@opnpress/opnpress-cli 0.1.1 → 0.2.0

package/README.md

@@ -61,7 +61,10 @@ Release flow:
 5. Update `package.json` version.
 6. Create and push a tag such as `v0.1.1`.
 7. GitHub Actions runs build, test, and `npm publish --access public`.
-8. npm generates provenance automatically and GitHub creates a release for the tag.
+8. npm publishes `@opnpress/opnpress-cli` and GitHub creates a release for the tag.
+
+Provenance is only generated automatically when the source repository is public.
+If this GitHub repository stays private, publish without `--provenance`.
 
 The package is org-scoped and public, so `npm` treats each `name + version` combination as permanent once published.
 

package/dist/build.js

@@ -1,5 +1,6 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
+import sharp from 'sharp';
 import { unified } from 'unified';
 import remarkParse from 'remark-parse';
 import remarkGfm from 'remark-gfm';
@@ -7,7 +8,7 @@ import YAML from 'yaml';
 import { loadNavigationConfig, loadSiteConfig, loadThemeConfig } from './config.js';
 import { buildPageTitle, isPublished, loadContentSources } from './content.js';
 import { buildPageArtifact, writeRenderedPage } from './render.js';
-import { escapeHtml, ensureDir, writeFileEnsured } from './utils.js';
+import { escapeHtml, ensureDir, walkFiles, writeFileEnsured } from './utils.js';
 async function removeIfExists(target) {
     await fs.rm(target, { recursive: true, force: true });
 }
@@ -21,6 +22,112 @@ async function copyPublicAssets(rootDir, distDir) {
     }
     await fs.cp(publicDir, distDir, { recursive: true, force: true });
 }
+function isStaticAssetPath(pathname) {
+    return /\.(avif|bmp|css|gif|ico|jpe?g|js|png|svg|webp|woff2?|ttf|otf|pdf)$/i.test(pathname);
+}
+function isMachineReadablePath(pathname) {
+    return /\.(html?|json|md|xml|txt)$/i.test(pathname);
+}
+function toHeadersPath(relativeFilePath) {
+    return `/${relativeFilePath.replace(/\\/g, '/')}`;
+}
+function normalizeAnalyticsId(value) {
+    if (!value) {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    if (!/^G-[A-Z0-9][A-Z0-9-]*$/i.test(trimmed)) {
+        return undefined;
+    }
+    return trimmed;
+}
+async function prepareHeaderLogoAsset(rootDir, distDir, logoPath) {
+    if (!logoPath) {
+        return undefined;
+    }
+    if (/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(logoPath) || logoPath.startsWith('data:')) {
+        return logoPath;
+    }
+    const normalizedLogoPath = logoPath.replace(/^\/+/, '');
+    const sourceLogoPath = path.join(rootDir, 'public', normalizedLogoPath);
+    try {
+        await fs.access(sourceLogoPath);
+    }
+    catch {
+        return logoPath;
+    }
+    if (path.extname(normalizedLogoPath).toLowerCase() === '.svg') {
+        return `/${normalizedLogoPath}`;
+    }
+    const resizedLogoPath = normalizedLogoPath.replace(/\.(png|jpe?g|webp|avif|gif)$/i, '.opnpress.webp');
+    const outputPath = path.join(distDir, resizedLogoPath);
+    await fs.mkdir(path.dirname(outputPath), { recursive: true });
+    await sharp(sourceLogoPath)
+        .resize({ width: 72, height: 72, fit: 'inside', withoutEnlargement: true })
+        .webp({ quality: 82 })
+        .toFile(outputPath);
+    return `/${resizedLogoPath}`;
+}
+function extractAnchorLinks(html) {
+    const links = [];
+    const pattern = /<a\b[^>]*href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi;
+    let match;
+    while ((match = pattern.exec(html))) {
+        const text = stripHtmlMarkup(match[2]).replace(/\s+/g, ' ').trim();
+        links.push({ href: match[1], text });
+    }
+    return links;
+}
+function duplicateLinkWarnings(html, currentRoute) {
+    const counts = new Map();
+    const labels = new Map();
+    for (const link of extractAnchorLinks(html)) {
+        if (!link.href || !link.text) {
+            continue;
+        }
+        const key = `${link.href}|||${link.text.toLowerCase()}`;
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+        labels.set(key, `${link.text} -> ${link.href}`);
+    }
+    return [...counts.entries()]
+        .filter(([, count]) => count > 1)
+        .map(([key, count]) => `Duplicate link purpose detected on ${currentRoute}: ${labels.get(key)} appears ${count} times.`);
+}
+function generatedRobotsTxt(siteDomain) {
+    const sitemapUrl = new URL('sitemap.xml', getSiteBaseUrl(siteDomain)).toString();
+    return `User-agent: *\nAllow: /\nSitemap: ${sitemapUrl}\n`;
+}
+function generatedHeaders(pageOutputs, assetOutputs) {
+    const securityHeaders = [
+        `  Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; script-src 'self' https://www.googletagmanager.com 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com https://www.googletagmanager.com; form-action 'self' https:; frame-src 'self' https:; require-trusted-types-for 'script'`,
+        '  Cross-Origin-Opener-Policy: same-origin',
+        '  Cross-Origin-Resource-Policy: same-site',
+        '  Permissions-Policy: camera=(), geolocation=(), microphone=(), payment=()',
+        '  Referrer-Policy: strict-origin-when-cross-origin',
+        '  Strict-Transport-Security: max-age=31536000; includeSubDomains',
+        '  X-Content-Type-Options: nosniff',
+        '  X-Frame-Options: SAMEORIGIN',
+        '  X-Permitted-Cross-Domain-Policies: none'
+    ];
+    const lines = [];
+    for (const outputPath of [...pageOutputs, '/robots.txt']) {
+        lines.push(outputPath);
+        for (const header of securityHeaders) {
+            lines.push(header);
+        }
+        lines.push('  Cache-Control: public, max-age=0, must-revalidate');
+        lines.push('');
+    }
+    for (const outputPath of assetOutputs) {
+        lines.push(outputPath);
+        for (const header of securityHeaders) {
+            lines.push(header);
+        }
+        lines.push('  Cache-Control: public, max-age=31536000, immutable');
+        lines.push('');
+    }
+    return `${lines.join('\n').trimEnd()}\n`;
+}
 function getSiteBaseUrl(domain) {
     if (/^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(domain)) {
         return domain.endsWith('/') ? domain : `${domain}/`;
@@ -33,14 +140,16 @@ function isExternalUrl(url) {
 function isIgnoredLink(url) {
     return url.startsWith('#') || url.startsWith('mailto:') || url.startsWith('tel:') || url.startsWith('javascript:');
 }
-function isStaticAssetPath(pathname) {
-    return /\.(png|jpe?g|gif|webp|svg|ico|css|js|json|xml|txt)$/i.test(pathname);
-}
 function isSourceMirrorPath(pathname) {
     return pathname === '/source.md' || pathname === '/source.html' || pathname.endsWith('/source.md') || pathname.endsWith('/source.html');
 }
 function isGeneratedDocPath(pathname) {
-    return pathname === '/fullSiteContent.md' || pathname.endsWith('/fullSiteContent.md');
+    return (pathname === '/fullSiteContent.md' ||
+        pathname === '/llms.txt' ||
+        pathname === '/shortcodes.md' ||
+        pathname.endsWith('/fullSiteContent.md') ||
+        pathname.endsWith('/llms.txt') ||
+        pathname.endsWith('/shortcodes.md'));
 }
 function extractLinks(html) {
     const links = [];
@@ -466,20 +575,54 @@ export async function buildSite(rootDir = process.cwd()) {
     const knownRoutes = new Set(published.map((source) => source.routePath));
     const shortcodesDoc = await readOptionalTextFile(rootDir, '.skills/shortcodes.md');
     const shortcodesUrl = shortcodesDoc ? 'shortcodes.md' : undefined;
+    const configuredAnalyticsId = site.integrations.analytics.id ?? site.integrations.analytics.measurementId;
+    const normalizedAnalyticsId = normalizeAnalyticsId(configuredAnalyticsId);
+    if (configuredAnalyticsId && !normalizedAnalyticsId) {
+        console.warn('Skipping analytics because the configured analytics ID is incomplete or invalid.');
+    }
+    const renderSite = normalizedAnalyticsId
+        ? {
+            ...site,
+            integrations: {
+                ...site.integrations,
+                analytics: {
+                    ...site.integrations.analytics,
+                    id: normalizedAnalyticsId,
+                    measurementId: normalizedAnalyticsId
+                }
+            }
+        }
+        : {
+            ...site,
+            integrations: {
+                ...site.integrations,
+                analytics: {
+                    ...site.integrations.analytics,
+                    id: undefined,
+                    measurementId: undefined
+                }
+            }
+        };
+    await copyPublicAssets(rootDir, distDir);
+    const headerLogoUrl = await prepareHeaderLogoAsset(rootDir, distDir, site.site.logo);
     const llmsPages = [];
     const sitemapPages = [];
     for (const source of published) {
         const artifact = await buildPageArtifact({
             source,
-            site,
+            site: renderSite,
             theme,
             navigation,
-            allPublishedSources: published
+            allPublishedSources: published,
+            headerLogoUrl
         });
         const outputPath = routeToOutputPath(distDir, source.routePath, 'index.html');
         const jsonPath = routeToOutputPath(distDir, source.routePath, 'page.json');
         const sourceMirrorPath = routeToOutputPath(distDir, source.routePath, artifact.sourceMirror?.path ?? 'source.md');
         validateInternalLinks(artifact.html, source.routePath, site.site.domain, knownRoutes);
+        for (const warning of duplicateLinkWarnings(artifact.html, source.routePath)) {
+            console.warn(warning);
+        }
         await writeRenderedPage(outputPath, artifact.html);
         await writeFileEnsured(jsonPath, pageJsonToText(artifact.pageJson));
         await writeFileEnsured(sourceMirrorPath, artifact.sourceMirror?.content ?? '');
@@ -497,7 +640,6 @@ export async function buildSite(rootDir = process.cwd()) {
             updated: artifact.pageJson.updated
         });
     }
-    await copyPublicAssets(rootDir, distDir);
     if (shortcodesDoc) {
         await writeFileEnsured(path.join(distDir, 'shortcodes.md'), shortcodesDoc);
     }
@@ -511,6 +653,28 @@ export async function buildSite(rootDir = process.cwd()) {
     await writeFileEnsured(path.join(distDir, 'fullSiteContent.md'), fullSiteContentMarkdown);
     await writeFileEnsured(path.join(distDir, 'llms.txt'), llmsTextFromPages(site.site.name, site.site.description, llmsPages, 'fullSiteContent.md', shortcodesUrl));
     await writeFileEnsured(path.join(distDir, 'sitemap.xml'), sitemapXmlFromPages(site.site.domain, sitemapPages));
+    const distFiles = await walkFiles(distDir);
+    const generatedPageOutputs = new Set();
+    const generatedAssetOutputs = new Set();
+    for (const filePath of distFiles) {
+        const relativePath = toHeadersPath(path.relative(distDir, filePath));
+        if (relativePath === '/_headers' || relativePath === '/robots.txt') {
+            continue;
+        }
+        if (isMachineReadablePath(filePath)) {
+            generatedPageOutputs.add(relativePath);
+            continue;
+        }
+        if (isStaticAssetPath(filePath)) {
+            generatedAssetOutputs.add(relativePath);
+        }
+    }
+    await writeFileEnsured(path.join(distDir, '_headers'), generatedHeaders([...generatedPageOutputs].sort(), [...generatedAssetOutputs].sort()));
+    await writeFileEnsured(path.join(distDir, 'robots.txt'), generatedRobotsTxt(site.site.domain));
+    const robotsContents = await fs.readFile(path.join(distDir, 'robots.txt'), 'utf8');
+    if (!robotsContents.includes('Sitemap: ')) {
+        throw new Error('Generated robots.txt is missing the sitemap reference.');
+    }
     console.log(`Built ${published.length} pages into ${distDir}`);
     console.log(`Site: ${site.site.name}`);
     const homePage = published.find((page) => page.routePath === '/') ?? published[0];

package/dist/config.js

@@ -83,6 +83,7 @@ const BookingCalendarIntegrationSchema = z.object({
 });
 const AnalyticsIntegrationSchema = z.object({
     provider: z.enum(['google-analytics']).default('google-analytics'),
+    id: z.string().min(1).optional(),
     measurementId: z.string().min(1).optional()
 });
 const MapsIntegrationSchema = z.object({

package/dist/render.js

@@ -658,8 +658,8 @@ function discoveryHeadMarkup(params) {
 function normalizeShortcodeText(value) {
     return typeof value === 'string' && value.trim() ? value.trim() : undefined;
 }
-function analyticsSnippet(measurementId) {
-    const escapedId = escapeHtml(measurementId);
+function analyticsSnippet(analyticsId) {
+    const escapedId = escapeHtml(analyticsId);
     return `
     <script async src="https://www.googletagmanager.com/gtag/js?id=${escapedId}"></script>
     <script>
@@ -1791,7 +1791,7 @@ function buildThemeCss(theme) {
   `;
 }
 export async function buildPageArtifact(params) {
-    const { source, site, theme, navigation, allPublishedSources } = params;
+    const { source, site, theme, navigation, allPublishedSources, headerLogoUrl } = params;
     const title = buildPageTitle(source, site.site.name);
     const description = source.frontmatter.description ?? site.site.description ?? '';
     const canonicalUrl = source.frontmatter.canonical
@@ -1840,13 +1840,14 @@ export async function buildPageArtifact(params) {
         description,
         url: canonicalUrl
     };
-    const analytics = site.integrations.analytics.measurementId
-        ? analyticsSnippet(site.integrations.analytics.measurementId)
+    const analyticsId = site.integrations.analytics.id ?? site.integrations.analytics.measurementId;
+    const analytics = analyticsId
+        ? analyticsSnippet(analyticsId)
         : '';
     const poweredBy = site.branding.poweredByOpnPress
         ? `<a class="nav-link" href="https://opnpress.com" rel="noopener noreferrer">Built with OpnPress</a>`
         : '';
-    const logoUrl = site.site.logo ? hrefForAsset(source.routePath, site.site.logo) : '';
+    const logoUrl = headerLogoUrl ?? (site.site.logo ? hrefForAsset(source.routePath, site.site.logo) : '');
     const faviconAsset = site.site.favicon ?? site.site.logo;
     const faviconUrl = faviconAsset ? hrefForAsset(source.routePath, faviconAsset) : '';
     const twitterSiteHandle = socialMetaHandle(site.socials.twitter ?? site.socials.x);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opnpress/opnpress-cli",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "repository": {
@@ -34,6 +34,7 @@
     "rehype-raw": "^7.0.0",
     "rehype-slug": "^6.0.0",
     "rehype-stringify": "^10.0.1",
+    "sharp": "^0.34.4",
     "remark-gfm": "^4.0.1",
     "remark-parse": "^11.0.0",
     "remark-rehype": "^11.1.2",

package/templates/.github/workflows/build-pages.yml

@@ -24,10 +24,9 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: '22'
-          cache: npm
 
       - name: Build site
-        run: npx -y @opnpress/opnpress-cli@latest opnPress build
+        run: npx --yes @opnpress/opnpress-cli@latest build
 
       - name: Publish to Cloudflare Pages
         uses: cloudflare/wrangler-action@v3

package/templates/.skills/README.md

@@ -4,3 +4,4 @@ This folder stores starter guidance for building an OpnPress site.
 
 The files here are copied by `opnPress init`, so edit the templates in this repository to change the scaffold.
 Key starter skills include page editing, navigation, integrations, and audits.
+Build-enforced concerns such as `robots.txt`, headers, and logo optimization should be treated as generator behavior, not as manual content edits.

package/templates/.skills/setup-integrations.md

@@ -5,6 +5,7 @@ Use this skill when adding or changing integrations.
 ## What To Do
 
 - define the provider in `site.config.yaml`
+- use the public analytics ID field when tracking is enabled
 - author the semantic block in markdown
 - keep the content provider-agnostic
 - prefer integration-backed blocks for shared site data
@@ -64,6 +65,7 @@ Each value can be a handle or a full URL. The renderer converts handles into pub
 - `site.socials.*` for social identity links
 - `site.branding.poweredByOpnPress` for footer attribution
 - `site.deployment.provider` and `site.deployment.cloudflare.*` for publishing
+- `site.integrations.analytics.id` for production-only analytics tracking
 - `site.integrations.contactForm.*`
 - `site.integrations.shareableLinks.*`
 - `site.integrations.companyInfo.*`
@@ -81,4 +83,4 @@ Each value can be a handle or a full URL. The renderer converts handles into pub
 - verify required config values are present
 - verify the block renders instead of falling back to escaped code
 - verify the resulting links stay relative when they should
-
+- verify analytics is omitted when the ID is missing or incomplete

package/templates/.skills/site-audit.md

@@ -4,17 +4,18 @@ Use this skill when checking a site for missing pieces and recommending fixes.
 
 ## What To Check
 
-- required frontmatter fields
+- duplicate links with the same purpose
 - page titles and descriptions
 - canonical and social metadata
-- navigation completeness
-- footer branding
+- heading structure and semantic ordering
+- sitemap coverage and reachable content
+- footer branding and attribution
 - integration config presence
-- build output completeness
+- SEO gaps that affect crawl or clarity
 
 ## Output Style
 
 - list what is missing
 - explain the impact
 - recommend the next fix in file terms
-
+- separate content issues from build-enforced issues

package/templates/.skills/theme-customization.md

@@ -9,9 +9,10 @@ Use this skill when changing the site theme.
 - fonts
 - sizing
 - limited layout controls
+- logo asset choices and displayed size
 
 ## Recommended Checks
 
 - verify the theme still reads well on mobile
 - verify contrast and spacing remain usable
-
+- verify the header logo fits the intended slot cleanly

package/templates/.skills/update-header-footer.md

@@ -7,9 +7,10 @@ Use this skill when changing global header or footer content.
 - edit the site shell, not individual pages, for global header/footer changes
 - keep branding links intentional
 - preserve readable navigation on mobile
+- keep repeated destinations out of visible labels unless duplication is deliberate
 
 ## Recommended Checks
 
 - verify the header still links home correctly
 - verify the footer still includes required brand or attribution links
-
+- verify the same destination is not repeated with confusing labels

package/templates/.skills/update-navigation.md

@@ -8,9 +8,10 @@ Use this skill when editing site navigation.
 - keep labels short and clear
 - use relative internal paths for site pages
 - keep external links explicit
+- avoid repeated destinations unless the label and purpose are intentionally different
 
 ## Recommended Checks
 
 - verify every internal navigation target exists
 - verify footer and header nav stay consistent with the site structure
-
+- verify duplicate destinations are intentional

package/templates/site.config.yaml

@@ -30,13 +30,6 @@ site:
 # branding:
 #   poweredByOpnPress: true
 
-# Deployment target for the GitHub Actions workflow.
-# deployment:
-#   provider: cloudflare-pages
-#   cloudflare:
-#     projectName: opnpress
-#     productionBranch: master
-
 # Integrations and reusable contact blocks are rendered from markdown shortcodes.
 # integrations:
 #   contactForm:
@@ -74,7 +67,7 @@ site:
 #     buttonLabel: Book a call
 #   analytics:
 #     provider: google-analytics
-#     measurementId: G-EXAMPLE
+#     id: G-EXAMPLE
 #   maps:
 #     provider: google-maps
 #     embedUrl: https://www.google.com/maps?q=Chicago&output=embed