Arrow

Free, AI-enhanced website generator for small-business ad sites — and the business owns the output.

Arrow assembles a fast, mobile-responsive, vanilla static website for a local service business out of proven, pre-built parts — a whole-site pattern plus reusable scaffolds (feature modules the owner can manage from a page). The output is a plain folder of HTML/CSS/JS the customer keeps and hosts anywhere. There is no builder runtime, no phone-home, and no subscription required to keep the site online.

Free + source-available, attribution required, no reselling-as-a-service. Not OSI "open source" due to the no-resale clause (see License).

Live demo & pitch: https://discnxt.com/arrow/

---

What Arrow is (and isn't)

• ✅ It assembles a vetted whole-site pattern + reusable feature scaffolds.
• ✅ Output is an owned vanilla static bundle (+ a little PHP for the managed parts) that runs on any cheap host.
• ❌ It is not a "vibe-coding" code generator or an app builder. It ships proven parts, not risky one-offs.

What's in this repo

index.html            Arrow landing / pitch page (with the lead-capture funnel)
landing.css / .js     Landing page styling + funnel submit
download.html         "Download the owned bundle" page
contact.php           Arrow's OWN lead funnel (saves leads.json + emails)
lib.php               Shared helpers: session auth, atomic JSON IO, image upload
config.example.php    Config template (admin password + lead email)

demo/                 A generated DEMO site from the generic service-business pattern
  index.html          The whole site (hero, services, gallery, events, hours, contact)
  css/site.css        Pattern styles (self-hosted Rubik webfont, teal/amber brand)
  js/site.js          Wires the gallery + calendar from local JSON
  manage-events.php   Password-gated admin: add/edit/delete events -> data/events.json
  manage-gallery.php  Password-gated admin: upload/reorder/delete photos -> data/gallery.json
  contact.php         Per-site contact funnel template
  data/*.json         events.json, gallery.json (the scaffolds render from these)
  vendor/             Self-hosted MIT libraries (no CDNs)
  assets/             Webfont (OFL), favicon, demo images
  README.md           Customer setup/deploy guide (ships in the downloadable bundle)
  CREDITS.md          Attribution for bundled libraries
  sitemap.xml, llms.txt

vendor/               Self-hosted libraries for the landing page
LICENSE               Apache-2.0 + Commons Clause
CREDITS.md            Attribution

The two scaffolds (the "brangembringem" pattern)

Each scaffold is self-contained: the public part renders client-side from a simple JSON data file, and a tiny password-gated PHP page lets the owner edit it. No third-party services, everything self-hosted.

• Calendar — vkurko Event Calendar (MIT) renders upcoming events from data/events.json. manage-events.php adds/edits/deletes events (atomic write-back).
• Photo gallery — Swiper (MIT) for the rotating gallery + PhotoSwipe (MIT) for click-to-fullscreen. Renders from data/gallery.json. manage-gallery.php uploads (image-types only, validated), reorders (drag), captions, and deletes photos.

Admin auth is trivial-but-real: a single shared password in config.php (ARROW_ADMIN_PASSWORD) plus session + CSRF token. This is an MVP, not Fort Knox — change the password before going live.

How to use the output (self-hosting)

The generated site is static HTML + a little PHP. The static parts work on any host; the two admin pages and the contact form need PHP (every cheap shared host has it).

1. Copy demo/ (or your generated site) to your web root.
2. Copy config.example.php to config.php and set ARROW_ADMIN_PASSWORD and ARROW_LEAD_EMAIL.
3. Make data/ and assets/img/ writable by the web server (e.g. chmod 0775, or group-own to the web user).

The downloadable bundle (demo/README.md) has full instructions, plus sitemap.xml, llms.txt, and CREDITS.md.

Dual-target note: how we host the managed scaffolds may differ from the ZIP (e.g. web-user permissions / php_fastcgi scoping), but the bundle is built to run on commodity PHP hosting as-is.

Security notes (MVP honesty)

• Admin pages are password-gated with a session + CSRF token. Single shared password.
• Uploads are validated as real images (getimagesize) and re-named; size-capped.
• JSON writes are atomic (temp file + rename).
• config.php (real password) and data/leads.json are gitignored — never commit secrets.
• This is intentionally simple. It is not hardened multi-user auth. Set a strong password.

License

Arrow is licensed Apache-2.0 with a Commons Clause rider.

You may use Arrow freely — including commercially — and keep everything you build with it. You may not repackage Arrow itself and resell its functionality as a competing hosted service. Because of that no-resale clause, Arrow is source-available but not OSI "open source." Attribution is required (keep CREDITS.md with generated sites).

See LICENSE and CREDITS.md.

---

Arrow is a project by Digital Disconnections. Part of the Discnxt by Digital Disconnections.