@lownoise-studio/rendershield 0.3.1 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +58 -32
- package/CONTRIBUTING.md +41 -0
- package/README.md +209 -144
- package/SECURITY.md +25 -0
- package/dist/cli.d.ts +3 -0
- package/dist/cli.d.ts.map +1 -0
- package/dist/cli.js +27 -19
- package/dist/cli.js.map +1 -1
- package/dist/commands/build.d.ts +2 -0
- package/dist/commands/build.d.ts.map +1 -0
- package/dist/commands/build.js +10 -9
- package/dist/commands/build.js.map +1 -1
- package/dist/commands/init.d.ts +2 -0
- package/dist/commands/init.d.ts.map +1 -0
- package/dist/commands/verify.d.ts +19 -0
- package/dist/commands/verify.d.ts.map +1 -0
- package/dist/commands/verify.js +57 -64
- package/dist/commands/verify.js.map +1 -1
- package/dist/core/generateRobots.d.ts +3 -0
- package/dist/core/generateRobots.d.ts.map +1 -0
- package/dist/core/generateSitemap.d.ts +3 -0
- package/dist/core/generateSitemap.d.ts.map +1 -0
- package/dist/core/generateWorker.d.ts +3 -0
- package/dist/core/generateWorker.d.ts.map +1 -0
- package/dist/core/generateWorker.js +75 -75
- package/dist/core/loadConfig.d.ts +3 -0
- package/dist/core/loadConfig.d.ts.map +1 -0
- package/dist/core/loadConfig.js +68 -25
- package/dist/core/loadConfig.js.map +1 -1
- package/dist/core/loadMarkdown.d.ts +3 -0
- package/dist/core/loadMarkdown.d.ts.map +1 -0
- package/dist/core/loadMarkdown.js +4 -3
- package/dist/core/loadMarkdown.js.map +1 -1
- package/dist/core/renderHtml.d.ts +3 -0
- package/dist/core/renderHtml.d.ts.map +1 -0
- package/dist/core/renderHtml.js +25 -10
- package/dist/core/renderHtml.js.map +1 -1
- package/dist/core/validateOutput.d.ts +28 -0
- package/dist/core/validateOutput.d.ts.map +1 -0
- package/dist/core/validateOutput.js +7 -1
- package/dist/core/validateOutput.js.map +1 -1
- package/dist/errors.d.ts +14 -0
- package/dist/errors.d.ts.map +1 -0
- package/dist/errors.js +24 -0
- package/dist/errors.js.map +1 -0
- package/dist/index.d.ts +20 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +19 -0
- package/dist/index.js.map +1 -0
- package/dist/types.d.ts +53 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +1 -1
- package/dist/types.js.map +1 -1
- package/docs/deploy-cloudflare.md +40 -14
- package/package.json +24 -2
- package/src/cli.ts +86 -75
- package/src/commands/build.ts +199 -185
- package/src/commands/verify.ts +266 -236
- package/src/core/generateWorker.ts +97 -97
- package/src/core/loadConfig.ts +261 -173
- package/src/core/loadMarkdown.ts +9 -3
- package/src/core/renderHtml.ts +36 -12
- package/src/core/validateOutput.ts +335 -328
- package/src/errors.ts +48 -0
- package/src/index.ts +40 -0
- package/src/types.ts +4 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,32 +1,58 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
All notable changes to this project will be documented in this file.
|
|
4
|
-
|
|
5
|
-
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
|
-
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
|
-
|
|
8
|
-
## [Unreleased]
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
-
|
|
15
|
-
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
-
|
|
20
|
-
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
-
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
All notable changes to this project will be documented in this file.
|
|
4
|
+
|
|
5
|
+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
|
|
6
|
+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
|
+
|
|
8
|
+
## [Unreleased]
|
|
9
|
+
|
|
10
|
+
## [1.0.0] - 2026-08-23
|
|
11
|
+
|
|
12
|
+
### Added
|
|
13
|
+
|
|
14
|
+
- **Programmatic API**: import `@lownoise-studio/rendershield` for `cmdInit`, `cmdBuild`, `cmdVerify`, config loading, HTML rendering, contract validation, and artifact generators.
|
|
15
|
+
- **`RenderShieldError`**: stable error codes (`CONFIG_MISSING`, `CONFIG_INVALID`, `OUTPUT_PATH_UNSAFE`, `CONTENT_INVALID`, `BUILD_FAILED`, `VALIDATION_FAILED`, `VERIFY_FAILED`, `CLI_INVALID_ARGS`) with optional `details` for library consumers.
|
|
16
|
+
- **TypeScript declarations**: published `.d.ts` via `package.json` `types` and `exports` map.
|
|
17
|
+
- **CI**: GitHub Actions workflow runs build and tests on Node 18, 20, and 22.
|
|
18
|
+
- **Docs**: `CONTRIBUTING.md` and `SECURITY.md`.
|
|
19
|
+
- Tests for `cmdInit`, local and `--prod` `cmdVerify`, public API exports, and `schemaType` rendering.
|
|
20
|
+
- `schemaType` config field now drives JSON-LD `@type` (`Article`, `BlogPosting`, `WebPage`).
|
|
21
|
+
|
|
22
|
+
### Fixed
|
|
23
|
+
|
|
24
|
+
- `verify` without build output now exits with failure (`VERIFY_FAILED`) instead of succeeding silently.
|
|
25
|
+
- `verify --prod` without a URL is rejected with `CLI_INVALID_ARGS` instead of falling back to local verify.
|
|
26
|
+
|
|
27
|
+
### Changed
|
|
28
|
+
|
|
29
|
+
- `cmdVerify` returns structured `VerifyResult` on success for programmatic use.
|
|
30
|
+
- CLI errors include error codes when thrown as `RenderShieldError`.
|
|
31
|
+
- `package.json`: `engines.node >= 18`, `exports`, `keywords`; sample `content/**` no longer published to npm.
|
|
32
|
+
- README: npm install / `npx` quickstart and programmatic API section.
|
|
33
|
+
|
|
34
|
+
## [0.3.1] - 2025-02-18
|
|
35
|
+
|
|
36
|
+
### Added
|
|
37
|
+
|
|
38
|
+
- `verify --prod <url>`: production check that asserts `x-rendershield: bot-hit` and runs the same HTML contract validation as build.
|
|
39
|
+
- Worker response header `x-rendershield`: `bot-hit` | `bot-fallback` | `pass-through` so routing is observable without inferring from HTML.
|
|
40
|
+
- CLI `--version` / `-V`: prints version from package.json.
|
|
41
|
+
- Vitest test suite: contract validation, loadConfig (including sitemap/robots path preservation and worker validation), path safety, and integration build.
|
|
42
|
+
|
|
43
|
+
### Fixed
|
|
44
|
+
|
|
45
|
+
- Config: sitemap and robots `path` are preserved and defaulted when only `enabled` is set; no longer lost when using boolean flags.
|
|
46
|
+
- Config: when `worker.enabled` is true, full worker object is kept (lovableOrigin, rewriteRouteBases, etc.) instead of being replaced by the flag.
|
|
47
|
+
- Worker: 500 error response body is generic ("Service temporarily unavailable.") to avoid leaking internals.
|
|
48
|
+
- JSON-LD in generated HTML: script body is no longer HTML-escaped so contract validation and crawlers can parse it.
|
|
49
|
+
|
|
50
|
+
### Changed
|
|
51
|
+
|
|
52
|
+
- Help text shows version and documents that `verify --prod` requires `x-rendershield: bot-hit`.
|
|
53
|
+
- TypeScript: reduced `any`; use `unknown` and typed interfaces in CLI, loadConfig, validateOutput, loadMarkdown.
|
|
54
|
+
- README: added "Production check" for `verify --prod`.
|
|
55
|
+
|
|
56
|
+
## [0.3.0] - 2025-02-18
|
|
57
|
+
|
|
58
|
+
- Initial npm release with init, build, verify, optional Cloudflare Worker, and HTML contract validation.
|
package/CONTRIBUTING.md
ADDED
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
# Contributing to RenderShield
|
|
2
|
+
|
|
3
|
+
Thank you for your interest in contributing.
|
|
4
|
+
|
|
5
|
+
## Development setup
|
|
6
|
+
|
|
7
|
+
Requirements: **Node.js 18+**
|
|
8
|
+
|
|
9
|
+
```bash
|
|
10
|
+
git clone https://github.com/Lownoise-Studio/rendershield.git
|
|
11
|
+
cd rendershield
|
|
12
|
+
npm install
|
|
13
|
+
npm test
|
|
14
|
+
```
|
|
15
|
+
|
|
16
|
+
`npm test` runs `tsc` then Vitest. Tests import from `dist/`, so always build before running tests manually.
|
|
17
|
+
|
|
18
|
+
## Making changes
|
|
19
|
+
|
|
20
|
+
1. Create a branch from `main`.
|
|
21
|
+
2. Keep changes focused — RenderShield is intentionally narrow in scope.
|
|
22
|
+
3. Add or update tests for behavior changes.
|
|
23
|
+
4. Run `npm test` before opening a pull request.
|
|
24
|
+
5. Update `CHANGELOG.md` under `[Unreleased]` for user-visible changes.
|
|
25
|
+
|
|
26
|
+
## Pull requests
|
|
27
|
+
|
|
28
|
+
- Describe the problem and the approach.
|
|
29
|
+
- Link related issues when applicable.
|
|
30
|
+
- Ensure CI passes (build + tests on Node 18, 20, 22).
|
|
31
|
+
|
|
32
|
+
## Code style
|
|
33
|
+
|
|
34
|
+
- TypeScript strict mode; prefer `unknown` over `any`.
|
|
35
|
+
- Match existing module layout (`src/commands`, `src/core`).
|
|
36
|
+
- Throw `RenderShieldError` with a stable code for user-facing failures.
|
|
37
|
+
- Avoid drive-by refactors unrelated to the change.
|
|
38
|
+
|
|
39
|
+
## Reporting issues
|
|
40
|
+
|
|
41
|
+
Use [GitHub Issues](https://github.com/Lownoise-Studio/rendershield/issues). Include Node version, command run, and full error output.
|
package/README.md
CHANGED
|
@@ -1,144 +1,209 @@
|
|
|
1
|
-
# RenderShield
|
|
2
|
-
|
|
3
|
-
RenderShield
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
It prerenders content ahead of time and
|
|
7
|
-
at the edge, while normal users continue to receive
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
No
|
|
11
|
-
No
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
-
|
|
41
|
-
-
|
|
42
|
-
-
|
|
43
|
-
-
|
|
44
|
-
-
|
|
45
|
-
-
|
|
46
|
-
|
|
47
|
-
-
|
|
48
|
-
-
|
|
49
|
-
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
- It does not
|
|
62
|
-
|
|
63
|
-
It
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
npm
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
1
|
+
# RenderShield
|
|
2
|
+
|
|
3
|
+
RenderShield produces complete, static HTML for crawlers — and can prove
|
|
4
|
+
that bots receive it in production.
|
|
5
|
+
|
|
6
|
+
It prerenders structured content ahead of time and optionally routes crawler
|
|
7
|
+
requests to that output at the edge, while normal users continue to receive
|
|
8
|
+
your SPA.
|
|
9
|
+
|
|
10
|
+
No frameworks required.
|
|
11
|
+
No browser rendering.
|
|
12
|
+
No guessing what bots see.
|
|
13
|
+
|
|
14
|
+
If a page builds, the HTML contract is satisfied.
|
|
15
|
+
If verify --prod passes, crawlers are actually receiving it.
|
|
16
|
+
|
|
17
|
+
---
|
|
18
|
+
|
|
19
|
+
## What problem this solves
|
|
20
|
+
|
|
21
|
+
Modern SPAs often render content only after JavaScript executes.
|
|
22
|
+
|
|
23
|
+
Search engines, social scrapers, and AI crawlers may:
|
|
24
|
+
|
|
25
|
+
- see an empty shell
|
|
26
|
+
- see partial metadata
|
|
27
|
+
- receive inconsistent output
|
|
28
|
+
|
|
29
|
+
RenderShield enforces two guarantees:
|
|
30
|
+
|
|
31
|
+
- **Build-time contract** — Generated HTML must contain required metadata and content.
|
|
32
|
+
- **Production routing proof** — Bots must receive prerendered HTML (verified via header).
|
|
33
|
+
|
|
34
|
+
---
|
|
35
|
+
|
|
36
|
+
## What RenderShield does
|
|
37
|
+
|
|
38
|
+
- Converts structured content (Markdown) into full static HTML pages
|
|
39
|
+
- Injects:
|
|
40
|
+
- `<title>`
|
|
41
|
+
- meta description
|
|
42
|
+
- canonical link
|
|
43
|
+
- Open Graph tags
|
|
44
|
+
- Twitter tags
|
|
45
|
+
- JSON-LD (Article, BlogPosting, WebPage)
|
|
46
|
+
- Generates:
|
|
47
|
+
- index.html per route
|
|
48
|
+
- sitemap.xml
|
|
49
|
+
- robots.txt
|
|
50
|
+
- optional Cloudflare Worker
|
|
51
|
+
- Validates output:
|
|
52
|
+
- missing title, metadata, or article body causes the build to fail
|
|
53
|
+
- Verifies production behavior:
|
|
54
|
+
- `verify --prod` asserts `x-rendershield: bot-hit`
|
|
55
|
+
- fails if the Worker is missing or falling back
|
|
56
|
+
|
|
57
|
+
---
|
|
58
|
+
|
|
59
|
+
## What it does not do
|
|
60
|
+
|
|
61
|
+
- It does not execute your application
|
|
62
|
+
- It does not render JavaScript for bots
|
|
63
|
+
- It does not guess content
|
|
64
|
+
- It does not guarantee rankings or traffic
|
|
65
|
+
- It does not replace your SPA
|
|
66
|
+
|
|
67
|
+
It guarantees one thing only:
|
|
68
|
+
that bot-facing HTML meets a defined contract —
|
|
69
|
+
and (optionally) that production routing serves it.
|
|
70
|
+
|
|
71
|
+
---
|
|
72
|
+
|
|
73
|
+
## Quickstart
|
|
74
|
+
|
|
75
|
+
Requires **Node.js 18+**.
|
|
76
|
+
|
|
77
|
+
### From npm
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
npm install -D @lownoise-studio/rendershield
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
```bash
|
|
84
|
+
npx rendershield init
|
|
85
|
+
npx rendershield build
|
|
86
|
+
npx rendershield verify
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
Add a script to `package.json` if you prefer:
|
|
90
|
+
|
|
91
|
+
```json
|
|
92
|
+
{
|
|
93
|
+
"scripts": {
|
|
94
|
+
"prerender": "rendershield build",
|
|
95
|
+
"prerender:verify": "rendershield verify"
|
|
96
|
+
}
|
|
97
|
+
}
|
|
98
|
+
```
|
|
99
|
+
|
|
100
|
+
### From source
|
|
101
|
+
|
|
102
|
+
```bash
|
|
103
|
+
git clone https://github.com/Lownoise-Studio/rendershield.git
|
|
104
|
+
cd rendershield
|
|
105
|
+
npm install
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
**Initialize**
|
|
109
|
+
|
|
110
|
+
```bash
|
|
111
|
+
npm run start -- init
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
Or after `npm run build`:
|
|
115
|
+
|
|
116
|
+
```bash
|
|
117
|
+
rendershield init
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
**Add content**
|
|
121
|
+
|
|
122
|
+
```
|
|
123
|
+
content/blog/
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
**Build**
|
|
127
|
+
|
|
128
|
+
```bash
|
|
129
|
+
rendershield build
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
Or with npx:
|
|
133
|
+
|
|
134
|
+
```bash
|
|
135
|
+
npx rendershield build
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
**Output**
|
|
139
|
+
|
|
140
|
+
```
|
|
141
|
+
dist-prerender/
|
|
142
|
+
```
|
|
143
|
+
|
|
144
|
+
**Local verify**
|
|
145
|
+
|
|
146
|
+
```bash
|
|
147
|
+
rendershield verify
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
**Production verify (after deploying Worker)**
|
|
151
|
+
|
|
152
|
+
```bash
|
|
153
|
+
rendershield verify --prod https://your-domain.com
|
|
154
|
+
```
|
|
155
|
+
|
|
156
|
+
This command:
|
|
157
|
+
|
|
158
|
+
- Fetches as Googlebot
|
|
159
|
+
- Requires `x-rendershield: bot-hit`
|
|
160
|
+
- Validates metadata + JSON-LD + article content
|
|
161
|
+
- Exits with code 1 if anything fails
|
|
162
|
+
|
|
163
|
+
---
|
|
164
|
+
|
|
165
|
+
## Programmatic API
|
|
166
|
+
|
|
167
|
+
RenderShield can be used as a library:
|
|
168
|
+
|
|
169
|
+
```ts
|
|
170
|
+
import { cmdBuild, loadConfig, checkPrerenderContract, RenderShieldError } from "@lownoise-studio/rendershield";
|
|
171
|
+
|
|
172
|
+
await cmdBuild(process.cwd());
|
|
173
|
+
```
|
|
174
|
+
|
|
175
|
+
Exported commands, config loaders, HTML renderer, contract validators, and artifact generators are available from the package root. Errors throw `RenderShieldError` with stable `code` values for CI and tooling.
|
|
176
|
+
|
|
177
|
+
See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup.
|
|
178
|
+
|
|
179
|
+
---
|
|
180
|
+
|
|
181
|
+
## Deployment
|
|
182
|
+
|
|
183
|
+
Designed for Cloudflare Workers.
|
|
184
|
+
|
|
185
|
+
The generated Worker:
|
|
186
|
+
|
|
187
|
+
- Rewrites bot requests
|
|
188
|
+
- Sets `x-rendershield` on all responses
|
|
189
|
+
- Makes routing observable and testable
|
|
190
|
+
|
|
191
|
+
See: [docs/deploy-cloudflare.md](docs/deploy-cloudflare.md)
|
|
192
|
+
|
|
193
|
+
---
|
|
194
|
+
|
|
195
|
+
## Philosophy
|
|
196
|
+
|
|
197
|
+
RenderShield is intentionally narrow.
|
|
198
|
+
|
|
199
|
+
It does not attempt to simulate browsers.
|
|
200
|
+
It does not promise SEO outcomes.
|
|
201
|
+
It enforces a deterministic HTML contract and observable crawler routing.
|
|
202
|
+
|
|
203
|
+
Boring on purpose.
|
|
204
|
+
|
|
205
|
+
---
|
|
206
|
+
|
|
207
|
+
## License
|
|
208
|
+
|
|
209
|
+
MIT
|
package/SECURITY.md
ADDED
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## Supported versions
|
|
4
|
+
|
|
5
|
+
| Version | Supported |
|
|
6
|
+
| ------- | --------- |
|
|
7
|
+
| 1.0.x | Yes |
|
|
8
|
+
| < 1.0 | No |
|
|
9
|
+
|
|
10
|
+
## Reporting a vulnerability
|
|
11
|
+
|
|
12
|
+
Please **do not** open a public GitHub issue for security vulnerabilities.
|
|
13
|
+
|
|
14
|
+
Email security reports to the maintainers via the contact listed on the [GitHub repository](https://github.com/Lownoise-Studio/rendershield). Include:
|
|
15
|
+
|
|
16
|
+
- A description of the issue and potential impact
|
|
17
|
+
- Steps to reproduce
|
|
18
|
+
- Affected versions
|
|
19
|
+
- Any suggested fix, if you have one
|
|
20
|
+
|
|
21
|
+
We aim to acknowledge reports within **5 business days** and will coordinate disclosure and a fix before publishing details.
|
|
22
|
+
|
|
23
|
+
## Scope notes
|
|
24
|
+
|
|
25
|
+
RenderShield generates static HTML and an optional Cloudflare Worker template. Deployment, DNS, TLS, and Worker binding configuration are the operator's responsibility. Security issues in generated Worker routing logic or path-safety checks in the build command are in scope for this project.
|
package/dist/cli.d.ts
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}
|
package/dist/cli.js
CHANGED
|
@@ -3,26 +3,27 @@ import { createRequire } from "node:module";
|
|
|
3
3
|
import { cmdInit } from "./commands/init.js";
|
|
4
4
|
import { cmdBuild } from "./commands/build.js";
|
|
5
5
|
import { cmdVerify } from "./commands/verify.js";
|
|
6
|
+
import { formatCliError, renderShieldError } from "./errors.js";
|
|
6
7
|
const require = createRequire(import.meta.url);
|
|
7
8
|
const pkg = require("../package.json");
|
|
8
9
|
const VERSION = pkg.version ?? "0.0.0";
|
|
9
10
|
function printHelp() {
|
|
10
|
-
console.log(`
|
|
11
|
-
RenderShield v${VERSION} — boring bot-aware prerendering.
|
|
12
|
-
|
|
13
|
-
Usage:
|
|
14
|
-
rendershield init
|
|
15
|
-
rendershield build
|
|
16
|
-
rendershield verify [--prod <url>]
|
|
17
|
-
|
|
18
|
-
verify Print curl commands for local/build output.
|
|
19
|
-
verify --prod Fetch URL as bot and human; verify bot sees full HTML and contract fields.
|
|
20
|
-
Requires x-rendershield: bot-hit from the Worker.
|
|
21
|
-
|
|
22
|
-
Notes:
|
|
23
|
-
- Config file: rendershield.config.json
|
|
24
|
-
- Content: content/<collection>/**/*.md (frontmatter required)
|
|
25
|
-
- Output: dist-prerender/
|
|
11
|
+
console.log(`
|
|
12
|
+
RenderShield v${VERSION} — boring bot-aware prerendering.
|
|
13
|
+
|
|
14
|
+
Usage:
|
|
15
|
+
rendershield init
|
|
16
|
+
rendershield build
|
|
17
|
+
rendershield verify [--prod <url>]
|
|
18
|
+
|
|
19
|
+
verify Print curl commands for local/build output.
|
|
20
|
+
verify --prod Fetch URL as bot and human; verify bot sees full HTML and contract fields.
|
|
21
|
+
Requires x-rendershield: bot-hit from the Worker.
|
|
22
|
+
|
|
23
|
+
Notes:
|
|
24
|
+
- Config file: rendershield.config.json
|
|
25
|
+
- Content: content/<collection>/**/*.md (frontmatter required)
|
|
26
|
+
- Output: dist-prerender/
|
|
26
27
|
`);
|
|
27
28
|
}
|
|
28
29
|
async function main() {
|
|
@@ -52,8 +53,15 @@ async function main() {
|
|
|
52
53
|
process.exit(0);
|
|
53
54
|
}
|
|
54
55
|
const prodIdx = verifyArgs.indexOf("--prod");
|
|
55
|
-
|
|
56
|
-
|
|
56
|
+
if (prodIdx >= 0) {
|
|
57
|
+
const prodUrl = verifyArgs[prodIdx + 1]?.trim();
|
|
58
|
+
if (!prodUrl || prodUrl.startsWith("-")) {
|
|
59
|
+
throw renderShieldError("CLI_INVALID_ARGS", "verify --prod requires a URL. Example: rendershield verify --prod https://example.com/blog/hello-world");
|
|
60
|
+
}
|
|
61
|
+
await cmdVerify(undefined, { prodUrl });
|
|
62
|
+
return;
|
|
63
|
+
}
|
|
64
|
+
await cmdVerify();
|
|
57
65
|
return;
|
|
58
66
|
}
|
|
59
67
|
console.error(`Unknown command: ${cmd}\n`);
|
|
@@ -61,7 +69,7 @@ async function main() {
|
|
|
61
69
|
process.exit(1);
|
|
62
70
|
}
|
|
63
71
|
catch (err) {
|
|
64
|
-
const msg =
|
|
72
|
+
const msg = formatCliError(err);
|
|
65
73
|
console.error(`\nRenderShield error: ${msg}\n`);
|
|
66
74
|
process.exit(1);
|
|
67
75
|
}
|
package/dist/cli.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAyB,CAAC;AAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;AAEvC,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;gBACE,OAAO;;;;;;;;;;;;;;;CAetB,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAE5B,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC7C,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,OAAO,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,MAAM,QAAQ,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/D,SAAS,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxC,MAAM,iBAAiB,CACrB,kBAAkB,EAClB,wGAAwG,CACzG,CAAC;gBACJ,CAAC;gBACD,MAAM,SAAS,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;QAC3C,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/commands/build.ts"],"names":[],"mappings":"AAuIA,wBAAsB,QAAQ,CAAC,GAAG,SAAgB,iBA+DjD"}
|