@materializecms/server 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Novità di Materialize
+
+Ogni versione, dalla più recente. Le novità in arrivo si scrivono sotto «Prossima versione»: `npm run bump` le assegna alla nuova versione.
+
+## Prossima versione
+
+## 0.1.0 — 2026-10-31
+
+La prima versione pubblica.
+
+- **Editor visuale**: pagine disegnate su una tela, con sezioni, colonne, testi, immagini, video, icone e forme; componenti riutilizzabili con varianti; righelli, guide, allineamenti e misure; modalità Contenuti per chi modifica solo i testi.
+- **Animazioni ed effetti**: animazioni allo scorrimento e con linee temporali, stati al passaggio del mouse, sfondi WebGL e oggetti 3D.
+- **Contenuti**: raccolte come Progetti, Diario e Team, con pagine modello; azioni rapide e selezione multipla negli elenchi e nei Media.
+- **Siti in più lingue**: traduzioni collegate tra loro, anche con l’AI, e un selettore di lingua per il sito.
+- **SEO**: titoli e descrizioni, sitemap, controlli sulla pagina e reindirizzamenti automatici quando cambia un indirizzo.
+- **Moduli di contatto** con invio delle email dal tuo server di posta.
+- **Assistente AI e server MCP**: testi, traduzioni e modifiche alle pagine chiedendole a parole.
+- **Importazione da WordPress**: pagine, articoli e immagini.
+- **Statistiche e cookie**: Google Analytics, Tag Manager, Meta Pixel, Plausible, Matomo e codice personalizzato, con il banner per il consenso.
+- **Installazione su VPS con un comando**: Node.js, HTTPS con Caddy, servizio che riparte da solo, firewall e link per finire nel browser.
+- **Immagine Docker** con `compose.yaml` pronto per l'HTTPS: il sito sta in un volume, quindi gli aggiornamenti dal pannello restano anche ricreando il container.
+- **Installazione nel browser**: controllo del server, nome e lingua del sito, account amministratore, passo per passo.
+- **Aggiornamenti con un clic** da Impostazioni → Aggiornamenti, con backup prima e ritorno automatico alla versione precedente se la nuova non parte; le correzioni possono installarsi da sole.
+- **Sicurezza**: verifica in due passaggi, pausa dopo i tentativi di accesso falliti, registro delle attività, backup giornalieri del database e dei media.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cristiano Casazza
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,15 @@
-# Temporary Holding Version
+# @materializecms/server
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Il server di Materialize: API, accessi, media, backup, aggiornamenti dal pannello e server MCP.
+
+Lo avvia il comando `materialize` (`@materializecms/cli`): di solito non serve importarlo direttamente.
+
+## Materialize
+
+CMS open source con editor visuale: le pagine si disegnano sulla tela, il sito è fatto di file statici veloci. Per un nuovo sito (serve Node 24):
+
+```bash
+npm create materialize@latest
+```
+
+Documentazione e codice: https://github.com/materializecms/materialize · Licenza MIT.

package/package.json

@@ -1,6 +1,39 @@
 {
   "name": "@materializecms/server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Il server di Materialize: API, accessi, media, backup, aggiornamenti dal pannello e server MCP.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/materializecms/materialize.git",
+    "directory": "packages/server"
+  },
+  "homepage": "https://github.com/materializecms/materialize#readme",
+  "bugs": "https://github.com/materializecms/materialize/issues",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "1.3.0",
+    "@hono/node-server": "2.1.5",
+    "@materializecms/admin": "0.1.0",
+    "@materializecms/core": "0.1.0",
+    "@materializecms/db": "0.1.0",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "hono": "4.13.14",
+    "htmlparser2": "12.0.0",
+    "nodemailer": "10.2.1",
+    "sharp": "0.35.5",
+    "zod": "4.6.7"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/admin.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from 'hono';
+/**
+ * Where previews run code the panel's policy would block (custom code, the site's own scripts):
+ * an empty page, same origin, with no policy of its own. The panel fills it: the site preview is
+ * written in, custom code goes into a sandboxed frame inside it.
+ */
+export declare const FRAME_PATH = "/admin/frame.html";
+/**
+ * Serves the built admin app from `dir`. Hashed files under assets/ are cached forever;
+ * any other path without an extension falls back to index.html (client-side routing).
+ */
+export declare function serveAdmin(c: Context, dir: string | undefined): Promise<Response>;

package/src/admin.js

@@ -0,0 +1,92 @@
+import { createHash } from 'node:crypto';
+import { readFile, stat } from 'node:fs/promises';
+import { extname, join, normalize, sep } from 'node:path';
+const TYPES = {
+    '.html': 'text/html; charset=utf-8',
+    '.js': 'text/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.ico': 'image/x-icon',
+    '.woff2': 'font/woff2',
+    '.woff': 'font/woff',
+};
+async function isFile(path) {
+    return (await stat(path).catch(() => null))?.isFile() ?? false;
+}
+/**
+ * The panel's Content Security Policy: scripts only from the panel itself (plus the small inline
+ * script that applies the theme, allowed by its hash), data sent only to this server, no plugins,
+ * and the panel cannot be framed by other sites. Styles and pictures stay open: pages on the
+ * canvas carry inline styles and images from anywhere.
+ */
+function policy(inlineScripts) {
+    const hashes = inlineScripts.map((s) => `'sha256-${createHash('sha256').update(s).digest('base64')}'`);
+    return [
+        "default-src 'self'",
+        `script-src 'self' ${hashes.join(' ')}`.trim(),
+        "style-src 'self' 'unsafe-inline'",
+        'img-src * data: blob:',
+        'media-src * data: blob:',
+        "font-src 'self' data:",
+        "connect-src 'self'",
+        "frame-src 'self' https: blob: data:",
+        "worker-src 'self' blob:",
+        "object-src 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "frame-ancestors 'self'",
+    ].join('; ');
+}
+/**
+ * Where previews run code the panel's policy would block (custom code, the site's own scripts):
+ * an empty page, same origin, with no policy of its own. The panel fills it: the site preview is
+ * written in, custom code goes into a sandboxed frame inside it.
+ */
+export const FRAME_PATH = '/admin/frame.html';
+const FRAME_HTML = '<!doctype html><html data-mz-blank style="height:100%"><meta charset="utf-8"><title></title><body style="margin:0;height:100%"></body></html>';
+let cachedIndex = null;
+async function indexOf(path) {
+    const html = await readFile(path, 'utf8');
+    if (cachedIndex?.path === path && cachedIndex.html === html)
+        return cachedIndex;
+    const inline = [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+    cachedIndex = { path, html, csp: policy(inline) };
+    return cachedIndex;
+}
+/**
+ * Serves the built admin app from `dir`. Hashed files under assets/ are cached forever;
+ * any other path without an extension falls back to index.html (client-side routing).
+ */
+export async function serveAdmin(c, dir) {
+    const index = dir ? join(dir, 'index.html') : '';
+    if (!dir || !(await isFile(index))) {
+        return c.html('<!doctype html><meta charset="utf-8"><title>Materialize</title><body style="font:15px system-ui;padding:40px">' +
+            '<h1 style="font-size:20px">Il pannello non è ancora compilato</h1>' +
+            '<p>Esegui <code>npm run build</code> nella cartella di Materialize, poi ricarica la pagina.</p>', 503);
+    }
+    if (c.req.path === FRAME_PATH)
+        return c.body(FRAME_HTML, 200, {
+            'content-type': TYPES['.html'],
+            'cache-control': 'no-cache',
+            'content-security-policy': "frame-ancestors 'self'",
+        });
+    const relative = decodeURIComponent(c.req.path.replace(/^\/admin\/?/, ''));
+    const file = normalize(join(dir, relative));
+    if (relative && relative !== 'index.html' && file.startsWith(dir + sep) && (await isFile(file))) {
+        const immutable = relative.startsWith('assets/');
+        return c.body(await readFile(file), 200, {
+            'content-type': TYPES[extname(file)] ?? 'application/octet-stream',
+            'cache-control': immutable ? 'public, max-age=31536000, immutable' : 'no-cache',
+        });
+    }
+    if (extname(relative))
+        return c.text('Not found', 404);
+    const page = await indexOf(index);
+    return c.body(page.html, 200, {
+        'content-type': TYPES['.html'],
+        'cache-control': 'no-cache',
+        'content-security-policy': page.csp,
+    });
+}

package/src/ai.d.ts

@@ -0,0 +1,72 @@
+import { type SiteTool } from './tools.ts';
+/**
+ * The AI behind the panel's assistant and text actions: Claude through Anthropic's API, or any
+ * server that speaks OpenAI's Chat Completions (OpenAI itself, Ollama, LM Studio, OpenRouter…).
+ * Saved in Impostazioni → AI e MCP; the key never goes back to the browser.
+ */
+export interface AiSettings {
+    provider: 'anthropic' | 'openai';
+    apiKey: string;
+    /** Empty: the provider's own address. For OpenAI-compatible servers, e.g. http://localhost:11434/v1. */
+    baseUrl: string;
+    /** Empty: the default (Claude Opus 5.5 for Anthropic). */
+    model: string;
+}
+export declare const EMPTY_AI: AiSettings;
+export declare const DEFAULT_CLAUDE = "claude-opus-5-5";
+/** Raised when the AI cannot answer: not set up, refused, or the provider failed. */
+export declare class AiError extends Error {
+}
+/** What the panel may know: everything but the key. */
+export declare function publicAi(s: AiSettings | null): {
+    provider: 'anthropic' | 'openai';
+    baseUrl: string;
+    model: string;
+    hasKey: boolean;
+    envKey: boolean;
+    ready: boolean;
+};
+/** Claude needs a key (saved, or ANTHROPIC_API_KEY); a compatible server needs an address and a model. */
+export declare function isReady(s: AiSettings | null): s is AiSettings;
+/** Progress of an assistant turn, sent to the panel as it happens. */
+export type AiEvent = {
+    type: 'status';
+    text: string;
+} | {
+    type: 'tool';
+    name: string;
+    title: string;
+} | {
+    type: 'text';
+    text: string;
+};
+/** One conversation, kept by the server between turns in the provider's own format. */
+export interface Conversation {
+    provider: AiSettings['provider'];
+    messages: unknown[];
+}
+/** Text in, text out: a rewrite, a translation, an alt text (with an image). */
+export declare function complete(s: AiSettings, input: {
+    system: string;
+    prompt: string;
+    image?: {
+        data: string;
+        mime: string;
+    };
+}): Promise<string>;
+/**
+ * One turn of the assistant: the person's message, then as many tool calls as the model needs
+ * (at most `maxSteps`), then its answer. The conversation keeps everything for the next turn.
+ */
+export declare function runTurn(s: AiSettings, conv: Conversation, input: {
+    system: string;
+    text: string;
+    tools: SiteTool[];
+    onEvent: (e: AiEvent) => void;
+    maxSteps?: number;
+}): Promise<string>;
+/**
+ * Translates a page's texts in batches, keeping their order: each batch goes out as a JSON list
+ * and must come back as a list of the same length. Marks like <b>, <i> and <a1> stay in place.
+ */
+export declare function translateTexts(s: AiSettings, texts: string[], from: string, to: string, onProgress?: (done: number) => void): Promise<string[]>;

package/src/ai.js

@@ -0,0 +1,262 @@
+import Anthropic from '@anthropic-ai/sdk';
+import { z } from 'zod';
+import { ToolError } from './tools.js';
+export const EMPTY_AI = { provider: 'anthropic', apiKey: '', baseUrl: '', model: '' };
+export const DEFAULT_CLAUDE = 'claude-opus-5-5';
+/** Raised when the AI cannot answer: not set up, refused, or the provider failed. */
+export class AiError extends Error {
+}
+/** What the panel may know: everything but the key. */
+export function publicAi(s) {
+    const ai = { ...EMPTY_AI, ...s };
+    const { apiKey, ...rest } = ai;
+    return { ...rest, hasKey: !!apiKey, envKey: !!process.env.ANTHROPIC_API_KEY, ready: isReady(ai) };
+}
+/** Claude needs a key (saved, or ANTHROPIC_API_KEY); a compatible server needs an address and a model. */
+export function isReady(s) {
+    if (!s)
+        return !!process.env.ANTHROPIC_API_KEY;
+    return s.provider === 'anthropic' ? !!(s.apiKey || process.env.ANTHROPIC_API_KEY) : !!(s.baseUrl && s.model);
+}
+/** Text in, text out: a rewrite, a translation, an alt text (with an image). */
+export async function complete(s, input) {
+    if (s.provider === 'openai') {
+        const content = input.image
+            ? [
+                { type: 'image_url', image_url: { url: `data:${input.image.mime};base64,${input.image.data}` } },
+                { type: 'text', text: input.prompt },
+            ]
+            : input.prompt;
+        const reply = await openaiChat(s, {
+            messages: [
+                { role: 'system', content: input.system },
+                { role: 'user', content },
+            ],
+        });
+        return (reply.content ?? '').trim();
+    }
+    const message = await claude(s, {
+        max_tokens: 8000,
+        output_config: { effort: 'low' },
+        system: input.system,
+        messages: [
+            {
+                role: 'user',
+                content: input.image
+                    ? [
+                        {
+                            type: 'image',
+                            source: { type: 'base64', media_type: input.image.mime, data: input.image.data },
+                        },
+                        { type: 'text', text: input.prompt },
+                    ]
+                    : input.prompt,
+            },
+        ],
+    });
+    return textOf(message).trim();
+}
+/**
+ * One turn of the assistant: the person's message, then as many tool calls as the model needs
+ * (at most `maxSteps`), then its answer. The conversation keeps everything for the next turn.
+ */
+export async function runTurn(s, conv, input) {
+    const byName = new Map(input.tools.map((t) => [t.name, t]));
+    const runTool = async (name, raw) => {
+        const t = byName.get(name);
+        if (!t)
+            return { text: `There is no tool "${name}"`, error: true };
+        const parsed = t.input.safeParse(raw);
+        if (!parsed.success)
+            return { text: `Invalid input: ${z.prettifyError(parsed.error)}`, error: true };
+        input.onEvent({ type: 'tool', name, title: t.title });
+        try {
+            const out = await t.run(parsed.data);
+            return { text: typeof out === 'string' ? out : JSON.stringify(out), error: false };
+        }
+        catch (error) {
+            if (!(error instanceof ToolError))
+                console.error(error);
+            return { text: error instanceof Error ? error.message : String(error), error: true };
+        }
+    };
+    const maxSteps = input.maxSteps ?? 24;
+    if (s.provider === 'openai') {
+        const tools = input.tools.map((t) => ({
+            type: 'function',
+            function: { name: t.name, description: t.description, parameters: schemaOf(t) },
+        }));
+        const messages = conv.messages;
+        messages.push({ role: 'user', content: input.text });
+        for (let step = 0; step < maxSteps; step++) {
+            const reply = await openaiChat(s, { messages: [{ role: 'system', content: input.system }, ...messages], tools });
+            messages.push(reply);
+            if (!reply.tool_calls?.length)
+                return (reply.content ?? '').trim();
+            if (reply.content?.trim())
+                input.onEvent({ type: 'status', text: reply.content.trim() });
+            for (const call of reply.tool_calls) {
+                let args;
+                try {
+                    args = JSON.parse(call.function.arguments || '{}');
+                }
+                catch {
+                    args = undefined;
+                }
+                const result = args === undefined
+                    ? { text: `INVALID_JSON: ${call.function.arguments}`, error: true }
+                    : await runTool(call.function.name, args);
+                messages.push({ role: 'tool', tool_call_id: call.id, content: result.text });
+            }
+        }
+        return 'Mi sono fermato: servivano troppi passaggi. Dimmi se continuare.';
+    }
+    const tools = input.tools.map((t) => ({
+        name: t.name,
+        description: t.description,
+        input_schema: schemaOf(t),
+    }));
+    const messages = conv.messages;
+    messages.push({ role: 'user', content: input.text });
+    for (let step = 0; step < maxSteps; step++) {
+        const message = await claude(s, {
+            max_tokens: 16000,
+            output_config: { effort: 'medium' },
+            // Progress notes between tool calls, so the panel can say what is happening.
+            ...(updatesSupported(s) ? { thinking: { type: 'adaptive', display: 'updates' } } : {}),
+            system: input.system,
+            tools,
+            messages,
+        });
+        // Kept as returned (thinking blocks included): the next request must carry them unchanged.
+        messages.push({ role: 'assistant', content: message.content });
+        for (const block of message.content)
+            if (block.type === 'thinking' && block.thinking.trim())
+                input.onEvent({ type: 'status', text: block.thinking.trim() });
+        if (message.stop_reason === 'refusal')
+            throw new AiError('La richiesta è stata rifiutata dal modello.');
+        if (message.stop_reason !== 'tool_use')
+            return textOf(message).trim();
+        const calls = message.content.filter((b) => b.type === 'tool_use');
+        const results = await Promise.all(calls.map(async (call) => {
+            const r = await runTool(call.name, call.input);
+            return { type: 'tool_result', tool_use_id: call.id, content: r.text, is_error: r.error };
+        }));
+        // All results in one message, as the API expects for parallel calls.
+        messages.push({ role: 'user', content: results });
+    }
+    return 'Mi sono fermato: servivano troppi passaggi. Dimmi se continuare.';
+}
+// ---------- Claude ----------
+/** Models that take the server-side fallback on a refusal and progress notes between tool calls. */
+const CURRENT = /^claude-(opus-5-5|opus-5|sonnet-5-5|fable-5-1)$/;
+const modelOf = (s) => s.model.trim() || DEFAULT_CLAUDE;
+const updatesSupported = (s) => /^claude-(opus-5-5|sonnet-5-5|fable-5-1|fable-5)$/.test(modelOf(s));
+async function claude(s, params) {
+    const client = new Anthropic({ apiKey: s.apiKey || undefined, baseURL: s.baseUrl || undefined });
+    const model = modelOf(s);
+    const betas = [];
+    // A declined request is retried on a suitable model by the API itself (Claude API only).
+    const fallback = CURRENT.test(model) && !s.baseUrl;
+    if (fallback)
+        betas.push('server-side-fallback-2026-07-01');
+    if ('thinking' in params && params.thinking?.display === 'updates')
+        betas.push('thinking-display-updates-2026-08-18');
+    try {
+        return await client.beta.messages.create({
+            ...params,
+            model,
+            ...(betas.length ? { betas } : {}),
+            ...(fallback ? { fallbacks: 'default' } : {}),
+        });
+    }
+    catch (error) {
+        if (error instanceof Anthropic.AuthenticationError)
+            throw new AiError('La chiave API di Anthropic non è valida.');
+        if (error instanceof Anthropic.PermissionDeniedError)
+            throw new AiError('La chiave non ha accesso a questo modello.');
+        if (error instanceof Anthropic.NotFoundError)
+            throw new AiError(`Il modello “${model}” non esiste.`);
+        if (error instanceof Anthropic.RateLimitError)
+            throw new AiError('Troppe richieste ad Anthropic: riprova tra poco.');
+        if (error instanceof Anthropic.BadRequestError)
+            throw new AiError(`Richiesta non valida: ${error.message}`);
+        if (error instanceof Anthropic.APIError)
+            throw new AiError(`Anthropic non risponde (${error.status ?? 'rete'}).`);
+        throw error;
+    }
+}
+function textOf(message) {
+    return message.content
+        .filter((b) => b.type === 'text')
+        .map((b) => b.text)
+        .join('\n');
+}
+/** A tool's input as JSON Schema, without the meta keys providers reject. */
+function schemaOf(t) {
+    const { $schema: _, ...schema } = z.toJSONSchema(t.input, { io: 'input' });
+    return schema;
+}
+async function openaiChat(s, body) {
+    const base = (s.baseUrl || 'https://api.openai.com/v1').replace(/\/+$/, '');
+    let res;
+    try {
+        res = await fetch(`${base}/chat/completions`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...(s.apiKey ? { authorization: `Bearer ${s.apiKey}` } : {}) },
+            body: JSON.stringify({ model: s.model, ...body }),
+            signal: AbortSignal.timeout(300_000),
+        });
+    }
+    catch {
+        throw new AiError(`Il server AI non risponde su ${base}.`);
+    }
+    const json = (await res.json().catch(() => null));
+    if (!res.ok)
+        throw new AiError(json?.error?.message ?? `Il server AI ha risposto ${res.status}.`);
+    const message = json?.choices?.[0]?.message;
+    if (!message)
+        throw new AiError('Il server AI ha dato una risposta vuota.');
+    return { role: 'assistant', content: message.content ?? null, tool_calls: message.tool_calls };
+}
+// ---------- translation ----------
+const languageName = (code) => {
+    try {
+        return `${new Intl.DisplayNames(['en'], { type: 'language' }).of(code) ?? code} (${code})`;
+    }
+    catch {
+        return code;
+    }
+};
+/**
+ * Translates a page's texts in batches, keeping their order: each batch goes out as a JSON list
+ * and must come back as a list of the same length. Marks like <b>, <i> and <a1> stay in place.
+ */
+export async function translateTexts(s, texts, from, to, onProgress) {
+    const system = `You translate the texts of a website from ${languageName(from)} to ${languageName(to)}. You receive a JSON array of strings and reply with a JSON array of their translations: same length, same order, nothing else (no code fences, no notes). Keep the tags <b>, </b>, <i>, </i>, <a1>, </a1> and so on around the matching words, keep line breaks, numbers, brand names, e-mail addresses and URLs. Write naturally for native readers, as a professional copywriter would, with the same tone and roughly the same length.`;
+    const out = [];
+    const BATCH = 60;
+    for (let start = 0; start < texts.length; start += BATCH) {
+        const batch = texts.slice(start, start + BATCH);
+        let result = null;
+        for (let attempt = 0; attempt < 2 && !result; attempt++) {
+            const reply = await complete(s, { system, prompt: JSON.stringify(batch) });
+            result = parseList(reply, batch.length);
+        }
+        if (!result)
+            throw new AiError('Il modello non ha restituito la traduzione completa: riprova.');
+        out.push(...result);
+        onProgress?.(out.length);
+    }
+    return out;
+}
+function parseList(reply, length) {
+    const json = reply.slice(reply.indexOf('['), reply.lastIndexOf(']') + 1);
+    try {
+        const list = JSON.parse(json);
+        if (Array.isArray(list) && list.length === length && list.every((x) => typeof x === 'string'))
+            return list;
+    }
+    catch { }
+    return null;
+}

package/src/app.d.ts

@@ -0,0 +1,33 @@
+import { type MaterializeConfig } from '@materializecms/core';
+import { type Updates } from '@materializecms/core/updates';
+import { type Database, type User } from '@materializecms/db';
+import { Hono } from 'hono';
+/** The installed version, from this package's package.json (same place in the sources and in the release). */
+export declare const VERSION: string;
+/** `viaToken`: signed in with a personal access token (an MCP client, a script) instead of the panel's cookie. */
+type Env = {
+    Variables: {
+        user: User;
+        viaToken?: boolean;
+    };
+};
+export interface ServerContext {
+    /** Returns the current config; the CLI swaps it when materialize.config.ts changes. */
+    config: () => MaterializeConfig;
+    database: Database;
+    /** Folder with the built admin app, served at /admin. */
+    adminDir?: string;
+    /** True when a site renderer answers /_materialize/preview: the admin then shows the real site on the canvas. */
+    preview?: boolean;
+    /** Called after the live content changes (publish, unpublish, delete), e.g. to rebuild the static site. */
+    onPublish?: () => void;
+    /** Updates from the panel, when whoever started the server can apply them (materialize start). */
+    updates?: Updates;
+    /**
+     * Asked by the installation in the browser before the first account exists, so whoever finds a
+     * fresh server first cannot claim it: `materialize start` prints the link that carries it.
+     */
+    setupToken?: string;
+}
+export declare function createApp(base: ServerContext): Hono<Env, import("hono/types").BlankSchema, "/">;
+export {};