@wildo-ai/saas-website 1.1.5 → 1.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wildo-ai/saas-website",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "SaaS marketing/landing website engine — schemas, helpers, layout/primitive placeholders, Astro/MDX adapters, and SEO/AEO/GEO builder library. Consumers author all business sections themselves via the defineWebsiteSection factory.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Wildo AI",
@@ -65,10 +65,10 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@wildo-ai/external-connectors-public": "1.1.5",
-    "@wildo-ai/platform-config-lib": "1.1.5",
-    "@wildo-ai/presets-components-models": "1.1.5",
-    "@wildo-ai/saas-models": "1.1.5",
+    "@wildo-ai/external-connectors-public": "1.1.7",
+    "@wildo-ai/platform-config-lib": "1.1.7",
+    "@wildo-ai/presets-components-models": "1.1.7",
+    "@wildo-ai/saas-models": "1.1.7",
     "yaml": "^2.3.4"
   },
   "devDependencies": {

package/src/__tests__/bundle-isolation.test.ts

@@ -279,29 +279,14 @@ const ALLOWED_BARE_SPECIFIERS: ReadonlySet<string> = new Set([
    * `FORBIDDEN_SPECIFIERS`.
    */
   '@wildo-ai/zod-decorators',
-  /**
-   * SSR / Astro-middleware tier. These four specifiers support server-side code paths
-   * the marketing engine genuinely needs:
-   *   - `axios` — outbound HTTP from Astro middleware (proxy to
-   *     the SaaS backend, contact-form forwarding, webhook fan-out).
-   *   - `jsonwebtoken` — verify cross-frontend handoff JWTs in
-   *     middleware before letting a request reach a logged-in surface.
-   *   - `socket.io-client` — real-time push (e.g. live preview / status
-   *     events from the SaaS app to the marketing site).
-   *   - `reflect-metadata` — decorator metadata runtime; required
-   *     by any future build-time consumer of `@wildo-ai/zod-decorators`
-   *     metadata (the import IS side-effecting — it mutates
-   *     `globalThis.Reflect`; that side effect is acceptable in an
-   *     SSR context but would still be objectionable in a React
-   *     island bundle).
-   * Allowing them here is a deliberate trade-off: this test no
-   * longer guarantees a hard browser-bundle size budget on its own.
-   * Application import discipline keeps the React-island side lean.
+  /*
+   * `axios`, `jsonwebtoken`, `socket.io-client` and `reflect-metadata` were allowed here from
+   * 2026-04-19 for an SSR middleware tier (backend proxying, handoff-JWT verification, live push)
+   * that was never built. Removed 2026-09-25: no source in this package imports any of them, and an
+   * allow-list wider than the code is a door nothing guards — the next import of one would pass
+   * this test unexamined. The tier that does exist (contact forms, anonymous sessions, consent
+   * recording) uses `fetch`. Re-add a specifier in the change that first imports it.
    */
-  'axios',
-  'jsonwebtoken',
-  'socket.io-client',
-  'reflect-metadata',
   /**
    * SSR / Astro-build-time tier. The
    * `astro.ts` sub-entry exposes the label-pack loader, which
@@ -498,6 +483,18 @@ describe('saas-website — bundle-isolation boundary (D12)', () => {
     }
   });
 
+  it('walks the provider-component loader (#1703), so everything it imports is held to this boundary', () => {
+    // The loader reaches vendor code only through a provider module's DYNAMIC `import()`; these files
+    // must stay inside the walk so a static vendor import added to them is caught here.
+    for (const file of [
+      'core/external-providers/provider-component-registry.website.ts',
+      'core/external-providers/useWebsiteProviderComponent.ts',
+      'core/external-providers/WebsiteProviderComponent.tsx',
+    ]) {
+      expect(visited.has(resolve(SRC_ROOT, file)), `Closure did not visit ${file}`).toBe(true);
+    }
+  });
+
   it.each([...FORBIDDEN_SPECIFIERS])(
     'no file in the saas-website closure imports the forbidden specifier "%s"',
     (forbidden) => {

package/src/astro/__tests__/blog-post-bridge.test.tsx

@@ -5,7 +5,14 @@ import { useMDXComponents } from '@mdx-js/react';
 import React, { type ComponentType } from 'react';
 import { describe, expect, it } from 'vitest';
 
-import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
+import {
+  BUILTIN_PROVIDER_CAPABILITY,
+  defineFrontendPublicConfigSchema,
+  defineProviderMetadata,
+  FrontendPublicConfigValueKind,
+  ProviderOriginKind,
+  ProviderTier,
+} from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
 import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
@@ -57,6 +64,15 @@ const SKIP_LABEL_PACK = {
 // Typed as the real block rather than `as const`: the prop takes `FrontendProvidersBlock`,
 // whose `providerCapabilities` / `protocols` are mutable `string[]`, so a `readonly` tuple
 // fixture is not assignable to the surface under test.
+/**
+ * The key list every real frontend provider module declares (#1705): hydration withholds the code of a module
+ * without one, so a fixture module without it would never reach the closure this test observes.
+ */
+const PUBLIC_CONFIG_SCHEMA = defineFrontendPublicConfigSchema({
+  integrationKind: { kind: FrontendPublicConfigValueKind.STRING, description: 'Which integration.' },
+  websiteRuntime: { kind: FrontendPublicConfigValueKind.BOOLEAN, description: 'Serves the website runtime.' },
+});
+
 const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   providers: {
     sentry: {
@@ -104,7 +120,7 @@ describe('createWebsiteBlogPostBridgeIsland', () => {
       return <span>provider closure</span>;
     }
     const entry = { ...FRONTEND_PROVIDERS.providers.sentry, sdk: { packageName: '@test/sdk' } };
-    const modules = { sentry: { ...entry, sdk: { descriptor: entry.sdk, activate } } } as GeneratedWebsiteProviderModules;
+    const modules = { sentry: { ...entry, publicConfigSchema: PUBLIC_CONFIG_SCHEMA, sdk: { descriptor: entry.sdk, activate } } } as GeneratedWebsiteProviderModules;
     const Island = createWebsiteBlogPostBridgeIsland({
       slugToMdxBody: { demo: ProviderProbe },
       navigation: buildNavigation(),

package/src/astro/__tests__/bridge-runtime.test.tsx

@@ -4,7 +4,14 @@ import { render, screen } from '@testing-library/react';
 import React from 'react';
 import { describe, expect, it } from 'vitest';
 
-import { BUILTIN_PROVIDER_CAPABILITY, defineProviderMetadata, ProviderOriginKind, ProviderTier } from '@wildo-ai/saas-models/public-runtime';
+import {
+  BUILTIN_PROVIDER_CAPABILITY,
+  defineFrontendPublicConfigSchema,
+  defineProviderMetadata,
+  FrontendPublicConfigValueKind,
+  ProviderOriginKind,
+  ProviderTier,
+} from '@wildo-ai/saas-models/public-runtime';
 import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
 import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
@@ -73,6 +80,15 @@ const SKIP_LABEL_PACK = { 'website.chrome.layout.skip-to-main-content': 'Skip to
 // Typed as the real block rather than `as const`: the prop takes `FrontendProvidersBlock`,
 // whose `providerCapabilities` / `protocols` are mutable `string[]`, so a `readonly` tuple
 // fixture is not assignable to the surface under test.
+/**
+ * The key list every real frontend provider module declares (#1705): hydration withholds the code of a module
+ * without one, so a fixture module without it would never reach the closure this test observes.
+ */
+const PUBLIC_CONFIG_SCHEMA = defineFrontendPublicConfigSchema({
+  integrationKind: { kind: FrontendPublicConfigValueKind.STRING, description: 'Which integration.' },
+  websiteRuntime: { kind: FrontendPublicConfigValueKind.BOOLEAN, description: 'Serves the website runtime.' },
+});
+
 const FRONTEND_PROVIDERS: FrontendProvidersBlock = {
   providers: {
     posthog: {
@@ -94,7 +110,9 @@ function RuntimeProbe(): React.ReactNode {
 
 describe('createWebsitePageBridgeIsland', () => {
   it('keeps executable provider code in the bridge closure while props survive JSON serialization', () => {
-    const activate = async () => ({ handle: 'test' });
+    // PostHog rests on analytics consent, so like the real module it declares `stoppable` and returns the
+    // `deactivate` that promise requires (#1704); without it hydration withholds the code this test observes.
+    const activate = async () => ({ handle: 'test', deactivate: () => undefined });
     let observed: unknown;
     function ProviderProbe() {
       const registry = useWebsiteRuntime().frontendProviderRegistry;
@@ -102,7 +120,7 @@ describe('createWebsitePageBridgeIsland', () => {
       return <span>provider closure</span>;
     }
     const entry = { ...FRONTEND_PROVIDERS.providers.posthog, sdk: { packageName: '@test/sdk' } };
-    const modules = { posthog: { ...entry, sdk: { descriptor: entry.sdk, activate } } } as GeneratedWebsiteProviderModules;
+    const modules = { posthog: { ...entry, publicConfigSchema: PUBLIC_CONFIG_SCHEMA, sdk: { descriptor: entry.sdk, activate, stoppable: true } } } as GeneratedWebsiteProviderModules;
     const Island = createWebsitePageBridgeIsland({
       PageComponent: ProviderProbe, pageRef: PAGE_REF,
       navigation: buildNavigation(),

package/src/astro/__tests__/label-pack-loader.test.ts

@@ -1,4 +1,5 @@
 import { WEBSITE_CONSENT_LABEL_KEYS } from '../../schemas/label-keys/website-consent-label-keys.schemas';
+import { WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS } from '../../schemas/label-keys/website-provider-component-label-keys.schemas';
 import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { resolve } from 'node:path';
@@ -62,7 +63,9 @@ const buildManifest = () =>
 
 const SKIP_KEY_STR = 'website.chrome.layout.skip-to-main-content';
 // Framework-owned consent-panel keys (#534): required in every pack, like the skip link.
-const CONSENT_LABELS: Record<string, string> = Object.fromEntries(WEBSITE_CONSENT_LABEL_KEYS.map((key) => [key as unknown as string, 'X']));
+// The provider-component slot's refusal wording (#1703) is framework-owned the same way.
+const FRAMEWORK_OWNED_KEYS = [...WEBSITE_CONSENT_LABEL_KEYS, ...WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS];
+const CONSENT_LABELS: Record<string, string> = Object.fromEntries(FRAMEWORK_OWNED_KEYS.map((key) => [key as unknown as string, 'X']));
 
 const buildRootConfig = (): WebsiteRootConfig =>
   WebsiteRootConfigSchema.parse({
@@ -210,7 +213,7 @@ describe('label-pack-loader', () => {
       writeFileSync(resolve(tmpDir, 'fr.json'), JSON.stringify({}));
       expect(() =>
         assertLabelPacksValid(tmpDir, buildSiteContext(), buildExpectedKeys()),
-      ).toThrow(new RegExp(`Locale "fr".*missing ${4 + WEBSITE_CONSENT_LABEL_KEYS.length} required key\\(s\\)`, 's'));
+      ).toThrow(new RegExp(`Locale "fr".*missing ${4 + FRAMEWORK_OWNED_KEYS.length} required key\\(s\\)`, 's'));
     });
 
     it('annotates each missing key with its declaring page / section origin', () => {
@@ -294,7 +297,7 @@ describe('label-pack-loader', () => {
       warnSpy.mockRestore();
     });
 
-    it('requires every framework-owned consent-panel key in every locale pack (#534)', () => {
+    it('requires every framework-owned consent-panel (#534) and provider-component (#1703) key in every locale pack', () => {
       const withoutConsent = JSON.stringify({
         'website.landing.hero.headline': 'X',
         'website.landing.meta.title': 'X',
@@ -311,7 +314,7 @@ describe('label-pack-loader', () => {
       }
       expect(captured).toMatch(/Locale "en":/);
       expect(captured).not.toMatch(/Locale "fr":/);
-      for (const key of WEBSITE_CONSENT_LABEL_KEYS) expect(captured).toContain(key as unknown as string);
+      for (const key of FRAMEWORK_OWNED_KEYS) expect(captured).toContain(key as unknown as string);
     });
 
     it('treats WebsiteRootConfig.skipToMainContentLabelKey as required (Phase 6 third audit fix M-α)', () => {

package/src/astro/blog-post-bridge.tsx

@@ -7,7 +7,8 @@ import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
 } from '../core/contexts/WebsiteRuntimeContext';
-import { createFrontendWebsiteProviderRegistry } from '../core/external-providers/frontend-provider-registry.website';
+import { useWebsiteProviderRegistries } from '../core/external-providers/provider-component-registry.website';
+import type { ProviderComponentLoaderContribution } from '@wildo-ai/external-connectors-public/website';
 import type { GeneratedWebsiteProviderModules } from '../core/external-providers/frontend-provider-registry.website';
 import { BlogPost, BLOG_POST_PAGE_REF } from '../mdx/BlogPost';
 import type { WebsiteMdxComponentsMap } from '../mdx/website-mdx-provider';
@@ -228,6 +229,14 @@ export interface CreateWebsiteBlogPostBridgeIslandDeps {
    * Config sync emits a stable map, including an empty map when no providers are declared.
    */
   frontendProviderModules?: GeneratedWebsiteProviderModules;
+  /**
+   * Loaders for provider components an ENGINE provider module declares but cannot import (#1703) —
+   * the website's facet-library door, the equivalent of the application's
+   * `contributeProviderComponentLoaders`. A provider PACKAGE that ships its own component needs
+   * nothing here: its module's `components[capability].load` is used. A DEPS entry because a loader
+   * is a function, and island props are serialized.
+   */
+  providerComponentLoaders?: ReadonlyArray<ProviderComponentLoaderContribution>;
   /**
    * Per-slug map of compiled MDX bodies (each entry is a React
    * component — the `.default` export of the MDX module). Typically
@@ -383,6 +392,13 @@ export function createWebsiteBlogPostBridgeIsland(
       );
     }
 
+    // After the missing-slug throw on purpose: that throw ends the render, so it never changes the
+    // hook order of a render that completes, and the build-time error stays reachable.
+    const { frontendProviderRegistry, providerComponentRegistry } = useWebsiteProviderRegistries({
+      frontendProviders,
+      frontendProviderModules: deps.frontendProviderModules,
+      providerComponentLoaders: deps.providerComponentLoaders,
+    });
     const runtimeValue: WebsiteRuntimeContextValue = {
       locale,
       defaultLocale,
@@ -392,10 +408,8 @@ export function createWebsiteBlogPostBridgeIsland(
       skipToMainContentLabelKey,
       appOrigin,
       ...(deps.consentBannerComponent !== undefined ? { consentBannerComponent: deps.consentBannerComponent } : {}),
-      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
-        entries: frontendProviders,
-        modules: deps.frontendProviderModules,
-      }),
+      frontendProviderRegistry,
+      providerComponentRegistry,
     };
     return (
       <WebsiteRuntimeContextProvider value={runtimeValue}>

package/src/astro/bridge-runtime.tsx

@@ -1,14 +1,15 @@
 import { useMemo } from 'react';
 import type { ComponentType, FunctionComponent, ReactNode } from 'react';
 
-import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtime';
+import type { FrontendProvidersBlock, PublicPricingCatalog } from '@wildo-ai/saas-models/public-runtime';
 import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
 import {
   WebsiteRuntimeContextProvider,
   type WebsiteRuntimeContextValue,
 } from '../core/contexts/WebsiteRuntimeContext';
-import { createFrontendWebsiteProviderRegistry } from '../core/external-providers/frontend-provider-registry.website';
+import { useWebsiteProviderRegistries } from '../core/external-providers/provider-component-registry.website';
+import type { ProviderComponentLoaderContribution } from '@wildo-ai/external-connectors-public/website';
 import type { GeneratedWebsiteProviderModules } from '../core/external-providers/frontend-provider-registry.website';
 import { WebsitePageLayout } from '../core/layouts/WebsitePageLayout';
 import type { WebsiteConsentRecorder } from '../core/consent/WebsiteConsentContext';
@@ -72,22 +73,22 @@ import type { LabelPack } from '../schemas/validators/label-pack.validator';
  * } from '@wildo-ai/saas-website/astro';
  * import { LandingBridgeIsland } from '../pages-impl/landing.bridge';
  * import { LANDING_PAGE_MANIFEST } from '../pages-impl/landing.page';
- * import { WEBSITE_ROOT_CONFIG } from '../website-root.config';
+ * import { WEBSITE_SITE_CONTEXT } from '../website-site-context';
  *
  * const runtime = loadWebsitePageRuntime({
  *   manifest: LANDING_PAGE_MANIFEST,
- *   rootConfig: WEBSITE_ROOT_CONFIG,
+ *   siteContext: WEBSITE_SITE_CONTEXT,
  *   labelPacksDir: './src/i18n',
  *   astroLocale: Astro.currentLocale,
  * });
  * const headHtml = renderWebsitePageHeadHtml({
  *   manifest: LANDING_PAGE_MANIFEST,
- *   rootConfig: WEBSITE_ROOT_CONFIG,
+ *   siteContext: WEBSITE_SITE_CONTEXT,
  *   locale: runtime.locale,
  *   labelPack: runtime.labelPack,
  * });
  * const designTokensCss = renderWebsiteDesignTokensCss(
- *   WEBSITE_ROOT_CONFIG.designTokens,
+ *   WEBSITE_SITE_CONTEXT.rootConfig.designTokens,
  * );
  * ---
  * <!doctype html>
@@ -100,8 +101,11 @@ import type { LabelPack } from '../schemas/validators/label-pack.validator';
  *     <LandingBridgeIsland
  *       client:idle
  *       locale={runtime.locale}
+ *       defaultLocale={runtime.defaultLocale}
+ *       appOrigin={WEBSITE_SITE_CONTEXT.websiteConfig.appOrigin}
+ *       apiOrigin={WEBSITE_SITE_CONTEXT.websiteConfig.apiOrigin}
  *       labelPack={runtime.labelPack}
- *       designTokens={WEBSITE_ROOT_CONFIG.designTokens}
+ *       designTokens={WEBSITE_SITE_CONTEXT.rootConfig.designTokens}
  *     />
  *   </body>
  * </html>
@@ -152,6 +156,14 @@ export interface CreateWebsitePageBridgeIslandDeps {
    * Config sync emits a stable map, including an empty map when no providers are declared.
    */
   frontendProviderModules?: GeneratedWebsiteProviderModules;
+  /**
+   * Loaders for provider components an ENGINE provider module declares but cannot import (#1703) —
+   * the website's facet-library door, the equivalent of the application's
+   * `contributeProviderComponentLoaders`. A provider PACKAGE that ships its own component needs
+   * nothing here: its module's `components[capability].load` is used. A DEPS entry because a loader
+   * is a function, and island props are serialized.
+   */
+  providerComponentLoaders?: ReadonlyArray<ProviderComponentLoaderContribution>;
   /**
    * The page's React component. Typically the same value that was
    * passed to `defineWebsitePageManifest({ pageComponent })` — the
@@ -270,6 +282,13 @@ export interface WebsitePageBridgeIslandProps {
    * the consumer's job and the whole point of removing the fallback.
    */
   appOrigin?: string;
+  /**
+   * The application's public pricing catalogue (#1835), forwarded into
+   * `WebsiteRuntimeContext.pricingCatalog` for `useWebsitePricingCatalog()`. Plain JSON-safe data
+   * (amounts travel as decimal strings, never `bigint`), loaded in the `.astro` frontmatter with
+   * `loadWebsitePricingCatalog()`. Passed only by pages with a pricing section.
+   */
+  pricingCatalog?: PublicPricingCatalog;
 }
 
 /**
@@ -293,6 +312,7 @@ export function createWebsitePageBridgeIsland(
     frontendProviders,
     apiOrigin,
     appOrigin,
+    pricingCatalog,
   }: WebsitePageBridgeIslandProps): ReactNode {
     /*
      * Both must be present: the factory is build-time wiring and `apiOrigin` is per-environment, and
@@ -305,6 +325,11 @@ export function createWebsitePageBridgeIsland(
         : undefined),
       [apiOrigin],
     );
+    const { frontendProviderRegistry, providerComponentRegistry } = useWebsiteProviderRegistries({
+      frontendProviders,
+      frontendProviderModules: deps.frontendProviderModules,
+      providerComponentLoaders: deps.providerComponentLoaders,
+    });
     const runtimeValue: WebsiteRuntimeContextValue = {
       locale,
       defaultLocale,
@@ -312,13 +337,12 @@ export function createWebsitePageBridgeIsland(
       designTokens,
       navigation,
       skipToMainContentLabelKey,
-      frontendProviderRegistry: createFrontendWebsiteProviderRegistry({
-        entries: frontendProviders,
-        modules: deps.frontendProviderModules,
-      }),
+      frontendProviderRegistry,
+      providerComponentRegistry,
       ...(deps.consentBannerComponent !== undefined ? { consentBannerComponent: deps.consentBannerComponent } : {}),
       apiOrigin,
       appOrigin,
+      ...(pricingCatalog !== undefined ? { pricingCatalog } : {}),
     };
     return (
       <WebsiteRuntimeContextProvider value={runtimeValue}>

package/src/astro/label-pack-loader.ts

@@ -5,6 +5,7 @@ import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
 import type { WebsiteLabelKey } from '../schemas/label-keys/website-label-key.schemas';
 import { WEBSITE_CONSENT_LABEL_KEYS } from '../schemas/label-keys/website-consent-label-keys.schemas';
+import { WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS } from '../schemas/label-keys/website-provider-component-label-keys.schemas';
 import type { WebsitePageManifest } from '../schemas/manifests/website-page-manifest.shared.schemas';
 import type { WebsiteRootConfig } from '../schemas/manifests/website-root-config.shared.schemas';
 import {
@@ -21,10 +22,10 @@ import type { WebsiteSiteContext } from './website-site-context';
  *
  * `label-pack-loader.ts` — synchronous, fs-backed loader for
  * marketing-site label packs. Consumed by:
- *   - the Astro adapter (`WebsitePageBridge.astro` reads the active
- *     locale's pack at request time during SSR / pre-render),
- *   - the `wildo website audit` CLI (Phase 7) to validate every
- *     locale pack against every manifest at CI time,
+ *   - each page's `.astro` frontmatter, through `loadWebsitePageRuntime`,
+ *     which reads the active locale's pack during SSR / pre-render,
+ *   - `wildo website audit`, which validates every locale pack against
+ *     every manifest and section through `loadAndValidateAllLabelPacks`,
  *   - any build-time hook that wants to fail fast on a missing or
  *     malformed pack.
  *
@@ -211,6 +212,9 @@ function composeEffectiveChromeLabelKeys(
   // The visitor consent panel is framework-owned in the same way (#534): required in every pack, so a site
   // that turns on analytics can never ship it with an unlabelled way to refuse.
   for (const key of WEBSITE_CONSENT_LABEL_KEYS) set.add(key);
+  // So is the provider-component slot's refusal wording (#1703): a site placing an address lookup must not
+  // ship its consent-required or unavailable state as a raw key.
+  for (const key of WEBSITE_PROVIDER_COMPONENT_LABEL_KEYS) set.add(key);
   return Array.from(set);
 }
 

package/src/astro/robots-renderer.ts

@@ -34,10 +34,12 @@ import type { WebsiteSiteContext } from './website-site-context';
  *   2. Per-bot blocks for `disallowedCrawlers` (allow-by-default
  *      direction) — each named bot gets its own `User-agent: <bot>`
  *      + `Disallow: /` block.
- *   3. Catch-all `User-agent: *` block carrying the site-wide
- *      `policy` (`Disallow: /` if `policy === 'noindex'` OR if
- *      `allowedCrawlers` is set, otherwise nothing) and any
- *      `disallow[]` path-prefix entries.
+ *   3. Catch-all `User-agent: *` block: `Disallow: /` only when
+ *      `allowedCrawlers` is set (the named bots are then the only ones
+ *      permitted), otherwise the allow-everything `Disallow:` plus any
+ *      `disallow[]` path-prefix entries. `policy === 'noindex'` adds
+ *      nothing here — it is expressed by the page's robots meta tag,
+ *      which a crawler can only read if it may fetch the page (#494).
  *   4. `Sitemap: <publicOrigin>/sitemap-index.xml` footer when
  *      `seo.sitemap?.enabled !== false` (defaults to `true`).
  *      `@astrojs/sitemap` emits `sitemap-index.xml` regardless of
@@ -57,10 +59,9 @@ import type { WebsiteSiteContext } from './website-site-context';
  *
  * The `Sitemap:` directive is independent from any `User-agent`
  * block — it is a top-level signal to any crawler that the site
- * publishes a sitemap. Even when the catch-all policy is
- * `Disallow: /` (e.g. `policy === 'noindex'`), the `Sitemap:` line
- * stays useful: a crawler that ignores `noindex` (Bing was famous
- * for this) at least has a single canonical URL list to consult,
+ * publishes a sitemap. Even when the catch-all is `Disallow: /`
+ * (`allowedCrawlers` set), the `Sitemap:` line stays useful: the
+ * permitted crawlers have a single canonical URL list to consult,
  * and human readers of `robots.txt` see the publication contract
  * intact.
  *
@@ -120,13 +121,12 @@ export function renderRobotsTxt(siteContext: WebsiteSiteContext): string {
   }
 
   /**
-   * Block 3 — catch-all `User-agent: *`. Two policy-driven shapes:
-   *   - `noindex` → `Disallow: /` (the site-wide closure).
-   *   - `index` (default) → `Disallow:` is the spec-canonical "allow
-   *     everything" line; combined with any per-path `Disallow: <path>`
-   *     entries from `disallow[]`. When `allowedCrawlers` is set, the
-   *     catch-all also closes the rest of the crawler universe with
-   *     `Disallow: /` so the named bots are the ONLY ones permitted.
+   * Block 3 — catch-all `User-agent: *`. `Disallow:` is the
+   *   spec-canonical "allow everything" line, combined with any per-path
+   *   `Disallow: <path>` entries from `disallow[]`. When `allowedCrawlers`
+   *   is set, the catch-all instead closes the rest of the crawler universe
+   *   with `Disallow: /` so the named bots are the ONLY ones permitted. The
+   *   `policy` is not expressed here at all — see below.
    */
   const catchAllLines: string[] = ['User-agent: *'];
   /*

package/src/astro/website-page-head.renderer.ts

@@ -1,7 +1,7 @@
 import type { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
 
 import { buildLocalizedRoutePath } from '../core/routing/internal-routing.utils';
-import type { WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
+import { websiteDesignTokenCssProperty, type WebsiteDesignTokens } from '../schemas/design-tokens/website-design-tokens.shared.schemas';
 import type { WebsitePageManifest } from '../schemas/manifests/website-page-manifest.shared.schemas';
 import type { LabelPack } from '../schemas/validators/label-pack.validator';
 
@@ -277,7 +277,7 @@ export function renderWebsiteDesignTokensCss(tokens: WebsiteDesignTokens): strin
     if (groupValue !== null && typeof groupValue === 'object' && !Array.isArray(groupValue)) {
       for (const [tokenName, tokenValue] of Object.entries(groupValue) as [string, unknown][]) {
         if (typeof tokenValue === 'string') {
-          lines.push(`  --website-${groupName}-${tokenName}: ${tokenValue};`);
+          lines.push(`  ${websiteDesignTokenCssProperty(groupName, tokenName)}: ${tokenValue};`);
         }
       }
     } else if (typeof groupValue === 'string') {

package/src/astro/website-site-context.ts

@@ -10,7 +10,8 @@ import type { FrontendProvidersBlock } from '@wildo-ai/saas-models/public-runtim
  * `WebsiteRootConfig` (page registry, design tokens, navigation chrome,
  * site-level SEO branding) with the per-service `WildoMarketingWebsiteConfig`
  * loaded from `wildo.website.config.ts` (locales, default locale,
- * public origin, future `appOrigin` cross-origin handoff target).
+ * public origin, and the `appOrigin` / `apiOrigin` the site reaches the
+ * product through — settled for THIS build by `loadWebsiteSiteContext`).
  *
  * # Why a dedicated aggregator type (vs. threading both raw configs)
  *
@@ -84,7 +85,9 @@ export interface WebsiteSiteContext {
    * The per-service `WildoMarketingWebsiteConfig` loaded from
    * `wildo.website.config.ts`. Single source of truth for the
    * marketing-site ROUTING + ORIGIN surface (`defaultLocale`,
-   * `locales`, `publicOrigin`, future `appOrigin`).
+   * `locales`, `publicOrigin`, `appOrigin`, `apiOrigin`). The two origins
+   * are the values for THIS build (override, local dev, authored — see
+   * `resolveWebsiteBuildOrigins`), which is why every page reads them here.
    */
   readonly websiteConfig: WildoMarketingWebsiteConfig;
   /**

package/src/companion-exports.ts

@@ -8,22 +8,15 @@
  *   - anything Astro-build-time that cannot pull React into the
  *     evaluation graph
  *
- * Per `saas-website-slice.md` §"Note on `companion-exports.ts` scope
- * expansion": the SEO builder library lives here too (it's pure
- * string + JSON-LD generation, React-free by design).
- *
  * @wildo-boundary
- *   This file MUST re-export ONLY from `schemas/**` and `seo/**`.
- *   It MUST NOT import or re-export anything from:
- *     - `core/**`         (React runtime contexts/hooks)
- *     - `astro/**`        (Astro-only adapter)
- *     - `mdx/**`          (MDX-only adapter)
- *     - `integration/**`  (React-bearing integration code)
- *   It MUST NOT import React, Astro, or `@mdx-js/*`.
- *
- *   Enforced by review until Phase 8 boundary lint design (see plan).
- *
- * Phase 1 status: schemas exposed; SEO builders land in Phase 2.5.
+ *   This file re-exports ONLY from `schemas/**`. It MUST NOT import or
+ *   re-export anything from `core/**` (React contexts/hooks), `astro/**`
+ *   (Astro/Node adapter), `mdx/**` or `config/**`, and MUST NOT import
+ *   React, Astro or `@mdx-js/*`. The SEO and structured-data renderers
+ *   are React-free string builders too, but they live on `/astro` beside
+ *   the build-time helpers that call them, and are reached from there.
+ *   Enforced by `src/__tests__/bundle-isolation.test.ts` and
+ *   `schemas/__tests__/companion-exports-react-free.test.ts`.
  */
 
 export * from './schemas/refs/page-ref.schemas';

package/src/config/__tests__/website-build-origins.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+
+import { AvailableLanguage } from '@wildo-ai/saas-models/public-runtime';
+
+import { resolveWebsiteBuildOrigins } from '../load-website-site-context';
+import type { WildoMarketingWebsiteConfig } from '../wildo-website-config.schemas';
+
+const AUTHORED: WildoMarketingWebsiteConfig = {
+  publicOrigin: 'https://example.com',
+  appOrigin: 'https://app.example.com',
+  apiOrigin: 'https://api.example.com',
+  defaultLocale: AvailableLanguage.EN,
+  locales: [{ locale: AvailableLanguage.EN, path: 'en' }],
+} as WildoMarketingWebsiteConfig;
+
+const LOCAL = { app: 'http://localhost:4272', api: 'http://localhost:4271' };
+
+describe('resolveWebsiteBuildOrigins', () => {
+  it('under astro dev, links into the locally running product and API', () => {
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment: true, localOrigins: LOCAL, overrides: {} });
+    expect(resolved.appOrigin).toBe('http://localhost:4272');
+    expect(resolved.apiOrigin).toBe('http://localhost:4271');
+    expect(resolved.publicOrigin).toBe('https://example.com');
+  });
+
+  it('a production build keeps the authored origins, never a localhost one', () => {
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment: false, localOrigins: LOCAL, overrides: {} });
+    expect(resolved.appOrigin).toBe('https://app.example.com');
+    expect(resolved.apiOrigin).toBe('https://api.example.com');
+  });
+
+  it('an explicit per-environment override wins in both modes', () => {
+    const overrides = { appOrigin: 'https://app.staging.example.com', apiOrigin: 'https://api.staging.example.com' };
+    for (const isDevelopment of [true, false]) {
+      const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment, localOrigins: LOCAL, overrides });
+      expect(resolved.appOrigin).toBe(overrides.appOrigin);
+      expect(resolved.apiOrigin).toBe(overrides.apiOrigin);
+    }
+  });
+
+  it('falls back to the authored origin when the app declares no local port', () => {
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: AUTHORED, isDevelopment: true, localOrigins: {}, overrides: {} });
+    expect(resolved.appOrigin).toBe('https://app.example.com');
+    expect(resolved.apiOrigin).toBe('https://api.example.com');
+  });
+
+  it('leaves apiOrigin absent when nothing supplies one, so a capture form can refuse loudly', () => {
+    const { apiOrigin: _omitted, ...withoutApi } = AUTHORED;
+    const resolved = resolveWebsiteBuildOrigins({ websiteConfig: withoutApi as WildoMarketingWebsiteConfig, isDevelopment: false, localOrigins: LOCAL, overrides: {} });
+    expect('apiOrigin' in resolved).toBe(false);
+  });
+});

package/src/config/define-website-config.ts

@@ -13,8 +13,9 @@
  *
  * The warner has ZERO branches today because every OPTIONAL field that
  * exists is already wired (`csp?` now flows through the website-local
- * CSP sync step) and the only unwired field left is `appOrigin`, which
- * is REQUIRED. After the seam-collapse (`saas-website-seam-collapse.md`
+ * CSP sync step), and every REQUIRED field has a runtime consumer too —
+ * `appOrigin` reaches every CTA through `WebsiteRuntimeContext.appOrigin`,
+ * settled per build by `loadWebsiteSiteContext`. After the seam-collapse (`saas-website-seam-collapse.md`
  * — SHIPPED), the routing/origin fields (`publicOrigin`,
  * `defaultLocale`, `locales`) are consumed directly by every Astro
  * engine helper via `WebsiteSiteContext`, so they are no longer
@@ -99,14 +100,13 @@ export function defineWebsiteConfig(
  * but has no runtime consumer yet.
  *
  * Branches today: ZERO. The one OPTIONAL field that exists (`csp?`) is
- * fully wired through the website-local CSP sync/build path, while the
- * only field that still lacks a runtime consumer (`appOrigin`) is
- * REQUIRED. After the seam-collapse (`saas-website-seam-collapse.md` —
- * SHIPPED) the routing/origin fields are consumed directly by every
- * Astro engine helper via `WebsiteSiteContext`. Required-but-unwired
- * fields cannot reasonably fire on every parse — that's a
- * deferred-wiring surface tracked in the schema header, not an
- * `@unimplemented` warner concern.
+ * fully wired through the website-local CSP sync/build path. After the
+ * seam-collapse (`saas-website-seam-collapse.md` — SHIPPED) the
+ * routing/origin fields are consumed directly by every Astro engine
+ * helper via `WebsiteSiteContext`, and `appOrigin` / `apiOrigin` are
+ * settled per build by `loadWebsiteSiteContext` and read by every page.
+ * A required field could never fire this warner anyway — it would fire
+ * on every parse.
  *
  * The function exists as a structural mirror of
  * `defineTechnicalDocConfig.emitUnimplementedRuntimeWarnings` so