snappy-prerender 2.6.0 → 2.8.0

package/src/core/route-sources.js

@@ -0,0 +1,220 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { isSafeRoute, normaliseRoute, toAppRoute } from './routes.js';
+import { mapLimit } from './scheduler.js';
+
+const MAX_SOURCE_ROUTES = 100000;
+const FETCH_TIMEOUT = 10000;
+const SITEMAP_FETCH_CONCURRENCY = 4;
+const XML_ENTITIES = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
+
+/**
+ * Loads concrete route seeds from a text/JSON file and/or a sitemap. These are seeds,
+ * not a router: directory-style app paths still have to be handled by the app.
+ */
+export async function loadRouteSeeds(config) {
+  const routes = [];
+  const sources = [];
+  if (config.routesFile) {
+    const read = await readRouteFile(config.routesFile, config);
+    routes.push(...read.routes);
+    sources.push({
+      source: config.routesFile,
+      type: 'file',
+      routes: read.routes.length,
+      skipped: read.skipped,
+    });
+  }
+  if (config.routesFromSitemap) {
+    const read = await readRouteSitemap(config.routesFromSitemap, config);
+    routes.push(...read.routes);
+    sources.push({
+      source: config.routesFromSitemap,
+      type: 'sitemap',
+      routes: read.routes.length,
+      skipped: read.skipped,
+    });
+  }
+  const unique = [...new Set(routes)];
+  if (unique.length > MAX_SOURCE_ROUTES) {
+    throw new Error(`route sources produced more than ${MAX_SOURCE_ROUTES} routes`);
+  }
+  return { routes: unique, sources };
+}
+
+// Reads a text or JSON route list. Text accepts one route per line and # comments.
+async function readRouteFile(file, config) {
+  const contents = await fs.readFile(path.resolve(file), 'utf8');
+  let values;
+  const trimmed = contents.trim();
+  if (trimmed.startsWith('[') || trimmed.startsWith('{')) {
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch (error) {
+      throw new Error(`routesFile is not valid JSON: ${error.message}`);
+    }
+    values = Array.isArray(parsed) ? parsed : parsed?.routes;
+    if (!Array.isArray(values)) {
+      throw new Error('routesFile JSON must be an array or an object with a routes array');
+    }
+  } else {
+    values = trimmed
+      .split(/\r?\n/)
+      .map((line) => line.replace(/#.*$/, '').trim())
+      .filter((line) => line.length > 0);
+  }
+  return normaliseAndFilter(values, 'routesFile', config);
+}
+
+// Reads a sitemap, following a sitemap index one level deep.
+async function readRouteSitemap(location, config) {
+  const pageUrls = [];
+  await readSitemapLevel(location, pageUrls, 0);
+  const sourceOrigin = /^https?:\/\//i.test(location) ? new URL(location).origin : null;
+  return normaliseAndFilter(pageUrls, 'routesFromSitemap', config, sourceOrigin, true);
+}
+
+async function readSitemapLevel(location, pageUrls, depth) {
+  if (depth > 1) return;
+  const { text, base } = await readSource(location);
+  if (!/<(?:urlset|sitemapindex)\b/i.test(text)) {
+    throw new Error(`${location} is not a sitemap: no urlset or sitemapindex element found`);
+  }
+  if (/<sitemapindex\b/i.test(text)) {
+    const children = extractLocs(text);
+    const { results, errors } = await mapLimit(
+      children,
+      SITEMAP_FETCH_CONCURRENCY,
+      async (child) => {
+        const routes = [];
+        await readSitemapLevel(resolveChild(child, base), routes, depth + 1);
+        return routes;
+      },
+    );
+    if (errors.length > 0) throw errors[0].error;
+    for (const routes of results) pageUrls.push(...routes);
+    return;
+  }
+  pageUrls.push(...extractLocs(text));
+}
+
+// Reads a local path or an http(s) sitemap.
+async function readSource(location) {
+  if (/^https?:\/\//i.test(location)) {
+    const response = await fetch(location, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT),
+      headers: { accept: 'application/xml,text/xml,*/*' },
+    });
+    if (!response.ok) throw new Error(`sitemap ${location} answered HTTP ${response.status}`);
+    return { text: await response.text(), base: location };
+  }
+  const file = path.resolve(location);
+  return { text: await fs.readFile(file, 'utf8'), base: file };
+}
+
+// Resolves a child sitemap location relative to its parent.
+function resolveChild(child, base) {
+  if (/^https?:\/\//i.test(child)) return child;
+  if (/^https?:\/\//i.test(base)) return new URL(child, base).href;
+  return path.resolve(path.dirname(base), child);
+}
+
+// Extracts and unescapes every <loc> value.
+function extractLocs(xml) {
+  const values = [];
+  for (const match of xml.matchAll(/<loc\b[^>]*>([\s\S]*?)<\/loc>/gi)) {
+    values.push(unescapeXml(match[1].trim()));
+  }
+  return values;
+}
+
+function unescapeXml(value) {
+  return value.replace(/&(amp|lt|gt|quot|apos);/g, (_, name) => XML_ENTITIES[name]);
+}
+
+// Converts source values to app-relative routes and drops unsafe or off-origin entries.
+function normaliseAndFilter(
+  values,
+  source,
+  config = null,
+  sourceOrigin = null,
+  enforceOrigin = false,
+) {
+  const siteOrigin = config?.metadata?.siteUrl ? new URL(config.metadata.siteUrl).origin : null;
+  const referenceOrigin = siteOrigin ?? sourceOrigin;
+  const base = config?.base ?? '/';
+  const routes = [];
+  const seen = new Set();
+  let skipped = 0;
+  for (const value of values) {
+    if (typeof value !== 'string') {
+      skipped += 1;
+      continue;
+    }
+    const absolute = parseAbsolute(value, referenceOrigin);
+    if (/^https?:\/\//i.test(value) && !absolute) {
+      skipped += 1;
+      continue;
+    }
+    let route;
+    if (absolute) {
+      if (!referenceOrigin) {
+        if (enforceOrigin) {
+          skipped += 1;
+          continue;
+        }
+      } else if (absolute.origin !== referenceOrigin) {
+        skipped += 1;
+        continue;
+      }
+      route = toAppRoute(absolute.href, base);
+    } else if (value.startsWith('//')) {
+      // A protocol-relative URL needs an origin to resolve against; without one it is
+      // not safe to guess which host it belongs to.
+      skipped += 1;
+      continue;
+    } else {
+      route = normaliseRoute(stripBase(value, base));
+    }
+    if (!route || !isSafeRoute(route) || seen.has(route)) {
+      skipped += 1;
+      continue;
+    }
+    seen.add(route);
+    routes.push(route);
+  }
+  if (routes.length === 0 && values.length > 0) {
+    throw new Error(`${source} did not contain any usable routes`);
+  }
+  return { routes, skipped };
+}
+
+// Resolves an absolute or protocol-relative URL, returning null for paths.
+function parseAbsolute(value, referenceOrigin) {
+  if (/^https?:\/\//i.test(value)) {
+    try {
+      return new URL(value);
+    } catch {
+      return null;
+    }
+  }
+  if (value.startsWith('//') && referenceOrigin) {
+    try {
+      return new URL(value, referenceOrigin);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+// Removes the public base prefix from a root-relative path, leaving app-relative paths
+// alone so a sitemap can list either form.
+function stripBase(value, base) {
+  if (base === '/') return value;
+  const prefix = base.slice(0, -1);
+  if (value === prefix) return '/';
+  if (value.startsWith(`${prefix}/`)) return value.slice(prefix.length);
+  return value;
+}

package/src/core/run.js

@@ -1,21 +1,19 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { writePreloadManifest, writeSitemap } from './artifacts.js';
+import { auditRun } from './audit/index.js';
 import { launchBrowser } from './browser.js';
+import { resolveFixedTime } from './clock.js';
 import { resolveConfig } from './config.js';
+import { renderAllRoutes } from './crawl.js';
 import { prepareDestination } from './destination.js';
+import { buildLocalePlan } from './locales.js';
 import { createLogger } from './log.js';
 import { routeToFile } from './output.js';
 import { pruneStaleFiles, readPruneManifest, writePruneManifest } from './prune.js';
-import { renderRoute } from './render.js';
-import {
-  crawlRoots,
-  filterRoutes,
-  isIncludedRoute,
-  normaliseRoute,
-  withinDepth,
-} from './routes.js';
-import { createPool } from './scheduler.js';
+import { writeReport } from './report.js';
+import { loadRouteSeeds } from './route-sources.js';
+import { normaliseRoute } from './routes.js';
 import { startCommandServer, startStaticServer } from './server.js';
 import { verifyRoutes } from './verify.js';
 import { writeAllRoutes } from './write.js';
@@ -33,24 +31,41 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
   for (const warning of config.warnings ?? []) log.warn(warning);
   const sourceDir = path.resolve(config.sourceDir);
   const startedAt = Date.now();
+  const fixedTime = resolveFixedTime(config, startedAt);
+  config.fixedTime = fixedTime;
+  const localePlan = buildLocalePlan(config);
 
   await assertSourceDir(sourceDir, config);
-  const outputDir = await resolveOutputDir({ sourceDir, config, log });
+  const [outputDir, routeSources] = await Promise.all([
+    resolveOutputDir({ sourceDir, config, log }),
+    loadRouteSeeds(config),
+  ]);
   const previousManifest =
     config.pruneStaleRoutes && !config.dryRun ? await readPruneManifest(outputDir) : null;
+  for (const source of routeSources.sources) {
+    const skipped = source.skipped > 0 ? `, ${source.skipped} skipped` : '';
+    log.info(`Route source ${source.source}: ${source.routes} route(s)${skipped}`);
+  }
 
   if (config.saveAs !== 'html' && config.verify) {
     log.warn(`saveAs: '${config.saveAs}' writes images, so hydration verification is skipped`);
   }
 
-  const server = config.serveCmd
-    ? await startCommandServer({
-        command: config.serveCmd,
-        url: config.url,
-        timeout: config.serveCmdTimeout,
-        shutdownTimeout: config.shutdownTimeout,
-      })
-    : await startStaticServer({ dir: outputDir, base: config.base });
+  const browserPromise = launchBrowser(config, log);
+  let server;
+  try {
+    server = config.serveCmd
+      ? await startCommandServer({
+          command: config.serveCmd,
+          url: config.url,
+          timeout: config.serveCmdTimeout,
+          shutdownTimeout: config.shutdownTimeout,
+        })
+      : await startStaticServer({ dir: outputDir, base: config.base });
+  } catch (error) {
+    browserPromise.then(({ browser }) => browser.close()).catch(() => {});
+    throw error;
+  }
 
   const report = {
     routes: [],
@@ -62,30 +77,65 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
     emptyPages: [],
     duplicateTitles: [],
     duplicatePages: [],
+    links: [],
+    notFoundRoutes: [],
+    routeSources: routeSources.sources,
+    routeDetails: [],
+    clock: fixedTime === null ? null : { fixedTime, timezone: config.timezone ?? null },
+    locales: localePlan
+      ? { mode: localePlan.mode, default: localePlan.default, active: localePlan.active ?? null }
+      : null,
+    seoLocale: config.seoLocale
+      ? {
+          code: config.seoLocale.code ?? config.locales?.active ?? null,
+          source: config.seoLocale.source,
+          inject: config.seoLocale.inject,
+        }
+      : null,
+    cspSkipped: [],
+    traces: [],
     verification: null,
+    audit: null,
     preloadManifest: null,
     sitemap: null,
     pruned: [],
     truncated: null,
     ok: false,
     durationMs: 0,
+    timings: { render: 0, write: 0, artifacts: 0, verify: 0, audit: 0 },
   };
   const manifestEntries = [];
   const state = { warnedBuildOriginMetadata: false, warnedCriticalCssSkipped: false };
   let browser = null;
 
   try {
-    const launched = await launchBrowser(config, log);
+    const launched = await browserPromise;
     browser = launched.browser;
     log.info(`Browser: ${launched.source}`);
+    const renderCaches = { inlineCss: new Map(), criticalCss: new Map() };
 
+    let phaseStartedAt = Date.now();
     const rendered = await renderAllRoutes({
       browser,
       server,
       config,
       log,
       report,
+      outputDir,
+      sourceSeeds: routeSources.routes,
+      caches: renderCaches,
+      localePlan,
     });
+    report.timings.render = Date.now() - phaseStartedAt;
+    const { rendered: renderedRoutes, routeLocales } = rendered;
+    if (localePlan) {
+      const renderedByLocale = {};
+      for (const route of report.routes) {
+        const code = routeLocales.get(route)?.locale?.code ?? localePlan.default;
+        renderedByLocale[code] = (renderedByLocale[code] ?? 0) + 1;
+      }
+      report.locales.rendered = renderedByLocale;
+    }
     if (report.routes.length === 0) {
       report.errors.push({ route: null, message: 'no routes were rendered' });
       log.error('No routes were rendered; check include, exclude and sourceDir');
@@ -100,19 +150,32 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
       );
     }
 
+    phaseStartedAt = Date.now();
     const verifiable = await writeAllRoutes({
-      rendered,
+      rendered: renderedRoutes,
+      routeLocales,
+      localePlan,
       outputDir,
       config,
       log,
       report,
       state,
       manifestEntries,
+      caches: renderCaches,
     });
+    report.timings.write = Date.now() - phaseStartedAt;
+    const localeScripts = report.files
+      .filter((file) => file.file?.startsWith('snappy-seo-locale-'))
+      .map((file) => file.file);
+    if (report.seoLocale) {
+      report.seoLocale.script = localeScripts[0] ?? null;
+      report.seoLocale.scripts = [...new Set(localeScripts)];
+    }
     logFileSummary(report, log);
     logNotFoundNotice(report, config, log);
     logDuplicateTitles(report, log);
 
+    phaseStartedAt = Date.now();
     if (config.sitemap) {
       try {
         await writeSitemap({ outputDir, config, log, report });
@@ -145,6 +208,7 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
         log.error(`preload manifest write failed: ${error.message}`);
       }
     }
+    report.timings.artifacts = Date.now() - phaseStartedAt;
 
     const canVerify = config.verify && !config.dryRun && config.saveAs === 'html';
     if (canVerify && config.serveCmd) {
@@ -154,13 +218,13 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
     }
     // With verifyChangedOnly, a route whose HTML file was left untouched is not reloaded: the HTML
     // and the bundle are the same as the last time it was verified.
+    const fileStatus = new Map(
+      report.files.map((file) => [`${file.route ?? ''}|${file.file ?? ''}`, file.status]),
+    );
     const toVerify = config.verifyChangedOnly
       ? verifiable.filter((route) => {
           const file = routeToFile(route, config);
-          const entry = report.files.find(
-            (candidate) => candidate.route === route && candidate.file === file,
-          );
-          return entry?.status !== 'unchanged';
+          return fileStatus.get(`${route}|${file}`) !== 'unchanged';
         })
       : verifiable;
     const skipped = verifiable.length - toVerify.length;
@@ -168,14 +232,20 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
       log.info(`Verification skipped for ${skipped} unchanged route(s), as verifyChangedOnly asks`);
     }
     if (canVerify && !config.serveCmd && toVerify.length > 0) {
+      phaseStartedAt = Date.now();
       report.verification = await verifyRoutes({
         browser,
         origin: server.origin,
         routes: toVerify.sort(),
         config,
+        outputDir,
+        routeLocales,
       });
+      report.timings.verify = Date.now() - phaseStartedAt;
       report.verification.skipped = skipped;
+      report.verification.policySkipped = report.verification.skippedRoutes.length;
       logVerification(report.verification, config, log);
+      mergeVerification(report);
     }
 
     if (
@@ -211,7 +281,20 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
   }
 
   report.durationMs = Date.now() - startedAt;
+  if (config.audit) {
+    const auditStartedAt = Date.now();
+    try {
+      report.audit = await auditRun({ report, config, outputDir });
+      logAudit(report.audit, log);
+    } catch (error) {
+      report.errors.push({ route: null, message: `audit failed: ${error.message}` });
+      log.error(`audit failed: ${error.message}`);
+    }
+    report.timings.audit = Date.now() - auditStartedAt;
+  }
   const reRendered = report.verification?.modes['re-rendered'] ?? 0;
+  const allowedRerender = report.verification?.allowedRerender ?? 0;
+  const notAllowedRerender = Math.max(0, reRendered - allowedRerender);
   const undetected = report.verification
     ? (report.verification.modes.undetected ?? 0) + (report.verification.modes.unknown ?? 0)
     : 0;
@@ -222,10 +305,18 @@ export async function prerender(userOptions = {}, { log: injectedLog } = {}) {
     !(config.failOnConsoleError && report.consoleErrors.length > 0) &&
     !(config.failOnFailedRequest && report.failedRequests.length > 0) &&
     !(config.failOnDuplicateContent && report.duplicatePages.length > 0) &&
+    !(config.failOnAuditError && (report.audit?.errors.length ?? 0) > 0) &&
     !(config.failOnHydrationError && report.verification && !report.verification.ok) &&
     !(config.failOnVerificationError && report.verification?.errors.length > 0) &&
     !(config.failOnUndetected && undetected > 0) &&
-    !(config.failOnRerender && reRendered > 0);
+    !(config.failOnRerender && notAllowedRerender > 0);
+  try {
+    report.reportFile = await writeReport({ report, config, log });
+  } catch (error) {
+    report.errors.push({ route: null, message: `report write failed: ${error.message}` });
+    log.error(`report write failed: ${error.message}`);
+    if (config.failOnError) report.ok = false;
+  }
   return report;
 }
 
@@ -269,114 +360,44 @@ async function resolveOutputDir({ sourceDir, config, log }) {
   });
 }
 
-/**
- * Runs the crawl and render pool. Each rendered page contributes its output, any new
- * same-origin routes, and the resources recorded for the link-hint features.
- */
-async function renderAllRoutes({ browser, server, config, log, report }) {
-  const visited = new Set();
-  const scheduled = new Set();
-  const rendered = new Map();
-  const cap = config.maxRoutes ?? Number.POSITIVE_INFINITY;
-
-  // Queues routes up to maxRoutes, flagging the report the first time the cap bites.
-  // A seed used only to reach wildcard routes is given output: false and is rendered
-  // for its links without being written.
-  const accept = (routes, outputFor = () => true) => {
-    const accepted = [];
-    for (const route of routes) {
-      if (scheduled.has(route)) continue;
-      if (scheduled.size >= cap) {
-        report.truncated = { limit: config.maxRoutes, routes: scheduled.size };
-        break;
-      }
-      scheduled.add(route);
-      accepted.push({ route, output: outputFor(route) });
-    }
-    return accepted;
-  };
-
-  const pool = createPool({
-    concurrency: config.concurrency,
-    handler: async ({ route, depth, output }) => {
-      if (visited.has(route)) return;
-      visited.add(route);
-      log.debug(`rendering ${route}${output ? '' : ' as a crawl seed'}`);
-      try {
-        const result = await renderRoute({
-          browser,
-          origin: server.origin,
-          route,
-          config,
-          screenshot: config.saveAs !== 'html',
-        });
-        if (output && result.empty) {
-          report.emptyPages.push(route);
-          if (config.failOnEmptyPage) {
-            report.errors.push({ route, message: 'rendered an empty page' });
-            log.error(`  empty page ${route}: no app content was found`);
-            return;
-          }
-          log.warn(`  empty page ${route}: no app content was found`);
-        }
-        if (output) {
-          rendered.set(route, result);
-          report.routes.push(route);
-        }
-        for (const message of result.pageErrors) {
-          report.pageErrors.push({ route, message });
-          log.warn(`  page error on ${route}: ${message}`);
-        }
-        for (const message of result.consoleErrors) {
-          report.consoleErrors.push({ route, message });
-        }
-        if (result.consoleErrors.length > 0) {
-          log.debug(`  console error on ${route}: ${result.consoleErrors[0]}`);
-          if (config.failOnConsoleError) {
-            report.errors.push({ route, message: `console error: ${result.consoleErrors[0]}` });
-          }
-        }
-        for (const failure of result.failedRequests) {
-          report.failedRequests.push({ route, ...failure });
-          const detail = failure.status ? `HTTP ${failure.status}` : failure.error;
-          log.warn(`  failed request on ${route}: ${failure.url} (${detail})`);
-        }
-        if (result.failedRequests.length > 0 && config.failOnFailedRequest) {
-          const first = result.failedRequests[0];
-          report.errors.push({
-            route,
-            message: `failed request: ${first.url}${first.status ? ` (HTTP ${first.status})` : ''}`,
-          });
-        }
-        if (config.crawl && withinDepth(depth + 1, config.maxDepth)) {
-          const discovered = filterRoutes(result.links, {
-            include: config.includeProvided ? config.include : [],
-            exclude: config.exclude,
-          }).filter((candidate) => !scheduled.has(candidate));
-          pool.push(accept(discovered).map((item) => ({ ...item, depth: depth + 1 })));
-        }
-      } catch (error) {
-        report.errors.push({ route, message: error.message });
-        log.error(`  failed ${route}: ${error.message}`);
-      }
-    },
-  });
+// Adds the verification result to each route record for the JSON report.
+function mergeVerification(report) {
+  const details = new Map(report.routeDetails.map((record) => [record.route, record]));
+  for (const entry of report.verification?.routes ?? []) {
+    const detail = details.get(entry.route);
+    if (!detail) continue;
+    detail.mode = entry.mode;
+    detail.framework = entry.framework ?? null;
+    detail.hydrationErrors = entry.hydrationErrors;
+    detail.ignoredHydrationErrors = entry.ignoredHydrationErrors ?? [];
+    detail.hydrationPolicy = entry.hydrationPolicy ?? null;
+    detail.hydrationAllowed = entry.allowed === true;
+    detail.pageErrors = [...new Set([...(detail.pageErrors ?? []), ...entry.pageErrors])];
+    detail.consoleErrors = [...new Set([...(detail.consoleErrors ?? []), ...entry.consoleErrors])];
+    detail.verificationStatus = entry.status;
+    detail.empty = entry.empty || detail.empty;
+    detail.firstMismatch = entry.firstMismatch ?? null;
+  }
+}
 
-  const roots = accept(
-    crawlRoots(config),
-    (route) => !config.includeProvided || isIncludedRoute(route, config.include),
-  );
-  pool.push(roots.map((item) => ({ ...item, depth: 0 })));
-  const { errors } = await pool.run();
-  for (const { item, error } of errors) {
-    report.errors.push({ route: item.route, message: error.message });
-    log.error(`  pool error on ${item.route}: ${error.message}`);
+// Prints an audit summary and a bounded sample of findings.
+function logAudit(audit, log) {
+  const errors = audit?.errors?.length ?? 0;
+  const warnings = audit?.warnings?.length ?? 0;
+  if (errors === 0 && warnings === 0) {
+    log.success(`Audit: no issues (${audit?.linksChecked ?? 0} links checked)`);
+    return;
+  }
+  log.info(`Audit: ${errors} error(s), ${warnings} warning(s)`);
+  for (const finding of [...(audit?.errors ?? []), ...(audit?.warnings ?? [])].slice(0, 20)) {
+    const message = `${finding.rule}: ${finding.message}`;
+    if (finding.severity === 'error') log.error(`  ${message}`);
+    else log.warn(`  ${message}`);
   }
-  return rendered;
 }
 
-// Notes routes whose output carries more than one title, which is what React 19 native
-// metadata and the head layer together produce.
+// Notes duplicate title tags, which React 19 native metadata and the head layer can
+// each produce.
 function logDuplicateTitles(report, log) {
   if (report.duplicateTitles.length === 0) return;
   const sample = report.duplicateTitles.slice(0, 5).join(', ');
@@ -417,8 +438,10 @@ function logFileSummary(report, log) {
 // were reported but not enforced.
 function logVerification(verification, config, log) {
   const modes = verification.modes ?? {};
+  const allowed = verification.allowed ?? 0;
+  const policySkipped = verification.policySkipped ?? 0;
   log.info(
-    `Hydration modes: ${modes.hydrated ?? 0} hydrated, ${modes['re-rendered'] ?? 0} re-rendered, ${modes.undetected ?? 0} undetected, ${modes.unknown ?? 0} unknown`,
+    `Hydration modes: ${modes.hydrated ?? 0} hydrated, ${modes['re-rendered'] ?? 0} re-rendered, ${modes.undetected ?? 0} undetected, ${modes.unknown ?? 0} unknown${allowed > 0 ? `, ${allowed} allowed` : ''}${policySkipped > 0 ? `, ${policySkipped} skipped by policy` : ''}`,
   );
   const notDetected = (modes.undetected ?? 0) + (modes.unknown ?? 0);
   if (notDetected > 0) {
@@ -460,7 +483,9 @@ function logVerification(verification, config, log) {
     }
   }
 
-  const reRendered = verification.routes.filter((entry) => entry.mode === 're-rendered');
+  const reRendered = verification.routes.filter(
+    (entry) => entry.mode === 're-rendered' && !entry.allowed,
+  );
   if (reRendered.length > 0) {
     const sample = reRendered
       .slice(0, 5)