@evinvest/kitstart 0.1.0

package/dist/next/config/build-env.js

@@ -0,0 +1,101 @@
+// Build-time only: read by `next.config.ts` and `vitest.config.ts`, never by
+// app code. `assets/` is the one place a contact fact, the mark or a colour is
+// written — the printed card, the vCards and the site all read it — so the
+// site takes them at build time and inlines them rather than keeping a copy.
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+/**
+ * The slice of TOML these two files use for the values read here: `[a.b]`
+ * headers and `key = "basic string"` lines; everything else (arrays, numbers,
+ * comments) is skipped — not the kit's `parseToml`, to keep `next.config.ts`
+ * free of the kit. `evinvest-palette` still validates brand.toml in full.
+ */
+export function readStringTables(text) {
+    const tables = { "": {} };
+    let current = "";
+    for (const raw of text.split("\n")) {
+        const line = raw.trim();
+        const header = /^\[([A-Za-z0-9_.-]+)\]$/.exec(line);
+        if (header?.[1]) {
+            current = header[1];
+            tables[current] ??= {};
+            continue;
+        }
+        const pair = /^([A-Za-z0-9_-]+)\s*=\s*"((?:[^"\\]|\\.)*)"\s*(?:#.*)?$/.exec(line);
+        if (pair?.[1] && pair[2] !== undefined) {
+            const table = (tables[current] ??= {});
+            table[pair[1]] = pair[2].replace(/\\(["\\])/g, "$1");
+        }
+    }
+    return tables;
+}
+function readToml(root, file) {
+    return readStringTables(readFileSync(join(root, file), "utf8"));
+}
+export function readCard(root) {
+    const toml = readToml(root, "assets/card.toml")[""] ?? {};
+    // Optional for the web: a brand may launch with no phone line and no domain
+    // yet. Present but blank is still an error — a typo, not a choice.
+    const field = (key) => {
+        if (!Object.hasOwn(toml, key))
+            return null;
+        const value = toml[key];
+        if (typeof value !== "string" || value.trim() === "") {
+            throw new Error(`assets/card.toml: \`${key}\` must be a non-empty string when present`);
+        }
+        return value;
+    };
+    const phone = field("phone");
+    // A national number cannot become `tel:+…` or `wa.me/…` without guessing a
+    // country, and a mistyped call target is the most expensive silent bug on
+    // this page.
+    if (phone !== null && !phone.startsWith("+")) {
+        throw new Error(`assets/card.toml: phone must be international, got ${JSON.stringify(phone)}`);
+    }
+    return { phone, email: field("email"), site: field("site") };
+}
+/**
+ * The inner markup of `assets/mark.svg` — the path, not the `<svg>` wrapper,
+ * which the component writes itself so it can size and colour it. The fill is
+ * `currentColor`, which an `<img>` could not inherit.
+ */
+export function readMarkPath(root) {
+    const svg = readFileSync(join(root, "assets/mark.svg"), "utf8");
+    const d = /\sd="([^"]+)"/.exec(svg)?.[1];
+    if (!d)
+        throw new Error("assets/mark.svg: no <path d=…> to inline");
+    return d;
+}
+/**
+ * The dark scope's values for the OG card. `ImageResponse` draws with inline
+ * styles and cannot read a custom property, so the card takes the palette's
+ * values at build time instead of a second copy of them in code.
+ */
+export function readOgPalette(root) {
+    const dark = readToml(root, "assets/brand.toml")["colors.dark"] ?? {};
+    const pick = (key) => {
+        const value = dark[key];
+        if (value === undefined)
+            throw new Error(`assets/brand.toml: [colors.dark] ${key} is missing`);
+        return value;
+    };
+    return {
+        background: pick("background"),
+        card: pick("card"),
+        ink: pick("ink"),
+        inkSoft: pick("ink-soft"),
+        primary: pick("primary"),
+    };
+}
+/** Everything inlined as `process.env.*`, under the names app code reads. */
+export function buildEnv(root) {
+    const card = readCard(root);
+    return {
+        // An absent fact is inlined as "", which `cardFact` reads back as `null`.
+        SITE_CARD_PHONE: card.phone ?? "",
+        SITE_CARD_EMAIL: card.email ?? "",
+        SITE_CARD_SITE: card.site ?? "",
+        SITE_MARK_PATH: readMarkPath(root),
+        SITE_OG_PALETTE: JSON.stringify(readOgPalette(root)),
+    };
+}

package/dist/next/config/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * `@evinvest/kitstart/next/config` — for `next.config.ts` and
+ * `vitest.config.ts` only. Its own subpath because the config is loaded
+ * outside any React Server bundle, where `./next` (which reaches
+ * `server-only` modules) would throw on import.
+ */
+import type { NextConfig } from "next";
+export { buildEnv, readCard, readMarkPath, readOgPalette, readStringTables, type CardFacts, type OgPalette } from "./build-env.js";
+export interface LandingOptions {
+    /** The brand repo's root, where `assets/` lives: `process.cwd()` in `next.config.ts`. */
+    root: string;
+    /** Files the OG route reads at run time, which tracing cannot infer from a path. */
+    ogFiles?: string[];
+}
+/**
+ * The Next config every landing shares, under the brand's own. What each line
+ * is for:
+ *
+ * - `output: "standalone"` — the image ships the server plus only the traced
+ *   files, not the toolchain;
+ * - `env` — the card's facts, the mark and the OG palette inlined at build:
+ *   the container carries no `assets/`;
+ * - `expireTime` — pages are cached (ISR) on the live data's TTL; this bounds
+ *   the `stale-while-revalidate` tail a CDN may serve to a day, not a year;
+ * - `images.unoptimized` + the sharp exclusion — the optimiser would add a
+ *   native dependency the Nix image cannot load, for sources already sized;
+ * - `isrFlushToDisk: false` — the server runs from the read-only Nix store, so
+ *   the cache stays in memory, per pod.
+ */
+export declare function withLanding(config: NextConfig, options: LandingOptions): NextConfig;

package/dist/next/config/index.js

@@ -0,0 +1,38 @@
+import { buildEnv } from "./build-env.js";
+export { buildEnv, readCard, readMarkPath, readOgPalette, readStringTables } from "./build-env.js";
+/**
+ * The Next config every landing shares, under the brand's own. What each line
+ * is for:
+ *
+ * - `output: "standalone"` — the image ships the server plus only the traced
+ *   files, not the toolchain;
+ * - `env` — the card's facts, the mark and the OG palette inlined at build:
+ *   the container carries no `assets/`;
+ * - `expireTime` — pages are cached (ISR) on the live data's TTL; this bounds
+ *   the `stale-while-revalidate` tail a CDN may serve to a day, not a year;
+ * - `images.unoptimized` + the sharp exclusion — the optimiser would add a
+ *   native dependency the Nix image cannot load, for sources already sized;
+ * - `isrFlushToDisk: false` — the server runs from the read-only Nix store, so
+ *   the cache stays in memory, per pod.
+ */
+export function withLanding(config, options) {
+    return {
+        poweredByHeader: false,
+        output: "standalone",
+        expireTime: 86_400,
+        ...config,
+        env: { ...buildEnv(options.root), ...config.env },
+        images: { unoptimized: true, ...config.images },
+        outputFileTracingIncludes: {
+            ...(options.ogFiles ? { "/og": options.ogFiles } : {}),
+            ...config.outputFileTracingIncludes,
+        },
+        outputFileTracingExcludes: {
+            "*": ["node_modules/sharp/**", "node_modules/@img/**"],
+            ...config.outputFileTracingExcludes,
+        },
+        // `app/global-not-found.tsx` answers every path no route matches — the proxy
+        // sends dead paths there (`gone`); the root layout lives under `[locale]`.
+        experimental: { isrFlushToDisk: false, globalNotFound: true, ...config.experimental },
+    };
+}

package/dist/next/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `@evinvest/kitstart/next` — the handlers and loaders the brand's `app/`
+ * files take, so each route file is a few lines of literal segment config and
+ * one factory call. Server side only (route handlers, Server Components,
+ * `generateMetadata`); `next.config.ts` imports `./next/config` instead.
+ */
+export { brandMetadata, metadataBase, placeMetadata, statusMetadata, type PageMeta } from "./metadata.js";
+export { createPlaceLoader, loadLocale, type PlaceParams } from "./load.js";
+export { healthRoute, robotsRoute, sitemapRoute } from "./routes.js";
+export { ogRoute, type OgCard, type OgFont, type OgOptions } from "./og.js";
+export { ogPalette, type OgColours } from "./og-palette.js";
+export { quoteRoute, type QuoteRouteDeps, type UnavailableCopy } from "./quote-route.js";

package/dist/next/index.js

@@ -0,0 +1,12 @@
+/**
+ * `@evinvest/kitstart/next` — the handlers and loaders the brand's `app/`
+ * files take, so each route file is a few lines of literal segment config and
+ * one factory call. Server side only (route handlers, Server Components,
+ * `generateMetadata`); `next.config.ts` imports `./next/config` instead.
+ */
+export { brandMetadata, metadataBase, placeMetadata, statusMetadata } from "./metadata.js";
+export { createPlaceLoader, loadLocale } from "./load.js";
+export { healthRoute, robotsRoute, sitemapRoute } from "./routes.js";
+export { ogRoute } from "./og.js";
+export { ogPalette } from "./og-palette.js";
+export { quoteRoute } from "./quote-route.js";

package/dist/next/load.d.ts

@@ -0,0 +1,24 @@
+import { type PlaceView } from "../core/place/view.js";
+import type { Site } from "../core/site.js";
+import type { PlaceSource } from "../server/place-source.js";
+export interface PlaceParams {
+    locale: string;
+    location: string;
+}
+/**
+ * The place and the view for one page, from the route params alone: the link
+ * mode is in the `location` param (`_royat` on a place's own host), so the
+ * page reads nothing from the request and is cached (ISR) on the live data's
+ * TTL. `notFound()` for an unknown language or place — a real 404 with
+ * `noindex`. A failing live source never throws here (`createPlaceSource`).
+ *
+ * Memoised per render on (locale, param): `generateMetadata`, the layout and
+ * the page ask for the same place once.
+ */
+export declare function createPlaceLoader<L extends string, P extends string>(site: Site<L, P>, source: PlaceSource<L>): (params: Promise<PlaceParams> | PlaceParams) => Promise<PlaceView<L>>;
+/** `[locale]` alone: the language, or the 404. */
+export declare function loadLocale<L extends string, P extends string>(site: Site<L, P>, params: Promise<{
+    locale: string;
+}> | {
+    locale: string;
+}): Promise<L>;

package/dist/next/load.js

@@ -0,0 +1,36 @@
+import { notFound } from "next/navigation.js";
+import { cache } from "react";
+import { createPlaceView } from "../core/place/view.js";
+import { parsePlaceParam } from "../core/routing.js";
+/**
+ * The place and the view for one page, from the route params alone: the link
+ * mode is in the `location` param (`_royat` on a place's own host), so the
+ * page reads nothing from the request and is cached (ISR) on the live data's
+ * TTL. `notFound()` for an unknown language or place — a real 404 with
+ * `noindex`. A failing live source never throws here (`createPlaceSource`).
+ *
+ * Memoised per render on (locale, param): `generateMetadata`, the layout and
+ * the page ask for the same place once.
+ */
+export function createPlaceLoader(site, source) {
+    const load = cache(async (locale, param) => {
+        if (!site.i18n.isLocale(locale))
+            notFound();
+        const { slug, mode } = parsePlaceParam(param);
+        const place = await source.getPlace(slug, locale);
+        if (!place)
+            notFound();
+        return createPlaceView(site, place, locale, mode);
+    });
+    return async (params) => {
+        const { locale, location } = await params;
+        return load(locale, location);
+    };
+}
+/** `[locale]` alone: the language, or the 404. */
+export async function loadLocale(site, params) {
+    const { locale } = await params;
+    if (!site.i18n.isLocale(locale))
+        notFound();
+    return locale;
+}

package/dist/next/metadata.d.ts

@@ -0,0 +1,31 @@
+import type { Metadata } from "next";
+import { type PlaceView } from "../core/place/view.js";
+import { type Site } from "../core/site.js";
+/**
+ * `<head>` for the three kinds of page. Every string comes from the copy — the
+ * description here is the same field the OG card and the JSON-LD read. Output
+ * pinned in `tests/fixtures/kitstart/metadata.json` (aquafix's goldens, and
+ * the service-area and pre-launch sites).
+ *
+ * Each language version is its own indexable URL, self-canonical, naming the
+ * whole cluster in `hreflang` with `x-default` on the default locale. The
+ * canonical host is always the place's own (its subdomain, or the apex on a
+ * single site), so the apex fallback path never competes. An unpublished place
+ * answers `noindex`.
+ *
+ * A site with no domain yet is not on the web: every page is `noindex,
+ * nofollow`, and there is no canonical, no `hreflang` cluster and no
+ * `og:url` — a relative one would name no page, and a guessed host would name
+ * the wrong one.
+ */
+export interface PageMeta {
+    title: string;
+    description: string;
+}
+export declare function placeMetadata<L extends string, P extends string>(site: Site<L, P>, view: PlaceView<L>, page: P | "home", copy: PageMeta): Metadata;
+/** The apex's own page — the directory of a `subdomains` site. */
+export declare function brandMetadata<L extends string, P extends string>(site: Site<L, P>, locale: L, copy: PageMeta): Metadata;
+/** Status pages are never indexed and never in the sitemap. */
+export declare function statusMetadata<L extends string, P extends string>(site: Site<L, P>, title: string): Metadata;
+/** `metadataBase` for the root layout: the apex, or loopback before launch. */
+export declare function metadataBase<L extends string, P extends string>(site: Site<L, P>): URL;

package/dist/next/metadata.js

@@ -0,0 +1,66 @@
+import { isPublished } from "../core/place/publication.js";
+import { placeOrigin, siteOrigin } from "../core/place/view.js";
+import { ogImageUrl } from "../core/seo/sitemap.js";
+import { ogLocaleOf } from "../core/site.js";
+const OG_SIZE = { width: 1200, height: 630 };
+const PRE_LAUNCH = { index: false, follow: false };
+function others(site, locale) {
+    return site.i18n.locales.filter(l => l !== locale).map(l => ogLocaleOf(site, l));
+}
+/** One key order for every page kind — the fixtures pin it. */
+function head(site, page) {
+    return {
+        title: page.title,
+        description: page.description,
+        ...(page.robots ? { robots: page.robots } : {}),
+        ...(page.canonical !== null && page.languages ? { alternates: { canonical: page.canonical, languages: page.languages } } : {}),
+        openGraph: {
+            type: "website",
+            siteName: site.brand.name,
+            title: page.title,
+            description: page.description,
+            ...(page.canonical !== null ? { url: page.canonical } : {}),
+            locale: ogLocaleOf(site, page.locale),
+            alternateLocale: others(site, page.locale),
+            images: [{ url: page.image, ...OG_SIZE }],
+        },
+        twitter: { card: "summary_large_image" },
+    };
+}
+export function placeMetadata(site, view, page, copy) {
+    const { name } = site.brand;
+    const title = page === "home" ? `${name} — ${copy.title}` : `${copy.title} · ${name}`;
+    const suffix = site.pages[page];
+    const origin = placeOrigin(site, view.place.slug);
+    const published = isPublished(view.place, site.publication, site.brand);
+    return head(site, {
+        title,
+        description: copy.description,
+        locale: view.locale,
+        canonical: origin === null ? null : view.url(suffix),
+        languages: origin === null ? null : site.i18n.languageAlternates(suffix || "/", origin),
+        robots: origin === null ? PRE_LAUNCH : published ? { index: true, follow: true } : { index: false, follow: true },
+        image: ogImageUrl(site, { slug: view.place.slug, locale: view.locale, page }),
+    });
+}
+/** The apex's own page — the directory of a `subdomains` site. */
+export function brandMetadata(site, locale, copy) {
+    const origin = siteOrigin(site);
+    return head(site, {
+        title: copy.title,
+        description: copy.description,
+        locale,
+        canonical: origin === null ? null : `${origin}${site.i18n.localePath(locale, "/")}`,
+        languages: origin === null ? null : site.i18n.languageAlternates("/", origin),
+        robots: origin === null ? PRE_LAUNCH : undefined,
+        image: ogImageUrl(site, { locale }),
+    });
+}
+/** Status pages are never indexed and never in the sitemap. */
+export function statusMetadata(site, title) {
+    return { title: `${title} · ${site.brand.name}`, robots: { index: false, follow: false } };
+}
+/** `metadataBase` for the root layout: the apex, or loopback before launch. */
+export function metadataBase(site) {
+    return new URL(siteOrigin(site) ?? "http://localhost");
+}

package/dist/next/og-palette.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The OG card's colours, inlined at build by `withLanding` from
+ * `assets/brand.toml` `[colors.dark]` (`SITE_OG_PALETTE`). `ImageResponse`
+ * draws with inline styles and cannot read a custom property, so the card
+ * takes the palette's values rather than a second copy of them in code.
+ */
+export interface OgColours {
+    background: string;
+    card: string;
+    ink: string;
+    inkSoft: string;
+    primary: string;
+}
+export declare function ogPalette(inlined?: string | undefined): OgColours;

package/dist/next/og-palette.js

@@ -0,0 +1,14 @@
+export function ogPalette(inlined = process.env["SITE_OG_PALETTE"]) {
+    if (inlined === undefined)
+        throw new Error("SITE_OG_PALETTE was not inlined — build through withLanding (next.config.ts)");
+    const raw = JSON.parse(inlined);
+    if (typeof raw !== "object" || raw === null)
+        throw new Error("SITE_OG_PALETTE is not an object");
+    const pick = (k) => {
+        const v = Reflect.get(raw, k);
+        if (typeof v !== "string")
+            throw new Error(`SITE_OG_PALETTE.${k} is missing`);
+        return v;
+    };
+    return { background: pick("background"), card: pick("card"), ink: pick("ink"), inkSoft: pick("inkSoft"), primary: pick("primary") };
+}

package/dist/next/og.d.ts

@@ -0,0 +1,31 @@
+import type { ReactElement } from "react";
+import type { Place } from "../core/place/types.js";
+import { type Site } from "../core/site.js";
+/**
+ * `app/og/route.tsx`: the OG card, drawn by the brand from the same fields the
+ * `<head>` reads. The query is normalised to the closed set of (place,
+ * language, page) before it is a cache key — an unknown one falls back to a
+ * known one — and each card is drawn once per process: satori and resvg are
+ * the most expensive thing the server does, and a crawler fetching every card
+ * must not make them the most frequent. Baked data only.
+ */
+export interface OgCard<L extends string, P extends string> {
+    locale: L;
+    /** The baked place, or `null` for the brand's own card. */
+    place: Place<L> | null;
+    page: P | "home";
+}
+export interface OgFont {
+    name: string;
+    data: ArrayBuffer | Buffer;
+    weight?: 400 | 500 | 600 | 700;
+    style?: "normal" | "italic";
+}
+export interface OgOptions<L extends string, P extends string> {
+    draw: (card: OgCard<L, P>) => ReactElement;
+    /** Read once per card; the brand ships them via `outputFileTracingIncludes`. */
+    fonts: () => Promise<OgFont[]>;
+    width?: number;
+    height?: number;
+}
+export declare function ogRoute<L extends string, P extends string>(site: Site<L, P>, options: OgOptions<L, P>): (request: Request) => Promise<Response>;

package/dist/next/og.js

@@ -0,0 +1,42 @@
+import { ImageResponse } from "next/og.js";
+import { memoByKey } from "../core/memo.js";
+import { bakedPlace } from "../core/site.js";
+export function ogRoute(site, options) {
+    const width = options.width ?? 1200;
+    const height = options.height ?? 630;
+    // Read once per process, like the cards; a failed read is retried next time.
+    let fonts;
+    const loadFonts = () => {
+        fonts ??= options.fonts().catch((error) => {
+            fonts = undefined;
+            throw error;
+        });
+        return fonts;
+    };
+    const card = memoByKey(async (key) => {
+        const [slug = "", lang = "", p = ""] = key.split("|");
+        const locale = site.i18n.isLocale(lang) ? lang : site.i18n.defaultLocale;
+        const page = site.pageKeys.find(k => k === p) ?? "home";
+        const faces = await loadFonts();
+        // An empty list would replace `next/og`'s bundled face with nothing.
+        const image = new ImageResponse(options.draw({ locale, place: bakedPlace(site, slug) ?? null, page }), {
+            width,
+            height,
+            ...(faces.length > 0 ? { fonts: faces } : {}),
+        });
+        return image.arrayBuffer();
+    });
+    return async (request) => {
+        const url = new URL(request.url);
+        const lang = url.searchParams.get("lang");
+        const p = url.searchParams.get("p");
+        const key = [
+            bakedPlace(site, url.searchParams.get("l") ?? "")?.slug ?? "",
+            site.i18n.isLocale(lang) ? lang : site.i18n.defaultLocale,
+            site.pageKeys.find(k => k === p) ?? "home",
+        ].join("|");
+        return new Response(await card(key), {
+            headers: { "Content-Type": "image/png", "Cache-Control": "public, max-age=3600, s-maxage=86400" },
+        });
+    };
+}

package/dist/next/quote-route.d.ts

@@ -0,0 +1,36 @@
+import { RateLimiter } from "../core/antispam.js";
+import type { LeadStore } from "../core/lead.js";
+import type { Place } from "../core/place/types.js";
+import { type Site } from "../core/site.js";
+import type { ServerEnv } from "../server/env.js";
+import type { LeadNotifier } from "../server/notify.js";
+/**
+ * `app/quote/route.ts` — the no-JS path, and the one that has to keep working:
+ * a plain form POST answered with a 303, so a refresh does not resubmit.
+ *
+ * ```ts
+ * export const dynamic = "force-dynamic";
+ * export const POST = quoteRoute(site, { env: serverEnv, notifier, unavailable });
+ * ```
+ */
+export interface UnavailableCopy {
+    title: string;
+    heading: string;
+    body: string;
+    callLabel: string;
+}
+export interface QuoteRouteDeps<L extends string> {
+    env: () => Pick<ServerEnv, "leadsDb" | "posthogKey" | "posthogHost" | "trustedProxy">;
+    /** Built once (and at boot, by the brand) so a missing sender fails startup, not a lead. */
+    notifier: () => LeadNotifier;
+    /** The self-contained 500's words, when the store refused the lead. */
+    unavailable: (locale: L, place: Place<L> | null) => UnavailableCopy;
+    /** Opened on first use (`next build` imports the route); defaults to `LEADS_DB_URL`'s. */
+    store?: () => LeadStore;
+    limiter?: RateLimiter;
+    /** Work after the response; `after` from `next/server` by default. */
+    defer?: (task: () => Promise<void> | void) => void;
+    now?: () => number;
+    log?: Pick<Console, "warn" | "error">;
+}
+export declare function quoteRoute<L extends string, P extends string>(site: Site<L, P>, deps: QuoteRouteDeps<L>): (request: Request) => Promise<Response>;

package/dist/next/quote-route.js

@@ -0,0 +1,124 @@
+import { after } from "next/server.js";
+import { createAcceptLead } from "../core/accept.js";
+import { analyticsSink, EVENTS } from "../core/analytics.js";
+import { RateLimiter } from "../core/antispam.js";
+import { createPlaceView } from "../core/place/view.js";
+import { createRouting, THANKS } from "../core/routing.js";
+import { bakedPlace, contactOf } from "../core/site.js";
+import { clientKey } from "../server/client-key.js";
+import { openLeadStore } from "../server/lead-store.js";
+/** The Rust server's body limit; a quote is a few short fields. */
+const MAX_BODY = 64 * 1024;
+/** Outside production, with no `TRUSTED_PROXY`: the one hop a dev server has. */
+const DEV_TRUST = { xffHops: 1 };
+class TooLarge extends Error {
+}
+/**
+ * The form, read with a hard cut-off: `Content-Length` is only the client's
+ * word, and a chunked body has none, so the bytes are counted as they arrive.
+ */
+async function readForm(request) {
+    if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY)
+        throw new TooLarge();
+    const chunks = [];
+    let size = 0;
+    if (request.body) {
+        const reader = request.body.getReader();
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > MAX_BODY) {
+                await reader.cancel();
+                throw new TooLarge();
+            }
+            chunks.push(value);
+        }
+    }
+    const body = new Uint8Array(new ArrayBuffer(size));
+    let at = 0;
+    for (const chunk of chunks) {
+        body.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return new Response(body, { headers: { "content-type": request.headers.get("content-type") ?? "" } }).formData();
+}
+const escape = (s) => s.replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c] ?? c);
+function seeOther(location) {
+    return new Response(null, { status: 303, headers: { Location: location } });
+}
+export function quoteRoute(site, deps) {
+    const accept = createAcceptLead(site);
+    const routing = createRouting(site);
+    const limiter = deps.limiter ?? new RateLimiter(5, 10 * 60_000);
+    const defer = deps.defer ?? after;
+    const log = deps.log ?? console;
+    let store;
+    let notifier;
+    const leadStore = () => {
+        store ??= deps.store ? deps.store() : openLeadStore(deps.env().leadsDb);
+        return store;
+    };
+    /** Where a page of the submitting place is — or of the brand, with none. */
+    function href(request, slug, locale, suffix) {
+        const place = slug ? bakedPlace(site, slug) : undefined;
+        if (!place)
+            return `/${locale}${suffix}`;
+        // Links follow the host the form was posted from: the place's own, or the
+        // apex fallback path.
+        const mode = routing.hostSlug(request.headers.get("host") ?? "") === place.slug ? "host" : "path";
+        return createPlaceView(site, place, locale, mode).href(suffix);
+    }
+    /** Self-contained: the thing that failed may be the thing that renders pages. */
+    function unavailable(slug, locale) {
+        const place = (slug ? bakedPlace(site, slug) : undefined) ?? null;
+        const phone = place ? contactOf(site, place).phone : site.brand.phone;
+        const words = deps.unavailable(locale, place);
+        const call = phone ? `<p><a href="tel:${escape(phone.replace(/[^\d+]/g, ""))}">${escape(words.callLabel)}</a></p>` : "";
+        const html = `<!doctype html><html lang="${escape(locale)}"><meta charset="utf-8"><meta name="robots" content="noindex"><title>${escape(words.title)}</title><body style="font-family:system-ui;max-width:36rem;margin:4rem auto;padding:0 1.25rem"><h1>${escape(words.heading)}</h1><p>${escape(words.body)}</p>${call}</body></html>`;
+        return new Response(html, { status: 500, headers: { "Content-Type": "text/html; charset=utf-8" } });
+    }
+    return async (request) => {
+        let form;
+        try {
+            form = await readForm(request);
+        }
+        catch (error) {
+            return new Response(null, { status: error instanceof TooLarge ? 413 : 400 });
+        }
+        let env;
+        try {
+            env = deps.env();
+        }
+        catch (error) {
+            // A broken setting must still answer with the phone, never a bare 500.
+            log.error("quote: the server environment is unusable", error);
+            const locale = form.get("locale");
+            return unavailable(null, typeof locale === "string" && site.i18n.isLocale(locale) ? locale : site.i18n.defaultLocale);
+        }
+        const outcome = await accept(form, clientKey(request.headers, env.trustedProxy ?? DEV_TRUST), {
+            insert: lead => leadStore().insert(lead),
+            defer,
+            notify: (lead, id) => {
+                notifier ??= deps.notifier();
+                return notifier.notify(lead, id);
+            },
+            capture: (lead, formId) => analyticsSink({ key: env.posthogKey, host: env.posthogHost, brandId: site.brand.id }, lead.placeSlug).capture(EVENTS.leadSubmit, {
+                form_id: formId,
+            }),
+            limiter,
+            now: deps.now?.() ?? Date.now(),
+            log,
+        });
+        switch (outcome.kind) {
+            // A suspected bot is answered exactly as a person is.
+            case "stored":
+                return seeOther(href(request, outcome.lead.placeSlug, outcome.locale, THANKS));
+            case "invalid":
+                return seeOther(href(request, outcome.slug, outcome.locale, outcome.slug ? "#quote" : ""));
+            case "failed":
+                return unavailable(outcome.slug, outcome.locale);
+        }
+    };
+}

package/dist/next/routes.d.ts

@@ -0,0 +1,15 @@
+import type { MetadataRoute } from "next";
+import type { Site } from "../core/site.js";
+import type { PlaceSource } from "../server/place-source.js";
+/**
+ * Strict: with a live source configured, an unreachable one throws, and the
+ * crawler keeps its last copy — an empty or truncated sitemap would tell it
+ * the place is gone.
+ */
+export declare function sitemapRoute<L extends string, P extends string>(site: Site<L, P>, source: PlaceSource<L>): () => Promise<MetadataRoute.Sitemap>;
+export declare function robotsRoute<L extends string, P extends string>(site: Site<L, P>): () => Promise<MetadataRoute.Robots>;
+/**
+ * The readiness probe: the process answers. `check` is for a brand that wants
+ * more (the lead store's `health()`); a failing check answers 503.
+ */
+export declare function healthRoute(check?: () => Promise<void>): () => Promise<Response>;