# DynoStatic

> Self-hosted CMS and interactive widgets for PHP 8.4+ and MySQL 8.0+ or MariaDB 10.6+. The PHP installation needs no Node runtime or web-server rewrites. External Astro builds use their own build environment.

Build agents: start with this installation's integration.php, then follow agent.start. The versioned agent section links to installed contracts and explicitly distinguishes supported workflows from site-specific adapters. No external skill installation or DynoStatic source checkout is required. Public discovery is not a grant of access to any website; authenticated discovery determines identity, permissions and available actions.

All links below are relative to the installation root, including its subfolder.

## Start here

- [Integration manifest](integration.php): installed product version, embed snippets, agent guides, API discovery and delivery boundaries.
- [Build a CMS website](docs/site-conversion.md): editable Pages, safe import, source-managed translations, fresh published-content builds, media, forms and acceptance.
- [Optional skill](SKILL.md): concise workflow and widget embedding instructions.
- [Human documentation](docs/): the same guides rendered as HTML; also available in Admin → Help.

## Contracts

- [Headless CMS](docs/cms.md): website-bound Content API for published content, routes, media and native static exports.
- [Content OpenAPI](docs/cms-openapi.yaml): machine-readable API contract.
- [Automation API](docs/automation-api.md): authenticated capability discovery, revision-aware changesets, commands and media transport.
- [Source-managed translations](docs/source-managed-translations.md): source entries with grouped generated variants; manual/AI batch export and import. Built-in provider execution is not available.
- [Community deals and forums](docs/community-publishing.md): verified contributor accounts, product/photo suggestions, moderation, live discussions and confirmed Astro/Worker static publishing.
- [Website forms](docs/site-forms.md): cms.form v1; one complete published definition for a site's renderer and validator. The website owns submissions and runtime providers.
- [Form runtime example](examples/site-forms/runtime.mjs): dependency-free admission and validation helper, separate from transport.
- [Cloudflare website builds](docs/site-build-cloudflare.md): repository connection, build/runtime secrets, Node version, caching, Workers assets, deploy hooks and deployment proof.
- [Widget integration](docs/integration.md): exact origins, loader and browser events.
- [Styling](docs/styling.md): managed themes and host-owned light DOM.
- [Hosting DynoStatic](docs/deployment.md): root/subfolder installation and physical gateways.
- [Security](docs/security.md): permission and protected-data boundaries.

## Choose the delivery mode

Widget embeds render from DynoStatic at runtime. Headless sites fetch published content during a build and deploy their own markup and assets. Native Site publishing creates an immutable static export. These are separate workflows. An embed does not automatically copy its media into an Astro or Cloudflare build, and widget catalog readiness does not promise a static-build adapter for every widget.

Content builds use a private website-bound Bearer token with content:read and no browser Origin header. Begin with api/?action=cms.manifest; discover its actions before use. Current actions include cms.routes, cms.collection, cms.entry, cms.singleton, cms.translations, cms.media and cms.form. Follow pagination and declared locales. Production builds must fetch current published content and fail on incomplete or inconsistent inputs; an old local workspace or cached seed is not a live connection.

Workspace management uses a separate Automation bearer token. Discover api/?action=automation.capabilities before choosing a supported read, proposal, write or command. Do not infer permissions from the public manifest. Never place tokens in frontend code, URLs, public artifacts or logs.

## Embed shortcut

Add `<div data-dynostatic-widget="WIDGET_ULID"></div>` at the intended position and load the installation's classic deferred embed.js once, with data-cfasync="false". In Astro, mark the external script is:inline. Register the exact embedding origin in Settings → Integrations; never bypass that check. The runtime handles astro:page-load. Shadow DOM is the managed default; data-dynostatic-mode="light" requires the complete host styling contract.

Public events: dynostatic:ready, dynostatic:submitted, dynostatic:consent, dynostatic:error.