Brochure site

A non-developer writes Markdown in the admin area and it is served at /<slug>. Drafts are 404 until published or opened through a day-long signed link. The sanitizer, not the author, decides what HTML exists; a reserved-slug test stops a page shadowing a route.

Posts are files in the repo, validated and synced into Postgres at deploy; drafts are excluded in the query, not the template.

An admin uploads images once and pastes a snippet into any page. Several images on one line render as a gallery grid; a quote with an attribution line renders as a testimonial card — conventions in CSS, not a page builder. The sanitizer admits same-origin image paths alongside https; a test keeps protocol-relative hosts out.

Needs R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET, R2_PUBLIC_BASE_URL. Without it: Images are stored locally under .uploads/.

A visitor describes a job and attaches up to six photos that go straight to storage; the request is stored before it is mailed, then acknowledged to the sender and announced to the owner. A guest's photo is bound to an httpOnly cookie, claimable only by their own submission, and swept if nothing claims it in a day. Contact messages land in the same inbox.

Needs RESEND_API_KEY. Without it: The inquiry is stored and the notification prints to the console.

One schema that validates on the client and re-validates on the server.

One spec renders both an HTML email and its plain-text alternative; rich by default, MAIL_FORMAT=text for plain only. Two transports; real delivery is a key in .env. Previews at /admin/mail.

Needs RESEND_API_KEY. Without it: Messages print to the server console in full, links included.

robots.txt, a database-driven sitemap.xml, a web manifest, favicons, and a per-post and per-product OpenGraph image — all generated from code, no binary assets to keep in sync.

Every page names its publisher: an Organization, or the configured LocalBusiness type with address, phone, hours, and service area when SITE_BUSINESS is filled in. Posts carry Article, products carry Product with an Offer and stock state, admin pages carry WebPage, all with breadcrumbs. The serializer escapes anything that could close the script element, and a test proves it.

One beacon per navigation counts a view per (day, path) and a distinct visitor per day from a salted hash that cannot be linked across days. No cookie, no ip stored, crawlers and private pages excluded, Global Privacy Control honored. /admin/analytics charts real rows.

Needs NEXT_PUBLIC_VERCEL_ANALYTICS. Without it: First-party cookieless page views are recorded and charted at /admin/analytics.

Sign-up, forgot-password, and contact carry a hidden field a person never fills and a script always does. With Turnstile keys set, an invisible challenge is verified server-side too; the CSP admits the widget by derivation. One generic message for every failure.

Needs NEXT_PUBLIC_TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY. Without it: The honeypot field runs alone, which catches naive scripts.

Keyed per caller, so an abuser is throttled and not the site. Durable by default: one atomic upsert per hit holds the limit across serverless instances; RATE_LIMIT_STORE=memory keeps the per-process limiter, which is also the fallback if the database call fails.