create-prenta 1.3.0

package/CHANGELOG.md

@@ -0,0 +1,964 @@
+# create-actuate-cms
+
+## 1.3.0
+
+### Minor Changes
+
+- 5eea995: Product rename: ActuateCMS is now **Prenta**. Every package moves from the
+  `@actuate-media/*` scope to `@prenta/*` with simplified names (`@prenta/core`,
+  `@prenta/admin`, `create-prenta`), and version numbers continue from where the
+  old scope left off.
+
+  This is a clean break — no backwards-compat aliases:
+  - **npm packages**: `@actuate-media/cms-core` → `@prenta/core`,
+    `@actuate-media/cms-admin` → `@prenta/admin`, all other packages keep their
+    suffix under `@prenta/*`. `create-actuate-cms` → `create-prenta`
+    (`npm create prenta`), `create-actuate-astro` → `create-prenta-astro`.
+    CLI bins: `actuate`/`actuate-cms` → `prenta`/`prenta-cms`; `actuate-mcp` →
+    `prenta-mcp`.
+  - **Database**: migration `0012_rename_to_prenta` renames all 36 `actuate_*`
+    tables to `prenta_*` in place (plus prefixed constraints, indexes, and
+    sequences). Run `prisma migrate deploy` when upgrading.
+  - **Runtime identifiers**: `getActuateConfig` → `getPrentaConfig`,
+    `handleActuateAPI` → `handlePrentaAPI`, `ActuateClient` → `PrentaClient`,
+    `ActuateDB` → `PrentaDB`, config file `actuate.config.ts` →
+    `prenta.config.ts`, CSS scopes `.actuate-admin`/`.actuate-canvas` →
+    `.prenta-admin`/`.prenta-canvas`, preview protocol `actuate-preview:*` →
+    `prenta-preview:*`, webhook headers `X-Actuate-*` → `X-Prenta-*`, session
+    cookie `actuate_session` → `prenta_session`, env vars `ACTUATE_*` →
+    `PRENTA_*`, purge route `/api/actuate/purge` → `/api/prenta/purge`.
+  - **Sessions and webhooks**: all sessions reset on upgrade (cookie + JWT issuer
+    changed); webhook consumers must re-verify signatures against the new
+    `X-Prenta-*` headers.
+
+  The old `@actuate-media/*` packages are deprecated on npm and will receive no
+  further releases.
+
+## 1.2.4
+
+### Patch Changes
+
+- 6ff80a6: Add `@actuate-media/sections-react/testing` (`assertSectionRenderParity`, canvas render options) and wire an Astro-split starter `test:parity` gate so canvas and public orchestrators can't drift into a WYSIWYG lie.
+
+## 1.2.3
+
+### Patch Changes
+
+- 73854fc: Add `siteIdentityJsonLd*` / `jsonLdHasOrganization` so any page can emit resolvable WebSite + Organization JSON-LD (fixes dangling `#organization` @ids). Add `assertServingOriginConfigured` ops guard (Launch Gate E) and wire it into the Astro starter middleware + CMS API route boot; BaseLayout falls back to site-identity JSON-LD when page meta lacks Organization.
+
+## 1.2.2
+
+### Patch Changes
+
+- 576f076: Fix `blogPostCollection` archivePath footgun: deriving with a new slug/urlPrefix rebases `seo.archivePath` onto the urlPrefix unless set explicitly; `defineConfig` warns on duplicate archive paths. Astro starter/example: hybrid prerender defaults (`404.astro` prerendered; CMS catch-all / home / blog index explicit `prerender = false`).
+
+## 1.2.1
+
+### Patch Changes
+
+- dfffe08: Add `publicPageCacheControl()` on `@actuate-media/cms-core/astro/cache` (ADR 0011 cache-static defaults: 1h s-maxage / 24h SWR; preview → `private, no-store`) and wire the Astro starter + example site to use it instead of hardcoded Cache-Control strings. Purge remains path/URL-based per ADR 0011.
+
+## 1.2.0
+
+### Minor Changes
+
+- cf97a40: Launch-critical Astro SEO + freshness: `documentPublicPath` / `rewritePublicOrigin`, first-class `AstroPageMeta.robots`, admin/MCP path builders (#739), Yoast child sitemap + XSL proxies with origin rewrite, production purge 503 without CDN credentials, globals purge webhooks, and Launch Gate docs.
+
+## 1.1.0
+
+### Minor Changes
+
+- 7230d21: Scaffolded Astro public sites (`astro-split` workspaces and `--framework astro-site`) now pin Astro 7 (`astro@^7.1`, `@astrojs/vercel@^11`, `@astrojs/react@^6`). This picks up the fixes for three Astro XSS advisories (GHSA-f48w-9m4c-m7f5, GHSA-7pw4-f3q4-r2p2, GHSA-4g3v-8h47-v7g6). No template API changes: `output: 'server'`, the Vercel adapter, middleware, live content collections, and the purge webhook route all work unchanged on Astro 7. Node.js requirement stays 22.12+.
+
+## 1.0.0
+
+### Major Changes
+
+- 90f9801: Astro-first scaffolding: `astro-split` is now the default framework and emits a pnpm workspace instead of a nested `site/` folder.
+
+  **create-actuate-cms (breaking)**
+  - Default framework flipped from `next` to `astro-split`. `npm create actuate-cms` now scaffolds a pnpm workspace — Next CMS host in `apps/cms`, Astro public site in `apps/site` — instead of a Next monolith. Pass `--framework next` for the classic monolith (unchanged output).
+  - The `astro-split` layout changed from a root Next app with a nested `site/` Astro app to a proper workspace (`pnpm-workspace.yaml`, delegating root scripts, `packageManager: pnpm`). Re-running the scaffolder over an old layout is not supported.
+  - `astro-split` + `marketing-custom` (the default template) now compose: the section kit lands in `packages/sections` and all three layers are wired from it — `apps/cms/actuate.config.ts` imports the schema, the admin page imports `sectionRenderers` (via `transpilePackages`), and the Astro site registers the same renderer map. `verify:sections` runs from the root, both apps, and CI.
+  - Same-apex routing is now the default: `apps/site/vercel.json` ships rewrites for `/api/cms/*` and the admin/login paths to the CMS host (`CMS_HOST_ORIGIN` placeholder) instead of an opt-in `vercel.preview-proxy.example.json`.
+  - The Astro site template ships cache-static delivery: `Cache-Control: public, s-maxage=3600, stale-while-revalidate=86400` on published pages, a `/api/actuate/purge` webhook endpoint built on `createPublishPurgeReceiver` (Cloudflare / Vercel adapters selected by env), and an optional Upstash layer-2 cache that the purge endpoint drains.
+  - `ASTRO.md` documents the workspace flow, production routing, and the purge webhook setup (Settings → Webhooks).
+
+  **create-actuate-astro**
+  - `--split` now scaffolds the pnpm workspace (`apps/cms` + `apps/site` + `packages/sections` with the designed-sections standard template). Site-only mode (the default) is unchanged.
+
+## 0.33.2
+
+### Patch Changes
+
+- 56c1309: Fix page tag saves silently no-oping when `tags` / `primaryTag` were undeclared (passthrough + scaffold `page-tags` collection), and replace the status-token tag palette with distinct `--tag-*` colors so pink is no longer warning orange.
+
+## 0.33.1
+
+### Patch Changes
+
+- f4766d4: Bump `sharp` to `^0.35.0` so consumers inherit the patched libvips line (GHSA-f88m-g3jw-g9cj) instead of resolving `0.34.5` from the previous pin.
+
+## 0.33.0
+
+### Minor Changes
+
+- c72bd83: Make **Standard (designed sections)** (`marketing-custom`) the default scaffold template so new projects ship schema + shared admin/public section renderers + seed/verify by default. Minimal built-ins-only kits remain available via `--template default`.
+
+## 0.32.2
+
+### Patch Changes
+
+- f676bcc: Resolve View live / View Site from the effective public site URL (`GET /site/public-url`, DB SEO overrides first), warn when that URL matches the CMS admin host, unlock Settings → General site URL overrides for split deploys, and default Astro-split `NEXT_PUBLIC_SITE_URL` to the Astro apex.
+
+## 0.32.1
+
+### Patch Changes
+
+- 3d1a79f: Timestamp-bound HMAC webhook signing with skew/replay verification (`verifyActuateWebhook`), delivery-id headers on form webhooks, publish secret reveal + 24h rotation grace, and consumer verification docs (#679).
+
+## 0.32.0
+
+### Minor Changes
+
+- 58f3ca1: Split-deploy hardening: denormalize media IDs on document write, regenerate JSON-LD on published updates, include Organization parent for Corporation/OnlineBusiness subtypes, and ship Astro security-headers middleware matching Next baselines.
+
+## 0.31.0
+
+### Minor Changes
+
+- cc6ad93: Split-deploy SEO redirects: ship `applyPublicRedirect` / `createAstroRedirectMiddleware`, wire Astro starters and Next scaffold to the shared engine, clarify Never hit vs Stale, and return 409 on duplicate source updates.
+
+## 0.30.1
+
+### Patch Changes
+
+- b6945e3: Astro starter: the scaffolded `BaseLayout.astro` now renders the full composed head from `/resolve` — Open Graph tags, `twitter:card`, a robots meta tag (including the forced `noindex` in preview mode), and hreflang alternate links — via a single `meta` prop (`AstroPageMeta` from `toPageMeta()`), and injects JSON-LD with `<Fragment set:html>` instead of an invalid `<div>` inside `<head>`. Static pages can still pass plain `title` / `description` / `canonical` props. `examples/astro-site` re-synced from the template.
+
+## 0.30.0
+
+### Minor Changes
+
+- c6b006c: Astro discoverability and best practices: `create-actuate-astro` + `--framework astro-site`, Live Content Collections loader (`@actuate-media/cms-core/astro/content`), islands/preview docs, and fleet first-cutover runbook.
+
+## 0.29.1
+
+### Patch Changes
+
+- fe3e76c: Astro public-site starter and `--framework astro-split` `site/` template now pin Astro 6 (`astro@^6.4`, `@astrojs/vercel@^10`, `@astrojs/react@^5`) and require Node.js 22.12+.
+
+## 0.29.0
+
+### Minor Changes
+
+- fb89234: Add `--framework next|astro-split` (default `next`). `astro-split` scaffolds a Next CMS host (admin + API, no public catch-all) plus an Astro public site under `site/` that uses `createAstroSiteHelpers`, sections-react, and SEO proxies. Also ships `examples/astro-site` as the reference starter.
+
+## 0.28.14
+
+### Patch Changes
+
+- fdfae4c: Include `graphql` + `graphql-yoga` in generated projects.
+
+  cms-core made these optional peer dependencies (Tier 2), so scaffolded apps now
+  declare them directly to keep the `/api/cms/graphql` endpoint working out of the
+  box — the same pattern already used for `sharp` and `@vercel/blob`. Remove both
+  from `package.json` if you only use the REST API.
+
+## 0.28.13
+
+### Patch Changes
+
+- da73f45: Drop the broken `lint` script from scaffolded projects.
+
+  The scaffolder emitted `"lint": "next lint"` while pinning Next ^16 — but Next 16
+  removed the `next lint` subcommand, and the generated project ships no ESLint
+  config or `eslint-config-next` dependency, so `npm run lint` errored on a fresh
+  install. Removed the script (consumers can add ESLint themselves).
+
+  (Companion docs fix in the same PR: the "Add to Existing Project" guide now
+  installs `@vercel/blob` and `sharp` for Vercel media uploads — `@vercel/blob` is
+  a dynamically-imported optional peer whose absence 500s the first upload.)
+
+## 0.28.12
+
+### Patch Changes
+
+- 95ea95a: Ship an `actuate-add-section` agent skill in the `marketing-custom` scaffold.
+
+  New projects get `.cursor/skills/actuate-add-section/SKILL.md` — a prescriptive
+  contract that turns a designed section into an editable Actuate section (schema
+  in `types.ts` + renderer in `register.tsx`, plus optional block + seed), kept in
+  sync. When you ask an agent (Cursor, Claude, …) to "make this section editable"
+  in the kit, it follows the contract instead of re-deriving it — so a design
+  becomes an editable CMS section without hand-wiring. The skill documents the
+  exact field types, the `section.content` renderer pattern, a design→schema
+  mapping, and a verify checklist. SECTIONS.md and the Design-First Playbook doc
+  reference it.
+
+## 0.28.11
+
+### Patch Changes
+
+- cb94bf0: Simplify custom-section authoring in the `marketing-custom` template.
+
+  A custom section used to be four hand-synced artifacts: a block component, a
+  schema entry, a public `register.tsx` renderer, and a separate
+  `admin-renderers.tsx` canvas renderer. The public renderer also had a latent bug
+  (it destructured a non-existent `content` prop instead of `section.content`).
+
+  Now a section is just its schema (`types.ts`) plus ONE renderer map
+  (`register.tsx`) — a single `sectionRenderers` object, typed as
+  `AdminSectionRendererMap`, that drives BOTH the public site and the admin editor
+  canvas (the two renderer signatures are structural mirrors, so one component
+  serves both; the admin map type is assignable to the public one for
+  registration). The separate `admin-renderers.tsx` file and its wiring are gone;
+  `verify:sections` and `SECTIONS.md` are updated to match.
+
+  Also adds a **Design-First Playbook** doc: a repeatable "design → editable CMS
+  pages" recipe (Design Inventory → schema + renderer → seed → verify).
+
+## 0.28.10
+
+### Patch Changes
+
+- 4421c32: Fix media upload 500 ("Cannot find package 'sharp'") on Vercel.
+
+  cms-core optimizes uploaded images with `sharp` and marks it a Next
+  `serverExternalPackage` (a native module can't be bundled). Because it's also
+  dynamically imported (`import(/* webpackIgnore */ 'sharp')`), Next never traces
+  it — so unless the app depends on `sharp` directly, Vercel omits it from the
+  function bundle and every image upload 500s.
+
+  Two fixes:
+  - `create-actuate-cms` now adds `sharp` to the generated `package.json`
+    dependencies (like it already does for `@vercel/blob`), so scaffolded sites
+    bundle it.
+  - The `/media/upload` handler now degrades gracefully: if optimization throws
+    (e.g. sharp is missing), it stores the original image and logs a warning
+    instead of returning a 500. Uploads succeed; add `sharp` to re-enable
+    webp/resize/blur-placeholder.
+
+  Existing sites hit by this: `npm install sharp` and redeploy.
+
+## 0.28.9
+
+### Patch Changes
+
+- f283357: Implement the AWS platform adapter (`aws()`) at parity with `vercel()`.
+
+  `@actuate-media/platform-aws` previously threw "not yet implemented" — which
+  also meant scaffolded `--platform aws` sites had **no working media storage**
+  (`storage: { provider: 's3' }` auto-wires to `aws().storage`). All six adapters
+  are now implemented:
+  - **Storage** — S3 (`@aws-sdk/client-s3`) with presigned URLs
+    (`@aws-sdk/s3-request-presigner`) and CloudFront-aware public URLs. Reads
+    `AWS_S3_BUCKET` / `AWS_REGION` (plus the scaffolder's `S3_*` fallback names);
+    credentials come from the task/instance IAM role by default.
+  - **Database** — RDS/Aurora Postgres via a real `pg` connection pool.
+  - **Cache** — ElastiCache (Redis/Valkey) via `ioredis`, with an in-memory
+    fallback; tag invalidation delegates to `next/cache`.
+  - **Email** — SES (`@aws-sdk/client-ses`), honoring reply-to/from.
+  - **Scheduler** — EventBridge Scheduler guidance + `generateEventBridgeConfig()`
+    / `toEventBridgeCron()` helpers (standard 5-field → EventBridge 6-field).
+  - **Rate limit** — Redis sliding-window log (ZADD/ZREMRANGEBYSCORE/ZCARD) with
+    an in-memory fallback.
+
+  Every AWS SDK is an optional peer dependency, dynamically imported on first use,
+  so installing the package pulls in nothing until an adapter runs.
+
+  The `create-actuate-cms` scaffolder now emits AWS-standard env var names
+  (`AWS_S3_BUCKET`, `AWS_REGION`, optional `AWS_S3_PUBLIC_URL`) for `--platform aws`
+  and enriches the generated AWS deployment guide (S3 IAM, EventBridge cron).
+
+## 0.28.8
+
+### Patch Changes
+
+- cc18833: SEO audit remediation — 47 verified fixes across the SEO system.
+
+  Highlights: redirect middleware no longer excludes legacy `.html/.php/.aspx`
+  URLs (migrations); robots.txt now `Allow`s the default OG image (`/api/cms/og.png`)
+  so social shares render; RSS always emits the mandatory channel `<description>`;
+  structured-data auto-detection no longer emits invalid `Review/Event/JobPosting`
+  (required fields enforced or the node is suppressed) and no longer mis-types
+  collections by substring (`newsletters`→NewsArticle etc.); the sitemap endpoint
+  no longer selects full document JSON for up to 45k rows; IndexNow submits on
+  every publish instead of being swallowed by the sitemap debounce; the exported
+  `renderJsonLdScript()` now escapes `<`; the editor no longer shows two
+  conflicting scores and the Content-tab analysis now understands section-built
+  pages; plus pagination `rel`/canonical, `og:locale` normalization + alternates,
+  canonical absolutization, VideoObject/Product/WebSite-SearchAction builders,
+  redirect loop/case handling, plugin-seo sitemap caps + real `lastmod`, and
+  plugin link-health routed through `safeFetch`. Adds several new exports on
+  `@actuate-media/cms-core` (e.g. `buildVideoObjectSchema`, `buildProductSchema`).
+
+## 0.28.7
+
+### Patch Changes
+
+- d6665dd: Fix the consumer build produced by `npm create actuate-cms`. Scaffolded projects
+  now ship an `.npmrc` with `node-linker=hoisted` so Next.js/Turbopack can resolve
+  the published packages' transitive dependencies (Radix/TipTap internals) during
+  `next build` — previously a default `pnpm install` failed with "Module not found"
+  for packages like `@radix-ui/react-use-controllable-state`. Also fixes the
+  generated `actuate.config.ts` to use the media plugin's `allowedTypes` option
+  (was the non-existent `allowedMimeTypes`, which failed type-check on build).
+- 041a228: Scaffolded projects no longer migrate the production database from preview
+  deploys. The build command now runs `prisma migrate deploy` through
+  `scripts/deploy-migrate.mjs`, which applies migrations only on Vercel
+  **production** builds (`VERCEL_ENV=production`) — or when `ALLOW_MIGRATE_DEPLOY=true`
+  is set explicitly against an isolated preview database. Previously every build
+  (including preview deploys from unmerged PRs) ran a bare `prisma migrate deploy`
+  against the configured database.
+
+## 0.28.6
+
+### Patch Changes
+
+- 4afb589: Fix accent color not applying when AdminRoot is wrapped in an outer `.actuate-admin` by targeting the marked admin shell root for theme overrides, and remove the duplicate wrapper from the scaffold admin page template.
+- 4afb589: Add legitimacy-gated 404 redirect recovery: wire public 404 logging, filter probe URLs before suggesting redirects, connect broken internal links to the SEO audit approve flow, and seed suggestions during audits.
+
+## 0.28.5
+
+### Patch Changes
+
+- 163ae1d: Design parity phase 3 (wave 1): split-pane editors, Script Tag delivery controls, Media SEO Audit, Pages tree view, and Dashboard onboarding.
+
+  **cms-core**
+  - `ScriptTag` gains `loadAsync`, `disableInPreview` (default on), and `consentCategory` fields (migration `0005_script_tag_delivery_controls`), accepted and validated on the script-tag API routes.
+  - `resolveScriptTagsForPath` accepts `{ preview }` and skips preview-disabled tags; the public `GET /script-tags/resolve` endpoint supports `?preview=1`. `loadAsync` injects `async` into external scripts, and consent-gated tags are wrapped in a bootstrap that waits for the consent plugin's "accept all" before injecting. The resolved response shape is unchanged.
+  - `ScriptTagGroup` now preserves `async`/`defer` attributes on external scripts.
+  - `GET /media` items include server-derived `seoScore`, `seoGrade`, and `seoIssues` (from `calculateMediaSeoScore`), and `PUT /media/:id` accepts `caption`, `description`, and `focusKeyword`.
+
+  **cms-admin**
+  - New `SplitPaneLayout` / `InspectorPane` primitives implementing the design's inline editor-pane pattern; Script Tags is converted to a split-pane view with placement tiles, priority stepper, scope tiles, consent category grid, and Load async / Disable in preview toggles.
+  - Media gains a Library / SEO Audit tab bar with summary cards, filter pills, an audit table with score bars, and an Edit flow into the library detail panel (which now edits caption, description, and focus keyword).
+  - Pages gains a List / Tree view toggle: hierarchy from `parentPageId` with path-prefix fallback, expand/collapse rows, template pills, and an "Add sub-page" action that preselects the parent (also editable via a new Parent page picker in Page settings).
+  - The Dashboard shows a getting-started onboarding block (derived 6-step checklist + quick links) in place of the activity grid while the site has no content or media.
+
+  **create-actuate-cms**
+  - Scaffolded middleware flags `?preview=` requests and the site layout resolves script tags with `preview: true` (uncached) so tags marked "disable in preview" never fire during CMS preview; Prisma assets mirror the new migration.
+
+## 0.28.4
+
+### Patch Changes
+
+- 685958f: Correct 0.x upgrade guidance: document that npm update only applies patches within the pinned minor; use `actuate upgrade` for minor bumps. Admin Updates panel and update server now show the full upgrade command chain.
+
+  Clarify scaffold README populate/script-tag and upgrade steps.
+
+## 0.28.3
+
+### Patch Changes
+
+- 1a21341: Clarify scaffold README: `actuate populate` does not seed Script Tags; use admin or a custom insert-if-missing script.
+
+## 0.28.2
+
+### Patch Changes
+
+- 6d254f3: Fix Script Tags delivery and admin toggles: green/red enabled switches with optimistic saves, in-process resolve + executable script rendering in scaffold layouts, pathname header for scoped tags, and cache invalidation on tag writes.
+
+## 0.28.1
+
+### Patch Changes
+
+- 1a3cf91: Agent-ready public forms (WebMCP): declarative tool metadata on public form schemas, zero-JS `renderPublicFormHtml` / `ActuateFormHtml`, urlencoded submit parsing, HTML confirmation responses, scaffold form prefetch, `actuate doctor` check, and docs.
+
+## 0.28.0
+
+### Minor Changes
+
+- a6360cc: Forms launch kit (Batch 7): Integrations tab with Zapier Catch Hook helper and webhook CRUD in the form schema drawer; marketing seed contact form + /contact page; ActuateForm success focus; actuate doctor forms/CRM checks; forms-and-integrations docs.
+
+## 0.27.0
+
+### Minor Changes
+
+- a59a501: Batch 6 site performance and SEO: path-scoped ISR cache tags in createNextSiteHelpers, scaffold CMS API cache wiring with onInvalidate, JSON-LD in the catch-all, font preload template, and doctor checks for API cache and structured data HTML.
+- e1ad198: Platform site-launch defaults: export `createNextSiteHelpers()` from `@actuate-media/cms-core/next/site` for ISR-friendly cached `/resolve`, scaffold new projects with production plugins and cached catch-all pages, and extend `actuate doctor` with site-launch checks (plugins, SEO routes, cached resolve, SSR sections).
+
+## 0.26.10
+
+### Patch Changes
+
+- 0a170a7: Add `@actuate-media/plugin-consent` — cookie banner with `am_cookie_consent` / `am-consent` wiring and GA4, Google Ads, and Meta Pixel loaders gated on Accept all. Scaffold with `--plugins consent` to emit layout + config wiring.
+
+## 0.26.9
+
+### Patch Changes
+
+- 330da89: Scaffold SEO defaults in `actuate.config.ts`, document the prototype-to-production launch checklist, extend the deployment guide with SEO verification steps, and add `path: '/'` plus site-settings globals to the marketing seed.
+
+## 0.26.8
+
+### Patch Changes
+
+- 3983016: Yoast-style public sitemap URLs (`/post-sitemap.xml`, `/post-sitemap2.xml`, …), human-readable XSLT browser views, and middleware rewrites so collection sitemaps resolve at the site root.
+
+## 0.26.7
+
+### Patch Changes
+
+- 4899af9: Fix consumer production builds on Next.js 16 by not injecting a no-op webpack hook in `withActuateCMS`. Add `CRON_SECRET` to scaffold `.env.example`. Remove obsolete `earlyAccess` from scaffolded `prisma.config.ts`. Load project `.env` files in `actuate doctor` and `actuate deploy:check`.
+
+## 0.26.6
+
+### Patch Changes
+
+- 2b61b66: Core Web Vitals: give the `hero` section an optional image rendered as the page LCP, and serve AVIF in scaffolded sites.
+  - **Hero image (LCP):** the canonical `hero` section now has an optional `imageUrl`/`imageAlt` field. When set, the renderer draws it below the copy as the page's single priority (eager, `fetchpriority=high`) image with a full-width `sizes` hint and intrinsic dimensions — the explicit, dimensioned LCP element the best-practice spec calls for (rather than leaving the LCP to chance). Alt text is required when an image is set (existing accessibility rule). Dimensions are backfilled by the `/resolve` enrichment (hero is now enriched like `feature`).
+  - **AVIF delivery:** `create-actuate-cms` now sets `images.formats: ['image/avif', 'image/webp']` so scaffolded sites serve AVIF (≈50% smaller than JPEG) first, then WebP — a direct LCP win via `next/image` format negotiation.
+
+## 0.26.5
+
+### Patch Changes
+
+- 7b7f0be: Core Web Vitals: get intrinsic image dimensions onto every image so `next/image` engages and CLS is eliminated.
+
+  Without `width`/`height`, consumers silently fall back to an unsized `<img>` (no srcset, layout shift). This closes that gap two ways:
+  - **Read-time (`/resolve`) enrichment** now covers the **post featured image** and **`hero` section images** (previously only `feature`/`gallery`). The resolver looks up dimensions + alt from `actuate_media` and returns the featured image as `post.featuredImage = { url, width, height, alt }` (new `ResolveFeaturedImage` type). Exposes a `featuredImageUrl()` helper. Purely additive — the stored document is never mutated.
+  - **Author-time persistence**: selecting an image in the section editor's media picker now writes the intrinsic `width`/`height` alongside the URL (`imageUrl` → `imageWidth`/`imageHeight`; gallery `url` → `width`/`height`), so dimensions travel with the document even without `/resolve`. Exposes `companionDimensionKeys()`.
+
+  `create-actuate-cms` + `apps/dev`: the generated post page now feeds the resolved featured-image dimensions into the post header for a CLS-free, dimensioned LCP image.
+
+## 0.26.4
+
+### Patch Changes
+
+- 8a64a6e: Core Web Vitals: enforce the single-priority-image (LCP) policy and ship responsive `sizes` by default.
+
+  The section renderer now guarantees the key LCP/CLS image rules automatically, so an editor (or AI author) can't ship a slow page:
+  - **One priority image per page.** A new `LcpController` (exported `createLcpController`) grants the eager, `fetchpriority="high"` slot to the first image on the page; every other image lazy-loads. This replaces `PostHeader`'s hard-coded `priority` (which could collide with a section image). Pass one shared controller via `options.lcp` to both `PostHeader` and `Sections` to share the budget.
+  - **Responsive `sizes` everywhere.** Built-in renderers emit contextual `sizes` (full-width header, half-width feature, column-aware gallery via the exported `gallerySizes`) so mobile stops over-downloading the desktop image. `defaultRenderImage` now forwards `sizes` and sets `fetchPriority`.
+  - **No raw `<img>`.** The author-bio avatar now renders through `renderImage` (dimensioned, lazy) like every other image.
+  - `PostContext` gains `featuredImageWidth`/`featuredImageHeight` so the post header featured image can be dimensioned (CLS).
+
+  `create-actuate-cms`: the generated catch-all creates a per-request shared `LcpController` for the post header + body and forwards `sizes`/`fetchPriority` in its `next/image` fallback.
+
+  Note: `ResolvedRenderOptions` now includes a required `lcp` field — only affects code that constructs that internal type directly; consumers passing `RenderOptions` are unaffected (`lcp` is optional there).
+
+## 0.26.3
+
+### Patch Changes
+
+- 108a043: Make the uploaded favicon actually drive the browser tab.
+
+  Previously the admin tab favicon only read the static `admin.branding.favicon` config value, and the `create-actuate-cms` layouts had no favicon wiring at all — so a favicon uploaded in Settings → Appearance never reached the browser tab.
+  - **cms-admin**: the admin now applies the Settings → Appearance favicon to its own browser tab at runtime — fetched on mount and re-applied live when the brand is saved (no reload). The authenticated `public/brand` read bypasses shared caches, so the live update is always fresh. The static `admin.branding.favicon` remains a fast default that the uploaded favicon overrides.
+  - **create-actuate-cms**: the generated `(site)` and `(admin)` layouts now resolve the favicon from Brand Settings via `generateMetadata` (mirroring the dev app), so uploads update the public site's `<head>` icons out of the box. Wrapped in try/catch so DB-less builds still emit valid metadata.
+
+## 0.26.2
+
+### Patch Changes
+
+- 6f140bc: Auto-wire the `platform.storage` shorthand to a real adapter server-side, and keep `actuate.config.ts` client-safe.
+
+  `actuate.config.ts` is imported by the admin client bundle, so putting a platform adapter (e.g. `platform: vercel()`) in it pulls `node:*`/`@vercel/blob` into the client build and breaks it with `Module not found: node:fs`. The config must stay adapter-free.
+  - **cms-core**: When the API handler boots and sees a remote `platform.storage` shorthand (`vercel-blob` → `@actuate-media/platform-vercel`, `s3` → `@actuate-media/platform-aws`) with no adapter registered, it now dynamically imports the matching platform package and registers its storage adapter server-side. The import specifier is computed so bundlers never try to statically resolve an optional peer; a missing package degrades to a clear guidance warning instead of a silent upload failure. An explicitly registered adapter always wins. `setStorageAdapter` / `getStorageAdapter` are now also re-exported from `@actuate-media/cms-core/api` for server-side registration of custom adapters.
+  - **cms-core**: Clearer upload/diagnostics errors — when a Vercel Blob store is linked (`BLOB_STORE_ID`) but `BLOB_READ_WRITE_TOKEN` is missing, messages now explain that Vercel does not provide the token via OIDC and it must be added per-environment.
+  - **create-actuate-cms**: The generated `actuate.config.ts` uses the client-safe `storage: { provider: 'vercel-blob' | 's3' }` shorthand again (reverting the adapter-in-config change that broke the client build); uploads work out of the box via server-side auto-wiring.
+
+## 0.26.1
+
+### Patch Changes
+
+- 1c81772: Make storage configuration honest. `platform.storage: { provider: 'vercel-blob' }` is a descriptive shorthand that never registered an adapter, so uploads silently failed with a misleading `BLOB_READ_WRITE_TOKEN` error. Now:
+  - cms-core logs a clear boot-time warning when a remote `provider` shorthand is set but no adapter is registered, and `/media/upload` (used by media + appearance uploads) returns an error that names the real gap — a missing adapter, not a missing token.
+  - `create-actuate-cms` generates `platform: vercel()` (a real adapter) instead of the inert shorthand, and the docs gain a dedicated Storage section.
+
+## 0.26.0
+
+### Minor Changes
+
+- 9f5e5dc: Add the AI crawler activity panel (llms.txt measurement layer):
+  - **`cms-core`** — new `AiCrawlerHit` model (`actuate_ai_crawler_hits`) + migration, aggregated per `(bot, surface)` so storage stays bounded. `detectAiBot()` classifies known AI user-agents (training vs retrieval) from the existing taxonomy; `llms.txt`, `llms-full.txt`, and `.md` requests from a known crawler are recorded best-effort. New `GET /ai-crawlers` (admin) returns aggregated activity, and an opt-in honeypot (`seo.llms.honeypot`) appends a trap link to `llms.txt` served by `GET /ai-crawlers/trap`.
+  - **`cms-admin`** — new "AI crawler activity" panel under SEO → Technical showing per-bot hits, type, surface, and last-seen, plus totals. Frames the numbers honestly (visibility, not a traffic channel).
+  - **`create-actuate-cms`** — scaffolded Prisma assets include the new migration so fresh projects get crawler tracking out of the box.
+
+  Recording is always best-effort and gracefully no-ops on databases that predate the model.
+
+## 0.25.0
+
+### Minor Changes
+
+- 0bcc567: Add per-page Markdown for the AI/agent layer:
+  - **`GET /md?path=…`** (`@actuate-media/cms-core`) — returns a clean Markdown rendering of a single published page via `documentToMarkdown()`. Served with `X-Robots-Tag: noindex`; noindexed and `llmsInclude: NEVER` documents return `404` (the selection filter is the privacy boundary).
+  - **Clean `/{path}.md` URLs** — `create-actuate-cms` middleware rewrites `/{path}.md` → `/api/cms/md`, so any page is fetchable as Markdown by appending `.md` (e.g. `/about.md`). The HTML page stays canonical and `.md` URLs are never in the sitemap.
+  - **Shared path resolver** — extracted `matchPathToCollection()` so `/md` and `/resolve` agree on which document a public URL maps to (no logic drift).
+
+## 0.24.0
+
+### Minor Changes
+
+- a889054: Add the advanced `llms.txt` layer — clean Markdown content export for AI agents:
+  - **`documentToMarkdown()` serializer** (`@actuate-media/cms-core`) — renders a published document to clean Markdown. Rich-text/HTML slots are converted with Turndown; structured section content (and the page-builder block tree) is walked generically using an allow-list of prose/heading keys, so non-content data (URLs, ids, settings) never leaks and new section types render without per-type code.
+  - **`/llms-full.txt`** — opt-in route (`seo.llms.fullEnabled`) serving the same curated, noindex, sitemap-excluded selection as `/llms.txt` with each page's Markdown inlined and delimited by its canonical URL. Bounded by `seo.llms.maxFullBytes` (default 2 MB) with clean truncation.
+  - **Shared selection** — `/llms.txt` and `/llms-full.txt` now share one selector (`selectLlmsDocs` / `toLlmsPage`) so curation and the noindex privacy boundary can't drift.
+  - **Scaffold** — `create-actuate-cms` proxies `/llms-full.txt` at the domain root (always generated; enabling is config-only).
+
+## 0.23.0
+
+### Minor Changes
+
+- 4bf16c4: Harden the `/llms.txt` AI discovery file:
+  - **Root proxy** — `create-actuate-cms` now scaffolds `app/llms.txt/route.ts`, exposing the file at the spec-required domain root (`/llms.txt`) in addition to `/api/cms/llms.txt`.
+  - **noindex** — the route now sends `X-Robots-Tag: noindex` (and the scaffolded proxy preserves it) so the machine-facing index isn't itself indexed.
+  - **Sanitization** — titles, descriptions, and the site summary are collapsed to a single line and stripped of markdown link-breaking and control/zero-width characters, then length-capped. Reduces corruption and instruction-smuggling risk from editor fields.
+  - **Curation controls** — new `seo.llms` config: `disabled`, `eligibleCollections` (restrict AUTO selection to high-value types), `maxPerSection` (default 25), and `maxEntries` (default 50) so large archives can't flood the file.
+
+## 0.22.0
+
+### Minor Changes
+
+- 3f7fbf3: Add RSS 2.0 (`/feed.xml`) and JSON Feed 1.1 (`/feed.json`) content feeds.
+
+  Both serve the newest published items across post-type collections (falling back
+  to pages when there are no post collections), newest first, capped at 50, with
+  canonical URLs and per-document `noindex` exclusion. Item descriptions prefer the
+  GEO key takeaway, then the meta description, then the excerpt. Pure builders are
+  exported as `buildRssFeed` / `buildJsonFeed`. New `create-actuate-cms` projects
+  scaffold root `/feed.xml` + `/feed.json` proxy routes.
+
+### Patch Changes
+
+- df5d0de: SEO sitemap hardening: canonical URLs, noindex exclusion, accurate lastmod, hreflang, and IndexNow.
+
+  **cms-core**
+  - Sitemaps and the canonical `<link>` / `og:url` now resolve through a single shared `resolveDocumentUrl()` helper, so they can never disagree. It honours an explicit `data.path` (e.g. `/` for the homepage, `/about/story`), maps `home`/`index` to the site root, and otherwise uses `<urlPrefix>/<slug>`. Fixes homepages being listed as `/home` and any page whose `data.path` differed from `/{slug}`.
+  - Noindexed documents (`noIndex`/`noindex`/`robotsPolicy: noindex*`, collection/site defaults, non-production guard) are now excluded from the sitemap so it never conflicts with a page's own robots meta tag.
+  - The "Include posts in sitemap" crawl setting is now honoured by sitemap generation (both the index and the per-collection sitemap, which 404s when posts are excluded).
+  - The "Index entire site" master switch is now enforced: when off, `robots.txt` emits a blanket `Disallow: /` for all crawlers, the sitemap (index + per-collection) serves empty, and publish-time search-engine/IndexNow pings are suppressed. This governs the public site only — CMS admin/API protection (auth + the admin's own `noindex` meta tag + the always-present `/admin` and `/api/` disallows) is unaffected.
+  - Sitemap-index `<lastmod>` now reflects each collection's newest published change instead of "now", so crawlers can trust it.
+  - `robots.txt` and the SEO settings now advertise the canonical public `/sitemap.xml` instead of the internal `/api/cms/sitemap.xml`.
+  - hreflang `<xhtml:link rel="alternate">` annotations (incl. `x-default`) are emitted for translated documents when i18n is configured with more than one locale. No overhead for single-locale sites.
+  - IndexNow support: when `INDEXNOW_KEY` is set, changed URLs are submitted to IndexNow (Bing, Yandex, …) on publish/update/delete, and the key is served at `/api/cms/indexnow-key.txt`. New exports: `resolveDocumentUrl`, `buildIndexNowSubmission`, `INDEXNOW_ENDPOINT`.
+
+  **create-actuate-cms**
+  - Scaffolded projects ship root `app/sitemap.xml/route.ts` and `app/robots.txt/route.ts` proxy routes so the canonical `/sitemap.xml` and `/robots.txt` URLs resolve out of the box.
+
+## 0.21.0
+
+### Minor Changes
+
+- a6a17e9: Split login: serve the auth screens on their own non-obvious path while the admin app stays at `/admin`.
+  - **cms-core**: new `admin.loginPath` config. `createCMSMiddleware` applies the same guards (IP allowlist, CMS_SECRET check, setup bypass) to the login mount and redirects expired sessions there. Emailed password-reset and invite links point at the login mount when configured.
+  - **cms-admin**: new `LoginRoot` component mounts login (+ MFA), the first-run setup wizard, and forgot/reset-password on a separate route (e.g. `/securelogin`, with setup at `/securelogin/setup`), then hands off to the admin app after sign-in. `<AdminRoot loginPath>` makes the admin mount render a 404 lookalike for signed-out visitors instead of a login form — no redirect, so the login location is never leaked.
+  - **create-actuate-cms**: new `--login-path` flag and prompt (default `/securelogin`). New projects scaffold the split-login layout by default: login/setup at the login path, admin app at the admin path, config + proxy wired accordingly. Pass `--login-path` equal to `--admin-path` for the classic inline login.
+
+## 0.20.0
+
+### Minor Changes
+
+- 3e2daa4: Inline branded preview — see the draft through your real site without leaving the editor.
+  - cms-admin: the page and post editors gain a "Site preview" toggle in the top bar that swaps the structure canvas for an iframe of the public site rendering the draft (same signed `?preview=<token>` contract as "View on site"). Unsaved edits are persisted first, the frame reloads after every save, and the existing viewport controls size the frame.
+  - cms-core: `createSiteClient().resolveDocument(path, { previewToken })` forwards a preview token to `/resolve` so consumer routes can render drafts at their real URL.
+  - create-actuate-cms: the scaffolded catch-all route now forwards `?preview=` to the resolver and shows a draft banner, so new projects support "View on site" and inline preview out of the box.
+
+## 0.19.0
+
+### Minor Changes
+
+- 0f9c510: Editor & scaffold improvements from Upchat feedback.
+
+  **cms-admin** — Repeater rows now derive a scannable header from their values
+  ("Pro · $79/mo", "99.99% · Uptime") instead of only the positional label
+  ("Plan 2"), so long repeaters read like a list instead of a spreadsheet. Blank
+  rows still fall back to "Plan N".
+
+  **create-actuate-cms** — The `marketing-custom` template now ships the full
+  custom-section experience out of the box:
+  - `src/sections/admin-renderers.tsx` is scaffolded and pre-wired into
+    `<AdminRoot sectionRenderers={...}>`, so the editor canvas renders real
+    components for custom section types instead of structural placeholders.
+  - A pre-filled `actuate.seed.json` ("Marketing homepage" with hero, stats,
+    pricing, and CTA sections) loads via `npm run populate`, so the first visit
+    to the Page editor shows a fully-authored page instead of an empty canvas.
+  - `SECTIONS.md` and the project README document both workflows.
+
+## 0.18.0
+
+### Minor Changes
+
+- 0c3a6eb: Posts UX improvements from external-consumer feedback:
+  - New `admin.excludeFromPostsAggregate: true` collection flag keeps a post-shaped collection out of the admin's aggregate Posts area (cross-collection list, type tabs, New Post picker) while leaving its own admin list and API routes fully accessible. Enforced server-side in `GET /posts` and mirrored in the admin client.
+  - `blogPostCollection()` now satisfies the admin Post Editor's full field contract out of the box: it gains `sections` (json), `category`, and `publishDate` (replacing `publishedDate` — update seeds/queries that referenced the old key), and `body` is no longer hard-required so section-driven posts can publish.
+  - `create-actuate-cms` scaffolds now define `posts: blogPostCollection()` instead of an inline collection, so new projects always start with an editor-compatible posts schema.
+
+## 0.17.1
+
+### Patch Changes
+
+- 854152d: Developer experience improvements from external-consumer feedback:
+  - Every published package now ships its `CHANGELOG.md` in the npm tarball, and packages that were missing a `README.md` (cli, cms-admin, cms-core, import, platform-vercel, all plugins, sections-react) now have one — so release notes and usage docs are visible on npmjs.com and in `node_modules`.
+  - New client-safe form validation entry point: `@actuate-media/cms-core/forms/client` exports `validateFormFieldClient()`, `validateFormValuesClient()`, visibility/conditional helpers, and the exact `FORM_EMAIL_RE` / `FORM_PHONE_RE` regexes the server enforces — zero Node dependencies, so public-site forms can mirror server rules without reimplementing them. The server validator now imports the same primitives, so client and server can never drift.
+
+## 0.17.0
+
+### Minor Changes
+
+- 72a4fe9: Prisma Postgres is now the default (and recommended) database for scaffolded projects. `create-actuate-cms` adds a `prisma-postgres` database choice with matching `.env.example` connection strings and deployment-guide copy; Neon and Supabase remain available as explicit choices. Internal docs, deployment rules, and code comments no longer describe this repository's own deployment as Neon — it runs on Prisma Postgres. Benchmark policy messages now suggest a dedicated Prisma Postgres database for isolated runs.
+
+## 0.16.0
+
+### Minor Changes
+
+- 8e73cf5: Add a `--template marketing-custom` starter (and interactive prompt) that scaffolds custom section types end to end: a `src/sections/types.ts` schema wired into `actuate.config.ts` (`sections.types`), public renderers in `src/sections/register.tsx`, a typed `src/blocks/` component source tree, a `verify:sections` static check, `blocks:extract`/`blocks:diff` scripts for the component-blocks manifest, and a `SECTIONS.md` guide.
+
+  The default `pages` collection now ships with an explicit `path` field via the `pagePathField()` preset.
+
+## 0.15.0
+
+### Minor Changes
+
+- 74662c0: Next.js 16 scaffold fixes and polish.
+  - Generate `proxy.ts` (exporting a `proxy` function) instead of `middleware.ts`, matching the Next.js 16 convention.
+  - Fix an over-escaped template literal in the generated `app/(site)/layout.tsx` `fetch` call that produced invalid syntax, and add `metadataBase` to the site metadata.
+  - Guard the public catch-all route with `isAdminPath()` so requests under the admin base are never resolved as CMS content.
+  - Add `@actuate-media/component-blocks` to the default dependencies.
+  - New integration tests assert the generated `proxy.ts`, template literal, `metadataBase`, admin guard, and dependency, and TypeScript-parse the key generated files.
+
+## 0.14.0
+
+### Minor Changes
+
+- 13906f6: Scaffold a Renovate preset for the code plane (ADR 0003 §2). New projects ship a `renovate.json` that groups every `@actuate-media/*` upgrade into a single scheduled PR, **auto-merges non-major bumps once CI passes** (leaning on the migration gate added in the previous release), and labels major bumps `breaking-change` for manual review. Uses current `matchPackageNames` glob syntax. `DEPLOYMENT.md` documents enabling Renovate and the branch-protection rule that makes CI-gated auto-merge effective. "Patch the fleet" becomes merging each repo's grouped, independently CI-gated PR — no bespoke orchestrator.
+
+## 0.13.0
+
+### Minor Changes
+
+- e2d8d71: Scaffold a provider-agnostic CI migration gate (ADR 0003). New projects ship a `.github/workflows/ci.yml` that, on every pull request, stands up a throwaway Postgres service container and runs `prisma migrate deploy` against it — so a broken or out-of-order migration fails in review instead of breaking the production Vercel build. It needs no secrets and works regardless of where production runs (Prisma Postgres, Neon, Supabase, or self-hosted); `migrate deploy` reads `DIRECT_DATABASE_URL` per the generated `prisma.config.ts`. `DEPLOYMENT.md` documents the gate.
+
+## 0.12.0
+
+### Minor Changes
+
+- 127f91a: Generate a VS Code MCP config (`.vscode/mcp.json`) alongside the existing
+  Cursor/Claude `.cursor/mcp.json`, using VS Code's `servers` + `type: "stdio"`
+  schema. Both files ship a placeholder API key and are git-ignored, so a freshly
+  scaffolded project wires up an AI agent in either editor after a single
+  key-paste. The post-scaffold instructions now cover both editors.
+
+## 0.11.0
+
+### Minor Changes
+
+- 31224ae: WS-E (E4 follow-up): seed demo navigation menus and render a footer nav so
+  navigation works end-to-end on a fresh scaffold.
+  - **cli:** `actuate seed --demo` now seeds two `navigations` documents — a
+    `main` menu (location `header`, linking Home/About/Contact) and a `footer`
+    menu (location `footer`, linking Privacy/Terms) — so the shipped `<SiteNav>`
+    renders real links out of the box instead of an empty header. Items point at
+    the demo pages by public URL.
+  - **create-actuate-cms:** the generated site layout now also fetches the
+    `footer` menu and renders it in a semantic `<footer>` (with a copyright line),
+    alongside the existing header nav. The body is a flex column so the footer
+    sits at the bottom. Both navs still degrade gracefully when no menu exists.
+
+## 0.10.0
+
+### Minor Changes
+
+- 204da7a: WS-E (E3): media resolution + responsive images in the public render path.
+  - **sections-react:** new pluggable `renderImage` `RenderOptions` hook (with
+    exported `RenderImage`/`RenderImageProps` types and a `defaultRenderImage`).
+    The default emits a lazy, `decoding="async"` `<img>` and forwards intrinsic
+    `width`/`height` when known; a Next.js consumer can pass a `next/image`-backed
+    renderer for responsive `srcset` + optimization. The `feature`, `gallery`, and
+    post-header images now route through it (`<PostHeader>` gains an optional
+    `options` prop). The package stays React-only — no `next` dependency.
+  - **cms-core:** the `/resolve` endpoint now enriches section images with
+    intrinsic `width`/`height` and library `altText`, matched from `actuate_media`
+    by stored URL (`storageKey`/`publicUrl`). Additive and best-effort — the
+    stored document is never mutated and a lookup failure never breaks resolve.
+    `feature` sections gain `imageWidth`/`imageHeight` (+ backfilled `imageAlt`);
+    `gallery` rows gain `width`/`height` (+ backfilled `alt`).
+  - **create-actuate-cms:** the generated catch-all page renders CMS images via a
+    `next/image`-backed `renderImage` (falling back to a fluid `<img>` when the
+    CMS doesn't know dimensions), and `next.config` now allow-lists the storage
+    host under `images.remotePatterns` so optimization works out of the box.
+
+- e2e0bd7: WS-E (E4): public navigation endpoint + navigation rendering in the scaffold.
+  - **cms-core:** new unauthenticated `GET /api/cms/public/navigations/:slug` that
+    returns a clean `{ name, slug, location, items }` tree. Like globals it is site
+    chrome — not status-gated — and safe when the navigation plugin isn't installed
+    (no match → 404). A shared, pure `coercePublicNavItems` helper sanitizes the
+    open `data.items` JSON: drops unlabeled nodes, strips internal `id`s, caps
+    recursion depth, and only passes through `_blank`/`_self` targets. Both
+    `createSiteClient` and `createServerSiteClient` gain `getNavigation(slug)`
+    returning `PublicNavigation | null`, and `PublicNavigation` / `PublicNavItem`
+    are now exported types.
+  - **sections-react:** new presentational `<SiteNav>` — an accessible `<nav>`
+    landmark whose submenus use native `<details>`/`<summary>` disclosure
+    (keyboard-operable, no client JS). New-tab links get
+    `rel="noopener noreferrer"`; an empty menu renders nothing. Exports `SiteNav`
+    plus `SiteNavProps`/`SiteNavItem`.
+  - **create-actuate-cms:** `lib/cms.ts` re-exports `getNavigation`, and the
+    generated site layout fetches the `main` menu and renders a header with the
+    site name + `<SiteNav>`, degrading gracefully to just the name when no menu
+    exists yet.
+
+- a413616: Scaffold a ready-to-use MCP config and connect-an-agent onboarding (WS-C C5).
+
+  New projects now ship a `.cursor/mcp.json` wiring the Actuate MCP server (`npx -y @actuate-media/mcp-server`) with a placeholder `ACTUATE_API_KEY`. The file is added to `.gitignore` so a real key pasted in is never committed, and the post-setup output explains the "create API key → paste into `.cursor/mcp.json` → restart Cursor/Claude" flow. The MCP guide is also published into the docs-site nav (`apps/docs/content/mcp.md`).
+
+- 6927e4b: Non-interactive scaffolding + env wiring fixes (WS-D D1/D4).
+  - **Non-interactive mode (D1):** `create-actuate-cms` now accepts `--yes`,
+    `--admin-path`, `--plugins` (comma list, `all`, or `none`), `--platform`,
+    `--database`, and `--auth` flags. With `--yes` (or no TTY, e.g. CI/agents) it
+    scaffolds headlessly from flags + defaults instead of hanging on a prompt.
+    Provided flags also skip their prompt in interactive mode. Invalid values fail
+    fast with an actionable error listing the allowed choices.
+  - **OAuth env names (D4):** the generated `.env.example` now emits
+    `OAUTH_GOOGLE_CLIENT_ID` / `OAUTH_GOOGLE_CLIENT_SECRET` (and the GitHub/
+    Microsoft equivalents) to match what `cms-core` actually reads at runtime. The
+    bare `GOOGLE_CLIENT_ID` names (which the server ignored) and the unused
+    `MICROSOFT_TENANT_ID` are removed.
+  - **Vercel Blob dependency (D4):** Vercel projects now get `@vercel/blob` as a
+    direct dependency. The generated config wires `storage.provider: 'vercel-blob'`,
+    but `@vercel/blob` was only an optional peer of `platform-vercel` — so the
+    first media upload previously failed with a missing-module error.
+  - **Commerce webhook path (D4):** the scaffolded Stripe `webhookEndpoint` now
+    points at `/api/cms/stripe/webhook` (the mounted CMS API) instead of the
+    non-existent `/api/actuate/stripe/webhook`.
+
+## 0.9.0
+
+### Minor Changes
+
+- 9ba332c: Converge the scaffolder onto the canonical page-content contract (ADR 0001, WS-A4).
+  - **create-actuate-cms**: New projects now use the canonical `sections` (JSON `PageSection[]`) field for both `pages` and `posts`, and the generated public catch-all renders `data.sections` with `<Sections>` from `@actuate-media/sections-react` — passing cms-core's allow-list `sanitizeHtml` so author HTML (e.g. the article-body section) is sanitized before the DOM, and rendering a `<PostHeader>` for post-type documents. The deprecated Model C path is retired: the `content[]`/`BLOCK_MAP` `BlockRenderer`, `HeroBlock`, `CTABlock`, `TextBlock`, `ImageTextBlock`, `SiteHeader`, and `SiteFooter` generators (and the `blocks`-gated `layout`/headers/footers config) are removed. Generated apps now depend on `@actuate-media/sections-react` and emit the matching Tailwind `@source` directive.
+  - **@actuate-media/cms-core**: `ResolveResult` (the typed `createSiteClient().resolveDocument()` return) now exposes the optional `meta`, `metadata`, `jsonLd`, `jsonLdHtml`, `template`, `post`, and `preview` fields the `/resolve` endpoint already returns, plus the new `ResolvePostAuthor`, `ResolveRelatedPost`, `ResolvePostContext`, and `ResolvePreview` types — so consumers can render the full post experience (header, author, related posts, SEO metadata) without re-declaring the shape.
+
+## 0.8.2
+
+### Patch Changes
+
+- ae1af8f: Authoring correctness fixes for the AI site-building workflow (roadmap WS-B/E quick wins).
+  - **cms-core**: `createDocument` now honors a requested `status` (`DRAFT` or
+    `PUBLISHED`) instead of always forcing `DRAFT`. Publishing on create is gated
+    to EDITOR/ADMIN, stamps `publishedAt`, and emits the `document.published`
+    webhook + sitemap notify. This fixes `POST /page-builder/create?publish=true`
+    (and `status: 'PUBLISHED'`), which previously created a draft silently.
+    Statuses other than `DRAFT`/`PUBLISHED` on create are rejected with guidance
+    to schedule/archive via update.
+  - **client**: `listMedia()` now returns the canonical
+    `{ docs, total, page, pageSize, totalPages }` (`MediaList`) envelope. The
+    server returns the asset array under `items`/`data` (never `docs`), so the
+    previous typing made `listMedia().docs` always `undefined`. Adds exported
+    `MediaAsset` and `MediaList` types and an optional `init` (signal/cache) arg.
+  - **mcp-server**: the `list_media` tool now normalizes the same `items`→`docs`
+    shape so its output matches `list_documents`.
+  - **create-actuate-cms**: generated `TextBlock`/`ImageTextBlock` now sanitize
+    author-supplied HTML with `sanitizeHtml` before `dangerouslySetInnerHTML`
+    (was an XSS vector on hostile content).
+
+## 0.8.1
+
+### Patch Changes
+
+- 951963a: Build the Settings > Users access-control system: real invites, roles, seats, and access review.
+
+  **@actuate-media/cms-core**
+  - Schema: add `OWNER` and `VIEWER` to the `UserRole` enum, a new `InviteStatus` enum, a new `Invite` model (`actuate_invites`), and additive user-lifecycle columns (`suspendedAt`, `lockedAt`, `forcePasswordReset`, `mfaRequired`, `failedLoginCount`, `lastActiveAt`, `invitedById`, `acceptedInviteAt`). Two hand-authored migrations (`0011_user_roles_owner_viewer`, `0012_invites_and_user_lifecycle`) — enum values are added in their own migration so Postgres can use them as defaults afterward. All user columns are nullable/defaulted so existing rows migrate cleanly.
+  - Add a `roles` module (also exported as the `@actuate-media/cms-core/roles` subpath): display mapping (`OWNER/ADMIN/EDITOR/VIEWER` plus legacy `AUTHOR→Editor`, `CLIENT→Viewer`), assignable roles, privilege ranking, and per-role permission derivation.
+  - Add an `Invite` lifecycle service (`createInvite`, `listInvites`, `resendInvite`, `cancelInvite`, `updateInviteRole`, `extendInvite`, `expireStaleInvites`, `markInviteAcceptedForEmail`). Invite tokens are hashed at rest, single-use, and expire (7/14/30 days). Completing the password-reset flow for an invited email now marks the invite `ACCEPTED` atomically.
+  - Add a `team` module (`listTeamMembers`, `getUserStats`, `computeAccessReview`) that derives seat usage and access-review recommendations (inactive 90d+, external domain, admin/owner without MFA, stale invite) from real user/security signals.
+  - New admin endpoints: enriched `GET /users` (search/role/status filters), `GET /users/stats`, `PATCH /users/:id/role`, hardened `DELETE /users/:id` (revoke = suspend, last-Owner protection), `GET /invites` + `POST /invites/:id/resend|cancel` + `PATCH /invites/:id`, and `GET /access-review` + `POST /access-review/:id/dismiss`. Role assignment/removal of Owner is Owner-only, self-escalation is blocked, role downgrades revoke sessions, and seat limits are enforced. All sensitive actions are audit-logged.
+
+  **@actuate-media/cms-admin**
+  - Rebuild the Settings > Users tab to match the design: dynamic summary cards (members, pending invites, admins, seats used), an actionable access-review banner, a combined team table (active members + pending invites) with role-filter pills and search, per-row role dropdowns and revoke/resend/cancel actions, and an invite modal with role radio cards and advanced options (custom message, expiry). Includes loading, empty, filtered-empty, and error states; destructive and Owner-assignment actions require confirmation.
+
+  **create-actuate-cms**
+  - Sync the scaffold's Prisma schema and migrations with the new Users-management schema so newly created projects start with the `Invite` model, new roles, and user-lifecycle columns.
+
+## 0.8.0
+
+### Minor Changes
+
+- f043e18: Fix day-one auth dead-ends and wire up transactional email + user invites.
+
+  **@actuate-media/cms-core**
+  - Add a transactional email sender registry (`setEmailSender`, `getRegisteredEmailSender`, `resolveEmailSender`). Password-reset and form-notification email now resolve a sender via this registry, so apps that configure email purely through `emailPlugin()` actually send (previously only `config.platform.email` was consulted, so reset/notification mail silently never sent).
+  - Password reset links are now built from the configured admin path instead of a hardcoded `/admin`, so resets work on apps mounted elsewhere.
+  - Add an admin-only `POST /users/invite` endpoint plus `createUserInvite` / `normalizeInviteRole` / `VALID_INVITE_ROLES`. Invites provision the user with an unusable password and a single-use, 7-day token, then email a "set your password" link (reusing the existing `/reset-password` page). When no email sender is configured the response returns the link so an admin can share it manually. Rate-limited per admin.
+
+  **@actuate-media/cms-admin**
+  - `AdminRoot` gains an `onLogout` prop. The account-menu "Logout" item now revokes the server session (`POST /auth/logout`), clears local session state, and returns to the login screen — previously it navigated to a non-existent `/logout` route (404) and left the session valid.
+  - The "Invite User" dialog is now a real flow backed by `POST /users/invite` (loading state, error handling, valid roles, optional name) instead of a fake success toast.
+
+  **create-actuate-cms**
+  - The scaffolded admin page now wires `onVerifyTotp` (so MFA users can complete the second-factor step) and `onLogout`, matching the dev app.
+
+  **@actuate-media/plugin-email**
+  - `emailPlugin()` now registers its resolved provider with cms-core's email sender registry, so configuring email via the plugin is sufficient for password-reset, invite, and form-notification email.
+
+- 456e5f2: Fix client onboarding so a freshly scaffolded project actually has a working database.
+
+  **create-actuate-cms**
+  - Scaffolded projects now ship the canonical Prisma schema (all `actuate_*` models with `@@map`) and the full migration history, synced from `@actuate-media/cms-core` via `scripts/sync-prisma-assets.ts` and guarded by a drift test. Previously the scaffolder hand-maintained a divergent schema (14 of 33 models, no `@@map`) and shipped no migrations, so `prisma migrate deploy` in the build created no tables and core features (full-text search, i18n, API metrics, API keys, webhooks, notifications, etc.) were broken.
+  - The generated `prisma.config.ts` now warns when migrations would run against the pooled `DATABASE_URL` because `DIRECT_DATABASE_URL` is unset.
+  - The generated admin page now shows an actionable "run migrations" / backend-unreachable message instead of silently dropping to the login screen when the database has no tables or `/setup/status` fails.
+  - Next-steps + deployment docs now use `prisma migrate deploy` (applies the bundled migrations).
+
+  **@actuate-media/cms-core**
+  - `checkSetupRequired` now reports `migrationsRequired: true` (new `SetupStatus` field) when the database is reachable but the tables don't exist yet, and `POST /setup/create-admin` returns an actionable 503 in that case. New exported helper `isSchemaMissingError`.
+  - The admin middleware now returns an actionable HTML page (with remediation steps) when `CMS_SECRET` is missing, instead of a bare `500`.
+
+## 0.7.0
+
+### Minor Changes
+
+- 5fa84d3: SEO Operations Center — a full detect → prioritize → explain → route → fix → audit → generate workflow.
+
+  **cms-core**
+  - Additive `0009_seo` migration (mirrored to `apps/dev`): `SEOAuditRun`, `SEOIssue` (+ severity/status/category enums), `Redirect` extensions (`hits`, `lastHitAt`, `enabled`, `priority`, `preserveQuery`, `source`), `Redirect404Hit`, and `RedirectSuggestion`. All columns are nullable or defaulted, so it is safe to apply to an existing database.
+  - Pure, explainable scoring model (`seo/score.ts`): `calculatePageSeoScore` / `calculateSiteSeoScore` with documented weights and breakdowns.
+  - Persistent audit engine (`seo/audit-engine.ts`) with cross-run issue lifecycle (open / resolved / ignored / recurring) and a redirect engine (chain/loop detection, safe flatten, hit tracking, 404 logging, gated AI 404 recovery).
+  - New endpoints: `POST /seo/audit`, `GET /seo/audits[/:id]`, `GET /seo/issues[/:id]`, issue `resolve`/`ignore`/`reopen`/`fix`, `GET /seo/overview`, redirect CRUD + import/export + chains/loops/flatten/suggest, technical settings (`/seo/sitemap/*`, `/seo/crawl-settings`, `/seo/robots`), and approval-gated `/ai/seo/*` (generate-field, explain-issue, generate-schema, summarize) that degrade gracefully with 501 when `plugin-ai` is unconfigured.
+  - `/resolve` now returns Next.js-ready `metadata` plus validated JSON-LD; public `robots.txt` honors the admin-edited body.
+
+  **cms-admin**
+  - Rebuilt `SEO.tsx` into a five-tab Operations Center (Overview / Content / Technical / Redirects / Audit) with `?tab=` deep-link routing, dynamic badge counts, a typed `seo-service.ts` client, reusable token-only primitives and a focus-trapped drawer, editor/fix/copilot drawers, and full loading / empty / error / permission states.
+
+  **mcp-server**
+  - New SEO tools: `seo_overview`, `run_seo_audit`, `list_seo_audit_runs`, `list_seo_issues`, `get_seo_issue`, `set_seo_issue_status`, `list_redirect_rules`, `seo_redirect_overview`, `seo_redirect_chains`.
+
+  **create-actuate-cms**
+  - Scaffolded projects now ship a redirect-resolving `middleware.ts` backed by the database redirect table.
+
+## 0.6.4
+
+### Patch Changes
+
+- c8f1022: Update scaffolded `.env.example` and deploy README to reflect the email + rate-limit changes:
+  - Email section now documents `EMAIL_PROVIDER` (resend/ses/smtpcom/smtp), `EMAIL_FROM`, and the generic SMTP vars (`SMTP_HOST`/`SMTP_PORT`/`SMTP_SECURE`/`SMTP_USER`/`SMTP_PASS`, requires `nodemailer`).
+  - Rate-limit guidance now notes that the Vercel Marketplace Upstash integration provisions `KV_REST_API_URL` / `KV_REST_API_TOKEN` (read automatically), correcting the previous claim that it provisions `UPSTASH_REDIS_REST_URL` / `UPSTASH_REDIS_REST_TOKEN`.
+
+## 0.6.3
+
+### Patch Changes
+
+- 560d1de: Dashboard redesign + real-data backends.
+
+  `@actuate-media/cms-admin`:
+  - Sidebar now uses explicit Content and Settings group headers with nested
+    Pages children (Saved Sections, Templates). The collapse control moved
+    to the sidebar footer.
+  - Header hoists primary page actions (e.g. "+ New Post", "View Site")
+    into the top utility bar so the page hero is no longer the source of
+    truth for those affordances. The notification bell is wired to the
+    real `NotificationBell` component.
+  - Dashboard greeting picks the user's first name, and the "Delivery API"
+    - "Content Health" cards now read live data from new endpoints.
+
+  `@actuate-media/cms-core`:
+  - New `ApiRequestMetric` table (minute-bucketed counter + log-scale
+    latency histogram) and `recordApiRequest` instrumentation wired into
+    `handler-factory.ts`. Writes are fire-and-forget — request paths are
+    never blocked on the metric DB.
+  - New `ContentIssue` table + nightly `processContentHealthScan` cron
+    (`/api/cms/cron/content-health`) that runs a pure-logic scanner for
+    missing meta descriptions, missing alt text, outdated content
+    (>90 days), and broken internal links via HEAD probes.
+  - New endpoints `GET /api/cms/stats/api-delivery` and
+    `GET /api/cms/stats/content-health` return the dashboard's
+    aggregates with stable, never-undefined response shapes.
+  - Migration `0007_dashboard_metrics` adds both tables with the indexes
+    the new queries need. Safe to apply to populated DBs (no backfill).
+
+  `create-actuate-cms`:
+  - Scaffolded `vercel.json` now includes the nightly content-health
+    cron entry, and the deployment guide documents it.
+
+## 0.6.2
+
+### Patch Changes
+
+- e2fabee: Add AI-friendly deployment diagnostics, align generated schemas with first-run admin features, and harden setup guidance for design-first deployments.
+
+## 0.6.1
+
+### Patch Changes
+
+- b224105: Fix post-release developer experience regressions in public site globals, scaffolded Prisma wiring, and seed/populate database initialization.
+
+## 0.6.0
+
+### Minor Changes
+
+- 266b657: Add first-class public site helpers, CLI init/populate workflows, and generated frontend boilerplate for globals, document resolution, and media normalization.
+
+## 0.5.1
+
+### Patch Changes
+
+- b5de8dd: Fix ESM module resolution and dependency duplication issues reported during consumer integration.
+  - Add "default" export condition to all platform and plugin packages so they resolve correctly from require() contexts (fixes ERR_PACKAGE_PATH_NOT_EXPORTED in next.config.ts and serverless functions).
+  - Move @actuate-media/cms-core from direct dependencies to peerDependencies across all packages to prevent duplicate installations when consumer version ranges don't exactly match the pinned version.
+  - Add "prepack" lifecycle script to create-actuate-cms to guarantee dist/ is built before npm publishes the package (fixes empty dist/ in v0.4.0).
+
+## 0.5.0
+
+### Minor Changes
+
+- 54c7a3b: Add Script Tags management system for injecting tracking codes, analytics, and custom scripts into public site pages. Admins create tags with HTML/JS code, choose placement (head, body open, body close), set scope (entire site, parent pages + descendants, or exact URLs), and assign priority order. Includes new ScriptTag database model, CRUD + public resolve API endpoints, admin list and editor views, and updated scaffolder site layout with automatic tag rendering.
+
+## 0.4.0
+
+### Minor Changes
+
+- 140b05c: Resolve package versions from npm registry at scaffold time instead of hardcoding ^0.1.0, which under pre-1.0 semver rules prevented consumers from receiving updates beyond 0.1.x. Falls back gracefully if npm is unreachable. Also fixes CLI --version to read from package.json instead of a stale hardcoded string.
+
+## 0.3.0
+
+### Minor Changes
+
+- 80aa939: Add scaffold site rendering layer with catch-all route, block components, layout components, and critical config wiring fixes.
+  - Fix API route template to pass config to handleActuateAPI (enables /resolve and layout regions)
+  - Fix admin page template to pass real config to AdminRoot (enables layout sidebar and blocks field)
+  - Fix /resolve endpoint to handle root path (/) by looking up "home" or "index" slug
+  - Add blocks-first page fields, header/footer collections, and layout config to scaffold (conditional on blocks plugin)
+  - Generate catch-all page route with dynamic SEO metadata and first-boot welcome page
+  - Generate BlockRenderer, HeroBlock, CTABlock, TextBlock, ImageTextBlock components
+  - Generate SiteHeader and SiteFooter layout components with graceful fallbacks
+
+## 0.2.0
+
+### Minor Changes
+
+- 4e3a5eb: RC2-RC4 and hardening release.
+
+  **cms-core:**
+  - Replace isomorphic-dompurify with sanitize-html (eliminates Vercel ESM crash)
+  - Remove cms-core from serverExternalPackages, move to transpilePackages
+  - Add GET /api/cms/health endpoint with model probing and diagnostics
+  - Harden db() Proxy with try/catch on property access and rawDb()
+  - Harden safeCount/safeFindMany against Proxy throws
+  - Add startup validation for missing CMS_SECRET (503 instead of 500)
+  - Bypass auth on /stats when secret is missing (returns zero-data)
+  - Loosen NextConfigLike types (experimental/images/webpack as unknown)
+  - Implement login anomaly detection (new IP, brute force, unusual hours)
+  - Implement webhook DNS resolution with private range checking
+  - Implement TOTP reauth verification
+  - Add Zod validation for secret in defineConfig (min 32 chars)
+  - Read CMS_CORE_VERSION from package.json at runtime instead of hardcoding '0.1.0'
+
+  **cms-admin:**
+  - Ship pre-compiled CSS (dist/actuate-admin.css) with all 48 responsive classes
+  - New export: @actuate-media/cms-admin/styles/precompiled.css
+  - Add CSS containment (`contain: layout style`) on .actuate-admin
+  - Fix ShortcutHelp modal using React state instead of DOM manipulation
+  - Add fixed-position layout isolation wrapper to AdminRoot
+  - Add useApiData retry limits (maxRetries=3) with exponential backoff
+  - Dashboard shows health-aware "Database Setup Required" banner
+
+  **cli:**
+  - Add `actuate db:init` command (injects CMS models into Prisma schema)
+  - Add `actuate db:status` command (checks model presence and DB connectivity)
+
+  **create-actuate-cms:**
+  - Embed full CMS schema (9 models + enum) in generated schema.prisma
+  - Add @actuate-media/cli to scaffolded devDependencies
+  - Use pre-compiled CSS import in scaffolded admin layout