@acms-subir/core 0.0.1 → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# @acms-subir/core
+
+## 0.1.0
+
+### Minor Changes
+
+- d2d4761: Calendar card: embed a Google Calendar (or any ICS feed) as a native, themeable widget instead of an iframe. One card renders one view — month grid, week strip, or upcoming list — server-side at request time from the feed (5-minute cache, recurring events expanded, site timezone honored), with a small vanilla script for month/week navigation and an event-details popover. Paste an embed URL, calendar ID, or .ics link in the editor; add up to six color-coded feeds per card, plus an optional title/subtitle. Styling is driven by scoped `--cal-*` custom properties defaulting to theme tokens and stable `.pc-cal-*` class hooks, so themes and Settings → Code injection can restyle it freely.
+- 769f9de: Code-first content config: `acms({ content })` renames the post collection per project
+
+  - `content.posts.{singular,plural,base}` changes every user-visible label
+    (site nav, admin sidebar, headings, buttons, feeds) and moves the public
+    routes off `/blog` — validated at build time, defaults unchanged.
+  - Tag archives moved to a standalone `/tag/[slug]` (configurable via
+    `content.tags.base`); `<postsBase>/tag/*` always 301s to the new location.
+  - When `base` is renamed, `/blog/*` (plus any `content.posts.redirectFrom`
+    entries) 301s to the new base — only on requests that would otherwise 404,
+    so rules never shadow real content.
+  - Internal identifiers (DB rows, backup format, `/admin/posts`) are never
+    renamed, so existing backups and sessions survive.
+  - Scaffolder: new "What do you call your posts?" prompt (`--content
+articles|releases|notes`) writes the block into `astro.config.mjs`.
+
+- 769f9de: Multiple content collections: `acms({ content: { collections } })`
+
+  - Each key in the `collections` map gets its own public routes at `base`,
+    admin section at `/admin/c/<key>`, sidebar entry, dashboard stat, and
+    feed/sitemap entries. `posts` is the built-in collection; `content.posts`
+    stays as shorthand for `collections.posts`. Labels default from the key.
+  - Migration v19 rebuilds the posts table: new `collection` column (existing
+    rows land in `posts`) and slug uniqueness becomes per-collection, so the
+    same slug can exist in different collections. Pre-v19 backups restore
+    cleanly.
+  - One shared tag registry; tag archives group entries by collection when
+    more than one is configured. `/rss.xml` stays the everything-feed with a
+    collection `<category>` per item.
+  - The editor gains a collection switcher (multi-collection sites only);
+    moving a published entry between collections leaves a 301. Post-list cards
+    can target a collection.
+  - `/admin/posts` and `/admin/posts/[id]` 308 to their `/admin/c/posts`
+    equivalents. Removing a collection key hides its routes but never deletes
+    rows — the dashboard shows a restore notice.
+
+- 8e1f688: The update story: `acms update` now prints the release notes it crossed and deploy instructions matched to your target — `npm run deploy` for Cloudflare, `docker compose up -d --build` for Docker — plus a `--check` flag that exits 1 when behind, for CI or cron. Notes come from the `CHANGELOG.md` that now ships inside the package, so nothing depends on a git host or an API token. The admin dashboard shows a dismissible banner when a new release is out (checked at most daily, straight from the npm registry, fail-open), and `astro dev` logs a once-a-day nudge (opt out with `ACMS_NO_UPDATE_CHECK=1`). The scaffolder no longer freezes silently during `npm install` — the spinner animates with elapsed time — and its Next-steps box now mentions `npx acms update`.
+
+### Patch Changes
+
+- 19bf3c7: Enforce the documented "project-local routes win" rule at injection time. Astro registers injected and file-based routes at equal priority and serves the injected one on a collision (with a deprecation warning that this becomes a hard error), so the integration now skips injecting any route whose pattern the consumer already defines in `src/pages/` — checked as `<pattern>.astro`, `<pattern>.ts`, `<pattern>/index.astro`, or `<pattern>/index.ts`. Shell overrides of `/`, collection indexes, feeds, and any other public route now actually take effect.

package/cli.mjs

@@ -1,24 +1,32 @@
 #!/usr/bin/env node
 // `acms` — tiny maintenance CLI installed with @acms-subir/core.
-//   acms update   check the registry, install the latest core, print what's new
-//   acms doctor   sanity-check the project setup
+//   acms update           check the registry, install the latest core, print what's new
+//   acms update --check   just report whether an update exists (exit 1 if behind)
+//   acms doctor           sanity-check the project setup
+//   acms add cloudflare   retrofit Workers deployment (wrangler.jsonc, deps, D1/R2)
+//   acms add docker       retrofit self-hosting (Dockerfile, compose.yml)
 import { spawnSync } from 'node:child_process';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 
 const PKG = '@acms-subir/core';
 const cmd = process.argv[2];
 
 const read = (p) => { try { return readFileSync(p, 'utf8'); } catch { return ''; } };
-const installedVersion = () => {
+const installedPkgJson = () => {
   try {
-    const require = createRequire(join(process.cwd(), 'package.json'));
-    return JSON.parse(readFileSync(require.resolve(`${PKG}/package.json`), 'utf8')).version;
+    return createRequire(join(process.cwd(), 'package.json')).resolve(`${PKG}/package.json`);
   } catch { return null; }
 };
+const installedVersion = () => {
+  const p = installedPkgJson();
+  try { return p ? JSON.parse(readFileSync(p, 'utf8')).version : null; } catch { return null; }
+};
 const latestVersion = async () => {
-  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`);
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`, {
+    signal: AbortSignal.timeout(10_000),
+  });
   if (!res.ok) throw new Error(`registry responded ${res.status}`);
   return (await res.json()).version;
 };
@@ -28,7 +36,33 @@ const semverLt = (a, b) => {
   return false;
 };
 
+// Release notes come from the CHANGELOG that changesets writes into the
+// package itself, read after the install from the freshly unpacked copy. No
+// git-host API is involved on purpose: the repository lives on a private
+// OneDev instance, so anything API-based would need a token on every site
+// that runs this command.
+const changelogFor = (pkgJsonPath) => (pkgJsonPath ? read(join(dirname(pkgJsonPath), 'CHANGELOG.md')) : '');
+// Entries newer than `current` up to `latest`, oldest first. Changesets writes
+// one "## X.Y.Z" heading per release.
+const releaseNotes = (md, current, latest) => {
+  // split on every "## " heading, not just the version ones, so a hand-written
+  // "## Unreleased" section cannot get swallowed into the entry above it
+  const heads = [...md.matchAll(/^## +(.*)$/gm)];
+  return heads
+    .map((h, i) => ({
+      version: h[1].trim().match(/^\d+\.\d+\.\d+$/)?.[0],
+      body: md.slice(h.index + h[0].length, heads[i + 1]?.index ?? md.length).trim(),
+    }))
+    .filter((r) => r.version && semverLt(current, r.version) && !semverLt(latest, r.version))
+    .sort((a, b) => (semverLt(a.version, b.version) ? -1 : 1));
+};
+const deployTargets = () => ({
+  cloudflare: ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'].some((f) => existsSync(f)),
+  docker: ['compose.yml', 'compose.yaml', 'docker-compose.yml', 'Dockerfile'].some((f) => existsSync(f)),
+});
+
 if (cmd === 'update') {
+  const checkOnly = process.argv.includes('--check');
   const current = installedVersion();
   if (!current) { console.error(`✗ ${PKG} is not installed here — run this from your site's folder.`); process.exit(1); }
   let latest;
@@ -37,13 +71,217 @@ if (cmd === 'update') {
     console.log(`✓ Already up to date (${current}).`);
     process.exit(0);
   }
+  if (checkOnly) {
+    console.log(`Update available: ${current} → ${latest}. Run: npx acms update`);
+    process.exit(1);
+  }
   console.log(`Updating ${PKG} ${current} → ${latest}…`);
   const res = spawnSync('npm', ['install', `${PKG}@latest`, '--no-audit', '--no-fund'], { stdio: 'inherit' });
   if (res.status !== 0) process.exit(res.status ?? 1);
-  console.log(`
-✓ Updated to ${latest}. What's new: https://github.com/zurielbm/acms-subir/releases
-  Deploy when ready:  npm run deploy
-  (the database migrates itself on the first request — no manual steps)`);
+  console.log(`\n✓ Updated to ${latest}.`);
+  const notes = releaseNotes(changelogFor(installedPkgJson()), current, latest);
+  if (notes.length) {
+    console.log(`\nWhat's new:`);
+    for (const r of notes) {
+      console.log(`\n  ${PKG} ${r.version}`);
+      if (r.body) console.log(r.body.split('\n').map((l) => `    ${l}`).join('\n'));
+    }
+  } else {
+    console.log(`\nWhat's new: https://www.npmjs.com/package/${PKG}/v/${latest}`);
+  }
+  const t = deployTargets();
+  const steps = [
+    ...(t.cloudflare ? ['  npm run deploy                       # Cloudflare Workers'] : []),
+    ...(t.docker ? ['  git push, then on your server:       docker compose up -d --build'] : []),
+  ];
+  console.log([
+    '',
+    'Deploy when ready:',
+    ...(steps.length ? steps : ['  rebuild and redeploy your host']),
+    '  (the database migrates itself on the first request — no manual steps)',
+  ].join('\n'));
+  // the registry fetch leaves a keep-alive socket in undici's pool, which can
+  // hold the event loop open for seconds after there is nothing left to do
+  process.exit(0);
+} else if (cmd === 'add') {
+  // Retrofit a deployment target onto an existing project. Both targets share
+  // one codebase — astro.config picks the adapter via DEPLOY_TARGET — so
+  // "adding" one is only config files + deps. Content moves between backends
+  // with a backup ZIP (admin → Backup, then admin → Restore on the new host).
+  const what = process.argv[3];
+  if (!existsSync('package.json')) {
+    console.error("✗ No package.json here — run this from your site's folder.");
+    process.exit(1);
+  }
+  const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
+  const slug = (pkg.name || 'my-site').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 50) || 'my-site';
+  const writeNew = (file, body) => {
+    if (existsSync(file)) { console.log(`• ${file} already exists — left untouched`); return false; }
+    writeFileSync(file, body);
+    console.log(`✓ wrote ${file}`);
+    return true;
+  };
+  const setScript = (name, value) => {
+    pkg.scripts ??= {};
+    if (pkg.scripts[name]) return;
+    pkg.scripts[name] = value;
+    console.log(`✓ added "${name}" script`);
+  };
+
+  if (what === 'cloudflare') {
+    writeNew('wrangler.jsonc', `{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "${slug}",
+  "main": "./dist/_worker.js/index.js",
+  "compatibility_date": "2025-07-01",
+  "compatibility_flags": ["nodejs_compat"],
+  "assets": {
+    "binding": "ASSETS",
+    "directory": "./dist"
+  },
+  "observability": {
+    "enabled": true
+  },
+  // Scheduled publishing: flips due scheduled posts to published every 5
+  // minutes, independent of site traffic.
+  "triggers": {
+    "crons": ["*/5 * * * *"]
+  },
+  // If the id below is still zeros, create the real database with
+  //   npx wrangler d1 create ${slug}-db
+  // and paste the returned database_id here. Local dev (wrangler dev /
+  // astro dev) uses a local simulator and works with the placeholder.
+  "d1_databases": [
+    {
+      "binding": "DB",
+      "database_name": "${slug}-db",
+      "database_id": "00000000-0000-0000-0000-000000000000"
+    }
+  ],
+  // If missing, create the real bucket with:
+  //   npx wrangler r2 bucket create ${slug}-media
+  // Local dev uses a local simulator and works without creating anything.
+  "r2_buckets": [
+    {
+      "binding": "MEDIA",
+      "bucket_name": "${slug}-media"
+    }
+  ]
+}
+`);
+    setScript('preview', 'npm run build && wrangler dev');
+    setScript('deploy', 'npm run build && wrangler deploy');
+    writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+    if (!pkg.devDependencies?.wrangler && !pkg.dependencies?.wrangler) {
+      console.log('Installing wrangler…');
+      const res = spawnSync('npm', ['install', '-D', 'wrangler', '--no-audit', '--no-fund'], { stdio: 'inherit' });
+      if (res.status !== 0) console.error('✗ npm install -D wrangler failed — install it manually.');
+    }
+    if (process.argv.includes('--provision')) {
+      console.log(`Creating D1 database ${slug}-db…`);
+      const d1 = spawnSync('npx', ['--no-install', 'wrangler', 'd1', 'create', `${slug}-db`], { encoding: 'utf8' });
+      const id = (d1.stdout || '').match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/)?.[0];
+      if (d1.status === 0 && id) {
+        writeFileSync('wrangler.jsonc', readFileSync('wrangler.jsonc', 'utf8').replace('00000000-0000-0000-0000-000000000000', id));
+        console.log(`✓ D1 created (${id})`);
+      } else {
+        console.error(`✗ D1 creation failed — create it later with: npx wrangler d1 create ${slug}-db`);
+      }
+      const r2 = spawnSync('npx', ['--no-install', 'wrangler', 'r2', 'bucket', 'create', `${slug}-media`], { encoding: 'utf8' });
+      console.log(r2.status === 0 ? '✓ R2 bucket created' : `✗ R2 creation failed — create it later with: npx wrangler r2 bucket create ${slug}-media`);
+    }
+    console.log(`
+✓ Cloudflare target ready. Next:
+  npx wrangler d1 create ${slug}-db          # unless --provision did it; paste the id into wrangler.jsonc
+  npx wrangler secret put ADMIN_PASSWORD
+  npx wrangler secret put SESSION_SECRET
+  npm run deploy
+  Moving existing content? Admin → Backup on the old host, Admin → Restore on the new one.`);
+  } else if (what === 'docker') {
+    writeNew('Dockerfile', `# Self-hosted Node target. Build/run via compose.yml, or directly:
+#   docker build -t ${slug} . && docker run -p 4321:4321 -v acms_data:/app/data ${slug}
+FROM node:22-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json* *.tgz* ./
+RUN npm install --no-audit --no-fund
+# self-heal npm/cli#4828: a lockfile updated on macOS can omit the Linux
+# platform binaries (rollup, libsql) while still "installing" cleanly
+RUN node -e "require('rollup')" >/dev/null 2>&1 || \\
+    (rm -rf node_modules package-lock.json && npm install --no-audit --no-fund)
+COPY . .
+RUN DEPLOY_TARGET=node npm run build:node
+
+FROM node:22-slim
+# WORKDIR must stay stable: SQLITE_URL and the media store resolve ./data
+# against the process CWD
+WORKDIR /app
+ENV NODE_ENV=production HOST=0.0.0.0 PORT=4321
+# the standalone bundle in dist/ contains all app code; the only runtime
+# import left in node_modules is @libsql/client (dynamically imported so it
+# stays out of the Workers bundle) — installing just that keeps the image
+# ~300MB instead of ~2GB
+RUN npm install --no-save --no-audit --no-fund "@libsql/client@^0.15.0"
+COPY --from=build /app/dist ./dist
+# ./data holds the SQLite database and uploaded media — mount a volume here.
+# Only data/ needs to be writable (a chown -R of /app would copy-on-write
+# duplicate every node_modules file into a fresh layer)
+RUN mkdir -p data && chown node:node data
+USER node
+EXPOSE 4321
+CMD ["node", "./dist/server/entry.mjs"]
+`);
+    writeNew('compose.yml', `# Self-hosting on your own server. A reverse proxy you already run (Coolify,
+# Dokploy, Traefik, nginx, Caddy) terminates TLS and routes to port 4321.
+# Secrets come from .env in this directory (compose reads it automatically).
+services:
+  site:
+    build: .
+    restart: unless-stopped
+    expose:
+      - "4321"
+    # No reverse proxy? Publish the port directly instead:
+    # ports:
+    #   - "4321:4321"
+    volumes:
+      # one volume covers everything: SQLite database + uploaded media
+      - data:/app/data
+    environment:
+      - HOST=0.0.0.0
+      - PORT=4321
+      - ADMIN_PASSWORD=\${ADMIN_PASSWORD:?set ADMIN_PASSWORD in .env}
+      - SESSION_SECRET=\${SESSION_SECRET:?set SESSION_SECRET in .env}
+      - SQLITE_URL=file:./data/acms.db
+    healthcheck:
+      # also serves as the scheduled-publish heartbeat: each probe is a real
+      # request, which triggers the middleware publish sweep
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4321/').then((r)=>process.exit(r.ok?0:1),()=>process.exit(1))"]
+      interval: 300s
+      start_period: 15s
+
+volumes:
+  data:
+`);
+    writeNew('.dockerignore', `node_modules
+dist
+.astro
+data
+.env
+.dev.vars
+.wrangler
+.git
+`);
+    setScript('build:node', 'DEPLOY_TARGET=node astro build');
+    writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+    console.log(`
+✓ Docker target ready. Next (on your server):
+  set real ADMIN_PASSWORD / SESSION_SECRET in .env
+  docker compose up -d --build     # or point Coolify/Dokploy/Railway at the repo
+  data lives in the volume at /app/data (SQLite + media)
+  Moving existing content? Admin → Backup on the old host, Admin → Restore on the new one.`);
+  } else {
+    console.error('Usage: acms add <cloudflare|docker> [--provision]');
+    process.exit(1);
+  }
 } else if (cmd === 'doctor') {
   let bad = 0;
   const check = (ok, label, hint) => {
@@ -69,7 +307,10 @@ if (cmd === 'update') {
   console.log(`acms — maintenance CLI for @acms-subir/core
 
 Usage:
-  acms update   Update the CMS core to the latest release
-  acms doctor   Check this project's setup`);
+  acms update           Update the CMS core to the latest release
+  acms update --check   Report whether an update exists (exit 1 if behind)
+  acms doctor           Check this project's setup
+  acms add cloudflare   Add Workers deployment to this project (--provision creates D1 + R2)
+  acms add docker       Add Docker self-hosting to this project`);
   process.exit(cmd ? 1 : 0);
 }

package/integration.mjs

@@ -1,4 +1,5 @@
-import { readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 // This file is loaded by Node while Astro evaluates the consumer's
@@ -27,7 +28,6 @@ const ROUTES = [
   ['/[...slug]', '[...slug].astro'],
   ['/author/[slug]', 'author/[slug].astro'],
   ['/links', 'links.astro'],
-  ['/search', 'search.astro'],
   ['/go/[id]', 'go/[id].ts'],
   ['/media/[...key]', 'media/[...key].ts'],
   ['/embed/[pageId]/[blockId]', 'embed/[pageId]/[blockId].ts'],
@@ -180,6 +180,55 @@ function resolveI18n(i18n, contentBases) {
   return { locales, defaultLocale };
 }
 
+// Defaults + validation for acms({ search }). Search ships on; disabling it
+// removes the /search page(s) and /api/search from the route table, and the
+// layout skips the header trigger + modal (lib/search-config.ts).
+function resolveSearch(search) {
+  if (search === undefined) return { enabled: true };
+  const unknown = Object.keys(search).filter((k) => k !== 'enabled');
+  if (unknown.length > 0) {
+    throw new Error(
+      `acms: unknown search key${unknown.length > 1 ? 's' : ''} ${unknown.map((k) => `"${k}"`).join(', ')} — ` +
+        'the only valid key is search.enabled'
+    );
+  }
+  const enabled = search.enabled ?? true;
+  if (typeof enabled !== 'boolean') {
+    throw new Error('acms: search.enabled must be true or false');
+  }
+  return { enabled };
+}
+
+const semverLt = (a, b) => {
+  const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
+  return false;
+};
+
+// Dev-only update nudge: one log line when a newer core is on npm, checked at
+// most once per 24h (stamp file in Astro's cache dir). Fire-and-forget — it
+// never delays startup and swallows every failure. ACMS_NO_UPDATE_CHECK=1
+// disables it entirely.
+async function devUpdateNudge(cacheDir, logger) {
+  const stampFile = join(cacheDir, 'acms-update-check.json');
+  try {
+    const stamp = JSON.parse(readFileSync(stampFile, 'utf8'));
+    if (Date.now() - stamp.at < 86_400_000) return;
+  } catch {}
+  try {
+    const res = await fetch('https://registry.npmjs.org/@acms-subir%2Fcore/latest', {
+      signal: AbortSignal.timeout(3000),
+    });
+    if (!res.ok) return;
+    const latest = (await res.json()).version ?? '';
+    mkdirSync(dirname(stampFile), { recursive: true });
+    writeFileSync(stampFile, JSON.stringify({ at: Date.now(), latest }));
+    if (latest && semverLt(CORE_VERSION, latest)) {
+      logger.info(`v${latest} is available (you're on ${CORE_VERSION}) — npx acms update`);
+    }
+  } catch {}
+}
+
 const CONFIG_ID = 'virtual:acms-config';
 const THEMES_ID = 'virtual:acms-user-themes';
 
@@ -231,6 +280,10 @@ function acmsVitePlugin(userConfig) {
  *   Home page content per language is authored in /admin as a normal page
  *   marked "home" with that language selected. Omit for monolingual sites —
  *   nothing changes.
+ * @param {{enabled?: boolean}} [options.search]
+ *   Public site search: the /search page, the /api/search JSON endpoint, and
+ *   the header search modal. On by default — set `enabled: false` to remove
+ *   all three.
  * @returns {import('astro').AstroIntegration}
  */
 export default function acms(options = {}) {
@@ -240,12 +293,14 @@ export default function acms(options = {}) {
     [content.tags.base, 'content.tags.base'],
   ]);
   const i18n = resolveI18n(options.i18n, contentBases);
+  const search = resolveSearch(options.search);
   const userConfig = {
     coreVersion: CORE_VERSION,
     brand: options.brand ?? {},
     seed: options.seed ?? {},
     content,
     i18n,
+    search,
   };
   const routes = [...ROUTES];
   for (const c of Object.values(content.collections)) {
@@ -257,13 +312,35 @@ export default function acms(options = {}) {
   for (const l of i18n.locales) {
     if (l !== i18n.defaultLocale) routes.push([`/${l}`, 'index.astro']);
   }
+  if (search.enabled) {
+    routes.push(['/search', 'search.astro'], ['/api/search', 'api/search.ts']);
+    // a locale-prefixed search page per non-default locale, mirroring the
+    // per-locale home routes; search.astro derives its locale from the path
+    for (const l of i18n.locales) {
+      if (l !== i18n.defaultLocale) routes.push([`/${l}/search`, 'search.astro']);
+    }
+  }
+  let cacheDir = '';
   return {
     name: 'acms',
     hooks: {
-      'astro:config:setup': ({ command, injectRoute, addMiddleware, updateConfig }) => {
+      'astro:config:setup': ({ config, command, injectRoute, addMiddleware, updateConfig }) => {
+        if (config.cacheDir) cacheDir = fileURLToPath(config.cacheDir);
         updateConfig({ vite: { plugins: [acmsVitePlugin(userConfig)] } });
 
+        // "Project-local routes win" is enforced here: Astro registers
+        // injected and file-based routes at equal priority (and the injected
+        // one is served on a collision), so a route is only injected when the
+        // consumer has no file at the same pattern in src/pages.
+        const pagesDir = fileURLToPath(new URL('./pages/', config.srcDir));
+        const overridden = (pattern) => {
+          const rel = pattern === '/' ? 'index' : pattern.slice(1);
+          return ['.astro', '.ts', '/index.astro', '/index.ts'].some((suffix) =>
+            existsSync(`${pagesDir}${rel}${suffix}`)
+          );
+        };
         for (const [pattern, file] of routes) {
+          if (overridden(pattern)) continue;
           injectRoute({ pattern, entrypoint: entry(`./src/pages/${file}`) });
         }
         // Auth gate, trailing-slash canonicalization, redirect fallback,
@@ -281,6 +358,11 @@ export default function acms(options = {}) {
           });
         }
       },
+      // fires only for `astro dev` — builds and previews never phone anywhere
+      'astro:server:start': ({ logger }) => {
+        if (!cacheDir || process.env.ACMS_NO_UPDATE_CHECK) return;
+        void devUpdateNudge(cacheDir, logger);
+      },
     },
   };
 }

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "publishConfig": {
     "access": "public"
   },
-  "description": "Widget-based CMS for Astro on Cloudflare Workers \u2014 admin UI, content storage, themes, and APIs shipped as one integration.",
+  "description": "Widget-based CMS for Astro on Cloudflare Workers — admin UI, content storage, themes, and APIs shipped as one integration.",
   "type": "module",
   "license": "MIT",
   "homepage": "https://acms.subir.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/zurielbm/acms-subir.git",
+    "url": "git+https://onedev.subir.dev/acms-subir.git",
     "directory": "packages/core"
   },
   "keywords": [
@@ -40,7 +40,8 @@
   "files": [
     "integration.mjs",
     "cli.mjs",
-    "src"
+    "src",
+    "CHANGELOG.md"
   ],
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -64,7 +65,7 @@
   "peerDependencies": {
     "@astrojs/cloudflare": "^12.6.13",
     "@astrojs/node": "^9.2.0",
-    "@astrojs/react": "^6.0.2",
+    "@astrojs/react": "^4.4.2",
     "astro": "^5.7.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"