create-ailk 0.26.0 → 0.28.0

package/templates/apps/web/app/api/offerings/checkout/[lookupKey]/route.ts

@@ -6,7 +6,9 @@
 // Only a buyer's page load starts anything: a prefetch, a crawler, a
 // cross-site load or an ungrammatical key is refused before any call. The
 // route then confirms, from a shown-set read shared for 15 seconds, that the
-// site is connected and shows the key — an unconnected site's POST would take
+// site is connected and shows the key — and, for a bundle link, the required
+// product's key it carries as `?with=` (#10028 D10), sent as the body's
+// `requires` — an unconnected site's POST would take
 // the API's env path (#8931 A9) — and POSTs `/v1/checkout/sessions` with
 // success and cancel URLs on the site's configured origin, never the
 // request's. Every refusal is a 303 to `/pricing` with no body and one fixed
@@ -19,6 +21,10 @@ import { isShownLookupKey } from "../../../../../lib/offerings-pricing";
 import { FALLBACK_BASE_URL } from "../../../../../lib/site-brand";
 import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { resolveCommerceClaim } from "../../../../../src/lib/commerce-claim";
+import {
+  clientIpFromHeaders,
+  UNKNOWN_VISITOR_FACTOR,
+} from "../../../../../src/lib/rate-limit";
 import { resolveBaseUrl } from "../../../../../src/lib/routes";
 
 export const runtime = "nodejs";
@@ -166,37 +172,75 @@ function siteOrigin(): string | null {
 const BUDGET_STARTS = 5;
 const BUDGET_WINDOW_MS = 10 * 60_000;
 const BUDGET_MAX_ADDRESSES = 10_000;
-/** An address key is cut to this length, so the Map cannot grow by key size. */
-const BUDGET_ADDRESS_LENGTH = 64;
 
-const starts = new Map<string, { windowStart: number; count: number }>();
+/** One visitor's window: the starts it made, and the ones still in flight. */
+interface StartWindow {
+  windowStart: number;
+  count: number;
+  pending: number;
+}
+
+const starts = new Map<string, StartWindow>();
+/** The address-less visitors' one window, which no address key can evict. */
+const unknownStarts: StartWindow = { windowStart: 0, count: 0, pending: 0 };
 
-function visitorAddress(headers: Headers): string | null {
-  const address =
-    headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
-    headers.get("x-real-ip")?.trim();
-  return address ? address.slice(0, BUDGET_ADDRESS_LENGTH) : null;
+/** Starts `window` afresh once its time is up, in place, so a start in flight settles on it. */
+function rollOver(window: StartWindow, now: number): void {
+  if (now - window.windowStart < BUDGET_WINDOW_MS) return;
+  window.windowStart = now;
+  window.count = 0;
 }
 
 /**
- * Charges one start to `address`, or answers false when its window is spent.
- * The oldest-inserted address is evicted at BUDGET_MAX_ADDRESSES.
+ * The window for `address`, re-inserted when it rolls over so the
+ * oldest-inserted window evicted at BUDGET_MAX_ADDRESSES is the stalest.
  */
-function spendStart(address: string, now: number): boolean {
-  const entry = starts.get(address);
-  if (entry && now - entry.windowStart < BUDGET_WINDOW_MS) {
-    if (entry.count >= BUDGET_STARTS) return false;
-    entry.count += 1;
-    return true;
+function addressWindow(address: string, now: number): StartWindow {
+  const window = starts.get(address);
+  if (window) {
+    if (now - window.windowStart >= BUDGET_WINDOW_MS) {
+      rollOver(window, now);
+      starts.delete(address);
+      starts.set(address, window);
+    }
+    return window;
   }
-  if (entry) {
-    starts.delete(address);
-  } else if (starts.size >= BUDGET_MAX_ADDRESSES) {
+  if (starts.size >= BUDGET_MAX_ADDRESSES) {
     const oldest = starts.keys().next().value;
     if (oldest !== undefined) starts.delete(oldest);
   }
-  starts.set(address, { windowStart: now, count: 1 });
-  return true;
+  const fresh = { windowStart: now, count: 0, pending: 0 };
+  starts.set(address, fresh);
+  return fresh;
+}
+
+/**
+ * Reserves one start for the visitor, or answers null when its window is
+ * spent (#9059). The key is `clientIpFromHeaders`'s (#9967 D1): Vercel's own
+ * `x-vercel-forwarded-for`, read only on Vercel, never a header the client
+ * chooses. A visitor with no readable address shares one window
+ * UNKNOWN_VISITOR_FACTOR times as wide, never skipped. Starts in flight hold
+ * their place, so concurrent clicks cannot overrun the window.
+ */
+function reserveStart(headers: Headers, now: number): StartWindow | null {
+  const address = clientIpFromHeaders(headers);
+  let window = unknownStarts;
+  let limit = UNKNOWN_VISITOR_FACTOR * BUDGET_STARTS;
+  if (address === "unknown") {
+    rollOver(window, now);
+  } else {
+    window = addressWindow(address, now);
+    limit = BUDGET_STARTS;
+  }
+  if (window.count + window.pending >= limit) return null;
+  window.pending += 1;
+  return window;
+}
+
+/** Only a Checkout the API started spends the start (#9063). */
+function settleStart(window: StartWindow, started: boolean): void {
+  window.pending -= 1;
+  if (started) window.count += 1;
 }
 
 // ─── D2 steps 8 and 9 — the start and its answer ────────────────────────────
@@ -263,9 +307,12 @@ async function startCheckout(
   ctx: BuyContext,
 ): Promise<Response> {
   const { lookupKey } = await ctx.params;
+  // #10028 D10 — a bundle link names the required product's key as `?with=`.
+  const withKey = new URL(request.url).searchParams.get("with");
 
   if (!isBuyerNavigation(request)) return refuse("unintended");
   if (!parseLookupKey(lookupKey)) return refuse("ungrammatical");
+  if (withKey !== null && !parseLookupKey(withKey)) return refuse("ungrammatical");
   if (!(await resolveCommerceClaim())) return refuse("no_claim");
   if (process.env.NODE_ENV === "production" && !configuredApiBase()) {
     return refuse("unconnected");
@@ -276,29 +323,33 @@ async function startCheckout(
   if (shown.kind !== "shown" || !isShownLookupKey(shown.shownSet, lookupKey)) {
     return refuse("not_shown");
   }
+  if (withKey !== null && !isShownLookupKey(shown.shownSet, withKey)) {
+    return refuse("not_shown");
+  }
 
   const origin = siteOrigin();
   if (!origin) return refuse("no_origin");
 
-  const address = visitorAddress(request.headers);
-  if (address && !spendStart(address, Date.now())) {
-    return refuse("rate_limited");
-  }
-
-  const started = await settleWithin(
-    checkout
-      .createSession(
-        {
-          productCode: lookupKey,
-          successUrl: `${origin}/purchase/success?session_id={CHECKOUT_SESSION_ID}`,
-          cancelUrl: `${origin}/pricing`,
-        },
-        { headers: startHeaders(request.headers) },
-      )
-      .catch(() => null),
-    START_TIMEOUT_MS,
-    null,
-  );
+  const headers = startHeaders(request.headers);
+  const reserved = reserveStart(request.headers, Date.now());
+  if (!reserved) return refuse("rate_limited");
+
+  // Settled on the API's own answer, not the timeout: a start that answers
+  // late still spends, and one in flight still holds its place.
+  const start = checkout
+    .createSession(
+      {
+        productCode: lookupKey,
+        ...(withKey !== null && { requires: withKey }),
+        successUrl: `${origin}/purchase/success?session_id={CHECKOUT_SESSION_ID}`,
+        cancelUrl: `${origin}/pricing`,
+      },
+      { headers },
+    )
+    .catch(() => null);
+  void start.then((answer) => settleStart(reserved, answer?.ok === true));
+
+  const started = await settleWithin(start, START_TIMEOUT_MS, null);
   if (!started) return refuse("unreachable");
   if (!started.ok) return refuse(`api_${started.status}`);
 

package/templates/apps/web/app/api/offerings/checkout/__tests__/route.test.ts

@@ -29,6 +29,7 @@ jest.mock("@working-theory/license", () => ({
   checkLicense: jest.fn(),
 }));
 
+import { TOPOLOGY } from "../../../../../lib/topology.generated";
 import { GET } from "../[lookupKey]/route";
 
 const mockCheckLicense = checkLicense as jest.MockedFunction<
@@ -209,6 +210,7 @@ const ENV_NAMES = [
   "NODE_ENV",
   "OSS_API_INTERNAL_SECRET",
   "AILK_SPOKE_KEY",
+  "VERCEL",
 ] as const;
 const savedEnv = Object.fromEntries(ENV_NAMES.map((name) => [name, env[name]]));
 
@@ -248,6 +250,7 @@ beforeEach(() => {
   env.AILK_API_URL = API;
   env.NEXT_PUBLIC_BASE_URL = "https://shop.example.com";
   env.NODE_ENV = "test";
+  env.VERCEL = "1";
   shownAnswer = SHOWN;
   postAnswer = STARTED;
   fetchMock.mockClear();
@@ -267,8 +270,9 @@ afterEach(() => {
 
 /**
  * A buyer's card click on `key`: a top-level same-origin navigation to the
- * wrong host, with a session cookie and a fresh forwarded address. A header
- * set to `null` is left out.
+ * wrong host, with a session cookie and fresh forwarded addresses, Vercel's
+ * included, so no two cases share a visitor budget. A header set to `null` is
+ * left out.
  */
 function buyRequest(
   key: string,
@@ -281,6 +285,7 @@ function buyRequest(
     "sec-fetch-dest": "document",
     "sec-fetch-site": "same-origin",
     "x-forwarded-for": freshAddress(),
+    "x-vercel-forwarded-for": freshAddress(),
     ...options.headers,
   };
   const sent = new Headers();
@@ -411,11 +416,18 @@ describe("AC-1 — a shown key on a connected site starts its Checkout", () => {
     );
   });
 
-  it("sends x-internal-auth from OSS_API_INTERNAL_SECRET to an https API", async () => {
-    env.OSS_API_INTERNAL_SECRET = "s3cret";
-    await expectStarted(await buy("growth_monthly"));
-    expect(postHeaders(postCalls()[0]!)["x-internal-auth"]).toBe("s3cret");
-  });
+  // #9601 — hub-only: a spoke render of the seam withholds the secret even
+  // with no spoke key, so a spoke scaffold skips this case. The sibling
+  // suite's "a spoke with no spoke key never sends the internal secret"
+  // pins the spoke side.
+  (TOPOLOGY === "hub" ? it : it.skip)(
+    "sends x-internal-auth from OSS_API_INTERNAL_SECRET to an https API",
+    async () => {
+      env.OSS_API_INTERNAL_SECRET = "s3cret";
+      await expectStarted(await buy("growth_monthly"));
+      expect(postHeaders(postCalls()[0]!)["x-internal-auth"]).toBe("s3cret");
+    },
+  );
 
   it("sends no x-internal-auth when OSS_API_INTERNAL_SECRET is unset", async () => {
     await expectStarted(await buy("growth_monthly"));
@@ -649,6 +661,46 @@ describe("AC-4 — every other outcome returns to /pricing, without throwing and
 
 // ─── AC-5 ───────────────────────────────────────────────────────────────────
 
+// ── #10028 AC-10 — the bundle link's `?with=` ───────────────────────────────
+
+describe("#10028 AC-10 — a shown ?with= key is forwarded as requires; an ungrammatical or unshown one is refused", () => {
+  /** A buyer's click on a bundle link: the plan key with `?with=<required>` in the URL. */
+  function bundleRequest(key: string, withKey: string): Request {
+    const base = buyRequest(key);
+    return new Request(`${base.url}?with=${withKey}`, { method: "GET", headers: base.headers });
+  }
+
+  it("sends the shown ?with= key as the body's requires, beside the plan key", async () => {
+    const res = await buy("growth_monthly", bundleRequest("growth_monthly", "growth_yearly"));
+    await expectStarted(res);
+    const [call] = postCalls();
+    expect(JSON.parse(String(call!.init.body))).toEqual({
+      productCode: "growth_monthly",
+      requires: "growth_yearly",
+      successUrl: "https://shop.example.com/purchase/success?session_id={CHECKOUT_SESSION_ID}",
+      cancelUrl: "https://shop.example.com/pricing",
+    });
+  });
+
+  it("builds exactly today's body with no ?with=", async () => {
+    await expectStarted(await buy("growth_monthly"));
+    const [call] = postCalls();
+    expect(JSON.parse(String(call!.init.body))).not.toHaveProperty("requires");
+  });
+
+  it("refuses an ungrammatical ?with= before any call", async () => {
+    const res = await buy("growth_monthly", bundleRequest("growth_monthly", "Growth%20Yearly"));
+    await expectRefused(res, "Growth Yearly", "ungrammatical");
+    expect(postCalls()).toHaveLength(0);
+  });
+
+  it("refuses a grammatical ?with= the shown set does not hold, with no POST", async () => {
+    const res = await buy("growth_monthly", bundleRequest("growth_monthly", "managed_monthly"));
+    await expectRefused(res, "managed_monthly", "not_shown");
+    expect(postCalls()).toHaveLength(0);
+  });
+});
+
 describe("AC-5 — only a buyer's page load starts anything", () => {
   it.each<
     [string, { method?: string; headers?: Record<string, string | null> }]
@@ -735,7 +787,9 @@ describe("AC-6 — one shared read, a switched-off product stops within it, a pe
 
   it("starts at most 5 Checkouts per visitor per 10 minutes", async () => {
     const from = (address: string) =>
-      buyRequest("growth_monthly", { headers: { "x-forwarded-for": address } });
+      buyRequest("growth_monthly", {
+        headers: { "x-vercel-forwarded-for": address },
+      });
 
     for (let i = 0; i < 5; i += 1) {
       await expectStarted(await buy("growth_monthly", from("192.0.2.50")));
@@ -757,43 +811,27 @@ describe("AC-6 — one shared read, a switched-off product stops within it, a pe
     expect(postCalls()).toHaveLength(7);
   });
 
-  it("keys the budget on the first 64 characters of an address", async () => {
-    const prefix = "f".repeat(64);
-    for (let i = 0; i < 5; i += 1) {
-      await expectStarted(
-        await buy(
-          "growth_monthly",
-          buyRequest("growth_monthly", {
-            headers: { "x-forwarded-for": `${prefix}${i}` },
-          }),
-        ),
-      );
+  it("charges a request with no visitor address to one shared budget, ten times as wide", async () => {
+    jest.setSystemTime(Date.now() + 10 * 60_000);
+    const addressless = () =>
+      buyRequest("growth_monthly", {
+        headers: { "x-forwarded-for": null, "x-vercel-forwarded-for": null },
+      });
+
+    for (let i = 0; i < 50; i += 1) {
+      await expectStarted(await buy("growth_monthly", addressless()));
     }
+    expect(postCalls()).toHaveLength(50);
+
     await expectRefused(
-      await buy(
-        "growth_monthly",
-        buyRequest("growth_monthly", {
-          headers: { "x-forwarded-for": `${prefix}x` },
-        }),
-      ),
+      await buy("growth_monthly", addressless()),
       "growth_monthly",
       "rate_limited",
     );
-    expect(postCalls()).toHaveLength(5);
-  });
+    expect(postCalls()).toHaveLength(50);
 
-  it("does not count a request with no visitor address", async () => {
-    for (let i = 0; i < 7; i += 1) {
-      await expectStarted(
-        await buy(
-          "growth_monthly",
-          buyRequest("growth_monthly", {
-            headers: { "x-forwarded-for": null },
-          }),
-        ),
-      );
-    }
-    expect(postCalls()).toHaveLength(7);
+    await expectStarted(await buy("growth_monthly"));
+    expect(postCalls()).toHaveLength(51);
   });
 
   it("reaches neither Stripe nor the session cookie itself", () => {

package/templates/apps/web/app/llms.txt/route.ts

@@ -19,14 +19,30 @@
  * `getBlogPages` deps — tests inject stubs, and the module's variant of this
  * route supplies the real `blogSource` reader. The exported `GET` is
  * unchanged either way.
+ *
+ * Docs (#10041 D8): listed after the blog at the site's docs path. Under the
+ * database adapter the adapter's `DocsList` / `DocsDetail` rows are listed at
+ * the docs path; otherwise those rows are skipped (the MDX docs route never
+ * serves them) and the docs directory is listed (`getDocsPages`, default
+ * `listDocsPages`).
  */
 
-import { SCHEMA_ORG_TYPES } from "@working-theory/content-adapters";
+import {
+  SCHEMA_ORG_TYPES,
+  resolvedAdapterKind,
+} from "@working-theory/content-adapters";
 import type { ContentAdapter, SchemaOrgType } from "@working-theory/content-adapters";
 import { getContentAdapter as defaultGetContentAdapter } from "@working-theory/page-renderer";
 
+import {
+  adapterDocsUrl,
+  isDocsType,
+  listDocsPages,
+  type DocsIndexPage,
+} from "../../lib/docs-index";
+import { PUBLIC_PAGES } from "../../lib/modules.generated";
 import { SITE_NAME } from "../../lib/site-brand";
-import { resolveBaseUrl, slugToPath } from "../../src/lib/routes";
+import { pagePathFor, resolveBaseUrl } from "../../src/lib/routes";
 
 export interface LlmsHandlerDeps {
   /**
@@ -40,6 +56,8 @@ export interface LlmsHandlerDeps {
    * Override in tests to inject stub pages.
    */
   getBlogPages?: () => Array<{ url: string; data: { title: string; description?: string } }>;
+  /** The docs pages (#10041). Defaults to `listDocsPages` over this app's docs directory. */
+  getDocsPages?: () => DocsIndexPage[];
 }
 
 /**
@@ -49,8 +67,11 @@ export interface LlmsHandlerDeps {
 export function createLlmsHandler(deps: LlmsHandlerDeps = {}) {
   const resolveAdapter = deps.getContentAdapter ?? defaultGetContentAdapter;
   const resolveBlogPages = deps.getBlogPages ?? (() => []);
+  const resolveDocsPages = deps.getDocsPages ?? listDocsPages;
 
   return async function llmsGET(): Promise<Response> {
+    // #10040 decision 7 — no public page, no content index: 404 before the adapter.
+    if (!PUBLIC_PAGES) return new Response(null, { status: 404 });
     const adapter = resolveAdapter();
     const baseUrl = resolveBaseUrl();
     const lines: string[] = [`# ${SITE_NAME} — content index`, ""];
@@ -66,9 +87,13 @@ export function createLlmsHandler(deps: LlmsHandlerDeps = {}) {
       types.map((type) => adapter.listPages(type, defaultLocale)),
     );
 
+    const databaseDocs = resolvedAdapterKind() === "database";
     for (const pages of pageLists) {
       for (const page of pages) {
-        const path = slugToPath(page.type, page.slug);
+        if (isDocsType(page.type) && !databaseDocs) continue;
+        const path = isDocsType(page.type)
+          ? adapterDocsUrl(page.type, page.slug)
+          : pagePathFor(page);
         const url = `${baseUrl}${path}`;
         lines.push(`- Title: ${page.title}`);
         lines.push(`  URL: ${url}`);
@@ -92,6 +117,19 @@ export function createLlmsHandler(deps: LlmsHandlerDeps = {}) {
       lines.push("");
     }
 
+    // The docs directory (#10041 D8) — not under the database adapter, whose
+    // docs rows are listed above.
+    if (!databaseDocs) {
+      for (const doc of resolveDocsPages()) {
+        lines.push(`- Title: ${doc.title}`);
+        lines.push(`  URL: ${baseUrl}${doc.url}`);
+        if (doc.description) {
+          lines.push(`  Description: ${doc.description}`);
+        }
+        lines.push("");
+      }
+    }
+
     return new Response(lines.join("\n"), {
       status: 200,
       headers: {

package/templates/apps/web/app/robots.txt/route.ts

@@ -15,12 +15,16 @@
 
 import { parseStealth } from "@working-theory/web-i18n/stealth";
 
+import { PUBLIC_PAGES } from "../../lib/modules.generated";
 import { resolveBaseUrl } from "../../src/lib/routes";
 
 export function GET(): Response {
   const baseUrl = resolveBaseUrl();
   const disallowEnv = process.env["AILK_ROBOTS_DISALLOW"] ?? "";
-  const stealth = parseStealth(process.env["STEALTH"]);
+  // #10040 decision 7 — a site with neither marketing nor docs-blog (a hub)
+  // has no public page to crawl: the same disallow-all, no-Sitemap shape as
+  // STEALTH, read from the module list, never from a setting.
+  const stealth = parseStealth(process.env["STEALTH"]) || !PUBLIC_PAGES;
 
   const disallowPaths = stealth
     ? ["/"]

package/templates/apps/web/app/sitemap.xml/route.ts

@@ -28,13 +28,30 @@
  * DI note: `createSitemapHandler` accepts an optional `getContentAdapter` dep
  * for testing — tests inject a stub adapter to avoid mocking the internal module.
  * The exported `GET` uses the real implementation.
+ *
+ * Docs (#10041 D8): the docs are listed at the site's docs path, default
+ * locale only, with no alternates (they exist in one locale). Under the
+ * database adapter the docs route reads the adapter's `DocsList` /
+ * `DocsDetail` rows, so those rows are listed at the docs path; otherwise
+ * those rows are skipped (the MDX docs route never serves them) and the docs
+ * directory is listed instead (`getDocsPages`, default `listDocsPages`).
  */
 
-import { SCHEMA_ORG_TYPES } from "@working-theory/content-adapters";
+import {
+  SCHEMA_ORG_TYPES,
+  resolvedAdapterKind,
+} from "@working-theory/content-adapters";
 import type { ContentAdapter, SchemaOrgType } from "@working-theory/content-adapters";
 import { getContentAdapter as defaultGetContentAdapter } from "@working-theory/page-renderer";
 
-import { resolveBaseUrl, slugToPath } from "../../src/lib/routes";
+import {
+  adapterDocsUrl,
+  isDocsType,
+  listDocsPages,
+  type DocsIndexPage,
+} from "../../lib/docs-index";
+import { PUBLIC_PAGES } from "../../lib/modules.generated";
+import { pagePathFor, resolveBaseUrl } from "../../src/lib/routes";
 
 export interface SitemapHandlerDeps {
   /**
@@ -42,6 +59,8 @@ export interface SitemapHandlerDeps {
    * Override in tests to inject a stub adapter without mocking the internal module.
    */
   getContentAdapter?: () => ContentAdapter;
+  /** The docs pages (#10041). Defaults to `listDocsPages` over this app's docs directory. */
+  getDocsPages?: () => DocsIndexPage[];
 }
 
 function escapeXml(value: string): string {
@@ -76,7 +95,10 @@ function buildLocaleUrl(
  */
 export function createSitemapHandler(deps: SitemapHandlerDeps = {}) {
   const resolveAdapter = deps.getContentAdapter ?? defaultGetContentAdapter;
+  const resolveDocsPages = deps.getDocsPages ?? listDocsPages;
   return async function sitemapGET(): Promise<Response> {
+    // #10040 decision 7 — no public page, no sitemap: 404 before the adapter.
+    if (!PUBLIC_PAGES) return new Response(null, { status: 404 });
     const adapter = resolveAdapter();
     const baseUrl = resolveBaseUrl();
     const today = new Date().toISOString().slice(0, 10);
@@ -87,6 +109,13 @@ export function createSitemapHandler(deps: SitemapHandlerDeps = {}) {
     const defaultLocale = process.env.NEXT_PUBLIC_DEFAULT_LOCALE ?? "en";
 
     const urlEntries: string[] = [];
+    // A docs entry: one locale, so no alternates (#10041 D8).
+    const pushDocsEntry = (url: string, lastmod: string): void => {
+      urlEntries.push(
+        `  <url>\n    <loc>${escapeXml(`${baseUrl}${url}`)}</loc>\n    <lastmod>${lastmod}</lastmod>\n  </url>`,
+      );
+    };
+    const databaseDocs = resolvedAdapterKind() === "database";
 
     const types = SCHEMA_ORG_TYPES as readonly SchemaOrgType[];
 
@@ -104,7 +133,16 @@ export function createSitemapHandler(deps: SitemapHandlerDeps = {}) {
     for (let i = 0; i < tuples.length; i++) {
       const { locale } = tuples[i]!;
       for (const page of lists[i]!) {
-        const path = slugToPath(page.type, page.slug);
+        if (isDocsType(page.type)) {
+          if (databaseDocs && locale === defaultLocale) {
+            pushDocsEntry(
+              adapterDocsUrl(page.type, page.slug),
+              page.publishedAt ?? today,
+            );
+          }
+          continue;
+        }
+        const path = pagePathFor(page);
         const lastmod = page.publishedAt ?? today;
 
         const defaultUrl = `${baseUrl}${path}`;
@@ -126,6 +164,10 @@ export function createSitemapHandler(deps: SitemapHandlerDeps = {}) {
       }
     }
 
+    if (!databaseDocs) {
+      for (const doc of resolveDocsPages()) pushDocsEntry(doc.url, today);
+    }
+
     const xml = [
       '<?xml version="1.0" encoding="UTF-8"?>',
       '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">',