@djangocfg/nextjs 2.1.543 → 2.1.545

package/dist/sitemap/index.d.mts

@@ -36,6 +36,15 @@ interface SitemapFeedPage {
     next_cursor: string | null;
     entries: SitemapEntry[];
 }
+/**
+ * Which backend sources a frontend claims: a list of names, or a predicate.
+ *
+ * Omit for every source in the index — right whenever the backend serves
+ * this frontend alone. Pass one when several frontends share a backend, so
+ * each emits only the URLs its own host can resolve. See `tenantSources`
+ * for the `<source>-<tenant>` convention.
+ */
+type SourceSelector = string[] | ((name: string) => boolean);
 interface StaticRoute {
     path: string;
     changeFrequency?: ChangeFreq;
@@ -51,6 +60,9 @@ interface CreateDjangoSitemapOptions {
     /** Frontend-only routes the backend doesn't know about. Auth/account
      *  pages should NOT be listed here. */
     staticRoutes?: StaticRoute[];
+    /** Backend sources to emit. Default: every source the index reports.
+     *  Keep in step with the same app's `createSitemapIndex`. */
+    sources?: SourceSelector;
     /** Index revalidate window in seconds. Default: 600. */
     indexRevalidate?: number;
     /** Feed (chunk) revalidate window in seconds. Default: 3600. */
@@ -66,6 +78,10 @@ interface CreateSitemapIndexOptions {
     /** Revalidate window in seconds for both the upstream `index/` fetch
      *  and the emitted XML's `s-maxage`. Default: 600. */
     indexRevalidate?: number;
+    /** Backend sources to list. Default: every source the index reports.
+     *  MUST match the same app's `createDjangoSitemap` — a mismatch
+     *  advertises chunks the sitemap route will not build. */
+    sources?: SourceSelector;
     /** Include the `static` chunk id at the top of the index. Turn off if
      *  the app's `sitemap.ts` opts out of `staticRoutes`. Default: true. */
     includeStatic?: boolean;
@@ -220,6 +236,57 @@ declare function decodeChunkId(id: string): {
     cursor: string | null;
 };
 
+/**
+ * Which backend sources a frontend claims.
+ *
+ * `GET /cfg/sitemap/index/` answers for the whole Django project — every
+ * source any installed app registered. One frontend is not always entitled
+ * to all of them: a backend serving several brands registers a source per
+ * brand (`properties-caribbean`, `properties-bali`), and each brand's app
+ * must emit only its own, or it advertises the other's URLs under its own
+ * host — every one of them a 404, and the sitemap that carries them is
+ * discredited whole.
+ *
+ * The selector lives here, shared, for the same reason `STATIC_ID` does:
+ * `createDjangoSitemap` enumerates the chunks and `createSitemapIndex`
+ * enumerates them again for the index document. If the two applied
+ * different filters, the index would advertise shards the chunk route
+ * refuses to build — and that mismatch is invisible until a crawler reads
+ * both. One function, called by both, cannot drift.
+ *
+ * Source NAMES are the contract. The module ships no notion of a brand or
+ * a tenant, and it should not: the backend chose what its source names
+ * mean, and only the app knows which of them are its own.
+ */
+
+/**
+ * A predicate from whatever the caller passed.
+ *
+ * Omitted means every source — the single-tenant default, and what every
+ * caller before this option existed already relied on.
+ */
+declare function sourceFilter(select: SourceSelector | undefined): (name: string) => boolean;
+/** The index's sources, narrowed to those the caller claims. */
+declare function selectSources(index: SitemapIndex, select: SourceSelector | undefined): SitemapSourceInfo[];
+/**
+ * A selector for one tenant of a multi-brand backend.
+ *
+ * Matches the `<source>-<tenant>` names that a backend registering per
+ * tenant emits. It splits on the LAST hyphen and compares the tail exactly,
+ * rather than testing a suffix: `endsWith('-bali')` is correct for
+ * `properties-bali` but the same shape reads `pricing-plans-premium` as
+ * belonging to a `premium` tenant, and a substring match is not a contract.
+ *
+ * ```ts
+ * sources: tenantSources('bali')   // properties-bali, communities-bali, …
+ * ```
+ *
+ * Sources with no hyphen never match: an untenanted source belongs to the
+ * project rather than to a brand, and claiming it for one is the error this
+ * function exists to prevent.
+ */
+declare function tenantSources(tenant: string): (name: string) => boolean;
+
 /**
  * Sitemap fetch helpers — never throw.
  *
@@ -231,4 +298,4 @@ declare function decodeChunkId(id: string): {
 declare function fetchSitemapIndex(apiUrl: string, revalidate: number): Promise<SitemapIndex>;
 declare function fetchSitemapFeed(apiUrl: string, source: string, cursor: string | null, revalidate: number): Promise<SitemapFeedPage>;
 
-export { type CreateDjangoSitemapOptions, type CreateRobotsOptions, type CreateSitemapIndexOptions, type SitemapChunkInfo, type SitemapEntry, type SitemapFeedPage, type SitemapIndex, type SitemapSourceInfo, type StaticRoute, createDjangoSitemap, createRobots, createSitemapIndex, decodeChunkId, encodeChunkId, fetchSitemapFeed, fetchSitemapIndex };
+export { type CreateDjangoSitemapOptions, type CreateRobotsOptions, type CreateSitemapIndexOptions, type SitemapChunkInfo, type SitemapEntry, type SitemapFeedPage, type SitemapIndex, type SitemapSourceInfo, type SourceSelector, type StaticRoute, createDjangoSitemap, createRobots, createSitemapIndex, decodeChunkId, encodeChunkId, fetchSitemapFeed, fetchSitemapIndex, selectSources, sourceFilter, tenantSources };

package/dist/sitemap/index.mjs

@@ -62,12 +62,40 @@ function decodeChunkId(id) {
   return { source, cursor: cursorRaw === "" ? null : cursorRaw };
 }
 
+// src/sitemap/select.ts
+function sourceFilter(select) {
+  if (select === void 0) return () => true;
+  if (typeof select === "function") return select;
+  const allowed = new Set(select);
+  return (name) => allowed.has(name);
+}
+function selectSources(index, select) {
+  const keep = sourceFilter(select);
+  return index.sources.filter((source) => keep(source.name));
+}
+function selectedChunkIds(index, select, encode) {
+  const ids = [];
+  for (const source of selectSources(index, select)) {
+    for (const chunk of source.chunks) {
+      ids.push(encode(source.name, chunk.cursor_to));
+    }
+  }
+  return ids;
+}
+function tenantSources(tenant) {
+  return (name) => {
+    const sep = name.lastIndexOf("-");
+    return sep !== -1 && name.slice(sep + 1) === tenant;
+  };
+}
+
 // src/sitemap/sitemap.ts
 function createDjangoSitemap(opts) {
   const {
     host,
     apiUrl,
     staticRoutes = [],
+    sources,
     indexRevalidate = DEFAULT_INDEX_REVALIDATE,
     feedRevalidate = DEFAULT_FEED_REVALIDATE
   } = opts;
@@ -76,10 +104,8 @@ function createDjangoSitemap(opts) {
       const ids = [{ id: STATIC_ID }];
       if (!apiUrl) return ids;
       const index = await fetchSitemapIndex(apiUrl, indexRevalidate);
-      for (const s of index.sources) {
-        for (const c of s.chunks) {
-          ids.push({ id: encodeChunkId(s.name, c.cursor_to) });
-        }
+      for (const id of selectedChunkIds(index, sources, encodeChunkId)) {
+        ids.push({ id });
       }
       return ids;
     },
@@ -90,6 +116,7 @@ function createDjangoSitemap(opts) {
       }
       if (!apiUrl) return [];
       const { source, cursor } = decodeChunkId(id);
+      if (!sourceFilter(sources)(source)) return [];
       const feed = await fetchSitemapFeed(apiUrl, source, cursor, feedRevalidate);
       return feed.entries.map((e) => ({
         url: `${host}${e.loc}`,
@@ -111,6 +138,7 @@ function createSitemapIndex(opts) {
   const {
     host,
     apiUrl,
+    sources,
     indexRevalidate = DEFAULT_INDEX_REVALIDATE,
     includeStatic = true
   } = opts;
@@ -119,11 +147,7 @@ function createSitemapIndex(opts) {
       const ids = includeStatic ? [STATIC_ID] : [];
       if (apiUrl) {
         const index = await fetchSitemapIndex(apiUrl, indexRevalidate);
-        for (const s of index.sources) {
-          for (const c of s.chunks) {
-            ids.push(encodeChunkId(s.name, c.cursor_to));
-          }
-        }
+        ids.push(...selectedChunkIds(index, sources, encodeChunkId));
       }
       const lastmod = (/* @__PURE__ */ new Date()).toISOString();
       const body = renderIndex(host, ids, lastmod);
@@ -173,6 +197,9 @@ export {
   decodeChunkId,
   encodeChunkId,
   fetchSitemapFeed,
-  fetchSitemapIndex
+  fetchSitemapIndex,
+  selectSources,
+  sourceFilter,
+  tenantSources
 };
 //# sourceMappingURL=index.mjs.map

package/dist/sitemap/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/sitemap/constants.ts","../../src/sitemap/fetch.ts","../../src/sitemap/ids.ts","../../src/sitemap/sitemap.ts","../../src/sitemap/index-route.ts","../../src/sitemap/robots.ts"],"sourcesContent":["/**\n * Shared sitemap constants.\n *\n * Pulled out so both the chunk factory (`createDjangoSitemap`) and the\n * index Route Handler (`createSitemapIndex`) agree on the id of the\n * frontend-only static-routes chunk.\n */\n\nexport const STATIC_ID = 'static';\nexport const DEFAULT_INDEX_REVALIDATE = 600;\nexport const DEFAULT_FEED_REVALIDATE = 3600;\n","/**\n * Sitemap fetch helpers — never throw.\n *\n * Failures are converted to empty payloads so a transient Django outage\n * doesn't break `next build`. The next ISR cycle (`revalidate`) recovers\n * automatically.\n */\n\nimport type { SitemapFeedPage, SitemapIndex } from './types';\n\nconst EMPTY_INDEX: SitemapIndex = {\n  sources: [],\n  generated_at: new Date(0).toISOString(),\n  ttl_seconds: 60,\n};\n\nconst emptyFeed = (source: string, cursor: string | null): SitemapFeedPage => ({\n  source,\n  chunk_id: `${source}-empty`,\n  count: 0,\n  has_more: false,\n  next_cursor: cursor,\n  entries: [],\n});\n\nexport async function fetchSitemapIndex(\n  apiUrl: string,\n  revalidate: number,\n): Promise<SitemapIndex> {\n  try {\n    const r = await fetch(`${apiUrl}/cfg/sitemap/index/`, {\n      next: { revalidate },\n    });\n    if (!r.ok) {\n      console.warn(`[sitemap] index fetch returned ${r.status}; falling back to empty`);\n      return EMPTY_INDEX;\n    }\n    return (await r.json()) as SitemapIndex;\n  } catch (err) {\n    console.warn('[sitemap] index fetch failed:', err);\n    return EMPTY_INDEX;\n  }\n}\n\nexport async function fetchSitemapFeed(\n  apiUrl: string,\n  source: string,\n  cursor: string | null,\n  revalidate: number,\n): Promise<SitemapFeedPage> {\n  const params = new URLSearchParams({ source });\n  if (cursor) params.set('cursor', cursor);\n  try {\n    const r = await fetch(`${apiUrl}/cfg/sitemap/feed/?${params}`, {\n      next: { revalidate },\n    });\n    if (!r.ok) {\n      console.warn(`[sitemap] feed ${source} returned ${r.status}; falling back to empty`);\n      return emptyFeed(source, cursor);\n    }\n    return (await r.json()) as SitemapFeedPage;\n  } catch (err) {\n    console.warn(`[sitemap] feed ${source} fetch failed:`, err);\n    return emptyFeed(source, cursor);\n  }\n}\n","/**\n * Sitemap chunk id encoding.\n *\n * Each Next.js sitemap file is addressed by an opaque string id. We\n * round-trip a `(source, cursor)` pair through that id so the default\n * sitemap handler knows which Django chunk to fetch.\n *\n * Separator `--` is unambiguous: backend cursors use URL-safe base64 (`-_`).\n */\n\nexport function encodeChunkId(source: string, cursor: string | null): string {\n  return `${source}--${cursor ?? ''}`;\n}\n\nexport function decodeChunkId(id: string): { source: string; cursor: string | null } {\n  const sep = id.indexOf('--');\n  if (sep === -1) return { source: id, cursor: null };\n  const source = id.slice(0, sep);\n  const cursorRaw = id.slice(sep + 2);\n  return { source, cursor: cursorRaw === '' ? null : cursorRaw };\n}\n","/**\n * createDjangoSitemap — factory for Next.js `app/sitemap.ts`.\n *\n * Backed by `django_cfg.modules.django_sitemap`: the backend exposes a\n * paginated JSON feed, this factory turns each chunk into a Next.js\n * sitemap file via `generateSitemaps()`.\n *\n * Usage:\n *\n * ```ts\n * // apps/<app>/app/sitemap.ts\n * import { createDjangoSitemap } from '@djangocfg/nextjs/sitemap';\n *\n * const { generateSitemaps, sitemap } = createDjangoSitemap({\n *   host: process.env.NEXT_PUBLIC_SITE_URL!,\n *   apiUrl: process.env.NEXT_PUBLIC_API_URL!,\n *   staticRoutes: [\n *     { path: '/', changeFrequency: 'daily', priority: 1.0 },\n *     { path: '/catalog', changeFrequency: 'daily', priority: 0.9 },\n *   ],\n * });\n *\n * export { generateSitemaps, sitemap as default };\n * export const revalidate = 3600;\n * ```\n *\n * Without `apiUrl`, the sitemap emits only the static routes — handy for\n * marketing sites that don't have a backend-driven URL space.\n */\n\nimport type { MetadataRoute } from 'next';\n\nimport {\n  DEFAULT_FEED_REVALIDATE,\n  DEFAULT_INDEX_REVALIDATE,\n  STATIC_ID,\n} from './constants';\nimport { fetchSitemapFeed, fetchSitemapIndex } from './fetch';\nimport { decodeChunkId, encodeChunkId } from './ids';\n\nimport type { CreateDjangoSitemapOptions, StaticRoute } from './types';\n\ninterface SitemapApi {\n  generateSitemaps: () => Promise<Array<{ id: string }>>;\n  sitemap: (props: { id: Promise<string> }) => Promise<MetadataRoute.Sitemap>;\n}\n\nexport function createDjangoSitemap(opts: CreateDjangoSitemapOptions): SitemapApi {\n  const {\n    host,\n    apiUrl,\n    staticRoutes = [],\n    indexRevalidate = DEFAULT_INDEX_REVALIDATE,\n    feedRevalidate = DEFAULT_FEED_REVALIDATE,\n  } = opts;\n\n  return {\n    async generateSitemaps() {\n      const ids: Array<{ id: string }> = [{ id: STATIC_ID }];\n      if (!apiUrl) return ids;\n      const index = await fetchSitemapIndex(apiUrl, indexRevalidate);\n      for (const s of index.sources) {\n        for (const c of s.chunks) {\n          ids.push({ id: encodeChunkId(s.name, c.cursor_to) });\n        }\n      }\n      return ids;\n    },\n\n    async sitemap({ id: idPromise }) {\n      const id = await idPromise;\n\n      if (id === STATIC_ID) {\n        return renderStatic(host, staticRoutes);\n      }\n\n      if (!apiUrl) return [];\n\n      const { source, cursor } = decodeChunkId(id);\n      const feed = await fetchSitemapFeed(apiUrl, source, cursor, feedRevalidate);\n      return feed.entries.map((e) => ({\n        url: `${host}${e.loc}`,\n        lastModified: e.lastmod ? new Date(e.lastmod) : undefined,\n      }));\n    },\n  };\n}\n\nfunction renderStatic(host: string, routes: StaticRoute[]): MetadataRoute.Sitemap {\n  return routes.map((r) => ({\n    url: `${host}${r.path}`,\n    changeFrequency: r.changeFrequency,\n    priority: r.priority,\n  }));\n}\n","/**\n * createSitemapIndex — Route Handler factory for the sitemap-index XML.\n *\n * Next.js's `generateSitemaps()` API ships chunks at `/sitemap/<id>.xml`\n * but does NOT emit a single sitemap-index document. Without one,\n * robots.txt + crawlers point at a 404 and never discover the chunks.\n * This factory closes that gap: it returns a `GET` Route Handler that\n * mints a `<sitemapindex>` XML listing every chunk the matching\n * `createDjangoSitemap` would produce.\n *\n * Mount it at **`app/sitemap_index.xml/route.ts`** — NOT `sitemap.xml`.\n * `app/sitemap.ts` (where `createDjangoSitemap` lives) already owns\n * `/sitemap.xml` in Next.js's metadata routing, even when its output is\n * fan-out via `generateSitemaps()` and the singular URL serves 404.\n * Putting a route handler at `app/sitemap.xml/route.ts` throws at build\n * time: *Conflicting route and metadata at /sitemap.xml*.\n *\n * Usage — the full pattern with the matching chunk + robots factories:\n *\n * ```ts\n * // apps/<app>/app/sitemap.ts — chunks\n * import { createDjangoSitemap } from '@djangocfg/nextjs/sitemap';\n * const { generateSitemaps, sitemap } = createDjangoSitemap({ ... });\n * export { generateSitemaps, sitemap as default };\n *\n * // apps/<app>/app/sitemap_index.xml/route.ts — the index\n * import { createSitemapIndex } from '@djangocfg/nextjs/sitemap';\n * export const { GET } = createSitemapIndex({\n *   host: process.env.NEXT_PUBLIC_SITE_URL!,\n *   apiUrl: process.env.NEXT_PUBLIC_API_URL!,\n * });\n * export const revalidate = 600;\n *\n * // apps/<app>/app/robots.ts — point crawlers at the index URL above\n * import { createRobots } from '@djangocfg/nextjs/sitemap';\n * const host = process.env.NEXT_PUBLIC_SITE_URL!;\n * export default createRobots({\n *   host,\n *   sitemap: `${host}/sitemap_index.xml`,\n * });\n * ```\n *\n * Keep `host` / `apiUrl` in sync with the same app's `app/sitemap.ts`\n * — the index just enumerates the chunks the other file emits.\n */\n\nimport {\n  DEFAULT_INDEX_REVALIDATE,\n  STATIC_ID,\n} from './constants';\nimport { fetchSitemapIndex } from './fetch';\nimport { encodeChunkId } from './ids';\n\nimport type { CreateSitemapIndexOptions } from './types';\n\ninterface SitemapIndexRoute {\n  GET: () => Promise<Response>;\n}\n\nexport function createSitemapIndex(opts: CreateSitemapIndexOptions): SitemapIndexRoute {\n  const {\n    host,\n    apiUrl,\n    indexRevalidate = DEFAULT_INDEX_REVALIDATE,\n    includeStatic = true,\n  } = opts;\n\n  return {\n    async GET() {\n      const ids: string[] = includeStatic ? [STATIC_ID] : [];\n\n      if (apiUrl) {\n        const index = await fetchSitemapIndex(apiUrl, indexRevalidate);\n        for (const s of index.sources) {\n          for (const c of s.chunks) {\n            ids.push(encodeChunkId(s.name, c.cursor_to));\n          }\n        }\n      }\n\n      const lastmod = new Date().toISOString();\n      const body = renderIndex(host, ids, lastmod);\n\n      return new Response(body, {\n        status: 200,\n        headers: {\n          'content-type': 'application/xml; charset=utf-8',\n          // Mirror the per-chunk revalidate so a cached CDN edge expires\n          // at the same cadence as the index it points at.\n          'cache-control': `public, s-maxage=${indexRevalidate}, stale-while-revalidate=${indexRevalidate}`,\n        },\n      });\n    },\n  };\n}\n\nfunction renderIndex(host: string, ids: string[], lastmod: string): string {\n  const lines: string[] = [];\n  lines.push('<?xml version=\"1.0\" encoding=\"UTF-8\"?>');\n  lines.push('<sitemapindex xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">');\n  for (const id of ids) {\n    lines.push('  <sitemap>');\n    lines.push(`    <loc>${escapeXml(`${host}/sitemap/${id}.xml`)}</loc>`);\n    lines.push(`    <lastmod>${lastmod}</lastmod>`);\n    lines.push('  </sitemap>');\n  }\n  lines.push('</sitemapindex>');\n  return lines.join('\\n');\n}\n\nfunction escapeXml(s: string): string {\n  return s\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&apos;');\n}\n","/**\n * createRobots — factory for Next.js `app/robots.ts`.\n *\n * Emits a single `User-Agent: *` block plus a Sitemap pointer. Disallow\n * defaults cover the common cases (auth, account, API surface) — override\n * per app if needed.\n *\n * The `sitemap` default `${host}/sitemap.xml` only makes sense for the\n * single-file case. When the app uses `createDjangoSitemap`\n * (`generateSitemaps()` → chunked output) **plus** `createSitemapIndex`\n * — the canonical pairing — pass an explicit\n * `sitemap: \\`${host}/sitemap_index.xml\\`` to point crawlers at the\n * index. The default `/sitemap.xml` will serve a 404 in that setup\n * (Next.js reserves it for the metadata route but doesn't emit content\n * there).\n *\n * Usage:\n *\n * ```ts\n * // apps/<app>/app/robots.ts\n * import { createRobots } from '@djangocfg/nextjs/sitemap';\n *\n * const host = process.env.NEXT_PUBLIC_SITE_URL!;\n *\n * export default createRobots({\n *   host,\n *   disallow: ['/account/', '/auth', '/api/', '/apix/'],\n *   sitemap: `${host}/sitemap_index.xml`, // matches createSitemapIndex\n * });\n * ```\n */\n\nimport type { MetadataRoute } from 'next';\n\nimport type { CreateRobotsOptions } from './types';\n\nconst DEFAULT_DISALLOW = ['/account/', '/auth', '/api/'];\n\nexport function createRobots(opts: CreateRobotsOptions): () => MetadataRoute.Robots {\n  const { host, disallow = DEFAULT_DISALLOW, sitemap } = opts;\n  return () => ({\n    rules: [{ userAgent: '*', allow: '/', disallow }],\n    sitemap: sitemap ?? `${host}/sitemap.xml`,\n    host,\n  });\n}\n"],"mappings":";AAQO,IAAM,YAAY;AAClB,IAAM,2BAA2B;AACjC,IAAM,0BAA0B;;;ACAvC,IAAM,cAA4B;AAAA,EAChC,SAAS,CAAC;AAAA,EACV,eAAc,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,EACtC,aAAa;AACf;AAEA,IAAM,YAAY,CAAC,QAAgB,YAA4C;AAAA,EAC7E;AAAA,EACA,UAAU,GAAG,MAAM;AAAA,EACnB,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,CAAC;AACZ;AAEA,eAAsB,kBACpB,QACA,YACuB;AACvB,MAAI;AACF,UAAM,IAAI,MAAM,MAAM,GAAG,MAAM,uBAAuB;AAAA,MACpD,MAAM,EAAE,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,EAAE,IAAI;AACT,cAAQ,KAAK,kCAAkC,EAAE,MAAM,yBAAyB;AAChF,aAAO;AAAA,IACT;AACA,WAAQ,MAAM,EAAE,KAAK;AAAA,EACvB,SAAS,KAAK;AACZ,YAAQ,KAAK,iCAAiC,GAAG;AACjD,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,iBACpB,QACA,QACA,QACA,YAC0B;AAC1B,QAAM,SAAS,IAAI,gBAAgB,EAAE,OAAO,CAAC;AAC7C,MAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,MAAI;AACF,UAAM,IAAI,MAAM,MAAM,GAAG,MAAM,sBAAsB,MAAM,IAAI;AAAA,MAC7D,MAAM,EAAE,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,EAAE,IAAI;AACT,cAAQ,KAAK,kBAAkB,MAAM,aAAa,EAAE,MAAM,yBAAyB;AACnF,aAAO,UAAU,QAAQ,MAAM;AAAA,IACjC;AACA,WAAQ,MAAM,EAAE,KAAK;AAAA,EACvB,SAAS,KAAK;AACZ,YAAQ,KAAK,kBAAkB,MAAM,kBAAkB,GAAG;AAC1D,WAAO,UAAU,QAAQ,MAAM;AAAA,EACjC;AACF;;;ACvDO,SAAS,cAAc,QAAgB,QAA+B;AAC3E,SAAO,GAAG,MAAM,KAAK,UAAU,EAAE;AACnC;AAEO,SAAS,cAAc,IAAuD;AACnF,QAAM,MAAM,GAAG,QAAQ,IAAI;AAC3B,MAAI,QAAQ,GAAI,QAAO,EAAE,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,SAAS,GAAG,MAAM,GAAG,GAAG;AAC9B,QAAM,YAAY,GAAG,MAAM,MAAM,CAAC;AAClC,SAAO,EAAE,QAAQ,QAAQ,cAAc,KAAK,OAAO,UAAU;AAC/D;;;AC2BO,SAAS,oBAAoB,MAA8C;AAChF,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,eAAe,CAAC;AAAA,IAChB,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,EACnB,IAAI;AAEJ,SAAO;AAAA,IACL,MAAM,mBAAmB;AACvB,YAAM,MAA6B,CAAC,EAAE,IAAI,UAAU,CAAC;AACrD,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,QAAQ,MAAM,kBAAkB,QAAQ,eAAe;AAC7D,iBAAW,KAAK,MAAM,SAAS;AAC7B,mBAAW,KAAK,EAAE,QAAQ;AACxB,cAAI,KAAK,EAAE,IAAI,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAAA,QACrD;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,EAAE,IAAI,UAAU,GAAG;AAC/B,YAAM,KAAK,MAAM;AAEjB,UAAI,OAAO,WAAW;AACpB,eAAO,aAAa,MAAM,YAAY;AAAA,MACxC;AAEA,UAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,YAAM,EAAE,QAAQ,OAAO,IAAI,cAAc,EAAE;AAC3C,YAAM,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,QAAQ,cAAc;AAC1E,aAAO,KAAK,QAAQ,IAAI,CAAC,OAAO;AAAA,QAC9B,KAAK,GAAG,IAAI,GAAG,EAAE,GAAG;AAAA,QACpB,cAAc,EAAE,UAAU,IAAI,KAAK,EAAE,OAAO,IAAI;AAAA,MAClD,EAAE;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,QAA8C;AAChF,SAAO,OAAO,IAAI,CAAC,OAAO;AAAA,IACxB,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI;AAAA,IACrB,iBAAiB,EAAE;AAAA,IACnB,UAAU,EAAE;AAAA,EACd,EAAE;AACJ;;;ACnCO,SAAS,mBAAmB,MAAoD;AACrF,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,gBAAgB;AAAA,EAClB,IAAI;AAEJ,SAAO;AAAA,IACL,MAAM,MAAM;AACV,YAAM,MAAgB,gBAAgB,CAAC,SAAS,IAAI,CAAC;AAErD,UAAI,QAAQ;AACV,cAAM,QAAQ,MAAM,kBAAkB,QAAQ,eAAe;AAC7D,mBAAW,KAAK,MAAM,SAAS;AAC7B,qBAAW,KAAK,EAAE,QAAQ;AACxB,gBAAI,KAAK,cAAc,EAAE,MAAM,EAAE,SAAS,CAAC;AAAA,UAC7C;AAAA,QACF;AAAA,MACF;AAEA,YAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,YAAM,OAAO,YAAY,MAAM,KAAK,OAAO;AAE3C,aAAO,IAAI,SAAS,MAAM;AAAA,QACxB,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA;AAAA;AAAA,UAGhB,iBAAiB,oBAAoB,eAAe,4BAA4B,eAAe;AAAA,QACjG;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,YAAY,MAAc,KAAe,SAAyB;AACzE,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,wCAAwC;AACnD,QAAM,KAAK,oEAAoE;AAC/E,aAAW,MAAM,KAAK;AACpB,UAAM,KAAK,aAAa;AACxB,UAAM,KAAK,YAAY,UAAU,GAAG,IAAI,YAAY,EAAE,MAAM,CAAC,QAAQ;AACrE,UAAM,KAAK,gBAAgB,OAAO,YAAY;AAC9C,UAAM,KAAK,cAAc;AAAA,EAC3B;AACA,QAAM,KAAK,iBAAiB;AAC5B,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;;;ACjFA,IAAM,mBAAmB,CAAC,aAAa,SAAS,OAAO;AAEhD,SAAS,aAAa,MAAuD;AAClF,QAAM,EAAE,MAAM,WAAW,kBAAkB,QAAQ,IAAI;AACvD,SAAO,OAAO;AAAA,IACZ,OAAO,CAAC,EAAE,WAAW,KAAK,OAAO,KAAK,SAAS,CAAC;AAAA,IAChD,SAAS,WAAW,GAAG,IAAI;AAAA,IAC3B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/sitemap/constants.ts","../../src/sitemap/fetch.ts","../../src/sitemap/ids.ts","../../src/sitemap/select.ts","../../src/sitemap/sitemap.ts","../../src/sitemap/index-route.ts","../../src/sitemap/robots.ts"],"sourcesContent":["/**\n * Shared sitemap constants.\n *\n * Pulled out so both the chunk factory (`createDjangoSitemap`) and the\n * index Route Handler (`createSitemapIndex`) agree on the id of the\n * frontend-only static-routes chunk.\n */\n\nexport const STATIC_ID = 'static';\nexport const DEFAULT_INDEX_REVALIDATE = 600;\nexport const DEFAULT_FEED_REVALIDATE = 3600;\n","/**\n * Sitemap fetch helpers — never throw.\n *\n * Failures are converted to empty payloads so a transient Django outage\n * doesn't break `next build`. The next ISR cycle (`revalidate`) recovers\n * automatically.\n */\n\nimport type { SitemapFeedPage, SitemapIndex } from './types';\n\nconst EMPTY_INDEX: SitemapIndex = {\n  sources: [],\n  generated_at: new Date(0).toISOString(),\n  ttl_seconds: 60,\n};\n\nconst emptyFeed = (source: string, cursor: string | null): SitemapFeedPage => ({\n  source,\n  chunk_id: `${source}-empty`,\n  count: 0,\n  has_more: false,\n  next_cursor: cursor,\n  entries: [],\n});\n\nexport async function fetchSitemapIndex(\n  apiUrl: string,\n  revalidate: number,\n): Promise<SitemapIndex> {\n  try {\n    const r = await fetch(`${apiUrl}/cfg/sitemap/index/`, {\n      next: { revalidate },\n    });\n    if (!r.ok) {\n      console.warn(`[sitemap] index fetch returned ${r.status}; falling back to empty`);\n      return EMPTY_INDEX;\n    }\n    return (await r.json()) as SitemapIndex;\n  } catch (err) {\n    console.warn('[sitemap] index fetch failed:', err);\n    return EMPTY_INDEX;\n  }\n}\n\nexport async function fetchSitemapFeed(\n  apiUrl: string,\n  source: string,\n  cursor: string | null,\n  revalidate: number,\n): Promise<SitemapFeedPage> {\n  const params = new URLSearchParams({ source });\n  if (cursor) params.set('cursor', cursor);\n  try {\n    const r = await fetch(`${apiUrl}/cfg/sitemap/feed/?${params}`, {\n      next: { revalidate },\n    });\n    if (!r.ok) {\n      console.warn(`[sitemap] feed ${source} returned ${r.status}; falling back to empty`);\n      return emptyFeed(source, cursor);\n    }\n    return (await r.json()) as SitemapFeedPage;\n  } catch (err) {\n    console.warn(`[sitemap] feed ${source} fetch failed:`, err);\n    return emptyFeed(source, cursor);\n  }\n}\n","/**\n * Sitemap chunk id encoding.\n *\n * Each Next.js sitemap file is addressed by an opaque string id. We\n * round-trip a `(source, cursor)` pair through that id so the default\n * sitemap handler knows which Django chunk to fetch.\n *\n * Separator `--` is unambiguous: backend cursors use URL-safe base64 (`-_`).\n */\n\nexport function encodeChunkId(source: string, cursor: string | null): string {\n  return `${source}--${cursor ?? ''}`;\n}\n\nexport function decodeChunkId(id: string): { source: string; cursor: string | null } {\n  const sep = id.indexOf('--');\n  if (sep === -1) return { source: id, cursor: null };\n  const source = id.slice(0, sep);\n  const cursorRaw = id.slice(sep + 2);\n  return { source, cursor: cursorRaw === '' ? null : cursorRaw };\n}\n","/**\n * Which backend sources a frontend claims.\n *\n * `GET /cfg/sitemap/index/` answers for the whole Django project — every\n * source any installed app registered. One frontend is not always entitled\n * to all of them: a backend serving several brands registers a source per\n * brand (`properties-caribbean`, `properties-bali`), and each brand's app\n * must emit only its own, or it advertises the other's URLs under its own\n * host — every one of them a 404, and the sitemap that carries them is\n * discredited whole.\n *\n * The selector lives here, shared, for the same reason `STATIC_ID` does:\n * `createDjangoSitemap` enumerates the chunks and `createSitemapIndex`\n * enumerates them again for the index document. If the two applied\n * different filters, the index would advertise shards the chunk route\n * refuses to build — and that mismatch is invisible until a crawler reads\n * both. One function, called by both, cannot drift.\n *\n * Source NAMES are the contract. The module ships no notion of a brand or\n * a tenant, and it should not: the backend chose what its source names\n * mean, and only the app knows which of them are its own.\n */\n\nimport type { SitemapIndex, SitemapSourceInfo, SourceSelector } from './types';\n\n/**\n * A predicate from whatever the caller passed.\n *\n * Omitted means every source — the single-tenant default, and what every\n * caller before this option existed already relied on.\n */\nexport function sourceFilter(select: SourceSelector | undefined): (name: string) => boolean {\n  if (select === undefined) return () => true;\n  if (typeof select === 'function') return select;\n  const allowed = new Set(select);\n  return (name) => allowed.has(name);\n}\n\n/** The index's sources, narrowed to those the caller claims. */\nexport function selectSources(\n  index: SitemapIndex,\n  select: SourceSelector | undefined,\n): SitemapSourceInfo[] {\n  const keep = sourceFilter(select);\n  return index.sources.filter((source) => keep(source.name));\n}\n\n/**\n * Every chunk id the selected sources produce, in index order.\n *\n * The one place `(source, chunk)` becomes an id, so the chunk route and the\n * index document enumerate the same set by construction.\n */\nexport function selectedChunkIds(\n  index: SitemapIndex,\n  select: SourceSelector | undefined,\n  encode: (source: string, cursor: string | null) => string,\n): string[] {\n  const ids: string[] = [];\n  for (const source of selectSources(index, select)) {\n    for (const chunk of source.chunks) {\n      ids.push(encode(source.name, chunk.cursor_to));\n    }\n  }\n  return ids;\n}\n\n/**\n * A selector for one tenant of a multi-brand backend.\n *\n * Matches the `<source>-<tenant>` names that a backend registering per\n * tenant emits. It splits on the LAST hyphen and compares the tail exactly,\n * rather than testing a suffix: `endsWith('-bali')` is correct for\n * `properties-bali` but the same shape reads `pricing-plans-premium` as\n * belonging to a `premium` tenant, and a substring match is not a contract.\n *\n * ```ts\n * sources: tenantSources('bali')   // properties-bali, communities-bali, …\n * ```\n *\n * Sources with no hyphen never match: an untenanted source belongs to the\n * project rather than to a brand, and claiming it for one is the error this\n * function exists to prevent.\n */\nexport function tenantSources(tenant: string): (name: string) => boolean {\n  return (name) => {\n    const sep = name.lastIndexOf('-');\n    return sep !== -1 && name.slice(sep + 1) === tenant;\n  };\n}\n","/**\n * createDjangoSitemap — factory for Next.js `app/sitemap.ts`.\n *\n * Backed by `django_cfg.modules.django_sitemap`: the backend exposes a\n * paginated JSON feed, this factory turns each chunk into a Next.js\n * sitemap file via `generateSitemaps()`.\n *\n * Usage:\n *\n * ```ts\n * // apps/<app>/app/sitemap.ts\n * import { createDjangoSitemap } from '@djangocfg/nextjs/sitemap';\n *\n * const { generateSitemaps, sitemap } = createDjangoSitemap({\n *   host: process.env.NEXT_PUBLIC_SITE_URL!,\n *   apiUrl: process.env.NEXT_PUBLIC_API_URL!,\n *   staticRoutes: [\n *     { path: '/', changeFrequency: 'daily', priority: 1.0 },\n *     { path: '/catalog', changeFrequency: 'daily', priority: 0.9 },\n *   ],\n * });\n *\n * export { generateSitemaps, sitemap as default };\n * export const revalidate = 3600;\n * ```\n *\n * Without `apiUrl`, the sitemap emits only the static routes — handy for\n * marketing sites that don't have a backend-driven URL space.\n */\n\nimport type { MetadataRoute } from 'next';\n\nimport {\n  DEFAULT_FEED_REVALIDATE,\n  DEFAULT_INDEX_REVALIDATE,\n  STATIC_ID,\n} from './constants';\nimport { fetchSitemapFeed, fetchSitemapIndex } from './fetch';\nimport { decodeChunkId, encodeChunkId } from './ids';\nimport { selectedChunkIds, sourceFilter } from './select';\n\nimport type { CreateDjangoSitemapOptions, StaticRoute } from './types';\n\ninterface SitemapApi {\n  generateSitemaps: () => Promise<Array<{ id: string }>>;\n  sitemap: (props: { id: Promise<string> }) => Promise<MetadataRoute.Sitemap>;\n}\n\nexport function createDjangoSitemap(opts: CreateDjangoSitemapOptions): SitemapApi {\n  const {\n    host,\n    apiUrl,\n    staticRoutes = [],\n    sources,\n    indexRevalidate = DEFAULT_INDEX_REVALIDATE,\n    feedRevalidate = DEFAULT_FEED_REVALIDATE,\n  } = opts;\n\n  return {\n    async generateSitemaps() {\n      const ids: Array<{ id: string }> = [{ id: STATIC_ID }];\n      if (!apiUrl) return ids;\n      const index = await fetchSitemapIndex(apiUrl, indexRevalidate);\n      for (const id of selectedChunkIds(index, sources, encodeChunkId)) {\n        ids.push({ id });\n      }\n      return ids;\n    },\n\n    async sitemap({ id: idPromise }) {\n      const id = await idPromise;\n\n      if (id === STATIC_ID) {\n        return renderStatic(host, staticRoutes);\n      }\n\n      if (!apiUrl) return [];\n\n      const { source, cursor } = decodeChunkId(id);\n      // A chunk this app does not claim renders empty rather than fetching.\n      // `generateSitemaps` never mints such an id, but the route stays\n      // reachable by hand, and serving another tenant's URLs from a guessed\n      // address would undo the filter above.\n      if (!sourceFilter(sources)(source)) return [];\n\n      const feed = await fetchSitemapFeed(apiUrl, source, cursor, feedRevalidate);\n      return feed.entries.map((e) => ({\n        url: `${host}${e.loc}`,\n        lastModified: e.lastmod ? new Date(e.lastmod) : undefined,\n      }));\n    },\n  };\n}\n\nfunction renderStatic(host: string, routes: StaticRoute[]): MetadataRoute.Sitemap {\n  return routes.map((r) => ({\n    url: `${host}${r.path}`,\n    changeFrequency: r.changeFrequency,\n    priority: r.priority,\n  }));\n}\n","/**\n * createSitemapIndex — Route Handler factory for the sitemap-index XML.\n *\n * Next.js's `generateSitemaps()` API ships chunks at `/sitemap/<id>.xml`\n * but does NOT emit a single sitemap-index document. Without one,\n * robots.txt + crawlers point at a 404 and never discover the chunks.\n * This factory closes that gap: it returns a `GET` Route Handler that\n * mints a `<sitemapindex>` XML listing every chunk the matching\n * `createDjangoSitemap` would produce.\n *\n * Mount it at **`app/sitemap_index.xml/route.ts`** — NOT `sitemap.xml`.\n * `app/sitemap.ts` (where `createDjangoSitemap` lives) already owns\n * `/sitemap.xml` in Next.js's metadata routing, even when its output is\n * fan-out via `generateSitemaps()` and the singular URL serves 404.\n * Putting a route handler at `app/sitemap.xml/route.ts` throws at build\n * time: *Conflicting route and metadata at /sitemap.xml*.\n *\n * Usage — the full pattern with the matching chunk + robots factories:\n *\n * ```ts\n * // apps/<app>/app/sitemap.ts — chunks\n * import { createDjangoSitemap } from '@djangocfg/nextjs/sitemap';\n * const { generateSitemaps, sitemap } = createDjangoSitemap({ ... });\n * export { generateSitemaps, sitemap as default };\n *\n * // apps/<app>/app/sitemap_index.xml/route.ts — the index\n * import { createSitemapIndex } from '@djangocfg/nextjs/sitemap';\n * export const { GET } = createSitemapIndex({\n *   host: process.env.NEXT_PUBLIC_SITE_URL!,\n *   apiUrl: process.env.NEXT_PUBLIC_API_URL!,\n * });\n * export const revalidate = 600;\n *\n * // apps/<app>/app/robots.ts — point crawlers at the index URL above\n * import { createRobots } from '@djangocfg/nextjs/sitemap';\n * const host = process.env.NEXT_PUBLIC_SITE_URL!;\n * export default createRobots({\n *   host,\n *   sitemap: `${host}/sitemap_index.xml`,\n * });\n * ```\n *\n * Keep `host` / `apiUrl` in sync with the same app's `app/sitemap.ts`\n * — the index just enumerates the chunks the other file emits.\n */\n\nimport {\n  DEFAULT_INDEX_REVALIDATE,\n  STATIC_ID,\n} from './constants';\nimport { fetchSitemapIndex } from './fetch';\nimport { encodeChunkId } from './ids';\nimport { selectedChunkIds } from './select';\n\nimport type { CreateSitemapIndexOptions } from './types';\n\ninterface SitemapIndexRoute {\n  GET: () => Promise<Response>;\n}\n\nexport function createSitemapIndex(opts: CreateSitemapIndexOptions): SitemapIndexRoute {\n  const {\n    host,\n    apiUrl,\n    sources,\n    indexRevalidate = DEFAULT_INDEX_REVALIDATE,\n    includeStatic = true,\n  } = opts;\n\n  return {\n    async GET() {\n      const ids: string[] = includeStatic ? [STATIC_ID] : [];\n\n      if (apiUrl) {\n        const index = await fetchSitemapIndex(apiUrl, indexRevalidate);\n        ids.push(...selectedChunkIds(index, sources, encodeChunkId));\n      }\n\n      const lastmod = new Date().toISOString();\n      const body = renderIndex(host, ids, lastmod);\n\n      return new Response(body, {\n        status: 200,\n        headers: {\n          'content-type': 'application/xml; charset=utf-8',\n          // Mirror the per-chunk revalidate so a cached CDN edge expires\n          // at the same cadence as the index it points at.\n          'cache-control': `public, s-maxage=${indexRevalidate}, stale-while-revalidate=${indexRevalidate}`,\n        },\n      });\n    },\n  };\n}\n\nfunction renderIndex(host: string, ids: string[], lastmod: string): string {\n  const lines: string[] = [];\n  lines.push('<?xml version=\"1.0\" encoding=\"UTF-8\"?>');\n  lines.push('<sitemapindex xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\">');\n  for (const id of ids) {\n    lines.push('  <sitemap>');\n    lines.push(`    <loc>${escapeXml(`${host}/sitemap/${id}.xml`)}</loc>`);\n    lines.push(`    <lastmod>${lastmod}</lastmod>`);\n    lines.push('  </sitemap>');\n  }\n  lines.push('</sitemapindex>');\n  return lines.join('\\n');\n}\n\nfunction escapeXml(s: string): string {\n  return s\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&apos;');\n}\n","/**\n * createRobots — factory for Next.js `app/robots.ts`.\n *\n * Emits a single `User-Agent: *` block plus a Sitemap pointer. Disallow\n * defaults cover the common cases (auth, account, API surface) — override\n * per app if needed.\n *\n * The `sitemap` default `${host}/sitemap.xml` only makes sense for the\n * single-file case. When the app uses `createDjangoSitemap`\n * (`generateSitemaps()` → chunked output) **plus** `createSitemapIndex`\n * — the canonical pairing — pass an explicit\n * `sitemap: \\`${host}/sitemap_index.xml\\`` to point crawlers at the\n * index. The default `/sitemap.xml` will serve a 404 in that setup\n * (Next.js reserves it for the metadata route but doesn't emit content\n * there).\n *\n * Usage:\n *\n * ```ts\n * // apps/<app>/app/robots.ts\n * import { createRobots } from '@djangocfg/nextjs/sitemap';\n *\n * const host = process.env.NEXT_PUBLIC_SITE_URL!;\n *\n * export default createRobots({\n *   host,\n *   disallow: ['/account/', '/auth', '/api/', '/apix/'],\n *   sitemap: `${host}/sitemap_index.xml`, // matches createSitemapIndex\n * });\n * ```\n */\n\nimport type { MetadataRoute } from 'next';\n\nimport type { CreateRobotsOptions } from './types';\n\nconst DEFAULT_DISALLOW = ['/account/', '/auth', '/api/'];\n\nexport function createRobots(opts: CreateRobotsOptions): () => MetadataRoute.Robots {\n  const { host, disallow = DEFAULT_DISALLOW, sitemap } = opts;\n  return () => ({\n    rules: [{ userAgent: '*', allow: '/', disallow }],\n    sitemap: sitemap ?? `${host}/sitemap.xml`,\n    host,\n  });\n}\n"],"mappings":";AAQO,IAAM,YAAY;AAClB,IAAM,2BAA2B;AACjC,IAAM,0BAA0B;;;ACAvC,IAAM,cAA4B;AAAA,EAChC,SAAS,CAAC;AAAA,EACV,eAAc,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,EACtC,aAAa;AACf;AAEA,IAAM,YAAY,CAAC,QAAgB,YAA4C;AAAA,EAC7E;AAAA,EACA,UAAU,GAAG,MAAM;AAAA,EACnB,OAAO;AAAA,EACP,UAAU;AAAA,EACV,aAAa;AAAA,EACb,SAAS,CAAC;AACZ;AAEA,eAAsB,kBACpB,QACA,YACuB;AACvB,MAAI;AACF,UAAM,IAAI,MAAM,MAAM,GAAG,MAAM,uBAAuB;AAAA,MACpD,MAAM,EAAE,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,EAAE,IAAI;AACT,cAAQ,KAAK,kCAAkC,EAAE,MAAM,yBAAyB;AAChF,aAAO;AAAA,IACT;AACA,WAAQ,MAAM,EAAE,KAAK;AAAA,EACvB,SAAS,KAAK;AACZ,YAAQ,KAAK,iCAAiC,GAAG;AACjD,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,iBACpB,QACA,QACA,QACA,YAC0B;AAC1B,QAAM,SAAS,IAAI,gBAAgB,EAAE,OAAO,CAAC;AAC7C,MAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,MAAI;AACF,UAAM,IAAI,MAAM,MAAM,GAAG,MAAM,sBAAsB,MAAM,IAAI;AAAA,MAC7D,MAAM,EAAE,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,EAAE,IAAI;AACT,cAAQ,KAAK,kBAAkB,MAAM,aAAa,EAAE,MAAM,yBAAyB;AACnF,aAAO,UAAU,QAAQ,MAAM;AAAA,IACjC;AACA,WAAQ,MAAM,EAAE,KAAK;AAAA,EACvB,SAAS,KAAK;AACZ,YAAQ,KAAK,kBAAkB,MAAM,kBAAkB,GAAG;AAC1D,WAAO,UAAU,QAAQ,MAAM;AAAA,EACjC;AACF;;;ACvDO,SAAS,cAAc,QAAgB,QAA+B;AAC3E,SAAO,GAAG,MAAM,KAAK,UAAU,EAAE;AACnC;AAEO,SAAS,cAAc,IAAuD;AACnF,QAAM,MAAM,GAAG,QAAQ,IAAI;AAC3B,MAAI,QAAQ,GAAI,QAAO,EAAE,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,SAAS,GAAG,MAAM,GAAG,GAAG;AAC9B,QAAM,YAAY,GAAG,MAAM,MAAM,CAAC;AAClC,SAAO,EAAE,QAAQ,QAAQ,cAAc,KAAK,OAAO,UAAU;AAC/D;;;ACWO,SAAS,aAAa,QAA+D;AAC1F,MAAI,WAAW,OAAW,QAAO,MAAM;AACvC,MAAI,OAAO,WAAW,WAAY,QAAO;AACzC,QAAM,UAAU,IAAI,IAAI,MAAM;AAC9B,SAAO,CAAC,SAAS,QAAQ,IAAI,IAAI;AACnC;AAGO,SAAS,cACd,OACA,QACqB;AACrB,QAAM,OAAO,aAAa,MAAM;AAChC,SAAO,MAAM,QAAQ,OAAO,CAAC,WAAW,KAAK,OAAO,IAAI,CAAC;AAC3D;AAQO,SAAS,iBACd,OACA,QACA,QACU;AACV,QAAM,MAAgB,CAAC;AACvB,aAAW,UAAU,cAAc,OAAO,MAAM,GAAG;AACjD,eAAW,SAAS,OAAO,QAAQ;AACjC,UAAI,KAAK,OAAO,OAAO,MAAM,MAAM,SAAS,CAAC;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAmBO,SAAS,cAAc,QAA2C;AACvE,SAAO,CAAC,SAAS;AACf,UAAM,MAAM,KAAK,YAAY,GAAG;AAChC,WAAO,QAAQ,MAAM,KAAK,MAAM,MAAM,CAAC,MAAM;AAAA,EAC/C;AACF;;;ACzCO,SAAS,oBAAoB,MAA8C;AAChF,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,eAAe,CAAC;AAAA,IAChB;AAAA,IACA,kBAAkB;AAAA,IAClB,iBAAiB;AAAA,EACnB,IAAI;AAEJ,SAAO;AAAA,IACL,MAAM,mBAAmB;AACvB,YAAM,MAA6B,CAAC,EAAE,IAAI,UAAU,CAAC;AACrD,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,QAAQ,MAAM,kBAAkB,QAAQ,eAAe;AAC7D,iBAAW,MAAM,iBAAiB,OAAO,SAAS,aAAa,GAAG;AAChE,YAAI,KAAK,EAAE,GAAG,CAAC;AAAA,MACjB;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,EAAE,IAAI,UAAU,GAAG;AAC/B,YAAM,KAAK,MAAM;AAEjB,UAAI,OAAO,WAAW;AACpB,eAAO,aAAa,MAAM,YAAY;AAAA,MACxC;AAEA,UAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,YAAM,EAAE,QAAQ,OAAO,IAAI,cAAc,EAAE;AAK3C,UAAI,CAAC,aAAa,OAAO,EAAE,MAAM,EAAG,QAAO,CAAC;AAE5C,YAAM,OAAO,MAAM,iBAAiB,QAAQ,QAAQ,QAAQ,cAAc;AAC1E,aAAO,KAAK,QAAQ,IAAI,CAAC,OAAO;AAAA,QAC9B,KAAK,GAAG,IAAI,GAAG,EAAE,GAAG;AAAA,QACpB,cAAc,EAAE,UAAU,IAAI,KAAK,EAAE,OAAO,IAAI;AAAA,MAClD,EAAE;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,QAA8C;AAChF,SAAO,OAAO,IAAI,CAAC,OAAO;AAAA,IACxB,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI;AAAA,IACrB,iBAAiB,EAAE;AAAA,IACnB,UAAU,EAAE;AAAA,EACd,EAAE;AACJ;;;ACxCO,SAAS,mBAAmB,MAAoD;AACrF,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,gBAAgB;AAAA,EAClB,IAAI;AAEJ,SAAO;AAAA,IACL,MAAM,MAAM;AACV,YAAM,MAAgB,gBAAgB,CAAC,SAAS,IAAI,CAAC;AAErD,UAAI,QAAQ;AACV,cAAM,QAAQ,MAAM,kBAAkB,QAAQ,eAAe;AAC7D,YAAI,KAAK,GAAG,iBAAiB,OAAO,SAAS,aAAa,CAAC;AAAA,MAC7D;AAEA,YAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,YAAM,OAAO,YAAY,MAAM,KAAK,OAAO;AAE3C,aAAO,IAAI,SAAS,MAAM;AAAA,QACxB,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA;AAAA;AAAA,UAGhB,iBAAiB,oBAAoB,eAAe,4BAA4B,eAAe;AAAA,QACjG;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,YAAY,MAAc,KAAe,SAAyB;AACzE,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,wCAAwC;AACnD,QAAM,KAAK,oEAAoE;AAC/E,aAAW,MAAM,KAAK;AACpB,UAAM,KAAK,aAAa;AACxB,UAAM,KAAK,YAAY,UAAU,GAAG,IAAI,YAAY,EAAE,MAAM,CAAC,QAAQ;AACrE,UAAM,KAAK,gBAAgB,OAAO,YAAY;AAC9C,UAAM,KAAK,cAAc;AAAA,EAC3B;AACA,QAAM,KAAK,iBAAiB;AAC5B,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,QAAQ;AAC3B;;;AC/EA,IAAM,mBAAmB,CAAC,aAAa,SAAS,OAAO;AAEhD,SAAS,aAAa,MAAuD;AAClF,QAAM,EAAE,MAAM,WAAW,kBAAkB,QAAQ,IAAI;AACvD,SAAO,OAAO;AAAA,IACZ,OAAO,CAAC,EAAE,WAAW,KAAK,OAAO,KAAK,SAAS,CAAC;AAAA,IAChD,SAAS,WAAW,GAAG,IAAI;AAAA,IAC3B;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@djangocfg/nextjs",
-  "version": "2.1.543",
+  "version": "2.1.545",
   "description": "Next.js server utilities: sitemap, health, OG images, contact forms, navigation, config",
   "keywords": [
     "nextjs",
@@ -149,9 +149,9 @@
     "ai-docs": "tsx src/ai/cli.ts"
   },
   "peerDependencies": {
-    "@djangocfg/devtools": "^2.1.543",
-    "@djangocfg/i18n": "^2.1.543",
-    "@djangocfg/ui-core": "^2.1.543",
+    "@djangocfg/devtools": "^2.1.545",
+    "@djangocfg/i18n": "^2.1.545",
+    "@djangocfg/ui-core": "^2.1.545",
     "next": "^16.2.2"
   },
   "peerDependenciesMeta": {
@@ -170,11 +170,11 @@
     "semver": "^7.8.5"
   },
   "devDependencies": {
-    "@djangocfg/devtools": "^2.1.543",
-    "@djangocfg/i18n": "^2.1.543",
-    "@djangocfg/layouts": "^2.1.543",
-    "@djangocfg/typescript-config": "^2.1.543",
-    "@djangocfg/ui-core": "^2.1.543",
+    "@djangocfg/devtools": "^2.1.545",
+    "@djangocfg/i18n": "^2.1.545",
+    "@djangocfg/layouts": "^2.1.545",
+    "@djangocfg/typescript-config": "^2.1.545",
+    "@djangocfg/ui-core": "^2.1.545",
     "@types/node": "^25.9.5",
     "@types/react": "19.2.15",
     "@types/react-dom": "19.2.3",

package/src/sitemap/README.md

@@ -258,6 +258,7 @@ expects: named `generateSitemaps` + default-exported `sitemap`.
 | `host` | `string` | (required) | Canonical host (e.g. `https://example.com`). URLs are joined as `${host}${loc}`. |
 | `apiUrl` | `string` | `undefined` | Django backend base URL. Omit to skip the backend feed entirely. |
 | `staticRoutes` | `StaticRoute[]` | `[]` | Frontend-only routes. Auth/account routes should NOT be listed here. |
+| `sources` | `string[] \| (name) => boolean` | every source | Which backend sources this frontend claims. See [Several frontends, one backend](#several-frontends-one-backend). |
 | `indexRevalidate` | `number` | `600` | Seconds — `next: { revalidate }` on the index fetch. |
 | `feedRevalidate` | `number` | `3600` | Seconds — `next: { revalidate }` on each chunk fetch. |
 
@@ -284,6 +285,55 @@ it from `app/robots.ts`.
 | `disallow` | `string[]` | `['/account/', '/auth', '/api/']` | Path prefixes to block. |
 | `sitemap` | `string` | `${host}/sitemap.xml` | Override the sitemap pointer. |
 
+## Several frontends, one backend
+
+`GET /cfg/sitemap/index/` answers for the whole Django project — every
+source any installed app registered. When one backend serves several
+brands, register a source per brand and give each frontend its own:
+
+```python
+# apps/catalog/sitemap_sources.py
+for portal in ("caribbean", "bali"):
+    register(SitemapSource(name=f"properties-{portal}", ...))
+```
+
+```ts
+// apps/web-bali/app/sitemap.ts
+import { createDjangoSitemap, tenantSources } from '@djangocfg/nextjs/sitemap';
+
+const { generateSitemaps, sitemap } = createDjangoSitemap({
+  host, apiUrl,
+  sources: tenantSources('bali'),   // properties-bali, communities-bali, …
+});
+```
+
+```ts
+// apps/web-bali/app/sitemap_index.xml/route.ts — the SAME selector
+export const { GET } = createSitemapIndex({
+  host, apiUrl,
+  sources: tenantSources('bali'),
+});
+```
+
+Pass the same selector to both. The index lists chunks, `sitemap.ts`
+builds them; a mismatch advertises shards that render empty, and nothing
+fails loudly when it happens.
+
+**Why the frontend filters and not the backend.** The index view is
+cached under a key with no tenant dimension, so a `?tenant=` parameter
+would pass every cold-cache test and then serve one brand's chunk list
+to the other an hour later. Source names carry the distinction instead:
+an unknown source 404s, which is a loud failure rather than a silent
+wrong one.
+
+`tenantSources` splits the source name on its LAST hyphen and compares
+the tail exactly. Prefer it over `endsWith('-bali')`, which also matches
+a `pricing-plans-premium` for a tenant named `premium`. Names without a
+hyphen never match — an untenanted source belongs to the project, not to
+a brand.
+
+Omit `sources` entirely when the backend serves this frontend alone.
+
 ### Lower-level utilities
 
 Exposed for advanced use cases (custom Next route handlers, debugging):
@@ -294,6 +344,9 @@ import {
   fetchSitemapFeed,
   encodeChunkId,
   decodeChunkId,
+  selectSources,
+  sourceFilter,
+  tenantSources,
 } from '@djangocfg/nextjs/sitemap';
 ```
 

package/src/sitemap/index-route.ts

@@ -50,6 +50,7 @@ import {
 } from './constants';
 import { fetchSitemapIndex } from './fetch';
 import { encodeChunkId } from './ids';
+import { selectedChunkIds } from './select';
 
 import type { CreateSitemapIndexOptions } from './types';
 
@@ -61,6 +62,7 @@ export function createSitemapIndex(opts: CreateSitemapIndexOptions): SitemapInde
   const {
     host,
     apiUrl,
+    sources,
     indexRevalidate = DEFAULT_INDEX_REVALIDATE,
     includeStatic = true,
   } = opts;
@@ -71,11 +73,7 @@ export function createSitemapIndex(opts: CreateSitemapIndexOptions): SitemapInde
 
       if (apiUrl) {
         const index = await fetchSitemapIndex(apiUrl, indexRevalidate);
-        for (const s of index.sources) {
-          for (const c of s.chunks) {
-            ids.push(encodeChunkId(s.name, c.cursor_to));
-          }
-        }
+        ids.push(...selectedChunkIds(index, sources, encodeChunkId));
       }
 
       const lastmod = new Date().toISOString();

package/src/sitemap/index.ts

@@ -13,6 +13,7 @@ export { createDjangoSitemap } from './sitemap';
 export { createSitemapIndex } from './index-route';
 export { createRobots } from './robots';
 export { encodeChunkId, decodeChunkId } from './ids';
+export { selectSources, sourceFilter, tenantSources } from './select';
 export { fetchSitemapIndex, fetchSitemapFeed } from './fetch';
 
 export type {
@@ -24,5 +25,6 @@ export type {
   CreateDjangoSitemapOptions,
   CreateSitemapIndexOptions,
   CreateRobotsOptions,
+  SourceSelector,
   StaticRoute,
 } from './types';

package/src/sitemap/select.ts

@@ -0,0 +1,90 @@
+/**
+ * Which backend sources a frontend claims.
+ *
+ * `GET /cfg/sitemap/index/` answers for the whole Django project — every
+ * source any installed app registered. One frontend is not always entitled
+ * to all of them: a backend serving several brands registers a source per
+ * brand (`properties-caribbean`, `properties-bali`), and each brand's app
+ * must emit only its own, or it advertises the other's URLs under its own
+ * host — every one of them a 404, and the sitemap that carries them is
+ * discredited whole.
+ *
+ * The selector lives here, shared, for the same reason `STATIC_ID` does:
+ * `createDjangoSitemap` enumerates the chunks and `createSitemapIndex`
+ * enumerates them again for the index document. If the two applied
+ * different filters, the index would advertise shards the chunk route
+ * refuses to build — and that mismatch is invisible until a crawler reads
+ * both. One function, called by both, cannot drift.
+ *
+ * Source NAMES are the contract. The module ships no notion of a brand or
+ * a tenant, and it should not: the backend chose what its source names
+ * mean, and only the app knows which of them are its own.
+ */
+
+import type { SitemapIndex, SitemapSourceInfo, SourceSelector } from './types';
+
+/**
+ * A predicate from whatever the caller passed.
+ *
+ * Omitted means every source — the single-tenant default, and what every
+ * caller before this option existed already relied on.
+ */
+export function sourceFilter(select: SourceSelector | undefined): (name: string) => boolean {
+  if (select === undefined) return () => true;
+  if (typeof select === 'function') return select;
+  const allowed = new Set(select);
+  return (name) => allowed.has(name);
+}
+
+/** The index's sources, narrowed to those the caller claims. */
+export function selectSources(
+  index: SitemapIndex,
+  select: SourceSelector | undefined,
+): SitemapSourceInfo[] {
+  const keep = sourceFilter(select);
+  return index.sources.filter((source) => keep(source.name));
+}
+
+/**
+ * Every chunk id the selected sources produce, in index order.
+ *
+ * The one place `(source, chunk)` becomes an id, so the chunk route and the
+ * index document enumerate the same set by construction.
+ */
+export function selectedChunkIds(
+  index: SitemapIndex,
+  select: SourceSelector | undefined,
+  encode: (source: string, cursor: string | null) => string,
+): string[] {
+  const ids: string[] = [];
+  for (const source of selectSources(index, select)) {
+    for (const chunk of source.chunks) {
+      ids.push(encode(source.name, chunk.cursor_to));
+    }
+  }
+  return ids;
+}
+
+/**
+ * A selector for one tenant of a multi-brand backend.
+ *
+ * Matches the `<source>-<tenant>` names that a backend registering per
+ * tenant emits. It splits on the LAST hyphen and compares the tail exactly,
+ * rather than testing a suffix: `endsWith('-bali')` is correct for
+ * `properties-bali` but the same shape reads `pricing-plans-premium` as
+ * belonging to a `premium` tenant, and a substring match is not a contract.
+ *
+ * ```ts
+ * sources: tenantSources('bali')   // properties-bali, communities-bali, …
+ * ```
+ *
+ * Sources with no hyphen never match: an untenanted source belongs to the
+ * project rather than to a brand, and claiming it for one is the error this
+ * function exists to prevent.
+ */
+export function tenantSources(tenant: string): (name: string) => boolean {
+  return (name) => {
+    const sep = name.lastIndexOf('-');
+    return sep !== -1 && name.slice(sep + 1) === tenant;
+  };
+}

package/src/sitemap/sitemap.ts

@@ -37,6 +37,7 @@ import {
 } from './constants';
 import { fetchSitemapFeed, fetchSitemapIndex } from './fetch';
 import { decodeChunkId, encodeChunkId } from './ids';
+import { selectedChunkIds, sourceFilter } from './select';
 
 import type { CreateDjangoSitemapOptions, StaticRoute } from './types';
 
@@ -50,6 +51,7 @@ export function createDjangoSitemap(opts: CreateDjangoSitemapOptions): SitemapAp
     host,
     apiUrl,
     staticRoutes = [],
+    sources,
     indexRevalidate = DEFAULT_INDEX_REVALIDATE,
     feedRevalidate = DEFAULT_FEED_REVALIDATE,
   } = opts;
@@ -59,10 +61,8 @@ export function createDjangoSitemap(opts: CreateDjangoSitemapOptions): SitemapAp
       const ids: Array<{ id: string }> = [{ id: STATIC_ID }];
       if (!apiUrl) return ids;
       const index = await fetchSitemapIndex(apiUrl, indexRevalidate);
-      for (const s of index.sources) {
-        for (const c of s.chunks) {
-          ids.push({ id: encodeChunkId(s.name, c.cursor_to) });
-        }
+      for (const id of selectedChunkIds(index, sources, encodeChunkId)) {
+        ids.push({ id });
       }
       return ids;
     },
@@ -77,6 +77,12 @@ export function createDjangoSitemap(opts: CreateDjangoSitemapOptions): SitemapAp
       if (!apiUrl) return [];
 
       const { source, cursor } = decodeChunkId(id);
+      // A chunk this app does not claim renders empty rather than fetching.
+      // `generateSitemaps` never mints such an id, but the route stays
+      // reachable by hand, and serving another tenant's URLs from a guessed
+      // address would undo the filter above.
+      if (!sourceFilter(sources)(source)) return [];
+
       const feed = await fetchSitemapFeed(apiUrl, source, cursor, feedRevalidate);
       return feed.entries.map((e) => ({
         url: `${host}${e.loc}`,

package/src/sitemap/types.ts

@@ -44,6 +44,16 @@ export interface SitemapFeedPage {
 
 // ── Public option types ─────────────────────────────────────────────────
 
+/**
+ * Which backend sources a frontend claims: a list of names, or a predicate.
+ *
+ * Omit for every source in the index — right whenever the backend serves
+ * this frontend alone. Pass one when several frontends share a backend, so
+ * each emits only the URLs its own host can resolve. See `tenantSources`
+ * for the `<source>-<tenant>` convention.
+ */
+export type SourceSelector = string[] | ((name: string) => boolean);
+
 export interface StaticRoute {
   path: string;
   changeFrequency?: ChangeFreq;
@@ -63,6 +73,10 @@ export interface CreateDjangoSitemapOptions {
    *  pages should NOT be listed here. */
   staticRoutes?: StaticRoute[];
 
+  /** Backend sources to emit. Default: every source the index reports.
+   *  Keep in step with the same app's `createSitemapIndex`. */
+  sources?: SourceSelector;
+
   /** Index revalidate window in seconds. Default: 600. */
   indexRevalidate?: number;
 
@@ -83,6 +97,11 @@ export interface CreateSitemapIndexOptions {
    *  and the emitted XML's `s-maxage`. Default: 600. */
   indexRevalidate?: number;
 
+  /** Backend sources to list. Default: every source the index reports.
+   *  MUST match the same app's `createDjangoSitemap` — a mismatch
+   *  advertises chunks the sitemap route will not build. */
+  sources?: SourceSelector;
+
   /** Include the `static` chunk id at the top of the index. Turn off if
    *  the app's `sitemap.ts` opts out of `staticRoutes`. Default: true. */
   includeStatic?: boolean;