@wildo-ai/saas-website 1.1.1

package/src/astro/pick-labels-for-page.ts

@@ -0,0 +1,85 @@
+import type { WebsiteLabelKey } from '../schemas/label-keys/website-label-key.schemas';
+import type { WebsitePageManifest } from '../schemas/manifests/website-page-manifest.shared.schemas';
+import type { LabelPack } from '../schemas/validators/label-pack.validator';
+
+/**
+ * @wildo_source:part:start saas.website.astro.pick-labels-for-page facet:layer:astro facet:family:website
+ *
+ * `pickLabelsForPage(pack, manifest)` — return the subset of a loaded
+ * label pack that the given page actually consumes at render time.
+ *
+ * **Why this exists**: the per-page bridge island carries its
+ * `labelPack` prop across the SSR → client hydration boundary as
+ * serialized JSON inside the `<astro-island props=...>` attribute.
+ * Shipping the entire site's pack on every page (every locale × every
+ * page = every visitor pays the full pack) inflates the static HTML
+ * payload by ~70% on a typical marketing surface where each page reads
+ * only its own slice plus the shared chrome slice.
+ *
+ * **Filter rule** (matches the runtime contract enforced by
+ * `useWebsiteLabel` / `useWebsiteLabelByKey`):
+ *   - Keep keys starting with `website.<manifest.ref>.` — every key a
+ *     `useWebsiteLabel(slot)` call inside any of this page's sections
+ *     can ever resolve to (the hook composes
+ *     `website.<pageRef>.<sectionRef>.<slot>`).
+ *   - Keep keys starting with `website.chrome.` — the synthetic
+ *     namespace site-wide chrome (header / footer) reads via
+ *     `useWebsiteLabelByKey(absoluteKey)`. The chrome contract is
+ *     declared on `WebsiteRootConfig.chromeLabelKeys` and validated
+ *     by the label-pack validator.
+ *
+ * **What gets dropped**: every `website.<otherPage>.…` key. A page
+ * cannot legitimately read another page's labels through the hook
+ * surface — the hook would either throw (`useWebsiteLabel`) or
+ * surface a missing-key diagnostic (`useWebsiteLabelByKey`) — so
+ * dropping those keys is observably safe.
+ *
+ * **Why prefix-based** (vs. walking `expectedKeysBySectionRef` for an
+ * exact key list): prefix matching is O(N) over `Object.entries(pack)`
+ * with no extra inputs threaded through `loadWebsitePageRuntime`. An
+ * exact-list filter would need to know the section-key map at request
+ * time, forcing every consumer's `.astro` page to import the
+ * collected map — extra config-surface for a tighter filter that
+ * saves an additional handful of bytes (the section keys for the
+ * page would already match the prefix).
+ *
+ * **Pure**: no I/O, no observable side-effects. Returns a fresh
+ * object — the input `pack` reference is not mutated.
+ *
+ * @param pack The full loaded label pack for the active locale.
+ * @param manifest The page manifest being rendered (drives the
+ *                 `website.<manifest.ref>.*` page-own prefix).
+ * @param explicitKeys OPTIONAL allow-list of additional fully-composed
+ *                     label keys to keep regardless of prefix. Used by
+ *                     the framework to guarantee that
+ *                     `WebsiteRootConfig.skipToMainContentLabelKey`
+ *                     reaches the bridge even if a consumer chose to
+ *                     namespace it outside `website.chrome.*` (the
+ *                     framework MUST be able to render the skip link
+ *                     on every page in every locale — Phase 6 audit
+ *                     fix M-α).
+ */
+export function pickLabelsForPage(
+  pack: LabelPack,
+  manifest: WebsitePageManifest,
+  explicitKeys: readonly WebsiteLabelKey[] = [],
+): LabelPack {
+  const pagePrefix = `website.${manifest.ref as unknown as string}.`;
+  const chromePrefix = 'website.chrome.';
+  const explicitKeySet = new Set<string>(
+    explicitKeys.map((key) => key as unknown as string),
+  );
+
+  const filtered: LabelPack = {};
+  for (const [key, value] of Object.entries(pack)) {
+    if (
+      key.startsWith(pagePrefix) ||
+      key.startsWith(chromePrefix) ||
+      explicitKeySet.has(key)
+    ) {
+      filtered[key] = value;
+    }
+  }
+  return filtered;
+}
+/** @wildo_source:part:end saas.website.astro.pick-labels-for-page */

package/src/astro/robots-renderer.ts

@@ -0,0 +1,171 @@
+import type {
+  WebsiteRobotsConfig,
+} from '../schemas/manifests/website-root-config.shared.schemas';
+
+import type { WebsiteSiteContext } from './website-site-context';
+
+/**
+ * @wildo_source:part:start saas.website.astro.robots-renderer facet:layer:astro facet:family:website
+ *
+ * `renderRobotsTxt(siteContext)` — pure string builder for the
+ * marketing site's `robots.txt` body. The consumer wires a thin
+ * `src/pages/robots.txt.ts` Astro endpoint that imports this helper
+ * + `WEBSITE_SITE_CONTEXT` and returns its output as a `Response`
+ * with `Content-Type: text/plain` (see `website-seo-aeo-geo` SKILL).
+ *
+ * # Why a pure string builder (not an Astro component)
+ *
+ * Same rationale as `renderWebsitePageHeadHtml`:
+ *   1. Pure TypeScript ships through the `@wildo-ai/saas-website/astro`
+ *      subpath barrel (Astro components do not).
+ *   2. Vitest-friendly — every policy permutation is asserted
+ *      against the returned string without an Astro test harness.
+ *   3. The Astro endpoint stays a 3-line shim the consumer can
+ *      audit at a glance.
+ *
+ * # Output shape
+ *
+ * The emitted text follows the de-facto `robots.txt` ordering
+ * (RFC 9309 §2 + Google's published guidance):
+ *
+ *   1. Per-bot blocks for `allowedCrawlers` (deny-by-default
+ *      direction) — each named bot gets its own `User-agent: <bot>`
+ *      + `Allow: /` block.
+ *   2. Per-bot blocks for `disallowedCrawlers` (allow-by-default
+ *      direction) — each named bot gets its own `User-agent: <bot>`
+ *      + `Disallow: /` block.
+ *   3. Catch-all `User-agent: *` block carrying the site-wide
+ *      `policy` (`Disallow: /` if `policy === 'noindex'` OR if
+ *      `allowedCrawlers` is set, otherwise nothing) and any
+ *      `disallow[]` path-prefix entries.
+ *   4. `Sitemap: <publicOrigin>/sitemap-index.xml` footer when
+ *      `seo.sitemap?.enabled !== false` (defaults to `true`).
+ *      `@astrojs/sitemap` emits `sitemap-index.xml` regardless of
+ *      whether the site has one or many sitemap files (the index
+ *      is always-present per the plugin's contract), so this is
+ *      the stable URL to advertise.
+ *
+ * # Mutual-exclusion invariant
+ *
+ * `WebsiteRobotsConfigSchema.superRefine` already guarantees
+ * `allowedCrawlers` and `disallowedCrawlers` are NOT both set, so
+ * step 1 and step 2 above are mutually exclusive at the input
+ * layer. The string builder is defensive (handles both being unset)
+ * but does NOT re-validate the invariant.
+ *
+ * # Why we always emit `Sitemap:` footer when `enabled !== false`
+ *
+ * The `Sitemap:` directive is independent from any `User-agent`
+ * block — it is a top-level signal to any crawler that the site
+ * publishes a sitemap. Even when the catch-all policy is
+ * `Disallow: /` (e.g. `policy === 'noindex'`), the `Sitemap:` line
+ * stays useful: a crawler that ignores `noindex` (Bing was famous
+ * for this) at least has a single canonical URL list to consult,
+ * and human readers of `robots.txt` see the publication contract
+ * intact.
+ *
+ * # Failure modes
+ *
+ * - `siteContext.websiteConfig.publicOrigin` undefined → throws.
+ *   The marketing-site origin is the SINGLE source of truth for
+ *   absolute URL composition (see `WildoMarketingWebsiteConfig`
+ *   JSDoc); a missing origin is a configuration error, not a
+ *   silent fallback opportunity.
+ *
+ * @example
+ * ```ts
+ * // examples/<app>/website/src/pages/robots.txt.ts
+ * import type { APIRoute } from 'astro';
+ * import { renderRobotsTxt } from '@wildo-ai/saas-website/astro';
+ * import { WEBSITE_SITE_CONTEXT } from '@/website-site-context';
+ *
+ * export const GET: APIRoute = () =>
+ *   new Response(renderRobotsTxt(WEBSITE_SITE_CONTEXT), {
+ *     headers: { 'Content-Type': 'text/plain; charset=utf-8' },
+ *   });
+ * ```
+ */
+export function renderRobotsTxt(siteContext: WebsiteSiteContext): string {
+  const { rootConfig, websiteConfig } = siteContext;
+
+  if (!websiteConfig.publicOrigin) {
+    throw new Error(
+      'renderRobotsTxt: WildoMarketingWebsiteConfig.publicOrigin is required to compose the absolute Sitemap: URL. Author it in your service\'s `wildo.website.config.ts`.',
+    );
+  }
+
+  const robots: WebsiteRobotsConfig | undefined = rootConfig.seo.robots;
+  const policy: 'index' | 'noindex' = robots?.policy ?? 'index';
+  const allowedCrawlers = robots?.allowedCrawlers ?? [];
+  const disallowedCrawlers = robots?.disallowedCrawlers ?? [];
+  const disallow = robots?.disallow ?? [];
+
+  const blocks: string[] = [];
+
+  /**
+   * Block 1 — per-bot `Allow: /` for the deny-by-default direction.
+   * Empty when `allowedCrawlers` is unset (the dominant case).
+   */
+  for (const bot of allowedCrawlers) {
+    blocks.push(`User-agent: ${bot}\nAllow: /`);
+  }
+
+  /**
+   * Block 2 — per-bot `Disallow: /` for the allow-by-default
+   * direction. Empty when `disallowedCrawlers` is unset (the
+   * dominant case for a public marketing site).
+   */
+  for (const bot of disallowedCrawlers) {
+    blocks.push(`User-agent: ${bot}\nDisallow: /`);
+  }
+
+  /**
+   * Block 3 — catch-all `User-agent: *`. Two policy-driven shapes:
+   *   - `noindex` → `Disallow: /` (the site-wide closure).
+   *   - `index` (default) → `Disallow:` is the spec-canonical "allow
+   *     everything" line; combined with any per-path `Disallow: <path>`
+   *     entries from `disallow[]`. When `allowedCrawlers` is set, the
+   *     catch-all also closes the rest of the crawler universe with
+   *     `Disallow: /` so the named bots are the ONLY ones permitted.
+   */
+  const catchAllLines: string[] = ['User-agent: *'];
+  if (policy === 'noindex' || allowedCrawlers.length > 0) {
+    catchAllLines.push('Disallow: /');
+  } else if (disallow.length === 0) {
+    /**
+     * Spec-canonical "allow everything" — `Disallow:` with no path.
+     * Some crawlers treat the absence of any `Disallow:` line as
+     * undefined behavior; an explicit empty Disallow is the safe
+     * shape.
+     */
+    catchAllLines.push('Disallow:');
+  }
+  for (const path of disallow) {
+    catchAllLines.push(`Disallow: ${path}`);
+  }
+  blocks.push(catchAllLines.join('\n'));
+
+  /**
+   * Block 4 — `Sitemap:` footer, advertised whenever sitemap
+   * emission is enabled (the marketing-site default). See file
+   * preamble for why we always advertise `sitemap-index.xml` as
+   * the stable URL.
+   */
+  const sitemapEnabled = rootConfig.seo.sitemap?.enabled ?? true;
+  if (sitemapEnabled) {
+    /**
+     * Trim trailing slash on the origin to avoid emitting
+     * `https://example.com//sitemap-index.xml`. `URL` constructor
+     * is overkill for a single concat; the regex is enough.
+     */
+    const origin = websiteConfig.publicOrigin.replace(/\/+$/, '');
+    blocks.push(`Sitemap: ${origin}/sitemap-index.xml`);
+  }
+
+  /**
+   * Spec-conformant trailing newline. Some crawler parsers tolerate
+   * its absence; emitting it is universally safe.
+   */
+  return `${blocks.join('\n\n')}\n`;
+}
+/** @wildo_source:part:end saas.website.astro.robots-renderer */

package/src/astro/sitemap-coverage.ts

@@ -0,0 +1,186 @@
+import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
+
+import { buildLocalizedRoutePath } from '../core/routing/internal-routing.utils';
+import type { WebsitePageManifest } from '../schemas/manifests/website-page-manifest.shared.schemas';
+
+import type { WebsiteSiteContext } from './website-site-context';
+
+/**
+ * @wildo_source:part:start saas.website.astro.sitemap-coverage facet:layer:astro facet:family:website
+ *
+ * `enumerateMarketingPageSitemapUrls(siteContext)` — pure helper that
+ * returns every (page-manifest × locale) absolute URL the marketing
+ * site's `sitemap.xml` MUST advertise, paired with its hreflang
+ * alternates.
+ *
+ * # Why this helper exists (vs leaning entirely on `@astrojs/sitemap`)
+ *
+ * `@astrojs/sitemap` (the official Astro plugin) auto-discovers every
+ * page Astro emits and emits a `sitemap-index.xml` + sub-sitemaps at
+ * build time. That covers the dominant case (every page in
+ * `src/pages/**` ships in the sitemap). What it does NOT cover by
+ * itself:
+ *
+ *   1. **Coverage enforcement at unit-test time.** The plugin runs
+ *      during `astro build`; vitest cannot exercise it without
+ *      booting the full Astro pipeline. This helper is the testable
+ *      surface — a regression that drops a manifest-registered route
+ *      from the expected URL set fails fast in vitest, well before
+ *      the `astro build` step would surface it (and even then only
+ *      via end-to-end inspection of the emitted XML).
+ *   2. **Programmatic page registration.** Future framework-owned
+ *      features that synthesize routes outside Astro's
+ *      file-based router (e.g. data-driven landing variants) need an
+ *      explicit URL list to pass into `@astrojs/sitemap`'s
+ *      `customPages` config. This helper is the canonical place to
+ *      compute that list — consumers spread the result into the
+ *      plugin config without re-deriving the locale × route logic.
+ *   3. **Cross-check.** The same site context that drives the head
+ *      renderer drives this enumeration; a divergence between
+ *      "what the head renderer thinks the canonical URL set is" and
+ *      "what the sitemap publishes" is a silent drift surface this
+ *      helper makes auditable.
+ *
+ * # Output shape
+ *
+ * Each entry carries:
+ *   - `url` — the absolute canonical URL (no trailing slash, matches
+ *     `<link rel="canonical">` output of `renderWebsitePageHeadHtml`).
+ *   - `pageRef` — the page-manifest `ref` (debug + grouping aid).
+ *   - `routePath` — the manifest-declared `routePath` (debug + grouping aid).
+ *   - `locale` — the URL's language.
+ *   - `alternates` — every other locale's URL for the SAME page,
+ *     emitted as `xhtml:link rel="alternate" hreflang` entries inside
+ *     the sitemap (single-sitemap-with-hreflang shape, per Google's
+ *     recommended sitemap format).
+ *
+ * # Routing convention (matches `buildLocalizedRoutePath`)
+ *
+ * Default locale mounts at the un-prefixed path (`/`, `/pricing`);
+ * other locales sit under `/<locale>/…`. The helper delegates to
+ * `buildLocalizedRoutePath` so a future change to the routing
+ * convention lands in one file rather than two.
+ *
+ * # What this helper does NOT enumerate
+ *
+ * - **Blog post slugs.** Blog posts share ONE page-manifest ref
+ *   (`BLOG_POST_PAGE_REF`) but materialize as N URLs — one per
+ *   `(slug, locale)` MDX file. The MDX file system is the
+ *   source-of-truth for blog URLs, NOT the page manifest. Astro's
+ *   file-based router auto-discovers each blog `[slug].astro` route
+ *   and `@astrojs/sitemap` auto-publishes them. A future helper
+ *   (`enumerateBlogPostSitemapUrls(...)`) can address the same
+ *   coverage-enforcement gap for the blog surface specifically.
+ * - **Static `.astro` pages without a page manifest.** If a consumer
+ *   authors a page directly in `src/pages/` without registering a
+ *   manifest in `WebsiteRootConfig.pageManifests`, this helper will
+ *   not list it (and `renderWebsitePageHeadHtml` cannot render its
+ *   `<head>` either). The framework convention is "every public
+ *   page has a manifest" — pages without manifests are a label-pack
+ *   discipline regression and surface separately via
+ *   `assertLabelPacksValid`.
+ */
+export interface MarketingPageSitemapEntry {
+  /** Absolute canonical URL, no trailing slash. */
+  readonly url: string;
+  /** The page-manifest `ref` (branded string in the source schema). */
+  readonly pageRef: string;
+  /** The manifest-declared `routePath` (always starts with `/`). */
+  readonly routePath: string;
+  /** The URL's language. */
+  readonly locale: AvailableLanguage;
+  /**
+   * Every OTHER locale's URL for the same page, suitable for emitting
+   * `xhtml:link rel="alternate" hreflang` entries inside the sitemap.
+   * Includes an `x-default` synthesized from the default-locale URL
+   * (Google's i18n discoverability convention; matches the head
+   * renderer's hreflang output).
+   */
+  readonly alternates: readonly { readonly hreflang: string; readonly url: string }[];
+}
+
+export function enumerateMarketingPageSitemapUrls(
+  siteContext: WebsiteSiteContext,
+): readonly MarketingPageSitemapEntry[] {
+  const { rootConfig, websiteConfig } = siteContext;
+
+  if (!websiteConfig.publicOrigin) {
+    throw new Error(
+      'enumerateMarketingPageSitemapUrls: WildoMarketingWebsiteConfig.publicOrigin is required to compose absolute sitemap URLs. Author it in your service\'s `wildo.website.config.ts`.',
+    );
+  }
+
+  /**
+   * Trim trailing slash defensively (the schema-level refinement
+   * already rejects them, but the helper is consumed in synthetic
+   * test contexts that bypass the parser).
+   */
+  const origin = websiteConfig.publicOrigin.replace(/\/+$/, '');
+  const defaultLocale = websiteConfig.defaultLocale;
+  const locales: readonly AvailableLanguage[] = websiteConfig.locales.map(
+    (entry: { locale: AvailableLanguage }) => entry.locale,
+  );
+
+  const entries: MarketingPageSitemapEntry[] = [];
+
+  for (const manifest of rootConfig.pageManifests as readonly WebsitePageManifest[]) {
+    const routePath = manifest.routePath as unknown as string;
+    const pageRef = manifest.ref as unknown as string;
+
+    /**
+     * Pre-compute every locale's URL for this page once — each entry
+     * needs the full set as its `alternates` (with itself excluded
+     * later if/when the consumer wants the strict
+     * "alternates-don't-include-self" shape; today we keep the full
+     * set + add `x-default` for parity with the head renderer's
+     * hreflang output).
+     */
+    const urlsByLocale = new Map<AvailableLanguage, string>();
+    for (const locale of locales) {
+      const localizedPath = buildLocalizedRoutePath({ locale, defaultLocale, routePath });
+      urlsByLocale.set(locale, `${origin}${localizedPath}`);
+    }
+
+    const defaultLocaleUrl = urlsByLocale.get(defaultLocale);
+    if (defaultLocaleUrl === undefined) {
+      throw new Error(
+        `enumerateMarketingPageSitemapUrls: defaultLocale "${String(defaultLocale)}" is missing from WildoMarketingWebsiteConfig.locales (page "${pageRef}"). This is a configuration invariant — locales[] must include the default locale.`,
+      );
+    }
+
+    for (const locale of locales) {
+      const url = urlsByLocale.get(locale);
+      if (url === undefined) {
+        throw new Error(
+          `enumerateMarketingPageSitemapUrls: missing computed URL for locale "${String(locale)}" on page "${pageRef}" (internal invariant violation).`,
+        );
+      }
+
+      const alternates: { hreflang: string; url: string }[] = [];
+      for (const altLocale of locales) {
+        const altUrl = urlsByLocale.get(altLocale);
+        if (altUrl !== undefined) {
+          alternates.push({ hreflang: String(altLocale), url: altUrl });
+        }
+      }
+      /**
+       * `x-default` — Google's hreflang convention for "the URL to
+       * serve when no locale signal is available". The marketing-site
+       * convention (default locale at the un-prefixed path) makes the
+       * default-locale URL the right `x-default` target.
+       */
+      alternates.push({ hreflang: 'x-default', url: defaultLocaleUrl });
+
+      entries.push({
+        url,
+        pageRef,
+        routePath,
+        locale,
+        alternates,
+      });
+    }
+  }
+
+  return entries;
+}
+/** @wildo_source:part:end saas.website.astro.sitemap-coverage */

package/src/astro/structured-data.renderer.ts

@@ -0,0 +1,171 @@
+import type {
+  WebsiteStructuredDataPayload,
+  WebsiteStructuredDataReturn,
+} from '../schemas/structured-data/website-structured-data.shared.schemas';
+import type { WebsiteSectionDefinition } from '../schemas/sections/website-section-definition.shared.schemas';
+
+/**
+ * @wildo_source:part:start saas.website.astro.structured-data-renderer facet:layer:astro facet:family:website
+ *
+ * `renderPageStructuredData()` — collects every section's
+ * `getStructuredData()` return + any explicit page-level payloads,
+ * normalizes them, dedupes by `@id`, and emits one
+ * `<script type="application/ld+json">` block per surviving payload.
+ *
+ * **Why one `<script>` per payload (NOT a single `@graph` array)**:
+ *
+ * - Google's structured-data testing tool, Bing webmaster tools, and
+ *   the Schema.org reference parser all accept multiple sibling
+ *   `<script type="application/ld+json">` blocks. Emitting them as
+ *   separate blocks lets each payload be diff-friendly in the
+ *   page source AND lets per-payload removal happen on a future
+ *   AEO opt-out without churning the whole graph.
+ * - `@graph` is technically valid but harder to author — every
+ *   payload would need to share `@context` with the wrapper, and
+ *   per-section authors would have to coordinate to merge their
+ *   payloads into one shared graph. The "one script per payload"
+ *   pattern keeps section authoring fully local.
+ *
+ * **Why dedupe by `@id` (last-wins)**: a page may have a section
+ * emit a `Product` payload AND another section emit a `Review`
+ * referencing the same `Product` via `@id`. Without dedupe, the
+ * `Product` would emit twice (once standalone, once referenced).
+ * Last-wins because the section's own emission is closer to the
+ * truth than a reference; the dedupe is best-effort and harmless
+ * if `@id` is absent (the payload always emits).
+ *
+ * **`@context` injection**: when a payload omits `@context`, the
+ * renderer injects `'https://schema.org'`. Consumers wanting a
+ * custom vocabulary supply `@context` themselves and the renderer
+ * passes it through unchanged.
+ *
+ * **HTML-safe serialization**: JSON-LD payloads are serialized via
+ * `JSON.stringify` with the closing `</` escaped to `<\/` (and the
+ * `<!` opener escaped to `<\!`) to prevent the payload from
+ * accidentally closing the surrounding `<script>` tag if the
+ * payload contains the string `</script>` (e.g. a blog post about
+ * structured data). This is the canonical safe-serialization
+ * pattern (see https://html.spec.whatwg.org/#restrictions-for-contents-of-script-elements).
+ */
+
+const SCHEMA_ORG_DEFAULT_CONTEXT = 'https://schema.org' as const;
+
+export interface RenderPageStructuredDataOptions {
+  /**
+   * Section definitions whose `getStructuredData()` (when present)
+   * contributes payloads to the page. Sections without
+   * `getStructuredData` are skipped silently.
+   */
+  sections?: readonly Pick<WebsiteSectionDefinition, 'sectionRef' | 'getStructuredData'>[];
+  /**
+   * Optional page-level payloads contributed by the page-shell
+   * itself (typical: `BreadcrumbList`, `Organization`, `WebSite`).
+   * Composed AFTER section payloads in the emission order so a
+   * section's `@id`-keyed payload wins over a page-level one with
+   * the same `@id` (last-wins; see preamble).
+   */
+  pagePayloads?: readonly WebsiteStructuredDataPayload[];
+}
+
+export function renderPageStructuredData(opts: RenderPageStructuredDataOptions): string {
+  const collected: WebsiteStructuredDataPayload[] = [];
+
+  if (opts.sections) {
+    for (const section of opts.sections) {
+      if (!section.getStructuredData) continue;
+      const value: WebsiteStructuredDataReturn = section.getStructuredData();
+      collectInto(collected, value);
+    }
+  }
+
+  if (opts.pagePayloads) {
+    for (const payload of opts.pagePayloads) {
+      collected.push(payload);
+    }
+  }
+
+  if (collected.length === 0) return '';
+
+  /**
+   * Dedupe by `@id` (last-wins). Payloads without `@id` always
+   * survive. We walk LAST-to-FIRST so the LAST occurrence of an
+   * `@id` is the kept one (later writes overwrite earlier ones
+   * naturally with this loop direction + reverse at the end).
+   */
+  const seen = new Set<string>();
+  const deduped: WebsiteStructuredDataPayload[] = [];
+  for (let i = collected.length - 1; i >= 0; i -= 1) {
+    const payload = collected[i];
+    if (payload === undefined) continue;
+    const id = payload['@id'];
+    if (typeof id === 'string') {
+      if (seen.has(id)) continue;
+      seen.add(id);
+    }
+    deduped.push(payload);
+  }
+  deduped.reverse();
+
+  const lines: string[] = [];
+  for (const payload of deduped) {
+    const withContext: Record<string, unknown> =
+      payload['@context'] === undefined
+        ? { '@context': SCHEMA_ORG_DEFAULT_CONTEXT, ...payload }
+        : { ...payload };
+    const json = serializeForScriptTag(withContext);
+    lines.push(`<script type="application/ld+json">${json}</script>`);
+  }
+  return lines.join('\n');
+}
+
+/**
+ * Normalize a `getStructuredData()` return value into a flat array
+ * the renderer iterates. Handles the four legal shapes
+ * (`null` / `undefined` / single payload / readonly array).
+ *
+ * Mutates the `into` array in place — the function is private to
+ * this module and the in-place mutation avoids one allocation per
+ * section (sections compose linearly, the cost adds up on long
+ * pages).
+ */
+function collectInto(
+  into: WebsiteStructuredDataPayload[],
+  value: WebsiteStructuredDataReturn,
+): void {
+  if (value === null || value === undefined) return;
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      if (item !== null && item !== undefined) into.push(item);
+    }
+    return;
+  }
+  /**
+   * Single-payload shape — narrow the readonly-array branch above
+   * by elimination. `Array.isArray` returns `false` for readonly
+   * arrays in some TS configs but TRUE at runtime; this branch
+   * runs only for non-array `WebsiteStructuredDataPayload`.
+   */
+  into.push(value as WebsiteStructuredDataPayload);
+}
+
+/**
+ * Serialize a payload for emission inside a `<script>` tag.
+ *
+ * `JSON.stringify` alone is NOT safe inside `<script>` tags:
+ *
+ *   - A payload field containing the literal string `</script>`
+ *     (rare but possible on a blog post about HTML / structured
+ *     data) would close the script tag prematurely and inject the
+ *     remainder as page HTML.
+ *   - A payload field containing `<!--` similarly opens an HTML
+ *     comment that breaks the surrounding parsing context.
+ *
+ * Both are mitigated by escaping `<` to `\u003c` inside the JSON
+ * payload — the JSON parser treats `\u003c` as identical to `<`,
+ * so the consumed payload is unchanged, but the HTML parser sees
+ * no `<` characters and never gets confused.
+ */
+function serializeForScriptTag(payload: Record<string, unknown>): string {
+  return JSON.stringify(payload).replace(/</g, '\\u003c');
+}
+/** @wildo_source:part:end saas.website.astro.structured-data-renderer */