@evinvest/kitstart 0.1.0

package/dist/react/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `@evinvest/kitstart/react` — the structural widgets every landing shares,
+ * where behaviour matters more than look. Server components by default; only
+ * `MapFacade` and `AnalyticsBoundary` are client modules, each its own file
+ * with its own `"use client"`, so a page pays for what it renders.
+ *
+ * Styled with the kit's token roles only (`text-ink`, `border-border`,
+ * `bg-card`…); a brand restyles through `className`, a widget's named parts
+ * (`classNames={{ list: "gap-2" }}`) and its palette. Tailwind
+ * must scan the package: `@source "<path to>/node_modules/@evinvest/kitstart/dist";`,
+ * relative to the stylesheet (`../../node_modules/…` from `src/app/`).
+ */
+export { AnalyticsBoundary } from "./AnalyticsBoundary.js";
+export { AreaChips } from "./AreaChips.js";
+export { CallBar, type CallBarPart, type CallBarProps } from "./CallBar.js";
+export { Coverage, type CoveragePart, type CoverageProps } from "./Coverage.js";
+export { Faq, type FaqPart, type FaqProps } from "./Faq.js";
+export { LangSwitch, withLang, type LangSwitchProps } from "./LangSwitch.js";
+export { MapFacade, type MapFacadeProps } from "./MapFacade.js";
+export { PlaceDirectory, type PlaceDirectoryPart, type PlaceDirectoryProps } from "./PlaceDirectory.js";
+export { PHONE_INPUT_PROPS, QuoteFormShell, type QuoteFormShellProps } from "./QuoteFormShell.js";
+export { StatusScreen, type StatusScreenPart, type StatusScreenProps } from "./StatusScreen.js";
+export type { PartClassNames } from "./parts.js";
+export { Badge, Button, buttonVariants, Check, cn, Display, Eyebrow, Field, FieldLabel, Input, NativeSelect, NativeSelectOption, Prose, Section, SectionHead, Separator, Textarea, } from "@evinvest/uikit";
+export { JsonLd } from "@evinvest/marketing";
+export { ClickToLoad } from "@evinvest/marketing/click-to-load";
+export { ContactLinkTracker } from "@evinvest/marketing/tracker";

package/dist/react/index.js

@@ -0,0 +1,29 @@
+/**
+ * `@evinvest/kitstart/react` — the structural widgets every landing shares,
+ * where behaviour matters more than look. Server components by default; only
+ * `MapFacade` and `AnalyticsBoundary` are client modules, each its own file
+ * with its own `"use client"`, so a page pays for what it renders.
+ *
+ * Styled with the kit's token roles only (`text-ink`, `border-border`,
+ * `bg-card`…); a brand restyles through `className`, a widget's named parts
+ * (`classNames={{ list: "gap-2" }}`) and its palette. Tailwind
+ * must scan the package: `@source "<path to>/node_modules/@evinvest/kitstart/dist";`,
+ * relative to the stylesheet (`../../node_modules/…` from `src/app/`).
+ */
+export { AnalyticsBoundary } from "./AnalyticsBoundary.js";
+export { AreaChips } from "./AreaChips.js";
+export { CallBar } from "./CallBar.js";
+export { Coverage } from "./Coverage.js";
+export { Faq } from "./Faq.js";
+export { LangSwitch, withLang } from "./LangSwitch.js";
+export { MapFacade } from "./MapFacade.js";
+export { PlaceDirectory } from "./PlaceDirectory.js";
+export { PHONE_INPUT_PROPS, QuoteFormShell } from "./QuoteFormShell.js";
+export { StatusScreen } from "./StatusScreen.js";
+// The kit's pieces a landing composes with, by name — the list is the surface.
+// The kit ships one module per file with its own boundary, so a page that
+// renders a `Button` pays for the button, and `cn` works on the server.
+export { Badge, Button, buttonVariants, Check, cn, Display, Eyebrow, Field, FieldLabel, Input, NativeSelect, NativeSelectOption, Prose, Section, SectionHead, Separator, Textarea, } from "@evinvest/uikit";
+export { JsonLd } from "@evinvest/marketing";
+export { ClickToLoad } from "@evinvest/marketing/click-to-load";
+export { ContactLinkTracker } from "@evinvest/marketing/tracker";

package/dist/react/parts.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Class names for a widget's named parts, merged after its own through `cn`
+ * (tailwind-merge), so a brand's `gap-3` replaces the kit's `gap-6`. The
+ * geometry a brand needs, without descendant selectors that break silently
+ * when the widget's markup moves.
+ */
+export type PartClassNames<P extends string> = Readonly<Partial<Record<P, string>>>;

package/dist/react/parts.js

@@ -0,0 +1 @@
+export {};

package/dist/server/boot.d.ts

@@ -0,0 +1,11 @@
+import "server-only";
+import type { ServerEnv } from "./env.js";
+/**
+ * Opens the store once at boot — the brand's `instrumentation.ts` calls this —
+ * and closes it again. A missing volume, a `leads` table the migrations refuse
+ * or an adapter that does not exist then fails startup, and the pod never
+ * turns ready, instead of the first customer's submission failing. Says which
+ * store and where, because `LEADS_DB_URL` outranks `LEADS_DB_PATH` and the
+ * log is the one place that shows which won.
+ */
+export declare function checkLeadStore(env: Pick<ServerEnv, "leadsDb" | "leadsDbFrom">, log?: Pick<Console, "info">): Promise<void>;

package/dist/server/boot.js

@@ -0,0 +1,20 @@
+import "server-only";
+import { describeLeadDb, openLeadStore } from "./lead-store.js";
+/**
+ * Opens the store once at boot — the brand's `instrumentation.ts` calls this —
+ * and closes it again. A missing volume, a `leads` table the migrations refuse
+ * or an adapter that does not exist then fails startup, and the pod never
+ * turns ready, instead of the first customer's submission failing. Says which
+ * store and where, because `LEADS_DB_URL` outranks `LEADS_DB_PATH` and the
+ * log is the one place that shows which won.
+ */
+export async function checkLeadStore(env, log = console) {
+    const store = openLeadStore(env.leadsDb);
+    try {
+        await store.health();
+        log.info(`leads: ${describeLeadDb(env.leadsDb)}, schema v${await store.schemaVersion()} (from ${env.leadsDbFrom})`);
+    }
+    finally {
+        await store.close();
+    }
+}

package/dist/server/client-key.d.ts

@@ -0,0 +1,22 @@
+import "server-only";
+/**
+ * Which proxy's word the rate limit takes for the client's address — said
+ * outright, because the wrong guess is either forgeable or useless:
+ *
+ * - `"cloudflare"`: the origin is reached only through Cloudflare (the
+ *   cloudflared tunnel), so `CF-Connecting-IP` is the visitor and cannot be
+ *   forged past the edge;
+ * - `{ xffHops: n }`: `n` proxies of ours each append to `X-Forwarded-For`,
+ *   so the visitor is the n-th entry from the right — everything left of it
+ *   is whatever the client wrote.
+ *
+ * From `TRUSTED_PROXY` (`cloudflare` | `xff:<n>`); production refuses to boot
+ * without it (`parseServerEnv`).
+ */
+export type ProxyTrust = "cloudflare" | {
+    xffHops: number;
+};
+/** One shared bucket when the trusted header is absent: coarse, but it throttles rather than admits. */
+export declare const NO_CLIENT_ADDRESS = "no-client-address";
+export declare function parseProxyTrust(value: string): ProxyTrust;
+export declare function clientKey(headers: Headers, trust: ProxyTrust): string;

package/dist/server/client-key.js

@@ -0,0 +1,20 @@
+import "server-only";
+/** One shared bucket when the trusted header is absent: coarse, but it throttles rather than admits. */
+export const NO_CLIENT_ADDRESS = "no-client-address";
+export function parseProxyTrust(value) {
+    if (value === "cloudflare")
+        return "cloudflare";
+    const hops = /^xff:([1-9]\d?)$/.exec(value)?.[1];
+    if (hops)
+        return { xffHops: Number(hops) };
+    throw new Error('TRUSTED_PROXY must be "cloudflare" or "xff:<n>" (n ≥ 1)');
+}
+export function clientKey(headers, trust) {
+    if (trust === "cloudflare")
+        return headers.get("cf-connecting-ip")?.trim() || NO_CLIENT_ADDRESS;
+    const hops = (headers.get("x-forwarded-for") ?? "")
+        .split(",")
+        .map(h => h.trim())
+        .filter(Boolean);
+    return hops.at(-trust.xffHops) ?? NO_CLIENT_ADDRESS;
+}

package/dist/server/env.d.ts

@@ -0,0 +1,44 @@
+import "server-only";
+import { type ProxyTrust } from "./client-key.js";
+import { type LeadDb } from "./lead-store.js";
+/**
+ * The server's runtime configuration, parsed once. Secrets (`SMTP_URL`,
+ * `SMS_TOKEN`, `POSTHOG_KEY`) arrive from the container environment, never
+ * from the image.
+ *
+ * Production has no default for where state lives: a missing lead store
+ * (`LEADS_DB_URL` or `LEADS_DB_PATH`) throws, and a brand that parses this in
+ * `instrumentation.ts` gets a server that answers 500 everywhere — its
+ * readiness probe included — rather than one that loses the first lead.
+ */
+export interface ServerEnv {
+    production: boolean;
+    /** Where leads are kept; see `LeadDb`. */
+    leadsDb: LeadDb;
+    /** Which setting chose it, for the boot log. */
+    leadsDbFrom: "LEADS_DB_URL" | "LEADS_DB_PATH" | "default";
+    /** Where the live place data comes from; absent → the baked config. */
+    locationsApiUrl: string | null;
+    smtpUrl: string | null;
+    /** A bare address (`leads@brand.fr`), not `Name <…>`. */
+    notifyTo: string | null;
+    /** A bare address (`leads@brand.fr`), not `Name <…>`. */
+    notifyFrom: string | null;
+    /** Whose word the rate limit takes for the client's address; see `ProxyTrust`. */
+    trustedProxy: ProxyTrust | null;
+    smsToken: string | null;
+    posthogKey: string | null;
+    posthogHost: string;
+}
+export type EnvSource = Readonly<Record<string, string | undefined>>;
+export declare function parseServerEnv(site: {
+    brand: {
+        id: string;
+    };
+}, source: EnvSource): ServerEnv;
+/** Lazy and cached: `next build` imports the brand's env module and must not need prod secrets. */
+export declare function createServerEnv(site: {
+    brand: {
+        id: string;
+    };
+}, source?: EnvSource): () => ServerEnv;

package/dist/server/env.js

@@ -0,0 +1,73 @@
+import "server-only";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parseProxyTrust } from "./client-key.js";
+import { parseLeadDb } from "./lead-store.js";
+function opt(source, name) {
+    const value = source[name]?.trim();
+    return value ? value : null;
+}
+function url(source, name) {
+    const value = opt(source, name);
+    if (value === null)
+        return null;
+    try {
+        return new URL(value).toString().replace(/\/$/, "");
+    }
+    catch {
+        // Never the value: a URL setting may carry credentials.
+        throw new Error(`${name} is not a URL`);
+    }
+}
+/**
+ * `LEADS_DB_URL` picks the adapter by scheme; `LEADS_DB_PATH`, the setting a
+ * deployed image may already carry, is the SQLite file and stays valid. Both
+ * set is the migration path (the image bakes the path, a Secret adds the URL):
+ * the URL wins, and the boot log says so.
+ */
+function leadsDb(source, production, brandId) {
+    const dbUrl = opt(source, "LEADS_DB_URL");
+    if (dbUrl !== null) {
+        const db = parseLeadDb(dbUrl);
+        // Refused here, at boot, until the adapter exists — not on the first lead.
+        if (db.kind === "postgres")
+            throw new Error("LEADS_DB_URL: the postgres lead store is not implemented yet; use sqlite:///<path>");
+        return { leadsDb: db, leadsDbFrom: "LEADS_DB_URL" };
+    }
+    const path = opt(source, "LEADS_DB_PATH");
+    if (path !== null)
+        return { leadsDb: { kind: "sqlite", path }, leadsDbFrom: "LEADS_DB_PATH" };
+    if (production) {
+        throw new Error("LEADS_DB_URL or LEADS_DB_PATH is required in production — the leads volume, e.g. /data/leads.db");
+    }
+    return { leadsDb: { kind: "sqlite", path: join(homedir(), ".local/share", brandId, "leads.db") }, leadsDbFrom: "default" };
+}
+export function parseServerEnv(site, source) {
+    const production = source["NODE_ENV"] === "production";
+    const trust = opt(source, "TRUSTED_PROXY");
+    if (trust === null && production) {
+        throw new Error("TRUSTED_PROXY is required in production: cloudflare, or xff:<n> for n proxies of ours");
+    }
+    return {
+        production,
+        trustedProxy: trust === null ? null : parseProxyTrust(trust),
+        ...leadsDb(source, production, site.brand.id),
+        locationsApiUrl: url(source, "LOCATIONS_API_URL"),
+        smtpUrl: opt(source, "SMTP_URL"),
+        notifyTo: opt(source, "LEAD_NOTIFY_TO"),
+        notifyFrom: opt(source, "LEAD_NOTIFY_FROM"),
+        smsToken: opt(source, "SMS_TOKEN"),
+        posthogKey: opt(source, "POSTHOG_KEY"),
+        // Explicit because PostHog rejects a project's events at the other
+        // region's host; the audience is European, so EU unless told otherwise.
+        posthogHost: url(source, "POSTHOG_HOST") ?? "https://eu.i.posthog.com",
+    };
+}
+/** Lazy and cached: `next build` imports the brand's env module and must not need prod secrets. */
+export function createServerEnv(site, source = process.env) {
+    let cached;
+    return () => {
+        cached ??= parseServerEnv(site, source);
+        return cached;
+    };
+}

package/dist/server/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `@evinvest/kitstart/server` — Node-only, and marked so: every module here
+ * imports `server-only`, so reaching one from a client component fails the
+ * build instead of shipping SMTP credentials to a browser.
+ */
+import "server-only";
+export { createServerEnv, parseServerEnv, type EnvSource, type ServerEnv } from "./env.js";
+export { createPlaceSource, PLACE_REVALIDATE_SECONDS, PlaceSourceError, type PlaceSource, type PlaceSourceOptions } from "./place-source.js";
+export { describeLeadDb, openLeadStore, parseLeadDb, type LeadDb } from "./lead-store.js";
+export { openSqliteLeadStore, type SqliteLeadStore } from "./lead-store-sqlite.js";
+export { LeadStoreNotImplemented, openPostgresLeadStore } from "./lead-store-postgres.js";
+export { parseSmtpUrl, sendMail, type Mail, type SendOptions } from "./smtp.js";
+export { defaultLeadMail, leadNotifier, MAIL_PER_MINUTE, type LeadMail, type LeadNotifier, type NotifyEnv } from "./notify.js";
+export { clientKey, NO_CLIENT_ADDRESS, parseProxyTrust, type ProxyTrust } from "./client-key.js";
+export { checkLeadStore } from "./boot.js";

package/dist/server/index.js

@@ -0,0 +1,15 @@
+/**
+ * `@evinvest/kitstart/server` — Node-only, and marked so: every module here
+ * imports `server-only`, so reaching one from a client component fails the
+ * build instead of shipping SMTP credentials to a browser.
+ */
+import "server-only";
+export { createServerEnv, parseServerEnv } from "./env.js";
+export { createPlaceSource, PLACE_REVALIDATE_SECONDS, PlaceSourceError } from "./place-source.js";
+export { describeLeadDb, openLeadStore, parseLeadDb } from "./lead-store.js";
+export { openSqliteLeadStore } from "./lead-store-sqlite.js";
+export { LeadStoreNotImplemented, openPostgresLeadStore } from "./lead-store-postgres.js";
+export { parseSmtpUrl, sendMail } from "./smtp.js";
+export { defaultLeadMail, leadNotifier, MAIL_PER_MINUTE } from "./notify.js";
+export { clientKey, NO_CLIENT_ADDRESS, parseProxyTrust } from "./client-key.js";
+export { checkLeadStore } from "./boot.js";

package/dist/server/lead-store-postgres.d.ts

@@ -0,0 +1,14 @@
+import "server-only";
+import type { LeadStore } from "../core/lead.js";
+/**
+ * The Postgres adapter of the `LeadStore` port — not written yet. It is
+ * recognised so that `LEADS_DB_URL=postgres://…` fails at boot, loudly, instead
+ * of a deployment that asked for Postgres writing leads somewhere nobody
+ * looks. When it lands: the driver is an optional peer, the table mirrors the
+ * SQLite columns, the schema version follows `LEAD_SCHEMA_VERSION`, and it
+ * must pass `describeLeadStoreContract` before `openLeadStore` may return it.
+ */
+export declare class LeadStoreNotImplemented extends Error {
+    readonly name = "LeadStoreNotImplemented";
+}
+export declare function openPostgresLeadStore(url: string): LeadStore;

package/dist/server/lead-store-postgres.js

@@ -0,0 +1,23 @@
+import "server-only";
+/**
+ * The Postgres adapter of the `LeadStore` port — not written yet. It is
+ * recognised so that `LEADS_DB_URL=postgres://…` fails at boot, loudly, instead
+ * of a deployment that asked for Postgres writing leads somewhere nobody
+ * looks. When it lands: the driver is an optional peer, the table mirrors the
+ * SQLite columns, the schema version follows `LEAD_SCHEMA_VERSION`, and it
+ * must pass `describeLeadStoreContract` before `openLeadStore` may return it.
+ */
+export class LeadStoreNotImplemented extends Error {
+    name = "LeadStoreNotImplemented";
+}
+export function openPostgresLeadStore(url) {
+    const host = (() => {
+        try {
+            return new URL(url).host;
+        }
+        catch {
+            return "?";
+        }
+    })();
+    throw new LeadStoreNotImplemented(`LEADS_DB_URL names postgres (${host}), whose lead store adapter is not implemented yet; use sqlite:///<path>`);
+}

package/dist/server/lead-store-sqlite.d.ts

@@ -0,0 +1,21 @@
+import "server-only";
+import { type LeadStore } from "../core/lead.js";
+/**
+ * The SQLite adapter of the `LeadStore` port: one file on the pod's volume.
+ *
+ * The table began as the Rust server's (`job`, `zip`, `mobile`, `at`); the
+ * file on a prod volume is opened as it is and brought forward in place. The
+ * columns keep their first names — renaming a column on a live volume buys
+ * nothing — and map to the lead's `subject`, `locality` and `mobile`.
+ */
+export interface SqliteLeadStore extends LeadStore {
+    /** The schema version the file is at after opening. */
+    version(): number;
+}
+/**
+ * Opens (and migrates) the file synchronously, so a broken volume fails boot
+ * (see `checkLeadStore`); the port's methods are async only by contract —
+ * `node:sqlite` answers in-process, and an `async` body turns its throw into
+ * the rejection the funnel expects.
+ */
+export declare function openSqliteLeadStore(path: string): SqliteLeadStore;

package/dist/server/lead-store-sqlite.js

@@ -0,0 +1,158 @@
+import "server-only";
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { LEAD_SCHEMA_VERSION } from "../core/lead.js";
+// `node:sqlite` is reached through `getBuiltinModule` rather than an import so
+// the bundler never has to resolve a builtin it may not know yet; the type is
+// the module's own.
+function sqlite() {
+    const mod = process.getBuiltinModule("node:sqlite");
+    if (!mod)
+        throw new Error("node:sqlite is unavailable — Node ≥ 22.13 is required");
+    return mod;
+}
+/** A column of a row SQLite handed back, checked rather than cast. */
+function column(row, key) {
+    return typeof row === "object" && row !== null ? Reflect.get(row, key) : undefined;
+}
+function integer(row, key) {
+    const value = column(row, key);
+    if (typeof value === "number" || typeof value === "bigint")
+        return Number(value);
+    throw new Error(`leads: expected an integer \`${key}\`, got ${typeof value}`);
+}
+/**
+ * Each step takes the file from version `i` to `i + 1`. Append only: a step
+ * that shipped is history, and a file anywhere may be at any of them.
+ */
+const STEPS = [
+    // 1 — the Rust server's table.
+    db => db.exec(`CREATE TABLE leads (
+      id      INTEGER PRIMARY KEY AUTOINCREMENT,
+      job     TEXT NOT NULL,
+      zip     TEXT NOT NULL,
+      mobile  TEXT NOT NULL,
+      at      TEXT NOT NULL DEFAULT (datetime('now'))
+    )`),
+    // 2 — the point a lead came from. Nullable: every row written before points
+    // existed has none, and inventing one would be a lie in the one table that matters.
+    db => db.exec("ALTER TABLE leads ADD COLUMN location_id TEXT"),
+    // 3 — suspected spam is kept, flagged, and never notified: a false positive
+    // is a customer, and a reviewer can still find it here.
+    db => db.exec("ALTER TABLE leads ADD COLUMN spam_verdict TEXT"),
+    // 4 — the brand's extra fields, as a JSON object; `NULL` when there are none.
+    db => db.exec("ALTER TABLE leads ADD COLUMN extras TEXT"),
+];
+if (STEPS.length !== LEAD_SCHEMA_VERSION) {
+    // The version belongs to the port, shared by every adapter; this table of
+    // steps must end exactly there.
+    throw new Error(`leads: ${STEPS.length} sqlite steps for schema version ${LEAD_SCHEMA_VERSION}`);
+}
+const RUST_COLUMNS = ["id", "job", "zip", "mobile", "at"];
+function userVersion(db) {
+    return integer(db.prepare("PRAGMA user_version").get(), "user_version");
+}
+/**
+ * Step 0, for a file no versioned store has opened (`user_version` 0): which
+ * step it already stands at, read off the columns. The Rust server and the
+ * first Node port both left an unversioned table; the port added its columns
+ * one at a time, so a file may stop at any of them.
+ */
+function recognise(db) {
+    const columns = db.prepare("PRAGMA table_info(leads)").all().map(row => column(row, "name"));
+    if (columns.length === 0)
+        return 0;
+    if (!RUST_COLUMNS.every(c => columns.includes(c))) {
+        throw new Error(`leads: an unrecognised table (${columns.join(", ")}); refusing to migrate it`);
+    }
+    let at = 1;
+    for (const [step, added] of [[2, "location_id"], [3, "spam_verdict"], [4, "extras"]]) {
+        if (!columns.includes(added))
+            break;
+        at = step;
+    }
+    return at;
+}
+/** Runs `fn` under a write lock; two pods opening one file take turns. */
+function immediate(db, fn) {
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        fn();
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        // SQLite may already have rolled back (a failed COMMIT, an I/O error), and
+        // then ROLLBACK throws too. The first error says what went wrong; this one
+        // would only hide it. `db.isTransaction` is not in every Node ≥ 22.13.
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+            // Nothing left to roll back.
+        }
+        throw error;
+    }
+}
+function migrate(db) {
+    immediate(db, () => {
+        if (userVersion(db) === 0)
+            db.exec(`PRAGMA user_version = ${recognise(db)}`);
+    });
+    for (let target = 1; target <= STEPS.length; target++) {
+        immediate(db, () => {
+            // Read again under the lock: another process may have run this step.
+            if (userVersion(db) >= target)
+                return;
+            STEPS[target - 1]?.(db);
+            db.exec(`PRAGMA user_version = ${target}`);
+        });
+    }
+}
+/**
+ * Opens (and migrates) the file synchronously, so a broken volume fails boot
+ * (see `checkLeadStore`); the port's methods are async only by contract —
+ * `node:sqlite` answers in-process, and an `async` body turns its throw into
+ * the rejection the funnel expects.
+ */
+export function openSqliteLeadStore(path) {
+    if (path !== ":memory:")
+        mkdirSync(dirname(path), { recursive: true });
+    const db = new (sqlite().DatabaseSync)(path);
+    try {
+        // The wait first: switching to WAL takes a lock another pod may hold.
+        db.exec("PRAGMA busy_timeout = 5000");
+        db.exec("PRAGMA journal_mode = WAL");
+        migrate(db);
+    }
+    catch (error) {
+        // A refused file must not stay open behind the error: the handle would
+        // hold its WAL and leak on every retry.
+        db.close();
+        throw error;
+    }
+    const insert = db.prepare("INSERT INTO leads (job, zip, mobile, location_id, spam_verdict, extras) VALUES (?, ?, ?, ?, ?, ?) RETURNING id");
+    const count = db.prepare("SELECT COUNT(*) AS n FROM leads");
+    return {
+        async insert(lead) {
+            const extras = Object.keys(lead.extras).length > 0 ? JSON.stringify(lead.extras) : null;
+            return integer(insert.get(lead.subject, lead.locality, lead.mobile, lead.placeSlug, lead.spamVerdict, extras), "id");
+        },
+        async count() {
+            return integer(count.get(), "n");
+        },
+        version() {
+            return userVersion(db);
+        },
+        async schemaVersion() {
+            return userVersion(db);
+        },
+        async health() {
+            // A read through the handle the funnel writes with: a volume that
+            // vanished or a file locked for good answers here, not on a lead.
+            integer(count.get(), "n");
+        },
+        async close() {
+            db.close();
+        },
+    };
+}

package/dist/server/lead-store.d.ts

@@ -0,0 +1,20 @@
+import "server-only";
+import type { LeadStore } from "../core/lead.js";
+/**
+ * Where leads are kept, chosen by the scheme of `LEADS_DB_URL`:
+ *
+ * - `sqlite:///data/leads.db` — a file on the pod's volume;
+ * - `postgres://…` / `postgresql://…` — the Postgres adapter (a stub today,
+ *   which refuses at boot).
+ */
+export type LeadDb = {
+    kind: "sqlite";
+    path: string;
+} | {
+    kind: "postgres";
+    url: string;
+};
+export declare function parseLeadDb(value: string): LeadDb;
+/** Where a `LeadDb` points, for a log line: never a password. */
+export declare function describeLeadDb(db: LeadDb): string;
+export declare function openLeadStore(db: LeadDb): LeadStore;

package/dist/server/lead-store.js

@@ -0,0 +1,43 @@
+import "server-only";
+import { openPostgresLeadStore } from "./lead-store-postgres.js";
+import { openSqliteLeadStore } from "./lead-store-sqlite.js";
+const POSTGRES = new Set(["postgres:", "postgresql:"]);
+export function parseLeadDb(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        // Never the value: it may carry a password.
+        throw new Error("LEADS_DB_URL is not a URL");
+    }
+    if (url.protocol === "sqlite:") {
+        // `sqlite://data/leads.db` parses `data` as a host and would put the file
+        // at `/leads.db`; a query or fragment would be dropped just as quietly.
+        if (url.host !== "" || url.search !== "" || url.hash !== "") {
+            throw new Error("LEADS_DB_URL: a sqlite URL is sqlite:///<absolute path> with no host, query or fragment");
+        }
+        const path = decodeURIComponent(url.pathname);
+        if (!path.startsWith("/"))
+            throw new Error("LEADS_DB_URL: a sqlite path must be absolute");
+        return { kind: "sqlite", path };
+    }
+    if (POSTGRES.has(url.protocol))
+        return { kind: "postgres", url: value };
+    throw new Error(`LEADS_DB_URL: unsupported scheme ${url.protocol}`);
+}
+/** Where a `LeadDb` points, for a log line: never a password. */
+export function describeLeadDb(db) {
+    if (db.kind === "sqlite")
+        return `sqlite at ${db.path}`;
+    const url = new URL(db.url);
+    return `postgres at ${url.host}${url.pathname}`;
+}
+export function openLeadStore(db) {
+    switch (db.kind) {
+        case "sqlite":
+            return openSqliteLeadStore(db.path);
+        case "postgres":
+            return openPostgresLeadStore(db.url);
+    }
+}

package/dist/server/notify.d.ts

@@ -0,0 +1,37 @@
+import "server-only";
+import type { Lead } from "../core/lead.js";
+import type { BrandFacts } from "../core/site.js";
+import type { ServerEnv } from "./env.js";
+/**
+ * Telling the business a lead arrived. Called only after the lead is stored,
+ * and allowed to fail: a lead on disk but un-notified is recoverable; a 500
+ * shown to a customer whose lead we already hold is not.
+ */
+export interface LeadNotifier {
+    notify(lead: Lead, id: number): Promise<void>;
+}
+export interface LeadMail {
+    subject: string;
+    text: string;
+}
+export type NotifyEnv = Pick<ServerEnv, "smtpUrl" | "notifyTo" | "notifyFrom" | "smsToken">;
+/** A plain default; a brand passes `format` to write it in its own language. */
+export declare function defaultLeadMail(brand: Pick<BrandFacts, "name">, lead: Lead, id: number): LeadMail;
+/**
+ * Checked when it is built — at boot, when a brand builds it there — not on
+ * the first lead: with SMTP configured, a sender needs a domain to be `leads@`
+ * of (or `LEAD_NOTIFY_FROM`), and a recipient needs the brand's mailbox (or
+ * `LEAD_NOTIFY_TO`). A site before launch has neither, and `leads@null` is a
+ * mail no relay delivers.
+ */
+/** Mails a notifier sends per minute, per process; past it the lead is only logged. */
+export declare const MAIL_PER_MINUTE = 20;
+export declare function leadNotifier(site: {
+    brand: BrandFacts;
+}, env: NotifyEnv, options?: {
+    format?: (lead: Lead, id: number) => LeadMail;
+    log?: Pick<Console, "warn">;
+    /** `MAIL_PER_MINUTE` by default: a flood that passes the antispam must not become a mail flood. */
+    mailPerMinute?: number;
+    now?: () => number;
+}): LeadNotifier;