@koehler8/cms 1.0.0-beta.16 → 1.0.0-beta.18

package/src/components/Hero.vue

@@ -7,7 +7,7 @@
 >
     <div class="container text-center hero-content hero-inner">
       <div class="hero-eyebrow fade-up-in js-scroll-fade" style="--fade-up-delay: 0s">
-        <h2
+        <p
           :class="[
             'h4',
             'text-uppercase',
@@ -16,9 +16,9 @@
           ]"
         >
           {{ tagLine }}
-        </h2>
+        </p>
       </div>
-      <h3
+      <h1
         :class="[
           'display-heading',
           'text-uppercase',
@@ -38,7 +38,7 @@
         >
           {{ part }}
         </span>
-      </h3>
+      </h1>
       <div
         class="hero-cta-stack fade-up-in js-scroll-fade"
         style="--fade-up-delay: 0.2s"
@@ -256,8 +256,9 @@ function getHeaderOffset() {
   letter-spacing: 0.12em;
   font-size: clamp(1.1rem, 1.5vw, 1.55rem);
   line-height: 1.35;
-  color: var(--hero-text-color, var(--ui-text-primary, var(--brand-fg-100, #111)));
+  color: var(--hero-eyebrow-color, var(--brand-hero-text-on-dark, var(--brand-hero-text, #f0eaf3)));
   border-bottom: 1px solid currentColor;
+  margin: 0;
 }
 
 .hero-headline {
@@ -266,7 +267,7 @@ function getHeaderOffset() {
   line-height: 1.08;
   margin-bottom: clamp(18px, 2.5vw, 28px);
   letter-spacing: 0.04em;
-  color: var(--hero-text-color, var(--ui-text-primary, var(--brand-fg-100, #111)));
+  color: var(--hero-text-color, var(--brand-hero-text-on-dark, var(--brand-hero-text, #f0eaf3)));
 }
 
 .promo-surface {

package/src/components/Home.vue

@@ -1,28 +1,39 @@
 <template>
-  <IntroGate
-    :enabled="introGateEnabled"
-    v-bind="introGateProps"
-  />
-  <main>
-    <component
-      v-for="entry in loadedComponents"
-      :is="entry.component"
-      :key="entry.key"
-      v-bind="entry.props"
+  <template v-if="isDraft && !isUnlocked">
+    <DraftGate
+      :has-password="hasPassword"
+      :error-message="errorMessage"
+      @submit="attemptUnlock"
     />
-  </main>
-  <ComingSoonModal
-    :open="isComingSoonVisible"
-    :title="comingSoonTitle"
-    :message="comingSoonMessage"
-    @close="closeComingSoon"
-  />
+  </template>
+  <template v-else>
+    <a class="cms-skip-link" href="#main-content">Skip to main content</a>
+    <IntroGate
+      :enabled="introGateEnabled"
+      v-bind="introGateProps"
+    />
+    <main id="main-content" tabindex="-1">
+      <component
+        v-for="entry in loadedComponents"
+        :is="entry.component"
+        :key="entry.key"
+        v-bind="entry.props"
+      />
+    </main>
+    <ComingSoonModal
+      :open="isComingSoonVisible"
+      :title="comingSoonTitle"
+      :message="comingSoonMessage"
+      @close="closeComingSoon"
+    />
+  </template>
 </template>
 
 <script setup>
 import { computed, nextTick, provide, watch } from 'vue';
 
 import ComingSoonModal from '../components/ComingSoonModal.vue';
+import DraftGate from '../components/DraftGate.vue';
 import IntroGate from '../components/IntroGate.vue';
 
 import { registry } from '../utils/componentRegistry.js';
@@ -30,6 +41,7 @@ import { usePageConfig } from '../composables/usePageConfig.js';
 import { useComponentResolver } from '../composables/useComponentResolver.js';
 import { usePageMeta } from '../composables/usePageMeta.js';
 import { useIntroGate } from '../composables/useIntroGate.js';
+import { useDraftGate } from '../composables/useDraftGate.js';
 import { useEngagementTracking } from '../composables/useEngagementTracking.js';
 import { useComingSoonInterstitial } from '../composables/useComingSoonInterstitial.js';
 
@@ -70,6 +82,14 @@ const { loadedComponents } = useComponentResolver({
 
 const { introGateEnabled, introGateProps } = useIntroGate({ siteData, pageContent });
 
+const {
+  isDraft,
+  isUnlocked,
+  hasPassword,
+  errorMessage,
+  attemptUnlock,
+} = useDraftGate({ siteData, currentPage });
+
 usePageMeta({ siteData, currentPage });
 
 const {
@@ -115,3 +135,43 @@ watch(
 );
 </script>
 
+<style>
+/* Visually-hidden until focused. The skip link is the first focusable
+   element on the page; pressing Tab once reveals it and Enter jumps
+   focus past the sticky header into <main>. WCAG 2.4.1 (Bypass Blocks). */
+.cms-skip-link {
+  position: absolute;
+  top: 0;
+  left: 0;
+  padding: 12px 20px;
+  background: #ffffff;
+  color: #1f2a44;
+  border: 2px solid #1f2a44;
+  border-radius: 0 0 8px 0;
+  font-family: var(--ui-font-body, system-ui, -apple-system, sans-serif);
+  font-weight: 600;
+  text-decoration: none;
+  z-index: 9999;
+  transform: translateY(-100%);
+  transition: transform 0.15s ease;
+}
+.cms-skip-link:focus {
+  transform: translateY(0);
+  outline: 2px solid #1f2a44;
+  outline-offset: 2px;
+}
+@media (prefers-reduced-motion: reduce) {
+  .cms-skip-link { transition: none; }
+}
+
+/* When the skip link sends focus to <main>, browsers don't render an
+   outline on the [tabindex="-1"] element by default — strip it so the
+   page doesn't get an unexpected ring around its main region. */
+#main-content:focus { outline: none; }
+
+/* Sticky header offset for in-page anchor jumps and skip-link landing.
+   Without this, the focused element is hidden under the sticky header
+   (fails 2.4.11 Focus Not Obscured). */
+html { scroll-padding-top: 88px; }
+</style>
+

package/src/components/Plan.vue

@@ -94,7 +94,8 @@ const planItems = computed(() =>
   width: 70px;
   height: 70px;
   border-radius: 50%;
-  border: 3px solid var(--plan-step-border, rgba(255, 255, 255, 0.3));
+  /* 3:1+ against the dark plan-card surface (WCAG 1.4.11). */
+  border: 3px solid var(--plan-step-border, var(--brand-plan-step-ring, rgba(255, 255, 255, 0.5)));
   color: var(--plan-step-color, #ffffff);
   display: inline-flex;
   align-items: center;
@@ -107,10 +108,12 @@ const planItems = computed(() =>
   font-size: 1.15rem;
   font-weight: 600;
   margin: 0;
-  color: var(--plan-card-title, var(--ui-text-primary, #ffffff));
+  /* Dark plan-card surface needs light text. Don't fall through to
+     --ui-text-primary (dark) — that's the FOUC trap that bit FooterMinimal. */
+  color: var(--plan-card-title, var(--brand-plan-card-text, #ffffff));
 }
 
 .plan-card__description {
-  color: var(--ui-text-muted, rgba(255, 255, 255, 0.78));
+  color: var(--plan-card-description, var(--brand-plan-card-muted-text, #c8c2cf));
 }
 </style>

package/src/components/Portfolio.vue

@@ -72,7 +72,7 @@
             </div>
             <span class="portfolio-tag ui-label-sm">{{ project.displayTags || project.tags }}</span>
             <h3 class="portfolio-title ui-title-md">{{ project.title }}</h3>
-            <a class="portfolio-card__link" :href="project.href" aria-label="Visit portfolio link"></a>
+            <a class="portfolio-card__link" :href="project.href" :aria-label="`View ${project.title}`"></a>
           </div>
         </div>
       </transition-group>
@@ -340,10 +340,14 @@ function handleAfterLeave() {
 
 .portfolio-filter:hover,
 .portfolio-filter:focus-visible {
-  color: var(--portfolio-filter-hover-color, var(--brand-accent-electric, #4f6cf0));
-  border-color: var(--portfolio-filter-hover-border, rgba(79, 108, 240, 0.5));
+  color: var(--portfolio-filter-hover-color, var(--brand-accent-electric, #4361dd));
+  border-color: var(--portfolio-filter-hover-border, rgba(67, 97, 221, 0.55));
   transform: translateY(-1px);
 }
+.portfolio-filter:focus-visible {
+  outline: 2px solid var(--portfolio-filter-focus-outline, var(--brand-accent-electric, #4361dd));
+  outline-offset: 2px;
+}
 
 .portfolio-filter--active {
   color: var(--portfolio-filter-active-color, #fff);

package/src/components/StickyCTA.vue

@@ -220,9 +220,13 @@ function scrollTargetWithOffset(target) {
   padding: 14px 24px;
   border: none;
   border-radius: var(--brand-button-radius, 14px);
+  /* The default 3-stop gradient previously failed contrast at the mid stop
+     (#0a0a0d on #9a2eff = 3.96:1). Mid stop darkened to #7e23d5 → 5.34:1
+     with the dark text. Sites overriding --brand-primary-cta-gradient
+     are responsible for verifying contrast against --brand-primary-cta-text. */
   background: var(
     --brand-primary-cta-gradient,
-    linear-gradient(135deg, #ff2d86 0%, #9a2eff 55%, #27f3ff 100%)
+    linear-gradient(135deg, #ff2d86 0%, #7e23d5 55%, #2bb8d9 100%)
   );
   color: var(--brand-primary-cta-text, #0a0a0d);
   font-size: clamp(0.95rem, 2.5vw, 1.05rem);

package/src/components/Team.vue

@@ -337,7 +337,9 @@ const buildSocialAriaLabel = (memberName, social) => {
   font-size: 0.72rem;
   letter-spacing: 0.18em;
   text-transform: uppercase;
-  color: var(--ui-text-muted, var(--brand-border-highlight, rgba(79, 108, 240, 0.8)));
+  /* AA-safe muted text on the white card. Don't fall through to a brand
+     color rgba — it composites below 4.5:1. */
+  color: var(--team-role-color, var(--ui-text-muted, #54627b));
 }
 
 .team-card__bio {

package/src/composables/useDraftGate.js

@@ -0,0 +1,89 @@
+/**
+ * Reactive gate state for draft pages.
+ *
+ * - During SSR (vite-ssg pre-render), isUnlocked is always false so the
+ *   pre-rendered HTML on disk contains only the gate component, not the
+ *   page body. Crawlers and `curl` see a noindex page with no content.
+ * - In the browser, isUnlocked hydrates from sessionStorage so the gate
+ *   doesn't re-prompt while the user iterates between draft pages within
+ *   one tab. Closing the tab re-engages the gate (sessionStorage scope).
+ * - Password verification is hash-based: the Vite plugin replaces
+ *   site.draftPassword with site.draftPasswordHash (SHA-256 hex) at build
+ *   time so the plaintext never lands in the bundle. attemptUnlock hashes
+ *   the user's input with the same algorithm and compares.
+ * - Empty/missing hash is a deliberate fail-safe state: the gate still
+ *   appears, but accepts any input including empty. This makes the gate
+ *   visible even when the author hasn't picked a password yet — see
+ *   hasPassword in the return value.
+ */
+
+import { computed, ref } from 'vue';
+import { isPathDraft, getDraftPasswordHash } from '../utils/draftMode.js';
+import { sha256Hex } from '../utils/sha256.js';
+
+const SESSION_KEY = 'cms_draft_unlocked';
+
+function readUnlockedFromSession() {
+  if (typeof window === 'undefined') return false;
+  try {
+    return window.sessionStorage.getItem(SESSION_KEY) === '1';
+  } catch {
+    return false;
+  }
+}
+
+function persistUnlocked() {
+  if (typeof window === 'undefined') return;
+  try {
+    window.sessionStorage.setItem(SESSION_KEY, '1');
+  } catch {
+    /* sessionStorage may be blocked in private mode; gate falls back to
+       in-memory unlock for the lifetime of the page. */
+  }
+}
+
+export function useDraftGate({ siteData, currentPage }) {
+  const isDraft = computed(() => {
+    const page = currentPage.value || {};
+    return isPathDraft(siteData.value, page.path, page);
+  });
+
+  const expectedHash = computed(() => getDraftPasswordHash(siteData.value));
+  const hasPassword = computed(() => expectedHash.value.length > 0);
+
+  const isUnlocked = ref(import.meta.env.SSR ? false : readUnlockedFromSession());
+  const errorMessage = ref('');
+
+  async function attemptUnlock(input) {
+    const hash = expectedHash.value;
+    if (!hash) {
+      isUnlocked.value = true;
+      errorMessage.value = '';
+      persistUnlocked();
+      return true;
+    }
+    const provided = typeof input === 'string' ? input : '';
+    let providedHash = '';
+    try {
+      providedHash = await sha256Hex(provided);
+    } catch {
+      providedHash = '';
+    }
+    if (providedHash && providedHash === hash) {
+      isUnlocked.value = true;
+      errorMessage.value = '';
+      persistUnlocked();
+      return true;
+    }
+    errorMessage.value = 'Incorrect password.';
+    return false;
+  }
+
+  return {
+    isDraft,
+    isUnlocked,
+    hasPassword,
+    errorMessage,
+    attemptUnlock,
+  };
+}

package/src/composables/usePageConfig.js

@@ -26,6 +26,7 @@ export function usePageConfig({ pageId, pagePath, locale, onPageLoaded } = {}) {
     components: [],
     content: {},
     meta: {},
+    draft: undefined,
   });
   const componentKeys = ref([]);
   const isLoading = ref(false);
@@ -48,6 +49,7 @@ export function usePageConfig({ pageId, pagePath, locale, onPageLoaded } = {}) {
         components: Array.isArray(data.components) ? [...data.components] : [],
         content: data.content || {},
         meta: data.meta || {},
+        draft: data.draft,
       };
     };
 
@@ -69,6 +71,7 @@ export function usePageConfig({ pageId, pagePath, locale, onPageLoaded } = {}) {
             components: Array.isArray(data.components) ? [...data.components] : [],
             content: data.content || {},
             meta: data.meta || {},
+            draft: data.draft,
           };
         }
       }
@@ -85,6 +88,7 @@ export function usePageConfig({ pageId, pagePath, locale, onPageLoaded } = {}) {
         components: Array.isArray(firstData.components) ? [...firstData.components] : [],
         content: firstData.content || {},
         meta: firstData.meta || {},
+        draft: firstData.draft,
       };
     }
 
@@ -141,7 +145,7 @@ export function usePageConfig({ pageId, pagePath, locale, onPageLoaded } = {}) {
       if (import.meta.env.DEV) {
         console.error('[PageRenderer] Failed to load page configuration', error);
       }
-      currentPage.value = { id: '', path: '/', components: [], content: {}, meta: {} };
+      currentPage.value = { id: '', path: '/', components: [], content: {}, meta: {}, draft: undefined };
       pageContent.value = {};
       if (typeof onPageLoaded === 'function') {
         onPageLoaded({ config: null, page: null, content: {} });

package/src/composables/usePageMeta.js

@@ -1,5 +1,6 @@
 import { computed } from 'vue';
 import { useHead } from '@unhead/vue';
+import { isPathDraft } from '../utils/draftMode.js';
 
 const SPECIAL_PAGE_LABELS = {
   home: '',
@@ -39,9 +40,20 @@ export function usePageMeta({ siteData, currentPage }) {
   const siteTitle = computed(() => siteData.value?.site?.title || '');
   const siteDescription = computed(() => siteData.value?.site?.description || '');
 
+  const isDraft = computed(() =>
+    isPathDraft(siteData.value, currentPage.value?.path, currentPage.value),
+  );
+
   const pageMetaTitle = computed(() => {
     const page = currentPage.value;
     const site = siteTitle.value;
+    // Draft pages emit a generic title so the page slug doesn't leak via
+    // <title> in the SSG-rendered HTML on disk. The tab title remains
+    // generic even after client-side unlock — for "iterate before launch"
+    // the URL bar already identifies the page.
+    if (isDraft.value) {
+      return site ? `Draft — ${site}` : 'Draft';
+    }
     const explicitTitle = page?.meta?.title;
     if (explicitTitle) {
       return explicitTitle;
@@ -54,6 +66,9 @@ export function usePageMeta({ siteData, currentPage }) {
   });
 
   const pageMetaDescription = computed(() => {
+    if (isDraft.value) {
+      return '';
+    }
     const explicitDescription = currentPage.value?.meta?.description;
     if (explicitDescription && explicitDescription.trim()) {
       return explicitDescription.trim();
@@ -63,14 +78,18 @@ export function usePageMeta({ siteData, currentPage }) {
 
   useHead(() => {
     const description = pageMetaDescription.value;
-    const meta = description
-      ? [{ name: 'description', content: description, key: 'description' }]
-      : [];
+    const meta = [];
+    if (description) {
+      meta.push({ name: 'description', content: description, key: 'description' });
+    }
+    if (isDraft.value) {
+      meta.push({ name: 'robots', content: 'noindex, nofollow', key: 'robots' });
+    }
     return {
       title: pageMetaTitle.value,
       meta,
     };
   });
 
-  return { pageMetaTitle, pageMetaDescription };
+  return { pageMetaTitle, pageMetaDescription, isDraft };
 }

package/src/styles/base.css

@@ -643,7 +643,9 @@ a:focus-visible {
 }
 
 .ui-form-control::placeholder {
-  color: var(--ui-form-placeholder, var(--brand-input-placeholder, rgba(84, 98, 123, 0.64)));
+  /* Solid fallback (#54627b = 5.66:1 on white). Avoid alpha — composited
+     placeholder colors slip below 4.5:1 quickly. */
+  color: var(--ui-form-placeholder, var(--brand-input-placeholder, #54627b));
 }
 
 .ui-form-control:focus {
@@ -692,7 +694,9 @@ a:focus-visible {
 }
 
 .ui-input-group__input::placeholder {
-  color: var(--ui-form-placeholder, var(--brand-input-placeholder, rgba(84, 98, 123, 0.64)));
+  /* Solid fallback (#54627b = 5.66:1 on white). Avoid alpha — composited
+     placeholder colors slip below 4.5:1 quickly. */
+  color: var(--ui-form-placeholder, var(--brand-input-placeholder, #54627b));
 }
 
 .ui-input-group__input:focus {
@@ -852,6 +856,11 @@ a:focus-visible {
   transform: translate3d(0, 0, 0);
 }
 
+.ui-backtotop:focus-visible {
+  outline: 2px solid #ffffff;
+  outline-offset: 3px;
+}
+
 .ui-backtotop__icon {
   font-size: 1rem;
   line-height: 1;

package/src/themes/buildCssVarMap.js

@@ -68,6 +68,12 @@ export function buildCssVarMap(manifest) {
   const radii = tokens.radii || {};
   const elevation = tokens.elevation || {};
   const utility = tokens.utility || {};
+  // Section-chrome blocks for surfaces that pair text with non-default
+  // backgrounds. Components read these to avoid the fallback-chain trap
+  // (e.g. dark hero surface + light --ui-text-primary fallback = invisible).
+  const hero = tokens.hero || {};
+  const footer = tokens.footer || {};
+  const plan = tokens.plan || {};
 
   assignPrefixed(
     vars,
@@ -231,6 +237,25 @@ export function buildCssVarMap(manifest) {
   setVar(vars, '--status-price-value-color', palette.accent || palette.primary || text.primary);
   setVar(vars, '--status-price-value-shadow', elevation.raised);
 
+  // Hero text — paired with the hero surface to keep contrast intact when
+  // a consumer overrides the hero bg. textOnDark is the fallback when no
+  // hero.text is set.
+  setVar(vars, '--brand-hero-text', hero.text || text.primary);
+  setVar(vars, '--brand-hero-text-on-dark', hero.textOnDark || text.onDark || text.inverse);
+  setVar(vars, '--brand-hero-eyebrow', hero.eyebrow || palette.primary);
+
+  // Footer chrome — FooterMinimal's default bg is dark, so it reads
+  // these instead of falling through --ui-text-primary (a light-on-light trap).
+  setVar(vars, '--brand-footer-text', footer.text || text.onDark || text.inverse);
+  setVar(vars, '--brand-footer-text-muted', footer.textMuted || text.onDarkMuted);
+  setVar(vars, '--brand-footer-link-color', footer.linkColor || footer.text || text.onDark || text.inverse);
+  setVar(vars, '--brand-footer-link-hover', footer.linkHover || '#ffffff');
+
+  // Plan card chrome — same dark-surface pairing.
+  setVar(vars, '--brand-plan-card-text', plan.cardText || text.inverse);
+  setVar(vars, '--brand-plan-card-muted-text', plan.cardMutedText || text.onDarkMuted);
+  setVar(vars, '--brand-plan-step-ring', plan.stepRing);
+
   return vars;
 }
 

package/src/utils/draftMode.js

@@ -0,0 +1,65 @@
+/**
+ * Pure helpers for "draft mode" — letting authors mark a whole site, a URL
+ * prefix, or a single page as not-yet-public so search engines and casual
+ * visitors stay out while content is being iterated on.
+ *
+ * Used by:
+ *   - vite-plugin.js: emit Disallow lines in robots.txt, skip URLs in sitemap.xml
+ *   - usePageMeta.js: inject <meta name="robots" content="noindex,nofollow">
+ *   - useDraftGate.js: decide whether to render the password gate instead of
+ *     the page contents
+ *
+ * Resolution rule (page wins both ways, then site, then prefixes):
+ *   1. pageData.draft === true  → draft
+ *   2. pageData.draft === false → published (overrides site/prefix)
+ *   3. site.draft === true      → draft
+ *   4. any draftPaths prefix matches → draft
+ *   5. otherwise                → published
+ *
+ * Prefix match is path-segment-aware: "/blog" matches "/blog" and
+ * "/blog/2026/post" but NOT "/blog-archive". The literal prefix "/" matches
+ * only "/" itself; for whole-site draft, set site.draft = true instead.
+ */
+
+export function normalizeDraftPath(value) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  let p = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+  p = p.replace(/\/+/g, '/').replace(/\/+$/, '');
+  return p || '/';
+}
+
+export function pathMatchesPrefix(prefix, path) {
+  const np = normalizeDraftPath(prefix);
+  const target = normalizeDraftPath(path);
+  if (!np || !target) return false;
+  if (np === target) return true;
+  if (np === '/') return false;
+  return target.startsWith(`${np}/`);
+}
+
+export function isPathDraft(siteData, pagePath, pageData) {
+  if (pageData && typeof pageData === 'object') {
+    if (pageData.draft === true) return true;
+    if (pageData.draft === false) return false;
+  }
+
+  const site = siteData?.site;
+  if (!site || typeof site !== 'object') return false;
+
+  if (site.draft === true) return true;
+
+  const draftPaths = Array.isArray(site.draftPaths) ? site.draftPaths : [];
+  for (const prefix of draftPaths) {
+    if (pathMatchesPrefix(prefix, pagePath)) return true;
+  }
+
+  return false;
+}
+
+export function getDraftPasswordHash(siteData) {
+  const raw = siteData?.site?.draftPasswordHash;
+  if (typeof raw !== 'string') return '';
+  return raw.trim().toLowerCase();
+}

package/src/utils/robotsGenerator.js

@@ -0,0 +1,62 @@
+/**
+ * Build robots.txt body from the inflated site config.
+ *
+ * Replaces the static cms/public/robots.txt — the plugin writes this string
+ * to siteRoot/public/robots.txt at config time so per-site draft state
+ * (site.draft, site.draftPaths, page.draft) regenerates the disallow list on
+ * every build.
+ *
+ * Always includes the framework-default disallows (/admin, /privacy, /terms,
+ * /cookies — these routes exist on every CMS site). Adds:
+ *   - "Disallow: /" when site.draft === true
+ *   - "Disallow: <prefix>" for each entry in site.draftPaths
+ *   - "Disallow: <path>" for each page with draft === true
+ *
+ * If sitemapUrl is provided, appends a "Sitemap: <url>" line.
+ */
+
+import { normalizeDraftPath } from './draftMode.js';
+
+const FRAMEWORK_DEFAULTS = ['/admin', '/privacy', '/terms', '/cookies'];
+
+export function buildRobotsTxt(siteConfig, sitemapUrl = '') {
+  const lines = ['User-agent: *'];
+
+  for (const p of FRAMEWORK_DEFAULTS) {
+    lines.push(`Disallow: ${p}`);
+  }
+
+  const site = siteConfig?.site || {};
+  const pages = siteConfig?.pages || {};
+
+  if (site.draft === true) {
+    lines.push('Disallow: /');
+  } else {
+    const additional = new Set();
+
+    const draftPaths = Array.isArray(site.draftPaths) ? site.draftPaths : [];
+    for (const p of draftPaths) {
+      const np = normalizeDraftPath(p);
+      if (np && !FRAMEWORK_DEFAULTS.includes(np)) additional.add(np);
+    }
+
+    for (const [, pageData] of Object.entries(pages)) {
+      if (!pageData || typeof pageData !== 'object') continue;
+      if (pageData.draft !== true) continue;
+      const np = normalizeDraftPath(pageData.path);
+      if (np && !FRAMEWORK_DEFAULTS.includes(np)) additional.add(np);
+    }
+
+    for (const p of Array.from(additional).sort()) {
+      lines.push(`Disallow: ${p}`);
+    }
+  }
+
+  const trimmedSitemap = (sitemapUrl || '').trim();
+  if (trimmedSitemap) {
+    lines.push('');
+    lines.push(`Sitemap: ${trimmedSitemap}`);
+  }
+
+  return `${lines.join('\n')}\n`;
+}

package/src/utils/sha256.js

@@ -0,0 +1,20 @@
+/**
+ * SHA-256 hex digest via Web Crypto API.
+ *
+ * Available in Node 19+ (globalThis.crypto.subtle), modern browsers, and
+ * happy-dom test environment (which inherits Node's globalThis.crypto). The
+ * CMS targets Node 20.19, so a single Web Crypto path is sufficient.
+ *
+ * Used by the draft gate: site.draftPassword is hashed at build time (in
+ * the Vite plugin) so the plaintext never reaches the bundle. At runtime,
+ * the user's input is hashed and compared against the stored hash.
+ */
+
+export async function sha256Hex(input) {
+  const text = typeof input === 'string' ? input : String(input ?? '');
+  const bytes = new TextEncoder().encode(text);
+  const hashBuffer = await globalThis.crypto.subtle.digest('SHA-256', bytes);
+  return Array.from(new Uint8Array(hashBuffer))
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('');
+}