create-prenta 1.3.0

package/dist/scaffold.js

@@ -0,0 +1,2163 @@
+import { cp, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import chalk from 'chalk';
+import ora from 'ora';
+import { generatePrentaConfig } from './templates/prenta.config.ts.template.js';
+import { generateAdminPage } from './templates/admin-page.ts.template.js';
+import { generateLoginPage } from './templates/login-page.ts.template.js';
+import { MARKETING_CUSTOM_GITIGNORE, MARKETING_CUSTOM_SCRIPTS, isMarketingCustom, marketingCustomFiles, workspaceSectionKitFiles, } from './templates/marketing-custom.js';
+import { astroSiteFiles, isAstroSiteOnly, isAstroSplit } from './templates/astro-site.js';
+/**
+ * Canonical Prisma schema + migrations bundled with this package, synced from
+ * `@prenta/core` via `scripts/sync-prisma-assets.ts`. Resolves the
+ * same whether running from `src/` (tests/tsx) or `dist/` (published) since both
+ * sit one level below the package root next to `assets/`.
+ */
+const PRISMA_ASSETS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'assets', 'prisma');
+const PRENTA_PACKAGES = [
+    '@prenta/core',
+    '@prenta/admin',
+    '@prenta/component-blocks',
+    '@prenta/sections-react',
+    '@prenta/cli',
+    '@prenta/platform-vercel',
+    '@prenta/platform-aws',
+    '@prenta/plugin-seo',
+    '@prenta/plugin-blocks',
+    '@prenta/plugin-forms',
+    '@prenta/plugin-email',
+    '@prenta/plugin-media',
+    '@prenta/plugin-redirects',
+    '@prenta/plugin-navigation',
+    '@prenta/plugin-commerce',
+    '@prenta/plugin-ai',
+];
+async function fetchLatestVersion(pkg) {
+    try {
+        const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        return data.version ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+async function resolvePackageVersions() {
+    const results = await Promise.allSettled(PRENTA_PACKAGES.map(async (pkg) => {
+        const version = await fetchLatestVersion(pkg);
+        return [pkg, version];
+    }));
+    const versions = {};
+    for (const result of results) {
+        if (result.status === 'fulfilled') {
+            const [pkg, version] = result.value;
+            if (version) {
+                versions[pkg] = `^${version}`;
+            }
+        }
+    }
+    return versions;
+}
+function versionFor(versions, pkg) {
+    return versions[pkg] ?? '^0.1.0';
+}
+function generateGlobalsCss() {
+    return `@import "tailwindcss";
+
+/*
+ * The public section renderer (@prenta/sections-react) ships its own
+ * Tailwind utility classes outside this app's default content roots. Scan the
+ * built package so those classes are generated. See ADR 0001 / WS-A4.
+ */
+@source '../../node_modules/@prenta/sections-react/dist';
+
+:root {
+  --font-sans: system-ui, -apple-system, sans-serif;
+}
+
+/*
+ * Custom fonts — uncomment after adding licensed woff2 files to public/fonts/.
+ *
+ * @font-face {
+ *   font-family: 'Site Display';
+ *   src: url('/fonts/display.woff2') format('woff2');
+ *   font-weight: 600 700;
+ *   font-display: swap;
+ * }
+ * @font-face {
+ *   font-family: 'Site Body';
+ *   src: url('/fonts/body.woff2') format('woff2');
+ *   font-weight: 400 500;
+ *   font-display: swap;
+ * }
+ * :root {
+ *   --font-sans: 'Site Body', system-ui, sans-serif;
+ * }
+ */
+
+body {
+  font-family: var(--font-sans);
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+`;
+}
+/**
+ * `.cursor/mcp.json` — wires the Prenta MCP server into Cursor / Claude
+ * Desktop so an AI agent can author content right after setup. The API key is
+ * a clearly-fake placeholder the developer swaps for a real `act_sk_...` key
+ * minted in Admin → API Keys. The file is git-ignored (see `buildGitignore`)
+ * so a real key pasted here never gets committed. See ADR 0001 / WS-C C5.
+ */
+function generateCursorMcpJson() {
+    const config = {
+        mcpServers: {
+            prenta: {
+                command: 'npx',
+                args: ['-y', '@prenta/mcp-server'],
+                env: {
+                    PRENTA_BASE_URL: 'http://localhost:3000',
+                    PRENTA_API_KEY: 'act_sk_REPLACE_WITH_YOUR_KEY',
+                },
+            },
+        },
+    };
+    return JSON.stringify(config, null, 2) + '\n';
+}
+/**
+ * VS Code uses a different MCP config shape than Cursor: the top-level key is
+ * `servers` (not `mcpServers`) and each entry declares `type: "stdio"`. Same
+ * placeholder key as the Cursor config; the file is git-ignored so a real key
+ * pasted here is never committed.
+ */
+function generateVscodeMcpJson() {
+    const config = {
+        servers: {
+            prenta: {
+                type: 'stdio',
+                command: 'npx',
+                args: ['-y', '@prenta/mcp-server'],
+                env: {
+                    PRENTA_BASE_URL: 'http://localhost:3000',
+                    PRENTA_API_KEY: 'act_sk_REPLACE_WITH_YOUR_KEY',
+                },
+            },
+        },
+    };
+    return JSON.stringify(config, null, 2) + '\n';
+}
+/**
+ * GitHub Actions CI: a migration gate that runs on every pull request. The
+ * bundled Prenta migrations (plus any the consumer adds) must apply cleanly to
+ * a fresh Postgres, so a broken/out-of-order migration fails the PR in review
+ * instead of breaking the production Vercel build (whose build command runs
+ * `prisma migrate deploy`).
+ *
+ * Provider-agnostic by design: it stands up a throwaway Postgres service
+ * container rather than branching a specific host, so it works the same whether
+ * production runs on Prisma Postgres, Neon, Supabase, or self-hosted — and needs
+ * no secrets. `migrate deploy` reads `DIRECT_DATABASE_URL` (see prisma.config.ts).
+ *
+ * Note: `\${{ ... }}` below are GitHub Actions expressions, escaped so they
+ * survive this template literal verbatim.
+ *
+ * astro-split scaffolds are pnpm workspaces: the workflow installs with pnpm,
+ * targets `apps/cms` via a filter for the migration gate, and (marketing-custom)
+ * runs `verify:sections` so schema/renderer drift in the shared section kit
+ * fails the PR.
+ */
+function generateCiWorkflow(options) {
+    const header = `name: CI
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ci-\${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  migrations:
+    name: Prisma migrate (ephemeral Postgres)
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: prenta
+          POSTGRES_PASSWORD: prenta
+          POSTGRES_DB: prenta_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U prenta"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    env:
+      # prisma migrate deploy reads DIRECT_DATABASE_URL (see prisma.config.ts).
+      # Both point at the throwaway CI database — never a real environment.
+      DATABASE_URL: postgresql://prenta:prenta@localhost:5432/prenta_ci
+      DIRECT_DATABASE_URL: postgresql://prenta:prenta@localhost:5432/prenta_ci
+
+    steps:
+      - uses: actions/checkout@v4
+`;
+    if (isAstroSplit(options)) {
+        const verifyStep = isMarketingCustom(options)
+            ? `      # Section contract gate: every schema id in packages/sections has a
+      # renderer and vice versa (drift breaks the editor canvas or the site).
+      - name: Verify section contract
+        run: pnpm run verify:sections
+      # Canvas ↔ public fidelity: same sectionRenderers → same normalized tree.
+      - name: Section render parity
+        run: pnpm run test:parity
+`
+            : '';
+        return `${header}      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - name: Install dependencies
+        # Switch to --frozen-lockfile once pnpm-lock.yaml is committed.
+        run: pnpm install --no-frozen-lockfile
+      - name: Generate Prisma client
+        run: pnpm --filter cms exec prisma generate
+      # The gate: migrations must apply cleanly to a fresh database. A broken or
+      # out-of-order migration fails here, not at deploy time.
+      - name: Apply migrations
+        run: pnpm --filter cms exec prisma migrate deploy
+${verifyStep}`;
+    }
+    return `${header}      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Generate Prisma client
+        run: npx prisma generate
+      # The gate: migrations must apply cleanly to a fresh database. A broken or
+      # out-of-order migration fails here, not at deploy time.
+      - name: Apply migrations
+        run: npx prisma migrate deploy
+`;
+}
+/**
+ * Renovate preset (ADR 0003, code plane). Groups every `@prenta/*`
+ * upgrade into one PR, schedules it, and — crucially — only auto-merges
+ * non-major bumps, leaning on the CI migration gate (`.github/workflows/ci.yml`)
+ * to prove the new schema before merge. Major bumps (which can carry breaking
+ * schema/API changes) are never auto-merged and get labelled for review.
+ *
+ * "Patch the fleet" then = merge N Renovate PRs, each independently CI-gated —
+ * no bespoke orchestrator. Auto-merge of minor/patch only actually waits for CI
+ * when the repo has branch protection requiring the `CI` check (documented in
+ * DEPLOYMENT.md).
+ */
+function generateRenovateJson() {
+    const config = {
+        $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+        extends: ['config:recommended'],
+        labels: ['dependencies'],
+        schedule: ['before 6am on monday'],
+        prConcurrentLimit: 5,
+        packageRules: [
+            {
+                description: 'Group all Prenta CMS packages so cms-core, plugins, admin, and the CLI bump together in one CI-gated PR.',
+                matchPackageNames: ['@prenta/*'],
+                groupName: 'Prenta CMS',
+            },
+            {
+                description: 'Auto-merge non-major Prenta updates once CI passes (incl. the prisma migrate deploy gate). Requires branch protection that requires the CI check.',
+                matchPackageNames: ['@prenta/*'],
+                matchUpdateTypes: ['minor', 'patch'],
+                automerge: true,
+            },
+            {
+                description: 'Major Prenta bumps can ship breaking schema/API changes — never auto-merge; flag for manual review.',
+                matchPackageNames: ['@prenta/*'],
+                matchUpdateTypes: ['major'],
+                automerge: false,
+                addLabels: ['breaking-change'],
+            },
+        ],
+    };
+    return JSON.stringify(config, null, 2) + '\n';
+}
+function generatePostcssConfig() {
+    return `const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+};
+export default config;
+`;
+}
+function generateAdminLayoutCss() {
+    return `/* Pre-compiled Prenta CMS admin styles — includes all Tailwind utilities and theme. */
+@import "@prenta/admin/styles/precompiled.css";
+`;
+}
+function generateAdminLayout() {
+    return `import type { Metadata } from 'next';
+import './admin.css';
+
+// Resolve the browser-tab favicon from CMS Brand Settings (Settings →
+// Appearance). Wrapped in try/catch so builds without a DB connection still
+// emit valid metadata. The admin SPA also keeps the favicon live on save (no
+// reload needed). Importing the light \`appearance\` subpath avoids dragging DB
+// codegen into the layout module graph.
+export async function generateMetadata(): Promise<Metadata> {
+  const base: Metadata = { robots: 'noindex, nofollow' };
+  try {
+    const [{ resolveBrand }, { getPrisma }] = await Promise.all([
+      import('@prenta/core/appearance'),
+      import('@/lib/prisma'),
+    ]);
+    const { favicon } = await resolveBrand(getPrisma(), null);
+    if (favicon.icon) {
+      base.icons = {
+        icon: [{ url: favicon.icon, type: favicon.type ?? undefined }],
+        shortcut: [{ url: favicon.icon }],
+        apple: favicon.apple ? [{ url: favicon.apple }] : undefined,
+      };
+    }
+  } catch {
+    // Database unavailable — fall back to base metadata.
+  }
+  return base;
+}
+
+export default function AdminLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return (
+    <html lang="en" suppressHydrationWarning>
+      <body>
+        <div className="prenta-admin">
+          {children}
+        </div>
+      </body>
+    </html>
+  );
+}
+`;
+}
+function generateSiteLayout(options) {
+    const { projectName, plugins } = options;
+    const registerCustomSections = isMarketingCustom(options);
+    const hasConsent = plugins.includes('consent');
+    // The marketing-custom template registers its public section renderers via a
+    // side-effect import so <Sections> can render them on the server.
+    const registerImport = registerCustomSections ? `import '@/src/sections/register';\n` : '';
+    const consentImport = hasConsent
+        ? `import { ConsentRoot } from '@prenta/plugin-consent';\nimport { consentAnalyticsConfig, consentLinks } from '@/src/consent/config';\n`
+        : '';
+    const consentNode = hasConsent
+        ? `\n        <ConsentRoot analytics={consentAnalyticsConfig} {...consentLinks} />`
+        : '';
+    return `import type { Metadata } from 'next';
+import { headers } from 'next/headers';
+import { unstable_cache } from 'next/cache';
+import { SiteNav } from '@prenta/sections-react';
+import { ScriptTagGroup } from '@prenta/core/next/script-tags';
+import {
+  resolveScriptTagsForPath,
+  SCRIPT_TAGS_CACHE_TAG,
+} from '@prenta/core/script-tags';
+import { getNavigation } from '@/lib/cms';
+import { getPrisma } from '@/lib/prisma';
+${registerImport}${consentImport}import './globals.css';
+
+// Optional custom fonts — after adding woff2 files under public/fonts/, uncomment
+// the preload links below and the @font-face rules in globals.css.
+// See public/fonts/README.md for licensing and naming guidance.
+/*
+<link rel="preload" href="/fonts/display.woff2" as="font" type="font/woff2" crossOrigin="anonymous" />
+<link rel="preload" href="/fonts/body.woff2" as="font" type="font/woff2" crossOrigin="anonymous" />
+*/
+
+// Resolve the browser-tab favicon from CMS Brand Settings (Settings →
+// Appearance) so uploading a favicon updates the public site's <head> icons.
+// Wrapped in try/catch with a static fallback so builds without a DB still emit
+// valid base metadata. The light \`appearance\` subpath keeps DB codegen out of
+// the layout module graph.
+export async function generateMetadata(): Promise<Metadata> {
+  const base: Metadata = {
+    metadataBase: new URL(process.env.NEXT_PUBLIC_SITE_URL ?? 'http://localhost:3000'),
+    title: '${projectName}',
+    description: 'Powered by Prenta CMS',
+  };
+  try {
+    const [{ resolveBrand }, { getPrisma }] = await Promise.all([
+      import('@prenta/core/appearance'),
+      import('@/lib/prisma'),
+    ]);
+    const { favicon } = await resolveBrand(getPrisma(), null);
+    if (favicon.icon) {
+      base.icons = {
+        icon: [{ url: favicon.icon, type: favicon.type ?? undefined }],
+        shortcut: [{ url: favicon.icon }],
+        apple: favicon.apple ? [{ url: favicon.apple }] : undefined,
+      };
+    }
+  } catch {
+    // Database unavailable — fall back to base metadata.
+  }
+  return base;
+}
+
+interface ScriptTags {
+  head: string[];
+  body_open: string[];
+  body_close: string[];
+}
+
+async function getScriptTags(): Promise<ScriptTags> {
+  const headerStore = await headers();
+  const pathname =
+    headerStore.get('x-prenta-pathname') ??
+    headerStore.get('x-invoke-path') ??
+    '/';
+  const preview = headerStore.get('x-prenta-preview') === '1';
+  try {
+    // Preview requests bypass the cache: they're rare, and tags flagged
+    // "disable in preview" must be filtered per-request, not cached.
+    if (preview) {
+      return await resolveScriptTagsForPath(getPrisma(), pathname, { preview: true });
+    }
+    const resolve = unstable_cache(
+      async (path: string) => resolveScriptTagsForPath(getPrisma(), path),
+      ['script-tags'],
+      { revalidate: 60, tags: ['prenta', SCRIPT_TAGS_CACHE_TAG] },
+    );
+    return await resolve(pathname);
+  } catch {
+    return { head: [], body_open: [], body_close: [] };
+  }
+}
+
+// Load a navigation menu by slug. Returns null when the navigation plugin
+// isn't installed or no menu with that slug exists yet, so the header/footer
+// degrade gracefully.
+async function getNav(slug: string) {
+  try {
+    return await getNavigation(slug);
+  } catch {
+    return null;
+  }
+}
+
+export default async function SiteLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  const [tags, headerNav, footerNav] = await Promise.all([
+    getScriptTags(),
+    getNav('main'),
+    getNav('footer'),
+  ]);
+
+  return (
+    <html lang="en">
+      <head>
+        <ScriptTagGroup codes={tags.head} idPrefix="head" />
+      </head>
+      <body className="flex min-h-screen flex-col">
+        <ScriptTagGroup codes={tags.body_open} idPrefix="body-open" />
+        <header className="border-b border-zinc-200">
+          <div className="mx-auto flex max-w-5xl items-center justify-between px-4 py-3">
+            <a href="/" className="text-lg font-medium text-zinc-900">
+              ${projectName}
+            </a>
+            {headerNav && headerNav.items.length > 0 && <SiteNav items={headerNav.items} />}
+          </div>
+        </header>
+        <main className="flex-1">{children}</main>
+        {footerNav && footerNav.items.length > 0 && (
+          <footer className="border-t border-zinc-200">
+            <div className="mx-auto flex max-w-5xl flex-col gap-2 px-4 py-6 text-sm text-zinc-600 sm:flex-row sm:items-center sm:justify-between">
+              <span>&copy; {new Date().getFullYear()} ${projectName}</span>
+              <SiteNav items={footerNav.items} ariaLabel="Footer" />
+            </div>
+          </footer>
+        )}
+        <ScriptTagGroup codes={tags.body_close} idPrefix="body-close" />${consentNode}
+      </body>
+    </html>
+  );
+}
+`;
+}
+function generateConsentConfig() {
+    return `import type { ConsentAnalyticsConfig } from '@prenta/plugin-consent';
+
+/** Analytics IDs — injected only after the visitor accepts all cookies. */
+export const consentAnalyticsConfig: ConsentAnalyticsConfig = {
+  ga4MeasurementId: process.env.NEXT_PUBLIC_GA4_MEASUREMENT_ID,
+  googleAdsId: process.env.NEXT_PUBLIC_GOOGLE_ADS_ID,
+  metaPixelId: process.env.NEXT_PUBLIC_META_PIXEL_ID,
+};
+
+export const consentLinks = {
+  privacyUrl: '/privacy-policy',
+  termsUrl: '/terms',
+};
+`;
+}
+/**
+ * Split-login mode: the auth screens get their own mount, distinct from the
+ * admin app. When the two paths are equal the classic inline login applies.
+ */
+export function isSplitLogin(options) {
+    return options.loginPath !== options.adminPath;
+}
+/** Package names for CLI plugin slugs — exported for scaffold / CLI consistency tests. */
+export const PLUGIN_PACKAGES = {
+    seo: '@prenta/plugin-seo',
+    blocks: '@prenta/plugin-blocks',
+    forms: '@prenta/plugin-forms',
+    email: '@prenta/plugin-email',
+    media: '@prenta/plugin-media',
+    redirects: '@prenta/plugin-redirects',
+    navigation: '@prenta/plugin-navigation',
+    commerce: '@prenta/plugin-commerce',
+    ai: '@prenta/plugin-ai',
+    consent: '@prenta/plugin-consent',
+};
+/** Package names for CLI platform slugs — exported for scaffold / CLI consistency tests. */
+export const PLATFORM_PACKAGES = {
+    vercel: '@prenta/platform-vercel',
+    aws: '@prenta/platform-aws',
+};
+/**
+ * npm-safe workspace scope derived from the project name (folder basename when
+ * scaffolding into `.`). Used for the shared section-kit package name
+ * (`@<scope>/sections`) and the workspace-root package name.
+ */
+function workspaceScopeName(options, root) {
+    const base = options.projectName === '.' ? path.basename(root) : options.projectName;
+    const cleaned = base
+        .toLowerCase()
+        .replace(/[^a-z0-9_-]/g, '-')
+        .replace(/^[-_.]+|[-_.]+$/g, '');
+    return cleaned || 'site';
+}
+/** `pnpm-workspace.yaml` for astro-split scaffolds. */
+function buildPnpmWorkspaceYaml() {
+    return `packages:
+  - apps/*
+  - packages/*
+`;
+}
+/**
+ * Workspace-root `package.json` for astro-split scaffolds. Scripts delegate to
+ * the member packages via pnpm filters so day-to-day commands run from the
+ * repo root (`pnpm dev`, `pnpm db:migrate`, `pnpm verify:sections`, …).
+ */
+function buildWorkspaceRootPackageJson(options, root, sectionsPackage) {
+    const scripts = {
+        // Both apps in one terminal; use dev:cms / dev:site for separate terminals.
+        dev: 'pnpm --parallel -r run dev',
+        'dev:cms': 'pnpm --filter cms dev',
+        'dev:site': 'pnpm --filter site dev',
+        build: 'pnpm -r run build',
+        'db:migrate': 'pnpm --filter cms db:migrate',
+        'db:seed': 'pnpm --filter cms db:seed',
+        populate: 'pnpm --filter cms populate',
+        doctor: 'pnpm --filter cms doctor',
+        'deploy:check': 'pnpm --filter cms deploy:check',
+        verify: 'pnpm --filter cms verify',
+    };
+    if (sectionsPackage) {
+        scripts['verify:sections'] = `pnpm --filter ${sectionsPackage} verify:sections`;
+        scripts['blocks:extract'] = `pnpm --filter ${sectionsPackage} blocks:extract`;
+        scripts['blocks:diff'] = `pnpm --filter ${sectionsPackage} blocks:diff`;
+        scripts['test:parity'] = `pnpm --filter ${sectionsPackage} test:parity`;
+    }
+    const pkg = {
+        name: workspaceScopeName(options, root),
+        version: '0.1.0',
+        private: true,
+        // pnpm/action-setup and corepack read the toolchain from here.
+        packageManager: 'pnpm@9.15.0',
+        scripts,
+        engines: {
+            // Astro 7 (apps/site) requires Node 22.12+; hold the workspace to it.
+            node: '>=22.12.0',
+        },
+    };
+    return JSON.stringify(pkg, null, 2) + '\n';
+}
+function buildPackageJson(options, versions) {
+    const deps = {
+        '@prenta/core': versionFor(versions, '@prenta/core'),
+        '@prenta/admin': versionFor(versions, '@prenta/admin'),
+        // Block primitives the admin page-builder relies on (optional peer of cms-admin).
+        '@prenta/component-blocks': versionFor(versions, '@prenta/component-blocks'),
+        // Public renderer for the canonical PageSection[] content contract (ADR 0001).
+        '@prenta/sections-react': versionFor(versions, '@prenta/sections-react'),
+        '@prisma/adapter-pg': '^7.8.0',
+        '@prisma/client': '^7.8.0',
+        next: '^16.2.4',
+        pg: '^8.20.0',
+        react: '^19.2.0',
+        'react-dom': '^19.2.0',
+        // The /api/cms/graphql endpoint is served by cms-core, which lazily imports
+        // graphql + graphql-yoga (their optional peer dependencies). Ship them so the
+        // GraphQL API works out of the box; remove both if you only use the REST API.
+        graphql: '^16.13.2',
+        'graphql-yoga': '^5.19.0',
+        // cms-core optimizes uploaded images with sharp and marks it a Next
+        // serverExternalPackage (a native module can't be bundled). It's dynamically
+        // imported, so Next never traces it — the app must depend on it directly or
+        // Vercel won't include it in the function bundle and media uploads 500 with
+        // "Cannot find package 'sharp'".
+        sharp: '^0.35.0',
+    };
+    if (options.platform in PLATFORM_PACKAGES) {
+        const pkg = PLATFORM_PACKAGES[options.platform];
+        deps[pkg] = versionFor(versions, pkg);
+    }
+    // The generated prenta.config uses the `storage: { provider: 'vercel-blob' }`
+    // shorthand, which Prenta auto-wires to platform-vercel's storage adapter
+    // server-side. That adapter dynamically imports `@vercel/blob` (an *optional*
+    // peer it never installs), so without this the first media upload throws
+    // "Cannot find module '@vercel/blob'". Ship it as a direct runtime dependency
+    // so uploads work out of the box.
+    if (options.platform === 'vercel') {
+        deps['@vercel/blob'] = '^2.4.0';
+        deps['@vercel/functions'] = '^3.6.0';
+    }
+    for (const plugin of options.plugins) {
+        const pkg = PLUGIN_PACKAGES[plugin];
+        if (pkg)
+            deps[pkg] = versionFor(versions, pkg);
+    }
+    const scripts = {
+        dev: 'next dev',
+        build: 'prisma generate && node scripts/deploy-migrate.mjs && next build',
+        start: 'next start',
+        postinstall: 'prisma generate',
+        // No `lint` script: Next 16 removed the `next lint` subcommand, and we ship
+        // no ESLint config or eslint-config-next dependency — so `next lint` would
+        // just error in a fresh project. Consumers can add ESLint themselves.
+        generate: 'prenta generate',
+        'db:migrate': 'prisma migrate dev',
+        'db:push': 'prisma db push',
+        'db:studio': 'prisma studio',
+        'db:seed': 'prenta seed',
+        populate: 'prenta populate',
+        doctor: 'prenta doctor',
+        'deploy:check': 'prenta deploy:check',
+        verify: 'prenta verify --full',
+        // The marketing-custom template adds blocks:extract / blocks:diff /
+        // verify:sections for the custom-section workflow. In the astro-split
+        // workspace those live on packages/sections; the CMS app keeps a
+        // verify:sections alias so the contract check runs from either app.
+        ...(isMarketingCustom(options)
+            ? isAstroSplit(options)
+                ? { 'verify:sections': 'node ../../packages/sections/scripts/verify-sections.mjs' }
+                : MARKETING_CUSTOM_SCRIPTS
+            : {}),
+    };
+    const packageJson = {
+        // In the astro-split workspace this package is `apps/cms` (the workspace
+        // root carries the project name); pnpm filters target it as `cms`.
+        name: isAstroSplit(options) ? 'cms' : options.projectName,
+        version: '0.1.0',
+        private: true,
+        scripts,
+        dependencies: Object.fromEntries(Object.entries(deps).sort(([a], [b]) => a.localeCompare(b))),
+        devDependencies: {
+            '@prenta/cli': versionFor(versions, '@prenta/cli'),
+            '@tailwindcss/postcss': '^4.0.0',
+            '@types/node': '^22.0.0',
+            '@types/pg': '^8.20.0',
+            '@types/react': '^19.0.0',
+            '@types/react-dom': '^19.0.0',
+            prisma: '^7.8.0',
+            typescript: '^5.7.0',
+        },
+    };
+    return JSON.stringify(packageJson, null, 2) + '\n';
+}
+function buildEnvExample(options) {
+    const lines = ['# ── Database (Required) ──────────────────────────────────'];
+    if (options.database === 'prisma-postgres') {
+        lines.push('# Pooled connection (runtime queries — provisioned by the Vercel Marketplace)');
+        lines.push('DATABASE_URL="prisma+postgres://accelerate.prisma-data.net/?api_key=YOUR_API_KEY"');
+        lines.push('# Direct TCP connection (migrations - non-pooled)');
+        lines.push('DIRECT_DATABASE_URL="postgresql://user:password@db.prisma.io:5432/postgres?sslmode=require"');
+    }
+    else if (options.database === 'neon') {
+        lines.push('# Pooled connection (runtime queries)');
+        lines.push('DATABASE_URL="postgresql://user:password@ep-xyz.us-east-2.aws.neon.tech/prenta?sslmode=require"');
+        lines.push('# Direct connection (migrations — non-pooled)');
+        lines.push('DIRECT_DATABASE_URL="postgresql://user:password@ep-xyz.us-east-2.aws.neon.tech/prenta?sslmode=require"');
+    }
+    else if (options.database === 'supabase') {
+        lines.push('# Pooled connection (runtime queries)');
+        lines.push('DATABASE_URL="postgresql://postgres:password@db.xyzproject.supabase.co:6543/postgres"');
+        lines.push('# Direct connection (migrations — non-pooled)');
+        lines.push('DIRECT_DATABASE_URL="postgresql://postgres:password@db.xyzproject.supabase.co:5432/postgres"');
+    }
+    else {
+        lines.push('DATABASE_URL="postgresql://user:password@localhost:5432/prenta"');
+        lines.push('DIRECT_DATABASE_URL="postgresql://user:password@localhost:5432/prenta"');
+    }
+    lines.push('');
+    lines.push('# ── Security (Required) ──────────────────────────────────');
+    lines.push('# Min 32 chars — used for JWT signing and session encryption');
+    lines.push('CMS_SECRET=""');
+    lines.push('# 32-byte hex key for AES-256-GCM field encryption');
+    lines.push("# Generate with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"");
+    lines.push('CMS_ENCRYPTION_KEY=""');
+    lines.push('# Protects /api/cms/cron/* (Vercel sends Authorization: Bearer <CRON_SECRET>)');
+    lines.push("# Generate with: node -e \"console.log(require('crypto').randomBytes(24).toString('hex'))\"");
+    lines.push('CRON_SECRET=""');
+    lines.push('');
+    lines.push('# ── Public ───────────────────────────────────────────────');
+    if (options.framework === 'astro-split') {
+        // Public apex is Astro (default :4321). Admin/API stay on the Next CMS host
+        // (:3000). Pointing NEXT_PUBLIC_SITE_URL at the CMS host makes View live open
+        // the wrong site — Admin → Settings → General can override without redeploy.
+        lines.push('NEXT_PUBLIC_SITE_URL="http://localhost:4321"');
+        lines.push('# PUBLIC apex (Astro site/), NOT the CMS host. Production: your marketing domain.');
+        lines.push('# Mirrored as prenta.config.ts `seo.siteUrl`. Admin → Settings → General overrides.');
+    }
+    else {
+        lines.push('NEXT_PUBLIC_SITE_URL="http://localhost:3000"');
+        lines.push('# Canonical origin for sitemap, OG tags, and JSON-LD. Must match your');
+        lines.push('# production domain (no trailing slash). Also mirrored in prenta.config.ts');
+        lines.push('# `seo.siteUrl` — Admin → Settings → General can override without redeploying.');
+    }
+    if (options.plugins.includes('consent')) {
+        lines.push('');
+        lines.push('# ── Consent & analytics (plugin-consent) ─────────────────');
+        lines.push('# Loaded only after the visitor clicks Accept all on the cookie banner.');
+        lines.push('NEXT_PUBLIC_GA4_MEASUREMENT_ID=""');
+        lines.push('NEXT_PUBLIC_GOOGLE_ADS_ID=""');
+        lines.push('NEXT_PUBLIC_META_PIXEL_ID=""');
+    }
+    lines.push('');
+    lines.push('# ── First-Run Admin (Optional) ───────────────────────────');
+    lines.push('# If set, auto-creates the initial admin user on first boot.');
+    lines.push('# If not set, visit /admin to create via the setup wizard.');
+    lines.push('# CMS_ADMIN_EMAIL=""');
+    lines.push('# CMS_ADMIN_PASSWORD=""');
+    // OAuth env names must match what cms-core reads at runtime:
+    // `OAUTH_<PROVIDER>_CLIENT_ID` / `OAUTH_<PROVIDER>_CLIENT_SECRET`
+    // (see handlers.ts `/auth/oauth/:provider`). Bare GOOGLE_*/GITHUB_* names
+    // are ignored by the server.
+    if (options.authProviders.includes('google')) {
+        lines.push('', '# ── Google OAuth ─────────────────────────────────────────');
+        lines.push('OAUTH_GOOGLE_CLIENT_ID=""');
+        lines.push('OAUTH_GOOGLE_CLIENT_SECRET=""');
+    }
+    if (options.authProviders.includes('github')) {
+        lines.push('', '# ── GitHub OAuth ─────────────────────────────────────────');
+        lines.push('OAUTH_GITHUB_CLIENT_ID=""');
+        lines.push('OAUTH_GITHUB_CLIENT_SECRET=""');
+    }
+    if (options.authProviders.includes('microsoft')) {
+        lines.push('', '# ── Microsoft OAuth ──────────────────────────────────────');
+        lines.push('OAUTH_MICROSOFT_CLIENT_ID=""');
+        lines.push('OAUTH_MICROSOFT_CLIENT_SECRET=""');
+    }
+    if (options.platform === 'vercel') {
+        lines.push('', '# ── Rate Limiting (Optional, recommended for production) ──');
+        lines.push('# Adding Upstash from the Vercel Marketplace auto-provisions');
+        lines.push('# KV_REST_API_URL / KV_REST_API_TOKEN — the rate limiter accepts');
+        lines.push('# those automatically, so you usually do not set anything here.');
+        lines.push('# Set these only when pointing at an Upstash store directly:');
+        lines.push('# UPSTASH_REDIS_REST_URL=""');
+        lines.push('# UPSTASH_REDIS_REST_TOKEN=""');
+    }
+    if (options.plugins.includes('forms')) {
+        lines.push('', '# ── Forms & CRM (plugin-forms) ───────────────────────────');
+        lines.push('# After `npm run populate`, open Admin → Forms → [form] → Integrations');
+        lines.push('# and paste your Zapier Catch Hook URL (Webhooks by Zapier → Catch Hook).');
+        lines.push('# Email notifications use RESEND_API_KEY / SMTP when the email plugin is enabled.');
+    }
+    if (options.plugins.includes('email')) {
+        lines.push('', '# ── Email (Optional) ─────────────────────────────────────');
+        lines.push('# Choose a provider with EMAIL_PROVIDER: resend | ses | smtpcom | smtp.');
+        lines.push('# When omitted it is inferred: SMTP_HOST → smtp, else RESEND_API_KEY → resend.');
+        lines.push('# EMAIL_PROVIDER=""');
+        lines.push('EMAIL_FROM="noreply@example.com"');
+        lines.push('#');
+        lines.push('# Resend (HTTP API):');
+        lines.push('RESEND_API_KEY=""');
+        lines.push('#');
+        lines.push('# Generic SMTP (any mail server; run `npm i nodemailer`):');
+        lines.push('# EMAIL_PROVIDER="smtp"');
+        lines.push('# SMTP_HOST=""');
+        lines.push('# SMTP_PORT="587"           # 587 = STARTTLS, 465 = implicit TLS');
+        lines.push('# SMTP_SECURE="false"       # "true" forces implicit TLS');
+        lines.push('# SMTP_USER=""');
+        lines.push('# SMTP_PASS=""');
+    }
+    if (options.plugins.includes('commerce')) {
+        lines.push('', '# ── Stripe ───────────────────────────────────────────────');
+        lines.push('STRIPE_SECRET_KEY=""');
+        lines.push('STRIPE_WEBHOOK_SECRET=""');
+    }
+    if (options.plugins.includes('ai')) {
+        lines.push('', '# ── AI Provider ──────────────────────────────────────────');
+        lines.push('ANTHROPIC_API_KEY=""');
+        lines.push('# OPENAI_API_KEY=""');
+    }
+    if (options.plugins.includes('media')) {
+        lines.push('', '# ── Media Storage ────────────────────────────────────────');
+        if (options.platform === 'vercel') {
+            lines.push('BLOB_READ_WRITE_TOKEN=""');
+        }
+        else {
+            // Auto-wired via `storage: { provider: 's3' }` → @prenta/platform-aws.
+            // In production, prefer an IAM role (ECS task role / EC2 instance profile) and
+            // leave the key/secret unset — the AWS SDK resolves credentials automatically.
+            lines.push('AWS_S3_BUCKET=""');
+            lines.push('AWS_REGION=""');
+            lines.push('# Static keys for local dev only; omit when running under an IAM role:');
+            lines.push('# AWS_ACCESS_KEY_ID=""');
+            lines.push('# AWS_SECRET_ACCESS_KEY=""');
+            lines.push('# Optional CloudFront/CDN base for public object URLs:');
+            lines.push('# AWS_S3_PUBLIC_URL=""');
+        }
+    }
+    lines.push('', '# ── CAPTCHA (Optional) ───────────────────────────────────');
+    lines.push('# Google reCAPTCHA v3 — get keys at https://www.google.com/recaptcha/admin');
+    lines.push('# RECAPTCHA_SITE_KEY=""');
+    lines.push('# RECAPTCHA_SECRET_KEY=""');
+    lines.push('# RECAPTCHA_SCORE_THRESHOLD="0.5"');
+    lines.push('#');
+    lines.push('# OR Cloudflare Turnstile — get keys at https://dash.cloudflare.com/turnstile');
+    lines.push('# TURNSTILE_SITE_KEY=""');
+    lines.push('# TURNSTILE_SECRET_KEY=""');
+    lines.push('');
+    return lines.join('\n');
+}
+function buildVercelJson(options) {
+    const config = {
+        buildCommand: 'prisma generate && node scripts/deploy-migrate.mjs && next build',
+        framework: 'nextjs',
+        functions: {
+            'app/api/cms/**/*.ts': {
+                maxDuration: 30,
+                memory: 1024,
+            },
+        },
+    };
+    const crons = [];
+    crons.push({
+        path: '/api/cms/cron/publish',
+        schedule: '*/5 * * * *',
+    });
+    crons.push({
+        path: '/api/cms/cron/cleanup',
+        schedule: '0 3 * * *',
+    });
+    if (options.plugins.includes('seo')) {
+        crons.push({
+            path: '/api/cms/cron/seo-scan',
+            schedule: '0 4 * * 1',
+        });
+    }
+    // Nightly content-health scan — populates the dashboard "Content
+    // Health" tile (missing meta descriptions, alt text, outdated
+    // content, broken internal links). Scheduled at 02:30 UTC so it
+    // doesn't collide with the 03:00 cleanup or 04:00 SEO scan.
+    crons.push({
+        path: '/api/cms/cron/content-health',
+        schedule: '30 2 * * *',
+    });
+    config.crons = crons;
+    return JSON.stringify(config, null, 2) + '\n';
+}
+function databaseLabel(database) {
+    if (database === 'prisma-postgres')
+        return 'Prisma Postgres';
+    if (database === 'neon')
+        return 'Neon';
+    if (database === 'supabase')
+        return 'Supabase';
+    return 'PostgreSQL';
+}
+function marketplaceDatabaseLabel(database) {
+    if (database === 'neon')
+        return 'Neon Postgres';
+    // Prisma Postgres is the default Marketplace recommendation; Supabase and
+    // custom URLs are provisioned outside the Marketplace, so still point the
+    // reader at the recommended integration.
+    return 'Prisma Postgres';
+}
+function buildDeploymentGuide(options) {
+    const lines = [
+        '# Deployment Guide',
+        '',
+        '## Prerequisites',
+        '',
+        // Astro 7 (apps/site) requires Node 22.12+, so the workspace holds to it.
+        isAstroSplit(options) ? '- Node.js >= 22.12' : '- Node.js >= 20',
+        `- A ${databaseLabel(options.database)} database`,
+        options.platform === 'vercel'
+            ? '- A Vercel account'
+            : '- An AWS account with appropriate IAM permissions',
+        '',
+    ];
+    if (isAstroSplit(options)) {
+        lines.push('## Monorepo layout (astro-split)', '', 'This repo is a **pnpm workspace**: `apps/cms` (Next CMS host) and', '`apps/site` (Astro public site)' +
+            (isMarketingCustom(options) ? ', plus `packages/sections` (the shared section kit).' : '.'), '', 'The steps below apply to the **CMS host** — create that Vercel project', 'with **Root Directory = `apps/cms`**. Deploy `apps/site` as a second', 'project (Root Directory = `apps/site`); see `ASTRO.md` for its routing,', 'env vars, and the purge-on-publish webhook.', '', 'Run the `npm run …` commands below from `apps/cms`, or use the pnpm', 'aliases at the workspace root (`pnpm db:seed`, `pnpm doctor`, …).', '');
+    }
+    if (options.platform === 'vercel') {
+        lines.push('## Vercel Deployment', '', '### 1. Link your project', '', '```bash', 'npx vercel link', '```', '', '### 2. Provision infrastructure', '', 'Via the Vercel dashboard or CLI:', '', `- **Database**: Add ${marketplaceDatabaseLabel(options.database)} from the Vercel Marketplace`, '  - This auto-provisions `DATABASE_URL` and `DIRECT_DATABASE_URL`', '- **Blob Storage**: Add Vercel Blob from the dashboard', '  - This auto-provisions `BLOB_READ_WRITE_TOKEN`', '- **Rate Limiting**: Add Upstash Redis from the Vercel Marketplace', '  - This auto-provisions `KV_REST_API_URL` / `KV_REST_API_TOKEN`, which the', '    rate limiter reads automatically (the native `UPSTASH_REDIS_REST_URL` /', '    `UPSTASH_REDIS_REST_TOKEN` names also work if you set them directly)', '', '### 3. Pull auto-provisioned env vars', '', '```bash', 'npx vercel env pull .env.local', '```', '', '### 4. Set remaining environment variables', '', 'In the Vercel dashboard (Settings > Environment Variables), add:', '', '```', 'CMS_SECRET=<min-32-char-random-string>', 'CMS_ENCRYPTION_KEY=<64-char-hex-string>', 'NEXT_PUBLIC_SITE_URL=https://your-domain.com', '```', '', 'Generate secrets with:', '', '```bash', "node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"", '```', '', '### 5. Deploy', '', '```bash', 'git push  # Vercel auto-deploys on push', '```', '', 'The build command runs migrations automatically before building, but only on', '**production** deploys (`scripts/deploy-migrate.mjs` gates `prisma migrate deploy`', 'on `VERCEL_ENV=production`). Preview deploys skip migrations so an unmerged PR', "can't mutate your production database — set `ALLOW_MIGRATE_DEPLOY=true` in a", 'preview environment only if it has its own isolated database.', '', '### 6. Verify deployment readiness', '', '```bash', 'npm run doctor', 'npm run deploy:check', '```', '', 'These commands check required env vars, Prisma models, and deployment metadata', 'before you rely on the admin UI.', '', '### 7. Configure SEO & verify public routes', '', '1. Set **Admin → Settings → General** site URL to match `NEXT_PUBLIC_SITE_URL`.', '2. Open **Admin → SEO** and confirm:', '   - Default OG image (upload 1200×630 to Media or set `public/og-default.png`)', '   - Organization name, logo URL, and social profiles (`sameAs`)', '   - AI crawler policy under Technical → Robots (GPTBot, ClaudeBot, etc.)', '3. Hit these URLs on your deployed domain (scaffold proxies cms-core):', '   - `/sitemap.xml`', '   - `/robots.txt`', '   - `/llms.txt`', '4. Work through the **Prototype → Production** checklist in the Prenta docs', '   before go-live (forms, consent, performance, accessibility, launch QA).', '', '### 8. Seed first-run content', '', '```bash', 'CMS_ADMIN_EMAIL=admin@example.com CMS_ADMIN_PASSWORD=change-me npm run db:seed -- --demo', '```', '', ...(isMarketingCustom(options)
+            ? [
+                'This project includes a pre-filled `prenta.seed.json` ("Marketing homepage"',
+                'with hero, stats, pricing, and CTA sections). Load it with:',
+                '',
+                '```bash',
+                'npm run populate',
+                '```',
+                '',
+            ]
+            : []), 'For real projects, create `prenta.seed.json` or `prenta.seed.ts` with pages,', 'globals, forms, SEO fields, media references, and saved sections, then run', '`npm run populate`. Script tags are **not** part of the seed envelope —', 'bootstrap them in Admin → Script Tags or a custom insert-if-missing seed script', '(see Prenta docs: Script Tags / populate guidance).', '', '### 9. Create your admin account', '', `Visit \`https://your-domain.com${options.loginPath}\` — the setup wizard will`, 'guide you through creating the initial admin account.', '', ...(isSplitLogin(options)
+            ? [
+                `Sign-in happens at \`${options.loginPath}\`; the admin app itself lives at`,
+                `\`${options.adminPath}\`. Signed-out visits to \`${options.adminPath}\` show a 404 so the`,
+                'admin is not advertised at a well-known path.',
+                '',
+            ]
+            : []), 'Alternatively, set `CMS_ADMIN_EMAIL` and `CMS_ADMIN_PASSWORD` env vars', 'before deploying to auto-create the admin account. If you did this (or ran', 'the seed in step 7 with those vars set), the admin already exists and the', 'setup wizard will not appear — sign in with those credentials instead.', '', '### 10. Verify after deploy', '', '```bash', 'npm run verify', '```', '', '---', '', '## Continuous integration (migration gate)', '', 'This project ships a `.github/workflows/ci.yml` that runs on every pull', 'request. It stands up a throwaway Postgres container and runs', '`prisma migrate deploy` against it, so a broken or out-of-order migration', 'fails the PR in review instead of breaking your production build (whose', 'build applies migrations only on production deploys — see above).', '', 'It is **provider-agnostic** — the container is independent of where', 'production runs (Prisma Postgres, Neon, Supabase, or self-hosted) and needs', 'no secrets. The workflow points `DATABASE_URL` / `DIRECT_DATABASE_URL` at the', 'CI container only; it never touches a real environment.', '', '### Dependency updates (Renovate)', '', 'This project ships a `renovate.json` preset that groups every', '`@prenta/*` upgrade into a single PR. Enable Renovate (the GitHub', 'app, or self-hosted) on the repo and it will open a grouped "Prenta CMS"', 'PR on a weekly schedule.', '', '- **Minor/patch** Prenta bumps **auto-merge once CI passes** — including the', '  migration gate above — so routine security/patch updates land hands-free.', '- **Major** bumps are never auto-merged (they can carry breaking schema/API', '  changes); they get a `breaking-change` label for manual review.', '', 'For auto-merge to actually wait on CI, add a **branch protection rule** on', '`main` that requires the `CI` status check. Without it, Renovate may merge a', 'green-but-unchecked PR.', '', 'Running several Prenta sites? "Patch the fleet" is just merging each', "repo's grouped Renovate PR — every one independently CI-gated. See ADR 0003", 'in the Prenta repo for the full multi-site model.', '', '---', '', '## Preview Deployments', '', 'Every PR creates a preview deployment with its own URL. Preview deployments', 'share the production database by default. To use a separate preview database:', '', '1. Provision a second database (e.g. a separate Prisma Postgres database)', '2. Set `DATABASE_URL` and `DIRECT_DATABASE_URL` for the Preview environment', '   in Vercel dashboard > Settings > Environment Variables', '', '---', '', '## Cron Jobs', '', 'The following cron jobs are configured in `vercel.json`:', '', '| Schedule | Endpoint | Purpose |', '|----------|----------|---------|', '| Every 5 min | `/api/cms/cron/publish` | Process scheduled publish/unpublish |', '| Daily 3 AM | `/api/cms/cron/cleanup` | Clean expired locks, sessions, soft-deleted content |');
+        if (options.plugins.includes('seo')) {
+            lines.push('| Weekly Mon 4 AM | `/api/cms/cron/seo-scan` | Run automated SEO audit |');
+        }
+        lines.push('| Nightly 2:30 AM | `/api/cms/cron/content-health` | Scan content for missing meta, alt text, broken links, outdated docs |');
+        lines.push('', 'These require Vercel Pro or Enterprise plan for cron intervals < 1 day.', '');
+    }
+    else {
+        lines.push('## AWS Deployment', '', 'Deploy the Next.js standalone output on ECS/Fargate (recommended) or Lambda', '(OpenNext/SST), backed by RDS PostgreSQL and S3 + CloudFront for media. See the', '`@prenta/platform-aws` README for the full service mapping, IAM policy,', 'and CloudFront/OAC setup.', '', "Media storage is auto-wired from `storage: { provider: 's3' }` in", '`prenta.config.ts`. Set `AWS_S3_BUCKET` + `AWS_REGION` (see `.env.example`) and', 'grant the task/instance IAM role `s3:PutObject`, `s3:GetObject`, `s3:DeleteObject`', 'on the bucket — no static keys needed in production.', '', 'Scheduled jobs run via EventBridge Scheduler, one schedule per endpoint', '(targeting API Gateway/Lambda or the ALB). `generateEventBridgeConfig()` from', '`@prenta/platform-aws` emits the `cron(...)` expressions:', '', '| Schedule | Endpoint | Purpose |', '|----------|----------|---------|', '| Every 5 min | `/api/cms/cron/publish` | Process scheduled publish/unpublish |', '| Daily 3 AM | `/api/cms/cron/cleanup` | Clean expired locks, sessions, soft-deleted content |');
+        if (options.plugins.includes('seo')) {
+            lines.push('| Weekly Mon 4 AM | `/api/cms/cron/seo-scan` | Run automated SEO audit |');
+        }
+        lines.push('| Nightly 2:30 AM | `/api/cms/cron/content-health` | Scan content for missing meta, alt text, broken links, outdated docs |', '');
+    }
+    lines.push('## Updating Prenta CMS', '', '1. Check for updates in the admin panel (Settings > Updates)', '2. Or run: `npm outdated @prenta/core`', '3. Upgrade (pre-1.0 minors require an explicit bump — `npm update` alone is not enough):', '   `npx prenta upgrade --dry-run` then `npx prenta upgrade && npm install`', '4. Sync schema + migrations: `npx prenta db:sync && npx prisma migrate deploy`', '5. Deploy: `git push`', '', '## Troubleshooting', '', '### Build fails with "migration failed"', '', 'Ensure `DIRECT_DATABASE_URL` is set and points to a non-pooled connection.', 'Pooled connections (PgBouncer/Neon pooler) cannot run DDL statements.', '', '### "No users found" after deploy', '', `Visit \`${options.loginPath}\` to trigger the setup wizard, or set`, '`CMS_ADMIN_EMAIL` and `CMS_ADMIN_PASSWORD` environment variables.', '');
+    return lines.join('\n');
+}
+function buildNextConfig(options, sectionsPackage) {
+    // Allow next/image to optimize media served from the project's storage
+    // backend (CMS images carry absolute URLs from the upload provider).
+    const remoteHost = options.platform === 'aws' ? '*.amazonaws.com' : '*.public.blob.vercel-storage.com';
+    const transpileBlock = sectionsPackage
+        ? `
+  // The shared section kit ships raw TypeScript source (one map for the admin
+  // canvas here and the Astro public site) — have Next compile it.
+  transpilePackages: ['${sectionsPackage}'],`
+        : '';
+    return `import type { NextConfig } from 'next';
+import { withPrentaCMS } from '@prenta/core/next';
+import config from './prenta.config';
+
+const nextConfig: NextConfig = {${transpileBlock}
+  images: {
+    // Serve AVIF first (≈50% smaller than JPEG), then WebP, for the best LCP.
+    // next/image negotiates the format per request based on Accept headers.
+    formats: ['image/avif', 'image/webp'],
+    // Storage backend for CMS media. Add your own CDN/host here as needed.
+    remotePatterns: [{ protocol: 'https', hostname: '${remoteHost}' }],
+  },
+};
+
+export default withPrentaCMS(config, nextConfig);
+`;
+}
+function buildPrismaConfig() {
+    return `import path from 'node:path';
+import { defineConfig } from 'prisma/config';
+
+// Migrations (DDL) should run over a NON-pooled connection. Neon/Supabase
+// poolers frequently break schema changes, producing opaque "migration failed"
+// errors. Prefer DIRECT_DATABASE_URL; fall back to DATABASE_URL but warn loudly
+// so the failure mode isn't silent.
+const migrationUrl = process.env.DIRECT_DATABASE_URL ?? process.env.DATABASE_URL ?? '';
+if (process.env.DATABASE_URL && !process.env.DIRECT_DATABASE_URL) {
+  console.warn(
+    '[prenta] DIRECT_DATABASE_URL is not set — running migrations against DATABASE_URL. ' +
+      'If that is a pooled connection (e.g. a Neon/Supabase pooler), migrations may fail; ' +
+      'set DIRECT_DATABASE_URL to the non-pooled connection string.',
+  );
+}
+
+export default defineConfig({
+  schema: path.join(__dirname, 'prisma', 'schema.prisma'),
+  migrations: {
+    path: path.join(__dirname, 'prisma', 'migrations'),
+  },
+  datasource: {
+    url: migrationUrl,
+  },
+});
+`;
+}
+function generateCmsHelper() {
+    return `import { createNextSiteHelpers } from '@prenta/core/next/site';
+
+const site = createNextSiteHelpers({
+  baseUrl: process.env.NEXT_PUBLIC_SITE_URL || 'http://localhost:3000',
+  revalidate: 300,
+});
+
+export const {
+  getGlobal,
+  resolveDocument,
+  getNavigation,
+  getPublicForm,
+  getCachedPublishedDocument,
+  getCachedPageMetadata,
+} = site;
+`;
+}
+function generatePrismaHelper() {
+    return `import { PrismaPg } from '@prisma/adapter-pg';
+import pg from 'pg';
+import { PrismaClient } from '../generated/prisma/client';
+
+const globalForPrisma = globalThis as unknown as { prisma?: InstanceType<typeof PrismaClient> };
+
+function makePrisma() {
+  const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });
+  const adapter = new PrismaPg(pool);
+  return new PrismaClient({ adapter } as any);
+}
+
+export function getPrisma() {
+  if (!globalForPrisma.prisma) {
+    globalForPrisma.prisma = makePrisma();
+  }
+  return globalForPrisma.prisma;
+}
+`;
+}
+function generateSiteSettingsHelper() {
+    return `import { getGlobal } from './cms';
+
+export interface SiteSettings {
+  siteName?: string;
+  description?: string;
+  phone?: string;
+  email?: string;
+  [key: string]: unknown;
+}
+
+export async function getSiteSettings(): Promise<SiteSettings | null> {
+  try {
+    return await getGlobal<SiteSettings>('site-settings');
+  } catch {
+    return null;
+  }
+}
+`;
+}
+function generateResolveMediaHelper() {
+    return `export {
+  normalizeMedia,
+  resolveMedia,
+} from '@prenta/core/site';
+
+export type {
+  MediaInput,
+  ResolvedMedia,
+  ResolveMediaOptions,
+} from '@prenta/core/site';
+`;
+}
+function buildTsConfig() {
+    return (JSON.stringify({
+        compilerOptions: {
+            target: 'ES2022',
+            lib: ['dom', 'dom.iterable', 'esnext'],
+            allowJs: true,
+            skipLibCheck: true,
+            strict: true,
+            noEmit: true,
+            esModuleInterop: true,
+            module: 'esnext',
+            moduleResolution: 'bundler',
+            resolveJsonModule: true,
+            isolatedModules: true,
+            jsx: 'preserve',
+            incremental: true,
+            plugins: [{ name: 'next' }],
+            paths: { '@/*': ['./*'] },
+        },
+        include: ['next-env.d.ts', '**/*.ts', '**/*.tsx', '.next/types/**/*.ts'],
+        exclude: ['node_modules'],
+    }, null, 2) + '\n');
+}
+function buildNpmrc() {
+    // pnpm's default isolated node_modules layout does not flatten the transitive
+    // dependencies that some published @prenta/* packages (and their
+    // Radix/TipTap deps) rely on being resolvable from their own package
+    // directory. Under Next.js + Turbopack that surfaces as "Module not found"
+    // for packages like @radix-ui/react-use-controllable-state during `next build`.
+    // A hoisted linker gives a flat, npm-like layout so those resolve cleanly.
+    return `# Flatten node_modules so bundlers can resolve the published packages'
+# transitive deps (Radix/TipTap internals) during \`next build\`.
+node-linker=hoisted
+`;
+}
+function generateDeployMigrateScript() {
+    // Emitted to scripts/deploy-migrate.mjs and invoked from the build command.
+    // No template placeholders / backticks inside so it survives this template.
+    return `// Applies pending Prisma migrations, but ONLY on Vercel *production* builds.
+//
+// Vercel preview deployments (from PRs) share the production database by
+// default, so running \`prisma migrate deploy\` on every build would apply an
+// unmerged branch's migrations to production before review. This guard runs
+// migrations only when VERCEL_ENV=production, or when you explicitly opt in
+// with ALLOW_MIGRATE_DEPLOY=true (e.g. against an isolated preview database).
+// Locally (no VERCEL_ENV) it skips — use \`pnpm db:migrate\` for local changes.
+import { execSync } from 'node:child_process'
+
+const vercelEnv = process.env.VERCEL_ENV || 'unset'
+const force = process.env.ALLOW_MIGRATE_DEPLOY === 'true'
+
+if (vercelEnv === 'production' || force) {
+  console.log('[deploy-migrate] applying migrations (VERCEL_ENV=' + vercelEnv + (force ? ', forced' : '') + ')')
+  execSync('prisma migrate deploy', { stdio: 'inherit' })
+} else {
+  console.log(
+    '[deploy-migrate] skipping prisma migrate deploy (VERCEL_ENV=' + vercelEnv + '). ' +
+      'Set ALLOW_MIGRATE_DEPLOY=true to run it against an isolated preview database.',
+  )
+}
+`;
+}
+function buildGitignore(options) {
+    const base = `node_modules/
+.next/
+dist/
+.env
+.env.local
+.env.production.local
+.turbo
+.vercel
+*.tsbuildinfo
+
+# Local MCP config — contains a real API key once you fill it in.
+.cursor/mcp.json
+.vscode/mcp.json
+`;
+    const extras = [];
+    if (isAstroSplit(options)) {
+        // Astro build artifacts in apps/site (node_modules/ and dist/ are already
+        // covered at any depth by the base patterns above).
+        extras.push('.astro/');
+    }
+    if (isMarketingCustom(options) && MARKETING_CUSTOM_GITIGNORE.length > 0) {
+        extras.push('# Throwaway manifest written by `npm run blocks:diff`.');
+        extras.push(...MARKETING_CUSTOM_GITIGNORE);
+    }
+    if (extras.length === 0)
+        return base;
+    return `${base}\n${extras.join('\n')}\n`;
+}
+async function mkdirSafe(dirPath) {
+    await mkdir(dirPath, { recursive: true });
+}
+/**
+ * Scaffold only the Astro public site (no Next CMS host). Used by
+ * `--framework astro-site` and `create-prenta-astro` when attaching to an
+ * existing Prenta CMS deployment.
+ */
+async function scaffoldAstroSiteOnly(options, root) {
+    const spinner = ora('Creating Astro public site...').start();
+    try {
+        await mkdirSafe(root);
+        const siteFiles = astroSiteFiles({
+            cmsUrlExample: 'https://cms.example.com',
+        });
+        await Promise.all(Object.entries(siteFiles).map(async ([relPath, contents]) => {
+            const dest = path.join(root, ...relPath.split('/'));
+            await mkdirSafe(path.dirname(dest));
+            await writeFile(dest, contents);
+        }));
+        // Prefer a project-named package.json when scaffolding into a named folder.
+        if (options.projectName !== '.') {
+            try {
+                const pkgPath = path.join(root, 'package.json');
+                const pkg = JSON.parse(await readFile(pkgPath, 'utf-8'));
+                pkg.name = options.projectName;
+                await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+            }
+            catch {
+                // package.json is always written by astroSiteFiles; ignore rename failures.
+            }
+        }
+        spinner.succeed('Astro public site created!');
+        console.log();
+        console.log(chalk.green('  Prenta Astro site is ready.'));
+        console.log();
+        console.log('  Next steps:');
+        console.log();
+        if (options.projectName !== '.') {
+            console.log(chalk.cyan(`    cd ${options.projectName}`));
+        }
+        console.log(chalk.cyan('    cp .env.example .env'));
+        console.log(chalk.dim('    # Set PRENTA_CMS_URL to your existing CMS host origin'));
+        console.log(chalk.cyan('    npm install && npm run dev'));
+        console.log();
+        console.log(chalk.dim('  Preview cookies need same-origin /api/cms — see README.'));
+        console.log(chalk.dim('  Docs: https://github.com/actuate-media/prenta/blob/main/apps/docs/content/astro-public-site.md'));
+        console.log();
+    }
+    catch (err) {
+        spinner.fail('Failed to create Astro site');
+        throw err;
+    }
+}
+export async function scaffoldProject(rawOptions) {
+    // Older programmatic callers may omit `loginPath`; treat that as the classic
+    // inline login (auth screens on the admin mount).
+    const options = {
+        ...rawOptions,
+        loginPath: rawOptions.loginPath ?? rawOptions.adminPath,
+    };
+    const root = path.resolve(process.cwd(), options.projectName);
+    if (isAstroSiteOnly(options)) {
+        await scaffoldAstroSiteOnly(options, root);
+        return;
+    }
+    const spinner = ora('Resolving latest package versions...').start();
+    try {
+        const versions = await resolvePackageVersions();
+        const resolvedCount = Object.keys(versions).length;
+        if (resolvedCount > 0) {
+            spinner.text = `Resolved ${resolvedCount} package versions from npm`;
+        }
+        else {
+            spinner.text = 'Using default versions (npm registry unreachable)';
+        }
+        const adminDir = options.adminPath.slice(1);
+        const splitLogin = isSplitLogin(options);
+        const loginDir = options.loginPath.slice(1);
+        spinner.text = 'Creating project structure...';
+        const astroSplit = isAstroSplit(options);
+        // astro-split scaffolds are pnpm workspaces: the Next CMS host lives in
+        // apps/cms, the Astro public site in apps/site, and (marketing-custom) the
+        // shared section kit in packages/sections. Flat scaffolds keep the Next
+        // app at the project root (cmsRoot === root).
+        const cmsRoot = astroSplit ? path.join(root, 'apps', 'cms') : root;
+        const sectionsPackage = astroSplit && isMarketingCustom(options)
+            ? `@${workspaceScopeName(options, root)}/sections`
+            : undefined;
+        await mkdirSafe(root);
+        await mkdirSafe(path.join(cmsRoot, 'app', '(admin)', adminDir, '[[...path]]'));
+        if (splitLogin) {
+            await mkdirSafe(path.join(cmsRoot, 'app', '(admin)', loginDir, '[[...path]]'));
+        }
+        await mkdirSafe(path.join(cmsRoot, 'app', 'api', 'cms', '[[...cms]]'));
+        if (!astroSplit) {
+            await mkdirSafe(path.join(cmsRoot, 'app', '(site)', '[[...path]]'));
+            await mkdirSafe(path.join(cmsRoot, 'app', 'sitemap.xml'));
+            await mkdirSafe(path.join(cmsRoot, 'app', 'robots.txt'));
+            await mkdirSafe(path.join(cmsRoot, 'app', 'feed.xml'));
+            await mkdirSafe(path.join(cmsRoot, 'app', 'feed.json'));
+            await mkdirSafe(path.join(cmsRoot, 'app', 'llms.txt'));
+            await mkdirSafe(path.join(cmsRoot, 'app', 'llms-full.txt'));
+        }
+        await mkdirSafe(path.join(cmsRoot, 'prisma'));
+        await mkdirSafe(path.join(cmsRoot, 'public'));
+        await mkdirSafe(path.join(cmsRoot, 'public', 'fonts'));
+        await mkdirSafe(path.join(cmsRoot, 'lib'));
+        await mkdirSafe(path.join(cmsRoot, 'scripts'));
+        await mkdirSafe(path.join(root, '.cursor'));
+        await mkdirSafe(path.join(root, '.vscode'));
+        await mkdirSafe(path.join(root, '.github', 'workflows'));
+        if (astroSplit) {
+            await mkdirSafe(path.join(root, 'apps', 'site'));
+        }
+        spinner.text = 'Writing configuration files...';
+        // Read the canonical schema once up front so the parallel write batch below
+        // stays synchronous; migrations are copied as a tree after the batch.
+        const prismaSchema = await readFile(path.join(PRISMA_ASSETS_DIR, 'schema.prisma'), 'utf-8');
+        const writes = [
+            // CMS app manifest (apps/cms in a workspace; project root otherwise).
+            writeFile(path.join(cmsRoot, 'package.json'), buildPackageJson(options, versions)),
+            // Workspace plumbing lives at the repo root.
+            ...(astroSplit
+                ? [
+                    writeFile(path.join(root, 'package.json'), buildWorkspaceRootPackageJson(options, root, sectionsPackage)),
+                    writeFile(path.join(root, 'pnpm-workspace.yaml'), buildPnpmWorkspaceYaml()),
+                ]
+                : []),
+            writeFile(path.join(root, '.npmrc'), buildNpmrc()),
+            writeFile(path.join(cmsRoot, 'scripts', 'deploy-migrate.mjs'), generateDeployMigrateScript()),
+            writeFile(path.join(cmsRoot, '.env.example'), buildEnvExample(options)),
+            writeFile(path.join(cmsRoot, 'next.config.ts'), buildNextConfig(options, sectionsPackage)),
+            writeFile(path.join(cmsRoot, 'prisma.config.ts'), buildPrismaConfig()),
+            writeFile(path.join(cmsRoot, 'tsconfig.json'), buildTsConfig()),
+            writeFile(path.join(root, '.gitignore'), buildGitignore(options)),
+            writeFile(path.join(root, '.github', 'workflows', 'ci.yml'), generateCiWorkflow(options)),
+            writeFile(path.join(root, 'renovate.json'), generateRenovateJson()),
+            writeFile(path.join(root, 'DEPLOYMENT.md'), buildDeploymentGuide(options)),
+            writeFile(path.join(cmsRoot, 'public', 'fonts', 'README.md'), generateFontsReadme()),
+            writeFile(path.join(cmsRoot, 'prisma', 'schema.prisma'), prismaSchema),
+            writeFile(path.join(cmsRoot, 'prenta.config.ts'), generatePrentaConfig(options)),
+            writeFile(path.join(cmsRoot, 'lib', 'cms.ts'), generateCmsHelper()),
+            writeFile(path.join(cmsRoot, 'lib', 'prisma.ts'), generatePrismaHelper()),
+            writeFile(path.join(cmsRoot, 'lib', 'site-settings.ts'), generateSiteSettingsHelper()),
+            writeFile(path.join(cmsRoot, 'lib', 'resolve-media.ts'), generateResolveMediaHelper()),
+            writeFile(path.join(cmsRoot, 'app', '(admin)', adminDir, '[[...path]]', 'page.tsx'), generateAdminPage({
+                sectionRenderers: isMarketingCustom(options),
+                // Workspace: import the shared kit by package name (compiled via
+                // next.config transpilePackages); flat: the local src/sections path.
+                sectionRenderersImport: sectionsPackage ? `${sectionsPackage}/register` : undefined,
+                loginPath: splitLogin ? options.loginPath : undefined,
+            })),
+            writeFile(path.join(cmsRoot, 'app', 'api', 'cms', '[[...cms]]', 'route.ts'), generateApiRoute(options)),
+            // Monolith: root SEO proxies + public catch-all. Astro-split: public SEO
+            // and pages live under apps/site; CMS host only serves admin + API.
+            ...(astroSplit
+                ? [
+                    writeFile(path.join(cmsRoot, 'app', 'page.tsx'), generateCmsHostRootPage(options)),
+                    writeFile(path.join(root, 'ASTRO.md'), generateAstroSplitReadme(options, sectionsPackage)),
+                ]
+                : [
+                    writeFile(path.join(cmsRoot, 'app', 'sitemap.xml', 'route.ts'), generateSitemapRoute()),
+                    writeFile(path.join(cmsRoot, 'app', 'robots.txt', 'route.ts'), generateRobotsRoute()),
+                    writeFile(path.join(cmsRoot, 'app', 'feed.xml', 'route.ts'), generateFeedRoute('xml')),
+                    writeFile(path.join(cmsRoot, 'app', 'feed.json', 'route.ts'), generateFeedRoute('json')),
+                    writeFile(path.join(cmsRoot, 'app', 'llms.txt', 'route.ts'), generateLlmsRoute('llms.txt')),
+                    writeFile(path.join(cmsRoot, 'app', 'llms-full.txt', 'route.ts'), generateLlmsRoute('llms-full.txt')),
+                    writeFile(path.join(cmsRoot, 'app', '(site)', 'layout.tsx'), generateSiteLayout(options)),
+                    writeFile(path.join(cmsRoot, 'app', '(site)', '[[...path]]', 'page.tsx'), generateCatchAllPage()),
+                    writeFile(path.join(cmsRoot, 'app', '(site)', 'globals.css'), generateGlobalsCss()),
+                ]),
+            writeFile(path.join(cmsRoot, 'proxy.ts'), generateProxy(options.adminPath, splitLogin ? options.loginPath : undefined)),
+            writeFile(path.join(cmsRoot, 'app', 'layout.tsx'), generateRootLayout()),
+            writeFile(path.join(cmsRoot, 'postcss.config.mjs'), generatePostcssConfig()),
+            writeFile(path.join(cmsRoot, 'app', '(admin)', adminDir, 'admin.css'), generateAdminLayoutCss()),
+            writeFile(path.join(cmsRoot, 'app', '(admin)', adminDir, 'layout.tsx'), generateAdminLayout()),
+            ...(splitLogin
+                ? [
+                    writeFile(path.join(cmsRoot, 'app', '(admin)', loginDir, '[[...path]]', 'page.tsx'), generateLoginPage({ loginPath: options.loginPath, adminPath: options.adminPath })),
+                    writeFile(path.join(cmsRoot, 'app', '(admin)', loginDir, 'admin.css'), generateAdminLayoutCss()),
+                    writeFile(path.join(cmsRoot, 'app', '(admin)', loginDir, 'layout.tsx'), generateAdminLayout()),
+                ]
+                : []),
+            writeFile(path.join(root, '.cursor', 'mcp.json'), generateCursorMcpJson()),
+            writeFile(path.join(root, '.vscode', 'mcp.json'), generateVscodeMcpJson()),
+            ...(options.plugins.includes('consent')
+                ? [
+                    (async () => {
+                        const consentDir = path.join(cmsRoot, 'src', 'consent');
+                        await mkdirSafe(consentDir);
+                        await writeFile(path.join(consentDir, 'config.ts'), generateConsentConfig());
+                    })(),
+                ]
+                : []),
+        ];
+        if (options.platform === 'vercel') {
+            writes.push(writeFile(path.join(cmsRoot, 'vercel.json'), buildVercelJson(options)));
+        }
+        await Promise.all(writes);
+        // Ship the canonical migration history so `prisma migrate deploy` (run in
+        // the build) actually creates the `prenta_*` tables. Without this the
+        // build applies nothing and the client gets an empty database.
+        await cp(path.join(PRISMA_ASSETS_DIR, 'migrations'), path.join(cmsRoot, 'prisma', 'migrations'), { recursive: true });
+        // Marketing-custom template: emit the section schema/renderer/blocks/verify
+        // files. Workspace scaffolds put the kit in packages/sections (keys are
+        // project-root-relative in both shapes); create parent dirs, then write.
+        if (isMarketingCustom(options)) {
+            spinner.text = 'Writing marketing-custom section files...';
+            const extraFiles = sectionsPackage
+                ? workspaceSectionKitFiles({ packageName: sectionsPackage, versions })
+                : marketingCustomFiles();
+            await Promise.all(Object.entries(extraFiles).map(async ([relPath, contents]) => {
+                const dest = path.join(root, ...relPath.split('/'));
+                await mkdirSafe(path.dirname(dest));
+                await writeFile(dest, contents);
+            }));
+        }
+        if (astroSplit) {
+            spinner.text = 'Writing Astro public site (apps/site)...';
+            const siteFiles = astroSiteFiles({
+                cmsUrlExample: 'http://localhost:3000',
+                packageName: 'site',
+                sectionsPackage,
+                adminPath: options.adminPath,
+                loginPath: options.loginPath,
+            });
+            await Promise.all(Object.entries(siteFiles).map(async ([relPath, contents]) => {
+                const dest = path.join(root, 'apps', 'site', ...relPath.split('/'));
+                await mkdirSafe(path.dirname(dest));
+                await writeFile(dest, contents);
+            }));
+        }
+        spinner.succeed('Project created successfully!');
+        console.log();
+        console.log(chalk.green('  Your Prenta CMS project is ready!'));
+        console.log();
+        console.log('  Next steps:');
+        console.log();
+        console.log(chalk.cyan(`    cd ${options.projectName}`));
+        if (astroSplit) {
+            console.log(chalk.cyan('    pnpm install'));
+            console.log(chalk.cyan('    cp apps/cms/.env.example apps/cms/.env'));
+            console.log(chalk.dim('    # Edit with your database URL and secrets'));
+            console.log(chalk.cyan('    cp apps/site/.env.example apps/site/.env'));
+            console.log(chalk.dim('    # PRENTA_CMS_URL=http://localhost:3000'));
+            console.log(chalk.cyan('    pnpm --filter cms exec prisma migrate deploy'));
+            console.log(chalk.dim('    # applies the bundled Prenta CMS migrations to your database'));
+            console.log(chalk.cyan('    pnpm dev'));
+            console.log(chalk.dim('    # both apps (or pnpm dev:cms / pnpm dev:site)'));
+            console.log();
+            console.log(chalk.dim('  See ASTRO.md for routing, the section kit, and purge-on-publish.'));
+        }
+        else {
+            console.log(chalk.cyan('    cp .env.example .env'));
+            console.log(chalk.dim('    # Edit .env with your database URL and secrets'));
+            console.log(chalk.cyan('    npm install'));
+            console.log(chalk.cyan('    npx prisma migrate deploy'));
+            console.log(chalk.dim('    # applies the bundled Prenta CMS migrations to your database'));
+            console.log(chalk.cyan('    npm run dev'));
+        }
+        console.log();
+        console.log(chalk.dim('  Then visit'), chalk.cyan(`http://localhost:3000${options.loginPath}`));
+        console.log(chalk.dim('  to create your admin account via the setup wizard.'));
+        if (splitLogin) {
+            console.log(chalk.dim('  Sign-in lives at'), chalk.cyan(options.loginPath), chalk.dim('— the admin app at'), chalk.cyan(options.adminPath), chalk.dim('shows a 404 when signed out.'));
+        }
+        console.log();
+        console.log('  Connect an AI agent (optional):');
+        console.log();
+        console.log(chalk.dim('    1.'), `Create an API key in Admin → API Keys (Content preset).`);
+        console.log(chalk.dim('    2.'), `Paste it into`, chalk.cyan('.cursor/mcp.json'), chalk.dim('(Cursor / Claude Desktop) or'), chalk.cyan('.vscode/mcp.json'), chalk.dim('(VS Code) as PRENTA_API_KEY.'));
+        console.log(chalk.dim('    3.'), `Restart your editor — Prenta MCP tools + the authoring guide appear automatically.`);
+        console.log(chalk.dim('    Both files are git-ignored so your key is never committed.'));
+        console.log();
+        console.log(chalk.dim('  For deployment instructions, see'), chalk.cyan('DEPLOYMENT.md'));
+        console.log();
+        console.log(chalk.dim('  Admin path:'), options.adminPath);
+        console.log(chalk.dim('  Login path:'), options.loginPath);
+        console.log(chalk.dim('  Plugins:'), options.plugins.join(', ') || 'none');
+        console.log(chalk.dim('  Platform:'), options.platform);
+        console.log(chalk.dim('  Database:'), options.database);
+        console.log(chalk.dim('  Auth:'), options.authProviders.join(', '));
+        console.log();
+    }
+    catch (err) {
+        spinner.fail('Failed to create project');
+        throw err;
+    }
+}
+function generateFontsReadme() {
+    return `# Custom fonts
+
+Place licensed \`.woff2\` files here, then:
+
+1. Uncomment the \`@font-face\` rules in \`app/(site)/globals.css\`.
+2. Uncomment the \`<link rel="preload">\` hints in \`app/(site)/layout.tsx\`.
+3. Keep \`font-display: swap\` and preload only the weights you use above the fold.
+
+Recommended filenames:
+
+- \`display.woff2\` — headings (600–700)
+- \`body.woff2\` — body copy (400–500)
+
+Self-hosted fonts avoid third-party latency and keep LCP predictable.
+`;
+}
+function generateApiRoute(options) {
+    const cacheBlock = options.platform === 'vercel'
+        ? `import { getCache, invalidateByTag } from '@vercel/functions';
+import { revalidateTag } from 'next/cache';
+import { getPrisma } from '../../../../lib/prisma';
+import config from '../../../../prenta.config';
+import { handlePrentaAPI } from '@prenta/core/api';
+import { assertServingOriginConfigured } from '@prenta/core';
+
+// Launch Gate E — fail loud when NEXT_PUBLIC_SITE_URL is unset in production
+// (siteUrlFromRequest would otherwise fall back to the request host).
+assertServingOriginConfigured({
+  siteUrl: process.env.NEXT_PUBLIC_SITE_URL ?? config.seo?.siteUrl,
+  strict:
+    process.env.NODE_ENV === 'production' || process.env.VERCEL_ENV === 'production',
+});
+
+/**
+ * Tag-based caching for public CMS reads + on-demand invalidation after writes.
+ * See https://prentacms.dev/docs/caching — mirrors apps/dev production wiring.
+ */
+const handler = handlePrentaAPI({
+  prismaClient: getPrisma(),
+  config: {
+    ...config,
+    cache: {
+      publicReads: {
+        enabled: true,
+        maxAge: 60,
+        staleWhileRevalidate: 300,
+      },
+      runtimeCache: {
+        adapter: getCache(),
+        ttl: 60,
+      },
+      onInvalidate: async (tags: string[]) => {
+        for (const tag of tags) revalidateTag(tag, 'default');
+        try {
+          await invalidateByTag(tags);
+        } catch (err) {
+          console.warn('[prenta][cache] invalidateByTag unavailable:', err);
+        }
+      },
+    },
+  },
+});`
+        : `import { revalidateTag } from 'next/cache';
+import { getPrisma } from '../../../../lib/prisma';
+import config from '../../../../prenta.config';
+import { handlePrentaAPI } from '@prenta/core/api';
+import { assertServingOriginConfigured } from '@prenta/core';
+
+assertServingOriginConfigured({
+  siteUrl: process.env.NEXT_PUBLIC_SITE_URL ?? config.seo?.siteUrl,
+  strict:
+    process.env.NODE_ENV === 'production' || process.env.VERCEL_ENV === 'production',
+});
+
+/** CDN/runtime cache wiring is Vercel-specific; still drain Next ISR on writes. */
+const handler = handlePrentaAPI({
+  prismaClient: getPrisma(),
+  config: {
+    ...config,
+    cache: {
+      publicReads: { enabled: true, maxAge: 60, staleWhileRevalidate: 300 },
+      onInvalidate: async (tags: string[]) => {
+        for (const tag of tags) revalidateTag(tag, 'default');
+      },
+    },
+  },
+});`;
+    return `${cacheBlock}
+
+export const GET = handler;
+export const POST = handler;
+export const PUT = handler;
+export const PATCH = handler;
+export const DELETE = handler;
+`;
+}
+function generateSitemapRoute() {
+    // Root /sitemap.xml proxies the cms-core sitemap index so the public domain
+    // serves a canonical sitemap URL (cms-core's robots.txt advertises this
+    // path). cms-core (+ plugin-seo) is the single source of truth; this route
+    // only forwards and preserves caching headers.
+    return `import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: Request): Promise<NextResponse> {
+  const origin = new URL(request.url).origin;
+  try {
+    const res = await fetch(\`\${origin}/api/cms/sitemap.xml\`, {
+      headers: { accept: 'application/xml' },
+      cache: 'no-store',
+    });
+    if (!res.ok) {
+      return new NextResponse('Sitemap unavailable', { status: res.status });
+    }
+    const xml = await res.text();
+    return new NextResponse(xml, {
+      status: 200,
+      headers: {
+        'Content-Type': 'application/xml; charset=utf-8',
+        'Cache-Control': 'public, max-age=300, s-maxage=600',
+      },
+    });
+  } catch {
+    return new NextResponse('Sitemap unavailable', { status: 502 });
+  }
+}
+`;
+}
+function generateFeedRoute(kind) {
+    // Root /feed.xml + /feed.json proxy the cms-core content feeds. cms-core is
+    // the single source of truth; this route only forwards and preserves caching.
+    const contentType = kind === 'xml' ? 'application/rss+xml; charset=utf-8' : 'application/feed+json; charset=utf-8';
+    const accept = kind === 'xml' ? 'application/rss+xml' : 'application/feed+json';
+    return `import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: Request): Promise<NextResponse> {
+  const origin = new URL(request.url).origin;
+  try {
+    const res = await fetch(\`\${origin}/api/cms/feed.${kind}\`, {
+      headers: { accept: '${accept}' },
+      cache: 'no-store',
+    });
+    if (!res.ok) {
+      return new NextResponse('Feed unavailable', { status: res.status });
+    }
+    const body = await res.text();
+    return new NextResponse(body, {
+      status: 200,
+      headers: {
+        'Content-Type': '${contentType}',
+        'Cache-Control': 'public, max-age=300, s-maxage=600',
+      },
+    });
+  } catch {
+    return new NextResponse('Feed unavailable', { status: 502 });
+  }
+}
+`;
+}
+function generateRobotsRoute() {
+    // Root /robots.txt proxies the cms-core robots route (which honours the
+    // admin-edited custom robots.txt body / generated defaults). Single source of
+    // truth lives in cms-core; this route only forwards.
+    return `import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: Request): Promise<NextResponse> {
+  const origin = new URL(request.url).origin;
+  try {
+    const res = await fetch(\`\${origin}/api/cms/robots.txt\`, {
+      headers: { accept: 'text/plain' },
+      cache: 'no-store',
+    });
+    if (!res.ok) {
+      return new NextResponse('robots.txt unavailable', { status: res.status });
+    }
+    const body = await res.text();
+    return new NextResponse(body, {
+      status: 200,
+      headers: {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'public, max-age=3600, s-maxage=3600',
+      },
+    });
+  } catch {
+    return new NextResponse('robots.txt unavailable', { status: 502 });
+  }
+}
+`;
+}
+function generateLlmsRoute(file) {
+    // Root /llms.txt (+ optional /llms-full.txt) proxy the cms-core routes.
+    // cms-core is the single source of truth (curation, eligibility, sanitization,
+    // noindex header); this route only forwards and preserves the noindex header
+    // so the file itself is never indexed.
+    return `import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function GET(request: Request): Promise<NextResponse> {
+  const origin = new URL(request.url).origin;
+  try {
+    const res = await fetch(\`\${origin}/api/cms/${file}\`, {
+      headers: { accept: 'text/plain' },
+      cache: 'no-store',
+    });
+    if (!res.ok) {
+      return new NextResponse('${file} unavailable', { status: res.status });
+    }
+    const body = await res.text();
+    return new NextResponse(body, {
+      status: 200,
+      headers: {
+        'Content-Type': 'text/plain; charset=utf-8',
+        'Cache-Control': 'public, max-age=3600, s-maxage=3600',
+        'X-Robots-Tag': 'noindex',
+      },
+    });
+  } catch {
+    return new NextResponse('${file} unavailable', { status: 502 });
+  }
+}
+`;
+}
+/** Minimal CMS-host landing when the public site is Astro (`astro-split`). */
+function generateCmsHostRootPage(options) {
+    const admin = options.adminPath;
+    const login = options.loginPath;
+    return `export default function CmsHostHome() {
+  return (
+    <main style={{ fontFamily: 'system-ui', maxWidth: 40 + 'rem', margin: '3rem auto', padding: '0 1rem' }}>
+      <h1>Prenta CMS host</h1>
+      <p>
+        This deploy serves the admin app and <code>/api/cms</code>. The public site is the Astro
+        app in <code>apps/site</code>.
+      </p>
+      <ul>
+        <li>
+          <a href="${login}">Sign in / setup</a> ({login})
+        </li>
+        <li>
+          <a href="${admin}">Admin</a> ({admin})
+        </li>
+      </ul>
+      <p>
+        See <code>ASTRO.md</code> for split-deploy routing.
+      </p>
+    </main>
+  );
+}
+`;
+}
+function generateAstroSplitReadme(options, sectionsPackage) {
+    const kitRow = sectionsPackage
+        ? `\n| \`packages/sections\` | Shared section kit (\`${sectionsPackage}\`) — schema + ONE renderer map for both apps |`
+        : '';
+    const kitSection = sectionsPackage
+        ? `
+## Section kit (three-layer contract)
+
+Custom sections live in **one** workspace package so the schema, the admin
+editor canvas, and the public site can never drift:
+
+1. **Schema** — \`packages/sections/src/types.ts\`, imported by
+   \`apps/cms/prenta.config.ts\` (\`sections.types\`) so editors can author the
+   sections.
+2. **Renderers** — \`packages/sections/src/register.tsx\` exports ONE
+   \`sectionRenderers\` map. \`apps/cms\` passes it to
+   \`<AdminRoot sectionRenderers>\` (designed previews in the editor canvas);
+   \`apps/site\` imports \`${sectionsPackage}/register\` as a side effect in
+   \`PageSections.tsx\` (public rendering via \`<Sections>\`).
+3. **Verification** — \`pnpm verify:sections\` (schema ↔ renderer ids) and
+   \`pnpm test:parity\` (canvas ↔ public render trees); both run in CI
+   fails when a schema id has no renderer or vice versa.
+
+See \`SECTIONS.md\` for the add-a-section workflow (and the bundled
+\`.cursor/skills/prenta-add-section\` agent skill).
+`
+        : '';
+    const loginRewrite = options.loginPath !== options.adminPath ? `, \`${options.loginPath}/*\`` : '';
+    return `# Astro split deploy (pnpm workspace)
+
+This project was scaffolded with \`--framework astro-split\`:
+
+| Path | Role |
+|------|------|
+| \`apps/cms\` | Next CMS host — admin (${options.adminPath}), API (\`/api/cms\`), cron |
+| \`apps/site\` | Astro public site — pages, SEO proxies, section rendering |${kitRow}
+
+## Local development
+
+\`\`\`bash
+pnpm install                               # once, at the workspace root
+
+cp apps/cms/.env.example apps/cms/.env     # DATABASE_URL, CMS_SECRET, …
+# NEXT_PUBLIC_SITE_URL must be the Astro apex (default http://localhost:4321), not :3000
+cp apps/site/.env.example apps/site/.env
+# PRENTA_CMS_URL=http://localhost:3000    ← CMS API host
+# SITE=http://localhost:4321               ← public apex (matches NEXT_PUBLIC_SITE_URL)
+
+pnpm --filter cms exec prisma migrate deploy   # apply the bundled CMS migrations
+pnpm dev                                   # both apps (or: pnpm dev:cms / pnpm dev:site)
+\`\`\`
+
+## Two URLs (do not conflate)
+
+| Variable | Where | Meaning |
+|----------|-------|---------|
+| \`NEXT_PUBLIC_SITE_URL\` / \`seo.siteUrl\` | \`apps/cms\` | **Public** apex (Astro) — View live, sitemap, OG |
+| \`PRENTA_CMS_URL\` | \`apps/site\` | CMS API origin (admin + \`/api/cms\`) |
+
+If View live opens the Next CMS host, fix **Admin → Settings → General → Site URL** (or \`NEXT_PUBLIC_SITE_URL\`) to the Astro origin.
+${kitSection}
+## Publish freshness (purge-on-publish)
+
+Published pages serve **cache-static** from the CDN edge
+(\`Cache-Control: public, s-maxage=3600, stale-while-revalidate=86400\`) and are
+evicted the moment an editor publishes:
+
+1. Deploy \`apps/site\`, then in the CMS admin go to **Settings → Webhooks** and
+   add an endpoint for \`https://<public apex>/api/prenta/purge\` (it subscribes
+   to the publish lifecycle by default).
+2. Copy the endpoint's signing secret into \`PRENTA_WEBHOOK_SECRET\` on the
+   Astro deploy.
+3. Optional: add CDN purge credentials (Cloudflare zone purge or a Vercel
+   deploy hook) and/or Upstash Redis as a layer-2 runtime cache — see
+   \`apps/site/.env.example\`. Without CDN credentials the endpoint still drains
+   the runtime cache, so staleness is bounded by the CDN TTL.
+
+## Production routing (same-apex default)
+
+\`apps/site/vercel.json\` ships the same-apex rewrites as the **default**:
+
+- \`/api/cms/*\`, \`${options.adminPath}/*\`${loginRewrite} → CMS host
+- everything else → Astro
+
+**Before going live**, replace \`CMS_HOST_ORIGIN\` in \`apps/site/vercel.json\`
+with the deployed CMS host origin (or configure the same rules at your CDN),
+and set \`PRENTA_CMS_URL\` on the Astro project to the **public apex** so draft
+preview cookies stay same-origin.
+
+## Deploy (Vercel)
+
+Create **two projects** from this repository:
+
+| Project | Root Directory | Notes |
+|---------|----------------|-------|
+| CMS host | \`apps/cms\` | database, cron, \`NEXT_PUBLIC_SITE_URL\` = public apex |
+| Public site | \`apps/site\` | \`PRENTA_CMS_URL\`, \`PRENTA_WEBHOOK_SECRET\`, apex domain |
+
+Then finish the purge webhook setup above. See \`DEPLOYMENT.md\` for the full
+CMS-host checklist (env vars, migrations, seeding, SEO).
+`;
+}
+function generateRootLayout() {
+    return `export default function RootLayout({
+  children,
+}: {
+  children: React.ReactNode;
+}) {
+  return children;
+}
+`;
+}
+function generateCatchAllPage() {
+    // Canonical content contract (ADR 0001): the public site renders the ordered
+    // PageSection[] stored at `data.sections` with <Sections> from
+    // @prenta/sections-react. Author-supplied rich text is sanitized
+    // through cms-core's allow-list (`sanitizeHtml`) before it reaches the DOM.
+    return `import { notFound } from 'next/navigation';
+import type { Metadata } from 'next';
+import Image from 'next/image';
+import { headers } from 'next/headers';
+import { sanitizeHtml } from '@prenta/core';
+import { recordPublic404 } from '@prenta/core/site';
+import { collectFormSlugsFromSections, prefetchPublicForms } from '@prenta/core';
+import { coercePostHeader } from '@prenta/core/page-sections';
+import {
+  PostHeader,
+  Sections,
+  createLcpController,
+  type PostContext,
+  type PublicSection,
+  type RenderImage,
+} from '@prenta/sections-react';
+import { getAdminPath } from '@prenta/core/next';
+import {
+  getCachedPageMetadata,
+  getCachedPublishedDocument,
+  getPublicForm,
+  resolveDocument,
+} from '@/lib/cms';
+import { getSiteSettings } from '@/lib/site-settings';
+
+export const revalidate = 300;
+
+interface PageProps {
+  params: Promise<{ path?: string[] }>;
+  searchParams: Promise<{ preview?: string }>;
+}
+
+const ADMIN_PATH = getAdminPath();
+
+// The site catch-all lives in the (site) route group; the admin SPA lives in
+// (admin). Next route precedence usually keeps them separate, but guard here so
+// a request under the admin base is never resolved as CMS content.
+function isAdminPath(p: string): boolean {
+  const base = ADMIN_PATH.endsWith('/') ? ADMIN_PATH.slice(0, -1) : ADMIN_PATH;
+  return p === base || p.startsWith(\`\${base}/\`);
+}
+
+// Render CMS images through next/image for responsive srcset + optimization.
+// The /resolve endpoint enriches section images with intrinsic width/height
+// from the media library; when present we hand them to next/image, otherwise
+// we fall back to a fluid lazy <img> (next/image requires dimensions).
+const renderCmsImage: RenderImage = ({ src, alt, width, height, className, priority, sizes }) => {
+  if (!src) return null;
+  if (typeof width === 'number' && typeof height === 'number') {
+    return (
+      <Image
+        src={src}
+        alt={alt}
+        width={width}
+        height={height}
+        className={className}
+        priority={priority}
+        sizes={sizes ?? '100vw'}
+      />
+    );
+  }
+  // eslint-disable-next-line @next/next/no-img-element
+  return (
+    <img
+      src={src}
+      alt={alt}
+      loading={priority ? 'eager' : 'lazy'}
+      fetchPriority={priority ? 'high' : undefined}
+      decoding="async"
+      sizes={sizes}
+      className={className}
+    />
+  );
+};
+
+// sanitizeHtml + renderImage are stable; the LCP controller is created
+// per-request inside the page so each render gets exactly one priority image.
+const renderOptions = { sanitizeHtml, renderImage: renderCmsImage };
+
+function asUrl(value: unknown): string {
+  if (typeof value === 'string') return value;
+  if (value && typeof value === 'object' && 'url' in value) {
+    const u = (value as { url?: unknown }).url;
+    return typeof u === 'string' ? u : '';
+  }
+  return '';
+}
+
+function asSections(value: unknown): PublicSection[] {
+  return Array.isArray(value) ? (value as PublicSection[]) : [];
+}
+
+async function reportPublic404(urlPath: string): Promise<void> {
+  const siteUrl = process.env.NEXT_PUBLIC_SITE_URL?.trim();
+  let apiBase: string | null = null;
+  if (siteUrl) {
+    try {
+      apiBase = \`\${new URL(siteUrl).origin}/api/cms\`;
+    } catch {
+      apiBase = null;
+    }
+  }
+  if (!apiBase) {
+    const h = await headers();
+    const host = h.get('host');
+    if (!host) return;
+    const proto = h.get('x-forwarded-proto') ?? 'https';
+    apiBase = \`\${proto}://\${host}/api/cms\`;
+  }
+  recordPublic404(apiBase, urlPath);
+}
+
+export async function generateMetadata({ params }: PageProps): Promise<Metadata> {
+  const { path } = await params;
+  const urlPath = path && path.length ? \`/\${path.join('/')}\` : '/';
+  if (isAdminPath(urlPath)) return {};
+  const result = await getCachedPageMetadata(urlPath);
+  // cms-core composes a Next.js-compatible metadata object server-side, so we
+  // can spread it directly instead of re-deriving OG/Twitter/robots tags.
+  return result;
+}
+
+export default async function CatchAllPage({ params, searchParams }: PageProps) {
+  const { path } = await params;
+  // Editors arrive with \`?preview=<signed token>\` (admin "View on site" /
+  // inline site preview). Forwarding it to /resolve renders the draft at its
+  // real URL; without a valid token only PUBLISHED content resolves.
+  const { preview } = await searchParams;
+  const urlPath = path && path.length ? \`/\${path.join('/')}\` : '/';
+  if (isAdminPath(urlPath)) notFound();
+  const [result, siteSettings] = await Promise.all([
+    preview ? resolveDocument(urlPath, preview) : getCachedPublishedDocument(urlPath),
+    getSiteSettings(),
+  ]);
+
+  if (!result?.data) {
+    if (urlPath === '/') {
+      return (
+        <main className="flex min-h-screen flex-col items-center justify-center p-8 text-center">
+          <h1 className="mb-4 text-4xl font-bold">{siteSettings?.siteName ?? 'Welcome'}</h1>
+          <p className="mb-8 text-lg text-gray-600">
+            Your site is running. Create a page with slug &quot;home&quot; in the CMS to replace this message.
+          </p>
+        </main>
+      );
+    }
+    if (!preview) void reportPublic404(urlPath);
+    notFound();
+  }
+
+  const doc = result.data;
+  const data = (doc.data ?? {}) as Record<string, unknown>;
+  const isPage = doc.collection === 'pages';
+
+  const sections = asSections(data.sections);
+  const str = (key: string) => (typeof data[key] === 'string' ? (data[key] as string) : '');
+
+  const formSlugs = collectFormSlugsFromSections(sections);
+  const prefetchedForms =
+    formSlugs.length > 0 ? await prefetchPublicForms(getPublicForm, formSlugs) : {};
+
+  const ctx: PostContext = {
+    title: str('title'),
+    excerpt: str('excerpt'),
+    body: str('body'),
+    // Prefer the resolver's featured image (carries intrinsic width/height from
+    // the media library) so the post header renders a CLS-free, dimensioned LCP
+    // image; fall back to the raw field URL.
+    featuredImageUrl: result.post?.featuredImage?.url ?? asUrl(data.featuredImage),
+    featuredImageWidth: result.post?.featuredImage?.width,
+    featuredImageHeight: result.post?.featuredImage?.height,
+    publishDate: str('publishDate') || null,
+    category: str('category'),
+    author: result.post?.author ?? undefined,
+    relatedPosts: result.post?.relatedPosts ?? [],
+  };
+
+  // One LCP budget shared by the post header + body sections so only the first
+  // image on the page is eager/high-priority; everything else lazy-loads.
+  const lcp = createLcpController();
+  const pageOptions = { ...renderOptions, lcp, prefetchedForms };
+
+  return (
+    <main className="min-h-screen bg-white">
+      {result.jsonLd ? (
+        <script
+          type="application/ld+json"
+          dangerouslySetInnerHTML={{
+            __html: JSON.stringify(result.jsonLd).replace(/</g, '\\u003c'),
+          }}
+        />
+      ) : null}
+      {result.preview?.active && (
+        <div className="bg-amber-100 px-4 py-2 text-center text-sm text-amber-900">
+          Preview mode — you are viewing a draft. This page is not publicly visible.
+        </div>
+      )}
+      {/* Posts render a design-driven header from their post-type template;
+          pages render their own hero section instead. */}
+      {!isPage && (
+        <PostHeader
+          config={coercePostHeader(result.template?.header)}
+          ctx={ctx}
+          options={pageOptions}
+        />
+      )}
+
+      {sections.length ? (
+        <Sections sections={sections} ctx={ctx} options={pageOptions} />
+      ) : (
+        <div className="mx-auto max-w-2xl px-6 py-24 text-center text-gray-400">
+          This document has no sections yet.
+        </div>
+      )}
+    </main>
+  );
+}
+`;
+}
+function generateProxy(adminPath, loginPath) {
+    // Skip the public-route redirect engine for both CMS mounts. The auth/IP
+    // guard itself comes from `createCMSMiddleware(cmsConfig)`, which reads
+    // `admin.path` and `admin.loginPath` from the config.
+    const cmsMountCheck = loginPath
+        ? `pathname.startsWith('${adminPath}') || pathname.startsWith('${loginPath}')`
+        : `pathname.startsWith('${adminPath}')`;
+    const adminPathsLiteral = loginPath ? `['${adminPath}', '${loginPath}']` : `['${adminPath}']`;
+    return `import { createCMSMiddleware } from '@prenta/core/middleware';
+import { applyPublicRedirect } from '@prenta/core/site';
+import { NextResponse, type NextRequest } from 'next/server';
+import cmsConfig from './prenta.config';
+
+const cmsMiddleware = createCMSMiddleware(cmsConfig);
+
+function toNextRedirect(response: Response): Response {
+  if (response.status === 410) return new NextResponse('Gone', { status: 410 });
+  const location = response.headers.get('Location');
+  if (!location) return response;
+  const status = [301, 302, 307, 308].includes(response.status) ? response.status : 301;
+  return NextResponse.redirect(location, status as 301 | 302 | 307 | 308);
+}
+
+export async function proxy(request: NextRequest) {
+  const { pathname, origin } = request.nextUrl;
+
+  // Admin + API guard (auth, IP allowlist).
+  const result = await cmsMiddleware(request);
+  if (result) return result;
+
+  const isAdmin = ${cmsMountCheck};
+  const isApi = pathname.startsWith('/api');
+
+  // Yoast-style public sitemap URLs at site root (post-sitemap.xml,
+  // post-sitemap2.xml, …) and browser XSLT stylesheets. Rewrites to the
+  // cms-core handler; /sitemap.xml is handled by app/sitemap.xml/route.ts.
+  if (
+    !isAdmin &&
+    !isApi &&
+    (request.method === 'GET' || request.method === 'HEAD') &&
+    new RegExp('^/(?:[a-z0-9-]+-sitemap\\\\d*\\\\.xml|sitemap-index\\\\.xsl|sitemap\\\\.xsl)$', 'i').test(pathname)
+  ) {
+    const target = pathname.endsWith('.xsl')
+      ? new URL(\`/api/cms\${pathname}\`, origin)
+      : new URL(\`/api/cms/sitemaps\${pathname}\`, origin);
+    return NextResponse.rewrite(target);
+  }
+
+  // Per-page Markdown: rewrite /{path}.md -> the cms-core md route so agents can
+  // fetch clean Markdown of any published page. The route serves noindex and the
+  // URLs are never in the sitemap, so the HTML page stays canonical.
+  if (
+    !isAdmin &&
+    !isApi &&
+    pathname.endsWith('.md') &&
+    (request.method === 'GET' || request.method === 'HEAD')
+  ) {
+    const docPath = pathname.slice(0, -3) || '/';
+    const rewriteUrl = new URL('/api/cms/md', origin);
+    rewriteUrl.searchParams.set('path', docPath);
+    return NextResponse.rewrite(rewriteUrl);
+  }
+
+  // SEO redirects — shared engine (chain collapse, preserveQuery, record-hit).
+  // Same helper Astro split-deploy sites use via createAstroRedirectMiddleware.
+  if (!isAdmin && !isApi) {
+    const redirect = await applyPublicRedirect(request, {
+      baseUrl: origin,
+      adminPaths: ${adminPathsLiteral},
+    });
+    if (redirect) return toNextRedirect(redirect);
+  }
+
+  const requestHeaders = new Headers(request.headers);
+  requestHeaders.set('x-prenta-pathname', pathname);
+  // Editors preview drafts via \`?preview=<token>\`. Flag those requests so the
+  // layout can skip script tags marked "disable in preview" (analytics/pixels
+  // shouldn't fire while editing).
+  if (request.nextUrl.searchParams.has('preview')) {
+    requestHeaders.set('x-prenta-preview', '1');
+  }
+  return NextResponse.next({ request: { headers: requestHeaders } });
+}
+
+export const config = {
+  // Admin + API for the auth guard, plus all public routes for redirects
+  // (excluding Next internals and static files). The \`(?!md$)\` exception lets
+  // \`/{path}.md\` requests through; a dedicated matcher re-admits legacy
+  // content-page extensions (.html/.php/.aspx/.jsp/.cfm) so migrated URLs like
+  // /products.html can still be redirected. Additional matchers expose
+  // Yoast-style \`*-sitemap*.xml\` and XSL stylesheets at the site root.
+  matcher: [
+    '/((?!_next/|.*\\\\.(?!md$)[a-zA-Z0-9]+$).*)',
+    '/((?!_next/|api/).*\\\\.(?:html?|php|aspx?|jsp|cfm)$)',
+    '/((?:[a-z0-9-]+-sitemap\\\\d*)\\\\.xml)',
+    '/sitemap.xsl',
+    '/sitemap-index.xsl',
+  ],
+};
+`;
+}
+//# sourceMappingURL=scaffold.js.map