@getrefino/onboarding 0.1.0-rc.1

package/dist/templates.js

@@ -0,0 +1,671 @@
+/**
+ * Boilerplate written by `refino init --apply`. Each file is isolated
+ * under `refino/` (or is a new route file) and is only written when it
+ * does not already exist. Authored in TypeScript; JavaScript projects get a
+ * transpiled copy.
+ */
+import ts from "typescript";
+import { BOILERPLATE_DIR } from "./plan.js";
+import { hostedFiles } from "./templates-hosted.js";
+const BOILERPLATE_DIR_NAME = BOILERPLATE_DIR;
+function relativeImport(fromFile, toFile) {
+    const fromParts = fromFile.split("/").slice(0, -1);
+    const toParts = toFile.split("/");
+    while (fromParts.length > 0 && toParts.length > 0 && fromParts[0] === toParts[0]) {
+        fromParts.shift();
+        toParts.shift();
+    }
+    const up = fromParts.length === 0 ? "." : fromParts.map(() => "..").join("/");
+    return `${up}/${toParts.join("/")}`.replace(/\.(tsx?|jsx?)$/, "");
+}
+const EDITOR_AUTH = `/**
+ * Single-owner edit-mode authentication for Refino. Server-side only.
+ * One password (EDITOR_PASSWORD) unlocks a signed, expiring cookie whose
+ * signature uses EDITOR_SESSION_SECRET. Replace isEditorAuthenticated in
+ * editor-session with your own owner check if the site already has auth.
+ */
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+
+export const SESSION_COOKIE = "refino_edit_session";
+export const SESSION_TTL_SECONDS = 12 * 60 * 60;
+
+export interface EditorAuthConfig {
+  readonly password: string;
+  readonly secret: string;
+}
+
+const DEV_FALLBACK_PASSWORD = "edit";
+let warnedAboutFallback = false;
+
+function devFallbackSecret(): string {
+  return createHash("sha256").update(\`refino-dev-secret:\${process.cwd()}\`).digest("hex");
+}
+
+/** Null means editing is disabled (production without both variables). */
+export function readEditorAuthConfig(
+  env: Readonly<Record<string, string | undefined>> = process.env,
+): EditorAuthConfig | null {
+  const password = env.EDITOR_PASSWORD;
+  const secret = env.EDITOR_SESSION_SECRET;
+  if (password && secret) return { password, secret };
+  if (env.NODE_ENV === "development") {
+    if (!warnedAboutFallback) {
+      warnedAboutFallback = true;
+      console.warn(\`[refino] EDITOR_PASSWORD/EDITOR_SESSION_SECRET not set; using the development password "\${DEV_FALLBACK_PASSWORD}".\`);
+    }
+    return { password: password ?? DEV_FALLBACK_PASSWORD, secret: secret ?? devFallbackSecret() };
+  }
+  return null;
+}
+
+function digest(value: string): Buffer {
+  return createHash("sha256").update(value, "utf8").digest();
+}
+
+export function verifyPassword(config: EditorAuthConfig, candidate: string): boolean {
+  return timingSafeEqual(digest(config.password), digest(candidate));
+}
+
+function sign(config: EditorAuthConfig, payload: string): string {
+  return createHmac("sha256", config.secret).update(payload, "utf8").digest("base64url");
+}
+
+export function createSessionToken(config: EditorAuthConfig, now: number = Date.now()): string {
+  const payload = String(Math.floor(now / 1000) + SESSION_TTL_SECONDS);
+  return \`\${payload}.\${sign(config, payload)}\`;
+}
+
+export function verifySessionToken(config: EditorAuthConfig, token: string | undefined, now: number = Date.now()): boolean {
+  if (!token) return false;
+  const separator = token.indexOf(".");
+  if (separator <= 0) return false;
+  const payload = token.slice(0, separator);
+  const signature = token.slice(separator + 1);
+  if (!/^\\d{1,12}$/.test(payload) || signature.length === 0) return false;
+  const a = Buffer.from(signature, "utf8");
+  const b = Buffer.from(sign(config, payload), "utf8");
+  if (a.length !== b.length || !timingSafeEqual(a, b)) return false;
+  return Number(payload) * 1000 > now;
+}
+
+/** Parse a Cookie header and return the session token, if any. */
+export function sessionTokenFromCookieHeader(cookieHeader: string | null | undefined): string | undefined {
+  if (!cookieHeader) return undefined;
+  for (const part of cookieHeader.split(";")) {
+    const [name, ...rest] = part.trim().split("=");
+    if (name === SESSION_COOKIE) return decodeURIComponent(rest.join("="));
+  }
+  return undefined;
+}
+
+export function serializeSessionCookie(value: string, options: { secure: boolean; maxAge?: number }): string {
+  const parts = [\`\${SESSION_COOKIE}=\${encodeURIComponent(value)}\`, "Path=/", "HttpOnly", "SameSite=Lax", \`Max-Age=\${options.maxAge ?? SESSION_TTL_SECONDS}\`];
+  if (options.secure) parts.push("Secure");
+  return parts.join("; ");
+}
+
+/** Reject cross-site requests to state-changing endpoints. */
+export function isSameOriginRequest(request: { headers: { get(name: string): string | null } }): boolean {
+  const site = request.headers.get("sec-fetch-site");
+  if (site && site !== "same-origin" && site !== "none") return false;
+  const origin = request.headers.get("origin");
+  if (origin) {
+    const host = request.headers.get("x-forwarded-host") ?? request.headers.get("host");
+    try {
+      if (host && new URL(origin).host !== host) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+`;
+const CONTENT_ADAPTER = (contentFile) => `/**
+ * Where saved copy goes. Server-side only; never import from client code.
+ *   COPY_ADAPTER=local   writes ${contentFile} on disk (development default)
+ *   COPY_ADAPTER=github  commits the file through the GitHub Contents API
+ */
+import path from "node:path";
+
+import type { ContentAdapter } from "@getrefino/core";
+import { ContentError, createContentApi } from "@getrefino/core";
+import { createLocalFileContentAdapter } from "@getrefino/core/local-file";
+import { createGitHubContentAdapter, githubOptionsFromEnv } from "@getrefino/github";
+
+export const LOCAL_COPY_FILE = path.join(process.cwd(), ${JSON.stringify(contentFile)});
+
+export function createContentAdapter(env: Readonly<Record<string, string | undefined>> = process.env): ContentAdapter {
+  const kind = env.COPY_ADAPTER ?? (env.NODE_ENV === "production" ? undefined : "local");
+  switch (kind) {
+    case "local":
+      return createLocalFileContentAdapter({ filePath: LOCAL_COPY_FILE });
+    case "github":
+      return createGitHubContentAdapter(githubOptionsFromEnv(env));
+    default:
+      throw new ContentError("NOT_CONFIGURED", 'Set COPY_ADAPTER to "local" or "github" to enable saving.');
+  }
+}
+
+let adapter: ContentAdapter | null = null;
+
+/** Resolved on first use so a misconfiguration becomes a 503, not a crash at import. */
+export const contentAdapter: ContentAdapter = {
+  get name() {
+    return (adapter ??= createContentAdapter()).name;
+  },
+  load: () => (adapter ??= createContentAdapter()).load(),
+  save: (request) => (adapter ??= createContentAdapter()).save(request),
+};
+
+export const contentApi = createContentApi(contentAdapter, {
+  onError: (error) => console.error("[refino]", error),
+});
+
+/**
+ * For runtimes that hand the environment to each request (Cloudflare Pages
+ * Functions, Netlify, Vercel): an API whose adapter is built lazily from that
+ * environment, so a misconfiguration is a 503 from the API, never a crash.
+ */
+export function createContentApiFor(env: Readonly<Record<string, string | undefined>>) {
+  let resolved: ContentAdapter | null = null;
+  const lazy: ContentAdapter = {
+    get name() {
+      return (resolved ??= createContentAdapter(env)).name;
+    },
+    load: () => (resolved ??= createContentAdapter(env)).load(),
+    save: (request) => (resolved ??= createContentAdapter(env)).save(request),
+  };
+  return createContentApi(lazy, { onError: (error) => console.error("[refino]", error) });
+}
+`;
+const COPY_EDITING = `"use client";
+
+import type { CopyContent } from "@getrefino/core";
+import { RefinoProvider } from "@getrefino/react";
+import type { ReactNode } from "react";
+import { useCallback } from "react";
+
+interface CopyEditingProps {
+  content: CopyContent;
+  /** Decided server-side from the session cookie. */
+  editing: boolean;
+  children: ReactNode;
+}
+
+/** Client boundary around the provider so a server layout can pass onExit. */
+export function CopyEditing({ content, editing, children }: CopyEditingProps) {
+  const onExit = useCallback(async () => {
+    await fetch("/api/edit-session", { method: "DELETE", credentials: "same-origin" });
+    window.location.assign("/");
+  }, []);
+
+  return (
+    <RefinoProvider content={content} editing={editing} endpoint="/api/copy" onExit={onExit}>
+      {children}
+    </RefinoProvider>
+  );
+}
+`;
+const COPY_EDITING_CLIENT_SESSION = `"use client";
+
+import type { CopyContent } from "@getrefino/core";
+import { RefinoProvider } from "@getrefino/react";
+import type { ReactNode } from "react";
+import { useCallback, useEffect, useState } from "react";
+
+interface CopyEditingProps {
+  content: CopyContent;
+  children: ReactNode;
+}
+
+/**
+ * Provider wrapper for a site that is served as static files. Pages cannot
+ * read the session cookie while rendering, so edit mode is decided in the
+ * browser by asking the server: GET /api/edit-session answers 204 only for
+ * an authenticated owner. Visitors get one small request and the plain site.
+ */
+export function CopyEditing({ content, children }: CopyEditingProps) {
+  const [editing, setEditing] = useState(false);
+
+  useEffect(() => {
+    const controller = new AbortController();
+    fetch("/api/edit-session", { method: "GET", credentials: "same-origin", cache: "no-store", signal: controller.signal })
+      .then((response) => setEditing(response.status === 204))
+      .catch(() => setEditing(false));
+    return () => controller.abort();
+  }, []);
+
+  const onExit = useCallback(async () => {
+    await fetch("/api/edit-session", { method: "DELETE", credentials: "same-origin" });
+    window.location.assign("/");
+  }, []);
+
+  return (
+    <RefinoProvider content={content} editing={editing} endpoint="/api/copy" onExit={onExit}>
+      {children}
+    </RefinoProvider>
+  );
+}
+`;
+const EDITOR_SESSION_NEXT = `import { cookies } from "next/headers";
+
+import { SESSION_COOKIE, readEditorAuthConfig, verifySessionToken } from "./editor-auth";
+
+/**
+ * Is the current request from the site owner? Used by the root layout (a
+ * server component that cannot see the Request) to decide whether to render
+ * edit mode. The route handlers use the same token check through
+ * request-handlers. If the site already has an owner login, replace the
+ * body of this function with that check.
+ */
+export async function isEditorAuthenticated(): Promise<boolean> {
+  const store = await cookies();
+  const token = store.get(SESSION_COOKIE)?.value;
+  const config = readEditorAuthConfig();
+  if (!config) return false;
+  return verifySessionToken(config, token);
+}
+`;
+/**
+ * The one implementation of both editor endpoints. Every host wrapper below
+ * is a few lines that hand a standard Request plus the runtime's environment
+ * object to these two functions. Never runs in the browser.
+ */
+const REQUEST_HANDLERS = `/**
+ * Framework-neutral handlers for the two editor endpoints. Each host wrapper
+ * (Next.js route handler, Cloudflare Pages Function, Vercel Function,
+ * Netlify Function, or your own server) passes a standard Request and the
+ * runtime's environment object; nothing host-specific lives here.
+ *
+ *   GET    /api/edit-session -> 204 when the session cookie is valid, 401 otherwise
+ *   POST   /api/edit-session -> form { password } -> 303 to / with the cookie, or to /edit?error=…
+ *   DELETE /api/edit-session -> 204 and clears the cookie
+ *   GET    /api/copy         -> latest canonical copy + revision (401 without a session)
+ *   POST   /api/copy         -> { baseRevision, changes } -> saved | unchanged | conflict (409)
+ *
+ * The browser never names a file, repository or branch; those come from the
+ * environment. Server-side only: never import this from client code.
+ */
+import type { ContentApi } from "@getrefino/core";
+
+import { createContentApiFor } from "./content-adapter";
+import {
+  createSessionToken,
+  isSameOriginRequest,
+  readEditorAuthConfig,
+  serializeSessionCookie,
+  sessionTokenFromCookieHeader,
+  verifyPassword,
+  verifySessionToken,
+} from "./editor-auth";
+
+export type EditorEnv = Readonly<Record<string, string | undefined>>;
+
+const NO_STORE = { "cache-control": "no-store" };
+
+/** Does this request carry a valid, unexpired editor session? */
+export function isEditorRequest(request: Request, env: EditorEnv): boolean {
+  const config = readEditorAuthConfig(env);
+  if (!config) return false;
+  return verifySessionToken(config, sessionTokenFromCookieHeader(request.headers.get("cookie")));
+}
+
+function json(body: unknown, status: number): Response {
+  return Response.json(body, { status, headers: NO_STORE });
+}
+
+function methodNotAllowed(allowed: readonly string[]): Response {
+  return new Response(null, { status: 405, headers: { allow: allowed.join(", ") } });
+}
+
+function redirectTo(request: Request, pathname: string, setCookie?: string): Response {
+  const headers = new Headers({ location: new URL(pathname, request.url).toString(), ...NO_STORE });
+  if (setCookie) headers.set("set-cookie", setCookie);
+  return new Response(null, { status: 303, headers });
+}
+
+function isSecure(request: Request): boolean {
+  const proto = request.headers.get("x-forwarded-proto") ?? new URL(request.url).protocol.replace(":", "");
+  return proto === "https";
+}
+
+// One API per environment object (process.env, or the per-request env of a
+// serverless runtime); the adapter inside is built on first use.
+const apis = new WeakMap<object, ContentApi>();
+
+function apiFor(env: EditorEnv): ContentApi {
+  let api = apis.get(env);
+  if (!api) {
+    api = createContentApiFor(env);
+    apis.set(env, api);
+  }
+  return api;
+}
+
+export async function handleCopyRequest(request: Request, env: EditorEnv): Promise<Response> {
+  if (!isEditorRequest(request, env)) {
+    return json({ ok: false, error: { code: "UNAUTHORIZED", message: "Sign in to edit copy." } }, 401);
+  }
+  switch (request.method) {
+    case "GET": {
+      const result = await apiFor(env).load();
+      return json(result.body, result.status);
+    }
+    case "POST": {
+      if (!isSameOriginRequest(request)) {
+        return json({ ok: false, error: { code: "FORBIDDEN", message: "Cross-site request rejected." } }, 403);
+      }
+      let body: unknown;
+      try {
+        body = await request.json();
+      } catch {
+        return json({ ok: false, error: { code: "INVALID_REQUEST", message: "Body must be JSON." } }, 400);
+      }
+      const result = await apiFor(env).save(body);
+      return json(result.body, result.status);
+    }
+    default:
+      return methodNotAllowed(["GET", "POST"]);
+  }
+}
+
+export async function handleEditSessionRequest(request: Request, env: EditorEnv): Promise<Response> {
+  switch (request.method) {
+    case "GET":
+      return new Response(null, { status: isEditorRequest(request, env) ? 204 : 401, headers: NO_STORE });
+    case "POST": {
+      if (!isSameOriginRequest(request)) return new Response("Cross-site request rejected.", { status: 403 });
+      const config = readEditorAuthConfig(env);
+      if (!config) return redirectTo(request, "/edit?error=unconfigured");
+      let password: FormDataEntryValue | null = null;
+      try {
+        password = (await request.formData()).get("password");
+      } catch {
+        return new Response("Expected a form body with a password field.", { status: 400 });
+      }
+      if (typeof password !== "string" || !verifyPassword(config, password)) {
+        await new Promise((resolve) => setTimeout(resolve, 750));
+        return redirectTo(request, "/edit?error=invalid");
+      }
+      return redirectTo(request, "/", serializeSessionCookie(createSessionToken(config), { secure: isSecure(request) }));
+    }
+    case "DELETE": {
+      if (!isSameOriginRequest(request)) return new Response("Cross-site request rejected.", { status: 403 });
+      return new Response(null, { status: 204, headers: { "set-cookie": serializeSessionCookie("", { secure: isSecure(request), maxAge: 0 }), ...NO_STORE } });
+    }
+    default:
+      return methodNotAllowed(["GET", "POST", "DELETE"]);
+  }
+}
+`;
+/* ---------- Host wrappers: thin, generated, never edited by hand ---------- */
+const COPY_ROUTE_NEXT = (handlersImport) => `/**
+ * /api/copy for Next.js route handlers. The behaviour lives in
+ * ${BOILERPLATE_DIR_NAME}/request-handlers; this file only adapts the Next.js signature.
+ */
+import { handleCopyRequest } from "${handlersImport}";
+
+export const dynamic = "force-dynamic";
+
+export function GET(request: Request): Promise<Response> {
+  return handleCopyRequest(request, process.env);
+}
+
+export function POST(request: Request): Promise<Response> {
+  return handleCopyRequest(request, process.env);
+}
+`;
+const SESSION_ROUTE_NEXT = (handlersImport) => `/**
+ * /api/edit-session for Next.js route handlers (GET: probe, POST: login,
+ * DELETE: logout). The behaviour lives in ${BOILERPLATE_DIR_NAME}/request-handlers.
+ */
+import { handleEditSessionRequest } from "${handlersImport}";
+
+export const dynamic = "force-dynamic";
+
+export function GET(request: Request): Promise<Response> {
+  return handleEditSessionRequest(request, process.env);
+}
+
+export function POST(request: Request): Promise<Response> {
+  return handleEditSessionRequest(request, process.env);
+}
+
+export function DELETE(request: Request): Promise<Response> {
+  return handleEditSessionRequest(request, process.env);
+}
+`;
+const CLOUDFLARE_FUNCTION = (route, handlersImport) => {
+    const handler = route === "copy" ? "handleCopyRequest" : "handleEditSessionRequest";
+    return `/**
+ * Cloudflare Pages Function serving /api/${route}. Pages maps this file to
+ * that path; every method is forwarded to ${BOILERPLATE_DIR_NAME}/request-handlers.
+ * Configuration comes from the project's variables (context.env). The
+ * handlers use node:crypto, so the Pages project needs the nodejs_compat
+ * compatibility flag.
+ */
+import { ${handler} } from "${handlersImport}";
+
+interface PagesContext {
+  readonly request: Request;
+  readonly env: Readonly<Record<string, string | undefined>>;
+}
+
+export function onRequest(context: PagesContext): Promise<Response> {
+  return ${handler}(context.request, context.env);
+}
+`;
+};
+const NETLIFY_FUNCTION = (route, handlersImport) => {
+    const handler = route === "copy" ? "handleCopyRequest" : "handleEditSessionRequest";
+    return `/**
+ * Netlify Function serving /api/${route} (Functions 2.0: a default export that
+ * takes a Request and returns a Response, mounted at the path in config).
+ * Every method is forwarded to ${BOILERPLATE_DIR_NAME}/request-handlers.
+ */
+import { ${handler} } from "${handlersImport}";
+
+export const config = { path: "/api/${route}" };
+
+export default function handler(request: Request): Promise<Response> {
+  return ${handler}(request, process.env);
+}
+`;
+};
+const VERCEL_FUNCTION = (route, handlersImport) => {
+    const handler = route === "copy" ? "handleCopyRequest" : "handleEditSessionRequest";
+    const methods = route === "copy" ? ["GET", "POST"] : ["GET", "POST", "DELETE"];
+    return `/**
+ * Vercel Function serving /api/${route} (Node.js runtime, Web-standard
+ * signature). Every method is forwarded to ${BOILERPLATE_DIR_NAME}/request-handlers.
+ */
+import { ${handler} } from "${handlersImport}";
+
+${methods
+        .map((method) => `export function ${method}(request: Request): Promise<Response> {
+  return ${handler}(request, process.env);
+}`)
+        .join("\n\n")}
+`;
+};
+const EDIT_PAGE_NEXT = (sessionImport) => `import type { Metadata } from "next";
+
+import { isEditorAuthenticated } from "${sessionImport}";
+
+export const dynamic = "force-dynamic";
+
+/** The owner's sign-in, not a public page. */
+export const metadata: Metadata = { title: "Edit copy", robots: { index: false, follow: false } };
+
+/** Minimal owner login. Restyle freely; keep the form action and field name. */
+export default async function EditPage(props: { searchParams: Promise<{ error?: string }> }) {
+  const { error } = await props.searchParams;
+  const authenticated = await isEditorAuthenticated();
+  return (
+    <main style={{ maxWidth: 420, margin: "10vh auto", padding: 24, fontFamily: "system-ui, sans-serif" }}>
+      {authenticated ? (
+        <>
+          <h1>Edit mode is on</h1>
+          <p>Go to the site, click any text, and press Save when you are done.</p>
+          <a href="/">Open the site</a>
+        </>
+      ) : (
+        <>
+          <h1>Edit the words on this site</h1>
+          {error === "invalid" && <p role="alert">That password was not accepted.</p>}
+          {error === "unconfigured" && <p role="alert">Editing is not configured. Set EDITOR_PASSWORD and EDITOR_SESSION_SECRET.</p>}
+          <form method="post" action="/api/edit-session">
+            <label htmlFor="password">Editor password</label>
+            <br />
+            <input id="password" name="password" type="password" autoComplete="current-password" required />
+            <button type="submit">Enter edit mode</button>
+          </form>
+        </>
+      )}
+    </main>
+  );
+}
+`;
+const EDIT_LAYOUT_STATIC = `import type { Metadata } from "next";
+import type { ReactNode } from "react";
+
+/** /edit is the owner's sign-in, not a public page; the page itself is a client component and cannot export metadata. */
+export const metadata: Metadata = { title: "Edit copy", robots: { index: false, follow: false } };
+
+export default function EditLayout({ children }: { children: ReactNode }) {
+  return children;
+}
+`;
+const EDIT_PAGE_STATIC = `"use client";
+
+import Link from "next/link";
+import { useEffect, useState } from "react";
+
+interface EditState {
+  authenticated: boolean;
+  error: string | null;
+}
+
+/**
+ * Minimal owner login for a statically exported site. The form posts to the
+ * serverless /api/edit-session, which sets the session cookie and redirects
+ * to /. Restyle freely; keep the form action and field name.
+ */
+export default function EditPage() {
+  const [state, setState] = useState<EditState>({ authenticated: false, error: null });
+  const { authenticated, error } = state;
+
+  useEffect(() => {
+    // State is set only from the probe's callbacks (never synchronously in the effect).
+    const code = new URLSearchParams(window.location.search).get("error");
+    fetch("/api/edit-session", { method: "GET", credentials: "same-origin", cache: "no-store" })
+      .then((response) => setState({ authenticated: response.status === 204, error: code }))
+      .catch(() => setState({ authenticated: false, error: code }));
+  }, []);
+
+  return (
+    <main style={{ maxWidth: 420, margin: "10vh auto", padding: 24, fontFamily: "system-ui, sans-serif" }}>
+      {authenticated ? (
+        <>
+          <h1>Edit mode is on</h1>
+          <p>Go to the site, click any text, and press Save when you are done.</p>
+          <Link href="/">Open the site</Link>
+        </>
+      ) : (
+        <>
+          <h1>Edit the words on this site</h1>
+          {error === "invalid" && <p role="alert">That password was not accepted.</p>}
+          {error === "unconfigured" && <p role="alert">Editing is not configured on the server. Set the editor password and session secret documented in .env.example.</p>}
+          <form method="post" action="/api/edit-session">
+            <label htmlFor="password">Editor password</label>
+            <br />
+            <input id="password" name="password" type="password" autoComplete="current-password" required />
+            <button type="submit">Enter edit mode</button>
+          </form>
+        </>
+      )}
+    </main>
+  );
+}
+`;
+export const ENV_EXAMPLE_BLOCK = `
+# --- Refino (server-side only; never expose with NEXT_PUBLIC_/VITE_) ---
+# Edit-mode login. Both required in production; development falls back to password "edit".
+EDITOR_PASSWORD=
+EDITOR_SESSION_SECRET=
+# Persistence: "local" writes the copy file on disk (development), "github" commits it.
+COPY_ADAPTER=local
+# GitHub persistence (COPY_ADAPTER=github): fine-grained token, Contents read/write, one repo.
+COPY_GITHUB_TOKEN=
+COPY_GITHUB_REPO=owner/name
+COPY_GITHUB_BRANCH=main
+COPY_FILE_PATH=
+`;
+function transpileToJs(path, source) {
+    const output = ts.transpileModule(source, {
+        compilerOptions: {
+            target: ts.ScriptTarget.ES2022,
+            module: ts.ModuleKind.ESNext,
+            jsx: ts.JsxEmit.Preserve,
+            removeComments: false,
+            verbatimModuleSyntax: false,
+        },
+        fileName: path,
+    });
+    return { path: path.replace(/\.tsx$/, ".jsx").replace(/\.ts$/, ".js"), content: output.outputText.replace(/^export \{\};\s*$/m, "").replace(/\n{3,}/g, "\n\n") };
+}
+/** Files the apply step may create for a plan, in TS or JS as the project requires. */
+export function boilerplateFiles(plan) {
+    if (plan.refino) {
+        const files = hostedFiles(plan);
+        return plan.repository.language === "javascript" ? files.map((file) => transpileToJs(file.path, file.content)) : files;
+    }
+    const dir = plan.integration.boilerplateDir;
+    const strategy = plan.integration.provider.strategy;
+    const host = plan.integration.host;
+    // Server-rendered hosts pass `editing` from a cookie check; everything else probes the session in the browser.
+    const serverRenderedEditing = strategy === "next-app-root-layout" || strategy === "next-pages-app";
+    const handlers = `${dir}/request-handlers.ts`;
+    const files = [
+        { path: `${dir}/editor-auth.ts`, content: EDITOR_AUTH },
+        { path: `${dir}/content-adapter.ts`, content: CONTENT_ADAPTER(plan.contentFile.path) },
+        { path: handlers, content: REQUEST_HANDLERS },
+        { path: `${dir}/copy-editing.tsx`, content: serverRenderedEditing ? COPY_EDITING : COPY_EDITING_CLIENT_SESSION },
+    ];
+    if (strategy === "next-app-root-layout-client-session") {
+        const routesDir = plan.files.find((file) => /\/edit\/page\.\w+$/.test(file.path))?.path.replace(/\/edit\/page\.\w+$/, "") ?? "app";
+        files.push({ path: `${routesDir}/edit/layout.tsx`, content: EDIT_LAYOUT_STATIC });
+        files.push({ path: `${routesDir}/edit/page.tsx`, content: EDIT_PAGE_STATIC });
+    }
+    const copyFile = host.copyEndpoint.replace(/\.\w+$/, ".ts");
+    const sessionFile = host.sessionEndpoint.replace(/\.\w+$/, ".ts");
+    switch (host.kind) {
+        case "next-route-handlers": {
+            const editPage = `${copyFile.replace(/\/api\/copy\/route\.ts$/, "")}/edit/page.tsx`;
+            files.push({ path: `${dir}/editor-session.ts`, content: EDITOR_SESSION_NEXT });
+            files.push({ path: copyFile, content: COPY_ROUTE_NEXT(relativeImport(copyFile, handlers)) });
+            files.push({ path: sessionFile, content: SESSION_ROUTE_NEXT(relativeImport(sessionFile, handlers)) });
+            files.push({ path: editPage, content: EDIT_PAGE_NEXT(relativeImport(editPage, `${dir}/editor-session.ts`)) });
+            break;
+        }
+        case "cloudflare-pages-functions":
+            files.push({ path: copyFile, content: CLOUDFLARE_FUNCTION("copy", relativeImport(copyFile, handlers)) });
+            files.push({ path: sessionFile, content: CLOUDFLARE_FUNCTION("edit-session", relativeImport(sessionFile, handlers)) });
+            break;
+        case "netlify-functions":
+            files.push({ path: copyFile, content: NETLIFY_FUNCTION("copy", relativeImport(copyFile, handlers)) });
+            files.push({ path: sessionFile, content: NETLIFY_FUNCTION("edit-session", relativeImport(sessionFile, handlers)) });
+            break;
+        case "vercel-functions":
+            files.push({ path: copyFile, content: VERCEL_FUNCTION("copy", relativeImport(copyFile, handlers)) });
+            files.push({ path: sessionFile, content: VERCEL_FUNCTION("edit-session", relativeImport(sessionFile, handlers)) });
+            break;
+        default:
+            // next-api-routes, custom-server, unknown: the agent adapts request-handlers (see the instructions).
+            break;
+    }
+    if (plan.repository.language === "javascript") {
+        return files.map((file) => transpileToJs(file.path, file.content));
+    }
+    return files;
+}