ferst-core 0.7.13 → 0.8.1

package/content/cookies.ts

@@ -1,8 +1,11 @@
 /**
  * Cookie / third-party-storage registry + a scanner that reports which uses are
  * actually active on a given site. This powers the auto-generated cookie policy
- * page: its categories and items are DERIVED from the recipes/templates the site
- * uses — functionality-driven, never hand-written or client-specific.
+ * page: its categories and items are DERIVED from the blocks the site uses AND what
+ * each one actually loads — functionality-driven, never hand-written or
+ * client-specific. A hero playing a YouTube link loads YouTube (listed, and gated by
+ * consent); a hero playing a video file the site hosts loads nothing from anyone (not
+ * listed, plays straight away). A map with no embed address loads nothing.
  *
  * Two canonical categories:
  *   • necessary  — the site's OWN functional storage (no third parties). Always
@@ -11,10 +14,13 @@
  *                  they load. Gated behind the site's shared embed consent, and
  *                  listed only when a recipe/template that uses them is present.
  *
- * Adding a new cookie-using recipe = one entry here (its `blocks` and/or a
- * detection flag); the policy page then lists it automatically wherever it's used.
- * Pure + framework-free so it's unit-testable without a render.
+ * Adding a new cookie-using recipe = one entry here (a `loads` rule reading the
+ * block's own data, and/or a detection flag); the policy page then lists it
+ * automatically wherever it's used. Pure + framework-free so it's unit-testable
+ * without a render.
  */
+import { backgroundEmbed, videoEmbed } from '../lib/video';
+import { isSafeEmbedUrl } from './calendar';
 
 export type CookieCategory = 'necessary' | 'additional';
 
@@ -32,14 +38,40 @@ export interface CookieUse {
   storage: string;
 }
 
+/** A block as stored in a page: its `type`, its own fields, and any child blocks. */
+export type BlockLike = { type: string; blocks?: unknown } & Record<string, unknown>;
+
 /** Additional uses carry detection rules; stripped before returning to the view. */
 interface AdditionalUse extends CookieUse {
-  /** Present if any of these block `type`s appears anywhere on the site. */
-  blocks?: string[];
+  /** Present if any block on the site loads this provider, judged from the block's data. */
+  loads?: (block: BlockLike) => boolean;
   /** Present if the site has a Google Calendar configured (a dedicated page). */
   calendar?: boolean;
 }
 
+/** The video provider a block plays from (a video block's link, a hero's background), if any. */
+function videoProviderOf(b: BlockLike): string | undefined {
+  if (b.type === 'video') return videoEmbed(typeof b.url === 'string' ? b.url : '')?.provider;
+  if (b.type === 'hero') {
+    if (b.layout !== 'media') return undefined; // only the media layout shows a background
+    const video = (b.media as { video?: unknown } | undefined)?.video;
+    return typeof video === 'string' ? backgroundEmbed(video)?.provider : undefined;
+  }
+  return undefined;
+}
+
+/** The provider a block shows a map from (its own label), if it has a map to show. */
+function mapProviderOf(b: BlockLike): string | undefined {
+  const label = typeof b.provider === 'string' && b.provider.trim() ? b.provider.trim() : 'Google Maps';
+  if (b.type === 'mapEmbed') return isSafeEmbedUrl(typeof b.embedUrl === 'string' ? b.embedUrl : '') ? label : undefined;
+  if (b.type === 'locations' && Array.isArray(b.items)) {
+    const hasMap = b.items.some((i: { embedUrl?: unknown }) => isSafeEmbedUrl(typeof i?.embedUrl === 'string' ? i.embedUrl : ''));
+    return hasMap ? label : undefined;
+  }
+  return undefined;
+}
+const isGoogleMaps = (provider: string) => /google/i.test(provider);
+
 /** The site's own functional storage — always present, always on. */
 const NECESSARY: readonly CookieUse[] = [
   {
@@ -67,7 +99,10 @@ const ADDITIONAL: readonly AdditionalUse[] = [
     provider: 'Google',
     purpose: 'Shows embedded maps of where to find us. Google may set cookies when a map loads.',
     storage: 'Third-party cookies set by Google.',
-    blocks: ['locations', 'mapEmbed'],
+    loads: (b) => {
+      const provider = mapProviderOf(b);
+      return provider !== undefined && isGoogleMaps(provider);
+    },
   },
   {
     id: 'google-calendar',
@@ -76,23 +111,46 @@ const ADDITIONAL: readonly AdditionalUse[] = [
     provider: 'Google',
     purpose: 'Shows the parish calendar. Google may set cookies when the calendar loads.',
     storage: 'Third-party cookies set by Google.',
-    blocks: ['calendar'],
+    loads: (b) => b.type === 'calendar',
     calendar: true,
   },
   {
-    id: 'video',
+    id: 'youtube',
+    category: 'additional',
+    name: 'YouTube',
+    provider: 'Google',
+    purpose: 'Plays videos from YouTube on our pages. YouTube may store data on your device and see your IP address when a video plays.',
+    storage: 'Third-party cookies and local storage set by YouTube (Google).',
+    loads: (b) => videoProviderOf(b) === 'YouTube',
+  },
+  {
+    id: 'vimeo',
     category: 'additional',
-    name: 'Embedded video (YouTube / Vimeo)',
-    provider: 'Google (YouTube) or Vimeo',
-    purpose: 'Plays videos embedded on our pages. The provider may set cookies when a video loads.',
-    storage: 'Third-party cookies set by the video provider.',
-    blocks: ['video'],
+    name: 'Vimeo',
+    provider: 'Vimeo',
+    purpose: 'Plays videos from Vimeo on our pages. Vimeo may store data on your device and see your IP address when a video plays.',
+    storage: 'Third-party cookies set by Vimeo.',
+    loads: (b) => videoProviderOf(b) === 'Vimeo',
   },
 ];
 
+/** A map from a provider other than Google, named as the block names it (e.g. OpenStreetMap). */
+function otherMapUse(provider: string): CookieUse {
+  const slug = provider.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+  return {
+    id: `map-${slug}`,
+    category: 'additional',
+    name: provider,
+    provider,
+    purpose: `Shows embedded maps of where to find us. ${provider} may set cookies when a map loads.`,
+    storage: `Third-party cookies set by ${provider}.`,
+  };
+}
+
 export interface CookieScanInput {
-  /** Every block `type` that appears anywhere on the site. */
-  blockTypes: Iterable<string>;
+  /** Every block on the site's pages. Container children (`section` / `grid` / `stack`)
+   *  are walked, so an embed nested in a grid counts. */
+  blocks: Iterable<BlockLike>;
   /** True when the site has a Google Calendar configured (dedicated calendar page). */
   calendarConfigured?: boolean;
 }
@@ -102,21 +160,36 @@ export interface CookiePolicyModel {
   additional: CookieUse[];
 }
 
+/** Every block that renders, walking container children (`section` / `grid` / `stack`).
+ *  A block switched off (`enabled: false`) renders nothing, and neither do its children. */
+function allBlocks(blocks: Iterable<BlockLike>, acc: BlockLike[] = []): BlockLike[] {
+  for (const b of blocks) {
+    if (!b || typeof b !== 'object' || typeof b.type !== 'string' || b.enabled === false) continue;
+    acc.push(b);
+    if (Array.isArray(b.blocks)) allBlocks(b.blocks as BlockLike[], acc);
+  }
+  return acc;
+}
+
 /** Report the cookie uses actually active on a site, grouped by category. */
 export function scanCookieUses(input: CookieScanInput): CookiePolicyModel {
-  const types = new Set(input.blockTypes);
-  const additional = ADDITIONAL.filter(
-    (u) => (u.blocks?.some((b) => types.has(b)) ?? false) || (u.calendar === true && !!input.calendarConfigured),
-  ).map(({ blocks, calendar, ...use }) => use); // drop detection fields from the view model
+  const blocks = allBlocks(input.blocks);
+  const additional: CookieUse[] = ADDITIONAL.filter(
+    (u) => (u.loads ? blocks.some(u.loads) : false) || (u.calendar === true && !!input.calendarConfigured),
+  ).map(({ loads, calendar, ...use }) => use); // drop detection fields from the view model
+  // Maps from other providers, as the blocks name them, listed with the other maps.
+  const otherMaps = new Set(blocks.map(mapProviderOf).filter((p): p is string => p !== undefined && !isGoogleMaps(p)));
+  const afterMaps = additional.findIndex((u) => u.id !== 'google-maps');
+  additional.splice(afterMaps === -1 ? additional.length : afterMaps, 0, ...[...otherMaps].map(otherMapUse));
   return { necessary: NECESSARY.map((u) => ({ ...u })), additional };
 }
-
-/** Every block `type` used in a list of blocks, walking container children
- *  (`section` / `grid` / `stack`), so the policy sees an embed nested in a grid. */
-export function blockTypesIn(blocks: ReadonlyArray<{ type: string; blocks?: unknown }>, acc = new Set<string>()): Set<string> {
-  for (const b of blocks) {
-    acc.add(b.type);
-    if (Array.isArray(b.blocks)) blockTypesIn(b.blocks as Array<{ type: string; blocks?: unknown }>, acc);
-  }
-  return acc;
-}
+
+/** Every block `type` used in a list of blocks, walking container children
+ *  (`section` / `grid` / `stack`), so the policy sees an embed nested in a grid. */
+export function blockTypesIn(blocks: ReadonlyArray<{ type: string; blocks?: unknown }>, acc = new Set<string>()): Set<string> {
+  for (const b of blocks) {
+    acc.add(b.type);
+    if (Array.isArray(b.blocks)) blockTypesIn(b.blocks as Array<{ type: string; blocks?: unknown }>, acc);
+  }
+  return acc;
+}

package/content/schemas.ts

@@ -65,6 +65,10 @@ export const logoSettingsSchema = z.object({
   secondaryLogoLight: z.string().optional(),
   /** Secondary/footer logo — dark theme variant (optional). */
   secondaryLogoDark: z.string().optional(),
+  /** Browser icon (favicon): a square image, PNG or SVG, at least 48×48. Optional: blank
+   *  uses the header logo when it's roughly square, else the site's initial in its brand
+   *  colour (lib/site-icon.mjs). */
+  favicon: z.string().optional(),
   /** Display name + target URL for the secondary/footer logo's link (optional). */
   secondaryLogoLink: z
     .object({

package/integration.mjs

@@ -1,123 +1,208 @@
-/**
- * ferst() — the Astro integration that makes a client site's ROUTING package-owned.
- *
- * A thin client adds `integrations: [ferst()]` to astro.config.mjs and carries
- * ZERO page files: the page catch-all (which also owns the home page), the
- * calendar route and the blog routes are injected from ferst-core. A routing fix
- * then ships as a package bump + rebuild — the same channel component fixes travel
- * through — instead of being hand-copied into every client repo.
- *
- * Irreducible caveat (Astro 5): content collections must be defined in the CONSUMER,
- * so the one-line `src/content/config.ts` re-export stays. "Zero page files" is
- * reachable; "zero files" is not. Explicit client `.astro` routes still win over
- * these injected ones, so a one-off hand-built page is always possible.
- *
- * The blog routes (posts index / individual post / tag pages) inject as a set:
- * the listing components (NewsList, PostsFilter) now live in core, so `/posts`,
- * `/posts/[...slug]` and `/posts/tag/[...tag]` all ship from the package. Turn
- * the whole capability off with `blog: false` (then a client wanting posts hand-
- * builds its own routes over `ferst-core/lib/posts`).
- *
- * @param {object} [options]
- * @param {boolean} [options.calendar=true] Inject the `/calendar` route.
- * @param {boolean} [options.blog=true] Inject the blog routes (`/posts`,
- *   `/posts/[...slug]`, `/posts/tag/[...tag]`).
- * @param {boolean} [options.cookiePolicy=true] Inject `/cookie-policy` (the page the cookie
- *   banner links to), generated from the blocks the site uses. Skipped automatically when
- *   the site has its own `src/pages/cookie-policy.astro`.
- * @returns {import('astro').AstroIntegration}
- */
-import { copyFileSync, createReadStream, existsSync, mkdirSync, readdirSync } from 'node:fs';
-
-/** The self-hosted fonts the engine's CSS requests (/fonts/*.woff2), shipped in the package. */
-const FONTS_DIR = new URL('./fonts/', import.meta.url);
-const FONT_URL = /^\/fonts\/([a-z0-9-]+\.woff2)(?:\?.*)?$/;
-
-/**
- * ferstFonts() — serves the engine's self-hosted fonts in `astro dev` and copies them into
- * every build's `/fonts/`. Included in ferst(); usable on its own (the showcase). A file
- * the site already has in its own `public/fonts/` is never overwritten.
- * @returns {import('astro').AstroIntegration}
- */
-export function ferstFonts() {
-  return {
-    name: 'ferst-fonts',
-    hooks: {
-      'astro:server:setup': ({ server }) => {
-        server.middlewares.use((req, res, next) => {
-          const m = req.url && req.url.match(FONT_URL);
-          if (!m) return next();
-          const file = new URL(m[1], FONTS_DIR);
-          if (!existsSync(file)) return next();
-          res.setHeader('Content-Type', 'font/woff2');
-          res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
-          createReadStream(file).pipe(res);
-        });
-      },
-      'astro:build:done': async ({ dir }) => {
-        const out = new URL('fonts/', dir);
-        mkdirSync(out, { recursive: true });
-        for (const name of readdirSync(FONTS_DIR)) {
-          if (!name.endsWith('.woff2')) continue;
-          const dest = new URL(name, out);
-          if (!existsSync(dest)) copyFileSync(new URL(name, FONTS_DIR), dest);
-        }
-      },
-    },
-  };
-}
-
-export default function ferst(options = {}) {
-  const { calendar = true, blog = true, cookiePolicy = true } = options;
-  return {
-    name: 'ferst',
-    hooks: {
-      'astro:config:setup': ({ injectRoute, config }) => {
-        // Pages + home: the reserved `index` entry renders at `/`, every other
-        // `pages` entry at its own slug (see lib/pages.ts `getSiteRoutes`).
-        injectRoute({
-          pattern: '/[...slug]',
-          entrypoint: 'ferst-core/routes/[...slug].astro',
-        });
-        if (calendar) {
-          injectRoute({
-            pattern: '/calendar',
-            entrypoint: 'ferst-core/routes/calendar/index.astro',
-          });
-        }
-        if (blog) {
-          // The posts capability: index, individual post, and tag pages. Reads
-          // the `posts`/`tags`/`postsSettings` collections (content/collections.ts).
-          injectRoute({
-            pattern: '/posts',
-            entrypoint: 'ferst-core/routes/posts/index.astro',
-          });
-          injectRoute({
-            pattern: '/posts/[...slug]',
-            entrypoint: 'ferst-core/routes/posts/[...slug].astro',
-          });
-          injectRoute({
-            pattern: '/posts/tag/[...tag]',
-            entrypoint: 'ferst-core/routes/posts/tag/[...tag].astro',
-          });
-          // Index pages 2+ (page 1 is /posts; tag pages paginate inside their own route).
-          injectRoute({
-            pattern: '/posts/page/[page]',
-            entrypoint: 'ferst-core/routes/posts/page/[page].astro',
-          });
-        }
-        // The cookie banner links here on every page, so it must always resolve. A site's
-        // own hand-built page wins (Astro would otherwise see two routes for one path).
-        const bespoke = config?.root && existsSync(new URL('src/pages/cookie-policy.astro', config.root));
-        if (cookiePolicy && !bespoke) {
-          injectRoute({
-            pattern: '/cookie-policy',
-            entrypoint: 'ferst-core/routes/cookie-policy.astro',
-          });
-        }
-      },
-      // The engine's self-hosted fonts: served in dev, copied into every build.
-      ...ferstFonts().hooks,
-    },
-  };
-}
+/**
+ * ferst() — the Astro integration that makes a client site's ROUTING package-owned.
+ *
+ * A thin client adds `integrations: [ferst()]` to astro.config.mjs and carries
+ * ZERO page files: the page catch-all (which also owns the home page), the
+ * calendar route and the blog routes are injected from ferst-core. A routing fix
+ * then ships as a package bump + rebuild — the same channel component fixes travel
+ * through — instead of being hand-copied into every client repo.
+ *
+ * Irreducible caveat (Astro 5): content collections must be defined in the CONSUMER,
+ * so the one-line `src/content/config.ts` re-export stays. "Zero page files" is
+ * reachable; "zero files" is not. Explicit client `.astro` routes still win over
+ * these injected ones, so a one-off hand-built page is always possible.
+ *
+ * The blog routes (posts index / individual post / tag pages) inject as a set:
+ * the listing components (NewsList, PostsFilter) now live in core, so `/posts`,
+ * `/posts/[...slug]` and `/posts/tag/[...tag]` all ship from the package. Turn
+ * the whole capability off with `blog: false` (then a client wanting posts hand-
+ * builds its own routes over `ferst-core/lib/posts`).
+ *
+ * @param {object} [options]
+ * @param {boolean} [options.calendar=true] Inject the `/calendar` route.
+ * @param {boolean} [options.blog=true] Inject the blog routes (`/posts`,
+ *   `/posts/[...slug]`, `/posts/tag/[...tag]`).
+ * @param {boolean} [options.cookiePolicy=true] Inject `/cookie-policy` (the page the cookie
+ *   banner links to), generated from the blocks the site uses. Skipped automatically when
+ *   the site has its own `src/pages/cookie-policy.astro`.
+ * @param {boolean} [options.notFound=true] Inject the "page not found" page (`/404` →
+ *   `404.html`). Cloudflare Pages answers a missing address with it and a real 404 status;
+ *   without one it serves the home page with a 200 (a "soft 404"). Skipped automatically
+ *   when the site has its own `src/pages/404.astro` or `public/404.html`.
+ * @param {boolean} [options.icons=true] The browser icon (lib/site-icon.mjs): `/favicon.ico` and
+ *   `/apple-touch-icon.png` in every build, from the icon set in the CMS, else a roughly
+ *   square logo, else the site's initial in its brand colour. A site's own files in
+ *   `public/` win.
+ * @param {boolean} [options.seo=true] Search signals (lib/seo.mjs): `/robots.txt`, and once
+ *   `ferst-site.json` has a `siteUrl`, `/sitemap.xml` and a canonical address on every page.
+ *   A test copy (any branch but the production one) is marked noindex on every file. A
+ *   site's own `public/robots.txt` or `public/sitemap.xml` wins.
+ * @returns {import('astro').AstroIntegration}
+ */
+import { copyFileSync, createReadStream, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { deploymentBranch } from './bin/cms-config.mjs';
+import { seoContext, withNoindexHeader } from './lib/seo.mjs';
+import { writeSiteIcons } from './lib/site-icon.mjs';
+
+/** The self-hosted fonts the engine's CSS requests (/fonts/*.woff2), shipped in the package. */
+const FONTS_DIR = new URL('./fonts/', import.meta.url);
+const FONT_URL = /^\/fonts\/([a-z0-9-]+\.woff2)(?:\?.*)?$/;
+
+/**
+ * ferstFonts() — serves the engine's self-hosted fonts in `astro dev` and copies them into
+ * every build's `/fonts/`. Included in ferst(); usable on its own (the showcase). A file
+ * the site already has in its own `public/fonts/` is never overwritten.
+ * @returns {import('astro').AstroIntegration}
+ */
+export function ferstFonts() {
+  return {
+    name: 'ferst-fonts',
+    hooks: {
+      'astro:server:setup': ({ server }) => {
+        server.middlewares.use((req, res, next) => {
+          const m = req.url && req.url.match(FONT_URL);
+          if (!m) return next();
+          const file = new URL(m[1], FONTS_DIR);
+          if (!existsSync(file)) return next();
+          res.setHeader('Content-Type', 'font/woff2');
+          res.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+          createReadStream(file).pipe(res);
+        });
+      },
+      'astro:build:done': async ({ dir }) => {
+        const out = new URL('fonts/', dir);
+        mkdirSync(out, { recursive: true });
+        for (const name of readdirSync(FONTS_DIR)) {
+          if (!name.endsWith('.woff2')) continue;
+          const dest = new URL(name, out);
+          if (!existsSync(dest)) copyFileSync(new URL(name, FONTS_DIR), dest);
+        }
+      },
+    },
+  };
+}
+
+/** The site's `ferst-site.json`, or null (no file, or not JSON). */
+function readSiteMeta(root) {
+  if (!root) return null;
+  try {
+    return JSON.parse(readFileSync(new URL('ferst-site.json', root), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+/** Does the site ship this file in its own `public/`? (Its own file wins over ours.) */
+const hasPublicFile = (root, name) => Boolean(root) && existsSync(new URL(`public/${name}`, root));
+
+export default function ferst(options = {}) {
+  const { calendar = true, blog = true, cookiePolicy = true, notFound = true, icons = true, seo = true } = options;
+  const fonts = ferstFonts().hooks;
+  /** This build's search context, decided at setup and used again when the build is done. */
+  let search = null;
+  /** The site's folder, for the content and public files the build-done steps read. */
+  let siteRoot = null;
+  return {
+    name: 'ferst',
+    hooks: {
+      'astro:config:setup': ({ injectRoute, updateConfig, config }) => {
+        siteRoot = config?.root ?? null;
+        // Pages + home: the reserved `index` entry renders at `/`, every other
+        // `pages` entry at its own slug (see lib/pages.ts `getSiteRoutes`).
+        injectRoute({
+          pattern: '/[...slug]',
+          entrypoint: 'ferst-core/routes/[...slug].astro',
+        });
+        if (calendar) {
+          injectRoute({
+            pattern: '/calendar',
+            entrypoint: 'ferst-core/routes/calendar/index.astro',
+          });
+        }
+        if (blog) {
+          // The posts capability: index, individual post, and tag pages. Reads
+          // the `posts`/`tags`/`postsSettings` collections (content/collections.ts).
+          injectRoute({
+            pattern: '/posts',
+            entrypoint: 'ferst-core/routes/posts/index.astro',
+          });
+          injectRoute({
+            pattern: '/posts/[...slug]',
+            entrypoint: 'ferst-core/routes/posts/[...slug].astro',
+          });
+          injectRoute({
+            pattern: '/posts/tag/[...tag]',
+            entrypoint: 'ferst-core/routes/posts/tag/[...tag].astro',
+          });
+          // Index pages 2+ (page 1 is /posts; tag pages paginate inside their own route).
+          injectRoute({
+            pattern: '/posts/page/[page]',
+            entrypoint: 'ferst-core/routes/posts/page/[page].astro',
+          });
+        }
+        // The cookie banner links here on every page, so it must always resolve. A site's
+        // own hand-built page wins (Astro would otherwise see two routes for one path).
+        const bespoke = config?.root && existsSync(new URL('src/pages/cookie-policy.astro', config.root));
+        if (cookiePolicy && !bespoke) {
+          injectRoute({
+            pattern: '/cookie-policy',
+            entrypoint: 'ferst-core/routes/cookie-policy.astro',
+          });
+        }
+        // A missing address must answer 404, not the home page (Cloudflare Pages serves the
+        // home page with a 200 when a build has no 404.html). The site's own page wins.
+        const ownNotFound = config?.root && existsSync(new URL('src/pages/404.astro', config.root));
+        if (notFound && !ownNotFound && !hasPublicFile(config?.root, '404.html')) {
+          injectRoute({ pattern: '/404', entrypoint: 'ferst-core/routes/404.astro' });
+        }
+        // Which optional routes this site has, for the pages that link to them (the sitemap,
+        // the "page not found" page).
+        updateConfig?.({
+          vite: {
+            define: {
+              'import.meta.env.FERST_ROUTES_BLOG': JSON.stringify(blog),
+              'import.meta.env.FERST_ROUTES_CALENDAR': JSON.stringify(calendar),
+            },
+          },
+        });
+        // Search signals: the site's address and whether this deploy is the live site (the
+        // production branch) or a test copy, the same rule the CMS uses for its git-proxy.
+        if (seo) {
+          const root = config?.root;
+          search = seoContext({ siteMeta: readSiteMeta(root), branch: deploymentBranch(), env: process.env });
+          updateConfig?.({
+            ...(search.siteUrl && !config?.site ? { site: search.siteUrl } : {}),
+            vite: {
+              define: {
+                'import.meta.env.FERST_SITE_URL': JSON.stringify(search.siteUrl ?? ''),
+                'import.meta.env.FERST_SEO_PRODUCTION': JSON.stringify(search.production),
+              },
+            },
+          });
+          if (!hasPublicFile(root, 'robots.txt')) {
+            injectRoute({ pattern: '/robots.txt', entrypoint: 'ferst-core/routes/robots.txt.ts' });
+          }
+          // A sitemap lists absolute addresses, so it needs the site's address.
+          if (search.siteUrl && !hasPublicFile(root, 'sitemap.xml')) {
+            injectRoute({ pattern: '/sitemap.xml', entrypoint: 'ferst-core/routes/sitemap.xml.ts' });
+          }
+        }
+      },
+      // The engine's self-hosted fonts: served in dev, copied into every build.
+      'astro:server:setup': fonts['astro:server:setup'],
+      'astro:build:done': async (ctx) => {
+        await fonts['astro:build:done'](ctx);
+        // A test copy is noindex on every file: pages, and the PDFs and images beside them.
+        if (search && !search.production) {
+          const file = new URL('_headers', ctx.dir);
+          writeFileSync(file, withNoindexHeader(existsSync(file) ? readFileSync(file, 'utf8') : ''));
+        }
+        // The browser icon: /favicon.ico and /apple-touch-icon.png (sharp comes with Astro).
+        if (icons && siteRoot) {
+          const sharp = await import('sharp').then((m) => m.default ?? m).catch(() => null);
+          await writeSiteIcons({ root: siteRoot, outDir: ctx.dir, sharp, warn: (m) => (ctx.logger ? ctx.logger.warn(m) : console.warn(m)) });
+        }
+      },
+    },
+  };
+}