@marvalt/digivalt-core 0.2.9 → 0.2.11

package/docs/SEO-PERFORMANCE.md

@@ -43,7 +43,15 @@ Read via `getPerformanceConfig()` from `@marvalt/digivalt-core/config`. Set to `
 
 ## Sitemap (`/sitemap.xml`)
 
-DigiValt apps ship a **Cloudflare Pages Function** at **`functions/sitemap.xml.ts`** that responds at **`/sitemap.xml`**. It reads **`VITE_SEO_SITE_URL`** (or **`SITE_URL`**) for canonical `<loc>` values and loads path slugs from **`public/sitemap-paths.json`** (shape: `{ "paths": ["/", "/pricing"] }`). Update that JSON when you add marketing routes; avoid a static **`public/sitemap.xml`** file, which would override the Function.
+**Runtime:** A **Cloudflare Pages Function** at **`functions/sitemap.xml.ts`** serves **`/sitemap.xml`**. It **`fetch`es `/sitemap-paths.json`** from the deployed static assets and uses **`VITE_SEO_SITE_URL`** (or **`SITE_URL`**) for canonical `<loc>` values (fallback: request origin). Do not add **`public/sitemap.xml`**; it would shadow the Function.
+
+**Build time:** **`public/sitemap-paths.json`** is **generated** by **`@marvalt/digivalt-core/generators`** (`generateSitemapPaths`) at the end of **`generateAllData`**, and when **`VITE_IS_LOVABLE=true`** the app’s **`scripts/generate.ts`** still runs that step so paths stay in sync with committed **`wordpress-data.json`**. Sources merged:
+
+1. **`public/sitemap-static-paths.json`** — you maintain this for **React-only / Lovable** public routes (not inferred from code).
+2. **`navigation_menu`** items in **`wordpress-data.json`** (recursive `url` fields), filtered to **`http(s)`** and the CMS host from **`VITE_WORDPRESS_API_URL`** / **`WORDPRESS_API_URL`**.
+3. **`link`** on entities in top-level arrays whose keys match **`config.post_types`** (fallback: other top-level arrays minus a fixed skip list). Taxonomy archives are omitted by default.
+
+Paths are normalized (no trailing slash except **`/`**), deduped, and sorted. If generation fails, a safe fallback writes **`{ "paths": ["/"] }`**.
 
 ## Imports
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marvalt/digivalt-core",
-  "version": "0.2.9",
+  "version": "0.2.11",
   "description": "Core glue logic and shared context for DigiVAlt frontend applications",
   "license": "GPL-3.0-or-later",
   "main": "dist/index.cjs",
@@ -65,7 +65,8 @@
     "clean": "rimraf dist",
     "smoke:imports": "node ./scripts/smoke-imports.mjs",
     "smoke:init": "node ./scripts/smoke-init.cjs",
-    "smoke": "npm run smoke:imports && npm run smoke:init",
+    "smoke:sitemap": "node ./scripts/test-sitemap-paths.cjs",
+    "smoke": "npm run smoke:imports && npm run smoke:init && npm run smoke:sitemap",
     "prepublishOnly": "npm run clean && npm run build && npm run smoke"
   },
   "devDependencies": {

package/template/DIGIVALT_SETUP.md

@@ -84,7 +84,7 @@ Init will:
 1. Install **`react-helmet-async`** and wrap your app with **`HelmetProvider`** at the root (next to the router).
 2. Set at least **`VITE_SEO_SITE_URL`** (no trailing slash), **`VITE_SEO_SITE_NAME`**, **`VITE_SEO_DEFAULT_TITLE`**, **`VITE_SEO_DEFAULT_DESCRIPTION`**, and **`VITE_SEO_DEFAULT_OG_IMAGE`** in Cloudflare Pages / `.env.local`.
 3. Import **`DigiValtSeoHead`** and **`JsonLd`** from **`@marvalt/digivalt-core/seo`** in your layouts or page components; pass **`pathname`** per route for correct canonical URLs.
-4. **Sitemap:** After init, **`/sitemap.xml`** is served by **`functions/sitemap.xml.ts`** (Cloudflare Pages). Canonical URLs use **`VITE_SEO_SITE_URL`** (or **`SITE_URL`**); edit **`public/sitemap-paths.json`** (`{ "paths": ["/", "/about"] }`) when you add public routes. Do not add a static **`public/sitemap.xml`** (it would shadow the Function).
+4. **Sitemap:** **`/sitemap.xml`** is served by **`functions/sitemap.xml.ts`**. **`public/sitemap-paths.json`** is **generated** when you run **`npm run build`** (or `generate`): it merges (a) **`public/sitemap-static-paths.json`** — edit this for Lovable/SPA-only routes, (b) URLs from **`navigation_menu`** in **`wordpress-data.json`**, (c) **`link`** pathnames from CPT/post arrays listed under **`config.post_types`**. Only CMS links whose host matches **`VITE_WORDPRESS_API_URL`** / **`WORDPRESS_API_URL`** are included. Canonical `<loc>` values use **`VITE_SEO_SITE_URL`** (or **`SITE_URL`**). Do not add **`public/sitemap.xml`** (it would shadow the Function). With **`VITE_IS_LOVABLE=true`**, static fetch is skipped but sitemap paths are still regenerated from committed JSON.
 5. Read the full guide shipped with the package: **`node_modules/@marvalt/digivalt-core/docs/SEO-PERFORMANCE.md`** (or in the repo: `digivalt-npm-packages/digivalt-core/docs/SEO-PERFORMANCE.md`).
 
 You are fully onboarded and ready to develop offline!

package/template/functions/sitemap.xml.ts

@@ -1,5 +1,5 @@
 /**
- * Serves /sitemap.xml from canonical site URL + public/sitemap-paths.json (no WordPress).
+ * Serves /sitemap.xml from canonical site URL + public/sitemap-paths.json (generated at build).
  * Set VITE_SEO_SITE_URL (or SITE_URL) on Cloudflare Pages for production canonical hosts.
  */
 

package/template/public/sitemap-static-paths.json

@@ -0,0 +1,3 @@
+{
+  "paths": []
+}

package/template/scripts/deploy-secrets.js

@@ -11,10 +11,13 @@ import { execSync } from 'child_process';
  */
 
 const secrets = {};
+/** Keys we never push from .env / .env.local (local dev or set manually on Cloudflare Pages). */
 const excludedKeys = new Set([
   'NODE_ENV',
   'VITE_IS_LOVABLE',
   'VITE_LOCAL_DEVELOPMENT',
+  'VITE_AUTH_MODE',
+  'VITE_DEFAULT_MAX_ITEMS',
 ]);
 
 // VITE_SEO_* are often public (verification meta, titles); allow upload when teams store them as Pages secrets.
@@ -27,13 +30,7 @@ const allowedPatterns = [
   /^VITE_(WORDPRESS|WP|GF|GRAVITY_FORMS|FRONTEND|FRONTENDS|MAUTIC|SUITECRM|SUPABASE|CLOUDFLARE|AUTH|TURNSTILE|CHATWOOT|THEME|GOOGLE_|FACEBOOK_|LINKEDIN_)/,
 ];
 
-const isAllowedSecretKey = (key) => {
-  if (excludedKeys.has(key)) {
-    return false;
-  }
-
-  return allowedPatterns.some((pattern) => pattern.test(key));
-};
+const isAllowedSecretKey = (key) => allowedPatterns.some((pattern) => pattern.test(key));
 
 const parseEnvFile = (filePath) => {
   if (!fs.existsSync(filePath)) return;
@@ -51,6 +48,11 @@ const parseEnvFile = (filePath) => {
     const key = match[1].trim();
     let value = match[2].trim();
 
+    if (excludedKeys.has(key)) {
+      console.log(`⚠️ Skipping ${key} (DigiVAlt: excluded from Cloudflare bulk upload)`);
+      return;
+    }
+
     if (!isAllowedSecretKey(key)) {
       console.log(`⚠️ Skipping ${key} (not in DigiVAlt allowlist)`);
       return;

package/template/scripts/generate.ts

@@ -1,18 +1,22 @@
-import { generateAllData } from '@marvalt/digivalt-core/generators';
+import { generateAllData, generateSitemapPathsSafe } from '@marvalt/digivalt-core/generators';
 
 async function runGenerators() {
   console.log('🚀 Starting DigiVAlt static data generation for Landing Project...');
-  
+
   if (process.env.VITE_IS_LOVABLE === 'true') {
-     console.log('⚡ Lovable Environment Detected (VITE_IS_LOVABLE). Skipping static data generation to use GitHub synced files.');
-     return;
+    console.log(
+      '⚡ Lovable Environment Detected (VITE_IS_LOVABLE). Skipping static data fetch; refreshing sitemap paths from committed JSON.'
+    );
+    await generateSitemapPathsSafe();
+    return;
   }
-  
+
   try {
     await generateAllData();
     console.log('✅ Customized static generation complete!');
   } catch (error) {
     console.error('❌ Data fetching encountered an error, but continuing build gracefully:', error);
+    await generateSitemapPathsSafe();
   }
 }