@wildo-ai/saas-website 1.1.4 → 1.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wildo-ai/saas-website",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "SaaS marketing/landing website engine — schemas, helpers, layout/primitive placeholders, Astro/MDX adapters, and SEO/AEO/GEO builder library. Consumers author all business sections themselves via the defineWebsiteSection factory.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Wildo AI",
@@ -65,10 +65,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@wildo-ai/external-connectors-public": "1.1.4",
-    "@wildo-ai/platform-config-lib": "1.1.4",
-    "@wildo-ai/presets-components-models": "1.1.4",
-    "@wildo-ai/saas-models": "1.1.4",
+    "@wildo-ai/external-connectors-public": "1.1.6",
+    "@wildo-ai/platform-config-lib": "1.1.6",
+    "@wildo-ai/presets-components-models": "1.1.6",
+    "@wildo-ai/saas-models": "1.1.6",
     "yaml": "^2.3.4"
   },
   "devDependencies": {
@@ -96,19 +96,11 @@
   },
   "peerDependencies": {
     "@astrojs/react": "^3.0.0",
-    "@astrojs/sitemap": "^3.7.2",
     "@mdx-js/react": "^3.0.0",
     "astro": "^4.0.0",
-    "axios": "^1.6.8",
-    "clsx": "^2.1.0",
-    "jsonwebtoken": "^9.0.2",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "react-intl": "^8.0.0",
-    "reflect-metadata": "^0.2.2",
-    "socket.io-client": "^4.7.5",
-    "tailwind-merge": "^3.3.1",
-    "tailwind-variants": "^3.1.0"
+    "zod": "^4.3.6"
   },
   "peerDependenciesMeta": {
     "astro": {
@@ -117,23 +109,8 @@
     "@astrojs/react": {
       "optional": true
     },
-    "@astrojs/sitemap": {
-      "optional": true
-    },
     "@mdx-js/react": {
       "optional": true
-    },
-    "axios": {
-      "optional": true
-    },
-    "jsonwebtoken": {
-      "optional": true
-    },
-    "reflect-metadata": {
-      "optional": true
-    },
-    "socket.io-client": {
-      "optional": true
     }
   },
   "repository": {

package/src/__tests__/bundle-isolation.test.ts

@@ -279,29 +279,14 @@ const ALLOWED_BARE_SPECIFIERS: ReadonlySet<string> = new Set([
    * `FORBIDDEN_SPECIFIERS`.
    */
   '@wildo-ai/zod-decorators',
-  /**
-   * SSR / Astro-middleware tier. These four specifiers support server-side code paths
-   * the marketing engine genuinely needs:
-   *   - `axios` — outbound HTTP from Astro middleware (proxy to
-   *     the SaaS backend, contact-form forwarding, webhook fan-out).
-   *   - `jsonwebtoken` — verify cross-frontend handoff JWTs in
-   *     middleware before letting a request reach a logged-in surface.
-   *   - `socket.io-client` — real-time push (e.g. live preview / status
-   *     events from the SaaS app to the marketing site).
-   *   - `reflect-metadata` — decorator metadata runtime; required
-   *     by any future build-time consumer of `@wildo-ai/zod-decorators`
-   *     metadata (the import IS side-effecting — it mutates
-   *     `globalThis.Reflect`; that side effect is acceptable in an
-   *     SSR context but would still be objectionable in a React
-   *     island bundle).
-   * Allowing them here is a deliberate trade-off: this test no
-   * longer guarantees a hard browser-bundle size budget on its own.
-   * Application import discipline keeps the React-island side lean.
+  /*
+   * `axios`, `jsonwebtoken`, `socket.io-client` and `reflect-metadata` were allowed here from
+   * 2026-04-19 for an SSR middleware tier (backend proxying, handoff-JWT verification, live push)
+   * that was never built. Removed 2026-09-25: no source in this package imports any of them, and an
+   * allow-list wider than the code is a door nothing guards — the next import of one would pass
+   * this test unexamined. The tier that does exist (contact forms, anonymous sessions, consent
+   * recording) uses `fetch`. Re-add a specifier in the change that first imports it.
    */
-  'axios',
-  'jsonwebtoken',
-  'socket.io-client',
-  'reflect-metadata',
   /**
    * SSR / Astro-build-time tier. The
    * `astro.ts` sub-entry exposes the label-pack loader, which
@@ -498,6 +483,18 @@ describe('saas-website — bundle-isolation boundary (D12)', () => {
     }
   });
 
+  it('walks the provider-component loader (#1703), so everything it imports is held to this boundary', () => {
+    // The loader reaches vendor code only through a provider module's DYNAMIC `import()`; these files
+    // must stay inside the walk so a static vendor import added to them is caught here.
+    for (const file of [
+      'core/external-providers/provider-component-registry.website.ts',
+      'core/external-providers/useWebsiteProviderComponent.ts',
+      'core/external-providers/WebsiteProviderComponent.tsx',
+    ]) {
+      expect(visited.has(resolve(SRC_ROOT, file)), `Closure did not visit ${file}`).toBe(true);
+    }
+  });
+
   it.each([...FORBIDDEN_SPECIFIERS])(
     'no file in the saas-website closure imports the forbidden specifier "%s"',
     (forbidden) => {

package/src/astro/__tests__/blog-post-bridge.test.tsx

@@ -1,10 +1,18 @@
+import type { GeneratedWebsiteProviderModules } from '../../core/external-providers/frontend-provider-registry.website';
 import '@testing-library/jest-dom/vitest';
 import { render, screen } from '@testing-library/react';
 import { useMDXComponents } from '@mdx-js/react';
 import React, { type ComponentType } from 'react';
 import { describe, expect, it } from 'vitest';
 
-import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
+import {
+  BUILTIN_PROVIDER_CAPABILITY,
+  defineFrontendPublicConfigSchema,
+  defineProviderMetadata,
+  FrontendPublicConfigValueKind,
+  ProviderOriginKind,
+  ProviderTier,
+} from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
 import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
@@ -56,6 +64,15 @@ const SKIP_LABEL_PACK = {
 // Typed as the real block rather than `as const`: the prop takes `FrontendProvidersBlock`,
 // whose `providerCapabilities` / `protocols` are mutable `string[]`, so a `readonly` tuple
 // fixture is not assignable to the surface under test.
+/**
+ * The key list every real frontend provider module declares (#1705): hydration withholds the code of a module
+ * without one, so a fixture module without it would never reach the closure this test observes.
+ */
+const PUBLIC_CONFIG_SCHEMA = defineFrontendPublicConfigSchema({
+  integrationKind: { kind: FrontendPublicConfigValueKind.STRING, description: 'Which integration.' },
+  websiteRuntime: { kind: FrontendPublicConfigValueKind.BOOLEAN, description: 'Serves the website runtime.' },
+});
+
 const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   providers: {
     sentry: {
@@ -94,6 +111,46 @@ function ProviderAwareMdxBody(): React.ReactElement {
 }
 
 describe('createWebsiteBlogPostBridgeIsland', () => {
+  it('keeps executable provider code in the bridge closure while props survive JSON serialization', () => {
+    const activate = async () => ({ handle: 'test' });
+    let observed: unknown;
+    function ProviderProbe() {
+      const registry = useWebsiteRuntime().frontendProviderRegistry;
+      observed = registry?.modules.values().next().value?.sdk?.activate;
+      return <span>provider closure</span>;
+    }
+    const entry = { ...FRONTEND_PROVIDERS.providers.sentry, sdk: { packageName: '@test/sdk' } };
+    const modules = { sentry: { ...entry, publicConfigSchema: PUBLIC_CONFIG_SCHEMA, sdk: { descriptor: entry.sdk, activate } } } as GeneratedWebsiteProviderModules;
+    const Island = createWebsiteBlogPostBridgeIsland({
+      slugToMdxBody: { demo: ProviderProbe },
+      navigation: buildNavigation(),
+      frontendProviderModules: modules,
+    });
+    const props = JSON.parse(JSON.stringify({
+      locale: AvailableLanguage.EN, defaultLocale: AvailableLanguage.EN,
+      labelPack: SKIP_LABEL_PACK, designTokens: DESIGN_TOKENS, skipToMainContentLabelKey: SKIP_KEY,
+      frontendProviders: { providers: { sentry: entry } }, slug: 'demo', rawFrontmatter: VALID_FRONTMATTER,
+    }));
+    render(<Island {...props} />);
+    expect(observed).toBe(activate);
+  });
+
+  it('carries the configured product origin into blog navigation and MDX content', () => {
+    function OriginProbe() {
+      return <span data-testid="blog-app-origin">{useWebsiteRuntime().appOrigin}</span>;
+    }
+    const Island = createWebsiteBlogPostBridgeIsland({
+      slugToMdxBody: { demo: OriginProbe }, navigation: buildNavigation(),
+    });
+    render(<Island
+      slug="demo" rawFrontmatter={VALID_FRONTMATTER}
+      locale={AvailableLanguage.EN} defaultLocale={AvailableLanguage.EN}
+      labelPack={SKIP_LABEL_PACK} designTokens={DESIGN_TOKENS} skipToMainContentLabelKey={SKIP_KEY}
+      appOrigin="https://product.example"
+    />);
+    expect(screen.getByTestId('blog-app-origin').textContent).toBe('https://product.example');
+  });
+
   it('returns a React component (closes over deps; never crosses prop boundary)', () => {
     const Island = createWebsiteBlogPostBridgeIsland({
       slugToMdxBody: { 'why-context-beats-content': MdxBodyA },

package/src/astro/__tests__/bridge-runtime.test.tsx

@@ -1,9 +1,17 @@
+import type { GeneratedWebsiteProviderModules } from '../../core/external-providers/frontend-provider-registry.website';
 import '@testing-library/jest-dom/vitest';
 import { render, screen } from '@testing-library/react';
 import React from 'react';
 import { describe, expect, it } from 'vitest';
 
-import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
+import {
+  BUILTIN_PROVIDER_CAPABILITY,
+  defineFrontendPublicConfigSchema,
+  defineProviderMetadata,
+  FrontendPublicConfigValueKind,
+  ProviderOriginKind,
+  ProviderTier,
+} from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
 import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
@@ -72,6 +80,15 @@ const SKIP_LABEL_PACK = { 'website.chrome.layout.skip-to-main-content': 'Skip to
 // Typed as the real block rather than `as const`: the prop takes `FrontendProvidersBlock`,
 // whose `providerCapabilities` / `protocols` are mutable `string[]`, so a `readonly` tuple
 // fixture is not assignable to the surface under test.
+/**
+ * The key list every real frontend provider module declares (#1705): hydration withholds the code of a module
+ * without one, so a fixture module without it would never reach the closure this test observes.
+ */
+const PUBLIC_CONFIG_SCHEMA = defineFrontendPublicConfigSchema({
+  integrationKind: { kind: FrontendPublicConfigValueKind.STRING, description: 'Which integration.' },
+  websiteRuntime: { kind: FrontendPublicConfigValueKind.BOOLEAN, description: 'Serves the website runtime.' },
+});
+
 const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   providers: {
     posthog: {
@@ -92,6 +109,32 @@ function RuntimeProbe(): React.ReactNode {
 }
 
 describe('createWebsitePageBridgeIsland', () => {
+  it('keeps executable provider code in the bridge closure while props survive JSON serialization', () => {
+    // PostHog rests on analytics consent, so like the real module it declares `stoppable` and returns the
+    // `deactivate` that promise requires (#1704); without it hydration withholds the code this test observes.
+    const activate = async () => ({ handle: 'test', deactivate: () => undefined });
+    let observed: unknown;
+    function ProviderProbe() {
+      const registry = useWebsiteRuntime().frontendProviderRegistry;
+      observed = registry?.modules.values().next().value?.sdk?.activate;
+      return <span>provider closure</span>;
+    }
+    const entry = { ...FRONTEND_PROVIDERS.providers.posthog, sdk: { packageName: '@test/sdk' } };
+    const modules = { posthog: { ...entry, publicConfigSchema: PUBLIC_CONFIG_SCHEMA, sdk: { descriptor: entry.sdk, activate, stoppable: true } } } as GeneratedWebsiteProviderModules;
+    const Island = createWebsitePageBridgeIsland({
+      PageComponent: ProviderProbe, pageRef: PAGE_REF,
+      navigation: buildNavigation(),
+      frontendProviderModules: modules,
+    });
+    const props = JSON.parse(JSON.stringify({
+      locale: AvailableLanguage.EN, defaultLocale: AvailableLanguage.EN,
+      labelPack: SKIP_LABEL_PACK, designTokens: DESIGN_TOKENS, skipToMainContentLabelKey: SKIP_KEY,
+      frontendProviders: { providers: { posthog: entry } },
+    }));
+    render(<Island {...props} />);
+    expect(observed).toBe(activate);
+  });
+
   it('returns a React component (closes over deps; never crosses prop boundary)', () => {
     const Island = createWebsitePageBridgeIsland({
       PageComponent: PageProbe,

package/src/astro/__tests__/label-pack-loader.test.ts

@@ -1,3 +1,5 @@
+import { WEBSITE_CONSENT_LABEL_KEYS } from '../../schemas/label-keys/website-consent-label-keys.schemas';
+import { WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS } from '../../schemas/label-keys/website-provider-component-label-keys.schemas';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { resolve } from 'node:path';
@@ -60,6 +62,10 @@ const buildManifest = () =>
   });
 
 const SKIP_KEY_STR = 'website.chrome.layout.skip-to-main-content';
+// Framework-owned consent-panel keys (#534): required in every pack, like the skip link.
+// The provider-component slot's refusal wording (#1703) is framework-owned the same way.
+const FRAMEWORK_OWNED_KEYS = [...WEBSITE_CONSENT_LABEL_KEYS, ...WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS];
+const CONSENT_LABELS: Record<string, string> = Object.fromEntries(FRAMEWORK_OWNED_KEYS.map((key) => [key as unknown as string, 'X']));
 
 const buildRootConfig = (): WebsiteRootConfig =>
   WebsiteRootConfigSchema.parse({
@@ -207,7 +213,7 @@ describe('label-pack-loader', () => {
       writeFileSync(resolve(tmpDir, 'fr.json'), JSON.stringify({}));
       expect(() =>
         assertLabelPacksValid(tmpDir, buildSiteContext(), buildExpectedKeys()),
-      ).toThrow(/Locale "fr".*missing 4 required key\(s\)/s);
+      ).toThrow(new RegExp(`Locale "fr".*missing ${4 + FRAMEWORK_OWNED_KEYS.length} required key\\(s\\)`, 's'));
     });
 
     it('annotates each missing key with its declaring page / section origin', () => {
@@ -261,6 +267,7 @@ describe('label-pack-loader', () => {
         'website.landing.meta.title': 'X',
         'website.landing.meta.description': 'X',
         [SKIP_KEY_STR]: 'Skip to main content',
+        ...CONSENT_LABELS,
       });
       writeFileSync(resolve(tmpDir, 'en.json'), fullPack);
       writeFileSync(resolve(tmpDir, 'fr.json'), fullPack);
@@ -277,6 +284,7 @@ describe('label-pack-loader', () => {
         'website.landing.meta.description': 'X',
         'website.landing.hero.unused-orphan': 'X',
         [SKIP_KEY_STR]: 'Skip to main content',
+        ...CONSENT_LABELS,
       });
       writeFileSync(resolve(tmpDir, 'en.json'), packWithOrphan);
       writeFileSync(resolve(tmpDir, 'fr.json'), packWithOrphan);
@@ -289,6 +297,26 @@ describe('label-pack-loader', () => {
       warnSpy.mockRestore();
     });
 
+    it('requires every framework-owned consent-panel (#534) and provider-component (#1703) key in every locale pack', () => {
+      const withoutConsent = JSON.stringify({
+        'website.landing.hero.headline': 'X',
+        'website.landing.meta.title': 'X',
+        'website.landing.meta.description': 'X',
+        [SKIP_KEY_STR]: 'Skip to main content',
+      });
+      writeFileSync(resolve(tmpDir, 'en.json'), withoutConsent);
+      writeFileSync(resolve(tmpDir, 'fr.json'), JSON.stringify({ ...JSON.parse(withoutConsent), ...CONSENT_LABELS }));
+      let captured = '';
+      try {
+        assertLabelPacksValid(tmpDir, buildSiteContext(), buildExpectedKeys());
+      } catch (err) {
+        captured = (err as Error).message;
+      }
+      expect(captured).toMatch(/Locale "en":/);
+      expect(captured).not.toMatch(/Locale "fr":/);
+      for (const key of FRAMEWORK_OWNED_KEYS) expect(captured).toContain(key as unknown as string);
+    });
+
     it('treats WebsiteRootConfig.skipToMainContentLabelKey as required (Phase 6 third audit fix M-α)', () => {
       const partialPack = JSON.stringify({
         'website.landing.hero.headline': 'X',

package/src/astro/blog-post-bridge.tsx

@@ -7,7 +7,8 @@ import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
 } from '../core/contexts/WebsiteRuntimeContext';
-import { createFrontendWebsiteProviderRegistry } from '../core/external-providers/frontend-provider-registry.website';
+import { useWebsiteProviderRegistries } from '../core/external-providers/provider-component-registry.website';
+import type { ProviderComponentLoaderContribution } from '@wildo-ai/external-connectors-public/website';
 import type { GeneratedWebsiteProviderModules } from '../core/external-providers/frontend-provider-registry.website';
 import { BlogPost, BLOG_POST_PAGE_REF } from '../mdx/BlogPost';
 import type { WebsiteMdxComponentsMap } from '../mdx/website-mdx-provider';
@@ -222,6 +223,20 @@ import type { LabelPack } from '../schemas/validators/label-pack.validator';
  * island. NEVER cross the hydration boundary as serialized props.
  */
 export interface CreateWebsiteBlogPostBridgeIslandDeps {
+  /**
+   * Browser CODE imported by the consumer bridge, closed over at module load.
+   * Never pass executable modules through Astro island props: those are serialized.
+   * Config sync emits a stable map, including an empty map when no providers are declared.
+   */
+  frontendProviderModules?: GeneratedWebsiteProviderModules;
+  /**
+   * Loaders for provider components an ENGINE provider module declares but cannot import (#1703) —
+   * the website's facet-library door, the equivalent of the application's
+   * `contributeProviderComponentLoaders`. A provider PACKAGE that ships its own component needs
+   * nothing here: its module's `components[capability].load` is used. A DEPS entry because a loader
+   * is a function, and island props are serialized.
+   */
+  providerComponentLoaders?: ReadonlyArray<ProviderComponentLoaderContribution>;
   /**
    * Per-slug map of compiled MDX bodies (each entry is a React
    * component — the `.default` export of the MDX module). Typically
@@ -256,6 +271,11 @@ export interface CreateWebsiteBlogPostBridgeIslandDeps {
    * serialization boundary.
    */
   navigation: WebsiteNavigationConfig;
+  /**
+   * Optional replacement for the framework's visitor consent panel (#534). Closed over for the same
+   * reason as `navigation`. See `WebsiteRuntimeContextValue.consentBannerComponent`.
+   */
+  consentBannerComponent?: ComponentType;
   /**
    * MDX-tag → React-component map forwarded into `<BlogPost>` and
    * scoped via `<WebsiteMdxProvider>`. Typically a small object
@@ -314,26 +334,9 @@ export interface WebsiteBlogPostBridgeIslandProps {
   skipToMainContentLabelKey: WebsiteLabelKey;
   /** Optional website-facing public providers materialized at build time. */
   frontendProviders?: FrontendProvidersBlock;
-  /**
-   * The CODE channel for those providers (#332): the
-   * `generatedFrontendProviderModules` export of this website service's own
-   * `src/generated/frontend-providers.generated.ts`, written by
-   * `wildo config sync`.
-   *
-   * `frontendProviders` above says WHICH providers this service turned on, in
-   * this environment; this says what code the bundle actually contains for
-   * them. Both are needed, because a JSON payload cannot carry an SDK loader
-   * and a bundle cannot know which environment it is running in.
-   *
-   * NOT a JSON-serializable island prop like its siblings, and it does not need
-   * to be: the bridge module is bundled with the page, so the generated module
-   * map is an ordinary import in the same graph rather than something that has
-   * to cross the hydration boundary.
-   *
-   * Omitted is the ordinary case for a website declaring no package-shipped
-   * provider: no such file is generated, so there is nothing to import.
-   */
-  frontendProviderModules?: GeneratedWebsiteProviderModules;
+  /** Product origin for navigation and call-to-action components inside the blog island.
+   * Supplied by the Astro page from websiteConfig, just as on ordinary page bridges. */
+  appOrigin?: string;
 }
 
 const EMPTY_MDX_COMPONENTS: WebsiteMdxComponentsMap = Object.freeze({});
@@ -364,7 +367,7 @@ export function createWebsiteBlogPostBridgeIsland(
     designTokens,
     skipToMainContentLabelKey,
     frontendProviders,
-    frontendProviderModules,
+    appOrigin,
   }: WebsiteBlogPostBridgeIslandProps): ReactNode {
     const MdxBody = slugToMdxBody[slug];
     if (MdxBody === undefined) {
@@ -389,6 +392,13 @@ export function createWebsiteBlogPostBridgeIsland(
       );
     }
 
+    // After the missing-slug throw on purpose: that throw ends the render, so it never changes the
+    // hook order of a render that completes, and the build-time error stays reachable.
+    const { frontendProviderRegistry, providerComponentRegistry } = useWebsiteProviderRegistries({
+      frontendProviders,
+      frontendProviderModules: deps.frontendProviderModules,
+      providerComponentLoaders: deps.providerComponentLoaders,
+    });
     const runtimeValue: WebsiteRuntimeContextValue = {
       locale,
       defaultLocale,
@@ -396,10 +406,10 @@ export function createWebsiteBlogPostBridgeIsland(
       designTokens,
       navigation,
       skipToMainContentLabelKey,
-      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
-        entries: frontendProviders,
-        modules: frontendProviderModules,
-      }),
+      appOrigin,
+      ...(deps.consentBannerComponent !== undefined ? { consentBannerComponent: deps.consentBannerComponent } : {}),
+      frontendProviderRegistry,
+      providerComponentRegistry,
     };
     return (
       <WebsiteRuntimeContextProvider value={runtimeValue}>

package/src/astro/bridge-runtime.tsx

@@ -1,15 +1,18 @@
+import { useMemo } from 'react';
 import type { ComponentType, FunctionComponent, ReactNode } from 'react';
 
-import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
+import type { FrontendProvidersBlock, PublicPricingCatalog } from '@wildo-ai/saas-models/public-runtime';
 import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
 import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
 } from '../core/contexts/WebsiteRuntimeContext';
-import { createFrontendWebsiteProviderRegistry } from '../core/external-providers/frontend-provider-registry.website';
+import { useWebsiteProviderRegistries } from '../core/external-providers/provider-component-registry.website';
+import type { ProviderComponentLoaderContribution } from '@wildo-ai/external-connectors-public/website';
 import type { GeneratedWebsiteProviderModules } from '../core/external-providers/frontend-provider-registry.website';
 import { WebsitePageLayout } from '../core/layouts/WebsitePageLayout';
+import type { WebsiteConsentRecorder } from '../core/consent/WebsiteConsentContext';
 import type { WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
 import type { WebsiteLabelKey } from '../schemas/label-keys/website-label-key.schemas';
 import type { WebsiteNavigationConfig } from '../schemas/manifests/website-root-config.shared.schemas';
@@ -70,22 +73,22 @@ import type { LabelPack } from '../schemas/validators/label-pack.validator';
  * } from '@wildo-ai/saas-website/astro';
  * import { LandingBridgeIsland } from '../pages-impl/landing.bridge';
  * import { LANDING_PAGE_MANIFEST } from '../pages-impl/landing.page';
- * import { WEBSITE_ROOT_CONFIG } from '../website-root.config';
+ * import { WEBSITE_SITE_CONTEXT } from '../website-site-context';
  *
  * const runtime = loadWebsitePageRuntime({
  *   manifest: LANDING_PAGE_MANIFEST,
- *   rootConfig: WEBSITE_ROOT_CONFIG,
+ *   siteContext: WEBSITE_SITE_CONTEXT,
  *   labelPacksDir: './src/i18n',
  *   astroLocale: Astro.currentLocale,
  * });
  * const headHtml = renderWebsitePageHeadHtml({
  *   manifest: LANDING_PAGE_MANIFEST,
- *   rootConfig: WEBSITE_ROOT_CONFIG,
+ *   siteContext: WEBSITE_SITE_CONTEXT,
  *   locale: runtime.locale,
  *   labelPack: runtime.labelPack,
  * });
  * const designTokensCss = renderWebsiteDesignTokensCss(
- *   WEBSITE_ROOT_CONFIG.designTokens,
+ *   WEBSITE_SITE_CONTEXT.rootConfig.designTokens,
  * );
  * ---
  * <!doctype html>
@@ -98,8 +101,11 @@ import type { LabelPack } from '../schemas/validators/label-pack.validator';
  *     <LandingBridgeIsland
  *       client:idle
  *       locale={runtime.locale}
+ *       defaultLocale={runtime.defaultLocale}
+ *       appOrigin={WEBSITE_SITE_CONTEXT.websiteConfig.appOrigin}
+ *       apiOrigin={WEBSITE_SITE_CONTEXT.websiteConfig.apiOrigin}
  *       labelPack={runtime.labelPack}
- *       designTokens={WEBSITE_ROOT_CONFIG.designTokens}
+ *       designTokens={WEBSITE_SITE_CONTEXT.rootConfig.designTokens}
  *     />
  *   </body>
  * </html>
@@ -144,6 +150,20 @@ import type { LabelPack } from '../schemas/validators/label-pack.validator';
  * island. NEVER cross the hydration boundary as serialized props.
  */
 export interface CreateWebsitePageBridgeIslandDeps {
+  /**
+   * Browser CODE imported by the consumer bridge, closed over at module load.
+   * Never pass executable modules through Astro island props: those are serialized.
+   * Config sync emits a stable map, including an empty map when no providers are declared.
+   */
+  frontendProviderModules?: GeneratedWebsiteProviderModules;
+  /**
+   * Loaders for provider components an ENGINE provider module declares but cannot import (#1703) —
+   * the website's facet-library door, the equivalent of the application's
+   * `contributeProviderComponentLoaders`. A provider PACKAGE that ships its own component needs
+   * nothing here: its module's `components[capability].load` is used. A DEPS entry because a loader
+   * is a function, and island props are serialized.
+   */
+  providerComponentLoaders?: ReadonlyArray<ProviderComponentLoaderContribution>;
   /**
    * The page's React component. Typically the same value that was
    * passed to `defineWebsitePageManifest({ pageComponent })` — the
@@ -160,6 +180,24 @@ export interface CreateWebsitePageBridgeIslandDeps {
    * runtime-safe.
    */
   PageComponent: ComponentType<any>;
+  /**
+   * Builds the recorder that persists a VISITOR's consent decision server-side, from the island's
+   * runtime `apiOrigin` (#1258).
+   *
+   * A DEPS entry rather than an island prop, for the reason this whole interface exists: it is a
+   * function, and island props are serialized. A factory rather than an instance, because the
+   * `apiOrigin` it needs is resolved per environment by the `.astro` page and only reaches the island
+   * as a prop.
+   *
+   * The engine cannot build this itself — a client needs the application's own
+   * `frontendServiceName`, which the engine has no way to know. The application already constructs
+   * one for its capture forms; passing THAT factory here is what makes a visitor's consent decision,
+   * their captured lead and their draft note share a single `uuidRef` and transpose together.
+   *
+   * Optional. Omitted, a decision lives in the visitor's browser and nowhere else — the behaviour
+   * before this existed, and correct for a site with no anonymous-session wiring.
+   */
+  consentRecorderFactory?: (apiOrigin: string) => WebsiteConsentRecorder;
   /**
    * The active page's ref. Carried as a primitive (string-branded)
    * value so the inner `WebsitePageLayout` can register the
@@ -173,6 +211,11 @@ export interface CreateWebsitePageBridgeIslandDeps {
    * serialization boundary.
    */
   navigation: WebsiteNavigationConfig;
+  /**
+   * Optional replacement for the framework's visitor consent panel (#534). Closed over for the same
+   * reason as `navigation`. See `WebsiteRuntimeContextValue.consentBannerComponent`.
+   */
+  consentBannerComponent?: ComponentType;
 }
 
 /**
@@ -212,26 +255,6 @@ export interface WebsitePageBridgeIslandProps {
   skipToMainContentLabelKey: WebsiteLabelKey;
   /** Optional website-facing public providers materialized at build time. */
   frontendProviders?: FrontendProvidersBlock;
-  /**
-   * The CODE channel for those providers (#332): the
-   * `generatedFrontendProviderModules` export of this website service's own
-   * `src/generated/frontend-providers.generated.ts`, written by
-   * `wildo config sync`.
-   *
-   * `frontendProviders` above says WHICH providers this service turned on, in
-   * this environment; this says what code the bundle actually contains for
-   * them. Both are needed, because a JSON payload cannot carry an SDK loader
-   * and a bundle cannot know which environment it is running in.
-   *
-   * NOT a JSON-serializable island prop like its siblings, and it does not need
-   * to be: the bridge module is bundled with the page, so the generated module
-   * map is an ordinary import in the same graph rather than something that has
-   * to cross the hydration boundary.
-   *
-   * Omitted is the ordinary case for a website declaring no package-shipped
-   * provider: no such file is generated, so there is nothing to import.
-   */
-  frontendProviderModules?: GeneratedWebsiteProviderModules;
   /**
    * Optional backend API origin (no trailing slash) forwarded into
    * `WebsiteRuntimeContext.apiOrigin` for anonymous-capture sections
@@ -259,6 +282,13 @@ export interface WebsitePageBridgeIslandProps {
    * the consumer's job and the whole point of removing the fallback.
    */
   appOrigin?: string;
+  /**
+   * The application's public pricing catalogue (#1835), forwarded into
+   * `WebsiteRuntimeContext.pricingCatalog` for `useWebsitePricingCatalog()`. Plain JSON-safe data
+   * (amounts travel as decimal strings, never `bigint`), loaded in the `.astro` frontmatter with
+   * `loadWebsitePricingCatalog()`. Passed only by pages with a pricing section.
+   */
+  pricingCatalog?: PublicPricingCatalog;
 }
 
 /**
@@ -280,10 +310,26 @@ export function createWebsitePageBridgeIsland(
     designTokens,
     skipToMainContentLabelKey,
     frontendProviders,
-    frontendProviderModules,
     apiOrigin,
     appOrigin,
+    pricingCatalog,
   }: WebsitePageBridgeIslandProps): ReactNode {
+    /*
+     * Both must be present: the factory is build-time wiring and `apiOrigin` is per-environment, and
+     * a page that declares no capture section legitimately has neither. Memoised on `apiOrigin` so a
+     * re-render cannot hand the provider a new identity and re-post a decision nobody retook.
+     */
+    const consentRecorder = useMemo(
+      () => (deps.consentRecorderFactory !== undefined && apiOrigin !== undefined
+        ? deps.consentRecorderFactory(apiOrigin)
+        : undefined),
+      [apiOrigin],
+    );
+    const { frontendProviderRegistry, providerComponentRegistry } = useWebsiteProviderRegistries({
+      frontendProviders,
+      frontendProviderModules: deps.frontendProviderModules,
+      providerComponentLoaders: deps.providerComponentLoaders,
+    });
     const runtimeValue: WebsiteRuntimeContextValue = {
       locale,
       defaultLocale,
@@ -291,16 +337,16 @@ export function createWebsitePageBridgeIsland(
       designTokens,
       navigation,
       skipToMainContentLabelKey,
-      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
-        entries: frontendProviders,
-        modules: frontendProviderModules,
-      }),
+      frontendProviderRegistry,
+      providerComponentRegistry,
+      ...(deps.consentBannerComponent !== undefined ? { consentBannerComponent: deps.consentBannerComponent } : {}),
       apiOrigin,
       appOrigin,
+      ...(pricingCatalog !== undefined ? { pricingCatalog } : {}),
     };
     return (
       <WebsiteRuntimeContextProvider value={runtimeValue}>
-        <WebsitePageLayout pageRef={pageRef}>
+        <WebsitePageLayout pageRef={pageRef} {...(consentRecorder !== undefined ? { consentRecorder } : {})}>
           <PageComponent />
         </WebsitePageLayout>
       </WebsiteRuntimeContextProvider>