create-prenta 1.3.0

package/dist/templates/astro-site.js

@@ -0,0 +1,918 @@
+/**
+ * Astro public-site files for `create-prenta --framework astro-split`
+ * and the `examples/astro-site` reference.
+ *
+ * Keys are POSIX paths relative to the Astro app root (`site/` in a split
+ * scaffold, or the example package root).
+ */
+export function astroSiteFiles(opts) {
+    const cmsExample = opts.cmsUrlExample ?? 'http://localhost:3000';
+    const sectionsPackage = opts.sectionsPackage;
+    const adminPath = opts.adminPath ?? '/admin';
+    const loginPath = opts.loginPath ?? '/securelogin';
+    return {
+        'package.json': JSON.stringify({
+            name: opts.packageName ?? 'prenta-astro-site',
+            private: true,
+            type: 'module',
+            scripts: {
+                dev: 'astro dev',
+                build: 'astro build',
+                preview: 'astro preview',
+                ...(sectionsPackage
+                    ? { 'verify:sections': 'node ../../packages/sections/scripts/verify-sections.mjs' }
+                    : {}),
+            },
+            dependencies: {
+                '@prenta/core': 'latest',
+                '@prenta/sections-react': 'latest',
+                ...(sectionsPackage ? { [sectionsPackage]: 'workspace:*' } : {}),
+                '@astrojs/react': '^6.0.0',
+                '@astrojs/vercel': '^11.0.0',
+                astro: '^7.1.0',
+                react: '^19.0.0',
+                'react-dom': '^19.0.0',
+            },
+            devDependencies: {
+                '@types/react': '^19.0.0',
+                '@types/react-dom': '^19.0.0',
+                typescript: '^5.7.0',
+            },
+            engines: {
+                node: '>=22.12.0',
+            },
+        }, null, 2),
+        'astro.config.mjs': `import { defineConfig } from 'astro/config';
+import react from '@astrojs/react';
+import vercel from '@astrojs/vercel';
+
+/**
+ * Prenta Astro public site — talks to a separate CMS host via PRENTA_CMS_URL.
+ * Requires Node.js 22.12+ (Astro 7).
+ *
+ * Hybrid rendering: \`output: 'server'\` keeps CMS catch-alls on-demand.
+ * Code-owned/static pages should set \`export const prerender = true\`
+ * (see \`src/pages/404.astro\`).
+ *
+ * @see https://docs.prentacms.com/astro-public-site
+ */
+export default defineConfig({
+  output: 'server',
+  adapter: vercel(),
+  integrations: [react()],
+});
+`,
+        'tsconfig.json': JSON.stringify({
+            extends: 'astro/tsconfigs/strict',
+            compilerOptions: {
+                jsx: 'react-jsx',
+                baseUrl: '.',
+                paths: { '@/*': ['src/*'] },
+            },
+        }, null, 2),
+        '.env.example': `# Public site origin (Astro) — must match CMS NEXT_PUBLIC_SITE_URL
+SITE=http://localhost:4321
+
+# Optional brand signals for site-identity JSON-LD (Organization / WebSite)
+# PUBLIC_SITE_NAME=Example
+# PUBLIC_SITE_LOGO=https://cdn.example.com/logo.webp
+
+# CMS host origin (Next/Node Prenta API + admin) — no trailing slash
+PRENTA_CMS_URL=${cmsExample}
+
+# Optional: API key for public reads if the CMS requires auth on /resolve
+# PRENTA_API_KEY=act_sk_...
+
+# Purge-on-publish (recommended): CMS Settings → Webhooks → add endpoint
+# https://<this site>/api/prenta/purge and paste its signing secret here.
+# PRENTA_WEBHOOK_SECRET=whsec_...
+
+# Optional CDN purge credentials (pick the one matching your deploy):
+# Cloudflare zone purge (targeted, instant)
+# CLOUDFLARE_ZONE_ID=...
+# CLOUDFLARE_API_TOKEN=...
+# Vercel deploy hook (full purge via redeploy)
+# VERCEL_DEPLOY_HOOK_URL=https://api.vercel.com/v1/integrations/deploy/...
+
+# Optional layer-2 runtime cache (Upstash Redis) — drained on purge
+# UPSTASH_REDIS_REST_URL=https://...upstash.io
+# UPSTASH_REDIS_REST_TOKEN=...
+`,
+        'src/env.d.ts': `/// <reference path="../.astro/types.d.ts" />
+/// <reference types="astro/client" />
+
+interface ImportMetaEnv {
+  readonly PRENTA_CMS_URL: string
+  readonly PRENTA_API_KEY?: string
+  readonly SITE?: string
+  /** Brand name for site-identity JSON-LD (Organization / WebSite). */
+  readonly PUBLIC_SITE_NAME?: string
+  /** Absolute logo URL for Organization JSON-LD (Article rich results). */
+  readonly PUBLIC_SITE_LOGO?: string
+  /** Signing secret from CMS Settings → Webhooks (purge-on-publish). */
+  readonly PRENTA_WEBHOOK_SECRET?: string
+  readonly CLOUDFLARE_ZONE_ID?: string
+  readonly CLOUDFLARE_API_TOKEN?: string
+  readonly VERCEL_DEPLOY_HOOK_URL?: string
+  readonly UPSTASH_REDIS_REST_URL?: string
+  readonly UPSTASH_REDIS_REST_TOKEN?: string
+}
+
+interface ImportMeta {
+  readonly env: ImportMetaEnv
+}
+`,
+        'src/lib/cms.ts': `import { createAstroSiteHelpers } from '@prenta/core/astro/site';
+import {
+  createUpstashSiteCacheAdapter,
+  publicPageCacheControl,
+  type UpstashSiteCacheAdapter,
+} from '@prenta/core/astro/cache';
+
+/** ADR 0011 cache-static header helper — re-exported for page routes. */
+export { publicPageCacheControl };
+
+/**
+ * Optional layer-2 runtime cache (Upstash Redis) — active when the env
+ * credentials exist. The purge endpoint drains it on publish, so entries can
+ * outlive their TTL without going stale.
+ */
+export const siteCache: UpstashSiteCacheAdapter | undefined =
+  import.meta.env.UPSTASH_REDIS_REST_URL && import.meta.env.UPSTASH_REDIS_REST_TOKEN
+    ? createUpstashSiteCacheAdapter({
+        url: import.meta.env.UPSTASH_REDIS_REST_URL,
+        token: import.meta.env.UPSTASH_REDIS_REST_TOKEN,
+      })
+    : undefined;
+
+/**
+ * Framework-neutral site client. Points at the CMS host via PRENTA_CMS_URL
+ * (set in .env). Do not use createNextSiteHelpers here — that is Next-only.
+ */
+export const {
+  client,
+  getGlobal,
+  resolveDocument,
+  getPublishedDocument,
+  getNavigation,
+  getPublicForm,
+  getPageMeta,
+  toPageMeta,
+} = createAstroSiteHelpers({
+  baseUrl: import.meta.env.PRENTA_CMS_URL,
+  apiKey: import.meta.env.PRENTA_API_KEY,
+  cache: siteCache,
+});
+`,
+        'src/lib/cms-proxy.ts': `import { rewritePublicOrigin } from '@prenta/core';
+
+/** CMS host origin (no trailing slash). */
+export function cmsOrigin(): string {
+  return (import.meta.env.PRENTA_CMS_URL as string).replace(/\\/$/, '');
+}
+
+/** Public serving origin — SITE from env, else Astro site config. */
+export function publicOrigin(siteFromAstro?: string | URL): string {
+  const fromEnv = (import.meta.env.SITE as string | undefined)?.replace(/\\/$/, '');
+  if (fromEnv) return fromEnv;
+  if (siteFromAstro) return String(siteFromAstro).replace(/\\/$/, '');
+  return cmsOrigin();
+}
+
+/**
+ * Proxy a CMS SEO artifact to the public host, rewriting absolute URLs from
+ * the CMS origin to the public apex (Yoast-parity sitemaps, robots Sitemap:
+ * line, feeds, llms).
+ */
+export async function proxyCmsSeoArtifact(
+  upstreamPath: string,
+  opts: { accept?: string; publicOrigin: string },
+): Promise<Response> {
+  const from = cmsOrigin();
+  const res = await fetch(\`\${from}\${upstreamPath}\`, {
+    headers: { accept: opts.accept ?? '*/*' },
+  });
+  const raw = await res.text();
+  const body = rewritePublicOrigin(raw, {
+    publicOrigin: opts.publicOrigin,
+    fromOrigin: from,
+  });
+  return new Response(body, {
+    status: res.status,
+    headers: {
+      'Content-Type':
+        res.headers.get('Content-Type') ??
+        (upstreamPath.endsWith('.xml') || upstreamPath.endsWith('.xsl')
+          ? 'application/xml'
+          : 'text/plain; charset=utf-8'),
+      'Cache-Control': res.headers.get('Cache-Control') ?? 'public, max-age=60',
+    },
+  });
+}
+`,
+        'src/middleware.ts': `import { sequence } from 'astro:middleware';
+import type { MiddlewareHandler } from 'astro';
+import { createAstroRedirectMiddleware } from '@prenta/core/astro/redirects';
+import { createAstroSecurityHeadersMiddleware } from '@prenta/core/astro/security';
+import { assertServingOriginConfigured } from '@prenta/core/astro/site';
+import { publicOrigin } from './lib/cms-proxy';
+
+/**
+ * Split-deploy public host middleware:
+ * 1. Launch Gate E — fail loud in production when SITE / public apex is unset
+ * 2. Admin-managed SEO redirects — Next \`proxy.ts\` only covers the CMS host
+ * 3. CMS baseline security headers — Next \`withPrentaCMS()\` only covers the CMS host
+ *
+ * @see https://docs.prentacms.com/astro-public-site
+ */
+let servingOriginChecked = false;
+const assertServingOrigin: MiddlewareHandler = async (context, next) => {
+  if (!servingOriginChecked) {
+    servingOriginChecked = true;
+    assertServingOriginConfigured({
+      servingOrigin: publicOrigin(context.site),
+      siteUrl: import.meta.env.SITE,
+      strict: import.meta.env.PROD,
+    });
+  }
+  return next();
+};
+
+export const onRequest = sequence(
+  assertServingOrigin,
+  createAstroRedirectMiddleware({
+    baseUrl: import.meta.env.PRENTA_CMS_URL,
+  }),
+  createAstroSecurityHeadersMiddleware(),
+);
+`,
+        'src/components/PageSections.tsx': `import { Sections, type PublicSection, type PostContext } from '@prenta/sections-react'
+${sectionsPackage
+            ? `// Side-effect import: registers this site's custom section renderers (the
+// shared section kit) before <Sections> renders. The same map drives the
+// admin editor canvas in apps/cms — see SECTIONS.md.
+import '${sectionsPackage}/register'
+`
+            : ''}
+/**
+ * React SSR for Prenta sections (Astro islands pattern).
+ *
+ * Default: import from .astro with no client:* directive — Astro SSR-renders
+ * the React tree to HTML with zero client JS (best for CMS page content).
+ *
+ * Add interactivity only where needed:
+ *   <PageSections client:visible sections={...} />  // hydrate when scrolled into view
+ *   <PageSections client:load sections={...} />     // hydrate immediately
+ *
+ * Prefer zero client JS for marketing pages; hydrate carousels, forms widgets,
+ * or custom interactive sections only.
+ */
+export function PageSections({
+  sections,
+  ctx,
+}: {
+  sections: PublicSection[];
+  ctx?: PostContext;
+}) {
+  return <Sections sections={sections} ctx={ctx} />;
+}
+`,
+        'src/live.config.ts': `/**
+ * Astro Live Content Collections (stable since Astro 6) — optional blog/index listing from Prenta.
+ *
+ * Posts still render via [...path].astro (sections + SEO). Use this collection
+ * for index pages, related lists, and typed getLiveEntry lookups.
+ *
+ * @see https://docs.astro.build/en/guides/content-collections/#live-content-collections
+ */
+import { defineLiveCollection } from 'astro:content';
+import { z } from 'astro/zod';
+import { createPrentaLiveLoader } from '@prenta/core/astro/content';
+
+const posts = defineLiveCollection({
+  loader: createPrentaLiveLoader({
+    baseUrl: import.meta.env.PRENTA_CMS_URL,
+    apiKey: import.meta.env.PRENTA_API_KEY,
+  }),
+  schema: z.object({
+    title: z.string(),
+    url: z.string(),
+    summary: z.string().optional(),
+    datePublished: z.string().optional(),
+    dateModified: z.string().optional(),
+  }),
+});
+
+export const collections = { posts };
+`,
+        'src/pages/blog/index.astro': `---
+/**
+ * Example blog index via Astro Live Content Collections + Prenta feed.json.
+ * Individual posts still use [...path].astro → /resolve → sections.
+ *
+ * On-demand: this page reads the live CMS feed at request time.
+ */
+export const prerender = false;
+
+import BaseLayout from '../../layouts/BaseLayout.astro';
+import { getLiveCollection } from 'astro:content';
+
+const { entries, error } = await getLiveCollection('posts');
+const posts = error ? [] : entries;
+---
+<BaseLayout title="Blog" description="Latest posts from Prenta CMS">
+  <main style="max-width:42rem;margin:2rem auto;padding:0 1rem;font:16px/1.5 system-ui">
+    <h1>Blog</h1>
+    {error && (
+      <p role="alert">Could not load posts from the CMS feed. Check PRENTA_CMS_URL and that SEO feeds are enabled.</p>
+    )}
+    {!error && posts.length === 0 && <p>No published posts yet.</p>}
+    <ul>
+      {posts.map((post) => (
+        <li>
+          <a href={post.id}>{post.data.title}</a>
+          {post.data.summary && <p>{post.data.summary}</p>}
+          {post.data.datePublished && (
+            <time datetime={post.data.datePublished}>{post.data.datePublished.slice(0, 10)}</time>
+          )}
+        </li>
+      ))}
+    </ul>
+  </main>
+</BaseLayout>
+`,
+        'src/pages/404.astro': `---
+/**
+ * Code-owned static route — built once per deploy (no CMS round-trip).
+ * Add other registry/marketing pages the same way: \`export const prerender = true\`.
+ * Keep CMS-backed routes (\`[...path].astro\`, live feeds) on-demand.
+ */
+export const prerender = true;
+
+import BaseLayout from '../layouts/BaseLayout.astro';
+---
+<BaseLayout title="Page not found" description="This page does not exist." robots="noindex, follow">
+  <main style="max-width:42rem;margin:4rem auto;padding:0 1rem;font:16px/1.5 system-ui;text-align:center">
+    <h1>Page not found</h1>
+    <p><a href="/">Back to home</a></p>
+  </main>
+</BaseLayout>
+`,
+        'src/layouts/BaseLayout.astro': `---
+import type { AstroPageMeta } from '@prenta/core/astro/site';
+import {
+  jsonLdHasOrganization,
+  siteIdentityJsonLdHtml,
+} from '@prenta/core/astro/site';
+import { publicOrigin } from '../lib/cms-proxy';
+
+interface Props {
+  /** Full composed head from toPageMeta() — use this for CMS-resolved pages. */
+  meta?: AstroPageMeta;
+  /** Simple overrides for static pages (blog index, 404, ...). */
+  title?: string;
+  description?: string;
+  canonical?: string;
+  /** Optional robots override; defaults to meta.robots / metadata.robots. */
+  robots?: string;
+}
+
+const { meta, ...overrides } = Astro.props;
+
+const title = overrides.title ?? meta?.title ?? 'Site';
+const description = overrides.description ?? meta?.description;
+const canonical = overrides.canonical ?? meta?.canonical;
+const origin = publicOrigin(Astro.site);
+const brandName =
+  (import.meta.env.PUBLIC_SITE_NAME as string | undefined)?.trim() || 'Site';
+const brandLogo = (import.meta.env.PUBLIC_SITE_LOGO as string | undefined)?.trim();
+
+// Site-identity JSON-LD so publisher/Organization @ids resolve on every page
+// (including static routes that never call composePageMeta). Skip when the
+// page graph already includes Organization (CMS /resolve path).
+const identityHtml =
+  !jsonLdHasOrganization(meta?.jsonLd) && origin
+    ? siteIdentityJsonLdHtml({
+        siteUrl: origin,
+        siteName: brandName,
+        ...(brandLogo ? { organizationLogo: brandLogo } : {}),
+      })
+    : '';
+
+// Prefer first-class AstroPageMeta.robots; fall back to the metadata bag.
+const bagRobots = (meta?.metadata.robots ?? {}) as { index?: boolean; follow?: boolean };
+const robotsContent =
+  overrides.robots ??
+  meta?.robots ??
+  [
+    bagRobots.index === false ? 'noindex' : 'index',
+    bagRobots.follow === false ? 'nofollow' : 'follow',
+  ].join(', ');
+
+const og = (meta?.metadata.openGraph ?? {}) as Record<string, unknown>;
+const ogImage = ((og.images ?? []) as { url?: string; alt?: string }[])[0];
+const ogImageUrl = ogImage?.url
+  ? ogImage.url.startsWith('http')
+    ? ogImage.url
+    : \`\${origin}\${ogImage.url.startsWith('/') ? '' : '/'}\${ogImage.url}\`
+  : undefined;
+const twitter = (meta?.metadata.twitter ?? {}) as Record<string, unknown>;
+const twitterImageRaw = Array.isArray(twitter.images) ? twitter.images[0] : twitter.images;
+const twitterImage =
+  typeof twitterImageRaw === 'string'
+    ? twitterImageRaw.startsWith('http')
+      ? twitterImageRaw
+      : \`\${origin}\${twitterImageRaw.startsWith('/') ? '' : '/'}\${twitterImageRaw}\`
+    : ogImageUrl;
+const alternates = (meta?.metadata.alternates ?? {}) as { languages?: Record<string, string> };
+const languages = alternates.languages ?? {};
+---
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{title}</title>
+    {description && <meta name="description" content={description} />}
+    {canonical && <link rel="canonical" href={canonical} />}
+    <meta name="robots" content={robotsContent} />
+    {Object.entries(languages).map(([hreflang, href]) => (
+      <link rel="alternate" hreflang={hreflang} href={href} />
+    ))}
+
+    <meta property="og:title" content={String(og.title ?? title)} />
+    {(og.description ?? description) && (
+      <meta property="og:description" content={String(og.description ?? description)} />
+    )}
+    {og.url && <meta property="og:url" content={String(og.url)} />}
+    {og.siteName && <meta property="og:site_name" content={String(og.siteName)} />}
+    <meta property="og:type" content={String(og.type ?? 'website')} />
+    {ogImageUrl && <meta property="og:image" content={ogImageUrl} />}
+    {ogImage?.alt && <meta property="og:image:alt" content={ogImage.alt} />}
+
+    <meta name="twitter:card" content={String(twitter.card ?? (ogImageUrl ? 'summary_large_image' : 'summary'))} />
+    <meta name="twitter:title" content={String(twitter.title ?? og.title ?? title)} />
+    {(twitter.description ?? og.description ?? description) && (
+      <meta name="twitter:description" content={String(twitter.description ?? og.description ?? description)} />
+    )}
+    {twitterImage && <meta name="twitter:image" content={twitterImage} />}
+    {twitter.site && <meta name="twitter:site" content={String(twitter.site)} />}
+
+    {identityHtml && <Fragment set:html={identityHtml} />}
+    {meta?.jsonLdHtml && <Fragment set:html={meta.jsonLdHtml} />}
+  </head>
+  <body>
+    <slot />
+  </body>
+</html>
+`,
+        'src/pages/[...path].astro': `---
+/**
+ * CMS catch-all — always on-demand so publishes + preview tokens work.
+ * Code-owned pages (no CMS fetch) should use \`export const prerender = true\`.
+ */
+export const prerender = false;
+
+import BaseLayout from '../layouts/BaseLayout.astro';
+import { PageSections } from '../components/PageSections';
+import {
+  getPublishedDocument,
+  resolveDocument,
+  toPageMeta,
+  publicPageCacheControl,
+} from '../lib/cms';
+import type { PublicSection, PostContext } from '@prenta/sections-react';
+
+const segments = Astro.params.path;
+const urlPath =
+  !segments || (Array.isArray(segments) && segments.length === 0)
+    ? '/'
+    : '/' + (Array.isArray(segments) ? segments.join('/') : segments);
+
+const previewToken =
+  Astro.url.searchParams.get('preview') ??
+  Astro.cookies.get('prenta_preview')?.value ??
+  undefined;
+
+const result = previewToken
+  ? await resolveDocument(urlPath, previewToken)
+  : await getPublishedDocument(urlPath);
+
+if (!result) {
+  return new Response(null, { status: 404, statusText: 'Not Found' });
+}
+
+// Serving-contract: /home → / when /resolve hints a canonical redirect.
+if (result.redirect?.to) {
+  return Astro.redirect(result.redirect.to, result.redirect.status ?? 301);
+}
+
+// Cache-static delivery via publicPageCacheControl (ADR 0011 defaults).
+// /api/prenta/purge evicts by path/URL the moment an editor publishes.
+// @see https://docs.prentacms.com/astro-public-site#caching
+Astro.response.headers.set(
+  'Cache-Control',
+  publicPageCacheControl({ preview: Boolean(previewToken) }),
+);
+
+const meta = toPageMeta(result);
+const data = result.data.data as Record<string, unknown>;
+const sections = (Array.isArray(data.sections) ? data.sections : []) as PublicSection[];
+
+const postCtx: PostContext | undefined = result.post
+  ? {
+      title: typeof data.title === 'string' ? data.title : undefined,
+      excerpt: typeof data.excerpt === 'string' ? data.excerpt : undefined,
+      featuredImageUrl: result.post.featuredImage?.url,
+      featuredImageWidth: result.post.featuredImage?.width,
+      featuredImageHeight: result.post.featuredImage?.height,
+      publishDate: result.data.publishedAt ?? null,
+      author: result.post.author
+        ? { name: result.post.author.name, avatarUrl: result.post.author.avatarUrl }
+        : undefined,
+      relatedPosts: result.post.relatedPosts,
+    }
+  : undefined;
+---
+<BaseLayout meta={meta}>
+  {previewToken && (
+    <div style="background:#fef3c7;padding:0.5rem 1rem;font:14px system-ui">
+      Preview mode — unpublished content may be shown.
+    </div>
+  )}
+  <main>
+    {/* Zero client JS by default — SSR only. Add client:visible only for interactive sections. */}
+    <PageSections sections={sections} ctx={postCtx} />
+  </main>
+</BaseLayout>
+`,
+        'src/pages/index.astro': `---
+/**
+ * CMS home — on-demand (same contract as [...path].astro).
+ * Home is handled by [...path] with path undefined → "/".
+ * Keep a thin index that mirrors "/" resolve for clearer routing.
+ */
+export const prerender = false;
+
+import BaseLayout from '../layouts/BaseLayout.astro';
+import { PageSections } from '../components/PageSections';
+import {
+  getPublishedDocument,
+  resolveDocument,
+  toPageMeta,
+  publicPageCacheControl,
+} from '../lib/cms';
+import type { PublicSection } from '@prenta/sections-react';
+
+const previewToken =
+  Astro.url.searchParams.get('preview') ??
+  Astro.cookies.get('prenta_preview')?.value ??
+  undefined;
+
+const result = previewToken
+  ? await resolveDocument('/', previewToken)
+  : await getPublishedDocument('/');
+
+if (!result) {
+  return new Response(null, { status: 404, statusText: 'Not Found' });
+}
+
+Astro.response.headers.set(
+  'Cache-Control',
+  publicPageCacheControl({ preview: Boolean(previewToken) }),
+);
+
+const meta = toPageMeta(result);
+const data = result.data.data as Record<string, unknown>;
+const sections = (Array.isArray(data.sections) ? data.sections : []) as PublicSection[];
+---
+<BaseLayout meta={meta}>
+  <main>
+    <PageSections sections={sections} />
+  </main>
+</BaseLayout>
+`,
+        'src/pages/api/prenta/purge.ts': `import type { APIRoute } from 'astro';
+import {
+  createPublishPurgeReceiver,
+  createCloudflarePurgeAdapter,
+  createVercelDeployHookPurgeAdapter,
+  type CachePurgeAdapter,
+} from '@prenta/core/purge';
+import { siteCache } from '../../../lib/cms';
+
+/**
+ * Purge-on-publish receiver — makes cache-static delivery safe by evicting
+ * edge-cached pages the moment content changes in the CMS.
+ *
+ * Setup (CMS admin → Settings → Webhooks):
+ *   1. Add an endpoint: https://<this site>/api/prenta/purge
+ *      (subscribes to the publish lifecycle by default).
+ *   2. Copy the signing secret into PRENTA_WEBHOOK_SECRET on this deploy.
+ *   3. Add CDN purge credentials (.env.example). In production a missing
+ *      adapter returns 503 so "webhook delivered" never means "edge purged"
+ *      when the CDN was never contacted.
+ */
+function buildPurgeAdapter(): CachePurgeAdapter | null {
+  const env = import.meta.env;
+  if (env.CLOUDFLARE_ZONE_ID && env.CLOUDFLARE_API_TOKEN) {
+    return createCloudflarePurgeAdapter({
+      zoneId: env.CLOUDFLARE_ZONE_ID,
+      apiToken: env.CLOUDFLARE_API_TOKEN,
+      siteUrl: env.SITE ?? 'http://localhost:4321',
+    });
+  }
+  if (env.VERCEL_DEPLOY_HOOK_URL) {
+    return createVercelDeployHookPurgeAdapter({ deployHookUrl: env.VERCEL_DEPLOY_HOOK_URL });
+  }
+  return null;
+}
+
+const secret = import.meta.env.PRENTA_WEBHOOK_SECRET;
+const cdnAdapter = buildPurgeAdapter();
+const isProd = import.meta.env.PROD;
+
+const receiver =
+  secret && (cdnAdapter || !isProd)
+    ? createPublishPurgeReceiver({
+        secret,
+        purge: cdnAdapter ?? {
+          purgeAll: async () => {
+            console.error(
+              '[prenta] CDN purge not configured — draining site cache only. ' +
+                'Set CLOUDFLARE_* or VERCEL_DEPLOY_HOOK_URL before production launch.',
+            );
+          },
+        },
+        onPurged: async () => {
+          await siteCache?.clear();
+        },
+      })
+    : null;
+
+export const POST: APIRoute = async ({ request }) => {
+  if (!secret) {
+    return new Response(
+      JSON.stringify({ error: 'PRENTA_WEBHOOK_SECRET is not configured on this deploy' }),
+      { status: 503, headers: { 'content-type': 'application/json' } },
+    );
+  }
+  if (!cdnAdapter && isProd) {
+    console.error(
+      '[prenta] Rejecting purge webhook: no CDN adapter in production (silent no-op forbidden)',
+    );
+    return new Response(
+      JSON.stringify({
+        error: 'cdn_purge_not_configured',
+        message:
+          'Set CLOUDFLARE_ZONE_ID + CLOUDFLARE_API_TOKEN or VERCEL_DEPLOY_HOOK_URL. ' +
+          'A 200 with a no-op CDN adapter is not allowed in production.',
+      }),
+      { status: 503, headers: { 'content-type': 'application/json' } },
+    );
+  }
+  if (!receiver) {
+    return new Response(JSON.stringify({ error: 'Purge receiver unavailable' }), {
+      status: 503,
+      headers: { 'content-type': 'application/json' },
+    });
+  }
+  return receiver(request);
+};
+`,
+        'src/pages/sitemap.xml.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+/** Yoast-style sitemap index (children + XSL proxied separately). */
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/sitemap.xml', {
+    accept: 'application/xml',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/[name].xml.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+/**
+ * Yoast-style child sitemaps at the public root:
+ * /page-sitemap.xml, /post-sitemap2.xml, /case-studies-sitemap.xml, …
+ * Upstream: /api/cms/sitemaps/{name}.xml
+ */
+const CHILD_SITEMAP = /^[a-z0-9-]+-sitemap\\d*$/i;
+
+export const GET: APIRoute = async ({ params, site }) => {
+  const name = params.name ?? '';
+  if (!CHILD_SITEMAP.test(name)) {
+    return new Response('Not Found', { status: 404 });
+  }
+  return proxyCmsSeoArtifact(\`/api/cms/sitemaps/\${name}.xml\`, {
+    accept: 'application/xml',
+    publicOrigin: publicOrigin(site),
+  });
+};
+`,
+        'src/pages/sitemap.xsl.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/sitemap.xsl', {
+    accept: 'application/xml',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/sitemap-index.xsl.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/sitemap-index.xsl', {
+    accept: 'application/xml',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/robots.txt.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/robots.txt', {
+    accept: 'text/plain',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/llms.txt.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/llms.txt', {
+    accept: 'text/plain',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/llms-full.txt.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/llms-full.txt', {
+    accept: 'text/plain',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/feed.xml.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/feed.xml', {
+    accept: 'application/xml',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'src/pages/feed.json.ts': `import type { APIRoute } from 'astro';
+import { proxyCmsSeoArtifact, publicOrigin } from '../lib/cms-proxy';
+
+export const GET: APIRoute = async ({ site }) =>
+  proxyCmsSeoArtifact('/api/cms/feed.json', {
+    accept: 'application/feed+json, application/json',
+    publicOrigin: publicOrigin(site),
+  });
+`,
+        'README.md': `# Prenta Astro public site
+
+Headless public frontend for an Prenta CMS host (**Astro 7**, Node.js 22.12+).
+
+## Setup
+
+\`\`\`bash
+# Preferred (existing CMS host — UpChat / fleet migrations)
+npm create prenta-astro@latest my-site
+# or: npx create-prenta@latest my-site -- --yes --framework astro-site
+
+cp .env.example .env
+# Set PRENTA_CMS_URL to your CMS host (admin + /api/cms)
+npm install
+npm run dev
+\`\`\`
+
+## Islands
+
+Page sections SSR via \`@astrojs/react\` with **no** \`client:*\` by default (zero client JS).
+Hydrate only interactive widgets (\`client:visible\` / \`client:load\`). See \`PageSections.tsx\`.
+
+## SEO redirects + security headers
+
+\`src/middleware.ts\` sequences \`createAstroRedirectMiddleware\` (\`PRENTA_CMS_URL\`)
+and \`createAstroSecurityHeadersMiddleware\` (same baseline as Next
+\`withPrentaCMS()\`). Next only covers the CMS host — keep this middleware on
+every Astro public deploy.
+
+## Site identity JSON-LD
+
+\`BaseLayout\` emits WebSite + Organization JSON-LD (stable \`#website\` /
+\`#organization\` @ids) on every page that does not already include Organization
+via CMS \`composePageMeta\`. Set \`PUBLIC_SITE_NAME\` / \`PUBLIC_SITE_LOGO\` for brand
+signals — this unblocks Article rich results that reference publisher by \`@id\`.
+
+Production middleware also asserts \`SITE\` is set (Launch Gate E). On the CMS
+host, \`NEXT_PUBLIC_SITE_URL\` must equal that same public apex.
+
+## Rendering: prerender vs on-demand
+
+Hybrid \`output: 'server'\`:
+
+| Route | \`prerender\` | Why |
+| --- | --- | --- |
+| \`404.astro\` (and other code-owned pages) | \`true\` | Built once per deploy; no CMS dependency |
+| \`[...path].astro\` / \`index.astro\` / \`blog/index.astro\` | \`false\` | CMS-backed; needs preview + publish freshness |
+| SEO proxies (\`sitemap.xml\`, \`robots.txt\`, …) | on-demand | Proxied from the CMS host |
+
+When you add a static marketing/registry page, start with
+\`export const prerender = true\`. Only leave a page on-demand when it calls
+\`/resolve\`, a live feed, or other request-time CMS data.
+
+## Freshness: cache-static + purge-on-publish
+
+Published pages use \`publicPageCacheControl()\` from
+\`@prenta/core/astro/cache\` (**cache-static** defaults:
+\`s-maxage=3600, stale-while-revalidate=86400\`) and are evicted the moment an
+editor publishes:
+
+1. In the CMS admin, go to **Settings → Webhooks** and add an endpoint for
+   \`https://<this site>/api/prenta/purge\` (it subscribes to the publish
+   lifecycle by default).
+2. Copy the signing secret into \`PRENTA_WEBHOOK_SECRET\` on this deploy.
+3. **Required for production:** CDN purge credentials in \`.env\` (Cloudflare
+   zone purge or a Vercel deploy hook — see \`.env.example\`). Without them the
+   production purge endpoint returns **503** (silent no-op is forbidden).
+4. Optional: set \`UPSTASH_REDIS_REST_URL\` / \`UPSTASH_REDIS_REST_TOKEN\` for
+   a layer-2 runtime cache drained on publish.
+
+If you cannot run the purge webhook, pass a lower \`maxAge\` to
+\`publicPageCacheControl({ maxAge })\` — staleness is then bounded by the TTL alone.
+
+## Blog / content collections
+
+\`src/live.config.ts\` wires Astro **Live Content Collections** to Prenta \`feed.json\`.
+\`/blog\` lists posts; individual URLs still resolve through \`[...path].astro\`.
+
+## Preview (same-origin, default)
+
+Draft preview cookies only work when the browser treats \`/api/cms\` as **same-origin**
+as the public site. The shipped \`vercel.json\` routes the apex accordingly:
+
+| Path | Target |
+|------|--------|
+| \`/api/cms/*\` | CMS host |
+| \`/admin\`, login path | CMS host |
+| Everything else | This Astro app |
+
+**Before going live:** replace \`CMS_HOST_ORIGIN\` in \`vercel.json\` with your
+deployed CMS host origin (or configure the same path rules at your CDN), and set
+\`PRENTA_CMS_URL\` to the **public apex** (not a separate CMS subdomain).
+
+## Deploy
+
+1. Deploy the **CMS host** (Next) with admin, API, cron, database.
+2. Deploy this Astro app with \`PRENTA_CMS_URL\` pointing at the CMS origin (or apex if proxied).
+3. At the CDN: route \`/admin\`, \`/api/cms\`, \`/securelogin\` → CMS; everything else → Astro.
+4. In the CMS: **Settings → Webhooks** → add \`https://<this site>/api/prenta/purge\`
+   and set \`PRENTA_WEBHOOK_SECRET\` here (see Freshness above).
+
+Docs: [Astro public site](https://github.com/actuate-media/prenta/blob/main/apps/docs/content/astro-public-site.md)
+`,
+        // Same-apex routing is the DEFAULT: the public apex serves Astro, while
+        // /api/cms, /admin, and the login mount rewrite to the CMS host. This is
+        // what makes draft-preview cookies same-origin out of the box. Replace
+        // CMS_HOST_ORIGIN with the deployed CMS host before going live (see README).
+        'vercel.json': JSON.stringify({
+            framework: 'astro',
+            rewrites: [
+                {
+                    source: '/api/cms/:path*',
+                    destination: 'https://CMS_HOST_ORIGIN/api/cms/:path*',
+                },
+                {
+                    source: `${adminPath}/:path*`,
+                    destination: `https://CMS_HOST_ORIGIN${adminPath}/:path*`,
+                },
+                ...(loginPath !== adminPath
+                    ? [
+                        {
+                            source: `${loginPath}/:path*`,
+                            destination: `https://CMS_HOST_ORIGIN${loginPath}/:path*`,
+                        },
+                    ]
+                    : []),
+            ],
+        }, null, 2),
+    };
+}
+/** True when the scaffold should emit a separate Astro public site under `site/`. */
+export function isAstroSplit(options) {
+    return options.framework === 'astro-split';
+}
+/**
+ * True when scaffolding an Astro-only public site (no CMS host).
+ * Used by `create-prenta-astro` / `--framework astro-site` against an existing Prenta CMS.
+ */
+export function isAstroSiteOnly(options) {
+    return options.framework === 'astro-site';
+}
+//# sourceMappingURL=astro-site.js.map