camox 0.44.0 → 0.45.0

package/dist/features/runtime/runtime.js

@@ -1,16 +1,28 @@
+import { serializeJsonForHtml } from "../../lib/html.js";
+import { createRequestContext } from "../../core/requestContext.js";
 import { buildClearServerAuthCookieHeader, getServerAuthCookieHeader } from "../../lib/server-auth-cookie.js";
-import { getPageDestinations } from "../../core/pageDestinations.js";
+import { UNNAMED_DEFAULT_LOCALE, localizedPath, parseLocalePath } from "../../lib/locale-path.js";
+import { draftNamedBy } from "../../lib/draft-scope.js";
+import { RUNTIME_ROUTE_PATHS, matchRuntimeOwnedRoute } from "./runtimeRoutes.js";
+import { reads } from "../../lib/studio-reads.js";
+import { asCollectionItem, recordMarkdownTemplate, recordPlainText } from "../../core/recordItem.js";
 import { PLATFORM_SCRIPT } from "../../lib/platform.js";
+import { STUDIO_ASSETS_PATH, STUDIO_CONTENT_PATH, matchCanvasOnlyPath, matchCollectionContentPath } from "../studio/routes.js";
 import { STUDIO_THEME_SCRIPT } from "../studio/studioTheme.js";
-import { matchDerivedLayout } from "../../core/derivedRoutes.js";
-import { buildCamoxPageHead, createMarkdownResponse, createServerApiClient, isAuthSessionError, isNotFoundError, loadCamoxPageForRequest, seedBlockCaches } from "../routes/pageRuntime.js";
+import { discoverLayoutPages, matchDerivedLayout } from "../../core/derivedRoutes.js";
+import { buildCamoxPageHead, buildFaviconUrl, buildPageHead, buildPageMeta, createMarkdownResponse, createServerApiClient, createServerStudioCache, isNotFoundError, loadCamoxPageForRequest, parseMarkdownPath, prefersMarkdown, readDraftOrLive, readScopeLocales, renderedHref, resolveMemberProject, withFrontMatter } from "../routes/pageRuntime.js";
+import { alternatesByPage, findAlternates, hreflangLinks } from "./alternates.js";
+import { configuredProviders, renderAnalyticsScripts } from "./analytics.js";
+import { omitArtifactSources } from "./artifactSources.js";
+import { RouteDiscoveryError, listLivePages } from "./livePages.js";
+import { formatLlmsTxt } from "./llmsTxt.js";
+import { getPageBlockTypes } from "./pageBlockTypes.js";
+import { DEVELOPMENT_DRAFT, LOCALE_HEADER } from "@camox/api-contract/drafts";
 import { QueryClient, dehydrate } from "@tanstack/react-query";
 import { createHead, renderSSRHead } from "@unhead/react/server";
 
 //#region src/features/runtime/runtime.ts
 const DEFAULT_RUNTIME_BASE_PATH = "";
-const RUNTIME_HEALTH_PATH = "/_camox/health";
-const RUNTIME_REGISTRY_PATH = "/_camox/registry";
 function normalizeRuntimeBasePath(basePath) {
 	if (basePath === void 0) return DEFAULT_RUNTIME_BASE_PATH;
 	if (!basePath || basePath === "/") return "";
@@ -24,6 +36,21 @@ function getRuntimePathname(url, runtimeBasePath = DEFAULT_RUNTIME_BASE_PATH) {
 	if (!pathname.startsWith(`${basePath}/`)) return null;
 	return pathname.slice(basePath.length) || "/";
 }
+/**
+* The draft the request's URL names, if any, or in dev mode the development draft. Sitemaps and
+* Markdown ignore it: they read Live.
+*/
+function getRequestDraftId(request, options) {
+	if (options.developmentDraft) return DEVELOPMENT_DRAFT;
+	return draftNamedBy(request.url) ?? void 0;
+}
+/**
+* Whether a response may show what only this visitor sees: a session, or a draft named in the
+* URL. Shared caches must never keep it.
+*/
+function isPrivateRender(request, options) {
+	return !!getServerAuthCookieHeader(request.headers) || getRequestDraftId(request, options) !== void 0;
+}
 function escapeXml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&apos;");
 }
@@ -31,34 +58,29 @@ function normalizePagePath(path) {
 	if (!path) return "/";
 	return path.startsWith("/") ? path : `/${path}`;
 }
-function getLayoutIdentity(layout, source) {
+function getLayoutIdentity(layout) {
 	if (!layout) return null;
-	const version = source === "live" ? String(layout.livePublishedCheckpointId ?? "none") : String(layout.contentUpdatedAt ?? layout.updatedAt);
 	return {
 		blockIds: [...layout.beforeBlockIds, ...layout.afterBlockIds],
-		id: layout.id,
 		layoutId: layout.layoutId,
-		version
+		version: String(layout.contentUpdatedAt ?? layout.updatedAt)
 	};
 }
 function matchRuntimeRoute(pathname) {
-	if (pathname === RUNTIME_HEALTH_PATH) return {
-		kind: "health",
-		pathname
-	};
-	if (pathname === RUNTIME_REGISTRY_PATH) return {
-		kind: "registry",
-		pathname
-	};
-	if (pathname === "/_camox/data") return {
-		kind: "data",
+	const ownedRoute = matchRuntimeOwnedRoute(pathname);
+	if (ownedRoute) return {
+		kind: ownedRoute,
 		pathname
 	};
 	if (pathname === "/camox") return {
 		kind: "studio",
 		pathname
 	};
-	if (pathname === "/camox/content") return {
+	if (matchCanvasOnlyPath(pathname)) return {
+		kind: "canvas",
+		pathname
+	};
+	if (pathname === "/camox/content" || pathname === `${"/camox/content"}/` || pathname === "/camox/content/assets" || matchCollectionContentPath(pathname)) return {
 		kind: "studio-content",
 		pathname
 	};
@@ -66,14 +88,6 @@ function matchRuntimeRoute(pathname) {
 		kind: "studio-nested",
 		pathname
 	};
-	if (pathname === "/og") return {
-		kind: "og",
-		pathname
-	};
-	if (pathname === "/sitemap.xml") return {
-		kind: "sitemap",
-		pathname
-	};
 	return {
 		kind: "page",
 		pathname
@@ -85,24 +99,156 @@ function withRuntimeBasePath(pathname, runtimeBasePath) {
 	if (pathname === "/") return `${basePath}/`;
 	return `${basePath}${pathname}`;
 }
-async function createSitemapResponse(request, options) {
-	if (!options.apiUrl || !options.projectSlug) return Response.json({ message: "Camox sitemap is not configured." }, { status: 500 });
-	const api = createServerApiClient(options.apiUrl, options.environmentName);
-	const origin = new URL(request.url).origin;
-	const pages = await api.pages.listBySlug({ projectSlug: options.projectSlug });
-	const destinations = getPageDestinations(pages, (await options.getCamoxApp?.())?.getLayouts() ?? []);
-	const updatedAtById = new Map(pages.map((page) => [page.id, page.updatedAt]));
-	const entries = destinations.map((page) => {
-		const updatedAt = page.kind === "curated" ? updatedAtById.get(page.pageId) : void 0;
-		const lastmod = updatedAt == null ? "" : `\n    <lastmod>${escapeXml(new Date(updatedAt).toISOString())}</lastmod>`;
-		return `  <url>
-    <loc>${escapeXml(`${origin}${withRuntimeBasePath(page.fullPath, options.runtimeBasePath)}`)}</loc>${lastmod}
+/**
+* Answers with an index of the website's Live pages, or a 500 saying why they can't be listed.
+* Sitemaps and llms.txt read Live whoever asks: crawlers only ever see published content. With
+* `everyLocale`, it reads the pages of each of Live's locales. Any read failing, whether Live's
+* locales, a locale's pages or route discovery, fails the whole index: an index silently missing
+* pages is worse than one that visibly fails.
+*/
+async function respondWithLiveWebsite(options, name, respond, { everyLocale = false } = {}) {
+	const { apiUrl, projectUuid } = options;
+	if (!apiUrl || !projectUuid) return Response.json({ message: `Camox ${name} is not configured.` }, { status: 500 });
+	const app = await options.getCamoxApp?.();
+	const readLocale = async (locale) => {
+		const { projectName, pages } = await createServerApiClient(apiUrl, { locale }).pages.listBySlug({ projectUuid });
+		const records = createRecordLookup(options, "live", { locale });
+		return {
+			locale,
+			projectName,
+			pages: await listLivePages({
+				pages,
+				app,
+				records
+			})
+		};
+	};
+	let locales;
+	let localizations;
+	try {
+		locales = everyLocale ? [...await readScopeLocales({
+			apiUrl,
+			projectUuid
+		})].sort((a, b) => Number(b.isDefault) - Number(a.isDefault)) : [UNNAMED_DEFAULT_LOCALE];
+		localizations = await Promise.all(locales.map(readLocale));
+	} catch (error) {
+		const discovery = error instanceof RouteDiscoveryError;
+		const cause = discovery ? error.cause : error;
+		console.error(`[camox] ${discovery ? "Route discovery" : "Reading Live"} failed while building the ${name}.`, cause);
+		const reason = error instanceof Error ? error.message : String(error);
+		return Response.json({ message: `Camox ${name} failed: ${reason}` }, { status: 500 });
+	}
+	const [defaultLocale, ...otherLocales] = localizations;
+	return respond({
+		app,
+		projectName: defaultLocale.projectName,
+		localizations: [defaultLocale, ...otherLocales],
+		locales
+	});
+}
+/** A path's absolute URL, with the runtime base path. */
+function absoluteUrl(request, options) {
+	const { origin } = new URL(request.url);
+	return (path) => `${origin}${withRuntimeBasePath(path, options.runtimeBasePath)}`;
+}
+/** `body` with an ETag derived from it, or a 304 when the request's `If-None-Match` names it. */
+async function withEtag(request, body, headers) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body));
+	const etag = `"${[...new Uint8Array(digest)].slice(0, 16).map((byte) => byte.toString(16).padStart(2, "0")).join("")}"`;
+	const taggedHeaders = {
+		...headers,
+		ETag: etag
+	};
+	if ((request.headers.get("If-None-Match") ?? "").split(",").map((tag) => tag.trim().replace(/^W\//, "")).some((tag) => tag === etag || tag === "*")) return new Response(null, {
+		status: 304,
+		headers: taggedHeaders
+	});
+	return new Response(body, { headers: taggedHeaders });
+}
+function createLlmsTxtResponse(request, options) {
+	return respondWithLiveWebsite(options, "llms.txt", (website) => withEtag(request, formatLlmsTxt({
+		projectName: website.projectName,
+		pages: website.localizations[0].pages,
+		layouts: (website.app?.getLayouts() ?? []).map(({ _internal }) => _internal),
+		url: absoluteUrl(request, options)
+	}), {
+		"Content-Type": "text/plain; charset=utf-8",
+		"Cache-Control": "public, max-age=300, stale-while-revalidate=3600"
+	}));
+}
+/** Tells LLM tools fetching a page's HTML where the website's llms.txt is. */
+function llmsTxtLinkHeader(options) {
+	return `<${withRuntimeBasePath(RUNTIME_ROUTE_PATHS["llms-txt"], options.runtimeBasePath)}>; rel="llms-txt"`;
+}
+/**
+* One sitemap for every locale: each localization of a page once, with the page's alternates as
+* `xhtml:link`s, as its `hreflang` links list them.
+*/
+function createSitemapResponse(request, options) {
+	return respondWithLiveWebsite(options, "sitemap", (website) => {
+		const url = absoluteUrl(request, options);
+		const alternates = alternatesByPage(website.localizations);
+		const entries = website.localizations.flatMap(({ locale, pages }) => pages.map(({ key, fullPath, updatedAt }) => {
+			const lastmod = updatedAt == null ? "" : `\n    <lastmod>${escapeXml(new Date(updatedAt).toISOString())}</lastmod>`;
+			const links = hreflangLinks(alternates.get(key) ?? [], website.locales, url).map(({ hreflang, href }) => `\n    <xhtml:link rel="alternate" hreflang="${escapeXml(hreflang)}" href="${escapeXml(href)}"/>`).join("");
+			return `  <url>
+    <loc>${escapeXml(url(localizedPath(fullPath, locale)))}</loc>${lastmod}${links}
   </url>`;
-	}).join("\n");
-	return new Response(`<?xml version="1.0" encoding="UTF-8"?>
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+		})).join("\n");
+		return new Response(`<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">
 ${entries}
 </urlset>`, { headers: { "Content-Type": "application/xml; charset=utf-8" } });
+	}, { everyLocale: true });
+}
+/** The request's member project, if its session is valid. Without an API, nobody is a member. */
+async function resolveRequestMember(request, options) {
+	if (!options.apiUrl || !options.projectUuid) return { clearAuthCookie: false };
+	return resolveMemberProject({
+		apiUrl: options.apiUrl,
+		authCookieHeader: getServerAuthCookieHeader(request.headers),
+		projectUuid: options.projectUuid
+	});
+}
+/**
+* The first discovered page of a derived layout, which the Canvas previews by default. With
+* `recordId`, the page rendering that record, which the Studio follows when its slug changes.
+* Records are found by their values in the locale `LOCALE_HEADER` names, the default locale
+* without it, and the path is that locale's, without its prefix: route patterns aren't localized.
+*/
+async function createRoutesResponse(request, options) {
+	const camoxApp = await options.getCamoxApp?.();
+	if (!camoxApp) return Response.json({ message: "Camox app registry is not available." }, { status: 500 });
+	const { searchParams } = new URL(request.url);
+	const layoutId = searchParams.get("layoutId") ?? "";
+	const recordId = searchParams.get("recordId");
+	const layout = camoxApp.getLayoutById(layoutId);
+	if (layout?._internal.kind !== "derived") return new Response("Not found", { status: 404 });
+	const { project, clearAuthCookie } = await resolveRequestMember(request, options);
+	const headers = {
+		"Cache-Control": "private, no-store",
+		Vary: `Cookie, ${LOCALE_HEADER}`,
+		...clearAuthCookie ? { "Set-Cookie": buildClearServerAuthCookieHeader() } : {}
+	};
+	const tag = request.headers.get(LOCALE_HEADER);
+	try {
+		const pages = await discoverLayoutPages(layout, createLayoutRequestContext(options, project ? "draft" : "live", {
+			authCookieHeader: getServerAuthCookieHeader(request.headers),
+			locale: tag ? {
+				tag,
+				isDefault: false
+			} : void 0
+		}));
+		const page = recordId ? pages.find((entry) => entry.recordId === recordId) : pages[0];
+		return Response.json({ path: page?.path ?? null }, { headers });
+	} catch (error) {
+		console.error(`[camox] Route discovery failed for layout "${layoutId}".`, error);
+		const message = error instanceof Error ? error.message : String(error);
+		return Response.json({ message }, {
+			status: 500,
+			headers
+		});
+	}
 }
 async function createOgResponse(request, options) {
 	const camoxApp = await options.getCamoxApp?.();
@@ -156,9 +302,19 @@ function createPageHeadInput(head) {
 	}
 	const pageLinks = [];
 	for (const entry of links) {
-		if (entry.rel !== "icon" || !entry.href) continue;
-		pageLinks.push({
-			rel: "icon",
+		if (!entry.href) continue;
+		if (entry.rel === "icon") {
+			pageLinks.push({
+				rel: "icon",
+				href: entry.href,
+				"data-camox-page-head": "true"
+			});
+			continue;
+		}
+		if (entry.rel === "alternate" && (entry.hreflang || entry.type)) pageLinks.push({
+			rel: "alternate",
+			...entry.hreflang && { hreflang: entry.hreflang },
+			...entry.type && { type: entry.type },
 			href: entry.href,
 			"data-camox-page-head": "true"
 		});
@@ -169,10 +325,11 @@ function createPageHeadInput(head) {
 		link: pageLinks
 	};
 }
-function renderHead(document, pageHead, stylesheetUrl, studioStylesheetUrl) {
+function renderHead(document, pageHead, stylesheetUrl, studioStylesheetUrl, locale) {
 	const head = createHead();
 	head.push(createDefaultHeadInput(stylesheetUrl));
 	head.push(document);
+	if (locale) head.push({ htmlAttrs: { lang: locale.tag } });
 	if (studioStylesheetUrl) head.push({ link: [{
 		rel: "stylesheet",
 		href: studioStylesheetUrl,
@@ -181,15 +338,28 @@ function renderHead(document, pageHead, stylesheetUrl, studioStylesheetUrl) {
 	head.push(pageHead);
 	return renderSSRHead(head);
 }
-function serializeJsonForHtml(value) {
-	return JSON.stringify(value).replaceAll("<", "\\u003c");
+/**
+* The browser loads a page's blocks before hydrating it. Preloading them alongside the entry
+* script avoids a request waterfall.
+*/
+function renderBlockPreloads(options, dehydratedState) {
+	const preloads = options.blockPreloads;
+	if (!preloads) return "";
+	const urls = /* @__PURE__ */ new Set();
+	for (const type of getPageBlockTypes(dehydratedState)) {
+		const modulePath = preloads.modulePaths[type];
+		if (!modulePath) continue;
+		if (!preloads.chunks) urls.add(modulePath);
+		for (const chunk of preloads.chunks?.[modulePath] ?? []) urls.add(`/${chunk}`);
+	}
+	return [...urls].map((url) => `<link rel="modulepreload" href="${escapeXml(url)}">`).join("");
 }
 function renderClientEntryScript(src) {
 	if (!src) return "";
 	return `<script type="module" src="${escapeXml(src)}"><\/script>`;
 }
 async function preparePreviewDocument(input, options, document, content) {
-	const siteHead = renderHead(document, createPageHeadInput(input.head ?? {}), options.stylesheetUrl);
+	const siteHead = renderHead(document, createPageHeadInput(input.head ?? {}), options.stylesheetUrl, void 0, input.locale);
 	const href = new URL(withRuntimeBasePath(input.pathname, options.runtimeBasePath), input.href).href;
 	const siteHtml = content ?? (options.renderPage ? await options.renderPage({
 		...input,
@@ -199,88 +369,193 @@ async function preparePreviewDocument(input, options, document, content) {
 	}) : "");
 	input.previewDocument = `<!doctype html><html${siteHead.htmlAttrs}><head><base href="${escapeXml(href)}">${siteHead.headTags}</head><body${siteHead.bodyAttrs}>${siteHead.bodyTagsOpen}<div id="root" data-camox-preview-root>${siteHtml}</div>${siteHead.bodyTags}</body></html>`;
 }
+/**
+* The render input a page's HTML embeds for hydration. Visitors load public pages, whose HTML
+* already holds each rendered artifact source in its frame, so their copy leaves those out.
+*/
+function hydrationInputFor(input, html) {
+	if (input.presentation === "studio") return input;
+	return {
+		...input,
+		dehydratedState: omitArtifactSources(input.dehydratedState, html)
+	};
+}
 function renderStudioThemeScript(enabled) {
 	return enabled ? `<script data-camox-studio>${STUDIO_THEME_SCRIPT}${PLATFORM_SCRIPT}<\/script>` : "";
 }
-async function createPageHtmlResponse({ options, pathname, request }) {
-	if (!options.apiUrl || !options.authenticationUrl || !options.projectSlug || !options.renderPage) return createPageDataResponse({
+/**
+* The analytics providers a render counts its reader with: only a visitor, meaning someone the
+* API didn't confirm as a member, on a Live page. A development draft never counts anyone.
+*/
+function visitorAnalytics(options, render, project) {
+	if (render.studio || render.draftId || options.developmentDraft) return void 0;
+	return configuredProviders(project.analytics);
+}
+/** Whether a request is a preview link's token handoff, which signs in before reading anything. */
+function isPreviewHandoff(request, options) {
+	const { searchParams } = new URL(request.url);
+	return searchParams.has("camox-preview") && searchParams.has("ott") && !!options.apiUrl && !!options.authenticationUrl && !!options.projectUuid && !!options.renderPage;
+}
+/**
+* The alternates of the page a request renders, where it exists in each of the scope's locales,
+* and its head with their `hreflang` links. Without a head, there is none to add them to.
+*/
+async function readAlternates(request, options, { located, identity, head, ...reading }) {
+	const alternates = await findRequestAlternates(options, located, identity, reading);
+	const links = hreflangLinks(alternates, located.locales, absoluteUrl(request, options));
+	return {
+		alternates,
+		head: head && withHreflangs(head, links)
+	};
+}
+/** Where the page a request renders exists in each of the scope's locales: itself alone in one. */
+async function findRequestAlternates(options, located, identity, { authCookieHeader, draftId }) {
+	const { apiUrl, projectUuid } = options;
+	const here = [{
+		locale: located.locale.tag,
+		path: localizedPath(located.path, located.locale)
+	}];
+	if (!apiUrl || !projectUuid || located.locales.length < 2) return here;
+	const app = await options.getCamoxApp?.();
+	const reading = {
+		authCookieHeader: draftId ? authCookieHeader : void 0,
+		draftId
+	};
+	return findAlternates({
+		identity,
+		located,
+		layouts: app?.getLayouts() ?? [],
+		reads: {
+			pages: async (locale) => (await createServerApiClient(apiUrl, {
+				...reading,
+				locale
+			}).pages.listBySlug({ projectUuid })).pages,
+			context: (locale) => createLayoutRequestContext(options, draftId ? "draft" : "live", {
+				...reading,
+				locale
+			})
+		}
+	});
+}
+/** A page's head with its alternates' `hreflang` links. */
+function withHreflangs(head, hreflangs) {
+	if (!hreflangs.length) return head;
+	const links = hreflangs.map((link) => ({
+		rel: "alternate",
+		...link
+	}));
+	return {
+		...head,
+		links: [...head.links ?? [], ...links]
+	};
+}
+/**
+* The sign-in page a preview link opens on. No page, project or locale lookup yet: the browser
+* authenticates first, then loads the page again.
+*/
+async function createPreviewHandoffResponse({ options, pathname, request }) {
+	const locale = UNNAMED_DEFAULT_LOCALE;
+	const input = {
+		previewHandoff: true,
+		presentation: "public",
+		apiUrl: options.apiUrl,
+		authenticationUrl: options.authenticationUrl,
+		projectUuid: options.projectUuid,
+		href: request.url,
+		pathname,
+		runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
+		locale,
+		locales: [locale],
+		head: {},
+		loaderData: null,
+		layoutIdentity: null,
+		dehydratedState: dehydrate(new QueryClient())
+	};
+	const html = await options.renderPage(input);
+	return new Response(`<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="referrer" content="no-referrer"><title>Camox draft preview</title><script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(input)}<\/script></head><body><div id="root">${html}</div>${renderClientEntryScript(options.pageClientEntryUrl)}</body></html>`, { headers: {
+		"Content-Type": "text/html; charset=utf-8",
+		"Cache-Control": "private, no-store",
+		"Referrer-Policy": "no-referrer"
+	} });
+}
+async function createPageHtmlResponse({ options, pathname, located, request }) {
+	if (!options.apiUrl || !options.authenticationUrl || !options.projectUuid || !options.renderPage) return createPageDataResponse({
 		options,
 		pathname,
+		located,
 		request
 	});
-	const requestUrl = new URL(request.url);
-	if (requestUrl.searchParams.has("camox-preview") && requestUrl.searchParams.has("ott")) {
-		const input = {
-			previewHandoff: true,
-			presentation: "public",
-			source: "live",
-			apiUrl: options.apiUrl,
-			authenticationUrl: options.authenticationUrl,
-			environmentName: options.environmentName,
-			projectSlug: options.projectSlug,
-			href: requestUrl.href,
-			pathname,
-			runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
-			head: {},
-			loaderData: null,
-			layoutIdentity: null,
-			dehydratedState: dehydrate(new QueryClient())
-		};
-		const html = await options.renderPage(input);
-		return new Response(`<!doctype html><html><head><meta name="referrer" content="no-referrer"><title>Camox draft preview</title><script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(input)}<\/script></head><body><div id="root">${html}</div>${renderClientEntryScript(options.pageClientEntryUrl)}</body></html>`, { headers: {
-			"Content-Type": "text/html; charset=utf-8",
-			"Cache-Control": "private, no-store",
-			"Referrer-Policy": "no-referrer"
-		} });
-	}
-	const singleton = await createDerivedResponse(options, pathname, request, false, true);
+	const singleton = await createDerivedResponse(options, pathname, located, request, { singletonOnly: true });
 	if (singleton) return singleton;
 	const queryClient = new QueryClient();
 	try {
 		const result = await loadCamoxPageForRequest({
 			apiUrl: options.apiUrl,
 			authCookieHeader: getServerAuthCookieHeader(request.headers),
-			environmentName: options.environmentName,
+			draftId: getRequestDraftId(request, options),
+			locale: located.locale,
 			origin: new URL(request.url).origin,
-			pathname,
-			projectSlug: options.projectSlug,
+			pathname: located.path,
+			projectUuid: options.projectUuid,
 			queryClient
 		});
 		const headers = new Headers({
 			"Content-Type": "text/html; charset=utf-8",
-			Vary: "Cookie"
+			Vary: "Cookie",
+			Link: llmsTxtLinkHeader(options)
 		});
-		if (getServerAuthCookieHeader(request.headers)) headers.set("Cache-Control", "private, no-store");
+		if (isPrivateRender(request, options)) headers.set("Cache-Control", "private, no-store");
 		if (result.shouldClearAuthCookie) headers.append("Set-Cookie", buildClearServerAuthCookieHeader());
 		const camoxApp = await options.getCamoxApp?.();
 		const document = await options.getDocument?.() ?? {};
-		const head = camoxApp ? buildCamoxPageHead(camoxApp, result.data) : {};
+		const { alternates, head } = await readAlternates(request, options, {
+			located,
+			identity: {
+				kind: "curated",
+				pageId: result.data.page.page.id
+			},
+			head: camoxApp ? buildCamoxPageHead(camoxApp, result.data, located.locale) : {},
+			authCookieHeader: getServerAuthCookieHeader(request.headers),
+			draftId: result.draftId
+		});
 		const dehydratedState = dehydrate(queryClient);
+		const { project } = result;
+		const studio = project !== void 0;
+		const analytics = visitorAnalytics(options, {
+			studio,
+			draftId: result.draftId
+		}, result.data.page.project);
 		const pageRenderInput = {
-			project: result.source === "draft" ? await createServerApiClient(options.apiUrl, options.environmentName, { authCookieHeader: getServerAuthCookieHeader(request.headers) }).projects.getBySlug({ slug: options.projectSlug }) : void 0,
-			presentation: result.source === "draft" ? "studio" : "public",
+			alternates,
+			project,
+			presentation: studio ? "studio" : "public",
+			...analytics && { analytics },
 			apiUrl: options.apiUrl,
 			authenticationUrl: options.authenticationUrl,
 			dehydratedState,
-			environmentName: options.environmentName,
+			draftId: result.draftId,
+			refusedDraft: result.refusedDraft,
 			head,
-			href: new URL(request.url).href,
-			layoutIdentity: getLayoutIdentity(result.data.page.layout, result.source),
+			href: renderedHref(request.url, result),
+			layoutIdentity: getLayoutIdentity(result.data.page.layout),
 			loaderData: result.data,
 			pathname,
-			projectSlug: options.projectSlug,
+			projectUuid: options.projectUuid,
 			runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
-			source: result.source
+			locale: located.locale,
+			locales: located.locales
 		};
-		await preparePreviewDocument(pageRenderInput, options, document, result.source === "live" ? "" : void 0);
+		await preparePreviewDocument(pageRenderInput, options, document, studio ? void 0 : "");
 		const appHtml = await options.renderPage(pageRenderInput);
-		const renderedHead = renderHead(result.source === "draft" ? {} : document, createPageHeadInput(head), result.source === "draft" ? void 0 : options.stylesheetUrl, result.source === "draft" ? options.studioStylesheetUrl : void 0);
+		const renderedHead = renderHead(studio ? {} : document, createPageHeadInput(head), studio ? void 0 : options.stylesheetUrl, studio ? options.studioStylesheetUrl : void 0, studio ? void 0 : located.locale);
 		return new Response(`<!doctype html>
 <html${renderedHead.htmlAttrs}>
 <head>
-${renderStudioThemeScript(result.source === "draft")}
+${renderStudioThemeScript(studio)}
 ${renderedHead.headTags}
-<script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(pageRenderInput)}<\/script>
+${renderAnalyticsScripts(analytics)}
+${renderBlockPreloads(options, dehydratedState)}
+<script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(hydrationInputFor(pageRenderInput, appHtml))}<\/script>
 </head>
 <body${renderedHead.bodyAttrs}>
 ${renderedHead.bodyTagsOpen}
@@ -291,71 +566,252 @@ ${renderClientEntryScript(options.pageClientEntryUrl)}
 </html>`, { headers });
 	} catch (error) {
 		if (isNotFoundError(error)) {
-			const derived = await createDerivedResponse(options, pathname, request);
+			const derived = await createDerivedResponse(options, pathname, located, request);
 			if (derived) return derived;
 			return new Response("No Camox page on this path", { status: 404 });
 		}
 		throw error;
 	}
 }
-async function createDerivedResponse(options, pathname, request, dataOnly = false, singletonOnly = false) {
+/**
+* The context `loader` and `routes` get. Its record lookup reads each record's current content;
+* only draft reads carry the editor's session, and `draftId` names the draft they read.
+*/
+function createLayoutRequestContext(options, source, reading) {
+	return createRequestContext({ records: createRecordLookup(options, source, reading) });
+}
+/**
+* Reads the records `loader` and `routes` ask for, in `locale` or the default locale; none
+* without an API.
+*/
+function createRecordLookup(options, source, { authCookieHeader, draftId, locale } = {}) {
+	const { apiUrl, projectUuid } = options;
+	if (!apiUrl || !projectUuid) return void 0;
+	const api = createServerApiClient(apiUrl, {
+		authCookieHeader: source === "draft" ? authCookieHeader : void 0,
+		draftId,
+		locale
+	});
+	return {
+		findByField: (input) => api.collectionDefinitions.findRecordsByField({
+			...input,
+			projectUuid
+		}),
+		listPageValues: (input) => api.collectionDefinitions.listRecordPageValues({
+			...input,
+			projectUuid
+		})
+	};
+}
+const RECORD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** An envelope names its record; it doesn't authorize anything, the API does. */
+function isValidCollectionItem(app, result) {
+	const data = result.data;
+	return typeof result.collectionId === "string" && !!app?.getCollectionById(result.collectionId) && typeof data?.id === "string" && RECORD_ID.test(data.id) && typeof data.content === "object" && data.content !== null;
+}
+/**
+* Runs a code-owned page's loader in the page's locale. The envelope survives SSR, navigation and
+* hydration, and its data renders as returned: Camox never translates it.
+*/
+async function loadLayoutResult(app, match, context, locale) {
+	const { loader, id } = match.layout._internal;
+	if (!loader) return void 0;
+	const result = await loader({
+		params: match.params,
+		context,
+		locale: locale.tag
+	});
+	const serializedResult = result === void 0 ? void 0 : JSON.parse(JSON.stringify(result));
+	const record = asCollectionItem(serializedResult);
+	if (!(record ? isValidCollectionItem(app, record) : serializedResult?.kind === "data" && Object.hasOwn(serializedResult, "data"))) throw new Error(`Layout "${id}" loader must return { kind: "data", data } with JSON-serializable data, or a collection-item envelope naming a registered collection and a record id`);
+	return serializedResult;
+}
+/**
+* The Markdown of a singleton or derived page: front matter, its before blocks, the layout's
+* toMarkdown output, then its after blocks. Without toMarkdown, the page is HTML only.
+*/
+async function createLayoutMarkdownResponse(options, match, locale, page) {
+	const { toMarkdown, id } = match.layout._internal;
+	const { apiUrl, projectUuid } = options;
+	if (!toMarkdown || !apiUrl || !projectUuid) return null;
+	const api = createServerApiClient(apiUrl, { locale });
+	const app = await options.getCamoxApp?.();
+	/** The layout's own Markdown, between its before and after blocks, and what built it. */
+	const layoutMarkdown = async () => {
+		const result = await loadLayoutResult(app, match, createLayoutRequestContext(options, "live", { locale }), locale);
+		const record = asCollectionItem(result);
+		const collection = record && app?.getCollectionById(record.collectionId);
+		if (!record || !collection) return {
+			body: toMarkdown({
+				data: result?.data,
+				params: match.params
+			}),
+			data: result?.data
+		};
+		const { data } = record;
+		const template = recordMarkdownTemplate(collection, (item) => toMarkdown({
+			data,
+			params: match.params,
+			item
+		}));
+		return {
+			body: [await api.collectionDefinitions.recordMarkdown({
+				projectUuid,
+				collectionId: record.collectionId,
+				id: data.id,
+				toMarkdown: template
+			})],
+			data,
+			item: recordPlainText(collection, data.content)
+		};
+	};
+	let rendered;
+	try {
+		rendered = await layoutMarkdown();
+	} catch (error) {
+		if (isNotFoundError(error)) return new Response("Page not found", { status: 404 });
+		throw error;
+	}
+	const slots = await api.blocks.getLayoutMarkdown({
+		projectUuid,
+		layoutId: id
+	}).catch((error) => {
+		if (isNotFoundError(error)) return {
+			before: "",
+			after: "",
+			projectName: ""
+		};
+		throw error;
+	});
+	const meta = buildPageMeta({
+		layout: match.layout._internal,
+		pageMetaTitle: match.layout._internal.title,
+		pageMetaDescription: void 0,
+		data: rendered.data,
+		item: rendered.item,
+		params: match.params,
+		projectName: slots.projectName,
+		pageFullPath: page.pathname
+	});
+	const markdown = [
+		slots.before,
+		...rendered.body,
+		slots.after
+	].filter(Boolean).join("\n\n");
+	return new Response(withFrontMatter(markdown, {
+		...meta,
+		url: page.url
+	}), { headers: { "Content-Type": "text/markdown; charset=utf-8" } });
+}
+async function createDerivedResponse(options, pathname, located, request, { dataOnly = false, singletonOnly = false } = {}) {
 	const app = await options.getCamoxApp?.();
-	const match = app && matchDerivedLayout(app.getLayouts(), pathname);
+	const match = app && matchDerivedLayout(app.getLayouts(), located.path);
 	if (!match || !dataOnly && !options.renderPage) return null;
 	if (singletonOnly && match.layout._internal.kind !== "singleton") return null;
 	try {
-		const data = await match.layout._internal.loader?.({ params: match.params });
-		const serializedData = data === void 0 ? void 0 : JSON.parse(JSON.stringify(data));
 		const queryClient = new QueryClient();
-		const authCookieHeader = getServerAuthCookieHeader(request.headers);
-		let source = authCookieHeader ? "draft" : "live";
-		let clearAuthCookie = false;
-		const loadLayout = (source) => createServerApiClient(options.apiUrl, options.environmentName, { authCookieHeader: source === "draft" ? authCookieHeader : void 0 }).layouts.get({
-			projectSlug: options.projectSlug,
-			layoutId: match.layout._internal.id,
-			source
+		const { project, clearAuthCookie } = await resolveRequestMember(request, options);
+		const studio = project !== void 0;
+		const authCookieHeader = studio ? getServerAuthCookieHeader(request.headers) : void 0;
+		const requestedDraft = getRequestDraftId(request, options);
+		const readLayout = () => readDraftOrLive(requestedDraft, studio, (draftId) => createServerApiClient(options.apiUrl, {
+			authCookieHeader,
+			draftId,
+			locale: located.locale
+		}).layouts.get({
+			projectUuid: options.projectUuid,
+			layoutId: match.layout._internal.id
+		}));
+		const runLoader = (draftId) => loadLayoutResult(app, match, createLayoutRequestContext(options, studio ? "draft" : "live", {
+			authCookieHeader,
+			draftId,
+			locale: located.locale
+		}), located.locale);
+		const [serializedResult, { value: shared, ...read }] = studio && requestedDraft ? await readLayout().then(async (read) => [await runLoader(read.draftId), read]) : await Promise.all([runLoader(), readLayout()]);
+		const studioCache = createServerStudioCache(queryClient, {
+			apiUrl: options.apiUrl,
+			authCookieHeader,
+			locale: located.locale
 		});
-		const shared = await loadLayout(source).catch(async (error) => {
-			if (source !== "draft" || !isAuthSessionError(error)) throw error;
-			source = "live";
-			clearAuthCookie = true;
-			return loadLayout("live");
+		const projectUuid = options.projectUuid;
+		const shownIn = { in: read.draftId ?? null };
+		studioCache.land(reads.layoutStructure({
+			projectUuid,
+			layoutId: match.layout._internal.id
+		}), shared, shownIn);
+		studioCache.set(reads.derivedPageData({
+			projectUuid,
+			runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
+			pathname
+		}), serializedResult ?? null, shownIn);
+		const record = asCollectionItem(serializedResult);
+		const recordCollection = record && app.getCollectionById(record.collectionId);
+		const { alternates, head: pageHead } = await readAlternates(request, options, {
+			located,
+			identity: record && match.layout._internal.kind === "derived" ? {
+				kind: "record",
+				layout: match.layout,
+				recordId: record.data.id
+			} : { kind: "code-owned" },
+			head: buildPageHead({
+				layout: match.layout._internal,
+				pageMetaTitle: match.layout._internal.title,
+				pageMetaDescription: void 0,
+				data: serializedResult?.data,
+				item: record && recordCollection ? recordPlainText(recordCollection, record.data.content) : void 0,
+				params: match.params,
+				projectName: shared.projectName,
+				pageFullPath: pathname,
+				origin: new URL(request.url).origin,
+				faviconUrl: buildFaviconUrl(options.apiUrl, shared.project),
+				hasMarkdown: match.layout._internal.toMarkdown !== void 0
+			}),
+			authCookieHeader,
+			draftId: read.draftId
 		});
-		seedBlockCaches(queryClient, shared, source);
+		const analytics = dataOnly ? void 0 : visitorAnalytics(options, {
+			studio,
+			draftId: read.draftId
+		}, shared.project);
 		const input = {
-			project: source === "draft" ? await createServerApiClient(options.apiUrl, options.environmentName, { authCookieHeader }).projects.getBySlug({ slug: options.projectSlug }) : void 0,
-			presentation: source === "draft" ? "studio" : "public",
+			alternates,
+			project,
+			presentation: studio ? "studio" : "public",
+			...analytics && { analytics },
 			apiUrl: options.apiUrl,
 			authenticationUrl: options.authenticationUrl,
-			projectSlug: options.projectSlug,
-			environmentName: options.environmentName,
+			projectUuid: options.projectUuid,
 			dehydratedState: dehydrate(queryClient),
-			head: { meta: [{ title: match.layout._internal.title }] },
-			href: request.url,
-			layoutIdentity: getLayoutIdentity(shared.layout, source),
+			draftId: read.draftId,
+			refusedDraft: read.refusedDraft,
+			head: pageHead,
+			href: renderedHref(request.url, read),
+			layoutIdentity: getLayoutIdentity(shared.layout),
 			loaderData: null,
 			pathname,
 			runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
-			source,
+			locale: located.locale,
+			locales: located.locales,
 			derived: {
 				layoutId: match.layout._internal.id,
-				data: serializedData,
+				result: serializedResult,
 				layout: shared.layout
 			}
 		};
 		const document = await options.getDocument?.() ?? {};
-		await preparePreviewDocument(input, options, document, source === "live" && !dataOnly ? "" : void 0);
+		await preparePreviewDocument(input, options, document, !studio && !dataOnly ? "" : void 0);
 		if (dataOnly) return Response.json(input, { headers: {
 			"Cache-Control": "private, no-store",
 			Vary: "Cookie",
 			...clearAuthCookie ? { "Set-Cookie": buildClearServerAuthCookieHeader() } : {}
 		} });
 		const html = await options.renderPage(input);
-		const head = renderHead(source === "draft" ? {} : document, { title: match.layout._internal.title }, source === "draft" ? void 0 : options.stylesheetUrl, source === "draft" ? options.studioStylesheetUrl : void 0);
-		return new Response(`<!doctype html><html${head.htmlAttrs}><head>${renderStudioThemeScript(source === "draft")}${head.headTags}<script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(input)}<\/script></head><body${head.bodyAttrs}>${head.bodyTagsOpen}<div id="root">${html}</div>${head.bodyTags}${renderClientEntryScript(options.pageClientEntryUrl)}</body></html>`, { headers: {
+		const head = renderHead(studio ? {} : document, createPageHeadInput(pageHead), studio ? void 0 : options.stylesheetUrl, studio ? options.studioStylesheetUrl : void 0, studio ? void 0 : located.locale);
+		return new Response(`<!doctype html><html${head.htmlAttrs}><head>${renderStudioThemeScript(studio)}${head.headTags}${renderAnalyticsScripts(analytics)}${renderBlockPreloads(options, input.dehydratedState)}<script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(hydrationInputFor(input, html))}<\/script></head><body${head.bodyAttrs}>${head.bodyTagsOpen}<div id="root">${html}</div>${head.bodyTags}${renderClientEntryScript(options.pageClientEntryUrl)}</body></html>`, { headers: {
 			"Content-Type": "text/html; charset=utf-8",
 			Vary: "Cookie",
-			...authCookieHeader ? { "Cache-Control": "private, no-store" } : {},
+			Link: llmsTxtLinkHeader(options),
+			...isPrivateRender(request, options) ? { "Cache-Control": "private, no-store" } : {},
 			...clearAuthCookie ? { "Set-Cookie": buildClearServerAuthCookieHeader() } : {}
 		} });
 	} catch (error) {
@@ -363,26 +819,16 @@ async function createDerivedResponse(options, pathname, request, dataOnly = fals
 		throw error;
 	}
 }
-async function createStudioHtmlResponse({ match, options, request, dataOnly = false }) {
-	if (!options.apiUrl || !options.authenticationUrl || !options.projectSlug || !dataOnly && !options.renderStudio) return Response.json({
+async function createStudioHtmlResponse({ match, options, pathname, located, request, dataOnly = false }) {
+	if (!options.apiUrl || !options.authenticationUrl || !options.projectUuid || !dataOnly && !options.renderStudio) return Response.json({
 		message: "Camox Studio renderer is not configured.",
 		...match
 	}, { status: 500 });
 	const queryClient = new QueryClient();
-	const authCookieHeader = getServerAuthCookieHeader(request.headers);
-	let project;
-	let presentation = "public";
-	let clearAuthCookie = false;
-	if (authCookieHeader) try {
-		project = await createServerApiClient(options.apiUrl, options.environmentName, { authCookieHeader }).projects.getBySlug({ slug: options.projectSlug });
-		presentation = "studio";
-	} catch (error) {
-		if (!isAuthSessionError(error)) throw error;
-		clearAuthCookie = true;
-	}
+	const { project, clearAuthCookie } = await resolveRequestMember(request, options);
+	const presentation = project ? "studio" : "public";
 	const studioRenderInput = {
 		project,
-		source: "live",
 		head: { meta: [{ title: "Camox Studio" }] },
 		layoutIdentity: null,
 		loaderData: null,
@@ -390,12 +836,13 @@ async function createStudioHtmlResponse({ match, options, request, dataOnly = fa
 		apiUrl: options.apiUrl,
 		authenticationUrl: options.authenticationUrl,
 		dehydratedState: dehydrate(queryClient),
-		environmentName: options.environmentName,
 		href: new URL(request.url).href,
-		pathname: match.pathname,
-		projectSlug: options.projectSlug,
+		pathname,
+		projectUuid: options.projectUuid,
 		routeKind: match.kind,
-		runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath)
+		runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
+		locale: located.locale,
+		locales: located.locales
 	};
 	if (dataOnly) return Response.json(studioRenderInput, { headers: {
 		"Cache-Control": "private, no-store",
@@ -424,19 +871,80 @@ ${renderClientEntryScript(options.studioClientEntryUrl)}
 		...clearAuthCookie ? { "Set-Cookie": buildClearServerAuthCookieHeader() } : {}
 	} });
 }
-async function createPageDataResponse({ options, pathname, request }) {
-	if (!options.apiUrl || !options.projectSlug) return Response.json({ message: "Camox page loader is not configured." }, { status: 500 });
-	const singleton = await createDerivedResponse(options, pathname, request, true, true);
+/**
+* The Canvas with nothing selected, or a block of the Block Catalog, renders the
+* page app, like a Page, so selecting it keeps the Canvas mounted. A block path
+* without a page-content block of that id redirects home.
+*/
+async function createCanvasOnlyResponse({ options, pathname, located, request, dataOnly = false }) {
+	const { blockId } = matchCanvasOnlyPath(located.path);
+	const app = blockId ? await options.getCamoxApp?.() : void 0;
+	const block = blockId ? app?.getBlockById(blockId) : void 0;
+	if (blockId && (!block || block._internal.layoutOnly)) {
+		if (dataOnly) return Response.json({
+			kind: "canvas",
+			message: "No block of the Block Catalog on this path",
+			pathname
+		}, { status: 404 });
+		return Response.redirect(new URL(withRuntimeBasePath(localizedPath("/", located.locale), options.runtimeBasePath), request.url), 302);
+	}
+	if (!options.apiUrl || !options.authenticationUrl || !options.projectUuid || !dataOnly && !options.renderPage) return Response.json({
+		message: "Camox page renderer is not configured.",
+		kind: "canvas",
+		pathname
+	}, { status: 500 });
+	const { project, clearAuthCookie } = await resolveRequestMember(request, options);
+	const studio = project !== void 0;
+	const title = block?._internal.title ?? "Canvas";
+	const input = {
+		project,
+		presentation: studio ? "studio" : "public",
+		apiUrl: options.apiUrl,
+		authenticationUrl: options.authenticationUrl,
+		projectUuid: options.projectUuid,
+		runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
+		locale: located.locale,
+		locales: located.locales,
+		href: request.url,
+		pathname,
+		head: { meta: [{ title }] },
+		layoutIdentity: null,
+		loaderData: null,
+		dehydratedState: dehydrate(new QueryClient()),
+		canvasOnly: blockId ? { blockId } : {},
+		draftId: studio ? getRequestDraftId(request, options) : void 0
+	};
+	await preparePreviewDocument(input, options, await options.getDocument?.() ?? {}, "");
+	const headers = {
+		"Cache-Control": "private, no-store",
+		Vary: "Cookie",
+		...clearAuthCookie ? { "Set-Cookie": buildClearServerAuthCookieHeader() } : {}
+	};
+	if (dataOnly) return Response.json(input, { headers });
+	const html = await options.renderPage(input);
+	const head = renderHead({}, { title }, void 0, studio ? options.studioStylesheetUrl : void 0);
+	return new Response(`<!doctype html><html${head.htmlAttrs}><head>${renderStudioThemeScript(studio)}${head.headTags}<script id="__CAMOX_DATA__" type="application/json">${serializeJsonForHtml(input)}<\/script></head><body${head.bodyAttrs}>${head.bodyTagsOpen}<div id="root">${html}</div>${head.bodyTags}${renderClientEntryScript(options.pageClientEntryUrl)}</body></html>`, { headers: {
+		"Content-Type": "text/html; charset=utf-8",
+		...headers
+	} });
+}
+async function createPageDataResponse({ options, pathname, located, request }) {
+	if (!options.apiUrl || !options.projectUuid) return Response.json({ message: "Camox page loader is not configured." }, { status: 500 });
+	const singleton = await createDerivedResponse(options, pathname, located, request, {
+		dataOnly: true,
+		singletonOnly: true
+	});
 	if (singleton) return singleton;
 	const queryClient = new QueryClient();
 	try {
 		const result = await loadCamoxPageForRequest({
 			apiUrl: options.apiUrl,
 			authCookieHeader: getServerAuthCookieHeader(request.headers),
-			environmentName: options.environmentName,
+			draftId: getRequestDraftId(request, options),
+			locale: located.locale,
 			origin: new URL(request.url).origin,
-			pathname,
-			projectSlug: options.projectSlug,
+			pathname: located.path,
+			projectUuid: options.projectUuid,
 			queryClient
 		});
 		const headers = new Headers({
@@ -446,21 +954,32 @@ async function createPageDataResponse({ options, pathname, request }) {
 		});
 		if (result.shouldClearAuthCookie) headers.append("Set-Cookie", buildClearServerAuthCookieHeader());
 		const camoxApp = await options.getCamoxApp?.();
-		const head = camoxApp ? buildCamoxPageHead(camoxApp, result.data) : null;
+		const { alternates, head } = await readAlternates(request, options, {
+			located,
+			identity: {
+				kind: "curated",
+				pageId: result.data.page.page.id
+			},
+			head: camoxApp ? buildCamoxPageHead(camoxApp, result.data, located.locale) : null,
+			authCookieHeader: getServerAuthCookieHeader(request.headers),
+			draftId: result.draftId
+		});
 		const dehydratedState = dehydrate(queryClient);
-		const project = result.source === "draft" ? await createServerApiClient(options.apiUrl, options.environmentName, { authCookieHeader: getServerAuthCookieHeader(request.headers) }).projects.getBySlug({ slug: options.projectSlug }) : void 0;
 		const input = {
+			alternates,
 			apiUrl: options.apiUrl,
 			authenticationUrl: options.authenticationUrl ?? "",
-			environmentName: options.environmentName,
-			projectSlug: options.projectSlug,
+			projectUuid: options.projectUuid,
 			runtimeBasePath: normalizeRuntimeBasePath(options.runtimeBasePath),
-			href: request.url,
-			presentation: result.source === "draft" ? "studio" : "public",
-			source: result.source,
+			locale: located.locale,
+			locales: located.locales,
+			href: renderedHref(request.url, result),
+			draftId: result.draftId,
+			refusedDraft: result.refusedDraft,
+			presentation: result.project ? "studio" : "public",
 			pathname,
-			layoutIdentity: getLayoutIdentity(result.data.page.layout, result.source),
-			project,
+			layoutIdentity: getLayoutIdentity(result.data.page.layout),
+			project: result.project,
 			loaderData: result.data,
 			head,
 			dehydratedState
@@ -469,7 +988,7 @@ async function createPageDataResponse({ options, pathname, request }) {
 		return Response.json(input, { headers });
 	} catch (error) {
 		if (isNotFoundError(error)) {
-			const derived = await createDerivedResponse(options, pathname, request, true);
+			const derived = await createDerivedResponse(options, pathname, located, request, { dataOnly: true });
 			if (derived) return derived;
 			return Response.json({
 				kind: "page",
@@ -495,48 +1014,117 @@ async function handleCamoxRequest(request, options = {}) {
 	}
 	if (match.kind === "og") return createOgResponse(request, options);
 	if (match.kind === "sitemap") return createSitemapResponse(request, options);
+	if (match.kind === "llms-txt") return createLlmsTxtResponse(request, options);
+	if (match.kind === "routes") return createRoutesResponse(request, options);
 	if (match.kind === "data") {
 		const targetPathname = normalizePagePath(new URL(request.url).searchParams.get("path"));
-		const targetMatch = matchRuntimeRoute(targetPathname);
-		if (targetMatch.kind.startsWith("studio")) return createStudioHtmlResponse({
-			match: targetMatch,
-			options,
-			request,
-			dataOnly: true
-		});
-		if (targetMatch.kind !== "page") return new Response("Not found", { status: 404 });
-		return createPageDataResponse({
-			options,
-			pathname: targetPathname,
-			request
-		});
+		if (matchRuntimeOwnedRoute(targetPathname)) return new Response("Not found", { status: 404 });
+		return respondInLocale(options, request, targetPathname, { dataOnly: true });
 	}
-	if (match.kind === "studio" || match.kind === "studio-content" || match.kind === "studio-nested") return createStudioHtmlResponse({
-		match,
+	if (isPreviewHandoff(request, options) && match.kind === "page") return createPreviewHandoffResponse({
 		options,
+		pathname,
 		request
 	});
-	if (match.kind === "page") {
-		if (options.apiUrl && options.projectSlug) {
-			const markdownResponse = await createMarkdownResponse({
-				apiUrl: options.apiUrl,
-				environmentName: options.environmentName,
-				pathname: match.pathname,
-				projectSlug: options.projectSlug,
+	const { apiUrl, projectUuid } = options;
+	const markdownPathname = parseMarkdownPath(pathname);
+	if (apiUrl && projectUuid && (markdownPathname || prefersMarkdown(request.headers.get("Accept") ?? ""))) {
+		const located = await locateRequest(request, options, markdownPathname ?? pathname, { live: true });
+		if (markdownPathname || matchLocalizedRoute(located.path)?.kind === "page") {
+			const markdownResponse = await createPageMarkdownResponse({
+				...options,
+				apiUrl,
+				projectUuid
+			}, located, {
+				pathname: markdownPathname ?? pathname,
 				request
 			});
 			if (markdownResponse) return markdownResponse;
+			if (markdownPathname) return new Response("Page not found", { status: 404 });
 		}
-		return createPageHtmlResponse({
-			options,
-			pathname: match.pathname,
-			request
-		});
 	}
-	return Response.json({
-		message: "Camox runtime route matched.",
-		...match
-	}, { status: 501 });
+	return respondInLocale(options, request, pathname);
+}
+/**
+* Answers a path under its locale's prefix: the Canvas, a studio route or a page, in that locale.
+* With `dataOnly`, as the JSON client navigation loads.
+*/
+async function respondInLocale(options, request, pathname, { dataOnly = false } = {}) {
+	const located = await locateRequest(request, options, pathname);
+	const localized = matchLocalizedRoute(located.path);
+	if (!localized) return new Response("Not found", { status: 404 });
+	const target = {
+		options,
+		pathname,
+		located,
+		request
+	};
+	if (localized.kind === "canvas") return createCanvasOnlyResponse({
+		...target,
+		dataOnly
+	});
+	if (isStudioRoute(localized)) return createStudioHtmlResponse({
+		...target,
+		match: localized,
+		dataOnly
+	});
+	return dataOnly ? createPageDataResponse(target) : createPageHtmlResponse(target);
+}
+/**
+* A page's Markdown Representation in its locale, with the same precedence as its HTML:
+* singleton, curated page, then derived layout. Null when the page has none.
+*/
+async function createPageMarkdownResponse(options, { locale, path }, { pathname, request }) {
+	const page = {
+		pathname,
+		url: absoluteUrl(request, options)(pathname)
+	};
+	const app = await options.getCamoxApp?.();
+	const layoutMatch = app && matchDerivedLayout(app.getLayouts(), path);
+	if (layoutMatch?.layout._internal.kind === "singleton") return createLayoutMarkdownResponse(options, layoutMatch, locale, page);
+	return createMarkdownResponse({
+		apiUrl: options.apiUrl,
+		camoxApp: app,
+		locale,
+		pathname: path,
+		projectUuid: options.projectUuid,
+		request,
+		url: page.url,
+		onNotFound: async () => layoutMatch ? createLayoutMarkdownResponse(options, layoutMatch, locale, page) : null
+	});
+}
+/** Whether a route is one of the studio's own, rather than a page or the Canvas. */
+function isStudioRoute(match) {
+	return match.kind === "studio" || match.kind === "studio-content" || match.kind === "studio-nested";
+}
+/**
+* The studio or page route a locale-relative path names, or null for a runtime-owned route
+* under a locale's prefix (`/de/sitemap.xml`), which names nothing.
+*/
+function matchLocalizedRoute(path) {
+	const match = matchRuntimeRoute(path);
+	return match.kind === "page" || match.kind === "canvas" || isStudioRoute(match) ? match : null;
+}
+/**
+* The locale a request's path names, among the locales of the scope it reads: the URL's draft's
+* for a session naming one, else Live's. `live` reads Live's whatever the request names. Without
+* an API there are none to read: every path is the default locale's, which then says it can't
+* render.
+*/
+async function locateRequest(request, options, pathname, { live = false } = {}) {
+	const { apiUrl, projectUuid } = options;
+	const locales = apiUrl && projectUuid ? await readScopeLocales({
+		apiUrl,
+		projectUuid,
+		...!live && {
+			authCookieHeader: getServerAuthCookieHeader(request.headers),
+			draftId: getRequestDraftId(request, options)
+		}
+	}) : [UNNAMED_DEFAULT_LOCALE];
+	return {
+		...parseLocalePath(pathname, locales),
+		locales
+	};
 }
 
 //#endregion