@prenta/sections-react 0.15.0

package/CHANGELOG.md

@@ -0,0 +1,1037 @@
+# @actuate-media/sections-react
+
+## 0.15.0
+
+### Minor Changes
+
+- 5eea995: Product rename: ActuateCMS is now **Prenta**. Every package moves from the
+  `@actuate-media/*` scope to `@prenta/*` with simplified names (`@prenta/core`,
+  `@prenta/admin`, `create-prenta`), and version numbers continue from where the
+  old scope left off.
+
+  This is a clean break — no backwards-compat aliases:
+  - **npm packages**: `@actuate-media/cms-core` → `@prenta/core`,
+    `@actuate-media/cms-admin` → `@prenta/admin`, all other packages keep their
+    suffix under `@prenta/*`. `create-actuate-cms` → `create-prenta`
+    (`npm create prenta`), `create-actuate-astro` → `create-prenta-astro`.
+    CLI bins: `actuate`/`actuate-cms` → `prenta`/`prenta-cms`; `actuate-mcp` →
+    `prenta-mcp`.
+  - **Database**: migration `0012_rename_to_prenta` renames all 36 `actuate_*`
+    tables to `prenta_*` in place (plus prefixed constraints, indexes, and
+    sequences). Run `prisma migrate deploy` when upgrading.
+  - **Runtime identifiers**: `getActuateConfig` → `getPrentaConfig`,
+    `handleActuateAPI` → `handlePrentaAPI`, `ActuateClient` → `PrentaClient`,
+    `ActuateDB` → `PrentaDB`, config file `actuate.config.ts` →
+    `prenta.config.ts`, CSS scopes `.actuate-admin`/`.actuate-canvas` →
+    `.prenta-admin`/`.prenta-canvas`, preview protocol `actuate-preview:*` →
+    `prenta-preview:*`, webhook headers `X-Actuate-*` → `X-Prenta-*`, session
+    cookie `actuate_session` → `prenta_session`, env vars `ACTUATE_*` →
+    `PRENTA_*`, purge route `/api/actuate/purge` → `/api/prenta/purge`.
+  - **Sessions and webhooks**: all sessions reset on upgrade (cookie + JWT issuer
+    changed); webhook consumers must re-verify signatures against the new
+    `X-Prenta-*` headers.
+
+  The old `@actuate-media/*` packages are deprecated on npm and will receive no
+  further releases.
+
+### Patch Changes
+
+- Updated dependencies [5eea995]
+  - @prenta/core@0.118.0
+
+## 0.14.0
+
+### Minor Changes
+
+- 56ebbb9: New `assertSectionCoverage` export in `@actuate-media/sections-react/testing` (issue #775) — the real implementation behind the `verify:sections` check the docs describe. Asserts the three-layer section contract agrees: every declared `sections.types` id has an entry in the shared renderer map, every renderer corresponds to a declared type (catches schema renames that leave a stale renderer), and intentionally renderer-less types are declared via an `allowDataOnly` opt-out list that fails when stale. Aggregates all problems into one actionable error.
+
+## 0.13.1
+
+### Patch Changes
+
+- 02be20a: Visual editing Stage 3: path-aware section content updates, preview bridge edit/mode/request-media protocol with suppress-echo for canvas text edits, and media field-kind annotations on default section renderers.
+- Updated dependencies [02be20a]
+  - @actuate-media/cms-core@0.117.0
+
+## 0.13.0
+
+### Minor Changes
+
+- abce7a5: Visual editing Phase 2: field selection via `data-cms-field`, unified `insp-field-*` inspector ids, and canvas `fieldPath` → inspector focus.
+
+## 0.12.0
+
+### Minor Changes
+
+- 1216ee7: Visual editing Phase 1: annotate `<Sections>` with `data-cms-section-id` / `data-cms-section-type`, and wire an origin-pinned `actuate-preview:*` postMessage bus so Site preview can select sections into the inspector and highlight the selection.
+
+## 0.11.0
+
+### Minor Changes
+
+- 6ff80a6: Add `@actuate-media/sections-react/testing` (`assertSectionRenderParity`, canvas render options) and wire an Astro-split starter `test:parity` gate so canvas and public orchestrators can't drift into a WYSIWYG lie.
+
+## 0.10.25
+
+### Patch Changes
+
+- Updated dependencies [73854fc]
+  - @actuate-media/cms-core@0.116.0
+
+## 0.10.24
+
+### Patch Changes
+
+- Updated dependencies [576f076]
+  - @actuate-media/cms-core@0.115.0
+
+## 0.10.23
+
+### Patch Changes
+
+- Updated dependencies [dfffe08]
+  - @actuate-media/cms-core@0.114.0
+
+## 0.10.22
+
+### Patch Changes
+
+- Updated dependencies [38aa813]
+  - @actuate-media/cms-core@0.113.0
+
+## 0.10.21
+
+### Patch Changes
+
+- Updated dependencies [cf97a40]
+  - @actuate-media/cms-core@0.112.0
+
+## 0.10.20
+
+### Patch Changes
+
+- Updated dependencies [90f9801]
+- Updated dependencies [90f9801]
+  - @actuate-media/cms-core@0.111.0
+
+## 0.10.19
+
+### Patch Changes
+
+- Updated dependencies [56c1309]
+  - @actuate-media/cms-core@0.110.2
+
+## 0.10.18
+
+### Patch Changes
+
+- Updated dependencies [f4766d4]
+  - @actuate-media/cms-core@0.110.1
+
+## 0.10.17
+
+### Patch Changes
+
+- Updated dependencies [46ea4a7]
+  - @actuate-media/cms-core@0.110.0
+
+## 0.10.16
+
+### Patch Changes
+
+- Updated dependencies [e4e55de]
+  - @actuate-media/cms-core@0.109.0
+
+## 0.10.15
+
+### Patch Changes
+
+- Updated dependencies [6eaffa5]
+  - @actuate-media/cms-core@0.108.0
+
+## 0.10.14
+
+### Patch Changes
+
+- Updated dependencies [1c2afa5]
+  - @actuate-media/cms-core@0.107.3
+
+## 0.10.13
+
+### Patch Changes
+
+- Updated dependencies [b305f0c]
+  - @actuate-media/cms-core@0.107.2
+
+## 0.10.12
+
+### Patch Changes
+
+- Updated dependencies [a26f61a]
+  - @actuate-media/cms-core@0.107.1
+
+## 0.10.11
+
+### Patch Changes
+
+- Updated dependencies [f676bcc]
+  - @actuate-media/cms-core@0.107.0
+
+## 0.10.10
+
+### Patch Changes
+
+- Updated dependencies [9d5dad3]
+  - @actuate-media/cms-core@0.106.1
+
+## 0.10.9
+
+### Patch Changes
+
+- Updated dependencies [3d1a79f]
+  - @actuate-media/cms-core@0.106.0
+
+## 0.10.8
+
+### Patch Changes
+
+- Updated dependencies [78671c4]
+  - @actuate-media/cms-core@0.105.0
+
+## 0.10.7
+
+### Patch Changes
+
+- Updated dependencies [258cbc3]
+  - @actuate-media/cms-core@0.104.0
+
+## 0.10.6
+
+### Patch Changes
+
+- Updated dependencies [2f2fe29]
+  - @actuate-media/cms-core@0.103.0
+
+## 0.10.5
+
+### Patch Changes
+
+- Updated dependencies [f8a2c07]
+  - @actuate-media/cms-core@0.102.0
+
+## 0.10.4
+
+### Patch Changes
+
+- Updated dependencies [afceb12]
+  - @actuate-media/cms-core@0.101.2
+
+## 0.10.3
+
+### Patch Changes
+
+- Updated dependencies [81aa012]
+  - @actuate-media/cms-core@0.101.1
+
+## 0.10.2
+
+### Patch Changes
+
+- Updated dependencies [58f3ca1]
+  - @actuate-media/cms-core@0.101.0
+
+## 0.10.1
+
+### Patch Changes
+
+- Updated dependencies [cc6ad93]
+- Updated dependencies [cc6ad93]
+- Updated dependencies [cc6ad93]
+  - @actuate-media/cms-core@0.100.0
+
+## 0.10.0
+
+### Minor Changes
+
+- 80d4e5f: Marketing attribution tracking for forms — captures where every lead came from, automatically.
+
+  **cms-core**: rebuilt `forms/attribution` (now also published at `@actuate-media/cms-core/forms/attribution`) with a first-touch (30-day) / last-touch (24-hour) model merged at submit, the full ad click-ID registry (gclid, fbclid, msclkid, ttclid, li_fat_id, dclid, twclid, rdt_cid + long-tail IDs in `extraIds`), and referrer classification into marketing channels (paid / organic search / social / email / **ai** / referral / direct) with friendly source names ("ChatGPT" instead of "chat.openai.com"). Form entry payloads now expose the full `attribution` blob, CSV exports gained Source / Medium / Campaign / Channel / Referrer / Landing Page columns, and `form.submitted` webhooks forward the merged attribution to CRM consumers. Note: `AttributionData` gained required fields (`channel`, `referrerName`, `extraIds`, `firstTouchAt`, `lastTouchAt`, `version`) and `clickIds` grew from 5 to 8 networks.
+
+  **sections-react**: `<ActuateForm>` now records an attribution touch on mount and attaches the merged first/last-touch payload to every submission — no setup required. Capture is consent-gated when `@actuate-media/plugin-consent` is installed (waits for an analytics grant; proceeds when the plugin is absent). New `<AttributionTracker />` component for the site layout improves first-touch fidelity across multi-page journeys.
+
+  **cms-admin**: the form entry detail pane now shows the full attribution picture — channel with friendly source name, source/medium/campaign/term/content, landing page, referrer, device type, first-touch date, and any ad click IDs — with graceful fallback to the legacy UTM columns for older entries.
+
+### Patch Changes
+
+- Updated dependencies [80d4e5f]
+- Updated dependencies [80d4e5f]
+  - @actuate-media/cms-core@0.99.0
+
+## 0.9.0
+
+### Minor Changes
+
+- 21aa417: Consolidate the two form-editing surfaces onto the typed Forms API and make GA4 form analytics work end-to-end.
+
+  **cms-admin** — The Edit Form page is rebuilt as the canonical full-page form editor, backed by the same typed Forms API as the Forms list's inline Schema pane (no more legacy `/collections/forms` writes that bypassed schema versioning). It now covers everything in one place: Details (name/description/status + post-submit confirmation), Fields (versioned schema editor), **Notifications** (previously only reachable from the Schema pane), Analytics (GA4), Embed, and Integrations (webhooks). Confirmation settings now persist to `successMessage` / `redirectUrl` — the fields the public submission pipeline actually reads (the old editor wrote a `confirmation` object the runtime ignored). New forms are created through `POST /forms`, gaining slug generation, an initial schema version, and notification defaults, then route into the full editor.
+
+  **cms-core** — `FormDefinition` gains a sanitized `analytics` (GA4) config, persisted via the forms service (`createForm` / `updateForm` / `duplicateForm`) and exposed on the public form schema only when tracking is enabled. New `normalizeAnalyticsConfig` export and a client-safe `@actuate-media/cms-core/forms/analytics` subpath export.
+
+  **sections-react** — `<ActuateForm>` now fires GA4 `form_start` / `form_submit` / `form_error` events (with optional conversion value) when the form has analytics enabled. Also fixes the success state to read the submit endpoint's `confirmation` _object_ (`{ type, message, redirectUrl }`) — previously it was treated as a string, which broke the success message and ignored server-driven redirects. New `resolveSubmitOutcome` helper with regression coverage.
+
+  **plugin-forms** — The `forms` collection field map now declares every key the typed forms service persists (`description`, `notificationSettings`, `embedSettings`, `spamSettings`, `successMessage`, `redirectUrl`, `analytics`, `activeSchemaVersionId`, …). The data layer strips undeclared keys on write, so consumer apps registering this plugin would previously drop notification/embed/spam settings silently. Status options now match the typed `FormStatus` (`active` / `draft` / `archived`).
+
+### Patch Changes
+
+- Updated dependencies [c6b006c]
+- Updated dependencies [21aa417]
+  - @actuate-media/cms-core@0.98.0
+
+## 0.8.29
+
+### Patch Changes
+
+- Updated dependencies [fb89234]
+  - @actuate-media/cms-core@0.97.0
+
+## 0.8.28
+
+### Patch Changes
+
+- Updated dependencies [fdfae4c]
+  - @actuate-media/cms-core@0.96.0
+
+## 0.8.27
+
+### Patch Changes
+
+- Updated dependencies [2ccc0a7]
+  - @actuate-media/cms-core@0.95.1
+
+## 0.8.26
+
+### Patch Changes
+
+- Updated dependencies [0bd5153]
+  - @actuate-media/cms-core@0.95.0
+
+## 0.8.25
+
+### Patch Changes
+
+- Updated dependencies [d9096d9]
+  - @actuate-media/cms-core@0.94.0
+
+## 0.8.24
+
+### Patch Changes
+
+- Updated dependencies [fe2b661]
+  - @actuate-media/cms-core@0.93.11
+
+## 0.8.23
+
+### Patch Changes
+
+- Updated dependencies [78c6d0f]
+  - @actuate-media/cms-core@0.93.10
+
+## 0.8.22
+
+### Patch Changes
+
+- Updated dependencies [06e7fbc]
+  - @actuate-media/cms-core@0.93.9
+
+## 0.8.21
+
+### Patch Changes
+
+- Updated dependencies [28dd310]
+  - @actuate-media/cms-core@0.93.8
+
+## 0.8.20
+
+### Patch Changes
+
+- Updated dependencies [ac2cf04]
+  - @actuate-media/cms-core@0.93.7
+
+## 0.8.19
+
+### Patch Changes
+
+- Updated dependencies [886238a]
+  - @actuate-media/cms-core@0.93.6
+
+## 0.8.18
+
+### Patch Changes
+
+- Updated dependencies [430ae43]
+  - @actuate-media/cms-core@0.93.5
+
+## 0.8.17
+
+### Patch Changes
+
+- Updated dependencies [899ca9a]
+  - @actuate-media/cms-core@0.93.4
+
+## 0.8.16
+
+### Patch Changes
+
+- Updated dependencies [77b3922]
+  - @actuate-media/cms-core@0.93.3
+
+## 0.8.15
+
+### Patch Changes
+
+- Updated dependencies [4421c32]
+  - @actuate-media/cms-core@0.93.2
+
+## 0.8.14
+
+### Patch Changes
+
+- Updated dependencies [898ec8b]
+  - @actuate-media/cms-core@0.93.1
+
+## 0.8.13
+
+### Patch Changes
+
+- Updated dependencies [c231dd0]
+  - @actuate-media/cms-core@0.93.0
+
+## 0.8.12
+
+### Patch Changes
+
+- Updated dependencies [cc18833]
+  - @actuate-media/cms-core@0.92.0
+
+## 0.8.11
+
+### Patch Changes
+
+- Updated dependencies [f9513f3]
+  - @actuate-media/cms-core@0.91.1
+
+## 0.8.10
+
+### Patch Changes
+
+- 041a228: Add the MIT `license` field to every published package (previously missing) and correct `repository.url` to `github.com/actuate-media/actuatecms` (13 packages carried the wrong org).
+- Updated dependencies [041a228]
+- Updated dependencies [b53b4a4]
+- Updated dependencies [041a228]
+- Updated dependencies [de419f2]
+- Updated dependencies [898a3f8]
+- Updated dependencies [4198920]
+- Updated dependencies [d6665dd]
+  - @actuate-media/cms-core@0.91.0
+
+## 0.8.9
+
+### Patch Changes
+
+- Updated dependencies [3b6d7b3]
+  - @actuate-media/cms-core@0.90.1
+
+## 0.8.8
+
+### Patch Changes
+
+- Updated dependencies [4afb589]
+- Updated dependencies [4afb589]
+- Updated dependencies [4afb589]
+- Updated dependencies [4afb589]
+- Updated dependencies [4afb589]
+- Updated dependencies [4afb589]
+- Updated dependencies [4afb589]
+  - @actuate-media/cms-core@0.90.0
+
+## 0.8.7
+
+### Patch Changes
+
+- Updated dependencies [41bd56a]
+  - @actuate-media/cms-core@0.89.0
+
+## 0.8.6
+
+### Patch Changes
+
+- Updated dependencies [9046381]
+  - @actuate-media/cms-core@0.88.0
+
+## 0.8.5
+
+### Patch Changes
+
+- Updated dependencies [163ae1d]
+  - @actuate-media/cms-core@0.87.0
+
+## 0.8.4
+
+### Patch Changes
+
+- Updated dependencies [7c105f0]
+  - @actuate-media/cms-core@0.86.0
+
+## 0.8.3
+
+### Patch Changes
+
+- Updated dependencies [685958f]
+  - @actuate-media/cms-core@0.85.3
+
+## 0.8.2
+
+### Patch Changes
+
+- Updated dependencies [6a6101a]
+  - @actuate-media/cms-core@0.85.2
+
+## 0.8.1
+
+### Patch Changes
+
+- Updated dependencies [6d254f3]
+  - @actuate-media/cms-core@0.85.1
+
+## 0.8.0
+
+### Minor Changes
+
+- 1a3cf91: Agent-ready public forms (WebMCP): declarative tool metadata on public form schemas, zero-JS `renderPublicFormHtml` / `ActuateFormHtml`, urlencoded submit parsing, HTML confirmation responses, scaffold form prefetch, `actuate doctor` check, and docs.
+
+### Patch Changes
+
+- Updated dependencies [1a3cf91]
+  - @actuate-media/cms-core@0.85.0
+
+## 0.7.1
+
+### Patch Changes
+
+- a6360cc: Forms launch kit (Batch 7): Integrations tab with Zapier Catch Hook helper and webhook CRUD in the form schema drawer; marketing seed contact form + /contact page; ActuateForm success focus; actuate doctor forms/CRM checks; forms-and-integrations docs.
+
+## 0.7.0
+
+### Minor Changes
+
+- 6592e09: Add the `widget-embed` section type for lazy-loaded Elfsight, Trustpilot, and Calendly widgets with reserved min-height (CLS-safe) and optional cookie-consent gating via plugin-consent.
+
+### Patch Changes
+
+- Updated dependencies [e1ad198]
+- Updated dependencies [a59a501]
+- Updated dependencies [e1ad198]
+- Updated dependencies [6592e09]
+  - @actuate-media/cms-core@0.84.0
+
+## 0.6.17
+
+### Patch Changes
+
+- Updated dependencies [3983016]
+  - @actuate-media/cms-core@0.83.0
+
+## 0.6.16
+
+### Patch Changes
+
+- Updated dependencies [c4c41f3]
+- Updated dependencies [b22a7bc]
+  - @actuate-media/cms-core@0.82.0
+
+## 0.6.15
+
+### Patch Changes
+
+- Updated dependencies [b8b930b]
+  - @actuate-media/cms-core@0.81.0
+
+## 0.6.14
+
+### Patch Changes
+
+- Updated dependencies [af18915]
+  - @actuate-media/cms-core@0.80.1
+
+## 0.6.13
+
+### Patch Changes
+
+- Updated dependencies [5fce703]
+  - @actuate-media/cms-core@0.80.0
+
+## 0.6.12
+
+### Patch Changes
+
+- Updated dependencies [8229d94]
+  - @actuate-media/cms-core@0.79.3
+
+## 0.6.11
+
+### Patch Changes
+
+- Updated dependencies [2966293]
+  - @actuate-media/cms-core@0.79.2
+
+## 0.6.10
+
+### Patch Changes
+
+- Updated dependencies [0ad67c9]
+  - @actuate-media/cms-core@0.79.1
+
+## 0.6.9
+
+### Patch Changes
+
+- Updated dependencies [39e2419]
+  - @actuate-media/cms-core@0.79.0
+
+## 0.6.8
+
+### Patch Changes
+
+- Updated dependencies [bc51a1d]
+  - @actuate-media/cms-core@0.78.0
+
+## 0.6.7
+
+### Patch Changes
+
+- Updated dependencies [9d4e24c]
+- Updated dependencies [869620b]
+  - @actuate-media/cms-core@0.77.3
+
+## 0.6.6
+
+### Patch Changes
+
+- Updated dependencies [9875fa3]
+  - @actuate-media/cms-core@0.77.2
+
+## 0.6.5
+
+### Patch Changes
+
+- Updated dependencies [4dafd90]
+  - @actuate-media/cms-core@0.77.1
+
+## 0.6.4
+
+### Patch Changes
+
+- Updated dependencies [d97e388]
+- Updated dependencies [d97e388]
+- Updated dependencies [d97e388]
+- Updated dependencies [d97e388]
+  - @actuate-media/cms-core@0.77.0
+
+## 0.6.3
+
+### Patch Changes
+
+- Updated dependencies [7a6a140]
+  - @actuate-media/cms-core@0.76.3
+
+## 0.6.2
+
+### Patch Changes
+
+- Updated dependencies [90b5826]
+  - @actuate-media/cms-core@0.76.2
+
+## 0.6.1
+
+### Patch Changes
+
+- Updated dependencies [4899af9]
+- Updated dependencies [df1176a]
+  - @actuate-media/cms-core@0.76.1
+
+## 0.6.0
+
+### Minor Changes
+
+- c656ddc: Add an `embed` (video) section type for YouTube, Vimeo, and Loom.
+  - **cms-core:** new `embed` section in the registry (`url`, `title`, `ratio`, `caption`) plus a shared, deterministic `parseEmbed()` provider allowlist (`@actuate-media/cms-core/page-sections`). Section validation rejects any URL that isn't a recognised YouTube/Vimeo/Loom link, so an arbitrary URL can never reach an iframe.
+  - **sections-react:** `EmbedSection` renderer — a lazy-loaded provider iframe inside a fixed aspect-ratio box (16:9 / 4:3 / 1:1 / 9:16) so the embed reserves its space and never causes layout shift (CLS). The URL is re-parsed through the same allowlist at render time.
+  - **cms-admin:** matching editor-canvas body for `embed` (provider + ratio placeholder) so the page/post editors preview the section instead of showing a generic "custom section" placeholder.
+  - **mcp-server:** `list_section_types` description now lists `embed`.
+
+### Patch Changes
+
+- Updated dependencies [c656ddc]
+  - @actuate-media/cms-core@0.76.0
+
+## 0.5.1
+
+### Patch Changes
+
+- Updated dependencies [5446671]
+  - @actuate-media/cms-core@0.75.0
+
+## 0.5.0
+
+### Minor Changes
+
+- 2b61b66: Core Web Vitals: give the `hero` section an optional image rendered as the page LCP, and serve AVIF in scaffolded sites.
+  - **Hero image (LCP):** the canonical `hero` section now has an optional `imageUrl`/`imageAlt` field. When set, the renderer draws it below the copy as the page's single priority (eager, `fetchpriority=high`) image with a full-width `sizes` hint and intrinsic dimensions — the explicit, dimensioned LCP element the best-practice spec calls for (rather than leaving the LCP to chance). Alt text is required when an image is set (existing accessibility rule). Dimensions are backfilled by the `/resolve` enrichment (hero is now enriched like `feature`).
+  - **AVIF delivery:** `create-actuate-cms` now sets `images.formats: ['image/avif', 'image/webp']` so scaffolded sites serve AVIF (≈50% smaller than JPEG) first, then WebP — a direct LCP win via `next/image` format negotiation.
+
+### Patch Changes
+
+- Updated dependencies [2b61b66]
+  - @actuate-media/cms-core@0.74.0
+
+## 0.4.1
+
+### Patch Changes
+
+- Updated dependencies [7b7f0be]
+  - @actuate-media/cms-core@0.73.0
+
+## 0.4.0
+
+### Minor Changes
+
+- 8a64a6e: Core Web Vitals: enforce the single-priority-image (LCP) policy and ship responsive `sizes` by default.
+
+  The section renderer now guarantees the key LCP/CLS image rules automatically, so an editor (or AI author) can't ship a slow page:
+  - **One priority image per page.** A new `LcpController` (exported `createLcpController`) grants the eager, `fetchpriority="high"` slot to the first image on the page; every other image lazy-loads. This replaces `PostHeader`'s hard-coded `priority` (which could collide with a section image). Pass one shared controller via `options.lcp` to both `PostHeader` and `Sections` to share the budget.
+  - **Responsive `sizes` everywhere.** Built-in renderers emit contextual `sizes` (full-width header, half-width feature, column-aware gallery via the exported `gallerySizes`) so mobile stops over-downloading the desktop image. `defaultRenderImage` now forwards `sizes` and sets `fetchPriority`.
+  - **No raw `<img>`.** The author-bio avatar now renders through `renderImage` (dimensioned, lazy) like every other image.
+  - `PostContext` gains `featuredImageWidth`/`featuredImageHeight` so the post header featured image can be dimensioned (CLS).
+
+  `create-actuate-cms`: the generated catch-all creates a per-request shared `LcpController` for the post header + body and forwards `sizes`/`fetchPriority` in its `next/image` fallback.
+
+  Note: `ResolvedRenderOptions` now includes a required `lcp` field — only affects code that constructs that internal type directly; consumers passing `RenderOptions` are unaffected (`lcp` is optional there).
+
+## 0.3.2
+
+### Patch Changes
+
+- Updated dependencies [2fa4ebb]
+  - @actuate-media/cms-core@0.72.1
+
+## 0.3.1
+
+### Patch Changes
+
+- Updated dependencies [6f140bc]
+  - @actuate-media/cms-core@0.72.0
+
+## 0.3.0
+
+### Minor Changes
+
+- ab216f8: Export the `Img` helper for admin-safe image rendering in section components. Section components that `import next/image` directly break the post/page editor canvas (the admin runs the same components in a plain client bundle with no Next image pipeline). `Img` renders through `options.renderImage` — a `next/image`-backed optimizer on the public site, and Actuate's plain `<img>` renderer in the admin canvas — so one component works in both. Docs gain a "Rendering images in section components" section with the rule and pattern.
+
+## 0.2.25
+
+### Patch Changes
+
+- Updated dependencies [1c81772]
+- Updated dependencies [9e0d82b]
+  - @actuate-media/cms-core@0.71.1
+
+## 0.2.24
+
+### Patch Changes
+
+- Updated dependencies [9f5e5dc]
+  - @actuate-media/cms-core@0.71.0
+
+## 0.2.23
+
+### Patch Changes
+
+- Updated dependencies [0bcc567]
+  - @actuate-media/cms-core@0.70.0
+
+## 0.2.22
+
+### Patch Changes
+
+- Updated dependencies [a889054]
+  - @actuate-media/cms-core@0.69.0
+
+## 0.2.21
+
+### Patch Changes
+
+- Updated dependencies [4bf16c4]
+- Updated dependencies [47bed20]
+  - @actuate-media/cms-core@0.68.0
+
+## 0.2.20
+
+### Patch Changes
+
+- Updated dependencies [3ab0649]
+- Updated dependencies [5545bfd]
+- Updated dependencies [3f7fbf3]
+- Updated dependencies [bf00622]
+- Updated dependencies [f05c89b]
+- Updated dependencies [eb3786d]
+- Updated dependencies [88161e8]
+- Updated dependencies [2f1f398]
+- Updated dependencies [a3c5904]
+- Updated dependencies [ee53cfc]
+- Updated dependencies [218c5b0]
+- Updated dependencies [df5d0de]
+  - @actuate-media/cms-core@0.67.0
+
+## 0.2.19
+
+### Patch Changes
+
+- Updated dependencies [a6a17e9]
+  - @actuate-media/cms-core@0.66.0
+
+## 0.2.18
+
+### Patch Changes
+
+- Updated dependencies [3e2daa4]
+  - @actuate-media/cms-core@0.65.0
+
+## 0.2.17
+
+### Patch Changes
+
+- Updated dependencies [135d0c7]
+  - @actuate-media/cms-core@0.64.0
+
+## 0.2.16
+
+### Patch Changes
+
+- Updated dependencies [e3da3bc]
+  - @actuate-media/cms-core@0.63.0
+
+## 0.2.15
+
+### Patch Changes
+
+- Updated dependencies [d6b21e7]
+  - @actuate-media/cms-core@0.62.0
+
+## 0.2.14
+
+### Patch Changes
+
+- Updated dependencies [0c3a6eb]
+  - @actuate-media/cms-core@0.61.0
+
+## 0.2.13
+
+### Patch Changes
+
+- 854152d: Developer experience improvements from external-consumer feedback:
+  - Every published package now ships its `CHANGELOG.md` in the npm tarball, and packages that were missing a `README.md` (cli, cms-admin, cms-core, import, platform-vercel, all plugins, sections-react) now have one — so release notes and usage docs are visible on npmjs.com and in `node_modules`.
+  - New client-safe form validation entry point: `@actuate-media/cms-core/forms/client` exports `validateFormFieldClient()`, `validateFormValuesClient()`, visibility/conditional helpers, and the exact `FORM_EMAIL_RE` / `FORM_PHONE_RE` regexes the server enforces — zero Node dependencies, so public-site forms can mirror server rules without reimplementing them. The server validator now imports the same primitives, so client and server can never drift.
+
+- Updated dependencies [854152d]
+- Updated dependencies [bf5f857]
+  - @actuate-media/cms-core@0.60.0
+
+## 0.2.12
+
+### Patch Changes
+
+- Updated dependencies [15b3f45]
+  - @actuate-media/cms-core@0.59.1
+
+## 0.2.11
+
+### Patch Changes
+
+- Updated dependencies [f962e2d]
+- Updated dependencies [73a117a]
+  - @actuate-media/cms-core@0.59.0
+
+## 0.2.10
+
+### Patch Changes
+
+- Updated dependencies [363bb3e]
+  - @actuate-media/cms-core@0.58.0
+
+## 0.2.9
+
+### Patch Changes
+
+- Updated dependencies [a5f8bc0]
+  - @actuate-media/cms-core@0.57.1
+
+## 0.2.8
+
+### Patch Changes
+
+- Updated dependencies [8e73cf5]
+  - @actuate-media/cms-core@0.57.0
+
+## 0.2.7
+
+### Patch Changes
+
+- Updated dependencies [99565a1]
+  - @actuate-media/cms-core@0.56.0
+
+## 0.2.6
+
+### Patch Changes
+
+- Updated dependencies [74662c0]
+  - @actuate-media/cms-core@0.55.0
+
+## 0.2.5
+
+### Patch Changes
+
+- Updated dependencies [29f32ba]
+  - @actuate-media/cms-core@0.54.0
+
+## 0.2.4
+
+### Patch Changes
+
+- Updated dependencies [aa4bd1a]
+  - @actuate-media/cms-core@0.53.0
+
+## 0.2.3
+
+### Patch Changes
+
+- Updated dependencies [01eef99]
+  - @actuate-media/cms-core@0.52.0
+
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [aeee3a4]
+  - @actuate-media/cms-core@0.51.2
+
+## 0.2.1
+
+### Patch Changes
+
+- Updated dependencies [f88a406]
+  - @actuate-media/cms-core@0.51.1
+
+## 0.2.0
+
+### Minor Changes
+
+- 204da7a: WS-E (E3): media resolution + responsive images in the public render path.
+  - **sections-react:** new pluggable `renderImage` `RenderOptions` hook (with
+    exported `RenderImage`/`RenderImageProps` types and a `defaultRenderImage`).
+    The default emits a lazy, `decoding="async"` `<img>` and forwards intrinsic
+    `width`/`height` when known; a Next.js consumer can pass a `next/image`-backed
+    renderer for responsive `srcset` + optimization. The `feature`, `gallery`, and
+    post-header images now route through it (`<PostHeader>` gains an optional
+    `options` prop). The package stays React-only — no `next` dependency.
+  - **cms-core:** the `/resolve` endpoint now enriches section images with
+    intrinsic `width`/`height` and library `altText`, matched from `actuate_media`
+    by stored URL (`storageKey`/`publicUrl`). Additive and best-effort — the
+    stored document is never mutated and a lookup failure never breaks resolve.
+    `feature` sections gain `imageWidth`/`imageHeight` (+ backfilled `imageAlt`);
+    `gallery` rows gain `width`/`height` (+ backfilled `alt`).
+  - **create-actuate-cms:** the generated catch-all page renders CMS images via a
+    `next/image`-backed `renderImage` (falling back to a fluid `<img>` when the
+    CMS doesn't know dimensions), and `next.config` now allow-lists the storage
+    host under `images.remotePatterns` so optimization works out of the box.
+
+- 2f18c56: WS-E (E2): public form rendering — a built site can now render and submit a CMS form end to end.
+  - **sections-react:** new `<ActuateForm>` Client Component fetches the public form
+    schema (`GET /api/cms/public/forms/:slug`), renders the fields (text/email/
+    url/tel/number/date, textarea, select, checkbox, radio), and submits to the
+    schema's `submitPath`. Spam protection is wired automatically: a hidden
+    honeypot (keyed from `spam.honeypotFieldKey`), an `elapsedMs` "time to submit"
+    timer, and an optional consumer-supplied `captchaToken`. Pre-fetch a schema via
+    the `form` prop to skip the round-trip (SSR/streaming). Adds a `baseUrl`
+    `RenderOptions` field (defaults to same-origin). Exposes pure, tested helpers
+    (`coercePublicForm`, `buildSubmitBody`, `fieldControl`, `firstMissingRequired`).
+  - **cms-core:** new canonical `form` section type. Set `content.formSlug` (plus
+    optional heading/intro) on any page or post and the matching renderer embeds
+    the form. The registry-drift guard now covers it (renderer ↔ type).
+  - **cms-admin:** the form Embed panel now shows the real public endpoints
+    (`/api/cms/public/forms/:slug` + `/submit`) and a copy-paste `<ActuateForm>`
+    snippet, replacing the previously-advertised `/api/forms/*`, iframe, and
+    `embed.js` routes that were never implemented. Adds a `mail` section icon.
+
+- e2e0bd7: WS-E (E4): public navigation endpoint + navigation rendering in the scaffold.
+  - **cms-core:** new unauthenticated `GET /api/cms/public/navigations/:slug` that
+    returns a clean `{ name, slug, location, items }` tree. Like globals it is site
+    chrome — not status-gated — and safe when the navigation plugin isn't installed
+    (no match → 404). A shared, pure `coercePublicNavItems` helper sanitizes the
+    open `data.items` JSON: drops unlabeled nodes, strips internal `id`s, caps
+    recursion depth, and only passes through `_blank`/`_self` targets. Both
+    `createSiteClient` and `createServerSiteClient` gain `getNavigation(slug)`
+    returning `PublicNavigation | null`, and `PublicNavigation` / `PublicNavItem`
+    are now exported types.
+  - **sections-react:** new presentational `<SiteNav>` — an accessible `<nav>`
+    landmark whose submenus use native `<details>`/`<summary>` disclosure
+    (keyboard-operable, no client JS). New-tab links get
+    `rel="noopener noreferrer"`; an empty menu renders nothing. Exports `SiteNav`
+    plus `SiteNavProps`/`SiteNavItem`.
+  - **create-actuate-cms:** `lib/cms.ts` re-exports `getNavigation`, and the
+    generated site layout fetches the `main` menu and renders a header with the
+    site name + `<SiteNav>`, degrading gracefully to just the name when no menu
+    exists yet.
+
+### Patch Changes
+
+- Updated dependencies [a413616]
+- Updated dependencies [204da7a]
+- Updated dependencies [2f18c56]
+- Updated dependencies [e2e0bd7]
+  - @actuate-media/cms-core@0.51.0
+
+## 0.1.2
+
+### Patch Changes
+
+- Updated dependencies [d7a144c]
+  - @actuate-media/cms-core@0.50.0
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [9ba332c]
+  - @actuate-media/cms-core@0.49.0
+
+## 0.1.0
+
+### Minor Changes
+
+- 989bd09: New package: a public React renderer for Actuate's canonical page-content
+  contract (ADR 0001 — `data.sections: PageSection[]`).
+  - `<Sections sections={...} ctx={...} />` renders all 10 built-in section types
+    (hero, text, feature, stats, cta, article-body, quote, author-bio,
+    related-posts, gallery) with zero hand-written mapper. SSR-first (safe in
+    React Server Components).
+  - `<PostHeader config={...} ctx={...} />` renders a post header from its
+    template config + the post's own fields.
+  - Consumer-controlled renderer registry: override any section type per-render
+    via the `renderers` prop, or app-wide via `registerSectionRenderer()`.
+    Resolution precedence: prop > global registry > built-in default > skip.
+  - Rich-text fields go through an injectable `options.sanitizeHtml` hook
+    (default identity; Actuate sanitizes on write, pass a sanitizer for
+    defense-in-depth or third-party HTML).
+  - A registry-drift guard test keeps the renderer map in lockstep with the
+    cms-core section registry, so no section type can ship without a renderer
+    (and vice-versa).