refactor: separate website presentation from runtime

7 files changed, 110 insertions, 120 deletions

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 912ff332..fee229e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,8 +5,6 @@ on:
     types: [opened, synchronize, reopened]
   push:
     branches: [master, windows]
-    paths-ignore:
-      - "website/**"
 
 permissions:
   contents: read
diff --git a/.github/workflows/distribution.yml b/.github/workflows/distribution.yml
new file mode 100644
index 00000000..7062dc36
--- /dev/null
+++ b/.github/workflows/distribution.yml
@@ -0,0 +1,82 @@
+name: Distribution contract
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/distribution.yml"
+      - "distribution/**"
+      - "docs/next/website/**"
+      - "docs/preview/**"
+      - "docs/versions/**"
+      - "scripts/agent_detection_manifest_check.py"
+      - "scripts/config_reference_check.py"
+      - "scripts/docs/**"
+      - "scripts/docs_translation_parity.py"
+      - "scripts/preview.py"
+      - "scripts/test_agent_detection_manifest_check.py"
+      - "scripts/test_config_reference_check.py"
+      - "scripts/test_docs_translation_parity.py"
+      - "scripts/test_preview.py"
+      - "src/detect/manifest_update.rs"
+      - "src/detect/manifests/**"
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/distribution.yml"
+      - "distribution/**"
+      - "docs/next/website/**"
+      - "docs/preview/**"
+      - "docs/versions/**"
+      - "scripts/agent_detection_manifest_check.py"
+      - "scripts/config_reference_check.py"
+      - "scripts/docs/**"
+      - "scripts/docs_translation_parity.py"
+      - "scripts/preview.py"
+      - "scripts/test_agent_detection_manifest_check.py"
+      - "scripts/test_config_reference_check.py"
+      - "scripts/test_docs_translation_parity.py"
+      - "scripts/test_preview.py"
+      - "src/detect/manifest_update.rs"
+      - "src/detect/manifests/**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: distribution-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Test documentation lifecycle
+        run: bun test scripts/docs/*.test.ts
+
+      - name: Validate published contract
+        run: |
+          python3 scripts/agent_detection_manifest_check.py --require-published
+          python3 scripts/config_reference_check.py
+          python3 scripts/docs_translation_parity.py --docs-root docs/next/website/src/content/docs
+          node scripts/docs/versions.mjs check
+          node scripts/docs/preview.mjs check
+
+      - name: Test contract tooling
+        run: |
+          python3 -m unittest \
+            scripts.test_agent_detection_manifest_check \
+            scripts.test_config_reference_check \
+            scripts.test_docs_translation_parity \
+            scripts.test_preview
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index f2314dcf..cd880016 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -57,8 +57,8 @@ jobs:
           else
             commit="$(python3 scripts/preview.py select-commit --ref origin/master)"
           fi
-          current_preview="$(python3 scripts/preview.py current-commit --manifest website/preview.json || true)"
-          if [ "$current_preview" = "$commit" ] && node website/scripts/docs-preview.mjs check; then
+          current_preview="$(python3 scripts/preview.py current-commit --manifest distribution/preview.json || true)"
+          if [ "$current_preview" = "$commit" ] && node scripts/docs/preview.mjs check; then
             echo "Preview and documentation already point at $commit; skipping."
             echo "should_publish=false" >> "$GITHUB_OUTPUT"
             exit 0
@@ -305,17 +305,12 @@ jobs:
         with:
           path: artifacts
 
-      - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
-
       - name: Record previous preview commit
         id: previous-preview
         shell: bash
         run: |
           set -euo pipefail
-          previous="$(python3 scripts/preview.py current-commit --manifest website/preview.json || true)"
+          previous="$(python3 scripts/preview.py current-commit --manifest distribution/preview.json || true)"
           if [ -z "$previous" ]; then
             previous="$(git describe --tags --match 'v[0-9]*' --abbrev=0)"
           fi
@@ -418,9 +413,9 @@ jobs:
 
       - name: Update preview documentation and manifest
         run: |
-          node website/scripts/docs-preview.mjs snapshot '${{ needs.preflight.outputs.commit }}'
+          node scripts/docs/preview.mjs snapshot '${{ needs.preflight.outputs.commit }}'
           python3 scripts/preview.py manifest \
-            --output website/preview.json \
+            --output distribution/preview.json \
             --tag '${{ needs.preflight.outputs.tag }}' \
             --build-id '${{ needs.preflight.outputs.build_id }}' \
             --commit '${{ needs.preflight.outputs.commit }}' \
@@ -430,7 +425,6 @@ jobs:
             --notes PREVIEW_NOTES.md \
             --sha-file preview-sha256.json \
             --retain 30
-          (cd website && bun install --frozen-lockfile)
 
       - name: Commit preview publication
         env:
@@ -438,14 +432,13 @@ jobs:
         run: |
           git config user.name "kangal-bot"
           git config user.email "285672167+kangal-bot@users.noreply.github.com"
-          git add -A docs/preview website/preview.json
+          git add -A docs/preview distribution/preview.json
           git diff --cached --quiet || git commit -m "docs: publish preview documentation"
           remote="https://x-access-token:${KANGAL_GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           for attempt in 1 2 3; do
             git pull --rebase "$remote" master
-            node website/scripts/docs-preview.mjs check
-            node website/scripts/docs-versions.mjs check
-            (cd website && bun run build)
+            node scripts/docs/preview.mjs check
+            node scripts/docs/versions.mjs check
             if git push "$remote" HEAD:master; then
               exit 0
             fi
@@ -457,17 +450,6 @@ jobs:
           echo "failed to publish preview documentation after 3 attempts" >&2
           exit 1
 
-      - name: Trigger website deploy
-        env:
-          DEPLOY_HOOK: ${{ secrets.CLOUDFLARE_PAGES_DEPLOY_HOOK }}
-        run: |
-          if [ -z "$DEPLOY_HOOK" ]; then
-            echo "CLOUDFLARE_PAGES_DEPLOY_HOOK not set; relying on Cloudflare git auto-deploy"
-            exit 0
-          fi
-          curl -fsS -X POST "$DEPLOY_HOOK" > /dev/null
-          echo "Triggered Cloudflare Pages production deploy"
-
       - name: Mark preview-released issues
         continue-on-error: true
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a7cc3558..3b835c7a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -191,6 +191,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Install Bun
@@ -201,9 +202,13 @@ jobs:
       - name: Validate release inputs
         run: |
           python3 scripts/changelog.py validate-product-announcement
+          python3 scripts/agent_detection_manifest_check.py --require-all-published
+          python3 scripts/config_reference_check.py
+          node scripts/docs/versions.mjs check
+          node scripts/docs/preview.mjs check
+          bun test scripts/docs/*.test.ts
           test -f docs/next/README.md
           test -f docs/next/README.zh-CN.md
-          (cd website && bun install --frozen-lockfile && bun run test && bun run build:draft)
 
   release:
     needs: [build, flake-check, validate-release-inputs]
@@ -388,17 +393,12 @@ jobs:
           fetch-depth: 0
           ssh-key: ${{ secrets.RELEASE_DEPLOY_KEY }}
 
-      - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
-
-      - name: Publish tagged documentation and update website manifest
+      - name: Publish tagged documentation and update distribution manifest
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
-          node website/scripts/docs-versions.mjs publish "$GITHUB_REF_NAME"
+          node scripts/docs/versions.mjs publish "$GITHUB_REF_NAME"
           ANNOUNCEMENT_PATH="$RUNNER_TEMP/product-announcement.json"
           ANNOUNCEMENT_ORIGINAL_PATH="$RUNNER_TEMP/product-announcement-original.json"
           git show "${GITHUB_REF_NAME}:docs/next/product-announcement.json" > "$ANNOUNCEMENT_PATH"
@@ -406,35 +406,34 @@ jobs:
           python3 scripts/changelog.py validate-product-announcement --path "$ANNOUNCEMENT_PATH"
           RELEASE_PROTOCOL=$(git show "${GITHUB_REF_NAME}:src/protocol/wire.rs" | python3 -c 'import re, sys; match = re.search(r"pub const PROTOCOL_VERSION: u32 = (\d+);", sys.stdin.read()); sys.exit(1) if match is None else print(match.group(1))')
 
-          DOCS_CURRENT=$(node website/scripts/docs-versions.mjs current)
+          DOCS_CURRENT=$(node scripts/docs/versions.mjs current)
           if [ "$DOCS_CURRENT" != "$VERSION" ]; then
             echo "Archived v$VERSION documentation without moving current docs backward from v$DOCS_CURRENT"
             exit 0
           fi
-          CURRENT_VERSION=$(python3 -c 'import json; print(json.load(open("website/latest.json")).get("version", ""))')
+          CURRENT_VERSION=$(python3 -c 'import json; print(json.load(open("distribution/latest.json")).get("version", ""))')
           if [ "$CURRENT_VERSION" = "$VERSION" ]; then
-            echo "website/latest.json is already at v$VERSION"
+            echo "distribution/latest.json is already at v$VERSION"
             exit 0
           fi
-          python3 scripts/changelog.py sync-latest-json --version "$VERSION" --output website/latest.json --announcement "$ANNOUNCEMENT_PATH" --protocol "$RELEASE_PROTOCOL"
+          python3 scripts/changelog.py sync-latest-json --version "$VERSION" --output distribution/latest.json --announcement "$ANNOUNCEMENT_PATH" --protocol "$RELEASE_PROTOCOL"
           if cmp -s "$ANNOUNCEMENT_ORIGINAL_PATH" docs/next/product-announcement.json; then
             printf 'null\n' > docs/next/product-announcement.json
           else
             echo "::warning::docs/next/product-announcement.json changed after $GITHUB_REF_NAME; leaving it unchanged."
           fi
 
-      - name: Commit website latest manifest
+      - name: Commit release distribution
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add -A README.md README.zh-CN.md docs/versions website/latest.json docs/next/product-announcement.json
-          git diff --cached --quiet || git commit -m "docs: update website manifest for v$VERSION"
+          git add -A README.md README.zh-CN.md docs/versions distribution/latest.json docs/next/product-announcement.json
+          git diff --cached --quiet || git commit -m "docs: publish release distribution for v$VERSION"
           for attempt in 1 2 3; do
             git pull --rebase origin master
-            node website/scripts/docs-versions.mjs check
-            node website/scripts/docs-preview.mjs check
-            (cd website && bun install --frozen-lockfile && bun run build)
+            node scripts/docs/versions.mjs check
+            node scripts/docs/preview.mjs check
             if git push origin master; then
               exit 0
             fi
@@ -445,14 +444,3 @@ jobs:
           done
           echo "failed to publish release documentation after 3 attempts" >&2
           exit 1
-
-      - name: Trigger website deploy
-        env:
-          DEPLOY_HOOK: ${{ secrets.CLOUDFLARE_PAGES_DEPLOY_HOOK }}
-        run: |
-          if [ -z "$DEPLOY_HOOK" ]; then
-            echo "CLOUDFLARE_PAGES_DEPLOY_HOOK not set; relying on Cloudflare git auto-deploy"
-            exit 0
-          fi
-          curl -fsS -X POST "$DEPLOY_HOOK" > /dev/null
-          echo "Triggered Cloudflare Pages production deploy"
diff --git a/.github/workflows/website-deploy.yml b/.github/workflows/website-deploy.yml
index 7220af72..88283d6e 100644
--- a/.github/workflows/website-deploy.yml
+++ b/.github/workflows/website-deploy.yml
@@ -9,13 +9,7 @@ on:
       - "docs/preview/**"
       - "docs/versions/**"
       - "src/detect/manifests/**"
-      - "website/agent-detection/**"
-      - "website/agent-guide.md"
-      - "website/install.cmd"
-      - "website/install.ps1"
-      - "website/install.sh"
-      - "website/latest.json"
-      - "website/preview.json"
+      - "distribution/**"
 
 permissions:
   contents: read
diff --git a/.github/workflows/website.yml b/.github/workflows/website.yml
deleted file mode 100644
index b437c61f..00000000
--- a/.github/workflows/website.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: Website
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/website.yml"
-      - "website/**"
-      - "docs/next/website/**"
-      - "docs/preview/**"
-      - "docs/versions/**"
-      - "scripts/test_preview.py"
-  push:
-    branches: [master]
-    paths:
-      - ".github/workflows/website.yml"
-      - "website/**"
-      - "docs/next/website/**"
-      - "docs/preview/**"
-      - "docs/versions/**"
-      - "scripts/test_preview.py"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: website-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Install Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
-        with:
-          bun-version: 1.3.14
-
-      - name: Validate published documentation
-        run: |
-          node website/scripts/docs-versions.mjs check
-          node website/scripts/docs-preview.mjs check
-
-      - name: Build published website
-        run: cd website && bun install --frozen-lockfile && bun run build
-
-      - name: Validate unpublished draft
-        run: cd website && bun run build:draft
diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
index 1488d1f1..9904281b 100644
--- a/.github/workflows/windows-arm64.yml
+++ b/.github/workflows/windows-arm64.yml
@@ -6,13 +6,13 @@ on:
     paths:
       - ".github/workflows/windows-arm64.yml"
       - "scripts/windows_arm64_installer_test.ps1"
-      - "website/install.ps1"
+      - "distribution/install.ps1"
   push:
     branches: [master]
     paths:
       - ".github/workflows/windows-arm64.yml"
       - "scripts/windows_arm64_installer_test.ps1"
-      - "website/install.ps1"
+      - "distribution/install.ps1"
 
 permissions:
   contents: read