Compatibility matrix
How DynoStatic surfaces talk to external apps. Hosting remains PHP 8.4+ / MySQL|MariaDB with physical gateways—no required Node, Redis, or rewrites.
Widgets (runtime embeds)
| Concern | Contract |
|---|---|
| Markup | data-dynostatic-widget="WIDGET_ULID" |
| Loader | Classic deferred {installation}/embed.js |
| Auth | Exact registered Origin + signed one-use action tickets |
| Events | dynostatic:ready, dynostatic:submitted, dynostatic:consent, dynostatic:error |
| Frameworks | Astro view transitions supported (astro:page-load); any static host that can include a classic script |
| WordPress | A separately packaged PHP 7.4+/WordPress 6.2+ connector adds a widget block and shortcode while retaining the authenticated publication lanes. Unified WXR and authenticated HTTPS REST workflows import CMS posts/pages/custom types plus comments into the website discussion corpus; REST Application Password credentials remain request-ephemeral. A legacy comments-only WXR path remains available. Public imported media can be verified, retained remotely, copied locally, or have its DynoStatic reference retired without changing its asset ID |
| Drupal | Selected HTTPS JSON:API node collections import as CMS content; selected taxonomy/user collections resolve node labels, and same-origin file records become verification-pending media references. Public, Basic, and bearer credentials are request-ephemeral. Public imported files can later use the shared verify/retain/copy/retire workflow; private account fields and protected binaries are not fetched |
| Joomla | The verified Joomla 4/5 core articles route imports as CMS content; independently verified category/tag/user routes resolve article labels using public access or a request-ephemeral X-Joomla-Token. Article image references can later use the shared public verify/retain/copy/retire workflow. Standalone supporting objects, broader components, private account fields, and protected binaries are not active |
Headless CMS (build-time)
| Concern | Contract |
|---|---|
| Gateway | api/?action=cms.* (Bearer dynostatic_cms_…) |
| Origin | None — CI has no browser Origin; do not send one |
| Cache | ETag + If-None-Match → 304; X-DynoStatic-Content-Version |
| Preview | preview=1 requires token scope content:preview (drafts) |
| Media | Public media.php?id=ULID (rate-limited); optional signed URLs via signed_media=1 |
| Rebuilds | Webhooks content.published (+ related); prefer bin/dynostatic cron |
| Machine contract | cms-openapi.yaml; example clients for Astro and Hugo |
Do not mix
- Do not store CMS pages as widgets, or embed CMS entries as
data-dynostatic-widget. - Do not put Content API tokens in public frontends or shared CDN caches.
- Do not expect widget Origin CORS to apply to the Content API.
See also foundations.md, cms.md, integration.md.