create-stitchkit 0.3.2 → 0.4.0

package/template/packages/config/src/variables.ts

@@ -0,0 +1,89 @@
+import { z } from 'zod';
+import { featureServerSchema } from './features';
+
+/**
+ * Every environment variable this application reads, declared **once**.
+ *
+ * There used to be three overlapping copies — the server schema, the frontend
+ * schema and the tooling schema — and they had already drifted in composition.
+ * A fourth copy in the project declaration would have been worse still, so this
+ * module is the source and everything else is a projection of it:
+ *
+ * - `server.ts` validates all of them for the API role;
+ * - `frontend/src/env.ts` projects the handful the web role reads;
+ * - `scripts/declaration.ts` DERIVES `env.required` in `project.json` from
+ *   here, so the declaration a deployment reads can never fall behind.
+ *
+ * Defaults, coercion and error messages live here and only here. The
+ * declaration carries names and shapes; it deliberately carries no values.
+ */
+const baseVariables = {
+  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
+  DATABASE_URL: z.url(),
+  // Loopback by default — exposing the app to the network is an explicit
+  // opt-in (`BIND_HOST=0.0.0.0`), never something a forgotten edit causes.
+  BIND_HOST: z.string().min(1).default('127.0.0.1'),
+  API_PORT: z.coerce.number().int().positive(),
+  WEB_PORT: z.coerce.number().int().positive(),
+  /**
+   * Override for the public origin of the web role, for a proxy that forwards
+   * neither `x-forwarded-host` nor a usable `Host`. Normally unset: the origin
+   * comes from the request, which is what lets one artifact serve many
+   * addresses.
+   */
+  PUBLIC_WEB_ORIGIN: z.url().optional(),
+  /**
+   * Which hosts this deployment answers for, comma-separated, when more than
+   * one address reaches the same artifact. Unset means only PUBLIC_WEB_ORIGIN;
+   * a forwarded host outside the list is refused rather than believed.
+   */
+  PUBLIC_WEB_HOSTS: z.string().min(1).optional(),
+  /**
+   * Where the web role reaches the API role, server side. Never seen by a
+   * browser. The blank starter needs it only if it calls the API at all.
+   */
+  INTERNAL_API_URL: z.url().optional(),
+  /**
+   * Where the BROWSER dials the API role over HTTP, when it must dial it
+   * directly instead of reaching it through its own origin.
+   *
+   * Set it only for a genuinely cross-origin frontend. It affects HTTP and
+   * nothing else — the realtime socket has its own variable below, because the
+   * two answers differ: HTTP can be forwarded by the web role, and a WebSocket
+   * upgrade cannot.
+   */
+  PUBLIC_API_ORIGIN: z.url().optional(),
+  /**
+   * Where the browser opens the realtime socket, when the two roles do not
+   * share an origin.
+   *
+   * Separate from `PUBLIC_API_ORIGIN` on purpose. A WebSocket upgrade does not
+   * survive a proxying route handler, so a deployment can serve HTTP from one
+   * origin and still need to name the socket's — which is exactly the shape of
+   * running the two roles on two ports with no routing layer in front of them.
+   * Unset means the page's own origin, where a routing layer forwards
+   * `/socket.io` to the API role.
+   */
+  PUBLIC_REALTIME_ORIGIN: z.url().optional(),
+  LOG_FORMAT: z.enum(['pretty', 'json']).default('pretty'),
+  /**
+   * The browser origin the API role admits, for HTTP and for the realtime
+   * handshake alike. Only a genuinely cross-origin browser needs it: a frontend
+   * reaching the API through its own origin makes same-origin requests, and
+   * requiring an origin there would be requiring knowledge of the place.
+   */
+  CORS_ORIGIN: z.url().optional(),
+};
+
+/**
+ * The base declaration, then whatever this project's own features say.
+ *
+ * A merge rather than a spread inside one literal, so an overlay can **tighten**
+ * a variable the base declares optional — not only add new ones. Without that,
+ * a project whose code dereferences a variable without a fallback had no way to
+ * say so, and its declaration told a deployment the variable was optional while
+ * the first render threw.
+ */
+export const applicationVariables = { ...baseVariables, ...featureServerSchema };
+
+export type ApplicationVariable = keyof typeof applicationVariables;

package/template/packages/frontend/next.config.ts

@@ -1,7 +1,6 @@
 import path from 'node:path';
 import type { NextConfig } from 'next';
 import createNextIntlPlugin from 'next-intl/plugin';
-import { env } from './src/env';
 
 const config: NextConfig = {
   agentRules: false,
@@ -11,7 +10,9 @@ const config: NextConfig = {
   turbopack: {
     root: path.resolve(import.meta.dirname, '../..'),
   },
-  allowedDevOrigins: [new URL(env.NEXT_PUBLIC_WEB_URL).hostname],
+  // Development only, and deliberately not derived from a public address:
+  // reading one here would pull a value of the place into the build.
+  allowedDevOrigins: ['127.0.0.1', 'localhost'],
   images: { remotePatterns: [] },
 };
 

package/template/packages/frontend/package.json

@@ -4,9 +4,9 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "dev": "next dev --port ${WEB_PORT:-3210}",
+    "dev": "bun scripts/serve.ts development",
     "build": "next build",
-    "start": "next start --port ${WEB_PORT:-3210}",
+    "start": "bun scripts/serve.ts production",
     "check": "next typegen && bun x tsc --noEmit",
     "test": "bun test --pass-with-no-tests"
   },

package/template/packages/frontend/scripts/serve.ts

@@ -0,0 +1,70 @@
+import { env } from '../src/env';
+
+/**
+ * Run the web role.
+ *
+ * Next takes its port and interface as command-line arguments; the ROLE builds
+ * that argv from its own bindings, so a deployment only ever has to set
+ * variables. That is the whole contract of the declaration: one injection form,
+ * named by the role, and no supervisor guessing how a process wants its port.
+ *
+ * There is no fallback port here on purpose. A default in the repository is a
+ * value of the place living in the code, and a forgotten variable would start
+ * the role on the wrong port in silence instead of failing by name — the
+ * environment schema in `@app/config` is the one place a default may live, and
+ * `WEB_PORT` deliberately has none.
+ */
+/**
+ * The run mode, fail-closed.
+ *
+ * `argv[2] === 'development' ? 'dev' : 'start'` meant a typo, an empty string
+ * and a missing argument all silently became production. A wrong mode is not a
+ * detail — it decides whether the role serves a build or compiles on demand —
+ * and the supervision files pass it explicitly, so anything else is a mistake
+ * worth seeing.
+ */
+const MODES: Record<string, 'dev' | 'start'> = {
+  development: 'dev',
+  production: 'start',
+};
+
+const requested = process.argv[2];
+const mode = requested === undefined ? undefined : MODES[requested];
+if (mode === undefined) {
+  throw new Error(
+    `Run mode must be "development" or "production", received ${requested === undefined ? 'nothing' : `"${requested}"`}. The supervision files pass it explicitly; run \`bun run gen:declaration\` if they have fallen behind.`,
+  );
+}
+const next = new URL('../node_modules/.bin/next', import.meta.url).pathname;
+
+const child = Bun.spawn(
+  [next, mode, '--port', String(env.WEB_PORT), '--hostname', env.BIND_HOST],
+  { stdin: 'inherit', stdout: 'inherit', stderr: 'inherit' },
+);
+
+// Forward the shutdown signal rather than dying and orphaning the server: the
+// supervisor's kill timeout is measured against the role, not against this
+// three-line wrapper.
+let stopping = false;
+
+function forward(signal: 'SIGINT' | 'SIGTERM'): void {
+  stopping = true;
+  child.kill(signal);
+}
+
+process.on('SIGINT', () => forward('SIGINT'));
+process.on('SIGTERM', () => forward('SIGTERM'));
+
+const code = await child.exited;
+/**
+ * A stop that was ASKED for is a success — but only for the codes a stop
+ * actually produces.
+ *
+ * `stopping ? 0 : code` reported success for ANY exit during shutdown, so a
+ * role that crashed while draining looked identical to one that drained. Next
+ * exits 130 on SIGINT and 143 on SIGTERM, and reporting those upward would make
+ * every ordinary supervised stop look like a failure; anything else during a
+ * shutdown is a real failure and keeps its code.
+ */
+const SIGNAL_EXIT_CODES = new Set([0, 130, 143]);
+process.exitCode = stopping && SIGNAL_EXIT_CODES.has(code) ? 0 : code;

package/template/packages/frontend/src/app/[locale]/layout.tsx

@@ -5,10 +5,9 @@ import { notFound } from 'next/navigation';
 import { NextIntlClientProvider } from 'next-intl';
 import { getMessages } from 'next-intl/server';
 import type { ReactNode } from 'react';
-import { env } from '@/env';
 import { LocaleSchema } from '@/i18n/locales';
 import { routing } from '@/i18n/routing';
-import { createPageMetadata } from '@/lib/seo/metadata';
+import { createPageMetadata, siteMetadataBase } from '@/lib/seo/metadata';
 import { SITE_NAME } from '@/lib/seo/pages';
 import { Providers } from '@/providers';
 import { themeProviderConfig } from '@/theme/config';
@@ -21,12 +20,14 @@ const montserrat = Montserrat({
   display: 'swap',
 });
 
-export const metadata: Metadata = {
-  metadataBase: new URL(env.NEXT_PUBLIC_WEB_URL),
-  ...createPageMetadata('home', 'en'),
-  title: SITE_NAME,
-  icons: { icon: [{ url: '/favicon/mascot-stitch.png', type: 'image/png' }] },
-};
+export async function generateMetadata(): Promise<Metadata> {
+  return {
+    metadataBase: await siteMetadataBase(),
+    ...(await createPageMetadata('home', 'en')),
+    title: SITE_NAME,
+    icons: { icon: [{ url: '/favicon/mascot-stitch.png', type: 'image/png' }] },
+  };
+}
 
 export function generateStaticParams() {
   return routing.locales.map((locale) => ({ locale }));

package/template/packages/frontend/src/app/[locale]/page.tsx

@@ -1,4 +1,4 @@
-import { appIdentity } from '@app/config/identity';
+import { appIdentity } from '@app/config/app-identity';
 import type { Metadata } from 'next';
 import { getTranslations } from 'next-intl/server';
 import { LocaleSchema } from '@/i18n/locales';
@@ -13,7 +13,7 @@ export async function generateMetadata({
   params: Promise<{ locale: string }>;
 }): Promise<Metadata> {
   const { locale } = await params;
-  return createPageMetadata('home', LocaleSchema.parse(locale));
+  return await createPageMetadata('home', LocaleSchema.parse(locale));
 }
 
 export default async function Page({ params }: { params: Promise<{ locale: string }> }) {

package/template/packages/frontend/src/app/[locale]/starter-page.tsx

@@ -56,7 +56,7 @@ const architecture = [
   },
 ];
 
-export function StarterPage({
+export async function StarterPage({
   applicationName,
   applicationDescription,
   heroTitle,
@@ -70,7 +70,7 @@ export function StarterPage({
     name: SITE_NAME,
     applicationCategory: 'DeveloperApplication',
     operatingSystem: 'Web',
-    url: absoluteSiteUrl(`/${locale}`),
+    url: await absoluteSiteUrl(`/${locale}`),
     description: homeSeo.description,
   };
 

package/template/packages/frontend/src/app/[locale]/ui/[story]/page.tsx

@@ -16,7 +16,7 @@ export async function generateMetadata({
 }): Promise<Metadata> {
   const { locale, story } = await params;
   if (!isStoryId(story)) notFound();
-  return createPageMetadata(story, LocaleSchema.parse(locale));
+  return await createPageMetadata(story, LocaleSchema.parse(locale));
 }
 
 export default async function UiStoryPage({

package/template/packages/frontend/src/app/[locale]/ui/_catalogue/landing-showcase.tsx

@@ -1,6 +1,6 @@
 'use client';
 
-import { appIdentity } from '@app/config/identity';
+import { appIdentity } from '@app/config/app-identity';
 import { IconArrowRight, IconBraces, IconDatabase, IconWorld } from '@tabler/icons-react';
 import type { ReactNode } from 'react';
 import { BrandMark } from '@/components/brand-mark';

package/template/packages/frontend/src/app/robots.ts

@@ -1,9 +1,11 @@
 import type { MetadataRoute } from 'next';
 import { absoluteSiteUrl } from '@/lib/seo/metadata';
 
-export default function robots(): MetadataRoute.Robots {
+// Dynamic on purpose: a prerendered robots.txt freezes one external address
+// into the artifact, and a single build then cannot serve a second one.
+export default async function robots(): Promise<MetadataRoute.Robots> {
   return {
     rules: { userAgent: '*', allow: '/' },
-    sitemap: absoluteSiteUrl('/sitemap.xml'),
+    sitemap: await absoluteSiteUrl('/sitemap.xml'),
   };
 }

package/template/packages/frontend/src/app/sitemap.ts

@@ -1,22 +1,10 @@
 import type { MetadataRoute } from 'next';
-import { locales } from '@/i18n/locales';
-import { absoluteSiteUrl } from '@/lib/seo/metadata';
-import { localizedPagePath, publicPageIds } from '@/lib/seo/pages';
+import { sitemapForOrigin } from '@/lib/seo/metadata';
+import { requestOrigin } from '@/lib/seo/request-origin';
 
-export default function sitemap(): MetadataRoute.Sitemap {
-  return publicPageIds.flatMap((pageId) =>
-    locales.map((locale) => ({
-      url: absoluteSiteUrl(localizedPagePath(pageId, locale)),
-      changeFrequency: pageId === 'home' ? 'weekly' : 'monthly',
-      priority: pageId === 'home' ? 1 : 0.7,
-      alternates: {
-        languages: Object.fromEntries(
-          locales.map((availableLocale) => [
-            availableLocale,
-            absoluteSiteUrl(localizedPagePath(pageId, availableLocale)),
-          ]),
-        ),
-      },
-    })),
-  );
+// Dynamic on purpose (see robots.ts): the URLs are a function of the origin
+// this response is served on, and that is not known until the request arrives.
+// The entries themselves are built once per origin, not once per request.
+export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
+  return sitemapForOrigin(await requestOrigin());
 }

package/template/packages/frontend/src/env.ts

@@ -1,21 +1,40 @@
 import path from 'node:path';
+import { applicationVariables } from '@app/config/variables';
 import { createEnv } from '@t3-oss/env-nextjs';
 import { config } from 'dotenv';
-import { z } from 'zod';
 
 config({ path: path.resolve(process.cwd(), '../../.env'), quiet: true });
 
+/**
+ * The web role's view of the environment — a PROJECTION of the one declaration
+ * in `@app/config/variables`, never a second copy of it.
+ *
+ * There is deliberately NO `client` block. A `NEXT_PUBLIC_` variable is
+ * substituted at BUILD time, so declaring one freezes a value of the place into
+ * the artifact — the built server chunk once carried
+ * `NEXT_PUBLIC_API_URL:"http://…"` as a literal while a plain `WEB_PORT` stayed
+ * a runtime read. Anything the browser needs is either relative (so it needs no
+ * address at all), derived from the request, or read on the server and handed
+ * down per request — never compiled in.
+ */
 export const env = createEnv({
-  server: { INTERNAL_API_URL: z.url(), WEB_PORT: z.coerce.number().int().positive() },
-  client: {
-    NEXT_PUBLIC_API_URL: z.url(),
-    NEXT_PUBLIC_WEB_URL: z.url(),
+  server: {
+    BIND_HOST: applicationVariables.BIND_HOST,
+    WEB_PORT: applicationVariables.WEB_PORT,
+    PUBLIC_WEB_ORIGIN: applicationVariables.PUBLIC_WEB_ORIGIN,
+    PUBLIC_WEB_HOSTS: applicationVariables.PUBLIC_WEB_HOSTS,
+    INTERNAL_API_URL: applicationVariables.INTERNAL_API_URL,
+    PUBLIC_API_ORIGIN: applicationVariables.PUBLIC_API_ORIGIN,
+    PUBLIC_REALTIME_ORIGIN: applicationVariables.PUBLIC_REALTIME_ORIGIN,
   },
   runtimeEnv: {
-    INTERNAL_API_URL: process.env.INTERNAL_API_URL,
+    BIND_HOST: process.env.BIND_HOST,
     WEB_PORT: process.env.WEB_PORT,
-    NEXT_PUBLIC_API_URL: process.env.NEXT_PUBLIC_API_URL,
-    NEXT_PUBLIC_WEB_URL: process.env.NEXT_PUBLIC_WEB_URL,
+    PUBLIC_WEB_ORIGIN: process.env.PUBLIC_WEB_ORIGIN,
+    PUBLIC_WEB_HOSTS: process.env.PUBLIC_WEB_HOSTS,
+    INTERNAL_API_URL: process.env.INTERNAL_API_URL,
+    PUBLIC_API_ORIGIN: process.env.PUBLIC_API_ORIGIN,
+    PUBLIC_REALTIME_ORIGIN: process.env.PUBLIC_REALTIME_ORIGIN,
   },
   emptyStringAsUndefined: true,
 });

package/template/packages/frontend/src/lib/seo/cache-by-origin.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from 'bun:test';
+import { cacheByOrigin } from './cache-by-origin';
+
+describe('cacheByOrigin', () => {
+  test('builds once per address, not once per request', () => {
+    let builds = 0;
+    const render = cacheByOrigin(
+      (origin: string) => origin,
+      (origin: string) => {
+        builds += 1;
+        return `${origin}/sitemap.xml`;
+      },
+    );
+
+    expect(render('https://alpha.example')).toBe('https://alpha.example/sitemap.xml');
+    expect(render('https://alpha.example')).toBe('https://alpha.example/sitemap.xml');
+    expect(render('https://alpha.example')).toBe('https://alpha.example/sitemap.xml');
+    expect(builds).toBe(1);
+
+    expect(render('https://beta.example')).toBe('https://beta.example/sitemap.xml');
+    expect(builds).toBe(2);
+  });
+
+  test('a forged Host cannot grow the cache without limit', () => {
+    let builds = 0;
+    const render = cacheByOrigin(
+      (origin: string) => origin,
+      (origin: string) => {
+        builds += 1;
+        return origin;
+      },
+      2,
+    );
+
+    render('a');
+    render('b');
+    render('c'); // evicts the least recently used, 'a'
+    expect(builds).toBe(3);
+
+    render('c');
+    render('b');
+    expect(builds).toBe(3);
+
+    render('a'); // evicted, so rebuilt — the cache stayed bounded
+    expect(builds).toBe(4);
+  });
+
+  test('recency is refreshed on a hit, so a hot address is not evicted', () => {
+    let builds = 0;
+    const render = cacheByOrigin(
+      (origin: string) => origin,
+      (origin: string) => {
+        builds += 1;
+        return origin;
+      },
+      2,
+    );
+
+    render('hot');
+    render('cold');
+    render('hot'); // refreshes 'hot', leaving 'cold' as least recent
+    render('new'); // evicts 'cold', not 'hot'
+    expect(builds).toBe(3);
+
+    render('hot');
+    expect(builds).toBe(3);
+  });
+});

package/template/packages/frontend/src/lib/seo/cache-by-origin.ts

@@ -0,0 +1,40 @@
+/**
+ * Memoise a pure function of its input, so a deployment serving N addresses builds
+ * each answer once rather than once per request.
+ *
+ * This is the price of deriving the public origin from the request instead of
+ * the build: `robots.txt`, `sitemap.xml` and page metadata stopped being
+ * prerendered constants. They are still constants *per address*, and this is
+ * where that is spent — one render per address, not one per hit.
+ *
+ * Bounded and least-recently-used on purpose: part of every key comes from a
+ * request header, and a forged `Host` must not be able to grow the cache
+ * without limit. The key is derived by `keyOf` so the builder keeps its real
+ * types — nothing is stringified and parsed back.
+ */
+export function cacheByOrigin<Input, Value>(
+  keyOf: (input: Input) => string,
+  build: (input: Input) => Value,
+  limit = 64,
+): (input: Input) => Value {
+  // The value is boxed so that a builder returning `undefined` is still a hit.
+  // Testing the stored value for `undefined` would rebuild it on every request
+  // while the cache kept growing an entry per key.
+  const entries = new Map<string, { value: Value }>();
+  return (input) => {
+    const key = keyOf(input);
+    const hit = entries.get(key);
+    if (hit) {
+      entries.delete(key);
+      entries.set(key, hit);
+      return hit.value;
+    }
+    const built = { value: build(input) };
+    entries.set(key, built);
+    if (entries.size > limit) {
+      const oldest = entries.keys().next();
+      if (!oldest.done) entries.delete(oldest.value);
+    }
+    return built.value;
+  };
+}

package/template/packages/frontend/src/lib/seo/metadata.ts

@@ -1,25 +1,57 @@
-import type { Metadata } from 'next';
-import { env } from '@/env';
+import type { Metadata, MetadataRoute } from 'next';
 import type { AppLocale } from '@/i18n/locales';
 import { locales } from '@/i18n/locales';
+import { cacheByOrigin } from './cache-by-origin';
 import type { SeoPageId } from './pages';
-import { getSeoPage, localizedPagePath, SITE_NAME } from './pages';
+import { getSeoPage, localizedPagePath, publicPageIds, SITE_NAME } from './pages';
+import { requestOrigin } from './request-origin';
 
-export const siteOrigin = new URL(env.NEXT_PUBLIC_WEB_URL).origin;
+/** Absolute URL for `path` on the origin this response is being served from. */
+export async function absoluteSiteUrl(path: string): Promise<string> {
+  return siteUrl(await requestOrigin(), path);
+}
+
+function siteUrl(origin: string, path: string): string {
+  return new URL(path, origin).toString();
+}
 
-export function absoluteSiteUrl(path: string): string {
-  return new URL(path, siteOrigin).toString();
+interface PageMetadataInput {
+  origin: string;
+  pageId: SeoPageId;
+  locale: AppLocale;
 }
 
-export function createPageMetadata(pageId: SeoPageId, locale: AppLocale): Metadata {
+/**
+ * Page metadata for one origin. Pure in its inputs, so it is built once per
+ * (origin, page, locale) instead of once per request — the cost of trading a
+ * build-time constant for a request-time value, paid once per address.
+ */
+const metadataFor = cacheByOrigin(
+  ({ origin, pageId, locale }: PageMetadataInput) => `${origin}|${pageId}|${locale}`,
+  ({ origin, pageId, locale }: PageMetadataInput) => buildPageMetadata(origin, pageId, locale),
+);
+
+export async function createPageMetadata(
+  pageId: SeoPageId,
+  locale: AppLocale,
+): Promise<Metadata> {
+  return metadataFor({ origin: await requestOrigin(), pageId, locale });
+}
+
+/** `metadataBase` for the origin in hand — relative metadata resolves against it. */
+export async function siteMetadataBase(): Promise<URL> {
+  return new URL(await requestOrigin());
+}
+
+function buildPageMetadata(origin: string, pageId: SeoPageId, locale: AppLocale): Metadata {
   const page = getSeoPage(pageId, locale);
   const title = pageId === 'home' ? SITE_NAME : `${page.title} · ${SITE_NAME}`;
   const canonicalPath = localizedPagePath(pageId, locale);
-  const image = absoluteSiteUrl(`/api/og/${locale}/${pageId}`);
+  const image = siteUrl(origin, `/api/og/${locale}/${pageId}`);
   const languageAlternates = Object.fromEntries(
     locales.map((availableLocale) => [
       availableLocale,
-      absoluteSiteUrl(localizedPagePath(pageId, availableLocale)),
+      siteUrl(origin, localizedPagePath(pageId, availableLocale)),
     ]),
   );
 
@@ -27,7 +59,7 @@ export function createPageMetadata(pageId: SeoPageId, locale: AppLocale): Metada
     title,
     description: page.description,
     alternates: {
-      canonical: absoluteSiteUrl(canonicalPath),
+      canonical: siteUrl(origin, canonicalPath),
       languages: languageAlternates,
     },
     openGraph: {
@@ -35,7 +67,7 @@ export function createPageMetadata(pageId: SeoPageId, locale: AppLocale): Metada
       siteName: SITE_NAME,
       title,
       description: page.description,
-      url: absoluteSiteUrl(canonicalPath),
+      url: siteUrl(origin, canonicalPath),
       locale: locale === 'ru' ? 'ru_RU' : 'en_US',
       alternateLocale: locale === 'ru' ? ['en_US'] : ['ru_RU'],
       images: [{ url: image, width: 1200, height: 630, alt: `${title} — ${page.eyebrow}` }],
@@ -48,3 +80,28 @@ export function createPageMetadata(pageId: SeoPageId, locale: AppLocale): Metada
     },
   };
 }
+
+/**
+ * Sitemap entries for one origin — the same value for every request that
+ * arrives on that address, so it is built once per address.
+ */
+export const sitemapForOrigin = cacheByOrigin(
+  (origin: string) => origin,
+  (origin: string): MetadataRoute.Sitemap =>
+    publicPageIds.flatMap(
+      (pageId): MetadataRoute.Sitemap =>
+        locales.map((locale) => ({
+          url: siteUrl(origin, localizedPagePath(pageId, locale)),
+          changeFrequency: pageId === 'home' ? 'weekly' : 'monthly',
+          priority: pageId === 'home' ? 1 : 0.7,
+          alternates: {
+            languages: Object.fromEntries(
+              locales.map((availableLocale) => [
+                availableLocale,
+                siteUrl(origin, localizedPagePath(pageId, availableLocale)),
+              ]),
+            ),
+          },
+        })),
+    ),
+);

package/template/packages/frontend/src/lib/seo/pages.ts

@@ -1,8 +1,8 @@
-import { appIdentity } from '@app/config/identity';
+import { appDeclaration } from '@app/config/declaration';
 import { z } from 'zod';
 import type { AppLocale } from '@/i18n/locales';
 
-export const SITE_NAME = appIdentity.name;
+export const SITE_NAME = appDeclaration.identity.name;
 export const StoryIdSchema = z.enum(['components', 'themes', 'blocks']);
 export type StoryId = z.infer<typeof StoryIdSchema>;