caracms 0.0.0-stage → 0.2.0

package/src/files-route.ts

@@ -0,0 +1,201 @@
+/**
+ * `GET`/`HEAD /files/<hash>/<name>.<ext>` (M6c Decision 6): the library's files, streamed
+ * from the bucket (never through imgproxy), on every site, in every mode. Injected by the
+ * integration as `/files/[...path]`, so everything under `/files` reaches this module and
+ * ends at its own answers, whatever Astro's router makes of the path.
+ *
+ * **It must never become a way to read the bucket** (the spec's Watch-outs). In order:
+ *
+ * 1. Not `GET`/`HEAD`: `405`.
+ * 2. **The path, an allow-list.** The request's own pathname (as the adapter built the
+ *    URL, still percent-encoded) must be exactly a file link's: `fileKeyOf` (files.ts)
+ *    splits it into two segments, checks the hash raw (`[0-9a-f]{12}`), decodes the name
+ *    once, and `isFileKey` takes only `uploads/<hash>/<name>.<ext>` with `<ext>` in the
+ *    file-type table and no slash, backslash or control character in the name. So `..`,
+ *    `.`, `//`, a trailing `/`, `%2f`, `%5c`, a malformed escape, an image's or a
+ *    submission's key and an extension not in the table all fail here: the short `404`
+ *    (`no-store`), before anything else is asked.
+ * 3. **The query**: none, or exactly `download`. Anything else (`?x=1`, a bare `?`,
+ *    `?download&x=1`) is a `301` to the clean address, keeping `?download` when it was
+ *    there, cached a day (`public, max-age=86400`) so the CDN keeps the redirect.
+ * 4. No media variables: `503`, a neutral sentence; the missing names go to the log only.
+ * 5. **The rate limit**, its own instance (`caracms:files:rl:`, 30 per 10 minutes per
+ *    visitor, Redis at `REDIS_URL`, failing open): `429` with `Retry-After` the window.
+ * 6. The bucket's `get` for that one key: missing (or a memory object with no bytes) is
+ *    the same `404`. Otherwise the bytes, with `Content-Type` from the table, `nosniff`,
+ *    `inline` for a PDF without `?download` and `attachment` with the key's name for the
+ *    rest, and a year's immutable cache (an address never changes content), or
+ *    `private, max-age=86400` while the pre-launch password is on (the gate reads
+ *    `CARACMS_PRELAUNCH` in this same process), so a shared cache never keeps it.
+ */
+import type { APIRoute } from 'astro';
+import { clientIp } from './live/auth/request.ts';
+import { fileAddress, fileKeyOf, fileTypeOf } from './files.ts';
+import { s3Bucket, type Bucket } from './editor/server/media/bucket.ts';
+import { readImagesConfig } from './editor/server/media/config.ts';
+import { memoryMedia } from './editor/server/media/memory.ts';
+import { isProductionBuild } from './media.ts';
+import { processLimiter, resetProcessLimiter, type LimitSettings, type RateLimiter } from './forms/rate-limit.ts';
+
+export const prerender = false;
+
+/** The route's own limiter: 30 downloads per visitor per 10 minutes (Decision 6). */
+export const FILES_LIMIT: LimitSettings = { prefix: 'caracms:files:rl:', max: 30, windowMs: 10 * 60 * 1000, area: 'files', hitName: 'download' };
+const FILES_LIMITER = 'caracms.filesLimiter';
+
+/** The process's download limiter (Redis at `REDIS_URL`, else memory). */
+export function filesLimiter(env: Record<string, string | undefined> = process.env): RateLimiter {
+	return processLimiter(FILES_LIMITER, FILES_LIMIT, env);
+}
+
+/** Forget it (tests). */
+export function resetFilesLimiter(): void {
+	resetProcessLimiter(FILES_LIMITER);
+}
+
+export const NOT_FOUND_TEXT = 'Not found.\n';
+export const UNAVAILABLE_TEXT = "Downloads aren't available right now.\n";
+export const RATE_LIMITED_TEXT = 'Too many downloads from here. Try again in a few minutes.\n';
+
+export const CACHE_YEAR = 'public, max-age=31536000, immutable';
+export const CACHE_PRELAUNCH = 'private, max-age=86400';
+export const CACHE_REDIRECT = 'public, max-age=86400';
+
+type Env = Record<string, string | undefined>;
+
+export interface FileRouteContext {
+	/** Default `process.env`, read on each request. */
+	env?: Env;
+	production?: boolean;
+	/** The socket's address (Astro's `clientAddress`), read after `X-Real-IP`. */
+	clientAddress?: () => string | undefined;
+	/** Default the process's own (`filesLimiter`). */
+	limiter?: RateLimiter;
+	/** The S3 bucket's `fetch` (tests). */
+	fetch?: typeof fetch;
+	/** Server log lines (the 503's missing variables, a bucket failure). */
+	log?: (line: string) => void;
+}
+
+const text = (status: number, body: string, headers: Record<string, string> = {}, head = false) =>
+	new Response(head ? null : body, {
+		status,
+		headers: { 'Content-Type': 'text/plain; charset=utf-8', 'X-Content-Type-Options': 'nosniff', 'Cache-Control': 'no-store', ...headers },
+	});
+
+/** The query as sent: null for none, `''` for a bare `?`. A fragment never reaches a server, but is dropped if it does. */
+function rawQuery(url: string): string | null {
+	const q = url.indexOf('?');
+	if (q === -1) return null;
+	const hash = url.indexOf('#', q);
+	return url.slice(q + 1, hash === -1 ? undefined : hash);
+}
+
+/** The request's pathname, still percent-encoded (not Astro's decoded view). */
+function rawPathname(url: string): string | null {
+	try {
+		return new URL(url).pathname;
+	} catch {
+		return null;
+	}
+}
+
+const PRINTABLE_ASCII = /^[\x20-\x7e]+$/;
+/** RFC 5987's `attr-char` escapes: encodeURIComponent leaves `'()*` and `!` alone, which `filename*` can't carry raw (`'`, and the rest by caution). */
+const rfc5987 = (s: string) => encodeURIComponent(s).replace(/['()*!]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+
+/**
+ * `attachment; filename="<name>"`. The key's name is a slug, so header-safe as it is;
+ * anything a quoted string can't carry (non-ASCII, `"`, `\`) is `_` there, and the
+ * real name goes in `filename*` too.
+ */
+export function attachmentDisposition(name: string): string {
+	if (PRINTABLE_ASCII.test(name) && !/["\\]/.test(name)) return `attachment; filename="${name}"`;
+	const fallback = name.replace(/[^\x20-\x7e]|["\\]/g, '_');
+	return `attachment; filename="${fallback}"; filename*=UTF-8''${rfc5987(name)}`;
+}
+
+const prelaunchOn = (env: Env) => typeof env['CARACMS_PRELAUNCH'] === 'string' && env['CARACMS_PRELAUNCH'].trim() !== '';
+
+const logged = new Set<string>();
+const logOnce = (log: (line: string) => void, line: string) => {
+	if (logged.has(line)) return;
+	logged.add(line);
+	log(line);
+};
+
+/** The handler, Astro-free so tests call it with a plain `Request`. */
+export async function handleFileRequest(request: Request, ctx: FileRouteContext = {}): Promise<Response> {
+	const method = request.method.toUpperCase();
+	const head = method === 'HEAD';
+	if (method !== 'GET' && !head) return text(405, 'Method not allowed.\n', { Allow: 'GET, HEAD' });
+
+	// 2. The path: exactly a file key's shape, or the 404, before anything else is asked.
+	const path = rawPathname(request.url);
+	const file = path === null ? null : fileKeyOf(path);
+	const type = file ? fileTypeOf(file.key) : null;
+	if (!file || !type) return text(404, NOT_FOUND_TEXT, {}, head);
+
+	// 3. The query: none, or exactly `download`.
+	const query = rawQuery(request.url);
+	let download = false;
+	if (query !== null) {
+		const parts = query.split('&');
+		download = parts.some((p) => p.split('=')[0] === 'download');
+		if (query !== 'download') {
+			return new Response(null, { status: 301, headers: { Location: fileAddress(file.key, { download }), 'Cache-Control': CACHE_REDIRECT } });
+		}
+	}
+
+	// 4. The media variables.
+	const env = ctx.env ?? process.env;
+	const log = ctx.log ?? ((line: string) => console.error(line));
+	const config = readImagesConfig(env, ctx.production ?? isProductionBuild());
+	if (config.kind === 'unset') {
+		logOnce(log, `[caracms] files: /files/ answers 503: ${config.message}${config.missing.length ? ` (missing: ${config.missing.join(', ')})` : ''}`);
+		return text(503, UNAVAILABLE_TEXT, {}, head);
+	}
+
+	// 5. The visitor's allowance.
+	const limiter = ctx.limiter ?? filesLimiter(env);
+	if (await limiter.hit(clientIp(request, ctx.clientAddress ?? (() => undefined)))) {
+		return text(429, RATE_LIMITED_TEXT, { 'Retry-After': String(Math.ceil(FILES_LIMIT.windowMs / 1000)) }, head);
+	}
+
+	// 6. The one key the allow-list passed.
+	const bucket: Bucket = config.kind === 'memory' ? memoryMedia().bucket : s3Bucket(config.bucket, ctx.fetch);
+	let object;
+	try {
+		object = await bucket.get(file.key);
+	} catch (error) {
+		log(`[caracms] files: couldn't read ${file.key} from the bucket: ${error instanceof Error ? error.message : String(error)}`);
+		return text(503, UNAVAILABLE_TEXT, {}, head);
+	}
+	if (!object) return text(404, NOT_FOUND_TEXT, {}, head);
+
+	const name = file.key.slice(file.key.lastIndexOf('/') + 1);
+	const headers: Record<string, string> = {
+		'Content-Type': type.contentType,
+		'X-Content-Type-Options': 'nosniff',
+		'Content-Disposition': type.opensInTab && !download ? 'inline' : attachmentDisposition(name),
+		'Cache-Control': prelaunchOn(env) ? CACHE_PRELAUNCH : CACHE_YEAR,
+	};
+	if (object.size !== null) headers['Content-Length'] = String(object.size);
+	if (head) {
+		await object.body.cancel().catch(() => {});
+		return new Response(null, { status: 200, headers });
+	}
+	return new Response(object.body, { status: 200, headers });
+}
+
+export const ALL: APIRoute = (context) =>
+	handleFileRequest(context.request, {
+		// Astro's getter throws where the adapter gives no address (tests' containers).
+		clientAddress: () => {
+			try {
+				return context.clientAddress;
+			} catch {
+				return undefined;
+			}
+		},
+	});

package/src/files.ts

@@ -0,0 +1,116 @@
+/**
+ * Files in the library (M6c G4; notes/2026-10-17-m6c-downloads-grid.md → Contracts): the
+ * one table of file types, and a file's public address as a pure function of its key.
+ * **Browser-safe** (no imports): the sniffer, the public route, the link picker, the
+ * library, Replace, the missing-file check, `mediaUses` and `<Link>` all read these, and
+ * none of them parses a `/files/` address its own way.
+ *
+ * - A file is stored as `uploads/<12 hex>/<name>.<ext>` (Decisions 1–2), `<ext>` one of
+ *   the table's, from the sniffed bytes.
+ * - Its address is the key without `uploads/`: `/files/<hash>/<name>.<ext>`, each segment
+ *   percent-encoded (slugs keep non-ASCII letters), and `?download` when a PDF link should
+ *   download rather than open in a tab (Decisions 3 and 5).
+ * - **A file link** is an address under `/files/` of a key's exact shape, with or without
+ *   `?download` or a fragment (Decision 4). `/brochure.pdf` from `public/` is not one.
+ */
+
+export interface FileType {
+	/** The key's extension, lower case, no dot. */
+	ext: string;
+	/** The `Content-Type` the public route answers with. */
+	contentType: string;
+	/** What the editor calls it: "PDF", "Word", … */
+	label: string;
+	/** Opens in a browser tab (PDF only), so its links get the New tab / Download toggle (Decision 5). */
+	opensInTab: boolean;
+}
+
+/** Decision 1's types, in the order the editor lists them. */
+export const FILE_TYPES: readonly FileType[] = [
+	{ ext: 'pdf', contentType: 'application/pdf', label: 'PDF', opensInTab: true },
+	{ ext: 'docx', contentType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', label: 'Word', opensInTab: false },
+	{ ext: 'doc', contentType: 'application/msword', label: 'Word', opensInTab: false },
+	{ ext: 'xlsx', contentType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', label: 'Excel', opensInTab: false },
+	{ ext: 'xls', contentType: 'application/vnd.ms-excel', label: 'Excel', opensInTab: false },
+	{ ext: 'pptx', contentType: 'application/vnd.openxmlformats-officedocument.presentationml.presentation', label: 'PowerPoint', opensInTab: false },
+	{ ext: 'ppt', contentType: 'application/vnd.ms-powerpoint', label: 'PowerPoint', opensInTab: false },
+	{ ext: 'csv', contentType: 'text/csv; charset=utf-8', label: 'CSV', opensInTab: false },
+	{ ext: 'zip', contentType: 'application/zip', label: 'Zip', opensInTab: false },
+];
+
+const BY_EXT = new Map(FILE_TYPES.map((t) => [t.ext, t]));
+
+/** The type a key or name ends in, or null when it isn't one of the table's. */
+export function fileTypeOf(keyOrName: string): FileType | null {
+	const m = /\.([a-z0-9]+)$/i.exec(keyOrName);
+	return m ? (BY_EXT.get(m[1]!.toLowerCase()) ?? null) : null;
+}
+
+/** The address prefix, and the folder every key lives in. */
+export const FILES_BASE = '/files/';
+export const UPLOADS_PREFIX = 'uploads/';
+
+/** A file's name part: no slash, backslash or control character, something before a table extension. */
+const NAME = /^[^/\\\u0000-\u001f\u007f]+\.([a-z0-9]+)$/;
+const HASH = /^[0-9a-f]{12}$/;
+
+/** Is this a file's key (`uploads/<hash>/<name>.<ext>`, `<ext>` in the table)? Images and submissions aren't. */
+export function isFileKey(key: unknown): key is string {
+	if (typeof key !== 'string' || !key.startsWith(UPLOADS_PREFIX)) return false;
+	const parts = key.slice(UPLOADS_PREFIX.length).split('/');
+	if (parts.length !== 2 || !HASH.test(parts[0]!)) return false;
+	const m = NAME.exec(parts[1]!);
+	return !!m && BY_EXT.has(m[1]!) && parts[1] !== `.${m[1]}`;
+}
+
+/** A file key's public address: `/files/<hash>/<name>.<ext>`, each segment encoded, `?download` when asked. */
+export function fileAddress(key: string, options: { download?: boolean } = {}): string {
+	if (!isFileKey(key)) throw new Error(`Not a file key: ${key}`);
+	const [hash, name] = key.slice(UPLOADS_PREFIX.length).split('/') as [string, string];
+	return `${FILES_BASE}${hash}/${encodeURIComponent(name)}${options.download ? '?download' : ''}`;
+}
+
+/**
+ * The inverse: the key and download flag an address names, or null when it isn't a file
+ * link. A fragment is ignored; the query must be empty or exactly `download`. The name is
+ * decoded once; an encoded slash, a malformed escape or anything not of a key's shape is
+ * null. (The public route answers other queries with a 301 first; this is the link side.)
+ */
+export function fileKeyOf(address: unknown): { key: string; download: boolean } | null {
+	if (typeof address !== 'string' || !address.startsWith(FILES_BASE)) return null;
+	let rest = address.slice(FILES_BASE.length);
+	const hashAt = rest.indexOf('#');
+	if (hashAt !== -1) rest = rest.slice(0, hashAt);
+	let download = false;
+	const q = rest.indexOf('?');
+	if (q !== -1) {
+		const query = rest.slice(q + 1);
+		if (query !== 'download') return null;
+		download = true;
+		rest = rest.slice(0, q);
+	}
+	const parts = rest.split('/');
+	if (parts.length !== 2) return null;
+	let name: string;
+	try {
+		name = decodeURIComponent(parts[1]!);
+	} catch {
+		return null;
+	}
+	const key = `${UPLOADS_PREFIX}${parts[0]}/${name}`;
+	return isFileKey(key) ? { key, download } : null;
+}
+
+/** Is this address a file link (Decision 4)? */
+export const isFileLink = (address: unknown): boolean => fileKeyOf(address) !== null;
+
+/**
+ * How a file link behaves on the site (Decision 11), or null for any other address: a PDF
+ * without `?download` opens in a new tab; every other file link downloads. `<Link>` and
+ * rich text's render use this; a site's own markup can too.
+ */
+export function fileLinkBehaviour(address: unknown): 'new-tab' | 'download' | null {
+	const file = fileKeyOf(address);
+	if (!file) return null;
+	return fileTypeOf(file.key)?.opensInTab && !file.download ? 'new-tab' : 'download';
+}

package/src/forms/email.ts

@@ -0,0 +1,149 @@
+/**
+ * The submission's email (M6 Decision 8; `forms.md` → Recipients and email): one
+ * plain-text email per stored submission, through the package's sender (../email.ts).
+ *
+ * - **Recipients and the brand name are read from the deployed Site Settings file**
+ *   (`content/site-settings.json` on disk: `formRecipients.<form id>`, `brand.name`), so
+ *   a change applies once it's published and deployed. Unreadable: the email is recorded
+ *   `failed` with "Could not read Site Settings".
+ * - Every field in the form's order by its label, a select by its option's label; the
+ *   files by name and size, **never attached, never linked to the bucket**; the receive
+ *   time in the site's zone; one link to the submission in the editor.
+ * - Subject `<the form's email subject> — <brand name> website`, from `FORMS_FROM`,
+ *   Reply-To the visitor's address when it looks like one.
+ * - Addresses are checked again here (Decision 14's third check): trimmed, a duplicate
+ *   dropped, one that doesn't look like an address skipped. An empty list is `skipped`.
+ * - **Only a production server sends.** Elsewhere the email is written to the log and
+ *   recorded `skipped`, saying so.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { SITE_SETTINGS_FILE } from '../reserved.ts';
+import { sendEmail, sendsEmail } from '../email.ts';
+import { formatBytes, looksLikeEmail, shownFileName, submissionAddress, type ResolvedForm } from './rules.ts';
+import type { EmailOutcome, StoredSubmission } from './store.ts';
+
+type Env = Record<string, string | undefined>;
+
+export interface FormSettings {
+	/** Site Settings' `brand.name`, trimmed; '' when it has none. */
+	brandName: string;
+	/** `formRecipients` as written, each list's entries trimmed (strings only). */
+	recipients: Record<string, string[]>;
+}
+
+/** The settings out of a parsed Site Settings document. */
+export function formSettingsFrom(doc: unknown): FormSettings {
+	const o = (doc && typeof doc === 'object' ? doc : {}) as Record<string, unknown>;
+	const brand = (o.brand && typeof o.brand === 'object' ? o.brand : {}) as Record<string, unknown>;
+	const lists = (o.formRecipients && typeof o.formRecipients === 'object' && !Array.isArray(o.formRecipients) ? o.formRecipients : {}) as Record<string, unknown>;
+	const recipients: Record<string, string[]> = {};
+	for (const [id, list] of Object.entries(lists)) {
+		recipients[id] = Array.isArray(list) ? list.filter((v): v is string => typeof v === 'string').map((v) => v.trim()) : [];
+	}
+	return { brandName: typeof brand.name === 'string' ? brand.name.trim() : '', recipients };
+}
+
+/** Read the deployed file, on every submission (a few KB, no cache to go stale). Throws when it's missing or not JSON. */
+export async function readFormSettings(root: string): Promise<FormSettings> {
+	return formSettingsFrom(JSON.parse(await readFile(join(root, SITE_SETTINGS_FILE), 'utf8')));
+}
+
+/** Trimmed, de-duplicated (without case), only what looks like an address: who the email goes to. */
+export function sendableAddresses(values: readonly unknown[]): string[] {
+	const out: string[] = [];
+	const seen = new Set<string>();
+	for (const value of values) {
+		if (typeof value !== 'string') continue;
+		const address = value.trim();
+		if (!looksLikeEmail(address) || seen.has(address.toLowerCase())) continue;
+		seen.add(address.toLowerCase());
+		out.push(address);
+	}
+	return out;
+}
+
+/** "25 September 2026, 9:14 pm" in the site's zone. */
+export function receivedText(iso: string, timeZone: string): string {
+	const date = new Date(iso);
+	if (Number.isNaN(date.getTime())) return iso;
+	const parts = new Intl.DateTimeFormat('en-GB', { timeZone, day: 'numeric', month: 'long', year: 'numeric', hour: 'numeric', minute: '2-digit', hour12: true }).formatToParts(date);
+	const part = (type: string) => parts.find((p) => p.type === type)?.value ?? '';
+	return `${part('day')} ${part('month')} ${part('year')}, ${part('hour')}:${part('minute')} ${part('dayPeriod').toLowerCase()}`;
+}
+
+/** The subject, the plain-text body and the Reply-To. */
+export function buildNotification(input: { submission: StoredSubmission; form: ResolvedForm | null; brandName: string; siteUrl: string | null; timeZone: string }): {
+	subject: string;
+	text: string;
+	replyTo?: string;
+} {
+	const { submission, form, siteUrl, timeZone } = input;
+	const site = input.brandName.trim();
+	const formLabel = form?.label ?? submission.form;
+	const lines = [`Someone sent the ${formLabel} form on the ${site || 'your'} website.`, ''];
+	const push = (label: string, value: string) => {
+		if (value.includes('\n')) lines.push(`${label}:`, value, '');
+		else lines.push(`${label}: ${value}`);
+	};
+	const stored = submission.fields ?? {};
+	const shown = new Set<string>();
+	for (const field of form?.fields ?? []) {
+		shown.add(field.name);
+		if (field.type === 'files') {
+			const files = submission.files ?? [];
+			if (files.length) lines.push(`${field.label}:`, ...files.map((f) => `${shownFileName(f.name) || shownFileName(f.key)}, ${formatBytes(f.size)}`), '');
+			continue;
+		}
+		const value = typeof stored[field.name] === 'string' ? stored[field.name]!.trim() : '';
+		push(field.label, field.type === 'select' ? (field.options?.find((o) => o.value === value)?.label ?? value) : value);
+	}
+	// Anything stored that the form no longer names (a form changed since), by name.
+	for (const [name, value] of Object.entries(stored)) if (!shown.has(name)) push(name, String(value ?? '').trim());
+	if (!form && submission.files?.length) lines.push('Files:', ...submission.files.map((f) => `${shownFileName(f.name) || shownFileName(f.key)}, ${formatBytes(f.size)}`), '');
+	if (lines[lines.length - 1] !== '') lines.push('');
+	lines.push(`Received: ${receivedText(submission.receivedAt, timeZone)}`);
+	const visitor = typeof stored.email === 'string' ? stored.email.trim() : '';
+	const replyTo = looksLikeEmail(visitor) ? visitor : undefined;
+	if (replyTo) lines.push('Reply to this email to answer them.');
+	// With no public origin there is no link: a Host header could be anyone's, so the email says where to look instead.
+	if (siteUrl) lines.push('', submission.files?.length ? 'Open it in the editor (the files download there):' : 'Open it in the editor:', new URL(submissionAddress(submission.id), siteUrl).href);
+	else lines.push('', submission.files?.length ? 'Open Site-wide → Submissions in the editor (the files download there).' : 'Open Site-wide → Submissions in the editor.');
+	return {
+		subject: `${form?.email.subject ?? `New ${submission.form} enquiry`} — ${site ? `${site} website` : 'your website'}`,
+		text: `${lines.join('\n')}\n`,
+		...(replyTo ? { replyTo } : {}),
+	};
+}
+
+/** Send a submission's email and say what happened (the outcome recorded on it). Never throws. */
+export async function sendNotification(input: {
+	submission: StoredSubmission;
+	form: ResolvedForm | null;
+	settings: FormSettings;
+	siteUrl: string | null;
+	timeZone: string;
+	env?: Env;
+	fetch?: typeof fetch;
+	now?: () => Date;
+	log?: (line: string) => void;
+}): Promise<EmailOutcome> {
+	const env = input.env ?? process.env;
+	const at = (input.now ?? (() => new Date()))().toISOString();
+	const log = input.log ?? ((line: string) => console.log(line));
+	const to = sendableAddresses(input.settings.recipients[input.submission.form] ?? []);
+	const label = input.form?.label ?? input.submission.form;
+	if (to.length === 0) return { status: 'skipped', at, to, error: `No one is set to get the ${label} form's emails (Site Settings → Form emails).` };
+	let built: ReturnType<typeof buildNotification>;
+	try {
+		built = buildNotification({ submission: input.submission, form: input.form, brandName: input.settings.brandName, siteUrl: input.siteUrl, timeZone: input.timeZone });
+	} catch (error) {
+		return { status: 'failed', at, to, error: `Could not write the email: ${error instanceof Error ? error.message : String(error)}` };
+	}
+	if (!sendsEmail(env)) {
+		log(`[caracms] form email for ${input.submission.id} (not emailed outside production), to ${to.join(', ')}:\nSubject: ${built.subject}\n${built.text}`);
+		return { status: 'skipped', at, to, error: 'Not emailed: only the production server sends email. It was written to the server log.' };
+	}
+	const result = await sendEmail({ to, subject: built.subject, text: built.text, replyTo: built.replyTo }, { env, fetch: input.fetch });
+	return result.status === 'sent' ? { status: 'sent', at, to } : { status: result.status, at, to, error: result.error };
+}