@getrefino/onboarding 0.1.0-rc.4 → 0.1.0-rc.6

package/dist/templates-legacy.js

@@ -11,8 +11,16 @@
  * renderings. `generated-templates.test.ts` fails until you do, because it
  * pins the hash of every generated file.
  */
-/** The last release that wrote the bodies below. */
+/** The last release that wrote the rc.1 bodies below. */
 export const RC1 = "0.1.0-rc.1";
+/**
+ * The last release that wrote the rc.4 bodies below (unchanged since rc.2).
+ * If rc.4 is ever published with the update-aware bodies instead, this label
+ * is still harmless: it only names the `from` version in upgrade reports.
+ */
+export const RC4 = "0.1.0-rc.4";
+/** The release that wrote the rc.5 bodies below: the published 0.1.0-rc.5. */
+export const RC5 = "0.1.0-rc.5";
 /** 0.1.0-rc.1 refino/refino-site.ts: the two public constants, before REFINO_INSTALL. */
 export const REFINO_SITE_RC1 = (config) => `/**
  * Public Refino configuration for this site. Neither value is a secret:
@@ -219,3 +227,560 @@ export function CopyEditing({ content, children }: CopyEditingProps) {
   );
 }
 `;
+/** 0.1.0-rc.4 refino/refino-client.ts: before refinoUpdates, and before reportEditorEvent carried the editing surface. */
+export const REFINO_CLIENT_RC4 = `/**
+ * Browser-side Refino editor authorization for this site. No secrets here:
+ * the site is a public client (OAuth 2.1 with PKCE). The editor token lives
+ * in sessionStorage only (never localStorage, never a URL), is scoped to
+ * this site, and Refino re-checks the account's entitlement on every load
+ * and save. Never import this from server code.
+ */
+import { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from "./refino-site";
+
+const PKCE_KEY = "refino.pkce";
+const SESSION_KEY = "refino.editor";
+const CALLBACK_PATH = "/edit";
+
+export interface EditorSession {
+  readonly token: string;
+  /** Unix seconds. */
+  readonly expiresAt: number;
+  readonly siteId: string;
+}
+
+interface PendingAuthorization {
+  readonly verifier: string;
+  readonly state: string;
+  readonly returnTo: string;
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(bytes: number): string {
+  const buffer = new Uint8Array(bytes);
+  crypto.getRandomValues(buffer);
+  return base64url(buffer);
+}
+
+async function sha256(text: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return base64url(new Uint8Array(digest));
+}
+
+function storage(): Storage | null {
+  try {
+    return typeof window === "undefined" ? null : window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+
+function readJson<T>(key: string): T | null {
+  const raw = storage()?.getItem(key);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+/** Only a path on this site, never another origin. */
+export function safeReturnTo(value: string | null | undefined): string {
+  if (!value || !value.startsWith("/") || value.startsWith("//") || value.startsWith("/\\\\") || value.length > 512) return "/";
+  return value;
+}
+
+export function editorEndpoint(): string {
+  return \`\${REFINO_APP_URL}/api/sites/\${REFINO_SITE_ID}/copy\`;
+}
+
+export function callbackUrl(): string {
+  return \`\${window.location.origin}\${CALLBACK_PATH}\`;
+}
+
+/** The current editor session, or null when there is none or it expired. */
+export function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {
+  const session = readJson<EditorSession>(SESSION_KEY);
+  if (!session || typeof session.token !== "string" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== "number") return null;
+  if (session.expiresAt <= nowSeconds) {
+    storage()?.removeItem(SESSION_KEY);
+    return null;
+  }
+  return session;
+}
+
+export function clearEditorSession(): void {
+  storage()?.removeItem(SESSION_KEY);
+  storage()?.removeItem(PKCE_KEY);
+}
+
+/** Start the flow: remember the PKCE verifier and state, then go to Refino. */
+export async function beginAuthorization(returnTo: string): Promise<void> {
+  const verifier = randomToken(32);
+  const state = randomToken(16);
+  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };
+  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));
+  const params = new URLSearchParams({
+    site_id: REFINO_SITE_ID,
+    redirect_uri: callbackUrl(),
+    code_challenge: await sha256(verifier),
+    code_challenge_method: "S256",
+    state,
+  });
+  window.location.assign(\`\${REFINO_APP_URL}/editor/authorize?\${params.toString()}\`);
+}
+
+export type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };
+
+/**
+ * Finish the flow on /edit?code&state: check the state, exchange the code
+ * with the verifier this browser kept, store the session, and scrub the
+ * code from the URL. The token is never placed in a URL.
+ */
+export async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {
+  const params = new URLSearchParams(search);
+  const code = params.get("code");
+  const state = params.get("state");
+  const pending = readJson<PendingAuthorization>(PKCE_KEY);
+  storage()?.removeItem(PKCE_KEY);
+  if (typeof window !== "undefined" && window.history.replaceState) window.history.replaceState(null, "", window.location.pathname);
+  if (!code || !state) return { ok: false, error: "Refino did not return an authorization code." };
+  if (!pending || pending.state !== state) return { ok: false, error: "Sign-in was interrupted (state mismatch). Start again." };
+
+  let response: Response;
+  try {
+    response = await fetch(\`\${REFINO_APP_URL}/api/editor/token\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        code,
+        code_verifier: pending.verifier,
+        site_id: REFINO_SITE_ID,
+        redirect_uri: callbackUrl(),
+        // The public install facts from refino-site.ts, sent once per
+        // sign-in. Refino records them the first time and ignores them
+        // afterwards. Remove this line and everything still works.
+        install: REFINO_INSTALL,
+      }),
+    });
+  } catch {
+    return { ok: false, error: "Could not reach Refino to finish signing in." };
+  }
+  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;
+  if (!response.ok || !body?.ok || typeof body.token !== "string" || typeof body.expiresAt !== "number" || body.siteId !== REFINO_SITE_ID) {
+    return { ok: false, error: body?.error?.message ?? "Refino did not accept the authorization." };
+  }
+  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };
+  storage()?.setItem(SESSION_KEY, JSON.stringify(session));
+  return { ok: true, returnTo: pending.returnTo };
+}
+
+/**
+ * The three editor events this site reports, and the only ones it ever
+ * sends. There is no analytics SDK on this site: no autocapture, no session
+ * recording, no third-party script, no cookie. Each event is one small POST
+ * to Refino carrying an event name and, for a revert, whether it was one
+ * word or all of them — never your page, your copy, your visitors or your
+ * repository. \`edit_saved\` is not in this list on purpose: a save is a
+ * commit, and Refino records that on its own side where it cannot be faked
+ * or lost.
+ */
+const REPORTABLE_EVENTS = ["editor_opened", "edit_started", "edit_reverted"] as const;
+
+type ReportableEvent = (typeof REPORTABLE_EVENTS)[number];
+
+interface EditorEventLike {
+  readonly name: string;
+  readonly properties: Readonly<Record<string, unknown>>;
+}
+
+/**
+ * Fire and forget. A failure here is invisible and harmless: nothing in the
+ * editor waits for it, retries it, or behaves differently when it fails.
+ */
+export function reportEditorEvent(event: EditorEventLike): void {
+  const session = readEditorSession();
+  if (!session) return;
+  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;
+  const name = event.name as ReportableEvent;
+  const scope = event.properties.scope;
+  try {
+    void fetch(\`\${REFINO_APP_URL}/api/editor/events\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      keepalive: true,
+      headers: { "content-type": "application/json", authorization: \`Bearer \${session.token}\` },
+      body: JSON.stringify(scope === "one" || scope === "all" ? { event: name, scope } : { event: name }),
+    }).catch(() => {});
+  } catch {
+    // Never let reporting affect editing.
+  }
+}
+`;
+/** 0.1.0-rc.4 refino/copy-editing.tsx: before updates={refinoUpdates}. */
+export const COPY_EDITING_HOSTED_RC4 = `"use client";
+
+import type { CopyContent } from "@getrefino/core";
+import { RefinoProvider } from "@getrefino/react";
+import type { ReactNode } from "react";
+import { useCallback, useEffect, useState } from "react";
+
+import { clearEditorSession, editorEndpoint, readEditorSession, reportEditorEvent } from "./refino-client";
+import type { EditorSession } from "./refino-client";
+
+interface CopyEditingProps {
+  content: CopyContent;
+  children: ReactNode;
+}
+
+/**
+ * Hosted mode (Refino). Visitors get the plain site: the server never
+ * decides edit mode, so pages can stay static. In the browser, an editor
+ * session stored by /edit turns edit mode on; loads and saves go to Refino
+ * with the session's bearer token, and Refino checks the site's
+ * entitlement on every request.
+ */
+export function CopyEditing({ content, children }: CopyEditingProps) {
+  const [session, setSession] = useState<EditorSession | null>(null);
+
+  useEffect(() => {
+    // Read the session only after mount so server-rendered HTML never differs from the visitor's.
+    setSession(readEditorSession());
+  }, []);
+
+  // Read at request time (the provider keeps its options from the first render), so the
+  // token is always the one currently stored and never sent once the session is cleared.
+  const headers = useCallback((): Record<string, string> => {
+    const current = readEditorSession();
+    return current ? { authorization: \`Bearer \${current.token}\` } : {};
+  }, []);
+
+  const onExit = useCallback(async () => {
+    clearEditorSession();
+    window.location.assign("/");
+  }, []);
+
+  return (
+    <RefinoProvider content={content} editing={session !== null} endpoint={editorEndpoint()} headers={headers} signInHref="/edit" onExit={onExit} onEvent={reportEditorEvent}>
+      {children}
+    </RefinoProvider>
+  );
+}
+`;
+/**
+ * 0.1.0-rc.5 refino/refino-client.ts: before `resolveEditorPhase`, `signOut`
+ * and the hardened `safeReturnTo`. This is what every rc.5 site has on disk.
+ */
+export const REFINO_CLIENT_RC5 = `/**
+ * Browser-side Refino editor authorization for this site. No secrets here:
+ * the site is a public client (OAuth 2.1 with PKCE). The editor token lives
+ * in sessionStorage only (never localStorage, never a URL), is scoped to
+ * this site, and Refino re-checks the account's entitlement on every load
+ * and save. Never import this from server code.
+ */
+import { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from "./refino-site";
+
+const PKCE_KEY = "refino.pkce";
+const SESSION_KEY = "refino.editor";
+const CALLBACK_PATH = "/edit";
+
+export interface EditorSession {
+  readonly token: string;
+  /** Unix seconds. */
+  readonly expiresAt: number;
+  readonly siteId: string;
+}
+
+interface PendingAuthorization {
+  readonly verifier: string;
+  readonly state: string;
+  readonly returnTo: string;
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(bytes: number): string {
+  const buffer = new Uint8Array(bytes);
+  crypto.getRandomValues(buffer);
+  return base64url(buffer);
+}
+
+async function sha256(text: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return base64url(new Uint8Array(digest));
+}
+
+function storage(): Storage | null {
+  try {
+    return typeof window === "undefined" ? null : window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+
+function readJson<T>(key: string): T | null {
+  const raw = storage()?.getItem(key);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+/** Only a path on this site, never another origin. */
+export function safeReturnTo(value: string | null | undefined): string {
+  if (!value || !value.startsWith("/") || value.startsWith("//") || value.startsWith("/\\\\") || value.length > 512) return "/";
+  return value;
+}
+
+export function editorEndpoint(): string {
+  return \`\${REFINO_APP_URL}/api/sites/\${REFINO_SITE_ID}/copy\`;
+}
+
+export function callbackUrl(): string {
+  return \`\${window.location.origin}\${CALLBACK_PATH}\`;
+}
+
+/** The current editor session, or null when there is none or it expired. */
+export function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {
+  const session = readJson<EditorSession>(SESSION_KEY);
+  if (!session || typeof session.token !== "string" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== "number") return null;
+  if (session.expiresAt <= nowSeconds) {
+    storage()?.removeItem(SESSION_KEY);
+    return null;
+  }
+  return session;
+}
+
+export function clearEditorSession(): void {
+  storage()?.removeItem(SESSION_KEY);
+  storage()?.removeItem(PKCE_KEY);
+}
+
+/** Start the flow: remember the PKCE verifier and state, then go to Refino. */
+export async function beginAuthorization(returnTo: string): Promise<void> {
+  const verifier = randomToken(32);
+  const state = randomToken(16);
+  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };
+  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));
+  const params = new URLSearchParams({
+    site_id: REFINO_SITE_ID,
+    redirect_uri: callbackUrl(),
+    code_challenge: await sha256(verifier),
+    code_challenge_method: "S256",
+    state,
+  });
+  window.location.assign(\`\${REFINO_APP_URL}/editor/authorize?\${params.toString()}\`);
+}
+
+export type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };
+
+/**
+ * Finish the flow on /edit?code&state: check the state, exchange the code
+ * with the verifier this browser kept, store the session, and scrub the
+ * code from the URL. The token is never placed in a URL.
+ */
+export async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {
+  const params = new URLSearchParams(search);
+  const code = params.get("code");
+  const state = params.get("state");
+  const pending = readJson<PendingAuthorization>(PKCE_KEY);
+  storage()?.removeItem(PKCE_KEY);
+  if (typeof window !== "undefined" && window.history.replaceState) window.history.replaceState(null, "", window.location.pathname);
+  if (!code || !state) return { ok: false, error: "Refino did not return an authorization code." };
+  if (!pending || pending.state !== state) return { ok: false, error: "Sign-in was interrupted (state mismatch). Start again." };
+
+  let response: Response;
+  try {
+    response = await fetch(\`\${REFINO_APP_URL}/api/editor/token\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        code,
+        code_verifier: pending.verifier,
+        site_id: REFINO_SITE_ID,
+        redirect_uri: callbackUrl(),
+        // The public install facts from refino-site.ts, sent once per
+        // sign-in. Refino records them the first time and ignores them
+        // afterwards. Remove this line and everything still works.
+        install: REFINO_INSTALL,
+      }),
+    });
+  } catch {
+    return { ok: false, error: "Could not reach Refino to finish signing in." };
+  }
+  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;
+  if (!response.ok || !body?.ok || typeof body.token !== "string" || typeof body.expiresAt !== "number" || body.siteId !== REFINO_SITE_ID) {
+    return { ok: false, error: body?.error?.message ?? "Refino did not accept the authorization." };
+  }
+  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };
+  storage()?.setItem(SESSION_KEY, JSON.stringify(session));
+  return { ok: true, returnTo: pending.returnTo };
+}
+
+/**
+ * The three editor events this site reports, and the only ones it ever
+ * sends. There is no analytics SDK on this site: no autocapture, no session
+ * recording, no third-party script, no cookie. Each event is one small POST
+ * to Refino carrying an event name and, for a revert, whether it was one
+ * word or all of them — never your page, your copy, your visitors or your
+ * repository. \`edit_saved\` is not in this list on purpose: a save is a
+ * commit, and Refino records that on its own side where it cannot be faked
+ * or lost.
+ */
+const REPORTABLE_EVENTS = ["editor_opened", "edit_started", "edit_reverted"] as const;
+
+type ReportableEvent = (typeof REPORTABLE_EVENTS)[number];
+
+interface EditorEventLike {
+  readonly name: string;
+  readonly properties: Readonly<Record<string, unknown>>;
+}
+
+/**
+ * Fire and forget. A failure here is invisible and harmless: nothing in the
+ * editor waits for it, retries it, or behaves differently when it fails.
+ */
+export function reportEditorEvent(event: EditorEventLike): void {
+  const session = readEditorSession();
+  if (!session) return;
+  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;
+  const name = event.name as ReportableEvent;
+  const scope = event.properties.scope;
+  try {
+    void fetch(\`\${REFINO_APP_URL}/api/editor/events\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      keepalive: true,
+      headers: { "content-type": "application/json", authorization: \`Bearer \${session.token}\` },
+      body: JSON.stringify(scope === "one" || scope === "all" ? { event: name, scope } : { event: name }),
+    }).catch(() => {});
+  } catch {
+    // Never let reporting affect editing.
+  }
+}
+
+/**
+ * Updates to this site's Refino integration, offered in the editor
+ * toolbar. Asking is read-only. Nothing changes unless the owner presses
+ * "Update Refino": Refino then commits the new Refino version to this
+ * repository, and the site's normal deployment takes it from there. The
+ * editor checks every answer itself, so this stays a plain pipe.
+ */
+export const refinoUpdates = {
+  check: (): Promise<unknown> => updateRequest("GET"),
+  apply: (version: string): Promise<unknown> => updateRequest("POST", JSON.stringify({ version })),
+};
+
+async function updateRequest(method: "GET" | "POST", body?: string): Promise<unknown> {
+  const session = readEditorSession();
+  if (!session) return null;
+  const headers: Record<string, string> = { accept: "application/json", authorization: \`Bearer \${session.token}\` };
+  if (body) headers["content-type"] = "application/json";
+  try {
+    const response = await fetch(\`\${REFINO_APP_URL}/api/sites/\${REFINO_SITE_ID}/update\`, { method, mode: "cors", credentials: "omit", headers, body });
+    return await response.json();
+  } catch {
+    // Unreachable or unreadable: the editor treats it as "nothing to offer", or as an unknown outcome.
+    return null;
+  }
+}
+`;
+/**
+ * refino/edit-page.tsx as every release up to and including 0.1.0-rc.5 wrote
+ * it (the body never changed after rc.1): the unstyled handoff screen, which
+ * a successful sign-in never landed on, and its "Sign in as someone else"
+ * button, which cleared the site's editor session but not the Refino one and
+ * so signed the same account straight back in.
+ */
+export const EDIT_PAGE_HOSTED_RC5 = `"use client";
+
+import { useEffect, useState } from "react";
+
+import { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from "./refino-client";
+
+type Phase = { kind: "loading" } | { kind: "signed-in" } | { kind: "error"; message: string };
+
+/**
+ * Owner entry point for Refino-hosted editing. Visiting /edit sends the
+ * owner to Refino to sign in and authorize this site; Refino sends them
+ * back here with a one-time code, which is exchanged for an editor session
+ * and scrubbed from the URL. Restyle freely; keep the behaviour.
+ */
+export default function EditPage() {
+  const [phase, setPhase] = useState<Phase>({ kind: "loading" });
+
+  useEffect(() => {
+    let cancelled = false;
+    const params = new URLSearchParams(window.location.search);
+    if (params.has("code") || params.has("state")) {
+      void completeAuthorization().then((result) => {
+        if (cancelled) return;
+        if (result.ok) window.location.assign(result.returnTo);
+        else setPhase({ kind: "error", message: result.error });
+      });
+    } else if (readEditorSession()) {
+      setPhase({ kind: "signed-in" });
+    } else if (params.get("error")) {
+      setPhase({ kind: "error", message: params.get("error") ?? "Sign-in failed." });
+    } else {
+      void beginAuthorization(safeReturnTo(params.get("return_to")));
+    }
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return (
+    <main style={{ maxWidth: 420, margin: "10vh auto", padding: 24, fontFamily: "system-ui, sans-serif" }}>
+      {phase.kind === "loading" && <p>Signing you in with Refino…</p>}
+      {phase.kind === "signed-in" && (
+        <>
+          <h1>Edit mode is on</h1>
+          <p>Go to the site, click any text, and press Save when you are done.</p>
+          <p>
+            <a href="/">Open the site</a>
+          </p>
+          <button
+            type="button"
+            onClick={() => {
+              clearEditorSession();
+              setPhase({ kind: "loading" });
+              void beginAuthorization("/");
+            }}
+          >
+            Sign in as someone else
+          </button>
+        </>
+      )}
+      {phase.kind === "error" && (
+        <>
+          <h1>Could not start editing</h1>
+          <p role="alert">{phase.message}</p>
+          <button type="button" onClick={() => void beginAuthorization("/")}>
+            Try again
+          </button>
+        </>
+      )}
+    </main>
+  );
+}
+`;

package/dist/templates.js

@@ -10,7 +10,7 @@
  * is invited to restyle -- and, when its body has changed since a released
  * version, the byte-exact body that version wrote.
  */
-import { BOILERPLATE_DIR } from "./plan.js";
+import { BOILERPLATE_DIR } from "./constants.js";
 import { createTemplateFactory } from "./template-file.js";
 import { hostedFiles } from "./templates-hosted.js";
 const BOILERPLATE_DIR_NAME = BOILERPLATE_DIR;

package/dist/verify.js

@@ -6,6 +6,7 @@
 import { spawnSync } from "node:child_process";
 import { dirname, join, resolve } from "node:path";
 import { isContentId, parseCopy } from "@getrefino/core";
+import { parseContentConfig } from "@getrefino/core/documents";
 import ts from "typescript";
 import { exists, isFile, isTestOrStoryFile, readJson, readText, rel, walkFiles } from "./fs.js";
 import { COMPARISON_SUFFIX, classifyGeneratedFiles, readGeneratedManifest } from "./generated.js";
@@ -389,6 +390,35 @@ export function verifyIntegration(rootPath, options = {}) {
                 add({ id: "content-ids", status: "pass", message: "All ids are valid." });
         }
     }
+    // Content sources (article editing). Absent is the normal case and not a
+    // finding: a site that edits only copy has nothing to declare.
+    if (config?.content !== undefined) {
+        try {
+            const content = parseContentConfig(config.content);
+            const missing = content.sources.filter((source) => !exists(join(appDir, source.dir)));
+            if (content.sources.length === 0) {
+                add({ id: "content-sources", status: "warn", message: 'refino.config.json has a "content" block with no sources.', fix: 'Add a source, or remove the "content" block.' });
+            }
+            else if (missing.length > 0) {
+                add({
+                    id: "content-sources",
+                    status: "fail",
+                    message: `Content source directories do not exist: ${missing.map((source) => `${source.id} (${source.dir})`).join(", ")}.`,
+                    fix: "Point each source at the directory that actually holds the articles.",
+                });
+            }
+            else {
+                add({
+                    id: "content-sources",
+                    status: "pass",
+                    message: `Article sources: ${content.sources.map((source) => `${source.id} (${source.dir}/*${source.extensions.join(",*")})`).join(", ")}.`,
+                });
+            }
+        }
+        catch (error) {
+            add({ id: "content-sources", status: "fail", message: error.message, fix: 'Fix the "content" block, or remove it to turn article editing off.' });
+        }
+    }
     // Source scan
     const sourceFiles = walkFiles(appDir).filter((file) => !isTestOrStoryFile(rel(appDir, file)));
     const uses = collectEditableTextUses(appDir, sourceFiles);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getrefino/onboarding",
-  "version": "0.1.0-rc.4",
+  "version": "0.1.0-rc.6",
   "description": "The engine behind `npx @getrefino/cli init`: deterministic repository inspection, copy discovery, migration planning, agent instructions and verification for adding Refino to an existing React site. Development tooling only; never part of a site's runtime.",
   "keywords": [
     "refino",
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "typescript": ">=5.5 <7",
-    "@getrefino/core": "0.1.0-rc.4"
+    "@getrefino/core": "0.1.0-rc.6"
   },
   "devDependencies": {
     "@types/node": "22.20.2",