@mohasinac/appkit 4.75.0 → 4.76.0

package/dist/.build-stamp.json

@@ -1,8 +1,8 @@
 {
   "stampVersion": 1,
-  "version": "4.75.0",
-  "head": "c5426d7535f8b4331464486d52298a6f668168ee",
+  "version": "4.76.0",
+  "head": "5da3ede2a94c94baadd8314d99ff43092dc5abd2",
   "branch": "main",
   "dirty": true,
-  "builtAt": "2026-11-09T07:08:58.762Z"
+  "builtAt": "2026-11-09T10:25:07.042Z"
 }

package/dist/_internal/server/features/seo/sitemap.d.ts

@@ -58,5 +58,37 @@ export interface SitemapOptions {
      * below exists to catch.
      */
     excludeSections?: readonly SitemapSection[];
+    /**
+     * Skip the SHOP's surface-visibility policy — for a host that OWNS the
+     * sections it is emitting.
+     *
+     * ## 🛑 Why this is necessary and not a loophole
+     *
+     * `keep()` below withholds any URL under a closed browse section, an
+     * unlisted listing-type route, or a `closedSurfacePrefix` derived from
+     * `siteSettings.disabledRoutes`. That is exactly right for the shop: a
+     * surface it has switched off must not be advertised.
+     *
+     * It is exactly WRONG for an extracted subdomain, and the reason is almost
+     * funny: the shop disables `/blog` **because the blog moved to
+     * `blogs.<domain>`**. The subdomain then reads the same settings document,
+     * sees `/blog` disabled, and withholds its own content.
+     *
+     * Measured on 2026-11-09, from the blogs build log:
+     *
+     *   sitemap: built  {"sections":{"blog":16},"total":0}
+     *
+     * Sixteen posts fetched, every one filtered out, and a valid empty
+     * `<urlset>` served with HTTP 200. The pages themselves rendered perfectly
+     * throughout — only the sitemap was gone.
+     *
+     * 🛑 It does NOT skip the section scope. `sections`/`excludeSections` still
+     * apply, so this cannot be used to make one host emit another's URLs. It
+     * only stops the SHOP's visibility flags from governing a host the shop does
+     * not serve.
+     *
+     * 🛑 Leave it UNSET on the shop. There, those flags are the whole point.
+     */
+    ownsSections?: boolean;
 }
-export declare function buildSitemap({ baseUrl, sections: only, excludeSections, }: SitemapOptions): Promise<MetadataRoute.Sitemap>;
+export declare function buildSitemap({ baseUrl, sections: only, excludeSections, ownsSections, }: SitemapOptions): Promise<MetadataRoute.Sitemap>;

package/dist/_internal/server/features/seo/sitemap.js

@@ -536,7 +536,7 @@ async function fetchScammerUrls(baseUrl) {
         return sitemapSectionFailed("scammer", err);
     }
 }
-export async function buildSitemap({ baseUrl, sections: only, excludeSections, }) {
+export async function buildSitemap({ baseUrl, sections: only, excludeSections, ownsSections = false, }) {
     /*
      * Which sections this host emits. See `SitemapOptions.sections` for why a
      * host must be able to answer this at all.
@@ -697,6 +697,12 @@ export async function buildSitemap({ baseUrl, sections: only, excludeSections, }
      */
     const closedPrefixes = closedSurfacePrefixes(settings);
     const keep = (entry) => {
+        /*
+         * A host that OWNS its sections is not governed by the shop's visibility
+         * flags — see `ownsSections`. The section scope above still applies.
+         */
+        if (ownsSections)
+            return true;
         const path = entry.url.startsWith("http")
             ? new URL(entry.url).pathname
             : entry.url;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mohasinac/appkit",
-  "version": "4.75.0",
+  "version": "4.76.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"