@wildo-ai/saas-website 1.1.4 → 1.1.6

package/src/astro/label-pack-loader.ts

@@ -4,6 +4,8 @@ import { resolve } from 'node:path';
 import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
 import type { WebsiteLabelKey } from '../schemas/label-keys/website-label-key.schemas';
+import { WEBSITE_CONSENT_LABEL_KEYS } from '../schemas/label-keys/website-consent-label-keys.schemas';
+import { WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS } from '../schemas/label-keys/website-provider-component-label-keys.schemas';
 import type { WebsitePageManifest } from '../schemas/manifests/website-page-manifest.shared.schemas';
 import type { WebsiteRootConfig } from '../schemas/manifests/website-root-config.shared.schemas';
 import {
@@ -20,10 +22,10 @@ import type { WebsiteSiteContext } from './website-site-context';
  *
  * `label-pack-loader.ts` — synchronous, fs-backed loader for
  * marketing-site label packs. Consumed by:
- *   - the Astro adapter (`WebsitePageBridge.astro` reads the active
- *     locale's pack at request time during SSR / pre-render),
- *   - the `wildo website audit` CLI (Phase 7) to validate every
- *     locale pack against every manifest at CI time,
+ *   - each page's `.astro` frontmatter, through `loadWebsitePageRuntime`,
+ *     which reads the active locale's pack during SSR / pre-render,
+ *   - `wildo website audit`, which validates every locale pack against
+ *     every manifest and section through `loadAndValidateAllLabelPacks`,
  *   - any build-time hook that wants to fail fast on a missing or
  *     malformed pack.
  *
@@ -207,6 +209,12 @@ function composeEffectiveChromeLabelKeys(
 ): readonly WebsiteLabelKey[] {
   const set = new Set<WebsiteLabelKey>(rootConfig.chromeLabelKeys);
   set.add(rootConfig.skipToMainContentLabelKey);
+  // The visitor consent panel is framework-owned in the same way (#534): required in every pack, so a site
+  // that turns on analytics can never ship it with an unlabelled way to refuse.
+  for (const key of WEBSITE_CONSENT_LABEL_KEYS) set.add(key);
+  // So is the provider-component slot's refusal wording (#1703): a site placing an address lookup must not
+  // ship its consent-required or unavailable state as a raw key.
+  for (const key of WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS) set.add(key);
   return Array.from(set);
 }
 

package/src/astro/robots-renderer.ts

@@ -34,10 +34,12 @@ import type { WebsiteSiteContext } from './website-site-context';
  *   2. Per-bot blocks for `disallowedCrawlers` (allow-by-default
  *      direction) — each named bot gets its own `User-agent: <bot>`
  *      + `Disallow: /` block.
- *   3. Catch-all `User-agent: *` block carrying the site-wide
- *      `policy` (`Disallow: /` if `policy === 'noindex'` OR if
- *      `allowedCrawlers` is set, otherwise nothing) and any
- *      `disallow[]` path-prefix entries.
+ *   3. Catch-all `User-agent: *` block: `Disallow: /` only when
+ *      `allowedCrawlers` is set (the named bots are then the only ones
+ *      permitted), otherwise the allow-everything `Disallow:` plus any
+ *      `disallow[]` path-prefix entries. `policy === 'noindex'` adds
+ *      nothing here — it is expressed by the page's robots meta tag,
+ *      which a crawler can only read if it may fetch the page (#494).
  *   4. `Sitemap: <publicOrigin>/sitemap-index.xml` footer when
  *      `seo.sitemap?.enabled !== false` (defaults to `true`).
  *      `@astrojs/sitemap` emits `sitemap-index.xml` regardless of
@@ -57,10 +59,9 @@ import type { WebsiteSiteContext } from './website-site-context';
  *
  * The `Sitemap:` directive is independent from any `User-agent`
  * block — it is a top-level signal to any crawler that the site
- * publishes a sitemap. Even when the catch-all policy is
- * `Disallow: /` (e.g. `policy === 'noindex'`), the `Sitemap:` line
- * stays useful: a crawler that ignores `noindex` (Bing was famous
- * for this) at least has a single canonical URL list to consult,
+ * publishes a sitemap. Even when the catch-all is `Disallow: /`
+ * (`allowedCrawlers` set), the `Sitemap:` line stays useful: the
+ * permitted crawlers have a single canonical URL list to consult,
  * and human readers of `robots.txt` see the publication contract
  * intact.
  *
@@ -120,13 +121,12 @@ export function renderRobotsTxt(siteContext: WebsiteSiteContext): string {
   }
 
   /**
-   * Block 3 — catch-all `User-agent: *`. Two policy-driven shapes:
-   *   - `noindex` → `Disallow: /` (the site-wide closure).
-   *   - `index` (default) → `Disallow:` is the spec-canonical "allow
-   *     everything" line; combined with any per-path `Disallow: <path>`
-   *     entries from `disallow[]`. When `allowedCrawlers` is set, the
-   *     catch-all also closes the rest of the crawler universe with
-   *     `Disallow: /` so the named bots are the ONLY ones permitted.
+   * Block 3 — catch-all `User-agent: *`. `Disallow:` is the
+   *   spec-canonical "allow everything" line, combined with any per-path
+   *   `Disallow: <path>` entries from `disallow[]`. When `allowedCrawlers`
+   *   is set, the catch-all instead closes the rest of the crawler universe
+   *   with `Disallow: /` so the named bots are the ONLY ones permitted. The
+   *   `policy` is not expressed here at all — see below.
    */
   const catchAllLines: string[] = ['User-agent: *'];
   /*

package/src/astro/website-page-head.renderer.ts

@@ -1,7 +1,7 @@
 import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
 import { buildLocalizedRoutePath } from '../core/routing/internal-routing.utils';
-import type { WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
+import { websiteDesignTokenCssProperty, type WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
 import type { WebsitePageManifest } from '../schemas/manifests/website-page-manifest.shared.schemas';
 import type { LabelPack } from '../schemas/validators/label-pack.validator';
 
@@ -277,7 +277,7 @@ export function renderWebsiteDesignTokensCss(tokens: WebsiteDesignTokens): strin
     if (groupValue !== null && typeof groupValue === 'object' && !Array.isArray(groupValue)) {
       for (const [tokenName, tokenValue] of Object.entries(groupValue) as [string, unknown][]) {
         if (typeof tokenValue === 'string') {
-          lines.push(`  --website-${groupName}-${tokenName}: ${tokenValue};`);
+          lines.push(`  ${websiteDesignTokenCssProperty(groupName, tokenName)}: ${tokenValue};`);
         }
       }
     } else if (typeof groupValue === 'string') {

package/src/astro/website-site-context.ts

@@ -10,7 +10,8 @@ import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtim
  * `WebsiteRootConfig` (page registry, design tokens, navigation chrome,
  * site-level SEO branding) with the per-service `WildoMarketingWebsiteConfig`
  * loaded from `wildo.website.config.ts` (locales, default locale,
- * public origin, future `appOrigin` cross-origin handoff target).
+ * public origin, and the `appOrigin` / `apiOrigin` the site reaches the
+ * product through — settled for THIS build by `loadWebsiteSiteContext`).
  *
  * # Why a dedicated aggregator type (vs. threading both raw configs)
  *
@@ -84,7 +85,9 @@ export interface WebsiteSiteContext {
    * The per-service `WildoMarketingWebsiteConfig` loaded from
    * `wildo.website.config.ts`. Single source of truth for the
    * marketing-site ROUTING + ORIGIN surface (`defaultLocale`,
-   * `locales`, `publicOrigin`, future `appOrigin`).
+   * `locales`, `publicOrigin`, `appOrigin`, `apiOrigin`). The two origins
+   * are the values for THIS build (override, local dev, authored — see
+   * `resolveWebsiteBuildOrigins`), which is why every page reads them here.
    */
   readonly websiteConfig: WildoMarketingWebsiteConfig;
   /**

package/src/companion-exports.ts

@@ -8,22 +8,15 @@
  *   - anything Astro-build-time that cannot pull React into the
  *     evaluation graph
  *
- * Per `saas-website-slice.md` §"Note on `companion-exports.ts` scope
- * expansion": the SEO builder library lives here too (it's pure
- * string + JSON-LD generation, React-free by design).
- *
  * @wildo-boundary
- *   This file MUST re-export ONLY from `schemas/**` and `seo/**`.
- *   It MUST NOT import or re-export anything from:
- *     - `core/**`         (React runtime contexts/hooks)
- *     - `astro/**`        (Astro-only adapter)
- *     - `mdx/**`          (MDX-only adapter)
- *     - `integration/**`  (React-bearing integration code)
- *   It MUST NOT import React, Astro, or `@mdx-js/*`.
- *
- *   Enforced by review until Phase 8 boundary lint design (see plan).
- *
- * Phase 1 status: schemas exposed; SEO builders land in Phase 2.5.
+ *   This file re-exports ONLY from `schemas/**`. It MUST NOT import or
+ *   re-export anything from `core/**` (React contexts/hooks), `astro/**`
+ *   (Astro/Node adapter), `mdx/**` or `config/**`, and MUST NOT import
+ *   React, Astro or `@mdx-js/*`. The SEO and structured-data renderers
+ *   are React-free string builders too, but they live on `/astro` beside
+ *   the build-time helpers that call them, and are reached from there.
+ *   Enforced by `src/__tests__/bundle-isolation.test.ts` and
+ *   `schemas/__tests__/companion-exports-react-free.test.ts`.
  */
 
 export * from './schemas/refs/page-ref.schemas';

package/src/config/__tests__/website-build-origins.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+
+import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
+
+import { resolveWebsiteBuildOrigins } from '../load-website-site-context';
+import type { WildoMarketingWebsiteConfig } from '../wildo-website-config.schemas';
+
+const AUTHORED: WildoMarketingWebsiteConfig = {
+  publicOrigin: 'https://example.com',
+  appOrigin: 'https://app.example.com',
+  apiOrigin: 'https://api.example.com',
+  defaultLocale: AvailableLanguage.EN,
+  locales: [{ locale: AvailableLanguage.EN, path: 'en' }],
+} as WildoMarketingWebsiteConfig;
+
+const LOCAL = { app: 'http://localhost:4272', api: 'http://localhost:4271' };
+
+describe('resolveWebsiteBuildOrigins', () => {
+  it('under astro dev, links into the locally running product and API', () => {
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment: true, localOrigins: LOCAL, overrides: {} });
+    expect(resolved.appOrigin).toBe('http://localhost:4272');
+    expect(resolved.apiOrigin).toBe('http://localhost:4271');
+    expect(resolved.publicOrigin).toBe('https://example.com');
+  });
+
+  it('a production build keeps the authored origins, never a localhost one', () => {
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment: false, localOrigins: LOCAL, overrides: {} });
+    expect(resolved.appOrigin).toBe('https://app.example.com');
+    expect(resolved.apiOrigin).toBe('https://api.example.com');
+  });
+
+  it('an explicit per-environment override wins in both modes', () => {
+    const overrides = { appOrigin: 'https://app.staging.example.com', apiOrigin: 'https://api.staging.example.com' };
+    for (const isDevelopment of [true, false]) {
+      const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment, localOrigins: LOCAL, overrides });
+      expect(resolved.appOrigin).toBe(overrides.appOrigin);
+      expect(resolved.apiOrigin).toBe(overrides.apiOrigin);
+    }
+  });
+
+  it('falls back to the authored origin when the app declares no local port', () => {
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment: true, localOrigins: {}, overrides: {} });
+    expect(resolved.appOrigin).toBe('https://app.example.com');
+    expect(resolved.apiOrigin).toBe('https://api.example.com');
+  });
+
+  it('leaves apiOrigin absent when nothing supplies one, so a capture form can refuse loudly', () => {
+    const { apiOrigin: _omitted, ...withoutApi } = AUTHORED;
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: withoutApi as WildoMarketingWebsiteConfig, isDevelopment: false, localOrigins: LOCAL, overrides: {} });
+    expect('apiOrigin' in resolved).toBe(false);
+  });
+});

package/src/config/define-website-config.ts

@@ -13,8 +13,9 @@
  *
  * The warner has ZERO branches today because every OPTIONAL field that
  * exists is already wired (`csp?` now flows through the website-local
- * CSP sync step) and the only unwired field left is `appOrigin`, which
- * is REQUIRED. After the seam-collapse (`saas-website-seam-collapse.md`
+ * CSP sync step), and every REQUIRED field has a runtime consumer too —
+ * `appOrigin` reaches every CTA through `WebsiteRuntimeContext.appOrigin`,
+ * settled per build by `loadWebsiteSiteContext`. After the seam-collapse (`saas-website-seam-collapse.md`
  * — SHIPPED), the routing/origin fields (`publicOrigin`,
  * `defaultLocale`, `locales`) are consumed directly by every Astro
  * engine helper via `WebsiteSiteContext`, so they are no longer
@@ -99,14 +100,13 @@ export function defineWebsiteConfig(
  * but has no runtime consumer yet.
  *
  * Branches today: ZERO. The one OPTIONAL field that exists (`csp?`) is
- * fully wired through the website-local CSP sync/build path, while the
- * only field that still lacks a runtime consumer (`appOrigin`) is
- * REQUIRED. After the seam-collapse (`saas-website-seam-collapse.md` —
- * SHIPPED) the routing/origin fields are consumed directly by every
- * Astro engine helper via `WebsiteSiteContext`. Required-but-unwired
- * fields cannot reasonably fire on every parse — that's a
- * deferred-wiring surface tracked in the schema header, not an
- * `@unimplemented` warner concern.
+ * fully wired through the website-local CSP sync/build path. After the
+ * seam-collapse (`saas-website-seam-collapse.md` — SHIPPED) the
+ * routing/origin fields are consumed directly by every Astro engine
+ * helper via `WebsiteSiteContext`, and `appOrigin` / `apiOrigin` are
+ * settled per build by `loadWebsiteSiteContext` and read by every page.
+ * A required field could never fire this warner anyway — it would fire
+ * on every parse.
  *
  * The function exists as a structural mirror of
  * `defineTechnicalDocConfig.emitUnimplementedRuntimeWarnings` so

package/src/config/load-website-config.ts

@@ -37,6 +37,7 @@ import { AppFrontendType, loadConfig } from '@wildo-ai/platform-config-lib';
 import type { WildoSaasConfig } from '@wildo-ai/platform-config-lib';
 import type { WildoMarketingWebsiteConfig } from './wildo-website-config.schemas';
 
+import { describeThrownValue } from '@wildo-ai/saas-models/public-runtime';
 /**
  * Conventional file name for the per-service marketing-website
  * configuration (Step 7.5 refactor — `saas-website-slice.md` /
@@ -125,6 +126,30 @@ export interface LoadWebsiteConfigArgs {
   saasConfig: WildoSaasConfig;
 }
 
+/**
+ * The application's one `STATIC_WEBSITE` service, as `[serviceKey, service]`.
+ * Throws when none is declared: the service folder is what owns
+ * `wildo.website.config.ts`, so a website build without one has nothing to load.
+ */
+export function resolveStaticWebsiteServiceEntry(
+  saasConfig: WildoSaasConfig,
+): [string, WildoSaasConfig['services'][string]] {
+  const websiteServiceEntry = Object.entries(saasConfig.services).find(
+    ([, service]) => service.frontendType === AppFrontendType.STATIC_WEBSITE,
+  );
+  if (!websiteServiceEntry) {
+    throw new Error(
+      '[wildo-website-config] No frontend service with `frontendType: STATIC_WEBSITE` is declared in '
+        + 'wildo.saas.config.ts. The marketing-website Astro build / loader requires an authored '
+        + 'STATIC_WEBSITE service because that service folder owns the per-service '
+        + '`wildo.website.config.ts` (publicOrigin, appOrigin, defaultLocale, locales). '
+        + 'Add a STATIC_WEBSITE service in wildo.saas.config.ts and ship the per-service '
+        + 'config file under it.',
+    );
+  }
+  return websiteServiceEntry;
+}
+
 /**
  * Discover and load the per-service marketing-website config.
  *
@@ -168,20 +193,7 @@ export async function loadWebsiteConfig(
   args: LoadWebsiteConfigArgs,
 ): Promise<WildoMarketingWebsiteConfig> {
   const { saasRoot, saasConfig } = args;
-
-  const websiteServiceEntry = Object.entries(saasConfig.services).find(
-    ([, service]) => service.frontendType === AppFrontendType.STATIC_WEBSITE,
-  );
-  if (!websiteServiceEntry) {
-    throw new Error(
-      '[wildo-website-config] No frontend service with `frontendType: STATIC_WEBSITE` is declared in '
-        + 'wildo.saas.config.ts. The marketing-website Astro build / loader requires an authored '
-        + 'STATIC_WEBSITE service because that service folder owns the per-service '
-        + '`wildo.website.config.ts` (publicOrigin, appOrigin, defaultLocale, locales). '
-        + 'Add a STATIC_WEBSITE service in wildo.saas.config.ts and ship the per-service '
-        + 'config file under it.',
-    );
-  }
+  const websiteServiceEntry = resolveStaticWebsiteServiceEntry(saasConfig);
 
   const [websiteServiceKey, websiteService] = websiteServiceEntry;
   const websiteConfigPath = resolvePath(
@@ -213,7 +225,7 @@ export async function loadWebsiteConfig(
   try {
     loaded = await loadConfig<WildoMarketingWebsiteConfig>(websiteConfigPath);
   } catch (e) {
-    const cause = e instanceof Error ? e.message : String(e);
+    const cause = describeThrownValue(e);
     throw new Error(
       `[wildo-website-config] Failed to load per-service marketing-website config at `
         + `${websiteConfigPath}. The file MUST do `

package/src/config/load-website-pricing-catalog.ts

@@ -0,0 +1,52 @@
+/**
+ * @wildo_source:part:start saas.website.config.pricing-catalog-loader facet:layer:astro facet:family:website facet:audience:app-developer
+ *
+ * `loadWebsitePricingCatalog` — the application's public pricing catalogue, for a website's pricing
+ * page (#1835). Call it in the page's `.astro` frontmatter, pass the result to the bridge island as
+ * `pricingCatalog`, and read it in the section with `useWebsitePricingCatalog()`; build the page's
+ * `AggregateOffer` from the same value with `buildWebsitePricingOfferStructuredData`.
+ *
+ * It walks up to `wildo.saas.config.ts` the way `loadWebsiteSiteContext` does, and reads the billing
+ * catalogue the backend sells from — the `productDefinitions` of the application's shared modules —
+ * through `loadApplicationPublicPricingCatalog`, from SOURCE, so a website image that builds only the
+ * website still sees the current catalogue.
+ *
+ * Separate from `loadWebsiteSiteContext` on purpose: loading the shared graph costs seconds, and only a
+ * pricing page needs it. Every other page's build stays as fast as it was.
+ *
+ * **Node-only.** Lives on the `/config-loader` subpath; it must never reach a React-island bundle.
+ */
+import {
+  loadApplicationPublicPricingCatalog,
+  loadConfig,
+  resolveWorkspaceScope,
+  type WildoSaasConfig,
+} from '@wildo-ai/platform-config-lib';
+import type { PublicPricingCatalog } from '@wildo-ai/saas-models/public-runtime';
+
+export interface LoadWebsitePricingCatalogInput {
+  /** Where to start the walk up to `wildo.saas.config.ts`. Defaults to the working directory. */
+  readonly cwd?: string | undefined;
+  /**
+   * Keep only plans this scope may subscribe to (a `ResourcePrimaryScope` wire value, e.g.
+   * `'organizations'`). Omit when the catalogue sells to one audience.
+   */
+  readonly targetScope?: string | undefined;
+}
+
+export async function loadWebsitePricingCatalog(input: LoadWebsitePricingCatalogInput = {}): Promise<PublicPricingCatalog> {
+  const workspaceScope = resolveWorkspaceScope(input.cwd);
+  if (workspaceScope.saasRoot === null || workspaceScope.saasConfigPath === null) {
+    throw new Error(
+      `[saas-website] No wildo.saas.config.ts found walking up from ${input.cwd ?? process.cwd()}. `
+        + 'Run astro from inside the application workspace.',
+    );
+  }
+  const saasConfig = await loadConfig<WildoSaasConfig>(workspaceScope.saasConfigPath);
+  return loadApplicationPublicPricingCatalog({
+    saasRoot: workspaceScope.saasRoot,
+    saasConfig,
+    ...(input.targetScope === undefined ? {} : { targetScope: input.targetScope }),
+  });
+}
+/** @wildo_source:part:end saas.website.config.pricing-catalog-loader */

package/src/config/load-website-site-context.ts

@@ -0,0 +1,145 @@
+/**
+ * @wildo_source:part:start saas.website.config.site-context-loader facet:layer:astro facet:family:website facet:audience:app-developer
+ *
+ * `loadWebsiteSiteContext` — the ONE way a website workspace builds its
+ * `WebsiteSiteContext`. Called once, from the workspace's
+ * `src/website-site-context.ts`:
+ *
+ * ```ts
+ * import { loadWebsiteSiteContext } from '@wildo-ai/saas-website/config-loader';
+ * import { WEBSITE_ROOT_CONFIG } from './website-root.config';
+ *
+ * export const WEBSITE_SITE_CONTEXT = await loadWebsiteSiteContext({
+ *   rootConfig: WEBSITE_ROOT_CONFIG,
+ *   isDevelopment: import.meta.env?.DEV === true,
+ * });
+ * ```
+ *
+ * It walks up from the working directory to `wildo.saas.config.ts`, finds the
+ * application's single `STATIC_WEBSITE` service, loads that service's
+ * `wildo.website.config.ts` and its materialized provider block, and settles the
+ * two origins the site reaches the product through (see
+ * {@link resolveWebsiteBuildOrigins}).
+ *
+ * **Why the engine owns this.** Every website workspace used to carry its own
+ * copy of this lookup — the scaffolded ones and the hand-written ones alike —
+ * and each copy hardcoded its local API port while the app origin had no local
+ * form at all. The result: under `astro dev`, every "Start free" CTA pointed at a
+ * production-shaped host that resolves to nothing. One loader means one rule.
+ *
+ * **Why it walks up from the working directory, never from `import.meta.url`.**
+ * Astro's prerender pass bundles the calling module into `dist/.prerender/chunks/…`,
+ * where a `new URL('../..', import.meta.url)` anchor resolves to `dist/` rather than
+ * the application root — every prerendered route then failed with "Config file not
+ * found: …/website/dist/wildo.saas.config.ts", while `astro dev` hid it by serving
+ * from `src/`. Every `astro dev` / `astro build` runs with the website package (or
+ * an ancestor) as its working directory, which is inside the application either way.
+ *
+ * **Node-only.** Lives on the `/config-loader` subpath with the other loaders; it
+ * must never reach a React-island bundle.
+ */
+import { resolve as resolvePath } from 'node:path';
+
+import {
+  loadConfig,
+  loadMaterializedFrontendProviders,
+  resolveFrontendServicesArtifactPath,
+  resolveLocalhostApplicationOrigins,
+  resolveWorkspaceScope,
+  type LocalhostApplicationOrigins,
+  type WildoSaasConfig,
+} from '@wildo-ai/platform-config-lib';
+
+import { composeWebsiteSiteContext, type WebsiteSiteContext } from '../astro/website-site-context';
+import type { WebsiteRootConfig } from '../schemas/manifests/website-root-config.shared.schemas';
+import { loadWebsiteConfig, resolveStaticWebsiteServiceEntry } from './load-website-config';
+import type { WildoMarketingWebsiteConfig } from './wildo-website-config.schemas';
+
+/** Explicit per-build origin overrides — what a deploy build passes as build arguments. */
+export interface WebsiteOriginOverrides {
+  /** `PUBLIC_APP_ORIGIN`: this environment's product origin, derived by the deploy workflow. */
+  readonly appOrigin?: string | undefined;
+  /** `PUBLIC_API_ORIGIN`: this environment's API origin. */
+  readonly apiOrigin?: string | undefined;
+}
+
+export interface ResolveWebsiteBuildOriginsInput {
+  /** The authored `wildo.website.config.ts` — the production default. */
+  readonly websiteConfig: WildoMarketingWebsiteConfig;
+  /** `true` under `astro dev`. */
+  readonly isDevelopment: boolean;
+  /** Where the product and API run locally, from the app's own declared ports. */
+  readonly localOrigins: LocalhostApplicationOrigins;
+  /** Explicit overrides, which win over everything. */
+  readonly overrides: WebsiteOriginOverrides;
+}
+
+/**
+ * The `websiteConfig` this BUILD serves, with `appOrigin` and `apiOrigin` settled.
+ *
+ * Precedence, per origin:
+ *
+ * 1. an explicit override (`PUBLIC_APP_ORIGIN` / `PUBLIC_API_ORIGIN`) — the deploy
+ *    workflow derives these per environment, so a staging build links into staging;
+ * 2. under `astro dev`, the locally running product / API, from the ports the
+ *    application declares — so a CTA reaches the process `wildo local dev` started;
+ * 3. the value authored in `wildo.website.config.ts`.
+ *
+ * The result replaces the two fields in `websiteConfig` rather than living beside
+ * it, because every page already forwards `websiteConfig.appOrigin` /
+ * `websiteConfig.apiOrigin` into its island: a second field would be a second
+ * source that pages could read instead. `websiteConfig` in a site context is
+ * therefore "the config as it applies to this build", which the config file was
+ * already half-way to being — it reads `PUBLIC_APP_ORIGIN` itself.
+ */
+export function resolveWebsiteBuildOrigins(input: ResolveWebsiteBuildOriginsInput): WildoMarketingWebsiteConfig {
+  const { websiteConfig, isDevelopment, localOrigins, overrides } = input;
+  const settle = (override: string | undefined, local: string | undefined, authored: string | undefined): string | undefined =>
+    override || (isDevelopment ? local : undefined) || authored;
+  const appOrigin = settle(overrides.appOrigin, localOrigins.app, websiteConfig.appOrigin) ?? websiteConfig.appOrigin;
+  const apiOrigin = settle(overrides.apiOrigin, localOrigins.api, websiteConfig.apiOrigin);
+  return { ...websiteConfig, appOrigin, ...(apiOrigin === undefined ? {} : { apiOrigin }) };
+}
+
+export interface LoadWebsiteSiteContextInput {
+  /** The workspace's `WEBSITE_ROOT_CONFIG`. */
+  readonly rootConfig: WebsiteRootConfig;
+  /** Pass `import.meta.env?.DEV === true` (optional chaining: `astro.config.ts` evaluates the caller before Vite's env exists). */
+  readonly isDevelopment: boolean;
+  /** Where to start the walk up to `wildo.saas.config.ts`. Defaults to the working directory. */
+  readonly cwd?: string | undefined;
+  /** Defaults to `PUBLIC_APP_ORIGIN` / `PUBLIC_API_ORIGIN` from the process environment. */
+  readonly overrides?: WebsiteOriginOverrides | undefined;
+}
+
+export async function loadWebsiteSiteContext(input: LoadWebsiteSiteContextInput): Promise<WebsiteSiteContext> {
+  const workspaceScope = resolveWorkspaceScope(input.cwd);
+  if (workspaceScope.saasRoot === null || workspaceScope.saasConfigPath === null) {
+    throw new Error(
+      `[saas-website] No wildo.saas.config.ts found walking up from ${input.cwd ?? process.cwd()}. `
+        + 'Run astro from inside the application workspace.',
+    );
+  }
+  const saasRoot = workspaceScope.saasRoot;
+  const saasConfig = await loadConfig<WildoSaasConfig>(workspaceScope.saasConfigPath);
+  const [websiteServiceKey] = resolveStaticWebsiteServiceEntry(saasConfig);
+  const websiteConfig = await loadWebsiteConfig({ saasRoot, saasConfig });
+
+  return composeWebsiteSiteContext({
+    rootConfig: input.rootConfig,
+    websiteConfig: resolveWebsiteBuildOrigins({
+      websiteConfig,
+      isDevelopment: input.isDevelopment,
+      localOrigins: resolveLocalhostApplicationOrigins(saasConfig.services),
+      overrides: input.overrides ?? {
+        appOrigin: process.env.PUBLIC_APP_ORIGIN,
+        apiOrigin: process.env.PUBLIC_API_ORIGIN,
+      },
+    }),
+    frontendProviders: loadMaterializedFrontendProviders({
+      artifactPath: resolveFrontendServicesArtifactPath(resolvePath(saasRoot)),
+      serviceKey: websiteServiceKey,
+    }),
+  });
+}
+/** @wildo_source:part:end saas.website.config.site-context-loader */

package/src/config/wildo-website-config.schemas.ts

@@ -195,11 +195,16 @@ export const WildoMarketingWebsiteConfigSchema = z
      * Origin of the SaaS application the marketing site links into
      * (signup / login / pricing → checkout).
      *
-     * **Today**: NO runtime consumer. The cross-origin handoff
-     * surface that will read it does not exist yet. Authored
-     * eagerly so the link-surface PR is a single framework-owned move
-     * — until then the field is exercised only by the schema
-     * parser.
+     * Read at runtime since #493: each `.astro` page forwards it to its
+     * bridge island, and the CTA reads it off `WebsiteRuntimeContext`.
+     *
+     * Per environment: a deployment's app lives at a different host in each
+     * environment, and a static site bakes the value in at build time, so the
+     * generated deploy workflow passes the environment's app origin as
+     * `PUBLIC_APP_ORIGIN` — derived from the infra config's `serviceHosts` and
+     * `publicDomain`, not authored a second time. An application's
+     * `wildo.website.config.ts` reads that first and keeps its authored value
+     * as the default for a build that passes none.
      *
      * Distinct from the general `WildoSaasConfig.services.<name>`
      * URL surface because the marketing site is a separate Astro

package/src/config-loader.ts

@@ -33,3 +33,5 @@
  */
 
 export * from './config/load-website-config';
+export * from './config/load-website-site-context';
+export * from './config/load-website-pricing-catalog';

package/src/core/__tests__/WebsitePageLayout.test.tsx

@@ -5,7 +5,7 @@ import '@testing-library/jest-dom';
 import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
 
 import { WebsitePageLayout } from '../layouts/WebsitePageLayout';
-import { PROVIDER_SCRIPT_MARKER_ATTRIBUTE } from '../external-providers/provider-scripts.website';
+import { PROVIDER_SCRIPT_MARKER_ATTRIBUTE } from '@wildo-ai/external-connectors-public/website';
 import { createFrontendWebsiteProviderRegistry } from '../external-providers/frontend-provider-registry.website';
 import {
   WebsiteRuntimeContextProvider,

package/src/core/__tests__/contexts.test.tsx

@@ -7,7 +7,7 @@ import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
 } from '../contexts/WebsiteRuntimeContext';
-import { useWebsiteRuntime } from '../contexts/useWebsiteRuntime';
+import { useWebsitePricingCatalog, useWebsiteRuntime } from '../contexts/useWebsiteRuntime';
 import { WebsitePageContextProvider } from '../contexts/WebsitePageContext';
 import { useWebsitePage } from '../contexts/useWebsitePage';
 import { WebsiteSectionContextProvider } from '../contexts/WebsiteSectionContext';
@@ -76,6 +76,25 @@ describe('WebsiteRuntimeContext', () => {
   });
 });
 
+describe('useWebsitePricingCatalog', () => {
+  const wrapperWith = (value: WebsiteRuntimeContextValue) => ({ children }: { children: React.ReactNode }) => (
+    <WebsiteRuntimeContextProvider value={value}>{children}</WebsiteRuntimeContextProvider>
+  );
+
+  it('returns the catalogue the page passed to its island', () => {
+    const catalog = { plans: [] };
+    const { result } = renderHook(() => useWebsitePricingCatalog(), { wrapper: wrapperWith({ ...RUNTIME_FIXTURE, pricingCatalog: catalog }) });
+    expect(result.current).toBe(catalog);
+  });
+
+  it('fails loudly when the page passed none — a pricing section must never render "no plans" for a missing prop', () => {
+    vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    expect(() => renderHook(() => useWebsitePricingCatalog(), { wrapper: wrapperWith(RUNTIME_FIXTURE) })).toThrowError(
+      /did not pass a pricing catalogue/,
+    );
+  });
+});
+
 describe('WebsitePageContext', () => {
   it('provides the page ref through the provider component', () => {
     const pageRef = WebsitePageRefSchema.parse('landing');