@tryvitris/website-harness 0.0.0-stage → 0.1.0-beta.5

package/bin/cloudflare/forms-test.js

@@ -0,0 +1,429 @@
+// src/forms/config.ts
+var safeId = (s) => typeof s === "string" && /^[a-zA-Z0-9_-]{1,80}$/.test(s);
+var safeEmail = (s) => {
+  if (typeof s !== "string" || s.length > 254 || !/^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,63}$/.test(s)) return false;
+  const [local, domain] = s.split("@");
+  return !!local && local.length <= 64 && !local.startsWith(".") && !local.endsWith(".") && !local.includes("..") && !!domain && domain.split(".").every((label) => label.length <= 63 && /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
+};
+function approvedOrigin(value) {
+  const u = new URL(value);
+  if (u.origin !== value || u.hostname.includes("*") || u.username || u.password || u.protocol !== "https:" && !(u.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(u.hostname))) throw new Error("Expected exact HTTPS origin (HTTP only on loopback)");
+  return u.origin;
+}
+function validateFormConfig(value) {
+  const c = value;
+  if (!c || !safeId(c.id) || !["disabled", "test", "live"].includes(c.mode)) throw new Error("Invalid form ID or mode");
+  if (!Array.isArray(c.origins) || !c.origins.length || c.origins.length > 10 || new Set(c.origins).size !== c.origins.length) throw new Error("One to ten unique exact origins required");
+  c.origins.forEach(approvedOrigin);
+  if (c.mode === "live" && c.origins.some((o) => new URL(o).protocol !== "https:" || ["localhost", "127.0.0.1", "[::1]"].includes(new URL(o).hostname))) throw new Error("Live forms cannot approve loopback origins");
+  if (!Array.isArray(c.fields) || !c.fields.length || c.fields.length > 32 || new Set(c.fields.map((f) => f.name)).size !== c.fields.length) throw new Error("One to 32 unique fields required");
+  const reserved = /* @__PURE__ */ new Set(["form_id", "tenant_id", "idempotency_key", "page_path", "vid", "company_url", "cf-turnstile-response", "recipients", "to", "from", "sender"]);
+  const maps = /* @__PURE__ */ new Set();
+  for (const f of c.fields) {
+    if (!safeId(f.name) || reserved.has(f.name) || !["text", "email", "tel", "textarea", "select", "checkbox", "radio"].includes(f.type) || !Number.isInteger(f.maxLength) || f.maxLength < 1 || f.maxLength > 8e3 || f.minLength !== void 0 && (!Number.isInteger(f.minLength) || f.minLength < 0 || f.minLength > f.maxLength) || f.label !== void 0 && (typeof f.label !== "string" || f.label.length > 200) || f.required !== void 0 && typeof f.required !== "boolean") throw new Error("Invalid field schema");
+    if (f.map !== void 0) {
+      if (!["name", "email", "phone", "message"].includes(f.map) || maps.has(f.map)) throw new Error("Invalid or duplicate mapping");
+      maps.add(f.map);
+    }
+    if ((["select", "checkbox", "radio"].includes(f.type) || f.options !== void 0) && (!Array.isArray(f.options) || !f.options.length || f.options.length > 40 || f.options.some((s) => typeof s !== "string" || !s || s.length > f.maxLength) || new Set(f.options).size !== f.options.length)) throw new Error("Choice fields need bounded options");
+  }
+  if (!c.fields.some((f) => f.map === "email" && f.type === "email" && f.required)) throw new Error("A required visitor email mapping is needed");
+  if (!Array.isArray(c.recipients) || c.recipients.length > 5 || c.recipients.some((r) => !safeEmail(r)) || new Set(c.recipients).size !== c.recipients.length) throw new Error("Invalid notification recipients");
+  if (!c.turnstile || typeof c.turnstile.sitekey !== "string" || !/^[a-zA-Z0-9_-]{1,100}$/.test(c.turnstile.sitekey) || !safeId(c.turnstile.secretRef) || !safeId(c.turnstile.action) || c.turnstile.action.length > 32) throw new Error("Invalid Turnstile configuration");
+  return c;
+}
+
+// src/worker/http.ts
+function cookies(request) {
+  const out = {};
+  const raw = request.headers.get("cookie") || "";
+  for (const part of raw.split(";")) {
+    const trimmed = part.trim();
+    if (!trimmed) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    try {
+      out[trimmed.slice(0, eq)] = decodeURIComponent(trimmed.slice(eq + 1));
+    } catch {
+    }
+  }
+  return out;
+}
+
+// src/worker/env.ts
+function isLocalRequest(request) {
+  const host = new URL(request.url).hostname.toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "[::1]";
+}
+function secret(env) {
+  return env.SESSION_SECRET || "dev-insecure-session-secret";
+}
+
+// src/worker/auth.ts
+var SESSION_COOKIE = "__Host-vitris_sid";
+function sessionCookieName(request) {
+  return request && isLocalRequest(request) ? "vitris_sid" : SESSION_COOKIE;
+}
+async function hmacHex(key, value) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(value));
+  return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function readSession(env, request) {
+  if (!isLocalRequest(request) && new URL(request.url).protocol !== "https:") return null;
+  const sid = cookies(request)[sessionCookieName(request)];
+  if (!sid || !/^[a-f0-9-]{36}$/.test(sid)) return null;
+  const row = await env.DB.prepare("SELECT session_json FROM auth_sessions WHERE id_hash=? AND expires_at>?").bind(await hmacHex(secret(env), `session:${sid}`), Math.floor(Date.now() / 1e3)).first();
+  return row ? JSON.parse(row.session_json) : null;
+}
+
+// src/html.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+// src/analytics.ts
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+  return UUID_RE.test(value);
+}
+
+// src/worker/forms.ts
+var MAX_BODY = 32768;
+function sandboxMailReadiness(env) {
+  if (!env.FORMS_TEST_RECIPIENT) return [];
+  return [
+    ...env.FORMS_SANDBOX !== "1" ? ["Operator test mail requires sandbox backend"] : [],
+    ...!safeEmail(env.FORMS_TEST_RECIPIENT) ? ["Valid operator test recipient"] : [],
+    ...!env.FORMS_TEST_EMAIL ? ["FORMS_TEST_EMAIL restricted binding"] : [],
+    ...!safeEmail(env.FORMS_FROM) ? ["Authenticated FORMS_FROM sender"] : [],
+    ...env.FORMS_SENDER_READY !== "1" ? ["Verified sender domain / account sending access"] : []
+  ];
+}
+async function digest(s) {
+  return [...new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(s)))].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function formReadiness(env, c) {
+  const missing = [];
+  let secrets = {};
+  try {
+    const parsed = JSON.parse(env.FORMS_TURNSTILE_SECRETS || "{}");
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) secrets = parsed;
+  } catch {
+  }
+  const secret2 = typeof secrets[c.turnstile.secretRef] === "string" ? secrets[c.turnstile.secretRef] : "";
+  if (!secret2) missing.push("Turnstile secret");
+  if (c.mode === "live") {
+    if (c.origins.some((origin) => new URL(origin).protocol !== "https:" || ["localhost", "127.0.0.1", "[::1]"].includes(new URL(origin).hostname))) missing.push("Approved HTTPS production origins");
+    if (env.FORMS_SANDBOX === "1") missing.push("Sandbox backend cannot activate live delivery");
+    if (c.turnstile.sitekey.startsWith("1x") || c.turnstile.sitekey.startsWith("2x") || c.turnstile.sitekey.startsWith("3x") || secret2.startsWith("1x") || secret2.startsWith("2x")) missing.push("Production Turnstile keys");
+    if (!c.recipients.length) missing.push("Notification recipients");
+    if (!env.FORMS_EMAIL) missing.push("FORMS_EMAIL binding");
+    if (!safeEmail(env.FORMS_FROM)) missing.push("Authenticated FORMS_FROM sender");
+    if (env.FORMS_SENDER_READY !== "1") missing.push("Verified sender domain / account sending access");
+  }
+  if (!env.FORMS_ABUSE_SECRET || env.FORMS_ABUSE_SECRET.length < 32) missing.push("FORMS_ABUSE_SECRET (32+ characters)");
+  return missing;
+}
+async function boundedBody(request) {
+  if (Number(request.headers.get("content-length") || 0) > MAX_BODY) throw new Error("too_large");
+  const reader = request.body?.getReader();
+  if (!reader) return "";
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    size += value.length;
+    if (size > MAX_BODY) {
+      await reader.cancel();
+      throw new Error("too_large");
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const c of chunks) {
+    bytes.set(c, offset);
+    offset += c.length;
+  }
+  return new TextDecoder("utf-8", { fatal: true, ignoreBOM: false }).decode(bytes);
+}
+async function formRateLimit(env, tenant, source, now = Date.now()) {
+  const window = Math.floor(now / 6e5), expires = Math.floor(now / 1e3) + 1200;
+  const counters = [[`tenant:${tenant}:${window}`, 100], [`source:${tenant}:${source}:${window}`, 10]];
+  const rows = await env.DB.batch(counters.map(([key, limit]) => env.DB.prepare(`INSERT INTO form_rate_limits(key,n,expires) VALUES(?,1,?) ON CONFLICT(key) DO UPDATE SET n=n+1 WHERE n < ? RETURNING n`).bind(key, expires, limit)));
+  return rows.every((r) => r.results.length === 1);
+}
+async function handleFormSubmission(env, request) {
+  const url = new URL(request.url);
+  let origin = "";
+  try {
+    origin = approvedOrigin(request.headers.get("origin") || "");
+  } catch {
+  }
+  const headers = { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", vary: "Origin", "x-content-type-options": "nosniff" };
+  const respond = (error, status, extra = {}) => {
+    if (request.method === "POST" && !request.headers.get("accept")?.includes("application/json")) {
+      const message = error ? "Your message could not be accepted. This form requires JavaScript and a valid security check. Return to the website and try again, or use its listed contact details." : extra.mode === "test" ? "Test message accepted. No customer email will be sent." : "Message accepted. Your inquiry has been saved.";
+      return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Form submission</title></head><body><main><h1>Form submission</h1><p role="${error ? "alert" : "status"}">${escapeHtml(message)}</p></main></body></html>`, { status, headers: { ...headers, "content-type": "text/html; charset=utf-8" } });
+    }
+    return new Response(JSON.stringify({ ok: !error, ...error ? { error } : {}, ...extra }), { status, headers });
+  };
+  let body;
+  if (request.method === "OPTIONS") body = new URLSearchParams({ form_id: url.searchParams.get("form_id") || "" });
+  else if (request.method !== "POST") return respond("method_not_allowed", 405);
+  else {
+    const type = request.headers.get("content-type")?.split(";")[0]?.trim();
+    if (type !== "application/x-www-form-urlencoded") return respond("unsupported_content_type", 415);
+    try {
+      body = new URLSearchParams(await boundedBody(request));
+    } catch (e) {
+      return respond(e instanceof Error && e.message === "too_large" ? "too_large" : "invalid_body", 413);
+    }
+  }
+  const id = body.get("form_id");
+  if (request.method === "POST" && url.searchParams.has("form_id") && url.searchParams.get("form_id") !== id) return respond("form_mismatch", 403);
+  if (!safeId(id)) return respond("form_configuration_required", 403);
+  const row = await env.DB.prepare("SELECT * FROM contact_forms WHERE id=?").bind(id).first();
+  if (!row) return respond("unknown_form", 403);
+  let c;
+  try {
+    c = validateFormConfig(JSON.parse(row.config_json));
+  } catch {
+    return respond("configuration_unavailable", 503);
+  }
+  if (c.id !== row.id || body.has("tenant_id") && body.get("tenant_id") !== row.tenant_id) return respond("tenant_mismatch", 403);
+  if (!origin || !c.origins.includes(origin)) return respond("invalid_origin", 403);
+  const owner = await env.DB.prepare("SELECT tenant_id FROM form_origins WHERE origin=?").bind(origin).first();
+  if (owner?.tenant_id !== row.tenant_id) return respond("tenant_mismatch", 403);
+  const hostnameOwner = await env.DB.prepare("SELECT tenant_id FROM hostnames WHERE hostname=?").bind(new URL(origin).hostname).first();
+  if (hostnameOwner && hostnameOwner.tenant_id !== row.tenant_id) return respond("tenant_mismatch", 403);
+  headers["access-control-allow-origin"] = origin;
+  headers["access-control-allow-methods"] = "POST, OPTIONS";
+  headers["access-control-allow-headers"] = "Content-Type, Accept";
+  if (c.mode === "disabled") return respond("form_disabled", 403);
+  if (request.method === "OPTIONS") {
+    if (request.headers.get("access-control-request-method") !== "POST" || (request.headers.get("access-control-request-headers") || "").split(",").some((h) => h.trim() && !["content-type", "accept"].includes(h.trim().toLowerCase()))) return respond("invalid_preflight", 403);
+    return new Response(null, { status: 204, headers });
+  }
+  const missing = formReadiness(env, c);
+  if (missing.length) return respond("configuration_unavailable", 503);
+  const meta = /* @__PURE__ */ new Set(["form_id", "tenant_id", "idempotency_key", "page_path", "vid", "company_url", "cf-turnstile-response"]);
+  for (const [key2] of body) if (!meta.has(key2) && !c.fields.some((f) => f.name === key2)) return respond("unknown_field", 400);
+  for (const key2 of meta) if (body.getAll(key2).length > 1) return respond("duplicate_field", 400);
+  if (body.get("company_url")?.trim()) return respond("invalid_submission", 400);
+  const key = body.get("idempotency_key") || "";
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(key)) return respond("invalid_idempotency_key", 400);
+  const path = body.get("page_path") || "/";
+  const vid = body.get("vid") || "";
+  if (vid && !isUuid(vid)) return respond("invalid_visitor_id", 400);
+  if (!path.startsWith("/") || path.length > 200 || /[\r\n\x00]/.test(path)) return respond("invalid_path", 400);
+  const fields = /* @__PURE__ */ Object.create(null), mapped = { name: "", email: "", phone: "", message: "" };
+  for (const f of c.fields) {
+    const values = body.getAll(f.name).map((v) => ["select", "checkbox", "radio"].includes(f.type) ? v : v.trim());
+    if (f.type !== "checkbox" && values.length > 1 || values.length > 40 || new Set(values).size !== values.length || f.required && (!values.length || values.every((v) => !v)) || values.some((v) => v.length > f.maxLength || v && v.length < (f.minLength || 0) || /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(v) || f.type === "email" && v && !safeEmail(v) || f.options && v && !f.options.includes(v))) return respond("validation_error", 400, { field: f.name });
+    fields[f.name] = values;
+    if (f.map) mapped[f.map] = values.join(", ");
+  }
+  if (!safeEmail(mapped.email)) return respond("validation_error", 400, { field: "email" });
+  const fingerprint = await digest(JSON.stringify({ origin, path, fields: Object.fromEntries(Object.entries(fields).sort(([a], [b]) => a.localeCompare(b))) }));
+  const receipt = () => env.DB.prepare("SELECT s.id,s.fingerprint,s.mode,o.status AS notification FROM form_submissions s LEFT JOIN form_outbox o ON o.id=s.id AND o.tenant_id=s.tenant_id WHERE s.tenant_id=? AND s.form_id=? AND s.idempotency_key=?").bind(row.tenant_id, id, key).first();
+  const acknowledge = (r) => r.fingerprint !== fingerprint ? respond("idempotency_conflict", 409) : respond(null, 200, { leadId: r.id, mode: r.mode, notification: r.notification || "unknown" });
+  const existing = await receipt();
+  if (existing) return acknowledge(existing);
+  const ip = request.headers.get("cf-connecting-ip") || (isLocalRequest(request) ? "local" : "unknown");
+  const source = await hmacHex(env.FORMS_ABUSE_SECRET, ip);
+  if (!await formRateLimit(env, row.tenant_id, source)) {
+    headers["retry-after"] = "600";
+    return respond("rate_limited", 429);
+  }
+  const token = body.get("cf-turnstile-response") || "";
+  if (!token || token.length > 2048) return respond("challenge_required", 400);
+  let challenge;
+  try {
+    const hash = await digest(`${row.tenant_id}|${id}|${key}|${token}`);
+    const verificationKey = `${hash.slice(0, 8)}-${hash.slice(8, 12)}-4${hash.slice(13, 16)}-a${hash.slice(17, 20)}-${hash.slice(20, 32)}`;
+    const r = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", { method: "POST", signal: AbortSignal.timeout(1e4), body: new URLSearchParams({ secret: JSON.parse(env.FORMS_TURNSTILE_SECRETS)[c.turnstile.secretRef], response: token, remoteip: ip === "local" || ip === "unknown" ? "" : ip, idempotency_key: verificationKey }) });
+    if (!r.ok) return respond("challenge_unavailable", 503);
+    challenge = await r.json();
+  } catch {
+    return respond("challenge_unavailable", 503);
+  }
+  const raced = await receipt();
+  if (raced) return acknowledge(raced);
+  if (!challenge.success || challenge.hostname !== new URL(origin).hostname || challenge.action !== c.turnstile.action) return respond("challenge_invalid", 400);
+  const leadId = crypto.randomUUID();
+  try {
+    await env.DB.prepare(`INSERT INTO form_submissions(id,tenant_id,form_id,idempotency_key,fingerprint,challenge_hash,mode,fields_json,schema_json,name,email,phone,message,page_path,recipients_json,vid) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).bind(leadId, row.tenant_id, id, key, fingerprint, await digest(token), c.mode, JSON.stringify(fields), JSON.stringify(c.fields), mapped.name, mapped.email, mapped.phone, mapped.message, path, JSON.stringify(c.recipients), vid || null).run();
+  } catch {
+    const duplicate = await receipt();
+    if (duplicate) return acknowledge(duplicate);
+    const replay = await env.DB.prepare("SELECT id FROM form_submissions WHERE challenge_hash=?").bind(await digest(token)).first();
+    return respond(replay ? "challenge_replayed" : "acceptance_unavailable", replay ? 400 : 503);
+  }
+  return respond(null, 201, { leadId, mode: c.mode, notification: c.mode === "test" ? env.FORMS_TEST_RECIPIENT ? "test_mail_pending" : "test_capture_pending" : "pending" });
+}
+async function formAdminAuthorized(env, request, tenantId) {
+  const bearer = request.headers.get("authorization")?.replace(/^Bearer /, "");
+  if (bearer) {
+    try {
+      const expected = JSON.parse(env.FORMS_SETUP_TOKENS || "{}")[tenantId];
+      if (typeof expected === "string" && expected.length >= 32 && await digest(bearer) === await digest(expected)) return true;
+    } catch {
+    }
+    return false;
+  }
+  const session = await readSession(env, request);
+  if (session?.tenantId !== tenantId || session.role !== "owner") return false;
+  return request.method === "GET" || request.headers.get("origin") === new URL(request.url).origin;
+}
+async function configureForms(env, tenantId, forms, tenant) {
+  if (!forms.length || forms.length > 20 || new Set(forms.map((f) => f.id)).size !== forms.length) throw new Error("One to 20 unique forms required");
+  const statements = [];
+  if (!await env.DB.prepare("SELECT id FROM tenants WHERE id=?").bind(tenantId).first()) {
+    if (!tenant || !safeId(tenant.slug) || typeof tenant.name !== "string" || !tenant.name || tenant.name.length > 200) throw new Error("Unknown tenant");
+    statements.push(env.DB.prepare("INSERT INTO tenants(id,slug,name) VALUES(?,?,?) ON CONFLICT(id) DO NOTHING").bind(tenantId, tenant.slug, tenant.name));
+  }
+  for (const value of forms) {
+    const c = validateFormConfig(value);
+    const previous = await env.DB.prepare("SELECT tenant_id FROM contact_forms WHERE id=?").bind(c.id).first();
+    if (previous && previous.tenant_id !== tenantId) throw new Error("Form belongs to another tenant");
+    if (c.mode === "live" && formReadiness(env, c).length) throw new Error("Live readiness: " + formReadiness(env, c).join(", "));
+    for (const origin of c.origins) {
+      const host = await env.DB.prepare("SELECT tenant_id FROM hostnames WHERE hostname=?").bind(new URL(origin).hostname).first();
+      if (host && host.tenant_id !== tenantId) throw new Error("Hostname belongs to another tenant");
+      statements.push(env.DB.prepare("INSERT INTO form_origins(origin,hostname,tenant_id) VALUES(?,?,?) ON CONFLICT(origin) DO UPDATE SET tenant_id=excluded.tenant_id RETURNING tenant_id").bind(origin, new URL(origin).hostname, tenantId));
+      const owner = await env.DB.prepare("SELECT tenant_id FROM form_origins WHERE origin=?").bind(origin).first();
+      if (owner && owner.tenant_id !== tenantId) throw new Error("Origin belongs to another tenant");
+    }
+    statements.push(env.DB.prepare(`INSERT INTO contact_forms(id,tenant_id,config_json) VALUES(?,?,?) ON CONFLICT(id) DO UPDATE SET tenant_id=excluded.tenant_id,config_json=excluded.config_json,updated_at=datetime('now')`).bind(c.id, tenantId, JSON.stringify(c)));
+  }
+  await env.DB.batch(statements);
+}
+async function retryNotification(env, tenantId, id) {
+  const r = await env.DB.prepare(`UPDATE form_outbox SET status='pending',attempts=0,next_attempt=0,last_error=NULL WHERE id=? AND tenant_id=? AND status='failed' RETURNING id`).bind(id, tenantId).all();
+  return !!r.results.length;
+}
+async function handleFormsAdmin(env, request) {
+  const match = new URL(request.url).pathname.match(/^\/api\/forms\/([a-zA-Z0-9_-]+)(?:\/(retry))?$/);
+  const reply = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+  if (!match || !await formAdminAuthorized(env, request, match[1])) return reply({ error: "unauthorized" }, 401);
+  const tenantId = match[1];
+  if (request.method === "GET" && !match[2]) {
+    const rows = await env.DB.prepare("SELECT * FROM contact_forms WHERE tenant_id=?").bind(tenantId).all();
+    const forms = rows.results.map((row) => {
+      const config = validateFormConfig(JSON.parse(row.config_json));
+      const missing = formReadiness(env, config), liveMissing = formReadiness(env, { ...config, mode: "live" });
+      return { config, missing, ready: config.mode !== "disabled" && !missing.length, liveMissing, liveReady: !liveMissing.length };
+    });
+    const notifications = await env.DB.prepare("SELECT id,status,attempts,last_error,provider_id,accepted_at FROM form_outbox WHERE tenant_id=? ORDER BY rowid DESC LIMIT 100").bind(tenantId).all();
+    return reply({ forms, notifications: notifications.results, sandboxMail: { enabled: !!env.FORMS_TEST_RECIPIENT, recipient: env.FORMS_TEST_RECIPIENT || null, missing: sandboxMailReadiness(env) } });
+  }
+  if (request.method !== "POST" || !request.headers.get("content-type")?.startsWith("application/json")) return reply({ error: "invalid_request" }, 400);
+  try {
+    const input = JSON.parse(await boundedBody(request));
+    if (match[2]) return reply({ ok: await retryNotification(env, tenantId, input.id) });
+    await configureForms(env, tenantId, input.forms, input.tenant);
+    return reply({ ok: true });
+  } catch {
+    return reply({ error: "invalid_configuration_or_ownership" }, 400);
+  }
+}
+
+// src/worker/form-outbox.ts
+function cloudflareEmailProvider(env, test = false) {
+  return { send: async (message, _idempotencyKey) => {
+    const binding = test ? env.FORMS_TEST_EMAIL : env.FORMS_EMAIL;
+    if (!binding) throw Object.assign(new Error("Missing binding"), { code: "MAIL_CONFIGURATION" });
+    return binding.send(message);
+  } };
+}
+var terminalCodes = /* @__PURE__ */ new Set(["MAIL_CONFIGURATION", "E_VALIDATION_ERROR", "E_SENDER_NOT_VERIFIED", "E_RECIPIENT_NOT_ALLOWED", "E_RECIPIENT_SUPPRESSED", "E_SENDER_DOMAIN_NOT_AVAILABLE", "E_HEADER_NOT_ALLOWED", "E_HEADER_USE_API_FIELD"]);
+async function processFormOutbox(env, provider, now = Math.floor(Date.now() / 1e3)) {
+  const started = Date.now(), clock = () => now + Math.floor((Date.now() - started) / 1e3);
+  const due = await env.DB.prepare(`SELECT o.id FROM form_outbox o JOIN form_submissions s ON s.id=o.id JOIN contact_forms f ON f.id=s.form_id AND f.tenant_id=s.tenant_id WHERE (o.status='pending' OR (o.status='processing' AND o.lease_until<?)) AND o.next_attempt<=? AND json_extract(f.config_json,'$.mode')=s.mode ORDER BY o.rowid LIMIT 20`).bind(now, now).all();
+  let processed = 0;
+  for (const candidate of due.results) {
+    const claim = crypto.randomUUID();
+    const claimTime = clock();
+    const claimed = await env.DB.prepare(`UPDATE form_outbox SET status='processing',claim=?,lease_until=?,attempts=attempts+1 WHERE id=? AND attempts<8 AND next_attempt<=? AND (status='pending' OR (status='processing' AND lease_until<?)) RETURNING id`).bind(claim, claimTime + 300, candidate.id, claimTime, claimTime).all();
+    if (!claimed.results.length) continue;
+    const job = await env.DB.prepare(`SELECT o.id,o.tenant_id,o.attempts,s.mode,s.form_id,s.fields_json,s.schema_json,s.email,s.recipients_json,s.page_path,f.config_json FROM form_outbox o JOIN form_submissions s ON s.id=o.id JOIN contact_forms f ON f.id=s.form_id AND f.tenant_id=s.tenant_id WHERE o.id=? AND o.claim=?`).bind(candidate.id, claim).first();
+    if (!job) continue;
+    try {
+      const c = validateFormConfig(JSON.parse(job.config_json));
+      if (c.mode !== job.mode) throw Object.assign(new Error("Paused configuration"), { code: "MAIL_CONFIGURATION" });
+      const values = JSON.parse(job.fields_json);
+      const schema = JSON.parse(job.schema_json);
+      const message = { from: env.FORMS_FROM || "test@vitris.invalid", to: JSON.parse(job.recipients_json), replyTo: job.email, subject: `Website inquiry: ${job.form_id}`, text: `Form: ${job.form_id}
+Page: ${job.page_path}
+
+` + schema.map((f) => `${f.label || f.name}: ${(values[f.name] || []).join(", ")}`).join("\n") };
+      const testMail = job.mode === "test" && !!env.FORMS_TEST_RECIPIENT;
+      if (job.mode === "test" && !testMail) {
+        await env.DB.prepare(`UPDATE form_outbox SET status='captured',test_output=?,claim=NULL,lease_until=0,last_error=NULL WHERE id=? AND claim=?`).bind(JSON.stringify(message), job.id, claim).run();
+      } else {
+        if ((testMail ? sandboxMailReadiness(env) : formReadiness(env, c)).length) throw Object.assign(new Error("Not ready"), { code: "MAIL_CONFIGURATION" });
+        if (testMail) {
+          message.to = [env.FORMS_TEST_RECIPIENT];
+          message.subject = `[VITRIS TEST] ${message.subject}`;
+          message.text = `Isolated test submission. Customer notifications are disabled.
+
+${message.text}`;
+          await env.DB.prepare("UPDATE form_outbox SET test_output=? WHERE id=? AND claim=?").bind(JSON.stringify(message), job.id, claim).run();
+        }
+        let timeout;
+        let result;
+        try {
+          result = await Promise.race([(provider || cloudflareEmailProvider(env, testMail)).send(message, job.id), new Promise((_, reject) => {
+            timeout = setTimeout(() => reject(Object.assign(new Error("Ambiguous provider timeout"), { code: "PROVIDER_TIMEOUT" })), 3e4);
+          })]);
+        } finally {
+          if (timeout) clearTimeout(timeout);
+        }
+        await env.DB.prepare(`UPDATE form_outbox SET status='accepted',provider_id=?,accepted_at=datetime('now'),claim=NULL,lease_until=0,last_error=NULL WHERE id=? AND claim=?`).bind(result.messageId, job.id, claim).run();
+      }
+    } catch (error) {
+      const raw = error?.code;
+      const code = raw && /^[A-Z_]{1,64}$/.test(raw) ? raw : "PROVIDER_TEMPORARY_FAILURE";
+      const terminal = terminalCodes.has(code) || job.attempts >= 8;
+      await env.DB.prepare(`UPDATE form_outbox SET status=?,next_attempt=?,last_error=?,claim=NULL,lease_until=0 WHERE id=? AND claim=?`).bind(terminal ? "failed" : "pending", clock() + Math.min(21600, 60 * 2 ** (job.attempts - 1)), code, job.id, claim).run();
+    }
+    processed++;
+  }
+  await env.DB.prepare(`UPDATE form_outbox SET status='failed',last_error='CLAIM_EXHAUSTED',claim=NULL WHERE status='processing' AND lease_until<? AND attempts>=8`).bind(clock()).run();
+  await env.DB.batch([
+    env.DB.prepare("DELETE FROM form_rate_limits WHERE expires<?").bind(clock()),
+    env.DB.prepare(`DELETE FROM form_submissions WHERE mode='test' AND created_at<datetime('now','-7 days')`)
+  ]);
+  return processed;
+}
+
+// src/worker/forms-sandbox.ts
+var forms_sandbox_default = {
+  async fetch(request, env) {
+    if (env.FORMS_SANDBOX !== "1") return new Response("Sandbox configuration required", { status: 503 });
+    const path = new URL(request.url).pathname;
+    try {
+      if (path === "/api/leads") return await handleFormSubmission(env, request);
+      if (path.startsWith("/api/forms/") && request.headers.get("authorization")?.startsWith("Bearer ")) return await handleFormsAdmin(env, request);
+      if (path === "/health") return Response.json({ service: "vitris-forms", sandbox: true, customerNotifications: false });
+      return new Response("Not found", { status: 404 });
+    } catch {
+      return Response.json({ ok: false, error: "service_unavailable" }, { status: 503 });
+    }
+  },
+  async scheduled(_event, env) {
+    if (env.FORMS_SANDBOX === "1") await processFormOutbox(env);
+  }
+};
+export {
+  forms_sandbox_default as default
+};

package/bin/cloudflare/templates.js

@@ -0,0 +1,100 @@
+// src/template-cloud/render.ts
+var esc = (s) => s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+var lum = (c) => {
+  const v = [1, 3, 5].map((i) => {
+    const n = parseInt(c.slice(i, i + 2), 16) / 255;
+    return n <= 0.04045 ? n / 12.92 : ((n + 0.055) / 1.055) ** 2.4;
+  });
+  return 0.2126 * v[0] + 0.7152 * v[1] + 0.0722 * v[2];
+};
+var contrast = (a, b) => (Math.max(lum(a), lum(b)) + 0.05) / (Math.min(lum(a), lum(b)) + 0.05);
+function brandVars(tokens, colors) {
+  const brand = colors[0] || "#56636b", bg = tokens.colorBg;
+  let action = colors.find((c) => contrast(c, bg) >= 4.5) || brand;
+  if (contrast(action, bg) < 4.5) {
+    const target = lum(bg) < 0.2 ? 255 : 0;
+    for (let step = 1; step <= 20; step++) {
+      action = "#" + [1, 3, 5].map((i) => Math.round(parseInt(brand.slice(i, i + 2), 16) * (1 - step / 20) + target * step / 20).toString(16).padStart(2, "0")).join("");
+      if (contrast(action, bg) >= 4.5) break;
+    }
+  }
+  const t = { ...tokens, colorAccent: action, colorAccentText: contrast(action, "#ffffff") >= 4.5 ? "#ffffff" : contrast(action, "#111111") >= 4.5 ? "#111111" : "#000000", colorFocus: lum(bg) < 0.2 ? "#f4d788" : "#365e85" };
+  const keys = { "color-bg": "colorBg", "color-text": "colorText", "color-muted": "colorMuted", "color-accent": "colorAccent", "color-accent-text": "colorAccentText", "color-surface": "colorSurface", "color-surface-2": "colorSurface2", "color-border": "colorBorder", "color-focus": "colorFocus", "font-body": "fontBody", "font-display": "fontDisplay", radius: "radius", max: "maxWidth" };
+  return Object.entries(keys).map(([k, v]) => `--${k}:${t[v]}`).join(";") + `;--brand-original:${brand}`;
+}
+function previewBridge(identity) {
+  return `<style>html{overscroll-behavior:contain}</style><script>(()=>{const identity=${JSON.stringify(identity)},params=new URLSearchParams(location.hash.slice(1)),nonce=params.get('bridge'),origin=params.get('parent');let ready=false;const report=(kind,extra={})=>{if(parent!==window&&nonce&&origin)parent.postMessage({channel:'vitris-specimen-v1',identity,nonce,kind,...extra},origin);};addEventListener('click',e=>{const back=e.target.closest?.('a[href]');if(parent!==window&&nonce&&origin&&back?.href==='http://127.0.0.1:4390/'){e.preventDefault();report('close');return;}const a=e.target.closest?.('a[data-page-id],a[data-page-role]');if(a&&parent!==window&&nonce&&origin){e.preventDefault();const pageId=a.dataset.pageId||a.dataset.pageRole;report('navigate',{role:pageId,pageId});}});addEventListener('vitris-remember',e=>{const d=e.detail||{};if(typeof d.key==='string')report('memory',{key:d.key,value:d.value});});const metrics=()=>({y:scrollY,height:document.documentElement.scrollHeight,viewport:innerHeight});Promise.all([document.fonts.ready,...Array.from(document.images,i=>i.decode().catch(()=>null))]).then(()=>{if(document.body.getBoundingClientRect().height>0&&document.body.innerText.trim().length>20){ready=true;report('ready',metrics());}else report('error',{message:'Preview has no visible layout.'});});addEventListener('scroll',()=>{if(ready)report('scroll',metrics());},{passive:true});new ResizeObserver(()=>{if(ready)report('resize',metrics());}).observe(document.body);addEventListener('wheel',e=>{if(e.ctrlKey||e.metaKey)return;const max=document.documentElement.scrollHeight-innerHeight;if((e.deltaY<0&&scrollY<=1)||(e.deltaY>0&&scrollY>=max-1))report('edge',{delta:e.deltaY,mode:e.deltaMode});},{passive:true});addEventListener('keydown',e=>{if(e.key==='Escape'){e.preventDefault();report('close');}});addEventListener('message',e=>{const m=e.data;if(e.source!==parent||!m||m.channel!=='vitris-specimen-v1'||m.nonce!==nonce||m.identity!==identity)return;if(m.kind==='memory'&&typeof m.key==='string'){dispatchEvent(new CustomEvent('vitris-apply',{detail:{key:m.key,value:m.value}}));return;}if(m.kind!=='scroll-to'||!Number.isFinite(m.y))return;scrollTo({top:Math.max(0,Math.min(m.y,document.documentElement.scrollHeight-innerHeight)),behavior:'instant'});if(ready)report('scroll',metrics());});})();<\/script>`;
+}
+function renderCloudPage(recipe, manifest, brand, base, identity) {
+  let html = brand.original ? recipe.original : recipe.brand;
+  const logo = brand.logo ? `<img src="${esc(brand.logo)}" alt="${esc(brand.name)}">` : `<span>${esc(brand.name)}</span>`;
+  html = html.replaceAll("__VITRIS_LOGO__", logo).replaceAll("__VITRIS_BRAND_NAME__", esc(brand.name)).replaceAll("__VITRIS_CSS_VARS__", brandVars(manifest.tokens, brand.colors));
+  const encoded = brand.original ? "" : btoa(unescape(encodeURIComponent(JSON.stringify(brand))));
+  for (const page of manifest.pages) html = html.replaceAll(new RegExp("__VITRIS_PAGE_" + page.pageId + "__(\\?[A-Za-z0-9%&=;,+|:-]*)?", "g"), (_match, suffix = "") => {
+    const params = new URLSearchParams(suffix.replaceAll("&amp;", "&"));
+    if (encoded) params.set("b", encoded);
+    return esc(base + page.path + (params.size ? "?" + params : ""));
+  });
+  html = html.replaceAll("__VITRIS_RETURN__", "http://127.0.0.1:4390/");
+  if (identity) html = html.replaceAll('loading="lazy"', 'loading="eager"').replace("</body>", previewBridge(identity) + "</body>");
+  return html;
+}
+
+// src/template-cloud/worker.ts
+var failure = (status, message) => new Response(message, { status, headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store", "access-control-allow-origin": "*" } });
+async function object(env, key) {
+  return env.R2.get(key);
+}
+function displayBrand(url, manifest) {
+  const encoded = url.searchParams.get("b");
+  if (!encoded) return { name: manifest.business, colors: [manifest.tokens.colorAccent], original: true };
+  if (encoded.length > 1e5) throw Error("Brand payload too large");
+  const b = JSON.parse(decodeURIComponent(escape(atob(encoded))));
+  if (typeof b.name !== "string" || b.name.length > 500 || !Array.isArray(b.colors) || b.colors.length > 12 || b.colors.some((c) => !/^#[a-f0-9]{6}$/.test(c)) || b.logo && !/^data:image\/(png|jpeg|webp|gif);base64,[A-Za-z0-9+/=]+$/.test(b.logo)) throw Error("Invalid display brand");
+  return { name: b.name, colors: b.colors, ...b.logo ? { logo: b.logo } : {}, original: !!b.original };
+}
+var worker_default = { async fetch(request, env) {
+  try {
+    const url = new URL(request.url), path = url.pathname;
+    if (request.method === "OPTIONS") return new Response(null, { status: 204, headers: { "access-control-allow-origin": "*", "access-control-allow-methods": "GET, HEAD, OPTIONS" } });
+    if (!["GET", "HEAD"].includes(request.method)) return failure(405, "Read-only template library");
+    if (path === "/templates/catalog.json") {
+      const found = await object(env, "templates/catalog.json");
+      if (!found) return failure(404, "Catalog not published");
+      return new Response(request.method === "HEAD" ? null : found.body, { headers: { "content-type": "application/json", "cache-control": "no-cache", "access-control-allow-origin": "*", "x-content-type-options": "nosniff" } });
+    }
+    if (/^\/templates\/(assets|objects)\/[a-f0-9]{64}\/[a-zA-Z0-9._/-]+$/.test(path) && !path.includes("..")) {
+      const found = await object(env, path.slice(1));
+      if (!found) return failure(404, "Unknown template object");
+      const headers2 = new Headers();
+      found.writeHttpMetadata(headers2);
+      headers2.set("etag", found.httpEtag);
+      headers2.set("cache-control", "public, max-age=31536000, immutable");
+      headers2.set("access-control-allow-origin", "*");
+      headers2.set("x-content-type-options", "nosniff");
+      if (request.headers.get("if-none-match") === found.httpEtag) return new Response(null, { status: 304, headers: headers2 });
+      return new Response(request.method === "HEAD" ? null : found.body, { headers: headers2 });
+    }
+    const match = path.match(/^\/templates\/(demo|preview)\/([a-f0-9]{64})\/([a-z0-9-]+)(\/.*)?$/);
+    if (!match) return failure(404, "Unknown template route");
+    const [, mode, revision, id, tail = "/"] = match;
+    const stored = await object(env, `templates/manifests/${revision}.json`);
+    if (!stored) return failure(404, "Unknown template revision");
+    const manifest = await stored.json();
+    if (manifest.id !== id || manifest.revision !== revision) return failure(404, "Template identity mismatch");
+    const preview = mode === "preview", segments = tail.split("/").filter(Boolean), identity = preview ? segments[2] : void 0;
+    if (preview && (!/^[a-f0-9]{64}$/.test(identity || "") || !["desktop", "mobile"].includes(segments[1] || "") || segments.length !== 3)) return failure(404, "Unknown preview identity");
+    const page = manifest.pages.find((p) => preview ? p.pageId === segments[0] : p.path === tail);
+    if (!page) return failure(404, "Unknown template page");
+    const recipeObject = await object(env, `templates/objects/${page.recipe}/recipe.json`);
+    if (!recipeObject) return failure(503, "Template page unavailable");
+    const html = renderCloudPage(await recipeObject.json(), manifest, displayBrand(url, manifest), url.origin + `/templates/demo/${revision}/${id}`, identity);
+    const headers = { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "access-control-allow-origin": "*", "x-content-type-options": "nosniff", "x-robots-tag": "noindex, nofollow", "referrer-policy": "no-referrer", "x-template-revision": revision, "content-security-policy": "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; img-src data: 'self'; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors * file:" };
+    return new Response(request.method === "HEAD" ? null : html, { headers });
+  } catch {
+    return failure(400, "Invalid template request");
+  }
+} };
+export {
+  worker_default as default
+};

package/bin/types/scripts/lib/r2.d.ts

@@ -0,0 +1,7 @@
+export declare const R2_BUCKET = "vitris-assets";
+export declare function loadDevVars(root: string): void;
+export declare function assetsOrigin(): string;
+export declare function publicAssetUrl(r2Key: string): string;
+export declare function putLocalR2(root: string, key: string, file: string, contentType: string): void;
+export declare function putRemoteR2(key: string, file: string, contentType: string): Promise<void>;
+export declare function writeScratchFile(path: string, data: Buffer): void;

package/bin/types/scripts/onboard/browser.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Playwright crawl: rendered DOM, lazy-scroll, full link discovery.
+ * Falls back is handled by run.ts when this throws or Chromium is missing.
+ */
+import { type CrawlResult } from "./crawl.ts";
+/**
+ * Playwright harvest. Optional maxPages is emergency abort only.
+ */
+export declare function crawlSiteBrowser(startUrl: string, maxPages?: number, kernelRoot?: string, stillsDir?: string, checkpointPath?: string, fresh?: boolean): Promise<CrawlResult>;

package/bin/types/scripts/onboard/crawl.d.ts

@@ -0,0 +1,35 @@
+import { type ExtractedPage } from "../../src/onboard/extract.ts";
+import type { VisualHints } from "../../src/onboard/brief.ts";
+import { type HarvestDiscovery, type HarvestExclusion } from "../../src/onboard/harvest-inventory.ts";
+export type CrawlResult = {
+    startUrl: string;
+    pages: ExtractedPage[];
+    warnings: string[];
+    engine: "fetch" | "playwright";
+    hints?: VisualHints;
+    stills?: string[];
+    exclusions: HarvestExclusion[];
+    unvisited: string[];
+};
+export declare function enqueue(queue: string[], seen: Set<string>, href: string, startUrl: string, discovery?: Map<string, HarvestDiscovery>, meta?: HarvestDiscovery): void;
+export declare function sitemapUrls(startUrl: string, warnings: string[]): Promise<string[]>;
+type Checkpoint = {
+    version: 2;
+    start: string;
+    pages: ExtractedPage[];
+    queue: string[];
+    visited: string[];
+    seen: string[];
+    warnings: string[];
+    stills: string[];
+    hints?: VisualHints;
+    exclusions?: HarvestExclusion[];
+    discovery?: [string, HarvestDiscovery][];
+};
+export declare function persistCheckpoint(path: string | undefined, payload: Checkpoint): void;
+/**
+ * Fetch-based crawl. Optional maxPages is an emergency abort only (undefined = unbounded).
+ * The queue visits home / about / work before legal and shop.
+ */
+export declare function crawlSite(startUrl: string, maxPages?: number, checkpointPath?: string, fresh?: boolean): Promise<CrawlResult>;
+export {};

package/bin/types/scripts/onboard/images.d.ts

@@ -0,0 +1,19 @@
+import type { BriefImage } from "../../src/onboard/brief.ts";
+import type { ExtractedImage } from "../../src/onboard/extract.ts";
+export type UploadOptions = {
+    kernelRoot: string;
+    slug: string;
+    local: boolean;
+    remote: boolean;
+    captureKey?: string;
+};
+/**
+ * Download and upload every unique non-tracking image (no MAX_IMAGES cap).
+ * Byte-hash dedupe so the same photo on many pages is stored once.
+ * Classify/shortlist are hints only — interpret owns the must-use list.
+ */
+export declare function uploadImages(images: ExtractedImage[], opts: UploadOptions): Promise<BriefImage[]>;
+/** Copy every successful harvest image into the site repo under media/harvest/. */
+export declare function copyHarvestToSite(siteRoot: string, images: BriefImage[]): void;
+/** @deprecated use copyHarvestToSite */
+export declare function copyShortlistToSite(siteRoot: string, images: BriefImage[]): void;

package/bin/types/scripts/onboard/prompt.d.ts

@@ -0,0 +1,10 @@
+import type { BusinessFacts } from "../../src/onboard/brief.ts";
+export declare function promptMissingFacts(facts: BusinessFacts, opts: {
+    noPrompt: boolean;
+}): Promise<BusinessFacts>;
+export declare function normalizeSourceUrl(url: string): string;
+export declare function promptSourceUrl(opts: {
+    noPrompt: boolean;
+    from?: string;
+    blank: boolean;
+}): Promise<string>;