create-nevela 0.8.0 → 0.9.2

package/template/laravel/src/Forms/PublicMail.php

@@ -0,0 +1,217 @@
+<?php
+
+namespace Nevela\Laravel\Forms;
+
+use Illuminate\Contracts\Mail\Mailable;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Str;
+use Throwable;
+
+/**
+ * The mail a public form causes, with the limits that make it safe to send.
+ *
+ *     PublicMail::toVisitor($message->email, new MessageReceived($message));
+ *     PublicMail::toOwner(new NewMessage($message), line: $message->subject, url: $link);
+ *
+ * A form that writes back to whatever address was typed into it will write to anyone:
+ * type a stranger's address a thousand times and the site has sent them a thousand
+ * emails. So an address is written to at most once an hour and three times a day,
+ * counted across every form, and past that the email is dropped. The record is saved
+ * either way.
+ *
+ * The owner is the other inbox. A burst of submissions would bury the real ones, so only
+ * so many notices go out in an hour. The rest are held, and one email at the top of the
+ * hour names them. Nothing is lost: every record is in the dashboard.
+ *
+ * Both are queued, so a slow mail server doesn't keep a visitor waiting.
+ *
+ * Called while a record is being saved (a model's `created`, inside a transaction), the
+ * counting and the sending wait until the save is committed. A record that is rolled
+ * back sends nothing, and nothing here can spoil the transaction it was called in: on
+ * Postgres one failed statement, such as a lock someone else holds, would abort it all.
+ */
+final class PublicMail
+{
+    private const SENT = 'nevela_public_mail';
+
+    private const HELD = 'nevela_owner_digest';
+
+    /**
+     * Write to an address a form was given. False when it has been written to too often
+     * and this one was dropped. (Inside a transaction that isn't known yet: the answer is
+     * true, and the limit is applied when the transaction commits.)
+     */
+    public static function toVisitor(string $address, Mailable $mail): bool
+    {
+        $address = strtolower(trim($address));
+        if (! filter_var($address, FILTER_VALIDATE_EMAIL)) {
+            return false;
+        }
+        $who = self::fingerprint($address);
+
+        return self::whenSaved(fn () => self::counted("visitor:{$who}", function () use ($address, $mail, $who) {
+            $hour = self::sentSince('visitor', $who, now()->subHour());
+            $day = self::sentSince('visitor', $who, now()->subDay());
+            if ($hour >= (int) config('nevela.public.mail.visitor_per_hour', 1) || $day >= (int) config('nevela.public.mail.visitor_per_day', 3)) {
+                return false;
+            }
+            self::record('visitor', $who);
+            Mail::to($address)->queue($mail);
+
+            return true;
+        }));
+    }
+
+    /**
+     * Tell the owner a form was sent. False when the hour's notices have gone, and this
+     * one waits for the digest.
+     *
+     * @param  string|null  $line  What the digest says of it: a subject, or its first line
+     * @param  string|null  $url  Where in the dashboard it is
+     */
+    public static function toOwner(Mailable $mail, ?string $line = null, ?string $url = null): bool
+    {
+        $to = self::owner();
+        if ($to === null) {
+            return false;
+        }
+
+        return self::whenSaved(fn () => self::counted('owner', function () use ($mail, $line, $url, $to) {
+            if (self::sentSince('owner', 'owner', now()->subHour()) >= (int) config('nevela.public.notify.max_per_hour', 10)) {
+                DB::table(self::HELD)->insert([
+                    'id' => (string) Str::uuid(),
+                    'subject' => Str::limit(self::subjectOf($mail), 250, ''),
+                    'line' => $line === null ? null : Str::limit(trim(preg_replace('/\s+/', ' ', $line) ?? ''), 490),
+                    'url' => $url === null ? null : Str::limit($url, 2040, ''),
+                    'held_at' => now(),
+                ]);
+
+                return false;
+            }
+            self::record('owner', 'owner');
+            Mail::to($to)->queue($mail);
+
+            return true;
+        }));
+    }
+
+    /**
+     * Send what was held, as one email, and forget it. Run at the top of each hour by the
+     * scheduler (`nevela:digest`). Returns how many notices it named.
+     */
+    public static function digest(): int
+    {
+        $to = self::owner();
+        $held = DB::table(self::HELD)->orderBy('held_at')->get();
+        if ($held->isEmpty()) {
+            return 0;
+        }
+        if ($to !== null) {
+            Notification::route('mail', $to)->notify(new OwnerDigest(
+                $held->map(fn ($row) => ['subject' => (string) $row->subject, 'line' => $row->line, 'url' => $row->url])->all(),
+                Carbon::parse($held->first()->held_at)->format('H:i'),
+            ));
+        }
+        DB::table(self::HELD)->whereIn('id', $held->pluck('id')->all())->delete();
+
+        return $held->count();
+    }
+
+    /** Forget who was written to more than a few days ago, and old counts of what was refused. */
+    public static function prune(): void
+    {
+        try {
+            DB::table(self::SENT)->where('sent_at', '<', now()->subDays(2))->delete();
+            DB::table('nevela_form_blocks')->where('day', '<', now()->subDays(90)->toDateString())->delete();
+        } catch (Throwable) {
+            // Not migrated yet.
+        }
+    }
+
+    /** Who a form's notices go to: nevela.public.notify.to, or the address the app sends from. */
+    public static function owner(): ?string
+    {
+        $to = config('nevela.public.notify.to') ?: config('mail.from.address');
+
+        return is_string($to) && filter_var($to, FILTER_VALIDATE_EMAIL) ? $to : null;
+    }
+
+    /** An address as it is counted by: enough to tell it from another, not to read it back. */
+    public static function fingerprint(string $address): string
+    {
+        return hash_hmac('sha256', strtolower(trim($address)), 'nevela-mail|'.config('app.key'));
+    }
+
+    private static function sentSince(string $kind, string $recipient, Carbon $since): int
+    {
+        return DB::table(self::SENT)->where('kind', $kind)->where('recipient', $recipient)->where('sent_at', '>', $since)->count();
+    }
+
+    private static function record(string $kind, string $recipient): void
+    {
+        DB::table(self::SENT)->insert(['id' => (string) Str::uuid(), 'kind' => $kind, 'recipient' => $recipient, 'sent_at' => now()]);
+    }
+
+    /** What an email is headed, for the digest to name it by: its subject, or failing that what it is called. */
+    private static function subjectOf(Mailable $mail): string
+    {
+        try {
+            // Asked of a copy: a mailable that sets its subject in build() must not be built twice.
+            $probe = clone $mail;
+            if (method_exists($probe, 'envelope')) {
+                $subject = $probe->envelope()->subject;
+            } else {
+                if (method_exists($probe, 'build')) {
+                    app()->call([$probe, 'build']);
+                }
+                $subject = $probe->subject ?? null;
+            }
+        } catch (Throwable) {
+            $subject = null;
+        }
+
+        return is_string($subject) && $subject !== '' ? $subject : Str::headline(class_basename($mail));
+    }
+
+    /**
+     * Now, or once the transaction this was called in has committed. Never inside it.
+     *
+     * @param  callable(): bool  $send
+     */
+    private static function whenSaved(callable $send): bool
+    {
+        $sent = null;
+        // Runs at once where there is no transaction to wait for.
+        DB::afterCommit(function () use (&$sent, $send) {
+            $sent = $send();
+        });
+
+        return $sent ?? true;
+    }
+
+    /**
+     * Count and send as one step, so two requests at the same moment can't both be the
+     * last one allowed. Mail is never the reason a form fails: a problem here is reported
+     * and the answer is "not sent".
+     *
+     * @param  callable(): bool  $send
+     */
+    private static function counted(string $name, callable $send): bool
+    {
+        try {
+            try {
+                return (bool) Cache::lock('nevela-mail:'.$name, 10)->block(5, $send);
+            } catch (\Illuminate\Contracts\Cache\LockTimeoutException) {
+                return (bool) $send();
+            }
+        } catch (Throwable $e) {
+            report($e);
+
+            return false;
+        }
+    }
+}

package/template/laravel/src/Forms/Refusal.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace Nevela\Laravel\Forms;
+
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Response;
+
+/**
+ * A public form that was turned away, and what its sender is told.
+ *
+ * Which of three it is depends on who could be on the other end. A filled honeypot or a
+ * forged token is a program, and is told it worked: it learns nothing to adjust to. A
+ * failed robot check can happen to a person, so they are told, in a sentence. A problem
+ * with the address they typed is a validation message on that field, like any other.
+ */
+final class Refusal
+{
+    /** Refusals nobody is told about. The answer is the one a success gets, and nothing is stored. */
+    public const SILENT = ['honeypot', 'forged', 'too_fast'];
+
+    public function __construct(
+        public readonly string $reason,
+        public readonly int $status = 422,
+        public readonly string $message = '',
+        public readonly ?string $field = null,
+    ) {}
+
+    public function silent(): bool
+    {
+        return in_array($this->reason, self::SILENT, true);
+    }
+
+    public function response(): JsonResponse|Response
+    {
+        if ($this->silent()) {
+            $response = response()->noContent(201);
+            // Whoever is building the form sees why nothing arrived. A bot in production doesn't.
+            if (config('app.debug')) {
+                $response->header('X-Nevela-Blocked', $this->reason);
+            }
+
+            return $response;
+        }
+        if ($this->field !== null) {
+            return response()->json(['error' => 'Validation failed.', 'issues' => [['path' => $this->field, 'message' => $this->message]]], $this->status);
+        }
+
+        return response()->json(['error' => $this->message, 'code' => strtoupper($this->reason)], $this->status);
+    }
+}

package/template/laravel/src/Generator/BlogPages.php

@@ -0,0 +1,409 @@
+<?php
+
+namespace Nevela\Laravel\Generator;
+
+use Nevela\Laravel\Support\Descriptor;
+
+/**
+ * The site's blog: the pages that show a resource's public records as posts.
+ *
+ * Written once by `nevela:blog` into the web app, and the app's from then on, like the
+ * dashboard's pages. What differs between one app's blog and another's is which resource
+ * the posts are and what its fields are called, and all of that goes into one file,
+ * lib/blog.ts. The pages only know a post has a title, a body and an address.
+ *
+ * Pure, like the resource generator: this returns files, and Writer writes them.
+ */
+final class BlogPages
+{
+    /**
+     * @param  array{title: string, body: string, excerpt?: string|null, image?: string|null, published?: string|null}  $fields  The resource's field for each part of a post
+     * @return list<GeneratedFile>
+     */
+    public static function files(Descriptor $d, array $fields): array
+    {
+        $path = (string) $d->blog;
+        $segment = ltrim($path, '/');
+        $image = $fields['image'] ?? null;
+        $published = $fields['published'] ?? null;
+        $excerpt = $fields['excerpt'] ?? null;
+        $quote = fn (?string $value) => $value === null ? 'null' : json_encode($value, JSON_UNESCAPED_SLASHES);
+
+        $replace = [
+            '__PATH__' => $path,
+            '__RESOURCE__' => $d->name,
+            '__SLUG__' => $d->slug,
+            '__PLURAL__' => strtolower($d->pluralLabel),
+            '__BY__' => (string) $d->public?->by,
+            '__TITLE__' => $fields['title'],
+            '__BODY__' => $fields['body'],
+            '__EXCERPT__' => $quote($excerpt),
+            '__IMAGE__' => $quote($image),
+            '__PUBLISHED__' => $quote($published),
+            // HTML only where Laravel cleans it: a rich text field. Anything else is shown as the text it is.
+            '__HTML__' => $d->fields[$fields['body']]->isRich() ? 'true' : 'false',
+            // An upload has renditions and is fetched through this app. A path kept in a plain column is the old app's own file.
+            '__UPLOAD__' => $image !== null && $d->fields[$image]->kind === 'file' ? 'true' : 'false',
+            '__SORT__' => $published !== null ? "-{$published}" : '-createdAt',
+        ];
+        $header = "// Generated once by Nevela for the blog at {$path}. This file is yours.\n";
+        $files = [
+            'lib/blog.ts' => self::LIBRARY,
+            "app/{$segment}/page.tsx" => self::INDEX,
+            "app/{$segment}/[slug]/page.tsx" => self::POST,
+            "app/{$segment}/feed.xml/route.ts" => self::FEED,
+            'app/sitemap.ts' => self::SITEMAP,
+        ];
+
+        return array_map(
+            fn (string $file, string $contents) => new GeneratedFile(GeneratedFile::TARGET_WEB, $file, $header.strtr($contents, $replace), GeneratedFile::MODE_ONCE),
+            array_keys($files),
+            $files,
+        );
+    }
+
+    private const LIBRARY = <<<'TS'
+    //
+    // Everything the blog's pages know about where posts come from is here: which resource
+    // they are, what its fields are called, and how long a page of them may be reused.
+    // The posts are the resource's public records (its descriptor's "public" section, and
+    // the publicQuery scope on its model), read with no session, so the pages are the same
+    // for every visitor and are cached.
+    import { resourceTag } from "@/lib/cache";
+    import { fileUrl } from "@/lib/files";
+    import { API_URL, laravelPublic } from "@/lib/laravel";
+    import { site } from "@/lib/site";
+
+    export const blog = {
+      /** Where the blog is on the site. The pages are in app__PATH__. */
+      path: "__PATH__",
+      title: "Blog",
+      description: `News and notes from ${site.name}.`,
+      /** Posts on a page of the list. */
+      perPage: 9,
+    };
+
+    /** The resource's field for each part of a post. `null` where it has none. */
+    const FIELDS = {
+      title: "__TITLE__",
+      body: "__BODY__",
+      excerpt: __EXCERPT__ as string | null,
+      image: __IMAGE__ as string | null,
+      published: __PUBLISHED__ as string | null,
+    };
+
+    /**
+     * Whether the body is HTML. True for a rich text field, which Laravel cleans before it
+     * sends it, so it can go on the page as it is. Leave it false for any other field: its
+     * value is then shown as plain text, and whatever is in it can do no harm.
+     */
+    export const BODY_IS_HTML: boolean = __HTML__;
+
+    /**
+     * Whether the picture is a file uploaded through Nevela (an image field), which has
+     * smaller renditions and is fetched through this app. False for a plain column that
+     * holds a path or an address of the app's own.
+     */
+    const IMAGE_IS_UPLOAD: boolean = __UPLOAD__;
+
+    /**
+     * How long an answer may be reused, in seconds. Saving a post in the dashboard clears it
+     * at once (the tag below). The time is for what nobody saves: a post scheduled for later
+     * appears within this long of its moment.
+     */
+    const FRESH_FOR = 60;
+    const TAGS = [resourceTag("__RESOURCE__")];
+
+    export interface BlogPost {
+      id: string;
+      title: string;
+      /** What its address ends in: __PATH__/<slug>. */
+      slug: string;
+      /** A sentence or two for the list and for search engines. From the body when the post has none. */
+      excerpt: string;
+      body: string;
+      /** A picture for the list, and a larger one for the post's own page and for sharing. */
+      image: string | null;
+      imageLarge: string | null;
+      /** When it was published, as an ISO date. */
+      publishedAt: string | null;
+    }
+
+    /** The address a visitor reaches this site at, for the sitemap, the feed and shared links. */
+    export function siteUrl(): string {
+      return (process.env.NEXT_PUBLIC_SITE_URL ?? process.env.SITE_URL ?? "http://localhost:3000").replace(/\/+$/, "");
+    }
+
+    const words = (html: string) => html.replace(/<[^>]*>/g, " ").replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#0*39;/g, "'").replace(/\s+/g, " ").trim();
+
+    function picture(value: unknown, rendition?: string): string | null {
+      if (typeof value !== "string" || value === "") return null;
+      // A file uploaded through Nevela: fetched through this app, in the size asked for.
+      if (IMAGE_IS_UPLOAD) return fileUrl(value, rendition);
+      // A path kept in a plain column: a file on the Laravel app's public disk, or an address already.
+      if (/^https?:\/\//.test(value)) return value;
+      return `${new URL(API_URL).origin}/storage/${value.replace(/^\/+/, "")}`;
+    }
+
+    function toPost(row: Record<string, unknown>): BlogPost {
+      const text = (key: string | null) => (key && typeof row[key] === "string" ? (row[key] as string) : "");
+      const body = text(FIELDS.body);
+      const excerpt = text(FIELDS.excerpt) || words(body).slice(0, 180);
+      return {
+        id: String(row.id),
+        title: text(FIELDS.title),
+        slug: String(row["__BY__"] ?? row.id),
+        excerpt,
+        body,
+        // "thumb" is the small rendition every image profile makes. One that was never made is answered with the picture itself.
+        image: picture(FIELDS.image ? row[FIELDS.image] : null, "thumb"),
+        imageLarge: picture(FIELDS.image ? row[FIELDS.image] : null),
+        publishedAt: text(FIELDS.published) || null,
+      };
+    }
+
+    /** One page of published posts, newest first. */
+    export async function listPosts(page = 1, perPage = blog.perPage): Promise<{ posts: BlogPost[]; page: number; totalPages: number; total: number }> {
+      const response = await laravelPublic(`__SLUG__?sort=__SORT__&page=${page}&perPage=${perPage}`, { revalidate: FRESH_FOR, tags: TAGS });
+      if (!response.ok) return { posts: [], page, totalPages: 1, total: 0 };
+      const { data, meta } = response.body as { data: Record<string, unknown>[]; meta: { page: number; totalPages: number; total: number } };
+      return { posts: data.map(toPost), page: meta.page, totalPages: meta.totalPages, total: meta.total };
+    }
+
+    /** One published post by its address, or null: a draft, one still to come and one that never was are all "not here". */
+    export async function getPost(slug: string): Promise<BlogPost | null> {
+      const response = await laravelPublic(`__SLUG__/${encodeURIComponent(slug)}`, { revalidate: FRESH_FOR, tags: TAGS });
+      return response.ok ? toPost(response.body as Record<string, unknown>) : null;
+    }
+
+    /** Every published post, newest first, for the sitemap and the feed. */
+    export async function allPosts(most = 1000): Promise<BlogPost[]> {
+      const posts: BlogPost[] = [];
+      for (let page = 1; posts.length < most; page++) {
+        const result = await listPosts(page, 100);
+        posts.push(...result.posts);
+        if (page >= result.totalPages || result.posts.length === 0) break;
+      }
+      return posts.slice(0, most);
+    }
+
+    /** "11 October 2026" */
+    export function postDate(post: BlogPost): string {
+      return post.publishedAt ? new Intl.DateTimeFormat("en-GB", { dateStyle: "long" }).format(new Date(post.publishedAt)) : "";
+    }
+
+    TS;
+
+    private const INDEX = <<<'TSX'
+    import type { Metadata } from "next";
+    import Link from "next/link";
+    import { SiteHeader } from "@/components/marketing/site-header";
+    import { blog, listPosts, postDate } from "@/lib/blog";
+
+    export const metadata: Metadata = {
+      title: blog.title,
+      description: blog.description,
+      alternates: { types: { "application/rss+xml": `${blog.path}/feed.xml` } },
+    };
+
+    /** The blog: published __PLURAL__, newest first. */
+    export default async function BlogPage({ searchParams }: { searchParams: Promise<{ page?: string }> }) {
+      const asked = Number.parseInt((await searchParams).page ?? "1", 10);
+      const { posts, page, totalPages } = await listPosts(Number.isInteger(asked) && asked > 0 ? asked : 1);
+
+      return (
+        <>
+          <SiteHeader />
+          <main className="mx-auto max-w-6xl px-6 py-16">
+            <header className="max-w-2xl">
+              <h1 className="text-4xl md:text-5xl">{blog.title}</h1>
+              <p className="mt-4 text-lg text-foreground-muted">{blog.description}</p>
+            </header>
+
+            {posts.length === 0 ? (
+              <p className="mt-16 text-foreground-muted">Nothing has been published yet.</p>
+            ) : (
+              <ul className="mt-12 grid gap-8 sm:grid-cols-2 lg:grid-cols-3">
+                {posts.map((post) => (
+                  <li key={post.id}>
+                    <Link href={`${blog.path}/${post.slug}`} className="group flex h-full flex-col overflow-hidden rounded-[calc(var(--radius)+4px)] border border-border bg-surface hover:border-foreground/30">
+                      {post.image && (
+                        // eslint-disable-next-line @next/next/no-img-element -- already the right size: Laravel made this rendition when the picture was uploaded
+                        <img src={post.image} alt="" loading="lazy" decoding="async" className="aspect-[16/9] w-full object-cover" />
+                      )}
+                      <div className="flex flex-1 flex-col gap-2 p-6">
+                        {post.publishedAt && (
+                          <time dateTime={post.publishedAt} className="text-xs text-foreground-muted">
+                            {postDate(post)}
+                          </time>
+                        )}
+                        <h2 className="text-xl text-balance group-hover:underline">{post.title}</h2>
+                        <p className="line-clamp-3 text-sm leading-relaxed text-foreground-muted">{post.excerpt}</p>
+                      </div>
+                    </Link>
+                  </li>
+                ))}
+              </ul>
+            )}
+
+            {totalPages > 1 && (
+              <nav aria-label="Pages" className="mt-12 flex items-center justify-between text-sm">
+                {page > 1 ? (
+                  <Link href={page === 2 ? blog.path : `${blog.path}?page=${page - 1}`} className="hover:underline">
+                    ← Newer
+                  </Link>
+                ) : (
+                  <span />
+                )}
+                <span className="text-foreground-muted">
+                  Page {page} of {totalPages}
+                </span>
+                {page < totalPages ? (
+                  <Link href={`${blog.path}?page=${page + 1}`} className="hover:underline">
+                    Older →
+                  </Link>
+                ) : (
+                  <span />
+                )}
+              </nav>
+            )}
+          </main>
+        </>
+      );
+    }
+
+    TSX;
+
+    private const POST = <<<'TSX'
+    import type { Metadata } from "next";
+    import Link from "next/link";
+    import { notFound } from "next/navigation";
+    import { SiteHeader } from "@/components/marketing/site-header";
+    import { BODY_IS_HTML, blog, getPost, postDate, siteUrl } from "@/lib/blog";
+
+    type Props = { params: Promise<{ slug: string }> };
+
+    /** What a search engine and a shared link show: the title, the excerpt and the picture. */
+    export async function generateMetadata({ params }: Props): Promise<Metadata> {
+      const post = await getPost((await params).slug);
+      if (!post) return { title: "Not found" };
+      const image = post.imageLarge ? [new URL(post.imageLarge, siteUrl()).toString()] : undefined;
+      return {
+        title: post.title,
+        description: post.excerpt,
+        alternates: { canonical: `${siteUrl()}${blog.path}/${post.slug}` },
+        openGraph: { type: "article", title: post.title, description: post.excerpt, publishedTime: post.publishedAt ?? undefined, images: image },
+        twitter: { card: image ? "summary_large_image" : "summary", title: post.title, description: post.excerpt, images: image },
+      };
+    }
+
+    /** One post. A draft, one scheduled for later and one that never was are all a 404. */
+    export default async function PostPage({ params }: Props) {
+      const post = await getPost((await params).slug);
+      if (!post) notFound();
+
+      return (
+        <>
+          <SiteHeader />
+          <main className="mx-auto max-w-3xl px-6 py-16">
+            <Link href={blog.path} className="text-sm text-foreground-muted hover:text-foreground">
+              ← {blog.title}
+            </Link>
+            <article className="mt-8">
+              <header>
+                {post.publishedAt && (
+                  <time dateTime={post.publishedAt} className="text-sm text-foreground-muted">
+                    {postDate(post)}
+                  </time>
+                )}
+                <h1 className="mt-2 text-4xl text-balance md:text-5xl">{post.title}</h1>
+              </header>
+              {post.imageLarge && (
+                // eslint-disable-next-line @next/next/no-img-element -- optimised by Laravel when it was uploaded
+                <img src={post.imageLarge} alt="" className="mt-10 w-full rounded-[calc(var(--radius)+4px)] border border-border" />
+              )}
+              {BODY_IS_HTML ? (
+                // Laravel cleaned this HTML when the post was saved and again when it was read.
+                <div className="rich-text mt-10 text-lg" dangerouslySetInnerHTML={{ __html: post.body }} />
+              ) : (
+                <div className="mt-10 text-lg leading-relaxed whitespace-pre-line">{post.body}</div>
+              )}
+            </article>
+          </main>
+        </>
+      );
+    }
+
+    TSX;
+
+    private const FEED = <<<'TS'
+    import { blog, allPosts, siteUrl } from "@/lib/blog";
+    import { site } from "@/lib/site";
+
+    /** Rebuilt at most once a minute, like the pages. */
+    export const revalidate = 60;
+
+    const escape = (text: string) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+    /** The blog as an RSS feed: the latest fifty published __PLURAL__. */
+    export async function GET() {
+      const posts = await allPosts(50);
+      const home = siteUrl();
+      const items = posts
+        .map((post) => {
+          const link = `${home}${blog.path}/${post.slug}`;
+          return [
+            "    <item>",
+            `      <title>${escape(post.title)}</title>`,
+            `      <link>${escape(link)}</link>`,
+            `      <guid isPermaLink="true">${escape(link)}</guid>`,
+            post.publishedAt ? `      <pubDate>${new Date(post.publishedAt).toUTCString()}</pubDate>` : "",
+            `      <description>${escape(post.excerpt)}</description>`,
+            "    </item>",
+          ]
+            .filter(Boolean)
+            .join("\n");
+        })
+        .join("\n");
+
+      const xml = [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<rss version="2.0">',
+        "  <channel>",
+        `    <title>${escape(`${site.name}: ${blog.title}`)}</title>`,
+        `    <link>${escape(`${home}${blog.path}`)}</link>`,
+        `    <description>${escape(blog.description)}</description>`,
+        items,
+        "  </channel>",
+        "</rss>",
+        "",
+      ].join("\n");
+
+      return new Response(xml, { headers: { "Content-Type": "application/rss+xml; charset=utf-8" } });
+    }
+
+    TS;
+
+    private const SITEMAP = <<<'TS'
+    import type { MetadataRoute } from "next";
+    import { allPosts, blog, siteUrl } from "@/lib/blog";
+
+    /** Rebuilt at most once a minute, so a post is in it soon after it is published. */
+    export const revalidate = 60;
+
+    /** The site's pages, and every published post. Add your own pages to the first list. */
+    export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
+      const home = siteUrl();
+      const posts = await allPosts();
+      return [
+        { url: home, changeFrequency: "monthly", priority: 1 },
+        { url: `${home}${blog.path}`, changeFrequency: "daily", priority: 0.8 },
+        ...posts.map((post) => ({
+          url: `${home}${blog.path}/${post.slug}`,
+          lastModified: post.publishedAt ? new Date(post.publishedAt) : undefined,
+        })),
+      ];
+    }
+
+    TS;
+}