@the-smithy/hearth 0.24.1 → 0.26.0

package/README.md

@@ -52,6 +52,11 @@ curl -H "Authorization: Bearer $HEARTH_API_KEY" https://hearth.thesmithy.io/admi
 
 Keep `hearth-api.md` out of git, and the key out of chat: the agent only needs it in `.env.local`.
 
+## Hosting
+
+Netlify and Vercel both work with no host-specific code. Sites made from the starter have a guide to each in
+`HOSTING.md`, and `llms.md` has the short version.
+
 ## Documentation
 
 Once you have developer access, the full documentation (every method, Next.js helpers, rendering blocks,

package/dist/next.d.ts

@@ -5,6 +5,11 @@ import { Metadata, MetadataRoute } from 'next';
 
 /** Holds the preview token while Next.js draft mode is on. */
 declare const PREVIEW_COOKIE = "hearth-preview";
+/**
+ * The visitor's IP. Netlify's own header only counts on Netlify, whose functions always have SITE_ID: anywhere else a
+ * visitor could send it themselves to get round the rate limits. Vercel overwrites x-forwarded-for, so it's safe there.
+ */
+declare const clientIp: (h: Headers) => string | null;
 /**
  * Whether this deploy is a preview or branch deploy (Netlify's CONTEXT, Vercel's VERCEL_ENV), which search engines
  * shouldn't index: only the production deploy is the real site.
@@ -254,7 +259,7 @@ declare function createHearthNext(client: HearthCore, { tag, revalidate }?: Hear
     sitemap(): Promise<MetadataRoute.Sitemap>;
     /**
      * Hearth's sitemap plus pages the site's own code serves (an events calendar, a donate page), skipping any
-     * Hearth already lists:
+     * Hearth already lists and any that a page in Hearth at that address hides from search engines:
      *   export default hearthNext.sitemapWith(["/events", "/fundraisers"]);
      */
     sitemapWith(paths: string[]): () => Promise<MetadataRoute.Sitemap>;
@@ -285,4 +290,4 @@ declare function createHearthNext(client: HearthCore, { tag, revalidate }?: Hear
     submitFormAction: (formKey: string) => (_prev: FormResult | null, formData: FormData) => Promise<FormResult>;
 };
 
-export { type HearthNextOptions, PREVIEW_COOKIE, createHearthNext, isNonProductionDeploy, metadataFromMeta, siteBaseUrl, siteLang };
+export { type HearthNextOptions, PREVIEW_COOKIE, clientIp, createHearthNext, isNonProductionDeploy, metadataFromMeta, siteBaseUrl, siteLang };

package/dist/next.js

@@ -18,7 +18,7 @@ async function previewToken() {
   if (!(await draftMode()).isEnabled) return void 0;
   return (await cookies()).get(PREVIEW_COOKIE)?.value;
 }
-var clientIp = (h) => h.get("x-nf-client-connection-ip") ?? h.get("x-forwarded-for")?.split(",")[0]?.trim() ?? h.get("x-real-ip");
+var clientIp = (h) => (process.env.SITE_ID ? h.get("x-nf-client-connection-ip") : null) ?? h.get("x-forwarded-for")?.split(",")[0]?.trim() ?? h.get("x-real-ip");
 var safePath = (path) => path && path.startsWith("/") && !path.startsWith("//") ? path : "/";
 var isNonProductionDeploy = () => {
   const netlify = process.env.CONTEXT;
@@ -276,15 +276,15 @@ function createHearthNext(client, { tag = "hearth", revalidate = 3600 } = {}) {
     },
     /**
      * Hearth's sitemap plus pages the site's own code serves (an events calendar, a donate page), skipping any
-     * Hearth already lists:
+     * Hearth already lists and any that a page in Hearth at that address hides from search engines:
      *   export default hearthNext.sitemapWith(["/events", "/fundraisers"]);
      */
     sitemapWith(paths) {
       return async () => {
-        const [entries, site] = await Promise.all([client.sitemap(tags(`${tag}:pages`, `${tag}:events`)), client.site.get(tags(`${tag}:site`))]);
+        const [entries, site, pages] = await Promise.all([client.sitemap(tags(`${tag}:pages`, `${tag}:events`)), client.site.get(tags(`${tag}:site`)), client.pages.list(tags(`${tag}:pages`))]);
         const base = siteBaseUrl(site) ?? "";
-        const listed = new Set(entries.map((e) => e.path));
-        const extra = site.settings.seo.noIndex ? [] : paths.filter((p) => !listed.has(p)).map((p) => ({ url: `${base}${p}`, priority: 0.6 }));
+        const skip = /* @__PURE__ */ new Set([...entries.map((e) => e.path), ...pages.filter((p) => p.noIndex).map((p) => p.path)]);
+        const extra = site.settings.seo.noIndex ? [] : paths.filter((p) => !skip.has(p)).map((p) => ({ url: `${base}${p}`, priority: 0.6 }));
         return [...entries.map((e) => ({ url: e.url, ...e.lastModified ? { lastModified: e.lastModified } : {}, priority: e.priority })), ...extra];
       };
     },
@@ -332,6 +332,7 @@ function createHearthNext(client, { tag = "hearth", revalidate = 3600 } = {}) {
 }
 export {
   PREVIEW_COOKIE,
+  clientIp,
   createHearthNext,
   isNonProductionDeploy,
   metadataFromMeta,

package/dist/testing.js

@@ -1,4 +1,5 @@
 // src/testing.ts
+import { isUnlistedPage } from "@the-smithy/hearth-schema";
 var json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });
 var notFound = () => json({ error: { code: "not_found", message: "Not found" } }, 404);
 function createMockHearth(data = {}) {
@@ -30,7 +31,7 @@ function createMockHearth(data = {}) {
       return result.ok ? json({ data: { message: result.message } }, 201) : json({ error: { code: "bad_request", message: result.message, details: result.fieldErrors } }, 400);
     }
     if (rest === "") return json({ data: { slug, name: slug, domain: null, features: [], settings: {}, ...data.site } });
-    if (rest === "/pages") return json({ data: (data.pages ?? []).map(({ slug: slug2, path, title, seo, publishedAt }) => ({ slug: slug2, path, title, seo, noIndex: false, publishedAt })) });
+    if (rest === "/pages") return json({ data: (data.pages ?? []).map(({ slug: slug2, path, title, seo, publishedAt }) => ({ slug: slug2, path, title, seo, noIndex: Boolean(seo?.noIndex) || isUnlistedPage(slug2), publishedAt })) });
     if (rest.startsWith("/pages/")) {
       const pool = req.headers.get("x-hearth-preview") ? [...data.draftPages ?? [], ...data.pages ?? []] : data.pages ?? [];
       const page = pool.find((p) => p.slug === decodeURIComponent(rest.slice(7)));

package/llms.md

@@ -6,7 +6,7 @@ client components: the API key is secret.
 ## Setup
 - Sites made with `pnpm create @the-smithy/hearth-site` already have all of this, and every block, page and form,
   in `src/hearth/` (the client is `@/hearth/client`). Don't rebuild them: style the site in `src/theme/` (tokens,
-  and Tailwind classes per slot; `src/hearth/theme/defaults.ts` lists the slots) and read the site's `CLAUDE.md`.
+  and Tailwind classes per slot; `src/hearth/theme/defaults.ts` lists the slots) and read the site's `AGENTS.md`.
   `pnpm hearth:update` brings in new releases. The rest of this section is for other Next.js apps.
 - `pnpm add @the-smithy/hearth` (public on npm; no registry config or token needed). It's useless without a
   Hearth site's API key. The full guide is in Hearth under API docs (Markdown download).
@@ -62,6 +62,7 @@ client components: the API key is secret.
 - `PageMeta`: `fullTitle`, `title`, `description`, `canonical`, `robots { index, follow }`,
   `openGraph`, `twitter`, `image { url, width, height, alt }`, `jsonLd[]`.
 - Each block is `{ id, type, data }`; fields live on `data`. Narrow by `type`; use `BlockOf<"hero">` for one type.
+- Any block may have `anchor` (beside `type`): make it the `id` of its outermost element, so `/#anchor` links reach it.
 - Unknown future types arrive as `UnknownBlock`. Always handle a fallback.
 - Images are `ImageRef = { src, alt, width?, height?, focal?: { x, y } }`. `focal` is the spot to keep in view when the
   image is cropped (percentages across and down, set in Hearth's media library). For an image with `object-fit: cover`,
@@ -113,6 +114,11 @@ client components: the API key is secret.
   how-to guides (a "guides" collection) read inside The Smithy's products. Same blocks and structure everywhere;
   each product passes its own class names (`GuideTheme`) and Markdown renderer. No CSS ships with it.
 
+## Hosting
+Netlify and Vercel both work with no host-specific code. Set `HEARTH_SITE` and `HEARTH_API_KEY` at the host before the
+first build, since it reads Hearth. Point the publish webhook at `https://<primary domain>/api/revalidate` and set
+`HEARTH_WEBHOOK_SECRET`, then deploy again. Sites from the starter have the full guide in `HOSTING.md`.
+
 ## Other entry points
 - `@the-smithy/hearth/webhooks`: `verifyWebhook(raw, header, secret)`, `parseWebhook(request, secret)`,
   `tagsForWebhook(payload)`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-smithy/hearth",
-  "version": "0.24.1",
+  "version": "0.26.0",
   "description": "Typed client for the Hearth Delivery API: content, SEO, forms and publish webhooks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -49,7 +49,7 @@
     "llms.md"
   ],
   "dependencies": {
-    "@the-smithy/hearth-schema": "^0.24.1"
+    "@the-smithy/hearth-schema": "^0.26.0"
   },
   "peerDependencies": {
     "next": ">=15",