@wildo-ai/saas-website 1.1.4 → 1.1.6

package/src/core/external-providers/useWebsiteProviderScripts.ts

@@ -12,35 +12,68 @@
  * does not exist would throw, and starting a vendor SDK there would run a live
  * analytics client inside a build.
  *
- * SDK activation comes from `@wildo-ai/external-connectors-public/website`, which
- * this package now depends on. The script injector beside it does NOT yet, and
- * that is a timing artifact rather than a decision: it belongs in the same
- * package so the technical doc can use one copy — a second copy of a DOM
- * mutation eventually disagrees about idempotence, which is how a vendor tag
- * gets loaded twice. Moving it needs that package's `dist` to carry it, and no
- * watcher is running in this tree; consolidating it is a one-step follow-up, not
- * a design question.
+ * Both come from `@wildo-ai/external-connectors-public/website`. The script
+ * injector lives there rather than here so the SaaS application, the technical
+ * doc and this site run ONE copy of it: a second copy of a DOM mutation
+ * eventually disagrees about idempotence, which is how a vendor tag gets loaded
+ * twice. It first shipped here alone, and that is how the application came to
+ * declare its Drive Picker's Google API script and never inject it.
+ *
+ * ## Client-side injection, and the alternative that was rejected
+ *
+ * This is an Astro static site, so the "obvious" home for a third-party tag is
+ * the built HTML `<head>`. That was rejected for now: the set of live providers
+ * is per SERVICE and per ENVIRONMENT, resolved from the materialized artifact,
+ * while the built HTML is one artifact shared across deploys of the same build.
+ * Baking the tags in would make the build environment-specific — the same class
+ * of coupling the DATA channel exists to avoid. Injecting from the client keeps
+ * one build correct everywhere, at the cost of the tag arriving after hydration.
+ * Revisit if a provider ever needs to run before first paint.
  */
 
-import { useEffect } from 'react';
+import { useEffect, useMemo, useRef, useState } from 'react';
 import {
   activateFrontendProviderSdks,
-  type ActivatedFrontendProviderSdks,
-} from '@wildo-ai/external-connectors-public/website';
-import {
-  collectDeclaredProviderScripts,
+  collectProviderScriptsWithoutComponents,
+  consentPurposesRequiredByProvider,
+  createFrontendProviderSdkActivationLane,
   injectProviderScripts,
-} from './provider-scripts.website';
-import { AppFrontendType } from '@wildo-ai/saas-models/public-runtime';
+} from '@wildo-ai/external-connectors-public/website';
+import { AppFrontendType, type ConsentPurpose } from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendWebsiteProviderRegistry } from './frontend-provider-registry.website';
+import type { WebsiteProviderComponentRegistry } from './provider-component-registry.website';
+import type { WebsiteProviderSdkActivation } from './website-provider-sdk-activations';
+
+/**
+ * A stable key for a granted-purpose set, so an effect re-runs when the SET changes and not when a new
+ * array with the same members is handed in.
+ */
+function grantedKey(grantedConsentPurposes: readonly ConsentPurpose[]): string {
+  return [...grantedConsentPurposes].sort().join(',');
+}
 
+/**
+ * Injects the `<script>` tags of the live providers that rest on NO consent purpose and render no component.
+ *
+ * No consent input, deliberately (#1704): an executed `<script>` cannot be stopped, so a provider that rests on a
+ * purpose must ship as a stoppable SDK (started on the grant and stopped on withdrawal by
+ * {@link useWebsiteProviderSdks}); a consent-based module declaring `scripts` is refused at projection and skipped by
+ * the collector. No grant could change what this injects.
+ */
 export function useWebsiteProviderScripts(
   registry: FrontendWebsiteProviderRegistry | undefined,
+  /**
+   * The website's provider-component registry (#1703). A provider with a registered component loads its
+   * scripts WITH that component, when a page first shows it — so an address lookup's vendor loader is
+   * not downloaded on every page of the site, only on the one with the form. This hook injects the rest.
+   */
+  componentRegistry?: WebsiteProviderComponentRegistry,
 ): void {
   useEffect(() => {
     if (typeof document === 'undefined') return;
 
-    const scripts = collectDeclaredProviderScripts(registry);
+    const withComponents = [...(componentRegistry?.providersWithComponents() ?? [])].map((providerRef) => ({ providerRef }));
+    const scripts = collectProviderScriptsWithoutComponents(registry?.modules.values() ?? [], withComponents);
     if (scripts.length === 0) return;
 
     injectProviderScripts(scripts, document);
@@ -48,7 +81,7 @@ export function useWebsiteProviderScripts(
     // work immediately; removing the element undoes neither, so a cleanup that
     // removed it would only make the next mount inject a SECOND copy of an
     // already-running script. Idempotence by `src` is the real guard.
-  }, [registry]);
+  }, [registry, componentRegistry]);
 }
 
 /**
@@ -60,33 +93,74 @@ export function useWebsiteProviderScripts(
  */
 export function useWebsiteProviderSdks(
   registry: FrontendWebsiteProviderRegistry | undefined,
-): void {
+  /**
+   * The purposes the visitor granted (#534). Providers are activated in TWO groups on purpose: those that
+   * rest on no purpose (error monitoring, captcha) are started once and never restarted by a consent
+   * change, while the consent-based ones start when their purpose is granted and are DEACTIVATED when it
+   * is withdrawn — which is the only way a withdrawal stops a running analytics client.
+   */
+  grantedConsentPurposes: readonly ConsentPurpose[],
+): ReadonlyArray<WebsiteProviderSdkActivation> {
+  const consentFree = useProviderSdkGroup(registry, false, []);
+  const consentBased = useProviderSdkGroup(registry, true, grantedConsentPurposes);
+  // The providers RUNNING on this page, both groups, published by the page layout (#1735): a form reads the captcha
+  // vendor's handle from here. Emptied the moment a group stops, so nothing holds a handle past a withdrawal.
+  return useMemo(() => [...consentFree, ...consentBased], [consentFree, consentBased]);
+}
+
+function useProviderSdkGroup(
+  registry: FrontendWebsiteProviderRegistry | undefined,
+  consentBased: boolean,
+  grantedConsentPurposes: readonly ConsentPurpose[],
+): ReadonlyArray<WebsiteProviderSdkActivation> {
+  const [running, setRunning] = useState<ReadonlyArray<WebsiteProviderSdkActivation>>([]);
+  // Keyed by the grants this group's providers actually rest on, so changing an unrelated purpose does
+  // not stop and restart a running analytics client.
+  const relevant = registry === undefined
+    ? []
+    : [...registry.modules.values()]
+      .filter((module) => (consentPurposesRequiredByProvider(module).length > 0) === consentBased)
+      .flatMap((module) => consentPurposesRequiredByProvider(module))
+      .filter((purpose) => grantedConsentPurposes.includes(purpose));
+  const key = grantedKey(relevant);
+  // One lane per group for the page's lifetime: a start waits for the previous stop.
+  const lane = useRef(createFrontendProviderSdkActivationLane());
   useEffect(() => {
     if (registry === undefined) return;
+    const modules = [...registry.modules.values()].filter(
+      (module) => (consentPurposesRequiredByProvider(module).length > 0) === consentBased,
+    );
+    if (modules.length === 0) return;
 
-    let unmounted = false;
-    let activated: ActivatedFrontendProviderSdks | undefined;
-
-    void activateFrontendProviderSdks({
-      surface: AppFrontendType.STATIC_WEBSITE,
-      modules: registry.modules.values(),
-      onDiagnostic: (diagnostic) => {
-        // The website runtime has no logger service, and a provider that cannot
-        // start is a developer-facing fact that must not be silent.
-        // eslint-disable-next-line no-console
-        console.warn(`[wildo-provider-sdk] ${diagnostic.kind}: ${diagnostic.message}`);
+    // Through the group's lane, so a start never overlaps the previous stop of the same page-global vendor (#1704): a
+    // visitor who grants, withdraws and grants again while the bundle downloads must not have the first run's stop
+    // switch off the second run's client. The stop also covers an unmount mid-download.
+    const stop = lane.current.start(
+      () => activateFrontendProviderSdks({
+        surface: AppFrontendType.STATIC_WEBSITE,
+        modules,
+        grantedConsentPurposes,
+        onDiagnostic: (diagnostic) => {
+          // The website runtime has no logger service, and a provider that cannot
+          // start is a developer-facing fact that must not be silent.
+          // eslint-disable-next-line no-console
+          console.warn(`[wildo-provider-sdk] ${diagnostic.kind}: ${diagnostic.message}`);
+        },
+      }),
+      (result) => {
+        setRunning(modules.flatMap((module) => {
+          const activation = result.activations.get(module.metadata.ref);
+          return activation === undefined
+            ? []
+            : [{ providerRef: module.metadata.ref, providerCapabilities: [...module.providerCapabilities], activation }];
+        }));
       },
-    }).then((result) => {
-      activated = result;
-      // Activation is asynchronous and unmount is not: if the surface went away
-      // while a vendor bundle was still downloading, stop what we just started
-      // rather than leaving a client nobody can reach.
-      if (unmounted) void result.deactivateAll();
-    });
-
+    );
     return () => {
-      unmounted = true;
-      void activated?.deactivateAll();
+      setRunning([]);
+      stop();
     };
-  }, [registry]);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- keyed by the granted SET, see grantedKey.
+  }, [registry, consentBased, key]);
+  return running;
 }

package/src/core/external-providers/website-provider-sdk-activations.ts

@@ -0,0 +1,23 @@
+/**
+ * The provider SDKs RUNNING on this website page (#1735), published by the page layout.
+ *
+ * A section reaches a running vendor through here rather than through a global — the contact form asks the consented
+ * captcha vendor for a token this way. The list is emptied the moment a provider is stopped (a consent withdrawal, a
+ * navigation), so a consumer that reads it at the moment it needs a handle never holds one past a withdrawal.
+ */
+import { createContext, useContext } from 'react';
+import type { ProviderFrontendSdkActivation } from '@wildo-ai/external-connectors-public/website';
+
+/** One running provider: its ref, the capabilities it serves, and its activation (whose `handle` is the vendor's client). */
+export interface WebsiteProviderSdkActivation {
+  readonly providerRef: string;
+  readonly providerCapabilities: ReadonlyArray<string>;
+  readonly activation: ProviderFrontendSdkActivation;
+}
+
+export const WebsiteProviderSdkActivationsContext = createContext<ReadonlyArray<WebsiteProviderSdkActivation>>([]);
+
+/** The provider SDKs running on this page, in declaration order. Empty outside a page layout and before any start. */
+export function useWebsiteProviderSdkActivations(): ReadonlyArray<WebsiteProviderSdkActivation> {
+  return useContext(WebsiteProviderSdkActivationsContext);
+}

package/src/core/factories/define-website-section.ts

@@ -71,9 +71,9 @@ export interface TypedWebsiteSectionDefinition<TProps>
  * **Why a factory instead of constructing the literal directly**:
  *   - Consumers don't have to remember to parse refs / keys
  *     themselves before assembling the literal.
- *   - The schema parse provides a single audited validation chokepoint
- *     so `wildo website audit` (Phase 7) can re-validate definitions
- *     without re-entering the React graph.
+ *   - The schema parse provides a single audited validation chokepoint,
+ *     and the parsed `expectedLabelKeys` are what `wildo website audit`
+ *     checks every locale pack against, without re-entering the React graph.
  *   - The factory is the documented authoring API the
  *     `website_factory_authoring` skill targets — keeping the
  *     authoring surface narrow lets the framework evolve the

package/src/core/layouts/WebsitePageLayout.tsx

@@ -1,14 +1,20 @@
 import React, { useMemo, type ReactNode } from 'react';
 import { BUILTIN_PROVIDER_CAPABILITY } from '@wildo-ai/saas-models/public-runtime';
+import { consentPurposesInUseByProviders } from '@wildo-ai/external-connectors-public/website';
 
 import { WebsitePageContextProvider } from '../contexts/WebsitePageContext';
 import {
   useWebsiteProviderScripts,
   useWebsiteProviderSdks,
 } from '../external-providers/useWebsiteProviderScripts';
+import { WebsiteProviderSdkActivationsContext } from '../external-providers/website-provider-sdk-activations';
 import type { WebsitePageContextValue } from '../contexts/WebsitePageContext';
 import { useWebsiteRuntime } from '../contexts/useWebsiteRuntime';
+import { websiteDesignTokenCssVar } from '../../schemas/design-tokens/website-design-tokens.shared.schemas';
 import { useWebsiteLabelByKey } from '../hooks/useWebsiteLabel';
+import { WebsiteConsentProvider, WebsiteConsentStatus, type WebsiteConsentRecorder } from '../consent/WebsiteConsentContext';
+import { useWebsiteConsent } from '../consent/useWebsiteConsent';
+import { WebsiteConsentBanner, WebsiteConsentSettingsButton } from '../consent/WebsiteConsentBanner';
 import {
   WebsitePageRefSchema,
   type WebsitePageRef,
@@ -96,10 +102,10 @@ const SKIP_LINK_FOCUS_CSS = `
   overflow: visible !important;
   clip: auto !important;
   white-space: normal !important;
-  background: var(--website-colors-background, #fff) !important;
-  color: var(--website-colors-foreground, #000) !important;
-  border: 2px solid var(--website-colors-primary, #000) !important;
-  border-radius: var(--website-radii-md, 0.375rem) !important;
+  background: ${websiteDesignTokenCssVar('colors', 'background', '#fff')} !important;
+  color: ${websiteDesignTokenCssVar('colors', 'foreground', '#000')} !important;
+  border: 2px solid ${websiteDesignTokenCssVar('colors', 'primary', '#000')} !important;
+  border-radius: ${websiteDesignTokenCssVar('radii', 'md', '0.375rem')} !important;
   z-index: 9999 !important;
   text-decoration: none !important;
 }
@@ -133,6 +139,14 @@ const SKIP_LINK_FOCUS_CSS = `
  *      captcha so non-React tooling can detect the configured vendor
  *      without reverse-engineering app code.
  *
+ *   4. **Provides the visitor's consent state and enforces it** (#534) —
+ *      mounts `WebsiteConsentProvider`, starts a provider SDK or script only
+ *      once the purpose it rests on is granted (and stops the SDK when it is
+ *      withdrawn), and renders the consent panel when the site runs a
+ *      consent-based provider and the visitor has not decided. Here rather
+ *      than in each bridge because every page — including every blog post —
+ *      renders through this layout, so no page can be mounted without it.
+ *
  * **Why semantic `<header>` / `<main>` / `<footer>` elements**:
  * marketing-site SEO scoring penalizes pages that ship a single
  * unstructured `<div>` tree. Using semantic landmarks costs nothing
@@ -178,6 +192,17 @@ export interface WebsitePageLayoutProps {
    * vertical-rhythm overrides on long-scroll landing pages.
    */
   mainClassName?: string;
+  /**
+   * OPTIONAL anonymous-session client. When supplied, a visitor's consent decision is ALSO recorded
+   * server-side against their session, which is what lets it follow them into the account they go on
+   * to create (#1258). Pass the SAME instance the page's capture sections use, so one `uuidRef`
+   * carries the decision, the lead and the draft note together.
+   *
+   * Absent keeps today's behaviour exactly: the decision lives in this browser and nowhere else.
+   * The engine cannot construct the client here — it needs the application's own
+   * `frontendServiceName` — which is why it arrives as a prop rather than off the runtime context.
+   */
+  consentRecorder?: WebsiteConsentRecorder;
   /**
    * The page's section composition. Typically a sequence of
    * `<WebsiteSection>` wrappers around concrete section components.
@@ -185,7 +210,21 @@ export interface WebsitePageLayoutProps {
   children: ReactNode;
 }
 
-export function WebsitePageLayout({
+export function WebsitePageLayout(props: WebsitePageLayoutProps): ReactNode {
+  const runtime = useWebsiteRuntime();
+  // Derived from the LIVE providers, so the panel asks about exactly what this site processes.
+  const purposesInUse = useMemo(
+    () => consentPurposesInUseByProviders(runtime.frontendProviderRegistry?.modules.values()),
+    [runtime.frontendProviderRegistry],
+  );
+  return (
+    <WebsiteConsentProvider purposesInUse={purposesInUse} recorder={props.consentRecorder}>
+      <WebsitePageLayoutContent {...props} />
+    </WebsiteConsentProvider>
+  );
+}
+
+function WebsitePageLayoutContent({
   pageRef,
   header,
   footer,
@@ -194,6 +233,7 @@ export function WebsitePageLayout({
   children,
 }: WebsitePageLayoutProps): ReactNode {
   const runtime = useWebsiteRuntime();
+  const consent = useWebsiteConsent();
 
   /**
    * Defensive parse: callers should pass a `WebsitePageManifest.ref`
@@ -240,8 +280,12 @@ export function WebsitePageLayout({
   // resolved provider refs and stamped them into the attributes below and
   // stopped there — a provider could be declared, enabled and hydrated without
   // anything of it ever running.
-  useWebsiteProviderScripts(runtime.frontendProviderRegistry);
-  useWebsiteProviderSdks(runtime.frontendProviderRegistry);
+  //
+  // Consent-based providers start only once their purpose is granted (#534). Before the stored decision is
+  // read, nothing is granted — the static HTML and the first render start nothing optional.
+  useWebsiteProviderScripts(runtime.frontendProviderRegistry, runtime.providerComponentRegistry);
+  // The running SDKs are published to the page (#1735): the contact form asks the consented captcha vendor for a token.
+  const runningProviderSdks = useWebsiteProviderSdks(runtime.frontendProviderRegistry, consent.grantedPurposes);
 
   const providerRootAttributes = useMemo<Record<string, string>>(() => {
     const attrs: Record<string, string> = {};
@@ -289,6 +333,7 @@ export function WebsitePageLayout({
 
   return (
     <WebsitePageContextProvider value={pageContextValue}>
+      <WebsiteProviderSdkActivationsContext.Provider value={runningProviderSdks}>
       <div
         data-website-page-ref={safePageRef as unknown as string}
         className={className}
@@ -314,9 +359,32 @@ export function WebsitePageLayout({
           {children}
         </main>
         {resolvedFooter !== null ? <footer>{resolvedFooter}</footer> : null}
+        {renderConsentSurface(consent, runtime.consentBannerComponent)}
       </div>
+      </WebsiteProviderSdkActivationsContext.Provider>
     </WebsitePageContextProvider>
   );
 }
 WebsitePageLayout.displayName = 'WebsitePageLayout';
+
+/**
+ * The panel while a decision is owed (or re-opened), the reopen button once one is made, and nothing at
+ * all on a site whose live providers rest on no consent. Nothing renders before the stored decision is
+ * read, so a visitor who already decided never sees the panel flash.
+ */
+function renderConsentSurface(
+  consent: ReturnType<typeof useWebsiteConsent>,
+  BannerOverride: React.ComponentType | undefined,
+): ReactNode {
+  if (!consent.isResolved || consent.purposesInUse.length === 0) return null;
+  if (consent.status === WebsiteConsentStatus.UNDECIDED || consent.isSettingsOpen) {
+    const Banner = BannerOverride ?? WebsiteConsentBanner;
+    return <Banner />;
+  }
+  return (
+    <div data-website-consent-settings="">
+      <WebsiteConsentSettingsButton />
+    </div>
+  );
+}
 /** @wildo_source:part:end saas.website.page-layout.component */

package/src/index.ts

@@ -11,75 +11,33 @@
  * accompanying SKILLs in `framework-knowledge`.
  *
  * @wildo-boundary
- *   - This barrel MAY re-export from any subdirectory of `src/`.
- *   - Subdirectories MUST observe their own boundary contracts (see
- *     each subdirectory's own `index.ts` `@wildo-boundary` block):
+ *   This barrel re-exports the React-side surface: `schemas/`, `core/`,
+ *   `components/`. The other entries are separate subpaths with their own
+ *   audiences — `/astro` (Node, Astro frontmatter), `/astro-island` (the
+ *   bridge factory), `/config` and `/config-loader` (Node), `/mdx`,
+ *   `/companion` (React-free). Per directory:
  *       - `schemas/`            : NO React, NO Astro, NO `~wildo-frontend-lib/**`
- *       - `seo/`                : NO React, NO Astro
- *       - `core/`               : MAY use React; NO `~wildo-frontend-lib/**` (Q17=B)
- *       - `astro/`              : MAY use Astro; NO React component runtime imports
+ *       - `core/`, `components/`: MAY use React; NO `~wildo-frontend-lib/**` (Q17=B)
+ *       - `astro/`              : MAY use Astro and Node; NO React component runtime imports
+ *       - `config/`             : Node-side loaders; never reachable from a React-island entry
  *       - `mdx/`                : MAY use `@mdx-js/*`
- *       - `integration/`        : MAY use React; MAY import the
- *                                 `@wildo-ai/saas-models/public-runtime` SUBPATH,
- *                                 the `@wildo-ai/presets-components-models/public-runtime`
- *                                 SUBPATH, `@wildo-ai/zod-decorators`,
- *                                 plus the SSR / Astro-middleware tier
- *                                 (`axios`, `jsonwebtoken`, `socket.io-client`,
- *                                 `reflect-metadata`) — D12 revised
- *                                 2026-04-19 (second same-day loosening);
- *                                 the ROOT barrels of `@wildo-ai/saas-models`
- *                                 and `@wildo-ai/presets-components-models`
- *                                 are FORBIDDEN (they boot the decorator
- *                                 framework / pull the heavy registry);
- *                                 the saas-app DI / backend stack
- *                                 (`inversify`, `mongoose`, `express`,
- *                                 `pino`, `helmet`, `argon2`, `bcrypt`,
- *                                 the `@wildo-ai/saas-frontend-lib` /
- *                                 `@wildo-ai/saas-backend-lib` /
- *                                 `@wildo-ai/external-connectors-models`
- *                                 root + subpath surfaces) is FORBIDDEN;
- *                                 MUST NOT import `~wildo-frontend-lib/**`
- *                                 (Q17=B / D16)
  *
- *   D12 (client-bundle import discipline, all `core/`/`schemas/`/`integration/`
- *   files): the entire saas-website source tree ships into a browser bundle
- *   (Astro SSG + React islands). Every shared model atom MUST come from a
- *   side-effect-free `/public-runtime` subpath:
- *     - `@wildo-ai/saas-models/public-runtime` is the primary door
- *       (saas-models-public-runtime.md K-6 — consumers see one path).
- *     - `@wildo-ai/presets-components-models/public-runtime` is the
- *       internal seam for symbols not (yet) re-exported by saas-models.
- *     - `@wildo-ai/zod-decorators` is allowed to import (first revision
- *       2026-04-19). The package itself is side-effect-free; only an
- *       explicit `initZodDecorators()` call mutates `z.ZodType.prototype`,
- *       which neither saas-website nor the saas-models /public-runtime
- *       barrel does.
- *     - `axios`, `jsonwebtoken`, `socket.io-client`, `reflect-metadata` are
- *       allowed for SSR / Astro-middleware code paths (second same-day
- *       revision 2026-04-19). The website engine needs them to provide
- *       middleware utilities (HTTP proxying to the SaaS backend, JWT
- *       verification of cross-frontend handoff codes, real-time push,
- *       decorator-metadata reads). They are SSR-tier — discipline
- *       (and a future strict/loose entry split for React islands vs
- *       middleware) keeps them out of the React-island bundle.
+ *   D12 (client-bundle import discipline): everything reachable from a
+ *   React-island entry ships to the browser, so every shared model atom
+ *   comes from a side-effect-free `/public-runtime` subpath —
+ *   `@wildo-ai/saas-models/public-runtime` first,
+ *   `@wildo-ai/presets-components-models/public-runtime` for symbols it does
+ *   not re-export yet — and `@wildo-ai/zod-decorators` is allowed because
+ *   only an explicit `initZodDecorators()` mutates Zod's prototype.
  *
- *   The ROOT barrel of `@wildo-ai/saas-models` is forbidden everywhere in
- *   this package — it calls `initZodDecorators()` at module load and pulls
- *   `@wildo-ai/external-connectors-models` + the full schema graph into
- *   the bundle. Same forbid applies to the root barrel of
- *   `@wildo-ai/presets-components-models`, the saas-app DI runtime
- *   (`inversify`, `@wildo-ai/saas-frontend-lib`, `@wildo-ai/saas-backend-lib`),
- *   and pure-backend libs (`mongoose`, `express`, `pino`, `helmet`,
- *   `argon2`, `bcrypt`). Enforced by `src/__tests__/bundle-isolation.test.ts`.
- *
- *   These boundaries are enforced by review + the bundle-isolation test
- *   above until Phase 8 promotes them to a programmatic ESLint check
- *   (cf. `saas-website-slice.md`
- *   §"DEFERRED to Phase 8 — boundary lint mechanism design").
- *
- * Phase 1+2 status: schemas + runtime contexts/hooks + layout
- * primitives + L1 placeholders + factories are all exported. Phase 5
- * adds the Astro adapter; Phase 5.7 the `integration/` layer.
+ *   The ROOT barrels of `@wildo-ai/saas-models` and
+ *   `@wildo-ai/presets-components-models` are forbidden everywhere in this
+ *   package (they boot the decorator framework and pull the full schema
+ *   graph), as are the saas-app DI runtime (`inversify`,
+ *   `@wildo-ai/saas-frontend-lib`, `@wildo-ai/saas-backend-lib`) and
+ *   pure-backend libs (`mongoose`, `express`, `pino`, `helmet`, `argon2`,
+ *   `bcrypt`). Enforced by `src/__tests__/bundle-isolation.test.ts`, which
+ *   walks every entry's import graph against an allow-list.
  *
  * D18 (L1 boundary, Phase 2): the L1 primitives (`WebsiteHeading`,
  * `WebsiteText`, `WebsiteButton`, `WebsiteLink`, `WebsiteImage`) are
@@ -95,10 +53,13 @@
 export * from './schemas/refs/page-ref.schemas';
 export * from './schemas/refs/section-ref.schemas';
 export * from './schemas/label-keys/website-label-key.schemas';
+export * from './schemas/label-keys/website-consent-label-keys.schemas';
+export * from './schemas/label-keys/website-provider-component-label-keys.schemas';
 export * from './schemas/sections/website-section-category.shared';
 export * from './schemas/sections/website-section-definition.shared.schemas';
 export * from './schemas/structured-data/website-structured-data.shared.schemas';
 export * from './schemas/structured-data/structured-data-reconciliation.shared';
+export * from './schemas/structured-data/pricing-offer-structured-data.shared';
 export * from './schemas/design-tokens/website-design-tokens.shared.schemas';
 export * from './schemas/manifests/website-page-manifest.shared.schemas';
 export * from './schemas/manifests/website-root-config.shared.schemas';
@@ -118,9 +79,21 @@ export * from './core/factories/define-website-page-manifest';
 export * from './core/layouts/WebsitePageLayout';
 export * from './core/layouts/WebsiteSection';
 
+export * from './core/consent/website-consent-storage';
+export * from './core/consent/WebsiteConsentContext';
+export * from './core/consent/useWebsiteConsent';
+export * from './core/consent/WebsiteConsentGate';
+export * from './core/consent/WebsiteConsentBanner';
+
+export * from './core/external-providers/provider-component-registry.website';
+export * from './core/external-providers/useWebsiteProviderComponent';
+export * from './core/external-providers/WebsiteProviderComponent';
+export * from './core/external-providers/website-provider-sdk-activations';
+
 export * from './core/anonymous-session/website-anonymous-session-client';
 export * from './core/anonymous-session/inbound-contact-form.schema';
 export * from './core/anonymous-session/InboundContactForm';
+export * from './core/anonymous-session/website-submission-challenge';
 
 export * from './components/low-level/WebsiteHeading';
 export * from './components/low-level/WebsiteText';

package/src/schemas/__tests__/design-token-css-property.test.ts

@@ -0,0 +1,72 @@
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, relative } from 'node:path';
+
+import { describe, expect, it } from 'vitest';
+
+import { renderWebsiteDesignTokensCss } from '../../astro/website-page-head.renderer';
+import {
+  WebsiteDesignTokensSchema,
+  websiteDesignTokenCssProperty,
+  websiteDesignTokenCssVar,
+  type WebsiteDesignTokens,
+} from '../design-tokens/website-design-tokens.shared.schemas';
+
+const TOKENS: WebsiteDesignTokens = WebsiteDesignTokensSchema.parse({
+  colors: {
+    background: '#fff',
+    foreground: '#111',
+    primary: '#222',
+    primaryForeground: '#fff',
+    accent: '#333',
+    accentForeground: '#fff',
+    surface: '#eee',
+    surfaceForeground: '#444',
+    border: '#ccc',
+    muted: '#ddd',
+    mutedForeground: '#555',
+  },
+  radii: { none: '0', sm: '0.25rem', md: '0.5rem', lg: '0.75rem', xl: '1rem', full: '9999px' },
+});
+
+const SOURCE_ROOT = join(__dirname, '..', '..');
+
+function sourceFiles(dir: string): string[] {
+  return readdirSync(dir).flatMap((entry) => {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) return entry === '__tests__' ? [] : sourceFiles(full);
+    return /\.(ts|tsx)$/.test(entry) ? [full] : [];
+  });
+}
+
+describe('design-token CSS property naming', () => {
+  it('the renderer emits every token under the name the readers reference', () => {
+    const css = renderWebsiteDesignTokensCss(TOKENS);
+    for (const [group, values] of Object.entries(TOKENS)) {
+      for (const token of Object.keys(values)) {
+        expect(css).toContain(`${websiteDesignTokenCssProperty(group, token)}:`);
+      }
+    }
+    // The key is verbatim: the reader the consent banner used to be spelled `surface-foreground`.
+    expect(css).toContain('--website-colors-surfaceForeground: #444;');
+    expect(websiteDesignTokenCssVar('colors', 'surfaceForeground', '#000')).toBe('var(--website-colors-surfaceForeground, #000)');
+    expect(websiteDesignTokenCssVar('radii', 'md')).toBe('var(--website-radii-md)');
+  });
+
+  it('no engine source spells a token custom property by hand', () => {
+    // Positive control: the walk reaches the component that used to carry the defect.
+    const files = sourceFiles(SOURCE_ROOT);
+    expect(files.some((file) => file.endsWith('WebsiteConsentBanner.tsx'))).toBe(true);
+
+    const offenders = files
+      .filter((file) => !file.endsWith('website-design-tokens.shared.schemas.ts'))
+      .flatMap((file) =>
+        readFileSync(file, 'utf8')
+          .split('\n')
+          .map((line, index) => ({ line, index }))
+          // A `var(--website-…)` in code, not in a comment explaining the naming rule.
+          .filter(({ line }) => /var\(--website-/.test(line) && !/^\s*(\*|\/\/)/.test(line))
+          .map(({ index }) => `${relative(SOURCE_ROOT, file)}:${index + 1}`),
+      );
+    expect(offenders).toEqual([]);
+  });
+});