bsmnt 0.10.0 → 0.11.0

package/src/templates/next-pagebuilder-cache/README.md

@@ -0,0 +1,212 @@
+# Page Builder Template (Cache Components)
+
+Next.js + Sanity CMS page builder architecture. All URL structure is managed in Sanity, not in code.
+
+This is the [Cache Components](https://nextjs.org/docs/app/api-reference/config/next-config-js/cacheComponents)
+variant: `cacheComponents: true`, so every Sanity read sits behind a `'use cache'`
+boundary and lands in the static shell, and `cacheLife` runs on a ~1-year window.
+Nothing is time-based — the publish webhook is what invalidates, and
+`<SanityLive />` only runs in draft mode. See "Content invalidation" below; without
+that webhook, published changes never reach the deployed site.
+
+## Getting Started
+
+```bash
+bun dev
+```
+
+## Architecture
+
+- Single catch-all route `[[...slug]]` handles all pages
+- Sanity page builder with composable content blocks
+- Blog with categories, filtering, and pagination
+- Visual editing and live preview support
+
+## Commands
+
+- `bun dev` - Start dev server
+- `bun build` - Production build
+- `bun lint` - Run linter
+- `bun sanity:typegen` - Generate Sanity types
+<!-- bsmnt:if dotenvx -->
+- `bun env:set KEY value` - Encrypt one value into `.env` (`--plain`, `--preview`/`--prod`)
+- `bun env:encrypt-all` - Bulk-encrypt every plaintext value in a file (`--preview`/`--prod`)
+- `bun env:setup` - Restore `.env.keys` from 1Password
+- `bun env:view` - Print the decrypted `.env` (`--preview` / `--prod`)
+- `bun env:setup-remote` - Push private keys to GitHub / Vercel (`github`/`vercel`, or pick)
+- `bun setup-remote` - Create the GitHub repo, link a Vercel project, and push the key to Vercel env
+- `bun env:save` - Save the private key to 1Password (Development vault)
+<!-- bsmnt:endif -->
+
+<!-- bsmnt:if dotenvx -->
+## Environment variables
+
+Secrets are encrypted at rest with [dotenvx](https://dotenvx.com): the committed `.env` holds encrypted values, the private keys live in `.env.keys` (gitignored), and dev/build run through `dotenvx run` so values decrypt automatically.
+
+**First run.** `bun install` restores `.env.keys` from 1Password (via `DOTENV_PRIVATE_KEY_OP_REF` in `.env`), or run `bun run env:setup`. Needs 1Password access + the `op` CLI:
+
+- macOS: `brew install --cask 1password-cli`
+- Windows: `winget install 1password-cli`
+- Linux / other: [1Password CLI docs](https://developer.1password.com/docs/cli/get-started/)
+
+**Add or change a variable** (in `.env`):
+
+- Secret: `bun run env:set KEY value` (`--preview`/`--prod` to target an environment)
+- Public / `NEXT_PUBLIC_*`: `bun run env:set KEY value --plain`
+- Bulk-encrypt a hand-edited file: `bun run env:encrypt-all`
+- Inspect: `bun run env:view` (`--preview`/`--prod`)
+
+**Per environment.** Scripts load `.env.$VERCEL_ENV` over `.env`. After adding a per-env file, push its key with `bun run env:setup-remote vercel` — `instrumentation.ts` uses it to decrypt at runtime.
+
+**Edge runtime.** dotenvx decrypts only in the Node runtime; secrets read in `middleware.ts` or a `runtime = "edge"` route must be set as plain Vercel env vars.
+
+A gitleaks pre-commit hook + CI scan block committed plaintext secrets (install: `brew install gitleaks`).
+
+<!-- bsmnt:endif -->
+<!-- bsmnt:if !dotenvx -->
+## Environment variables
+
+Copy `.env.example` to `.env.local` and fill in the values you need. `.env.local` is gitignored, so it stays off version control. Only `NEXT_PUBLIC_*` variables are exposed to the browser — everything else is server-only.
+
+For deploys, set the same variables in your host's dashboard (e.g. Vercel → Settings → Environment Variables).
+
+<!-- bsmnt:endif -->
+## Sanity Dashboard (Studio in an iframe)
+
+The Studio at `/studio` can be embedded in the Sanity Dashboard
+(`https://www.sanity.io/@<org>/studio/<appId>/<workspace>`), which loads it in an
+iframe from `www.sanity.io`. Three things have to be true for that to work:
+
+1. **Headers.** `next.config.ts` already exempts `/studio/:path*` from the
+   site-wide `X-Frame-Options` / `frame-ancestors 'self'` headers, sending
+   `frame-ancestors 'self' https://*.sanity.io` there instead and dropping
+   `X-Frame-Options` entirely for that path (it has no "allow this origin"
+   form — it must be absent, not overridden). Nothing to do here unless
+   you've hand-edited `headers()`.
+2. **Bridge script.** Already wired in: `next-sanity/studio`'s `NextStudio`
+   re-exports `NextStudioWithBridge`, which renders the
+   `core.sanity-cdn.com/bridge.js` tag the Dashboard needs. Don't hand-roll
+   that script tag, and don't switch the Studio route to
+   `next-sanity/studio/client-component` (the bridge-less variant).
+3. **Registered URL.** In [Sanity Manage](https://sanity.io/manage), the
+   Studio application's URL must be the **full path**
+   (`https://example.com/studio`), not just the domain. This can't be set
+   from code — either click through Manage, or run
+   `sanity deploy --external --url https://example.com/studio --yes` from
+   `lib/integrations/sanity`. Writing it via the API needs the
+   `sanity.project.deployStudio` grant, which read/write tokens don't have.
+
+Verify against a production build (`bun build && bun start`), not dev. One trap:
+the Dashboard reports `Failed to load iframe due to X-Frame-Options: SAMEORIGIN`
+for *any* framing failure, including a wrong registered URL with already-correct
+headers. Trust the browser console's `Framing '<url>' violates …` line instead —
+it names the URL actually being framed.
+
+## Content invalidation (publish webhook) — required
+
+Cached content is invalidated **on demand**, not on a timer: `cacheLife` is set to
+a ~1-year window because a publish is supposed to clear the affected entries. That
+clearing happens in `app/api/revalidate/route.ts`, which only runs if a Sanity
+webhook calls it. **Until you create that webhook, published changes will not
+appear on the deployed site until the next deploy.**
+
+`SANITY_REVALIDATE_SECRET` is generated for you during `bsmnt create` (see your
+env file). The webhook itself is manual, because the deployed URL isn't known at
+scaffold time. Once deployed, in **sanity.io/manage → API → Webhooks → Create**:
+
+| Field | Value |
+| --- | --- |
+| URL | `https://<your-domain>/api/revalidate` |
+| Dataset | `production` |
+| Trigger on | Create, Update, Delete |
+| Filter | leave empty (the route decides what to invalidate) |
+| Projection | see below — the route needs `operation` and `before()` |
+| HTTP method | `POST` |
+| API version | `v2021-03-25` or later |
+| Secret | the `SANITY_REVALIDATE_SECRET` value from your env |
+
+The projection is not optional: the route reads `operation` and the pre-delete
+document to invalidate a removed page, and neither is in the default payload.
+
+```groq
+{
+  "_id": _id,
+  "_type": _type,
+  "operation": delta::operation(),
+  "before": before(),
+  "after": after()
+}
+```
+
+Make sure the same secret is set in your hosting provider's environment, not just
+locally. To check it end to end: publish a change in the Studio, then reload the
+affected page — it should update without a redeploy. Close any other tab on the
+site first: in draft mode `<SanityLive>` refreshes the router on its own, which
+can make a broken webhook look like it works.
+
+### Watch that it keeps working
+
+This webhook is the only thing that invalidates published content — `<SanityLive>`
+is mounted in draft mode only, so nothing else clears a cache entry. A webhook that
+silently stops delivering therefore freezes the site until the next deploy, with no
+other symptom.
+
+**sanity.io/manage → API → Webhooks → your webhook → Delivery log** is where to
+check. A 401 means the secret doesn't match; repeated 5xx means the route is
+erroring; no attempts at all means the filter or dataset is wrong. Worth an alert
+if you have somewhere to send one.
+
+### Recovering from a missed invalidation
+
+If a page is stale and you don't know which tag was missed, `POST` a purge to the
+same route. It clears every fixed tag plus every published page's per-slug tag —
+including the `/api/<slug>.md` routes, which no `revalidatePath` reaches:
+
+```bash
+curl -X POST https://<your-domain>/api/revalidate \
+  -H "content-type: application/json" \
+  -H "sanity-webhook-signature: <signature>" \
+  -d '{"purgeAll": true}'
+```
+
+The route validates the same signature as a real webhook, so the simplest way to
+send it is a second Sanity webhook with `{"purgeAll": true}` as a fixed projection,
+triggered by hand from sanity.io/manage.
+
+## Continuous Integration
+
+A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.
+
+The workflow takes its runtime versions from your manifests, so there's a single source of truth and nothing to keep in sync by hand:
+
+- **Node** comes from `.nvmrc`.
+- **Bun** comes from the `packageManager` field in `package.json`.
+
+It also caches Bun's install cache between runs, and the test step is a no-op until you add real test files.
+
+<!-- bsmnt:if dotenvx -->
+The build decrypts the committed `.env` with the dotenvx private key, pulled from 1Password: set an **org-level** `OP_SERVICE_ACCOUNT_TOKEN` (a read-only [service account](https://developer.1password.com/docs/service-accounts/) scoped to the `Development` vault) — one secret for every repo — and CI reads the key via the op-ref committed in `.env`. A per-repo `DOTENV_PRIVATE_KEY` secret (`bun run env:setup-remote github`) works as a fallback; builds pass without either (only plaintext / `NEXT_PUBLIC_*` is read).
+
+<!-- bsmnt:endif -->
+### Sanity environment
+
+The build reads Sanity config from GitHub Actions variables/secrets (empty and harmless until you configure Sanity). Once your repo is on GitHub, the quickest way to set them is:
+
+```bash
+bun run ci:secrets
+```
+
+This reads the values from `.env.local` and pushes them to this repo with the GitHub CLI — `NEXT_PUBLIC_SANITY_PROJECT_ID` / `NEXT_PUBLIC_SANITY_DATASET` as **Variables** (they are public) and `SANITY_API_READ_TOKEN` as a **Secret**. Requires the [GitHub CLI](https://cli.github.com), authenticated (`gh auth login`).
+
+To set them by hand instead, go to **Settings → Secrets and variables → Actions** and add the two `NEXT_PUBLIC_*` values under **Variables** and the token under **Secrets**.
+
+### Branch protection
+
+To block merges when CI fails, enable branch protection on `main`:
+
+1. Go to **Settings → Branches → Add branch ruleset** (or **Add rule**).
+2. Target the `main` branch.
+3. Enable **Require status checks to pass before merging** and select the **CI** check.
+4. (Recommended) Enable **Require a pull request before merging**.
+
+Pull requests then cannot be merged until the CI workflow passes.

package/src/templates/next-pagebuilder-cache/_gitignore

@@ -0,0 +1,65 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.*
+.turbo
+.npmrc
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/versions
+
+# testing
+/coverage
+
+# next.js
+/.next/
+/out/
+
+# TypeScript
+*.tsbuildinfo
+
+# production
+/build
+/public/sw.js
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# local env files
+.env
+.env.local
+.env*.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# vercel
+.vercel
+
+# tldr
+.tldr
+
+# eslint
+.eslintcache
+
+# certificates
+certificates
+
+next-env.d.ts
+
+
+# unlighthouse
+.unlighthouse/
+
+# storybook
+*storybook.log

package/src/templates/next-pagebuilder-cache/app/(content)/[[...slug]]/page.tsx

@@ -0,0 +1,124 @@
+import { cacheLife, cacheTag } from "next/cache"
+import { notFound } from "next/navigation"
+import { PageDocument } from "@/components/page-document"
+import {
+  type DynamicFetchOptions,
+  getDynamicFetchOptions,
+  toSanityFetchOptions,
+  sanityFetch,
+  sanityFetchStaticParams,
+} from "@/lib/integrations/sanity/live"
+import {
+  ALL_PAGE_SLUGS_QUERY,
+  PAGE_QUERY,
+} from "@/lib/integrations/sanity/queries"
+import { BLOG_CATEGORIES_TAG } from "@/lib/integrations/sanity/tags"
+import type {
+  ALL_PAGE_SLUGS_QUERY_RESULT,
+  PAGE_QUERY_RESULT,
+} from "@/lib/integrations/sanity/sanity.types"
+import { checkRedirect } from "@/lib/utils/check-redirect"
+import { generateSanityMetadata } from "@/lib/utils/metadata"
+import { getSlugTag } from "@/lib/utils/slug-tag"
+
+type SearchParams = Promise<{ [key: string]: string | string[] | undefined }>
+type Props = { params: Promise<{ slug?: string[] }> }
+
+const isValidSegment = (segment: string) =>
+  segment.length > 0 && segment !== "." && segment !== ".."
+
+const toPath = (segments?: string[]) => {
+  if (!segments?.length) return null
+  if (!segments.every(isValidSegment)) return null
+  return segments.join("/")
+}
+
+// One cached read of PAGE_QUERY for both the body and generateMetadata — as two
+// functions it was two entries and two fetches per slug. The key must keep every
+// DynamicFetchOptions field: dropping `variant` breaks release previews.
+async function getCachedPage(
+  slug: string | null,
+  fetchOptions: DynamicFetchOptions
+): Promise<NonNullable<PAGE_QUERY_RESULT> | null> {
+  "use cache"
+  const { data } = await sanityFetch({
+    query: PAGE_QUERY,
+    params: { slug },
+    ...toSanityFetchOptions(fetchOptions),
+  })
+  const page = (data as NonNullable<PAGE_QUERY_RESULT> | null) ?? null
+
+  if (page) {
+    // Tagged inside the boundary so only real pages mint one: the slug is
+    // URL-derived, and a per-slug tag can't be enumerated or purged.
+    cacheTag(getSlugTag(slug))
+
+    // The pinned category is dereferenced into this entry, so it expires with it.
+    if (page.collectionCategory) cacheTag(BLOG_CATEGORIES_TAG)
+  } else {
+    // No document, so no publish event will ever clear this entry.
+    cacheLife("hours")
+  }
+
+  return page
+}
+
+const HOMEPAGE_PARAM: { slug: string[] } = { slug: [] }
+
+export const generateStaticParams = async () => {
+  const { data: slugs } =
+    await sanityFetchStaticParams<ALL_PAGE_SLUGS_QUERY_RESULT>({
+      query: ALL_PAGE_SLUGS_QUERY,
+    })
+
+  return [
+    HOMEPAGE_PARAM,
+    ...(slugs ?? []).flatMap((page) => {
+      if (!page.slug || page.slug === "/") return []
+      return { slug: page.slug.split("/") }
+    }),
+  ]
+}
+
+export const generateMetadata = async ({ params }: Props) => {
+  const [{ slug }, fetchOptions] = await Promise.all([
+    params,
+    getDynamicFetchOptions(),
+  ])
+  const path = toPath(slug)
+
+  if (slug?.length && path === null) return {}
+
+  // stega off: it would corrupt a <title> or og:image URL, and metadata renders no
+  // DOM for <VisualEditing> anyway. In published mode this is the body's key.
+  const page = await getCachedPage(path, { ...fetchOptions, stega: false })
+
+  return page
+    ? generateSanityMetadata({ document: page, url: path ? `/${path}` : "/" })
+    : {}
+}
+
+// No Suspense wrapper needed: `getDynamicFetchOptions` is prerender-safe and
+// `searchParams` is passed down unawaited, so the page prerenders.
+export default async function CatchAllPage({
+  params,
+  searchParams,
+}: Props & { searchParams: SearchParams }) {
+  const [{ slug }, fetchOptions] = await Promise.all([
+    params,
+    getDynamicFetchOptions(),
+  ])
+  const path = toPath(slug)
+
+  if (slug?.length && path === null) notFound()
+
+  const page = await getCachedPage(path, fetchOptions)
+
+  if (!page) {
+    // Fall back to a CMS redirect before 404ing.
+    await checkRedirect(path)
+    notFound()
+  }
+
+  return <PageDocument page={page} path={path} searchParams={searchParams} />
+}

package/src/templates/next-pagebuilder-cache/app/(content)/layout.tsx

@@ -0,0 +1,28 @@
+import { draftMode } from "next/headers"
+import { JsonLd } from "@/components/layout/json-ld"
+import { Wrapper } from "@/components/layout/wrapper"
+import { SanityVisualEditing } from "@/components/sanity/visual-editing"
+import { SanityLive } from "@/lib/integrations/sanity/live"
+
+// The one dynamic API allowed at the top of a layout: it still prerenders, and
+// resolving it once lets each chrome component cache its published render.
+const Layout = async ({ children }: { children: React.ReactNode }) => {
+  const { isEnabled: isDraftMode } = await draftMode()
+
+  return (
+    <>
+      <JsonLd isDraftMode={isDraftMode} />
+      <Wrapper isDraftMode={isDraftMode}>{children}</Wrapper>
+      {/* Draft mode only: for the public this costs a live connection and a
+          server action per tab, and the webhook is what invalidates. */}
+      {isDraftMode ? (
+        <>
+          <SanityLive includeDrafts />
+          <SanityVisualEditing />
+        </>
+      ) : null}
+    </>
+  )
+}
+
+export default Layout

package/src/templates/next-pagebuilder-cache/app/actions/unlock-gated-content.ts

@@ -0,0 +1,53 @@
+"use server"
+
+import { client } from "@/lib/integrations/sanity/client"
+import {
+  getDynamicFetchOptions,
+  toSanityFetchOptions,
+} from "@/lib/integrations/sanity/live"
+import { GATED_CONTENT_QUERY } from "@/lib/integrations/sanity/queries"
+import type { GATED_CONTENT_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types"
+
+export type GatedContentPayload = NonNullable<GATED_CONTENT_QUERY_RESULT>
+
+export type UnlockResult =
+  | { ok: true; payload: GatedContentPayload }
+  | { ok: false; error: string }
+
+type UnlockInput = { documentId: string; email: string }
+
+export async function unlockGatedContent({
+  documentId,
+  email,
+}: UnlockInput): Promise<UnlockResult> {
+  if (!documentId) return { ok: false, error: "Missing content id." }
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+    return { ok: false, error: "Enter a valid email address." }
+  }
+
+  // Lead-capture seam: forward `email` to your CRM / email provider here.
+  // This is not access control — the payload is withheld from the page until
+  // this action runs, but anyone who submits the form receives it.
+
+  if (!client) return { ok: false, error: "Content not found." }
+
+  const fetchOptions = await getDynamicFetchOptions()
+
+  // `client`, not `directClient`: a read by id needs no post-mutation freshness,
+  // so it belongs on the CDN meter. Options threaded whole — hand-picking fields
+  // is how `variant` goes missing.
+  const payload = await client.fetch<GATED_CONTENT_QUERY_RESULT>(
+    GATED_CONTENT_QUERY,
+    { id: documentId },
+    toSanityFetchOptions({
+      ...fetchOptions,
+      // stega must stay off: it injects invisible characters into strings, which
+      // would corrupt the asset URLs returned for download/playback.
+      stega: false,
+    }),
+  )
+
+  if (!payload) return { ok: false, error: "Content not found." }
+
+  return { ok: true, payload }
+}

package/src/templates/next-pagebuilder-cache/app/layout.tsx

@@ -0,0 +1,83 @@
+import "@/lib/styles/global.css"
+
+import type { Metadata } from "next"
+import { Geist } from "next/font/google"
+import type { PropsWithChildren } from "react"
+import { cn } from "@/lib/styles/cn"
+import AppData from "@/package.json"
+
+const APP_NAME = AppData.name
+const APP_DEFAULT_TITLE = "My Site"
+const APP_TITLE_TEMPLATE = "%s"
+const APP_DESCRIPTION = AppData.description
+// Build-time-stable so static routes (Studio, /_not-found) stay prerenderable
+// under Cache Components. NEXT_PUBLIC_* is inlined at build; reading runtime env
+// (VERCEL_URL) here would taint every route's metadata as request-time data.
+const APP_BASE_URL =
+  process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"
+
+const geist = Geist({
+  subsets: ["latin"],
+  variable: "--font-geist-variable",
+})
+
+export const metadata: Metadata = {
+  alternates: {
+    canonical: "/",
+    languages: {
+      "en-US": "/en-US",
+    },
+  },
+  appleWebApp: {
+    capable: true,
+    statusBarStyle: "default",
+    title: APP_DEFAULT_TITLE,
+  },
+  applicationName: APP_NAME,
+  authors: [{ name: "basement.studio", url: "https://basement.studio" }],
+  description: APP_DESCRIPTION,
+  formatDetection: { telephone: false },
+  metadataBase: new URL(APP_BASE_URL),
+  openGraph: {
+    description: APP_DESCRIPTION,
+    images: [
+      {
+        alt: APP_DEFAULT_TITLE,
+        height: 630,
+        url: "/opengraph-image.jpg",
+        width: 1200,
+      },
+    ],
+    locale: "en_US",
+    siteName: APP_NAME,
+    title: {
+      default: APP_DEFAULT_TITLE,
+      template: APP_TITLE_TEMPLATE,
+    },
+    type: "website",
+    url: APP_BASE_URL,
+  },
+  other: {
+    "fb:app_id": process.env.NEXT_PUBLIC_FACEBOOK_APP_ID || "",
+  },
+  title: {
+    default: APP_DEFAULT_TITLE,
+    template: APP_TITLE_TEMPLATE,
+  },
+  twitter: {
+    card: "summary_large_image",
+    description: APP_DESCRIPTION,
+    title: {
+      default: APP_DEFAULT_TITLE,
+      template: APP_TITLE_TEMPLATE,
+    },
+  },
+}
+
+const Layout = ({ children }: PropsWithChildren) => (
+  <html lang="en" dir="ltr" className={cn(geist.variable)}>
+    <body className="text-black">{children}</body>
+  </html>
+)
+
+export default Layout

package/src/templates/next-pagebuilder-cache/app/robots.ts

@@ -0,0 +1,13 @@
+import type { MetadataRoute } from "next"
+import { getBaseUrl } from "@/lib/utils/base-url"
+
+export default function robots(): MetadataRoute.Robots {
+  return {
+    rules: {
+      userAgent: "*",
+      allow: "/",
+      disallow: [],
+    },
+    sitemap: `${getBaseUrl()}/sitemap.xml`,
+  }
+}

package/src/templates/next-pagebuilder-cache/app/sitemap.xml/route.ts

@@ -0,0 +1,84 @@
+import { NextResponse } from "next/server"
+import { isSanityConfigured } from "@/lib/integrations/check-integration"
+import type { PAGE_SITEMAP_QUERY_RESULT } from "@/lib/integrations/sanity/sanity.types"
+import { getPageUrl, getSitemap, getSitemapBaseUrl } from "@/lib/utils/sitemap"
+
+type PageDoc = PAGE_SITEMAP_QUERY_RESULT[number]
+
+interface SitemapEntry {
+  url: string
+  lastModified?: string | null
+}
+
+const createPageEntry = (
+  baseUrl: string,
+  slug: string | null,
+  updatedAt?: string | null
+): SitemapEntry => ({
+  url: getPageUrl(baseUrl, slug),
+  lastModified: updatedAt ?? null,
+})
+
+const escapeXml = (value: string) =>
+  value
+    .replaceAll("&", "&")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;")
+
+const renderUrl = (entry: SitemapEntry) => {
+  const parts = ["  <url>", `    <loc>${escapeXml(entry.url)}</loc>`]
+
+  if (entry.lastModified) {
+    parts.push(
+      `    <lastmod>${new Date(entry.lastModified).toISOString()}</lastmod>`
+    )
+  }
+
+  parts.push("  </url>")
+
+  return parts.join("\n")
+}
+
+const renderSitemap = (entries: SitemapEntry[]) =>
+  [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">',
+    ...entries.map(renderUrl),
+    "</urlset>",
+  ].join("\n")
+
+const getSitemapResponse = (entries: SitemapEntry[], status = 200) =>
+  new NextResponse(renderSitemap(entries), {
+    status,
+    headers: { "Content-Type": "application/xml; charset=utf-8" },
+  })
+
+// No `connection()`: per-request rendering meant a Sanity round trip per crawler
+// hit. No `Cache-Control` either — a CDN copy is a second cache the webhook
+// can't purge.
+export const GET = async () => {
+  const baseUrl = getSitemapBaseUrl()
+  const homepageEntry = createPageEntry(baseUrl, null)
+
+  if (!isSanityConfigured()) return getSitemapResponse([homepageEntry])
+
+  try {
+    const allPages = await getSitemap()
+
+    if (!allPages) return getSitemapResponse([homepageEntry])
+
+    const pages = (allPages ?? []).filter((page) => !page.noIndex)
+    const sitemapEntries = pages.map((page: PageDoc) =>
+      createPageEntry(baseUrl, page.slug ?? null, page._updatedAt)
+    )
+
+    return getSitemapResponse(
+      sitemapEntries.length > 0 ? sitemapEntries : [homepageEntry]
+    )
+  } catch (error) {
+    console.error("Error generating sitemap.xml:", error)
+    return getSitemapResponse([homepageEntry], 503)
+  }
+}