nuxt-ai-ready 3.3.1 → 3.5.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-ai-ready",
   "type": "module",
-  "version": "3.3.1",
+  "version": "3.5.0",
   "description": "Best practice AI & LLM discoverability for Nuxt sites.",
   "author": {
     "name": "Harlan Wilton",

package/skills/nuxt-ai-ready/references/runtime-indexing.md

@@ -29,13 +29,19 @@ For D1, set `database: { type: 'd1', bindingName: 'AI_READY_DB' }` and create th
 export default defineNuxtConfig({
   aiReady: {
     runtimeSync: { ttl: 3600, batchSize: 50, pruneTtl: 0 },
-    runtimeSyncSecret: process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET,
     cron: true, // every 5 minutes, also enables runtimeSync
   },
 })
 ```
 
-Set `runtimeSyncSecret`. Without it, each build generates a new random secret, and external schedulers lose access after the next deployment.
+Set `NUXT_APP_SECRET` in production to a string with at least 32 characters.
+AI Ready and OG Image derive separate tokens from this shared Nuxt root secret.
+Run `pnpm exec nuxt-ai-ready token` with the root secret in your environment to obtain the runtime sync bearer token.
+Cloudflare can supply the root through its encrypted `NUXT_APP_SECRET` binding at runtime.
+The legacy `runtimeSyncSecret` option and `NUXT_AI_READY_RUNTIME_SYNC_SECRET` remain supported with a deprecation warning.
+They use the original bearer token unchanged when `appSecret` is unset or empty.
+A non-empty application secret takes precedence. An invalid application secret fails without using the legacy token.
+Without a root or legacy token, protected requests return `500`.
 
 Every control endpoint needs `Authorization: Bearer <secret>`, including `GET /__ai-ready/status`. Only `POST /__ai-ready/prune?dry=true` works without it.