@treeseed/core 0.1.2

package/dist/utils/forms/contact-submissions.js

@@ -0,0 +1,72 @@
+import { hashValue } from "./crypto.js";
+async function hasRuntimeRecordsTable(db) {
+  const row = await db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'runtime_records' LIMIT 1").first();
+  return Boolean(row?.name);
+}
+async function createContactSubmission(db, input) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const ipHash = await hashValue(input.ip || "unknown");
+  if (await hasRuntimeRecordsTable(db)) {
+    const payloadJson = JSON.stringify({
+      name: input.name,
+      email: input.email,
+      organization: input.organization || null,
+      contactType: input.contactType,
+      subject: input.subject,
+      message: input.message,
+      userAgent: input.userAgent || "unknown user agent",
+      ipHash
+    });
+    const metaJson = JSON.stringify({});
+    await db.prepare(
+      `INSERT INTO runtime_records (
+					record_type,
+					record_key,
+					lookup_key,
+					secondary_key,
+					status,
+					schema_version,
+					created_at,
+					updated_at,
+					payload_json,
+					meta_json
+				) VALUES (?, ?, ?, ?, 'received', 1, ?, ?, ?, ?)`
+    ).bind(
+      "contact_submission",
+      `${input.email}:${now}`,
+      input.email,
+      input.contactType,
+      now,
+      now,
+      payloadJson,
+      metaJson
+    ).run();
+    return;
+  }
+  await db.prepare(
+    `INSERT INTO contact_submissions (
+				name,
+				email,
+				organization,
+				contact_type,
+				subject,
+				message,
+				user_agent,
+				created_at,
+				ip_hash
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).bind(
+    input.name,
+    input.email,
+    input.organization || null,
+    input.contactType,
+    input.subject,
+    input.message,
+    input.userAgent || "unknown user agent",
+    now,
+    ipHash
+  ).run();
+}
+export {
+  createContactSubmission
+};

package/dist/utils/forms/crypto.js

@@ -0,0 +1,64 @@
+import { FORM_TOKEN_TTL_MS } from "./constants.js";
+function base64UrlEncode(input) {
+  let binary = "";
+  for (const value of input) {
+    binary += String.fromCharCode(value);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function base64UrlDecode(input) {
+  const normalized = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalized + "=".repeat((4 - normalized.length % 4) % 4);
+  const binary = atob(padded);
+  return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+}
+async function importHmacKey(secret) {
+  return crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+async function signFormToken(payload, secret) {
+  const serialized = JSON.stringify(payload);
+  const encodedPayload = base64UrlEncode(new TextEncoder().encode(serialized));
+  const key = await importHmacKey(secret);
+  const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(encodedPayload));
+  return `${encodedPayload}.${base64UrlEncode(new Uint8Array(signature))}`;
+}
+async function verifyFormToken(token, secret) {
+  const [encodedPayload, encodedSignature] = token.split(".");
+  if (!encodedPayload || !encodedSignature) {
+    return { ok: false, reason: "malformed" };
+  }
+  const key = await importHmacKey(secret);
+  const isValid = await crypto.subtle.verify(
+    "HMAC",
+    key,
+    base64UrlDecode(encodedSignature),
+    new TextEncoder().encode(encodedPayload)
+  );
+  if (!isValid) {
+    return { ok: false, reason: "signature" };
+  }
+  const payload = JSON.parse(new TextDecoder().decode(base64UrlDecode(encodedPayload)));
+  if (Date.now() - payload.issuedAt > FORM_TOKEN_TTL_MS) {
+    return { ok: false, reason: "expired", payload };
+  }
+  return { ok: true, payload };
+}
+function createOpaqueId() {
+  return crypto.randomUUID();
+}
+async function hashValue(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return Array.from(new Uint8Array(digest)).map((entry) => entry.toString(16).padStart(2, "0")).join("");
+}
+export {
+  createOpaqueId,
+  hashValue,
+  signFormToken,
+  verifyFormToken
+};

package/dist/utils/forms/guard.js

@@ -0,0 +1,76 @@
+import { NONCE_TTL_SECONDS, RATE_LIMIT_MAX_ATTEMPTS, RATE_LIMIT_TTL_SECONDS } from "./constants.js";
+import { hashValue } from "./crypto.js";
+const localNonceStore = globalThis.__treeseedFixtureNonceStore ?? /* @__PURE__ */ new Map();
+const localRateStore = globalThis.__treeseedFixtureRateStore ?? /* @__PURE__ */ new Map();
+globalThis.__treeseedFixtureNonceStore = localNonceStore;
+globalThis.__treeseedFixtureRateStore = localRateStore;
+async function incrementCounter(kv, key, ttl) {
+  const currentValue = await kv.get(key);
+  const nextValue = (Number.parseInt(currentValue ?? "0", 10) || 0) + 1;
+  await kv.put(key, String(nextValue), { expirationTtl: ttl });
+  return nextValue;
+}
+async function assertNonceUnused(kv, nonce) {
+  const nonceKey = `nonce:${nonce}`;
+  const current = await kv.get(nonceKey);
+  if (current) {
+    return false;
+  }
+  await kv.put(nonceKey, "1", { expirationTtl: NONCE_TTL_SECONDS });
+  return true;
+}
+async function applySubmissionRateLimit(kv, remoteIp, email, formType) {
+  const ipHash = remoteIp ? await hashValue(remoteIp) : "unknown";
+  const emailHash = await hashValue(email);
+  const ipKey = `rate:${formType}:ip:${ipHash}`;
+  const emailKey = `rate:${formType}:email:${emailHash}`;
+  const [ipCount, emailCount] = await Promise.all([
+    incrementCounter(kv, ipKey, RATE_LIMIT_TTL_SECONDS),
+    incrementCounter(kv, emailKey, RATE_LIMIT_TTL_SECONDS)
+  ]);
+  return ipCount <= RATE_LIMIT_MAX_ATTEMPTS && emailCount <= RATE_LIMIT_MAX_ATTEMPTS;
+}
+function pruneExpiredLocalState() {
+  const now = Date.now();
+  for (const [nonce, expiresAt] of localNonceStore.entries()) {
+    if (expiresAt <= now) {
+      localNonceStore.delete(nonce);
+    }
+  }
+  for (const [key, record] of localRateStore.entries()) {
+    if (record.expiresAt <= now) {
+      localRateStore.delete(key);
+    }
+  }
+}
+async function assertNonceUnusedLocal(nonce) {
+  pruneExpiredLocalState();
+  if (localNonceStore.has(nonce)) {
+    return false;
+  }
+  localNonceStore.set(nonce, Date.now() + NONCE_TTL_SECONDS * 1e3);
+  return true;
+}
+async function incrementLocalCounter(key, ttlSeconds) {
+  pruneExpiredLocalState();
+  const currentRecord = localRateStore.get(key);
+  const nextCount = (currentRecord?.count ?? 0) + 1;
+  localRateStore.set(key, {
+    count: nextCount,
+    expiresAt: Date.now() + ttlSeconds * 1e3
+  });
+  return nextCount;
+}
+async function applySubmissionRateLimitLocal(remoteIp, email, formType) {
+  const ipHash = remoteIp ? await hashValue(remoteIp) : "unknown";
+  const emailHash = await hashValue(email);
+  const ipCount = await incrementLocalCounter(`rate:${formType}:ip:${ipHash}`, RATE_LIMIT_TTL_SECONDS);
+  const emailCount = await incrementLocalCounter(`rate:${formType}:email:${emailHash}`, RATE_LIMIT_TTL_SECONDS);
+  return ipCount <= RATE_LIMIT_MAX_ATTEMPTS && emailCount <= RATE_LIMIT_MAX_ATTEMPTS;
+}
+export {
+  applySubmissionRateLimit,
+  applySubmissionRateLimitLocal,
+  assertNonceUnused,
+  assertNonceUnusedLocal
+};

package/dist/utils/forms/http.js

@@ -0,0 +1,51 @@
+import { FORM_CODE_PARAM, FORM_SUCCESS_PARAM, SUBSCRIBE_ANCHOR_ID } from "./constants.js";
+function getRemoteIp(request) {
+  return request.headers.get("CF-Connecting-IP") ?? request.headers.get("X-Forwarded-For") ?? "";
+}
+function fallbackPath(formType) {
+  return formType === "contact" ? "/contact/" : "/";
+}
+function resolveRedirectBase(requestUrl) {
+  if (requestUrl instanceof URL) {
+    return requestUrl.origin;
+  }
+  if (typeof requestUrl === "string" && requestUrl.length) {
+    try {
+      return new URL(requestUrl).origin;
+    } catch {
+      return requestUrl;
+    }
+  }
+  return "https://treeseed.dev";
+}
+function buildRedirectTarget(formType, rawRedirectTo, isSuccess, code, requestUrl) {
+  const fallback = fallbackPath(formType);
+  const url = new URL(rawRedirectTo || fallback, resolveRedirectBase(requestUrl));
+  url.searchParams.set(FORM_SUCCESS_PARAM, isSuccess ? "success" : "error");
+  url.searchParams.set(FORM_CODE_PARAM, code);
+  if (formType === "subscribe") {
+    url.hash = SUBSCRIBE_ANCHOR_ID;
+  }
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+function sanitizeRedirectTo(rawRedirectTo, formType, requestUrl) {
+  const fallback = fallbackPath(formType);
+  if (!rawRedirectTo) {
+    return fallback;
+  }
+  try {
+    const base = resolveRedirectBase(requestUrl);
+    const url = new URL(rawRedirectTo, base);
+    if (url.origin !== new URL(base).origin) {
+      return fallback;
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return fallback;
+  }
+}
+export {
+  buildRedirectTarget,
+  getRemoteIp,
+  sanitizeRedirectTo
+};

package/dist/utils/forms/provider-core.js

@@ -0,0 +1,88 @@
+import { assertNonceUnused, assertNonceUnusedLocal, applySubmissionRateLimit, applySubmissionRateLimitLocal } from "./guard.js";
+import { createContactSubmission } from "./contact-submissions.js";
+import { upsertSubscriber } from "./subscribers.js";
+import { sendEmail as sendDefaultEmail } from "./smtp.js";
+import { verifyTurnstileToken as verifyDefaultTurnstileToken } from "./turnstile.js";
+function createDefaultGuardStore(runtime, kv) {
+  return {
+    assertNonceUnused(nonce) {
+      if (runtime.isCloudflareRuntime && kv && !runtime.bypassCloudflareGuards) {
+        return assertNonceUnused(kv, nonce);
+      }
+      return assertNonceUnusedLocal(nonce);
+    },
+    applyRateLimit(remoteIp, email, formType) {
+      if (runtime.isCloudflareRuntime && kv && !runtime.bypassCloudflareGuards) {
+        return applySubmissionRateLimit(kv, remoteIp, email, formType);
+      }
+      return applySubmissionRateLimitLocal(remoteIp, email, formType);
+    }
+  };
+}
+function createDefaultSubscriberStore(runtime, db) {
+  return {
+    async upsert(input) {
+      if (runtime.isCloudflareRuntime && db) {
+        return upsertSubscriber(db, input);
+      }
+      const { upsertLocalSubscriber } = await import("./subscribers-local.js");
+      return upsertLocalSubscriber(input);
+    }
+  };
+}
+function createDefaultContactStore(runtime, db) {
+  return {
+    async create(input) {
+      if (runtime.isCloudflareRuntime && db) {
+        return createContactSubmission(db, input);
+      }
+      const { createLocalContactSubmission } = await import("./contact-submissions-local.js");
+      return createLocalContactSubmission(input);
+    }
+  };
+}
+const BUILTIN_FORMS_PROVIDERS = {
+  store_only: {
+    id: "store_only",
+    behavior: {
+      contact: { notifyAdmin: false, requireSmtp: false },
+      subscribe: { notifyAdmin: false, sendConfirmation: false, requireSmtp: false }
+    }
+  },
+  notify_admin: {
+    id: "notify_admin",
+    behavior: {
+      contact: { notifyAdmin: true, requireSmtp: false },
+      subscribe: { notifyAdmin: true, sendConfirmation: false, requireSmtp: false }
+    }
+  },
+  full_email: {
+    id: "full_email",
+    behavior: {
+      contact: { notifyAdmin: true, requireSmtp: true },
+      subscribe: { notifyAdmin: true, sendConfirmation: true, requireSmtp: true }
+    }
+  }
+};
+function finalizeFormsProvider(provider) {
+  return {
+    ...provider,
+    createGuardStore: provider.createGuardStore ?? ((input) => createDefaultGuardStore(input.runtime, input.kv)),
+    createSubscriberStore: provider.createSubscriberStore ?? ((input) => createDefaultSubscriberStore(input.runtime, input.db)),
+    createContactStore: provider.createContactStore ?? ((input) => createDefaultContactStore(input.runtime, input.db)),
+    sendEmail: provider.sendEmail ?? sendDefaultEmail,
+    verifyTurnstileToken: provider.verifyTurnstileToken ?? verifyDefaultTurnstileToken
+  };
+}
+function resolveBuiltinFormsProvider(providerId) {
+  const provider = BUILTIN_FORMS_PROVIDERS[providerId];
+  if (!provider) {
+    throw new Error(`Treeseed built-in forms provider "${providerId}" is not registered.`);
+  }
+  return finalizeFormsProvider(provider);
+}
+export {
+  BUILTIN_FORMS_PROVIDERS,
+  finalizeFormsProvider,
+  resolveBuiltinFormsProvider
+};

package/dist/utils/forms/routing-core.js

@@ -0,0 +1,7 @@
+function resolveContactRecipientsFromMap(routingMap, contactType) {
+  const recipients = routingMap[contactType]?.length ? routingMap[contactType] : routingMap.default;
+  return recipients ?? [];
+}
+export {
+  resolveContactRecipientsFromMap
+};

package/dist/utils/forms/routing.js

@@ -0,0 +1,13 @@
+import { getContactRoutingMap, getSubscribeRecipients } from "./config.js";
+import { resolveContactRecipientsFromMap } from "./routing-core.js";
+function resolveContactRecipients(contactType) {
+  const routingMap = getContactRoutingMap();
+  return resolveContactRecipientsFromMap(routingMap, contactType);
+}
+function resolveSubscribeRecipients() {
+  return getSubscribeRecipients();
+}
+export {
+  resolveContactRecipients,
+  resolveSubscribeRecipients
+};

package/dist/utils/forms/runtime-core.js

@@ -0,0 +1,17 @@
+function deriveFormRuntimeCapabilities(input) {
+  const isLocalMode = input.isDevServer || Boolean(input.localDevMode);
+  return {
+    isCloudflareRuntime: input.isCloudflareRuntime,
+    isLocalMode,
+    localDevMode: input.localDevMode ?? "production",
+    bypassTurnstile: isLocalMode ? input.bypassTurnstile ?? false : false,
+    bypassCloudflareGuards: isLocalMode ? input.bypassCloudflareGuards ?? false : false,
+    useMailpit: isLocalMode ? input.useMailpit : false,
+    formsMode: input.formsMode,
+    smtpEnabled: input.smtpEnabled || (isLocalMode ? input.useMailpit : false),
+    turnstileEnabled: input.turnstileEnabled
+  };
+}
+export {
+  deriveFormRuntimeCapabilities
+};

package/dist/utils/forms/runtime.js

@@ -0,0 +1,27 @@
+import {
+  getFormsMode,
+  getLocalDevMode,
+  isSmtpEnabled,
+  isTurnstileEnabled,
+  shouldBypassCloudflareGuardsByEnv,
+  shouldBypassTurnstileByEnv,
+  shouldUseMailpit
+} from "./config.js";
+import { deriveFormRuntimeCapabilities } from "./runtime-core.js";
+function resolveFormRuntimeCapabilities(locals) {
+  const runtime = locals.runtime;
+  return deriveFormRuntimeCapabilities({
+    isCloudflareRuntime: Boolean(runtime?.env?.FORM_GUARD_KV && runtime?.env?.SITE_DATA_DB),
+    localDevMode: getLocalDevMode(),
+    isDevServer: import.meta.env.DEV,
+    bypassTurnstile: shouldBypassTurnstileByEnv(),
+    bypassCloudflareGuards: shouldBypassCloudflareGuardsByEnv(),
+    useMailpit: shouldUseMailpit(),
+    formsMode: getFormsMode(),
+    smtpEnabled: isSmtpEnabled(),
+    turnstileEnabled: isTurnstileEnabled()
+  });
+}
+export {
+  resolveFormRuntimeCapabilities
+};

package/dist/utils/forms/service-core.js

@@ -0,0 +1,256 @@
+import { CONTACT_TYPE_LABELS, FORM_SESSION_COOKIE, HONEYPOT_FIELD } from "./constants.js";
+import { buildRedirectTarget, getRemoteIp, sanitizeRedirectTo } from "./http.js";
+import { issueFormToken, verifyIssuedToken, createSessionCookie } from "./session.js";
+import { parsePayload, validatePayload } from "./validation.js";
+import { hashValue } from "./crypto.js";
+import { resolveContactRecipientsFromMap } from "./routing-core.js";
+function resultFor(formType, redirectTo, ok, code, message) {
+  return {
+    ok,
+    code,
+    message,
+    redirectTo: buildRedirectTarget(formType, redirectTo, ok, code)
+  };
+}
+function summarizeRequest(request) {
+  return request.headers.get("user-agent") ?? "unknown user agent";
+}
+async function buildContactMessage(payload, remoteIp, request) {
+  const ipHash = await hashValue(remoteIp || "unknown");
+  return [
+    "TreeSeed contact form submission",
+    "",
+    `Name: ${payload.name}`,
+    `Email: ${payload.email}`,
+    `Organization: ${payload.organization || "n/a"}`,
+    `Contact type: ${CONTACT_TYPE_LABELS[payload.contactType]}`,
+    `Subject: ${payload.subject}`,
+    "",
+    payload.message,
+    "",
+    "Metadata",
+    `Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+    `IP hash: ${ipHash}`,
+    `User agent: ${summarizeRequest(request)}`
+  ].join("\n");
+}
+async function sendContactEmail(payload, remoteIp, request, runtime, config, formsProvider = config.formsProvider) {
+  const recipients = resolveContactRecipientsFromMap(config.contactRouting, payload.contactType);
+  if (!recipients.length) {
+    throw new Error("No contact recipients configured for this route.");
+  }
+  await formsProvider.sendEmail(
+    {
+      to: recipients,
+      subject: `[TreeSeed Contact] ${payload.subject}`,
+      text: await buildContactMessage(payload, remoteIp, request),
+      replyTo: payload.email
+    },
+    runtime,
+    { smtp: config.smtpConfig, siteUrl: config.siteUrl }
+  );
+}
+async function persistContactSubmission(payload, remoteIp, request, contactStore) {
+  await contactStore.create({
+    name: payload.name,
+    email: payload.email,
+    organization: payload.organization,
+    contactType: payload.contactType,
+    subject: payload.subject,
+    message: payload.message,
+    ip: remoteIp,
+    userAgent: summarizeRequest(request)
+  });
+}
+async function handleSubscribe(payload, remoteIp, request, subscriberStore, runtime, config, formsProvider = config.formsProvider) {
+  await subscriberStore.upsert({
+    email: payload.email,
+    name: payload.name,
+    source: "footer",
+    ip: remoteIp
+  });
+  const notifyRecipients = config.subscribeRecipients;
+  const ipHash = await hashValue(remoteIp || "unknown");
+  if (!formsProvider.behavior.subscribe.notifyAdmin && !formsProvider.behavior.subscribe.sendConfirmation) {
+    return;
+  }
+  const notifyAdmin = async () => {
+    if (!notifyRecipients.length) {
+      return;
+    }
+    await formsProvider.sendEmail({
+      to: notifyRecipients,
+      subject: "[TreeSeed Updates] New subscriber",
+      text: [
+        "TreeSeed updates signup",
+        "",
+        `Email: ${payload.email}`,
+        `Name: ${payload.name || "n/a"}`,
+        `Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+        `IP hash: ${ipHash}`,
+        `User agent: ${summarizeRequest(request)}`
+      ].join("\n")
+    }, runtime, { smtp: config.smtpConfig, siteUrl: config.siteUrl });
+  };
+  if (!formsProvider.behavior.subscribe.sendConfirmation) {
+    if (formsProvider.behavior.subscribe.requireSmtp && !runtime.smtpEnabled) {
+      return;
+    }
+    try {
+      await notifyAdmin();
+    } catch (error) {
+      console.warn("Subscriber notification email failed", error);
+    }
+    return;
+  }
+  if (!runtime.smtpEnabled) {
+    throw new Error("SMTP is required for full_email subscribe delivery.");
+  }
+  await notifyAdmin();
+  await formsProvider.sendEmail({
+    to: [payload.email],
+    subject: "You are subscribed to TreeSeed updates",
+    text: [
+      "Thanks for subscribing to TreeSeed updates.",
+      "",
+      "We will use this address to send occasional product, documentation, and workflow updates as the project evolves.",
+      "",
+      "You can reply to this email if you need anything in the meantime."
+    ].join("\n")
+  }, runtime, { smtp: config.smtpConfig, siteUrl: config.siteUrl });
+}
+async function handleTokenRequestWithConfig(context, config) {
+  const formType = context.url.searchParams.get("formType");
+  if (formType !== "contact" && formType !== "subscribe") {
+    return new Response(JSON.stringify({ ok: false, message: "Unknown form type." }), {
+      status: 400,
+      headers: { "content-type": "application/json" }
+    });
+  }
+  const issued = await issueFormToken(formType, config.formSecret);
+  const cookie = createSessionCookie(issued.sessionId, context.url);
+  context.setCookie?.(cookie);
+  return new Response(
+    JSON.stringify({
+      ok: true,
+      formToken: issued.formToken,
+      sessionId: issued.sessionId
+    }),
+    {
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store"
+      }
+    }
+  );
+}
+async function handleFormSubmissionWithConfig(context, config) {
+  const bindings = config.bindings ?? {};
+  const runtime = config.runtime;
+  const formsProvider = config.formsProvider;
+  const guardStore = formsProvider.createGuardStore({
+    runtime,
+    kv: bindings.FORM_GUARD_KV ?? null
+  });
+  const subscriberStore = formsProvider.createSubscriberStore({
+    runtime,
+    db: bindings.SITE_DATA_DB ?? null
+  });
+  const contactStore = formsProvider.createContactStore({
+    runtime,
+    db: bindings.SITE_DATA_DB ?? null
+  });
+  const formData = await context.request.formData();
+  const payload = parsePayload(formData);
+  const formTypeValue = typeof formData.get("formType") === "string" ? String(formData.get("formType")) : "contact";
+  const normalizedFormType = formTypeValue === "subscribe" ? "subscribe" : "contact";
+  const redirectTo = sanitizeRedirectTo(
+    typeof formData.get("redirectTo") === "string" ? String(formData.get("redirectTo")) : null,
+    normalizedFormType,
+    context.url
+  );
+  if (typeof formData.get(HONEYPOT_FIELD) === "string" && String(formData.get(HONEYPOT_FIELD)).trim()) {
+    return resultFor(normalizedFormType, redirectTo, false, "invalid_request", "Spam protection triggered.");
+  }
+  if (!payload) {
+    return resultFor(normalizedFormType, redirectTo, false, "invalid_form", "The submitted form data was invalid.");
+  }
+  const validation = validatePayload(payload);
+  if (!validation.ok) {
+    return resultFor(payload.formType, redirectTo, false, "invalid_form", validation.message);
+  }
+  const cookieSessionId = context.getCookie(FORM_SESSION_COOKIE) ?? "";
+  const postedSessionId = typeof formData.get("formSession") === "string" ? String(formData.get("formSession")).trim() : "";
+  const formToken = typeof formData.get("formToken") === "string" ? String(formData.get("formToken")) : "";
+  const sessionCandidates = Array.from(new Set([cookieSessionId, postedSessionId].filter(Boolean)));
+  let tokenResult;
+  if (!sessionCandidates.length) {
+    tokenResult = { ok: false, reason: "missing-session" };
+  } else {
+    tokenResult = { ok: false, reason: "mismatch" };
+    for (const sessionId of sessionCandidates) {
+      const candidateResult = await verifyIssuedToken(formToken, sessionId, payload.formType, config.formSecret);
+      if (candidateResult.ok) {
+        tokenResult = candidateResult;
+        break;
+      }
+      if (tokenResult.reason !== "expired") {
+        tokenResult = candidateResult;
+      }
+    }
+  }
+  if (!tokenResult.ok) {
+    const code = tokenResult.reason === "expired" ? "token_expired" : "token_invalid";
+    return resultFor(payload.formType, redirectTo, false, code, "Please refresh the page and try again.");
+  }
+  if (!await guardStore.assertNonceUnused(tokenResult.payload.nonce)) {
+    return resultFor(payload.formType, redirectTo, false, "token_replayed", "This submission token has already been used.");
+  }
+  const remoteIp = getRemoteIp(context.request);
+  const rateLimitOk = await guardStore.applyRateLimit(remoteIp, payload.email, payload.formType);
+  if (!rateLimitOk) {
+    return resultFor(payload.formType, redirectTo, false, "rate_limited", "Please wait a moment before trying again.");
+  }
+  const turnstileToken = typeof formData.get("cf-turnstile-response") === "string" ? String(formData.get("cf-turnstile-response")) : "";
+  const turnstileResult = await formsProvider.verifyTurnstileToken(
+    turnstileToken,
+    remoteIp,
+    payload.formType === "contact" ? "contact_submit" : "subscribe_submit",
+    runtime,
+    config.turnstileSecret
+  );
+  if (!turnstileResult.ok) {
+    return resultFor(payload.formType, redirectTo, false, "captcha_failed", "Please complete the verification challenge and try again.");
+  }
+  try {
+    if (payload.formType === "contact") {
+      await persistContactSubmission(payload, remoteIp, context.request, contactStore);
+      if (formsProvider.behavior.contact.requireSmtp && !runtime.smtpEnabled) {
+        return resultFor(payload.formType, redirectTo, false, "config_error", "SMTP must be configured for this form mode.");
+      }
+      if (formsProvider.behavior.contact.notifyAdmin) {
+        if (!formsProvider.behavior.contact.requireSmtp && !runtime.smtpEnabled) {
+          return resultFor(payload.formType, redirectTo, true, "success", "Thanks, your submission has been received.");
+        }
+        try {
+          await sendContactEmail(payload, remoteIp, context.request, runtime, config, formsProvider);
+        } catch (error) {
+          console.warn("Contact notification email failed", error);
+        }
+      }
+    } else {
+      if (formsProvider.behavior.subscribe.requireSmtp && !runtime.smtpEnabled) {
+        return resultFor(payload.formType, redirectTo, false, "config_error", "SMTP must be configured for this form mode.");
+      }
+      await handleSubscribe(payload, remoteIp, context.request, subscriberStore, runtime, config, formsProvider);
+    }
+  } catch (error) {
+    console.error("Form submission failed", error);
+    return resultFor(payload.formType, redirectTo, false, "delivery_failed", "The submission could not be delivered right now.");
+  }
+  return resultFor(payload.formType, redirectTo, true, "success", "Thanks, your submission has been received.");
+}
+export {
+  handleFormSubmissionWithConfig,
+  handleTokenRequestWithConfig
+};