@wildo-ai/saas-website 1.1.1

package/src/astro/__tests__/robots-renderer.test.ts

@@ -0,0 +1,228 @@
+import { describe, expect, it } from 'vitest';
+
+import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
+
+import { WildoMarketingWebsiteConfigSchema } from '../../config/wildo-website-config.schemas';
+import { WebsiteLabelKeySchema } from '../../schemas/label-keys/website-label-key.schemas';
+import {
+  WebsitePageManifestSchema,
+  type WebsitePageManifest,
+} from '../../schemas/manifests/website-page-manifest.shared.schemas';
+import {
+  WebsiteRootConfigSchema,
+  type WebsiteRootConfig,
+  type WebsiteRobotsConfig,
+  type WebsiteSitemapConfig,
+} from '../../schemas/manifests/website-root-config.shared.schemas';
+import { WebsitePageRefSchema } from '../../schemas/refs/page-ref.schemas';
+import { WebsiteSectionRefSchema } from '../../schemas/refs/section-ref.schemas';
+import { renderRobotsTxt } from '../robots-renderer';
+import { composeWebsiteSiteContext, type WebsiteSiteContext } from '../website-site-context';
+
+const NoopComponent = () => null;
+
+const COLORS = {
+  background: '#fff',
+  foreground: '#111',
+  primary: '#0070f3',
+  primaryForeground: '#fff',
+  accent: '#ff5e5b',
+  accentForeground: '#fff',
+  surface: '#fafafa',
+  surfaceForeground: '#111',
+  border: '#e5e5e5',
+  muted: '#f5f5f5',
+  mutedForeground: '#737373',
+};
+const RADII = {
+  none: '0',
+  sm: '0.125rem',
+  md: '0.375rem',
+  lg: '0.75rem',
+  xl: '1.5rem',
+  full: '9999px',
+};
+const DESIGN_TOKENS = { colors: COLORS, radii: RADII };
+
+const buildManifest = (ref: string, routePath: string): WebsitePageManifest =>
+  WebsitePageManifestSchema.parse({
+    ref: WebsitePageRefSchema.parse(ref),
+    routePath,
+    pageComponent: NoopComponent,
+    sectionRefs: [WebsiteSectionRefSchema.parse('hero')],
+    metaLabelKeys: {
+      titleKey: WebsiteLabelKeySchema.parse(`website.${ref}.meta.title`),
+      descriptionKey: WebsiteLabelKeySchema.parse(`website.${ref}.meta.description`),
+    },
+  }) as WebsitePageManifest;
+
+interface BuildSiteContextOverrides {
+  robots?: WebsiteRobotsConfig | undefined;
+  sitemap?: WebsiteSitemapConfig | undefined;
+  publicOrigin?: string;
+}
+
+const buildSiteContext = (overrides: BuildSiteContextOverrides = {}): WebsiteSiteContext => {
+  const rootConfig = WebsiteRootConfigSchema.parse({
+    pageManifests: [buildManifest('landing', '/')],
+    designTokens: DESIGN_TOKENS,
+    navigation: { headerComponent: NoopComponent, footerComponent: NoopComponent },
+    seo: {
+      siteName: 'Example Site',
+      ...(overrides.robots !== undefined ? { robots: overrides.robots } : {}),
+      ...(overrides.sitemap !== undefined ? { sitemap: overrides.sitemap } : {}),
+    },
+    skipToMainContentLabelKey: WebsiteLabelKeySchema.parse(
+      'website.chrome.layout.skip-to-main-content',
+    ),
+  }) as WebsiteRootConfig;
+
+  const websiteConfig = WildoMarketingWebsiteConfigSchema.parse({
+    publicOrigin: overrides.publicOrigin ?? 'https://example.com',
+    appOrigin: 'https://app.example.com',
+    defaultLocale: AvailableLanguage.EN,
+    locales: [{ locale: AvailableLanguage.EN, path: 'en' }],
+  });
+
+  return composeWebsiteSiteContext({ rootConfig, websiteConfig });
+};
+
+describe('renderRobotsTxt (Phase 8 close-out — saas-website-seo-sitemap.md)', () => {
+  describe('default policy (no robots block authored)', () => {
+    it('emits a permissive User-agent: * block + Sitemap: footer', () => {
+      const txt = renderRobotsTxt(buildSiteContext());
+      expect(txt).toBe(
+        'User-agent: *\nDisallow:\n\nSitemap: https://example.com/sitemap-index.xml\n',
+      );
+    });
+
+    it('strips a trailing slash on the public origin (defense in depth — schema already refuses it)', () => {
+      /**
+       * The schema-level refinement already rejects trailing slashes,
+       * so we exercise the renderer's defense-in-depth path by
+       * bypassing the parser via a hand-built site context.
+       */
+      const handBuiltContext: WebsiteSiteContext = {
+        rootConfig: buildSiteContext().rootConfig,
+        websiteConfig: {
+          ...buildSiteContext().websiteConfig,
+          publicOrigin: 'https://example.com/',
+        },
+      };
+      const txt = renderRobotsTxt(handBuiltContext);
+      expect(txt).toContain('Sitemap: https://example.com/sitemap-index.xml');
+      expect(txt).not.toContain('//sitemap-index.xml');
+    });
+  });
+
+  describe('policy = noindex (staging / private surfaces)', () => {
+    it('emits Disallow: / for the catch-all User-agent', () => {
+      const txt = renderRobotsTxt(buildSiteContext({ robots: { policy: 'noindex' } }));
+      expect(txt).toContain('User-agent: *\nDisallow: /');
+    });
+
+    it('STILL emits the Sitemap: footer when noindex (crawler-ignoring-noindex defense)', () => {
+      const txt = renderRobotsTxt(buildSiteContext({ robots: { policy: 'noindex' } }));
+      expect(txt).toContain('Sitemap: https://example.com/sitemap-index.xml');
+    });
+  });
+
+  describe('disallow path-prefix list', () => {
+    it('emits one Disallow line per entry under the catch-all block', () => {
+      const txt = renderRobotsTxt(
+        buildSiteContext({
+          robots: { policy: 'index', disallow: ['/internal/', '/preview/'] },
+        }),
+      );
+      expect(txt).toContain('User-agent: *\nDisallow: /internal/\nDisallow: /preview/');
+      /**
+       * When per-path disallow entries are present, the spec-canonical
+       * empty `Disallow:` line is NOT emitted (the per-path entries
+       * carry the policy intent).
+       */
+      expect(txt).not.toMatch(/User-agent: \*\nDisallow:\n/);
+    });
+  });
+
+  describe('allowedCrawlers (deny-by-default direction)', () => {
+    it('emits a per-bot Allow: / block for each named crawler', () => {
+      const txt = renderRobotsTxt(
+        buildSiteContext({
+          robots: { policy: 'index', allowedCrawlers: ['Googlebot', 'Bingbot'] },
+        }),
+      );
+      expect(txt).toContain('User-agent: Googlebot\nAllow: /');
+      expect(txt).toContain('User-agent: Bingbot\nAllow: /');
+    });
+
+    it('closes the rest of the crawler universe with Disallow: / on the catch-all', () => {
+      const txt = renderRobotsTxt(
+        buildSiteContext({
+          robots: { policy: 'index', allowedCrawlers: ['Googlebot'] },
+        }),
+      );
+      expect(txt).toContain('User-agent: *\nDisallow: /');
+    });
+  });
+
+  describe('disallowedCrawlers (allow-by-default direction)', () => {
+    it('emits a per-bot Disallow: / block for each named crawler', () => {
+      const txt = renderRobotsTxt(
+        buildSiteContext({
+          robots: { policy: 'index', disallowedCrawlers: ['GPTBot', 'CCBot'] },
+        }),
+      );
+      expect(txt).toContain('User-agent: GPTBot\nDisallow: /');
+      expect(txt).toContain('User-agent: CCBot\nDisallow: /');
+    });
+
+    it('keeps the catch-all permissive (Disallow:) when only disallowedCrawlers are set', () => {
+      const txt = renderRobotsTxt(
+        buildSiteContext({
+          robots: { policy: 'index', disallowedCrawlers: ['GPTBot'] },
+        }),
+      );
+      expect(txt).toContain('User-agent: *\nDisallow:\n');
+    });
+  });
+
+  describe('sitemap.enabled', () => {
+    it('omits the Sitemap: footer when sitemap.enabled = false (staging suppression)', () => {
+      const txt = renderRobotsTxt(buildSiteContext({ sitemap: { enabled: false } }));
+      expect(txt).not.toContain('Sitemap:');
+    });
+
+    it('emits the Sitemap: footer when sitemap is omitted (default = enabled)', () => {
+      const txt = renderRobotsTxt(buildSiteContext());
+      expect(txt).toContain('Sitemap: https://example.com/sitemap-index.xml');
+    });
+  });
+
+  describe('failure modes', () => {
+    it('throws when publicOrigin is missing (configuration error, not silent fallback)', () => {
+      const handBuiltContext = {
+        rootConfig: buildSiteContext().rootConfig,
+        websiteConfig: {
+          ...buildSiteContext().websiteConfig,
+          publicOrigin: '',
+        },
+      } as WebsiteSiteContext;
+      expect(() => renderRobotsTxt(handBuiltContext)).toThrow(/publicOrigin/);
+    });
+  });
+
+  describe('output shape', () => {
+    it('always ends with a trailing newline (spec-conformant)', () => {
+      expect(renderRobotsTxt(buildSiteContext())).toMatch(/\n$/);
+    });
+
+    it('separates blocks with one blank line', () => {
+      const txt = renderRobotsTxt(
+        buildSiteContext({
+          robots: { policy: 'index', allowedCrawlers: ['Googlebot'] },
+        }),
+      );
+      expect(txt.split('\n\n').length).toBeGreaterThanOrEqual(3);
+    });
+  });
+});

package/src/astro/__tests__/sitemap-coverage.test.ts

@@ -0,0 +1,230 @@
+import { describe, expect, it } from 'vitest';
+
+import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
+
+import { WildoMarketingWebsiteConfigSchema } from '../../config/wildo-website-config.schemas';
+import { WebsiteLabelKeySchema } from '../../schemas/label-keys/website-label-key.schemas';
+import {
+  WebsitePageManifestSchema,
+  type WebsitePageManifest,
+} from '../../schemas/manifests/website-page-manifest.shared.schemas';
+import {
+  WebsiteRootConfigSchema,
+  type WebsiteRootConfig,
+} from '../../schemas/manifests/website-root-config.shared.schemas';
+import { WebsitePageRefSchema } from '../../schemas/refs/page-ref.schemas';
+import { WebsiteSectionRefSchema } from '../../schemas/refs/section-ref.schemas';
+import { enumerateMarketingPageSitemapUrls } from '../sitemap-coverage';
+import { composeWebsiteSiteContext, type WebsiteSiteContext } from '../website-site-context';
+
+const NoopComponent = () => null;
+
+const COLORS = {
+  background: '#fff',
+  foreground: '#111',
+  primary: '#0070f3',
+  primaryForeground: '#fff',
+  accent: '#ff5e5b',
+  accentForeground: '#fff',
+  surface: '#fafafa',
+  surfaceForeground: '#111',
+  border: '#e5e5e5',
+  muted: '#f5f5f5',
+  mutedForeground: '#737373',
+};
+const RADII = {
+  none: '0',
+  sm: '0.125rem',
+  md: '0.375rem',
+  lg: '0.75rem',
+  xl: '1.5rem',
+  full: '9999px',
+};
+const DESIGN_TOKENS = { colors: COLORS, radii: RADII };
+
+const buildManifest = (ref: string, routePath: string): WebsitePageManifest =>
+  WebsitePageManifestSchema.parse({
+    ref: WebsitePageRefSchema.parse(ref),
+    routePath,
+    pageComponent: NoopComponent,
+    sectionRefs: [WebsiteSectionRefSchema.parse('hero')],
+    metaLabelKeys: {
+      titleKey: WebsiteLabelKeySchema.parse(`website.${ref}.meta.title`),
+      descriptionKey: WebsiteLabelKeySchema.parse(`website.${ref}.meta.description`),
+    },
+  }) as WebsitePageManifest;
+
+interface BuildContextOpts {
+  manifests?: WebsitePageManifest[];
+  locales?: AvailableLanguage[];
+  defaultLocale?: AvailableLanguage;
+  publicOrigin?: string;
+}
+
+const buildSiteContext = (opts: BuildContextOpts = {}): WebsiteSiteContext => {
+  const manifests = opts.manifests ?? [
+    buildManifest('landing', '/'),
+    buildManifest('pricing', '/pricing'),
+    buildManifest('contact', '/contact'),
+  ];
+  const locales = opts.locales ?? [AvailableLanguage.EN, AvailableLanguage.FR];
+  const defaultLocale = opts.defaultLocale ?? AvailableLanguage.EN;
+
+  const rootConfig = WebsiteRootConfigSchema.parse({
+    pageManifests: manifests,
+    designTokens: DESIGN_TOKENS,
+    navigation: { headerComponent: NoopComponent, footerComponent: NoopComponent },
+    seo: { siteName: 'Example' },
+    skipToMainContentLabelKey: WebsiteLabelKeySchema.parse(
+      'website.chrome.layout.skip-to-main-content',
+    ),
+  }) as WebsiteRootConfig;
+
+  const websiteConfig = WildoMarketingWebsiteConfigSchema.parse({
+    publicOrigin: opts.publicOrigin ?? 'https://example.com',
+    appOrigin: 'https://app.example.com',
+    defaultLocale,
+    locales: locales.map((locale) => ({ locale, path: String(locale) })),
+  });
+
+  return composeWebsiteSiteContext({ rootConfig, websiteConfig });
+};
+
+describe('enumerateMarketingPageSitemapUrls (Phase 8 close-out — sitemap-coverage enforcement)', () => {
+  describe('coverage invariant — every (page × locale) appears as a URL entry', () => {
+    it('emits N pages × M locales URLs for a multi-page multi-locale config', () => {
+      const ctx = buildSiteContext({
+        manifests: [
+          buildManifest('landing', '/'),
+          buildManifest('pricing', '/pricing'),
+          buildManifest('contact', '/contact'),
+        ],
+        locales: [AvailableLanguage.EN, AvailableLanguage.FR],
+      });
+      const entries = enumerateMarketingPageSitemapUrls(ctx);
+      expect(entries).toHaveLength(3 * 2);
+    });
+
+    it('preserves the manifest order × locale order in the output', () => {
+      const ctx = buildSiteContext({
+        manifests: [buildManifest('landing', '/'), buildManifest('pricing', '/pricing')],
+        locales: [AvailableLanguage.EN, AvailableLanguage.FR],
+      });
+      const entries = enumerateMarketingPageSitemapUrls(ctx);
+      expect(entries.map((e) => `${e.pageRef}/${String(e.locale)}`)).toEqual([
+        'landing/en',
+        'landing/fr',
+        'pricing/en',
+        'pricing/fr',
+      ]);
+    });
+  });
+
+  describe('URL composition (matches buildLocalizedRoutePath)', () => {
+    it('mounts the default locale at the un-prefixed path', () => {
+      const ctx = buildSiteContext({
+        manifests: [buildManifest('landing', '/'), buildManifest('pricing', '/pricing')],
+        locales: [AvailableLanguage.EN, AvailableLanguage.FR],
+        defaultLocale: AvailableLanguage.EN,
+      });
+      const entries = enumerateMarketingPageSitemapUrls(ctx);
+      const enLanding = entries.find((e) => e.pageRef === 'landing' && e.locale === AvailableLanguage.EN);
+      const enPricing = entries.find((e) => e.pageRef === 'pricing' && e.locale === AvailableLanguage.EN);
+      expect(enLanding?.url).toBe('https://example.com/');
+      expect(enPricing?.url).toBe('https://example.com/pricing');
+    });
+
+    it('prefixes non-default locales with /<locale>/', () => {
+      const ctx = buildSiteContext({
+        manifests: [buildManifest('landing', '/'), buildManifest('pricing', '/pricing')],
+        locales: [AvailableLanguage.EN, AvailableLanguage.FR],
+        defaultLocale: AvailableLanguage.EN,
+      });
+      const entries = enumerateMarketingPageSitemapUrls(ctx);
+      const frLanding = entries.find((e) => e.pageRef === 'landing' && e.locale === AvailableLanguage.FR);
+      const frPricing = entries.find((e) => e.pageRef === 'pricing' && e.locale === AvailableLanguage.FR);
+      /**
+       * `/` → `/fr` (no trailing slash for the locale-prefixed root).
+       */
+      expect(frLanding?.url).toBe('https://example.com/fr');
+      expect(frPricing?.url).toBe('https://example.com/fr/pricing');
+    });
+  });
+
+  describe('hreflang alternates (single-sitemap-with-hreflang shape)', () => {
+    it('includes one alternate per locale + an x-default pointing at the default-locale URL', () => {
+      const ctx = buildSiteContext({
+        manifests: [buildManifest('pricing', '/pricing')],
+        locales: [AvailableLanguage.EN, AvailableLanguage.FR],
+        defaultLocale: AvailableLanguage.EN,
+      });
+      const entries = enumerateMarketingPageSitemapUrls(ctx);
+      const enEntry = entries.find((e) => e.locale === AvailableLanguage.EN);
+      expect(enEntry?.alternates).toEqual([
+        { hreflang: 'en', url: 'https://example.com/pricing' },
+        { hreflang: 'fr', url: 'https://example.com/fr/pricing' },
+        { hreflang: 'x-default', url: 'https://example.com/pricing' },
+      ]);
+    });
+
+    it('every entry for a given page shares the same alternate URL set', () => {
+      const ctx = buildSiteContext({
+        manifests: [buildManifest('pricing', '/pricing')],
+        locales: [AvailableLanguage.EN, AvailableLanguage.FR],
+      });
+      const entries = enumerateMarketingPageSitemapUrls(ctx);
+      const [a, b] = entries;
+      expect(a?.alternates.map((x) => x.url)).toEqual(b?.alternates.map((x) => x.url));
+    });
+  });
+
+  describe('failure modes', () => {
+    it('throws when publicOrigin is missing (configuration error)', () => {
+      const ctx = buildSiteContext();
+      const broken: WebsiteSiteContext = {
+        rootConfig: ctx.rootConfig,
+        websiteConfig: { ...ctx.websiteConfig, publicOrigin: '' },
+      };
+      expect(() => enumerateMarketingPageSitemapUrls(broken)).toThrow(/publicOrigin/);
+    });
+  });
+
+  describe('coverage REGRESSION guard — the test that fails when a route silently drops out', () => {
+    it('listing the full URL set against expected (page × locale) tuples — every route must appear exactly once', () => {
+      const manifests = [
+        buildManifest('landing', '/'),
+        buildManifest('features', '/features'),
+        buildManifest('pricing', '/pricing'),
+        buildManifest('contact', '/contact'),
+        buildManifest('not-found', '/404'),
+      ];
+      const locales = [AvailableLanguage.EN, AvailableLanguage.FR];
+      const ctx = buildSiteContext({ manifests, locales, defaultLocale: AvailableLanguage.EN });
+
+      const expected = new Set<string>();
+      for (const m of manifests) {
+        for (const locale of locales) {
+          expected.add(`${m.ref as unknown as string}|${String(locale)}`);
+        }
+      }
+
+      const actual = new Set(
+        enumerateMarketingPageSitemapUrls(ctx).map((e) => `${e.pageRef}|${String(e.locale)}`),
+      );
+
+      expect(actual).toEqual(expected);
+      /**
+       * Negative: removing any single manifest from the input must
+       * shrink the output by `locales.length` entries — direct
+       * proof that the helper is the enforcement seam (no other
+       * stage can silently re-add a dropped page).
+       */
+      const ctxMissingPricing = buildSiteContext({
+        manifests: manifests.filter((m) => (m.ref as unknown as string) !== 'pricing'),
+        locales,
+      });
+      const after = enumerateMarketingPageSitemapUrls(ctxMissingPricing);
+      expect(after).toHaveLength(actual.size - locales.length);
+    });
+  });
+});

package/src/astro/__tests__/structured-data.renderer.test.ts

@@ -0,0 +1,172 @@
+import { describe, expect, it } from 'vitest';
+
+import type { WebsiteSectionDefinition } from '../../schemas/sections/website-section-definition.shared.schemas';
+import type {
+  WebsiteStructuredDataPayload,
+  WebsiteStructuredDataReturn,
+} from '../../schemas/structured-data/website-structured-data.shared.schemas';
+import { renderPageStructuredData } from '../structured-data.renderer';
+
+/**
+ * Tiny helper that fabricates a section-shaped object — the renderer
+ * only reads `getStructuredData` (and `sectionRef` for type
+ * compatibility), so we can hand-roll a partial that satisfies
+ * `Pick<WebsiteSectionDefinition, 'sectionRef' | 'getStructuredData'>`
+ * without dragging the full section schema through every test.
+ */
+function makeSection(
+  sectionRef: string,
+  getStructuredData?: () => WebsiteStructuredDataReturn,
+): Pick<WebsiteSectionDefinition, 'sectionRef' | 'getStructuredData'> {
+  return {
+    sectionRef: sectionRef as unknown as WebsiteSectionDefinition['sectionRef'],
+    ...(getStructuredData ? { getStructuredData } : {}),
+  };
+}
+
+describe('renderPageStructuredData', () => {
+  it('returns empty string when no sections, no page payloads', () => {
+    expect(renderPageStructuredData({})).toBe('');
+  });
+
+  it('returns empty string when every section returns null/undefined/[]', () => {
+    const sections = [
+      makeSection('a', () => null),
+      makeSection('b', () => undefined),
+      makeSection('c', () => []),
+    ];
+    expect(renderPageStructuredData({ sections })).toBe('');
+  });
+
+  it('skips sections without `getStructuredData`', () => {
+    const sections = [makeSection('a'), makeSection('b')];
+    expect(renderPageStructuredData({ sections })).toBe('');
+  });
+
+  it('emits one `<script>` per single payload, with `@context` injected when omitted', () => {
+    const payload: WebsiteStructuredDataPayload = {
+      '@type': 'Article',
+      headline: 'Hello',
+    };
+    const result = renderPageStructuredData({
+      sections: [makeSection('hero', () => payload)],
+    });
+    expect(result).toContain('<script type="application/ld+json">');
+    expect(result).toContain('</script>');
+    expect(result).toContain('"@context":"https://schema.org"');
+    expect(result).toContain('"@type":"Article"');
+    expect(result).toContain('"headline":"Hello"');
+  });
+
+  it('preserves a consumer-supplied `@context` (does not overwrite)', () => {
+    const payload: WebsiteStructuredDataPayload = {
+      '@type': 'Article',
+      '@context': 'https://example.com/custom-context',
+    };
+    const result = renderPageStructuredData({
+      sections: [makeSection('hero', () => payload)],
+    });
+    expect(result).toContain('"@context":"https://example.com/custom-context"');
+    expect(result).not.toContain('"@context":"https://schema.org"');
+  });
+
+  it('emits separate `<script>` blocks for an array return (Product + AggregateOffer pattern)', () => {
+    const sections = [
+      makeSection('pricing', () => [
+        { '@type': 'Product', name: 'Plan' } satisfies WebsiteStructuredDataPayload,
+        { '@type': 'AggregateOffer', lowPrice: '9' } satisfies WebsiteStructuredDataPayload,
+      ]),
+    ];
+    const result = renderPageStructuredData({ sections });
+    const blockCount = result.match(/<script type="application\/ld\+json">/g)?.length ?? 0;
+    expect(blockCount).toBe(2);
+    expect(result).toContain('"@type":"Product"');
+    expect(result).toContain('"@type":"AggregateOffer"');
+  });
+
+  it('appends page-level payloads after section payloads', () => {
+    const sections = [
+      makeSection('hero', () => ({ '@type': 'Article', headline: 'A' }) as WebsiteStructuredDataPayload),
+    ];
+    const pagePayloads: WebsiteStructuredDataPayload[] = [
+      { '@type': 'BreadcrumbList', itemListElement: [] },
+    ];
+    const result = renderPageStructuredData({ sections, pagePayloads });
+    const articleIdx = result.indexOf('"@type":"Article"');
+    const breadcrumbIdx = result.indexOf('"@type":"BreadcrumbList"');
+    expect(articleIdx).toBeGreaterThan(-1);
+    expect(breadcrumbIdx).toBeGreaterThan(-1);
+    expect(articleIdx).toBeLessThan(breadcrumbIdx);
+  });
+
+  it('dedupes payloads sharing the same `@id` (last-wins)', () => {
+    const sections = [
+      makeSection('hero', () => ({
+        '@type': 'Product',
+        '@id': 'https://example.com/#product',
+        name: 'OldName',
+      }) as WebsiteStructuredDataPayload),
+      makeSection('cta', () => ({
+        '@type': 'Product',
+        '@id': 'https://example.com/#product',
+        name: 'NewName',
+      }) as WebsiteStructuredDataPayload),
+    ];
+    const result = renderPageStructuredData({ sections });
+    const blockCount = result.match(/<script type="application\/ld\+json">/g)?.length ?? 0;
+    expect(blockCount).toBe(1);
+    expect(result).toContain('"name":"NewName"');
+    expect(result).not.toContain('"name":"OldName"');
+  });
+
+  it('does NOT dedupe payloads without `@id` (every payload always emits)', () => {
+    const sections = [
+      makeSection('a', () => ({ '@type': 'Article', headline: 'A' }) as WebsiteStructuredDataPayload),
+      makeSection('b', () => ({ '@type': 'Article', headline: 'B' }) as WebsiteStructuredDataPayload),
+    ];
+    const result = renderPageStructuredData({ sections });
+    const blockCount = result.match(/<script type="application\/ld\+json">/g)?.length ?? 0;
+    expect(blockCount).toBe(2);
+  });
+
+  it('escapes `<` to `\\u003c` so a payload containing `</script>` cannot break the surrounding tag', () => {
+    const sections = [
+      makeSection(
+        'evil',
+        () =>
+          ({
+            '@type': 'Article',
+            description: 'Malicious </script><img src=x onerror=alert(1)>',
+          }) as WebsiteStructuredDataPayload,
+      ),
+    ];
+    const result = renderPageStructuredData({ sections });
+    /**
+     * The serialized JSON inside the `<script>` block must NOT
+     * contain a literal `</` sequence — that would let the HTML
+     * parser see `</script>` and prematurely close the script
+     * element. The renderer escapes every `<` to `\u003c`.
+     */
+    const scriptOpenIdx = result.indexOf('<script type="application/ld+json">');
+    const scriptCloseIdx = result.indexOf('</script>', scriptOpenIdx);
+    const innerJson = result.slice(
+      scriptOpenIdx + '<script type="application/ld+json">'.length,
+      scriptCloseIdx,
+    );
+    expect(innerJson).not.toContain('</');
+    /**
+     * The renderer escapes `<` (the only character that can open
+     * an HTML comment / close a tag inside a `<script>` body); `>`
+     * is left alone because it cannot start a parsing escape on
+     * its own. So `</script>` becomes `\u003c/script>`.
+     */
+    expect(innerJson).toContain('\\u003c/script>');
+    /**
+     * Re-parse the escaped JSON to confirm the consumer sees the
+     * original payload unchanged (escape is HTML-only, not a JSON
+     * mutation).
+     */
+    const reparsed = JSON.parse(innerJson) as Record<string, unknown>;
+    expect(reparsed.description).toBe('Malicious </script><img src=x onerror=alert(1)>');
+  });
+});