@deneb-ui/cli 2.0.54 → 2.0.55

package/bin/index.js

@@ -720,6 +720,13 @@ async function initProject(targetInput, options = {}) {
       addedCount++;
     }
   }
+  // Ensure Node 20 LTS platform engine compatibility
+  pkg.overrides = pkg.overrides || {};
+  if (!pkg.overrides['content-type']) {
+    pkg.overrides['content-type'] = '2.1.0';
+    pkg.overrides['@octokit/request'] = { 'content-type': '2.1.0' };
+  }
+
   fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
   if (addedCount > 0) {
     console.log(`\x1b[32m✔ Configured\x1b[0m DENEB scripts in package.json (lab, validate, zip, validate-and-zip, package:template, update:deneb)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deneb-ui/cli",
-  "version": "2.0.54",
+  "version": "2.0.55",
   "description": "Official DENEB CLI — scaffold, convert, validate, and package Fivora-ready storefront templates.",
   "bin": {
     "deneb": "bin/index.js",
@@ -49,7 +49,7 @@
   "license": "MIT",
   "dependencies": {
     "@babel/parser": "^7.28.0",
-    "@deneb-ui/core": "^2.0.54",
+    "@deneb-ui/core": "^2.0.55",
     "@octokit/rest": "^22.0.1",
     "adm-zip": "^0.6.0",
     "dotenv": "^17.4.2",
@@ -58,5 +58,8 @@
   "devDependencies": {
     "esbuild": "^0.28.2",
     "typescript": "^5.9.3"
+  },
+  "overrides": {
+    "content-type": "2.1.0"
   }
 }

package/src/arc/fivora-contract.cjs

@@ -1,5 +1,8 @@
 'use strict';
 
+const PLATFORM_CONTRACT = require('../platform/platform-contract.json');
+
+
 /**
  * Faithful port of the Fivora strict visual-editing contract rules that the
  * platform ingest pipeline applies (backend/src/common/template-visual-edit-contract.ts).
@@ -64,7 +67,14 @@ function pathsOverlap(left, right) {
   return wildcardPath(left) === wildcardPath(right);
 }
 
+function isPlatformControlled(path) {
+  return (PLATFORM_CONTRACT.platformControlledPaths || []).some((platformPath) =>
+    platformPath.includes('[*]') ? wildcardPath(path) === platformPath : path === platformPath
+  );
+}
+
 function isControlOnly(path, controlOnlyPaths) {
+  if (isPlatformControlled(path)) return true;
   return (controlOnlyPaths || []).some((controlPath) =>
     controlPath.includes('[*]') ? wildcardPath(path) === controlPath : path === controlPath
   );

package/src/arc/manifest.cjs

@@ -5,6 +5,8 @@ const { readJsonSafe, writeJson, deepMerge, isPlainObject } = require('./fs-util
 const { ARC_VERSION, SCHEMA_VERSION } = require('./version.cjs');
 const { collectFontIdsFromSiteData, applyFontTheme } = require('./font-plan.cjs');
 const { humanLabel, classifyFieldType } = require('./field-paths.cjs');
+const PLATFORM_CONTRACT = require('../platform/platform-contract.json');
+
 const {
   enumerateContentPaths,
   canonicalizeMarkerPath,
@@ -294,9 +296,16 @@ function baseContent(projectName, routes) {
  * data-preview-field-path marker or be declared control-only. Control-only is
  * reserved for ids, internal flags, and the unrendered merchant baseline — not
  * as a dump for fields ARC planned but failed to bind.
+ *
+ * PLATFORM_CONTROLLED_PATHS: paths the Fivora AI/platform writes that templates
+ * must never render as inline editable HTML. Loaded from platform-contract.json
+ * so all templates benefit automatically without any template-side declaration.
  */
 const BASELINE_CONTROL_ONLY = /^(common\.(websiteTitle|shortDescription|logoUrl|headerCtaLabel|copyright|navLabels(\.[^.]+)?|business(\.[^.]+)*))$/;
 const SYSTEM_FIELD = /(^|\.)(id|key|slug|internalId|sku|_id)$/i;
+const PLATFORM_CONTROLLED_PATHS = new Set(
+  (PLATFORM_CONTRACT.platformControlledPaths || []).map(wildcardPath)
+);
 
 function slimListItems(items, itemFields) {
   const keys = (itemFields || []).map((field) => field.key).filter(Boolean);
@@ -314,7 +323,56 @@ function slimListItems(items, itemFields) {
 }
 
 function isAllowedControlOnly(path) {
-  return BASELINE_CONTROL_ONLY.test(path) || SYSTEM_FIELD.test(path);
+  return (
+    BASELINE_CONTROL_ONLY.test(path) ||
+    SYSTEM_FIELD.test(path) ||
+    PLATFORM_CONTROLLED_PATHS.has(wildcardPath(path))
+  );
+}
+
+/**
+ * Ensures platform-managed editorSchema sections exist. These sections are required
+ * by the strict contract validator when their sub-paths appear in controlOnlyPaths.
+ * Template developers must never need to add these manually.
+ */
+function ensurePlatformSections(sections) {
+  // additionalPages: rendered visually by PlatformAdditionalPages component.
+  // label is editable; id and route are platform-controlled.
+  if (!sections.find((s) => s.id === 'additionalPages')) {
+    sections.push({
+      id: 'additionalPages',
+      path: 'additionalPages',
+      type: 'list',
+      label: 'Additional Pages',
+      minItems: 0,
+      maxItems: 20,
+      fields: [
+        { key: 'label', type: 'text', label: 'Page label', required: true },
+        { key: 'id', type: 'text', label: 'Page ID' },
+        { key: 'route', type: 'text', label: 'Page route' },
+      ],
+    });
+  }
+
+  // __fivoraIntake: AI intake data written by the platform. Never rendered in
+  // template HTML — always control-only. Section required so sub-paths can be
+  // declared in controlOnlyPaths without "unknown path" errors.
+  if (!sections.find((s) => s.id === '__fivoraIntake')) {
+    sections.push({
+      id: '__fivoraIntake',
+      path: '__fivoraIntake',
+      type: 'object',
+      label: 'AI Intake (Platform Managed)',
+      fields: [
+        { key: 'tone', type: 'text', label: 'Brand tone' },
+        { key: 'outputLanguage', type: 'text', label: 'Output language' },
+        { key: 'businessSummary', type: 'textarea', label: 'Business summary' },
+        { key: 'additionalBusinessDetails', type: 'textarea', label: 'Additional business details' },
+        { key: 'referenceWebsiteUrl', type: 'url', label: 'Reference website URL' },
+        { key: 'guidanceNotes', type: 'object', label: 'AI Guidance Notes' },
+      ],
+    });
+  }
 }
 
 function computeControlOnlyPaths(content, boundPaths, declared = []) {
@@ -322,6 +380,17 @@ function computeControlOnlyPaths(content, boundPaths, declared = []) {
   const bound = new Set([...(boundPaths || [])].map(wildcardPath));
   const controlOnly = new Set();
 
+  // Auto-inject all platform-contract paths that exist in site data content —
+  // templates never need to declare these manually.
+  for (const platformPath of PLATFORM_CONTRACT.platformControlledPaths || []) {
+    const canonical = canonicalizeMarkerPath(platformPath);
+    if (!canonical) continue;
+    const known = [...inventory.fieldPatterns, ...inventory.concreteFields].some(
+      (path) => wildcardPath(path) === wildcardPath(canonical)
+    );
+    if (known) controlOnly.add(canonical);
+  }
+
   for (const declaredPath of declared) {
     const canonical = canonicalizeMarkerPath(declaredPath);
     if (!canonical || !isAllowedControlOnly(canonical)) continue;
@@ -506,6 +575,14 @@ function buildSiteDataAndManifest({
   assignSectionPageKeys(editorSections, routes, markerRoutes);
   enrichSchemasFromContent(content, editorSections);
 
+  // Auto-inject platform-managed editorSchema sections if not already present.
+  // These sections are required so the validator accepts their controlOnlyPaths,
+  // but template developers should never need to add these manually.
+  ensurePlatformSections(editorSections);
+
+  // controlOnlyPaths: platform paths are auto-merged by platform-contract.json at
+  // validate/build time. We only emit template-specific paths here (currently none
+  // by default — templates add their own via controlOnlyPaths in fivora-template.json).
   const controlOnlyPaths = computeControlOnlyPaths(
     content,
     boundFieldPaths,

package/src/arc/transformer.cjs

@@ -1046,11 +1046,78 @@ function instrumentLayoutSource(code, siteDataImport, providerImport = '@deneb-u
   }
 
   ensureProviderInitialData(ast, jsonIdent);
+  injectPlatformAdditionalPages(ast, providerImport);
   sanitizeDuplicateBindings(ast);
   const next = printSource(ast, code);
   return { code: next, updated: next !== code };
 }
 
+/**
+ * Injects <PlatformAdditionalPages /> into the layout JSX tree after <main>.
+ * This component handles all additionalPages visual-editing markers correctly
+ * so template developers never need to know the complex nesting rules.
+ *
+ * The injected pattern looks like:
+ *   <main>{children}</main>
+ *   <PlatformAdditionalPages />    ← injected (inside the SiteDataProvider/body)
+ *
+ * If PlatformAdditionalPages is already in the source, it's a no-op.
+ */
+function injectPlatformAdditionalPages(ast, providerImport) {
+  if (!ast) return;
+  // Already injected - skip
+  let alreadyPresent = false;
+  recast.types.visit(ast, {
+    visitJSXIdentifier(pathNode) {
+      if (pathNode.node.name === 'PlatformAdditionalPages') {
+        alreadyPresent = true;
+        return false;
+      }
+      this.traverse(pathNode);
+    },
+  });
+  if (alreadyPresent) return;
+
+  // Inject after the first <main> element in any JSX tree
+  let injected = false;
+  recast.types.visit(ast, {
+    visitJSXElement(pathNode) {
+      if (injected) return false;
+      const name = getJsxName(pathNode.node);
+      if (name === 'main') {
+        const parent = pathNode.parent;
+        if (!parent || !Array.isArray(parent.node.children)) {
+          this.traverse(pathNode);
+          return;
+        }
+        const siblings = parent.node.children;
+        const idx = siblings.indexOf(pathNode.node);
+        if (idx === -1) {
+          this.traverse(pathNode);
+          return;
+        }
+        // Build <PlatformAdditionalPages />
+        const platformElement = b.jsxElement(
+          b.jsxOpeningElement(
+            b.jsxIdentifier('PlatformAdditionalPages'),
+            [],
+            true // self-closing
+          ),
+          null,
+          [],
+          true
+        );
+        const newline = b.jsxText('\n            ');
+        siblings.splice(idx + 1, 0, newline, platformElement);
+        ensureImport(ast, providerImport || '@deneb-ui/ui', ['PlatformAdditionalPages']);
+        injected = true;
+        return false;
+      }
+      this.traverse(pathNode);
+    },
+  });
+}
+
 function ensureJsonModule(tsconfig) {
   if (!tsconfig || !tsconfig.compilerOptions) return { config: tsconfig, changed: false };
   if (tsconfig.compilerOptions.resolveJsonModule) return { config: tsconfig, changed: false };

package/src/platform/platform-contract.json

@@ -0,0 +1,39 @@
+{
+  "_comment": "Platform-managed field paths for Fivora templates. These are written by the Fivora platform (AI agent, site builder) and must NEVER require data-preview-field-path HTML markers. The CLI merges these into every template's controlOnlyPaths automatically — templates do not need to declare them.",
+  "version": 1,
+  "platformControlledPaths": [
+    "__fivoraIntake.tone",
+    "__fivoraIntake.outputLanguage",
+    "__fivoraIntake.businessSummary",
+    "__fivoraIntake.additionalBusinessDetails",
+    "__fivoraIntake.referenceWebsiteUrl",
+    "additionalPages[*].id",
+    "additionalPages[*].route",
+    "common.currency",
+    "common.whatsappNumber",
+    "common.whatsapp",
+    "common.email",
+    "common.address",
+    "common.contactNumber",
+    "common.openingHours",
+    "common.newsletterTitle",
+    "common.newsletterDescription",
+    "contact.contactNumber",
+    "contact.googleMapLink",
+    "contact.whatsapp",
+    "products[*].id",
+    "products[*].isAvailable",
+    "products[*].measurement",
+    "products[*].unit",
+    "testimonials[*].id",
+    "categories[*].slug"
+  ],
+  "platformSiteDataKeys": [
+    "__fivoraIntake",
+    "additionalPages"
+  ],
+  "forbiddenNextConfigKeys": [
+    "outputFileTracingRoot",
+    "experimental.outputFileTracingRoot"
+  ]
+}