dh-remixer-sdk 0.0.45-fa836ab → 0.0.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dh-remixer-sdk",
-  "version": "0.0.45-fa836ab",
+  "version": "0.0.45",
   "type": "module",
   "files": [
     "templates",

package/scripts/ssg-helmet/no-settings.test.mjs

@@ -26,7 +26,11 @@ const DEVELOP_LD_JSON = (name, description) => ({
   sameAs: [],
 });
 
+const ROUTE_TABLE = { routerFound: true, complete: true, hasCatchAll: true, patterns: ["/", "/about"] };
+const notFoundPrerenders = [];
+
 const read = (file) => fs.readFileSync(path.join(BUILD_DIR, file), "utf8");
+const exists = (file) => fs.existsSync(path.join(BUILD_DIR, file));
 const ldJson = (html) => JSON.parse(html.match(/<script type="application\/ld\+json">([\s\S]*?)<\/script>/)[1]);
 let resolveRobotsTxt;
 let buildSitemapXml;
@@ -45,7 +49,7 @@ before(async () => {
   const { markStaticHead } = await import("./inject-metadata-head.mjs");
   const { writeHelmetFile } = await import("./fs-utils.mjs");
   const { parseHtmlForContactInfo, applyBusinessLdJson } = await import("./parse-html-for-contact-info.mjs");
-  const { writeSiteFiles } = await import("./site-files.mjs");
+  const { writeNotFoundPageInTime, writeSiteFiles } = await import("./site-files.mjs");
   ({ resolveRobotsTxt } = await import("./robots-txt.mjs"));
   ({ buildSitemapXml } = await import("./build-sitemap-xml.mjs"));
 
@@ -67,7 +71,11 @@ before(async () => {
     await parseHtmlForContactInfo(html);
   }
   await applyBusinessLdJson();
-  await writeSiteFiles({ sitemapRoutes: ["/", "/about"], orphanRoutes: [], routeTable: { routerFound: false } });
+  await writeSiteFiles({ sitemapRoutes: ["/", "/about"], orphanRoutes: [], routeTable: ROUTE_TABLE });
+  await writeNotFoundPageInTime({
+    routeTable: ROUTE_TABLE,
+    prerender: async (route) => (notFoundPrerenders.push(route), SPA_INDEX),
+  });
 });
 
 test("without a settings file the JSON-LD is develop's minus the invented price range, with no FAQPage", () => {
@@ -89,9 +97,16 @@ test("without a settings file the only head changes are the rebased loopback can
   assert.match(about, /<!-- remixer:integrations:head --><meta name="google-site-verification" content="abc" \/><!-- \/remixer:integrations:head -->/);
 });
 
-test("without a settings file the site's own llms.txt is kept and the additions are written", () => {
+test("without a settings file the site's own llms.txt is kept and no llms additions are written", () => {
   assert.equal(read("llms.txt"), "# Wilton House\n\n> Curated by the site.\n");
-  assert.ok(fs.existsSync(path.join(BUILD_DIR, "llms-full.txt")));
-  assert.ok(fs.existsSync(path.join(BUILD_DIR, "index.md")));
-  assert.ok(fs.existsSync(path.join(BUILD_DIR, "about.md")));
+  assert.equal(exists("llms-full.txt"), false);
+  assert.equal(exists("index.md"), false);
+  assert.equal(exists("about.md"), false);
+});
+
+test("without a settings file there is no 404.html, _routes.json or seo-review.json, and no not-found prerender", () => {
+  assert.equal(exists("404.html"), false);
+  assert.equal(exists("_routes.json"), false);
+  assert.equal(exists("seo-review.json"), false);
+  assert.deepEqual(notFoundPrerenders, []);
 });

package/scripts/ssg-helmet/robots-txt.mjs

@@ -2,7 +2,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { SEO_SETTINGS } from "./vars.mjs";
 import {
-  hasAccessSettings,
+  hasSeoSettings,
   isAccessAllowed,
   isPrivateSite,
   siteOrigin,
@@ -63,7 +63,7 @@ export function presetRobotsTxt(settings, origin) {
 }
 
 export function resolveRobotsTxt(existing, targetDomain, settings = {}) {
-  if (hasAccessSettings(settings) || isPrivateSite(settings)) {
+  if (hasSeoSettings(settings) || isPrivateSite(settings)) {
     return presetRobotsTxt(settings, siteOrigin(settings, targetDomain));
   }
 

package/scripts/ssg-helmet/seo-only-files.test.mjs

@@ -0,0 +1,67 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const BUILD_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "ssg-seo-only-files-"));
+process.env.REMIXER_BUILD_DIR = BUILD_DIR;
+process.env.NEXT_PUBLIC_DOMAIN = "wiltonhouse.com";
+delete process.env.REMIXER_SEO_SETTINGS;
+delete process.env.GEO_CODER_API_KEY;
+
+const { writeNotFoundPageInTime, writeSiteFiles } = await import("./site-files.mjs");
+
+const SEO_ONLY_FILES = ["llms.txt", "llms-full.txt", "index.md", "about.md", "404.html", "_routes.json", "seo-review.json"];
+const ROUTE_TABLE = { routerFound: true, complete: true, hasCatchAll: false, patterns: ["/", "/about"] };
+
+const ALL_DEFAULT_SETTINGS = {
+  siteUrl: "https://wiltonhouse.com",
+  access: { search: true, assistants: true, training: true, llmsTxt: true, indexNow: true },
+  business: {
+    name: null,
+    type: null,
+    address: null,
+    phone: null,
+    email: null,
+    hours: [],
+    hoursNote: null,
+    priceRange: null,
+    serviceArea: null,
+    links: [],
+    siteIconUrl: null,
+  },
+  pages: {},
+  redirects: [],
+  private: false,
+  screenshots: true,
+};
+const PLATFORM_HOST_MARKER = { siteUrl: "https://wilton.example-cdn.com", private: true };
+
+const LONG = "Honest cocktails and small plates in a warm room on Main Street. ".repeat(3);
+const page = (title) =>
+  `<!doctype html><html lang="en"><head><title>${title}</title><meta name="description" content="${title} at Wilton House."></head><body><div id="root"><main><h1>${title}</h1><p>${LONG}</p></main></div></body></html>`;
+
+async function seoOnlyFilesBuiltWith(settings) {
+  fs.rmSync(BUILD_DIR, { recursive: true, force: true });
+  fs.mkdirSync(path.join(BUILD_DIR, "about"), { recursive: true });
+  fs.writeFileSync(path.join(BUILD_DIR, "index.html"), page("Wilton House"));
+  fs.writeFileSync(path.join(BUILD_DIR, "about", "index.html"), page("About"));
+
+  await writeSiteFiles({ sitemapRoutes: ["/", "/about"], orphanRoutes: [], routeTable: ROUTE_TABLE }, settings);
+  await writeNotFoundPageInTime({ routeTable: ROUTE_TABLE, prerender: async () => null }, settings);
+
+  return SEO_ONLY_FILES.filter((file) => fs.existsSync(path.join(BUILD_DIR, file)));
+}
+
+test("an activated project with every setting at its default gets every SEO-only file", async () => {
+  assert.deepEqual(await seoOnlyFilesBuiltWith(ALL_DEFAULT_SETTINGS), SEO_ONLY_FILES);
+});
+
+test("the platform-host build of a project that never switched SEO on gets no SEO-only file", async () => {
+  assert.deepEqual(await seoOnlyFilesBuiltWith(PLATFORM_HOST_MARKER), []);
+});
+
+test("an empty settings object gets no SEO-only file", async () => {
+  assert.deepEqual(await seoOnlyFilesBuiltWith({}), []);
+});

package/scripts/ssg-helmet/seo-settings.mjs

@@ -51,7 +51,7 @@ export function pageSettings(settings, route) {
   return key && isPlainObject(pages[key]) ? pages[key] : undefined;
 }
 
-export const hasSeoSettings = (settings) => isPlainObject(settings) && Object.keys(settings).length > 0;
+export const hasSeoSettings = (settings) => isPlainObject(settings?.access);
 
 export const isPrivateSite = (settings) => settings?.private === true;
 
@@ -61,8 +61,6 @@ export const isRouteHidden = (settings, route) =>
 export const isRouteIndexable = (settings, route) =>
   !isPrivateSite(settings) && !isRouteHidden(settings, route);
 
-export const hasAccessSettings = (settings) => isPlainObject(settings?.access);
-
 export const isAccessAllowed = (settings, key) =>
   settings?.access?.[key] !== false;
 

package/scripts/ssg-helmet/seo-settings.test.mjs

@@ -5,6 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import {
   flattenRoutes,
+  hasSeoSettings,
   isAccessAllowed,
   isRouteIndexable,
   normalizeRoutePath,
@@ -36,6 +37,13 @@ test("a valid settings file is read as is", () => {
   assert.deepEqual(readSeoSettings(writeTemp(JSON.stringify(settings))), settings);
 });
 
+test("only the settings of a project that switched SEO on count as SEO settings", () => {
+  assert.equal(hasSeoSettings({}), false);
+  assert.equal(hasSeoSettings({ siteUrl: "https://wilton.example-cdn.com", private: true }), false);
+  assert.equal(hasSeoSettings({ siteUrl: "https://wiltonhouse.com", access: { search: true }, private: false }), true);
+  assert.equal(hasSeoSettings({ siteUrl: "https://wilton.example-cdn.com", access: { search: true }, private: true }), true);
+});
+
 test("routes are normalised on both sides of the page lookup", () => {
   const settings = { pages: { "/about/": { title: "About" }, "/": { title: "Home" } } };
 

package/scripts/ssg-helmet/site-files.mjs

@@ -16,6 +16,7 @@ import { STATIC_HEAD_ATTR } from "./inject-metadata-head.mjs";
 import { OPTIONAL_WORK_RESERVE_MS, RUN_CLOCK } from "./run-clock.mjs";
 import {
   flattenRoutes,
+  hasSeoSettings,
   isAccessAllowed,
   isPrivateSite,
   normalizeRoutePath,
@@ -150,6 +151,10 @@ export async function writeNotFoundPageInTime(
   { routeTable, prerender, clock = RUN_CLOCK },
   settings = SEO_SETTINGS,
 ) {
+  if (!hasSeoSettings(settings)) {
+    console.log("[skipped] 404.html (SEO not switched on)");
+    return;
+  }
   let prerendered = null;
   if (routeTable?.hasCatchAll && clock.hasTimeFor(OPTIONAL_WORK_RESERVE_MS)) {
     prerendered = await prerender(NOT_FOUND_PROBE_ROUTE).catch((err) => {
@@ -169,8 +174,12 @@ export async function writeSiteFiles(
   await writeSitemapXml(sitemapRoutes, settings);
   await writeRobotsTxt(REMIXER_BUILD_DIR, TARGET_DOMAIN, settings);
   await optionalStep("_redirects.json", () => writeRedirectsJson(settings));
-  await optionalStep("_routes.json", () => writeRoutesJson(routeTable));
   await optionalStep("IndexNow key", () => writeIndexNowKeyFile(settings));
+  if (!hasSeoSettings(settings)) {
+    console.log(`[skipped] _routes.json, llms files and ${REVIEW_FILE} (SEO not switched on)`);
+    return;
+  }
+  await optionalStep("_routes.json", () => writeRoutesJson(routeTable));
   await optionalStep("llms.txt", () => writeLlmsFiles(flattenRoutes(sitemapRoutes), settings));
   await optionalStep(REVIEW_FILE, () => writeSeoReview({ sitemapRoutes, orphanRoutes }, settings));
 }

package/scripts/ssg-helmet/site-files.test.mjs

@@ -118,13 +118,29 @@ test("the IndexNow key file is written only when IndexNow is on and the key is w
 });
 
 const PRERENDERED_NOT_FOUND = `<html lang="en"><head><title>Not found | Site</title></head><body><h1>We could not find that page</h1></body></html>`;
+const SWITCHED_ON = { access: { search: true, assistants: true, training: true, llmsTxt: true, indexNow: true } };
 const clockAt = (elapsedMs) => createRunClock({ now: () => elapsedMs });
 
+test("without SEO settings the not-found page is neither prerendered nor written", async () => {
+  fs.rmSync(path.join(BUILD_DIR, "404.html"), { force: true });
+  const rendered = [];
+
+  for (const settings of [{}, { siteUrl: "https://wilton.example-cdn.com", private: true }]) {
+    await writeNotFoundPageInTime(
+      { routeTable: { hasCatchAll: true }, prerender: async (route) => (rendered.push(route), PRERENDERED_NOT_FOUND), clock: clockAt(0) },
+      settings,
+    );
+  }
+
+  assert.deepEqual(rendered, []);
+  assert.equal(existsInBuild("404.html"), false);
+});
+
 test("the not-found page is prerendered when the catch-all exists and enough time remains", async () => {
   const rendered = [];
   await writeNotFoundPageInTime(
     { routeTable: { hasCatchAll: true }, prerender: async (route) => (rendered.push(route), PRERENDERED_NOT_FOUND), clock: clockAt(300_000) },
-    {},
+    SWITCHED_ON,
   );
 
   assert.deepEqual(rendered, [NOT_FOUND_PROBE_ROUTE]);
@@ -135,7 +151,7 @@ test("the not-found page falls back to the plain page when less than 120 seconds
   const rendered = [];
   await writeNotFoundPageInTime(
     { routeTable: { hasCatchAll: true }, prerender: async (route) => (rendered.push(route), PRERENDERED_NOT_FOUND), clock: clockAt(810_000 - 119_000) },
-    {},
+    SWITCHED_ON,
   );
 
   assert.deepEqual(rendered, []);
@@ -145,7 +161,8 @@ test("the not-found page falls back to the plain page when less than 120 seconds
 
 test("without a catch-all the plain page is written and nothing is prerendered", async () => {
   const rendered = [];
-  await writeNotFoundPageInTime({ routeTable: { hasCatchAll: false }, prerender: async (route) => rendered.push(route), clock: clockAt(0) }, {});
+  fs.rmSync(path.join(BUILD_DIR, "404.html"), { force: true });
+  await writeNotFoundPageInTime({ routeTable: { hasCatchAll: false }, prerender: async (route) => rendered.push(route), clock: clockAt(0) }, SWITCHED_ON);
 
   assert.deepEqual(rendered, []);
   assert.match(readBuild("404.html"), /<h1>Page not found<\/h1>/);

package/scripts/ssg-helmet/site-wide-canonical.test.mjs

@@ -38,7 +38,14 @@ const read = (file) => fs.readFileSync(path.join(BUILD_DIR, file), "utf8");
 before(async () => {
   fs.mkdirSync(path.join(BUILD_DIR, "assets"), { recursive: true });
   fs.writeFileSync(path.join(BUILD_DIR, "index.html"), SPA_INDEX);
-  fs.writeFileSync(SETTINGS_FILE, JSON.stringify({ siteUrl: SITE_URL, private: false }));
+  fs.writeFileSync(
+    SETTINGS_FILE,
+    JSON.stringify({
+      siteUrl: SITE_URL,
+      access: { search: true, assistants: true, training: true, llmsTxt: true, indexNow: true },
+      private: false,
+    }),
+  );
 
   process.env.REMIXER_BUILD_DIR = BUILD_DIR;
   process.env.REMIXER_SEO_SETTINGS = SETTINGS_FILE;

package/templates/base/remixer/core.ts

@@ -11,7 +11,7 @@ type RuntimeAuthHeaders = {
   tokenSource: 'anonymous' | 'session';
 };
 
-async function runtimeAuthHeaders(url: string, method: string): Promise<RuntimeAuthHeaders> {
+async function runtimeAuthHeaders(url: string, method: string, nonce?: string): Promise<RuntimeAuthHeaders> {
   const session = await getProjectSession();
   const tokenSource = session?.access_token ? 'session' : 'anonymous';
   const token = session?.access_token ?? await getAnonymousToken();
@@ -19,7 +19,7 @@ async function runtimeAuthHeaders(url: string, method: string): Promise<RuntimeA
   return {
     headers: {
       Authorization: `Bearer ${token}`,
-      DPoP: await createDpopProof(url, method),
+      DPoP: await createDpopProof(url, method, nonce),
     },
     tokenSource,
   };
@@ -34,8 +34,9 @@ export async function runtimeJsonFetch(
   method: 'GET' | 'POST',
   body?: RemixerRecordData,
   retryOnUnauthorized = true,
+  dpopNonce?: string,
 ) {
-  const { headers, tokenSource } = await runtimeAuthHeaders(url, method);
+  const { headers, tokenSource } = await runtimeAuthHeaders(url, method, dpopNonce);
   const response = await fetch(url, {
     method,
     headers: {
@@ -45,9 +46,19 @@ export async function runtimeJsonFetch(
     body: body ? JSON.stringify(body) : undefined,
   });
 
-  if (response.status === 401 && retryOnUnauthorized && tokenSource === 'anonymous') {
-    clearAnonymousToken();
-    return runtimeJsonFetch(url, method, body, false);
+  if (response.status === 401) {
+    // RFC 9449 §9: the server challenges an expired/skewed proof with a DPoP-Nonce. Echo it back
+    // in a re-signed proof and retry once — the client's clock error becomes irrelevant. Gated on
+    // `!dpopNonce` so this never loops: a retry that already carried a nonce and still 401'd falls
+    // through to the token-retry path below instead.
+    const challengeNonce = response.headers.get('DPoP-Nonce');
+    if (challengeNonce && !dpopNonce) {
+      return runtimeJsonFetch(url, method, body, retryOnUnauthorized, challengeNonce);
+    }
+    if (retryOnUnauthorized && tokenSource === 'anonymous') {
+      clearAnonymousToken();
+      return runtimeJsonFetch(url, method, body, false);
+    }
   }
 
   return response;

package/templates/base/remixer/dpop.ts

@@ -104,7 +104,7 @@ export async function getThumbprint() {
   return cachedThumbprint;
 }
 
-export async function createDpopProof(url: string, method: string) {
+export async function createDpopProof(url: string, method: string, nonce?: string) {
   const { privateKey } = await getDpopKeyPair();
   const publicJwk = await getPublicJwk();
   const header = {
@@ -117,6 +117,7 @@ export async function createDpopProof(url: string, method: string) {
     htu: url,
     iat: Math.floor(Date.now() / 1000),
     jti: crypto.randomUUID(),
+    ...(nonce ? { nonce } : {}),
   };
   const signingInput = `${base64Url(new TextEncoder().encode(JSON.stringify(header)))}.${base64Url(new TextEncoder().encode(JSON.stringify(payload)))}`;
   const signature = await crypto.subtle.sign(

package/templates/base/remixer/seo.tsx

@@ -113,7 +113,15 @@ function findPage(pages: Record<string, RemixerSeoPage> | undefined, path: strin
   return key ? pages[key] : undefined;
 }
 
-export function RemixerSeo() {
+function hasPageOverrides() {
+  return Object.keys(getRemixerSeo()?.pages ?? {}).length > 0;
+}
+
+function isFramed() {
+  return window.parent !== window;
+}
+
+function RemixerSeoOverrides() {
   const snapshot = useSyncExternalStore(subscribeToHead, headSnapshot, () => '/#0');
   const seo = getRemixerSeo();
   const page = findPage(seo?.pages, currentPath());
@@ -138,4 +146,12 @@ export function RemixerSeo() {
   );
 }
 
+export function RemixerSeo() {
+  if (!hasPageOverrides() && !isFramed()) {
+    return null;
+  }
+
+  return <RemixerSeoOverrides />;
+}
+
 export default RemixerSeo;