nuxt-ai-ready 3.3.1 → 3.5.0

package/dist/shared/{nuxt-ai-ready.CKXM1jnE.mjs → nuxt-ai-ready.BaNK8yfw.mjs}

@@ -1,5 +1,4 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { readFile, access, mkdir, writeFile } from 'node:fs/promises';
+import { readFile, access, mkdir, writeFile, rm } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, basename, join, resolve, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -11,7 +10,9 @@ import { r as readPackageMetadata, a as resolvePackageMetadataPath } from './nux
 import { parseLlmsTxtConfig } from '../../dist/runtime/llms-txt-files.js';
 import { toDeployedRoute } from '../../dist/runtime/route-path.js';
 import { SITEMAP_MD_ROUTE } from '../../dist/runtime/server/utils/sitemap-md.js';
+import { LEGACY_RUNTIME_SYNC_SECRET_WARNING, deriveRuntimeSyncSecret } from '../../dist/runtime/sync-secret.js';
 import { publicCacheControl, mergeVaryHeader } from '../../dist/runtime/cache-control.js';
+import { createHash } from 'node:crypto';
 import { MCP_SERVER_CARD_MEDIA_TYPE, AI_CATALOG_MEDIA_TYPE } from '../../dist/runtime/server/utils/discovery-response.js';
 import { parseTOML, parseJSONC } from 'confbox';
 import { toMarkdownPath, hasMarkdownTwin, normalizePagePath } from '../../dist/runtime/markdown-path.js';
@@ -563,6 +564,334 @@ async function readCloudflareAssetRouting(rootDir) {
   }
 }
 
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function ensureStaticHeader(contents, route, name, value, mode = "default") {
+  const eol = contents.includes("\r\n") ? "\r\n" : "\n";
+  const routePattern = new RegExp(`^${escapeRegExp(route)}[\\t ]*\\r?$`, "gm");
+  const routeMatches = [...contents.matchAll(routePattern)];
+  const routeMatch = routeMatches.at(-1);
+  if (!routeMatch || routeMatch.index === void 0) {
+    const separator = contents.length === 0 ? "" : contents.endsWith(`${eol}${eol}`) ? "" : contents.endsWith(eol) ? eol : `${eol}${eol}`;
+    return `${contents}${separator}${route}${eol}  ${name}: ${value}${eol}`;
+  }
+  const routeLineEnd = routeMatch.index + routeMatch[0].length;
+  const blockStart = contents[routeLineEnd] === "\n" ? routeLineEnd + 1 : routeLineEnd;
+  const nextBlockPattern = /^(?![\t ]|\r?$).+/gm;
+  nextBlockPattern.lastIndex = blockStart;
+  const nextBlock = nextBlockPattern.exec(contents);
+  const blockEnd = nextBlock?.index ?? contents.length;
+  const block = contents.slice(blockStart, blockEnd);
+  const escapedName = escapeRegExp(name);
+  const existingHeaderPattern = new RegExp(
+    `^[\\t ]+(?:${escapedName}[\\t ]*:|![\\t ]*${escapedName}[\\t ]*\\r?$)`,
+    "im"
+  );
+  if (existingHeaderPattern.test(block)) {
+    if (mode === "append") {
+      const removalPattern = new RegExp(`^[\\t ]+![\\t ]*${escapedName}[\\t ]*\\r?$`, "im");
+      if (removalPattern.test(block))
+        return contents;
+      const valuePattern = new RegExp(`^([\\t ]+${escapedName}[\\t ]*:[\\t ]*)([^\\r\\n]*)(\\r?$)`, "im");
+      const match = block.match(valuePattern);
+      if (match) {
+        const merged = block.replace(valuePattern, (_line, prefix2, current, suffix) => {
+          const appended = name.toLowerCase() === "link" ? current.includes(value) ? current : [current, value].filter(Boolean).join(", ") : mergeVaryHeader(current, value);
+          return `${prefix2}${appended}${suffix}`;
+        });
+        return `${contents.slice(0, blockStart)}${merged}${contents.slice(blockEnd)}`;
+      }
+    }
+    return contents;
+  }
+  const prefix = blockStart === routeLineEnd ? eol : "";
+  return `${contents.slice(0, blockStart)}${prefix}  ${name}: ${value}${eol}${contents.slice(blockStart)}`;
+}
+function mergeStaticDiscoveryHeaders(contents, baseURL, entries) {
+  if (entries.length === 0)
+    return contents;
+  const route = toDeployedRoute("/*", baseURL);
+  const blocks = splitHeaderBlocks(contents);
+  const matching = blocks.filter((block) => block.route === route);
+  let merged = matching[0]?.text || "";
+  for (const block of matching.slice(1)) {
+    for (const line of block.text.split(/(?<=\n)/).slice(1)) {
+      const header = line.match(/^[\t ]+([^:\s]+):[\t ]*([^\r\n]*)/);
+      if (header?.[1]?.toLowerCase() === "link") {
+        merged = ensureStaticHeader(merged, route, header[1], header[2], "append");
+      } else if (header) {
+        const existing = new RegExp(`^[\\t ]+${escapeRegExp(header[1])}[\\t ]*:[^\\r\\n]*(?:\\r?\\n|$)`, "gim");
+        merged = ensureStaticHeader(merged.replace(existing, ""), route, header[1], header[2]);
+      } else {
+        merged += line;
+      }
+    }
+  }
+  if (matching.length > 1) {
+    let inserted = false;
+    contents = blocks.map((block) => {
+      if (block.route !== route)
+        return block.text;
+      if (inserted)
+        return "";
+      inserted = true;
+      return merged;
+    }).join("");
+  }
+  return entries.reduce((headers, entry) => ensureStaticHeader(headers, route, "Link", entry, "append"), contents);
+}
+function parseHeaderLine(line) {
+  const colon = line.indexOf(":");
+  if (!/^[\t ]/.test(line) || colon < 0)
+    return void 0;
+  const name = line.slice(0, colon).trim();
+  if (!name || name.startsWith("!") || /\s/.test(name))
+    return void 0;
+  const eol = line.endsWith("\r\n") ? "\r\n" : line.endsWith("\n") ? "\n" : "";
+  return {
+    name,
+    value: line.slice(colon + 1, line.length - eol.length).trim(),
+    withValue: (value) => `${line.slice(0, colon + 1)} ${value}${eol}`
+  };
+}
+const RE_DETACH_LINE = /^[\t ]+![\t ]*([^\s:]+)/;
+function patternToRegExp(pattern) {
+  const source = pattern.split(/(\*|:\w+)/).map((part) => part === "*" ? ".*" : part.startsWith(":") ? "[^/]+" : escapeRegExp(part)).join("");
+  return new RegExp(`^${source}$`);
+}
+function matchingStaticContentSignals(routeRules, route) {
+  return Object.entries(routeRules).flatMap(([pattern, rule]) => {
+    if (!patternToRegExp(pattern).test(route))
+      return [];
+    const headers = rule?.headers;
+    return Object.entries(headers || {}).filter(([name]) => name.toLowerCase() === "content-signal").map(([, value]) => value);
+  });
+}
+function normalizeStaticContentSignalHeaders(contents) {
+  const parsed = splitHeaderBlocks(contents);
+  if (!parsed.some((block) => /^\s+content-signal\s*:/im.test(block.text)))
+    return contents;
+  const policyLine = /^[\t ]+(?:content-signal\s*:.*|!\s*content-signal\s*)$/i;
+  const hasPolicy = (block) => block.text.split(/\r?\n/).slice(1).some((line) => policyLine.test(line));
+  const repeated = /* @__PURE__ */ new Map();
+  for (const block of parsed) {
+    if (block.route !== null)
+      repeated.set(block.route, [...repeated.get(block.route) || [], block]);
+  }
+  const combined = /* @__PURE__ */ new Set();
+  const blocks = parsed.flatMap((block) => {
+    const group = block.route === null ? [] : repeated.get(block.route);
+    if (group.length < 2 || !group.some(hasPolicy))
+      return [block];
+    if (combined.has(block.route))
+      return [];
+    combined.add(block.route);
+    const lines = group.at(-1).text.split(/\r?\n/).slice(1).filter((line) => !policyLine.test(line));
+    const policy = group.filter(hasPolicy).at(-1).text.split(/\r?\n/).slice(1).filter((line) => policyLine.test(line));
+    return [{ route: block.route, text: `${block.route}
+${[...lines, ...policy].join("\n")}
+` }];
+  });
+  const policyOnly = (block) => hasPolicy(block) && block.text.split(/\r?\n/).slice(1).every((line) => !line.trim() || line.trimStart().startsWith("#") || policyLine.test(line));
+  const policyValue = (block) => block.text.match(/^[\t ]+content-signal[\t ]*:(.*)$/im)?.[1]?.trim() ?? null;
+  const edges = blocks.map(() => /* @__PURE__ */ new Set());
+  const incoming = blocks.map(() => 0);
+  const connect = (before, after) => {
+    if (!edges[before].has(after)) {
+      edges[before].add(after);
+      incoming[after]++;
+    }
+  };
+  let previousUnrelated;
+  for (let index = 0; index < blocks.length; index++) {
+    if (!policyOnly(blocks[index])) {
+      if (previousUnrelated !== void 0)
+        connect(previousUnrelated, index);
+      previousUnrelated = index;
+    }
+  }
+  for (let broad = 0; broad < blocks.length; broad++) {
+    const source = blocks[broad];
+    if (!hasPolicy(source) || source.route === null)
+      continue;
+    for (let narrow = 0; narrow < blocks.length; narrow++) {
+      const target = blocks[narrow];
+      if (broad !== narrow && hasPolicy(target) && target.route !== null && policyValue(source) !== policyValue(target) && coversContentSignalPattern(source.route, target.route)) {
+        connect(broad, narrow);
+      }
+    }
+  }
+  const ordered = [];
+  const emitted = /* @__PURE__ */ new Set();
+  while (ordered.length < blocks.length) {
+    const next = incoming.findIndex((count, index) => count === 0 && !emitted.has(index));
+    if (next === -1)
+      throw new Error("Content-Signal rules conflict with other header ordering. Place broader mixed policy rules before narrower rules.");
+    emitted.add(next);
+    ordered.push(blocks[next]);
+    for (const target of edges[next])
+      incoming[target]--;
+  }
+  return ordered.map((block) => {
+    const text = block.text.trimEnd();
+    if (!/^\s+content-signal\s*:/im.test(text) || /^\s+!\s*content-signal\s*$/im.test(text))
+      return `${text}
+`;
+    return `${text.replace(/^(\s+)(content-signal\s*:)/im, "$1! Content-Signal\n$1$2")}
+`;
+  }).join("\n");
+}
+function coversPattern(broad, narrow) {
+  if (broad === narrow || !broad.startsWith("/") || !narrow.startsWith("/"))
+    return false;
+  if (!/[*:]/.test(narrow))
+    return patternToRegExp(broad).test(narrow);
+  return broad.indexOf("*") === broad.length - 1 && !broad.includes(":") && narrow.startsWith(broad.slice(0, -1));
+}
+function coversContentSignalPattern(broad, narrow) {
+  if (coversPattern(broad, narrow))
+    return true;
+  if (broad === narrow || !broad.startsWith("/") || !narrow.startsWith("/") || broad.indexOf("*") !== broad.length - 1 || !broad.includes(":")) {
+    return false;
+  }
+  const prefix = narrow.split("*")[0];
+  return !prefix.includes(":") && patternToRegExp(broad).test(prefix);
+}
+function splitLinkEntries(value) {
+  const entries = [];
+  let current = "";
+  let inUrl = false;
+  let inQuote = false;
+  for (const char of value) {
+    if (char === "<" && !inQuote)
+      inUrl = true;
+    else if (char === ">" && !inQuote)
+      inUrl = false;
+    else if (char === '"' && !inUrl)
+      inQuote = !inQuote;
+    if (char === "," && !inUrl && !inQuote) {
+      entries.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  entries.push(current.trim());
+  return entries.filter(Boolean);
+}
+function headerTokens(name, value) {
+  if (name === "link")
+    return splitLinkEntries(value);
+  if (name === "vary")
+    return value.split(",").map((token) => token.trim()).filter(Boolean);
+  return [value.trim()];
+}
+function tokenKey(name, token) {
+  return name === "vary" ? token.toLowerCase() : token;
+}
+function dedupeStaticHeaders(contents, names) {
+  const owned = new Set(names.map((name) => name.toLowerCase()));
+  const blocks = splitHeaderBlocks(contents);
+  const detached = /* @__PURE__ */ new Set();
+  const parsed = blocks.map((block) => {
+    const headers = [];
+    for (const line of block.text.split(/(?<=\n)/).slice(block.route === null ? 0 : 1)) {
+      const detach = line.match(RE_DETACH_LINE);
+      if (detach) {
+        detached.add(detach[1].toLowerCase());
+        continue;
+      }
+      const header = parseHeaderLine(line);
+      if (!header)
+        continue;
+      const name = header.name.toLowerCase();
+      if (owned.has(name))
+        headers.push({ name, tokens: headerTokens(name, header.value) });
+    }
+    return headers;
+  });
+  const lastRuleIndex = /* @__PURE__ */ new Map();
+  blocks.forEach((block, index) => {
+    if (block.route !== null)
+      lastRuleIndex.set(block.route, index);
+  });
+  let changed = false;
+  const output = blocks.map((block) => {
+    const route = block.route;
+    if (route === null)
+      return block.text;
+    const provided = /* @__PURE__ */ new Map();
+    lastRuleIndex.forEach((index, pattern) => {
+      if (!coversPattern(pattern, route))
+        return;
+      for (const { name, tokens } of parsed[index]) {
+        if (detached.has(name))
+          continue;
+        const values = provided.get(name) ?? /* @__PURE__ */ new Set();
+        tokens.forEach((token) => values.add(tokenKey(name, token)));
+        provided.set(name, values);
+      }
+    });
+    if (provided.size === 0)
+      return block.text;
+    const [routeLine, ...lines] = block.text.split(/(?<=\n)/);
+    let headerLines = 0;
+    const kept = lines.flatMap((line) => {
+      const header = parseHeaderLine(line);
+      if (!header) {
+        if (RE_DETACH_LINE.test(line))
+          headerLines++;
+        return [line];
+      }
+      headerLines++;
+      const name = header.name.toLowerCase();
+      const covered = provided.get(name);
+      if (!covered)
+        return [line];
+      const tokens = headerTokens(name, header.value);
+      const remaining = tokens.filter((token) => !covered.has(tokenKey(name, token)));
+      if (remaining.length === tokens.length)
+        return [line];
+      changed = true;
+      if (remaining.length > 0)
+        return [header.withValue(remaining.join(", "))];
+      headerLines--;
+      return [];
+    });
+    return headerLines === 0 ? kept.join("") : `${routeLine}${kept.join("")}`;
+  });
+  return changed ? output.join("") : contents;
+}
+const CLOUDFLARE_STATIC_HEADER_RULE_LIMIT = 100;
+const RE_EXACT_MARKDOWN_ROUTE$1 = /^\/[^*\s]*\.md[\t ]*\r?$/;
+function splitHeaderBlocks(contents) {
+  const blocks = [];
+  let current = { route: null, text: "" };
+  for (const line of contents.split(/(?<=\n)/)) {
+    const isRoute = /^[^\s#]/.test(line);
+    if (isRoute) {
+      blocks.push(current);
+      current = { route: line.trimEnd(), text: "" };
+    }
+    current.text += line;
+  }
+  blocks.push(current);
+  return blocks;
+}
+function enforceStaticHeaderBudget(contents, limit) {
+  const blocks = splitHeaderBlocks(contents);
+  const ruleCount = blocks.filter((block) => block.route !== null).length;
+  if (ruleCount <= limit)
+    return { contents, total: ruleCount, dropped: 0 };
+  const kept = blocks.filter((block) => block.route === null || !RE_EXACT_MARKDOWN_ROUTE$1.test(block.route) || /^\s+(?:content-signal\s*:|!\s*content-signal\s*$)/im.test(block.text));
+  return {
+    contents: kept.map((block) => block.text).join(""),
+    total: kept.filter((block) => block.route !== null).length,
+    dropped: ruleCount - kept.filter((block) => block.route !== null).length
+  };
+}
+
 const RE_MD_EXT = /\.md$/;
 function isStaticMarkdownSourceRoute(route) {
   if (route.includes("*") || route.includes(":"))
@@ -607,41 +936,68 @@ function prerenderedMarkdownHeaderRules(prerenderedRoutes, baseURL, describedby,
         headers: {
           "Content-Type": "text/markdown; charset=utf-8",
           "Vary": "Accept",
-          "Link": buildStaticMarkdownLinkHeader(pageRoute, baseURL, describedby)
+          "Link": buildStaticMarkdownLinkHeader(pageRoute, baseURL, describedby),
+          ...entry.contentSignal !== void 0 && { "Content-Signal": entry.contentSignal }
         }
       });
     }
   }
   return [...rules.values()];
 }
-const RE_EXACT_MARKDOWN_ROUTE$1 = /^\/[^*:\s]*\.md$/;
+const RE_EXACT_MARKDOWN_ROUTE = /^\/[^*:\s]*\.md$/;
 function isStaticHeaderRouteRule([, rule]) {
   return Boolean(rule && "headers" in rule && rule.headers);
 }
+function hasContentSignal$1(headers) {
+  return Object.keys(headers || {}).some((name) => name.toLowerCase() === "content-signal");
+}
 function planStaticMarkdownHeaderRules(routeRules, rules, limit) {
+  rules = rules.map((rule) => {
+    if (!hasContentSignal$1(rule.headers) || matchingStaticContentSignals(routeRules, rule.route).length === 0)
+      return rule;
+    return { ...rule, headers: Object.fromEntries(Object.entries(rule.headers).filter(([name]) => name.toLowerCase() !== "content-signal")) };
+  });
   if (limit === null)
     return { _tag: "apply", rules };
   const entries = Object.entries(routeRules).filter(isStaticHeaderRouteRule);
-  const registeredMarkdown = entries.map(([route]) => route).filter((route) => RE_EXACT_MARKDOWN_ROUTE$1.test(route));
+  const registeredMarkdown = entries.map(([route]) => route).filter((route) => RE_EXACT_MARKDOWN_ROUTE.test(route));
   const other = entries.length - registeredMarkdown.length;
   const markdown = /* @__PURE__ */ new Set([...registeredMarkdown, ...rules.map((rule) => rule.route)]);
   const total = other + markdown.size;
   if (total <= limit)
     return { _tag: "apply", rules };
-  return { _tag: "skip", drop: registeredMarkdown, total, dropped: markdown.size };
+  const policyRules = rules.filter((rule) => hasContentSignal$1(rule.headers));
+  const policyRoutes = /* @__PURE__ */ new Set([
+    ...policyRules.map((rule) => rule.route),
+    ...registeredMarkdown.filter((route) => hasContentSignal$1(routeRules[route].headers))
+  ]);
+  if (other + policyRoutes.size > limit)
+    return { _tag: "blocked", total: other + policyRoutes.size, limit };
+  return { _tag: "skip", drop: registeredMarkdown.filter((route) => !policyRoutes.has(route)), total, dropped: markdown.size - policyRoutes.size, rules: policyRules };
 }
 function applyStaticMarkdownHeaderPlan(routeRules, plan) {
+  if (plan._tag === "blocked")
+    throw new Error(`Content-Signal policy rules exceed the static header limit (${plan.total}/${plan.limit}). Reduce per-page policies or use a shared policy.`);
   if (plan._tag === "skip") {
     for (const route of plan.drop) {
       const rule = routeRules[route];
       if (rule)
         rule.headers = void 0;
     }
-    return;
   }
   for (const { route, headers } of plan.rules) {
     const existing = routeRules[route];
     const merged = defu({ headers: { ...headers } }, existing);
+    if (hasContentSignal$1(existing?.headers)) {
+      for (const name of Object.keys(merged.headers)) {
+        if (name.toLowerCase() === "content-signal")
+          delete merged.headers[name];
+      }
+      for (const [name, value] of Object.entries(existing.headers)) {
+        if (name.toLowerCase() === "content-signal")
+          merged.headers[name] = value;
+      }
+    }
     const vary = Object.entries(existing?.headers || {}).filter(([name]) => name.toLowerCase() === "vary").map(([, value]) => value).join(", ");
     if (headers.Vary) {
       for (const name of Object.keys(merged.headers)) {
@@ -788,7 +1144,8 @@ function resolveContentSignalPolicy(option) {
     _tag: "Configured",
     // One comma-separated line: validators reject one line per signal.
     contentSignal: `ai-train=${value(option.aiTrain)}, search=${value(option.search)}, ai-input=${value(option.aiInput)}`,
-    ...option.contentUsage !== false && { contentUsage: `train-ai=${option.aiTrain ? "y" : "n"}` }
+    // Opt-in: Lighthouse's robots-txt audit fails Content-Usage as an unknown directive.
+    ...option.contentUsage === true && { contentUsage: `train-ai=${option.aiTrain ? "y" : "n"}` }
   };
 }
 function hasContentSignal(value) {
@@ -829,6 +1186,8 @@ function applyContentSignalPolicy(groups, policy) {
   }
 }
 
+const AI_READY_CRON_SCHEDULE = "*/5 * * * *";
+
 const DATABASE_TYPE_NONE = "none";
 const DATABASE_DEPENDENT_OPTIONS = ["runtimeSync", "cron"];
 const DATABASE_CONSUMER_LABELS = {
@@ -1256,243 +1615,6 @@ function opaqueJsonModule(exports) {
   ].join("\n");
 }
 
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function ensureStaticHeader(contents, route, name, value, mode = "default") {
-  const eol = contents.includes("\r\n") ? "\r\n" : "\n";
-  const routePattern = new RegExp(`^${escapeRegExp(route)}[\\t ]*\\r?$`, "gm");
-  const routeMatches = [...contents.matchAll(routePattern)];
-  const routeMatch = routeMatches.at(-1);
-  if (!routeMatch || routeMatch.index === void 0) {
-    const separator = contents.length === 0 ? "" : contents.endsWith(`${eol}${eol}`) ? "" : contents.endsWith(eol) ? eol : `${eol}${eol}`;
-    return `${contents}${separator}${route}${eol}  ${name}: ${value}${eol}`;
-  }
-  const routeLineEnd = routeMatch.index + routeMatch[0].length;
-  const blockStart = contents[routeLineEnd] === "\n" ? routeLineEnd + 1 : routeLineEnd;
-  const nextBlockPattern = /^(?![\t ]|\r?$).+/gm;
-  nextBlockPattern.lastIndex = blockStart;
-  const nextBlock = nextBlockPattern.exec(contents);
-  const blockEnd = nextBlock?.index ?? contents.length;
-  const block = contents.slice(blockStart, blockEnd);
-  const escapedName = escapeRegExp(name);
-  const existingHeaderPattern = new RegExp(
-    `^[\\t ]+(?:${escapedName}[\\t ]*:|![\\t ]*${escapedName}[\\t ]*\\r?$)`,
-    "im"
-  );
-  if (existingHeaderPattern.test(block)) {
-    if (mode === "append") {
-      const removalPattern = new RegExp(`^[\\t ]+![\\t ]*${escapedName}[\\t ]*\\r?$`, "im");
-      if (removalPattern.test(block))
-        return contents;
-      const valuePattern = new RegExp(`^([\\t ]+${escapedName}[\\t ]*:[\\t ]*)([^\\r\\n]*)(\\r?$)`, "im");
-      const match = block.match(valuePattern);
-      if (match) {
-        const merged = block.replace(valuePattern, (_line, prefix2, current, suffix) => {
-          const appended = name.toLowerCase() === "link" ? current.includes(value) ? current : [current, value].filter(Boolean).join(", ") : mergeVaryHeader(current, value);
-          return `${prefix2}${appended}${suffix}`;
-        });
-        return `${contents.slice(0, blockStart)}${merged}${contents.slice(blockEnd)}`;
-      }
-    }
-    return contents;
-  }
-  const prefix = blockStart === routeLineEnd ? eol : "";
-  return `${contents.slice(0, blockStart)}${prefix}  ${name}: ${value}${eol}${contents.slice(blockStart)}`;
-}
-function mergeStaticDiscoveryHeaders(contents, baseURL, entries) {
-  if (entries.length === 0)
-    return contents;
-  const route = toDeployedRoute("/*", baseURL);
-  const blocks = splitHeaderBlocks(contents);
-  const matching = blocks.filter((block) => block.route === route);
-  let merged = matching[0]?.text || "";
-  for (const block of matching.slice(1)) {
-    for (const line of block.text.split(/(?<=\n)/).slice(1)) {
-      const header = line.match(/^[\t ]+([^:\s]+):[\t ]*([^\r\n]*)/);
-      if (header?.[1]?.toLowerCase() === "link") {
-        merged = ensureStaticHeader(merged, route, header[1], header[2], "append");
-      } else if (header) {
-        const existing = new RegExp(`^[\\t ]+${escapeRegExp(header[1])}[\\t ]*:[^\\r\\n]*(?:\\r?\\n|$)`, "gim");
-        merged = ensureStaticHeader(merged.replace(existing, ""), route, header[1], header[2]);
-      } else {
-        merged += line;
-      }
-    }
-  }
-  if (matching.length > 1) {
-    let inserted = false;
-    contents = blocks.map((block) => {
-      if (block.route !== route)
-        return block.text;
-      if (inserted)
-        return "";
-      inserted = true;
-      return merged;
-    }).join("");
-  }
-  return entries.reduce((headers, entry) => ensureStaticHeader(headers, route, "Link", entry, "append"), contents);
-}
-function parseHeaderLine(line) {
-  const colon = line.indexOf(":");
-  if (!/^[\t ]/.test(line) || colon < 0)
-    return void 0;
-  const name = line.slice(0, colon).trim();
-  if (!name || name.startsWith("!") || /\s/.test(name))
-    return void 0;
-  const eol = line.endsWith("\r\n") ? "\r\n" : line.endsWith("\n") ? "\n" : "";
-  return {
-    name,
-    value: line.slice(colon + 1, line.length - eol.length).trim(),
-    withValue: (value) => `${line.slice(0, colon + 1)} ${value}${eol}`
-  };
-}
-const RE_DETACH_LINE = /^[\t ]+![\t ]*([^\s:]+)/;
-function patternToRegExp(pattern) {
-  const source = pattern.split(/(\*|:\w+)/).map((part) => part === "*" ? ".*" : part.startsWith(":") ? "[^/]+" : escapeRegExp(part)).join("");
-  return new RegExp(`^${source}$`);
-}
-function coversPattern(broad, narrow) {
-  if (broad === narrow || !broad.startsWith("/") || !narrow.startsWith("/"))
-    return false;
-  if (!/[*:]/.test(narrow))
-    return patternToRegExp(broad).test(narrow);
-  return broad.indexOf("*") === broad.length - 1 && !broad.includes(":") && narrow.startsWith(broad.slice(0, -1));
-}
-function splitLinkEntries(value) {
-  const entries = [];
-  let current = "";
-  let inUrl = false;
-  let inQuote = false;
-  for (const char of value) {
-    if (char === "<" && !inQuote)
-      inUrl = true;
-    else if (char === ">" && !inQuote)
-      inUrl = false;
-    else if (char === '"' && !inUrl)
-      inQuote = !inQuote;
-    if (char === "," && !inUrl && !inQuote) {
-      entries.push(current.trim());
-      current = "";
-      continue;
-    }
-    current += char;
-  }
-  entries.push(current.trim());
-  return entries.filter(Boolean);
-}
-function headerTokens(name, value) {
-  if (name === "link")
-    return splitLinkEntries(value);
-  if (name === "vary")
-    return value.split(",").map((token) => token.trim()).filter(Boolean);
-  return [value.trim()];
-}
-function tokenKey(name, token) {
-  return name === "vary" ? token.toLowerCase() : token;
-}
-function dedupeStaticHeaders(contents, names) {
-  const owned = new Set(names.map((name) => name.toLowerCase()));
-  const blocks = splitHeaderBlocks(contents);
-  const detached = /* @__PURE__ */ new Set();
-  const parsed = blocks.map((block) => {
-    const headers = [];
-    for (const line of block.text.split(/(?<=\n)/).slice(block.route === null ? 0 : 1)) {
-      const detach = line.match(RE_DETACH_LINE);
-      if (detach) {
-        detached.add(detach[1].toLowerCase());
-        continue;
-      }
-      const header = parseHeaderLine(line);
-      if (!header)
-        continue;
-      const name = header.name.toLowerCase();
-      if (owned.has(name))
-        headers.push({ name, tokens: headerTokens(name, header.value) });
-    }
-    return headers;
-  });
-  const lastRuleIndex = /* @__PURE__ */ new Map();
-  blocks.forEach((block, index) => {
-    if (block.route !== null)
-      lastRuleIndex.set(block.route, index);
-  });
-  let changed = false;
-  const output = blocks.map((block) => {
-    const route = block.route;
-    if (route === null)
-      return block.text;
-    const provided = /* @__PURE__ */ new Map();
-    lastRuleIndex.forEach((index, pattern) => {
-      if (!coversPattern(pattern, route))
-        return;
-      for (const { name, tokens } of parsed[index]) {
-        if (detached.has(name))
-          continue;
-        const values = provided.get(name) ?? /* @__PURE__ */ new Set();
-        tokens.forEach((token) => values.add(tokenKey(name, token)));
-        provided.set(name, values);
-      }
-    });
-    if (provided.size === 0)
-      return block.text;
-    const [routeLine, ...lines] = block.text.split(/(?<=\n)/);
-    let headerLines = 0;
-    const kept = lines.flatMap((line) => {
-      const header = parseHeaderLine(line);
-      if (!header) {
-        if (RE_DETACH_LINE.test(line))
-          headerLines++;
-        return [line];
-      }
-      headerLines++;
-      const name = header.name.toLowerCase();
-      const covered = provided.get(name);
-      if (!covered)
-        return [line];
-      const tokens = headerTokens(name, header.value);
-      const remaining = tokens.filter((token) => !covered.has(tokenKey(name, token)));
-      if (remaining.length === tokens.length)
-        return [line];
-      changed = true;
-      if (remaining.length > 0)
-        return [header.withValue(remaining.join(", "))];
-      headerLines--;
-      return [];
-    });
-    return headerLines === 0 ? kept.join("") : `${routeLine}${kept.join("")}`;
-  });
-  return changed ? output.join("") : contents;
-}
-const CLOUDFLARE_STATIC_HEADER_RULE_LIMIT = 100;
-const RE_EXACT_MARKDOWN_ROUTE = /^\/[^*\s]*\.md[\t ]*\r?$/;
-function splitHeaderBlocks(contents) {
-  const blocks = [];
-  let current = { route: null, text: "" };
-  for (const line of contents.split(/(?<=\n)/)) {
-    const isRoute = /^[^\s#]/.test(line);
-    if (isRoute) {
-      blocks.push(current);
-      current = { route: line.trimEnd(), text: "" };
-    }
-    current.text += line;
-  }
-  blocks.push(current);
-  return blocks;
-}
-function enforceStaticHeaderBudget(contents, limit) {
-  const blocks = splitHeaderBlocks(contents);
-  const ruleCount = blocks.filter((block) => block.route !== null).length;
-  if (ruleCount <= limit)
-    return { contents, total: ruleCount, dropped: 0 };
-  const kept = blocks.filter((block) => block.route === null || !RE_EXACT_MARKDOWN_ROUTE.test(block.route));
-  return {
-    contents: kept.map((block) => block.text).join(""),
-    total: kept.filter((block) => block.route !== null).length,
-    dropped: ruleCount - kept.filter((block) => block.route !== null).length
-  };
-}
-
 const DEFAULT_MAX_OUTPUT_CHARS = 1500;
 const DEFAULT_LIST_LIMIT = 20;
 const DEFAULT_SEARCH_LIMIT = 10;
@@ -2121,18 +2243,17 @@ ${details}`);
     const sitemapConfig = nuxt.options.sitemap;
     const sitemapRouteRule = nuxt.options.nitro?.routeRules?.["/sitemap.xml"];
     const sitemapPrerendered = !!(sitemapConfig?.zeroRuntime || sitemapRouteRule?.prerender || process.argv.includes("generate") || process.env.NUXT_GENERATE === "true");
-    let runtimeSyncSecret = config.runtimeSyncSecret || process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET;
-    if (!runtimeSyncSecret && runtimeSyncEnabled) {
-      runtimeSyncSecret = randomBytes(32).toString("hex");
-      if (!nuxt.options.dev && !nuxt.options._prepare)
-        logger.info("Generated a new runtimeSyncSecret for this build. If an external scheduler calls /__ai-ready/*, set NUXT_AI_READY_RUNTIME_SYNC_SECRET; the generated secret changes on every build.");
-    }
-    if (runtimeSyncSecret) {
-      const cacheDir = join(nuxt.options.rootDir, "node_modules/.cache/nuxt/ai-ready");
-      logger.debug(`Creating cache directory for secret: ${cacheDir}`);
-      await mkdir(cacheDir, { recursive: true });
-      logger.debug(`Writing runtimeSyncSecret to cache`);
-      await writeFile(join(cacheDir, "secret"), runtimeSyncSecret);
+    const secretPath = join(nuxt.options.rootDir, "node_modules/.cache/nuxt/ai-ready/secret");
+    const appSecret = process.env.NITRO_APP_SECRET ?? process.env.NUXT_APP_SECRET ?? nuxt.options.runtimeConfig.appSecret;
+    const legacySecret = process.env.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? config.runtimeSyncSecret;
+    if (legacySecret)
+      logger.warn(LEGACY_RUNTIME_SYNC_SECRET_WARNING);
+    const syncSecret = typeof appSecret === "string" && appSecret.length >= 32 ? await deriveRuntimeSyncSecret(appSecret) : appSecret === void 0 || appSecret === "" ? legacySecret : void 0;
+    if (runtimeSyncEnabled && syncSecret) {
+      await mkdir(dirname(secretPath), { recursive: true });
+      await writeFile(secretPath, syncSecret, { mode: 384 });
+    } else {
+      await rm(secretPath, { force: true });
     }
     nuxt.hooks.hook("nitro:config", (nitroConfig) => {
       if (getNitroVersion(nuxt) === 3) {
@@ -2171,9 +2292,11 @@ ${details}`);
         const externals = nitroConfig.externals ||= {};
         externals.external ||= [];
         externals.external.push("mdream");
+        const rollupExternal = (nitroConfig.rollupConfig ||= {}).external ||= [];
+        if (Array.isArray(rollupExternal))
+          rollupExternal.push("node:sqlite");
       }
       if (config.cron && !nuxt.options.dev) {
-        const cronSchedule = "*/5 * * * *";
         const preset2 = String(nitroConfig.preset || "");
         const isVercel = preset2 === "vercel" || preset2 === "vercel-edge";
         const isCloudflarePages = preset2 === "cloudflare-pages" || preset2 === "cloudflare_pages";
@@ -2184,7 +2307,7 @@ ${details}`);
           nitroConfig.vercel.config = nitroConfig.vercel.config || {};
           nitroConfig.vercel.config.crons = nitroConfig.vercel.config.crons || [];
           nitroConfig.vercel.config.crons.push({
-            schedule: cronSchedule,
+            schedule: AI_READY_CRON_SCHEDULE,
             path: "/__ai-ready/cron"
           });
         } else {
@@ -2194,8 +2317,8 @@ ${details}`);
             handler: resolve$1("./runtime/server/tasks/ai-ready-cron")
           };
           nitroConfig.scheduledTasks = nitroConfig.scheduledTasks || {};
-          nitroConfig.scheduledTasks[cronSchedule] = nitroConfig.scheduledTasks[cronSchedule] || [];
-          nitroConfig.scheduledTasks[cronSchedule].push("ai-ready:cron");
+          nitroConfig.scheduledTasks[AI_READY_CRON_SCHEDULE] = nitroConfig.scheduledTasks[AI_READY_CRON_SCHEDULE] || [];
+          nitroConfig.scheduledTasks[AI_READY_CRON_SCHEDULE].push("ai-ready:cron");
           const isCloudflareWorkers = preset2.startsWith("cloudflare");
           if (isCloudflareWorkers) {
             nitroConfig.cloudflare = nitroConfig.cloudflare || {};
@@ -2203,8 +2326,8 @@ ${details}`);
             nitroConfig.cloudflare.wrangler = nitroConfig.cloudflare.wrangler || {};
             nitroConfig.cloudflare.wrangler.triggers = nitroConfig.cloudflare.wrangler.triggers || {};
             nitroConfig.cloudflare.wrangler.triggers.crons = nitroConfig.cloudflare.wrangler.triggers.crons || [];
-            if (!nitroConfig.cloudflare.wrangler.triggers.crons.includes(cronSchedule)) {
-              nitroConfig.cloudflare.wrangler.triggers.crons.push(cronSchedule);
+            if (!nitroConfig.cloudflare.wrangler.triggers.crons.includes(AI_READY_CRON_SCHEDULE)) {
+              nitroConfig.cloudflare.wrangler.triggers.crons.push(AI_READY_CRON_SCHEDULE);
             }
           }
         }
@@ -2322,7 +2445,7 @@ export function trackDrizzleWork(event, work) { return work }
         batchSize: runtimeSyncConfig.batchSize ?? 50,
         pruneTtl: runtimeSyncConfig.pruneTtl ?? 0
       },
-      runtimeSyncSecret,
+      runtimeSyncSecret: legacySecret || "",
       sitemapPrerendered,
       i18n: i18nConfig,
       ftsTokenizer,
@@ -2335,9 +2458,10 @@ export function trackDrizzleWork(event, work) { return work }
         handler: resolve$1("./runtime/server/middleware/markdown.prerender")
       });
       const htmlCapturePlugin = resolve$1("./runtime/server/plugins/html-capture.prerender");
+      const policyCapturePlugin = resolve$1(getNitroVersion(nuxt) === 3 ? "./runtime/server/plugins/content-signal-capture-nitro3.prerender" : "./runtime/server/plugins/content-signal-capture.prerender");
       nuxt.hook("nitro:init", (nitro) => {
         nitro.hooks.hook("prerender:config", (prerenderConfig) => {
-          prerenderConfig.plugins = [...prerenderConfig.plugins || [], htmlCapturePlugin];
+          prerenderConfig.plugins = [...prerenderConfig.plugins || [], htmlCapturePlugin, policyCapturePlugin];
         });
       });
       addPlugin({
@@ -2598,11 +2722,14 @@ export function trackDrizzleWork(event, work) { return work }
               discovery.push(`<${encodeURI(apiCatalogConfig.href)}>; rel="api-catalog"`);
             mergedHeaders = mergeStaticDiscoveryHeaders(mergedHeaders, staticBaseURL, discovery);
             mergedHeaders = dedupeStaticHeaders(mergedHeaders, ["Content-Type", "Link", "Vary"]);
+            mergedHeaders = normalizeStaticContentSignalHeaders(mergedHeaders);
             const budget = enforceStaticHeaderBudget(mergedHeaders, CLOUDFLARE_STATIC_HEADER_RULE_LIMIT);
             if (budget.dropped > 0) {
               mergedHeaders = budget.contents;
               noteSharedMarkdownRule(budget.total + budget.dropped, budget.dropped);
             }
+            if (budget.total > CLOUDFLARE_STATIC_HEADER_RULE_LIMIT && /^\s+(?:content-signal\s*:|!\s*content-signal\s*$)/im.test(budget.contents))
+              throw new Error(`Content-Signal policy rules exceed Cloudflare's ${CLOUDFLARE_STATIC_HEADER_RULE_LIMIT}-rule limit. Reduce per-page policies or use a shared policy.`);
             if (budget.total > CLOUDFLARE_STATIC_HEADER_RULE_LIMIT)
               logger.warn(`_headers still has ${budget.total} rules after dropping the .md rules. Cloudflare will reject the deploy until the other rules fit under ${CLOUDFLARE_STATIC_HEADER_RULE_LIMIT}.`);
           }
@@ -2616,4 +2743,4 @@ export function trackDrizzleWork(event, work) { return work }
   }
 });
 
-export { AGENT_SKILLS_SCHEMA as A, MARKDOWN_LINK_AVAILABILITY_FILE as M, logger as l, module$1 as m };
+export { AGENT_SKILLS_SCHEMA as A, MARKDOWN_LINK_AVAILABILITY_FILE as M, module$1 as a, logger as l, matchingStaticContentSignals as m };