Configuring your site

import { defineConfig } from "vagejs";

export default defineConfig({
  site: "https://example.com",
  title: "My Website",
  description: "What this site is about.",
  lang: "en",
  seo: {
    robots: { aiTraining: "disallow", aiSearch: "allow" },
    llmsTxt: { full: true },
  },
  redirects: { "/old-page/": "/new-page/" },
});

Search engines and AI crawlers

By default robots.txt allows every crawler and links your sitemap. AI crawler rules apply only when you set them:

• aiTraining: GPTBot, ClaudeBot and Google-Extended (model training)
• aiSearch: OAI-SearchBot and Claude-SearchBot (AI search)

These crawler names come from each provider's documentation; npx vage guidelines lists them with their sources. robots.txt is a request, not access control.

Analytics

Analytics stays off until you configure it, and is added to production builds only.

integrations: {
  ga4: {
    measurementId: process.env.GA4_MEASUREMENT_ID,
    consentDefault: "denied",
    events: { signup_click: { params: ["plan"] } },
  },
},

Plausible and Microsoft Clarity take the snippet from their dashboards (integrations.plausible.snippet, integrations.clarity.snippet). Your consent banner calls window.vageConsent.update({ analytics_storage: "granted" }), which updates Google and Clarity.

Track a click without writing JavaScript:

<a href="/pricing/" data-vage-event="signup_click" data-vage-param-plan="pro">See plans</a>

vage check fails if an event or parameter isn't declared.

Security headers

When deploy.target is "cloudflare-pages", the build writes _headers with a Content-Security-Policy computed from your pages. Add sources your site needs with security.cspSources, or start with security.csp: "report-only".