inputId(formId, first.name);
+	const common = attribute("placeholder", field.placeholder) + (field.maxLength ? ` maxlength="${field.maxLength}"` : "") + inputAttributes(field, context, notes);
+	let control;
+	if (field.type === "textarea") control = `<textarea id="${id}" name="${escapeHtml(first.name)}" rows="6"${common}>${escapeHtml(shown(first.name, field, context))}</textarea>`;
+	else if (field.type === "select") {
+		const value = typed(context) ? shown(first.name, field, context) : null;
+		const choices = field.choices ?? [];
+		const options = (choices.some((choice) => choice.value === "") ? "" : `<option value=""${value === "" ? " selected" : ""}></option>`) + choices.map((choice) => {
+			const selected = value !== null ? value === choice.value : choice.selected;
+			return `<option value="${escapeHtml(choice.value)}"${selected ? " selected" : ""}>${escapeHtml(choice.text)}</option>`;
+		}).join("");
+		control = `<select id="${id}" name="${escapeHtml(first.name)}"${inputAttributes(field, context, notes)}>${options}</select>`;
+	} else {
+		const inputmode = field.type === "number" ? " inputmode=\"decimal\"" : "";
+		const autocomplete = field.type === "name" ? "name" : AUTOCOMPLETE[field.type] ?? first.autocomplete;
+		control = `<input type="${INPUT_TYPE[field.type] ?? "text"}" id="${id}" name="${escapeHtml(first.name)}" value="${escapeHtml(shown(first.name, field, context))}"${attribute("autocomplete", autocomplete)}${inputmode}${common}>`;
+	}
+	let confirmation = "";
+	const second = field.inputs[1];
+	if (field.type === "email" && second) {
+		const confirmId = inputId(formId, second.name);
+		confirmation = `<label class="gq-form__label" for="${confirmId}">${escapeHtml(second.label)}${requiredMark(field, copy)}</label><input type="email" id="${confirmId}" name="${escapeHtml(second.name)}" value="${escapeHtml(shown(second.name, field, context))}" autocomplete="email"${inputAttributes(field, context, notes)}>`;
+	}
+	return `<div class="${classes}"><label class="gq-form__label" for="${id}">${label}</label>` + notes.html + control + confirmation + `</div>`;
+}
+/** Turnstile loads only once the visitor interacts with a form (CONSENT-1, CN-R3). */
+const FORMS_TURNSTILE_SCRIPT = `(()=>{const s="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit";let l;const load=()=>l??=new Promise((ok,no)=>{const e=document.createElement("script");e.src=s;e.async=true;e.onload=()=>ok(window.turnstile);e.onerror=no;document.head.append(e)});for(const f of document.querySelectorAll("form[data-gq-turnstile]")){const start=()=>{if(f.dataset.gqTurnstileStarted)return;f.dataset.gqTurnstileStarted="1";load().then(t=>t.render(f.querySelector("[data-gq-turnstile-widget]"),{sitekey:f.dataset.gqTurnstile,"response-field-name":"cf-turnstile-response"}))};f.addEventListener("focusin",start,{once:true});f.addEventListener("pointerdown",start,{once:true})}})();`;
+/**
+* A `gravityforms/form` block's HTML. Without a descriptor (the CMS hasn't
+* delivered one) or for an unavailable form, a status message instead of a
+* form that can't be sent.
+*/
+function renderGravityForm(input) {
+	const copy = FORMS_COPY[formsCopyLanguage(input.language)];
+	const descriptor = input.descriptor;
+	if (!descriptor || !descriptor.available) return `<div class="gq-form gq-form--unavailable"${descriptor ? ` id="gq-form-${descriptor.id}"` : ""}><p class="gq-form__status" role="status">${escapeHtml(copy.unavailable)}</p></div>`;
+	const formId = descriptor.id;
+	const state = input.state && input.state.formId === formId ? input.state : null;
+	const policy = input.legal?.roles.find((role) => role.role === "privacy_policy");
+	const context = {
+		formId,
+		copy,
+		state,
+		privacyPolicy: policy ? {
+			url: policy.url,
+			title: policy.title || copy.privacyPolicy
+		} : null
+	};
+	const level = input.headingLevel ?? 2;
+	const titleId = `gq-form-${formId}-title`;
+	const heading = input.showTitle !== false && descriptor.title ? `<h${level} class="gq-form__title" id="${titleId}">${escapeHtml(descriptor.title)}</h${level}>` : "";
+	const description = input.showDescription !== false && descriptor.description ? `<p class="gq-form__intro">${escapeHtml(descriptor.description)}</p>` : "";
+	const open = `<div class="gq-form" id="gq-form-${formId}" data-gq-form="${formId}" lang="${escapeHtml(input.language)}">${heading}${description}`;
+	if (state?.status === "sent") return `${open}<div class="gq-form__status gq-form__status--sent" role="status">${(state.confirmation || (descriptor.confirmation.type === "message" ? descriptor.confirmation.message : "") || copy.sent).split(/\n{2,}/).map((paragraph) => `<p>${escapeHtml(paragraph.trim())}</p>`).join("")}</div></div>`;
+	let status = "";
+	if (state) {
+		const problems = descriptor.fields.flatMap((field) => {
+			const error = errorText(field, context);
+			if (!error) return [];
+			const target = field.inputs[0];
+			return [`<li><a href="#${!target ? `gq-form-${formId}` : field.type === "radio" || field.type === "checkbox" ? `${inputId(formId, target.name)}-0` : inputId(formId, target.name)}">${escapeHtml(field.label)}: ${escapeHtml(error)}</a></li>`];
+		});
+		status = `<div class="gq-form__errors" role="alert" id="gq-form-${formId}-errors" tabindex="-1"><p>${escapeHtml(state.status === "invalid" ? copy.errorSummary : state.status === "verification" ? copy.verification : state.status === "too-many" ? copy.tooMany : copy.failed)}</p>${problems.length ? `<ul>${problems.join("")}</ul>` : ""}</div>`;
+	}
+	const required = descriptor.fields.some((field) => field.required && field.visibility === "visible") ? `<p class="gq-form__legend">${escapeHtml(copy.requiredFields)}</p>` : "";
+	const honeypot = descriptor.honeypot ? `<div class="gq-form__hp" aria-hidden="true" style="position:absolute!important;left:-9999px!important;width:1px;height:1px;overflow:hidden"><label for="${inputId(formId, descriptor.honeypot.name)}">${escapeHtml(copy.honeypot)}</label><input type="text" id="${inputId(formId, descriptor.honeypot.name)}" name="${escapeHtml(descriptor.honeypot.name)}" value="" tabindex="-1" autocomplete="off"></div>` : "";
+	const turnstile = input.turnstile?.siteKey ? `<div class="gq-form__turnstile" data-gq-turnstile-widget></div><noscript><p class="gq-form__status">${escapeHtml(copy.needsJavaScript)}</p></noscript>` : "";
+	const script = input.turnstile?.siteKey ? `<script>${FORMS_TURNSTILE_SCRIPT}<\/script>` : "";
+	return open + status + `<form class="gq-form__form" method="post" action="${formAction(formId)}" novalidate` + (heading ? ` aria-labelledby="${titleId}"` : "") + attribute("data-gq-turnstile", input.turnstile?.siteKey || null) + `><input type="hidden" name="gq_source" value="${escapeHtml(input.source)}">` + required + honeypot + descriptor.fields.map((field) => renderField(field, context)).join("") + turnstile + `<div class="gq-form__actions"><button type="submit" class="gq-form__submit">${escapeHtml(descriptor.submitLabel || copy.submit)}</button></div></form></div>` + script;
+}
+/**
+* A minimal default stylesheet (layout and states only). Sites usually style
+* the `gq-form*` classes with their own tokens instead.
+*/
+const FORMS_STYLES = `
+.gq-form__visually-hidden{position:absolute!important;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}
+.gq-form__form{display:grid;gap:var(--gq-form-gap,1rem)}
+.gq-form__field{display:grid;gap:.375rem;border:0;margin:0;padding:0;min-width:0}
+.gq-form__field input:not([type=checkbox]):not([type=radio]),.gq-form__field textarea,.gq-form__field select{font:inherit;width:100%;padding:.5rem .75rem;border:1px solid var(--gq-form-border,#767676);border-radius:var(--gq-form-radius,.25rem)}
+.gq-form__field--invalid input,.gq-form__field--invalid textarea,.gq-form__field--invalid select{border-color:var(--gq-form-error,#b00020)}
+.gq-form__error,.gq-form__errors{color:var(--gq-form-error,#b00020)}
+.gq-form__errors{border:2px solid currentColor;padding:1rem}
+.gq-form__choice{display:flex;gap:.5rem;align-items:baseline}
+.gq-form :focus-visible{outline:3px solid var(--gq-form-focus,#1a73e8);outline-offset:2px}
+`.trim();
+//#endregion
+export { FORMS_STYLES, FORMS_TURNSTILE_SCRIPT, FORM_STATE_PARAM, GRAVITY_FORMS_BLOCK, blockFormId, clearFormStateCookie, escapeHtml, findForm, inputId, readFormState, renderGravityForm };

package/dist/forms-server.d.ts

@@ -0,0 +1,80 @@
+import { o as FormDescriptor, t as FORMS_PATH } from "./descriptor-B-e7gHi1.js";
+//#region frontend/src/forms/server.d.ts
+/** The largest form body accepted (bytes); larger posts are refused unread. */
+export declare const MAX_FORM_BYTES: number;
+/** Cloudflare's server-side Turnstile verification. */
+export declare const TURNSTILE_SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/** The field Turnstile's widget posts its token in. */
+export declare const TURNSTILE_RESPONSE_FIELD = "cf-turnstile-response";
+/** A Workers Rate Limiting binding. */
+export interface FormsRateLimiter {
+  limit(options: {
+    key: string;
+  }): Promise<{
+    success: boolean;
+  }>;
+}
+/** The Worker bindings the handler reads. None is a Gravity Forms credential. */
+export interface FormsBindings {
+  /** Turnstile's secret key (a Worker secret), when the Site uses Turnstile. */
+  TURNSTILE_SECRET_KEY?: string;
+  /**
+   * A Cloudflare Access service token for the CMS's submissions path only,
+   * when the CMS is behind Access. Both or neither.
+   */
+  GQ_FORMS_ACCESS_CLIENT_ID?: string;
+  GQ_FORMS_ACCESS_CLIENT_SECRET?: string;
+  /** Rate limiting for form posts, keyed per client IP per request. */
+  FORMS_RATE_LIMITER?: FormsRateLimiter;
+}
+export interface FormLookup {
+  formId: number;
+  /** The page the form was posted from (a path on the Site). */
+  source: string;
+}
+export interface FormsServerConfig {
+  /** The CMS's origin (https://cms.example.com): Gravity Forms' REST API is under it. */
+  cmsOrigin: string;
+  /** WordPress's REST root, when not `<cmsOrigin>/wp-json`. */
+  restRoot?: string;
+  /**
+   * The form's descriptor as published with the page it was posted from
+   * (the content runtime's `publishedForm(source, formId)`), or null.
+   */
+  descriptor: (lookup: FormLookup) => Promise<FormDescriptor | null> | FormDescriptor | null;
+  /** The Site's spam controls. The honeypot is always applied when a form enables it. */
+  spam?: {
+    turnstile?: boolean;
+  };
+  bindings: () => FormsBindings | Promise<FormsBindings>;
+  /** The Site's public origin(s), when the Worker sees another (a proxy). */
+  siteOrigins?: readonly string[];
+  /** The page language for the handler's own messages (`pt-PT`, `en`). */
+  language?: string;
+  /** Milliseconds Gravity Forms and Turnstile have to answer (15 s). */
+  timeoutMs?: number;
+  fetch?: typeof globalThis.fetch;
+}
+/** HTML as text: tags dropped, paragraphs and breaks as new lines, entities decoded. */
+export declare function htmlText(html: string): string;
+/**
+ * The form endpoint. `handle` answers `POST /gq/forms/<id>` and null for any
+ * other path; `check` says what is configured, for readiness, never values.
+ */
+export declare function createFormsServer(config: FormsServerConfig): {
+  handle: (request: Request) => Promise<Response | null>;
+  check: () => Promise<{
+    cmsOrigin: string;
+    spam: {
+      honeypot: boolean;
+      turnstile: boolean;
+    };
+    turnstileSecret: boolean;
+    access: string;
+    rateLimit: boolean;
+    ready: boolean;
+  }>;
+};
+export type FormsServer = ReturnType<typeof createFormsServer>;
+//#endregion
+export { FORMS_PATH, type FormDescriptor };

package/dist/forms-server.js

@@ -0,0 +1,294 @@
+import { c as formDiagnostics, t as FORMS_PATH } from "./descriptor-x8kHFQ79.js";
+import { n as readBoundedBody, t as isSameOrigin } from "./request-guards-BUPr_vA4.js";
+import { n as honeypotFilled, r as validateSubmission } from "./validate-wRgYUNxN.js";
+import { c as formStateLocation, n as formsCopyLanguage, o as formStateCookie, t as FORMS_COPY } from "./copy-DLto_bWj.js";
+//#region frontend/src/forms/server.ts
+/** The largest form body accepted (bytes); larger posts are refused unread. */
+const MAX_FORM_BYTES = 65536;
+/** Cloudflare's server-side Turnstile verification. */
+const TURNSTILE_SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+/** The field Turnstile's widget posts its token in. */
+const TURNSTILE_RESPONSE_FIELD = "cf-turnstile-response";
+const SOURCE = /^\/(?!\/)[^\s\\]*$/;
+/** HTML as text: tags dropped, paragraphs and breaks as new lines, entities decoded. */
+function htmlText(html) {
+	return html.replace(/<(script|style)\b[\s\S]*?<\/\1>/gi, "").replace(/<br\s*\/?>/gi, "\n").replace(/<\/(p|div|li|h[1-6])>/gi, "\n\n").replace(/<[^>]*>/g, "").replace(/&#(\d+);/g, (_, code) => String.fromCodePoint(Number(code))).replace(/&#x([0-9a-f]+);/gi, (_, code) => String.fromCodePoint(parseInt(code, 16))).replace(/&nbsp;/g, " ").replace(/&quot;/g, "\"").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&").replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim().slice(0, 2e3);
+}
+/**
+* The form endpoint. `handle` answers `POST /gq/forms/<id>` and null for any
+* other path; `check` says what is configured, for readiness, never values.
+*/
+function createFormsServer(config) {
+	const cms = new URL(config.cmsOrigin);
+	if (cms.protocol !== "https:" && cms.protocol !== "http:") throw new Error("cmsOrigin must be the CMS's http(s) origin");
+	const restRoot = (config.restRoot ?? `${cms.origin}/wp-json`).replace(/\/+$/, "");
+	if (new URL(restRoot).origin !== cms.origin) throw new Error("restRoot must be on the CMS's origin");
+	const origins = new Set((config.siteOrigins ?? []).map((origin) => new URL(origin).origin));
+	const timeoutMs = config.timeoutMs ?? 15e3;
+	const fetcher = config.fetch ?? globalThis.fetch.bind(globalThis);
+	const copy = FORMS_COPY[formsCopyLanguage(config.language)];
+	const turnstileRequired = config.spam?.turnstile === true;
+	const wantsJson = (request) => {
+		const accept = request.headers.get("Accept") ?? "";
+		return /\bapplication\/json\b/i.test(accept) && !/\btext\/html\b/i.test(accept);
+	};
+	const json = (status, body, headers = {}) => Response.json(body, {
+		status,
+		headers: {
+			"Cache-Control": "no-store",
+			...headers
+		}
+	});
+	/** The Access pair, if both are set; "partial" is a misconfiguration and fails closed. */
+	function accessHeaders(bindings) {
+		const id = bindings.GQ_FORMS_ACCESS_CLIENT_ID?.trim() ?? "";
+		const secret = bindings.GQ_FORMS_ACCESS_CLIENT_SECRET?.trim() ?? "";
+		if (!id && !secret) return {};
+		if (!id || !secret) return "partial";
+		return {
+			"CF-Access-Client-Id": id,
+			"CF-Access-Client-Secret": secret
+		};
+	}
+	/** The answer to a post: JSON for a script that asks for it, else a redirect back. */
+	function outcome(request, state, source) {
+		const full = {
+			values: {},
+			messages: {},
+			errors: {},
+			...state
+		};
+		if (wantsJson(request)) return json({
+			sent: 200,
+			invalid: 422,
+			verification: 422,
+			"too-many": 429,
+			failed: 502
+		}[full.status], {
+			status: full.status,
+			errors: Object.fromEntries(Object.entries(full.errors).map(([id, code]) => [id, full.messages[Number(id)] ?? copy.errors[code]])),
+			...full.confirmation ? { confirmation: full.confirmation } : {}
+		});
+		return new Response(null, {
+			status: 303,
+			headers: {
+				Location: formStateLocation(source, full.formId),
+				"Set-Cookie": formStateCookie(full, { secure: new URL(request.url).protocol === "https:" }),
+				"Cache-Control": "no-store"
+			}
+		});
+	}
+	async function verifyTurnstile(secret, token, ip) {
+		const body = new URLSearchParams({
+			secret,
+			response: token
+		});
+		if (ip) body.set("remoteip", ip);
+		try {
+			const response = await fetcher(TURNSTILE_SITEVERIFY_URL, {
+				method: "POST",
+				body,
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+			if (!response.ok) return false;
+			return (await response.json()).success === true;
+		} catch (error) {
+			console.error(`Forms: Turnstile couldn't be verified: ${error.name}`);
+			return false;
+		}
+	}
+	/** Gravity Forms' field messages, by field id. */
+	function fieldMessages(value) {
+		if (!value || typeof value !== "object") return {};
+		return Object.fromEntries(Object.entries(value).flatMap(([id, message]) => /^\d+$/.test(id) && typeof message === "string" && message ? [[Number(id), htmlText(message)]] : []));
+	}
+	async function submit(request, formId, source, params) {
+		const bindings = await config.bindings();
+		let descriptor;
+		try {
+			descriptor = await config.descriptor({
+				formId,
+				source
+			});
+		} catch (error) {
+			console.error(`Forms: form ${formId}'s descriptor couldn't be read: ${error.message}`);
+			descriptor = null;
+		}
+		if (!descriptor || descriptor.id !== formId || !descriptor.available) return outcome(request, {
+			formId,
+			status: "failed"
+		}, source);
+		const diagnostics = formDiagnostics(descriptor);
+		if (diagnostics.length) {
+			console.error(`Forms: form ${formId} isn't submitted: ${diagnostics.map((each) => each.code).join(", ")}`);
+			return outcome(request, {
+				formId,
+				status: "failed"
+			}, source);
+		}
+		const sent = {
+			formId,
+			status: "sent",
+			...descriptor.confirmation.type === "message" && descriptor.confirmation.message ? { confirmation: descriptor.confirmation.message } : {}
+		};
+		if (honeypotFilled(descriptor, params)) return outcome(request, sent, source);
+		const checked = validateSubmission(descriptor, params);
+		if (Object.keys(checked.errors).length) return outcome(request, {
+			formId,
+			status: "invalid",
+			errors: checked.errors,
+			values: checked.values
+		}, source);
+		if (turnstileRequired) {
+			const secret = bindings.TURNSTILE_SECRET_KEY?.trim();
+			if (!secret) {
+				console.error("Forms: Turnstile is required but TURNSTILE_SECRET_KEY isn't bound");
+				return outcome(request, {
+					formId,
+					status: "failed",
+					values: checked.values
+				}, source);
+			}
+			const token = params.get("cf-turnstile-response") ?? "";
+			if (!token || token.length > 2048 || !await verifyTurnstile(secret, token, request.headers.get("CF-Connecting-IP"))) return outcome(request, {
+				formId,
+				status: "verification",
+				values: checked.values
+			}, source);
+		}
+		const access = accessHeaders(bindings);
+		if (access === "partial") {
+			console.error("Forms: set both GQ_FORMS_ACCESS_CLIENT_ID and GQ_FORMS_ACCESS_CLIENT_SECRET, or neither");
+			return outcome(request, {
+				formId,
+				status: "failed",
+				values: checked.values
+			}, source);
+		}
+		let response;
+		try {
+			response = await fetcher(`${restRoot}/gf/v2/forms/${formId}/submissions`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Accept: "application/json",
+					...access
+				},
+				body: JSON.stringify(checked.input),
+				redirect: "manual",
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+		} catch (error) {
+			console.error(`Forms: form ${formId} couldn't reach the CMS: ${error.name}`);
+			return outcome(request, {
+				formId,
+				status: "failed",
+				values: checked.values
+			}, source);
+		}
+		let result = null;
+		try {
+			result = await response.json();
+		} catch {
+			result = null;
+		}
+		if (response.status === 200 && result?.is_valid === true) {
+			if (result.confirmation_type === "redirect" && typeof result.confirmation_redirect === "string") {
+				let target = null;
+				try {
+					target = new URL(result.confirmation_redirect);
+				} catch {
+					target = null;
+				}
+				if (target && target.origin === cms.origin) target = new URL(`${target.pathname}${target.search}${target.hash}`, request.url);
+				if (target && (target.protocol === "https:" || target.protocol === "http:")) {
+					const location = target.origin === new URL(request.url).origin ? `${target.pathname}${target.search}${target.hash}` : target.href;
+					if (wantsJson(request)) return json(200, {
+						status: "sent",
+						redirect: location
+					});
+					return new Response(null, {
+						status: 303,
+						headers: {
+							Location: location,
+							"Cache-Control": "no-store"
+						}
+					});
+				}
+			}
+			const message = typeof result.confirmation_message === "string" ? htmlText(result.confirmation_message) : "";
+			return outcome(request, {
+				formId,
+				status: "sent",
+				...message ? { confirmation: message } : sent
+			}, source);
+		}
+		if (response.status === 400 && result?.is_valid === false) {
+			const messages = fieldMessages(result.validation_messages);
+			return outcome(request, {
+				formId,
+				status: "invalid",
+				errors: Object.fromEntries(Object.keys(messages).map((id) => [Number(id), "required"])),
+				messages,
+				values: checked.values
+			}, source);
+		}
+		console.error(`Forms: Gravity Forms refused form ${formId} (HTTP ${response.status})`);
+		return outcome(request, {
+			formId,
+			status: "failed",
+			values: checked.values
+		}, source);
+	}
+	/** `POST /gq/forms/<id>`. */
+	async function handlePost(request, formId) {
+		if (request.method !== "POST") return json(405, { error: "Send forms with POST." }, { Allow: "POST" });
+		if (!isSameOrigin(request, origins)) return json(403, { error: "Forms are accepted from this Site only." });
+		if (!/^application\/x-www-form-urlencoded\b/i.test(request.headers.get("Content-Type") ?? "")) return json(415, { error: "Send the form as application/x-www-form-urlencoded." });
+		const bindings = await config.bindings();
+		const text = await readBoundedBody(request, MAX_FORM_BYTES);
+		if (text === null) return json(413, { error: "The form is too large." });
+		const params = new URLSearchParams(text);
+		const source = params.get("gq_source") ?? "";
+		if (!SOURCE.test(source) || source.length > 2048) return json(400, { error: "The form's page (gq_source) isn't a path on this Site." });
+		const limiter = bindings.FORMS_RATE_LIMITER;
+		if (limiter) {
+			const { success } = await limiter.limit({ key: `${formId}:${request.headers.get("CF-Connecting-IP") ?? "unknown"}` });
+			if (!success) return outcome(request, {
+				formId,
+				status: "too-many"
+			}, source);
+		}
+		return submit(request, formId, source, params);
+	}
+	/** Routes a form post; null when the path isn't a form endpoint. */
+	async function handle(request) {
+		const path = new URL(request.url).pathname.replace(/\/+$/, "");
+		if (!path.startsWith(`/gq/forms/`)) return null;
+		const id = path.slice(FORMS_PATH.length + 1);
+		if (!/^[1-9]\d{0,8}$/.test(id)) return null;
+		return handlePost(request, Number(id));
+	}
+	/** What is configured, for readiness: never values. */
+	async function check() {
+		const bindings = await config.bindings();
+		const access = accessHeaders(bindings);
+		return {
+			cmsOrigin: cms.origin,
+			spam: {
+				honeypot: true,
+				turnstile: turnstileRequired
+			},
+			turnstileSecret: Boolean(bindings.TURNSTILE_SECRET_KEY?.trim()),
+			access: access === "partial" ? "partial" : Object.keys(access).length ? "configured" : "none",
+			rateLimit: Boolean(bindings.FORMS_RATE_LIMITER),
+			ready: (!turnstileRequired || Boolean(bindings.TURNSTILE_SECRET_KEY?.trim())) && access !== "partial"
+		};
+	}
+	return {
+		handle,
+		check
+	};
+}
+//#endregion
+export { FORMS_PATH, MAX_FORM_BYTES, TURNSTILE_RESPONSE_FIELD, TURNSTILE_SITEVERIFY_URL, createFormsServer, htmlText };

package/dist/forms-testing.d.ts

@@ -0,0 +1,66 @@
+import { o as FormDescriptor } from "./descriptor-B-e7gHi1.js";
+//#region frontend/src/forms/testing.d.ts
+/** A contact form like Nomia's form 1: name, email, subject, message and privacy consent. */
+export declare const CONTACT_FORM: FormDescriptor;
+/** A form readiness must fail: Gravity Forms' CAPTCHA, a file upload, a payment field and a page break. */
+export declare const UNSUPPORTED_FORM: FormDescriptor;
+/** A referenced form that is missing, inactive or trashed. */
+export declare const UNAVAILABLE_FORM: FormDescriptor;
+/** Keys that must never appear anywhere in a delivered descriptor. */
+export declare const PRIVATE_FORM_KEYS: readonly ["notifications", "notification", "confirmations", "entries", "entry", "entry_id", "feeds", "feed", "settings", "personalData", "routing", "to", "bcc", "from", "fromName", "replyTo", "save", "limitEntries", "scheduleForm", "requireLogin", "consumer_key", "consumer_secret"];
+/**
+ * Throws unless a delivered descriptor is public: it parses, and nothing in it
+ * is a notification, entry, feed or admin setting (by key, at any depth).
+ */
+export declare function assertPublicDescriptor(value: unknown): FormDescriptor;
+/**
+ * Throws unless rendered form HTML is accessible: every visible control has a
+ * label (`for`) or is in a labelled fieldset, every `aria-describedby` id
+ * exists, invalid controls are described by their error, an error summary is
+ * an alert and a confirmation is a status.
+ */
+export declare function assertAccessibleForm(html: string): void;
+/** A request Gravity Forms' stand-in received. */
+export interface RecordedRequest {
+  method: string;
+  url: string;
+  headers: Record<string, string>;
+  body: Record<string, string> | null;
+}
+export interface StoredEntry {
+  formId: number;
+  values: Record<string, string>;
+  spam: boolean;
+}
+/**
+ * A stand-in for Gravity Forms' REST API on a CMS: `POST
+ * /wp-json/gf/v2/forms/<id>/submissions` as Gravity Forms 3.2 answers it,
+ * validating required fields and storing entries for the given descriptors.
+ * A filled honeypot is stored as spam, Gravity Forms' default honeypot
+ * action. Anything else is a 404. `requests` records every request.
+ */
+export declare function gravityFormsStub(forms: readonly FormDescriptor[]): {
+  entries: StoredEntry[];
+  requests: RecordedRequest[];
+  handle: (request: Request) => Promise<Response>;
+  /** A `fetch` that answers the CMS's requests at `origin` and refuses any other. */
+  fetchFor(origin: string): typeof globalThis.fetch;
+};
+/** Throws if any request asked for entries, or carried a Gravity Forms credential. */
+export declare function assertNoEntryReadsOrCredentials(requests: readonly RecordedRequest[]): void;
+/** Throws if a module exports anything that reads entries (by name; these assertions aside). */
+export declare function assertNoEntryExports(module: Record<string, unknown>): void;
+/** A form body as a browser posts it (application/x-www-form-urlencoded). */
+export declare function formBody(values: Record<string, string>): string;
+/** A filled-in, valid submission of CONTACT_FORM from `source`. */
+export declare function contactSubmission(source?: string): Record<string, string>;
+/** Cloudflare's Turnstile test keys: always pass, always fail. */
+export declare const TURNSTILE_TEST_KEYS: {
+  readonly passingSiteKey: "1x00000000000000000000AA";
+  readonly failingSiteKey: "2x00000000000000000000AB";
+  readonly passingSecretKey: "1x0000000000000000000000000000000AA";
+  readonly failingSecretKey: "2x0000000000000000000000000000000AA";
+  /** The token the test site keys produce. */
+  readonly dummyToken: "XXXX.DUMMY.TOKEN.XXXX";
+};
+//#endregion