@taprootio/site-authoring 0.27.0 → 0.27.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@taprootio/site-authoring",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "Taproot site authoring CLI: sign in once in the browser, then pull, validate, push, preview, approve, and deploy a site from the terminal",
   "type": "module",
   "license": "ISC",

package/src/changelog.json

@@ -1,5 +1,16 @@
 {
   "entries": [
+    {
+      "version": "0.27.1",
+      "note": "The site checks refuse a page or redirect source named like a search-engine key file, which the platform now publishes at the site root.",
+      "behavior": [
+        "A redirect source whose first segment is 32 lowercase hexadecimal characters followed by .txt (any capitals, with or without a path beneath it) is refused with redirect.source_generated_file, like sitemap.xml and robots.txt. Taproot writes a file with that name at the root of a site that tells search engines about its releases, so nothing else can sit there. No command changed.",
+        "The help reference version is 45."
+      ],
+      "help": [
+        "redirects"
+      ]
+    },
     {
       "version": "0.27.0",
       "note": "Embedded forms inherit configurable background, border and shadow defaults from the site, with per-form overrides.",

package/src/reference-help.js

@@ -95,7 +95,7 @@ import {
 
 export { getAppearanceReference, getFooterReference, getSettingsReference, getThemeReference };
 
-export const REFERENCE_VERSION = 44;
+export const REFERENCE_VERSION = 45;
 
 // The date-limit examples `help forms` prints; tests run them through the form validator.
 export const FORM_DATE_WINDOW_FIELD = Object.freeze({
@@ -786,7 +786,9 @@ const WORKFLOW_REFERENCES = Object.freeze({
       + "check does not see may belong to a release the edge has not switched to yet; deploy --staging waits for "
       + "staging to serve the new release and reports stagingServed.",
       "A source cannot name a file the site generates: '/index.html' or any page's own 'index.html', '/404.html', "
-      + "'/sitemap.xml', '/robots.txt', '/favicon.ico', or a path under the sitemap or robots names. Nothing under "
+      + "'/sitemap.xml', '/robots.txt', '/favicon.ico', a path under the sitemap or robots names, or the "
+      + "search-engine key file Taproot publishes when a site tells search engines about its releases (32 "
+      + "lowercase hexadecimal characters followed by '.txt', in any capitals). Nothing under "
       + "'/taproot/<version>/' (for example '/taproot/5.0.62/manifest.json') can be a source either: the platform "
       + "serves the published-site runtime there before any redirect. The platform "
       + "already redirects every '…/index.html' address to its directory, so no entry is needed for one. A source "

package/src/site-checks.js

@@ -280,6 +280,8 @@ export function normalizeRedirectPath(value) {
     return trimmed === "" ? "/" : trimmed;
 }
 const GENERATED_ROOT_FILES = ["404.html", "sitemap.xml", "robots.txt", "favicon.ico"];
+// The IndexNow key file (TR01304) is named by a pattern, so it cannot join the list above.
+const INDEX_NOW_KEY_FILE = /^[a-f0-9]{32}\.txt$/u;
 const INTEGRATION_DATA_ROOT = "integrations";
 const MAX_MARKER_SEGMENT_BYTES = 200;
 const MAX_OUTPUT_PATH_LENGTH = 1_024;
@@ -317,8 +319,9 @@ export function redirectSourceRule(edgePath) {
         return refuse(RULE_REDIRECT_SOURCE_INTEGRATION_DATA);
     if (isRuntimeMirrorPath(decoded))
         return refuse(RULE_REDIRECT_SOURCE_RUNTIME_MIRROR);
-    if (GENERATED_ROOT_FILES.includes(first.toLowerCase()))
+    if (GENERATED_ROOT_FILES.includes(first.toLowerCase()) || INDEX_NOW_KEY_FILE.test(first.toLowerCase())) {
         return refuse(RULE_REDIRECT_SOURCE_GENERATED_FILE);
+    }
     if (!isStorable(decoded))
         return refuse(RULE_REDIRECT_SOURCE_NOT_STORABLE);
     return undefined;