create-kywi-app 0.16.0 → 0.18.0

package/bin/create-kywi-app.mjs

@@ -303,7 +303,7 @@ Next steps:
   pnpm seed                 # prints the superadmin credentials
   pnpm dev                  # http://localhost:3000
 
-Docs: https://kywi.dev/docs
+Docs: https://docs.kywi.dev
 `)
   return 0
 }

package/lib/templates.mjs

@@ -191,7 +191,7 @@ assertProductionAuthSecret(process.env.AUTH_SECRET)
 
 /**
  * Kywi configuration — the single source of truth for this project.
- * Docs: https://kywi.dev/docs/config
+ * Docs: https://docs.kywi.dev/config
  */
 export default defineKywiConfig({
   // Deployment mode:
@@ -458,7 +458,9 @@ public/kywi-admin.css.version
 // ── server runtime (lib/kywi.ts) ──────────────────────────────────────────────
 
 function libKywi() {
-  return `import {
+  return `import { cache } from 'react'
+import { headers } from 'next/headers'
+import {
   createDb,
   createKywiApiHandler,
   createStorageProvider,
@@ -468,6 +470,7 @@ function libKywi() {
 import type { KywiApiHandler, KywiDb } from '@kywi-software/core/server'
 import { createKywiScope } from '@kywi-software/core/scope'
 import type { KywiScope } from '@kywi-software/core/scope'
+import { resolveActiveSite } from '@kywi-software/core/host'
 import config from '../kywi.config'
 
 /**
@@ -478,6 +481,14 @@ export interface KywiRuntime {
   handler: KywiApiHandler
   scope: KywiScope
   db: KywiDb
+  /**
+   * DB UUID of the DEFAULT site (\`config.sites[0]\`), resolved once at init.
+   *
+   * This is a process-level fallback, NOT the site a request is for. Public
+   * render code must use \`getActiveSite()\` below, which resolves from the
+   * request's Host header — keying a public query on this instead is what makes
+   * a multi-site app serve the first site's content on every domain.
+   */
   siteId: string
   config: typeof config
 }
@@ -493,10 +504,11 @@ async function init(): Promise<KywiRuntime> {
   const handler = await createKywiApiHandler({ config, db, authSecret, storage })
   const scope = createKywiScope(config, db, undefined, { mediaBaseUrl: '/api/v1' })
 
-  // Resolve the DB UUID for the first configured site (its \`id\` is the slug).
+  // Resolve the DB UUID for the DEFAULT configured site (its \`id\` is the slug).
+  // Per-request site resolution lives in \`getActiveSite()\`, not here.
   const sites = await scope.site.list()
-  const match = sites.find((s) => (s as { slug?: string }).slug === config.sites[0]?.id)
-  const siteId = (match?.['id'] as string | undefined) ?? config.sites[0]?.id ?? 'default'
+  const match = sites.find((s) => (s as { slug?: string }).slug === config.sites[0]?.id) // DEFAULT-SITE FALLBACK: boot-time default, not a per-request resolution
+  const siteId = (match?.['id'] as string | undefined) ?? config.sites[0]?.id ?? 'default' // DEFAULT-SITE FALLBACK: boot-time default, not a per-request resolution
 
   return { handler, scope, db, siteId, config }
 }
@@ -510,6 +522,52 @@ export async function getKywi(): Promise<KywiRuntime> {
 export async function getKywiHandler(): Promise<KywiApiHandler> {
   return (await getKywi()).handler
 }
+
+// ─── Host → site resolution ─────────────────────────────────────────────────
+
+/** One configured site (config uses the slug as \`id\`). */
+export type SiteConfig = (typeof config.sites)[number]
+
+/** The site the current public request is for: config entry + its DB UUID. */
+export interface ActiveSite {
+  runtime: KywiRuntime
+  /** Resolved config site (matched by request Host, else the default site). */
+  site: SiteConfig
+  /** DB UUID of that site (what the scope/queries key on). */
+  siteId: string
+}
+
+// Config-slug → DB-UUID map, cached for the process. Sites are reconciled at
+// boot and static thereafter; a miss falls back to the slug.
+let _slugToUuid: Record<string, string> | null = null
+async function slugToUuid(runtime: KywiRuntime): Promise<Record<string, string>> {
+  if (_slugToUuid) return _slugToUuid
+  const rows = (await runtime.scope.site.list()) as Array<{ id?: string; slug?: string }>
+  const map: Record<string, string> = {}
+  for (const r of rows) if (r.slug && r.id) map[r.slug] = r.id
+  _slugToUuid = map
+  return map
+}
+
+/**
+ * Which configured site is this request for? Resolved from the request's HOST
+ * header, so \`docs.example.com\` serves the docs site and \`example.com\` serves
+ * the marketing site from one app and one database.
+ *
+ * Wrapped in React \`cache()\` so every helper on a single render shares one
+ * lookup. The process-level singletons in \`getKywi()\` are unaffected — only the
+ * per-request Host differs.
+ *
+ * DO NOT read \`x-kywi-url\` here: in dev it carries the server's own bound origin
+ * (localhost), which would defeat host-based routing entirely.
+ */
+export const getActiveSite = cache(async (): Promise<ActiveSite> => {
+  const runtime = await getKywi()
+  const host = (await headers()).get('host')
+  const map = await slugToUuid(runtime)
+  const { site, siteId } = resolveActiveSite(runtime.config.sites, map, host)
+  return { runtime, site, siteId }
+})
 `
 }
 
@@ -532,17 +590,15 @@ function libSite() {
   return `import { headers, cookies } from 'next/headers'
 import type {
   LayoutDocument,
-  RegionNode,
-  VariantContainer,
   FeedItemsResolver,
   PersonalizationState,
 } from '@kywi-software/core/layout'
 import {
-  isLayoutSection,
   collectComponentRefs,
   componentDetachSource,
   resolveComponentPlacements,
   applyPageVariant,
+  collectLayoutExperimentIds,
 } from '@kywi-software/core/layout'
 import { resolveContentByPath, normalizePath } from '@kywi-software/core/nav'
 import { getFeedBySlug, getComponentById, resolveLocaleFromRequest } from '@kywi-software/core'
@@ -561,8 +617,7 @@ import type {
   SelfIdTrigger,
 } from '@kywi-software/core/audiences/types'
 import { listRunningExperiments, resolveExperimentForContainer } from '@kywi-software/core/experiments'
-import { getKywi, type KywiRuntime } from './kywi'
-import config from './config'
+import { getActiveSite, type KywiRuntime, type SiteConfig } from './kywi'
 
 /** A resolved content node is a flat record of its columns (base + custom fields). */
 export type ContentNode = Record<string, unknown>
@@ -587,9 +642,18 @@ export async function requestBaseUrl(): Promise<string> {
 
 // ─── Locale routing (#51) ────────────────────────────────────────────────────
 
-/** The active site's configured locales (the default is always included first). */
-export function siteLocales(): { defaultLocale: string; locales: string[] } {
-  const site = config.sites[0]
+/**
+ * The active site's configured locales (the default is always included first).
+ *
+ * \`activeSite\` is the site the REQUEST resolved to (\`getActiveSite().site\`).
+ * Omitting it falls back to the default site, which is right only for a
+ * single-site app — a second site would otherwise be served site one's locales.
+ */
+export function siteLocales(
+  runtime: KywiRuntime,
+  activeSite?: SiteConfig,
+): { defaultLocale: string; locales: string[] } {
+  const site = activeSite ?? runtime.config.sites[0] // DEFAULT-SITE FALLBACK: Host matched no site
   const defaultLocale = site?.defaultLocale ?? 'en'
   const configured = site?.locales && site.locales.length > 0 ? site.locales : [defaultLocale]
   const locales = configured.includes(defaultLocale) ? configured : [defaultLocale, ...configured]
@@ -604,10 +668,12 @@ export function siteLocales(): { defaultLocale: string; locales: string[] } {
  * the slug). Locale prefixes are only honoured for locales in \`site.locales\`.
  */
 export function resolveRequestLocale(
+  runtime: KywiRuntime,
   slugSegments: string[],
   acceptLanguage?: string | null,
+  activeSite?: SiteConfig,
 ): { locale: string; slugPath: string[] } {
-  const { defaultLocale, locales } = siteLocales()
+  const { defaultLocale, locales } = siteLocales(runtime, activeSite)
   const pathname = '/' + slugSegments.join('/')
   const locale = resolveLocaleFromRequest(pathname, acceptLanguage ?? null, defaultLocale, locales)
   const first = slugSegments[0]
@@ -619,10 +685,17 @@ export function resolveRequestLocale(
  * hreflang alternates for a page across the site's configured locales, or
  * undefined for a single-locale site. Feeds Next's \`alternates.languages\`.
  */
-export function localeAlternates(slugSegments: string[]): Record<string, string> | undefined {
-  const { defaultLocale, locales } = siteLocales()
+export async function localeAlternates(
+  slugSegments: string[],
+): Promise<Record<string, string> | undefined> {
+  // Async because the alternates belong to the site THIS request is for: a
+  // two-locale docs site and a single-locale marketing site share this app, and
+  // reading the default site's locales here would emit the wrong hreflang set
+  // (or none) on the other host.
+  const { runtime, site } = await getActiveSite()
+  const { defaultLocale, locales } = siteLocales(runtime, site)
   if (locales.length <= 1) return undefined
-  const { slugPath } = resolveRequestLocale(slugSegments, null)
+  const { slugPath } = resolveRequestLocale(runtime, slugSegments, null, site)
   const rel = slugPath.join('/')
   const out: Record<string, string> = {}
   for (const loc of locales) {
@@ -646,9 +719,12 @@ export async function resolvePublicContent(
   slugSegments: string[],
   opts?: { acceptLanguage?: string | null },
 ): Promise<ContentNode | null> {
-  const { scope, db, siteId } = await getKywi()
-  const { defaultLocale } = siteLocales()
-  const { locale, slugPath } = resolveRequestLocale(slugSegments, opts?.acceptLanguage)
+  // Every query below is keyed on the site the REQUEST is for, not on the
+  // default site: this is the seam that decides whose \`/about\` a visitor gets.
+  const { runtime, site, siteId } = await getActiveSite()
+  const { scope, db } = runtime
+  const { defaultLocale } = siteLocales(runtime, site)
+  const { locale, slugPath } = resolveRequestLocale(runtime, slugSegments, opts?.acceptLanguage, site)
 
   const bySlug = async (slug: string): Promise<ContentNode | null> => {
     let node = await scope.content.getBySlug(slug, siteId, { locale })
@@ -691,8 +767,8 @@ export async function resolvePublicContent(
  * URL so the (client) module can render images. Core owns the walk + item shape;
  * this owns the data access.
  */
-export function buildFeedResolver(runtime: KywiRuntime): FeedItemsResolver {
-  const { scope, db, siteId } = runtime
+export function buildFeedResolver(runtime: KywiRuntime, siteId: string): FeedItemsResolver {
+  const { scope, db } = runtime
   return async (feedSlug, { limit }) => {
     const feed = await getFeedBySlug(db, feedSlug, siteId)
     if (!feed) return []
@@ -713,8 +789,8 @@ export function buildFeedResolver(runtime: KywiRuntime): FeedItemsResolver {
 // ─── Linked components: server-side pre-resolution (#46, #69, #147) ──────────
 
 /** Fetch a set of component rows once and index them by id. */
-async function loadComponents(ids: string[], runtime: KywiRuntime) {
-  const { db, siteId } = runtime
+async function loadComponents(ids: string[], runtime: KywiRuntime, siteId: string) {
+  const { db } = runtime
   const entries = await Promise.all(
     ids.map(async (id) => [id, await getComponentById(db, id, siteId)] as const),
   )
@@ -745,10 +821,11 @@ async function loadComponents(ids: string[], runtime: KywiRuntime) {
 export async function resolveLayoutComponents(
   layout: LayoutDocument,
   runtime: KywiRuntime,
+  siteId: string,
 ): Promise<LayoutDocument> {
   const refs = collectComponentRefs(layout)
   if (refs.length === 0) return layout
-  const map = await loadComponents([...new Set(refs.map((ref) => ref.componentId))], runtime)
+  const map = await loadComponents([...new Set(refs.map((ref) => ref.componentId))], runtime, siteId)
   return resolveComponentPlacements(layout, (componentId) =>
     componentDetachSource(map.get(componentId) ?? null),
   )
@@ -796,11 +873,14 @@ export async function resolvePersonalization(
   layout: LayoutDocument | null | undefined,
 ): Promise<PublicPersonalization> {
   const [h, cookieStore] = await Promise.all([headers(), cookies()])
+  // Evaluate against the HOST-resolved site, so a visitor on site B is matched
+  // only against site B's audiences and gated by site B's theme flags.
+  const { site, siteId } = await getActiveSite()
   // One resolution of \`theme.personalization.requireConsent\` for the whole
   // request, handed to every gate below — the visitor-id read AND the audience
   // engine's own collectors. They read the same cookies; disagreeing about
   // whether consent is required would personalize half a page.
-  const gate = { requireConsent: requireConsentEnabled() }
+  const gate = { requireConsent: requireConsentEnabled(runtime, site) }
   // \`kywi_visitor\` is a \`personalization\` cookie, so without consent it is
   // neither written nor read (kywi-cms#91) — the middleware hands this request a
   // THROWAWAY id instead, freshly minted and different on the next request.
@@ -823,7 +903,7 @@ export async function resolvePersonalization(
   h.forEach((value, key) => reqHeaders.set(key, value))
   const request = new Request(url, { headers: reqHeaders })
 
-  const { db, siteId } = runtime
+  const { db } = runtime
   // \`gate\` reaches the engine's server collectors, so a site whose consent is
   // owned by an external CMP (\`requireConsent: false\`) has its stored UTM /
   // visitor / known / pinned-audience cookies read here too, not just by the
@@ -835,6 +915,7 @@ export async function resolvePersonalization(
 
   const experimentAssignments = await resolveExperimentAssignments(
     runtime,
+    siteId,
     layout,
     audienceId,
     visitorId,
@@ -851,14 +932,6 @@ export async function resolvePersonalization(
   }
 }
 
-function* variantContainersInRegions(regions: Record<string, RegionNode[]>): Generator<VariantContainer> {
-  for (const nodes of Object.values(regions)) {
-    for (const node of nodes) {
-      if (!isLayoutSection(node)) yield node
-    }
-  }
-}
-
 /**
  * Deterministically assign this visitor to a variant of every running A/B
  * experiment the (audience-resolved) layout actually shows, and record the
@@ -871,9 +944,18 @@ function* variantContainersInRegions(regions: Record<string, RegionNode[]>): Gen
  * write stops being idempotent — every anonymous page view would insert another
  * assignment row. The ARM IS STILL CHOSEN, so the page renders exactly as it
  * does for anyone else; only the counting stops.
+ *
+ * Experiment ids come from \`collectLayoutExperimentIds\` — the engine's own
+ * walker, the same one \`<KywiLayout>\` and the reference app use. It descends
+ * into every section's columns as well as the top-level regions, so a
+ * module-level \`moduleVariantContainer\` (an ab_test placed inside a section,
+ * not a bare section-level band) is bucketed exactly like one — a hand-rolled
+ * walker here previously stopped at the top level and silently never assigned
+ * those (kywi-cms#221).
  */
 async function resolveExperimentAssignments(
   runtime: KywiRuntime,
+  siteId: string,
   layout: LayoutDocument | null | undefined,
   audienceId: string | null,
   visitorId: string,
@@ -887,16 +969,11 @@ async function resolveExperimentAssignments(
   // see the Default arm of a live experiment. After pre-resolution there are no
   // unresolved placements left to special-case — the containers here are the
   // containers that render.
-  const resolved = await resolveLayoutComponents(applyPageVariant(layout, audienceId), runtime)
-  const experimentIds = new Set<string>()
-  for (const node of variantContainersInRegions(resolved.regions)) {
-    if (node.mode === 'ab_test' && !node.winnerId && node.experimentId) {
-      experimentIds.add(node.experimentId)
-    }
-  }
-  if (experimentIds.size === 0) return {}
+  const resolved = await resolveLayoutComponents(applyPageVariant(layout, audienceId), runtime, siteId)
+  const experimentIds = collectLayoutExperimentIds(resolved)
+  if (experimentIds.length === 0) return {}
 
-  const running = await listRunningExperiments(runtime.db, runtime.siteId)
+  const running = await listRunningExperiments(runtime.db, siteId)
   const byId = new Map(running.map((e) => [e.id, e]))
   const assignments: Record<string, string | null> = {}
   for (const id of experimentIds) {
@@ -925,10 +1002,10 @@ export function personalizeLayout(
   return applyPageVariant(layout, audienceId)
 }
 
-/** Is the @kywi-software/js client runtime enabled for this site's theme? */
-export function clientRuntimeEnabled(): boolean {
-  const themeName = config.sites[0]?.theme
-  const theme = config.themes.find((t) => t.name === themeName) ?? config.themes[0]
+/** Is the @kywi-software/js client runtime enabled for the ACTIVE site's theme? */
+export function clientRuntimeEnabled(runtime: KywiRuntime, activeSite?: SiteConfig): boolean {
+  const themeName = (activeSite ?? runtime.config.sites[0])?.theme // DEFAULT-SITE FALLBACK: Host matched no site
+  const theme = runtime.config.themes.find((t) => t.name === themeName) ?? runtime.config.themes[0]
   return theme?.personalization?.clientRuntime === true
 }
 
@@ -940,9 +1017,9 @@ export function clientRuntimeEnabled(): boolean {
  * appearing on its own. Even then a \`personalizationBadge\` module can still
  * open it deliberately.
  */
-export function transparencyNoticeEnabled(): boolean {
-  const themeName = config.sites[0]?.theme
-  const theme = config.themes.find((t) => t.name === themeName) ?? config.themes[0]
+export function transparencyNoticeEnabled(runtime: KywiRuntime, activeSite?: SiteConfig): boolean {
+  const themeName = (activeSite ?? runtime.config.sites[0])?.theme // DEFAULT-SITE FALLBACK: Host matched no site
+  const theme = runtime.config.themes.find((t) => t.name === themeName) ?? runtime.config.themes[0]
   return theme?.personalization?.transparencyNotice?.enabled !== false
 }
 
@@ -955,9 +1032,18 @@ export function transparencyNoticeEnabled(): boolean {
  *
  * \`middleware.ts\` runs on the edge and cannot read this config, so it mirrors
  * the same flag with \`KYWI_REQUIRE_CONSENT=false\`. Set both, or neither.
+ *
+ * The flag is resolved from the ACTIVE site's theme, but as of core 0.17.0 every
+ * configured site in one deployment must agree on it: the edge mirror is a
+ * single process-wide env var and cannot carry two answers, so
+ * \`createKywiApiHandler\` FAILS STARTUP on a divergence rather than letting a
+ * second site silently inherit the first site's privacy default. A per-host
+ * mirror map would lift that constraint and is deferred
+ * (\`docs-site DESIGN.md §3.4\`).
  */
-export function requireConsentEnabled(): boolean {
-  const theme = config.themes.find((t) => t.name === config.sites[0]?.theme) ?? config.themes[0]
+export function requireConsentEnabled(runtime: KywiRuntime, activeSite?: SiteConfig): boolean {
+  const themeName = (activeSite ?? runtime.config.sites[0])?.theme // DEFAULT-SITE FALLBACK: Host matched no site
+  const theme = runtime.config.themes.find((t) => t.name === themeName) ?? runtime.config.themes[0]
   return theme?.personalization?.requireConsent !== false
 }
 
@@ -1002,10 +1088,13 @@ function mapFrequency(freq: SelfIdWidgetConfig['frequency']): PublicSelfIdWidget
  * picklist fields hydrated. Returns null when there is no config or it references
  * no resolvable fields, so the caller can skip mounting the widget entirely.
  */
-export async function resolveSelfIdWidget(runtime: KywiRuntime): Promise<PublicSelfIdWidget | null> {
+export async function resolveSelfIdWidget(
+  runtime: KywiRuntime,
+  siteId: string,
+): Promise<PublicSelfIdWidget | null> {
   const [widget, allFields] = await Promise.all([
-    getSelfIdWidgetConfig(runtime.db, runtime.siteId),
-    listSelfIdFields(runtime.db, runtime.siteId),
+    getSelfIdWidgetConfig(runtime.db, siteId),
+    listSelfIdFields(runtime.db, siteId),
   ])
   if (!widget) return null
 
@@ -1365,8 +1454,7 @@ import { navTreeToMenuItems, normalizePath } from '@kywi-software/core/nav'
 import '@kywi-software/core/site/styles.css'
 // This app's OWN chrome (header / footer / page wrapper). Yours to edit freely.
 import './site.css'
-import config from '../../kywi.config'
-import { getKywi } from '../../lib/kywi'
+import { getActiveSite } from '../../lib/kywi'
 import { SiteNav } from '../../components/site-nav'
 import { KywiJsLoader } from '../../components/kywi-js-loader'
 
@@ -1390,17 +1478,29 @@ import { KywiJsLoader } from '../../components/kywi-js-loader'
  * into a \`:root { --kywi-* }\` block by \`themeTokenStyleBlock\` and injected below,
  * so kywi.config.ts is the single source of truth for the palette and spacing and
  * both site.css and core's default styles resolve against those variables.
+ *
+ * Everything it renders — the menus, the nav-tree fallback and the theme block —
+ * is keyed on the site the REQUEST resolved to, so one app serves each of its
+ * configured domains its own nav and its own palette.
  */
-const siteTheme =
-  config.themes.find((t) => t.name === config.sites[0]?.theme) ?? config.themes[0]
-const themeVars = themeTokenStyleBlock(siteTheme?.tokens)
 
 // Content edits (a renamed page, a reordered menu) must show up without a
 // restart — same reasoning as the page route.
 export const dynamic = 'force-dynamic'
 
 export default async function SiteLayout({ children }: { children: React.ReactNode }) {
-  const { scope, siteId } = await getKywi()
+  // The site this request is FOR (resolved from its Host header), never the
+  // default site: the menus, the nav tree and the theme below are all keyed on
+  // it, so a second domain gets its own nav and its own palette.
+  const { runtime, site, siteId } = await getActiveSite()
+  const { scope } = runtime
+
+  // Resolved PER REQUEST, not at module scope: a module-scope constant is
+  // evaluated once at import, so every host would emit the first site's tokens
+  // and a second site could not be themed at all.
+  const siteTheme =
+    runtime.config.themes.find((t) => t.name === site.theme) ?? runtime.config.themes[0]
+  const themeVars = themeTokenStyleBlock(siteTheme?.tokens)
 
   // The middleware forwards the full request URL as \`x-kywi-url\` (see
   // middleware.ts) so this shared layout can resolve which page is current —
@@ -1573,7 +1673,7 @@ import {
 import { KywiJsonLd } from '@kywi-software/core/scope'
 import { ACCESS_COOKIE, canAccessContent, readSessionClaims } from '@kywi-software/core/host'
 import config from '../../../lib/config'
-import { getKywi } from '../../../lib/kywi'
+import { getActiveSite } from '../../../lib/kywi'
 import {
   resolvePublicContent,
   resolvePersonalization,
@@ -1623,7 +1723,7 @@ export async function generateMetadata({ params }: Params): Promise<Metadata> {
   const image = mediaUrl(node['metaImageId']) ?? mediaUrl(node['featuredImageId'])
   const images = image ? [image] : undefined
   const canonical = (node['canonicalUrl'] as string) || undefined
-  const languages = localeAlternates(slug ?? [])
+  const languages = await localeAlternates(slug ?? [])
   const alternates =
     canonical || languages
       ? { ...(canonical ? { canonical } : {}), ...(languages ? { languages } : {}) }
@@ -1674,7 +1774,10 @@ export default async function PublicPage({ params, searchParams }: Params & Sear
   const node = await getNode((slug ?? []).join('/'), acceptLanguage)
   if (!node || node['status'] !== 'published') notFound()
 
-  const runtime = await getKywi()
+  // The site this request is FOR, resolved from its Host header. \`siteId\` (not
+  // \`runtime.siteId\`, which is the DEFAULT site) keys every site-scoped call
+  // below; \`site\` selects the theme the flag helpers read.
+  const { runtime, site, siteId } = await getActiveSite()
   const contentId = String(node['id'] ?? '')
   const contentType = String(node['contentTypeName'] ?? 'page')
   const title = String(node['title'] ?? 'Untitled')
@@ -1695,7 +1798,7 @@ export default async function PublicPage({ params, searchParams }: Params & Sear
   // visitor's A/B arms are assigned deterministically. Opted-out / anonymous
   // visitors resolve to the default experience.
   const perso = await resolvePersonalization(runtime, layout)
-  const selfIdWidget = await resolveSelfIdWidget(runtime)
+  const selfIdWidget = await resolveSelfIdWidget(runtime, siteId)
 
   // <head> injections (React hoists these): per-page JSON-LD gated on the
   // AX/JSON-LD setting, mapping the SAME node so page and schema agree (#56); the
@@ -1717,17 +1820,17 @@ export default async function PublicPage({ params, searchParams }: Params & Sear
         node={node}
         config={runtime.config}
         baseUrl={baseUrl}
-        siteId={runtime.siteId}
+        siteId={siteId}
         {...(servedLayout ? { layout: servedLayout } : {})}
       />
       <AudienceMetaTags audienceId={perso.audienceId} visitorId={perso.visitorId} />
-      {clientRuntimeEnabled() && perso.audiences.length > 0 ? (
+      {clientRuntimeEnabled(runtime, site) && perso.audiences.length > 0 ? (
         <PersonalizationRuntime
           audiences={perso.audiences}
           serverSignals={perso.signals}
           selfIdWidget={selfIdWidget}
-          transparencyNotice={transparencyNoticeEnabled()}
-          requireConsent={requireConsentEnabled()}
+          transparencyNotice={transparencyNoticeEnabled(runtime, site)}
+          requireConsent={requireConsentEnabled(runtime, site)}
         />
       ) : null}
     </>
@@ -1744,19 +1847,19 @@ export default async function PublicPage({ params, searchParams }: Params & Sear
     // hydrate feeds and resolve components on the layout THIS visitor sees.
     // variantContainer arms resolve at render time from \`personalization\`.
     const personalized = personalizeLayout(layout, perso.audienceId)
-    const feedsHydrated = await hydrateLayoutFeeds(personalized, buildFeedResolver(runtime))
+    const feedsHydrated = await hydrateLayoutFeeds(personalized, buildFeedResolver(runtime, siteId))
     // Resolve every navMenu/navigation/siteMap module placed in THIS layout
     // (menuSlug → a real menu; the tree otherwise) — the same seam as feeds,
     // so a nav module dropped into any region/section just works (#112).
     const currentPath = String(node['path'] ?? '/')
     const navHydrated = await hydrateLayoutNav(
       feedsHydrated,
-      runtime.scope.menus.createHydrationResolver(runtime.siteId, currentPath),
+      runtime.scope.menus.createHydrationResolver(siteId, currentPath),
     )
     // Linked components resolve HERE, on the server, into the document itself:
     // KywiLayout is a client component and the renderer's resolver props are
     // functions, which cannot cross the RSC boundary (#147).
-    const hydrated = await resolveLayoutComponents(navHydrated, runtime)
+    const hydrated = await resolveLayoutComponents(navHydrated, runtime, siteId)
     // LAST pass before the client boundary (#167): keep ONLY the arm this
     // visitor is served in every variantContainer / moduleVariantContainer.
     // KywiLayout is a client component, so anything still on the document here

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-kywi-app",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Scaffold a new Kywi CMS project — npx create-kywi-app my-site",
   "type": "module",
   "homepage": "https://github.com/Kywi-Software/kywi-cms#readme",