@getrefino/onboarding 0.1.0-rc.1

package/dist/templates-hosted.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Boilerplate for a site connected to Refino (hosted mode). Everything runs
+ * in the browser: the site holds two public constants and no secrets, no
+ * copy endpoint, no session endpoint and no repository credential. Refino
+ * authenticates the owner, authorizes the site, and loads and saves the
+ * copy file in the repository.
+ *
+ *   /edit  → Refino /editor/authorize (PKCE) → back to /edit?code&state
+ *          → POST Refino /api/editor/token → 12 h editor token in sessionStorage
+ *          → <RefinoProvider endpoint={Refino copy API} headers={bearer}>
+ */
+import type { MigrationPlan } from "./types.js";
+import type { TemplateFile } from "./templates.js";
+export declare const DEFAULT_REFINO_APP_URL = "https://app.refino.dev";
+export interface RefinoSiteConfig {
+    readonly siteId: string;
+    readonly appUrl: string;
+}
+export declare const REFINO_SITE_ID_PATTERN: RegExp;
+/** Public configuration; safe to ship to the browser and to commit. */
+export declare const REFINO_SITE: (config: RefinoSiteConfig) => string;
+/** Browser-only client: PKCE, the authorization round trip and the session in sessionStorage. */
+export declare const REFINO_CLIENT = "/**\n * Browser-side Refino editor authorization for this site. No secrets here:\n * the site is a public client (OAuth 2.1 with PKCE). The editor token lives\n * in sessionStorage only (never localStorage, never a URL), is scoped to\n * this site, and Refino re-checks the account's entitlement on every load\n * and save. Never import this from server code.\n */\nimport { REFINO_APP_URL, REFINO_SITE_ID } from \"./refino-site\";\n\nconst PKCE_KEY = \"refino.pkce\";\nconst SESSION_KEY = \"refino.editor\";\nconst CALLBACK_PATH = \"/edit\";\n\nexport interface EditorSession {\n  readonly token: string;\n  /** Unix seconds. */\n  readonly expiresAt: number;\n  readonly siteId: string;\n}\n\ninterface PendingAuthorization {\n  readonly verifier: string;\n  readonly state: string;\n  readonly returnTo: string;\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomToken(bytes: number): string {\n  const buffer = new Uint8Array(bytes);\n  crypto.getRandomValues(buffer);\n  return base64url(buffer);\n}\n\nasync function sha256(text: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n  return base64url(new Uint8Array(digest));\n}\n\nfunction storage(): Storage | null {\n  try {\n    return typeof window === \"undefined\" ? null : window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction readJson<T>(key: string): T | null {\n  const raw = storage()?.getItem(key);\n  if (!raw) return null;\n  try {\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n/** Only a path on this site, never another origin. */\nexport function safeReturnTo(value: string | null | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\") || value.startsWith(\"/\\\\\") || value.length > 512) return \"/\";\n  return value;\n}\n\nexport function editorEndpoint(): string {\n  return `${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/copy`;\n}\n\nexport function callbackUrl(): string {\n  return `${window.location.origin}${CALLBACK_PATH}`;\n}\n\n/** The current editor session, or null when there is none or it expired. */\nexport function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {\n  const session = readJson<EditorSession>(SESSION_KEY);\n  if (!session || typeof session.token !== \"string\" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== \"number\") return null;\n  if (session.expiresAt <= nowSeconds) {\n    storage()?.removeItem(SESSION_KEY);\n    return null;\n  }\n  return session;\n}\n\nexport function clearEditorSession(): void {\n  storage()?.removeItem(SESSION_KEY);\n  storage()?.removeItem(PKCE_KEY);\n}\n\n/** Start the flow: remember the PKCE verifier and state, then go to Refino. */\nexport async function beginAuthorization(returnTo: string): Promise<void> {\n  const verifier = randomToken(32);\n  const state = randomToken(16);\n  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };\n  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));\n  const params = new URLSearchParams({\n    site_id: REFINO_SITE_ID,\n    redirect_uri: callbackUrl(),\n    code_challenge: await sha256(verifier),\n    code_challenge_method: \"S256\",\n    state,\n  });\n  window.location.assign(`${REFINO_APP_URL}/editor/authorize?${params.toString()}`);\n}\n\nexport type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };\n\n/**\n * Finish the flow on /edit?code&state: check the state, exchange the code\n * with the verifier this browser kept, store the session, and scrub the\n * code from the URL. The token is never placed in a URL.\n */\nexport async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {\n  const params = new URLSearchParams(search);\n  const code = params.get(\"code\");\n  const state = params.get(\"state\");\n  const pending = readJson<PendingAuthorization>(PKCE_KEY);\n  storage()?.removeItem(PKCE_KEY);\n  if (typeof window !== \"undefined\" && window.history.replaceState) window.history.replaceState(null, \"\", window.location.pathname);\n  if (!code || !state) return { ok: false, error: \"Refino did not return an authorization code.\" };\n  if (!pending || pending.state !== state) return { ok: false, error: \"Sign-in was interrupted (state mismatch). Start again.\" };\n\n  let response: Response;\n  try {\n    response = await fetch(`${REFINO_APP_URL}/api/editor/token`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ grant_type: \"authorization_code\", code, code_verifier: pending.verifier, site_id: REFINO_SITE_ID, redirect_uri: callbackUrl() }),\n    });\n  } catch {\n    return { ok: false, error: \"Could not reach Refino to finish signing in.\" };\n  }\n  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;\n  if (!response.ok || !body?.ok || typeof body.token !== \"string\" || typeof body.expiresAt !== \"number\" || body.siteId !== REFINO_SITE_ID) {\n    return { ok: false, error: body?.error?.message ?? \"Refino did not accept the authorization.\" };\n  }\n  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };\n  storage()?.setItem(SESSION_KEY, JSON.stringify(session));\n  return { ok: true, returnTo: pending.returnTo };\n}\n";
+/** Provider wrapper: edit mode is decided in the browser from the stored session. */
+export declare const COPY_EDITING_HOSTED = "\"use client\";\n\nimport type { CopyContent } from \"@getrefino/core\";\nimport { RefinoProvider } from \"@getrefino/react\";\nimport type { ReactNode } from \"react\";\nimport { useCallback, useEffect, useState } from \"react\";\n\nimport { clearEditorSession, editorEndpoint, readEditorSession } from \"./refino-client\";\nimport type { EditorSession } from \"./refino-client\";\n\ninterface CopyEditingProps {\n  content: CopyContent;\n  children: ReactNode;\n}\n\n/**\n * Hosted mode (Refino). Visitors get the plain site: the server never\n * decides edit mode, so pages can stay static. In the browser, an editor\n * session stored by /edit turns edit mode on; loads and saves go to Refino\n * with the session's bearer token, and Refino checks the site's\n * entitlement on every request.\n */\nexport function CopyEditing({ content, children }: CopyEditingProps) {\n  const [session, setSession] = useState<EditorSession | null>(null);\n\n  useEffect(() => {\n    // Read the session only after mount so server-rendered HTML never differs from the visitor's.\n    setSession(readEditorSession());\n  }, []);\n\n  // Read at request time (the provider keeps its options from the first render), so the\n  // token is always the one currently stored and never sent once the session is cleared.\n  const headers = useCallback((): Record<string, string> => {\n    const current = readEditorSession();\n    return current ? { authorization: `Bearer ${current.token}` } : {};\n  }, []);\n\n  const onExit = useCallback(async () => {\n    clearEditorSession();\n    window.location.assign(\"/\");\n  }, []);\n\n  return (\n    <RefinoProvider content={content} editing={session !== null} endpoint={editorEndpoint()} headers={headers} signInHref=\"/edit\" onExit={onExit}>\n      {children}\n    </RefinoProvider>\n  );\n}\n";
+/** The /edit page: starts the flow, finishes it on return, shows state. Works as a static export. */
+export declare const EDIT_PAGE_HOSTED = "\"use client\";\n\nimport { useEffect, useState } from \"react\";\n\nimport { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from \"./refino-client\";\n\ntype Phase = { kind: \"loading\" } | { kind: \"signed-in\" } | { kind: \"error\"; message: string };\n\n/**\n * Owner entry point for Refino-hosted editing. Visiting /edit sends the\n * owner to Refino to sign in and authorize this site; Refino sends them\n * back here with a one-time code, which is exchanged for an editor session\n * and scrubbed from the URL. Restyle freely; keep the behaviour.\n */\nexport default function EditPage() {\n  const [phase, setPhase] = useState<Phase>({ kind: \"loading\" });\n\n  useEffect(() => {\n    let cancelled = false;\n    const params = new URLSearchParams(window.location.search);\n    if (params.has(\"code\") || params.has(\"state\")) {\n      void completeAuthorization().then((result) => {\n        if (cancelled) return;\n        if (result.ok) window.location.assign(result.returnTo);\n        else setPhase({ kind: \"error\", message: result.error });\n      });\n    } else if (readEditorSession()) {\n      setPhase({ kind: \"signed-in\" });\n    } else if (params.get(\"error\")) {\n      setPhase({ kind: \"error\", message: params.get(\"error\") ?? \"Sign-in failed.\" });\n    } else {\n      void beginAuthorization(safeReturnTo(params.get(\"return_to\")));\n    }\n    return () => {\n      cancelled = true;\n    };\n  }, []);\n\n  return (\n    <main style={{ maxWidth: 420, margin: \"10vh auto\", padding: 24, fontFamily: \"system-ui, sans-serif\" }}>\n      {phase.kind === \"loading\" && <p>Signing you in with Refino\u2026</p>}\n      {phase.kind === \"signed-in\" && (\n        <>\n          <h1>Edit mode is on</h1>\n          <p>Go to the site, click any text, and press Save when you are done.</p>\n          <p>\n            <a href=\"/\">Open the site</a>\n          </p>\n          <button\n            type=\"button\"\n            onClick={() => {\n              clearEditorSession();\n              setPhase({ kind: \"loading\" });\n              void beginAuthorization(\"/\");\n            }}\n          >\n            Sign in as someone else\n          </button>\n        </>\n      )}\n      {phase.kind === \"error\" && (\n        <>\n          <h1>Could not start editing</h1>\n          <p role=\"alert\">{phase.message}</p>\n          <button type=\"button\" onClick={() => void beginAuthorization(\"/\")}>\n            Try again\n          </button>\n        </>\n      )}\n    </main>\n  );\n}\n";
+/** Next.js App Router route file for /edit: re-exports the generated client page. */
+export declare const EDIT_ROUTE_NEXT_HOSTED: (pageImport: string) => string;
+/** Next.js Pages Router page for /edit. */
+export declare const EDIT_PAGE_NEXT_PAGES_HOSTED: (pageImport: string) => string;
+export declare const EDIT_LAYOUT_HOSTED = "import type { Metadata } from \"next\";\nimport type { ReactNode } from \"react\";\n\n/** /edit is the owner's entry point, not a public page; the page itself is a client component and cannot export metadata. */\nexport const metadata: Metadata = { title: \"Edit this site\", robots: { index: false, follow: false } };\n\nexport default function EditLayout({ children }: { children: ReactNode }) {\n  return children;\n}\n";
+/** Files for a Refino-connected site. No server code, no secrets, in any framework. */
+export declare function hostedFiles(plan: MigrationPlan): TemplateFile[];

package/dist/templates-hosted.js

@@ -0,0 +1,332 @@
+export const DEFAULT_REFINO_APP_URL = "https://app.refino.dev";
+export const REFINO_SITE_ID_PATTERN = /^site_[a-f0-9]{32}$/;
+/** Public configuration; safe to ship to the browser and to commit. */
+export const REFINO_SITE = (config) => `/**
+ * Public Refino configuration for this site. Neither value is a secret:
+ * the site id appears in editor URLs and the app URL is where owners sign
+ * in. Generated by Refino; change it only when the site is
+ * reconnected to Refino.
+ */
+export const REFINO_SITE_ID = ${JSON.stringify(config.siteId)};
+export const REFINO_APP_URL = ${JSON.stringify(config.appUrl)};
+`;
+/** Browser-only client: PKCE, the authorization round trip and the session in sessionStorage. */
+export const REFINO_CLIENT = `/**
+ * Browser-side Refino editor authorization for this site. No secrets here:
+ * the site is a public client (OAuth 2.1 with PKCE). The editor token lives
+ * in sessionStorage only (never localStorage, never a URL), is scoped to
+ * this site, and Refino re-checks the account's entitlement on every load
+ * and save. Never import this from server code.
+ */
+import { REFINO_APP_URL, REFINO_SITE_ID } from "./refino-site";
+
+const PKCE_KEY = "refino.pkce";
+const SESSION_KEY = "refino.editor";
+const CALLBACK_PATH = "/edit";
+
+export interface EditorSession {
+  readonly token: string;
+  /** Unix seconds. */
+  readonly expiresAt: number;
+  readonly siteId: string;
+}
+
+interface PendingAuthorization {
+  readonly verifier: string;
+  readonly state: string;
+  readonly returnTo: string;
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(bytes: number): string {
+  const buffer = new Uint8Array(bytes);
+  crypto.getRandomValues(buffer);
+  return base64url(buffer);
+}
+
+async function sha256(text: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return base64url(new Uint8Array(digest));
+}
+
+function storage(): Storage | null {
+  try {
+    return typeof window === "undefined" ? null : window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+
+function readJson<T>(key: string): T | null {
+  const raw = storage()?.getItem(key);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+/** Only a path on this site, never another origin. */
+export function safeReturnTo(value: string | null | undefined): string {
+  if (!value || !value.startsWith("/") || value.startsWith("//") || value.startsWith("/\\\\") || value.length > 512) return "/";
+  return value;
+}
+
+export function editorEndpoint(): string {
+  return \`\${REFINO_APP_URL}/api/sites/\${REFINO_SITE_ID}/copy\`;
+}
+
+export function callbackUrl(): string {
+  return \`\${window.location.origin}\${CALLBACK_PATH}\`;
+}
+
+/** The current editor session, or null when there is none or it expired. */
+export function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {
+  const session = readJson<EditorSession>(SESSION_KEY);
+  if (!session || typeof session.token !== "string" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== "number") return null;
+  if (session.expiresAt <= nowSeconds) {
+    storage()?.removeItem(SESSION_KEY);
+    return null;
+  }
+  return session;
+}
+
+export function clearEditorSession(): void {
+  storage()?.removeItem(SESSION_KEY);
+  storage()?.removeItem(PKCE_KEY);
+}
+
+/** Start the flow: remember the PKCE verifier and state, then go to Refino. */
+export async function beginAuthorization(returnTo: string): Promise<void> {
+  const verifier = randomToken(32);
+  const state = randomToken(16);
+  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };
+  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));
+  const params = new URLSearchParams({
+    site_id: REFINO_SITE_ID,
+    redirect_uri: callbackUrl(),
+    code_challenge: await sha256(verifier),
+    code_challenge_method: "S256",
+    state,
+  });
+  window.location.assign(\`\${REFINO_APP_URL}/editor/authorize?\${params.toString()}\`);
+}
+
+export type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };
+
+/**
+ * Finish the flow on /edit?code&state: check the state, exchange the code
+ * with the verifier this browser kept, store the session, and scrub the
+ * code from the URL. The token is never placed in a URL.
+ */
+export async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {
+  const params = new URLSearchParams(search);
+  const code = params.get("code");
+  const state = params.get("state");
+  const pending = readJson<PendingAuthorization>(PKCE_KEY);
+  storage()?.removeItem(PKCE_KEY);
+  if (typeof window !== "undefined" && window.history.replaceState) window.history.replaceState(null, "", window.location.pathname);
+  if (!code || !state) return { ok: false, error: "Refino did not return an authorization code." };
+  if (!pending || pending.state !== state) return { ok: false, error: "Sign-in was interrupted (state mismatch). Start again." };
+
+  let response: Response;
+  try {
+    response = await fetch(\`\${REFINO_APP_URL}/api/editor/token\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ grant_type: "authorization_code", code, code_verifier: pending.verifier, site_id: REFINO_SITE_ID, redirect_uri: callbackUrl() }),
+    });
+  } catch {
+    return { ok: false, error: "Could not reach Refino to finish signing in." };
+  }
+  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;
+  if (!response.ok || !body?.ok || typeof body.token !== "string" || typeof body.expiresAt !== "number" || body.siteId !== REFINO_SITE_ID) {
+    return { ok: false, error: body?.error?.message ?? "Refino did not accept the authorization." };
+  }
+  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };
+  storage()?.setItem(SESSION_KEY, JSON.stringify(session));
+  return { ok: true, returnTo: pending.returnTo };
+}
+`;
+/** Provider wrapper: edit mode is decided in the browser from the stored session. */
+export const COPY_EDITING_HOSTED = `"use client";
+
+import type { CopyContent } from "@getrefino/core";
+import { RefinoProvider } from "@getrefino/react";
+import type { ReactNode } from "react";
+import { useCallback, useEffect, useState } from "react";
+
+import { clearEditorSession, editorEndpoint, readEditorSession } from "./refino-client";
+import type { EditorSession } from "./refino-client";
+
+interface CopyEditingProps {
+  content: CopyContent;
+  children: ReactNode;
+}
+
+/**
+ * Hosted mode (Refino). Visitors get the plain site: the server never
+ * decides edit mode, so pages can stay static. In the browser, an editor
+ * session stored by /edit turns edit mode on; loads and saves go to Refino
+ * with the session's bearer token, and Refino checks the site's
+ * entitlement on every request.
+ */
+export function CopyEditing({ content, children }: CopyEditingProps) {
+  const [session, setSession] = useState<EditorSession | null>(null);
+
+  useEffect(() => {
+    // Read the session only after mount so server-rendered HTML never differs from the visitor's.
+    setSession(readEditorSession());
+  }, []);
+
+  // Read at request time (the provider keeps its options from the first render), so the
+  // token is always the one currently stored and never sent once the session is cleared.
+  const headers = useCallback((): Record<string, string> => {
+    const current = readEditorSession();
+    return current ? { authorization: \`Bearer \${current.token}\` } : {};
+  }, []);
+
+  const onExit = useCallback(async () => {
+    clearEditorSession();
+    window.location.assign("/");
+  }, []);
+
+  return (
+    <RefinoProvider content={content} editing={session !== null} endpoint={editorEndpoint()} headers={headers} signInHref="/edit" onExit={onExit}>
+      {children}
+    </RefinoProvider>
+  );
+}
+`;
+/** The /edit page: starts the flow, finishes it on return, shows state. Works as a static export. */
+export const EDIT_PAGE_HOSTED = `"use client";
+
+import { useEffect, useState } from "react";
+
+import { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from "./refino-client";
+
+type Phase = { kind: "loading" } | { kind: "signed-in" } | { kind: "error"; message: string };
+
+/**
+ * Owner entry point for Refino-hosted editing. Visiting /edit sends the
+ * owner to Refino to sign in and authorize this site; Refino sends them
+ * back here with a one-time code, which is exchanged for an editor session
+ * and scrubbed from the URL. Restyle freely; keep the behaviour.
+ */
+export default function EditPage() {
+  const [phase, setPhase] = useState<Phase>({ kind: "loading" });
+
+  useEffect(() => {
+    let cancelled = false;
+    const params = new URLSearchParams(window.location.search);
+    if (params.has("code") || params.has("state")) {
+      void completeAuthorization().then((result) => {
+        if (cancelled) return;
+        if (result.ok) window.location.assign(result.returnTo);
+        else setPhase({ kind: "error", message: result.error });
+      });
+    } else if (readEditorSession()) {
+      setPhase({ kind: "signed-in" });
+    } else if (params.get("error")) {
+      setPhase({ kind: "error", message: params.get("error") ?? "Sign-in failed." });
+    } else {
+      void beginAuthorization(safeReturnTo(params.get("return_to")));
+    }
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return (
+    <main style={{ maxWidth: 420, margin: "10vh auto", padding: 24, fontFamily: "system-ui, sans-serif" }}>
+      {phase.kind === "loading" && <p>Signing you in with Refino…</p>}
+      {phase.kind === "signed-in" && (
+        <>
+          <h1>Edit mode is on</h1>
+          <p>Go to the site, click any text, and press Save when you are done.</p>
+          <p>
+            <a href="/">Open the site</a>
+          </p>
+          <button
+            type="button"
+            onClick={() => {
+              clearEditorSession();
+              setPhase({ kind: "loading" });
+              void beginAuthorization("/");
+            }}
+          >
+            Sign in as someone else
+          </button>
+        </>
+      )}
+      {phase.kind === "error" && (
+        <>
+          <h1>Could not start editing</h1>
+          <p role="alert">{phase.message}</p>
+          <button type="button" onClick={() => void beginAuthorization("/")}>
+            Try again
+          </button>
+        </>
+      )}
+    </main>
+  );
+}
+`;
+/** Next.js App Router route file for /edit: re-exports the generated client page. */
+export const EDIT_ROUTE_NEXT_HOSTED = (pageImport) => `export { default } from "${pageImport}";
+`;
+/** Next.js Pages Router page for /edit. */
+export const EDIT_PAGE_NEXT_PAGES_HOSTED = (pageImport) => `export { default } from "${pageImport}";
+`;
+export const EDIT_LAYOUT_HOSTED = `import type { Metadata } from "next";
+import type { ReactNode } from "react";
+
+/** /edit is the owner's entry point, not a public page; the page itself is a client component and cannot export metadata. */
+export const metadata: Metadata = { title: "Edit this site", robots: { index: false, follow: false } };
+
+export default function EditLayout({ children }: { children: ReactNode }) {
+  return children;
+}
+`;
+function relativeImport(fromFile, toFile) {
+    const fromParts = fromFile.split("/").slice(0, -1);
+    const toParts = toFile.split("/");
+    while (fromParts.length > 0 && toParts.length > 0 && fromParts[0] === toParts[0]) {
+        fromParts.shift();
+        toParts.shift();
+    }
+    const up = fromParts.length === 0 ? "." : fromParts.map(() => "..").join("/");
+    return `${up}/${toParts.join("/")}`.replace(/\.(tsx?|jsx?)$/, "");
+}
+/** Files for a Refino-connected site. No server code, no secrets, in any framework. */
+export function hostedFiles(plan) {
+    const refino = plan.refino;
+    if (!refino)
+        return [];
+    const dir = plan.integration.boilerplateDir;
+    const files = [
+        { path: `${dir}/refino-site.ts`, content: REFINO_SITE(refino) },
+        { path: `${dir}/refino-client.ts`, content: REFINO_CLIENT },
+        { path: `${dir}/copy-editing.tsx`, content: COPY_EDITING_HOSTED },
+        { path: `${dir}/edit-page.tsx`, content: EDIT_PAGE_HOSTED },
+    ];
+    const editPage = plan.files.find((file) => /(^|\/)edit(\/page)?\.\w+$/.test(file.path) && !file.path.startsWith(`${dir}/`))?.path;
+    if (plan.repository.router === "next-app") {
+        const routesDir = editPage?.replace(/\/edit\/page\.\w+$/, "") ?? "app";
+        files.push({ path: `${routesDir}/edit/layout.tsx`, content: EDIT_LAYOUT_HOSTED });
+        files.push({ path: `${routesDir}/edit/page.tsx`, content: EDIT_ROUTE_NEXT_HOSTED(relativeImport(`${routesDir}/edit/page.tsx`, `${dir}/edit-page.tsx`)) });
+    }
+    else if (plan.repository.router === "next-pages") {
+        const routesDir = editPage?.replace(/\/edit\.\w+$/, "") ?? "pages";
+        files.push({ path: `${routesDir}/edit.tsx`, content: EDIT_PAGE_NEXT_PAGES_HOSTED(relativeImport(`${routesDir}/edit.tsx`, `${dir}/edit-page.tsx`)) });
+    }
+    return files;
+}

package/dist/templates.d.ts

@@ -0,0 +1,8 @@
+import type { MigrationPlan } from "./types.js";
+export interface TemplateFile {
+    readonly path: string;
+    readonly content: string;
+}
+export declare const ENV_EXAMPLE_BLOCK = "\n# --- Refino (server-side only; never expose with NEXT_PUBLIC_/VITE_) ---\n# Edit-mode login. Both required in production; development falls back to password \"edit\".\nEDITOR_PASSWORD=\nEDITOR_SESSION_SECRET=\n# Persistence: \"local\" writes the copy file on disk (development), \"github\" commits it.\nCOPY_ADAPTER=local\n# GitHub persistence (COPY_ADAPTER=github): fine-grained token, Contents read/write, one repo.\nCOPY_GITHUB_TOKEN=\nCOPY_GITHUB_REPO=owner/name\nCOPY_GITHUB_BRANCH=main\nCOPY_FILE_PATH=\n";
+/** Files the apply step may create for a plan, in TS or JS as the project requires. */
+export declare function boilerplateFiles(plan: MigrationPlan): TemplateFile[];