@mohasinac/appkit 4.74.0 → 4.76.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.74.0",
-  "head": "69eb1a743d0233ce42a9b2836042d71958494e63",
+  "version": "4.76.0",
+  "head": "5da3ede2a94c94baadd8314d99ff43092dc5abd2",
   "branch": "main",
   "dirty": true,
-  "builtAt": "2026-11-09T01:51:49.655Z"
+  "builtAt": "2026-11-09T10:25:07.042Z"
 }

package/dist/_internal/server/features/seo/sitemap.d.ts

@@ -58,5 +58,37 @@ export interface SitemapOptions {
      * below exists to catch.
      */
     excludeSections?: readonly SitemapSection[];
+    /**
+     * Skip the SHOP's surface-visibility policy — for a host that OWNS the
+     * sections it is emitting.
+     *
+     * ## 🛑 Why this is necessary and not a loophole
+     *
+     * `keep()` below withholds any URL under a closed browse section, an
+     * unlisted listing-type route, or a `closedSurfacePrefix` derived from
+     * `siteSettings.disabledRoutes`. That is exactly right for the shop: a
+     * surface it has switched off must not be advertised.
+     *
+     * It is exactly WRONG for an extracted subdomain, and the reason is almost
+     * funny: the shop disables `/blog` **because the blog moved to
+     * `blogs.<domain>`**. The subdomain then reads the same settings document,
+     * sees `/blog` disabled, and withholds its own content.
+     *
+     * Measured on 2026-11-09, from the blogs build log:
+     *
+     *   sitemap: built  {"sections":{"blog":16},"total":0}
+     *
+     * Sixteen posts fetched, every one filtered out, and a valid empty
+     * `<urlset>` served with HTTP 200. The pages themselves rendered perfectly
+     * throughout — only the sitemap was gone.
+     *
+     * 🛑 It does NOT skip the section scope. `sections`/`excludeSections` still
+     * apply, so this cannot be used to make one host emit another's URLs. It
+     * only stops the SHOP's visibility flags from governing a host the shop does
+     * not serve.
+     *
+     * 🛑 Leave it UNSET on the shop. There, those flags are the whole point.
+     */
+    ownsSections?: boolean;
 }
-export declare function buildSitemap({ baseUrl, sections: only, excludeSections, }: SitemapOptions): Promise<MetadataRoute.Sitemap>;
+export declare function buildSitemap({ baseUrl, sections: only, excludeSections, ownsSections, }: SitemapOptions): Promise<MetadataRoute.Sitemap>;

package/dist/_internal/server/features/seo/sitemap.js

@@ -536,7 +536,7 @@ async function fetchScammerUrls(baseUrl) {
         return sitemapSectionFailed("scammer", err);
     }
 }
-export async function buildSitemap({ baseUrl, sections: only, excludeSections, }) {
+export async function buildSitemap({ baseUrl, sections: only, excludeSections, ownsSections = false, }) {
     /*
      * Which sections this host emits. See `SitemapOptions.sections` for why a
      * host must be able to answer this at all.
@@ -697,6 +697,12 @@ export async function buildSitemap({ baseUrl, sections: only, excludeSections, }
      */
     const closedPrefixes = closedSurfacePrefixes(settings);
     const keep = (entry) => {
+        /*
+         * A host that OWNS its sections is not governed by the shop's visibility
+         * flags — see `ownsSections`. The section scope above still applies.
+         */
+        if (ownsSections)
+            return true;
         const path = entry.url.startsWith("http")
             ? new URL(entry.url).pathname
             : entry.url;

package/dist/next/routing/portals.js

@@ -64,6 +64,29 @@ export const PORTAL_DEFINITIONS = [
      * this module exists to end.
      */
     { label: "auth", section: "/auth", roles: [], home: "/auth/login" },
+    /*
+     * ── help: a PORTAL, not a deployment (owner, 2026-11-09) ──────────────
+     *
+     * The plan had `help.<domain>` down as its own app alongside blogs and
+     * events. The owner's answer was "do like dashboards" — i.e. a host rewrite
+     * onto the main app, the same treatment `admin.`/`seller.`/`user.` get, and
+     * NOT a deployment.
+     *
+     * It is the right call for this surface: `/help` is six content pages with
+     * ZERO API routes (measured 2026-11-09). Everything the subdomain split buys
+     * — an independently deployable owner of its own data, exposing CRUD over
+     * HTTP — is worth nothing when there is no data and no CRUD. It would be a
+     * whole deployment, Vercel project, env set and CORS gate to serve six static
+     * pages the shop already renders.
+     *
+     * Consequently `help` is REMOVED from DEPLOYMENT_LABELS below. A label must
+     * be in exactly one of the two lists: in both, the deployment check wins and
+     * the rewrite silently never fires.
+     *
+     * `roles: []` like `auth` — the help centre is public, and a visitor with no
+     * account is precisely who needs it.
+     */
+    { label: "help", section: "/help", roles: [] },
 ];
 /**
  * Hosts that are their OWN DEPLOYMENT, not a portal of this app.
@@ -93,8 +116,20 @@ export const DEPLOYMENT_LABELS = [
     "blogs",
     "live",
     "media",
-    "help",
-    "chat",
+    /*
+     * 🛑 `help` WAS HERE and has moved to PORTAL_DEFINITIONS above — the
+     * owner chose a host rewrite over a deployment for it (2026-11-09). A label
+     * in BOTH lists is the bug this note exists to prevent: `isDeploymentHost`
+     * is consulted first, so the portal rewrite would silently never fire and
+     * `help.<domain>` would fall through to the homepage — exactly the duplicate
+     * content CLAUDE.md records for `audit.` and `tools.`.
+     *
+     * ⚠ `chat` IS ALSO ABSENT, and for a different reason: there is nothing to
+     * serve. `/chat` has ZERO pages in the shop (measured 2026-11-09), so making
+     * it a portal would rewrite `chat.<domain>` onto a 404, and making it a
+     * deployment would point a hostname at an app that does not exist. It joins
+     * one list or the other when it has a surface — not before.
+     */
 ];
 /** Is this hostname a separate deployment rather than a portal of this app? */
 export function isDeploymentHost(hostname) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.74.0",
+  "version": "4.76.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"