orionplace-nuxt 0.4.0 → 0.6.0

package/README.md

@@ -8,7 +8,7 @@ account, journal and support, in English and Russian. The package includes a Nux
 setup CLI and the full storefront source, so every page and component in your
 project is yours to change.
 
-- **Setup CLI:** `init`, `set backend`, `add frontend`, `set mimic` and `update`.
+- **Setup CLI:** `init`, `set backend`, `add frontend`, `set mimic`, `sitemap rebuild` and `update`.
 - **Server install:** `install` builds the storefront on your Linux server and
   runs it as a system service behind nginx with HTTPS.
 - **API gateway:** the browser calls `/api/...` on your own domain; the server
@@ -129,7 +129,7 @@ Framework imports such as `#imports` keep their own names.
 <!-- components:start (generated by scripts/generate-package-readme-components.mjs) -->
 ## Components
 
-The starter includes **124 storefront components**, copied into
+The starter includes **126 storefront components**, copied into
 `app/components/orionplace/` of your project. Each one has a README in English and Russian
 next to its source that describes its inputs, data and actions.
 
@@ -294,6 +294,8 @@ Journal content and customer contact flows.
 | **Contact details** | `AboutPage` | Display the store’s published company and contact information. |
 | **Contact form** | `ContactForm` | Sending a question to the store. |
 | **Unsubscribe from emails** | `EmailUnsubscribe` | Confirming an unsubscribe request from an email link. |
+| **Privacy policy page** | `StorefrontPrivacy` | The store’s personal data policy with a cookies section and the operator’s details. |
+| **Cookie notice** | `CookieNotice` | A small notice about the necessary cookies with a link to the cookies section of the policy. |
 
 ### Shared interface
 
@@ -318,6 +320,8 @@ npx orionplace-nuxt add frontend shop.example.com
 npx orionplace-nuxt add frontend www.shop.example.com
 npx orionplace-nuxt remove frontend www.shop.example.com
 npx orionplace-nuxt set mimic shop.example.com
+npx orionplace-nuxt sitemap rebuild [shop.example.com]
+npx orionplace-nuxt sitemap status
 sudo npx orionplace-nuxt install
 npx orionplace-nuxt status
 sudo npx orionplace-nuxt restart
@@ -334,8 +338,15 @@ npm run orionplace:remove-frontend -- www.shop.example.com
 npm run orionplace:mimic -- shop.example.com
 npm run orionplace:help
 npm run orionplace:update
+npm run orionplace:sitemap
 ```
 
+The storefront serves `/robots.txt` and `/sitemap.xml` (public pages, categories,
+products and journal publications in every language). The sitemap is rebuilt
+from the backend once an hour; `npm run orionplace:sitemap` rebuilds it at once,
+for example after new publications, and the running storefront serves it without
+a restart.
+
 `npm set` belongs to npm's own configuration system; use the commands above.
 The setup commands configure local integration files. They do not provision a
 backend, change your account or create DNS records. `install` deploys the
@@ -1096,10 +1107,14 @@ red `*` directly after the label text.
 
 The default layout renders the [footer](https://orionmarket.place/en/sandbox/components/nuxt/footer)
 with real store categories, home-section anchors, profile/journal navigation,
-a contact-page link and social links. On `/contact`, `StorefrontContact` places
+a contact-page link, a `/privacy` link and social links. On `/contact`, `StorefrontContact` places
 company details (address, `tel:` phone link, registration numbers with copy
 buttons and social links) in a column beside the bordered message-form panel;
-the columns stack on narrow screens and empty details are hidden.
+the columns stack on narrow screens and empty details are hidden. `/privacy`
+shows the store's privacy policy (`StorefrontPrivacy`, texts in
+`app/utils/orionplace/privacyLabels.ts`) with the operator's details; on the
+website the layout's `CookieNotice` links its `#cookies` section until the
+visitor dismisses it.
 The home banner spans the available viewport
 width without a frame. Its media area keeps the same proportions at every width; the image fills the
 area without distortion and crops its edges when needed. Event media keeps its

package/bin/orionplace-nuxt.mjs

@@ -3,6 +3,7 @@ import { setupProject } from '../src/setup.mjs';
 import { updateProject } from '../src/update.mjs';
 import { installService } from '../src/install.mjs';
 import { SERVICE_ACTIONS, SERVICE_ALIASES, controlService, findApp, printService } from '../src/service.mjs';
+import { sitemapCommand } from '../src/sitemap.mjs';
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
@@ -30,6 +31,9 @@ Commands for an existing project (run from its root):
   npx orionplace-nuxt remove frontend <shop.example.com>
   npx orionplace-nuxt set mimic <existing-frontend.example.com>
   npx orionplace-nuxt set frontend <shop.example.com>
+  npx orionplace-nuxt sitemap rebuild [domain]   rebuild /sitemap.xml now (every frontend, or one);
+                                       the running storefront serves it at once
+  npx orionplace-nuxt sitemap status [domain]    when each sitemap was built
 
 On your Linux server (run from the project root):
   sudo npx orionplace-nuxt install
@@ -130,6 +134,9 @@ try {
       }
       const done       = await controlService({ action: command, cwd, name: install.name, lines: positional[1] ?? 100, follow, dryRun });
       process.exitCode = printService(done);
+    } else if (command === 'sitemap' && positional.length <= 3) {
+      if (dryRun) throw new Error('--dry-run is not a sitemap option; sitemap status shows the state without changes.');
+      process.exitCode = await sitemapCommand({ cwd, action: target, domain: positional[2] });
     } else if (command === 'init' && positional.length <= 2) {
       result = await setupProject({ cwd: target ? resolve(cwd, target) : cwd, dryRun });
     } else if (command === 'update' && positional.length === 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionplace-nuxt",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Nuxt 4 storefront for your Orionplace marketplace: setup CLI, server API gateway, typed store and ready-made catalog, cart, checkout and account components in English and Russian, plus an Android app build.",
   "type": "module",
   "license": "MIT",

package/runtime/marketplace.mjs

@@ -1,5 +1,5 @@
-import { readFile } from 'node:fs/promises';
-import { resolve } from 'node:path';
+import { chown, mkdir, readFile, readdir, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { dirname, relative, resolve } from 'node:path';
 import {
   getDefaultAutoSelectFamilyAttemptTimeout,
   isIP,
@@ -81,8 +81,20 @@ export async function readMarketplace(request, configuration = {}) {
   if (!domain) {
     throw new Error('Invalid storefront domain');
   }
+  return readMarketplaceDomain(domain);
+}
 
-  const directory = environment.SITEMAPS_DIR || resolve('sitemaps');
+/**
+ * The marketplace of one storefront domain: its `sitemaps/<domain>.cfg` in
+ * the project (`root`, the working directory by default).
+ * @param {string} name @param {{root?: string}} options
+ */
+export async function readMarketplaceDomain(name, options = {}) {
+  const domain    = normalizeFrontDomain(name);
+  if (!domain) {
+    throw new Error('Invalid storefront domain');
+  }
+  const directory = marketplaceConfigDirectory(options.root);
   const source    = await readFile(resolve(directory, `${domain}.cfg`), 'utf8');
   const lines     = source
     .split(/\r?\n/)
@@ -111,6 +123,13 @@ export async function readMarketplace(request, configuration = {}) {
   return { domain, api };
 }
 
+/** The folder of the domain files (`SITEMAPS_DIR`, or `sitemaps`). */
+export function marketplaceConfigDirectory(root = process.cwd()) {
+  return environment.SITEMAPS_DIR
+    ? resolve(root, environment.SITEMAPS_DIR)
+    : resolve(root, 'sitemaps');
+}
+
 /** @param {number} status @param {string} message */
 function failure(status, message) {
   return Response.json(
@@ -297,3 +316,471 @@ export async function forwardMarketplace(request, configuration = {}) {
     headers: responseHeaders,
   });
 }
+
+// ---------------------------------------------------------------------------
+// robots.txt and sitemap.xml
+//
+// The sitemap lists the storefront's public pages in every language the
+// marketplace offers (`?locale=<code>` links, with hreflang alternates): the
+// home, catalog and directory pages, the journal and its publications when
+// the blog is on, the subscription plans when there are any, every public
+// category and every product on sale. It is built from the backend's public
+// API and kept for an hour per storefront domain in
+// node_modules/.cache/orionplace/sitemaps/<domain>.json (ORIONPLACE_CACHE_DIR
+// moves it). "orionplace-<framework> sitemap rebuild" rebuilds that file at
+// once; the running storefront serves the new file without a restart.
+
+export const SITEMAP_LIFETIME = 60 * 60 * 1000;
+const sitemapPageSize = 100;
+const sitemapMaxPages = 500;
+const sitemapMaxUrls  = 50_000;
+const sitemapVersion  = 1;
+/** Built sitemaps of this process, for when the cache folder is read-only. */
+const sitemapMemory   = new Map();
+/** @type {Map<string, Promise<object>>} */
+const sitemapBuilds   = new Map();
+
+/** The public origin a crawler used: the storefront host, or a local one. */
+export function marketplacePublicOrigin(request, tenantDomain = '') {
+  const url  = new URL(request.url);
+  const host = normalizeFrontDomain(
+    request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? '',
+  );
+  if (host) {
+    return `https://${host}`;
+  }
+  const local = /^(?:localhost|127(?:\.\d{1,3}){3}|\[::1\])$/.test(url.hostname);
+  return local || !tenantDomain ? url.origin : `https://${tenantDomain}`;
+}
+
+/** @param {string} origin */
+export function marketplaceRobots(origin) {
+  return `User-agent: *\nDisallow: /api/\nAllow: /\n\nSitemap: ${origin}/sitemap.xml\n`;
+}
+
+/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
+export async function marketplaceRobotsResponse(request, configuration = {}) {
+  let domain = '';
+  try {
+    domain = (await readMarketplace(request, configuration)).domain;
+  } catch {
+    domain = '';
+  }
+  return new Response(
+    marketplaceRobots(marketplacePublicOrigin(request, domain)),
+    {
+      headers: {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'public, max-age=3600',
+        'Vary': 'Host, X-Forwarded-Host, X-Front-Domain',
+      },
+    },
+  );
+}
+
+/** @param {string} value */
+function escapeXml(value) {
+  return value.replace(/[<>&"']/g, (character) => ({
+    '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&apos;',
+  })[character]);
+}
+
+/** @param {unknown} value */
+function publicId(value) {
+  const id = Number(value);
+  return Number.isSafeInteger(id) && id > 0 ? id : null;
+}
+
+/** The marketplace's languages from /appload `init.locale`. */
+export function sitemapLocales(locales) {
+  const codes = Object.entries(locales && typeof locales === 'object' ? locales : {})
+    .map(([key, item]) => String(item?.code || key).trim().toLowerCase())
+    .filter((code) => /^[a-z]{2,3}(?:-[a-z0-9]{2,8})*$/.test(code));
+  return [...new Set(codes)].sort();
+}
+
+/** A product edit time (ISO 8601) or a blog post day ({date: 'DD.MM.YYYY'}). */
+export function sitemapLastmod(value, now = Date.now()) {
+  if (typeof value === 'string' && value) {
+    const time = Date.parse(value);
+    return Number.isFinite(time) && time <= now + 60_000
+      ? new Date(time).toISOString().replace(/\.\d{3}Z$/, 'Z')
+      : null;
+  }
+  const match = /^(\d{2})\.(\d{2})\.(\d{4})$/.exec(value?.date ?? '');
+  if (!match) {
+    return null;
+  }
+  const [, day, month, year] = match;
+  const time  = Date.UTC(Number(year), Number(month) - 1, Number(day));
+  const date  = new Date(time);
+  return date.getUTCDate() === Number(day) &&
+    date.getUTCMonth() === Number(month) - 1 &&
+    time <= now + 24 * 60 * 60 * 1000
+    ? `${year}-${month}-${day}`
+    : null;
+}
+
+/** The API path (under /api) of a route named in /appload `unauth.paths`. */
+export function sitemapApiPath(paths, name) {
+  for (const group of Object.values(paths ?? {})) {
+    for (const route of Object.values(group ?? {})) {
+      if (route?.url_name === name) {
+        const target = String(route.target ?? '').split('/{')[0].replace(/^\/+/, '');
+        return target.startsWith('api/') ? `/${target}` : null;
+      }
+    }
+  }
+  return null;
+}
+
+/** Public categories, parents before children. */
+export function sitemapCategoryIds(categories) {
+  const ids   = [];
+  const visit = (category) => {
+    const id = publicId(category?.id);
+    if (id && category?.is_public) {
+      ids.push(id);
+    }
+    (category?.childs ?? []).forEach(visit);
+  };
+  (Array.isArray(categories) ? categories : []).forEach(visit);
+  return [...new Set(ids)];
+}
+
+/**
+ * One <url> per page and language, each with alternates for its languages.
+ * A page with its own `locales` (a publication written in some languages
+ * only) is listed in those of the marketplace's languages.
+ * @param {string} origin
+ * @param {{path: string, lastmod?: string | null, locales?: string[]}[]} pages
+ * @param {string[]} locales
+ */
+export function marketplaceSitemapXml(origin, pages, locales) {
+  const href  = (path, code) => {
+    const url = new URL(path, `${origin}/`);
+    if (code) {
+      url.searchParams.set('locale', code);
+    }
+    return escapeXml(url.toString());
+  };
+  const urls  = [];
+  for (const page of pages) {
+    const own        = page.locales
+      ? locales.filter((code) => page.locales.includes(code))
+      : locales;
+    if (page.locales && !own.length) {
+      continue;
+    }
+    const codes      = own.length ? own : [''];
+    const alternates = own.length > 1
+      ? own.map((code) =>
+        `    <xhtml:link rel="alternate" hreflang="${escapeXml(code)}" href="${href(page.path, code)}" />\n`).join('')
+      : '';
+    const lastmod    = page.lastmod ? `    <lastmod>${escapeXml(page.lastmod)}</lastmod>\n` : '';
+    for (const code of codes) {
+      if (urls.length >= sitemapMaxUrls) {
+        break;
+      }
+      urls.push(`  <url>\n    <loc>${href(page.path, code)}</loc>\n${lastmod}${alternates}  </url>\n`);
+    }
+  }
+  return '<?xml version="1.0" encoding="UTF-8"?>\n' +
+    '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">\n' +
+    urls.join('') +
+    '</urlset>\n';
+}
+
+/** @param {{domain: string, api: URL}} tenant @param {string} path @param {unknown} body */
+async function sitemapRequest(tenant, path, body) {
+  const response = await fetch(new URL(path, tenant.api.origin), {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      'X-Front-Domain': tenant.domain,
+    },
+    body: JSON.stringify(body),
+    cache: 'no-store',
+    signal: AbortSignal.timeout(requestTimeout),
+  });
+  if (!response.ok) {
+    throw new Error(`${path} answered ${response.status}`);
+  }
+  return response.json();
+}
+
+/** Every record of a paginated list (`page_data[key].data` + `rpag`). */
+async function sitemapList(tenant, path, key, filters = {}) {
+  const records = new Map();
+  let page      = 1;
+  for (let count = 0; count < sitemapMaxPages; count++) {
+    const payload = await sitemapRequest(tenant, path, {
+      filters,
+      paginate: { page, pp_items: sitemapPageSize },
+    });
+    const list    = payload?.page_data?.[key];
+    if (!Array.isArray(list?.data)) {
+      throw new Error(`${path} returned no ${key} list`);
+    }
+    for (const record of list.data) {
+      const id = publicId(record?.id);
+      if (id) {
+        records.set(id, record);
+      }
+    }
+    const next    = Number(list.rpag?.next_page_number);
+    if (!list.rpag?.has_next || !Number.isSafeInteger(next) || next <= page) {
+      return [...records.values()];
+    }
+    page          = next;
+  }
+  throw new Error(`${path} has more than ${sitemapMaxPages} pages`);
+}
+
+/** Products on sale and in stock states a shopper can open. */
+function productOnSale(product) {
+  const status = Number(product?.status?.status ?? product?.status);
+  return [2, -2, -3].includes(status);
+}
+
+/** Blog publications that are published. */
+function postPublished(post) {
+  const state = post?.publishing_state?.int ?? post?.publishing_state;
+  return state === undefined || state === null || Number(state) === 1;
+}
+
+/** The languages a publication is written in (it has a title there). */
+function postLocales(post) {
+  return Object.entries(post?.locale && typeof post.locale === 'object' ? post.locale : {})
+    .filter(([, text]) => typeof text?.post_title === 'string' && text.post_title.trim())
+    .map(([code]) => code.toLowerCase());
+}
+
+/** @param {{domain: string, api: URL}} tenant */
+async function buildMarketplaceSitemap(tenant) {
+  const appload    = await sitemapRequest(tenant, '/api/appload', {
+    detalize_mode: 'light',
+    ignore_cache: false,
+  });
+  const init       = appload?.page_data?.init;
+  const paths      = appload?.page_data?.unauth?.paths;
+  if (!init || !Array.isArray(init.catalog)) {
+    throw new Error('appload returned no catalog');
+  }
+  const locales    = sitemapLocales(init.locale);
+  const categories = sitemapCategoryIds(init.catalog);
+  const blogPath   = sitemapApiPath(paths, 'blog_posts_get');
+  const searchPath = sitemapApiPath(paths, 'products_search');
+  const [products, posts] = await Promise.all([
+    searchPath && categories.length
+      ? sitemapList(tenant, searchPath, 'products', { categories })
+      : [],
+    blogPath ? sitemapList(tenant, blogPath, 'posts') : [],
+  ]);
+  const postPages  = posts
+    .filter(postPublished)
+    .sort((left, right) => left.id - right.id)
+    .map((post) => ({
+      path: `/journal/${post.id}`,
+      lastmod: sitemapLastmod(post.date_updated),
+      locales: postLocales(post),
+    }));
+  const newestPost = postPages.map((page) => page.lastmod).filter(Boolean).sort().at(-1) ?? null;
+  const pages      = [
+    { path: '/' },
+    { path: '/catalog' },
+    ...(blogPath ? [{ path: '/journal', lastmod: newestPost }] : []),
+    ...(init.tariffs?.data?.length ? [{ path: '/tariffs' }] : []),
+    { path: '/manufacturers' },
+    ...(init.visual_settings?.single_seller_mode ? [] : [{ path: '/sellers' }]),
+    { path: '/stores' },
+    { path: '/contact' },
+    { path: '/privacy' },
+    ...categories.map((id) => ({ path: `/category/${id}` })),
+    ...products
+      .filter(productOnSale)
+      .map((product) => ({
+        path: `/product/${product.id}`,
+        lastmod: sitemapLastmod(product.date_updated),
+      })),
+    ...postPages,
+  ];
+  return {
+    version: sitemapVersion,
+    domain: tenant.domain,
+    built: new Date().toISOString(),
+    locales,
+    pages,
+  };
+}
+
+/** How many <url> entries a built sitemap has. */
+export function sitemapUrlCount(sitemap) {
+  let count = 0;
+  for (const page of sitemap.pages) {
+    const own = page.locales
+      ? sitemap.locales.filter((code) => page.locales.includes(code))
+      : sitemap.locales;
+    count    += page.locales ? own.length : Math.max(own.length, 1);
+  }
+  return Math.min(count, sitemapMaxUrls);
+}
+
+/** The cache folder of built sitemaps. */
+export function sitemapCacheDirectory(root = process.cwd()) {
+  return environment.ORIONPLACE_CACHE_DIR
+    ? resolve(root, environment.ORIONPLACE_CACHE_DIR, 'sitemaps')
+    : resolve(root, 'node_modules', '.cache', 'orionplace', 'sitemaps');
+}
+
+/** @param {string} domain @param {string} root */
+function sitemapCachePath(domain, root) {
+  return resolve(sitemapCacheDirectory(root), `${domain}.json`);
+}
+
+/** A cached sitemap of the domain, or null. @param {string} domain */
+export async function readSitemapCache(domain, root = process.cwd()) {
+  let sitemap;
+  try {
+    sitemap = JSON.parse(await readFile(sitemapCachePath(domain, root), 'utf8'));
+  } catch {
+    return null;
+  }
+  return sitemap?.version === sitemapVersion &&
+    sitemap.domain === domain &&
+    Number.isFinite(Date.parse(sitemap.built)) &&
+    Array.isArray(sitemap.locales) &&
+    Array.isArray(sitemap.pages)
+    ? sitemap
+    : null;
+}
+
+/**
+ * Write the cache file. When root writes it (sudo), the folders it creates
+ * and the file go to the project owner, so the storefront service can
+ * replace them later.
+ */
+async function writeSitemapCache(sitemap, root) {
+  const path      = sitemapCachePath(sitemap.domain, root);
+  const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+  await mkdir(dirname(path), { recursive: true });
+  try {
+    await writeFile(temporary, JSON.stringify(sitemap), { mode: 0o644 });
+    await rename(temporary, path);
+  } catch (error) {
+    await unlink(temporary).catch(() => {});
+    throw error;
+  }
+  if (process.getuid?.() === 0) {
+    const owner = await stat(root);
+    if (owner.uid !== 0) {
+      let cursor = path;
+      while (cursor !== root && !relative(root, cursor).startsWith('..')) {
+        const info = await stat(cursor);
+        if (info.uid === 0) {
+          await chown(cursor, owner.uid, owner.gid);
+        }
+        cursor = dirname(cursor);
+      }
+    }
+  }
+  return path;
+}
+
+/** @param {{domain: string, api: URL}} tenant @param {string} root */
+function buildOnce(tenant, root) {
+  let build = sitemapBuilds.get(tenant.domain);
+  if (!build) {
+    build = buildMarketplaceSitemap(tenant)
+      .then(async (sitemap) => {
+        sitemapMemory.set(tenant.domain, sitemap);
+        try {
+          await writeSitemapCache(sitemap, root);
+        } catch (error) {
+          console.error(`[orionplace] Sitemap cache not written: ${error?.code ?? error?.message ?? error}`);
+        }
+        return sitemap;
+      })
+      .finally(() => sitemapBuilds.delete(tenant.domain));
+    sitemapBuilds.set(tenant.domain, build);
+  }
+  return build;
+}
+
+/**
+ * Rebuild the sitemap of one storefront domain now and store it where the
+ * running storefront reads it (the "sitemap rebuild" command).
+ * @param {string} domain @param {{root?: string}} options
+ */
+export async function rebuildMarketplaceSitemap(domain, options = {}) {
+  const root    = resolve(options.root ?? process.cwd());
+  const tenant  = await readMarketplaceDomain(domain, { root });
+  const sitemap = await buildMarketplaceSitemap(tenant);
+  const path    = await writeSitemapCache(sitemap, root);
+  return {
+    domain: tenant.domain,
+    path,
+    built: sitemap.built,
+    urls: sitemapUrlCount(sitemap),
+    pages: sitemap.pages.length,
+    publications: sitemap.pages.filter((page) => page.path.startsWith('/journal/')).length,
+  };
+}
+
+/** The storefront domains of the project (its `sitemaps/*.cfg` files). */
+export async function marketplaceDomains(root = process.cwd()) {
+  let names;
+  try {
+    names = await readdir(marketplaceConfigDirectory(root));
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      return [];
+    }
+    throw error;
+  }
+  return names
+    .filter((name) => name.endsWith('.cfg'))
+    .map((name) => normalizeFrontDomain(name.slice(0, -4)))
+    .filter(Boolean)
+    .sort();
+}
+
+/** @param {Request} request @param {{mimicFrontDomain?: string}} configuration */
+export async function marketplaceSitemapResponse(request, configuration = {}) {
+  let tenant;
+  try {
+    tenant = await readMarketplace(request, configuration);
+  } catch {
+    return failure(503, 'Storefront domain configuration is missing or invalid');
+  }
+  const root    = process.cwd();
+  const fresh   = (sitemap) =>
+    sitemap && Date.now() - Date.parse(sitemap.built) < SITEMAP_LIFETIME;
+  // The file wins when it is newer: a "sitemap rebuild" replaced it.
+  const file    = await readSitemapCache(tenant.domain, root);
+  const memory  = sitemapMemory.get(tenant.domain);
+  const newest  = [file, memory]
+    .filter(Boolean)
+    .sort((left, right) => Date.parse(right.built) - Date.parse(left.built))[0];
+  let sitemap   = fresh(newest) ? newest : null;
+  if (!sitemap) {
+    try {
+      sitemap = await buildOnce(tenant, root);
+    } catch (error) {
+      console.error(`[orionplace] Sitemap build failed: ${error?.message ?? error}`);
+      if (!newest) {
+        return failure(502, 'Marketplace backend is unavailable');
+      }
+      sitemap = newest;
+    }
+  }
+  const origin  = marketplacePublicOrigin(request, tenant.domain);
+  return new Response(marketplaceSitemapXml(origin, sitemap.pages, sitemap.locales), {
+    headers: {
+      'Content-Type': 'application/xml; charset=utf-8',
+      'Cache-Control': 'public, max-age=3600',
+      'Vary': 'Host, X-Forwarded-Host, X-Front-Domain',
+    },
+  });
+}

package/runtime/seo.mjs

@@ -0,0 +1,17 @@
+// robots.txt and sitemap.xml of the storefront domain (see marketplace.mjs).
+import { defineEventHandler, getRequestURL, toWebRequest, sendWebResponse } from 'h3';
+import { useRuntimeConfig } from '#imports';
+import { marketplaceRobotsResponse, marketplaceSitemapResponse } from './marketplace.mjs';
+
+export default defineEventHandler(async (event) => {
+  const configuration = {
+    mimicFrontDomain:
+      process.env.MIMIC_FRONT_DOMAIN ??
+      useRuntimeConfig(event).mimicFrontDomain,
+  };
+  const request       = toWebRequest(event);
+  const response      = getRequestURL(event).pathname === '/robots.txt'
+    ? await marketplaceRobotsResponse(request, configuration)
+    : await marketplaceSitemapResponse(request, configuration);
+  return sendWebResponse(event, response);
+});

package/src/module.mjs

@@ -75,6 +75,12 @@ export default defineNuxtModule({
     addServerHandler({ route: '/api/**', handler: resolve(directory, 'api.mjs') });
     // Guarded blog images and videos; the runtime accepts only those paths.
     addServerHandler({ route: '/ps3/blog/**', handler: resolve(directory, 'api.mjs') });
+    // robots.txt and the sitemap of the storefront domain (projects set up
+    // earlier get seo.mjs with `npx orionplace-nuxt update`).
+    if (existsSync(resolve(directory, 'seo.mjs'))) {
+      addServerHandler({ route: '/robots.txt', method: 'get', handler: resolve(directory, 'seo.mjs') });
+      addServerHandler({ route: '/sitemap.xml', method: 'get', handler: resolve(directory, 'seo.mjs') });
+    }
     addServerHandler({ middleware: true, handler: resolve(directory, 'domain.mjs') });
     addServerPlugin(resolve(import.meta.dirname, 'asset-loading-plugin.mjs'));
   },