@wildo-ai/saas-website 1.1.2 → 1.1.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wildo-ai/saas-website",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "SaaS marketing/landing website engine — schemas, helpers, layout/primitive placeholders, Astro/MDX adapters, and SEO/AEO/GEO builder library. Consumers author all business sections themselves via the defineWebsiteSection factory.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Wildo AI",
@@ -65,9 +65,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@wildo-ai/platform-config-lib": "1.1.2",
-    "@wildo-ai/presets-components-models": "1.1.2",
-    "@wildo-ai/saas-models": "1.1.2",
+    "@wildo-ai/external-connectors-public": "1.1.4",
+    "@wildo-ai/platform-config-lib": "1.1.4",
+    "@wildo-ai/presets-components-models": "1.1.4",
+    "@wildo-ai/saas-models": "1.1.4",
     "yaml": "^2.3.4"
   },
   "devDependencies": {

package/src/__tests__/bundle-isolation.test.ts

@@ -235,6 +235,27 @@ const ALLOWED_BARE_SPECIFIERS: ReadonlySet<string> = new Set([
   'react',
   'zod',
   '@wildo-ai/saas-models/public-runtime',
+  /**
+   * The browser-bound trust zone of the provider registry split (#332). The
+   * website hydrates its providers from BOTH channels through this subpath:
+   * `composeHydratedFrontendWebsiteProviders` joins the served entries with the
+   * bundle's generated modules, and `activateFrontendProviderSdks` loads the
+   * vendor SDK of any provider that declares one.
+   *
+   * Admitted rather than mirrored locally, and the acceptance criteria are met
+   * by CONSTRUCTION rather than by inspection: this package's own
+   * `bundle-isolation.test.ts` walks each of its three facet subpaths and holds
+   * them to a one-entry allow-list — no saas-models root barrel, no
+   * presets-components-models root barrel, no backend lib, no
+   * `@wildo-ai/external-connectors-private` (the secrets-bound sibling), and no
+   * `reflect-metadata`. That test is the reason this entry is safe, and it is
+   * the thing to check if that ever stops being true.
+   *
+   * The `/website` FACET specifically: the package's facet boundary is
+   * type-enforced so this bundle never reaches the SaaS-app or techdoc provider
+   * modules.
+   */
+  '@wildo-ai/external-connectors-public/website',
   /**
    * Narrow public-runtime seam exposing
    * `AvailableLanguage` / `TextDirection` (and any future locale-tier

package/src/astro/__tests__/blog-post-bridge.test.tsx

@@ -4,7 +4,7 @@ import { useMDXComponents } from '@mdx-js/react';
 import React, { type ComponentType } from 'react';
 import { describe, expect, it } from 'vitest';
 
-import { BUILTIN_PROVIDER_CAPABILITY } from '@wildo-ai/saas-models/public-runtime';
+import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
 import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
@@ -59,7 +59,7 @@ const SKIP_LABEL_PACK = {
 const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   providers: {
     sentry: {
-      metadata: { ref: 'sentry' },
+      metadata: defineProviderMetadata({ ref: 'sentry', packageName: '@test/providers', tier: ProviderTier.EXTENSION, origin: { kind: ProviderOriginKind.APPLICATION } }),
       providerCapabilities: [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING],
       protocols: ['FRONTEND_SDK'],
       publicConfig: {

package/src/astro/__tests__/bridge-runtime.test.tsx

@@ -3,7 +3,7 @@ import { render, screen } from '@testing-library/react';
 import React from 'react';
 import { describe, expect, it } from 'vitest';
 
-import { BUILTIN_PROVIDER_CAPABILITY } from '@wildo-ai/saas-models/public-runtime';
+import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
 import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
@@ -75,7 +75,7 @@ const SKIP_LABEL_PACK = { 'website.chrome.layout.skip-to-main-content': 'Skip to
 const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   providers: {
     posthog: {
-      metadata: { ref: 'posthog' },
+      metadata: defineProviderMetadata({ ref: 'posthog', packageName: '@test/providers', tier: ProviderTier.EXTENSION, origin: { kind: ProviderOriginKind.APPLICATION } }),
       providerCapabilities: [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS],
       protocols: ['FRONTEND_SDK'],
       publicConfig: {
@@ -86,6 +86,11 @@ const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   },
 };
 
+function RuntimeProbe(): React.ReactNode {
+  const runtime = useWebsiteRuntime();
+  return <span data-testid="app-origin">{runtime.appOrigin ?? ''}</span>;
+}
+
 describe('createWebsitePageBridgeIsland', () => {
   it('returns a React component (closes over deps; never crosses prop boundary)', () => {
     const Island = createWebsitePageBridgeIsland({
@@ -120,6 +125,56 @@ describe('createWebsitePageBridgeIsland', () => {
     expect(screen.getByTestId('provider-ref').textContent).toBe('posthog');
   });
 
+  /**
+   * `appOrigin` reaches the browser, so a CTA no longer needs a second copy of the product host (#493).
+   *
+   * A `wildo.website.config.ts` is Node-loaded and invisible to a client island, so before this a site
+   * resolved the app origin AGAIN from a build-time environment variable — one host authored twice
+   * with no mechanical link, and a silent fallback to localhost when the variable was unset. It now
+   * travels exactly as `apiOrigin` does: page → island prop → runtime context.
+   */
+  it('forwards appOrigin from the island prop onto the runtime context', () => {
+    const Island = createWebsitePageBridgeIsland({
+      PageComponent: RuntimeProbe,
+      pageRef: PAGE_REF,
+      navigation: buildNavigation(),
+    });
+    render(
+      <Island
+        locale={AvailableLanguage.EN}
+        defaultLocale={AvailableLanguage.EN}
+        labelPack={{ ...SKIP_LABEL_PACK }}
+        designTokens={DESIGN_TOKENS}
+        skipToMainContentLabelKey={SKIP_KEY}
+        frontendProviders={FRONTEND_PROVIDERS}
+        appOrigin="https://app.example.com"
+      />,
+    );
+    expect(screen.getByTestId('app-origin').textContent).toBe('https://app.example.com');
+  });
+
+  it('leaves appOrigin undefined when the page does not forward it, so a consumer can fail loudly', () => {
+    // Optional on purpose: a page with no CTA needs none. The CONSUMER decides what absence means, and
+    // the dogfood's `useAppOrigin()` throws — which beats the old silent fallback to localhost, since
+    // that fallback shipped a production site whose every CTA pointed at a machine that was not there.
+    const Island = createWebsitePageBridgeIsland({
+      PageComponent: RuntimeProbe,
+      pageRef: PAGE_REF,
+      navigation: buildNavigation(),
+    });
+    render(
+      <Island
+        locale={AvailableLanguage.EN}
+        defaultLocale={AvailableLanguage.EN}
+        labelPack={{ ...SKIP_LABEL_PACK }}
+        designTokens={DESIGN_TOKENS}
+        skipToMainContentLabelKey={SKIP_KEY}
+        frontendProviders={FRONTEND_PROVIDERS}
+      />,
+    );
+    expect(screen.getByTestId('app-origin').textContent).toBe('');
+  });
+
   it('emits the layout-root data attribute carrying the page ref', () => {
     const Island = createWebsitePageBridgeIsland({
       PageComponent: PageProbe,

package/src/astro/__tests__/robots-renderer.test.ts

@@ -116,8 +116,23 @@ describe('renderRobotsTxt (Phase 8 close-out — saas-website-seo-sitemap.md)',
   });
 
   describe('policy = noindex (staging / private surfaces)', () => {
-    it('emits Disallow: / for the catch-all User-agent', () => {
+    /**
+     * The catch-all must NOT be barred (#494).
+     *
+     * `Disallow` governs crawling and `noindex` governs indexing, and the second only reaches a crawler
+     * that is allowed to fetch the page. Emitting `Disallow: /` here made the site's own `noindex` meta
+     * unreadable, so the site was closed to well-behaved crawlers and still listable as a bare URL —
+     * the weaker of the two outcomes. Closure lives in the document; this file stays out of the way.
+     */
+    it('does NOT bar the catch-all, so the noindex meta can be read', () => {
       const txt = renderRobotsTxt(buildSiteContext({ robots: { policy: 'noindex' } }));
+      expect(txt).not.toContain('User-agent: *\nDisallow: /');
+    });
+
+    it('STILL closes the catch-all when allowedCrawlers is set, which is a different feature', () => {
+      // Deny-by-default crawler allow-listing IS about crawling, so `Disallow: /` is correct there —
+      // and it must survive the noindex change rather than being removed with it.
+      const txt = renderRobotsTxt(buildSiteContext({ robots: { policy: 'noindex', allowedCrawlers: ['Googlebot'] } }));
       expect(txt).toContain('User-agent: *\nDisallow: /');
     });
 

package/src/astro/__tests__/website-page-head.renderer.test.ts

@@ -71,6 +71,7 @@ interface BuildSiteContextOverrides {
   defaultOgImageUrl?: string;
   siteName?: string;
   publicOrigin?: string;
+  robotsPolicy?: 'index' | 'noindex';
 }
 
 const buildSiteContext = (
@@ -88,6 +89,7 @@ const buildSiteContext = (
       ...(overrides.defaultOgImageUrl !== undefined
         ? { defaultOgImageUrl: overrides.defaultOgImageUrl }
         : {}),
+      ...(overrides.robotsPolicy !== undefined ? { robots: { policy: overrides.robotsPolicy } } : {}),
     },
     skipToMainContentLabelKey: WebsiteLabelKeySchema.parse(
       'website.chrome.layout.skip-to-main-content',
@@ -313,6 +315,47 @@ describe('renderWebsitePageHeadHtml', () => {
     expect(defaultHtml).not.toContain('noai, noimageai');
   });
 
+  /**
+   * #494 — the directive that actually keeps a site out of search.
+   *
+   * `robots.txt` `Disallow` governs CRAWLING and this meta governs INDEXING; only the second de-indexes,
+   * and it is readable only by a crawler that was allowed to fetch the page. Before this, a site declared
+   * `noindex` emitted the `Disallow` and NOT this tag — closed to well-behaved crawlers and still listable
+   * as a bare URL. The sibling assertion in `robots-renderer.test.ts` pins the other half.
+   */
+  it('emits noindex when the site policy is noindex, and nothing when it is index', () => {
+    const manifest = buildManifest('landing', '/');
+    const closedHtml = renderWebsitePageHeadHtml({
+      manifest,
+      siteContext: buildSiteContext([AvailableLanguage.EN], AvailableLanguage.EN, manifest, { robotsPolicy: 'noindex' }),
+      locale: AvailableLanguage.EN,
+      labelPack: { 'website.landing.meta.title': 'T', 'website.landing.meta.description': 'D' },
+    });
+    expect(closedHtml).toContain('<meta name="robots" content="noindex" />');
+
+    const openHtml = renderWebsitePageHeadHtml({
+      manifest,
+      siteContext: buildSiteContext([AvailableLanguage.EN], AvailableLanguage.EN, manifest, { robotsPolicy: 'index' }),
+      locale: AvailableLanguage.EN,
+      labelPack: { 'website.landing.meta.title': 'T', 'website.landing.meta.description': 'D' },
+    });
+    expect(openHtml).not.toContain('name="robots"');
+  });
+
+  it('merges noindex and the AI opt-out into ONE robots meta rather than emitting two', () => {
+    // Two `<meta name="robots">` tags are legal and read inconsistently; one comma-separated value is
+    // the canonical shape, and merging is what stops the two features colliding as they are combined.
+    const manifest = buildManifest('pricing', '/pricing', undefined, true);
+    const html = renderWebsitePageHeadHtml({
+      manifest,
+      siteContext: buildSiteContext([AvailableLanguage.EN], AvailableLanguage.EN, manifest, { robotsPolicy: 'noindex' }),
+      locale: AvailableLanguage.EN,
+      labelPack: { 'website.pricing.meta.title': 'T', 'website.pricing.meta.description': 'D' },
+    });
+    expect(html).toContain('<meta name="robots" content="noindex, noai, noimageai" />');
+    expect(html.match(/name="robots"/gu)).toHaveLength(1);
+  });
+
   it('per-page ogImageUrl wins over seo.defaultOgImageUrl (precedence rule, Phase 6 M-A)', () => {
     const manifest = buildManifest('landing', '/', 'https://cdn.example.com/page.png');
     const siteContext = buildSiteContext(

package/src/astro/__tests__/website-site-context.test.ts

@@ -99,7 +99,7 @@ describe('composeWebsiteSiteContext', () => {
     const frontendProviders = FrontendProvidersBlockSchema.parse({
       providers: {
         posthog: {
-          metadata: { ref: 'posthog' },
+          metadata: { ref: 'posthog', packageName: '@test/providers', tier: 'EXTENSION', vendor: 'posthog', origin: { kind: 'APPLICATION' } },
           providerCapabilities: ['FRONTEND_PRODUCT_ANALYTICS'],
           protocols: ['FRONTEND_SDK'],
           publicConfig: {

package/src/astro/blog-post-bridge.tsx

@@ -8,6 +8,7 @@ import {
   type WebsiteRuntimeContextValue,
 } from '../core/contexts/WebsiteRuntimeContext';
 import { createFrontendWebsiteProviderRegistry } from '../core/external-providers/frontend-provider-registry.website';
+import type { GeneratedWebsiteProviderModules } from '../core/external-providers/frontend-provider-registry.website';
 import { BlogPost, BLOG_POST_PAGE_REF } from '../mdx/BlogPost';
 import type { WebsiteMdxComponentsMap } from '../mdx/website-mdx-provider';
 import type { WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
@@ -313,6 +314,26 @@ export interface WebsiteBlogPostBridgeIslandProps {
   skipToMainContentLabelKey: WebsiteLabelKey;
   /** Optional website-facing public providers materialized at build time. */
   frontendProviders?: FrontendProvidersBlock;
+  /**
+   * The CODE channel for those providers (#332): the
+   * `generatedFrontendProviderModules` export of this website service's own
+   * `src/generated/frontend-providers.generated.ts`, written by
+   * `wildo config sync`.
+   *
+   * `frontendProviders` above says WHICH providers this service turned on, in
+   * this environment; this says what code the bundle actually contains for
+   * them. Both are needed, because a JSON payload cannot carry an SDK loader
+   * and a bundle cannot know which environment it is running in.
+   *
+   * NOT a JSON-serializable island prop like its siblings, and it does not need
+   * to be: the bridge module is bundled with the page, so the generated module
+   * map is an ordinary import in the same graph rather than something that has
+   * to cross the hydration boundary.
+   *
+   * Omitted is the ordinary case for a website declaring no package-shipped
+   * provider: no such file is generated, so there is nothing to import.
+   */
+  frontendProviderModules?: GeneratedWebsiteProviderModules;
 }
 
 const EMPTY_MDX_COMPONENTS: WebsiteMdxComponentsMap = Object.freeze({});
@@ -343,6 +364,7 @@ export function createWebsiteBlogPostBridgeIsland(
     designTokens,
     skipToMainContentLabelKey,
     frontendProviders,
+    frontendProviderModules,
   }: WebsiteBlogPostBridgeIslandProps): ReactNode {
     const MdxBody = slugToMdxBody[slug];
     if (MdxBody === undefined) {
@@ -374,7 +396,10 @@ export function createWebsiteBlogPostBridgeIsland(
       designTokens,
       navigation,
       skipToMainContentLabelKey,
-      frontendProviderRegistry: createFrontendWebsiteProviderRegistry(frontendProviders),
+      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
+        entries: frontendProviders,
+        modules: frontendProviderModules,
+      }),
     };
     return (
       <WebsiteRuntimeContextProvider value={runtimeValue}>

package/src/astro/bridge-runtime.tsx

@@ -8,6 +8,7 @@ import {
   type WebsiteRuntimeContextValue,
 } from '../core/contexts/WebsiteRuntimeContext';
 import { createFrontendWebsiteProviderRegistry } from '../core/external-providers/frontend-provider-registry.website';
+import type { GeneratedWebsiteProviderModules } from '../core/external-providers/frontend-provider-registry.website';
 import { WebsitePageLayout } from '../core/layouts/WebsitePageLayout';
 import type { WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
 import type { WebsiteLabelKey } from '../schemas/label-keys/website-label-key.schemas';
@@ -211,6 +212,26 @@ export interface WebsitePageBridgeIslandProps {
   skipToMainContentLabelKey: WebsiteLabelKey;
   /** Optional website-facing public providers materialized at build time. */
   frontendProviders?: FrontendProvidersBlock;
+  /**
+   * The CODE channel for those providers (#332): the
+   * `generatedFrontendProviderModules` export of this website service's own
+   * `src/generated/frontend-providers.generated.ts`, written by
+   * `wildo config sync`.
+   *
+   * `frontendProviders` above says WHICH providers this service turned on, in
+   * this environment; this says what code the bundle actually contains for
+   * them. Both are needed, because a JSON payload cannot carry an SDK loader
+   * and a bundle cannot know which environment it is running in.
+   *
+   * NOT a JSON-serializable island prop like its siblings, and it does not need
+   * to be: the bridge module is bundled with the page, so the generated module
+   * map is an ordinary import in the same graph rather than something that has
+   * to cross the hydration boundary.
+   *
+   * Omitted is the ordinary case for a website declaring no package-shipped
+   * provider: no such file is generated, so there is nothing to import.
+   */
+  frontendProviderModules?: GeneratedWebsiteProviderModules;
   /**
    * Optional backend API origin (no trailing slash) forwarded into
    * `WebsiteRuntimeContext.apiOrigin` for anonymous-capture sections
@@ -222,6 +243,22 @@ export interface WebsitePageBridgeIslandProps {
    * capture section.
    */
   apiOrigin?: string;
+  /**
+   * The product origin this site's self-serve CTAs link to ("Start free",
+   * "Get started"), forwarded into `WebsiteRuntimeContext.appOrigin` (#493).
+   *
+   * An island prop for the same reason `apiOrigin` above is one: the `.astro`
+   * page resolves it from `WildoMarketingWebsiteConfig.appOrigin`, which is
+   * Node-loaded and invisible to a client island. Before this, a site
+   * resolved the product origin a SECOND time from a public build-time
+   * environment variable — one host authored twice with no mechanical link,
+   * and a silent fallback to localhost when the variable was unset.
+   *
+   * Optional because a page with no CTA needs none; a page that renders one
+   * without passing this should fail LOUDLY rather than fall back, which is
+   * the consumer's job and the whole point of removing the fallback.
+   */
+  appOrigin?: string;
 }
 
 /**
@@ -243,7 +280,9 @@ export function createWebsitePageBridgeIsland(
     designTokens,
     skipToMainContentLabelKey,
     frontendProviders,
+    frontendProviderModules,
     apiOrigin,
+    appOrigin,
   }: WebsitePageBridgeIslandProps): ReactNode {
     const runtimeValue: WebsiteRuntimeContextValue = {
       locale,
@@ -252,8 +291,12 @@ export function createWebsitePageBridgeIsland(
       designTokens,
       navigation,
       skipToMainContentLabelKey,
-      frontendProviderRegistry: createFrontendWebsiteProviderRegistry(frontendProviders),
+      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
+        entries: frontendProviders,
+        modules: frontendProviderModules,
+      }),
       apiOrigin,
+      appOrigin,
     };
     return (
       <WebsiteRuntimeContextProvider value={runtimeValue}>

package/src/astro/robots-renderer.ts

@@ -129,7 +129,20 @@ export function renderRobotsTxt(siteContext: WebsiteSiteContext): string {
    *     `Disallow: /` so the named bots are the ONLY ones permitted.
    */
   const catchAllLines: string[] = ['User-agent: *'];
-  if (policy === 'noindex' || allowedCrawlers.length > 0) {
+  /*
+   * `policy === 'noindex'` deliberately does NOT emit `Disallow: /` (#494).
+   *
+   * `Disallow` governs CRAWLING; the `<meta name="robots" content="noindex">` emitted by the page-head
+   * renderer governs INDEXING, and it is the one that keeps a site out of search. Barring the crawler
+   * here would mean it never fetches the page and never reads that directive — so the pair defeated
+   * itself, and the site stayed indexable as a bare URL. Closure is expressed in the document; this
+   * file's job for that policy is to stay out of the way.
+   *
+   * `allowedCrawlers` is a DIFFERENT feature and keeps its `Disallow: /`: there the catch-all closes
+   * the rest of the crawler universe so the named bots are the only ones permitted, which is about
+   * crawling and is exactly what `Disallow` is for.
+   */
+  if (allowedCrawlers.length > 0) {
     catchAllLines.push('Disallow: /');
   } else if (disallow.length === 0) {
     /**

package/src/astro/website-page-head.renderer.ts

@@ -198,23 +198,43 @@ export function renderWebsitePageHeadHtml(opts: RenderWebsitePageHeadHtmlOptions
   const ogLocaleAttr = escapeHtmlAttribute(currentLocaleStr);
 
   /**
-   * AI-training opt-out (D-AG3) — `<meta name="robots" content="noai, noimageai">`
-   * is emitted ONLY when the page manifest opts in via
-   * `seo.noaiOptOut: true`. Default is OPT-IN to AI training (the
-   * marketing-site default). This emission pairs with the sibling
-   * `_headers` entry produced by `renderWebsitePageNoaiHeaders()`
+   * SITE-WIDE `noindex` (#494) — the directive that actually keeps a site out of search.
+   *
+   * `robots.txt` `Disallow` governs CRAWLING, not INDEXING: a disallowed URL can still be listed, as a
+   * bare URL with no snippet, if anything links to it. Only this directive de-indexes. Until 2026-09-08
+   * a site declared `noindex` emitted the `Disallow` and NOT this, so it was closed to well-behaved
+   * crawlers and still indexable — the weaker half of the pair.
+   *
+   * The two are also mutually defeating, which is why `renderRobotsTxt` no longer emits `Disallow: /`
+   * for this policy: a crawler barred from fetching the page never reads the directive telling it not
+   * to index. To stay out of search you must let the crawler IN and tell it no.
+   *
+   * `noindex` only — not `noindex, nofollow`. `nofollow` additionally suppresses link discovery, which
+   * is a broader claim than "keep this out of the index" and is not what the policy declares.
+   */
+  const robotsDirectives: string[] = [];
+  if (rootConfig.seo.robots?.policy === 'noindex') {
+    robotsDirectives.push('noindex');
+  }
+  /**
+   * AI-training opt-out (D-AG3) — emitted ONLY when the page manifest opts in via
+   * `seo.noaiOptOut: true`. Default is OPT-IN to AI training (the marketing-site default). This
+   * emission pairs with the sibling `_headers` entry produced by `renderWebsitePageNoaiHeaders()`
    * for crawlers that don't honor in-document meta.
    *
-   * Format: `noai` (block AI training on text) and `noimageai`
-   * (block AI training on images) are the two robots directives the
-   * major AI crawlers (GPTBot, ClaudeBot, Google-Extended, etc.)
-   * recognise. Emitting them as a single comma-separated `content`
-   * value is the canonical robots-meta shape.
+   * `noai` (block AI training on text) and `noimageai` (block AI training on images) are the two
+   * directives the major AI crawlers (GPTBot, ClaudeBot, Google-Extended, etc.) recognise.
    */
-  const noaiMetaLines: string[] = [];
   if (manifest.seo?.noaiOptOut === true) {
-    noaiMetaLines.push(`<meta name="robots" content="noai, noimageai" />`);
+    robotsDirectives.push('noai', 'noimageai');
   }
+  /*
+   * ONE `<meta name="robots">`, carrying every directive comma-separated — the canonical shape. Two
+   * separate robots meta tags are legal and are read inconsistently; merging avoids the question.
+   */
+  const noaiMetaLines: string[] = robotsDirectives.length > 0
+    ? [`<meta name="robots" content="${robotsDirectives.join(', ')}" />`]
+    : [];
 
   return [
     `<title>${titleText}</title>`,

package/src/config/__tests__/define-website-config.test.ts

@@ -204,12 +204,18 @@ describe('defineWebsiteConfig — @unimplemented warnings', () => {
   /**
    * The `@unimplemented` warner has ZERO branches today, NOT
    * because every authored field is wired to a runtime consumer
-   * — `appOrigin` still has no runtime consumer (the
-   * marketing → app handoff link surface that will read it does
-   * not exist yet, see the schema file header) — but because the
+   * (`appOrigin` still has no runtime consumer), but because the
    * only OPTIONAL field that exists today (`csp?`) is already wired,
    * and firing on every Astro build for a required field would drown
    * the dev console.
+   *
+   * `appOrigin` is unwired for a narrower reason than an absent
+   * surface. The marketing → app handoff EXISTS: the CTA renders as
+   * an external button into the app. It just does not read this
+   * field, because a `wildo.website.config.ts` is Node-loaded and
+   * invisible to client islands, so the button resolves the origin
+   * from a public build-time environment variable instead. See the
+   * schema file header.
    * After the seam-collapse (`saas-website-seam-collapse.md` —
    * SHIPPED), `publicOrigin`, `defaultLocale`, and `locales` are
    * each consumed by at least one engine helper via

package/src/config/wildo-website-config.schemas.ts

@@ -16,11 +16,18 @@
  *     `<link rel="canonical">`, `og:url`, hreflang `href` URLs and
  *     the structured-data `mainEntityOfPage`. The previous
  *     `WebsiteRootConfig.seo.siteOrigin` was deleted.
- *   - `appOrigin` — has NO runtime consumer today. The
- *     marketing → app handoff link surface that will read it does
- *     not exist yet. Authored eagerly so the link-surface PR is a
- *     single framework-owned move; until then the field is exercised
- *     only by the schema parser.
+ *   - `appOrigin` — the marketing → app handoff target, read at runtime
+ *     since #493. A `wildo.website.config.ts` is Node-loaded and so
+ *     invisible to a client island, which is why this value reaches the
+ *     browser the way `apiOrigin` does: the `.astro` page forwards it to
+ *     its bridge island, which puts it on `WebsiteRuntimeContext.appOrigin`
+ *     for the CTA to read.
+ *
+ *     It previously had NO runtime consumer, and a site resolved the app
+ *     origin a SECOND time from a public build-time environment variable —
+ *     one host authored twice with no mechanical link, and a silent
+ *     fallback to localhost when the variable was unset. That is how a
+ *     marketing site comes to point at the wrong environment.
  *   - `csp?` — read by the website-local `sync-nginx-csp` build step,
  *     which merges the app-static posture with `infra.csp?.<serviceKey>`,
  *     emits the generated artifact consumed by Astro pages, and rewrites

package/src/core/__tests__/WebsitePageLayout.test.tsx

@@ -2,9 +2,11 @@ import React from 'react';
 import { describe, expect, it } from 'vitest';
 import { render } from '@testing-library/react';
 import '@testing-library/jest-dom';
-import { BUILTIN_PROVIDER_CAPABILITY } from '@wildo-ai/saas-models/public-runtime';
+import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
 
 import { WebsitePageLayout } from '../layouts/WebsitePageLayout';
+import { PROVIDER_SCRIPT_MARKER_ATTRIBUTE } from '../external-providers/provider-scripts.website';
+import { createFrontendWebsiteProviderRegistry } from '../external-providers/frontend-provider-registry.website';
 import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
@@ -52,21 +54,21 @@ const RUNTIME_WITH_FRONTEND_PROVIDERS: WebsiteRuntimeContextValue = {
       switch (providerCapability) {
         case BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS:
           return {
-            metadata: { ref: 'posthog' },
+            metadata: defineProviderMetadata({ ref: 'posthog', packageName: '@test/providers', tier: ProviderTier.EXTENSION, origin: { kind: ProviderOriginKind.APPLICATION } }),
             providerCapabilities: [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_PRODUCT_ANALYTICS],
             protocols: ['FRONTEND_SDK'],
             publicConfig: { integrationKind: 'product-analytics' },
           };
         case BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING:
           return {
-            metadata: { ref: 'sentry' },
+            metadata: defineProviderMetadata({ ref: 'sentry', packageName: '@test/providers', tier: ProviderTier.EXTENSION, origin: { kind: ProviderOriginKind.APPLICATION } }),
             providerCapabilities: [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_ERROR_MONITORING],
             protocols: ['FRONTEND_SDK'],
             publicConfig: { integrationKind: 'browser-error-monitoring' },
           };
         case BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA:
           return {
-            metadata: { ref: 'recaptcha' },
+            metadata: defineProviderMetadata({ ref: 'recaptcha', packageName: '@test/providers', tier: ProviderTier.EXTENSION, origin: { kind: ProviderOriginKind.APPLICATION } }),
             providerCapabilities: [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA],
             protocols: ['FRONTEND_SDK'],
             publicConfig: { integrationKind: 'captcha' },
@@ -181,4 +183,45 @@ describe('WebsitePageLayout', () => {
       ),
     ).toThrowError(/WebsitePageRef/);
   });
+
+  it('loads the scripts a live provider declared, instead of only naming the provider', () => {
+    // The defect this closes: the layout resolved provider refs and stamped
+    // them into the `data-*` attributes asserted above, and nothing anywhere
+    // loaded anything. The attributes stay — they are a legitimate
+    // introspection surface — but they are no longer all that happens.
+    document.head.innerHTML = '';
+    const runtime: WebsiteRuntimeContextValue = {
+      ...RUNTIME,
+      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
+        entries: {
+          providers: {
+          recaptcha: {
+            metadata: defineProviderMetadata({
+              ref: 'recaptcha',
+              packageName: '@test/providers',
+              tier: ProviderTier.EXTENSION,
+              origin: { kind: ProviderOriginKind.APPLICATION },
+            }),
+            providerCapabilities: [BUILTIN_PROVIDER_CAPABILITY.FRONTEND_CAPTCHA],
+            protocols: ['FRONTEND_SDK'],
+            scripts: [{ src: 'https://captcha.test/api.js' }],
+            },
+          },
+        } as never,
+      }),
+    };
+
+    render(
+      <WebsiteRuntimeContextProvider value={runtime}>
+        <WebsitePageLayout pageRef="home">
+          <span>content</span>
+        </WebsitePageLayout>
+      </WebsiteRuntimeContextProvider>,
+    );
+
+    const injected = document.querySelectorAll(`script[${PROVIDER_SCRIPT_MARKER_ATTRIBUTE}]`);
+    expect(injected).toHaveLength(1);
+    expect(injected[0].getAttribute('src')).toBe('https://captcha.test/api.js');
+    expect(injected[0].getAttribute(PROVIDER_SCRIPT_MARKER_ATTRIBUTE)).toBe('recaptcha');
+  });
 });

package/src/core/anonymous-session/inbound-contact-form.schema.ts

@@ -10,11 +10,11 @@
  * server-set fields: `_id`, `anonymousUserId`, `userId`, `emailUserMatch`, timestamps).
  *
  * Mirrors the non-excluded, non-backend-only CREATE inputs of `InboundContact`
- * (`email` required; `firstName` / `lastName` / `phone` optional), plus TWO distinct
- * privacy signal: an OPTIONAL marketing opt-in (mapped to the
- * `privacy.dataProcessingConsent` tier). A governed notice, contract or consent
- * interaction must use the separate exact-release receipt contract; this DTO cannot
- * manufacture legal evidence from a checkbox and client timestamp.
+ * (`email` required; `firstName` / `lastName` / `phone` optional), plus ONE privacy
+ * signal: an OPTIONAL marketing opt-in (mapped to the `privacy.dataProcessingConsent`
+ * tier). There is no second, required agreement field: a governed notice, contract or
+ * consent interaction must use the separate exact-release receipt contract, because this
+ * DTO cannot manufacture legal evidence from a checkbox and a client timestamp.
  * `relatedUserId` is intentionally absent — it is `.excludeFromCreate()` on the
  * resource (sales/admin-only, never client-authored).
  */
@@ -35,7 +35,8 @@ export const InboundContactFormSchema = z.object({
   phone: z.string().trim().max(64).optional(),
   /**
    * OPTIONAL marketing opt-in — maps into the resource's `privacy.dataProcessingConsent`
-   * tier ('marketing' vs the BASIC default). Independent of the required agreement above.
+   * tier ('marketing' vs the BASIC default). It is the only privacy field on this form,
+   * and it gates nothing: an unchecked box still submits, at the BASIC tier.
    */
   marketingConsent: z.boolean().default(false),
 });

package/src/core/contexts/WebsitePageContext.tsx

@@ -17,9 +17,10 @@ import type { WebsitePageRef } from '../../schemas/refs/page-ref.schemas';
  * MDX-driven blog index aggregating post excerpts, etc.) without
  * lying about which page each subtree belongs to.
  *
- * **Why a separate file from the hook**: same Fast-Refresh rationale
- * as `WebsiteRuntimeContext` — split provider/context/hook to keep
- * HMR boundaries small.
+ * **Why the hook lives in a separate file**: same Fast-Refresh
+ * rationale as `WebsiteRuntimeContext` — the context and its provider
+ * component stay together here (`useContext` matches on object
+ * identity), and only the hook is split out, into `useWebsitePage.ts`.
  */
 export interface WebsitePageContextValue {
   /**