@unitninety/site-kit 1.6.4 → 1.6.6

package/src/components/Link.tsx

@@ -2,6 +2,8 @@ import NextLink from 'next/link'
 import { Children, createElement, type ReactNode } from 'react'
 import type { LinkRead } from '../elements'
 import { draftAttrs } from './draft'
+import { BlockLink } from './BlockLink'
+import { ID_RE } from '../elements/ids'
 export const isInternal = (href: string) => href.startsWith('/') && !href.startsWith('//')
 export function Link({ value, children, ...rest }: { value: LinkRead | null | undefined; children?: ReactNode } & Record<string, unknown>) {
   if (!value) return null
@@ -20,5 +22,10 @@ export function Link({ value, children, ...rest }: { value: LinkRead | null | un
   // element's props pass through). The href is always the value's.
   const tab: Record<string, unknown> = value.newTab ? { target: '_blank', rel: 'noopener' } : {}
   for (const key of ['target', 'rel'] as const) if (rest[key] !== undefined) tab[key] = rest[key]
-  return isInternal(value.href) && !(value.to && 'file' in value.to) ? createElement(NextLink, { ...attrs, href: value.href, ...tab } as never, label) : createElement('a', { ...attrs, href: value.href, ...tab }, label)
+  let generated = false
+  try {
+    const hash = decodeURIComponent(new URL(value.href, 'https://u90.invalid').hash.slice(1))
+    generated = hash.startsWith('u90-block-') && ID_RE.test(hash.slice(10))
+  } catch { /* malformed legacy fragments remain ordinary links */ }
+  return isInternal(value.href) && !(value.to && 'file' in value.to) ? createElement(generated ? BlockLink : NextLink, { ...attrs, href: value.href, ...tab } as never, label) : createElement('a', { ...attrs, href: value.href, ...tab }, label)
 }

package/src/components/block-navigation.ts

@@ -0,0 +1,24 @@
+/** A generated link's accepted navigation, shared with the destination renderer. */
+type BlockNavigation = { url: URL; scroll: boolean; expires: number }
+const pending = new WeakMap<Window, BlockNavigation>()
+
+export function requestBlockNavigation(win: Window, url: URL, scroll: boolean) {
+  pending.set(win, { url, scroll, expires: Date.now() + 10_000 })
+}
+
+export function clearBlockNavigation(win: Window) {
+  pending.delete(win)
+}
+
+export function arrivingBlockNavigation(win: Window): BlockNavigation | undefined {
+  const request = pending.get(win)
+  if (!request) return
+  if (Date.now() >= request.expires) { pending.delete(win); return }
+  const actual = new URL(win.location.href)
+  const expected = request.url
+  if (actual.origin !== expected.origin || actual.pathname !== expected.pathname || actual.search !== expected.search) return
+  // Next 16.4 caches the initial document fragment in its canonical route URL,
+  // then appends the requested fragment on a return navigation. Correct only a
+  // still-pending explicit request, never arbitrary fragment-containing URLs.
+  if (actual.hash === expected.hash || actual.hash.endsWith(expected.hash)) return request
+}

package/src/custom-code/fragments.ts

@@ -0,0 +1,64 @@
+import { parseFragment, type DefaultTreeAdapterTypes } from 'parse5'
+import type { CustomCodePlacement } from './index'
+
+type Node = DefaultTreeAdapterTypes.ChildNode
+export type CustomCodeElement = DefaultTreeAdapterTypes.Element
+const headTags = new Set(['script', 'style', 'meta', 'link'])
+const bodyTags = new Set(['script', 'style', 'link', 'noscript'])
+const fallbackTags = new Set(['iframe', 'img', 'div', 'span', 'p'])
+const voidTags = new Set(['meta', 'link', 'img'])
+const reservedAttributes = new Set(['children', 'dangerouslysetinnerhtml', 'suppresshydrationwarning', 'suppresscontenteditablewarning', 'key', 'ref'])
+const urlAttributes = new Set(['src', 'href', 'action', 'formaction', 'poster', 'background', 'cite', 'data', 'longdesc', 'manifest', 'xlink:href'])
+
+/** parse5 supplies HTML tokenization, decoded attribute values, and source spans. In addition
+ * to parser errors we require complete contiguous spans: HTML's normal error recovery can
+ * silently drop document wrappers/end tags or insert missing closing tags without an error. */
+export function parseCustomCodeFragment(source: string, placement: CustomCodePlacement): CustomCodeElement[] {
+  const fail = (reason: string): never => { throw new Error(`${placement}: ${reason}`) }
+  const fragment = parseFragment(source, {
+    scriptingEnabled: false, sourceCodeLocationInfo: true,
+    onParseError: (error) => fail(`malformed HTML (${error.code})`),
+  })
+  const visit = (nodes: Node[], start: number, end: number, fallback: boolean, rawText = false) => {
+    let cursor = start
+    for (const node of nodes) {
+      const loc = node.sourceCodeLocation
+      if (!loc || loc.startOffset !== cursor) fail('unsupported or malformed HTML was discarded by the parser')
+      cursor = loc!.endOffset
+      if (node.nodeName === '#comment') continue
+      if ('value' in node) {
+        if (!fallback && !rawText && node.value.trim()) fail('ordinary text is only supported inside noscript fallbacks')
+        continue
+      }
+      if (!('tagName' in node)) fail('document declarations are not supported')
+      const element = node as CustomCodeElement
+      const tag = element.tagName
+      const allowed = fallback ? fallbackTags : placement === 'head' ? headTags : bodyTags
+      if (!allowed.has(tag)) fail(`<${tag}> is not supported in this placement${fallback ? ' inside noscript' : ''}`)
+      const location = element.sourceCodeLocation!
+      if (!location.startTag || (!voidTags.has(tag) && !location.endTag)) fail(`<${tag}> requires explicit opening and closing tags`)
+      for (const { name, value } of element.attrs) {
+        if (name.startsWith('on')) fail(`event attribute ${name} is not supported`)
+        if (reservedAttributes.has(name)) fail(`reserved attribute ${name} is not supported`)
+        if (name === 'srcdoc' || name === 'srcset' || name === 'imagesrcset') fail(`attribute ${name} is not supported`)
+        if (name === 'style' && !fallback) fail('inline style attributes on resource tags are not supported; use a style element')
+        if (tag === 'meta' && name === 'http-equiv' && value.trim().toLowerCase() === 'refresh') fail('meta refresh is not supported')
+        if (urlAttributes.has(name)) {
+          // Reject whitespace/control characters and backslashes before URL parsing can repair them.
+          if (/[\u0000-\u0020\u007f\\]/u.test(value) || !(value.startsWith('/') && !value.startsWith('//') || /^https:\/\//i.test(value))) fail(`${name} must be an HTTPS or root-relative resource URL`)
+          try { new URL(value, 'https://custom-code.invalid') } catch { fail(`${name} is not a valid resource URL`) }
+        }
+      }
+      if (!voidTags.has(tag)) visit(element.childNodes, location.startTag!.endOffset, location.endTag!.startOffset, fallback || tag === 'noscript', tag === 'script' || tag === 'style')
+    }
+    if (cursor !== end) fail('unsupported or malformed HTML was discarded by the parser')
+  }
+  visit(fragment.childNodes, 0, source.length, false)
+  return fragment.childNodes.filter((node): node is CustomCodeElement => 'tagName' in node)
+}
+
+/** Retain raw text and fallback markup exactly, including HTML entities and JS comments. */
+export function fragmentInnerHtml(source: string, element: CustomCodeElement): string {
+  const location = element.sourceCodeLocation!
+  return location.endTag ? source.slice(location.startTag!.endOffset, location.endTag.startOffset) : ''
+}

package/src/custom-code/index.ts

@@ -0,0 +1,30 @@
+import { parseCustomCodeFragment } from './fragments'
+
+export type CustomCodePlacement = 'head' | 'bodyStart' | 'bodyEnd'
+export type CustomCode = Record<CustomCodePlacement, string>
+export type PublishedCustomCode = { version: 1; revision: number } & CustomCode
+export const EMPTY_CUSTOM_CODE: CustomCode = Object.freeze({ head: '', bodyStart: '', bodyEnd: '' })
+
+/** Server-safe validation only: never executes scripts or retrieves submitted URLs.
+ * Client forms should import types only, keeping the HTML parser on the server. */
+export function validateCustomCode(input: unknown): CustomCode {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('custom code: expected head, bodyStart and bodyEnd strings')
+  const fields = Object.keys(EMPTY_CUSTOM_CODE) as CustomCodePlacement[]
+  for (const key of Object.keys(input)) {
+    if (!fields.includes(key as CustomCodePlacement)) throw new Error(`${key}: unsupported custom code field`)
+  }
+  const result = { ...EMPTY_CUSTOM_CODE }
+  let total = 0
+  for (const field of fields) {
+    const value = (input as Record<string, unknown>)[field]
+    if (!Object.hasOwn(input, field) || typeof value !== 'string') throw new Error(`${field}: expected a string`)
+    const normalized = value.replace(/\r\n?/g, '\n')
+    const size = new TextEncoder().encode(normalized).length
+    if (size > 64 * 1024) throw new Error(`${field}: exceeds the 64 KiB UTF-8 limit`)
+    total += size
+    if (total > 128 * 1024) throw new Error(`${field}: exceeds the 128 KiB total UTF-8 limit`)
+    parseCustomCodeFragment(normalized, field)
+    result[field] = normalized
+  }
+  return result
+}

package/src/elements/blockAnchor.ts

@@ -0,0 +1,7 @@
+import { ID_RE } from './ids'
+
+/** The public fragment for a stored block identity; names and ordering never enter its address. */
+export function blockAnchor(id: string): string {
+  if (!ID_RE.test(id)) throw new Error('Invalid stored block identity')
+  return `u90-block-${id}`
+}

package/src/elements/declaration.ts

@@ -84,7 +84,7 @@ export const CollectionDeclSchema = z.strictObject({
     seen.add(name)
   })
 })
-export const SingleDeclSchema = z.strictObject({ key: z.string().regex(/^[a-z][a-zA-Z0-9_-]*$/), field: FieldDeclSchema })
+export const SingleDeclSchema = z.strictObject({ key: z.string().regex(/^[a-z][a-zA-Z0-9_-]*$/), field: FieldDeclSchema, editor: z.enum(['cms', 'canvas']).optional() })
 export const SchemaSchema = z.strictObject({ blocks: z.record(z.string(), BlockDeclSchema), collections: z.record(z.string(), CollectionDeclSchema), singles: z.record(z.string(), SingleDeclSchema) })
 
 type Where = 'block' | 'collection' | 'single'

package/src/elements/define.ts

@@ -140,7 +140,7 @@ export type CollectionDecl = {
   defaultSort?: { field: string; dir: 'asc' | 'desc' } | 'manual'
   order?: string[]
 }
-export type SingleDecl = { key: string; field: FieldDecl }
+export type SingleDecl = { key: string; field: FieldDecl; editor?: 'cms' | 'canvas' }
 export type Schema = {
   blocks: Record<string, BlockDecl>
   collections: Record<string, CollectionDecl>

package/src/elements/index.ts

@@ -33,3 +33,4 @@ export { translatableParts } from './ops/translatable'
 export { overlayKey, translatableLeaves, applyOverlay, type OverlayValues } from './ops/overlay'
 export { upgrade, UpgradeError, type UpgradeOptions } from './ops/upgrade'
 export { toJSONSchema } from './jsonSchema'
+export { blockAnchor } from './blockAnchor'

package/src/elements/ops/validate.ts

@@ -68,9 +68,16 @@ export function validate(schema: Schema, docDecl: DocumentDecl, doc: unknown, at
         const pointer = path.toPointer(opts.previous, here)
         const before = pointer === null ? undefined : valueAtPointer(opts.previous, pointer)
         if (before !== undefined)
-          for (const sub of decl.lock)
-            if (JSON.stringify(dig(before, sub)) !== JSON.stringify(dig(value, sub)))
+          for (const sub of decl.lock) {
+            // A blank fixed link label from an older editor may be restored only to the
+            // site's exact default. Other locked parts and deliberately cleared links stay fixed.
+            const restoresLabel = entry.id === 'u90/link' && sub === 'label' &&
+              record(before) && typeof before.label === 'string' && !before.label.trim() &&
+              record(decl.default) && typeof decl.default.label === 'string' && !!decl.default.label.trim() &&
+              dig(value, sub) === decl.default.label
+            if (!restoresLabel && JSON.stringify(dig(before, sub)) !== JSON.stringify(dig(value, sub)))
               push(here, { path: sub.split('.'), code: 'locked', message: 'This part is set by the site and cannot be changed here.' })
+          }
       }
       if (value !== undefined && value !== null) {
         const o = entry.options.safeParse(decl.options ?? {})

package/src/features/client/README.md

@@ -2,7 +2,7 @@
 
 The `@unitninety/site-kit/features` entry point targets Next 16.3.8–16.x and React 19.
 It uses Next's committed pathname updates; wrap `SiteFeatures` around the root layout's
-children from the first render, mount the server `ConsentDefaults` once before it, and import `@unitninety/site-kit/features/styles.css`. The internal pathname
+children from the first render and import `@unitninety/site-kit/features/styles.css`. The internal pathname
 reporter has its own Suspense boundary. Pure `features/contracts` has no Next dependency.
 No non-Next runtime support is claimed. The package's Next peer is optional for consumers
 using only contracts or server APIs, but required for the feature client entry point.
@@ -75,7 +75,6 @@ omitted at first capture; later settings changes cannot alter a retry.
 The scoped theme variables are `--u90-feature-background`, `--u90-feature-foreground`,
 `--u90-feature-accent`, `--u90-feature-radius`, and `--u90-feature-shadow`.
 
-See [consent setup](../consent/README.md) for the server root bootstrap, optional custom registration, remote authority, lifecycle limits and preferences hook. Consent does not reset the Feedback presentation, session or focus lifetime.
 
 ## Ask AI stock setup and remix
 

package/src/features/client/SiteFeatures.tsx

@@ -15,8 +15,6 @@ import type { FeedbackInput, PublicFeatureBase } from '../contracts'
 import { FeatureContext, type OverlayName } from './context'
 import { AskAiProvider } from './AskAiProvider'
 import { FeedbackProvider } from './FeedbackProvider'
-import { ConsentRuntime } from './ConsentRuntime'
-import type { CustomConsentRegistration } from '../consent/custom'
 import { acquireVerificationProof } from './verification'
 import type { VerificationAction } from '../contracts'
 import { createFeatureTransport, waitForSignal, type VisitorVerification } from './transport'
@@ -32,7 +30,6 @@ export type SiteFeaturesProps = {
   endpoint?: string
   components?: { AskAI?: ComponentType; Feedback?: ComponentType }
   verification?: VisitorVerification
-  customConsent?: CustomConsentRegistration
   children?: ReactNode
 }
 export function SiteFeatures(props: SiteFeaturesProps) {
@@ -43,7 +40,6 @@ function Runtime({
   endpoint,
   components,
   verification,
-  customConsent,
   children,
 }: SiteFeaturesProps) {
   const adapter = useRef(verification)
@@ -223,28 +219,22 @@ function Runtime({
   const Feedback = components?.Feedback ?? builtins.feedback
   return (
     <FeatureContext.Provider value={value}>
-      <ConsentRuntime
-        endpoint={endpoint ?? '/api/u90/features/v1'}
-        config={config}
-        customConsent={customConsent}
-      >
-        <AskAiProvider endpoint={endpoint ?? '/api/u90/features/v1'} getTransport={getTransport}>
-          <FeedbackProvider presentation={Feedback}>
-            {children}
-            <div className="u90-features">
-              <Suspense fallback={null}>{config?.enabled.askAi && AskAI && <AskAI />}</Suspense>
-              <div
-                className="u90-feature-announcement"
-                role="status"
-                aria-live="polite"
-                aria-atomic="true"
-              >
-                {error ?? announcement}
-              </div>
+      <AskAiProvider endpoint={endpoint ?? '/api/u90/features/v1'} getTransport={getTransport}>
+        <FeedbackProvider presentation={Feedback}>
+          {children}
+          <div className="u90-features">
+            <Suspense fallback={null}>{config?.enabled.askAi && AskAI && <AskAI />}</Suspense>
+            <div
+              className="u90-feature-announcement"
+              role="status"
+              aria-live="polite"
+              aria-atomic="true"
+            >
+              {error ?? announcement}
             </div>
-          </FeedbackProvider>
-        </AskAiProvider>
-      </ConsentRuntime>
+          </div>
+        </FeedbackProvider>
+      </AskAiProvider>
     </FeatureContext.Provider>
   )
 }

package/src/features/client/index.ts

@@ -12,12 +12,6 @@ export { FeatureClientError, type VisitorVerification } from './transport'
 
 export { useFeedback, type FeedbackController, type FeedbackAnswer } from './useFeedback'
 
-export { cookieScriptAdapter, normalizeCookieScript } from '../consent/cookieScript'
-export { customConsentAdapter, type CustomConsentRegistration } from '../consent/custom'
-
-export { useConsent, type ConsentController } from './useConsent'
-export { createConsentLoader } from '../consent/loader'
-
 export { useSiteSearch } from './useSiteSearch'
 
 export { useAskAI, type AskAiController } from './useAskAI'

package/src/features/client/verification.ts

@@ -3,6 +3,7 @@ import { useCallback } from 'react'
 import {
   ProofSchema,
   VerificationConfigSchema,
+  isUnconfiguredFormVerification,
   type VerificationAction,
   type VerificationConfig,
 } from '../contracts'
@@ -61,6 +62,8 @@ export async function acquireVerificationProof(
   options: { signal?: AbortSignal } = {},
 ): Promise<string | null> {
   const parsed = VerificationConfigSchema.parse(config)
+  options.signal?.throwIfAborted()
+  if (isUnconfiguredFormVerification(parsed, action)) return null
   if (parsed.readiness !== 'configured' || (parsed.mode !== 'disabled' && !parsed.siteKey))
     throw Error('Verification unavailable. Please retry or contact the site owner.')
   const signal = options.signal

package/src/features/contracts/base.ts

@@ -1,13 +1,12 @@
 import { VerificationConfigSchema, type VerificationConfig } from './verificationConfig'
 import { PublicAskAiWidgetSettingsSchema, type AskAiWidgetSettings } from './askAiSettings'
 import { z } from 'zod'
-import { PublicConsentInstallationSchema, type ConsentInstallation } from './consent'
 import { PublicFeedbackWidgetSettingsSchema, type FeedbackWidgetSettings } from './feedbackSettings'
 
 /** Visitor-feature wire version; independent of bridge and Site Kit package versions. */
 export const FEATURE_CONTRACT_VERSION = 1
 
-export type FeatureKey = 'search' | 'askAi' | 'feedback' | 'consent'
+export type FeatureKey = 'search' | 'askAi' | 'feedback'
 export type PageContext = { path: string; title?: string }
 export type FeatureFlags = Record<FeatureKey, boolean>
 export type PublicFeatureBase = {
@@ -17,7 +16,6 @@ export type PublicFeatureBase = {
   enabled: FeatureFlags
   askAi?: AskAiWidgetSettings
   feedback?: FeedbackWidgetSettings
-  consent?: ConsentInstallation
 }
 export type FeatureErrorCode =
   | 'invalid_request'
@@ -40,7 +38,6 @@ export const FeatureFlagsSchema = z.strictObject({
   search: z.boolean().default(false),
   askAi: z.boolean().default(false),
   feedback: z.boolean().default(false),
-  consent: z.boolean().default(false),
 })
 
 const PAGE_ORIGIN = 'https://page-context.invalid'
@@ -71,7 +68,6 @@ export const PublicFeatureBaseSchema = z.looseObject({
   enabled: FeatureFlagsSchema.loose(),
   askAi: PublicAskAiWidgetSettingsSchema.optional(),
   feedback: PublicFeedbackWidgetSettingsSchema.optional(),
-  consent: PublicConsentInstallationSchema.optional(),
   readiness: z
     .object({
       search: z.object({

package/src/features/contracts/index.ts

@@ -25,26 +25,6 @@ export {
 } from './feedbackSettings'
 export type { FeedbackWidgetSettings } from './feedbackSettings'
 
-export {
-  ConsentStateSchema,
-  ConsentInstallationSchema,
-  PublicConsentInstallationSchema,
-  ManagedIntegrationSchema,
-  deniedConsentState,
-  isCookieScriptURL,
-  classifyManagedIntegration,
-  consentChangeRequiresCodeWrite,
-} from './consent'
-export type {
-  ConsentState,
-  ConsentAdapter,
-  ConsentCategory,
-  ConsentInstallation,
-  ManagedIntegration,
-  IntegrationDriver,
-  ManagedIntegrationClassification,
-  ConsentConfiguration,
-} from './consent'
 
 export * from './knowledge'
 export * from './search'

package/src/features/contracts/verificationConfig.ts

@@ -7,3 +7,10 @@ export const VerificationConfigSchema = z.strictObject({
   revision: z.int().nonnegative(),
 })
 export type VerificationConfig = z.infer<typeof VerificationConfigSchema>
+
+/** An absent form CAPTCHA connection is optional; broken or configured connections are not. */
+export const isUnconfiguredFormVerification = (config: VerificationConfig, action?: string) =>
+  action === 'form_submit' &&
+  config.mode === 'managed' &&
+  config.readiness === 'setup_required' &&
+  config.siteKey === null

package/src/features/server/gateway.ts

@@ -185,20 +185,18 @@ export function createSiteFeatures(options: SiteFeaturesOptions) {
       if (operation === 'config') {
         const parsed = PublicFeatureBaseSchema.safeParse(await exchange())
         if (!parsed.success) throw new FeatureFailure('unavailable')
-        const { version, revision, enabled, feedback, consent, askAi, verification } = parsed.data
+        const { version, revision, enabled, feedback, askAi, verification } = parsed.data
         return Response.json(
           {
             version,
             revision,
             ...(verification ? { verification } : {}),
-            ...(consent ? { consent } : {}),
             feedback: FeedbackWidgetSettingsSchema.parse(feedback ?? {}),
             askAi: AskAiWidgetSettingsSchema.parse(askAi ?? {}),
             enabled: {
               search: enabled.search,
               askAi: enabled.askAi,
               feedback: enabled.feedback,
-              consent: enabled.consent,
             },
           },
           { headers: { 'cache-control': 'no-store' } },

package/src/features/server/index.ts

@@ -2,5 +2,3 @@ import 'server-only'
 export { createSiteFeatures } from './gateway'
 export type { FeatureEnvironment, VerifyVisitor, SiteFeaturesOptions } from './gateway'
 export { createRecaptchaVerifier } from './verifyVisitor'
-
-export { ConsentDefaults } from './ConsentDefaults'

package/src/legacy/cli.mjs

@@ -2,7 +2,7 @@
 import { readFile, writeFile } from 'node:fs/promises'
 
 /**
- * `npx --yes @unitninety/u90@1.0.4 pair <code>` — the one command an operator hands over. The u90 tool
+ * `npx --yes @unitninety/u90@1.0.6 pair <code>` — the one command an operator hands over. The u90 tool
  * runs this file for `u90 pair`. The command is scoped and pinned because an unscoped name, run in a
  * repository with no local bin, fetches whatever package npm holds under that name.
  *
@@ -115,7 +115,7 @@ const run = async () => {
   const args = process.argv.slice(2)
 
   if (args[0] !== 'pair' || !args[1]) {
-    fail('Usage: npx --yes @unitninety/u90@1.0.4 pair <code> --site https://example.com [--platform https://cms…]')
+    fail('Usage: npx --yes @unitninety/u90@1.0.6 pair <code> --site https://example.com [--platform https://cms…]')
   }
 
   const code = args[1]

package/src/legacy/content.ts

@@ -360,7 +360,7 @@ export const createContentClient = ({
             : !platformUrl
               ? 'PLATFORM_URL is unset'
               : 'PAYLOAD_API_KEY is unset'
-        }. Every page will render its committed fallback copy, and every collection route will 404. Set it in the site's environment — \`npx --yes @unitninety/u90@1.0.4 pair\` writes both.`,
+        }. Every page will render its committed fallback copy, and every collection route will 404. Set it in the site's environment — \`npx --yes @unitninety/u90@1.0.6 pair\` writes both.`,
       )
     }
     return true

package/src/server/BlockAnchors.tsx

@@ -0,0 +1,92 @@
+'use client'
+
+import { useEffect, useRef, type ReactNode } from 'react'
+import { ID_RE } from '../elements/ids'
+import { arrivingBlockNavigation, clearBlockNavigation } from '../components/block-navigation'
+
+/** Install navigation only for SDK-marked destinations within this render tree. */
+export function installBlockAnchors(root: HTMLElement): () => void {
+  const doc = root.ownerDocument
+  const win = doc.defaultView!
+  let observer: MutationObserver | undefined
+  let timeout: number | undefined
+  const stopWaiting = () => {
+    observer?.disconnect()
+    observer = undefined
+    win.clearTimeout(timeout)
+  }
+  const identity = (hash: string) => {
+    try {
+      const id = decodeURIComponent(hash.slice(1))
+      return id.startsWith('u90-block-') && ID_RE.test(id.slice(10)) ? id : null
+    } catch { return null }
+  }
+  const find = (id: string) => {
+    const target = doc.getElementById(id)
+    return target && root.contains(target) && target.hasAttribute('data-u90-anchor') ? target : null
+  }
+  const scroll = (id: string) => {
+    const target = find(id)
+    if (!target) return false
+    const request = arrivingBlockNavigation(win)
+    if (request) {
+      clearBlockNavigation(win)
+      if (win.location.href !== request.url.href) win.history.replaceState(null, '', request.url.href)
+      if (!request.scroll) return true
+    }
+    // getClientRects skips display:contents and non-rendered descendants, retaining
+    // native scrollIntoView handling of the actual child's scroll-margin.
+    const child = Array.from(target.querySelectorAll<HTMLElement>('*')).find(node => node.getClientRects().length > 0)
+    if (!child) return false
+    const event = new win.CustomEvent('u90:block-anchor', { bubbles: true, cancelable: true, detail: { target: child } })
+    if (child.dispatchEvent(event)) child.scrollIntoView({ block: 'start' })
+    return true
+  }
+  const requestedIdentity = () => identity(arrivingBlockNavigation(win)?.url.hash ?? win.location.hash)
+  const navigate = () => {
+    stopWaiting()
+    const id = requestedIdentity()
+    if (!id || scroll(id)) return
+    // Streaming/client navigation can deliver the destination after the hash.
+    // Observe only this tree, only for a requested destination, for at most 10s.
+    observer = new win.MutationObserver(() => { if (requestedIdentity() !== id || scroll(id)) stopWaiting() })
+    observer.observe(root, { childList: true, subtree: true, attributes: true, attributeFilter: ['id', 'style', 'class', 'hidden'] })
+    timeout = win.setTimeout(stopWaiting, 10_000)
+  }
+  const click = (event: MouseEvent) => {
+    if (event.defaultPrevented || event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return
+    const node = event.target
+    if (!(node instanceof win.Element)) return
+    const link = node.closest('a[href]')
+    if (!link || link.hasAttribute('download') || (link.getAttribute('target') && link.getAttribute('target') !== '_self')) return
+    let url: URL
+    try { url = new URL(link.getAttribute('href')!, doc.baseURI) } catch { return }
+    if (url.origin !== win.location.origin || url.pathname !== win.location.pathname || url.search !== win.location.search) return
+    const id = identity(url.hash)
+    if (!id) return
+    const existing = doc.getElementById(id)
+    if (existing && !find(id)) return
+    event.preventDefault()
+    if (url.hash !== win.location.hash) win.history.pushState(null, '', url.href)
+    navigate()
+  }
+  doc.addEventListener('click', click)
+  doc.addEventListener('u90:block-navigate', navigate)
+  win.addEventListener('hashchange', navigate)
+  win.addEventListener('popstate', navigate)
+  navigate()
+  return () => {
+    stopWaiting()
+    doc.removeEventListener('click', click)
+    doc.removeEventListener('u90:block-navigate', navigate)
+    win.removeEventListener('hashchange', navigate)
+    win.removeEventListener('popstate', navigate)
+  }
+}
+
+/** Server-rendered children remain server components across this client boundary. */
+export function BlockAnchors({ children }: { children: ReactNode }) {
+  const root = useRef<HTMLDivElement>(null)
+  useEffect(() => root.current ? installBlockAnchors(root.current) : undefined, [children])
+  return <div ref={root} style={{ display: 'contents' }}>{children}</div>
+}

package/src/server/CustomCode.tsx

@@ -0,0 +1,29 @@
+import { createElement, type ReactNode } from 'react'
+import type { CustomCodePlacement, PublishedCustomCode } from '../custom-code'
+import { fragmentInnerHtml, parseCustomCodeFragment } from '../custom-code/fragments'
+
+const names: Record<string, string> = {
+  class: 'className', charset: 'charSet', 'http-equiv': 'httpEquiv', crossorigin: 'crossOrigin',
+  referrerpolicy: 'referrerPolicy', fetchpriority: 'fetchPriority', nomodule: 'noModule',
+  itemprop: 'itemProp', itemscope: 'itemScope', itemtype: 'itemType', itemid: 'itemID', itemref: 'itemRef',
+  hreflang: 'hrefLang', tabindex: 'tabIndex', accesskey: 'accessKey', contenteditable: 'contentEditable',
+}
+const booleans = new Set(['async', 'defer', 'nomodule', 'disabled', 'hidden', 'itemscope', 'inert', 'autofocus'])
+
+/** Initial-document native elements, never next/script or a hydration-time injector.
+ * React hoists/deduplicates async scripts and links unless itemProp is present. An empty
+ * microdata token opts these resources out without adding a property; preserve supplied values.
+ * Metadata intentionally retains React's head handling (itemprop would conflict with name/etc.).
+ * Inline script/style bytes and validated noscript fallback HTML bypass React text escaping. */
+export function U90CustomCode({ code, placement }: { code: PublishedCustomCode | null; placement: CustomCodePlacement }): ReactNode {
+  if (!code || !code[placement]) return null
+  const source = code[placement]
+  return parseCustomCodeFragment(source, placement).map((element, index) => {
+    const props: Record<string, unknown> = { key: index }
+    for (const attr of element.attrs) props[names[attr.name] ?? attr.name] = booleans.has(attr.name) ? true : attr.value
+    const tag = element.tagName
+    if ((tag === 'link' || tag === 'script' && props.src && props.async || tag === 'style' && props.href && props.precedence) && props.itemProp === undefined) props.itemProp = ''
+    if (tag !== 'meta' && tag !== 'link') props.dangerouslySetInnerHTML = { __html: fragmentInnerHtml(source, element) }
+    return createElement(tag, props)
+  })
+}

package/src/server/index.ts

@@ -3,4 +3,5 @@ export { PREVIEW_COOKIE, type NextAdapters } from './adapters'
 export { DRAFT_LOCALE_PARAM } from '../elements'
 export type { RouteRead } from '../site'
 export { U90Bridge } from '../bridge/U90Bridge'
+export { U90CustomCode } from './CustomCode'
 export type { TestPreviewContext } from '../test-preview/runtime'

package/src/server/read.ts

@@ -4,6 +4,7 @@ import type { SiteLanguages } from '../languages/routing'
 import { sourceMediaPaths } from '../test-preview/media'
 import type { TestPreviewContext, TestPreviewRuntime } from '../test-preview/runtime'
 import type { NextAdapters } from './adapters'
+import type { PublishedCustomCode } from '../custom-code'
 
 export type Env = Partial<Record<'PLATFORM_URL' | 'PAYLOAD_API_KEY' | 'REVALIDATE_SECRET' | 'SITE_URL' | 'VERCEL_DEPLOYMENT_ID' | 'VERCEL_URL' | 'U90_TEST_PREVIEW_BUILD_ID', string>>
 /** `running` is the running code's `manifestHash`, compared with each reply's to tell whether the platform is behind a deploy. */
@@ -173,6 +174,18 @@ export function createRead(d: Deps) {
       if (!d.adapters.draftEnabled || await draftEnabled(instance)) await currentDraft()
       return siteOnce()
     },
+    /** Published initial-document code uses the same site-tagged request as metadata/languages.
+     * Authenticate preview context before suppressing output, including custom draft adapters. */
+    customCode: async (): Promise<PublishedCustomCode | null> => {
+      if (!d.adapters.draftEnabled) {
+        if (await currentDraft()) return null
+      } else if (await draftEnabled(instance)) {
+        await currentDraft()
+        return null
+      }
+      if (!d.env.PLATFORM_URL) return null
+      return (await siteOnce()).customCode ?? null
+    },
     /**
      * The site's languages, from the same per-request `/site` read as `site()`: cached until `site` is revalidated outside
      * draft, read once per request in draft. Null for a site with no platform, one with no languages, or a `/site` that