@getvitops/astro 8.2.0 → 8.3.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,104 @@
 # @getvitops/astro
 
+## 8.3.0-alpha.0
+
+### Minor Changes
+
+- 93d2067: New framework patterns and an `Entries` component for the EmDash block library.
+
+  **CSS, all formats** (css, bricks and inlined into tailwind's `components` layer; no existing class changes): `tone` (a shared tint/solid colour convention driven by `--tone-*` custom properties, plus `.accent` for a run inside a heading), `section` (head and heading-left `--split` layout), `steps` (numbered `<ol>` with a connector line), `stats` (figures and `--tiles`), `callout` (a call-to-action band), `logos` (a still partner grid) and `embed` (a consent-gated iframe frame). All are structural partials, classified `vitops.components`.
+
+  **`@getvitops/astro`:** new `Entries.astro` (`@getvitops/astro/components/Entries.astro`) emits `<wc-entries>` itself with the semantic heading + `<dl>` fallback.
+
+  **`@getvitops/generator`:** `TierEntry` gains `emdashExempt` (a reason a shipped web component has no EmDash block). `tiers.test.ts` now fails if a shipped `wc-*` has neither `emdash` nor `emdashExempt`, and the components doc and the docs site list the exemptions.
+
+  No other consumer-facing change in `@getvitops/core`, `@getvitops/utils`, `@getvitops/cli` or `@getvitops/vite` beyond the version bump.
+
+- 161c7f3: A contact form that works end to end: `vitops setup turnstile`, `<wc-turnstile>`, the `vitops.form` EmDash block, and the route the emdash template ships to receive it.
+
+  **CSS, all formats** (no existing class changes): `forms.css` gains `.form-notice--target:not(:target)` (a message revealed only when the URL fragment names it, which is how a prerendered page shows a no-JS form's result) and `:where(wc-turnstile) { display: block }`.
+
+  **`@getvitops/core`:** new `<wc-turnstile sitekey="…">` in `elements.js`. It loads Cloudflare Turnstile on the first interaction with its form (no request to `challenges.cloudflare.com` for a visitor who only reads the page), holds an early submit until the token arrives, and leaves its slotted no-JS explanation in place until JS takes over. Turnstile is category `necessary`, so it is not behind the consent banner.
+
+  **`@getvitops/utils` / `@getvitops/cli`:** new `@getvitops/utils/turnstile` and `vitops setup turnstile [--dry] [--check] [--no-write] [--no-secret]`. It plans from the site's hostnames, creates a managed widget unless one already covers them (an existing widget is adopted, never edited, rotated or deleted), writes the public key to `site.security.turnstile.siteKey`, and pipes the one-time secret to `wrangler secret put VITOPS_TURNSTILE_SECRET` without writing it to any file. Needs `CLOUDFLARE_API_TOKEN` with **Account > Turnstile > Edit** and `CLOUDFLARE_ACCOUNT_ID`.
+
+  **`@getvitops/astro`:** `virtual:getvitops/head` gains `turnstileSiteKey` (read from `site.security.turnstile.siteKey`) so blocks can render the widget. No other change.
+
+  **`@getvitops/generator`:** `TIERS` gains a `turnstile` entry (wc-turnstile, claimed by `vitops.form`); `wc-multi-field`'s `emdashExempt` reason is reworded now the form block exists.
+
+  **`@getvitops/emdash`:** new `vitops.form` block: a field repeater (text, email, phone, long text, choose one, tick box), required flags, help text, success/error messages, optional Turnstile. It renders a semantic `<form method="post">` that works with no JavaScript, with a honeypot named per `createConversionRoute`'s defaults. A field named `phone` submits as `tel`, because the route reserves `phone` and `event`.
+
+  **`@getvitops/create`:** the emdash template ships `src/pages/api/track.ts` (`prerender = false`, `createConversionRoute()`), a seeded contact form, and `challenges.cloudflare.com` in both templates' Report-Only CSP (`script-src`, `frame-src`). The route refuses a post with nowhere to deliver and fails closed when a site key exists without `VITOPS_TURNSTILE_SECRET`. SETUP.html gains the Turnstile step. Existing sites: copy the route and the CSP change, then run `vitops setup turnstile`.
+
+- 175d16e: **Added: `vitops.reviews` and `vitops.nav` EmDash blocks.** Non-breaking.
+
+  - **`vitops.reviews`** renders Google reviews from the committed `.vitops/reviews.json` cache (`vitops reviews`) as a grid, carousel or marquee of `<ReviewCard>`. Fields: location key, layout, columns, limit, lowest rating, order, featured ids, reviewer photos (off by default), tone/colour. Which reviews show is `selectReviews()`, the one shared decision. Review JSON-LD is not offered (Google treats self-marked-up reviews as ineligible for rich results). A new review reaches the page after `vitops reviews` is re-run, committed and the site rebuilt, not when an editor saves; with no cache file the block renders nothing (a note in `astro dev`).
+  - **`vitops.nav`** renders a named EmDash menu inside page content (site map, section links, footer-style columns), never the header. Fields: menu (picked from the site's menus via a new `menus/list` plugin route, with `footer-sitemap`/`footer-legal`/`primary` as the static fallback), accessible name, visible heading and level, layout `list | inline | columns | sitenav`, depth 1-3, tone/colour. It is a `<nav>` with a name that is never `Primary`, `Site map` or `Legal` (the layout's landmarks), `aria-current="page"`, no runtime JS; a missing or empty menu renders nothing.
+  - `@getvitops/astro`: **`virtual:getvitops/reviews`**, served by `vitops()`, is `.vitops/reviews.json` as a build-time import (an empty cache when absent or unreadable), because a Worker cannot read the file. `<ReviewCard>` now renders the review's source link (`.review__source`, `rel="nofollow noopener noreferrer"`), which the pattern already styled. **Fix:** `src/json-ld.ts` was missing from the published `files`, so any consumer importing `<ReviewCard>` (which composes `schemas/Review.astro`) failed to build with an unresolved import. `@getvitops/emdash` now needs this version of `@getvitops/astro` for the `vitops.reviews` block.
+  - `@getvitops/utils`: new Worker-safe subpath **`@getvitops/utils/reviews/select`** (`selectReviews` and the review types, no `node:fs`). `selectReviews` now takes only the display fields (`featured`, `minRating`, `limit`, `sort`), so a caller with no configured `locationId` can use it; existing calls are unchanged.
+  - `@getvitops/core`: new `.navlist` pattern in `patterns/sitenav.css` (`.navlist`, `__item`, `__link`, `__label`, `__sub`, `--inline`, `--columns`). **All formats** (css, bricks, tailwind). No existing class changes.
+  - `@getvitops/generator`: `TIERS.review` lists `vitops.reviews` and `TIERS.sitenav` lists `vitops.nav` (and `.navlist`), so `vitops docs components` and the docsite show them.
+
+- 06d6112: Fix the EmDash `/design-system` admin page erroring on a tailwind site. It fetches `/vitops/design-manifest.json`, which the `tailwind` format never emitted and the integration only mirrored under `editor: true` (which also loads `editor.js` on every public page).
+
+  - **generator** (`tailwind` format only): `design-manifest.json` is now emitted alongside `tailwind.css`. No change to the CSS.
+  - **astro**: new `vitops({ editorManifest: true })` writes everything an outside host needs into `public/vitops/` (`design-manifest.json`, `editor.js`, a standalone `editor.css`, and `design-system-editor.html`) without loading the editor on public pages. `editor: true` still loads it from `<Head />`.
+  - **vite**: `editorManifestDir` also writes `vitops/editor.css`, from a throwaway `css`-format pass on tailwind sites.
+  - **emdash**: the `/design-system` admin page was unstyled and overflowed the admin, because the editor borrows the framework CSS and the admin never loads it. It now embeds `/vitops/design-system-editor.html` in an iframe, so the design system can't leak into the admin's styles. **Requires `editorManifest: true`** in `vitops({ … })`.
+  - **create**: the EmDash template sets `editorManifest: true`. Existing sites: add it to `vitops({ … })` in `astro.config.mjs`.
+
+  No consumer-facing change in the other toolchain packages.
+
+- 224a731: **`@getvitops/astro` (no CSS change; all formats unaffected)**
+
+  - **`site.fonts` is no longer silently ignored.** `vitops()` now turns webfonts on by default when the site config (`site` option, or a `css.input` that is a site config) declares `site.fonts`, and logs that it did. Before, no `@font-face`, preload or warning was emitted unless you also passed `fonts: true`. Pass `fonts: false` to opt out. Migration: none — sites that already set `fonts` behave the same; sites that declared `site.fonts` without it will start loading those families.
+  - **The icon sprite is served when the site config asks for it.** `site.icons.sprite: true` made the generator write `icons.svg`, but only the `icons` integration option copied it to `public/vitops/`, so `/vitops/icons.svg` was never served. It is now mirrored whenever the site config sets it.
+  - **Strict CSP is achievable.** New build-time exports `inlineScriptHashes()`, `cspScriptHash()` and `contentSecurityPolicy()` give the SHA-256 hashes of the two inline scripts `<Head />` emits (colour-scheme bootstrap, consent-gate stub) and a starting policy built on them, with no `'unsafe-inline'` in `script-src`. The scripts moved from `Head.astro`'s frontmatter to `src/inline-scripts.ts` (shipped in the package) so the hash and the emitted bytes are the same constant; the rendered output is byte-identical.
+
+  **`@getvitops/create` (templates; existing scaffolded sites are not changed)**
+
+  - **emdash: every public page is prerendered.** `index.astro`, `[...slug].astro` (via `getStaticPaths` over the published `pages`) and `404.astro` set `prerender = true`. Unknown URLs now return the prerendered 404 with a real 404 status — the old `Astro.rewrite('/404')` from an on-demand route to a prerendered one was refused by Astro, so every unknown URL was a 500. `scripts/pull-content.mjs` (first step of `deploy`/`deploy:dev`) loads production's D1 into the local build database, because the Cloudflare adapter prerenders against a local D1 that is empty on CI; it fails closed. The deploy-prod workflow also runs on a `repository_dispatch` of type `emdash-publish`. Migration for an existing site: copy those pages, the script and the two `package.json` scripts, and add the trigger; previews of unpublished drafts no longer work on the public routes (see AGENTS.md).
+  - **emdash: seed menus are `primary` (Contact), `footer-sitemap` (Home, Contact) and `footer-legal` (Privacy Policy, Terms & Conditions, Cookie Notice)**, replacing `primary` (Home, About) and `footer` (Terms, Privacy), with placeholder `contact` and `cookies` pages so every seeded link resolves. The template Layout still reads the old menu names until it is updated; the seed only applies to an empty database, so existing sites keep their menus.
+  - **Both templates: `badge` and `tag` patterns (group `label`) are enabled, `button` carries `class: "btn"` so `<a class="btn">` is styled, and `neutral`/`surface` are declared as surface roles** (they were chromatic, which emitted no `.bg-neutral`/`text-neutral-muted`). css/bricks/tailwind output of a scaffolded site changes accordingly.
+  - **Both templates ship `public/_headers` with a `Content-Security-Policy-Report-Only` default** naming `<Head />`'s inline scripts by hash. It blocks nothing. `_headers` applies to static assets only, not Worker-rendered responses; see AGENTS.md for the EmDash admin and HTML-block trade-off.
+  - **Guidance is Vite+-first**: `AGENTS.md`, README, the `setup` skill, `SETUP.html` and the session hook use `vp`/`vpr`/`vp exec` instead of `pnpm`/`npx`, with one command table; `vpr dev` is documented as returning immediately. There is no `vp change`/`vp pm change` (checked against vp 1.5.0); the release flow is `dev` → promote.
+  - emdash ships `.agents/skills/custom-blocks/SKILL.md` (compose, extend, site-local, upstream; naming and lifecycle rules) and the favicon `themeColor`/`name` now derive from `site.json`.
+  - Label vocabulary: `badge` is a static label, `tag` is static or dynamic; `chip`/`pill` are not used.
+
+  **`@getvitops/cli`**: the bundled `vitops-design-system` skill points at `vp exec vitops docs <topic>`.
+
+  No consumer-facing change in `@getvitops/core`, `@getvitops/generator`, `@getvitops/utils` or `@getvitops/vite`.
+
+- 55061e2: **Added: `<SiteNav>` and `<SiteFooter>` for Astro/EmDash sites.** Both are tier-1 markup over the existing `sitenav` pattern (no runtime JS: `<details>` accordions + Popover API drawer). Non-breaking.
+
+  - `<SiteNav {...await loadNavMenus(getMenu)} />` renders EmDash menu `primary` (the default: depth 3, dropdowns from the `md` container width, drawer below). If a `primary-mobile` menu exists it replaces the nav below `md` (depth 1); if `primary-mega` exists it replaces it from `xl` (mega panels). Adding the menu in the admin is the whole change. Only one tier is in the accessibility tree at a time. An item's `titleAttr` is its description (EmDash has no description field yet).
+  - `<SiteFooter sitemap legal name>` renders `footer-sitemap` + `footer-legal` + a copyright line.
+  - `@getvitops/astro/components/sitenav.ts` exports the pure helpers (`loadNavMenus`, `selectTiers`, ...).
+  - CSS (`patterns/sitenav.css`, **all formats**): tier visibility classes (`.sitenav-tier--below-*`/`--from-*`), `.sitenav--mega`, `.sitenav__desc`, `.sitefooter*`, `aria-current` styling, reduced-motion and forced-colors handling. Existing `.sitenav` rules are unchanged, so the Bricks element is unaffected.
+  - `@getvitops/create` (emdash template): the layout now renders header and footer through these components, with the colour-scheme toggle in the header. It reads menus `primary`, `footer-sitemap` and `footer-legal`; a template whose seed still has the old `footer` menu renders no footer links until the seed is updated.
+  - `@getvitops/generator`: `TIERS.sitenav` now lists the two Astro components.
+
+### Patch Changes
+
+- efd4e72: Fix `astro dev` answering every route with `module is not defined` on the Cloudflare adapter. `<Icon>` imports `@getvitops/generator/icons-sprite`, which imports `@iconify/utils`; workerd's dev runner cannot load that un-prebundled, and Vite only pre-bundles what a site's own sources import, so a site that reached `<Icon>` only through a package's `.astro` file (for example the `vitops.reviews` EmDash block, which renders `<ReviewCard>`) crashed in dev while building fine. `vitops()` now adds the module to `ssr.optimizeDeps.include`. No change to builds or to output.
+
+  No consumer-facing change in the other toolchain packages.
+
+- Updated dependencies [93d2067]
+- Updated dependencies [161c7f3]
+- Updated dependencies [175d16e]
+- Updated dependencies [83d6f3c]
+- Updated dependencies [892b204]
+- Updated dependencies [06d6112]
+- Updated dependencies [6297337]
+- Updated dependencies [55061e2]
+- Updated dependencies [b47df4d]
+  - @getvitops/core@8.3.0-alpha.0
+  - @getvitops/generator@8.3.0-alpha.0
+  - @getvitops/utils@8.3.0-alpha.0
+  - @getvitops/vite@8.3.0-alpha.0
+  - @getvitops/config@8.3.0-alpha.0
+
 ## 8.2.0
 
 ### Minor Changes

package/dist/index.d.mts

@@ -584,6 +584,17 @@ interface GetvitopsOptions {
    * dev server, so on a static build that button simply isn't rendered.
    */
   editor?: boolean;
+  /**
+   * Ship what a host needs to embed `<wc-theme-editor>`, WITHOUT loading it from `<Head />`
+   * (default false). Writes into `public/vitops/`: `design-manifest.json`, `editor.js`, a
+   * standalone `editor.css`, and `design-system-editor.html`, a page that mounts the editor.
+   *
+   * For hosts outside the site's own pages, such as the EmDash admin
+   * (`@getvitops/emdash`'s `designSystemEditor`, which iframes that page so the design
+   * system never leaks into the admin's styles). Public pages don't pay for the bundle.
+   * Requires `css`.
+   */
+  editorManifest?: boolean;
   /**
    * Render the site's legal documents (privacy policy, terms, cookie notice)
    * from a site config, and re-render when it changes. Off unless provided.
@@ -801,6 +812,45 @@ interface ResolveAdsContext {
 }
 /** Resolve the configured ad properties into the tags `<Ads />` emits. */
 export declare function resolveAds(ads: GetvitopsAdsOptions | undefined, ctx?: ResolveAdsContext): ResolvedAds;
+/** The CSP source expression for one inline script: `'sha256-<base64>'`. */
+export declare function cspScriptHash(script: string): string;
+interface InlineScriptOptions {
+  /** `<Head />` emits the colour-scheme bootstrap (its `webComponents` prop). Default true. */
+  webComponents?: boolean;
+  /** `<Head />` emits the consent-gate stub (a site with the gate on). Default true. */
+  consent?: boolean;
+}
+/**
+ * CSP hash sources for every inline script `<Head />` can emit.
+ *
+ * Defaults to ALL of them: listing a hash for a script the page doesn't emit is
+ * harmless, while omitting one a page does emit is a violation.
+ */
+export declare function inlineScriptHashes(opts?: InlineScriptOptions): string[];
+interface ContentSecurityPolicyOptions {
+  /** Extra `script-src` sources, e.g. a hash for your own inline script or an origin. */
+  scriptSrc?: string[];
+  /** Origins for `connect-src` beyond `'self'` (analytics endpoints, a form API). */
+  connectSrc?: string[];
+  /** Origins for `img-src` beyond `'self'`, `data:` and `https:`. */
+  imgSrc?: string[];
+  /** Origins for `frame-src` (embeds). Default none. */
+  frameSrc?: string[];
+  /** A `report-uri` endpoint. Omit to rely on the browser console. */
+  reportUri?: string;
+  /** Which `<Head />` inline scripts to allow. Default all. */
+  inline?: InlineScriptOptions;
+}
+/**
+ * A strict starting policy for a prerendered site.
+ *
+ * `script-src` is `'self'` plus the `<Head />` hashes — no `'unsafe-inline'`.
+ * `style-src` keeps `'unsafe-inline'` because Astro inlines scoped `<style>` and
+ * components set `style=""` attributes; a style injection is far less dangerous
+ * than a script one, and hashing every stylesheet would break on any edit.
+ * `img-src` allows `https:` because editors paste images from anywhere.
+ */
+export declare function contentSecurityPolicy(opts?: ContentSecurityPolicyOptions): string;
 interface GitLastmodOptions {
   /** Directories to read history from (default `src/pages`, `src/content`, `src/data`). */
   dirs?: string[];
@@ -840,5 +890,5 @@ export declare function resolveSeoDefaults(config: Config, options?: ResolveSeoD
  * setting `openGraph.locale` in code doesn't discard the config's fallback image.
  */
 export declare function mergeSeoDefaults(fromConfig: GetvitopsSeoOptions, override: GetvitopsSeoOptions | undefined): GetvitopsSeoOptions;
-export { type AnalyticsStrategy, type ClarityOptions, type ConsentCategory, type GatedTag, type GetvitopsAdProperty, type GetvitopsAdsOptions, type GetvitopsAnalyticsOptions, type GetvitopsConsentOptions, type GetvitopsCssOptions, type GetvitopsFaviconOptions, type GetvitopsMediaOptions, type GetvitopsOptions, type GetvitopsSeoOptions, type GetvitopsSitemapChangeFreq, type GetvitopsSitemapEntry, type GetvitopsSitemapOptions, type GetvitopsTrackingOptions, type GitLastmodOptions, type GoogleAnalyticsOptions, type MatomoOptions, type OptionalConsentCategory, type PlausibleOptions, type ResolveAdsContext, type ResolveAnalyticsContext, type ResolveSeoDefaultsOptions, type ResolveTrackingContext, type ResolvedAdTag, type ResolvedAds, type ResolvedAnalytics, type ResolvedSeo, type ResolvedTag, type ResolvedTracking, type SeoContext, type SeoNameTag, type SeoOgType, type SeoPropertyTag, type SeoProps, type SeoTwitterCard, TRACKING_COOKIE, type TrackingCategory, resolveTracking };
+export { type AnalyticsStrategy, type ClarityOptions, type ConsentCategory, type ContentSecurityPolicyOptions, type GatedTag, type GetvitopsAdProperty, type GetvitopsAdsOptions, type GetvitopsAnalyticsOptions, type GetvitopsConsentOptions, type GetvitopsCssOptions, type GetvitopsFaviconOptions, type GetvitopsMediaOptions, type GetvitopsOptions, type GetvitopsSeoOptions, type GetvitopsSitemapChangeFreq, type GetvitopsSitemapEntry, type GetvitopsSitemapOptions, type GetvitopsTrackingOptions, type GitLastmodOptions, type GoogleAnalyticsOptions, type InlineScriptOptions, type MatomoOptions, type OptionalConsentCategory, type PlausibleOptions, type ResolveAdsContext, type ResolveAnalyticsContext, type ResolveSeoDefaultsOptions, type ResolveTrackingContext, type ResolvedAdTag, type ResolvedAds, type ResolvedAnalytics, type ResolvedSeo, type ResolvedTag, type ResolvedTracking, type SeoContext, type SeoNameTag, type SeoOgType, type SeoPropertyTag, type SeoProps, type SeoTwitterCard, TRACKING_COOKIE, type TrackingCategory, resolveTracking };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":["MediaOutputKind"],"sources":["../src/analytics.ts","../src/seo.ts","../src/integration.ts","../src/ads.ts","../src/lastmod.ts","../src/seo-defaults.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BY;;;;;;;KAQA;KAEA,0BAA0B,QAAQ;UAE7B;;EAEf;;;;;EAKA,WAAW;;EAEX,SAAS;;UAGM;;EAEf;EACA,WAAW;;UAGI;;EAEf;;EAEA;;;;;;;;;EASA;;UAGe;;EAEf;;EAEA;;UAGe;EACf,2BAA2B;EAC3B,mBAAmB;EACnB,SAAS;EACT,qBAAqB;;EAErB,WAAW;;;;;;;;;;UAWI;;;;;EAKf,aAAa;;EAEb;;;;;;;;;;;;;;;;;UAkBe;;EAEf;EACA,UAAU;EACV;;EAEA;EACA,UAAU;;;;;;EAMV;;EAEA;EACA;EACA,OAAO;;;UAIQ,oBAAoB;EACnC;;UAGe;EACf,MAAM;;EAEN;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA,cAAc;IAAiB;;;EAE/B,4BAA4B;;;;;;;;;wBAiNd,iBACd,MAAM,uCACN,MAAK,0BACJ;;wBA2Ca,kBAAkB,MAAM,aAAa;;;;;;;;;;;;;KC1ZzC;;KAGA;;;;;;;;;;;;UAaK;;EAEf;;;;;;;;;;;;EAYA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;EACA;;IAEE,OAAO;;IAEP;;IAEA;;IAEA;MAAU;MAAa;MAAc;MAAgB;MAAiB;;;EAExE;;IAEE,OAAO;;IAEP;;IAEA;;;;UAKa;;EAEf;;;;;;EAMA;EACA;;EAEA;;EAEA;;EAEA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA;;EAEA;;EAEA;;EAEA,OAAO;;EAEP;IACE;IACA;IACA;IACA;IACA;IACA;;;EAGF;;EAEA;;;;;;;;;;EAUA;IAAe;IAAkB;;;;UAIlB;EACf;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;;EAEA;EACA;EACA;EACA;EACA,WAAW;EACX,SAAS;EACT,cAAc;EACd;IAAc;IAAkB;;;;UAIjB;;;;;;;;;EASf,OAAO;;EAEP;;EAEA;;;;;;;;;wBA8Cc,WACd,UAAU,qBACV,OAAO,UACP,KAAK,aACJ;UCjLc;;EAEf;EACA;;EAEA;;EAEA;EACA;;;;;;;;UASe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAUA;;EAEV;;UAGe;;;;;;;;;;EAUf;;;;;EAKA;;;;;;;EAOA,SAAS;;EAET;;;;;;;;EAQA;;;;;;;;;;;;;;;;EAgBA;;UAGe;;EAEf;;EAEA;;UAGe;;;;;;EAMf;;;;;;;EAOA;;EAEA,SAAS;;EAET;;;KAIU;;UAUK;EACf;EACA;EACA,aAAa;EACb;;EAEA;IAAU;IAAc;IAAmB;;;;;;;;;;;;;;;UAe5B;;EAEf,UAAU;;EAEV;;EAEA;;EAEA;;EAEA;EACA,aAAa;EACb,UAAU;EACV;;EAEA,aACE,MAAM,0BACH,wBAAwB,QAAQ;;EAErC;IAAS;IAAuB,SAAS;;;EAEzC;;EAEA;IAAe;IAAgB;IAAiB;IAAiB;;;UAGlD;;;;;;;;;;;;;EAaf,OAAO;EACP,UAAU;;;;;;;;;;;;;;;;;;;;;;;;EAwBV,QAAQ;;EAER;;EAEA,MAAM;;;;;;;;;;;;EAYN;;;;;;;;;;EAUA,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+BR,2BAA2B,aAAa;;;;;;;;;;;;;EAaxC,oBAAoB;;;;;;;;;;;;;;;;EAgBpB,MAAM;;;;;;;;;;;;;;;;;;;;;;EAsBN,kBAAkB;;;;;;;;;;;;EAYlB,YAAY;;;;;;;;;;;;;EAaZ,oBAAoB;;;;;;;;;;;;;;;EAepB,qBAAqB;;UAGN;;EAEf;;EAEA,WAAW;;EAEX;;UAGe;;EAEf;;EAEA;;;;;EAKA;;;;;;;;;EASA,UAAU,kBAAkB;;;;;;;;;;;;EAY5B;;;;;;EAMA;;EAEA;;EAEA;;EAEA,YAAY;;wBA8bU,OAAO,OAAM,mBAAwB;;;;;;;KC71BjD,sBAAsB,KAChC;KAUU,sBAAsB,QAAQ,OAAO,YAAY;;UAG5C,sBAAsB;EACrC,KAAK;;UAGU;EACf,MAAM;;EAEN;;EAEA;;UAGe;;EAEf;;EAEA;;EAEA;;EAEA,WAAW;;;wBAYG,WACd,KAAK,iCACL,MAAK,oBACJ;UCrDc;;EAEf;;EAEA;;EAEA,UAAU;;;;;;;;;wBAUI,cAAc;;wBAad,gBAAgB;;;;;;;;;wBAoDV,WACpB,UAAS,oBACR,SAAS,MAAM,0BAA0B;UC1G3B;;EAEf;;EAEA;;wBAUc,mBACd,QAAQ,QACR,UAAS,4BACR;;;;;wBAmDa,iBACd,YAAY,qBACZ,UAAU,kCACT"}
+{"version":3,"file":"index.d.mts","names":["MediaOutputKind"],"sources":["../src/analytics.ts","../src/seo.ts","../src/integration.ts","../src/ads.ts","../src/csp.ts","../src/lastmod.ts","../src/seo-defaults.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BY;;;;;;;KAQA;KAEA,0BAA0B,QAAQ;UAE7B;;EAEf;;;;;EAKA,WAAW;;EAEX,SAAS;;UAGM;;EAEf;EACA,WAAW;;UAGI;;EAEf;;EAEA;;;;;;;;;EASA;;UAGe;;EAEf;;EAEA;;UAGe;EACf,2BAA2B;EAC3B,mBAAmB;EACnB,SAAS;EACT,qBAAqB;;EAErB,WAAW;;;;;;;;;;UAWI;;;;;EAKf,aAAa;;EAEb;;;;;;;;;;;;;;;;;UAkBe;;EAEf;EACA,UAAU;EACV;;EAEA;EACA,UAAU;;;;;;EAMV;;EAEA;EACA;EACA,OAAO;;;UAIQ,oBAAoB;EACnC;;UAGe;EACf,MAAM;;EAEN;;EAEA;;UAGe;;EAEf;;;;;;;;;EASA,cAAc;IAAiB;;;EAE/B,4BAA4B;;;;;;;;;wBAiNd,iBACd,MAAM,uCACN,MAAK,0BACJ;;wBA2Ca,kBAAkB,MAAM,aAAa;;;;;;;;;;;;;KC1ZzC;;KAGA;;;;;;;;;;;;UAaK;;EAEf;;;;;;;;;;;;EAYA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;EACA;;IAEE,OAAO;;IAEP;;IAEA;;IAEA;MAAU;MAAa;MAAc;MAAgB;MAAiB;;;EAExE;;IAEE,OAAO;;IAEP;;IAEA;;;;UAKa;;EAEf;;;;;;EAMA;EACA;;EAEA;;EAEA;;EAEA;EACA;EACA;EACA;;EAEA;EACA;EACA;EACA;EACA;;EAEA;;EAEA;;EAEA,OAAO;;EAEP;IACE;IACA;IACA;IACA;IACA;IACA;;;EAGF;;EAEA;;;;;;;;;;EAUA;IAAe;IAAkB;;;;UAIlB;EACf;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;;EAEA;EACA;EACA;EACA;EACA,WAAW;EACX,SAAS;EACT,cAAc;EACd;IAAc;IAAkB;;;;UAIjB;;;;;;;;;EASf,OAAO;;EAEP;;EAEA;;;;;;;;;wBA8Cc,WACd,UAAU,qBACV,OAAO,UACP,KAAK,aACJ;UChLc;;EAEf;EACA;;EAEA;;EAEA;EACA;;;;;;;;UASe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,UAAUA;;EAEV;;UAGe;;;;;;;;;;EAUf;;;;;EAKA;;;;;;;EAOA,SAAS;;EAET;;;;;;;;EAQA;;;;;;;;;;;;;;;;EAgBA;;UAGe;;EAEf;;EAEA;;UAGe;;;;;;EAMf;;;;;;;EAOA;;EAEA,SAAS;;EAET;;;KAIU;;UAUK;EACf;EACA;EACA,aAAa;EACb;;EAEA;IAAU;IAAc;IAAmB;;;;;;;;;;;;;;;UAe5B;;EAEf,UAAU;;EAEV;;EAEA;;EAEA;;EAEA;EACA,aAAa;EACb,UAAU;EACV;;EAEA,aACE,MAAM,0BACH,wBAAwB,QAAQ;;EAErC;IAAS;IAAuB,SAAS;;;EAEzC;;EAEA;IAAe;IAAgB;IAAiB;IAAiB;;;UAGlD;;;;;;;;;;;;;EAaf,OAAO;EACP,UAAU;;;;;;;;;;;;;;;;;;;;;;;;EAwBV,QAAQ;;EAER;;EAEA,MAAM;;;;;;;;;;;;EAYN;;;;;;;;;;;EAWA;;;;;;;;;;EAUA,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+BR,2BAA2B,aAAa;;;;;;;;;;;;;EAaxC,oBAAoB;;;;;;;;;;;;;;;;EAgBpB,MAAM;;;;;;;;;;;;;;;;;;;;;;EAsBN,kBAAkB;;;;;;;;;;;;EAYlB,YAAY;;;;;;;;;;;;;EAaZ,oBAAoB;;;;;;;;;;;;;;;EAepB,qBAAqB;;UAGN;;EAEf;;EAEA,WAAW;;EAEX;;UAGe;;EAEf;;EAEA;;;;;EAKA;;;;;;;;;EASA,UAAU,kBAAkB;;;;;;;;;;;;EAY5B;;;;;;EAMA;;EAEA;;EAEA;;EAEA,YAAY;;wBA+hBU,OAAO,OAAM,mBAAwB;;;;;;;KC18BjD,sBAAsB,KAChC;KAUU,sBAAsB,QAAQ,OAAO,YAAY;;UAG5C,sBAAsB;EACrC,KAAK;;UAGU;EACf,MAAM;;EAEN;;EAEA;;UAGe;;EAEf;;EAEA;;EAEA;;EAEA,WAAW;;;wBAYG,WACd,KAAK,iCACL,MAAK,oBACJ;;wBCjEa,cAAc;UAIb;;EAEf;;EAEA;;;;;;;;wBASc,mBAAmB,OAAM;UAOxB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,SAAS;;;;;;;;;;;wBAYK,sBAAsB,OAAM;UCpC3B;;EAEf;;EAEA;;EAEA,UAAU;;;;;;;;;wBAUI,cAAc;;wBAad,gBAAgB;;;;;;;;;wBAoDV,WACpB,UAAS,oBACR,SAAS,MAAM,0BAA0B;UC1G3B;;EAEf;;EAEA;;wBAUc,mBACd,QAAQ,QACR,UAAS,4BACR;;;;;wBAmDa,iBACd,YAAY,qBACZ,UAAU,kCACT"}

package/dist/index.mjs

@@ -6,9 +6,11 @@ import { fileURLToPath } from "node:url";
 import { isConfig, renderRobotsTxt, resolveConfig } from "@getvitops/generator";
 import { collectIconRefs, faviconLinks, generateFavicons, generateIconInclude, resolveIcon, scanFiles, writeFaviconManifest } from "@getvitops/utils";
 import vitopsPlugin from "@getvitops/vite";
+import { REVIEWS_CACHE_PATH, readCache } from "@getvitops/utils/reviews";
 import { AD_PLATFORMS, AD_PROVIDER_KEYS, normalizeConversionLabels } from "@getvitops/utils/ads";
 import { fontProviders } from "astro/config";
 import { t } from "@getvitops/utils/content";
+import { createHash } from "node:crypto";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
@@ -545,6 +547,14 @@ function readSiteAds(configPath, siteEnv) {
 		return null;
 	}
 }
+/** Read `site.security.turnstile.siteKey`. Best-effort, like `readSiteAds`. */
+function readSiteTurnstileKey(configPath, siteEnv) {
+	try {
+		return resolveConfig(JSON.parse(readFileSync(configPath, "utf8")), siteEnv).site.security?.turnstile?.siteKey || null;
+	} catch {
+		return null;
+	}
+}
 /**
 * Read `site.experiments` + `site.analytics.matomo.abVariantDimensions` out of
 * the site config, resolving each experiment's cookie name (default
@@ -687,6 +697,40 @@ function virtualIconsPlugin(data) {
 		}
 	};
 }
+const REVIEWS_ID = "virtual:getvitops/reviews";
+const RESOLVED_REVIEWS_ID = `\0${REVIEWS_ID}`;
+/**
+* The committed `.vitops/reviews.json` cache as a build-time import, for server-rendered
+* components that cannot read the filesystem (the EmDash `vitops.reviews` block runs in a
+* Worker — and, with pages prerendered, inside the Cloudflare adapter's local workerd).
+*
+* **An absent or unusable file serves an EMPTY cache, never an error.** A fresh scaffold has
+* no `.vitops/reviews.json` (nothing has run `vitops reviews` yet) and a build must not fail
+* for it; the block renders an editor placeholder instead. `readCache` already treats a
+* corrupt or wrong-version file as absent, which is the same rule — the failure is silent
+* here only because the consumer of this module reports it.
+*
+* Read in `load`, not at plugin construction, and the file is registered as a watch file, so
+* a dev server picks up a re-run of `vitops reviews` without a restart.
+*/
+function virtualReviewsPlugin(root) {
+	const path = resolve(root, REVIEWS_CACHE_PATH);
+	return {
+		name: "@getvitops/astro:virtual-reviews",
+		resolveId(id) {
+			return id === REVIEWS_ID ? RESOLVED_REVIEWS_ID : null;
+		},
+		load(id) {
+			if (id !== RESOLVED_REVIEWS_ID) return null;
+			this?.addWatchFile?.(path);
+			const cache = readCache(path) ?? {
+				version: 1,
+				locations: {}
+			};
+			return `export default ${JSON.stringify(cache)};`;
+		}
+	};
+}
 /** Defaults live here so the component and the integration can't drift. */
 const ICON_DEFAULTS = {
 	ui: "fa7-solid",
@@ -731,6 +775,46 @@ function readsAsConfig(path) {
 		return false;
 	}
 }
+/** Whether the site config sets `site.icons.sprite` — the fact that makes the generator emit icons.svg. */
+function siteWantsSprite(root, siteInput, siteEnv) {
+	if (!siteInput) return false;
+	try {
+		const cfg = resolveConfig(JSON.parse(readFileSync(resolve(root, siteInput), "utf8")), siteEnv ?? "production");
+		return Boolean(cfg.site.icons?.sprite);
+	} catch {
+		return false;
+	}
+}
+/**
+* A standalone page hosting `<wc-theme-editor>`, for a host that cannot load the
+* framework CSS itself (the EmDash admin embeds this in an iframe, so the design
+* system never touches the admin's own styles). `?save=<url>` supplies the save
+* endpoint, which is the host's to name, not this integration's.
+*/
+function writeEditorHost(dest) {
+	mkdirSync(dest, { recursive: true });
+	writeFileSync(join(dest, "design-system-editor.html"), `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Design system editor</title>
+<link rel="stylesheet" href="/vitops/editor.css">
+</head>
+<body>
+<script type="module">
+  await import('/vitops/editor.js');
+  const el = document.createElement('wc-theme-editor');
+  el.setAttribute('manifest', '/vitops/design-manifest.json');
+  const save = new URLSearchParams(location.search).get('save');
+  if (save && save.startsWith('/')) el.setAttribute('save-endpoint', save);
+  document.body.append(el);
+<\/script>
+</body>
+</html>
+`);
+}
 function vitops(opts = {}) {
 	return {
 		name: "@getvitops/astro",
@@ -739,7 +823,7 @@ function vitops(opts = {}) {
 			const publicDir = fileURLToPath(config.publicDir);
 			const webComponents = opts.webComponents !== false;
 			const editor = opts.editor === true;
-			if (editor && !opts.css) logger.warn("editor: true needs a `css` config — it reads design-manifest.json.");
+			if ((editor || opts.editorManifest) && !opts.css) logger.warn("editor/editorManifest needs a `css` config — it reads design-manifest.json.");
 			if (opts.legal && !opts.css) logger.warn("legal: needs a `css` config — the generation runs in the Vite plugin that `css` registers. Run `npx vitops legal` instead if you do not use `css`.");
 			if (opts.media && !opts.css) logger.warn("media: needs a `css` config — the encoding runs in the Vite plugin that `css` registers. Run `npx vitops media` instead if you do not use `css`.");
 			const cssInput = opts.css ? opts.css.input ?? "design-system.json" : void 0;
@@ -766,6 +850,7 @@ function vitops(opts = {}) {
 			const analytics = resolveAnalytics(opts.analytics, { consent: consentEnabled });
 			const trackingOpts = opts.tracking === true ? { enabled: true } : opts.tracking || (siteConsent?.tracking?.enabled ? siteConsent.tracking : void 0);
 			const adsConfig = siteInput ? readSiteAds(resolve(root, siteInput), opts.site?.siteEnv ?? "production") : null;
+			const turnstileSiteKey = siteInput ? readSiteTurnstileKey(resolve(root, siteInput), opts.site?.siteEnv ?? "production") : null;
 			const experimentsConfig = siteInput ? readSiteExperiments(resolve(root, siteInput), opts.site?.siteEnv ?? "production") : null;
 			const detectedCategories = consentCategories([...analytics.tags, ...resolveAds(adsConfig?.properties, {
 				consent: consentEnabled,
@@ -812,8 +897,15 @@ function vitops(opts = {}) {
 				logger.info("generated favicons + manifest → public/");
 			}
 			let headFonts = [];
-			if (opts.fonts) {
-				const given = Array.isArray(opts.fonts) ? { families: opts.fonts } : typeof opts.fonts === "string" ? { input: opts.fonts } : opts.fonts === true ? {} : opts.fonts;
+			let fontsOpt = opts.fonts;
+			if (fontsOpt === void 0 && siteInput) try {
+				if ((resolveConfig(JSON.parse(readFileSync(resolve(root, siteInput), "utf8")), opts.site?.siteEnv ?? "production").site.fonts ?? []).length > 0) {
+					fontsOpt = true;
+					logger.info(`fonts: ${siteInput} declares site.fonts, so webfonts are on (pass fonts: false to opt out)`);
+				}
+			} catch {}
+			if (fontsOpt) {
+				const given = Array.isArray(fontsOpt) ? { families: fontsOpt } : typeof fontsOpt === "string" ? { input: fontsOpt } : fontsOpt === true ? {} : fontsOpt;
 				const o = {
 					...given,
 					...given.input == null && given.families == null && siteInput ? {
@@ -851,11 +943,12 @@ function vitops(opts = {}) {
 						"polyfills"
 					] : [];
 					if (consentRuntime) bundles.push("consent.js");
-					if (editor) bundles.push("editor.js");
+					if (editor || opts.editorManifest) bundles.push("editor.js");
 					for (const f of bundles) {
 						const src = join(coreDist, f);
 						if (existsSync(src)) cpSync(src, join(dest, f), { recursive: true });
 					}
+					if (opts.editorManifest) writeEditorHost(dest);
 					logger.info("copied web-component bundles → public/vitops/");
 				} else logger.warn(`@getvitops/core dist not found (${coreDist}); run build:core. Skipping WC copy.`);
 			}
@@ -968,43 +1061,51 @@ function vitops(opts = {}) {
 					sprite: engine === "sprite" || o.sprite ? spriteHref : null
 				};
 			}
-			updateConfig({ vite: { plugins: [virtualIconsPlugin(iconsData ?? {
-				engine: "none",
-				root,
-				ui: ICON_DEFAULTS.ui,
-				brand: ICON_DEFAULTS.brand,
-				weight: null,
-				overrides: {},
-				sprite: null
-			}), virtualHeadPlugin({
-				favicons: !!opts.favicon,
-				faviconLinks: opts.favicon ? faviconLinks({
-					hasSvg,
-					manifest: hasManifest
-				}) : [],
-				themeColor: opts.favicon?.themeColor ?? null,
-				webComponents,
-				wcBase: "/vitops",
-				editor,
-				sitemap: sitemapHref,
-				fonts: headFonts,
-				site: config.site ?? null,
-				seo: seoDefaults,
-				analytics: opts.analytics ?? {},
-				consent: consentEnabled,
-				consentCategories: offeredCategories,
-				consentPolicyUrl: consentOpts.policyUrl ?? null,
-				consentRuntime,
-				tracking: tracking.enabled ? {
-					enabled: true,
-					category: tracking.category,
-					cookies: tracking.cookies,
-					abVariantCookie: experimentsConfig?.primaryCookie ?? null
-				} : null,
-				experiments: experimentsConfig?.experiments ?? {},
-				matomoAbVariantDimensions: experimentsConfig?.matomoAbVariantDimensions ?? {},
-				ads: adsConfig
-			})] } });
+			updateConfig({ vite: {
+				ssr: { optimizeDeps: { include: ["@getvitops/astro > @getvitops/generator/icons-sprite"] } },
+				plugins: [
+					virtualReviewsPlugin(root),
+					virtualIconsPlugin(iconsData ?? {
+						engine: "none",
+						root,
+						ui: ICON_DEFAULTS.ui,
+						brand: ICON_DEFAULTS.brand,
+						weight: null,
+						overrides: {},
+						sprite: null
+					}),
+					virtualHeadPlugin({
+						favicons: !!opts.favicon,
+						faviconLinks: opts.favicon ? faviconLinks({
+							hasSvg,
+							manifest: hasManifest
+						}) : [],
+						themeColor: opts.favicon?.themeColor ?? null,
+						webComponents,
+						wcBase: "/vitops",
+						editor,
+						sitemap: sitemapHref,
+						fonts: headFonts,
+						site: config.site ?? null,
+						seo: seoDefaults,
+						analytics: opts.analytics ?? {},
+						consent: consentEnabled,
+						consentCategories: offeredCategories,
+						consentPolicyUrl: consentOpts.policyUrl ?? null,
+						consentRuntime,
+						tracking: tracking.enabled ? {
+							enabled: true,
+							category: tracking.category,
+							cookies: tracking.cookies,
+							abVariantCookie: experimentsConfig?.primaryCookie ?? null
+						} : null,
+						experiments: experimentsConfig?.experiments ?? {},
+						matomoAbVariantDimensions: experimentsConfig?.matomoAbVariantDimensions ?? {},
+						ads: adsConfig,
+						turnstileSiteKey
+					})
+				]
+			} });
 			if (opts.css) {
 				const format = opts.css.format ?? "tailwind";
 				if (format === "design") throw new Error("[vitops] css.format: 'design' emits only DESIGN.md, not a stylesheet. Run `npx vitops generate --format design --out .` for that file, and set css.format to 'tailwind' | 'css' | 'bricks' here.");
@@ -1014,8 +1115,8 @@ function vitops(opts = {}) {
 					...opts.css.theme != null ? { theme: opts.css.theme } : {},
 					format,
 					out,
-					...editor ? { editorManifestDir: publicDir } : {},
-					...iconsData?.sprite ? { spriteDir: publicDir } : {},
+					...editor || opts.editorManifest ? { editorManifestDir: publicDir } : {},
+					...iconsData?.sprite || siteWantsSprite(root, siteInput, opts.site?.siteEnv) ? { spriteDir: publicDir } : {},
 					...opts.legal ? { legal: {
 						...opts.legal,
 						input: legalInput
@@ -1048,6 +1149,124 @@ function vitops(opts = {}) {
 	};
 }
 
+// src/inline-scripts.ts
+/**
+* The inline scripts `<Head />` emits, as plain strings.
+*
+* They live here rather than in `Head.astro`'s frontmatter for one reason: a
+* Content-Security-Policy that doesn't allow `'unsafe-inline'` has to name each
+* inline script by SHA-256, and the hash is of the exact emitted bytes. One
+* constant imported by both the component (which emits it) and `csp.ts` (which
+* hashes it) makes "the hash matches what the page serves" true by construction
+* rather than by a test remembering to compare two copies. `csp.test.ts` and the
+* container render test still assert it against real rendered HTML.
+*
+* No imports and no Node builtins: `Head.astro` runs in a Worker for any page
+* that is rendered on demand.
+*/
+/**
+* Applies the remembered colour scheme before first paint.
+*
+* The key MUST match `WCColorSchemeToggle.STORAGE_KEY` in @getvitops/core;
+* `head.test.ts` asserts they stay in step. try/catch because localStorage
+* throws in private/partitioned contexts.
+*/
+const THEME_SCRIPT = "try{var s=localStorage.getItem('vitops-color-scheme');if(s==='light'||s==='dark'){document.documentElement.dataset.theme=s;document.documentElement.style.colorScheme=s+' only'}}catch(e){}";
+/**
+* The consent gate's build-time signal: "something on this page may need
+* permission, and the real gate hasn't loaded yet."
+*
+* `consent.js` and `elements.js` are both deferred modules with no ordering
+* guarantee between them, so `<wc-color-scheme-toggle>` can upgrade and be clicked
+* before the gate exists. Without this, a caller probing for
+* `window.vitopsConsent` in that window would see nothing, correctly conclude
+* that sites without the gate should just store — and store. The stub closes the
+* window by making the gate's *existence* known synchronously in `<head>`, which
+* is the only place that beats every deferred bundle.
+*
+* It answers `false` to everything, because nothing is granted until the store
+* has been read, and queues what it was asked so `consent/runtime.ts` can replay
+* it on evaluation. `q` entries are `[category]` for `require()` and
+* `[category, resolve]` for `request()`. Same shape as the `dataLayer`/`gtag`
+* stub in `analytics.ts` and for the same reason.
+*
+* Emitted only when the gate is on: its absence is what tells a caller the site
+* has no gate at all.
+*/
+const CONSENT_STUB = "window.vitopsConsent=window.vitopsConsent||{q:[],require:function(c){this.q.push([c]);return false},request:function(c){var s=this;return new Promise(function(r){s.q.push([c,r])})},granted:function(){return false},needed:function(){return false}};";
+
+// src/csp.ts
+/**
+* Content-Security-Policy helpers for the inline scripts `<Head />` emits.
+*
+* `<Head />` writes up to two inline `<script>`s into every page: the pre-paint
+* colour-scheme bootstrap and the consent-gate stub. A policy without
+* `'unsafe-inline'` blocks both unless each is named by hash, and both are
+* constants (`inline-scripts.ts`), so their hashes are fixed per package version
+* and can sit in a static `_headers` file — which is exactly what the scaffolded
+* templates do, in `Content-Security-Policy-Report-Only` mode.
+*
+* Why hashes and not nonces: a nonce is per response, so it needs the page to be
+* rendered by a Worker on every request. The templates' pages are prerendered
+* static assets, which have no request to attach a nonce to. Hashes also survive
+* being cached.
+*
+* What this does NOT cover, and the policy says so rather than hiding it: scripts
+* the page gets from elsewhere (EmDash's own head tags, a server-island loader,
+* an editor's HTML block, the consent gate activating a third-party tag). Those
+* are what Report-Only is for — see the template's AGENTS.md.
+*
+* Node-only (`node:crypto`), so it is exported from the package root — a build
+* time import — and never from a Worker entry.
+*/
+/** The CSP source expression for one inline script: `'sha256-<base64>'`. */
+function cspScriptHash(script) {
+	return `'sha256-${createHash("sha256").update(script, "utf8").digest("base64")}'`;
+}
+/**
+* CSP hash sources for every inline script `<Head />` can emit.
+*
+* Defaults to ALL of them: listing a hash for a script the page doesn't emit is
+* harmless, while omitting one a page does emit is a violation.
+*/
+function inlineScriptHashes(opts = {}) {
+	const out = [];
+	if (opts.webComponents !== false) out.push(cspScriptHash(THEME_SCRIPT));
+	if (opts.consent !== false) out.push(cspScriptHash(CONSENT_STUB));
+	return out;
+}
+/**
+* A strict starting policy for a prerendered site.
+*
+* `script-src` is `'self'` plus the `<Head />` hashes — no `'unsafe-inline'`.
+* `style-src` keeps `'unsafe-inline'` because Astro inlines scoped `<style>` and
+* components set `style=""` attributes; a style injection is far less dangerous
+* than a script one, and hashing every stylesheet would break on any edit.
+* `img-src` allows `https:` because editors paste images from anywhere.
+*/
+function contentSecurityPolicy(opts = {}) {
+	const list = (name, ...sources) => `${name} ${sources.flatMap((s) => s ?? []).join(" ")}`.trim();
+	const directives = [
+		"default-src 'self'",
+		list("script-src", ["'self'"], inlineScriptHashes(opts.inline), opts.scriptSrc),
+		"style-src 'self' 'unsafe-inline'",
+		list("img-src", [
+			"'self'",
+			"data:",
+			"https:"
+		], opts.imgSrc),
+		"font-src 'self'",
+		list("connect-src", ["'self'"], opts.connectSrc),
+		list("frame-src", opts.frameSrc?.length ? opts.frameSrc : ["'none'"]),
+		"object-src 'none'",
+		"base-uri 'self'",
+		"form-action 'self'",
+		"frame-ancestors 'self'"
+	];
+	if (opts.reportUri) directives.push(`report-uri ${opts.reportUri}`);
+	return directives.join("; ");
+}
+
 // src/lastmod.ts
 /**
 * Real per-page `<lastmod>` for the sitemap, derived from git.
@@ -1328,5 +1547,5 @@ function resolveSeo(defaults, props, ctx) {
 	};
 }
 
-export { TRACKING_COOKIE, consentCategories, vitops as default, gitLastmod, mergeSeoDefaults, resolveAds, resolveAnalytics, resolveSeo, resolveSeoDefaults, resolveTracking, routeFromPage, slugFromContent };
+export { TRACKING_COOKIE, consentCategories, contentSecurityPolicy, cspScriptHash, vitops as default, gitLastmod, inlineScriptHashes, mergeSeoDefaults, resolveAds, resolveAnalytics, resolveSeo, resolveSeoDefaults, resolveTracking, routeFromPage, slugFromContent };
 //# sourceMappingURL=index.mjs.map