prestruct 1.0.0 → 1.1.0

package/README.md

@@ -99,6 +99,7 @@ after hydration.
 | `bin/cli.mjs` | The `prestruct` executable (init/build/validate/clean). |
 | `init/` | Project template `prestruct init` scaffolds, including `scripts/proxy.js` (VPS) and `proxy.worker.js` (Cloudflare Worker). |
 | `example/` | Working demo site (8 routes), kept byte-identical to engine via `scripts/sync-engine.mjs`. |
+| `packs/` | In-repo crashtest pack (`public/prestruct-proxy` v0.2.0) attacking the bot-proxy pair on both runtimes. |
 | `docs/` | Full docs site, AGENTS-built with Pagefind. |
 | `tests/` | vitest battery, including the engine sync contract test. |
 
@@ -118,31 +119,57 @@ CF Pages output; the two layers stack, they don't replace each other.
 
 ---
 
+## Crash testing (in-repo pack)
+
+`packs/public/prestruct-proxy` (pack v0.2.0) is this repo's own adversarial
+pack for the bot-proxy pair above: four wire-level contracts (method matrix,
+hostile-path fuzz, bot-render 302 fallback, refresh-secret strict parity),
+run through the [crashtest](https://github.com/dhaupin/crashtest) harness
+against both runtimes. Attack route names come from the host `moduleCtx`, so
+the pack runs against any wiring. Latest results live in
+[labs/hardening.md](./labs/hardening.md), the CI-comparable ledger in
+[labs/crashledger.json](./labs/crashledger.json).
+
+The pack travels with the checkout, not the npm tarball. Adopting it from
+another repo is one line in that repo's `crashtest.config.js`:
+`packs: ['/abs/path/to/prestruct/packs']` -- contract table and runbook in
+[packs/README.md](./packs/README.md).
+
+---
+
 ## Deploy
 
 - Cloudflare Pages: [docs/guides/cloudflare.md](./docs/guides/cloudflare.md)
-  (`npm run build`, output `dist/`, Node 18+).
+  (`npm run build`, output `dist/`, Node 20+).
 - Any static host works too: `dist/` is a plain static folder.
 
 ---
 
 ## Stack
 
-- Vite 5+
+- Vite 5+ (examples and the template battery build on Vite 6)
 - React 18+
-- React Router v6 (v7 works -- engine falls back to the package root when the
-  `./server.js` subpath is absent)
+- React Router v6 and v7 both work: v6 via the `./server.js` subpath, v7 via
+  the package-root fallback -- scaffold imports use the namespace+destructure
+  form so CJS v7 passes vite SSR (docs and generated HTML render from v7 live)
 - Cloudflare Pages default; any static host otherwise
-- Node 18+
+- Node 20+
 
 ---
 
 ## Publishing state
 
-`package.json` is at 1.0.0 but **not tagged and not published**. `publish.yml`
-(OIDC trusted publishing on `v*` tags) is wired and dormant -- it
-fires nothing until the first tag exists, by owner decision. When it fires,
-provenance is automatic and no stored npm token is needed.
+**prestruct is on npm: <https://www.npmjs.com/package/prestruct>** (1.1.0,
+published via `publish.yml`, GitHub Actions OIDC trusted publishing with
+npm provenance -- verify with `npm audit signatures`). Tags drive releases:
+`v*` triggers npm publish plus the GitHub release archive (template zip with
+a self-testing battery). `main` may be ahead of the latest tag; its version
+pins are the next planned release.
+
+Local install test from the registry tarball (35 files) passed: `init` never
+clobbers, `build` produces full `dist/` (baked meta, sitemap, 404). The
+release-body template inside `release.yml` was corrected in the v1.0.0
+aftermath to match what the archive actually contains.
 
 **Legal:** using prestruct means agreeing to [LICENSE](./LICENSE) and
 [LEGAL.md](./LEGAL.md). Fair-Code: commercial SaaS use is restricted.
@@ -153,7 +180,7 @@ provenance is automatic and no stored npm token is needed.
 
 - [AGENTS.md](./AGENTS.md) -- engineering history, gotchas, hard rules,
   what's in/out of scope.
-- [labs/prd.md](./labs/prd.md) -- roadmap.
+- [labs/prd-prestruct.md](./labs/prd-prestruct.md) -- roadmap.
 - [docs/](./docs/index.md) -- full site (SEO, routing, islands, proxy,
   Cloudflare).
 

package/bin/cli.mjs

@@ -2,7 +2,7 @@
 /**
  * bin/cli.mjs - prestruct CLI
  * ============================
- * Commands (spec'd in labs/prd.md Phase 2):
+ * Commands (spec'd in labs/prd-prestruct.md Phase 2):
  *
  *   prestruct init [dir]    Scaffold the template into dir (default: cwd).
  *                           Never clobbers existing files.

package/engine/scripts/prerender.js

@@ -272,6 +272,30 @@ export function cleanCache({ cacheFile = enginePaths().cacheFile } = {}) {
 
 // -- Sitemap -------------------------------------------------------------------
 
+//
+// AI-crawler policy preset (aeo option):
+// Search-visibility bots get explicit Allow groups; TRAINING-crawl preference
+// is a separate choice via config.robots.aiBots ('allow' | 'block', default
+// 'block'). Bot names are the token each vendor documents for its own robots
+// product (2026: OpenAI OAI-SearchBot/GPTBot, Anthropic
+// Claude-SearchBot/ClaudeBot, PerplexityBot, Apple Applebot/Applebot-Extended,
+// Common Crawl CCBot, Google-Extended)
+const AEO_SEARCH_BOTS = [
+  'OAI-SearchBot',      // OpenAI: surfaces sites in ChatGPT search
+  'PerplexityBot',      // Perplexity: search index, not model training
+  'Claude-SearchBot',   // Anthropic: Claude's search
+  'Applebot',           // Apple: Siri/Spotlight/Safari search
+  'Googlebot',          // Google Search incl. AI Overviews eligibility
+  'Bingbot',            // Bing / Copilot discovery
+]
+const AEO_TRAINING_BOTS = [
+  'GPTBot',             // OpenAI: model training crawl
+  'ClaudeBot',          // Anthropic: model development crawl
+  'Google-Extended',    // Gemini/Vertex grounding (product token, no HTTP hits)
+  'Applebot-Extended',  // Apple: foundation model training
+  'CCBot',              // Common Crawl: open corpus crawlers
+]
+
 /**
  * Generate robots.txt when config.robots is opted in; otherwise null so the
  * author's own public/robots.txt is left untouched. The Sitemap: line points
@@ -290,16 +314,25 @@ export function generateRobots(config) {
   const cfgBody    = typeof cfg === 'string' ? cfg : (cfg.body || '')
   const cfgSitemap = cfgBool || (cfg && typeof cfg === 'object' ? cfg.sitemap !== false : true)
   const siteUrl    = (config.siteUrl || '').replace(/\/$/, '')
-
-  if (cfgBool) {
-    const lines = [
-      'User-agent: *',
-      'Allow: /',
-    ]
-    if (cfgSitemap && siteUrl) {
-      lines.push('', `Sitemap: ${siteUrl}/sitemap.xml`)
+  const sitemapLine = cfgSitemap && siteUrl ? ['', `Sitemap: ${siteUrl}/sitemap.xml`] : []
+
+  // { aeo: true | {} } -> search bots allowed, training crawls blocked by
+  // default. { aeo: { aiBots: 'allow' } } flips training to Allow. aeo with
+  // an explicit body: the body is appended after the preset groups (letting
+  // owners add extra paths) only via body; the preset itself ignores body.
+  const aeo       = !cfgBool && cfg && cfg.aeo
+  const aeoCli    = aeo ? (aeo.aiBots === 'allow' ? 'allow' : 'block') : null
+
+  if (cfgBool || aeo) {
+    const lines = []
+    if (cfgBool) {
+      lines.push('User-agent: *', 'Allow: /')
+    } else {
+      for (const bot of AEO_SEARCH_BOTS) lines.push(`User-agent: ${bot}`, 'Allow: /', '')
+      const verdict = aeoCli === 'allow' ? 'Allow: /' : 'Disallow: /'
+      for (const bot of AEO_TRAINING_BOTS) lines.push(`User-agent: ${bot}`, verdict, '')
     }
-    return lines.join('\n') + '\n'
+    return lines.concat(sitemapLine).join('\n').replace(/\n+$/, '\n')
   }
 
   // Custom body; sitemap pointer appended unless { sitemap: false }
@@ -649,19 +682,21 @@ export async function prerender(cfg = config, { force = false, root } = {}) {
       console.log('[prerender] ok /robots.txt')
     }
 
-    // Cache stats -- static-sites-safe monitor: a JSON snapshot beside dist/
-    // (Intentionally not a runtime endpoint; static hosts serve files, not
-    // processes. Follows the PRD "static-sites-safe option preferred" note.)
+    // Cache stats -- static-sites-safe monitor: a JSON snapshot in the
+    // project's .prestruct/ dir, NOT dist/. Build telemetry must not become a
+    // deployed URL (issue 23): dist/ is the public artifact on every static
+    // host, and the old wall-clock generatedAt made two byte-identical
+    // builds differ. Same monitor, invisible to deploys, no opt-out needed
+    // because there is nothing to opt out of shipping.
     const stats = {
-      generatedAt: new Date().toISOString(),
       routeCount: ROUTES.length,
       succeeded,
       cached: Object.keys(cache).length,
       force,
       routes: ROUTES.map(r => ({ path: r.path, cached: Boolean(cache[r.path]) })),
     }
-    fs.mkdirSync(path.join(p.dist, '.prestruct'), { recursive: true })
-    fs.writeFileSync(path.join(p.dist, '.prestruct', 'status.json'), JSON.stringify(stats, null, 2), 'utf-8')
+    fs.mkdirSync(path.join(p.cacheDir, '..'), { recursive: true })
+    fs.writeFileSync(path.join(p.root, '.prestruct', 'status.json'), JSON.stringify(stats, null, 2), 'utf-8')
 
     console.log(`[prerender] Done. ${succeeded}/${ROUTES.length} pages rendered.\n`)
 

package/engine/src/hooks/usePageMeta.js

@@ -43,7 +43,14 @@
  */
 
 import { useEffect } from 'react'
-import { useLocation } from 'react-router-dom'
+import * as rrdNS from 'react-router-dom'
+// Neither plain named imports nor a bare namespace destructure survive
+// both majors: v7 ships CJS (vite SSR rejects named imports; node interop
+// gives a namespace whose only reliable export is `default` -- the exports
+// object), while v6 is ESM with possibly no default. Destructure from
+// whichever carries the exports.
+const rrd = rrdNS.default ?? rrdNS
+const { useLocation } = rrd
 
 /** Update the SPA head tags on every route change (see the module head doc). */
 export default function usePageMeta({ title, description, path, siteUrl }) {

package/init/VERSION

@@ -1 +1 @@
-1.0.0
+1.1.0