nuxt-ai-ready 3.3.1 → 3.5.0

package/dist/chunks/agent-skills.mjs

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { realpath, readFile, readdir } from 'node:fs/promises';
 import { join, resolve, isAbsolute, relative, sep } from 'node:path';
 import { parseDocument } from 'yaml';
-import { A as AGENT_SKILLS_SCHEMA } from '../shared/nuxt-ai-ready.CKXM1jnE.mjs';
+import { A as AGENT_SKILLS_SCHEMA } from '../shared/nuxt-ai-ready.BaNK8yfw.mjs';
 import 'node:module';
 import 'node:url';
 import '@nuxt/kit';
@@ -14,6 +14,7 @@ import 'node:fs';
 import '../../dist/runtime/llms-txt-files.js';
 import '../../dist/runtime/route-path.js';
 import '../../dist/runtime/server/utils/sitemap-md.js';
+import '../../dist/runtime/sync-secret.js';
 import '../../dist/runtime/cache-control.js';
 import '../../dist/runtime/server/utils/discovery-response.js';
 import 'confbox';

package/dist/chunks/prerender.mjs

@@ -6,7 +6,7 @@ import { resolveLocaleFromRoute } from 'nuxtseo-shared/i18n-runtime';
 import { createPrerenderFetch } from 'nuxtseo-shared/prerender';
 import { collectSitemap } from 'sitemapd/parse';
 import { parseURL, withLeadingSlash, joinURL, withBase } from 'ufo';
-import { l as logger, M as MARKDOWN_LINK_AVAILABILITY_FILE } from '../shared/nuxt-ai-ready.CKXM1jnE.mjs';
+import { l as logger, m as matchingStaticContentSignals, M as MARKDOWN_LINK_AVAILABILITY_FILE } from '../shared/nuxt-ai-ready.BaNK8yfw.mjs';
 import { toLogicalRoute, toDeployedRoute } from '../../dist/runtime/route-path.js';
 import { insertLlmsTxtDirective } from '../../dist/runtime/llms-txt-directive.js';
 import { absoluteSiteUrl } from '../../dist/runtime/markdown-links.js';
@@ -15,7 +15,6 @@ import { initSchema, computeContentHash, insertPage, queryAllPages, exportDbDump
 import { buildLlmsFullTxtHeader, formatPageForLlmsFullTxt } from '../../dist/runtime/server/utils/llms-full.js';
 import { resolvePageUpdatedAt } from '../../dist/runtime/server/utils/page-updated-at.js';
 import { SITEMAP_MD_ROUTE, appendSitemapSection } from '../../dist/runtime/server/utils/sitemap-md.js';
-import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'defu';
@@ -24,7 +23,9 @@ import 'nuxtseo-shared/kit';
 import '../shared/nuxt-ai-ready.B3hAuOLQ.mjs';
 import 'node:fs';
 import '../../dist/runtime/llms-txt-files.js';
+import '../../dist/runtime/sync-secret.js';
 import '../../dist/runtime/cache-control.js';
+import 'node:crypto';
 import '../../dist/runtime/server/utils/discovery-response.js';
 import 'confbox';
 import 'nuxtseo-shared/server';
@@ -497,6 +498,17 @@ function setupPrerenderHandler(options, dbPath, siteInfo, llmsTxtConfig, extras)
         initPromise = initCrawler(state);
       await initPromise;
       const parsed = JSON.parse(route.contents || "{}");
+      if (parsed.contentSignal !== void 0) {
+        route.contentSignal = parsed.contentSignal;
+        for (const sourceRoute of pageRoute === "/" ? ["/"] : [pageRoute, `${pageRoute}/`]) {
+          if (matchingStaticContentSignals(nitro.options.routeRules, sourceRoute).includes(parsed.contentSignal))
+            continue;
+          const source = nitro.options.routeRules[sourceRoute] ||= {};
+          source.headers ||= {};
+          if (!Object.keys(source.headers).some((name) => name.toLowerCase() === "content-signal"))
+            source.headers["Content-Signal"] = parsed.contentSignal;
+        }
+      }
       if (!state.prerenderedRoutes.has(pageRoute))
         await processMarkdownRoute(state, nuxt, pageRoute, parsed);
       const withSitemap = options.sitemapMd === false ? parsed.markdown : appendSitemapSection(parsed.markdown, absoluteSiteUrl(toDeployedRoute(SITEMAP_MD_ROUTE, nitro.options.baseURL), siteInfo?.url));

package/dist/cli.mjs

@@ -5,7 +5,9 @@ import { defineCommand, runMain } from 'citty';
 import { consola } from 'consola';
 import { colors } from 'consola/utils';
 import { resolve, join } from 'pathe';
+import { joinURL } from 'ufo';
 import { r as readPackageMetadata } from './shared/nuxt-ai-ready.B3hAuOLQ.mjs';
+import { deriveRuntimeSyncSecret, LEGACY_RUNTIME_SYNC_SECRET_WARNING } from '../dist/runtime/sync-secret.js';
 import 'node:module';
 import 'node:path';
 import 'node:url';
@@ -245,6 +247,14 @@ async function auditSite(options, dependencies) {
 }
 
 async function getSecret(cwd) {
+  const root = process.env.NITRO_APP_SECRET ?? process.env.NUXT_APP_SECRET;
+  if (root !== void 0 && root !== "")
+    return deriveRuntimeSyncSecret(root);
+  const legacy = process.env.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET;
+  if (legacy) {
+    console.warn(`[nuxt-ai-ready] ${LEGACY_RUNTIME_SYNC_SECRET_WARNING}`);
+    return legacy;
+  }
   const secretPath = join(cwd, "node_modules/.cache/nuxt/ai-ready/secret");
   if (!existsSync(secretPath)) {
     return null;
@@ -256,10 +266,10 @@ async function getSecret(cwd) {
 function authHeaders(secret) {
   return { Authorization: `Bearer ${secret}` };
 }
-async function requireSecret(cwd, hint = "") {
+async function requireSecret(cwd) {
   const secret = await getSecret(cwd);
   if (!secret) {
-    consola.error(`No secret found. Run \`nuxi dev\` or \`nuxi build\` first${hint}.`);
+    throw new Error("No secret found. Set NUXT_APP_SECRET, or run `nuxt dev` to cache its development token.");
   }
   return secret;
 }
@@ -287,6 +297,15 @@ const main = defineCommand({
     version: await readPackageMetadata(import.meta.url).then((p) => p.version || "0.0.0")
   },
   subCommands: {
+    token: () => defineCommand({
+      meta: { name: "token", description: "Print the runtime sync bearer token" },
+      args: { cwd: { type: "string", description: "Working directory", default: "." } },
+      async run({ args }) {
+        const secret = await requireSecret(resolve(args.cwd));
+        process.stdout.write(`${secret}
+`);
+      }
+    }),
     audit: () => defineCommand({
       meta: { name: "audit", description: "Check a public page and its agent discovery documents" },
       args: {
@@ -332,10 +351,10 @@ const main = defineCommand({
       },
       async run({ args }) {
         const cwd = resolve(args.cwd || ".");
-        const secret = await requireSecret(cwd, " to generate one");
+        const secret = await requireSecret(cwd);
         if (!secret)
           return;
-        const url = `${args.url}/__ai-ready/status`;
+        const url = joinURL(args.url, "/__ai-ready/status");
         consola.info(`Fetching status from ${args.url}...`);
         const res = await fetchJson(url, { headers: authHeaders(secret) }, "Failed to connect");
         consola.box("AI Ready Status");
@@ -419,7 +438,7 @@ const main = defineCommand({
         } else {
           params.set("limit", args.limit || "10");
         }
-        const url = `${args.url}/__ai-ready/poll?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/poll?${params}`);
         consola.info(`Triggering poll at ${args.url}...`);
         const res = await fetchJson(url, { method: "POST", headers: authHeaders(secret) });
         consola.success(`Indexed: ${colors.green(res.indexed?.toString() || "0")} pages`);
@@ -465,7 +484,7 @@ const main = defineCommand({
         if (!args.clear) {
           params.set("clear", "false");
         }
-        const url = `${args.url}/__ai-ready/restore?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/restore?${params}`);
         consola.info(`Restoring database at ${args.url}...`);
         const res = await fetchJson(url, { method: "POST", headers: authHeaders(secret) });
         consola.success(`Restored: ${colors.green(res.restored?.toString() || "0")} pages`);
@@ -505,15 +524,14 @@ const main = defineCommand({
         const cwd = resolve(args.cwd || ".");
         const secret = await getSecret(cwd);
         if (!secret && !args.dry) {
-          consola.error("No secret found. Run `nuxi dev` or `nuxi build` first.");
-          return;
+          throw new Error("No secret found. Set NUXT_APP_SECRET, or run `nuxt dev` to cache its development token.");
         }
         const params = new URLSearchParams();
         if (args.dry)
           params.set("dry", "true");
         if (args.ttl)
           params.set("ttl", args.ttl);
-        const url = `${args.url}/__ai-ready/prune?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/prune?${params}`);
         consola.info(`${args.dry ? "Previewing" : "Pruning"} stale routes at ${args.url}...`);
         const res = await fetchJson(url, {
           method: "POST",
@@ -572,7 +590,7 @@ const main = defineCommand({
         params.set("route", args.route);
         if (!args.force)
           params.set("force", "false");
-        const url = `${args.url}/__ai-ready/reindex?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/reindex?${params}`);
         consola.info(`Reindexing ${args.route} at ${args.url}...`);
         const res = await fetchJson(url, { method: "POST", headers: authHeaders(secret) });
         if (res.indexed) {

package/dist/module.d.mts

@@ -29,6 +29,7 @@ interface ParsedMarkdownResult {
     headings: Array<Record<string, string>>;
     keywords?: string[];
     updatedAt?: string;
+    contentSignal?: string;
 }
 
 interface ResolvedApiCatalogLinkTarget {

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": "^4.6.0 || ^5.0.0-0"
   },
   "configKey": "aiReady",
-  "version": "3.3.1",
+  "version": "3.5.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,4 +1,3 @@
-import 'node:crypto';
 import 'node:fs/promises';
 import 'node:module';
 import 'node:path';
@@ -7,13 +6,15 @@ import '@nuxt/kit';
 import 'defu';
 import 'nuxt-site-config/kit';
 import 'nuxtseo-shared/kit';
-export { m as default } from './shared/nuxt-ai-ready.CKXM1jnE.mjs';
+export { a as default } from './shared/nuxt-ai-ready.BaNK8yfw.mjs';
 import './shared/nuxt-ai-ready.B3hAuOLQ.mjs';
 import '../dist/runtime/llms-txt-files.js';
 import '../dist/runtime/route-path.js';
 import '../dist/runtime/server/utils/sitemap-md.js';
+import '../dist/runtime/sync-secret.js';
 import '../dist/runtime/server/utils/discovery-response.js';
 import '../dist/runtime/cache-control.js';
+import 'node:crypto';
 import 'confbox';
 import '../dist/runtime/markdown-path.js';
 import 'nuxtseo-shared/server';

package/dist/runtime/server/middleware/markdown.prerender.js

@@ -11,7 +11,7 @@ import { buildFrontmatter } from "../utils/frontmatter.js";
 import { extractKeywords } from "../utils/keywords.js";
 import { getMarkdownRenderInfo } from "../utils/markdown-request.js";
 import { agentSkillArtifactPaths } from "../utils/negotiation-response.js";
-import { consumePrerenderedHtml } from "../utils/prerender-html.js";
+import { consumePrerenderedContentSignal, consumePrerenderedHtml } from "../utils/prerender-html.js";
 import { isSitemapMdRequest } from "../utils/sitemap-md.js";
 function extractHeadingsFromMarkdown(markdown) {
   const headings = [];
@@ -37,6 +37,7 @@ export default defineEventHandler(async (event) => {
   if (!renderInfo || "notAcceptable" in renderInfo)
     return;
   const { path } = renderInfo;
+  let contentSignal = consumePrerenderedContentSignal(path);
   const runtimeConfig = fullRuntimeConfig["nuxt-ai-ready"];
   const deployedPath = toDeployedRoute(path, fullRuntimeConfig.app.baseURL);
   const canonicalUrl = withSiteUrl(event, deployedPath, { withBase: true });
@@ -62,6 +63,7 @@ ${absoluteMarkdownLinks(contentPage.markdown, canonicalUrl)}`;
       description: contentPage.description || "",
       headings,
       keywords: keywords2,
+      ...contentSignal !== void 0 && { contentSignal },
       // Only a real content date feeds the page index and sitemap lastmod.
       ...contentPage.updatedAt && { updatedAt: contentPage.updatedAt }
     });
@@ -95,8 +97,13 @@ ${absoluteMarkdownLinks(contentPage.markdown, canonicalUrl)}`;
       });
     }
     html = await response.text();
+    const fetchedPolicy = response.headers.get("content-signal");
+    const sharedPolicy = fullRuntimeConfig["nuxt-robots"]?.contentSignalHeader;
+    if (fetchedPolicy !== null && fetchedPolicy !== sharedPolicy)
+      contentSignal = fetchedPolicy;
     logger.debug(`[markdown.prerender] Fetched HTML for ${path} (${html.length} bytes)`);
     consumePrerenderedHtml(path);
+    consumePrerenderedContentSignal(path);
   }
   if (html.includes("__NUXT_ERROR__") || html.includes("nuxt-error-page")) {
     return createError({
@@ -125,6 +132,7 @@ ${absoluteMarkdownLinks(contentPage.markdown, canonicalUrl)}`;
     description: result.description,
     headings: result.headings,
     keywords,
+    ...contentSignal !== void 0 && { contentSignal },
     ...result.updatedAt && { updatedAt: result.updatedAt }
   });
 });

package/dist/runtime/server/plugins/content-signal-capture-nitro3.prerender.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/plugins/content-signal-capture-nitro3.prerender.js

@@ -0,0 +1,13 @@
+import { defineNitroPlugin, useRuntimeConfig } from "#nuxtseo/nitro";
+import { toLogicalRoute } from "../../route-path.js";
+import { storePrerenderedContentSignal } from "../utils/prerender-html.js";
+export default defineNitroPlugin((nitro) => {
+  const hooks = nitro.hooks;
+  hooks.hook("response", (response, event) => {
+    const policy = response.headers.get("content-signal");
+    const config = useRuntimeConfig();
+    const sharedPolicy = config["nuxt-robots"]?.contentSignalHeader;
+    if (policy !== null && policy !== sharedPolicy)
+      storePrerenderedContentSignal(toLogicalRoute(event.url.pathname, config.app.baseURL), policy);
+  });
+});

package/dist/runtime/server/plugins/content-signal-capture.prerender.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/plugins/content-signal-capture.prerender.js

@@ -0,0 +1,13 @@
+import { getRequestURL, getResponseHeader } from "#nuxtseo/h3";
+import { defineNitroPlugin, useRuntimeConfig } from "#nuxtseo/nitro";
+import { toLogicalRoute } from "../../route-path.js";
+import { storePrerenderedContentSignal } from "../utils/prerender-html.js";
+export default defineNitroPlugin((nitro) => {
+  nitro.hooks.hook("beforeResponse", (event) => {
+    const policy = getResponseHeader(event, "content-signal");
+    const config = useRuntimeConfig(event);
+    const sharedPolicy = config["nuxt-robots"]?.contentSignalHeader;
+    if (typeof policy === "string" && policy !== sharedPolicy)
+      storePrerenderedContentSignal(toLogicalRoute(getRequestURL(event).pathname, config.app.baseURL), policy);
+  });
+});

package/dist/runtime/server/routes/__ai-ready/cron.get.js

@@ -2,7 +2,7 @@ import { createError, eventHandler } from "#nuxtseo/h3";
 import { runCron } from "../../utils/runCron.js";
 export default eventHandler(async (event) => {
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const result = await runCron(event);
   if (result.failed) {
     throw createError({

package/dist/runtime/server/routes/__ai-ready/poll.post.js

@@ -5,7 +5,7 @@ import { logger } from "../../logger.js";
 import { batchIndexPages } from "../../utils/batchIndex.js";
 export default eventHandler(async (event) => {
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const lock = await tryAcquireCronLock(event);
   if (lock._tag === "held") {
     setResponseStatus(event, 409);

package/dist/runtime/server/routes/__ai-ready/prune.post.js

@@ -7,7 +7,7 @@ export default eventHandler(async (event) => {
   const dry = query.dry === "true" || query.dry === "1";
   if (!dry) {
     const { requireAuth } = await import("../../utils/auth.js");
-    requireAuth(event);
+    await requireAuth(event);
   }
   const ttl = query.ttl ? Math.max(0, Math.trunc(Number(query.ttl)) || config.runtimeSync.pruneTtl) : config.runtimeSync.pruneTtl;
   const refreshWindowMs = resolveSeedRefreshWindowMs(config.runtimeSync.pruneTtl);

package/dist/runtime/server/routes/__ai-ready/reindex.post.js

@@ -2,7 +2,7 @@ import { createError, eventHandler, getQuery, setResponseStatus } from "#nuxtseo
 import { indexPageByRoute } from "../../utils/indexPage.js";
 export default eventHandler(async (event) => {
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const query = getQuery(event);
   const route = typeof query.route === "string" ? query.route.trim() : "";
   if (!route.startsWith("/")) {

package/dist/runtime/server/routes/__ai-ready/restore.post.js

@@ -5,7 +5,7 @@ import { logger } from "../../logger.js";
 import { requireAuth } from "../../utils/auth.js";
 import { fetchPublicAsset } from "../../utils/cloudflare.js";
 export default eventHandler(async (event) => {
-  requireAuth(event);
+  await requireAuth(event);
   const query = getQuery(event);
   logger.debug("[restore] Fetching dump...");
   const dumpData = await fetchPublicAsset(event, "/__ai-ready/pages.dump", { responseType: "text" });

package/dist/runtime/server/routes/__ai-ready/status.get.js

@@ -4,7 +4,7 @@ import { countPages, countRecentlyIndexed, getCronLockStatus, getRecentCronRuns,
 export default eventHandler(async (event) => {
   const config = useRuntimeConfig(event)["nuxt-ai-ready"];
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const [total, pending, recentlyIndexed24h, recentlyIndexed1h, recentPages] = await Promise.all([
     countPages(event),
     countPages(event, { where: { pending: true } }),

package/dist/runtime/server/utils/auth.d.ts

@@ -2,8 +2,6 @@ import type { H3Event } from '#nuxtseo/h3';
 /**
  * Verify the request has a valid Authorization: Bearer token.
  * Throws 401 if the token is missing or invalid.
- * No-op if runtimeSyncSecret is not configured.
- *
- * Also accepts the deprecated `?secret=` query param with a warning.
+ * Legacy tokens remain valid when no application secret is configured.
  */
-export declare function requireAuth(event: H3Event): void;
+export declare function requireAuth(event: H3Event): Promise<void>;

package/dist/runtime/server/utils/auth.js

@@ -1,10 +1,31 @@
+import { deriveSecret } from "nuxt/server";
 import { logger } from "#ai-ready-virtual/logger.mjs";
 import { createError, getHeader, getQuery } from "#nuxtseo/h3";
 import { useRuntimeConfig } from "#nuxtseo/nitro";
-export function requireAuth(event) {
-  const config = useRuntimeConfig(event)["nuxt-ai-ready"];
-  if (!config.runtimeSyncSecret)
-    return;
+import { deriveRuntimeSyncSecret, LEGACY_RUNTIME_SYNC_SECRET_WARNING, RUNTIME_SYNC_SECRET_PURPOSE } from "../../sync-secret.js";
+import { getCfEnv } from "./cloudflare.js";
+let warnedLegacy = false;
+export async function requireAuth(event) {
+  const bindings = getCfEnv(event);
+  const config = useRuntimeConfig(event);
+  const root = bindings?.NUXT_APP_SECRET === void 0 ? config.appSecret : bindings.NUXT_APP_SECRET;
+  let secret;
+  if (root !== void 0 && root !== "") {
+    secret = await (bindings?.NUXT_APP_SECRET === void 0 ? deriveSecret(RUNTIME_SYNC_SECRET_PURPOSE) : deriveRuntimeSyncSecret(root)).catch((cause) => {
+      throw createError({ statusCode: 500, message: "Set NUXT_APP_SECRET to a string with at least 32 characters.", cause });
+    });
+  } else {
+    const moduleConfig = config["nuxt-ai-ready"];
+    const legacy = bindings?.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? bindings?.NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? globalThis.process?.env?.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? globalThis.process?.env?.NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? moduleConfig.runtimeSyncSecret;
+    if (typeof legacy !== "string" || !legacy) {
+      throw createError({ statusCode: 500, message: "Set NUXT_APP_SECRET to a string with at least 32 characters." });
+    }
+    if (!warnedLegacy) {
+      warnedLegacy = true;
+      logger.warn(LEGACY_RUNTIME_SYNC_SECRET_WARNING);
+    }
+    secret = legacy;
+  }
   const authHeader = getHeader(event, "authorization");
   let token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : void 0;
   if (!token) {
@@ -14,7 +35,7 @@ export function requireAuth(event) {
       logger.warn("Using `?secret=` query parameter is deprecated. Use `Authorization: Bearer <token>` header instead. See https://github.com/harlan-zw/nuxt-ai-ready/releases/tag/v1.0.0");
     }
   }
-  if (!token || token !== config.runtimeSyncSecret) {
+  if (!token || token !== secret) {
     throw createError({ statusCode: 401, message: "Unauthorized" });
   }
 }

package/dist/runtime/server/utils/cloudflare.d.ts

@@ -3,6 +3,9 @@ export interface CloudflareEnv {
     ASSETS?: {
         fetch: (req: Request | string) => Promise<Response>;
     };
+    NUXT_APP_SECRET?: unknown;
+    NUXT_AI_READY_RUNTIME_SYNC_SECRET?: unknown;
+    NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET?: unknown;
 }
 /**
  * Get Cloudflare environment from event context or globalThis.__env__ (for scheduled tasks)

package/dist/runtime/server/utils/prerender-html.d.ts

@@ -1,3 +1,6 @@
 import type { NuxtRenderHTMLContext } from 'nuxt/app';
 export declare function storePrerenderedHtml(path: string, html: string | NuxtRenderHTMLContext): void;
+/** Only rendered pages can hand a policy to a Markdown twin. */
+export declare function storePrerenderedContentSignal(path: string, policy: string): void;
+export declare function consumePrerenderedContentSignal(path: string): string | undefined;
 export declare function consumePrerenderedHtml(path: string): string | undefined;

package/dist/runtime/server/utils/prerender-html.js

@@ -1,10 +1,22 @@
 const htmlByPath = /* @__PURE__ */ new Map();
+const contentSignalByPath = /* @__PURE__ */ new Map();
 function normalizeHtmlCachePath(path) {
   return path.replace(/\/+$/, "") || "/";
 }
 export function storePrerenderedHtml(path, html) {
   htmlByPath.set(normalizeHtmlCachePath(path), html);
 }
+export function storePrerenderedContentSignal(path, policy) {
+  const key = normalizeHtmlCachePath(path);
+  if (htmlByPath.has(key))
+    contentSignalByPath.set(key, policy);
+}
+export function consumePrerenderedContentSignal(path) {
+  const key = normalizeHtmlCachePath(path);
+  const policy = contentSignalByPath.get(key);
+  contentSignalByPath.delete(key);
+  return policy;
+}
 export function consumePrerenderedHtml(path) {
   const key = normalizeHtmlCachePath(path);
   const html = htmlByPath.get(key);

package/dist/runtime/sync-secret.d.ts

@@ -0,0 +1,4 @@
+export declare const RUNTIME_SYNC_SECRET_PURPOSE = "nuxt-ai-ready:runtime-sync";
+export declare const LEGACY_RUNTIME_SYNC_SECRET_WARNING = "runtimeSyncSecret and NUXT_AI_READY_RUNTIME_SYNC_SECRET are deprecated. Set NUXT_APP_SECRET. Refresh scheduler tokens with `nuxt-ai-ready token`.";
+/** Nuxt deriveSecret's HKDF, for the CLI and event-bound Worker secrets. */
+export declare function deriveRuntimeSyncSecret(root: unknown): Promise<string>;

package/dist/runtime/sync-secret.js

@@ -0,0 +1,15 @@
+export const RUNTIME_SYNC_SECRET_PURPOSE = "nuxt-ai-ready:runtime-sync";
+export const LEGACY_RUNTIME_SYNC_SECRET_WARNING = "runtimeSyncSecret and NUXT_AI_READY_RUNTIME_SYNC_SECRET are deprecated. Set NUXT_APP_SECRET. Refresh scheduler tokens with `nuxt-ai-ready token`.";
+export async function deriveRuntimeSyncSecret(root) {
+  if (typeof root !== "string" || root.length < 32)
+    throw new Error("Set NUXT_APP_SECRET to a string with at least 32 characters.");
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(root), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: encoder.encode("nuxt"),
+    info: encoder.encode(RUNTIME_SYNC_SECRET_PURPOSE)
+  }, key, 256);
+  return Array.from(new Uint8Array(bits), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/runtime/types.d.ts

@@ -215,9 +215,10 @@ export interface ModuleOptions {
          */
         aiTrain?: boolean;
         /**
-         * Emit the draft Content-Usage robots.txt directive.
-         * Set to false to avoid robots.txt validators that do not support it yet.
-         * @default true
+         * Emit the draft IETF AI Preferences Content-Usage robots.txt directive.
+         * The Lighthouse robots-txt audit fails it as an unknown directive, so it is opt-in.
+         * Content-Signal already states the ai-train preference.
+         * @default false
          */
         contentUsage?: boolean;
         /**
@@ -336,8 +337,8 @@ export interface ModuleOptions {
      */
     cron?: boolean;
     /**
-     * Secret token for authenticating runtime sync endpoints
-     * When set, requires `Authorization: Bearer <token>` header for runtime sync endpoints
+     * Legacy bearer token for runtime sync endpoints.
+     * @deprecated Set NUXT_APP_SECRET instead. A configured application secret takes precedence.
      */
     runtimeSyncSecret?: string;
     /**