@gusnips/vite 0.4.5 → 0.4.6

package/README.md

@@ -111,6 +111,19 @@ text-fitting maths. When copy does not fit, it **records the overflow and refuse
 rather than appending an ellipsis — an ellipsis makes every string "fit", so copy that outgrew
 its column has no failing case and ships.
 
+`assertOgImages("dist", origin)` reads every page the build wrote and checks that each share card
+it advertises is a file that exists. Run it last:
+
+```ts
+await assertOgImages("dist", "https://example.com");
+```
+
+Three codebases shipped a `404.html` whose `og:image` named a card nothing had ever rendered —
+the card generator walks the page registry, and a not-found shell is not in it. Every share of a
+dead link unfurled broken, and nothing in a browser shows it. `bakeHead` cannot catch this: it
+writes the image it is handed, and a shell carrying the brand card is correct. The build can,
+because by then the card is on disk or it is not. Cards on another host are skipped.
+
 `loadTemplate` refuses a `dist/index.html` that is already a rendered page. `dist/index.html` is
 both the file every page is baked _from_ and the home page's own output, so a second pass over a
 written `dist/` reads a finished page as its blank and nests one render inside another. `vite

package/dist/index.d.ts

@@ -17,7 +17,7 @@
  */
 export { resolveKey } from "./catalog.ts";
 export { assertRendered, bakeHead, EMPTY_ROOT, ogLocale, type Alternate, type HeadTags, type RenderedChecks, } from "./head.ts";
-export { loadRenderer, loadTemplate, writeDist, writeOgCards, type OgCard, type WriteOgCardsOptions, } from "./node.ts";
+export { assertOgImages, loadRenderer, loadTemplate, writeDist, writeOgCards, type OgCard, type WriteOgCardsOptions, } from "./node.ts";
 export { describeOverflow, fitText, OG_CANVAS, type FitOptions, type FitResult, type OgOverflow, } from "./og.ts";
 export type { PageRenderer } from "./render.ts";
 export { ogImagePath, pageFile, pageSlug, robotsTxt, siteOrigin, sitemapFor, sitemapXml, type PublicPage, type RobotsOptions, type SitemapEntry, } from "./sitemap.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,mBAAmB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,SAAS,CAAC;AAKjB,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,EACV,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,QAAQ,EACb,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,mBAAmB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,SAAS,EACT,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,SAAS,CAAC;AAKjB,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,EACV,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -17,7 +17,7 @@
  */
 export { resolveKey } from "./catalog.js";
 export { assertRendered, bakeHead, EMPTY_ROOT, ogLocale, } from "./head.js";
-export { loadRenderer, loadTemplate, writeDist, writeOgCards, } from "./node.js";
+export { assertOgImages, loadRenderer, loadTemplate, writeDist, writeOgCards, } from "./node.js";
 export { describeOverflow, fitText, OG_CANVAS, } from "./og.js";
 export { ogImagePath, pageFile, pageSlug, robotsTxt, siteOrigin, sitemapFor, sitemapXml, } from "./sitemap.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,QAAQ,EACR,UAAU,EACV,QAAQ,GAIT,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,SAAS,GAIV,MAAM,SAAS,CAAC;AAMjB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,GAIX,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,QAAQ,EACR,UAAU,EACV,QAAQ,GAIT,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,OAAO,EACP,SAAS,GAIV,MAAM,SAAS,CAAC;AAMjB,OAAO,EACL,WAAW,EACX,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,UAAU,EACV,UAAU,EACV,UAAU,GAIX,MAAM,cAAc,CAAC"}

package/dist/node.d.ts

@@ -54,4 +54,28 @@ export interface WriteOgCardsOptions<Page> {
  * operator round the loop six times.
  */
 export declare function writeOgCards<Page>({ pages, outDir, file, card, check, }: WriteOgCardsOptions<Page>): Promise<string[]>;
+/**
+ * Every share card a built page advertises is a file that exists.
+ *
+ * Three repos shipped a page whose `og:image` named a card nothing had ever rendered. All three
+ * were `404.html`, all three for the same reason: a card generator walks the page registry, and
+ * a not-found shell is not in the registry, so a head built from the same template inherits a
+ * card address with no card behind it. Every share of a dead link unfurled broken, in one case
+ * in three languages, and **nothing in a browser shows it** — the page looks perfect, and the
+ * only reader who finds out is whoever the link was sent to.
+ *
+ * `bakeHead` cannot catch it: it is handed an `image` and writes it, and a shell carrying the
+ * brand card is correct, so it has no way to tell a right image from a wrong one (invariant 12).
+ * The build can, because by then the cards are either on disk or they are not. Run it last,
+ * after the pages and the cards are written:
+ *
+ * ```ts
+ * await assertOgImages("dist", "https://example.com");
+ * ```
+ *
+ * Cards on another host are somebody else's to serve and are skipped — but a build whose pages
+ * all advertise cards and whose origin matches NONE of them has been given the wrong origin,
+ * and a check that silently passes is worse than no check, so that is an error too.
+ */
+export declare function assertOgImages(distDir: string, origin: string): Promise<number>;
 //# sourceMappingURL=node.d.ts.map

package/dist/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE;AAWD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAG,OAAO,EAClD,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAOhC;AAED,8EAA8E;AAC9E,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F;AAED,yEAAyE;AACzE,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,UAAU,CAAC;IAChB;gCAC4B;IAC5B,QAAQ,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACvC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB;+CAC2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EACvC,KAAK,EACL,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAa,GACd,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB/C"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE;AAWD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAG,OAAO,EAClD,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAOhC;AAED,8EAA8E;AAC9E,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI9F;AAED,yEAAyE;AACzE,MAAM,WAAW,MAAM;IACrB,GAAG,EAAE,UAAU,CAAC;IAChB;gCAC4B;IAC5B,QAAQ,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB,CAAC,IAAI;IACvC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;IACvB;+CAC2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,EACvC,KAAK,EACL,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAa,GACd,EAAE,mBAAmB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsB/C;AAgDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCrF"}

package/dist/node.js

@@ -19,11 +19,12 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
  * policy the product owns. What is identical in every one of them is these four functions and
  * the gate in `assertRendered`, so those ship and the ~40-line loop stays in the app.
  */
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { EMPTY_ROOT } from "./head.js";
 import { describeOverflow } from "./og.js";
+import { siteOrigin } from "./sitemap.js";
 /**
  * The built `index.html`, and a refusal to bake one twice.
  *
@@ -101,4 +102,91 @@ export async function writeOgCards({ pages, outDir, file, card, check = false, }
         await writeFile(join(outDir, entry.file), entry.png);
     return laid.map((entry) => entry.file);
 }
+const CARD_META = /<meta[^>]+(?:property|name)="(?:og:image|twitter:image)"[^>]+content="([^"]*)"[^>]*>/gi;
+function advertisedCards(page, html) {
+    const seen = new Set();
+    const cards = [];
+    for (const match of html.matchAll(CARD_META)) {
+        const url = match[1];
+        if (url && !seen.has(url)) {
+            seen.add(url);
+            cards.push({ page, url });
+        }
+    }
+    return cards;
+}
+/**
+ * The path a card URL points at inside `dist`, or null when the card is not this build's to
+ * serve. A `?v=2` or a `#` is addressing, not a file name, so both come off.
+ */
+function distPathOf(url, origin) {
+    if (url.startsWith("/"))
+        return decodeURIComponent(url.split(/[?#]/)[0] ?? "");
+    try {
+        const parsed = new URL(url);
+        return parsed.origin === origin ? decodeURIComponent(parsed.pathname) : null;
+    }
+    catch {
+        // Not an address at all. A card URL relative to the page's own folder cannot be resolved
+        // without knowing where that page sits, and Open Graph asks for an absolute URL anyway.
+        return null;
+    }
+}
+async function isFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Every share card a built page advertises is a file that exists.
+ *
+ * Three repos shipped a page whose `og:image` named a card nothing had ever rendered. All three
+ * were `404.html`, all three for the same reason: a card generator walks the page registry, and
+ * a not-found shell is not in the registry, so a head built from the same template inherits a
+ * card address with no card behind it. Every share of a dead link unfurled broken, in one case
+ * in three languages, and **nothing in a browser shows it** — the page looks perfect, and the
+ * only reader who finds out is whoever the link was sent to.
+ *
+ * `bakeHead` cannot catch it: it is handed an `image` and writes it, and a shell carrying the
+ * brand card is correct, so it has no way to tell a right image from a wrong one (invariant 12).
+ * The build can, because by then the cards are either on disk or they are not. Run it last,
+ * after the pages and the cards are written:
+ *
+ * ```ts
+ * await assertOgImages("dist", "https://example.com");
+ * ```
+ *
+ * Cards on another host are somebody else's to serve and are skipped — but a build whose pages
+ * all advertise cards and whose origin matches NONE of them has been given the wrong origin,
+ * and a check that silently passes is worse than no check, so that is an error too.
+ */
+export async function assertOgImages(distDir, origin) {
+    const root = siteOrigin(origin);
+    const entries = await readdir(distDir, { recursive: true, withFileTypes: true });
+    const pages = entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".html"))
+        .map((entry) => join(entry.parentPath, entry.name));
+    const advertised = [];
+    for (const page of pages)
+        advertised.push(...advertisedCards(page, await readFile(page, "utf8")));
+    const mine = advertised
+        .map((card) => ({ ...card, file: distPathOf(card.url, root) }))
+        .filter((card) => card.file !== null);
+    if (advertised.length > 0 && mine.length === 0)
+        throw new Error(`og: ${String(advertised.length)} page(s) advertise a share card and none is under ` +
+            `${root}, so nothing was checked. Pass the origin this build renders for.`);
+    const missing = [];
+    for (const card of mine) {
+        if (!(await isFile(join(distDir, card.file))))
+            missing.push(card);
+    }
+    if (missing.length > 0)
+        throw new Error(`og: ${String(missing.length)} page(s) advertise a share card that is not in ${distDir} —\n\n` +
+            missing.map((card) => `  · ${card.page} → ${card.url}`).join("\n") +
+            "\n\n  Either render the card, or leave `image` out of the head for that page.");
+    return mine.length;
+}
 //# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAG3C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,mBAAmB,UAAU,yCAAyC;YACtF,oFAAoF;YACpF,kDAAkD,CACrD,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAU,GAAY;IAC5C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,YAAY,IAAI,GAAG;QACnB,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU,CACrC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB;IAEjB,MAAM,GAAG,GAAY,MAAM,MAAM,kCAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,EAAC,CAAC;IACjE,IAAI,CAAC,eAAe,CAAU,GAAG,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,OAAO,GAAG,CAAC,UAAU,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,IAAY,EAAE,QAAgB;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAuBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAO,EACvC,KAAK,EACL,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,GAAG,KAAK,GACa;IAC1B,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD,MAAM,SAAS,GAAiB,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,uCAAuC;YACpE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/D,sFAAsF,CACzF,CAAC;IAEJ,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,IAAI;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../src/node.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,mBAAmB,UAAU,yCAAyC;YACtF,oFAAoF;YACpF,kDAAkD,CACrD,CAAC;IACJ,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAU,GAAY;IAC5C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,YAAY,IAAI,GAAG;QACnB,OAAO,GAAG,CAAC,UAAU,KAAK,UAAU,CACrC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB;IAEjB,MAAM,GAAG,GAAY,MAAM,MAAM,kCAAC,aAAa,CAAC,SAAS,CAAC,CAAC,IAAI,EAAC,CAAC;IACjE,IAAI,CAAC,eAAe,CAAU,GAAG,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,8DAA8D,CACtF,CAAC;IACJ,OAAO,GAAG,CAAC,UAAU,CAAC;AACxB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,IAAY,EAAE,QAAgB;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAuBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAO,EACvC,KAAK,EACL,MAAM,EACN,IAAI,EACJ,IAAI,EACJ,KAAK,GAAG,KAAK,GACa;IAC1B,MAAM,IAAI,GAAwC,EAAE,CAAC;IACrD,MAAM,SAAS,GAAiB,EAAE,CAAC;IAEnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,uCAAuC;YACpE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAC/D,sFAAsF,CACzF,CAAC;IAEJ,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,IAAI;QAAE,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAQD,MAAM,SAAS,GACb,wFAAwF,CAAC;AAE3F,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAqB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,MAAc;IAC7C,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,yFAAyF;QACzF,wFAAwF;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,OAAO;SAClB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SACjE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAEtD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAElG,MAAM,IAAI,GAAG,UAAU;SACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;SAC9D,MAAM,CAAC,CAAC,IAAI,EAA6C,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAEnF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,oDAAoD;YAClF,GAAG,IAAI,mEAAmE,CAC7E,CAAC;IAEJ,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,kDAAkD,OAAO,QAAQ;YAC5F,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAClE,+EAA+E,CAClF,CAAC;IAEJ,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gusnips/vite",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "The build-time half of a prerendered Vite SPA: head baking, sitemap, robots, the prerender driver, and a shared vite preset.",
   "type": "module",
   "license": "MIT",
@@ -59,7 +59,7 @@
     "release:major": "bun pm version major && bun publish --access public"
   },
   "dependencies": {
-    "@gusnips/react": "0.4.5"
+    "@gusnips/react": "0.4.6"
   },
   "peerDependencies": {
     "@tailwindcss/vite": "^4",

package/src/index.ts

@@ -26,6 +26,7 @@ export {
   type RenderedChecks,
 } from "./head.ts";
 export {
+  assertOgImages,
   loadRenderer,
   loadTemplate,
   writeDist,

package/src/node.test.ts

@@ -1,8 +1,8 @@
-import { mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { loadTemplate, writeOgCards } from "./node.ts";
+import { assertOgImages, loadTemplate, writeOgCards } from "./node.ts";
 
 const dirs: string[] = [];
 
@@ -100,3 +100,77 @@ describe("writeOgCards", () => {
     await expect(run).rejects.toThrow(/2 card\(s\)/);
   });
 });
+
+describe("assertOgImages", () => {
+  const page = (image: string) =>
+    `<html><head><meta property="og:image" content="${image}" />` +
+    `<meta property="twitter:image" content="${image}" /></head></html>`;
+
+  async function distWith(files: Record<string, string>): Promise<string> {
+    const dir = await mkdtemp(join(tmpdir(), "frontkit-og-"));
+    dirs.push(dir);
+    for (const [file, contents] of Object.entries(files)) {
+      await mkdir(join(dir, dirname(file)), { recursive: true });
+      await writeFile(join(dir, file), contents, "utf8");
+    }
+    return dir;
+  }
+
+  it("passes when every advertised card is on disk", async () => {
+    const dist = await distWith({
+      "index.html": page("https://example.com/og/home.png"),
+      "og/home.png": "png",
+    });
+    await expect(assertOgImages(dist, "https://example.com")).resolves.toBe(1);
+  });
+
+  /**
+   * The bug itself, three repos over: the card generator walks the page registry, the 404 shell
+   * is not in the registry, and the head it inherits advertises a card that has never been
+   * rendered. Nothing in a browser shows it — only the person the link was sent to.
+   */
+  it("names the page whose card was never rendered", async () => {
+    const dist = await distWith({
+      "index.html": page("https://example.com/og/home.png"),
+      "404.html": page("https://example.com/og/__not-found__.png"),
+      "og/home.png": "png",
+    });
+
+    await expect(assertOgImages(dist, "https://example.com")).rejects.toThrow(
+      /404\.html → https:\/\/example\.com\/og\/__not-found__\.png/,
+    );
+  });
+
+  it("finds a page nested under a directory, and reads a root-relative card", async () => {
+    const dist = await distWith({
+      "precos/index.html": page("/og/precos.png"),
+    });
+    await expect(assertOgImages(dist, "https://example.com")).rejects.toThrow(/og\/precos\.png/);
+  });
+
+  it("skips a card served by somebody else", async () => {
+    const dist = await distWith({
+      "index.html": page("https://cdn.example.net/card.png"),
+      "about.html": page("https://example.com/og/about.png"),
+      "og/about.png": "png",
+    });
+    await expect(assertOgImages(dist, "https://example.com")).resolves.toBe(1);
+  });
+
+  // A check that silently passes is worse than no check: with the origin wrong, every card on
+  // the page looks like somebody else's and nothing gets looked at.
+  it("refuses an origin that matches none of the cards it found", async () => {
+    const dist = await distWith({ "index.html": page("https://example.com/og/home.png") });
+    await expect(assertOgImages(dist, "https://wrong.example")).rejects.toThrow(
+      /none is under https:\/\/wrong\.example/,
+    );
+  });
+
+  it("ignores a cache-busting query when looking for the file", async () => {
+    const dist = await distWith({
+      "index.html": page("https://example.com/og/home.png?v=2"),
+      "og/home.png": "png",
+    });
+    await expect(assertOgImages(dist, "https://example.com")).resolves.toBe(1);
+  });
+});

package/src/node.ts

@@ -11,13 +11,14 @@
  * policy the product owns. What is identical in every one of them is these four functions and
  * the gate in `assertRendered`, so those ship and the ~40-line loop stays in the app.
  */
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, stat, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { EMPTY_ROOT } from "./head.ts";
 import type { OgOverflow } from "./og.ts";
 import { describeOverflow } from "./og.ts";
 import type { PageRenderer } from "./render.ts";
+import { siteOrigin } from "./sitemap.ts";
 
 /**
  * The built `index.html`, and a refusal to bake one twice.
@@ -138,3 +139,107 @@ export async function writeOgCards<Page>({
   for (const entry of laid) await writeFile(join(outDir, entry.file), entry.png);
   return laid.map((entry) => entry.file);
 }
+
+/** Where a page says its share card is, and the page that says it. */
+interface AdvertisedCard {
+  page: string;
+  url: string;
+}
+
+const CARD_META =
+  /<meta[^>]+(?:property|name)="(?:og:image|twitter:image)"[^>]+content="([^"]*)"[^>]*>/gi;
+
+function advertisedCards(page: string, html: string): AdvertisedCard[] {
+  const seen = new Set<string>();
+  const cards: AdvertisedCard[] = [];
+  for (const match of html.matchAll(CARD_META)) {
+    const url = match[1];
+    if (url && !seen.has(url)) {
+      seen.add(url);
+      cards.push({ page, url });
+    }
+  }
+  return cards;
+}
+
+/**
+ * The path a card URL points at inside `dist`, or null when the card is not this build's to
+ * serve. A `?v=2` or a `#` is addressing, not a file name, so both come off.
+ */
+function distPathOf(url: string, origin: string): string | null {
+  if (url.startsWith("/")) return decodeURIComponent(url.split(/[?#]/)[0] ?? "");
+  try {
+    const parsed = new URL(url);
+    return parsed.origin === origin ? decodeURIComponent(parsed.pathname) : null;
+  } catch {
+    // Not an address at all. A card URL relative to the page's own folder cannot be resolved
+    // without knowing where that page sits, and Open Graph asks for an absolute URL anyway.
+    return null;
+  }
+}
+
+async function isFile(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Every share card a built page advertises is a file that exists.
+ *
+ * Three repos shipped a page whose `og:image` named a card nothing had ever rendered. All three
+ * were `404.html`, all three for the same reason: a card generator walks the page registry, and
+ * a not-found shell is not in the registry, so a head built from the same template inherits a
+ * card address with no card behind it. Every share of a dead link unfurled broken, in one case
+ * in three languages, and **nothing in a browser shows it** — the page looks perfect, and the
+ * only reader who finds out is whoever the link was sent to.
+ *
+ * `bakeHead` cannot catch it: it is handed an `image` and writes it, and a shell carrying the
+ * brand card is correct, so it has no way to tell a right image from a wrong one (invariant 12).
+ * The build can, because by then the cards are either on disk or they are not. Run it last,
+ * after the pages and the cards are written:
+ *
+ * ```ts
+ * await assertOgImages("dist", "https://example.com");
+ * ```
+ *
+ * Cards on another host are somebody else's to serve and are skipped — but a build whose pages
+ * all advertise cards and whose origin matches NONE of them has been given the wrong origin,
+ * and a check that silently passes is worse than no check, so that is an error too.
+ */
+export async function assertOgImages(distDir: string, origin: string): Promise<number> {
+  const root = siteOrigin(origin);
+  const entries = await readdir(distDir, { recursive: true, withFileTypes: true });
+  const pages = entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith(".html"))
+    .map((entry) => join(entry.parentPath, entry.name));
+
+  const advertised: AdvertisedCard[] = [];
+  for (const page of pages) advertised.push(...advertisedCards(page, await readFile(page, "utf8")));
+
+  const mine = advertised
+    .map((card) => ({ ...card, file: distPathOf(card.url, root) }))
+    .filter((card): card is AdvertisedCard & { file: string } => card.file !== null);
+
+  if (advertised.length > 0 && mine.length === 0)
+    throw new Error(
+      `og: ${String(advertised.length)} page(s) advertise a share card and none is under ` +
+        `${root}, so nothing was checked. Pass the origin this build renders for.`,
+    );
+
+  const missing: (AdvertisedCard & { file: string })[] = [];
+  for (const card of mine) {
+    if (!(await isFile(join(distDir, card.file)))) missing.push(card);
+  }
+
+  if (missing.length > 0)
+    throw new Error(
+      `og: ${String(missing.length)} page(s) advertise a share card that is not in ${distDir} —\n\n` +
+        missing.map((card) => `  · ${card.page} → ${card.url}`).join("\n") +
+        "\n\n  Either render the card, or leave `image` out of the head for that page.",
+    );
+
+  return mine.length;
+}