@stack-mode/site-manager-kit 1.44.0 → 1.45.0

package/src/blog.ts

@@ -1,122 +1,122 @@
-import { bp, bpWithMeta, tagsFor } from "./client";
-import type { BlogCategory, BlogFeed, BlogPage, BlogPost, BlogPostSummary, BlogTag, Paging } from "./types";
-
-// Reads for the Blog section. Posts are cached under the blog tag; a single post also under seo, since its search
-// listing is edited in Search Listings.
-
-type PageOpts = { page?: number; perPage?: number };
-
-const q = (params: Record<string, string | number | undefined | null>) => {
-  const sp = new URLSearchParams();
-  for (const [k, v] of Object.entries(params)) if (v !== undefined && v !== null && v !== "") sp.set(k, String(v));
-  const s = sp.toString();
-  return s ? `?${s}` : "";
-};
-
-const emptyPaging = (o: PageOpts): Paging => ({ page: o.page ?? 1, perPage: o.perPage ?? 10, total: 0, totalPages: 0 });
-
-function paging(meta: Record<string, unknown>, o: PageOpts): Paging {
-  const n = (k: keyof Paging) => (typeof meta[k] === "number" ? (meta[k] as number) : emptyPaging(o)[k]);
-  return { page: n("page"), perPage: n("perPage"), total: n("total"), totalPages: n("totalPages") };
-}
-
-/** Published posts, newest first, a page at a time (`perPage` up to 50), optionally in one category or with one tag (by slug). */
-export async function getPosts(opts: PageOpts & { category?: string; tag?: string } = {}): Promise<BlogPage> {
-  const r = await bpWithMeta<BlogPostSummary[]>(`/blog/posts${q({ page: opts.page, perPage: opts.perPage, category: opts.category, tag: opts.tag })}`, { tags: tagsFor("blog") });
-  return r ? { posts: r.data, paging: paging(r.meta, opts) } : { posts: [], paging: emptyPaging(opts) };
-}
-
-/** One published post with its body and search listing, or null. */
-export const getPost = (slug: string) => bp<BlogPost>(`/blog/posts/${encodeURIComponent(slug)}`, { tags: tagsFor("blog", "seo") });
-
-export const getBlogCategories = async () => (await bp<BlogCategory[]>("/blog/categories", { tags: tagsFor("blog") })) ?? [];
-
-/** One category and a page of its posts, or null when there's no such category. */
-export async function getBlogCategory(slug: string, opts: PageOpts = {}): Promise<{ category: BlogCategory; posts: BlogPostSummary[]; paging: Paging } | null> {
-  const r = await bpWithMeta<{ category: BlogCategory; posts: BlogPostSummary[] }>(`/blog/categories/${encodeURIComponent(slug)}${q({ page: opts.page, perPage: opts.perPage })}`, { tags: tagsFor("blog") });
-  return r ? { ...r.data, paging: paging(r.meta, opts) } : null;
-}
-
-export const getBlogTags = async () => (await bp<BlogTag[]>("/blog/tags", { tags: tagsFor("blog") })) ?? [];
-
-/** The newest posts with full bodies, shaped for RSS (`limit` up to 50, default 20). */
-export const getBlogFeed = (opts: { limit?: number } = {}) => bp<BlogFeed>(`/blog/feed${q({ limit: opts.limit })}`, { tags: tagsFor("blog", "business_info", "seo") });
-
-const xml = (s: string) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
-// CDATA can't contain its own end marker, so one is split across two sections.
-const cdata = (s: string) => `<![CDATA[${s.replace(/]]>/g, "]]]]><![CDATA[>")}]]>`;
-
-/**
- * Pure: an RSS 2.0 document from the feed. `feedUrl` is this feed's own address (for the atom:link self reference),
- * and `link` overrides the website address when Site Manager doesn't have one.
- */
-export function buildRss(feed: BlogFeed, opts: { feedUrl?: string; link?: string; title?: string; description?: string } = {}): string {
-  const link = opts.link ?? feed.link ?? "";
-  const self = opts.feedUrl ?? feed.feedUrl;
-  const items = feed.items.map((i) =>
-    [
-      "<item>",
-      `<title>${xml(i.title)}</title>`,
-      i.link ? `<link>${xml(i.link)}</link>` : "",
-      `<guid isPermaLink="${i.guidIsPermaLink ? "true" : "false"}">${xml(i.guid)}</guid>`,
-      i.pubDate ? `<pubDate>${xml(i.pubDate)}</pubDate>` : "",
-      i.author ? `<dc:creator>${xml(i.author)}</dc:creator>` : "",
-      ...i.categories.map((c) => `<category>${xml(c)}</category>`),
-      i.summary ? `<description>${xml(i.summary)}</description>` : "",
-      i.contentHtml ? `<content:encoded>${cdata(i.contentHtml)}</content:encoded>` : "",
-      i.image ? `<enclosure url="${xml(i.image.url)}" type="${xml(imageType(i.image.url))}" length="0"/>` : "",
-      "</item>",
-    ]
-      .filter(Boolean)
-      .join(""),
-  );
-  return [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    '<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/">',
-    "<channel>",
-    `<title>${xml(opts.title ?? feed.title)}</title>`,
-    `<link>${xml(link)}</link>`,
-    `<description>${xml(opts.description ?? feed.description ?? feed.title)}</description>`,
-    `<language>${xml(feed.language)}</language>`,
-    feed.updatedAt ? `<lastBuildDate>${new Date(feed.updatedAt).toUTCString()}</lastBuildDate>` : "",
-    self ? `<atom:link href="${xml(self)}" rel="self" type="application/rss+xml"/>` : "",
-    ...items,
-    "</channel>",
-    "</rss>",
-  ]
-    .filter(Boolean)
-    .join("\n");
-}
-
-function imageType(url: string): string {
-  const ext = url.split("?")[0].split(".").pop()?.toLowerCase();
-  return ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "gif" ? "image/gif" : ext === "avif" ? "image/avif" : "image/jpeg";
-}
-
-/**
- * Pure: schema.org BlogPosting JSON-LD for a post page. Put it in a `<script type="application/ld+json">` with
- * `JSON.stringify(...).replace(/</g, "\\u003c")`. Fields that aren't known are left out rather than guessed.
- */
-export function blogPostingJsonLd(post: BlogPost, opts: { publisherName?: string; publisherLogo?: string; url?: string } = {}): Record<string, unknown> {
-  const url = opts.url ?? post.seo?.canonical ?? post.url ?? undefined;
-  const image = post.cover?.url ?? post.seo?.ogImage?.url;
-  const out: Record<string, unknown> = {
-    "@context": "https://schema.org",
-    "@type": "BlogPosting",
-    headline: post.title.slice(0, 110),
-  };
-  if (url) {
-    out.url = url;
-    out.mainEntityOfPage = { "@type": "WebPage", "@id": url };
-  }
-  if (post.seo?.description ?? post.excerpt) out.description = post.seo?.description ?? post.excerpt;
-  if (image) out.image = [image];
-  if (post.publishedAt) out.datePublished = post.publishedAt;
-  out.dateModified = post.updatedAt;
-  if (post.author) out.author = { "@type": "Person", name: post.author.name, ...(post.author.url ? { url: post.author.url } : {}) };
-  if (opts.publisherName) out.publisher = { "@type": "Organization", name: opts.publisherName, ...(opts.publisherLogo ? { logo: { "@type": "ImageObject", url: opts.publisherLogo } } : {}) };
-  if (post.categories.length) out.articleSection = post.categories.map((c) => c.name);
-  if (post.tags.length) out.keywords = post.tags.map((t) => t.name).join(", ");
-  if (post.wordCount) out.wordCount = post.wordCount;
-  return out;
-}
+import { bp, bpWithMeta, tagsFor } from "./client";
+import type { BlogCategory, BlogFeed, BlogPage, BlogPost, BlogPostSummary, BlogTag, Paging } from "./types";
+
+// Reads for the Blog section. Posts are cached under the blog tag; a single post also under seo, since its search
+// listing is edited in Search Listings.
+
+type PageOpts = { page?: number; perPage?: number };
+
+const q = (params: Record<string, string | number | undefined | null>) => {
+  const sp = new URLSearchParams();
+  for (const [k, v] of Object.entries(params)) if (v !== undefined && v !== null && v !== "") sp.set(k, String(v));
+  const s = sp.toString();
+  return s ? `?${s}` : "";
+};
+
+const emptyPaging = (o: PageOpts): Paging => ({ page: o.page ?? 1, perPage: o.perPage ?? 10, total: 0, totalPages: 0 });
+
+function paging(meta: Record<string, unknown>, o: PageOpts): Paging {
+  const n = (k: keyof Paging) => (typeof meta[k] === "number" ? (meta[k] as number) : emptyPaging(o)[k]);
+  return { page: n("page"), perPage: n("perPage"), total: n("total"), totalPages: n("totalPages") };
+}
+
+/** Published posts, newest first, a page at a time (`perPage` up to 50), optionally in one category or with one tag (by slug). */
+export async function getPosts(opts: PageOpts & { category?: string; tag?: string } = {}): Promise<BlogPage> {
+  const r = await bpWithMeta<BlogPostSummary[]>(`/blog/posts${q({ page: opts.page, perPage: opts.perPage, category: opts.category, tag: opts.tag })}`, { tags: tagsFor("blog") });
+  return r ? { posts: r.data, paging: paging(r.meta, opts) } : { posts: [], paging: emptyPaging(opts) };
+}
+
+/** One published post with its body and search listing, or null. */
+export const getPost = (slug: string) => bp<BlogPost>(`/blog/posts/${encodeURIComponent(slug)}`, { tags: tagsFor("blog", "seo") });
+
+export const getBlogCategories = async () => (await bp<BlogCategory[]>("/blog/categories", { tags: tagsFor("blog") })) ?? [];
+
+/** One category and a page of its posts, or null when there's no such category. */
+export async function getBlogCategory(slug: string, opts: PageOpts = {}): Promise<{ category: BlogCategory; posts: BlogPostSummary[]; paging: Paging } | null> {
+  const r = await bpWithMeta<{ category: BlogCategory; posts: BlogPostSummary[] }>(`/blog/categories/${encodeURIComponent(slug)}${q({ page: opts.page, perPage: opts.perPage })}`, { tags: tagsFor("blog") });
+  return r ? { ...r.data, paging: paging(r.meta, opts) } : null;
+}
+
+export const getBlogTags = async () => (await bp<BlogTag[]>("/blog/tags", { tags: tagsFor("blog") })) ?? [];
+
+/** The newest posts with full bodies, shaped for RSS (`limit` up to 50, default 20). */
+export const getBlogFeed = (opts: { limit?: number } = {}) => bp<BlogFeed>(`/blog/feed${q({ limit: opts.limit })}`, { tags: tagsFor("blog", "business_info", "seo") });
+
+const xml = (s: string) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
+// CDATA can't contain its own end marker, so one is split across two sections.
+const cdata = (s: string) => `<![CDATA[${s.replace(/]]>/g, "]]]]><![CDATA[>")}]]>`;
+
+/**
+ * Pure: an RSS 2.0 document from the feed. `feedUrl` is this feed's own address (for the atom:link self reference),
+ * and `link` overrides the website address when Site Manager doesn't have one.
+ */
+export function buildRss(feed: BlogFeed, opts: { feedUrl?: string; link?: string; title?: string; description?: string } = {}): string {
+  const link = opts.link ?? feed.link ?? "";
+  const self = opts.feedUrl ?? feed.feedUrl;
+  const items = feed.items.map((i) =>
+    [
+      "<item>",
+      `<title>${xml(i.title)}</title>`,
+      i.link ? `<link>${xml(i.link)}</link>` : "",
+      `<guid isPermaLink="${i.guidIsPermaLink ? "true" : "false"}">${xml(i.guid)}</guid>`,
+      i.pubDate ? `<pubDate>${xml(i.pubDate)}</pubDate>` : "",
+      i.author ? `<dc:creator>${xml(i.author)}</dc:creator>` : "",
+      ...i.categories.map((c) => `<category>${xml(c)}</category>`),
+      i.summary ? `<description>${xml(i.summary)}</description>` : "",
+      i.contentHtml ? `<content:encoded>${cdata(i.contentHtml)}</content:encoded>` : "",
+      i.image ? `<enclosure url="${xml(i.image.url)}" type="${xml(imageType(i.image.url))}" length="0"/>` : "",
+      "</item>",
+    ]
+      .filter(Boolean)
+      .join(""),
+  );
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/">',
+    "<channel>",
+    `<title>${xml(opts.title ?? feed.title)}</title>`,
+    `<link>${xml(link)}</link>`,
+    `<description>${xml(opts.description ?? feed.description ?? feed.title)}</description>`,
+    `<language>${xml(feed.language)}</language>`,
+    feed.updatedAt ? `<lastBuildDate>${new Date(feed.updatedAt).toUTCString()}</lastBuildDate>` : "",
+    self ? `<atom:link href="${xml(self)}" rel="self" type="application/rss+xml"/>` : "",
+    ...items,
+    "</channel>",
+    "</rss>",
+  ]
+    .filter(Boolean)
+    .join("\n");
+}
+
+function imageType(url: string): string {
+  const ext = url.split("?")[0].split(".").pop()?.toLowerCase();
+  return ext === "png" ? "image/png" : ext === "webp" ? "image/webp" : ext === "gif" ? "image/gif" : ext === "avif" ? "image/avif" : "image/jpeg";
+}
+
+/**
+ * Pure: schema.org BlogPosting JSON-LD for a post page. Put it in a `<script type="application/ld+json">` with
+ * `JSON.stringify(...).replace(/</g, "\\u003c")`. Fields that aren't known are left out rather than guessed.
+ */
+export function blogPostingJsonLd(post: BlogPost, opts: { publisherName?: string; publisherLogo?: string; url?: string } = {}): Record<string, unknown> {
+  const url = opts.url ?? post.seo?.canonical ?? post.url ?? undefined;
+  const image = post.cover?.url ?? post.seo?.ogImage?.url;
+  const out: Record<string, unknown> = {
+    "@context": "https://schema.org",
+    "@type": "BlogPosting",
+    headline: post.title.slice(0, 110),
+  };
+  if (url) {
+    out.url = url;
+    out.mainEntityOfPage = { "@type": "WebPage", "@id": url };
+  }
+  if (post.seo?.description ?? post.excerpt) out.description = post.seo?.description ?? post.excerpt;
+  if (image) out.image = [image];
+  if (post.publishedAt) out.datePublished = post.publishedAt;
+  out.dateModified = post.updatedAt;
+  if (post.author) out.author = { "@type": "Person", name: post.author.name, ...(post.author.url ? { url: post.author.url } : {}) };
+  if (opts.publisherName) out.publisher = { "@type": "Organization", name: opts.publisherName, ...(opts.publisherLogo ? { logo: { "@type": "ImageObject", url: opts.publisherLogo } } : {}) };
+  if (post.categories.length) out.articleSection = post.categories.map((c) => c.name);
+  if (post.tags.length) out.keywords = post.tags.map((t) => t.name).join(", ");
+  if (post.wordCount) out.wordCount = post.wordCount;
+  return out;
+}

package/src/chat-route.ts

@@ -1,136 +1,136 @@
-import { createHash } from "node:crypto";
-
-/*
- * The website's own chat route, between the visitor's browser and Site Manager: the browser never sees the API key,
- * Site Manager never sees the visitor's IP address (only its hash), and only this website's pages can use it.
- *
- *   // app/api/blueprint/chat/route.ts
- *   export { GET, POST } from "site-manager-kit/chat-route";
- *
- * POST { type: "message", conversationId?, visitorId, message, pageUrl?, hp? }   streams the reply (NDJSON)
- * POST { type: "lead", conversationId, visitorId, name, email, phone, message, slot?, hp?, attribution? }
- * GET  ?slots=1&from=YYYY-MM-DD                                                  open times the chat can book
- */
-
-const MAX_BODY = 20_000;
-
-function env(name: string): string {
-  const v = process.env[name]?.trim();
-  if (!v) throw new Error(`${name} is not set`);
-  return v;
-}
-
-const json = (body: unknown, status = 200, headers: Record<string, string> = {}) => Response.json(body, { status, headers: { "cache-control": "no-store", ...headers } });
-
-/** Only this website's own pages may use the route, so nobody else can spend the site's AI key through it. */
-export function sameOrigin(req: Request): boolean {
-  const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host");
-  if (!host) return false;
-  const origin = req.headers.get("origin");
-  if (!origin) return req.headers.get("sec-fetch-site") === "same-origin";
-  try {
-    return new URL(origin).host === host;
-  } catch {
-    return false;
-  }
-}
-
-function visitorIpHash(req: Request): string | undefined {
-  const ip = req.headers.get("x-real-ip") ?? req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "";
-  return ip ? createHash("sha256").update(ip).digest("hex") : undefined;
-}
-
-async function isBot(): Promise<boolean> {
-  try {
-    const { checkBotId } = await import("botid/server");
-    const r = await checkBotId();
-    return r.isBot && !r.isVerifiedBot;
-  } catch {
-    // BotID isn't set up on this site. Site Manager's limits and the honeypot still apply.
-    return false;
-  }
-}
-
-async function upstream(path: string, init: RequestInit): Promise<Response> {
-  const base = env("BLUEPRINT_URL").replace(/\/+$/, "");
-  return fetch(`${base}/api/v1${path}`, {
-    cache: "no-store",
-    ...init,
-    headers: { authorization: `Bearer ${env("BLUEPRINT_API_KEY")}`, ...(init.body ? { "content-type": "application/json" } : {}) },
-  });
-}
-
-const str = (v: unknown, max: number) => (typeof v === "string" ? v.slice(0, max) : undefined);
-
-export async function POST(req: Request): Promise<Response> {
-  if (!sameOrigin(req)) return json({ error: "forbidden" }, 403);
-  const raw = await req.text();
-  if (raw.length > MAX_BODY) return json({ error: "too_large" }, 413);
-  let body: Record<string, unknown>;
-  try {
-    body = JSON.parse(raw) as Record<string, unknown>;
-  } catch {
-    return json({ error: "bad_request" }, 400);
-  }
-  const common = {
-    conversationId: str(body.conversationId, 64),
-    visitorId: str(body.visitorId, 100),
-    ipHash: visitorIpHash(req),
-    userAgent: req.headers.get("user-agent")?.slice(0, 500) ?? undefined,
-    hp: str(body.hp, 200),
-  };
-
-  if (body.type === "message") {
-    if (await isBot()) return json({ error: "forbidden" }, 403);
-    const res = await upstream("/chat", {
-      method: "POST",
-      body: JSON.stringify({ ...common, message: str(body.message, 5000) ?? "", pageUrl: str(body.pageUrl, 2000) ?? req.headers.get("referer") ?? undefined }),
-    });
-    if (!res.ok || !res.body) {
-      const err = (await res.json().catch(() => null)) as { error?: { code?: string; reason?: string } } | null;
-      const retry = res.headers.get("retry-after");
-      const status = res.status === 429 || res.status === 422 || res.status === 404 || res.status === 400 ? res.status : 502;
-      return json({ error: err?.error?.reason ?? err?.error?.code ?? "unavailable" }, status, retry ? { "retry-after": retry } : {});
-    }
-    // Passed through as it streams, so the visitor sees the reply being written.
-    return new Response(res.body, { status: 200, headers: { "content-type": "application/x-ndjson; charset=utf-8", "cache-control": "no-store", "x-accel-buffering": "no" } });
-  }
-
-  if (body.type === "lead") {
-    const attribution = body.attribution && typeof body.attribution === "object" ? (body.attribution as Record<string, unknown>) : {};
-    const res = await upstream("/chat/lead", {
-      method: "POST",
-      body: JSON.stringify({
-        ...common,
-        name: str(body.name, 200) ?? "",
-        email: str(body.email, 320) ?? "",
-        phone: str(body.phone, 40) ?? "",
-        message: str(body.message, 2000) ?? "",
-        slot: str(body.slot, 40),
-        // A bot gets the usual thanks and nothing is stored, as with forms.
-        ...((await isBot()) ? { hp: "kit:bot" } : {}),
-        attribution: { landingPath: str(attribution.landingPath, 2000), referrer: str(attribution.referrer, 2000) },
-      }),
-    });
-    const out = (await res.json().catch(() => null)) as { data?: { successMessage: string }; error?: { fields?: Record<string, string> } } | null;
-    if (res.status === 201 && out?.data) return json({ ok: true, successMessage: out.data.successMessage });
-    if (res.status === 422) return json({ ok: false, error: "invalid", fields: out?.error?.fields ?? {} });
-    if (res.status === 409) return json({ ok: false, error: "slot_taken", fields: out?.error?.fields ?? {} });
-    if (res.status === 429) return json({ ok: false, error: "rate_limited" });
-    return json({ ok: false, error: "unavailable" });
-  }
-
-  return json({ error: "bad_request" }, 400);
-}
-
-export async function GET(req: Request): Promise<Response> {
-  if (!sameOrigin(req)) return json({ error: "forbidden" }, 403);
-  const url = new URL(req.url);
-  if (!url.searchParams.has("slots")) return json({ error: "bad_request" }, 400);
-  const q = new URLSearchParams({ days: "7" });
-  const from = url.searchParams.get("from");
-  if (from && /^\d{4}-\d{2}-\d{2}$/.test(from)) q.set("from", from);
-  const res = await upstream(`/chat/slots?${q}`, { method: "GET" });
-  const out = (await res.json().catch(() => null)) as { data?: unknown } | null;
-  return res.ok && out?.data ? json(out.data) : json({ error: "unavailable" }, 404);
-}
+import { createHash } from "node:crypto";
+
+/*
+ * The website's own chat route, between the visitor's browser and Site Manager: the browser never sees the API key,
+ * Site Manager never sees the visitor's IP address (only its hash), and only this website's pages can use it.
+ *
+ *   // app/api/blueprint/chat/route.ts
+ *   export { GET, POST } from "site-manager-kit/chat-route";
+ *
+ * POST { type: "message", conversationId?, visitorId, message, pageUrl?, hp? }   streams the reply (NDJSON)
+ * POST { type: "lead", conversationId, visitorId, name, email, phone, message, slot?, hp?, attribution? }
+ * GET  ?slots=1&from=YYYY-MM-DD                                                  open times the chat can book
+ */
+
+const MAX_BODY = 20_000;
+
+function env(name: string): string {
+  const v = process.env[name]?.trim();
+  if (!v) throw new Error(`${name} is not set`);
+  return v;
+}
+
+const json = (body: unknown, status = 200, headers: Record<string, string> = {}) => Response.json(body, { status, headers: { "cache-control": "no-store", ...headers } });
+
+/** Only this website's own pages may use the route, so nobody else can spend the site's AI key through it. */
+export function sameOrigin(req: Request): boolean {
+  const host = req.headers.get("x-forwarded-host") ?? req.headers.get("host");
+  if (!host) return false;
+  const origin = req.headers.get("origin");
+  if (!origin) return req.headers.get("sec-fetch-site") === "same-origin";
+  try {
+    return new URL(origin).host === host;
+  } catch {
+    return false;
+  }
+}
+
+function visitorIpHash(req: Request): string | undefined {
+  const ip = req.headers.get("x-real-ip") ?? req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "";
+  return ip ? createHash("sha256").update(ip).digest("hex") : undefined;
+}
+
+async function isBot(): Promise<boolean> {
+  try {
+    const { checkBotId } = await import("botid/server");
+    const r = await checkBotId();
+    return r.isBot && !r.isVerifiedBot;
+  } catch {
+    // BotID isn't set up on this site. Site Manager's limits and the honeypot still apply.
+    return false;
+  }
+}
+
+async function upstream(path: string, init: RequestInit): Promise<Response> {
+  const base = env("BLUEPRINT_URL").replace(/\/+$/, "");
+  return fetch(`${base}/api/v1${path}`, {
+    cache: "no-store",
+    ...init,
+    headers: { authorization: `Bearer ${env("BLUEPRINT_API_KEY")}`, ...(init.body ? { "content-type": "application/json" } : {}) },
+  });
+}
+
+const str = (v: unknown, max: number) => (typeof v === "string" ? v.slice(0, max) : undefined);
+
+export async function POST(req: Request): Promise<Response> {
+  if (!sameOrigin(req)) return json({ error: "forbidden" }, 403);
+  const raw = await req.text();
+  if (raw.length > MAX_BODY) return json({ error: "too_large" }, 413);
+  let body: Record<string, unknown>;
+  try {
+    body = JSON.parse(raw) as Record<string, unknown>;
+  } catch {
+    return json({ error: "bad_request" }, 400);
+  }
+  const common = {
+    conversationId: str(body.conversationId, 64),
+    visitorId: str(body.visitorId, 100),
+    ipHash: visitorIpHash(req),
+    userAgent: req.headers.get("user-agent")?.slice(0, 500) ?? undefined,
+    hp: str(body.hp, 200),
+  };
+
+  if (body.type === "message") {
+    if (await isBot()) return json({ error: "forbidden" }, 403);
+    const res = await upstream("/chat", {
+      method: "POST",
+      body: JSON.stringify({ ...common, message: str(body.message, 5000) ?? "", pageUrl: str(body.pageUrl, 2000) ?? req.headers.get("referer") ?? undefined }),
+    });
+    if (!res.ok || !res.body) {
+      const err = (await res.json().catch(() => null)) as { error?: { code?: string; reason?: string } } | null;
+      const retry = res.headers.get("retry-after");
+      const status = res.status === 429 || res.status === 422 || res.status === 404 || res.status === 400 ? res.status : 502;
+      return json({ error: err?.error?.reason ?? err?.error?.code ?? "unavailable" }, status, retry ? { "retry-after": retry } : {});
+    }
+    // Passed through as it streams, so the visitor sees the reply being written.
+    return new Response(res.body, { status: 200, headers: { "content-type": "application/x-ndjson; charset=utf-8", "cache-control": "no-store", "x-accel-buffering": "no" } });
+  }
+
+  if (body.type === "lead") {
+    const attribution = body.attribution && typeof body.attribution === "object" ? (body.attribution as Record<string, unknown>) : {};
+    const res = await upstream("/chat/lead", {
+      method: "POST",
+      body: JSON.stringify({
+        ...common,
+        name: str(body.name, 200) ?? "",
+        email: str(body.email, 320) ?? "",
+        phone: str(body.phone, 40) ?? "",
+        message: str(body.message, 2000) ?? "",
+        slot: str(body.slot, 40),
+        // A bot gets the usual thanks and nothing is stored, as with forms.
+        ...((await isBot()) ? { hp: "kit:bot" } : {}),
+        attribution: { landingPath: str(attribution.landingPath, 2000), referrer: str(attribution.referrer, 2000) },
+      }),
+    });
+    const out = (await res.json().catch(() => null)) as { data?: { successMessage: string }; error?: { fields?: Record<string, string> } } | null;
+    if (res.status === 201 && out?.data) return json({ ok: true, successMessage: out.data.successMessage });
+    if (res.status === 422) return json({ ok: false, error: "invalid", fields: out?.error?.fields ?? {} });
+    if (res.status === 409) return json({ ok: false, error: "slot_taken", fields: out?.error?.fields ?? {} });
+    if (res.status === 429) return json({ ok: false, error: "rate_limited" });
+    return json({ ok: false, error: "unavailable" });
+  }
+
+  return json({ error: "bad_request" }, 400);
+}
+
+export async function GET(req: Request): Promise<Response> {
+  if (!sameOrigin(req)) return json({ error: "forbidden" }, 403);
+  const url = new URL(req.url);
+  if (!url.searchParams.has("slots")) return json({ error: "bad_request" }, 400);
+  const q = new URLSearchParams({ days: "7" });
+  const from = url.searchParams.get("from");
+  if (from && /^\d{4}-\d{2}-\d{2}$/.test(from)) q.set("from", from);
+  const res = await upstream(`/chat/slots?${q}`, { method: "GET" });
+  const out = (await res.json().catch(() => null)) as { data?: unknown } | null;
+  return res.ok && out?.data ? json(out.data) : json({ error: "unavailable" }, 404);
+}