@elytracms/next 0.0.93 → 0.0.94

package/dist/index.d.ts

@@ -13,6 +13,7 @@ import { Clock } from '@elytracms/core/determinism';
 import { ResolvingMetadata, Metadata, ResolvedMetadata, MetadataRoute } from 'next';
 import { RevalidationEvent } from '@elytracms/core/revalidation';
 export { REVALIDATE_SIGNATURE_HEADER, RevalidationEvent, RevalidationEventKind, revalidationEventSchema, signRevalidationBody, signedRevalidationRequest } from '@elytracms/core/revalidation';
+import { IngestPayload } from '@elytracms/core/ingest';
 import { ImageLoader } from 'next/image';
 import { HostImageRenderer } from './host-image.js';
 export { z } from 'zod';
@@ -378,6 +379,25 @@ interface CanvasWrapContext extends CanvasRequestInfo {
      */
     result: ResolvePageResult;
 }
+/**
+ * EC-618 — what the route's `analytics` slot is told about the page it renders on: the
+ * resolved document (the content model, not the URL — slug changes and locale paths then
+ * attribute correctly), the locale it rendered in, the request path and the status. Plain
+ * serializable values, so the slot may be a client component.
+ */
+interface CanvasBeaconProps {
+    /** The request path as served (including any locale prefix). */
+    path: string;
+    /** 200: the route renders the slot only on a rendered page (a 404 never reaches it). */
+    status: 200;
+    /** The locale the page rendered in. */
+    locale: string;
+    /** The resolved document's collection and id — absent when the URL resolved to no document. */
+    collection?: string;
+    documentId?: string;
+}
+/** PURE core (EC-618): the slot's props from a render outcome's resolution and the request info. */
+declare function canvasBeaconProps(result: ResolvePageResult, info: CanvasRequestInfo): CanvasBeaconProps;
 type CanvasPageOutcome = {
     kind: 'redirect';
     target: string;
@@ -729,6 +749,21 @@ interface CanvasRouteOptions {
      * the default.
      */
     wrap?: (children: ReactNode, ctx: CanvasWrapContext) => ReactNode;
+    /**
+     * The ANALYTICS slot (EC-618): a component the route renders inside every `render`
+     * outcome, AFTER the page (and outside `wrap`, so a wrapper cannot drop it), with the
+     * resolved document, the locale, the path and the status ({@link CanvasBeaconProps}).
+     * Published perspective only — a draft preview is an editor at work, not a visit.
+     *
+     * The engine supplies the slot and nothing else: its value is the beacon of the
+     * analytics addon, `@elytracms/analytics/next` — **unpublished, pending counsel's
+     * verdict on its consent-free claim** (EC-618) — or a host's own component. Absent, the
+     * route renders exactly what it rendered before, and sends nothing.
+     *
+     * A not-found page never reaches this slot (`notFound()` renders the host's
+     * `not-found.tsx`), so a 404 beacon lives in that file.
+     */
+    analytics?: ComponentType<CanvasBeaconProps>;
 }
 interface CanvasRouteProps {
     params: Promise<{
@@ -1058,6 +1093,177 @@ interface RevalidateRouteHandlers {
  */
 declare function createRevalidateRoute(options: RevalidateRouteOptions): RevalidateRouteHandlers;
 
+/**
+ * EC-617 — the pure decision core of the PUBLIC INGEST route (`createIngestRoute`, the
+ * Next wrapper in `ingest.ts`): no Next imports, no network, an injected clock — the
+ * house "pure core + thin wrapper" shape of `evaluateRevalidateRequest` /
+ * `createRevalidateRoute`.
+ *
+ * The route is a site's one public write path (ruling EC-565 § 6c). It runs, in order:
+ *
+ * 1. **method** — `POST` only (405);
+ * 2. **configured** — the server-held `INGEST_SECRET` and the receiver URL are set (503
+ *    otherwise: the route stays closed until deliberately configured, never a no-op);
+ * 3. **same-origin** — a browser request from another origin (`Origin` / `Sec-Fetch-Site`)
+ *    is refused (403). The route emits no CORS headers and reads no cookie;
+ * 4. **rate limit** — a fixed window per CLIENT KEY (429, `Retry-After`);
+ * 5. **size** — the raw body capped at `maxBodyBytes` (413), checked before parsing;
+ * 6. **shape** — JSON in the ingest envelope (400, with the issues);
+ * 7. **bot gate** — the host's own check, an injected seam (403, `{ gate: 'bot' }`): the
+ *    engine supplies the slot, never the vendor;
+ * 8. **enrichment** (EC-618) — an optional seam an ADDON fills (the analytics addon derives
+ *    a country and a visitor's sketch coordinates here, where the request is): it returns the
+ *    payload to forward, which is re-validated against the envelope and the receiver's cap
+ *    (500 — the site's own fault — when it throws or returns something invalid). Absent, the
+ *    route is exactly what it was;
+ *
+ * then the wrapper signs the payload with the server-held secret and forwards it to the
+ * one Convex receiver, relaying its answer. Only the PAYLOAD is forwarded — never a request
+ * header — so whatever an enrichment reads from the request (the client address, the user
+ * agent, a geo header) stays in this request's memory; only what it derives travels.
+ */
+/** The answer the core gives the wrapper. */
+type IngestEvaluation = {
+    ok: true;
+    payload: IngestPayload;
+} | {
+    ok: false;
+    status: 400 | 403 | 405 | 413 | 429 | 500 | 503;
+    body: Record<string, unknown>;
+    headers?: Record<string, string>;
+};
+/** What the host's bot gate answers (a Turnstile / hCaptcha / honeypot check the HOST implements). */
+type BotGateVerdict = {
+    allow: true;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * The bot-gate seam: called with the request and the parsed payload, AFTER the cheap
+ * checks (so a flood never reaches a paid verification API). Absent → no gate.
+ */
+type IngestBotGate = (input: {
+    request: Request;
+    payload: IngestPayload;
+}) => BotGateVerdict | Promise<BotGateVerdict>;
+/**
+ * EC-618 — the enrichment seam: called with the request and the parsed payload LAST (after
+ * the bot gate), it returns the payload the route signs and forwards. The engine supplies
+ * the slot, never the code: an addon fills it (`@elytracms/analytics/next`'s
+ * `analyticsEnrichment`), and a host may compose its own. Whatever it reads from the
+ * request is held for this request only — the route forwards the returned payload and
+ * nothing else. Absent → no enrichment, the payload forwarded as parsed.
+ */
+type IngestEnrich = (input: {
+    request: Request;
+    payload: IngestPayload;
+}) => IngestPayload | Promise<IngestPayload>;
+/**
+ * The fixed-window limiter — the AI route's pattern (EC-602), keyed per client. Holds,
+ * in memory only, one `{ windowStart, count }` per key seen in the current window; expired
+ * windows are dropped as the clock moves, so the map is bounded by the clients of one
+ * window. Each server instance holds its own windows (a serverless platform runs several),
+ * so the limit is per instance — the same documented limitation as the AI route.
+ */
+interface FixedWindowLimiter {
+    /** Count one request for `key`; `retryAfterSeconds` when it is over the limit. */
+    hit(key: string): {
+        allowed: true;
+    } | {
+        allowed: false;
+        retryAfterSeconds: number;
+    };
+    /** How many keys the limiter currently holds (for the bound test). */
+    size(): number;
+}
+declare function createFixedWindowLimiter(options: {
+    limit: number;
+    windowMs?: number;
+    now?: () => number;
+}): FixedWindowLimiter;
+/**
+ * The DEFAULT client key: the first hop of `x-forwarded-for` (what Vercel and most proxies
+ * set), else `x-real-ip`, else one shared `unknown` bucket. An IP address is personal
+ * data: it is held ONLY as a key of the in-memory window above, for at most one window,
+ * and is never stored, logged or forwarded to the receiver. A host that wants a different
+ * key (a hashed one, a session id) passes `clientKey`.
+ */
+declare function defaultIngestClientKey(request: Request): string;
+/** Is this a cross-origin BROWSER request? (A request with no browser headers is not judged here.) */
+declare function isCrossOrigin(request: Request): boolean;
+interface IngestEvaluationInput {
+    request: Request;
+    /** The raw body, read by the wrapper up to `maxBodyBytes + 1` bytes (`undefined` when over). */
+    rawBody: string | undefined;
+    configured: boolean;
+    limiter: FixedWindowLimiter;
+    clientKey: (request: Request) => string;
+    botGate?: IngestBotGate;
+    enrich?: IngestEnrich;
+}
+/** Evaluate one request (see the module header for the order). */
+declare function evaluateIngestRequest(input: IngestEvaluationInput): Promise<IngestEvaluation>;
+/**
+ * Read a request body as text, at most `maxBytes` (counted in UTF-8 bytes). `undefined`
+ * when it is longer — the over-size body is never buffered whole. A declared
+ * `Content-Length` over the cap is refused before a byte is read.
+ */
+declare function readCappedBody(request: Request, maxBytes?: number): Promise<string | undefined>;
+
+/**
+ * EC-617 — the PUBLIC INGEST route: a site's one write path into its project (form
+ * submissions, analytics events, upload URLs), mounted SAME-ORIGIN in the site's own
+ * App Router:
+ *
+ * ```ts
+ * // frontend/app/api/ingest/route.ts — through the delivery kit
+ * export const { POST } = elytra.ingestRoute()
+ * ```
+ *
+ * The decisions are the pure core's (`evaluateIngestRequest`: method, configured,
+ * same-origin, rate limit, size, shape, the host's bot gate); this wrapper then SIGNS the
+ * payload with the server-held `INGEST_SECRET` (it never reaches a browser) and forwards it
+ * to the deployment's ONE receiver (`<deployment>.convex.site/elytra/ingest`), relaying the
+ * receiver's answer. A receiver that rejects the signature is a SITE misconfiguration
+ * (the two secrets differ), answered 502 with that sentence — never a 401 a visitor could
+ * read as their fault.
+ *
+ * Uploads leave same-origin by design: an `upload` payload asks the receiver for ONE
+ * short-lived storage URL (the request rides this route's gate, limiter and bot gate), and
+ * the browser then sends the bytes straight to that URL; the submission that follows claims
+ * the stored file, which is checked against what the upload request declared.
+ */
+interface IngestRouteOptions {
+    /** The server-held HMAC secret (= the deployment's `ELYTRA_INGEST_SECRET`). Unset → 503. */
+    secret: string | undefined;
+    /** The deployment's HTTP origin (`https://<name>.convex.site`); the receiver path is appended. Unset → 503. */
+    siteUrl: string | undefined;
+    /** Cap on the raw JSON body, ≤ the receiver's `INGEST_MAX_BODY_BYTES` (default). */
+    maxBodyBytes?: number;
+    /** Requests per client key per minute (default 30). */
+    maxRequestsPerMinute?: number;
+    /** The rate limiter's key for a request (default: the client IP, in memory only — see `defaultIngestClientKey`). */
+    clientKey?: (request: Request) => string;
+    /** The host's bot check (Turnstile, hCaptcha, a honeypot …). The engine supplies the slot, never the vendor. */
+    botGate?: IngestBotGate;
+    /**
+     * EC-618 — an addon's enrichment, run last: it returns the payload to sign and forward
+     * (the analytics addon adds a country and the visitor's sketch coordinates, derived from
+     * the request here and never forwarded raw). Absent → the payload is forwarded as parsed.
+     */
+    enrich?: IngestEnrich;
+    /** Injected clock (tests). */
+    now?: () => number;
+    /** Injected transport (tests). */
+    fetchImpl?: typeof fetch;
+}
+interface IngestRouteHandlers {
+    POST(request: Request): Promise<Response>;
+}
+/** Create the ingest route handler (see the module header). */
+declare function createIngestRoute(options: IngestRouteOptions): IngestRouteHandlers;
+
 /**
  * Image delivery for the embedded runtime (EC-152).
  *
@@ -1253,6 +1459,8 @@ declare function elytraHostImage(options?: ElytraHostImageOptions): HostImageRen
  * |                       | equal the Convex deployment's own env var)           |
  * | `REVALIDATE_SECRET`   | Instant-publish webhook HMAC secret (must equal the  |
  * |                       | deployment's `CANVAS_REVALIDATE_SECRET`)             |
+ * | `INGEST_SECRET`       | Public-ingest HMAC secret (EC-617; must equal the    |
+ * |                       | deployment's `ELYTRA_INGEST_SECRET`)                 |
  *
  * EC-579 retired `STUDIO_ORIGIN` (the CORS origin of the studio's deleted browser
  * dispatcher): the one emitter is the Convex deployment, server to server.
@@ -1263,12 +1471,14 @@ declare const ELYTRA_HOST_ENV_KEYS: {
     readonly projectId: "ELYTRA_PROJECT_ID";
     readonly draftToken: "DRAFT_PREVIEW_TOKEN";
     readonly revalidateSecret: "REVALIDATE_SECRET";
+    readonly ingestSecret: "INGEST_SECRET";
 };
 interface ElytraHostEnv {
     convexUrl?: string;
     projectId?: string;
     draftToken?: string;
     revalidateSecret?: string;
+    ingestSecret?: string;
 }
 /**
  * Resolve the kit's env bag from a raw env record (`process.env` by default at
@@ -1585,6 +1795,12 @@ interface HostCanvasRouteOptions {
      * invalidation — a disagreement would drop nothing, silently.
      */
     published?: CanvasRouteOptions['published'];
+    /**
+     * EC-618 — the analytics slot (see `CanvasRouteOptions.analytics`): its value is an
+     * addon's beacon (`@elytracms/analytics/next`, unpublished pending counsel). Absent →
+     * nothing renders and nothing is sent.
+     */
+    analytics?: CanvasRouteOptions['analytics'];
 }
 interface LoadGlobalsOptions {
     /** Perspective of the chrome read. Default `'published'` (live is published-only). */
@@ -1705,6 +1921,15 @@ interface ElytraHost<Collections extends readonly CollectionDef[] = readonly Col
     previewRoute(): PreviewRouteHandlers;
     /** The draft-mode DISABLE route (no token — it only reduces visibility). */
     previewDisableRoute(): PreviewRouteHandlers;
+    /**
+     * EC-617 — the PUBLIC INGEST route for `app/api/ingest/route.ts`: the site's one write path
+     * (form submissions, analytics events, upload URLs), signed with `INGEST_SECRET` and
+     * forwarded to this deployment's receiver (its HTTP origin derived from
+     * `ELYTRA_CONVEX_URL`; pass `siteUrl` for a self-hosted backend). Unset secret or no
+     * backend = 503, closed. The rate limit, the client key and the bot gate are the host's to
+     * tune — the engine supplies the slots, never a vendor.
+     */
+    ingestRoute(options?: Partial<Omit<IngestRouteOptions, 'secret'>>): IngestRouteHandlers;
     /**
      * Does the page for this catch-all `slug` OPEN full-bleed? Manifest-driven
      * (`presentation.fullBleed`, EC-368) and draft-mode aware — the host lays out
@@ -1870,4 +2095,4 @@ declare function evaluatePreviewRequest(requestUrl: string | URL, expectedToken:
  */
 declare const PACKAGE = "@elytracms/next";
 
-export { type AssetImageLoaderOptions, type BakedListing, CANVAS_VALIDATION_SLUG, type CanvasCacheKey, type CanvasContentRequest, type CanvasPageOutcome, CanvasRenderer, type CanvasRendererProps, type CanvasRequestInfo, type CanvasRoute, type CanvasRouteOptions, type CanvasRouteProps, type CanvasSitemapOptions, type CanvasSitemapResult, type CanvasWrapContext, type ContentSnapshot, type ContentSnapshotOptions, type ContentSource, type CreateCanvasSitemapOptions, type DeliveryPresentation, ELYTRA_HOST_ENV_KEYS, type ElytraContentMode, type ElytraHost, type ElytraHostEnv, type ElytraHostImageOptions, type ElytraHostOptions, ElytraImage, type ElytraImageAsset, type ElytraImageProps, type GlobalsConventions, type HostCanvasRouteOptions, type HostComponent, type HostComponents, type LiveContentOptions, type LoadGlobalsOptions, type NextImageOptions, PACKAGE, type PreviewEvaluation, type PreviewRouteHandlers, type PreviewRouteOptions, type ResolveCanvasPageOptions, type ResolveGlobalsOptions, type ResolvedLink, type ResolvedNavEntry, type ResolvedNavLink, type RevalidateEvaluation, type RevalidateRouteHandlers, type RevalidateRouteOptions, type RevalidationProject, type SeoMetadataContext, type SiteGlobals, type SitemapSkippedRoute, type StaticContentData, assembleLiveSource, bodyItemsOf, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, openGraphLocale, pathFromSlug, projectSweepTag, requestPerspective, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag, seoContextOf, seoMetadata, seoObjectOf, withNextImage };
+export { type AssetImageLoaderOptions, type BakedListing, type BotGateVerdict, CANVAS_VALIDATION_SLUG, type CanvasBeaconProps, type CanvasCacheKey, type CanvasContentRequest, type CanvasPageOutcome, CanvasRenderer, type CanvasRendererProps, type CanvasRequestInfo, type CanvasRoute, type CanvasRouteOptions, type CanvasRouteProps, type CanvasSitemapOptions, type CanvasSitemapResult, type CanvasWrapContext, type ContentSnapshot, type ContentSnapshotOptions, type ContentSource, type CreateCanvasSitemapOptions, type DeliveryPresentation, ELYTRA_HOST_ENV_KEYS, type ElytraContentMode, type ElytraHost, type ElytraHostEnv, type ElytraHostImageOptions, type ElytraHostOptions, ElytraImage, type ElytraImageAsset, type ElytraImageProps, type FixedWindowLimiter, type GlobalsConventions, type HostCanvasRouteOptions, type HostComponent, type HostComponents, type IngestBotGate, type IngestEnrich, type IngestEvaluation, type IngestRouteHandlers, type IngestRouteOptions, type LiveContentOptions, type LoadGlobalsOptions, type NextImageOptions, PACKAGE, type PreviewEvaluation, type PreviewRouteHandlers, type PreviewRouteOptions, type ResolveCanvasPageOptions, type ResolveGlobalsOptions, type ResolvedLink, type ResolvedNavEntry, type ResolvedNavLink, type RevalidateEvaluation, type RevalidateRouteHandlers, type RevalidateRouteOptions, type RevalidationProject, type SeoMetadataContext, type SiteGlobals, type SitemapSkippedRoute, type StaticContentData, assembleLiveSource, bodyItemsOf, canvasBeaconProps, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createFixedWindowLimiter, createIngestRoute, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defaultIngestClientKey, defineHostComponents, docCacheTag, elytraHostImage, evaluateIngestRequest, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, isCrossOrigin, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, openGraphLocale, pathFromSlug, projectSweepTag, readCappedBody, requestPerspective, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag, seoContextOf, seoMetadata, seoObjectOf, withNextImage };

package/dist/index.js

@@ -1,15 +1,17 @@
 import { registerComponents, createRenderContext, renderDocumentBodyItems, documentBodyItems, serializeListingQuery, documentBodyRichTextValues, documentBodyCompositionNodes, richTextEmbedsInValue, collectReferencedAssetIds, collectRichTextRefsInValue, collectReferencedRelations, collectReferencedListings, collectReferencedRichTextLinks, listingRequestOf } from '@elytracms/core/runtime-renderer';
 import { isBlockSequenceValueShape } from '@elytracms/core/rich-text';
-import { jsx, Fragment } from 'react/jsx-runtime';
+import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
 import { cacheTags, isDocumentHistory, resolvedAsset, parseDeliveredDocuments, createContentClient, createContentContext } from '@elytracms/core/content';
 import { DEFAULT_SEO_FIELD, parseLocaleConfig, documentKey, liveRedirectRecords, SEO_SUBFIELDS, splitLocalePath, DRAFT_PERSPECTIVE, splitPath, localeUrlPath, variantOf, DRAFT_VARIANT, createRouter, presentationBodyFields, redirectRecordSchema } from '@elytracms/core/cms-core';
 export { DRAFT_PERSPECTIVE, documentSchema, localeConfigSchema, localeUrlPath, parseLocaleConfig, redirectRecordSchema, resolveLocale, routeRecordSchema, splitLocalePath, textDirection, variantOf } from '@elytracms/core/cms-core';
+import { redirectRecordKind } from '@elytracms/core/persistence';
 import { revalidateTag, cacheTag } from 'next/cache';
 import { draftMode } from 'next/headers';
 import { redirect, notFound, permanentRedirect } from 'next/navigation';
 import { COMPOSITE_KEY_SEPARATOR } from '@elytracms/core/project-graph';
 import { verifyRevalidationSignature, readRevalidationBody, REVALIDATE_SIGNATURE_HEADER } from '@elytracms/core/revalidation';
 export { REVALIDATE_SIGNATURE_HEADER, revalidationEventSchema, signRevalidationBody, signedRevalidationRequest } from '@elytracms/core/revalidation';
+import { INGEST_MAX_BODY_BYTES, readIngestPayload, INGEST_RECEIVER_PATH, signedIngestRequest, convexSiteUrl } from '@elytracms/core/ingest';
 import NextImage from 'next/image';
 import { normalizeImageSource } from '@elytracms/components';
 import { projectFrontendUrl, resolveProject } from '@elytracms/core/studio-core';
@@ -173,7 +175,7 @@ async function createContentSnapshot(adapter, projectId, options) {
   const documentRecords = await adapter.cms.listDocuments(projectId);
   const versionRecords = await adapter.cms.listAllDocumentVersions(projectId);
   const assetRecords = await adapter.assets.listAssets(projectId);
-  const redirectRecords = await adapter.redirects.listRedirects(projectId);
+  const redirectRecords = await adapter.records(redirectRecordKind).list(projectId);
   const redirects = liveRedirectRecords(redirectRecords);
   const versionsByKey = /* @__PURE__ */ new Map();
   for (const record2 of versionRecords) {
@@ -283,6 +285,15 @@ function canvasWrapContext(result, info) {
     result
   };
 }
+function canvasBeaconProps(result, info) {
+  const document = result.document;
+  return {
+    path: info.url,
+    status: 200,
+    locale: result.tags.locale,
+    ...document ? { collection: document.collection, documentId: document.id } : {}
+  };
+}
 function pathFromSlug(slug) {
   return "/" + (slug ?? []).join("/");
 }
@@ -590,8 +601,13 @@ function createCanvasRoute(options) {
             presentation: outcome.presentation
           }
         );
-        if (!options.wrap) return rendered;
-        return options.wrap(rendered, canvasWrapContext(outcome.result, { url, perspective }));
+        const page = options.wrap ? options.wrap(rendered, canvasWrapContext(outcome.result, { url, perspective })) : rendered;
+        const Beacon = options.analytics;
+        if (!Beacon || perspective !== "published") return page;
+        return /* @__PURE__ */ jsxs(Fragment, { children: [
+          page,
+          /* @__PURE__ */ jsx(Beacon, { ...canvasBeaconProps(outcome.result, { url}) })
+        ] });
       }
     }
   };
@@ -758,6 +774,177 @@ function createRevalidateRoute(options) {
     }
   };
 }
+function createFixedWindowLimiter(options) {
+  const windowMs = options.windowMs ?? 6e4;
+  const now = options.now ?? Date.now;
+  const windows = /* @__PURE__ */ new Map();
+  return {
+    hit(key) {
+      const at = now();
+      for (const [held, window2] of windows) if (at - window2.windowStart >= windowMs) windows.delete(held);
+      const window = windows.get(key);
+      if (!window) {
+        windows.set(key, { windowStart: at, count: 1 });
+        return { allowed: true };
+      }
+      if (window.count >= options.limit) {
+        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((window.windowStart + windowMs - at) / 1e3)) };
+      }
+      window.count += 1;
+      return { allowed: true };
+    },
+    size: () => windows.size
+  };
+}
+function defaultIngestClientKey(request) {
+  const forwarded = request.headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+  if (forwarded) return forwarded;
+  const real = request.headers.get("x-real-ip")?.trim();
+  return real || "unknown";
+}
+function isCrossOrigin(request) {
+  const site = request.headers.get("sec-fetch-site");
+  if (site && site !== "same-origin" && site !== "none") return true;
+  const origin = request.headers.get("origin");
+  if (!origin) return false;
+  try {
+    return new URL(origin).origin !== new URL(request.url).origin;
+  } catch {
+    return true;
+  }
+}
+async function evaluateIngestRequest(input) {
+  const { request } = input;
+  if (request.method !== "POST") {
+    return { ok: false, status: 405, body: { error: "Only POST is accepted." }, headers: { allow: "POST" } };
+  }
+  if (!input.configured) {
+    return { ok: false, status: 503, body: { error: "Ingest is not configured on this site." } };
+  }
+  if (isCrossOrigin(request)) {
+    return { ok: false, status: 403, body: { error: "Cross-origin requests are not accepted." } };
+  }
+  const limited = input.limiter.hit(input.clientKey(request));
+  if (!limited.allowed) {
+    return {
+      ok: false,
+      status: 429,
+      body: { error: "Too many requests \u2014 try again shortly." },
+      headers: { "retry-after": String(limited.retryAfterSeconds) }
+    };
+  }
+  if (input.rawBody === void 0) {
+    return { ok: false, status: 413, body: { error: "The payload is too large." } };
+  }
+  const read = readIngestPayload(input.rawBody);
+  if (!read.ok) {
+    return { ok: false, status: 400, body: { error: read.message, ...read.issues ? { issues: read.issues } : {} } };
+  }
+  if (input.botGate) {
+    const verdict = await input.botGate({ request, payload: read.value });
+    if (!verdict.allow) {
+      return { ok: false, status: 403, body: { error: "Refused by the bot gate.", gate: "bot", reason: verdict.reason } };
+    }
+  }
+  if (!input.enrich) return { ok: true, payload: read.value };
+  return enrichPayload(input.enrich, request, read.value);
+}
+async function enrichPayload(enrich, request, payload) {
+  let enriched;
+  try {
+    enriched = await enrich({ request, payload });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ok: false, status: 500, body: { error: `The site's ingest enrichment failed: ${message}` } };
+  }
+  const body = JSON.stringify(enriched ?? null);
+  const reread = readIngestPayload(body);
+  if (!reread.ok) {
+    return {
+      ok: false,
+      status: 500,
+      body: { error: "The site's ingest enrichment returned an invalid payload.", ...reread.issues ? { issues: reread.issues } : {} }
+    };
+  }
+  if (new TextEncoder().encode(body).byteLength > INGEST_MAX_BODY_BYTES) {
+    return { ok: false, status: 500, body: { error: "The site's ingest enrichment grew the payload past the receiver's cap." } };
+  }
+  return { ok: true, payload: reread.value };
+}
+async function readCappedBody(request, maxBytes = INGEST_MAX_BODY_BYTES) {
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) return void 0;
+  if (!request.body) return "";
+  const reader = request.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => void 0);
+      return void 0;
+    }
+    chunks.push(value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+var NO_STORE = { "cache-control": "no-store" };
+function createIngestRoute(options) {
+  const maxBodyBytes = options.maxBodyBytes ?? INGEST_MAX_BODY_BYTES;
+  if (maxBodyBytes > INGEST_MAX_BODY_BYTES || maxBodyBytes <= 0) {
+    throw new Error(`createIngestRoute: maxBodyBytes must be between 1 and ${INGEST_MAX_BODY_BYTES} (the receiver's cap).`);
+  }
+  const limiter = createFixedWindowLimiter({
+    limit: options.maxRequestsPerMinute ?? 30,
+    ...options.now ? { now: options.now } : {}
+  });
+  const clientKey = options.clientKey ?? defaultIngestClientKey;
+  const receiver = options.siteUrl ? `${options.siteUrl.replace(/\/+$/, "")}${INGEST_RECEIVER_PATH}` : void 0;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  return {
+    async POST(request) {
+      const rawBody = request.method === "POST" ? await readCappedBody(request, maxBodyBytes) : "";
+      const evaluation = await evaluateIngestRequest({
+        request,
+        rawBody,
+        configured: options.secret !== void 0 && options.secret.length > 0 && receiver !== void 0,
+        limiter,
+        clientKey,
+        ...options.botGate ? { botGate: options.botGate } : {},
+        ...options.enrich ? { enrich: options.enrich } : {}
+      });
+      if (!evaluation.ok) {
+        return Response.json(evaluation.body, { status: evaluation.status, headers: { ...NO_STORE, ...evaluation.headers } });
+      }
+      const signed = await signedIngestRequest(evaluation.payload, options.secret);
+      let answer;
+      try {
+        answer = await fetchImpl(receiver, { method: "POST", headers: signed.headers, body: signed.body });
+      } catch {
+        return Response.json({ error: "The ingest receiver could not be reached." }, { status: 502, headers: NO_STORE });
+      }
+      if (answer.status === 401) {
+        return Response.json(
+          { error: "The ingest receiver refused this site's signature \u2014 INGEST_SECRET must equal the deployment's ELYTRA_INGEST_SECRET." },
+          { status: 502, headers: NO_STORE }
+        );
+      }
+      const text = await answer.text();
+      return new Response(text, {
+        status: answer.status,
+        headers: { ...NO_STORE, "content-type": answer.headers.get("content-type") ?? "application/json" }
+      });
+    }
+  };
+}
 var LQIP_MAX_EDGE = 24;
 function fitLqipLongEdge(width, height) {
   const scale = Math.min(1, LQIP_MAX_EDGE / Math.max(width, height));
@@ -866,7 +1053,8 @@ var ELYTRA_HOST_ENV_KEYS = {
   convexUrl: "ELYTRA_CONVEX_URL",
   projectId: "ELYTRA_PROJECT_ID",
   draftToken: "DRAFT_PREVIEW_TOKEN",
-  revalidateSecret: "REVALIDATE_SECRET"
+  revalidateSecret: "REVALIDATE_SECRET",
+  ingestSecret: "INGEST_SECRET"
 };
 function cleaned(value) {
   const trimmed = value?.trim();
@@ -1136,8 +1324,6 @@ function createPreviewDisableRoute() {
     }
   };
 }
-
-// src/host-kit.ts
 function resolveHostProject(entry) {
   const result = resolveProject(entry);
   if (result.ok) return result.project;
@@ -1238,6 +1424,11 @@ function createElytraHost(options) {
   });
   const previewRoute = () => createPreviewRoute({ token: env.draftToken });
   const previewDisableRoute = () => createPreviewDisableRoute();
+  const ingestRoute = (overrides = {}) => createIngestRoute({
+    ...overrides,
+    secret: env.ingestSecret,
+    siteUrl: "siteUrl" in overrides ? overrides.siteUrl : convexSiteUrl(env.convexUrl)
+  });
   const pageOpensFullBleed = async (slug) => {
     const perspective = await requestPerspective();
     const source = await loadContent({ perspective });
@@ -1263,11 +1454,12 @@ function createElytraHost(options) {
     revalidateRoute,
     previewRoute,
     previewDisableRoute,
+    ingestRoute,
     pageOpensFullBleed
   };
 }
 var PACKAGE = "@elytracms/next";
 
-export { CANVAS_VALIDATION_SLUG, CanvasRenderer, ELYTRA_HOST_ENV_KEYS, ElytraImage, PACKAGE, assembleLiveSource, bodyItemsOf, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, openGraphLocale, pathFromSlug, projectSweepTag, requestPerspective, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag, seoContextOf, seoMetadata, seoObjectOf, withNextImage };
+export { CANVAS_VALIDATION_SLUG, CanvasRenderer, ELYTRA_HOST_ENV_KEYS, ElytraImage, PACKAGE, assembleLiveSource, bodyItemsOf, canvasBeaconProps, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createFixedWindowLimiter, createIngestRoute, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defaultIngestClientKey, defineHostComponents, docCacheTag, elytraHostImage, evaluateIngestRequest, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, isCrossOrigin, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, openGraphLocale, pathFromSlug, projectSweepTag, readCappedBody, requestPerspective, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag, seoContextOf, seoMetadata, seoObjectOf, withNextImage };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map