@ultimat3/seo 22.15.0 → 23.0.0

package/CLAUDE.md

@@ -114,6 +114,11 @@ Tier 1. May import `@ultimat3/core`, `@ultimat3/schema`, `@ultimat3/i18n`. Nothi
   `Math.max(...times)`: a spread is one argument per item and the engine's limit is the caller's
   stack depth, not the feed's size. "Now" arrives through `BuildFeedOptions.clock`; nothing in
   `rss.ts` reads a clock of its own.
+- **A document that is not indexed carries no social card.** `renderMeta` emits `og:*`, `article:*`
+  and `twitter:*` only when `meta.robots?.index !== false` — declared or derived, one rule and no
+  `social: false` beside it. The tags were unconditional, so every admin screen, every 4xx/5xx
+  (`defineRoute` marks them `noindex`) and every draft published its title and description to
+  whoever pasted the URL into a chat. `follow: false` alone withdraws nothing. `meta.test.ts`.
 - Only `site/` routes are SEO-checked — `app/` is behind auth and crawlers never authenticate.
 
 ## Files

package/README.md

@@ -44,7 +44,7 @@ a job boundary the class is gone and the `code` is what survives — match on th
 
 | File | Owns |
 |---|---|
-| `meta.ts` | the metadata model, `renderMeta()` → head tags: title template, canonical, robots, `og:*`, `twitter:*`, hreflang + `x-default`, `theme-color` per colour scheme |
+| `meta.ts` | the metadata model, `renderMeta()` → head tags: title template, canonical, robots, `og:*`, `twitter:*`, hreflang + `x-default`, `theme-color` per colour scheme. **`robots: { index: false }` withdraws every `og:*`, `article:*` and `twitter:*` tag** — declared or derived; there is no `social` switch |
 | `validate.ts` | the build gate — `validateMeta()` (`--json`-shaped) and `assertMeta()` |
 | `ld.ts` | typed JSON-LD builders; required fields are required in the **input type** |
 | `sitemap.ts` | `buildSitemap()` from the route table + each route's `prerender()`, per-locale alternates, automatic index splitting past 50k |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/seo",
-  "version": "22.15.0",
+  "version": "23.0.0",
   "description": "Enforced SEO: typed meta, JSON-LD, sitemap, robots, feeds, responsive images, perf budgets",
   "license": "MIT",
   "type": "module",
@@ -19,6 +19,7 @@
   "files": [
     "src",
     "!src/**/*.test.ts",
+    "!src/**/*-fixture.ts",
     "CLAUDE.md",
     "README.md",
     "LICENSE"
@@ -31,7 +32,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "22.15.0",
-    "@ultimat3/schema": "22.15.0"
+    "@ultimat3/core": "23.0.0",
+    "@ultimat3/schema": "23.0.0"
   }
 }

package/src/meta.ts

@@ -197,35 +197,23 @@ export function hreflangSet(
   return href === undefined ? alternates : [...alternates, { hreflang: 'x-default', href }];
 }
 
-export function renderMeta(meta: RouteMeta, options: RenderMetaOptions = {}): readonly HeadTag[] {
+/**
+ * The card a link preview is built from: `og:*`, `article:*`, `twitter:*`.
+ *
+ * Emitted only for a document that may be INDEXED. `robots: { index: false }` withdraws the whole
+ * set, declared or derived — one rule, no second switch: a page its author keeps out of a search
+ * result is a page behind sign-in, an error, or a draft, and a card for it publishes the title and
+ * description the `noindex` was hiding. Every admin document carried one until 2026-10.
+ */
+function socialTags(
+  meta: RouteMeta,
+  localization: MetaLocalization | undefined,
+  canonicalHref: string | undefined,
+  abs: (value: string) => string,
+): readonly HeadTag[] {
+  if (meta.robots?.index === false) return [];
   const tags: HeadTag[] = [];
-  const abs = (value: string): string =>
-    options.baseUrl === undefined ? value : absoluteUrl(options.baseUrl, value);
-
-  const canonical = meta.canonical ?? (options.path === undefined ? undefined : options.path);
-  const canonicalHref = canonical === undefined ? undefined : abs(canonical);
-
-  if (meta.title !== undefined) {
-    tags.push({
-      tag: 'title',
-      attrs: {},
-      text: applyTitleTemplate(meta.title, meta.titleTemplate),
-    });
-  }
-  if (meta.description !== undefined) {
-    tags.push({ tag: 'meta', attrs: { name: 'description', content: meta.description } });
-  }
-  if (canonicalHref !== undefined) {
-    tags.push({ tag: 'link', attrs: { rel: 'canonical', href: canonicalHref } });
-  }
-  tags.push({
-    tag: 'meta',
-    attrs: { name: 'robots', content: robotsContent(meta.robots ?? {}) },
-  });
-
-  // --- Open Graph ------------------------------------------------------------
   const og = meta.og ?? {};
-  const localization = options.localization;
   const ogLocale =
     og.locale ?? (localization === undefined ? undefined : ogLocaleTag(localization.locale));
   const ogEntries: Array<[string, string | undefined]> = [
@@ -298,6 +286,37 @@ export function renderMeta(meta: RouteMeta, options: RenderMetaOptions = {}): re
   for (const [name, content] of twitterEntries) {
     if (content !== undefined) tags.push({ tag: 'meta', attrs: { name, content } });
   }
+  return tags;
+}
+
+export function renderMeta(meta: RouteMeta, options: RenderMetaOptions = {}): readonly HeadTag[] {
+  const tags: HeadTag[] = [];
+  const abs = (value: string): string =>
+    options.baseUrl === undefined ? value : absoluteUrl(options.baseUrl, value);
+
+  const canonical = meta.canonical ?? (options.path === undefined ? undefined : options.path);
+  const canonicalHref = canonical === undefined ? undefined : abs(canonical);
+
+  if (meta.title !== undefined) {
+    tags.push({
+      tag: 'title',
+      attrs: {},
+      text: applyTitleTemplate(meta.title, meta.titleTemplate),
+    });
+  }
+  if (meta.description !== undefined) {
+    tags.push({ tag: 'meta', attrs: { name: 'description', content: meta.description } });
+  }
+  if (canonicalHref !== undefined) {
+    tags.push({ tag: 'link', attrs: { rel: 'canonical', href: canonicalHref } });
+  }
+  tags.push({
+    tag: 'meta',
+    attrs: { name: 'robots', content: robotsContent(meta.robots ?? {}) },
+  });
+
+  const localization = options.localization;
+  tags.push(...socialTags(meta, localization, canonicalHref, abs));
 
   // --- hreflang --------------------------------------------------------------
   // A route's own `alternates` win whole; otherwise the cluster comes from the routed locales.