bsmnt 0.9.0 → 0.10.0

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/components/slug-field.tsx

@@ -1,18 +1,24 @@
+import { Stack } from "@sanity/ui";
 import { type FieldProps, useFormValue } from "sanity";
+import { SlugRedirectNotice } from "@/lib/integrations/sanity/components/slug-notices";
 import { getPinnedPageById } from "@/lib/integrations/sanity/pinned-pages";
 
 const DEFAULT_DESCRIPTION = "URL path without leading slash.";
 const PINNED_DESCRIPTION =
 	"URL path without leading slash. Disabled on 📌 pinned pages.";
 
-// Swaps the slug description to a locked-state note on pinned pages.
-// (Sanity descriptions are plain strings, hence the 📌 character.)
+// Swaps the slug description on pinned pages (plain-string field, hence 📌).
 export function SlugField(props: FieldProps) {
 	const documentId = useFormValue(["_id"]) as string | undefined;
-	const isPinned = getPinnedPageById(documentId) !== null;
+	const pinned = getPinnedPageById(documentId);
 
-	return props.renderDefault({
-		...props,
-		description: isPinned ? PINNED_DESCRIPTION : DEFAULT_DESCRIPTION,
-	});
+	return (
+		<Stack space={3}>
+			{props.renderDefault({
+				...props,
+				description: pinned ? PINNED_DESCRIPTION : DEFAULT_DESCRIPTION,
+			})}
+			<SlugRedirectNotice pinnedPath={pinned?.path} />
+		</Stack>
+	);
 }

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/components/slug-notices.tsx

@@ -0,0 +1,135 @@
+import { Box, Button, Card, Stack, Text } from "@sanity/ui";
+import { useEffect, useState } from "react";
+import { useClient, useFormValue } from "sanity";
+import { useRouter } from "sanity/router";
+import { apiVersion } from "@/lib/integrations/sanity/env";
+import { isEmptyPageSlug } from "@/lib/integrations/sanity/page-category";
+
+// Mirrors `pageResolvedSlugExpression`'s chain; leaf joins in JS so this
+// tracks the live slug, not the last saved draft.
+const FOLDER_PATH_QUERY = `*[_id == $folderId][0]{
+  "path": array::join(array::compact([
+    parentFolder->parentFolder->parentFolder->parentFolder->parentFolder->slug.current,
+    parentFolder->parentFolder->parentFolder->parentFolder->slug.current,
+    parentFolder->parentFolder->parentFolder->slug.current,
+    parentFolder->parentFolder->slug.current,
+    parentFolder->slug.current,
+    slug.current
+  ]), "/")
+}.path`;
+
+const REDIRECT_QUERY = `*[_type == "redirect" && source.current == $source][0]._id`;
+
+// The slug field writes on every keystroke.
+const LOOKUP_DEBOUNCE_MS = 400;
+
+interface SlugRedirectNoticeProps {
+	/** Public path of a pinned page, whose URL is fixed rather than slug-derived. */
+	pinnedPath?: string | undefined;
+}
+
+/**
+ * Warns when a published redirect claims this page's URL — the catch-all
+ * route only runs `checkRedirect` after a page lookup misses, so the page
+ * wins and the redirect silently never fires.
+ *
+ * Reads the `page` form shape; don't reuse for other slug types.
+ */
+export function SlugRedirectNotice({ pinnedPath }: SlugRedirectNoticeProps) {
+	const client = useClient({ apiVersion });
+	const router = useRouter();
+	const slug = useFormValue(["slug", "current"]) as string | undefined;
+	const folderId = useFormValue(["pageFolder", "_ref"]) as string | undefined;
+	const [folderPath, setFolderPath] = useState("");
+	const [redirectId, setRedirectId] = useState<string | null>(null);
+
+	// Separate effect so the folder chain isn't re-resolved on every keystroke.
+	useEffect(() => {
+		if (!folderId) {
+			setFolderPath("");
+			return;
+		}
+
+		let active = true;
+		const published = client.withConfig({ perspective: "published" });
+
+		published
+			.fetch<string | null>(FOLDER_PATH_QUERY, { folderId })
+			.then((path) => {
+				if (active) setFolderPath(path ?? "");
+			})
+			.catch(() => {
+				if (active) setFolderPath("");
+			});
+
+		return () => {
+			active = false;
+		};
+	}, [client, folderId]);
+
+	useEffect(() => {
+		const leaf = isEmptyPageSlug(slug) ? "" : slug;
+		const source = pinnedPath
+			? pinnedPath.replace(/^\/+/, "")
+			: [folderPath, leaf].filter(Boolean).join("/");
+
+		if (!source) {
+			setRedirectId(null);
+			return;
+		}
+
+		let active = true;
+		// Drafts never reach visitors, so an unpublished redirect isn't a conflict.
+		const published = client.withConfig({ perspective: "published" });
+
+		const timer = setTimeout(async () => {
+			try {
+				const id = await published.fetch<string | null>(REDIRECT_QUERY, {
+					source,
+				});
+				if (active) setRedirectId(id);
+			} catch {
+				if (active) setRedirectId(null);
+			}
+		}, LOOKUP_DEBOUNCE_MS);
+
+		return () => {
+			active = false;
+			clearTimeout(timer);
+		};
+	}, [client, folderPath, pinnedPath, slug]);
+
+	if (!redirectId) return null;
+
+	return (
+		<Card border padding={3} radius={2} tone="caution">
+			<Stack space={3}>
+				<Stack space={2}>
+					<Text size={1} weight="semibold">
+						A redirect already claims this URL
+					</Text>
+					<Text muted size={1}>
+						Visitors reach this page instead — a redirect only runs when no page
+						matches its path. Remove the redirect, or move this page to another
+						slug.
+					</Text>
+				</Stack>
+				<Box>
+					<Button
+						fontSize={1}
+						mode="ghost"
+						onClick={() =>
+							router.navigateIntent("edit", {
+								id: redirectId,
+								type: "redirect",
+							})
+						}
+						padding={3}
+						text="Go to redirect"
+						tone="caution"
+					/>
+				</Box>
+			</Stack>
+		</Card>
+	);
+}

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/live/index.tsx

@@ -25,7 +25,7 @@ type SanityFetchOptions = {
 	query: string;
 	params?: QueryParams;
 	tags?: string[];
-	stega?: boolean;
+	stega?: boolean | undefined;
 	perspective?: "published" | "drafts" | "previewDrafts";
 };
 

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/markdown-proxy.config.ts

@@ -22,7 +22,7 @@ export interface MarkdownRoute {
 /** .md extension routes -- rewrite to API endpoints */
 export const mdExtensionRoutes: MarkdownRoute[] = [
 	{
-		regex: /^\/(.+)\.md$/,
+		regex: /^\/((?:[^/]+\/)*[^/]+)\.md$/,
 		apiPath: "/api/[slug].md",
 		publicPath: "/[slug].md",
 	},

package/src/modules/features/cms/sanity-pagebuilder/files/lib/integrations/sanity/schemas/layout/redirect.ts

@@ -65,7 +65,7 @@ export const redirect = defineType({
 			description:
 				"Where to send visitors. An internal route path without a leading slash (e.g. new-page or blog/new-post), or an absolute URL (e.g. https://example.com).",
 			validation: (Rule) =>
-				Rule.required().custom((value, context) => {
+				Rule.required().custom(async (value, context) => {
 					if (typeof value !== "string") return true;
 
 					const isAbsolute = /^https?:\/\//.test(value);
@@ -79,13 +79,44 @@ export const redirect = defineType({
 						return "Internal destination must not start or end with a forward slash";
 					}
 
-					const source = (
-						context.document as RedirectValidationDocument | undefined
-					)?.source?.current;
+					const document = context.document as
+						| RedirectValidationDocument
+						| undefined;
+					const source = document?.source?.current;
+
 					if (source && source === value) {
 						return "Destination must differ from source";
 					}
 
+					// Rejects a direct loop (a -> b, b -> a); longer chains aren't checked.
+					// Normalizes slashes since docs written outside Studio can skip that validation.
+					if (source) {
+						const id = document?._id?.replace(/^drafts\./, "") ?? "";
+						const client = context.getClient({ apiVersion });
+						const normalize = (path: string) => path.replace(/^\/+|\/+$/g, "");
+						const normalizedSource = normalize(source);
+						const normalizedDestination = normalize(value);
+						const others = await client.fetch<
+							Array<{ source?: string; destination?: string }>
+						>(
+							`*[
+                _type == "redirect" &&
+                !(_id in [$id, "drafts." + $id])
+              ]{ "source": source.current, destination }`,
+							{ id },
+						);
+						const hasInverse = others.some(
+							(redirect) =>
+								redirect.source &&
+								normalize(redirect.source) === normalizedDestination &&
+								redirect.destination &&
+								normalize(redirect.destination) === normalizedSource,
+						);
+						if (hasInverse) {
+							return "This creates a redirect loop — another redirect sends the destination back to this source";
+						}
+					}
+
 					return true;
 				}),
 		}),

package/src/modules/features/cms/sanity-pagebuilder/files/proxy.ts

@@ -14,6 +14,15 @@ export function proxy(request: NextRequest) {
 		return NextResponse.next();
 	}
 
+	// Collapse repeated slashes before any rewrite, or the rewrite below would
+	// mask the alias (e.g. /foo//bar.md silently resolving to /foo/bar.md).
+	const collapsedPathname = pathname.replace(/\/{2,}/g, "/");
+	if (collapsedPathname !== pathname) {
+		const url = request.nextUrl.clone();
+		url.pathname = collapsedPathname;
+		return NextResponse.redirect(url, 308);
+	}
+
 	if (pathname === "/" && acceptHeader.includes("text/markdown")) {
 		const url = request.nextUrl.clone();
 		url.pathname = "/api/index.md";

package/src/templates/next-default/.env.example

@@ -32,6 +32,8 @@
 # Base URL for your site (used for SEO, canonical URLs, etc.)
 # Development: http://localhost:3000
 # Production: https://your-domain.com
+# Inlined at build time — scope this to the Production environment only in
+# Vercel so Preview deployments fall through to VERCEL_PROJECT_PRODUCTION_URL.
 NEXT_PUBLIC_BASE_URL=""
 
 # Draft mode secret for preview functionality

package/src/templates/next-default/app/robots.ts

@@ -1,6 +1,5 @@
 import type { MetadataRoute } from "next"
-
-const APP_BASE_URL = process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"
+import { getBaseUrl } from "@/lib/utils/url"
 
 export default function robots(): MetadataRoute.Robots {
   return {
@@ -9,6 +8,6 @@ export default function robots(): MetadataRoute.Robots {
       allow: "/",
       disallow: [],
     },
-    sitemap: `${APP_BASE_URL}/sitemap.xml`,
+    sitemap: `${getBaseUrl()}/sitemap.xml`,
   }
 }

package/src/templates/next-default/next.config.ts

@@ -64,8 +64,10 @@ const nextConfig: NextConfig = {
       },
     },
   },
+  logging: {
+    browserToTerminal: true,
+  },
   experimental: {
-    browserDebugInfoInTerminal: true,
     optimizePackageImports: [
       "@react-three/drei",
       "@react-three/fiber",
@@ -86,7 +88,8 @@ const nextConfig: NextConfig = {
   },
   headers: async () => [
     {
-      source: "/(.*)",
+      // Excludes /studio* — must stay mutually exclusive with the rule below.
+      source: "/((?!studio(?:/|$)).*)",
       headers: [
         {
           key: "X-Content-Type-Options",
@@ -118,6 +121,37 @@ const nextConfig: NextConfig = {
         },
       ],
     },
+    {
+      // X-Frame-Options can't allow a third-party origin, and Next can't unset
+      // it from another rule — the iframe needs it absent, not overridden.
+      source: "/studio/:path*",
+      headers: [
+        {
+          key: "X-Content-Type-Options",
+          value: "nosniff",
+        },
+        {
+          key: "Content-Security-Policy",
+          value: "frame-ancestors 'self' https://*.sanity.io;",
+        },
+        {
+          key: "X-XSS-Protection",
+          value: "1; mode=block",
+        },
+        {
+          key: "X-DNS-Prefetch-Control",
+          value: "on",
+        },
+        {
+          key: "Strict-Transport-Security",
+          value: "max-age=63072000; includeSubDomains; preload",
+        },
+        {
+          key: "Permissions-Policy",
+          value: "camera=(), microphone=(), geolocation=()",
+        },
+      ],
+    },
   ],
   redirects: async () => [
     {

package/src/templates/next-default/package.json

@@ -30,30 +30,30 @@
   "dependencies": {
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
-    "next": "^16",
-    "react": "^19",
-    "react-dom": "^19",
+    "next": "^16.3.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "tailwind-merge": "^3.4.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.14",
-    "@next/bundle-analyzer": "^16",
+    "@next/bundle-analyzer": "^16.3.0",
     "@svgr/webpack": "^8.1.0",
-    "@tailwindcss/postcss": "^4",
+    "@tailwindcss/postcss": "^4.2.2",
     "@types/bun": "^1.3.6",
     "@types/node": "^24.13.1",
-    "@types/react": "^19.2.9",
+    "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
-    "@typescript/native-preview": "^7.0.0-dev.20260122.3",
+    "@typescript/native-preview": "^7.0.0-dev.20260323.1",
     "babel-plugin-react-compiler": "^1.0.0",
     "cross-env": "^10.1.0",
     "knip": "^6.16.1",
     "lefthook": "^1.13.0",
     "postcss-preset-env": "^10.6.1",
     "schema-dts": "^2.0.0",
-    "tailwindcss": "^4",
-    "typescript": "^5"
+    "tailwindcss": "^4.2.2",
+    "typescript": "^5.9.3"
   },
   "trustedDependencies": [
     "@biomejs/biome",

package/src/templates/next-experiments/.env.example

@@ -32,6 +32,8 @@
 # Base URL for your site (used for SEO, canonical URLs, etc.)
 # Development: http://localhost:3000
 # Production: https://your-domain.com
+# Inlined at build time — scope this to the Production environment only in
+# Vercel so Preview deployments fall through to VERCEL_PROJECT_PRODUCTION_URL.
 NEXT_PUBLIC_BASE_URL=""
 
 # Draft mode secret for preview functionality

package/src/templates/next-experiments/app/robots.ts

@@ -1,6 +1,5 @@
 import type { MetadataRoute } from "next"
-
-const APP_BASE_URL = process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"
+import { getBaseUrl } from "@/lib/utils/url"
 
 export default function robots(): MetadataRoute.Robots {
   return {
@@ -9,6 +8,6 @@ export default function robots(): MetadataRoute.Robots {
       allow: "/",
       disallow: [],
     },
-    sitemap: `${APP_BASE_URL}/sitemap.xml`,
+    sitemap: `${getBaseUrl()}/sitemap.xml`,
   }
 }

package/src/templates/next-experiments/next.config.ts

@@ -64,8 +64,10 @@ const nextConfig: NextConfig = {
       },
     },
   },
+  logging: {
+    browserToTerminal: true,
+  },
   experimental: {
-    browserDebugInfoInTerminal: true,
     optimizePackageImports: [
       "@react-three/drei",
       "@react-three/fiber",
@@ -86,7 +88,8 @@ const nextConfig: NextConfig = {
   },
   headers: async () => [
     {
-      source: "/(.*)",
+      // Excludes /studio* — must stay mutually exclusive with the rule below.
+      source: "/((?!studio(?:/|$)).*)",
       headers: [
         {
           key: "X-Content-Type-Options",
@@ -118,6 +121,37 @@ const nextConfig: NextConfig = {
         },
       ],
     },
+    {
+      // X-Frame-Options can't allow a third-party origin, and Next can't unset
+      // it from another rule — the iframe needs it absent, not overridden.
+      source: "/studio/:path*",
+      headers: [
+        {
+          key: "X-Content-Type-Options",
+          value: "nosniff",
+        },
+        {
+          key: "Content-Security-Policy",
+          value: "frame-ancestors 'self' https://*.sanity.io;",
+        },
+        {
+          key: "X-XSS-Protection",
+          value: "1; mode=block",
+        },
+        {
+          key: "X-DNS-Prefetch-Control",
+          value: "on",
+        },
+        {
+          key: "Strict-Transport-Security",
+          value: "max-age=63072000; includeSubDomains; preload",
+        },
+        {
+          key: "Permissions-Policy",
+          value: "camera=(), microphone=(), geolocation=()",
+        },
+      ],
+    },
   ],
   redirects: async () => [
     {

package/src/templates/next-experiments/package.json

@@ -31,31 +31,31 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "lucide-react": "^0.474.0",
-    "next": "^16",
-    "react": "^19",
-    "react-dom": "^19",
+    "next": "^16.3.0",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "tailwind-merge": "^3.4.0",
     "three": "^0.182.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.14",
-    "@next/bundle-analyzer": "^16",
+    "@next/bundle-analyzer": "^16.3.0",
     "@svgr/webpack": "^8.1.0",
-    "@tailwindcss/postcss": "^4",
+    "@tailwindcss/postcss": "^4.2.2",
     "@types/bun": "^1.3.6",
     "@types/node": "^24.13.1",
-    "@types/react": "^19.2.9",
+    "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
-    "@typescript/native-preview": "^7.0.0-dev.20260122.3",
+    "@typescript/native-preview": "^7.0.0-dev.20260323.1",
     "babel-plugin-react-compiler": "^1.0.0",
     "cross-env": "^10.1.0",
     "knip": "^6.16.1",
     "lefthook": "^1.13.0",
     "postcss-preset-env": "^10.6.1",
     "schema-dts": "^2.0.0",
-    "tailwindcss": "^4",
-    "typescript": "^5"
+    "tailwindcss": "^4.2.2",
+    "typescript": "^5.9.3"
   },
   "trustedDependencies": [
     "@biomejs/biome",

package/src/templates/next-pagebuilder/.env.example

@@ -25,6 +25,8 @@
 # bsmnt:endif
 
 # Base URL
+# Inlined at build time — scope this to the Production environment only in
+# Vercel so Preview deployments fall through to VERCEL_PROJECT_PRODUCTION_URL.
 NEXT_PUBLIC_BASE_URL=
 
 # Draft Mode

package/src/templates/next-pagebuilder/README.md

@@ -64,6 +64,37 @@ Copy `.env.example` to `.env.local` and fill in the values you need. `.env.local
 For deploys, set the same variables in your host's dashboard (e.g. Vercel → Settings → Environment Variables).
 
 <!-- bsmnt:endif -->
+## Sanity Dashboard (Studio in an iframe)
+
+The Studio at `/studio` can be embedded in the Sanity Dashboard
+(`https://www.sanity.io/@<org>/studio/<appId>/<workspace>`), which loads it in an
+iframe from `www.sanity.io`. Three things have to be true for that to work:
+
+1. **Headers.** `next.config.ts` already exempts `/studio/:path*` from the
+   site-wide `X-Frame-Options` / `frame-ancestors 'self'` headers, sending
+   `frame-ancestors 'self' https://*.sanity.io` there instead and dropping
+   `X-Frame-Options` entirely for that path (it has no "allow this origin"
+   form — it must be absent, not overridden). Nothing to do here unless
+   you've hand-edited `headers()`.
+2. **Bridge script.** Already wired in: `next-sanity/studio`'s `NextStudio`
+   re-exports `NextStudioWithBridge`, which renders the
+   `core.sanity-cdn.com/bridge.js` tag the Dashboard needs. Don't hand-roll
+   that script tag, and don't switch the Studio route to
+   `next-sanity/studio/client-component` (the bridge-less variant).
+3. **Registered URL.** In [Sanity Manage](https://sanity.io/manage), the
+   Studio application's URL must be the **full path**
+   (`https://example.com/studio`), not just the domain. This can't be set
+   from code — either click through Manage, or run
+   `sanity deploy --external --url https://example.com/studio --yes` from
+   `lib/integrations/sanity`. Writing it via the API needs the
+   `sanity.project.deployStudio` grant, which read/write tokens don't have.
+
+Verify against a production build (`bun build && bun start`), not dev. One trap:
+the Dashboard reports `Failed to load iframe due to X-Frame-Options: SAMEORIGIN`
+for *any* framing failure, including a wrong registered URL with already-correct
+headers. Trust the browser console's `Framing '<url>' violates …` line instead —
+it names the URL actually being framed.
+
 ## Continuous Integration
 
 A GitHub Actions workflow (`.github/workflows/ci.yml`) runs on every pull request to `main` and on pushes to `main`. It runs type checking, linting, the production build, tests, and `knip`.

package/src/templates/next-pagebuilder/app/(content)/[[...slug]]/page.tsx

@@ -22,8 +22,14 @@ const getPageDocument = async (slug: string | null, stega?: boolean) =>
     stega,
   })
 
-const toPath = (segments?: string[]) =>
-  segments?.filter(Boolean).join("/") || null
+const isValidSegment = (segment: string) =>
+  segment.length > 0 && segment !== "." && segment !== ".."
+
+const toPath = (segments?: string[]) => {
+  if (!segments?.length) return null
+  if (!segments.every(isValidSegment)) return null
+  return segments.join("/")
+}
 
 const getResolvedPage = async (
   path: string | null,
@@ -35,18 +41,21 @@ const getResolvedPage = async (
 
 type SearchParams = Promise<{ [key: string]: string | string[] | undefined }>
 
+const HOMEPAGE_PARAM: { slug: string[] } = { slug: [] }
+
 export const generateStaticParams = async () => {
-  if (!client) return [{ slug: [] }]
+  if (!client) return [HOMEPAGE_PARAM]
 
   const slugs =
     await client.fetch<ALL_PAGE_SLUGS_QUERY_RESULT>(ALL_PAGE_SLUGS_QUERY)
 
-  if (!slugs?.length) return [{ slug: [] }]
-
-  return (slugs ?? []).flatMap((page) => {
-    if (!page.slug) return []
-    return page.slug === "/" ? { slug: [] } : { slug: page.slug.split("/") }
-  })
+  return [
+    HOMEPAGE_PARAM,
+    ...(slugs ?? []).flatMap((page) => {
+      if (!page.slug || page.slug === "/") return []
+      return { slug: page.slug.split("/") }
+    }),
+  ]
 }
 
 type Props = { params: Promise<{ slug?: string[] }> }
@@ -54,6 +63,9 @@ type Props = { params: Promise<{ slug?: string[] }> }
 export const generateMetadata = async ({ params }: Props) => {
   const { slug } = await params
   const path = toPath(slug)
+
+  if (slug?.length && path === null) return {}
+
   const page = await getResolvedPage(path, false)
 
   return page
@@ -70,6 +82,9 @@ export default async function CatchAllPage({
   const { slug } = await params
 
   const path = toPath(slug)
+
+  if (slug?.length && path === null) notFound()
+
   const page = await getResolvedPage(path)
 
   if (!page) {

package/src/templates/next-pagebuilder/app/robots.ts

@@ -1,6 +1,5 @@
 import type { MetadataRoute } from "next"
-
-const APP_BASE_URL = process.env.NEXT_PUBLIC_BASE_URL ?? "http://localhost:3000"
+import { getBaseUrl } from "@/lib/utils/base-url"
 
 export default function robots(): MetadataRoute.Robots {
   return {
@@ -9,6 +8,6 @@ export default function robots(): MetadataRoute.Robots {
       allow: "/",
       disallow: [],
     },
-    sitemap: `${APP_BASE_URL}/sitemap.xml`,
+    sitemap: `${getBaseUrl()}/sitemap.xml`,
   }
 }

package/src/templates/next-pagebuilder/app/sitemap.xml/route.ts

@@ -51,8 +51,11 @@ const renderSitemap = (entries: SitemapEntry[]) =>
     "</urlset>",
   ].join("\n")
 
-const getSitemapResponse = (entries: SitemapEntry[]) =>
-  new NextResponse(renderSitemap(entries))
+const getSitemapResponse = (entries: SitemapEntry[], status = 200) =>
+  new NextResponse(renderSitemap(entries), {
+    status,
+    headers: { "Content-Type": "application/xml; charset=utf-8" },
+  })
 
 export const GET = async () => {
   const baseUrl = getSitemapBaseUrl()
@@ -75,6 +78,6 @@ export const GET = async () => {
     )
   } catch (error) {
     console.error("Error generating sitemap.xml:", error)
-    return getSitemapResponse([homepageEntry])
+    return getSitemapResponse([homepageEntry], 503)
   }
 }