nuxt-ai-ready 3.4.0 → 3.5.0

package/dist/chunks/agent-skills.mjs

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto';
 import { realpath, readFile, readdir } from 'node:fs/promises';
 import { join, resolve, isAbsolute, relative, sep } from 'node:path';
 import { parseDocument } from 'yaml';
-import { A as AGENT_SKILLS_SCHEMA } from '../shared/nuxt-ai-ready.O6_9Egm8.mjs';
+import { A as AGENT_SKILLS_SCHEMA } from '../shared/nuxt-ai-ready.BaNK8yfw.mjs';
 import 'node:module';
 import 'node:url';
 import '@nuxt/kit';
@@ -14,6 +14,7 @@ import 'node:fs';
 import '../../dist/runtime/llms-txt-files.js';
 import '../../dist/runtime/route-path.js';
 import '../../dist/runtime/server/utils/sitemap-md.js';
+import '../../dist/runtime/sync-secret.js';
 import '../../dist/runtime/cache-control.js';
 import '../../dist/runtime/server/utils/discovery-response.js';
 import 'confbox';

package/dist/chunks/prerender.mjs

@@ -6,7 +6,7 @@ import { resolveLocaleFromRoute } from 'nuxtseo-shared/i18n-runtime';
 import { createPrerenderFetch } from 'nuxtseo-shared/prerender';
 import { collectSitemap } from 'sitemapd/parse';
 import { parseURL, withLeadingSlash, joinURL, withBase } from 'ufo';
-import { l as logger, m as matchingStaticContentSignals, M as MARKDOWN_LINK_AVAILABILITY_FILE } from '../shared/nuxt-ai-ready.O6_9Egm8.mjs';
+import { l as logger, m as matchingStaticContentSignals, M as MARKDOWN_LINK_AVAILABILITY_FILE } from '../shared/nuxt-ai-ready.BaNK8yfw.mjs';
 import { toLogicalRoute, toDeployedRoute } from '../../dist/runtime/route-path.js';
 import { insertLlmsTxtDirective } from '../../dist/runtime/llms-txt-directive.js';
 import { absoluteSiteUrl } from '../../dist/runtime/markdown-links.js';
@@ -15,7 +15,6 @@ import { initSchema, computeContentHash, insertPage, queryAllPages, exportDbDump
 import { buildLlmsFullTxtHeader, formatPageForLlmsFullTxt } from '../../dist/runtime/server/utils/llms-full.js';
 import { resolvePageUpdatedAt } from '../../dist/runtime/server/utils/page-updated-at.js';
 import { SITEMAP_MD_ROUTE, appendSitemapSection } from '../../dist/runtime/server/utils/sitemap-md.js';
-import 'node:crypto';
 import 'node:module';
 import 'node:url';
 import 'defu';
@@ -24,7 +23,9 @@ import 'nuxtseo-shared/kit';
 import '../shared/nuxt-ai-ready.B3hAuOLQ.mjs';
 import 'node:fs';
 import '../../dist/runtime/llms-txt-files.js';
+import '../../dist/runtime/sync-secret.js';
 import '../../dist/runtime/cache-control.js';
+import 'node:crypto';
 import '../../dist/runtime/server/utils/discovery-response.js';
 import 'confbox';
 import 'nuxtseo-shared/server';

package/dist/cli.mjs

@@ -5,7 +5,9 @@ import { defineCommand, runMain } from 'citty';
 import { consola } from 'consola';
 import { colors } from 'consola/utils';
 import { resolve, join } from 'pathe';
+import { joinURL } from 'ufo';
 import { r as readPackageMetadata } from './shared/nuxt-ai-ready.B3hAuOLQ.mjs';
+import { deriveRuntimeSyncSecret, LEGACY_RUNTIME_SYNC_SECRET_WARNING } from '../dist/runtime/sync-secret.js';
 import 'node:module';
 import 'node:path';
 import 'node:url';
@@ -245,6 +247,14 @@ async function auditSite(options, dependencies) {
 }
 
 async function getSecret(cwd) {
+  const root = process.env.NITRO_APP_SECRET ?? process.env.NUXT_APP_SECRET;
+  if (root !== void 0 && root !== "")
+    return deriveRuntimeSyncSecret(root);
+  const legacy = process.env.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET;
+  if (legacy) {
+    console.warn(`[nuxt-ai-ready] ${LEGACY_RUNTIME_SYNC_SECRET_WARNING}`);
+    return legacy;
+  }
   const secretPath = join(cwd, "node_modules/.cache/nuxt/ai-ready/secret");
   if (!existsSync(secretPath)) {
     return null;
@@ -256,10 +266,10 @@ async function getSecret(cwd) {
 function authHeaders(secret) {
   return { Authorization: `Bearer ${secret}` };
 }
-async function requireSecret(cwd, hint = "") {
+async function requireSecret(cwd) {
   const secret = await getSecret(cwd);
   if (!secret) {
-    consola.error(`No secret found. Run \`nuxi dev\` or \`nuxi build\` first${hint}.`);
+    throw new Error("No secret found. Set NUXT_APP_SECRET, or run `nuxt dev` to cache its development token.");
   }
   return secret;
 }
@@ -287,6 +297,15 @@ const main = defineCommand({
     version: await readPackageMetadata(import.meta.url).then((p) => p.version || "0.0.0")
   },
   subCommands: {
+    token: () => defineCommand({
+      meta: { name: "token", description: "Print the runtime sync bearer token" },
+      args: { cwd: { type: "string", description: "Working directory", default: "." } },
+      async run({ args }) {
+        const secret = await requireSecret(resolve(args.cwd));
+        process.stdout.write(`${secret}
+`);
+      }
+    }),
     audit: () => defineCommand({
       meta: { name: "audit", description: "Check a public page and its agent discovery documents" },
       args: {
@@ -332,10 +351,10 @@ const main = defineCommand({
       },
       async run({ args }) {
         const cwd = resolve(args.cwd || ".");
-        const secret = await requireSecret(cwd, " to generate one");
+        const secret = await requireSecret(cwd);
         if (!secret)
           return;
-        const url = `${args.url}/__ai-ready/status`;
+        const url = joinURL(args.url, "/__ai-ready/status");
         consola.info(`Fetching status from ${args.url}...`);
         const res = await fetchJson(url, { headers: authHeaders(secret) }, "Failed to connect");
         consola.box("AI Ready Status");
@@ -419,7 +438,7 @@ const main = defineCommand({
         } else {
           params.set("limit", args.limit || "10");
         }
-        const url = `${args.url}/__ai-ready/poll?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/poll?${params}`);
         consola.info(`Triggering poll at ${args.url}...`);
         const res = await fetchJson(url, { method: "POST", headers: authHeaders(secret) });
         consola.success(`Indexed: ${colors.green(res.indexed?.toString() || "0")} pages`);
@@ -465,7 +484,7 @@ const main = defineCommand({
         if (!args.clear) {
           params.set("clear", "false");
         }
-        const url = `${args.url}/__ai-ready/restore?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/restore?${params}`);
         consola.info(`Restoring database at ${args.url}...`);
         const res = await fetchJson(url, { method: "POST", headers: authHeaders(secret) });
         consola.success(`Restored: ${colors.green(res.restored?.toString() || "0")} pages`);
@@ -505,15 +524,14 @@ const main = defineCommand({
         const cwd = resolve(args.cwd || ".");
         const secret = await getSecret(cwd);
         if (!secret && !args.dry) {
-          consola.error("No secret found. Run `nuxi dev` or `nuxi build` first.");
-          return;
+          throw new Error("No secret found. Set NUXT_APP_SECRET, or run `nuxt dev` to cache its development token.");
         }
         const params = new URLSearchParams();
         if (args.dry)
           params.set("dry", "true");
         if (args.ttl)
           params.set("ttl", args.ttl);
-        const url = `${args.url}/__ai-ready/prune?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/prune?${params}`);
         consola.info(`${args.dry ? "Previewing" : "Pruning"} stale routes at ${args.url}...`);
         const res = await fetchJson(url, {
           method: "POST",
@@ -572,7 +590,7 @@ const main = defineCommand({
         params.set("route", args.route);
         if (!args.force)
           params.set("force", "false");
-        const url = `${args.url}/__ai-ready/reindex?${params}`;
+        const url = joinURL(args.url, `/__ai-ready/reindex?${params}`);
         consola.info(`Reindexing ${args.route} at ${args.url}...`);
         const res = await fetchJson(url, { method: "POST", headers: authHeaders(secret) });
         if (res.indexed) {

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": "^4.6.0 || ^5.0.0-0"
   },
   "configKey": "aiReady",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -1,4 +1,3 @@
-import 'node:crypto';
 import 'node:fs/promises';
 import 'node:module';
 import 'node:path';
@@ -7,13 +6,15 @@ import '@nuxt/kit';
 import 'defu';
 import 'nuxt-site-config/kit';
 import 'nuxtseo-shared/kit';
-export { a as default } from './shared/nuxt-ai-ready.O6_9Egm8.mjs';
+export { a as default } from './shared/nuxt-ai-ready.BaNK8yfw.mjs';
 import './shared/nuxt-ai-ready.B3hAuOLQ.mjs';
 import '../dist/runtime/llms-txt-files.js';
 import '../dist/runtime/route-path.js';
 import '../dist/runtime/server/utils/sitemap-md.js';
+import '../dist/runtime/sync-secret.js';
 import '../dist/runtime/server/utils/discovery-response.js';
 import '../dist/runtime/cache-control.js';
+import 'node:crypto';
 import 'confbox';
 import '../dist/runtime/markdown-path.js';
 import 'nuxtseo-shared/server';

package/dist/runtime/server/routes/__ai-ready/cron.get.js

@@ -2,7 +2,7 @@ import { createError, eventHandler } from "#nuxtseo/h3";
 import { runCron } from "../../utils/runCron.js";
 export default eventHandler(async (event) => {
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const result = await runCron(event);
   if (result.failed) {
     throw createError({

package/dist/runtime/server/routes/__ai-ready/poll.post.js

@@ -5,7 +5,7 @@ import { logger } from "../../logger.js";
 import { batchIndexPages } from "../../utils/batchIndex.js";
 export default eventHandler(async (event) => {
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const lock = await tryAcquireCronLock(event);
   if (lock._tag === "held") {
     setResponseStatus(event, 409);

package/dist/runtime/server/routes/__ai-ready/prune.post.js

@@ -7,7 +7,7 @@ export default eventHandler(async (event) => {
   const dry = query.dry === "true" || query.dry === "1";
   if (!dry) {
     const { requireAuth } = await import("../../utils/auth.js");
-    requireAuth(event);
+    await requireAuth(event);
   }
   const ttl = query.ttl ? Math.max(0, Math.trunc(Number(query.ttl)) || config.runtimeSync.pruneTtl) : config.runtimeSync.pruneTtl;
   const refreshWindowMs = resolveSeedRefreshWindowMs(config.runtimeSync.pruneTtl);

package/dist/runtime/server/routes/__ai-ready/reindex.post.js

@@ -2,7 +2,7 @@ import { createError, eventHandler, getQuery, setResponseStatus } from "#nuxtseo
 import { indexPageByRoute } from "../../utils/indexPage.js";
 export default eventHandler(async (event) => {
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const query = getQuery(event);
   const route = typeof query.route === "string" ? query.route.trim() : "";
   if (!route.startsWith("/")) {

package/dist/runtime/server/routes/__ai-ready/restore.post.js

@@ -5,7 +5,7 @@ import { logger } from "../../logger.js";
 import { requireAuth } from "../../utils/auth.js";
 import { fetchPublicAsset } from "../../utils/cloudflare.js";
 export default eventHandler(async (event) => {
-  requireAuth(event);
+  await requireAuth(event);
   const query = getQuery(event);
   logger.debug("[restore] Fetching dump...");
   const dumpData = await fetchPublicAsset(event, "/__ai-ready/pages.dump", { responseType: "text" });

package/dist/runtime/server/routes/__ai-ready/status.get.js

@@ -4,7 +4,7 @@ import { countPages, countRecentlyIndexed, getCronLockStatus, getRecentCronRuns,
 export default eventHandler(async (event) => {
   const config = useRuntimeConfig(event)["nuxt-ai-ready"];
   const { requireAuth } = await import("../../utils/auth.js");
-  requireAuth(event);
+  await requireAuth(event);
   const [total, pending, recentlyIndexed24h, recentlyIndexed1h, recentPages] = await Promise.all([
     countPages(event),
     countPages(event, { where: { pending: true } }),

package/dist/runtime/server/utils/auth.d.ts

@@ -2,8 +2,6 @@ import type { H3Event } from '#nuxtseo/h3';
 /**
  * Verify the request has a valid Authorization: Bearer token.
  * Throws 401 if the token is missing or invalid.
- * No-op if runtimeSyncSecret is not configured.
- *
- * Also accepts the deprecated `?secret=` query param with a warning.
+ * Legacy tokens remain valid when no application secret is configured.
  */
-export declare function requireAuth(event: H3Event): void;
+export declare function requireAuth(event: H3Event): Promise<void>;

package/dist/runtime/server/utils/auth.js

@@ -1,10 +1,31 @@
+import { deriveSecret } from "nuxt/server";
 import { logger } from "#ai-ready-virtual/logger.mjs";
 import { createError, getHeader, getQuery } from "#nuxtseo/h3";
 import { useRuntimeConfig } from "#nuxtseo/nitro";
-export function requireAuth(event) {
-  const config = useRuntimeConfig(event)["nuxt-ai-ready"];
-  if (!config.runtimeSyncSecret)
-    return;
+import { deriveRuntimeSyncSecret, LEGACY_RUNTIME_SYNC_SECRET_WARNING, RUNTIME_SYNC_SECRET_PURPOSE } from "../../sync-secret.js";
+import { getCfEnv } from "./cloudflare.js";
+let warnedLegacy = false;
+export async function requireAuth(event) {
+  const bindings = getCfEnv(event);
+  const config = useRuntimeConfig(event);
+  const root = bindings?.NUXT_APP_SECRET === void 0 ? config.appSecret : bindings.NUXT_APP_SECRET;
+  let secret;
+  if (root !== void 0 && root !== "") {
+    secret = await (bindings?.NUXT_APP_SECRET === void 0 ? deriveSecret(RUNTIME_SYNC_SECRET_PURPOSE) : deriveRuntimeSyncSecret(root)).catch((cause) => {
+      throw createError({ statusCode: 500, message: "Set NUXT_APP_SECRET to a string with at least 32 characters.", cause });
+    });
+  } else {
+    const moduleConfig = config["nuxt-ai-ready"];
+    const legacy = bindings?.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? bindings?.NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? globalThis.process?.env?.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? globalThis.process?.env?.NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? moduleConfig.runtimeSyncSecret;
+    if (typeof legacy !== "string" || !legacy) {
+      throw createError({ statusCode: 500, message: "Set NUXT_APP_SECRET to a string with at least 32 characters." });
+    }
+    if (!warnedLegacy) {
+      warnedLegacy = true;
+      logger.warn(LEGACY_RUNTIME_SYNC_SECRET_WARNING);
+    }
+    secret = legacy;
+  }
   const authHeader = getHeader(event, "authorization");
   let token = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : void 0;
   if (!token) {
@@ -14,7 +35,7 @@ export function requireAuth(event) {
       logger.warn("Using `?secret=` query parameter is deprecated. Use `Authorization: Bearer <token>` header instead. See https://github.com/harlan-zw/nuxt-ai-ready/releases/tag/v1.0.0");
     }
   }
-  if (!token || token !== config.runtimeSyncSecret) {
+  if (!token || token !== secret) {
     throw createError({ statusCode: 401, message: "Unauthorized" });
   }
 }

package/dist/runtime/server/utils/cloudflare.d.ts

@@ -3,6 +3,9 @@ export interface CloudflareEnv {
     ASSETS?: {
         fetch: (req: Request | string) => Promise<Response>;
     };
+    NUXT_APP_SECRET?: unknown;
+    NUXT_AI_READY_RUNTIME_SYNC_SECRET?: unknown;
+    NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET?: unknown;
 }
 /**
  * Get Cloudflare environment from event context or globalThis.__env__ (for scheduled tasks)

package/dist/runtime/sync-secret.d.ts

@@ -0,0 +1,4 @@
+export declare const RUNTIME_SYNC_SECRET_PURPOSE = "nuxt-ai-ready:runtime-sync";
+export declare const LEGACY_RUNTIME_SYNC_SECRET_WARNING = "runtimeSyncSecret and NUXT_AI_READY_RUNTIME_SYNC_SECRET are deprecated. Set NUXT_APP_SECRET. Refresh scheduler tokens with `nuxt-ai-ready token`.";
+/** Nuxt deriveSecret's HKDF, for the CLI and event-bound Worker secrets. */
+export declare function deriveRuntimeSyncSecret(root: unknown): Promise<string>;

package/dist/runtime/sync-secret.js

@@ -0,0 +1,15 @@
+export const RUNTIME_SYNC_SECRET_PURPOSE = "nuxt-ai-ready:runtime-sync";
+export const LEGACY_RUNTIME_SYNC_SECRET_WARNING = "runtimeSyncSecret and NUXT_AI_READY_RUNTIME_SYNC_SECRET are deprecated. Set NUXT_APP_SECRET. Refresh scheduler tokens with `nuxt-ai-ready token`.";
+export async function deriveRuntimeSyncSecret(root) {
+  if (typeof root !== "string" || root.length < 32)
+    throw new Error("Set NUXT_APP_SECRET to a string with at least 32 characters.");
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(root), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: encoder.encode("nuxt"),
+    info: encoder.encode(RUNTIME_SYNC_SECRET_PURPOSE)
+  }, key, 256);
+  return Array.from(new Uint8Array(bits), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/runtime/types.d.ts

@@ -215,9 +215,10 @@ export interface ModuleOptions {
          */
         aiTrain?: boolean;
         /**
-         * Emit the draft Content-Usage robots.txt directive.
-         * Set to false to avoid robots.txt validators that do not support it yet.
-         * @default true
+         * Emit the draft IETF AI Preferences Content-Usage robots.txt directive.
+         * The Lighthouse robots-txt audit fails it as an unknown directive, so it is opt-in.
+         * Content-Signal already states the ai-train preference.
+         * @default false
          */
         contentUsage?: boolean;
         /**
@@ -336,8 +337,8 @@ export interface ModuleOptions {
      */
     cron?: boolean;
     /**
-     * Secret token for authenticating runtime sync endpoints
-     * When set, requires `Authorization: Bearer <token>` header for runtime sync endpoints
+     * Legacy bearer token for runtime sync endpoints.
+     * @deprecated Set NUXT_APP_SECRET instead. A configured application secret takes precedence.
      */
     runtimeSyncSecret?: string;
     /**

package/dist/shared/{nuxt-ai-ready.O6_9Egm8.mjs → nuxt-ai-ready.BaNK8yfw.mjs}

@@ -1,5 +1,4 @@
-import { createHash, randomBytes } from 'node:crypto';
-import { readFile, access, mkdir, writeFile } from 'node:fs/promises';
+import { readFile, access, mkdir, writeFile, rm } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { dirname, basename, join, resolve, relative } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -11,7 +10,9 @@ import { r as readPackageMetadata, a as resolvePackageMetadataPath } from './nux
 import { parseLlmsTxtConfig } from '../../dist/runtime/llms-txt-files.js';
 import { toDeployedRoute } from '../../dist/runtime/route-path.js';
 import { SITEMAP_MD_ROUTE } from '../../dist/runtime/server/utils/sitemap-md.js';
+import { LEGACY_RUNTIME_SYNC_SECRET_WARNING, deriveRuntimeSyncSecret } from '../../dist/runtime/sync-secret.js';
 import { publicCacheControl, mergeVaryHeader } from '../../dist/runtime/cache-control.js';
+import { createHash } from 'node:crypto';
 import { MCP_SERVER_CARD_MEDIA_TYPE, AI_CATALOG_MEDIA_TYPE } from '../../dist/runtime/server/utils/discovery-response.js';
 import { parseTOML, parseJSONC } from 'confbox';
 import { toMarkdownPath, hasMarkdownTwin, normalizePagePath } from '../../dist/runtime/markdown-path.js';
@@ -1143,7 +1144,8 @@ function resolveContentSignalPolicy(option) {
     _tag: "Configured",
     // One comma-separated line: validators reject one line per signal.
     contentSignal: `ai-train=${value(option.aiTrain)}, search=${value(option.search)}, ai-input=${value(option.aiInput)}`,
-    ...option.contentUsage !== false && { contentUsage: `train-ai=${option.aiTrain ? "y" : "n"}` }
+    // Opt-in: Lighthouse's robots-txt audit fails Content-Usage as an unknown directive.
+    ...option.contentUsage === true && { contentUsage: `train-ai=${option.aiTrain ? "y" : "n"}` }
   };
 }
 function hasContentSignal(value) {
@@ -1184,6 +1186,8 @@ function applyContentSignalPolicy(groups, policy) {
   }
 }
 
+const AI_READY_CRON_SCHEDULE = "*/5 * * * *";
+
 const DATABASE_TYPE_NONE = "none";
 const DATABASE_DEPENDENT_OPTIONS = ["runtimeSync", "cron"];
 const DATABASE_CONSUMER_LABELS = {
@@ -2239,18 +2243,17 @@ ${details}`);
     const sitemapConfig = nuxt.options.sitemap;
     const sitemapRouteRule = nuxt.options.nitro?.routeRules?.["/sitemap.xml"];
     const sitemapPrerendered = !!(sitemapConfig?.zeroRuntime || sitemapRouteRule?.prerender || process.argv.includes("generate") || process.env.NUXT_GENERATE === "true");
-    let runtimeSyncSecret = config.runtimeSyncSecret || process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET;
-    if (!runtimeSyncSecret && runtimeSyncEnabled) {
-      runtimeSyncSecret = randomBytes(32).toString("hex");
-      if (!nuxt.options.dev && !nuxt.options._prepare)
-        logger.info("Generated a new runtimeSyncSecret for this build. If an external scheduler calls /__ai-ready/*, set NUXT_AI_READY_RUNTIME_SYNC_SECRET; the generated secret changes on every build.");
-    }
-    if (runtimeSyncSecret) {
-      const cacheDir = join(nuxt.options.rootDir, "node_modules/.cache/nuxt/ai-ready");
-      logger.debug(`Creating cache directory for secret: ${cacheDir}`);
-      await mkdir(cacheDir, { recursive: true });
-      logger.debug(`Writing runtimeSyncSecret to cache`);
-      await writeFile(join(cacheDir, "secret"), runtimeSyncSecret);
+    const secretPath = join(nuxt.options.rootDir, "node_modules/.cache/nuxt/ai-ready/secret");
+    const appSecret = process.env.NITRO_APP_SECRET ?? process.env.NUXT_APP_SECRET ?? nuxt.options.runtimeConfig.appSecret;
+    const legacySecret = process.env.NUXT_NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET ?? config.runtimeSyncSecret;
+    if (legacySecret)
+      logger.warn(LEGACY_RUNTIME_SYNC_SECRET_WARNING);
+    const syncSecret = typeof appSecret === "string" && appSecret.length >= 32 ? await deriveRuntimeSyncSecret(appSecret) : appSecret === void 0 || appSecret === "" ? legacySecret : void 0;
+    if (runtimeSyncEnabled && syncSecret) {
+      await mkdir(dirname(secretPath), { recursive: true });
+      await writeFile(secretPath, syncSecret, { mode: 384 });
+    } else {
+      await rm(secretPath, { force: true });
     }
     nuxt.hooks.hook("nitro:config", (nitroConfig) => {
       if (getNitroVersion(nuxt) === 3) {
@@ -2289,9 +2292,11 @@ ${details}`);
         const externals = nitroConfig.externals ||= {};
         externals.external ||= [];
         externals.external.push("mdream");
+        const rollupExternal = (nitroConfig.rollupConfig ||= {}).external ||= [];
+        if (Array.isArray(rollupExternal))
+          rollupExternal.push("node:sqlite");
       }
       if (config.cron && !nuxt.options.dev) {
-        const cronSchedule = "*/5 * * * *";
         const preset2 = String(nitroConfig.preset || "");
         const isVercel = preset2 === "vercel" || preset2 === "vercel-edge";
         const isCloudflarePages = preset2 === "cloudflare-pages" || preset2 === "cloudflare_pages";
@@ -2302,7 +2307,7 @@ ${details}`);
           nitroConfig.vercel.config = nitroConfig.vercel.config || {};
           nitroConfig.vercel.config.crons = nitroConfig.vercel.config.crons || [];
           nitroConfig.vercel.config.crons.push({
-            schedule: cronSchedule,
+            schedule: AI_READY_CRON_SCHEDULE,
             path: "/__ai-ready/cron"
           });
         } else {
@@ -2312,8 +2317,8 @@ ${details}`);
             handler: resolve$1("./runtime/server/tasks/ai-ready-cron")
           };
           nitroConfig.scheduledTasks = nitroConfig.scheduledTasks || {};
-          nitroConfig.scheduledTasks[cronSchedule] = nitroConfig.scheduledTasks[cronSchedule] || [];
-          nitroConfig.scheduledTasks[cronSchedule].push("ai-ready:cron");
+          nitroConfig.scheduledTasks[AI_READY_CRON_SCHEDULE] = nitroConfig.scheduledTasks[AI_READY_CRON_SCHEDULE] || [];
+          nitroConfig.scheduledTasks[AI_READY_CRON_SCHEDULE].push("ai-ready:cron");
           const isCloudflareWorkers = preset2.startsWith("cloudflare");
           if (isCloudflareWorkers) {
             nitroConfig.cloudflare = nitroConfig.cloudflare || {};
@@ -2321,8 +2326,8 @@ ${details}`);
             nitroConfig.cloudflare.wrangler = nitroConfig.cloudflare.wrangler || {};
             nitroConfig.cloudflare.wrangler.triggers = nitroConfig.cloudflare.wrangler.triggers || {};
             nitroConfig.cloudflare.wrangler.triggers.crons = nitroConfig.cloudflare.wrangler.triggers.crons || [];
-            if (!nitroConfig.cloudflare.wrangler.triggers.crons.includes(cronSchedule)) {
-              nitroConfig.cloudflare.wrangler.triggers.crons.push(cronSchedule);
+            if (!nitroConfig.cloudflare.wrangler.triggers.crons.includes(AI_READY_CRON_SCHEDULE)) {
+              nitroConfig.cloudflare.wrangler.triggers.crons.push(AI_READY_CRON_SCHEDULE);
             }
           }
         }
@@ -2440,7 +2445,7 @@ export function trackDrizzleWork(event, work) { return work }
         batchSize: runtimeSyncConfig.batchSize ?? 50,
         pruneTtl: runtimeSyncConfig.pruneTtl ?? 0
       },
-      runtimeSyncSecret,
+      runtimeSyncSecret: legacySecret || "",
       sitemapPrerendered,
       i18n: i18nConfig,
       ftsTokenizer,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nuxt-ai-ready",
   "type": "module",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Best practice AI & LLM discoverability for Nuxt sites.",
   "author": {
     "name": "Harlan Wilton",

package/skills/nuxt-ai-ready/references/runtime-indexing.md

@@ -29,13 +29,19 @@ For D1, set `database: { type: 'd1', bindingName: 'AI_READY_DB' }` and create th
 export default defineNuxtConfig({
   aiReady: {
     runtimeSync: { ttl: 3600, batchSize: 50, pruneTtl: 0 },
-    runtimeSyncSecret: process.env.NUXT_AI_READY_RUNTIME_SYNC_SECRET,
     cron: true, // every 5 minutes, also enables runtimeSync
   },
 })
 ```
 
-Set `runtimeSyncSecret`. Without it, each build generates a new random secret, and external schedulers lose access after the next deployment.
+Set `NUXT_APP_SECRET` in production to a string with at least 32 characters.
+AI Ready and OG Image derive separate tokens from this shared Nuxt root secret.
+Run `pnpm exec nuxt-ai-ready token` with the root secret in your environment to obtain the runtime sync bearer token.
+Cloudflare can supply the root through its encrypted `NUXT_APP_SECRET` binding at runtime.
+The legacy `runtimeSyncSecret` option and `NUXT_AI_READY_RUNTIME_SYNC_SECRET` remain supported with a deprecation warning.
+They use the original bearer token unchanged when `appSecret` is unset or empty.
+A non-empty application secret takes precedence. An invalid application secret fails without using the legacy token.
+Without a root or legacy token, protected requests return `500`.
 
 Every control endpoint needs `Authorization: Bearer <secret>`, including `GET /__ai-ready/status`. Only `POST /__ai-ready/prune?dry=true` works without it.