@bagelink/blox 1.15.535 → 1.15.543

package/dist/{shard-runner-C-OeWaVM.cjs → shard-runner-DOK26Y78.cjs}

@@ -26,7 +26,7 @@ const node_child_process = require("node:child_process");
 const os = require("node:os");
 const path = require("node:path");
 const process = require("node:process");
-const llmArtifacts = require("./validate-output-2iH8f9ql.cjs");
+const llmArtifacts = require("./validate-output-Dku8tCir.cjs");
 const AUTO_SHARD_CAP = Number(process.env.BLOX_SSG_SHARD_CAP) || 6;
 const PREFETCH_BUDGET = Number(process.env.BLOX_SSG_PREFETCH_BUDGET) || 24;
 function resolveShardCount(shards) {
@@ -95,7 +95,11 @@ async function runSharded(opts) {
     }
     console.log(`[blox-ssg] routes-cmd enumerated ${enumerated.length} route(s)`);
   }
-  const siteData = await llmArtifacts.fetchCmsSiteData(opts.apiBase, opts.websiteName);
+  const siteData = await llmArtifacts.fetchCmsSiteData(
+    opts.apiBase,
+    opts.websiteName,
+    opts.buildRequest
+  );
   for (const p of siteData.paths) if (!paths.includes(p)) paths.push(p);
   const cmsPathSet = new Set(siteData.paths);
   const routerPaths = appPaths.filter((path2) => !cmsPathSet.has(path2));
@@ -133,7 +137,7 @@ async function runSharded(opts) {
   }
   if (process.env.BLOX_SSG_LLM !== "0") {
     try {
-      const { mergeLlmParts } = await Promise.resolve().then(() => require("./validate-output-2iH8f9ql.cjs")).then((n) => n.llmArtifacts);
+      const { mergeLlmParts } = await Promise.resolve().then(() => require("./validate-output-Dku8tCir.cjs")).then((n) => n.llmArtifacts);
       const mergeWebsite = website;
       const partFiles = Array.from({ length: total }, (_, i) => path.join(llmPartsDir, `part.${i}.json`));
       const { pages } = await mergeLlmParts({

package/dist/{shard-runner-Aw77Pe6C.js → shard-runner-Ic_t76Xj.js}

@@ -2,7 +2,7 @@ import { spawn } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
 import process from "node:process";
-import { f as fetchCmsSiteData, g as generateSitemapArtifacts } from "./validate-output-CfHo6w9k.js";
+import { f as fetchCmsSiteData, g as generateSitemapArtifacts } from "./validate-output-XdxaXjgE.js";
 const AUTO_SHARD_CAP = Number(process.env.BLOX_SSG_SHARD_CAP) || 6;
 const PREFETCH_BUDGET = Number(process.env.BLOX_SSG_PREFETCH_BUDGET) || 24;
 function resolveShardCount(shards) {
@@ -71,7 +71,11 @@ async function runSharded(opts) {
     }
     console.log(`[blox-ssg] routes-cmd enumerated ${enumerated.length} route(s)`);
   }
-  const siteData = await fetchCmsSiteData(opts.apiBase, opts.websiteName);
+  const siteData = await fetchCmsSiteData(
+    opts.apiBase,
+    opts.websiteName,
+    opts.buildRequest
+  );
   for (const p of siteData.paths) if (!paths.includes(p)) paths.push(p);
   const cmsPathSet = new Set(siteData.paths);
   const routerPaths = appPaths.filter((path2) => !cmsPathSet.has(path2));
@@ -109,7 +113,7 @@ async function runSharded(opts) {
   }
   if (process.env.BLOX_SSG_LLM !== "0") {
     try {
-      const { mergeLlmParts } = await import("./validate-output-CfHo6w9k.js").then((n) => n.A);
+      const { mergeLlmParts } = await import("./validate-output-XdxaXjgE.js").then((n) => n.A);
       const mergeWebsite = website;
       const partFiles = Array.from({ length: total }, (_, i) => path.join(llmPartsDir, `part.${i}.json`));
       const { pages } = await mergeLlmParts({

package/dist/ssg/build-grant.cjs

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const process = require("node:process");
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const PAYLOAD_FIELDS = /* @__PURE__ */ new Set(["version", "source", "website_id", "grant"]);
+function parseJsonObject(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Invalid Blox build hook payload");
+  }
+  if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new Error("Invalid Blox build hook payload");
+  }
+  return parsed;
+}
+function parseBloxBuildGrantBody(body) {
+  const trimmed = body.trim();
+  if (!trimmed) throw new Error("Missing Blox build hook payload");
+  let payload;
+  try {
+    payload = parseJsonObject(trimmed);
+  } catch {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(trimmed);
+    } catch {
+      throw new Error("Invalid Blox build hook payload");
+    }
+    payload = parseJsonObject(decoded);
+  }
+  if (Object.keys(payload).some((field) => !PAYLOAD_FIELDS.has(field))) {
+    throw new Error("Invalid Blox build hook payload fields");
+  }
+  if (payload.version !== 1 || payload.source !== "blox" || typeof payload.website_id !== "string" || !UUID_PATTERN.test(payload.website_id) || typeof payload.grant !== "string" || payload.grant.trim() === "") {
+    throw new Error("Invalid Blox build hook payload");
+  }
+  return {
+    version: 1,
+    source: "blox",
+    websiteId: payload.website_id,
+    grant: payload.grant
+  };
+}
+function isLocalOrTest(mode, env) {
+  return mode === "localhost" || mode === "development" || mode === "test" || env.NODE_ENV === "development" || env.NODE_ENV === "test";
+}
+function resolveBloxBuildGrant(options = {}) {
+  var _a, _b, _c, _d, _e;
+  const env = options.env ?? process.env;
+  if (isLocalOrTest(options.mode, env)) {
+    const websiteId = (_a = env.BLOX_WEBSITE_ID) == null ? void 0 : _a.trim();
+    const grant2 = (_b = env.BLOX_BUILD_TOKEN) == null ? void 0 : _b.trim();
+    if (!websiteId && !grant2) return void 0;
+    if (!websiteId || !UUID_PATTERN.test(websiteId) || !grant2) {
+      throw new Error("Local Blox build overrides require a valid BLOX_WEBSITE_ID and BLOX_BUILD_TOKEN");
+    }
+    return { version: 1, source: "blox", websiteId, grant: grant2 };
+  }
+  if (!((_c = env.INCOMING_HOOK_URL) == null ? void 0 : _c.trim()) || !((_d = env.INCOMING_HOOK_TITLE) == null ? void 0 : _d.trim())) {
+    throw new Error("Blox production builds require Netlify incoming hook metadata");
+  }
+  const body = env.INCOMING_HOOK_BODY;
+  if (body == null) throw new Error("Blox production builds require a hook payload");
+  const grant = parseBloxBuildGrantBody(body);
+  const configuredWebsiteId = (_e = env.BLOX_WEBSITE_ID) == null ? void 0 : _e.trim();
+  if (configuredWebsiteId && configuredWebsiteId !== grant.websiteId) {
+    throw new Error("Blox build hook website does not match the configured website");
+  }
+  return grant;
+}
+exports.parseBloxBuildGrantBody = parseBloxBuildGrantBody;
+exports.resolveBloxBuildGrant = resolveBloxBuildGrant;

package/dist/ssg/build-grant.d.ts

@@ -0,0 +1,18 @@
+export interface BloxBuildGrant {
+    version: 1;
+    source: 'blox';
+    websiteId: string;
+    grant: string;
+}
+export interface ResolveBloxBuildGrantOptions {
+    mode?: string;
+    env?: NodeJS.ProcessEnv;
+}
+/** Parse a Netlify hook body as direct JSON or exactly one URL-decoded JSON value. */
+export declare function parseBloxBuildGrantBody(body: string): BloxBuildGrant;
+/**
+ * Resolve ephemeral build authority. Non-local builds only trust Netlify hook
+ * metadata and never fall back to long-lived environment credentials.
+ */
+export declare function resolveBloxBuildGrant(options?: ResolveBloxBuildGrantOptions): BloxBuildGrant | undefined;
+//# sourceMappingURL=build-grant.d.ts.map

package/dist/ssg/build-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-grant.d.ts","sourceRoot":"","sources":["../../src/ssg/build-grant.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,4BAA4B;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CACvB;AAkBD,sFAAsF;AACtF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAqCpE;AAUD;;;GAGG;AACH,wBAAgB,qBAAqB,CACpC,OAAO,GAAE,4BAAiC,GACxC,cAAc,GAAG,SAAS,CAuB5B"}

package/dist/ssg/build-grant.mjs

@@ -0,0 +1,74 @@
+import process from "node:process";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const PAYLOAD_FIELDS = /* @__PURE__ */ new Set(["version", "source", "website_id", "grant"]);
+function parseJsonObject(value) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new Error("Invalid Blox build hook payload");
+  }
+  if (parsed === null || Array.isArray(parsed) || typeof parsed !== "object") {
+    throw new Error("Invalid Blox build hook payload");
+  }
+  return parsed;
+}
+function parseBloxBuildGrantBody(body) {
+  const trimmed = body.trim();
+  if (!trimmed) throw new Error("Missing Blox build hook payload");
+  let payload;
+  try {
+    payload = parseJsonObject(trimmed);
+  } catch {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(trimmed);
+    } catch {
+      throw new Error("Invalid Blox build hook payload");
+    }
+    payload = parseJsonObject(decoded);
+  }
+  if (Object.keys(payload).some((field) => !PAYLOAD_FIELDS.has(field))) {
+    throw new Error("Invalid Blox build hook payload fields");
+  }
+  if (payload.version !== 1 || payload.source !== "blox" || typeof payload.website_id !== "string" || !UUID_PATTERN.test(payload.website_id) || typeof payload.grant !== "string" || payload.grant.trim() === "") {
+    throw new Error("Invalid Blox build hook payload");
+  }
+  return {
+    version: 1,
+    source: "blox",
+    websiteId: payload.website_id,
+    grant: payload.grant
+  };
+}
+function isLocalOrTest(mode, env) {
+  return mode === "localhost" || mode === "development" || mode === "test" || env.NODE_ENV === "development" || env.NODE_ENV === "test";
+}
+function resolveBloxBuildGrant(options = {}) {
+  var _a, _b, _c, _d, _e;
+  const env = options.env ?? process.env;
+  if (isLocalOrTest(options.mode, env)) {
+    const websiteId = (_a = env.BLOX_WEBSITE_ID) == null ? void 0 : _a.trim();
+    const grant2 = (_b = env.BLOX_BUILD_TOKEN) == null ? void 0 : _b.trim();
+    if (!websiteId && !grant2) return void 0;
+    if (!websiteId || !UUID_PATTERN.test(websiteId) || !grant2) {
+      throw new Error("Local Blox build overrides require a valid BLOX_WEBSITE_ID and BLOX_BUILD_TOKEN");
+    }
+    return { version: 1, source: "blox", websiteId, grant: grant2 };
+  }
+  if (!((_c = env.INCOMING_HOOK_URL) == null ? void 0 : _c.trim()) || !((_d = env.INCOMING_HOOK_TITLE) == null ? void 0 : _d.trim())) {
+    throw new Error("Blox production builds require Netlify incoming hook metadata");
+  }
+  const body = env.INCOMING_HOOK_BODY;
+  if (body == null) throw new Error("Blox production builds require a hook payload");
+  const grant = parseBloxBuildGrantBody(body);
+  const configuredWebsiteId = (_e = env.BLOX_WEBSITE_ID) == null ? void 0 : _e.trim();
+  if (configuredWebsiteId && configuredWebsiteId !== grant.websiteId) {
+    throw new Error("Blox build hook website does not match the configured website");
+  }
+  return grant;
+}
+export {
+  parseBloxBuildGrantBody,
+  resolveBloxBuildGrant
+};

package/dist/ssg/build-request.d.ts

@@ -1,4 +1,6 @@
 export interface BloxBuildRequestOptions {
+    /** Website authorized by the ephemeral build grant. */
+    websiteId?: string;
     /** Server-only build token. Never use a VITE_-prefixed environment variable. */
     token?: string;
     /** Header accepted by the build API/gateway. @default "Authorization" */

package/dist/ssg/build-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-request.d.ts","sourceRoot":"","sources":["../../src/ssg/build-request.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACvC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAE/B,MAAM,EAAE,MAAM;aACd,GAAG,EAAE,MAAM;gBADX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EAC3B,UAAU,EAAE,MAAM;CAKnB;AAMD,uFAAuF;AACvF,wBAAgB,0BAA0B,CACzC,SAAS,GAAE,uBAA4B,GACrC,uBAAuB,CAWzB;AAMD,gFAAgF;AAChF,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,QAAQ,CAAC,CAiCnB;AAED,sEAAsE;AACtE,wBAAsB,aAAa,CAAC,CAAC,EACpC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,CAAC,CAAC,CAQZ"}
+{"version":3,"file":"build-request.d.ts","sourceRoot":"","sources":["../../src/ssg/build-request.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACvC,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qCAAqC;IACrC,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aAE/B,MAAM,EAAE,MAAM;aACd,GAAG,EAAE,MAAM;gBADX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EAC3B,UAAU,EAAE,MAAM;CAKnB;AAMD,uFAAuF;AACvF,wBAAgB,0BAA0B,CACzC,SAAS,GAAE,uBAA4B,GACrC,uBAAuB,CAYzB;AAMD,gFAAgF;AAChF,wBAAsB,gBAAgB,CACrC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,QAAQ,CAAC,CAiCnB;AAED,sEAAsE;AACtE,wBAAsB,aAAa,CAAC,CAAC,EACpC,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE,uBAA4B,GACnC,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/ssg/cli.cjs

@@ -2,7 +2,8 @@
 "use strict";
 const process = require("node:process");
 const fs = require("node:fs/promises");
-const llmArtifacts = require("../validate-output-2iH8f9ql.cjs");
+const ssg_buildGrant = require("./build-grant.cjs");
+const llmArtifacts = require("../validate-output-Dku8tCir.cjs");
 function installFetchTimeout() {
   const ms = Number(process.env.BLOX_SSG_FETCH_TIMEOUT_MS) || 2e4;
   const original = globalThis.fetch;
@@ -131,15 +132,22 @@ Environment:
     console.log(`[blox-ssg] validated output in ${validateOutDir}`);
     return;
   }
+  const buildGrant = ssg_buildGrant.resolveBloxBuildGrant({ mode });
+  if (buildGrant) {
+    process.env.BLOX_WEBSITE_ID = buildGrant.websiteId;
+    process.env.BLOX_BUILD_TOKEN = buildGrant.grant;
+  }
+  const buildRequest = buildGrant ? { websiteId: buildGrant.websiteId, token: buildGrant.grant } : {};
   if (shardsOpt !== null || routesCmd) {
     const { apiBase: apiBase2, websiteName: configWebsiteName2 } = await resolveApiBase(mode);
     const websiteName2 = process.env.WEBSITE_NAME ?? configWebsiteName2 ?? "default";
-    const { runSharded } = await Promise.resolve().then(() => require("../shard-runner-C-OeWaVM.cjs"));
+    const { runSharded } = await Promise.resolve().then(() => require("../shard-runner-DOK26Y78.cjs"));
     const code = await runSharded({
       shards: shardsOpt ?? "auto",
       mode,
       apiBase: apiBase2,
       websiteName: websiteName2,
+      buildRequest,
       extraPaths,
       passthroughArgs,
       routesCmd: routesCmd || void 0
@@ -147,7 +155,7 @@ Environment:
     if (code === 0 && (process.env.NODE_ENV === "production" || mode === "production")) {
       const uploadWebsiteId = (_a = process.env.BLOX_WEBSITE_ID) == null ? void 0 : _a.trim();
       if (uploadWebsiteId) {
-        await llmArtifacts.uploadBloxManifest(apiBase2, uploadWebsiteId);
+        await llmArtifacts.uploadBloxManifest(apiBase2, uploadWebsiteId, buildRequest);
         console.log("Uploaded .blox-manifest.json with Git provenance");
       } else {
         console.log("Skipped Blox manifest upload (BLOX_WEBSITE_ID is not configured)");
@@ -169,7 +177,7 @@ Environment:
   let cachedAppPaths = [];
   const productionBuild = process.env.NODE_ENV === "production" || mode === "production";
   try {
-    const siteData = siteDataFile ? JSON.parse(await fs.readFile(siteDataFile, "utf8")) : await llmArtifacts.fetchCmsSiteData(apiBase, websiteName);
+    const siteData = siteDataFile ? JSON.parse(await fs.readFile(siteDataFile, "utf8")) : await llmArtifacts.fetchCmsSiteData(apiBase, websiteName, buildRequest);
     paths = siteData.paths;
     cachedAppPaths = "appPaths" in siteData && Array.isArray(siteData.appPaths) ? siteData.appPaths : [];
     cmsPathSet = new Set(siteData.paths.filter((path) => !cachedAppPaths.includes(path)));
@@ -270,7 +278,7 @@ ${"=".repeat(60)}`);
     if (productionBuild && shardTotal === 1) {
       const uploadWebsiteId = ((_b = process.env.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim()) || websiteId;
       if (!uploadWebsiteId) throw new Error("BLOX_WEBSITE_ID is required to upload the Blox manifest");
-      await llmArtifacts.uploadBloxManifest(apiBase, uploadWebsiteId);
+      await llmArtifacts.uploadBloxManifest(apiBase, uploadWebsiteId, buildRequest);
       console.log("Uploaded .blox-manifest.json with Git provenance");
     }
   } catch (err) {

package/dist/ssg/cli.mjs

@@ -1,7 +1,8 @@
 #!/usr/bin/env bun
 import process from "node:process";
 import fs from "node:fs/promises";
-import { v as validateSsgOutput, u as uploadBloxManifest, p as polyfillBloxSsgGlobals, f as fetchCmsSiteData, a as prerender } from "../validate-output-CfHo6w9k.js";
+import { resolveBloxBuildGrant } from "./build-grant.mjs";
+import { v as validateSsgOutput, u as uploadBloxManifest, p as polyfillBloxSsgGlobals, f as fetchCmsSiteData, a as prerender } from "../validate-output-XdxaXjgE.js";
 function installFetchTimeout() {
   const ms = Number(process.env.BLOX_SSG_FETCH_TIMEOUT_MS) || 2e4;
   const original = globalThis.fetch;
@@ -130,15 +131,22 @@ Environment:
     console.log(`[blox-ssg] validated output in ${validateOutDir}`);
     return;
   }
+  const buildGrant = resolveBloxBuildGrant({ mode });
+  if (buildGrant) {
+    process.env.BLOX_WEBSITE_ID = buildGrant.websiteId;
+    process.env.BLOX_BUILD_TOKEN = buildGrant.grant;
+  }
+  const buildRequest = buildGrant ? { websiteId: buildGrant.websiteId, token: buildGrant.grant } : {};
   if (shardsOpt !== null || routesCmd) {
     const { apiBase: apiBase2, websiteName: configWebsiteName2 } = await resolveApiBase(mode);
     const websiteName2 = process.env.WEBSITE_NAME ?? configWebsiteName2 ?? "default";
-    const { runSharded } = await import("../shard-runner-Aw77Pe6C.js");
+    const { runSharded } = await import("../shard-runner-Ic_t76Xj.js");
     const code = await runSharded({
       shards: shardsOpt ?? "auto",
       mode,
       apiBase: apiBase2,
       websiteName: websiteName2,
+      buildRequest,
       extraPaths,
       passthroughArgs,
       routesCmd: routesCmd || void 0
@@ -146,7 +154,7 @@ Environment:
     if (code === 0 && (process.env.NODE_ENV === "production" || mode === "production")) {
       const uploadWebsiteId = (_a = process.env.BLOX_WEBSITE_ID) == null ? void 0 : _a.trim();
       if (uploadWebsiteId) {
-        await uploadBloxManifest(apiBase2, uploadWebsiteId);
+        await uploadBloxManifest(apiBase2, uploadWebsiteId, buildRequest);
         console.log("Uploaded .blox-manifest.json with Git provenance");
       } else {
         console.log("Skipped Blox manifest upload (BLOX_WEBSITE_ID is not configured)");
@@ -168,7 +176,7 @@ Environment:
   let cachedAppPaths = [];
   const productionBuild = process.env.NODE_ENV === "production" || mode === "production";
   try {
-    const siteData = siteDataFile ? JSON.parse(await fs.readFile(siteDataFile, "utf8")) : await fetchCmsSiteData(apiBase, websiteName);
+    const siteData = siteDataFile ? JSON.parse(await fs.readFile(siteDataFile, "utf8")) : await fetchCmsSiteData(apiBase, websiteName, buildRequest);
     paths = siteData.paths;
     cachedAppPaths = "appPaths" in siteData && Array.isArray(siteData.appPaths) ? siteData.appPaths : [];
     cmsPathSet = new Set(siteData.paths.filter((path) => !cachedAppPaths.includes(path)));
@@ -269,7 +277,7 @@ ${"=".repeat(60)}`);
     if (productionBuild && shardTotal === 1) {
       const uploadWebsiteId = ((_b = process.env.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim()) || websiteId;
       if (!uploadWebsiteId) throw new Error("BLOX_WEBSITE_ID is required to upload the Blox manifest");
-      await uploadBloxManifest(apiBase, uploadWebsiteId);
+      await uploadBloxManifest(apiBase, uploadWebsiteId, buildRequest);
       console.log("Uploaded .blox-manifest.json with Git provenance");
     }
   } catch (err) {

package/dist/ssg/cms-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cms-routes.d.ts","sourceRoot":"","sources":["../../src/ssg/cms-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAoB9D,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,WAAW,CAAA;IACpB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,EAAE,aAAa,EAAE,CAAA;IAC1B,oEAAoE;IACpE,WAAW,EAAE,aAAa,EAAE,CAAA;CAC5B;AAYD;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EAAE,GACxB,MAAM,EAAE,CASV;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,uBAA4B,GAC1C,OAAO,CAAC,WAAW,CAAC,CAwGtB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,uBAA4B,GAC1C,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB"}
+{"version":3,"file":"cms-routes.d.ts","sourceRoot":"","sources":["../../src/ssg/cms-routes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAoB9D,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,WAAW,CAAA;IACpB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,SAAS,EAAE,aAAa,EAAE,CAAA;IAC1B,oEAAoE;IACpE,WAAW,EAAE,aAAa,EAAE,CAAA;CAC5B;AAYD;;;GAGG;AACH,wBAAgB,iBAAiB,CAChC,KAAK,EAAE,MAAM,EAAE,EACf,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EAAE,GACxB,MAAM,EAAE,CASV;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,uBAA4B,GAC1C,OAAO,CAAC,WAAW,CAAC,CA4GtB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,GAAE,uBAA4B,GAC1C,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnB"}

package/dist/ssg/createSSREntry.d.ts

@@ -26,6 +26,11 @@ export interface CreateBloxSSREntryOptions {
     apiBase?: string;
     /** Build-only authentication/headers. Defaults to BLOX_BUILD_TOKEN env. */
     buildRequest?: BloxBuildRequestOptions;
+    /**
+     * Resolve concrete paths through `/resolve-path` even when a build website
+     * ID is available. This expands dynamic templates such as `/article/:slug`.
+     */
+    resolvePublishedPaths?: boolean;
     /** Immutable build-time datastore resolver used by content routes and SEO. */
     collectionResolver?: (collection: string, options: ListItemsOptions) => Promise<Array<Record<string, unknown>>>;
     /** Default locale. @default 'en' */
@@ -50,6 +55,10 @@ export interface BloxSSREntry {
     /** Resolve a URL's page data without rendering (for batched prefetch). */
     prefetchResolve?: (url: string) => Promise<unknown>;
 }
+interface PublishedPage {
+    slug?: string;
+}
+export declare function matchPublishedPage(pages: PublishedPage[], slug: string, allowTemplates?: boolean): PublishedPage | null;
 /**
  * Factory that produces the `{ render }` export for `main.server.ts`.
  *
@@ -80,4 +89,5 @@ export interface BloxSSREntry {
  * ```
  */
 export declare function createBloxSSREntry(options: CreateBloxSSREntryOptions): BloxSSREntry;
+export {};
 //# sourceMappingURL=createSSREntry.d.ts.map

package/dist/ssg/createSSREntry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createSSREntry.d.ts","sourceRoot":"","sources":["../../src/ssg/createSSREntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAO9D,OAAO,EAAuC,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAInF,MAAM,WAAW,yBAAyB;IACzC,oCAAoC;IACpC,aAAa,EAAE,SAAS,CAAA;IACxB;;;;OAIG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9D;;;OAGG;IACH,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpD,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,uBAAuB,CAAA;IACtC,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,CACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,KACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5C,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAA;IAC5E;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5C,kDAAkD;IAClD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAClE,0EAA0E;IAC1E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACnD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CAoNnF"}
+{"version":3,"file":"createSSREntry.d.ts","sourceRoot":"","sources":["../../src/ssg/createSSREntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,CAAA;AACzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAO9D,OAAO,EAAuC,KAAK,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAInF,MAAM,WAAW,yBAAyB;IACzC,oCAAoC;IACpC,aAAa,EAAE,SAAS,CAAA;IACxB;;;;OAIG;IACH,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,GAAG,QAAQ,EAAE,GAAG,CAAC,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9D;;;OAGG;IACH,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACpD,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,uBAAuB,CAAA;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,CACpB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,gBAAgB,KACrB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5C,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC,OAAO,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAA;IAC5E;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC5C,kDAAkD;IAClD,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAClE,0EAA0E;IAC1E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CACnD;AAED,UAAU,aAAa;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;CACb;AAED,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,aAAa,EAAE,EACtB,IAAI,EAAE,MAAM,EACZ,cAAc,UAAQ,GACpB,aAAa,GAAG,IAAI,CAUtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,YAAY,CA0NnF"}

package/dist/ssg/index.cjs

@@ -22,7 +22,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const llmArtifacts = require("../validate-output-2iH8f9ql.cjs");
+const llmArtifacts = require("../validate-output-Dku8tCir.cjs");
+const ssg_buildGrant = require("./build-grant.cjs");
 const ssg_client = require("./client.cjs");
 const pinia = require("pinia");
 const vue = require("vue");
@@ -111,6 +112,18 @@ ${jsonLd}`;
 function safeJson(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c");
 }
+function matchPublishedPage(pages, slug, allowTemplates = false) {
+  var _a;
+  const exact = pages.find((page) => page.slug === slug);
+  if (exact) return exact;
+  if (!allowTemplates) return null;
+  for (const template of pages) {
+    if (!((_a = template.slug) == null ? void 0 : _a.includes(":"))) continue;
+    const pattern = template.slug.replace(/:[a-z_]+/g, "[^/]+");
+    if (new RegExp(`^${pattern}$`).test(slug)) return template;
+  }
+  return null;
+}
 function createBloxSSREntry(options) {
   var _a;
   const {
@@ -127,12 +140,13 @@ function createBloxSSREntry(options) {
   } = options;
   const apiBase = options.apiBase ?? (typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a.BAGELINK_API_URL : void 0) ?? "https://api.bagel.to";
   let websiteIdCache = null;
+  const publishedBundleCache = /* @__PURE__ */ new Map();
   routes.setApiOrigin(apiBase);
   routes.setCollectionResolver(options.collectionResolver ?? null);
   async function getWebsiteId() {
-    var _a2, _b;
+    var _a2, _b, _c;
     if (websiteIdCache) return websiteIdCache;
-    const configuredWebsiteId = typeof process !== "undefined" ? (_b = (_a2 = process.env) == null ? void 0 : _a2.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0;
+    const configuredWebsiteId = ((_a2 = options.buildRequest) == null ? void 0 : _a2.websiteId) ?? (typeof process !== "undefined" ? (_c = (_b = process.env) == null ? void 0 : _b.BLOX_WEBSITE_ID) == null ? void 0 : _c.trim() : void 0);
     if (configuredWebsiteId) {
       websiteIdCache = configuredWebsiteId;
       return websiteIdCache;
@@ -156,18 +170,27 @@ function createBloxSSREntry(options) {
     return { locale, slug: urlPath || "/" };
   }
   async function fetchResolvedPage(slug, pageLocale) {
-    var _a2, _b;
+    var _a2, _b, _c;
     const websiteId = await getWebsiteId();
-    const configuredWebsiteId = typeof process !== "undefined" ? (_b = (_a2 = process.env) == null ? void 0 : _a2.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0;
+    const configuredWebsiteId = ((_a2 = options.buildRequest) == null ? void 0 : _a2.websiteId) ?? (typeof process !== "undefined" ? (_c = (_b = process.env) == null ? void 0 : _b.BLOX_WEBSITE_ID) == null ? void 0 : _c.trim() : void 0);
     if (configuredWebsiteId) {
-      const bundle = await llmArtifacts.bloxBuildJson(
-        `${apiBase}/blox-build/websites/${websiteId}/published?locale=${encodeURIComponent(pageLocale)}`,
-        {},
-        options.buildRequest
+      const cacheKey = pageLocale;
+      let pending = publishedBundleCache.get(cacheKey);
+      if (!pending) {
+        pending = llmArtifacts.bloxBuildJson(
+          `${apiBase}/blox-build/websites/${websiteId}/published?locale=${encodeURIComponent(pageLocale)}`,
+          {},
+          options.buildRequest
+        );
+        publishedBundleCache.set(cacheKey, pending);
+      }
+      const bundle = await pending;
+      const page = matchPublishedPage(
+        bundle.pages,
+        slug,
+        options.resolvePublishedPaths
       );
-      const page = bundle.pages.find((candidate) => candidate.slug === slug);
-      if (!page) return null;
-      return { page, contexts: {}, warnings: [] };
+      return page ? { page, contexts: {}, warnings: [] } : null;
     }
     const url = `${apiBase}/blox/websites/${websiteId}/resolve-path?path=${encodeURIComponent(slug)}&locale=${pageLocale}`;
     return llmArtifacts.bloxBuildJson(url, {}, options.buildRequest);
@@ -351,6 +374,8 @@ exports.resolveManifestProvenance = llmArtifacts.resolveManifestProvenance;
 exports.splitSitemapPathsByLocale = llmArtifacts.splitSitemapPathsByLocale;
 exports.uploadBloxManifest = llmArtifacts.uploadBloxManifest;
 exports.validateSsgOutput = llmArtifacts.validateSsgOutput;
+exports.parseBloxBuildGrantBody = ssg_buildGrant.parseBloxBuildGrantBody;
+exports.resolveBloxBuildGrant = ssg_buildGrant.resolveBloxBuildGrant;
 exports.BLOX_COLLECTIONS_WINDOW_KEY = ssg_client.BLOX_COLLECTIONS_WINDOW_KEY;
 exports.BLOX_DATA_WINDOW_KEY = ssg_client.BLOX_DATA_WINDOW_KEY;
 exports.BLOX_PAGE_SEO_WINDOW_KEY = ssg_client.BLOX_PAGE_SEO_WINDOW_KEY;

package/dist/ssg/index.d.ts

@@ -1,6 +1,8 @@
 export { fetchCmsPrerenderPaths, fetchCmsSiteData } from './cms-routes';
 export type { CmsSiteData, CollectionRef } from './cms-routes';
 export { BloxBuildResponseError, bloxBuildJson, bloxBuildRequest, getBloxBuildRequestOptions } from './build-request';
+export { parseBloxBuildGrantBody, resolveBloxBuildGrant } from './build-grant';
+export type { BloxBuildGrant, ResolveBloxBuildGrantOptions } from './build-grant';
 export type { BloxBuildRequestOptions } from './build-request';
 export { getCollectionCache, getEmbeddedWebsiteId, installCollectionCache } from './collection-cache';
 /**

package/dist/ssg/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ssg/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACvE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AACrH,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AACrG;;;;;;;;;;GAUG;AACH,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAC5J,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,YAAY,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC9F,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,OAAO,CAAA;AACxO,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AACtF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACnH,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACjF,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ssg/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACvE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAA;AACrH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAC9E,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AACjF,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AACrG;;;;;;;;;;GAUG;AACH,OAAO,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAC5J,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,YAAY,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC9F,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,OAAO,CAAA;AACxO,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,OAAO,CAAA;AACtF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACnH,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AACrD,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACjF,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/ssg/index.mjs

@@ -1,5 +1,6 @@
-import { b as buildPageHead, c as primaryContextEntry, d as buildJsonLd, e as extractPageText, B as BloxBuildResponseError, h as bloxBuildJson } from "../validate-output-CfHo6w9k.js";
-import { i, j, k, f, l, m, n, o, g, q, r, s, t, w, x, p, a, y, z, u, v } from "../validate-output-CfHo6w9k.js";
+import { b as buildPageHead, c as primaryContextEntry, d as buildJsonLd, e as extractPageText, B as BloxBuildResponseError, h as bloxBuildJson } from "../validate-output-XdxaXjgE.js";
+import { i, j, k, f, l, m, n, o, g, q, r, s, t, w, x, p, a, y, z, u, v } from "../validate-output-XdxaXjgE.js";
+import { parseBloxBuildGrantBody, resolveBloxBuildGrant } from "./build-grant.mjs";
 import { BLOX_STATE_WINDOW_KEY, BLOX_WEBSITE_ID_WINDOW_KEY } from "./client.mjs";
 import { BLOX_COLLECTIONS_WINDOW_KEY, BLOX_DATA_WINDOW_KEY, BLOX_PAGE_SEO_WINDOW_KEY, getCollectionCache, getEmbeddedWebsiteId, installBloxStateCache, installCollectionCache } from "./client.mjs";
 import { createPinia } from "pinia";
@@ -89,6 +90,18 @@ ${jsonLd}`;
 function safeJson(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c");
 }
+function matchPublishedPage(pages, slug, allowTemplates = false) {
+  var _a;
+  const exact = pages.find((page) => page.slug === slug);
+  if (exact) return exact;
+  if (!allowTemplates) return null;
+  for (const template of pages) {
+    if (!((_a = template.slug) == null ? void 0 : _a.includes(":"))) continue;
+    const pattern = template.slug.replace(/:[a-z_]+/g, "[^/]+");
+    if (new RegExp(`^${pattern}$`).test(slug)) return template;
+  }
+  return null;
+}
 function createBloxSSREntry(options) {
   var _a;
   const {
@@ -105,12 +118,13 @@ function createBloxSSREntry(options) {
   } = options;
   const apiBase = options.apiBase ?? (typeof process !== "undefined" ? (_a = process.env) == null ? void 0 : _a.BAGELINK_API_URL : void 0) ?? "https://api.bagel.to";
   let websiteIdCache = null;
+  const publishedBundleCache = /* @__PURE__ */ new Map();
   setApiOrigin(apiBase);
   setCollectionResolver(options.collectionResolver ?? null);
   async function getWebsiteId() {
-    var _a2, _b;
+    var _a2, _b, _c;
     if (websiteIdCache) return websiteIdCache;
-    const configuredWebsiteId = typeof process !== "undefined" ? (_b = (_a2 = process.env) == null ? void 0 : _a2.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0;
+    const configuredWebsiteId = ((_a2 = options.buildRequest) == null ? void 0 : _a2.websiteId) ?? (typeof process !== "undefined" ? (_c = (_b = process.env) == null ? void 0 : _b.BLOX_WEBSITE_ID) == null ? void 0 : _c.trim() : void 0);
     if (configuredWebsiteId) {
       websiteIdCache = configuredWebsiteId;
       return websiteIdCache;
@@ -134,18 +148,27 @@ function createBloxSSREntry(options) {
     return { locale, slug: urlPath || "/" };
   }
   async function fetchResolvedPage(slug, pageLocale) {
-    var _a2, _b;
+    var _a2, _b, _c;
     const websiteId = await getWebsiteId();
-    const configuredWebsiteId = typeof process !== "undefined" ? (_b = (_a2 = process.env) == null ? void 0 : _a2.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0;
+    const configuredWebsiteId = ((_a2 = options.buildRequest) == null ? void 0 : _a2.websiteId) ?? (typeof process !== "undefined" ? (_c = (_b = process.env) == null ? void 0 : _b.BLOX_WEBSITE_ID) == null ? void 0 : _c.trim() : void 0);
     if (configuredWebsiteId) {
-      const bundle = await bloxBuildJson(
-        `${apiBase}/blox-build/websites/${websiteId}/published?locale=${encodeURIComponent(pageLocale)}`,
-        {},
-        options.buildRequest
+      const cacheKey = pageLocale;
+      let pending = publishedBundleCache.get(cacheKey);
+      if (!pending) {
+        pending = bloxBuildJson(
+          `${apiBase}/blox-build/websites/${websiteId}/published?locale=${encodeURIComponent(pageLocale)}`,
+          {},
+          options.buildRequest
+        );
+        publishedBundleCache.set(cacheKey, pending);
+      }
+      const bundle = await pending;
+      const page = matchPublishedPage(
+        bundle.pages,
+        slug,
+        options.resolvePublishedPaths
       );
-      const page = bundle.pages.find((candidate) => candidate.slug === slug);
-      if (!page) return null;
-      return { page, contexts: {}, warnings: [] };
+      return page ? { page, contexts: {}, warnings: [] } : null;
     }
     const url = `${apiBase}/blox/websites/${websiteId}/resolve-path?path=${encodeURIComponent(slug)}&locale=${pageLocale}`;
     return bloxBuildJson(url, {}, options.buildRequest);
@@ -335,10 +358,12 @@ export {
   installCollectionCache,
   w as localeSitemapPath,
   x as mergeLlmParts,
+  parseBloxBuildGrantBody,
   p as polyfillBloxSsgGlobals,
   a as prerender,
   querySnapshotRows,
   renderBloxSsgPage,
+  resolveBloxBuildGrant,
   y as resolveManifestProvenance,
   snapshotRows,
   z as splitSitemapPathsByLocale,

package/dist/ssg/manifest-upload.d.ts

@@ -1,4 +1,5 @@
 import { BloxManifest } from '../manifest';
+import { BloxBuildRequestOptions } from './build-request';
 export interface ManifestProvenance {
     repository: string;
     branch: string;
@@ -9,5 +10,5 @@ export interface ManifestUpload {
     provenance: ManifestProvenance;
 }
 export declare function resolveManifestProvenance(): Promise<ManifestProvenance>;
-export declare function uploadBloxManifest(apiBase: string, websiteId: string): Promise<void>;
+export declare function uploadBloxManifest(apiBase: string, websiteId: string, requestOptions?: BloxBuildRequestOptions): Promise<void>;
 //# sourceMappingURL=manifest-upload.d.ts.map

package/dist/ssg/manifest-upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest-upload.d.ts","sourceRoot":"","sources":["../../src/ssg/manifest-upload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO/C,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,YAAY,CAAA;IACtB,UAAU,EAAE,kBAAkB,CAAA;CAC9B;AAsBD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAgB7E;AAED,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf"}
+{"version":3,"file":"manifest-upload.d.ts","sourceRoot":"","sources":["../../src/ssg/manifest-upload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAK/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAG9D,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,EAAE,YAAY,CAAA;IACtB,UAAU,EAAE,kBAAkB,CAAA;CAC9B;AAsBD,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAgB7E;AAED,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,cAAc,GAAE,uBAA4B,GAC1C,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/ssg/shard-runner.d.ts

@@ -1,22 +1,4 @@
-/**
- * Built-in sharded SSG runner (coordinator).
- *
- * Vue SSR (`renderToString`) is CPU-bound and single-threaded, and a single
- * long-lived `blox-ssg` process also accumulates happy-dom/window/timer state
- * under bun — on large sites (thousands of pages) that leak eventually crashes
- * the process silently. Splitting the work across N short-lived child processes
- * (each rendering a disjoint `--shard=i/n` slice into the same `dist`) both
- * parallelizes the CPU-bound render AND keeps each process well under the leak
- * threshold.
- *
- * This module is the coordinator: it enumerates the route list once (optionally
- * via an external `--routes-cmd` for router-driven sites that don't use CMS page
- * discovery), then spawns the shards, divides the resolve-prefetch budget across
- * them, and merges each shard's llms part file into the final llms.txt.
- *
- * Activated by `--shards=<n|auto>` on the CLI. Without it, the CLI runs a single
- * in-process render exactly as before (full backward compat).
- */
+import { BloxBuildRequestOptions } from './build-request';
 export interface ShardRunnerOptions {
     /** Number of shards, or 'auto' → min(cores, cap). */
     shards: number | 'auto';
@@ -26,6 +8,8 @@ export interface ShardRunnerOptions {
     apiBase: string;
     /** CMS website name (for the post-run llms merge). */
     websiteName: string;
+    /** Ephemeral build authority inherited by discovery and child shards. */
+    buildRequest?: BloxBuildRequestOptions;
     /** Extra paths already parsed from argv (router-driven sites, static routes). */
     extraPaths: string[];
     /** Other pass-through flags to forward verbatim to each shard (e.g. --exclude=…, --crawl). */

package/dist/ssg/shard-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shard-runner.d.ts","sourceRoot":"","sources":["../../src/ssg/shard-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAWH,MAAM,WAAW,kBAAkB;IAClC,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IACvB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAA;IACnB,iFAAiF;IACjF,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,8FAA8F;IAC9F,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AA4ED;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAgI1E"}
+{"version":3,"file":"shard-runner.d.ts","sourceRoot":"","sources":["../../src/ssg/shard-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAI9D,MAAM,WAAW,kBAAkB;IAClC,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,MAAM,CAAA;IACvB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,uBAAuB,CAAA;IACtC,iFAAiF;IACjF,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,8FAA8F;IAC9F,eAAe,EAAE,MAAM,EAAE,CAAA;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AA4ED;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoI1E"}

package/dist/{validate-output-2iH8f9ql.cjs → validate-output-Dku8tCir.cjs}

@@ -41,6 +41,7 @@ function env(name) {
 }
 function getBloxBuildRequestOptions(overrides = {}) {
   return {
+    websiteId: overrides.websiteId,
     token: overrides.token ?? env("BLOX_BUILD_TOKEN"),
     tokenHeader: overrides.tokenHeader ?? env("BLOX_BUILD_TOKEN_HEADER") ?? "Authorization",
     tokenScheme: overrides.tokenScheme ?? env("BLOX_BUILD_TOKEN_SCHEME") ?? "Bearer",
@@ -111,7 +112,7 @@ function expandLocalePaths(paths, defaultLocale, supportedLocales) {
 }
 async function fetchCmsSiteData(apiBase, websiteName, requestOptions = {}) {
   var _a, _b, _c;
-  const websiteId = typeof process !== "undefined" ? (_b = (_a = process.env) == null ? void 0 : _a.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0;
+  const websiteId = requestOptions.websiteId ?? (typeof process !== "undefined" ? (_b = (_a = process.env) == null ? void 0 : _a.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0);
   if (websiteId) {
     const bundle = await bloxBuildJson(
       `${apiBase}/blox-build/websites/${websiteId}/published`,
@@ -134,9 +135,11 @@ async function fetchCmsSiteData(apiBase, websiteName, requestOptions = {}) {
       collections: extractCollectionRefs(bundle.pages)
     };
   }
-  const sitesData = await bloxBuildJson(`${apiBase}/blox/websites`, {}, requestOptions);
-  const sites = Array.isArray(sitesData) ? sitesData : sitesData.data ?? [];
-  const site = sites.find((s) => s.name === websiteName);
+  const site = await bloxBuildJson(
+    `${apiBase}/blox/sites/${encodeURIComponent(websiteName)}`,
+    {},
+    requestOptions
+  );
   if ((site == null ? void 0 : site.id) == null || site.id === "") throw new Error(`Website "${websiteName}" not found at ${apiBase}`);
   const website = await bloxBuildJson(
     `${apiBase}/blox/websites/${site.id}`,
@@ -192,6 +195,7 @@ async function fetchCmsPrerenderPaths(apiBase, websiteName, requestOptions = {})
 }
 async function expandRoutes(apiBase, pages, requestOptions, locale) {
   const routes = [];
+  const grantedWebsiteId = requestOptions.websiteId;
   for (const page of pages) {
     const slug = page.slug ?? "/";
     if (page.status && page.status !== "published") continue;
@@ -201,12 +205,13 @@ async function expandRoutes(apiBase, pages, requestOptions, locale) {
         if (b.adapter === "datastore" && b.collection != null && b.collection !== "" && b.store != null && b.store !== "" && b.bind_by != null && b.bind_by !== "") {
           const q = b.filter ? `&q=${encodeURIComponent(b.filter)}` : "";
           const localeParam = locale ? `&locale=${encodeURIComponent(locale)}` : "";
+          const collectionPath = grantedWebsiteId ? `/blox-build/websites/${grantedWebsiteId}/collections/${b.store}/${b.collection}` : `/datastore/${b.store}/collections/${b.collection}`;
           const itemsData = await bloxBuildJson(
-            `${apiBase}/datastore/${b.store}/collections/${b.collection}?limit=200${localeParam}${q}`,
+            `${apiBase}${collectionPath}?limit=200${localeParam}${q}`,
             {},
             requestOptions
           );
-          const items = Array.isArray(itemsData) ? itemsData : itemsData.data ?? [];
+          const items = Array.isArray(itemsData) ? itemsData : itemsData.items ?? itemsData.data ?? [];
           for (const item of items) {
             const bindValue = item[b.bind_by];
             if (typeof bindValue !== "string" || bindValue === "") continue;
@@ -272,9 +277,9 @@ async function resolveManifestProvenance() {
     commit
   };
 }
-async function uploadBloxManifest(apiBase, websiteId) {
-  if (!environment("BLOX_BUILD_TOKEN")) {
-    throw new Error("BLOX_BUILD_TOKEN is required to upload the Blox manifest");
+async function uploadBloxManifest(apiBase, websiteId, requestOptions = {}) {
+  if (!requestOptions.token && !environment("BLOX_BUILD_TOKEN")) {
+    throw new Error("A Blox build grant is required to upload the Blox manifest");
   }
   const distDirectory = path.resolve(process$1.cwd(), "dist");
   const resolvedManifestPath = path.resolve(distDirectory, ".blox-manifest.json");
@@ -289,7 +294,8 @@ async function uploadBloxManifest(apiBase, websiteId) {
       method: "PUT",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload)
-    }
+    },
+    requestOptions
   );
 }
 async function polyfillBloxSsgGlobals(options) {

package/dist/{validate-output-CfHo6w9k.js → validate-output-XdxaXjgE.js}

@@ -18,6 +18,7 @@ function env(name) {
 }
 function getBloxBuildRequestOptions(overrides = {}) {
   return {
+    websiteId: overrides.websiteId,
     token: overrides.token ?? env("BLOX_BUILD_TOKEN"),
     tokenHeader: overrides.tokenHeader ?? env("BLOX_BUILD_TOKEN_HEADER") ?? "Authorization",
     tokenScheme: overrides.tokenScheme ?? env("BLOX_BUILD_TOKEN_SCHEME") ?? "Bearer",
@@ -88,7 +89,7 @@ function expandLocalePaths(paths, defaultLocale, supportedLocales) {
 }
 async function fetchCmsSiteData(apiBase, websiteName, requestOptions = {}) {
   var _a, _b, _c;
-  const websiteId = typeof process !== "undefined" ? (_b = (_a = process.env) == null ? void 0 : _a.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0;
+  const websiteId = requestOptions.websiteId ?? (typeof process !== "undefined" ? (_b = (_a = process.env) == null ? void 0 : _a.BLOX_WEBSITE_ID) == null ? void 0 : _b.trim() : void 0);
   if (websiteId) {
     const bundle = await bloxBuildJson(
       `${apiBase}/blox-build/websites/${websiteId}/published`,
@@ -111,9 +112,11 @@ async function fetchCmsSiteData(apiBase, websiteName, requestOptions = {}) {
       collections: extractCollectionRefs(bundle.pages)
     };
   }
-  const sitesData = await bloxBuildJson(`${apiBase}/blox/websites`, {}, requestOptions);
-  const sites = Array.isArray(sitesData) ? sitesData : sitesData.data ?? [];
-  const site = sites.find((s) => s.name === websiteName);
+  const site = await bloxBuildJson(
+    `${apiBase}/blox/sites/${encodeURIComponent(websiteName)}`,
+    {},
+    requestOptions
+  );
   if ((site == null ? void 0 : site.id) == null || site.id === "") throw new Error(`Website "${websiteName}" not found at ${apiBase}`);
   const website = await bloxBuildJson(
     `${apiBase}/blox/websites/${site.id}`,
@@ -169,6 +172,7 @@ async function fetchCmsPrerenderPaths(apiBase, websiteName, requestOptions = {})
 }
 async function expandRoutes(apiBase, pages, requestOptions, locale) {
   const routes = [];
+  const grantedWebsiteId = requestOptions.websiteId;
   for (const page of pages) {
     const slug = page.slug ?? "/";
     if (page.status && page.status !== "published") continue;
@@ -178,12 +182,13 @@ async function expandRoutes(apiBase, pages, requestOptions, locale) {
         if (b.adapter === "datastore" && b.collection != null && b.collection !== "" && b.store != null && b.store !== "" && b.bind_by != null && b.bind_by !== "") {
           const q = b.filter ? `&q=${encodeURIComponent(b.filter)}` : "";
           const localeParam = locale ? `&locale=${encodeURIComponent(locale)}` : "";
+          const collectionPath = grantedWebsiteId ? `/blox-build/websites/${grantedWebsiteId}/collections/${b.store}/${b.collection}` : `/datastore/${b.store}/collections/${b.collection}`;
           const itemsData = await bloxBuildJson(
-            `${apiBase}/datastore/${b.store}/collections/${b.collection}?limit=200${localeParam}${q}`,
+            `${apiBase}${collectionPath}?limit=200${localeParam}${q}`,
             {},
             requestOptions
           );
-          const items = Array.isArray(itemsData) ? itemsData : itemsData.data ?? [];
+          const items = Array.isArray(itemsData) ? itemsData : itemsData.items ?? itemsData.data ?? [];
           for (const item of items) {
             const bindValue = item[b.bind_by];
             if (typeof bindValue !== "string" || bindValue === "") continue;
@@ -249,9 +254,9 @@ async function resolveManifestProvenance() {
     commit
   };
 }
-async function uploadBloxManifest(apiBase, websiteId) {
-  if (!environment("BLOX_BUILD_TOKEN")) {
-    throw new Error("BLOX_BUILD_TOKEN is required to upload the Blox manifest");
+async function uploadBloxManifest(apiBase, websiteId, requestOptions = {}) {
+  if (!requestOptions.token && !environment("BLOX_BUILD_TOKEN")) {
+    throw new Error("A Blox build grant is required to upload the Blox manifest");
   }
   const distDirectory = resolve(process$1.cwd(), "dist");
   const resolvedManifestPath = resolve(distDirectory, ".blox-manifest.json");
@@ -266,7 +271,8 @@ async function uploadBloxManifest(apiBase, websiteId) {
       method: "PUT",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify(payload)
-    }
+    },
+    requestOptions
   );
 }
 async function polyfillBloxSsgGlobals(options) {

package/dist/vite-plugin.cjs

@@ -176,6 +176,7 @@ function bloxPlugin(options = {}) {
     let outDir = "dist";
     let isSsrBuild = false;
     let vuePlugin;
+    let resolvedAliases;
     plugins.push({
       name: "vite-plugin-blox-manifest",
       apply: "build",
@@ -184,6 +185,7 @@ function bloxPlugin(options = {}) {
         outDir = resolved.build.outDir;
         isSsrBuild = !!resolved.build.ssr;
         vuePlugin = resolved.plugins.find((plugin) => plugin.name === "vite:vue");
+        resolvedAliases = resolved.resolve.alias;
       },
       resolveId(id) {
         if (id === VIRTUAL_ENTRY) return RESOLVED_ENTRY;
@@ -212,6 +214,7 @@ function bloxPlugin(options = {}) {
           configFile: false,
           logLevel: "silent",
           server: { middlewareMode: true, hmr: false },
+          resolve: { alias: resolvedAliases },
           plugins: [
             {
               name: "vite-plugin-blox-manifest-entry",

package/dist/vite-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin.d.ts","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,MAAM,CAAA;AAM9C,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,OAAO,CAAA;IACb;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,EAAE,CAogBpE"}
+{"version":3,"file":"vite-plugin.d.ts","sourceRoot":"","sources":["../src/vite-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAc,MAAM,MAAM,CAAA;AAM9C,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,OAAO,CAAA;IACb;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,EAAE,CAugBpE"}

package/dist/vite-plugin.mjs

@@ -152,6 +152,7 @@ function bloxPlugin(options = {}) {
     let outDir = "dist";
     let isSsrBuild = false;
     let vuePlugin;
+    let resolvedAliases;
     plugins.push({
       name: "vite-plugin-blox-manifest",
       apply: "build",
@@ -160,6 +161,7 @@ function bloxPlugin(options = {}) {
         outDir = resolved.build.outDir;
         isSsrBuild = !!resolved.build.ssr;
         vuePlugin = resolved.plugins.find((plugin) => plugin.name === "vite:vue");
+        resolvedAliases = resolved.resolve.alias;
       },
       resolveId(id) {
         if (id === VIRTUAL_ENTRY) return RESOLVED_ENTRY;
@@ -188,6 +190,7 @@ function bloxPlugin(options = {}) {
           configFile: false,
           logLevel: "silent",
           server: { middlewareMode: true, hmr: false },
+          resolve: { alias: resolvedAliases },
           plugins: [
             {
               name: "vite-plugin-blox-manifest-entry",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bagelink/blox",
   "type": "module",
-  "version": "1.15.535",
+  "version": "1.15.543",
   "description": "Blox page builder library for drag-and-drop page building and static data management",
   "author": {
     "name": "Bagel Studio",
@@ -53,6 +53,10 @@
       "types": "./dist/ssg/client.d.ts",
       "import": "./dist/ssg/client.mjs"
     },
+    "./ssg/build-grant": {
+      "types": "./dist/ssg/build-grant.d.ts",
+      "import": "./dist/ssg/build-grant.mjs"
+    },
     "./style.css": "./dist/style.css",
     "./dist/style.css": "./dist/style.css"
   },