@getrefino/onboarding 0.1.0-rc.5 → 0.1.0

package/dist/apply.d.ts

@@ -16,6 +16,22 @@ export interface RefinoConfig {
         readonly siteId: string;
         readonly appUrl: string;
     };
+    /**
+     * Article editing: which directories hold editable Markdown and MDX.
+     * Owner-written and never generated — Refino has no way to know which of a
+     * repository's Markdown files are articles the owner wants edited. It is
+     * merged like every other key the owner may have tuned, so a run of `init`
+     * leaves it exactly as it is. `refino verify` checks it.
+     * See `docs/content-editing.md`.
+     */
+    readonly content?: {
+        readonly sources: readonly {
+            readonly id: string;
+            readonly dir: string;
+            readonly extensions?: readonly string[];
+            readonly fields?: Readonly<Record<string, string>>;
+        }[];
+    };
     readonly framework: string;
     readonly router: string;
     readonly routes: readonly string[];

package/dist/templates-hosted.d.ts

@@ -17,11 +17,14 @@ export declare const REFINO_SITE_ID_PATTERN: RegExp;
 /** Public configuration; safe to ship to the browser and to commit. */
 export declare const REFINO_SITE: (config: RefinoSiteConfig) => string;
 /** Browser-only client: PKCE, the authorization round trip and the session in sessionStorage. */
-export declare const REFINO_CLIENT = "/**\n * Browser-side Refino editor authorization for this site. No secrets here:\n * the site is a public client (OAuth 2.1 with PKCE). The editor token lives\n * in sessionStorage only (never localStorage, never a URL), is scoped to\n * this site, and Refino re-checks the account's entitlement on every load\n * and save. Never import this from server code.\n */\nimport { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from \"./refino-site\";\n\nconst PKCE_KEY = \"refino.pkce\";\nconst SESSION_KEY = \"refino.editor\";\nconst CALLBACK_PATH = \"/edit\";\n\nexport interface EditorSession {\n  readonly token: string;\n  /** Unix seconds. */\n  readonly expiresAt: number;\n  readonly siteId: string;\n}\n\ninterface PendingAuthorization {\n  readonly verifier: string;\n  readonly state: string;\n  readonly returnTo: string;\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomToken(bytes: number): string {\n  const buffer = new Uint8Array(bytes);\n  crypto.getRandomValues(buffer);\n  return base64url(buffer);\n}\n\nasync function sha256(text: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n  return base64url(new Uint8Array(digest));\n}\n\nfunction storage(): Storage | null {\n  try {\n    return typeof window === \"undefined\" ? null : window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction readJson<T>(key: string): T | null {\n  const raw = storage()?.getItem(key);\n  if (!raw) return null;\n  try {\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n/** Only a path on this site, never another origin. */\nexport function safeReturnTo(value: string | null | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\") || value.startsWith(\"/\\\\\") || value.length > 512) return \"/\";\n  return value;\n}\n\nexport function editorEndpoint(): string {\n  return `${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/copy`;\n}\n\nexport function callbackUrl(): string {\n  return `${window.location.origin}${CALLBACK_PATH}`;\n}\n\n/** The current editor session, or null when there is none or it expired. */\nexport function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {\n  const session = readJson<EditorSession>(SESSION_KEY);\n  if (!session || typeof session.token !== \"string\" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== \"number\") return null;\n  if (session.expiresAt <= nowSeconds) {\n    storage()?.removeItem(SESSION_KEY);\n    return null;\n  }\n  return session;\n}\n\nexport function clearEditorSession(): void {\n  storage()?.removeItem(SESSION_KEY);\n  storage()?.removeItem(PKCE_KEY);\n}\n\n/** Start the flow: remember the PKCE verifier and state, then go to Refino. */\nexport async function beginAuthorization(returnTo: string): Promise<void> {\n  const verifier = randomToken(32);\n  const state = randomToken(16);\n  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };\n  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));\n  const params = new URLSearchParams({\n    site_id: REFINO_SITE_ID,\n    redirect_uri: callbackUrl(),\n    code_challenge: await sha256(verifier),\n    code_challenge_method: \"S256\",\n    state,\n  });\n  window.location.assign(`${REFINO_APP_URL}/editor/authorize?${params.toString()}`);\n}\n\nexport type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };\n\n/**\n * Finish the flow on /edit?code&state: check the state, exchange the code\n * with the verifier this browser kept, store the session, and scrub the\n * code from the URL. The token is never placed in a URL.\n */\nexport async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {\n  const params = new URLSearchParams(search);\n  const code = params.get(\"code\");\n  const state = params.get(\"state\");\n  const pending = readJson<PendingAuthorization>(PKCE_KEY);\n  storage()?.removeItem(PKCE_KEY);\n  if (typeof window !== \"undefined\" && window.history.replaceState) window.history.replaceState(null, \"\", window.location.pathname);\n  if (!code || !state) return { ok: false, error: \"Refino did not return an authorization code.\" };\n  if (!pending || pending.state !== state) return { ok: false, error: \"Sign-in was interrupted (state mismatch). Start again.\" };\n\n  let response: Response;\n  try {\n    response = await fetch(`${REFINO_APP_URL}/api/editor/token`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({\n        grant_type: \"authorization_code\",\n        code,\n        code_verifier: pending.verifier,\n        site_id: REFINO_SITE_ID,\n        redirect_uri: callbackUrl(),\n        // The public install facts from refino-site.ts, sent once per\n        // sign-in. Refino records them the first time and ignores them\n        // afterwards. Remove this line and everything still works.\n        install: REFINO_INSTALL,\n      }),\n    });\n  } catch {\n    return { ok: false, error: \"Could not reach Refino to finish signing in.\" };\n  }\n  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;\n  if (!response.ok || !body?.ok || typeof body.token !== \"string\" || typeof body.expiresAt !== \"number\" || body.siteId !== REFINO_SITE_ID) {\n    return { ok: false, error: body?.error?.message ?? \"Refino did not accept the authorization.\" };\n  }\n  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };\n  storage()?.setItem(SESSION_KEY, JSON.stringify(session));\n  return { ok: true, returnTo: pending.returnTo };\n}\n\n/**\n * The three editor events this site reports, and the only ones it ever\n * sends. There is no analytics SDK on this site: no autocapture, no session\n * recording, no third-party script, no cookie. Each event is one small POST\n * to Refino carrying an event name and, for a revert, whether it was one\n * word or all of them \u2014 never your page, your copy, your visitors or your\n * repository. `edit_saved` is not in this list on purpose: a save is a\n * commit, and Refino records that on its own side where it cannot be faked\n * or lost.\n */\nconst REPORTABLE_EVENTS = [\"editor_opened\", \"edit_started\", \"edit_reverted\"] as const;\n\ntype ReportableEvent = (typeof REPORTABLE_EVENTS)[number];\n\ninterface EditorEventLike {\n  readonly name: string;\n  readonly properties: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Fire and forget. A failure here is invisible and harmless: nothing in the\n * editor waits for it, retries it, or behaves differently when it fails.\n */\nexport function reportEditorEvent(event: EditorEventLike): void {\n  const session = readEditorSession();\n  if (!session) return;\n  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;\n  const name = event.name as ReportableEvent;\n  const scope = event.properties.scope;\n  try {\n    void fetch(`${REFINO_APP_URL}/api/editor/events`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      keepalive: true,\n      headers: { \"content-type\": \"application/json\", authorization: `Bearer ${session.token}` },\n      body: JSON.stringify(scope === \"one\" || scope === \"all\" ? { event: name, scope } : { event: name }),\n    }).catch(() => {});\n  } catch {\n    // Never let reporting affect editing.\n  }\n}\n\n/**\n * Updates to this site's Refino integration, offered in the editor\n * toolbar. Asking is read-only. Nothing changes unless the owner presses\n * \"Update Refino\": Refino then commits the new Refino version to this\n * repository, and the site's normal deployment takes it from there. The\n * editor checks every answer itself, so this stays a plain pipe.\n */\nexport const refinoUpdates = {\n  check: (): Promise<unknown> => updateRequest(\"GET\"),\n  apply: (version: string): Promise<unknown> => updateRequest(\"POST\", JSON.stringify({ version })),\n};\n\nasync function updateRequest(method: \"GET\" | \"POST\", body?: string): Promise<unknown> {\n  const session = readEditorSession();\n  if (!session) return null;\n  const headers: Record<string, string> = { accept: \"application/json\", authorization: `Bearer ${session.token}` };\n  if (body) headers[\"content-type\"] = \"application/json\";\n  try {\n    const response = await fetch(`${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/update`, { method, mode: \"cors\", credentials: \"omit\", headers, body });\n    return await response.json();\n  } catch {\n    // Unreachable or unreadable: the editor treats it as \"nothing to offer\", or as an unknown outcome.\n    return null;\n  }\n}\n";
+export declare const REFINO_CLIENT = "/**\n * Browser-side Refino editor authorization for this site. No secrets here:\n * the site is a public client (OAuth 2.1 with PKCE). The editor token lives\n * in sessionStorage only (never localStorage, never a URL), is scoped to\n * this site, and Refino re-checks the account's entitlement on every load\n * and save. Never import this from server code.\n */\nimport { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from \"./refino-site\";\n\nconst PKCE_KEY = \"refino.pkce\";\nconst SESSION_KEY = \"refino.editor\";\n/** The owner's entry point, the OAuth callback, and the handoff screen: one route. */\nexport const CALLBACK_PATH = \"/edit\";\n\nexport interface EditorSession {\n  readonly token: string;\n  /** Unix seconds. */\n  readonly expiresAt: number;\n  readonly siteId: string;\n}\n\ninterface PendingAuthorization {\n  readonly verifier: string;\n  readonly state: string;\n  readonly returnTo: string;\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomToken(bytes: number): string {\n  const buffer = new Uint8Array(bytes);\n  crypto.getRandomValues(buffer);\n  return base64url(buffer);\n}\n\nasync function sha256(text: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n  return base64url(new Uint8Array(digest));\n}\n\nfunction storage(): Storage | null {\n  try {\n    return typeof window === \"undefined\" ? null : window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction readJson<T>(key: string): T | null {\n  const raw = storage()?.getItem(key);\n  if (!raw) return null;\n  try {\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n/** Only a path on this site, never another origin. */\nexport function safeReturnTo(value: string | null | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\") || value.startsWith(\"/\\\\\") || value.length > 512) return \"/\";\n  // Browsers delete tab, newline and carriage return from a URL before they\n  // resolve it, so \"/<tab>/example.test\" arrives at the address bar as\n  // \"//example.test\": another origin, out of something that passed every\n  // test above. A control character anywhere means the value is refused,\n  // never repaired.\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code < 0x20 || code === 0x7f) return \"/\";\n  }\n  return value;\n}\n\nexport function editorEndpoint(): string {\n  return `${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/copy`;\n}\n\nexport function callbackUrl(): string {\n  return `${window.location.origin}${CALLBACK_PATH}`;\n}\n\n/** The current editor session, or null when there is none or it expired. */\nexport function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {\n  const session = readJson<EditorSession>(SESSION_KEY);\n  if (!session || typeof session.token !== \"string\" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== \"number\") return null;\n  if (session.expiresAt <= nowSeconds) {\n    storage()?.removeItem(SESSION_KEY);\n    return null;\n  }\n  return session;\n}\n\nexport function clearEditorSession(): void {\n  storage()?.removeItem(SESSION_KEY);\n  storage()?.removeItem(PKCE_KEY);\n}\n\n/** Start the flow: remember the PKCE verifier and state, then go to Refino. */\nexport async function beginAuthorization(returnTo: string): Promise<void> {\n  const verifier = randomToken(32);\n  const state = randomToken(16);\n  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };\n  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));\n  const params = new URLSearchParams({\n    site_id: REFINO_SITE_ID,\n    redirect_uri: callbackUrl(),\n    code_challenge: await sha256(verifier),\n    code_challenge_method: \"S256\",\n    state,\n  });\n  window.location.assign(`${REFINO_APP_URL}/editor/authorize?${params.toString()}`);\n}\n\nexport type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };\n\n/**\n * Finish the flow on /edit?code&state: check the state, exchange the code\n * with the verifier this browser kept, store the session, and scrub the\n * code from the URL. The token is never placed in a URL.\n */\nexport async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {\n  const params = new URLSearchParams(search);\n  const code = params.get(\"code\");\n  const state = params.get(\"state\");\n  const pending = readJson<PendingAuthorization>(PKCE_KEY);\n  storage()?.removeItem(PKCE_KEY);\n  if (typeof window !== \"undefined\" && window.history.replaceState) window.history.replaceState(null, \"\", window.location.pathname);\n  if (!code || !state) return { ok: false, error: \"Refino did not return an authorization code.\" };\n  if (!pending || pending.state !== state) return { ok: false, error: \"Sign-in was interrupted (state mismatch). Start again.\" };\n\n  let response: Response;\n  try {\n    response = await fetch(`${REFINO_APP_URL}/api/editor/token`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({\n        grant_type: \"authorization_code\",\n        code,\n        code_verifier: pending.verifier,\n        site_id: REFINO_SITE_ID,\n        redirect_uri: callbackUrl(),\n        // The public install facts from refino-site.ts, sent once per\n        // sign-in. Refino records them the first time and ignores them\n        // afterwards. Remove this line and everything still works.\n        install: REFINO_INSTALL,\n      }),\n    });\n  } catch {\n    return { ok: false, error: \"Could not reach Refino to finish signing in.\" };\n  }\n  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;\n  if (!response.ok || !body?.ok || typeof body.token !== \"string\" || typeof body.expiresAt !== \"number\" || body.siteId !== REFINO_SITE_ID) {\n    return { ok: false, error: body?.error?.message ?? \"Refino did not accept the authorization.\" };\n  }\n  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };\n  storage()?.setItem(SESSION_KEY, JSON.stringify(session));\n  return { ok: true, returnTo: pending.returnTo };\n}\n\n/**\n * The three states /edit can be in. The page draws them; this module\n * decides which one it is, so restyling the page can never change where a\n * successful sign-in lands.\n */\nexport type EditorPhase =\n  /** Leaving for Refino, or coming back from it: the browser is navigating. */\n  | { readonly kind: \"authorizing\" }\n  /** The handoff: this browser holds an editor session for this site. */\n  | { readonly kind: \"ready\"; readonly openHref: string }\n  | { readonly kind: \"error\"; readonly message: string };\n\n/** Where \"Open the site\" goes: the page the owner asked for, or the site's home. Never /edit, never another origin. */\nfunction openSiteHref(params: URLSearchParams): string {\n  const requested = safeReturnTo(params.get(\"return_to\"));\n  return requested === CALLBACK_PATH || requested.startsWith(CALLBACK_PATH + \"?\") ? \"/\" : requested;\n}\n\nlet inFlight: { readonly search: string; readonly phase: Promise<EditorPhase> } | null = null;\n\n/**\n * The one decision /edit makes, in one place and in one order:\n *\n *   ?code&state       finish the authorization Refino sent back\n *   editor session    already authorized: the handoff\n *   ?error            Refino refused; say so and offer another go\n *   otherwise         start the authorization\n *\n * A successful sign-in lands here, on the handoff, and /edit is safe to\n * revisit: it shows the same screen rather than starting anything. The one\n * exception is deliberate and comes from the URL the owner arrived on --\n * /edit?return_to=/pricing sends them back to /pricing when they are\n * through, which is how the editor asks for a fresh session mid-edit.\n * Nothing else decides the destination.\n */\nexport function resolveEditorPhase(search: string = window.location.search): Promise<EditorPhase> {\n  // One resolution per URL. React runs an effect twice in development and the\n  // authorization code is single-use, so a second call would consume nothing\n  // and report a failed sign-in that did not happen.\n  if (!inFlight || inFlight.search !== search) inFlight = { search, phase: resolvePhase(search) };\n  return inFlight.phase;\n}\n\nasync function resolvePhase(search: string): Promise<EditorPhase> {\n  const params = new URLSearchParams(search);\n  if (params.has(\"code\") || params.has(\"state\")) {\n    const result = await completeAuthorization(search);\n    if (!result.ok) return { kind: \"error\", message: result.error };\n    if (result.returnTo !== CALLBACK_PATH) {\n      window.location.assign(result.returnTo);\n      return { kind: \"authorizing\" };\n    }\n    return { kind: \"ready\", openHref: openSiteHref(params) };\n  }\n  if (readEditorSession()) return { kind: \"ready\", openHref: openSiteHref(params) };\n  // Refino never sends a failure back to the site -- a refused authorization\n  // stays on the Refino dashboard, where it can say what to do about it -- so\n  // ?error here is somebody else's text and is not repeated back to the owner.\n  if (params.get(\"error\")) return { kind: \"error\", message: \"Refino did not authorize this browser to edit the site.\" };\n  await beginAuthorization(params.get(\"return_to\") ?? CALLBACK_PATH);\n  return { kind: \"authorizing\" };\n}\n\n/**\n * End the session, in the only order that leaves no live credential behind:\n * this site's editor token lives in this browser and is cleared here, and\n * the Refino account session lives in a cookie on Refino's own origin and\n * can only be ended there -- so the browser is handed to Refino, which\n * confirms and signs the owner out. Signing out of Refino is not signing\n * out of GitHub, and it changes nothing about this site.\n */\nexport function signOut(): void {\n  clearEditorSession();\n  window.location.assign(`${REFINO_APP_URL}/signout`);\n}\n\n/**\n * The three editor events this site reports, and the only ones it ever\n * sends. There is no analytics SDK on this site: no autocapture, no session\n * recording, no third-party script, no cookie. Each event is one small POST\n * to Refino carrying an event name and, for a revert, whether it was one\n * word or all of them \u2014 never your page, your copy, your visitors or your\n * repository. `edit_saved` is not in this list on purpose: a save is a\n * commit, and Refino records that on its own side where it cannot be faked\n * or lost.\n */\nconst REPORTABLE_EVENTS = [\"editor_opened\", \"edit_started\", \"edit_reverted\"] as const;\n\ntype ReportableEvent = (typeof REPORTABLE_EVENTS)[number];\n\ninterface EditorEventLike {\n  readonly name: string;\n  readonly properties: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Fire and forget. A failure here is invisible and harmless: nothing in the\n * editor waits for it, retries it, or behaves differently when it fails.\n */\nexport function reportEditorEvent(event: EditorEventLike): void {\n  const session = readEditorSession();\n  if (!session) return;\n  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;\n  const name = event.name as ReportableEvent;\n  const scope = event.properties.scope;\n  const surface = event.properties.edit_surface;\n  const payload: Record<string, string> = { event: name };\n  if (scope === \"one\" || scope === \"all\") payload.scope = scope;\n  // Which surface an edit started on: inline copy, an article's metadata, or\n  // an article's body. An enum of three, never an id and never a word of the\n  // text. Refino refuses anything it does not recognize.\n  if (typeof surface === \"string\") payload.surface = surface;\n  try {\n    void fetch(`${REFINO_APP_URL}/api/editor/events`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      keepalive: true,\n      headers: { \"content-type\": \"application/json\", authorization: `Bearer ${session.token}` },\n      body: JSON.stringify(payload),\n    }).catch(() => {});\n  } catch {\n    // Never let reporting affect editing.\n  }\n}\n\n/**\n * Updates to this site's Refino integration, offered in the editor\n * toolbar. Asking is read-only. Nothing changes unless the owner presses\n * \"Update Refino\": Refino then commits the new Refino version to this\n * repository, and the site's normal deployment takes it from there. The\n * editor checks every answer itself, so this stays a plain pipe.\n */\nexport const refinoUpdates = {\n  check: (): Promise<unknown> => updateRequest(\"GET\"),\n  apply: (version: string): Promise<unknown> => updateRequest(\"POST\", JSON.stringify({ version })),\n};\n\nasync function updateRequest(method: \"GET\" | \"POST\", body?: string): Promise<unknown> {\n  const session = readEditorSession();\n  if (!session) return null;\n  const headers: Record<string, string> = { accept: \"application/json\", authorization: `Bearer ${session.token}` };\n  if (body) headers[\"content-type\"] = \"application/json\";\n  try {\n    const response = await fetch(`${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/update`, { method, mode: \"cors\", credentials: \"omit\", headers, body });\n    return await response.json();\n  } catch {\n    // Unreachable or unreadable: the editor treats it as \"nothing to offer\", or as an unknown outcome.\n    return null;\n  }\n}\n";
 /** Provider wrapper: edit mode is decided in the browser from the stored session. */
 export declare const COPY_EDITING_HOSTED = "\"use client\";\n\nimport type { CopyContent } from \"@getrefino/core\";\nimport { RefinoProvider } from \"@getrefino/react\";\nimport type { ReactNode } from \"react\";\nimport { useCallback, useEffect, useState } from \"react\";\n\nimport { clearEditorSession, editorEndpoint, readEditorSession, refinoUpdates, reportEditorEvent } from \"./refino-client\";\nimport type { EditorSession } from \"./refino-client\";\n\ninterface CopyEditingProps {\n  content: CopyContent;\n  children: ReactNode;\n}\n\n/**\n * Hosted mode (Refino). Visitors get the plain site: the server never\n * decides edit mode, so pages can stay static. In the browser, an editor\n * session stored by /edit turns edit mode on; loads and saves go to Refino\n * with the session's bearer token, and Refino checks the site's\n * entitlement on every request.\n */\nexport function CopyEditing({ content, children }: CopyEditingProps) {\n  const [session, setSession] = useState<EditorSession | null>(null);\n\n  useEffect(() => {\n    // Read the session only after mount so server-rendered HTML never differs from the visitor's.\n    setSession(readEditorSession());\n  }, []);\n\n  // Read at request time (the provider keeps its options from the first render), so the\n  // token is always the one currently stored and never sent once the session is cleared.\n  const headers = useCallback((): Record<string, string> => {\n    const current = readEditorSession();\n    return current ? { authorization: `Bearer ${current.token}` } : {};\n  }, []);\n\n  const onExit = useCallback(async () => {\n    clearEditorSession();\n    window.location.assign(\"/\");\n  }, []);\n\n  return (\n    <RefinoProvider content={content} editing={session !== null} endpoint={editorEndpoint()} headers={headers} signInHref=\"/edit\" onExit={onExit} onEvent={reportEditorEvent} updates={refinoUpdates}>\n      {children}\n    </RefinoProvider>\n  );\n}\n";
-/** The /edit page: starts the flow, finishes it on return, shows state. Works as a static export. */
-export declare const EDIT_PAGE_HOSTED = "\"use client\";\n\nimport { useEffect, useState } from \"react\";\n\nimport { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from \"./refino-client\";\n\ntype Phase = { kind: \"loading\" } | { kind: \"signed-in\" } | { kind: \"error\"; message: string };\n\n/**\n * Owner entry point for Refino-hosted editing. Visiting /edit sends the\n * owner to Refino to sign in and authorize this site; Refino sends them\n * back here with a one-time code, which is exchanged for an editor session\n * and scrubbed from the URL. Restyle freely; keep the behaviour.\n */\nexport default function EditPage() {\n  const [phase, setPhase] = useState<Phase>({ kind: \"loading\" });\n\n  useEffect(() => {\n    let cancelled = false;\n    const params = new URLSearchParams(window.location.search);\n    if (params.has(\"code\") || params.has(\"state\")) {\n      void completeAuthorization().then((result) => {\n        if (cancelled) return;\n        if (result.ok) window.location.assign(result.returnTo);\n        else setPhase({ kind: \"error\", message: result.error });\n      });\n    } else if (readEditorSession()) {\n      setPhase({ kind: \"signed-in\" });\n    } else if (params.get(\"error\")) {\n      setPhase({ kind: \"error\", message: params.get(\"error\") ?? \"Sign-in failed.\" });\n    } else {\n      void beginAuthorization(safeReturnTo(params.get(\"return_to\")));\n    }\n    return () => {\n      cancelled = true;\n    };\n  }, []);\n\n  return (\n    <main style={{ maxWidth: 420, margin: \"10vh auto\", padding: 24, fontFamily: \"system-ui, sans-serif\" }}>\n      {phase.kind === \"loading\" && <p>Signing you in with Refino\u2026</p>}\n      {phase.kind === \"signed-in\" && (\n        <>\n          <h1>Edit mode is on</h1>\n          <p>Go to the site, click any text, and press Save when you are done.</p>\n          <p>\n            <a href=\"/\">Open the site</a>\n          </p>\n          <button\n            type=\"button\"\n            onClick={() => {\n              clearEditorSession();\n              setPhase({ kind: \"loading\" });\n              void beginAuthorization(\"/\");\n            }}\n          >\n            Sign in as someone else\n          </button>\n        </>\n      )}\n      {phase.kind === \"error\" && (\n        <>\n          <h1>Could not start editing</h1>\n          <p role=\"alert\">{phase.message}</p>\n          <button type=\"button\" onClick={() => void beginAuthorization(\"/\")}>\n            Try again\n          </button>\n        </>\n      )}\n    </main>\n  );\n}\n";
+/**
+ * The /edit page: the owner's entry point and, once they are through, the
+ * handoff screen. Presentation only -- every decision is in refino-client.
+ */
+export declare const EDIT_PAGE_HOSTED = "\"use client\";\n\nimport { useEffect, useState } from \"react\";\n\nimport { beginAuthorization, CALLBACK_PATH, resolveEditorPhase, signOut } from \"./refino-client\";\nimport type { EditorPhase } from \"./refino-client\";\n\n/**\n * Owner entry point for Refino-hosted editing. Visiting /edit sends the\n * owner to Refino to sign in and authorize this site; Refino sends them\n * back here with a one-time code, which is exchanged for an editor session\n * and scrubbed from the URL. The page then stays here and says so: /edit\n * with an editor session is the handoff, and it is safe to revisit.\n *\n * This file is yours. Restyle it, rewrite the markup, drop the styles below\n * and use your own -- keep the three phases, the link to `phase.openHref`\n * and the sign-out button, and the flow keeps working.\n */\nconst STYLES = `\n.refino-edit {\n  --refino-ink: #0f172a;\n  --refino-ink-soft: #334155;\n  --refino-muted: #64748b;\n  --refino-line: #e2e8f0;\n  --refino-accent: #0f766e;\n  --refino-accent-strong: #115e59;\n  --refino-accent-soft: #ccfbf1;\n  display: flex;\n  min-height: 100vh;\n  align-items: center;\n  justify-content: center;\n  margin: 0;\n  padding: 24px 16px 56px;\n  background: #f8fafc;\n  color: var(--refino-ink);\n  font-family: ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;\n  line-height: 1.55;\n  -webkit-font-smoothing: antialiased;\n}\n.refino-edit *,\n.refino-edit *::before,\n.refino-edit *::after { box-sizing: border-box; }\n.refino-edit__card {\n  width: 100%;\n  /* Roughly 45 characters a line: long enough to read, short enough to scan. */\n  max-width: 26rem;\n  padding: 28px 28px 20px;\n  border: 1px solid var(--refino-line);\n  border-radius: 12px;\n  background: #ffffff;\n  box-shadow: 0 1px 2px rgba(15, 23, 42, 0.04), 0 10px 28px rgba(15, 23, 42, 0.06);\n}\n.refino-edit__eyebrow {\n  margin: 0 0 20px;\n  font-size: 13px;\n  font-weight: 700;\n  letter-spacing: 0.01em;\n  color: var(--refino-muted);\n}\n.refino-edit__title {\n  display: flex;\n  align-items: center;\n  gap: 10px;\n  margin: 0 0 8px;\n  font-size: 22px;\n  font-weight: 700;\n  line-height: 1.25;\n  letter-spacing: -0.01em;\n}\n.refino-edit__check {\n  display: inline-flex;\n  flex: none;\n  align-items: center;\n  justify-content: center;\n  width: 26px;\n  height: 26px;\n  border-radius: 999px;\n  background: var(--refino-accent-soft);\n  color: var(--refino-accent-strong);\n  font-size: 15px;\n}\n.refino-edit__body {\n  margin: 0 0 20px;\n  color: var(--refino-ink-soft);\n}\n.refino-edit__cta {\n  display: block;\n  width: 100%;\n  padding: 11px 16px;\n  border: 1px solid var(--refino-accent);\n  border-radius: 8px;\n  background: var(--refino-accent);\n  color: #ffffff;\n  font: inherit;\n  font-weight: 600;\n  text-align: center;\n  text-decoration: none;\n  cursor: pointer;\n}\n.refino-edit__cta:hover { background: var(--refino-accent-strong); border-color: var(--refino-accent-strong); }\n.refino-edit__footer {\n  display: flex;\n  flex-wrap: wrap;\n  align-items: baseline;\n  gap: 2px 10px;\n  margin-top: 20px;\n  padding-top: 16px;\n  border-top: 1px solid var(--refino-line);\n}\n.refino-edit__signout {\n  padding: 0;\n  border: 0;\n  border-radius: 4px;\n  background: none;\n  color: var(--refino-accent-strong);\n  font: inherit;\n  font-weight: 600;\n  text-decoration: underline;\n  text-underline-offset: 3px;\n  cursor: pointer;\n}\n.refino-edit__signout:hover { color: var(--refino-ink); }\n.refino-edit__hint {\n  color: var(--refino-muted);\n  font-size: 13px;\n}\n.refino-edit__cta:focus-visible,\n.refino-edit__signout:focus-visible {\n  outline: 2px solid var(--refino-accent-strong);\n  outline-offset: 2px;\n}\n@media (max-width: 420px) {\n  .refino-edit__card { padding: 22px 20px 16px; }\n  .refino-edit__title { font-size: 20px; }\n}\n`;\n\nexport default function EditPage() {\n  const [phase, setPhase] = useState<EditorPhase>({ kind: \"authorizing\" });\n\n  useEffect(() => {\n    let cancelled = false;\n    void resolveEditorPhase().then((next) => {\n      if (!cancelled) setPhase(next);\n    });\n    return () => {\n      cancelled = true;\n    };\n  }, []);\n\n  return (\n    <main className=\"refino-edit\">\n      <style>{STYLES}</style>\n      <div className=\"refino-edit__card\" aria-live=\"polite\">\n        <p className=\"refino-edit__eyebrow\">Refino</p>\n\n        {phase.kind === \"authorizing\" && (\n          <>\n            <h1 className=\"refino-edit__title\">Signing you in\u2026</h1>\n            <p className=\"refino-edit__body\">Refino is checking that you may edit this site.</p>\n          </>\n        )}\n\n        {phase.kind === \"ready\" && (\n          <>\n            <h1 className=\"refino-edit__title\">\n              <span className=\"refino-edit__check\" aria-hidden=\"true\">\u2713</span>\n              Edit mode is on\n            </h1>\n            <p className=\"refino-edit__body\">Open your site, click any text you want to change, and press Save when you are done.</p>\n            <a className=\"refino-edit__cta\" href={phase.openHref}>\n              Open the site\n            </a>\n          </>\n        )}\n\n        {phase.kind === \"error\" && (\n          <>\n            <h1 className=\"refino-edit__title\">Could not start editing</h1>\n            <p className=\"refino-edit__body\" role=\"alert\">\n              {phase.message}\n            </p>\n            <button className=\"refino-edit__cta\" type=\"button\" onClick={() => void beginAuthorization(CALLBACK_PATH)}>\n              Try again\n            </button>\n          </>\n        )}\n\n        {phase.kind !== \"authorizing\" && (\n          <p className=\"refino-edit__footer\">\n            <button className=\"refino-edit__signout\" type=\"button\" onClick={signOut}>\n              Sign out\n            </button>\n            <span className=\"refino-edit__hint\">Ends edit mode here and your Refino session.</span>\n          </p>\n        )}\n      </div>\n    </main>\n  );\n}\n";
 /** Next.js App Router route file for /edit: re-exports the generated client page. */
 export declare const EDIT_ROUTE_NEXT_HOSTED: (pageImport: string) => string;
 /** Next.js Pages Router page for /edit. */

package/dist/templates-hosted.js

@@ -12,7 +12,7 @@
 import { isInstallMethod } from "./install-method.js";
 import { TOOL_VERSION } from "./constants.js";
 import { createTemplateFactory } from "./template-file.js";
-import { COPY_EDITING_HOSTED_RC1, COPY_EDITING_HOSTED_RC4, RC1, RC4, REFINO_CLIENT_RC1, REFINO_CLIENT_RC4, REFINO_SITE_RC1 } from "./templates-legacy.js";
+import { COPY_EDITING_HOSTED_RC1, COPY_EDITING_HOSTED_RC4, EDIT_PAGE_HOSTED_RC5, RC1, RC4, RC5, REFINO_CLIENT_RC1, REFINO_CLIENT_RC4, REFINO_CLIENT_RC5, REFINO_SITE_RC1 } from "./templates-legacy.js";
 export const DEFAULT_REFINO_APP_URL = "https://app.refino.dev";
 export const REFINO_SITE_ID_PATTERN = /^site_[a-f0-9]{32}$/;
 /** Public configuration; safe to ship to the browser and to commit. */
@@ -53,7 +53,8 @@ import { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from "./refino-site";
 
 const PKCE_KEY = "refino.pkce";
 const SESSION_KEY = "refino.editor";
-const CALLBACK_PATH = "/edit";
+/** The owner's entry point, the OAuth callback, and the handoff screen: one route. */
+export const CALLBACK_PATH = "/edit";
 
 export interface EditorSession {
   readonly token: string;
@@ -106,6 +107,15 @@ function readJson<T>(key: string): T | null {
 /** Only a path on this site, never another origin. */
 export function safeReturnTo(value: string | null | undefined): string {
   if (!value || !value.startsWith("/") || value.startsWith("//") || value.startsWith("/\\\\") || value.length > 512) return "/";
+  // Browsers delete tab, newline and carriage return from a URL before they
+  // resolve it, so "/<tab>/example.test" arrives at the address bar as
+  // "//example.test": another origin, out of something that passed every
+  // test above. A control character anywhere means the value is refused,
+  // never repaired.
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code < 0x20 || code === 0x7f) return "/";
+  }
   return value;
 }
 
@@ -197,6 +207,82 @@ export async function completeAuthorization(search: string = window.location.sea
   return { ok: true, returnTo: pending.returnTo };
 }
 
+/**
+ * The three states /edit can be in. The page draws them; this module
+ * decides which one it is, so restyling the page can never change where a
+ * successful sign-in lands.
+ */
+export type EditorPhase =
+  /** Leaving for Refino, or coming back from it: the browser is navigating. */
+  | { readonly kind: "authorizing" }
+  /** The handoff: this browser holds an editor session for this site. */
+  | { readonly kind: "ready"; readonly openHref: string }
+  | { readonly kind: "error"; readonly message: string };
+
+/** Where "Open the site" goes: the page the owner asked for, or the site's home. Never /edit, never another origin. */
+function openSiteHref(params: URLSearchParams): string {
+  const requested = safeReturnTo(params.get("return_to"));
+  return requested === CALLBACK_PATH || requested.startsWith(CALLBACK_PATH + "?") ? "/" : requested;
+}
+
+let inFlight: { readonly search: string; readonly phase: Promise<EditorPhase> } | null = null;
+
+/**
+ * The one decision /edit makes, in one place and in one order:
+ *
+ *   ?code&state       finish the authorization Refino sent back
+ *   editor session    already authorized: the handoff
+ *   ?error            Refino refused; say so and offer another go
+ *   otherwise         start the authorization
+ *
+ * A successful sign-in lands here, on the handoff, and /edit is safe to
+ * revisit: it shows the same screen rather than starting anything. The one
+ * exception is deliberate and comes from the URL the owner arrived on --
+ * /edit?return_to=/pricing sends them back to /pricing when they are
+ * through, which is how the editor asks for a fresh session mid-edit.
+ * Nothing else decides the destination.
+ */
+export function resolveEditorPhase(search: string = window.location.search): Promise<EditorPhase> {
+  // One resolution per URL. React runs an effect twice in development and the
+  // authorization code is single-use, so a second call would consume nothing
+  // and report a failed sign-in that did not happen.
+  if (!inFlight || inFlight.search !== search) inFlight = { search, phase: resolvePhase(search) };
+  return inFlight.phase;
+}
+
+async function resolvePhase(search: string): Promise<EditorPhase> {
+  const params = new URLSearchParams(search);
+  if (params.has("code") || params.has("state")) {
+    const result = await completeAuthorization(search);
+    if (!result.ok) return { kind: "error", message: result.error };
+    if (result.returnTo !== CALLBACK_PATH) {
+      window.location.assign(result.returnTo);
+      return { kind: "authorizing" };
+    }
+    return { kind: "ready", openHref: openSiteHref(params) };
+  }
+  if (readEditorSession()) return { kind: "ready", openHref: openSiteHref(params) };
+  // Refino never sends a failure back to the site -- a refused authorization
+  // stays on the Refino dashboard, where it can say what to do about it -- so
+  // ?error here is somebody else's text and is not repeated back to the owner.
+  if (params.get("error")) return { kind: "error", message: "Refino did not authorize this browser to edit the site." };
+  await beginAuthorization(params.get("return_to") ?? CALLBACK_PATH);
+  return { kind: "authorizing" };
+}
+
+/**
+ * End the session, in the only order that leaves no live credential behind:
+ * this site's editor token lives in this browser and is cleared here, and
+ * the Refino account session lives in a cookie on Refino's own origin and
+ * can only be ended there -- so the browser is handed to Refino, which
+ * confirms and signs the owner out. Signing out of Refino is not signing
+ * out of GitHub, and it changes nothing about this site.
+ */
+export function signOut(): void {
+  clearEditorSession();
+  window.location.assign(\`\${REFINO_APP_URL}/signout\`);
+}
+
 /**
  * The three editor events this site reports, and the only ones it ever
  * sends. There is no analytics SDK on this site: no autocapture, no session
@@ -226,6 +312,13 @@ export function reportEditorEvent(event: EditorEventLike): void {
   if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;
   const name = event.name as ReportableEvent;
   const scope = event.properties.scope;
+  const surface = event.properties.edit_surface;
+  const payload: Record<string, string> = { event: name };
+  if (scope === "one" || scope === "all") payload.scope = scope;
+  // Which surface an edit started on: inline copy, an article's metadata, or
+  // an article's body. An enum of three, never an id and never a word of the
+  // text. Refino refuses anything it does not recognize.
+  if (typeof surface === "string") payload.surface = surface;
   try {
     void fetch(\`\${REFINO_APP_URL}/api/editor/events\`, {
       method: "POST",
@@ -233,7 +326,7 @@ export function reportEditorEvent(event: EditorEventLike): void {
       credentials: "omit",
       keepalive: true,
       headers: { "content-type": "application/json", authorization: \`Bearer \${session.token}\` },
-      body: JSON.stringify(scope === "one" || scope === "all" ? { event: name, scope } : { event: name }),
+      body: JSON.stringify(payload),
     }).catch(() => {});
   } catch {
     // Never let reporting affect editing.
@@ -316,76 +409,207 @@ export function CopyEditing({ content, children }: CopyEditingProps) {
   );
 }
 `;
-/** The /edit page: starts the flow, finishes it on return, shows state. Works as a static export. */
+/**
+ * The /edit page: the owner's entry point and, once they are through, the
+ * handoff screen. Presentation only -- every decision is in refino-client.
+ */
 export const EDIT_PAGE_HOSTED = `"use client";
 
 import { useEffect, useState } from "react";
 
-import { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from "./refino-client";
-
-type Phase = { kind: "loading" } | { kind: "signed-in" } | { kind: "error"; message: string };
+import { beginAuthorization, CALLBACK_PATH, resolveEditorPhase, signOut } from "./refino-client";
+import type { EditorPhase } from "./refino-client";
 
 /**
  * Owner entry point for Refino-hosted editing. Visiting /edit sends the
  * owner to Refino to sign in and authorize this site; Refino sends them
  * back here with a one-time code, which is exchanged for an editor session
- * and scrubbed from the URL. Restyle freely; keep the behaviour.
+ * and scrubbed from the URL. The page then stays here and says so: /edit
+ * with an editor session is the handoff, and it is safe to revisit.
+ *
+ * This file is yours. Restyle it, rewrite the markup, drop the styles below
+ * and use your own -- keep the three phases, the link to \`phase.openHref\`
+ * and the sign-out button, and the flow keeps working.
  */
+const STYLES = \`
+.refino-edit {
+  --refino-ink: #0f172a;
+  --refino-ink-soft: #334155;
+  --refino-muted: #64748b;
+  --refino-line: #e2e8f0;
+  --refino-accent: #0f766e;
+  --refino-accent-strong: #115e59;
+  --refino-accent-soft: #ccfbf1;
+  display: flex;
+  min-height: 100vh;
+  align-items: center;
+  justify-content: center;
+  margin: 0;
+  padding: 24px 16px 56px;
+  background: #f8fafc;
+  color: var(--refino-ink);
+  font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+  line-height: 1.55;
+  -webkit-font-smoothing: antialiased;
+}
+.refino-edit *,
+.refino-edit *::before,
+.refino-edit *::after { box-sizing: border-box; }
+.refino-edit__card {
+  width: 100%;
+  /* Roughly 45 characters a line: long enough to read, short enough to scan. */
+  max-width: 26rem;
+  padding: 28px 28px 20px;
+  border: 1px solid var(--refino-line);
+  border-radius: 12px;
+  background: #ffffff;
+  box-shadow: 0 1px 2px rgba(15, 23, 42, 0.04), 0 10px 28px rgba(15, 23, 42, 0.06);
+}
+.refino-edit__eyebrow {
+  margin: 0 0 20px;
+  font-size: 13px;
+  font-weight: 700;
+  letter-spacing: 0.01em;
+  color: var(--refino-muted);
+}
+.refino-edit__title {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin: 0 0 8px;
+  font-size: 22px;
+  font-weight: 700;
+  line-height: 1.25;
+  letter-spacing: -0.01em;
+}
+.refino-edit__check {
+  display: inline-flex;
+  flex: none;
+  align-items: center;
+  justify-content: center;
+  width: 26px;
+  height: 26px;
+  border-radius: 999px;
+  background: var(--refino-accent-soft);
+  color: var(--refino-accent-strong);
+  font-size: 15px;
+}
+.refino-edit__body {
+  margin: 0 0 20px;
+  color: var(--refino-ink-soft);
+}
+.refino-edit__cta {
+  display: block;
+  width: 100%;
+  padding: 11px 16px;
+  border: 1px solid var(--refino-accent);
+  border-radius: 8px;
+  background: var(--refino-accent);
+  color: #ffffff;
+  font: inherit;
+  font-weight: 600;
+  text-align: center;
+  text-decoration: none;
+  cursor: pointer;
+}
+.refino-edit__cta:hover { background: var(--refino-accent-strong); border-color: var(--refino-accent-strong); }
+.refino-edit__footer {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 2px 10px;
+  margin-top: 20px;
+  padding-top: 16px;
+  border-top: 1px solid var(--refino-line);
+}
+.refino-edit__signout {
+  padding: 0;
+  border: 0;
+  border-radius: 4px;
+  background: none;
+  color: var(--refino-accent-strong);
+  font: inherit;
+  font-weight: 600;
+  text-decoration: underline;
+  text-underline-offset: 3px;
+  cursor: pointer;
+}
+.refino-edit__signout:hover { color: var(--refino-ink); }
+.refino-edit__hint {
+  color: var(--refino-muted);
+  font-size: 13px;
+}
+.refino-edit__cta:focus-visible,
+.refino-edit__signout:focus-visible {
+  outline: 2px solid var(--refino-accent-strong);
+  outline-offset: 2px;
+}
+@media (max-width: 420px) {
+  .refino-edit__card { padding: 22px 20px 16px; }
+  .refino-edit__title { font-size: 20px; }
+}
+\`;
+
 export default function EditPage() {
-  const [phase, setPhase] = useState<Phase>({ kind: "loading" });
+  const [phase, setPhase] = useState<EditorPhase>({ kind: "authorizing" });
 
   useEffect(() => {
     let cancelled = false;
-    const params = new URLSearchParams(window.location.search);
-    if (params.has("code") || params.has("state")) {
-      void completeAuthorization().then((result) => {
-        if (cancelled) return;
-        if (result.ok) window.location.assign(result.returnTo);
-        else setPhase({ kind: "error", message: result.error });
-      });
-    } else if (readEditorSession()) {
-      setPhase({ kind: "signed-in" });
-    } else if (params.get("error")) {
-      setPhase({ kind: "error", message: params.get("error") ?? "Sign-in failed." });
-    } else {
-      void beginAuthorization(safeReturnTo(params.get("return_to")));
-    }
+    void resolveEditorPhase().then((next) => {
+      if (!cancelled) setPhase(next);
+    });
     return () => {
       cancelled = true;
     };
   }, []);
 
   return (
-    <main style={{ maxWidth: 420, margin: "10vh auto", padding: 24, fontFamily: "system-ui, sans-serif" }}>
-      {phase.kind === "loading" && <p>Signing you in with Refino…</p>}
-      {phase.kind === "signed-in" && (
-        <>
-          <h1>Edit mode is on</h1>
-          <p>Go to the site, click any text, and press Save when you are done.</p>
-          <p>
-            <a href="/">Open the site</a>
+    <main className="refino-edit">
+      <style>{STYLES}</style>
+      <div className="refino-edit__card" aria-live="polite">
+        <p className="refino-edit__eyebrow">Refino</p>
+
+        {phase.kind === "authorizing" && (
+          <>
+            <h1 className="refino-edit__title">Signing you in…</h1>
+            <p className="refino-edit__body">Refino is checking that you may edit this site.</p>
+          </>
+        )}
+
+        {phase.kind === "ready" && (
+          <>
+            <h1 className="refino-edit__title">
+              <span className="refino-edit__check" aria-hidden="true">✓</span>
+              Edit mode is on
+            </h1>
+            <p className="refino-edit__body">Open your site, click any text you want to change, and press Save when you are done.</p>
+            <a className="refino-edit__cta" href={phase.openHref}>
+              Open the site
+            </a>
+          </>
+        )}
+
+        {phase.kind === "error" && (
+          <>
+            <h1 className="refino-edit__title">Could not start editing</h1>
+            <p className="refino-edit__body" role="alert">
+              {phase.message}
+            </p>
+            <button className="refino-edit__cta" type="button" onClick={() => void beginAuthorization(CALLBACK_PATH)}>
+              Try again
+            </button>
+          </>
+        )}
+
+        {phase.kind !== "authorizing" && (
+          <p className="refino-edit__footer">
+            <button className="refino-edit__signout" type="button" onClick={signOut}>
+              Sign out
+            </button>
+            <span className="refino-edit__hint">Ends edit mode here and your Refino session.</span>
           </p>
-          <button
-            type="button"
-            onClick={() => {
-              clearEditorSession();
-              setPhase({ kind: "loading" });
-              void beginAuthorization("/");
-            }}
-          >
-            Sign in as someone else
-          </button>
-        </>
-      )}
-      {phase.kind === "error" && (
-        <>
-          <h1>Could not start editing</h1>
-          <p role="alert">{phase.message}</p>
-          <button type="button" onClick={() => void beginAuthorization("/")}>
-            Try again
-          </button>
-        </>
-      )}
+        )}
+      </div>
     </main>
   );
 }
@@ -478,6 +702,14 @@ const RC1_COPY_EDITING = { version: RC1, content: COPY_EDITING_HOSTED_RC1 };
 /** What 0.1.0-rc.2 through 0.1.0-rc.4 wrote, before the toolbar could offer integration updates. */
 const RC4_CLIENT = { version: RC4, content: REFINO_CLIENT_RC4 };
 const RC4_COPY_EDITING = { version: RC4, content: COPY_EDITING_HOSTED_RC4 };
+/**
+ * What 0.1.0-rc.5 wrote, before /edit became the canonical handoff and could
+ * sign the owner out. The page body is byte-identical in every release from
+ * rc.1 on, so this one rendering recognises every existing installation; the
+ * label only names the `from` version in upgrade reports.
+ */
+const RC5_CLIENT = { version: RC5, content: REFINO_CLIENT_RC5 };
+const RC5_EDIT_PAGE = { version: RC5, content: EDIT_PAGE_HOSTED_RC5 };
 /** Files for a Refino-connected site. No server code, no secrets, in any framework. */
 export function hostedFiles(plan, factory) {
     const refino = plan.refino;
@@ -492,9 +724,9 @@ export function hostedFiles(plan, factory) {
             hosting: analyticsHosting(plan.repository.hosting),
             packageVersion: TOOL_VERSION,
         }), { recognize: recognizeSiteModule }),
-        make.machine(`${dir}/refino-client.ts`, REFINO_CLIENT, { previous: [RC4_CLIENT, RC1_CLIENT] }),
+        make.machine(`${dir}/refino-client.ts`, REFINO_CLIENT, { previous: [RC5_CLIENT, RC4_CLIENT, RC1_CLIENT] }),
         make.machine(`${dir}/copy-editing.tsx`, COPY_EDITING_HOSTED, { previous: [RC4_COPY_EDITING, RC1_COPY_EDITING] }),
-        make.scaffold(`${dir}/edit-page.tsx`, EDIT_PAGE_HOSTED),
+        make.scaffold(`${dir}/edit-page.tsx`, EDIT_PAGE_HOSTED, { previous: [RC5_EDIT_PAGE] }),
     ];
     const editPage = plan.files.find((file) => /(^|\/)edit(\/page)?\.\w+$/.test(file.path) && !file.path.startsWith(`${dir}/`))?.path;
     if (plan.repository.router === "next-app") {

package/dist/templates-legacy.d.ts

@@ -23,13 +23,28 @@ export declare const RC1 = "0.1.0-rc.1";
  * is still harmless: it only names the `from` version in upgrade reports.
  */
 export declare const RC4 = "0.1.0-rc.4";
+/** The release that wrote the rc.5 bodies below: the published 0.1.0-rc.5. */
+export declare const RC5 = "0.1.0-rc.5";
 /** 0.1.0-rc.1 refino/refino-site.ts: the two public constants, before REFINO_INSTALL. */
 export declare const REFINO_SITE_RC1: (config: LegacySiteConfig) => string;
 /** 0.1.0-rc.1 refino/refino-client.ts: before reportEditorEvent and the install facts. */
 export declare const REFINO_CLIENT_RC1 = "/**\n * Browser-side Refino editor authorization for this site. No secrets here:\n * the site is a public client (OAuth 2.1 with PKCE). The editor token lives\n * in sessionStorage only (never localStorage, never a URL), is scoped to\n * this site, and Refino re-checks the account's entitlement on every load\n * and save. Never import this from server code.\n */\nimport { REFINO_APP_URL, REFINO_SITE_ID } from \"./refino-site\";\n\nconst PKCE_KEY = \"refino.pkce\";\nconst SESSION_KEY = \"refino.editor\";\nconst CALLBACK_PATH = \"/edit\";\n\nexport interface EditorSession {\n  readonly token: string;\n  /** Unix seconds. */\n  readonly expiresAt: number;\n  readonly siteId: string;\n}\n\ninterface PendingAuthorization {\n  readonly verifier: string;\n  readonly state: string;\n  readonly returnTo: string;\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomToken(bytes: number): string {\n  const buffer = new Uint8Array(bytes);\n  crypto.getRandomValues(buffer);\n  return base64url(buffer);\n}\n\nasync function sha256(text: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n  return base64url(new Uint8Array(digest));\n}\n\nfunction storage(): Storage | null {\n  try {\n    return typeof window === \"undefined\" ? null : window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction readJson<T>(key: string): T | null {\n  const raw = storage()?.getItem(key);\n  if (!raw) return null;\n  try {\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n/** Only a path on this site, never another origin. */\nexport function safeReturnTo(value: string | null | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\") || value.startsWith(\"/\\\\\") || value.length > 512) return \"/\";\n  return value;\n}\n\nexport function editorEndpoint(): string {\n  return `${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/copy`;\n}\n\nexport function callbackUrl(): string {\n  return `${window.location.origin}${CALLBACK_PATH}`;\n}\n\n/** The current editor session, or null when there is none or it expired. */\nexport function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {\n  const session = readJson<EditorSession>(SESSION_KEY);\n  if (!session || typeof session.token !== \"string\" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== \"number\") return null;\n  if (session.expiresAt <= nowSeconds) {\n    storage()?.removeItem(SESSION_KEY);\n    return null;\n  }\n  return session;\n}\n\nexport function clearEditorSession(): void {\n  storage()?.removeItem(SESSION_KEY);\n  storage()?.removeItem(PKCE_KEY);\n}\n\n/** Start the flow: remember the PKCE verifier and state, then go to Refino. */\nexport async function beginAuthorization(returnTo: string): Promise<void> {\n  const verifier = randomToken(32);\n  const state = randomToken(16);\n  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };\n  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));\n  const params = new URLSearchParams({\n    site_id: REFINO_SITE_ID,\n    redirect_uri: callbackUrl(),\n    code_challenge: await sha256(verifier),\n    code_challenge_method: \"S256\",\n    state,\n  });\n  window.location.assign(`${REFINO_APP_URL}/editor/authorize?${params.toString()}`);\n}\n\nexport type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };\n\n/**\n * Finish the flow on /edit?code&state: check the state, exchange the code\n * with the verifier this browser kept, store the session, and scrub the\n * code from the URL. The token is never placed in a URL.\n */\nexport async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {\n  const params = new URLSearchParams(search);\n  const code = params.get(\"code\");\n  const state = params.get(\"state\");\n  const pending = readJson<PendingAuthorization>(PKCE_KEY);\n  storage()?.removeItem(PKCE_KEY);\n  if (typeof window !== \"undefined\" && window.history.replaceState) window.history.replaceState(null, \"\", window.location.pathname);\n  if (!code || !state) return { ok: false, error: \"Refino did not return an authorization code.\" };\n  if (!pending || pending.state !== state) return { ok: false, error: \"Sign-in was interrupted (state mismatch). Start again.\" };\n\n  let response: Response;\n  try {\n    response = await fetch(`${REFINO_APP_URL}/api/editor/token`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({ grant_type: \"authorization_code\", code, code_verifier: pending.verifier, site_id: REFINO_SITE_ID, redirect_uri: callbackUrl() }),\n    });\n  } catch {\n    return { ok: false, error: \"Could not reach Refino to finish signing in.\" };\n  }\n  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;\n  if (!response.ok || !body?.ok || typeof body.token !== \"string\" || typeof body.expiresAt !== \"number\" || body.siteId !== REFINO_SITE_ID) {\n    return { ok: false, error: body?.error?.message ?? \"Refino did not accept the authorization.\" };\n  }\n  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };\n  storage()?.setItem(SESSION_KEY, JSON.stringify(session));\n  return { ok: true, returnTo: pending.returnTo };\n}\n";
 /** 0.1.0-rc.1 refino/copy-editing.tsx: before onEvent={reportEditorEvent}. */
 export declare const COPY_EDITING_HOSTED_RC1 = "\"use client\";\n\nimport type { CopyContent } from \"@getrefino/core\";\nimport { RefinoProvider } from \"@getrefino/react\";\nimport type { ReactNode } from \"react\";\nimport { useCallback, useEffect, useState } from \"react\";\n\nimport { clearEditorSession, editorEndpoint, readEditorSession } from \"./refino-client\";\nimport type { EditorSession } from \"./refino-client\";\n\ninterface CopyEditingProps {\n  content: CopyContent;\n  children: ReactNode;\n}\n\n/**\n * Hosted mode (Refino). Visitors get the plain site: the server never\n * decides edit mode, so pages can stay static. In the browser, an editor\n * session stored by /edit turns edit mode on; loads and saves go to Refino\n * with the session's bearer token, and Refino checks the site's\n * entitlement on every request.\n */\nexport function CopyEditing({ content, children }: CopyEditingProps) {\n  const [session, setSession] = useState<EditorSession | null>(null);\n\n  useEffect(() => {\n    // Read the session only after mount so server-rendered HTML never differs from the visitor's.\n    setSession(readEditorSession());\n  }, []);\n\n  // Read at request time (the provider keeps its options from the first render), so the\n  // token is always the one currently stored and never sent once the session is cleared.\n  const headers = useCallback((): Record<string, string> => {\n    const current = readEditorSession();\n    return current ? { authorization: `Bearer ${current.token}` } : {};\n  }, []);\n\n  const onExit = useCallback(async () => {\n    clearEditorSession();\n    window.location.assign(\"/\");\n  }, []);\n\n  return (\n    <RefinoProvider content={content} editing={session !== null} endpoint={editorEndpoint()} headers={headers} signInHref=\"/edit\" onExit={onExit}>\n      {children}\n    </RefinoProvider>\n  );\n}\n";
-/** 0.1.0-rc.4 refino/refino-client.ts: before refinoUpdates. */
+/** 0.1.0-rc.4 refino/refino-client.ts: before refinoUpdates, and before reportEditorEvent carried the editing surface. */
 export declare const REFINO_CLIENT_RC4 = "/**\n * Browser-side Refino editor authorization for this site. No secrets here:\n * the site is a public client (OAuth 2.1 with PKCE). The editor token lives\n * in sessionStorage only (never localStorage, never a URL), is scoped to\n * this site, and Refino re-checks the account's entitlement on every load\n * and save. Never import this from server code.\n */\nimport { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from \"./refino-site\";\n\nconst PKCE_KEY = \"refino.pkce\";\nconst SESSION_KEY = \"refino.editor\";\nconst CALLBACK_PATH = \"/edit\";\n\nexport interface EditorSession {\n  readonly token: string;\n  /** Unix seconds. */\n  readonly expiresAt: number;\n  readonly siteId: string;\n}\n\ninterface PendingAuthorization {\n  readonly verifier: string;\n  readonly state: string;\n  readonly returnTo: string;\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomToken(bytes: number): string {\n  const buffer = new Uint8Array(bytes);\n  crypto.getRandomValues(buffer);\n  return base64url(buffer);\n}\n\nasync function sha256(text: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n  return base64url(new Uint8Array(digest));\n}\n\nfunction storage(): Storage | null {\n  try {\n    return typeof window === \"undefined\" ? null : window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction readJson<T>(key: string): T | null {\n  const raw = storage()?.getItem(key);\n  if (!raw) return null;\n  try {\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n/** Only a path on this site, never another origin. */\nexport function safeReturnTo(value: string | null | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\") || value.startsWith(\"/\\\\\") || value.length > 512) return \"/\";\n  return value;\n}\n\nexport function editorEndpoint(): string {\n  return `${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/copy`;\n}\n\nexport function callbackUrl(): string {\n  return `${window.location.origin}${CALLBACK_PATH}`;\n}\n\n/** The current editor session, or null when there is none or it expired. */\nexport function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {\n  const session = readJson<EditorSession>(SESSION_KEY);\n  if (!session || typeof session.token !== \"string\" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== \"number\") return null;\n  if (session.expiresAt <= nowSeconds) {\n    storage()?.removeItem(SESSION_KEY);\n    return null;\n  }\n  return session;\n}\n\nexport function clearEditorSession(): void {\n  storage()?.removeItem(SESSION_KEY);\n  storage()?.removeItem(PKCE_KEY);\n}\n\n/** Start the flow: remember the PKCE verifier and state, then go to Refino. */\nexport async function beginAuthorization(returnTo: string): Promise<void> {\n  const verifier = randomToken(32);\n  const state = randomToken(16);\n  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };\n  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));\n  const params = new URLSearchParams({\n    site_id: REFINO_SITE_ID,\n    redirect_uri: callbackUrl(),\n    code_challenge: await sha256(verifier),\n    code_challenge_method: \"S256\",\n    state,\n  });\n  window.location.assign(`${REFINO_APP_URL}/editor/authorize?${params.toString()}`);\n}\n\nexport type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };\n\n/**\n * Finish the flow on /edit?code&state: check the state, exchange the code\n * with the verifier this browser kept, store the session, and scrub the\n * code from the URL. The token is never placed in a URL.\n */\nexport async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {\n  const params = new URLSearchParams(search);\n  const code = params.get(\"code\");\n  const state = params.get(\"state\");\n  const pending = readJson<PendingAuthorization>(PKCE_KEY);\n  storage()?.removeItem(PKCE_KEY);\n  if (typeof window !== \"undefined\" && window.history.replaceState) window.history.replaceState(null, \"\", window.location.pathname);\n  if (!code || !state) return { ok: false, error: \"Refino did not return an authorization code.\" };\n  if (!pending || pending.state !== state) return { ok: false, error: \"Sign-in was interrupted (state mismatch). Start again.\" };\n\n  let response: Response;\n  try {\n    response = await fetch(`${REFINO_APP_URL}/api/editor/token`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({\n        grant_type: \"authorization_code\",\n        code,\n        code_verifier: pending.verifier,\n        site_id: REFINO_SITE_ID,\n        redirect_uri: callbackUrl(),\n        // The public install facts from refino-site.ts, sent once per\n        // sign-in. Refino records them the first time and ignores them\n        // afterwards. Remove this line and everything still works.\n        install: REFINO_INSTALL,\n      }),\n    });\n  } catch {\n    return { ok: false, error: \"Could not reach Refino to finish signing in.\" };\n  }\n  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;\n  if (!response.ok || !body?.ok || typeof body.token !== \"string\" || typeof body.expiresAt !== \"number\" || body.siteId !== REFINO_SITE_ID) {\n    return { ok: false, error: body?.error?.message ?? \"Refino did not accept the authorization.\" };\n  }\n  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };\n  storage()?.setItem(SESSION_KEY, JSON.stringify(session));\n  return { ok: true, returnTo: pending.returnTo };\n}\n\n/**\n * The three editor events this site reports, and the only ones it ever\n * sends. There is no analytics SDK on this site: no autocapture, no session\n * recording, no third-party script, no cookie. Each event is one small POST\n * to Refino carrying an event name and, for a revert, whether it was one\n * word or all of them \u2014 never your page, your copy, your visitors or your\n * repository. `edit_saved` is not in this list on purpose: a save is a\n * commit, and Refino records that on its own side where it cannot be faked\n * or lost.\n */\nconst REPORTABLE_EVENTS = [\"editor_opened\", \"edit_started\", \"edit_reverted\"] as const;\n\ntype ReportableEvent = (typeof REPORTABLE_EVENTS)[number];\n\ninterface EditorEventLike {\n  readonly name: string;\n  readonly properties: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Fire and forget. A failure here is invisible and harmless: nothing in the\n * editor waits for it, retries it, or behaves differently when it fails.\n */\nexport function reportEditorEvent(event: EditorEventLike): void {\n  const session = readEditorSession();\n  if (!session) return;\n  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;\n  const name = event.name as ReportableEvent;\n  const scope = event.properties.scope;\n  try {\n    void fetch(`${REFINO_APP_URL}/api/editor/events`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      keepalive: true,\n      headers: { \"content-type\": \"application/json\", authorization: `Bearer ${session.token}` },\n      body: JSON.stringify(scope === \"one\" || scope === \"all\" ? { event: name, scope } : { event: name }),\n    }).catch(() => {});\n  } catch {\n    // Never let reporting affect editing.\n  }\n}\n";
 /** 0.1.0-rc.4 refino/copy-editing.tsx: before updates={refinoUpdates}. */
 export declare const COPY_EDITING_HOSTED_RC4 = "\"use client\";\n\nimport type { CopyContent } from \"@getrefino/core\";\nimport { RefinoProvider } from \"@getrefino/react\";\nimport type { ReactNode } from \"react\";\nimport { useCallback, useEffect, useState } from \"react\";\n\nimport { clearEditorSession, editorEndpoint, readEditorSession, reportEditorEvent } from \"./refino-client\";\nimport type { EditorSession } from \"./refino-client\";\n\ninterface CopyEditingProps {\n  content: CopyContent;\n  children: ReactNode;\n}\n\n/**\n * Hosted mode (Refino). Visitors get the plain site: the server never\n * decides edit mode, so pages can stay static. In the browser, an editor\n * session stored by /edit turns edit mode on; loads and saves go to Refino\n * with the session's bearer token, and Refino checks the site's\n * entitlement on every request.\n */\nexport function CopyEditing({ content, children }: CopyEditingProps) {\n  const [session, setSession] = useState<EditorSession | null>(null);\n\n  useEffect(() => {\n    // Read the session only after mount so server-rendered HTML never differs from the visitor's.\n    setSession(readEditorSession());\n  }, []);\n\n  // Read at request time (the provider keeps its options from the first render), so the\n  // token is always the one currently stored and never sent once the session is cleared.\n  const headers = useCallback((): Record<string, string> => {\n    const current = readEditorSession();\n    return current ? { authorization: `Bearer ${current.token}` } : {};\n  }, []);\n\n  const onExit = useCallback(async () => {\n    clearEditorSession();\n    window.location.assign(\"/\");\n  }, []);\n\n  return (\n    <RefinoProvider content={content} editing={session !== null} endpoint={editorEndpoint()} headers={headers} signInHref=\"/edit\" onExit={onExit} onEvent={reportEditorEvent}>\n      {children}\n    </RefinoProvider>\n  );\n}\n";
+/**
+ * 0.1.0-rc.5 refino/refino-client.ts: before `resolveEditorPhase`, `signOut`
+ * and the hardened `safeReturnTo`. This is what every rc.5 site has on disk.
+ */
+export declare const REFINO_CLIENT_RC5 = "/**\n * Browser-side Refino editor authorization for this site. No secrets here:\n * the site is a public client (OAuth 2.1 with PKCE). The editor token lives\n * in sessionStorage only (never localStorage, never a URL), is scoped to\n * this site, and Refino re-checks the account's entitlement on every load\n * and save. Never import this from server code.\n */\nimport { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from \"./refino-site\";\n\nconst PKCE_KEY = \"refino.pkce\";\nconst SESSION_KEY = \"refino.editor\";\nconst CALLBACK_PATH = \"/edit\";\n\nexport interface EditorSession {\n  readonly token: string;\n  /** Unix seconds. */\n  readonly expiresAt: number;\n  readonly siteId: string;\n}\n\ninterface PendingAuthorization {\n  readonly verifier: string;\n  readonly state: string;\n  readonly returnTo: string;\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction randomToken(bytes: number): string {\n  const buffer = new Uint8Array(bytes);\n  crypto.getRandomValues(buffer);\n  return base64url(buffer);\n}\n\nasync function sha256(text: string): Promise<string> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(text));\n  return base64url(new Uint8Array(digest));\n}\n\nfunction storage(): Storage | null {\n  try {\n    return typeof window === \"undefined\" ? null : window.sessionStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction readJson<T>(key: string): T | null {\n  const raw = storage()?.getItem(key);\n  if (!raw) return null;\n  try {\n    return JSON.parse(raw) as T;\n  } catch {\n    return null;\n  }\n}\n\n/** Only a path on this site, never another origin. */\nexport function safeReturnTo(value: string | null | undefined): string {\n  if (!value || !value.startsWith(\"/\") || value.startsWith(\"//\") || value.startsWith(\"/\\\\\") || value.length > 512) return \"/\";\n  return value;\n}\n\nexport function editorEndpoint(): string {\n  return `${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/copy`;\n}\n\nexport function callbackUrl(): string {\n  return `${window.location.origin}${CALLBACK_PATH}`;\n}\n\n/** The current editor session, or null when there is none or it expired. */\nexport function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {\n  const session = readJson<EditorSession>(SESSION_KEY);\n  if (!session || typeof session.token !== \"string\" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== \"number\") return null;\n  if (session.expiresAt <= nowSeconds) {\n    storage()?.removeItem(SESSION_KEY);\n    return null;\n  }\n  return session;\n}\n\nexport function clearEditorSession(): void {\n  storage()?.removeItem(SESSION_KEY);\n  storage()?.removeItem(PKCE_KEY);\n}\n\n/** Start the flow: remember the PKCE verifier and state, then go to Refino. */\nexport async function beginAuthorization(returnTo: string): Promise<void> {\n  const verifier = randomToken(32);\n  const state = randomToken(16);\n  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };\n  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));\n  const params = new URLSearchParams({\n    site_id: REFINO_SITE_ID,\n    redirect_uri: callbackUrl(),\n    code_challenge: await sha256(verifier),\n    code_challenge_method: \"S256\",\n    state,\n  });\n  window.location.assign(`${REFINO_APP_URL}/editor/authorize?${params.toString()}`);\n}\n\nexport type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };\n\n/**\n * Finish the flow on /edit?code&state: check the state, exchange the code\n * with the verifier this browser kept, store the session, and scrub the\n * code from the URL. The token is never placed in a URL.\n */\nexport async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {\n  const params = new URLSearchParams(search);\n  const code = params.get(\"code\");\n  const state = params.get(\"state\");\n  const pending = readJson<PendingAuthorization>(PKCE_KEY);\n  storage()?.removeItem(PKCE_KEY);\n  if (typeof window !== \"undefined\" && window.history.replaceState) window.history.replaceState(null, \"\", window.location.pathname);\n  if (!code || !state) return { ok: false, error: \"Refino did not return an authorization code.\" };\n  if (!pending || pending.state !== state) return { ok: false, error: \"Sign-in was interrupted (state mismatch). Start again.\" };\n\n  let response: Response;\n  try {\n    response = await fetch(`${REFINO_APP_URL}/api/editor/token`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      headers: { \"content-type\": \"application/json\", accept: \"application/json\" },\n      body: JSON.stringify({\n        grant_type: \"authorization_code\",\n        code,\n        code_verifier: pending.verifier,\n        site_id: REFINO_SITE_ID,\n        redirect_uri: callbackUrl(),\n        // The public install facts from refino-site.ts, sent once per\n        // sign-in. Refino records them the first time and ignores them\n        // afterwards. Remove this line and everything still works.\n        install: REFINO_INSTALL,\n      }),\n    });\n  } catch {\n    return { ok: false, error: \"Could not reach Refino to finish signing in.\" };\n  }\n  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;\n  if (!response.ok || !body?.ok || typeof body.token !== \"string\" || typeof body.expiresAt !== \"number\" || body.siteId !== REFINO_SITE_ID) {\n    return { ok: false, error: body?.error?.message ?? \"Refino did not accept the authorization.\" };\n  }\n  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };\n  storage()?.setItem(SESSION_KEY, JSON.stringify(session));\n  return { ok: true, returnTo: pending.returnTo };\n}\n\n/**\n * The three editor events this site reports, and the only ones it ever\n * sends. There is no analytics SDK on this site: no autocapture, no session\n * recording, no third-party script, no cookie. Each event is one small POST\n * to Refino carrying an event name and, for a revert, whether it was one\n * word or all of them \u2014 never your page, your copy, your visitors or your\n * repository. `edit_saved` is not in this list on purpose: a save is a\n * commit, and Refino records that on its own side where it cannot be faked\n * or lost.\n */\nconst REPORTABLE_EVENTS = [\"editor_opened\", \"edit_started\", \"edit_reverted\"] as const;\n\ntype ReportableEvent = (typeof REPORTABLE_EVENTS)[number];\n\ninterface EditorEventLike {\n  readonly name: string;\n  readonly properties: Readonly<Record<string, unknown>>;\n}\n\n/**\n * Fire and forget. A failure here is invisible and harmless: nothing in the\n * editor waits for it, retries it, or behaves differently when it fails.\n */\nexport function reportEditorEvent(event: EditorEventLike): void {\n  const session = readEditorSession();\n  if (!session) return;\n  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;\n  const name = event.name as ReportableEvent;\n  const scope = event.properties.scope;\n  try {\n    void fetch(`${REFINO_APP_URL}/api/editor/events`, {\n      method: \"POST\",\n      mode: \"cors\",\n      credentials: \"omit\",\n      keepalive: true,\n      headers: { \"content-type\": \"application/json\", authorization: `Bearer ${session.token}` },\n      body: JSON.stringify(scope === \"one\" || scope === \"all\" ? { event: name, scope } : { event: name }),\n    }).catch(() => {});\n  } catch {\n    // Never let reporting affect editing.\n  }\n}\n\n/**\n * Updates to this site's Refino integration, offered in the editor\n * toolbar. Asking is read-only. Nothing changes unless the owner presses\n * \"Update Refino\": Refino then commits the new Refino version to this\n * repository, and the site's normal deployment takes it from there. The\n * editor checks every answer itself, so this stays a plain pipe.\n */\nexport const refinoUpdates = {\n  check: (): Promise<unknown> => updateRequest(\"GET\"),\n  apply: (version: string): Promise<unknown> => updateRequest(\"POST\", JSON.stringify({ version })),\n};\n\nasync function updateRequest(method: \"GET\" | \"POST\", body?: string): Promise<unknown> {\n  const session = readEditorSession();\n  if (!session) return null;\n  const headers: Record<string, string> = { accept: \"application/json\", authorization: `Bearer ${session.token}` };\n  if (body) headers[\"content-type\"] = \"application/json\";\n  try {\n    const response = await fetch(`${REFINO_APP_URL}/api/sites/${REFINO_SITE_ID}/update`, { method, mode: \"cors\", credentials: \"omit\", headers, body });\n    return await response.json();\n  } catch {\n    // Unreachable or unreadable: the editor treats it as \"nothing to offer\", or as an unknown outcome.\n    return null;\n  }\n}\n";
+/**
+ * refino/edit-page.tsx as every release up to and including 0.1.0-rc.5 wrote
+ * it (the body never changed after rc.1): the unstyled handoff screen, which
+ * a successful sign-in never landed on, and its "Sign in as someone else"
+ * button, which cleared the site's editor session but not the Refino one and
+ * so signed the same account straight back in.
+ */
+export declare const EDIT_PAGE_HOSTED_RC5 = "\"use client\";\n\nimport { useEffect, useState } from \"react\";\n\nimport { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from \"./refino-client\";\n\ntype Phase = { kind: \"loading\" } | { kind: \"signed-in\" } | { kind: \"error\"; message: string };\n\n/**\n * Owner entry point for Refino-hosted editing. Visiting /edit sends the\n * owner to Refino to sign in and authorize this site; Refino sends them\n * back here with a one-time code, which is exchanged for an editor session\n * and scrubbed from the URL. Restyle freely; keep the behaviour.\n */\nexport default function EditPage() {\n  const [phase, setPhase] = useState<Phase>({ kind: \"loading\" });\n\n  useEffect(() => {\n    let cancelled = false;\n    const params = new URLSearchParams(window.location.search);\n    if (params.has(\"code\") || params.has(\"state\")) {\n      void completeAuthorization().then((result) => {\n        if (cancelled) return;\n        if (result.ok) window.location.assign(result.returnTo);\n        else setPhase({ kind: \"error\", message: result.error });\n      });\n    } else if (readEditorSession()) {\n      setPhase({ kind: \"signed-in\" });\n    } else if (params.get(\"error\")) {\n      setPhase({ kind: \"error\", message: params.get(\"error\") ?? \"Sign-in failed.\" });\n    } else {\n      void beginAuthorization(safeReturnTo(params.get(\"return_to\")));\n    }\n    return () => {\n      cancelled = true;\n    };\n  }, []);\n\n  return (\n    <main style={{ maxWidth: 420, margin: \"10vh auto\", padding: 24, fontFamily: \"system-ui, sans-serif\" }}>\n      {phase.kind === \"loading\" && <p>Signing you in with Refino\u2026</p>}\n      {phase.kind === \"signed-in\" && (\n        <>\n          <h1>Edit mode is on</h1>\n          <p>Go to the site, click any text, and press Save when you are done.</p>\n          <p>\n            <a href=\"/\">Open the site</a>\n          </p>\n          <button\n            type=\"button\"\n            onClick={() => {\n              clearEditorSession();\n              setPhase({ kind: \"loading\" });\n              void beginAuthorization(\"/\");\n            }}\n          >\n            Sign in as someone else\n          </button>\n        </>\n      )}\n      {phase.kind === \"error\" && (\n        <>\n          <h1>Could not start editing</h1>\n          <p role=\"alert\">{phase.message}</p>\n          <button type=\"button\" onClick={() => void beginAuthorization(\"/\")}>\n            Try again\n          </button>\n        </>\n      )}\n    </main>\n  );\n}\n";

package/dist/templates-legacy.js

@@ -19,6 +19,8 @@ export const RC1 = "0.1.0-rc.1";
  * is still harmless: it only names the `from` version in upgrade reports.
  */
 export const RC4 = "0.1.0-rc.4";
+/** The release that wrote the rc.5 bodies below: the published 0.1.0-rc.5. */
+export const RC5 = "0.1.0-rc.5";
 /** 0.1.0-rc.1 refino/refino-site.ts: the two public constants, before REFINO_INSTALL. */
 export const REFINO_SITE_RC1 = (config) => `/**
  * Public Refino configuration for this site. Neither value is a secret:
@@ -225,7 +227,7 @@ export function CopyEditing({ content, children }: CopyEditingProps) {
   );
 }
 `;
-/** 0.1.0-rc.4 refino/refino-client.ts: before refinoUpdates. */
+/** 0.1.0-rc.4 refino/refino-client.ts: before refinoUpdates, and before reportEditorEvent carried the editing surface. */
 export const REFINO_CLIENT_RC4 = `/**
  * Browser-side Refino editor authorization for this site. No secrets here:
  * the site is a public client (OAuth 2.1 with PKCE). The editor token lives
@@ -474,3 +476,311 @@ export function CopyEditing({ content, children }: CopyEditingProps) {
   );
 }
 `;
+/**
+ * 0.1.0-rc.5 refino/refino-client.ts: before `resolveEditorPhase`, `signOut`
+ * and the hardened `safeReturnTo`. This is what every rc.5 site has on disk.
+ */
+export const REFINO_CLIENT_RC5 = `/**
+ * Browser-side Refino editor authorization for this site. No secrets here:
+ * the site is a public client (OAuth 2.1 with PKCE). The editor token lives
+ * in sessionStorage only (never localStorage, never a URL), is scoped to
+ * this site, and Refino re-checks the account's entitlement on every load
+ * and save. Never import this from server code.
+ */
+import { REFINO_APP_URL, REFINO_INSTALL, REFINO_SITE_ID } from "./refino-site";
+
+const PKCE_KEY = "refino.pkce";
+const SESSION_KEY = "refino.editor";
+const CALLBACK_PATH = "/edit";
+
+export interface EditorSession {
+  readonly token: string;
+  /** Unix seconds. */
+  readonly expiresAt: number;
+  readonly siteId: string;
+}
+
+interface PendingAuthorization {
+  readonly verifier: string;
+  readonly state: string;
+  readonly returnTo: string;
+}
+
+function base64url(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(bytes: number): string {
+  const buffer = new Uint8Array(bytes);
+  crypto.getRandomValues(buffer);
+  return base64url(buffer);
+}
+
+async function sha256(text: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+  return base64url(new Uint8Array(digest));
+}
+
+function storage(): Storage | null {
+  try {
+    return typeof window === "undefined" ? null : window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+
+function readJson<T>(key: string): T | null {
+  const raw = storage()?.getItem(key);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch {
+    return null;
+  }
+}
+
+/** Only a path on this site, never another origin. */
+export function safeReturnTo(value: string | null | undefined): string {
+  if (!value || !value.startsWith("/") || value.startsWith("//") || value.startsWith("/\\\\") || value.length > 512) return "/";
+  return value;
+}
+
+export function editorEndpoint(): string {
+  return \`\${REFINO_APP_URL}/api/sites/\${REFINO_SITE_ID}/copy\`;
+}
+
+export function callbackUrl(): string {
+  return \`\${window.location.origin}\${CALLBACK_PATH}\`;
+}
+
+/** The current editor session, or null when there is none or it expired. */
+export function readEditorSession(nowSeconds: number = Math.floor(Date.now() / 1000)): EditorSession | null {
+  const session = readJson<EditorSession>(SESSION_KEY);
+  if (!session || typeof session.token !== "string" || session.siteId !== REFINO_SITE_ID || typeof session.expiresAt !== "number") return null;
+  if (session.expiresAt <= nowSeconds) {
+    storage()?.removeItem(SESSION_KEY);
+    return null;
+  }
+  return session;
+}
+
+export function clearEditorSession(): void {
+  storage()?.removeItem(SESSION_KEY);
+  storage()?.removeItem(PKCE_KEY);
+}
+
+/** Start the flow: remember the PKCE verifier and state, then go to Refino. */
+export async function beginAuthorization(returnTo: string): Promise<void> {
+  const verifier = randomToken(32);
+  const state = randomToken(16);
+  const pending: PendingAuthorization = { verifier, state, returnTo: safeReturnTo(returnTo) };
+  storage()?.setItem(PKCE_KEY, JSON.stringify(pending));
+  const params = new URLSearchParams({
+    site_id: REFINO_SITE_ID,
+    redirect_uri: callbackUrl(),
+    code_challenge: await sha256(verifier),
+    code_challenge_method: "S256",
+    state,
+  });
+  window.location.assign(\`\${REFINO_APP_URL}/editor/authorize?\${params.toString()}\`);
+}
+
+export type AuthorizationResult = { readonly ok: true; readonly returnTo: string } | { readonly ok: false; readonly error: string };
+
+/**
+ * Finish the flow on /edit?code&state: check the state, exchange the code
+ * with the verifier this browser kept, store the session, and scrub the
+ * code from the URL. The token is never placed in a URL.
+ */
+export async function completeAuthorization(search: string = window.location.search): Promise<AuthorizationResult> {
+  const params = new URLSearchParams(search);
+  const code = params.get("code");
+  const state = params.get("state");
+  const pending = readJson<PendingAuthorization>(PKCE_KEY);
+  storage()?.removeItem(PKCE_KEY);
+  if (typeof window !== "undefined" && window.history.replaceState) window.history.replaceState(null, "", window.location.pathname);
+  if (!code || !state) return { ok: false, error: "Refino did not return an authorization code." };
+  if (!pending || pending.state !== state) return { ok: false, error: "Sign-in was interrupted (state mismatch). Start again." };
+
+  let response: Response;
+  try {
+    response = await fetch(\`\${REFINO_APP_URL}/api/editor/token\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        grant_type: "authorization_code",
+        code,
+        code_verifier: pending.verifier,
+        site_id: REFINO_SITE_ID,
+        redirect_uri: callbackUrl(),
+        // The public install facts from refino-site.ts, sent once per
+        // sign-in. Refino records them the first time and ignores them
+        // afterwards. Remove this line and everything still works.
+        install: REFINO_INSTALL,
+      }),
+    });
+  } catch {
+    return { ok: false, error: "Could not reach Refino to finish signing in." };
+  }
+  const body = (await response.json().catch(() => null)) as { ok?: boolean; token?: string; expiresAt?: number; siteId?: string; error?: { message?: string } } | null;
+  if (!response.ok || !body?.ok || typeof body.token !== "string" || typeof body.expiresAt !== "number" || body.siteId !== REFINO_SITE_ID) {
+    return { ok: false, error: body?.error?.message ?? "Refino did not accept the authorization." };
+  }
+  const session: EditorSession = { token: body.token, expiresAt: body.expiresAt, siteId: body.siteId };
+  storage()?.setItem(SESSION_KEY, JSON.stringify(session));
+  return { ok: true, returnTo: pending.returnTo };
+}
+
+/**
+ * The three editor events this site reports, and the only ones it ever
+ * sends. There is no analytics SDK on this site: no autocapture, no session
+ * recording, no third-party script, no cookie. Each event is one small POST
+ * to Refino carrying an event name and, for a revert, whether it was one
+ * word or all of them — never your page, your copy, your visitors or your
+ * repository. \`edit_saved\` is not in this list on purpose: a save is a
+ * commit, and Refino records that on its own side where it cannot be faked
+ * or lost.
+ */
+const REPORTABLE_EVENTS = ["editor_opened", "edit_started", "edit_reverted"] as const;
+
+type ReportableEvent = (typeof REPORTABLE_EVENTS)[number];
+
+interface EditorEventLike {
+  readonly name: string;
+  readonly properties: Readonly<Record<string, unknown>>;
+}
+
+/**
+ * Fire and forget. A failure here is invisible and harmless: nothing in the
+ * editor waits for it, retries it, or behaves differently when it fails.
+ */
+export function reportEditorEvent(event: EditorEventLike): void {
+  const session = readEditorSession();
+  if (!session) return;
+  if (!(REPORTABLE_EVENTS as readonly string[]).includes(event.name)) return;
+  const name = event.name as ReportableEvent;
+  const scope = event.properties.scope;
+  try {
+    void fetch(\`\${REFINO_APP_URL}/api/editor/events\`, {
+      method: "POST",
+      mode: "cors",
+      credentials: "omit",
+      keepalive: true,
+      headers: { "content-type": "application/json", authorization: \`Bearer \${session.token}\` },
+      body: JSON.stringify(scope === "one" || scope === "all" ? { event: name, scope } : { event: name }),
+    }).catch(() => {});
+  } catch {
+    // Never let reporting affect editing.
+  }
+}
+
+/**
+ * Updates to this site's Refino integration, offered in the editor
+ * toolbar. Asking is read-only. Nothing changes unless the owner presses
+ * "Update Refino": Refino then commits the new Refino version to this
+ * repository, and the site's normal deployment takes it from there. The
+ * editor checks every answer itself, so this stays a plain pipe.
+ */
+export const refinoUpdates = {
+  check: (): Promise<unknown> => updateRequest("GET"),
+  apply: (version: string): Promise<unknown> => updateRequest("POST", JSON.stringify({ version })),
+};
+
+async function updateRequest(method: "GET" | "POST", body?: string): Promise<unknown> {
+  const session = readEditorSession();
+  if (!session) return null;
+  const headers: Record<string, string> = { accept: "application/json", authorization: \`Bearer \${session.token}\` };
+  if (body) headers["content-type"] = "application/json";
+  try {
+    const response = await fetch(\`\${REFINO_APP_URL}/api/sites/\${REFINO_SITE_ID}/update\`, { method, mode: "cors", credentials: "omit", headers, body });
+    return await response.json();
+  } catch {
+    // Unreachable or unreadable: the editor treats it as "nothing to offer", or as an unknown outcome.
+    return null;
+  }
+}
+`;
+/**
+ * refino/edit-page.tsx as every release up to and including 0.1.0-rc.5 wrote
+ * it (the body never changed after rc.1): the unstyled handoff screen, which
+ * a successful sign-in never landed on, and its "Sign in as someone else"
+ * button, which cleared the site's editor session but not the Refino one and
+ * so signed the same account straight back in.
+ */
+export const EDIT_PAGE_HOSTED_RC5 = `"use client";
+
+import { useEffect, useState } from "react";
+
+import { beginAuthorization, clearEditorSession, completeAuthorization, readEditorSession, safeReturnTo } from "./refino-client";
+
+type Phase = { kind: "loading" } | { kind: "signed-in" } | { kind: "error"; message: string };
+
+/**
+ * Owner entry point for Refino-hosted editing. Visiting /edit sends the
+ * owner to Refino to sign in and authorize this site; Refino sends them
+ * back here with a one-time code, which is exchanged for an editor session
+ * and scrubbed from the URL. Restyle freely; keep the behaviour.
+ */
+export default function EditPage() {
+  const [phase, setPhase] = useState<Phase>({ kind: "loading" });
+
+  useEffect(() => {
+    let cancelled = false;
+    const params = new URLSearchParams(window.location.search);
+    if (params.has("code") || params.has("state")) {
+      void completeAuthorization().then((result) => {
+        if (cancelled) return;
+        if (result.ok) window.location.assign(result.returnTo);
+        else setPhase({ kind: "error", message: result.error });
+      });
+    } else if (readEditorSession()) {
+      setPhase({ kind: "signed-in" });
+    } else if (params.get("error")) {
+      setPhase({ kind: "error", message: params.get("error") ?? "Sign-in failed." });
+    } else {
+      void beginAuthorization(safeReturnTo(params.get("return_to")));
+    }
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+
+  return (
+    <main style={{ maxWidth: 420, margin: "10vh auto", padding: 24, fontFamily: "system-ui, sans-serif" }}>
+      {phase.kind === "loading" && <p>Signing you in with Refino…</p>}
+      {phase.kind === "signed-in" && (
+        <>
+          <h1>Edit mode is on</h1>
+          <p>Go to the site, click any text, and press Save when you are done.</p>
+          <p>
+            <a href="/">Open the site</a>
+          </p>
+          <button
+            type="button"
+            onClick={() => {
+              clearEditorSession();
+              setPhase({ kind: "loading" });
+              void beginAuthorization("/");
+            }}
+          >
+            Sign in as someone else
+          </button>
+        </>
+      )}
+      {phase.kind === "error" && (
+        <>
+          <h1>Could not start editing</h1>
+          <p role="alert">{phase.message}</p>
+          <button type="button" onClick={() => void beginAuthorization("/")}>
+            Try again
+          </button>
+        </>
+      )}
+    </main>
+  );
+}
+`;

package/dist/verify.js

@@ -6,6 +6,7 @@
 import { spawnSync } from "node:child_process";
 import { dirname, join, resolve } from "node:path";
 import { isContentId, parseCopy } from "@getrefino/core";
+import { parseContentConfig } from "@getrefino/core/documents";
 import ts from "typescript";
 import { exists, isFile, isTestOrStoryFile, readJson, readText, rel, walkFiles } from "./fs.js";
 import { COMPARISON_SUFFIX, classifyGeneratedFiles, readGeneratedManifest } from "./generated.js";
@@ -389,6 +390,35 @@ export function verifyIntegration(rootPath, options = {}) {
                 add({ id: "content-ids", status: "pass", message: "All ids are valid." });
         }
     }
+    // Content sources (article editing). Absent is the normal case and not a
+    // finding: a site that edits only copy has nothing to declare.
+    if (config?.content !== undefined) {
+        try {
+            const content = parseContentConfig(config.content);
+            const missing = content.sources.filter((source) => !exists(join(appDir, source.dir)));
+            if (content.sources.length === 0) {
+                add({ id: "content-sources", status: "warn", message: 'refino.config.json has a "content" block with no sources.', fix: 'Add a source, or remove the "content" block.' });
+            }
+            else if (missing.length > 0) {
+                add({
+                    id: "content-sources",
+                    status: "fail",
+                    message: `Content source directories do not exist: ${missing.map((source) => `${source.id} (${source.dir})`).join(", ")}.`,
+                    fix: "Point each source at the directory that actually holds the articles.",
+                });
+            }
+            else {
+                add({
+                    id: "content-sources",
+                    status: "pass",
+                    message: `Article sources: ${content.sources.map((source) => `${source.id} (${source.dir}/*${source.extensions.join(",*")})`).join(", ")}.`,
+                });
+            }
+        }
+        catch (error) {
+            add({ id: "content-sources", status: "fail", message: error.message, fix: 'Fix the "content" block, or remove it to turn article editing off.' });
+        }
+    }
     // Source scan
     const sourceFiles = walkFiles(appDir).filter((file) => !isTestOrStoryFile(rel(appDir, file)));
     const uses = collectEditableTextUses(appDir, sourceFiles);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getrefino/onboarding",
-  "version": "0.1.0-rc.5",
+  "version": "0.1.0",
   "description": "The engine behind `npx @getrefino/cli init`: deterministic repository inspection, copy discovery, migration planning, agent instructions and verification for adding Refino to an existing React site. Development tooling only; never part of a site's runtime.",
   "keywords": [
     "refino",
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "typescript": ">=5.5 <7",
-    "@getrefino/core": "0.1.0-rc.5"
+    "@getrefino/core": "0.1.0"
   },
   "devDependencies": {
     "@types/node": "22.20.2",