@nonext/husk 0.2.3

package/dist/cli/nonext-husk.js

@@ -0,0 +1,3360 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync, mkdirSync, renameSync, writeFileSync, readdirSync, statSync } from 'fs';
+import { resolve, join, posix, dirname } from 'path';
+import { createHash } from 'crypto';
+import { pathToFileURL } from 'url';
+import { createInterface } from 'readline/promises';
+import { stdout, stdin } from 'process';
+
+// src/cli/args.ts
+var ArgumentError = class extends Error {
+  name = "ArgumentError";
+};
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+  "yes",
+  "dry-run",
+  "force",
+  "media",
+  "auth",
+  "emulators",
+  "help",
+  "version"
+]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["cwd", "project-id", "storage-bucket", "admin-route"]);
+function base() {
+  return {
+    command: "help",
+    cwd: void 0,
+    yes: false,
+    dryRun: false,
+    force: false,
+    projectId: void 0,
+    storageBucket: void 0,
+    adminRoute: void 0,
+    media: void 0,
+    auth: void 0,
+    emulators: void 0
+  };
+}
+function parseArgs(argv) {
+  const parsed = base();
+  const flags = /* @__PURE__ */ new Map();
+  let commandSeen = false;
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index] ?? "";
+    if (token === "-y") {
+      flags.set("yes", true);
+      continue;
+    }
+    if (token === "-h") {
+      flags.set("help", true);
+      continue;
+    }
+    if (!token.startsWith("--")) {
+      if (commandSeen) {
+        throw new ArgumentError(`Unexpected argument "${token}".`);
+      }
+      if (token !== "init" && token !== "doctor" && token !== "help") {
+        throw new ArgumentError(
+          `Unknown command "${token}". Expected "init", "doctor" or "help".`
+        );
+      }
+      parsed.command = token;
+      commandSeen = true;
+      continue;
+    }
+    const body = token.slice(2);
+    const equals = body.indexOf("=");
+    const name = equals === -1 ? body : body.slice(0, equals);
+    const inlineValue = equals === -1 ? void 0 : body.slice(equals + 1);
+    if (name.startsWith("no-") && BOOLEAN_FLAGS.has(name.slice(3))) {
+      if (inlineValue !== void 0) {
+        throw new ArgumentError(`--${name} takes no value.`);
+      }
+      flags.set(name.slice(3), false);
+      continue;
+    }
+    if (BOOLEAN_FLAGS.has(name)) {
+      if (inlineValue !== void 0) {
+        throw new ArgumentError(`--${name} takes no value.`);
+      }
+      flags.set(name, true);
+      continue;
+    }
+    if (VALUE_FLAGS.has(name)) {
+      const value = inlineValue ?? argv[index + 1];
+      if (value === void 0 || value.startsWith("--")) {
+        throw new ArgumentError(`--${name} needs a value.`);
+      }
+      if (inlineValue === void 0) index += 1;
+      flags.set(name, value);
+      continue;
+    }
+    throw new ArgumentError(`Unknown option "${token}".`);
+  }
+  if (flags.get("version") === true) return { ...parsed, command: "version" };
+  if (flags.get("help") === true) return { ...parsed, command: "help" };
+  return {
+    ...parsed,
+    yes: flags.get("yes") === true,
+    dryRun: flags.get("dry-run") === true,
+    force: flags.get("force") === true,
+    cwd: stringFlag(flags, "cwd"),
+    projectId: stringFlag(flags, "project-id"),
+    storageBucket: stringFlag(flags, "storage-bucket"),
+    adminRoute: stringFlag(flags, "admin-route"),
+    media: booleanFlag(flags, "media"),
+    auth: booleanFlag(flags, "auth"),
+    emulators: booleanFlag(flags, "emulators")
+  };
+}
+function stringFlag(flags, name) {
+  const value = flags.get(name);
+  return typeof value === "string" ? value : void 0;
+}
+function booleanFlag(flags, name) {
+  const value = flags.get(name);
+  return typeof value === "boolean" ? value : void 0;
+}
+var HELP = `nonext-husk - Husk, the Nonext CMS
+
+Usage
+  npx nonext-husk init [options]      scaffold Husk into this Next.js app
+  npx nonext-husk doctor [options]    check an existing Husk installation
+
+Options
+  -y, --yes                take every default and ask nothing
+      --cwd <dir>          the project directory (default: the current one)
+      --project-id <id>    the Firebase project id
+      --storage-bucket <b> the Storage bucket (default: <project-id>.firebasestorage.app)
+      --admin-route <path> where the admin mounts (default: /admin)
+      --no-media           leave out the media library
+      --no-auth            leave out the sign-in screen and the session route
+      --no-emulators       target a real Firebase project instead of the emulators
+      --dry-run            list what would be written and write nothing
+      --force              overwrite files that exist and differ
+  -h, --help               this text
+      --version            the installed @nonext/husk version
+`;
+
+// src/core/errors.ts
+var SchemaError = class extends Error {
+  name = "SchemaError";
+  constructor(message) {
+    super(message);
+  }
+};
+
+// src/core/list-view.ts
+var FILTERABLE = ["select", "boolean"];
+function sortableFieldKeys(type) {
+  const keys = /* @__PURE__ */ new Set();
+  if (type.titleField !== void 0) keys.add(type.titleField);
+  if (type.defaultSort !== void 0) keys.add(type.defaultSort.field);
+  keys.add("updatedAt");
+  return [...keys];
+}
+function isFilterableField(field) {
+  return FILTERABLE.includes(field.type);
+}
+
+// src/core/indexes.ts
+var ENTRY_COLLECTION_GROUP = "entries";
+var MAX_ENTRY_INDEXES = 200;
+function order(direction) {
+  return direction === "asc" ? "ASCENDING" : "DESCENDING";
+}
+function subsets(keys) {
+  return keys.reduce(
+    (found, key) => [...found, ...found.map((subset) => [...subset, key])],
+    [[]]
+  );
+}
+function filterableKeys(type) {
+  return Object.entries(type.fields).filter(([, field]) => field.hidden !== true && isFilterableField(field)).map(([key]) => key);
+}
+function keyOf(index) {
+  return index.fields.map((field) => `${field.fieldPath}:${field.order}`).join("|");
+}
+function requiredEntryIndexes(types) {
+  const found = /* @__PURE__ */ new Map();
+  for (const type of types) {
+    if (type.kind !== "collection") continue;
+    for (const filters of subsets(filterableKeys(type))) {
+      for (const sortField of sortableFieldKeys(type)) {
+        for (const direction of ["asc", "desc"]) {
+          for (const withStatus of [true, false]) {
+            if (!withStatus && filters.length === 0) continue;
+            if (filters.includes(sortField)) continue;
+            const index = {
+              collectionGroup: ENTRY_COLLECTION_GROUP,
+              queryScope: "COLLECTION",
+              fields: [
+                ...withStatus ? [{ fieldPath: "status", order: "ASCENDING" }] : [],
+                ...filters.map((key) => ({
+                  fieldPath: key,
+                  order: "ASCENDING"
+                })),
+                { fieldPath: sortField, order: order(direction) },
+                { fieldPath: "__name__", order: order(direction) }
+              ]
+            };
+            found.set(keyOf(index), index);
+          }
+        }
+      }
+    }
+  }
+  const indexes = [...found.values()].sort(
+    (left, right) => keyOf(left).localeCompare(keyOf(right))
+  );
+  if (indexes.length > MAX_ENTRY_INDEXES) {
+    throw new SchemaError(
+      `These content types need ${indexes.length} composite indexes on "entries", and Firestore allows ${MAX_ENTRY_INDEXES} per database. Reduce the number of filterable fields or sort fields.`
+    );
+  }
+  return indexes;
+}
+function indexCovered(file, required) {
+  return (file.indexes ?? []).some(
+    (candidate) => candidate.collectionGroup === required.collectionGroup && keyOf(candidate) === keyOf(required)
+  );
+}
+function missingEntryIndexes(file, types) {
+  return requiredEntryIndexes(types).filter((required) => !indexCovered(file, required));
+}
+var FILE_NAME = {
+  firestore: "firestore.rules",
+  storage: "storage.rules"
+};
+function createFileTemplates(directory) {
+  return {
+    read(kind) {
+      return readFileSync(join(directory, FILE_NAME[kind]), "utf8").replace(/\r\n/g, "\n");
+    }
+  };
+}
+function checksum(body) {
+  return createHash("sha256").update(body.replace(/\r\n/g, "\n")).digest("hex").slice(0, 12);
+}
+var STAMP = /husk-template:\s*(firestore|storage)\.rules@([0-9a-f]{12})/;
+function stampRules(kind, body) {
+  return `// Husk security rules, generated by nonext-husk init.
+//
+// They are the third layer of the same permission model as can() and the adapter, and they
+// are tested against the emulators in the @nonext/husk repository. Edit them if your project
+// needs more, but do not weaken them: the admin assumes they hold.
+//
+// Deploy with: npx firebase deploy --only ${kind === "firestore" ? "firestore:rules,firestore:indexes" : "storage"}
+//
+// husk-template: ${FILE_NAME[kind]}@${checksum(body)}
+
+${body.replace(/^\s+/, "")}`;
+}
+function readStamp(text) {
+  const found = STAMP.exec(text);
+  if (found === null) return null;
+  return { kind: found[1], checksum: found[2] ?? "" };
+}
+
+// src/cli/doctor.ts
+function runChecks(input) {
+  return [
+    configCheck(input),
+    versionCheck(input),
+    rulesCheck(input, "firestore", "firestore.rules"),
+    ...shouldCheckStorage(input) ? [rulesCheck(input, "storage", "storage.rules")] : [],
+    indexCoverageCheck(input),
+    firebaseWiringCheck(input),
+    environmentCheck(input),
+    ...undeployableChecks()
+  ];
+}
+function exitCode(checks) {
+  return checks.some((check) => check.status === "problem") ? 1 : 0;
+}
+function shouldCheckStorage(input) {
+  return "error" in input.config ? input.fs.exists("storage.rules") : input.config.media;
+}
+function configCheck(input) {
+  if (!input.fs.exists("cms.config.ts")) {
+    return {
+      name: "config",
+      status: "problem",
+      detail: "cms.config.ts is missing.",
+      fix: "Run `npx nonext-husk init` in this project."
+    };
+  }
+  if ("error" in input.config) {
+    return {
+      name: "config",
+      status: "problem",
+      detail: `cms.config.ts could not be read: ${input.config.error}`,
+      fix: "Check that cms.config.ts exports `huskConfig` and `codeContentTypes`."
+    };
+  }
+  return {
+    name: "config",
+    status: "ok",
+    detail: `admin at ${input.config.adminRoute}, project ${input.config.projectId}, media ${input.config.media ? "on" : "off"}, auth ${input.config.auth ? "on" : "off"}.`
+  };
+}
+function versionCheck(input) {
+  if ("error" in input.config) {
+    return {
+      name: "version skew",
+      status: "unchecked",
+      detail: "The config could not be read, so there is nothing to compare against."
+    };
+  }
+  const generated = input.config.generatedWith;
+  const installed = input.installedVersion;
+  if (generated === installed) {
+    return { name: "version skew", status: "ok", detail: `@nonext/husk ${installed}.` };
+  }
+  const breaking = breakingApart(generated, installed);
+  return {
+    name: "version skew",
+    status: breaking ? "problem" : "ok",
+    detail: `Scaffolded with ${generated}, running ${installed}.`,
+    fix: breaking ? "Read the CHANGELOG for the versions in between. Generated files under app/ and lib/husk/ may need updating by hand, and `npx nonext-husk init` will show a diff for each of them rather than overwriting your work." : "Patch releases do not change the generated files."
+  };
+}
+function breakingApart(left, right) {
+  const [leftMajor = "", leftMinor = ""] = left.split(".");
+  const [rightMajor = "", rightMinor = ""] = right.split(".");
+  if (leftMajor !== rightMajor) return true;
+  return leftMajor === "0" && leftMinor !== rightMinor;
+}
+function rulesCheck(input, kind, path) {
+  const name = `${path}`;
+  if (!input.fs.exists(path)) {
+    return {
+      name,
+      status: "problem",
+      detail: `${path} is missing, so nothing is protecting this project's data.`,
+      fix: "Run `npx nonext-husk init` to write it, then deploy it."
+    };
+  }
+  const text = input.fs.read(path);
+  const shipped = input.templates.read(kind);
+  const expected = checksum(shipped);
+  const stamp = readStamp(text);
+  if (stamp === null) {
+    return {
+      name,
+      status: "problem",
+      detail: `${path} carries no Husk stamp, so it did not come from this tool and cannot be compared with the rules the installed package expects.`,
+      fix: `Compare it with the rules in node_modules/@nonext/husk/dist/cli/templates/${path}, or let \`npx nonext-husk init --force\` replace it.`
+    };
+  }
+  if (stamp.checksum !== expected) {
+    return {
+      name,
+      status: "problem",
+      detail: `${path} was generated by an older @nonext/husk (template ${stamp.checksum}, installed ${expected}). The admin assumes the newer rules.`,
+      fix: `Run \`npx nonext-husk init --force\` to rewrite it, then \`npx firebase deploy --only ${kind === "firestore" ? "firestore:rules" : "storage"}\`.`
+    };
+  }
+  const edited = text !== stampedShape(text, shipped);
+  return {
+    name,
+    status: "ok",
+    detail: edited ? `Current template (${expected}), with local edits. Husk does not check whether those edits still satisfy the admin.` : `Current template (${expected}).`
+  };
+}
+function stampedShape(existing, shipped) {
+  const marker = existing.indexOf("rules_version");
+  return marker === -1 ? shipped : existing.slice(0, marker) + shipped.trimStart();
+}
+function indexCoverageCheck(input) {
+  const name = "index coverage";
+  if ("error" in input.contentTypes) {
+    return {
+      name,
+      status: "unchecked",
+      detail: `The content types could not be loaded: ${input.contentTypes.error}`,
+      fix: "Without them there is no way to know which composite indexes the list views need."
+    };
+  }
+  if (!input.fs.exists("firestore.indexes.json")) {
+    return {
+      name,
+      status: "problem",
+      detail: "firestore.indexes.json is missing.",
+      fix: "Run `npx nonext-husk init` to write it."
+    };
+  }
+  let file;
+  try {
+    file = JSON.parse(input.fs.read("firestore.indexes.json"));
+  } catch {
+    return {
+      name,
+      status: "problem",
+      detail: "firestore.indexes.json is not valid JSON.",
+      fix: "Fix the file, or delete it and run `npx nonext-husk init`."
+    };
+  }
+  const missing = missingEntryIndexes(file, input.contentTypes);
+  if (missing.length === 0) {
+    return {
+      name,
+      status: "ok",
+      detail: `${String((file.indexes ?? []).length)} composite index(es) cover every query the list views generate.`
+    };
+  }
+  const described = missing.slice(0, 5).map(
+    (index) => index.fields.map((field) => `${field.fieldPath} ${field.order}`).join(", ")
+  ).map((line) => `    - entries: ${line}`).join("\n");
+  return {
+    name,
+    status: "problem",
+    detail: `${String(missing.length)} composite index(es) are missing from firestore.indexes.json:
+${described}${missing.length > 5 ? `
+    - ... and ${String(missing.length - 5)} more` : ""}`,
+    fix: "Add the entries above to firestore.indexes.json, then `npx firebase deploy --only firestore:indexes`."
+  };
+}
+function firebaseWiringCheck(input) {
+  const name = "firebase.json";
+  if (!input.fs.exists("firebase.json")) {
+    return {
+      name,
+      status: "problem",
+      detail: "firebase.json is missing, so there is nothing to deploy the rules or the indexes with.",
+      fix: "Run `npx nonext-husk init`."
+    };
+  }
+  let config;
+  try {
+    config = JSON.parse(input.fs.read("firebase.json"));
+  } catch {
+    return {
+      name,
+      status: "problem",
+      detail: "firebase.json is not valid JSON.",
+      fix: "Fix the file by hand."
+    };
+  }
+  const firestore = config["firestore"];
+  const storage = config["storage"];
+  const wantsStorage = shouldCheckStorage(input);
+  const missing = [
+    firestore?.["rules"] === "firestore.rules" ? null : "firestore.rules",
+    firestore?.["indexes"] === "firestore.indexes.json" ? null : "firestore.indexes.json",
+    !wantsStorage || storage?.["rules"] === "storage.rules" ? null : "storage.rules"
+  ].filter((entry) => entry !== null);
+  return missing.length === 0 ? { name, status: "ok", detail: "Points at the rules and the index file." } : {
+    name,
+    status: "problem",
+    detail: `firebase.json does not point at ${missing.join(", ")}, so a deploy would not carry ${missing.length === 1 ? "it" : "them"}.`,
+    fix: "Add the missing entries to firebase.json."
+  };
+}
+function environmentCheck(input) {
+  const name = "environment";
+  if ("error" in input.config) {
+    return {
+      name,
+      status: "unchecked",
+      detail: "The config could not be read, so there is no way to know whether this project targets the emulators."
+    };
+  }
+  if (!input.config.emulators) {
+    return {
+      name,
+      status: "ok",
+      detail: "This project does not target the Firebase emulators."
+    };
+  }
+  if (!input.fs.exists(".env.local")) {
+    return {
+      name,
+      status: "problem",
+      detail: ".env.local is missing, so FIREBASE_AUTH_EMULATOR_HOST is not set and every admin route will redirect to sign-in.",
+      fix: "Run `npx nonext-husk init` to write it."
+    };
+  }
+  const text = input.fs.read(".env.local");
+  const missing = [
+    "FIREBASE_AUTH_EMULATOR_HOST",
+    "NEXT_PUBLIC_FIREBASE_PROJECT_ID"
+  ].filter((key) => !new RegExp(`^\\s*${key}\\s*=\\s*\\S`, "m").test(text));
+  return missing.length === 0 ? { name, status: "ok", detail: ".env.local carries the emulator environment." } : {
+    name,
+    status: "problem",
+    detail: `.env.local is missing ${missing.join(" and ")}.`,
+    fix: "Add the missing lines. Without FIREBASE_AUTH_EMULATOR_HOST the server verifier trusts nothing and the admin is unreachable."
+  };
+}
+function undeployableChecks() {
+  return [
+    {
+      name: "rules deployment",
+      status: "unchecked",
+      detail: "Whether the rules on disk are the rules Firestore and Storage are enforcing is a property of the Firebase project, not of this directory.",
+      fix: "Run `npx firebase deploy --only firestore:rules,firestore:indexes,storage` and check the console."
+    },
+    {
+      name: "stored schema versions",
+      status: "unchecked",
+      detail: "Whether stored entries carry the schemaVersion the code declares today needs a Firestore read, credentials, and the migration runner.",
+      fix: "Open the Developer area in the admin, which reads it from the project you are signed in to."
+    }
+  ];
+}
+function createNodeFs(root) {
+  const absolute = (path) => resolve(root, ...path.split("/"));
+  return {
+    exists(path) {
+      try {
+        statSync(absolute(path));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    isDirectory(path) {
+      try {
+        return statSync(absolute(path)).isDirectory();
+      } catch {
+        return false;
+      }
+    },
+    read(path) {
+      return readFileSync(absolute(path), "utf8").replace(/\r\n/g, "\n");
+    },
+    list(path) {
+      try {
+        return readdirSync(absolute(path)).sort();
+      } catch {
+        return [];
+      }
+    },
+    write(path, contents) {
+      const target = absolute(path);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, contents, "utf8");
+    },
+    move(from, to) {
+      const target = absolute(to);
+      mkdirSync(dirname(target), { recursive: true });
+      renameSync(absolute(from), target);
+    }
+  };
+}
+function importSpecifier(fromFile, toFile) {
+  const from = posix.dirname(fromFile);
+  const to = toFile.replace(/\.tsx?$/, "");
+  const relativePath = posix.relative(from, to);
+  return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
+}
+function projectJoin(...parts) {
+  return posix.join(...parts.filter((part) => part.length > 0));
+}
+async function loadHuskConfig(root) {
+  const path = join(root, "cms.config.ts");
+  if (!existsSync(path)) {
+    const reason = "cms.config.ts is not in this directory.";
+    return { config: { error: reason }, contentTypes: { error: reason } };
+  }
+  let module;
+  try {
+    module = await import(`${pathToFileURL(path).href}?at=${String(Date.now())}`);
+  } catch (thrown) {
+    const reason = describe(thrown);
+    return { config: { error: reason }, contentTypes: { error: reason } };
+  }
+  return {
+    config: summarize(module.huskConfig),
+    contentTypes: contentTypesOf(module.codeContentTypes)
+  };
+}
+function describe(thrown) {
+  const message = thrown instanceof Error ? thrown.message : String(thrown);
+  return message.includes("Unknown file extension") || message.includes("ERR_UNKNOWN_FILE_EXTENSION") ? `this Node cannot import a TypeScript file (${process.version}). Node 22.18 or newer erases types on import; below that, run doctor with --experimental-strip-types.` : message;
+}
+function summarize(value) {
+  if (value === null || typeof value !== "object") {
+    return { error: "cms.config.ts does not export `huskConfig`." };
+  }
+  const record = value;
+  const strings = ["generatedWith", "adminRoute", "projectId"];
+  const booleans = ["media", "auth", "emulators"];
+  for (const key of strings) {
+    if (typeof record[key] !== "string") {
+      return { error: `huskConfig.${key} is missing or is not a string.` };
+    }
+  }
+  for (const key of booleans) {
+    if (typeof record[key] !== "boolean") {
+      return { error: `huskConfig.${key} is missing or is not a boolean.` };
+    }
+  }
+  return {
+    generatedWith: record["generatedWith"],
+    adminRoute: record["adminRoute"],
+    projectId: record["projectId"],
+    media: record["media"],
+    auth: record["auth"],
+    emulators: record["emulators"]
+  };
+}
+function contentTypesOf(value) {
+  if (!Array.isArray(value)) {
+    return { error: "cms.config.ts does not export a `codeContentTypes` array." };
+  }
+  const invalid = value.filter(
+    (entry) => entry === null || typeof entry !== "object" || typeof entry.slug !== "string" || typeof entry.fields !== "object"
+  );
+  if (invalid.length > 0) {
+    return { error: "codeContentTypes holds something that is not a content type." };
+  }
+  return value;
+}
+function installedVersion(root, fallback) {
+  const manifest = join(root, "node_modules", "@nonext", "cms", "package.json");
+  try {
+    const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+    return typeof parsed.version === "string" ? parsed.version : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+// src/cli/options.ts
+var DEFAULT_ADMIN_ROUTE = "/admin";
+var RESERVED_SEGMENTS = /* @__PURE__ */ new Set(["api", "_next", "favicon.ico"]);
+function normalizeAdminRoute(input) {
+  const trimmed = input.trim();
+  const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+  const withoutTrailing = withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+  if (withoutTrailing === "/") {
+    throw new ArgumentError(
+      'The admin route cannot be "/". The website lives there; pick something like "/admin".'
+    );
+  }
+  if (!/^(\/[a-z0-9][a-z0-9-]*)+$/.test(withoutTrailing)) {
+    throw new ArgumentError(
+      `"${input}" is not a usable admin route. Use lower-case segments of letters, digits and hyphens, for example "/admin" or "/studio/cms".`
+    );
+  }
+  for (const segment of withoutTrailing.slice(1).split("/")) {
+    if (RESERVED_SEGMENTS.has(segment)) {
+      throw new ArgumentError(
+        `"${segment}" is a reserved route segment in a Next app. Pick another admin route.`
+      );
+    }
+  }
+  return withoutTrailing;
+}
+function validateProjectId(input) {
+  const trimmed = input.trim();
+  if (!/^[a-z][a-z0-9-]{3,29}$/.test(trimmed)) {
+    throw new ArgumentError(
+      `"${input}" is not a Firebase project id. Ids are 4 to 30 characters, start with a letter, and contain lower-case letters, digits and hyphens.`
+    );
+  }
+  return trimmed;
+}
+function validateStorageBucket(input) {
+  const trimmed = input.trim();
+  if (!/^[a-z0-9][a-z0-9._-]{2,221}$/.test(trimmed)) {
+    throw new ArgumentError(`"${input}" is not a Storage bucket name.`);
+  }
+  return trimmed;
+}
+function defaultStorageBucket(projectId) {
+  return `${projectId}.firebasestorage.app`;
+}
+function optionsFromArgs(args) {
+  const projectId = validateProjectId(args.projectId ?? "husk-dev-project");
+  return {
+    projectId,
+    storageBucket: args.storageBucket === void 0 ? defaultStorageBucket(projectId) : validateStorageBucket(args.storageBucket),
+    adminRoute: normalizeAdminRoute(args.adminRoute ?? DEFAULT_ADMIN_ROUTE),
+    media: args.media ?? true,
+    auth: args.auth ?? true,
+    emulators: args.emulators ?? true
+  };
+}
+function adminSegments(adminRoute) {
+  return adminRoute.slice(1).split("/");
+}
+
+// src/cli/generate/context.ts
+function createContext(options, project, version) {
+  const huskDir = projectJoin(project.appDir, "(husk)");
+  const adminDir = projectJoin(huskDir, ...adminSegments(options.adminRoute));
+  return {
+    options,
+    project,
+    huskDir,
+    adminDir,
+    shellDir: projectJoin(adminDir, "(shell)"),
+    siteDir: projectJoin(project.appDir, "(site)"),
+    libDir: projectJoin(project.libDir, "husk"),
+    version
+  };
+}
+function specifier(fromFile, toFile) {
+  return importSpecifier(fromFile, toFile);
+}
+
+// src/cli/generate/admin-files.ts
+function adminFiles(context) {
+  const { huskDir, shellDir, adminDir, project, options } = context;
+  const notFound = projectJoin(huskDir, "admin-not-found.tsx");
+  const routeError = projectJoin(huskDir, "admin-route-error.tsx");
+  const chrome = projectJoin(huskDir, "admin-chrome.tsx");
+  const provider = projectJoin(huskDir, "husk-provider.tsx");
+  const shell = projectJoin(huskDir, "live-admin-shell.tsx");
+  const session = projectJoin(context.libDir, "session.ts");
+  const metadata = projectJoin(context.libDir, "admin-metadata.ts");
+  const firebaseClient = projectJoin(context.libDir, "firebase-client.ts");
+  const config = "cms.config.ts";
+  const contentDir = projectJoin(shellDir, "content", "[type]");
+  const contentRoute = projectJoin(contentDir, "content-route.tsx");
+  const files = {
+    [projectJoin(huskDir, "layout.tsx")]: adminRootLayout(),
+    [notFound]: adminNotFound(options.adminRoute),
+    [routeError]: adminRouteErrorBody(options.adminRoute),
+    [provider]: huskProvider(context, {
+      config: specifier(provider, config),
+      firebaseClient: specifier(provider, firebaseClient)
+    }),
+    [shell]: liveAdminShell(specifier(shell, provider)),
+    [chrome]: adminChrome(context, {
+      provider: specifier(chrome, provider),
+      shell: specifier(chrome, shell),
+      accountMenu: specifier(chrome, projectJoin(shellDir, "account-menu.tsx")),
+      navigationGuard: specifier(chrome, projectJoin(shellDir, "navigation-guard.tsx"))
+    }),
+    [projectJoin(huskDir, "error.tsx")]: boundary(
+      specifier(projectJoin(huskDir, "error.tsx"), routeError),
+      "Admin",
+      "The boundary above the shell layout. A segment's own error.tsx does not catch a throw\n * in that segment's layout, and the shell layout is where the session is read."
+    ),
+    [projectJoin(huskDir, "not-found.tsx")]: huskNotFound(context, {
+      session: specifier(projectJoin(huskDir, "not-found.tsx"), session),
+      chrome: specifier(projectJoin(huskDir, "not-found.tsx"), chrome),
+      notFound: specifier(projectJoin(huskDir, "not-found.tsx"), notFound)
+    }),
+    [projectJoin(shellDir, "layout.tsx")]: shellLayout(context, {
+      session: specifier(projectJoin(shellDir, "layout.tsx"), session),
+      chrome: specifier(projectJoin(shellDir, "layout.tsx"), chrome)
+    }),
+    [projectJoin(shellDir, "page.tsx")]: dashboardPage(context, {
+      session: specifier(projectJoin(shellDir, "page.tsx"), session),
+      metadata: specifier(projectJoin(shellDir, "page.tsx"), metadata),
+      panel: specifier(
+        projectJoin(shellDir, "page.tsx"),
+        projectJoin(shellDir, "dashboard-panel.tsx")
+      )
+    }),
+    [projectJoin(shellDir, "dashboard-panel.tsx")]: dashboardPanel(
+      specifier(projectJoin(shellDir, "dashboard-panel.tsx"), provider)
+    ),
+    [projectJoin(shellDir, "account-menu.tsx")]: accountMenu(
+      context,
+      specifier(projectJoin(shellDir, "account-menu.tsx"), firebaseClient)
+    ),
+    [projectJoin(shellDir, "navigation-guard.tsx")]: navigationGuard(),
+    [projectJoin(shellDir, "error.tsx")]: boundary(
+      specifier(projectJoin(shellDir, "error.tsx"), routeError),
+      "Admin",
+      "The boundary for every route under the shell that has no closer one. It renders inside\n * the shell layout, so the sidebar survives the failure and the reader still has somewhere\n * to go."
+    ),
+    [projectJoin(shellDir, "[...missing]", "page.tsx")]: catchAll(
+      specifier(projectJoin(shellDir, "[...missing]", "page.tsx"), notFound)
+    ),
+    [projectJoin(contentDir, "page.tsx")]: contentListPage(context, {
+      session: specifier(projectJoin(contentDir, "page.tsx"), session),
+      metadata: specifier(projectJoin(contentDir, "page.tsx"), metadata),
+      route: specifier(projectJoin(contentDir, "page.tsx"), contentRoute)
+    }),
+    [contentRoute]: contentRouteFile(context, {
+      notFound: specifier(contentRoute, notFound),
+      provider: specifier(contentRoute, provider),
+      collection: specifier(
+        contentRoute,
+        projectJoin(contentDir, "collection-panel.tsx")
+      ),
+      entry: specifier(contentRoute, projectJoin(contentDir, "entry-panel.tsx"))
+    }),
+    [projectJoin(contentDir, "collection-panel.tsx")]: collectionPanel(
+      context,
+      specifier(projectJoin(contentDir, "collection-panel.tsx"), provider)
+    ),
+    [projectJoin(contentDir, "entry-panel.tsx")]: entryPanel(context, {
+      provider: specifier(projectJoin(contentDir, "entry-panel.tsx"), provider),
+      firebaseClient: specifier(
+        projectJoin(contentDir, "entry-panel.tsx"),
+        firebaseClient
+      )
+    }),
+    [projectJoin(contentDir, "error.tsx")]: boundary(
+      specifier(projectJoin(contentDir, "error.tsx"), routeError),
+      "Content",
+      "The boundary for one content type's list and entry screens. A throw here takes down the\n * content area and nothing else."
+    ),
+    [projectJoin(contentDir, "new", "page.tsx")]: contentCreatePage(context, {
+      session: specifier(projectJoin(contentDir, "new", "page.tsx"), session),
+      metadata: specifier(projectJoin(contentDir, "new", "page.tsx"), metadata),
+      route: specifier(projectJoin(contentDir, "new", "page.tsx"), contentRoute)
+    }),
+    [projectJoin(contentDir, "[entry]", "page.tsx")]: contentEditPage(context, {
+      session: specifier(projectJoin(contentDir, "[entry]", "page.tsx"), session),
+      metadata: specifier(projectJoin(contentDir, "[entry]", "page.tsx"), metadata),
+      route: specifier(projectJoin(contentDir, "[entry]", "page.tsx"), contentRoute)
+    }),
+    [projectJoin(shellDir, "developer", "[[...section]]", "page.tsx")]: developerPage(
+      context,
+      {
+        session: specifier(
+          projectJoin(shellDir, "developer", "[[...section]]", "page.tsx"),
+          session
+        ),
+        metadata: specifier(
+          projectJoin(shellDir, "developer", "[[...section]]", "page.tsx"),
+          metadata
+        ),
+        config: specifier(
+          projectJoin(shellDir, "developer", "[[...section]]", "page.tsx"),
+          config
+        )
+      }
+    ),
+    [projectJoin(shellDir, "developer", "error.tsx")]: boundary(
+      specifier(projectJoin(shellDir, "developer", "error.tsx"), routeError),
+      "Developer",
+      "The boundary for the Developer area, including the Schema Builder. A malformed stored\n * content type throws while it renders, and that must not take down the one route that\n * would let an admin fix it."
+    ),
+    [projectJoin(shellDir, "developer", "content-types", "page.tsx")]: contentTypesPage(
+      context,
+      {
+        session: specifier(
+          projectJoin(shellDir, "developer", "content-types", "page.tsx"),
+          session
+        ),
+        metadata: specifier(
+          projectJoin(shellDir, "developer", "content-types", "page.tsx"),
+          metadata
+        ),
+        panel: specifier(
+          projectJoin(shellDir, "developer", "content-types", "page.tsx"),
+          projectJoin(shellDir, "developer", "content-types", "content-types-panel.tsx")
+        )
+      }
+    ),
+    [projectJoin(shellDir, "developer", "content-types", "content-types-panel.tsx")]: contentTypesPanel(
+      context,
+      specifier(
+        projectJoin(shellDir, "developer", "content-types", "content-types-panel.tsx"),
+        provider
+      )
+    ),
+    [projectJoin(shellDir, "developer", "content-types", "[slug]", "page.tsx")]: contentTypePage(context, {
+      session: specifier(
+        projectJoin(shellDir, "developer", "content-types", "[slug]", "page.tsx"),
+        session
+      ),
+      metadata: specifier(
+        projectJoin(shellDir, "developer", "content-types", "[slug]", "page.tsx"),
+        metadata
+      ),
+      panel: specifier(
+        projectJoin(shellDir, "developer", "content-types", "[slug]", "page.tsx"),
+        projectJoin(
+          shellDir,
+          "developer",
+          "content-types",
+          "[slug]",
+          "content-type-panel.tsx"
+        )
+      )
+    }),
+    [projectJoin(
+      shellDir,
+      "developer",
+      "content-types",
+      "[slug]",
+      "content-type-panel.tsx"
+    )]: contentTypePanel(context, {
+      provider: specifier(
+        projectJoin(
+          shellDir,
+          "developer",
+          "content-types",
+          "[slug]",
+          "content-type-panel.tsx"
+        ),
+        provider
+      ),
+      notFound: specifier(
+        projectJoin(
+          shellDir,
+          "developer",
+          "content-types",
+          "[slug]",
+          "content-type-panel.tsx"
+        ),
+        notFound
+      )
+    }),
+    [projectJoin(project.appDir, "global-error.tsx")]: globalError()
+  };
+  if (options.media) {
+    const mediaDir = projectJoin(shellDir, "media");
+    files[projectJoin(mediaDir, "page.tsx")] = mediaPage(context, {
+      session: specifier(projectJoin(mediaDir, "page.tsx"), session),
+      metadata: specifier(projectJoin(mediaDir, "page.tsx"), metadata),
+      panel: specifier(
+        projectJoin(mediaDir, "page.tsx"),
+        projectJoin(mediaDir, "media-panel.tsx")
+      )
+    });
+    files[projectJoin(mediaDir, "media-panel.tsx")] = mediaPanel(
+      specifier(projectJoin(mediaDir, "media-panel.tsx"), provider)
+    );
+    files[projectJoin(mediaDir, "error.tsx")] = boundary(
+      specifier(projectJoin(mediaDir, "error.tsx"), routeError),
+      "Media",
+      "The boundary for the media library. Uploads and Storage reads fail in ways entry screens\n * do not, and a failed thumbnail scan must not blank the rest of the admin."
+    );
+  }
+  if (options.auth) {
+    const loginDir = projectJoin(adminDir, "login");
+    files[projectJoin(loginDir, "page.tsx")] = loginPage(
+      specifier(
+        projectJoin(loginDir, "page.tsx"),
+        projectJoin(loginDir, "login-panel.tsx")
+      )
+    );
+    files[projectJoin(loginDir, "login-panel.tsx")] = loginPanel(
+      context,
+      specifier(projectJoin(loginDir, "login-panel.tsx"), firebaseClient)
+    );
+    files[projectJoin(loginDir, "error.tsx")] = boundary(
+      specifier(projectJoin(loginDir, "error.tsx"), routeError),
+      "Sign in",
+      "The boundary for the sign-in screen. It sits outside the shell, so it has no sidebar to\n * fall back on and the link back to the admin is the only way out."
+    );
+    files[projectJoin(project.appDir, "api", "husk", "session", "route.ts")] = sessionRoute(context);
+  }
+  return files;
+}
+function adminRootLayout() {
+  return `import "@nonext/husk/admin.css"
+
+import type { Metadata } from "next"
+import { Inter } from "next/font/google"
+
+const inter = Inter({
+  subsets: ["latin"],
+  variable: "--font-inter",
+  display: "swap",
+})
+
+export const metadata: Metadata = {
+  title: { default: "Husk", template: "%s | Husk" },
+}
+
+/**
+ * How this app mounts Husk: a second root layout, one stylesheet import, one font.
+ *
+ * It is a root layout, not a nested one, so the admin renders its own \`<html>\` and
+ * \`<body>\` and never inherits the website's stylesheet, fonts, providers or body classes,
+ * and nothing the admin loads can leak back out to the website. Next picks one root layout
+ * per request, so the two never coexist in a document. This is why your own root layout
+ * lives under \`(site)\`.
+ *
+ * The font is wired here rather than inside the package because \`next/font\` is a
+ * build-time transform in this app; the package only asks for the \`--font-inter\` variable
+ * its token layer reads.
+ */
+export default function HuskRootLayout({ children }: { children: React.ReactNode }) {
+  return (
+    <html lang="en" className={inter.variable}>
+      <body className="font-sans antialiased">{children}</body>
+    </html>
+  )
+}
+`;
+}
+function adminNotFound(adminRoute) {
+  return `import { NotFoundScreen } from "@nonext/husk/admin/ui"
+import Link from "next/link"
+
+/** The one 404 body in the admin, so the catch-all route and the boundary cannot drift. */
+export function AdminNotFoundScreen() {
+  return (
+    <NotFoundScreen>
+      <Link href="${adminRoute}" className="text-body-sm text-text-primary underline">
+        Back to the dashboard
+      </Link>
+    </NotFoundScreen>
+  )
+}
+`;
+}
+function adminRouteErrorBody(adminRoute) {
+  return `"use client"
+
+import { RouteError } from "@nonext/husk/admin/ui"
+import Link from "next/link"
+
+/**
+ * The one error-boundary body in the admin, so every \`error.tsx\` apologises the same way.
+ *
+ * Each route segment still gets its own \`error.tsx\`. That is what decides how much of the
+ * screen a failure takes down: a throw inside the media library replaces the media library
+ * and leaves the sidebar and every other route reachable. One boundary at the top would
+ * have replaced the whole admin with an apology.
+ */
+export function AdminRouteError({
+  error,
+  reset,
+  area,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+  /** Names the part of the admin that failed, so the screen says where it happened. */
+  area: string
+}) {
+  return (
+    <RouteError error={error} reset={reset} title={area}>
+      <Link href="${adminRoute}" className="text-body-sm text-text-primary underline">
+        Back to the dashboard
+      </Link>
+    </RouteError>
+  )
+}
+`;
+}
+function huskProvider(context, imports) {
+  const { media } = context.options;
+  return `"use client"
+
+import { fieldTypes, useLiveRegistry } from "@nonext/husk/admin/ui"
+${media ? 'import type { MediaUploader } from "@nonext/husk/admin/ui"\n' : ""}import { createRegistryStore } from "@nonext/husk/core"
+import type { CmsAdapter, Registry } from "@nonext/husk/core"
+import { createFirestoreAdapter${media ? ", createMediaUploader" : ""} } from "@nonext/husk/firebase"
+import type { AuthUser } from "@nonext/husk/types"
+import { createContext, useContext, useMemo, useState } from "react"
+import type { ReactNode } from "react"
+
+import { codeContentTypes } from "${imports.config}"
+import { huskFirestore${media ? ", huskStorage" : ""} } from "${imports.firebaseClient}"
+
+/**
+ * One adapter, one ${media ? "uploader, one " : ""}live registry for the whole admin.
+ *
+ * The registry is fed by a Firestore listener over \`schemas\`, which is what puts a content
+ * type created in the Schema Builder into the sidebar, with working routes, without a
+ * rebuild and without a reload. Code-defined types come from cms.config.ts and always win a
+ * slug conflict.
+ *
+ * It is a host concern rather than a package one because only a host can hold the Firebase
+ * handle. The package supplies the store and the hook; this is the wiring.
+ */
+
+export interface HuskContextValue {
+  registry: Registry
+  adapter: CmsAdapter
+${media ? "  uploader: MediaUploader\n" : ""}  user: AuthUser
+  /** False until the first schemas snapshot has arrived. */
+  synced: boolean
+  /** A dead schema listener, surfaced so a stale admin does not look like a working one. */
+  liveError: Error | null
+}
+
+const HuskContext = createContext<HuskContextValue | null>(null)
+
+export function HuskProvider({ user, children }: { user: AuthUser; children: ReactNode }) {
+  // Created once per mount. The code half never changes for the lifetime of the process;
+  // only the database half moves, which is exactly what the store is for.
+  const [store] = useState(() => createRegistryStore(codeContentTypes))
+
+  const adapter = useMemo(
+    () =>
+      createFirestoreAdapter({
+        db: huskFirestore(),
+        // A getter, not a value: the adapter has to see the registry as it is now, or a
+        // write against a type created a moment ago would be refused as unknown.
+        registry: () => store.registry,
+        currentUser: () => user,
+        // The admin declares its session, so a read of a content type this account may not
+        // read is refused by the adapter and not only hidden by the sidebar.
+        session: () => user,
+        // Without the field types the adapter falls back to the default converters and
+        // each field type's own validate never runs on the write path.
+        fieldTypes,
+      }),
+    [store, user],
+  )
+
+  // Memoized, or the listener would be closed and reopened on every render.
+  const watch = useMemo(() => adapter.schemas.watch, [adapter])
+  const { registry, synced, error } = useLiveRegistry(store, watch)
+${media ? `
+  const uploader = useMemo(
+    () =>
+      createMediaUploader({
+        storage: huskStorage(),
+        media: adapter.media,
+        currentUser: () => user,
+      }),
+    [adapter, user],
+  )
+` : ""}
+  const value = useMemo(
+    () => ({ registry, adapter,${media ? " uploader," : ""} user, synced, liveError: error }),
+    [registry, adapter,${media ? " uploader," : ""} user, synced, error],
+  )
+
+  return <HuskContext.Provider value={value}>{children}</HuskContext.Provider>
+}
+
+/** Everything an admin screen needs. Only callable under \`HuskProvider\`. */
+export function useHusk(): HuskContextValue {
+  const value = useContext(HuskContext)
+  if (value === null) {
+    throw new Error("useHusk was called outside HuskProvider.")
+  }
+  return value
+}
+
+/** Names a content type for a usage list. Falls back to the slug for an unknown one. */
+export function useContentTypeLabel(): (slug: string) => string {
+  const { registry } = useHusk()
+  return (slug) => registry.get(slug)?.type.label ?? slug
+}
+`;
+}
+function liveAdminShell(providerImport) {
+  return `"use client"
+
+import { buildAdminNavigation } from "@nonext/husk/admin"
+import { AdminShell } from "@nonext/husk/admin/ui"
+import type { AuthUser } from "@nonext/husk/types"
+import { useMemo } from "react"
+import type { ReactNode } from "react"
+
+import { useHusk } from "${providerImport}"
+
+/**
+ * The shell, with a sidebar that follows the live registry.
+ *
+ * The navigation is computed in the browser rather than on the server, because a
+ * database-defined content type exists only in Firestore and the server has no Firebase
+ * session to read \`schemas\` with. Same \`buildAdminNavigation\`, same \`can()\`, over a
+ * registry that is a subscription.
+ */
+export function LiveAdminShell({
+  user,
+  accountMenu,
+  children,
+}: {
+  user: AuthUser
+  accountMenu: ReactNode
+  children: ReactNode
+}) {
+  const { registry } = useHusk()
+  const navigation = useMemo(
+    () => buildAdminNavigation({ registry, user }),
+    [registry, user],
+  )
+
+  return (
+    <AdminShell navigation={navigation} user={user} accountMenu={accountMenu}>
+      {children}
+    </AdminShell>
+  )
+}
+`;
+}
+function adminChrome(_context, imports) {
+  return `import { ErrorCapture, ToastProvider } from "@nonext/husk/admin/ui"
+import type { AuthUser } from "@nonext/husk/types"
+
+import { AccountMenu } from "${imports.accountMenu}"
+import { NavigationGuard } from "${imports.navigationGuard}"
+import { HuskProvider } from "${imports.provider}"
+import { LiveAdminShell } from "${imports.shell}"
+
+/**
+ * The admin chrome: the adapter, the live registry, the sidebar and the account menu around
+ * a screen.
+ *
+ * It is a component rather than only a layout because two entries need it. The shell layout
+ * wraps every admin route in it, and the not-found boundary wraps itself in it, and a
+ * boundary cannot reuse a layout it did not render under.
+ */
+export function AdminChrome({
+  user,
+  children,
+}: {
+  user: AuthUser
+  children: React.ReactNode
+}) {
+  return (
+    <HuskProvider user={user}>
+      <LiveAdminShell user={user} accountMenu={<AccountMenu />}>
+        {/* One toast stack for the whole admin. A screen raises a toast through useToast
+            from three levels down; threading the state up is how stacks get duplicated. */}
+        <ToastProvider>
+          {/* What a React error boundary cannot see: a rejected promise. An adapter call
+              whose catch somebody forgets would otherwise fail into a console line. */}
+          <ErrorCapture />
+          {/* Around every screen rather than inside one, because the navigation it has to
+              intercept is the sidebar, which lives out here. */}
+          <NavigationGuard>{children}</NavigationGuard>
+        </ToastProvider>
+      </LiveAdminShell>
+    </HuskProvider>
+  )
+}
+`;
+}
+function boundary(bodyImport, area, why) {
+  return `"use client"
+
+import { AdminRouteError } from "${bodyImport}"
+
+/**
+ * ${why}
+ */
+export default function Boundary({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  return <AdminRouteError error={error} reset={reset} area="${area}" />
+}
+`;
+}
+function huskNotFound(context, imports) {
+  return `import type { Metadata } from "next"
+
+import { adminAccess } from "${imports.session}"
+import { AdminChrome } from "${imports.chrome}"
+import { AdminNotFoundScreen } from "${imports.notFound}"
+
+export const metadata: Metadata = { title: "Not found" }
+
+/**
+ * The boundary for a \`notFound()\` thrown anywhere under the admin.
+ *
+ * It draws the chrome itself rather than relying on the shell layout, because a boundary
+ * does not render under a layout it did not itself enter. A visitor with no session gets
+ * the bare screen: a 404 must not become a second way to find out what a project contains.
+ */
+export default async function HuskNotFound() {
+  const access = await adminAccess("${context.options.adminRoute}")
+  if (access.outcome !== "allow") return <AdminNotFoundScreen />
+
+  return (
+    <AdminChrome user={access.user}>
+      <AdminNotFoundScreen />
+    </AdminChrome>
+  )
+}
+`;
+}
+function shellLayout(context, imports) {
+  return `import { redirect } from "next/navigation"
+
+import { adminAccess } from "${imports.session}"
+import { AdminChrome } from "${imports.chrome}"
+
+/**
+ * Everything behind the guard renders inside the shell. The sign-in screen sits outside
+ * this route group on purpose: a sidebar on a sign-in page would offer navigation to
+ * someone who has no session.
+ */
+export default async function ShellLayout({ children }: { children: React.ReactNode }) {
+  const access = await adminAccess("${context.options.adminRoute}")
+  if (access.outcome === "sign-in") redirect(access.location)
+
+  return <AdminChrome user={access.user}>{children}</AdminChrome>
+}
+`;
+}
+function dashboardPage(context, imports) {
+  return `import { UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import type { Metadata } from "next"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { DashboardPanel } from "${imports.panel}"
+
+export function generateMetadata(): Promise<Metadata> {
+  return adminMetadata("${context.options.adminRoute}")
+}
+
+/**
+ * The dashboard. It resolves who the visitor is and hands that to the client panel, which
+ * owns the adapter. The screen itself is generated from the registry, so this file names no
+ * content type and no figure.
+ */
+export default async function DashboardPage() {
+  const access = await adminAccess("${context.options.adminRoute}")
+  if (access.outcome === "sign-in") redirect(access.location)
+  if (access.outcome === "unauthorized") {
+    return <UnauthorizedScreen action={access.action} role={access.user.role} />
+  }
+
+  return <DashboardPanel user={access.user} />
+}
+`;
+}
+function dashboardPanel(providerImport) {
+  return `"use client"
+
+import { Dashboard } from "@nonext/husk/admin/ui"
+import { can } from "@nonext/husk/permissions"
+import type { AuthUser } from "@nonext/husk/types"
+import { useMemo } from "react"
+
+import { useHusk } from "${providerImport}"
+
+/**
+ * The host's half of the dashboard: an adapter and the content types this account may read.
+ *
+ * It runs in the browser because that is where the Firebase session lives, so every read is
+ * subject to the same security rules as every other read. The tiles are filtered with
+ * \`can()\` rather than by hand; hiding a tile is presentation only, and the adapter and the
+ * rules refuse the same reads on their own.
+ */
+export function DashboardPanel({ user }: { user: AuthUser }) {
+  const { adapter, registry } = useHusk()
+  const types = useMemo(
+    () =>
+      registry.types
+        .filter((entry) => can(user, "read", { type: entry.type }))
+        .map((entry) => entry.type),
+    [registry, user],
+  )
+
+  return <Dashboard adapter={adapter} types={types} />
+}
+`;
+}
+function accountMenu(context, firebaseClientImport) {
+  const { auth, adminRoute } = context.options;
+  if (!auth) {
+    return `"use client"
+
+import { Menu } from "@nonext/husk/admin/ui"
+
+/**
+ * The sidebar footer's menu trigger.
+ *
+ * This app was scaffolded with --no-auth, so there is no generated sign-out. Wire this to
+ * whatever ends a session in your app, and delete the Husk session cookie along with it, or
+ * the server will keep treating the visitor as signed in.
+ */
+export function AccountMenu() {
+  return <Menu label="Account" items={[]} onSelect={() => undefined} triggerSize="sm" />
+}
+`;
+  }
+  return `"use client"
+
+import { Menu } from "@nonext/husk/admin/ui"
+import { useRouter } from "next/navigation"
+
+import { huskAuth } from "${firebaseClientImport}"
+
+/**
+ * The sidebar footer's menu trigger.
+ *
+ * The host owns it because the session is the host's: the package knows nothing about this
+ * app's Firebase client or its session route. The sidebar only asks for a node.
+ */
+export function AccountMenu() {
+  const router = useRouter()
+
+  return (
+    <Menu
+      label="Account"
+      items={[{ kind: "item", id: "sign-out", label: "Sign out" }]}
+      onSelect={async (id) => {
+        if (id !== "sign-out") return
+
+        // Cookie first: if the browser session were dropped first and this failed, the
+        // server would keep treating the visitor as signed in.
+        await fetch("/api/husk/session", { method: "DELETE" })
+        await huskAuth().signOut()
+        router.replace("${adminRoute}/login")
+        router.refresh()
+      }}
+      triggerSize="sm"
+    />
+  )
+}
+`;
+}
+function navigationGuard() {
+  return `"use client"
+
+import { UnsavedChangesProvider } from "@nonext/husk/admin/ui"
+import { useRouter } from "next/navigation"
+
+/**
+ * The host half of the unsaved-changes guard.
+ *
+ * The package intercepts the click and asks the question; it cannot know how this app
+ * navigates. Handing it \`router.push\` is what lets a confirmed "discard" resume the
+ * intercepted link as a client navigation instead of a full document load.
+ */
+export function NavigationGuard({ children }: { children: React.ReactNode }) {
+  const router = useRouter()
+
+  return (
+    <UnsavedChangesProvider navigate={(href) => router.push(href)}>
+      {children}
+    </UnsavedChangesProvider>
+  )
+}
+`;
+}
+function catchAll(notFoundImport) {
+  return `import type { Metadata } from "next"
+
+import { AdminNotFoundScreen } from "${notFoundImport}"
+
+export const metadata: Metadata = { title: "Not found" }
+
+/**
+ * Every unmatched path under the admin, answered inside the shell.
+ *
+ * It renders the 404 itself instead of calling \`notFound()\`. Next serves a thrown
+ * not-found as the framework's own error document, so the nested boundary only appears
+ * after hydration, behind a flash of a bare page with no way back.
+ *
+ * The cost is the status code: this route answers 200 where 404 would be truthful. The
+ * admin sits behind a session and is not crawled, and an editor who mistypes a URL is
+ * better served by the sidebar than by a correct header nobody sees.
+ */
+export default function AdminCatchAll() {
+  return <AdminNotFoundScreen />
+}
+`;
+}
+function contentListPage(context, imports) {
+  return `import { UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import type { Metadata } from "next"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { ContentRoute } from "${imports.route}"
+
+type ContentParams = { params: Promise<{ type: string }> }
+
+export async function generateMetadata({ params }: ContentParams): Promise<Metadata> {
+  const { type } = await params
+  return adminMetadata(\`${context.options.adminRoute}/content/\${type}\`)
+}
+
+/**
+ * One route for every content type, which is the whole point of a generated admin.
+ *
+ * The route checks the session; which screen it is comes from the live registry in the
+ * browser, because a database-defined content type exists only in Firestore and the server
+ * has no session to read it with. A singleton is not a list, so the same route is its
+ * editor instead. Nothing here is per content type.
+ */
+export default async function ContentTypePage({ params }: ContentParams) {
+  const { type: slug } = await params
+  const access = await adminAccess(\`${context.options.adminRoute}/content/\${slug}\`)
+  if (access.outcome === "sign-in") redirect(access.location)
+  if (access.outcome === "unauthorized") {
+    return <UnauthorizedScreen action={access.action} role={access.user.role} />
+  }
+
+  return <ContentRoute user={access.user} slug={slug} />
+}
+`;
+}
+function contentCreatePage(context, imports) {
+  return `import { UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import type { Metadata } from "next"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { ContentRoute } from "${imports.route}"
+
+type ContentParams = { params: Promise<{ type: string }> }
+
+export async function generateMetadata({ params }: ContentParams): Promise<Metadata> {
+  const { type } = await params
+  return adminMetadata(\`${context.options.adminRoute}/content/\${type}\`)
+}
+
+/**
+ * The create screen, for every collection at once.
+ *
+ * A singleton has no create route, because it always exists exactly once. The permission to
+ * create is checked here as well as by the adapter and by the security rules.
+ */
+export default async function NewEntryPage({ params }: ContentParams) {
+  const { type: slug } = await params
+  const access = await adminAccess(\`${context.options.adminRoute}/content/\${slug}/new\`)
+  if (access.outcome === "sign-in") redirect(access.location)
+  if (access.outcome === "unauthorized") {
+    return <UnauthorizedScreen action={access.action} role={access.user.role} />
+  }
+
+  return <ContentRoute user={access.user} slug={slug} creating />
+}
+`;
+}
+function contentEditPage(context, imports) {
+  return `import { UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import type { Metadata } from "next"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { ContentRoute } from "${imports.route}"
+
+type EntryParams = { params: Promise<{ type: string; entry: string }> }
+
+export async function generateMetadata({ params }: EntryParams): Promise<Metadata> {
+  const { type } = await params
+  return adminMetadata(\`${context.options.adminRoute}/content/\${type}\`)
+}
+
+/**
+ * The edit screen, for every collection at once.
+ *
+ * Whether this user may change this entry depends on who created it, which only the entry
+ * can answer, so the screen reads it and renders read-only rather than refusing the route.
+ */
+export default async function EditEntryPage({ params }: EntryParams) {
+  const { type: slug, entry: entryId } = await params
+  const access = await adminAccess(
+    \`${context.options.adminRoute}/content/\${slug}/\${entryId}\`,
+  )
+  if (access.outcome === "sign-in") redirect(access.location)
+  if (access.outcome === "unauthorized") {
+    return <UnauthorizedScreen action={access.action} role={access.user.role} />
+  }
+
+  return <ContentRoute user={access.user} slug={slug} entryId={entryId} />
+}
+`;
+}
+function contentRouteFile(_context, imports) {
+  return `"use client"
+
+import { Skeleton, UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import { can } from "@nonext/husk/permissions"
+import type { AuthUser } from "@nonext/husk/types"
+
+import { AdminNotFoundScreen } from "${imports.notFound}"
+import { useHusk } from "${imports.provider}"
+
+import { CollectionPanel } from "${imports.collection}"
+import { EntryPanel } from "${imports.entry}"
+
+/**
+ * Which content screen this route is, decided in the browser.
+ *
+ * The server has no Firebase session, cannot read \`schemas\`, and would answer 404 for a
+ * content type that exists but was created in the Schema Builder. The session lives in the
+ * browser, so the resolution lives there too, over the live registry.
+ *
+ * \`synced\` is why an unknown slug does not immediately 404: until the first schemas
+ * snapshot lands, "not in the registry" and "not read yet" are the same observation, and
+ * only one of them is a missing page.
+ */
+export function ContentRoute({
+  user,
+  slug,
+  entryId,
+  creating = false,
+}: {
+  user: AuthUser
+  slug: string
+  entryId?: string
+  creating?: boolean
+}) {
+  const { registry, synced } = useHusk()
+  const entry = registry.get(slug)
+
+  if (entry === undefined) {
+    return synced ? (
+      <AdminNotFoundScreen />
+    ) : (
+      <Skeleton line="heading-md" className="w-64" label="Reading the content types" />
+    )
+  }
+
+  const { type } = entry
+
+  // A singleton has one entry at a derived id, so it has no list, no create route and no
+  // id in its URL.
+  if ((creating || entryId !== undefined) && type.kind !== "collection") {
+    return <AdminNotFoundScreen />
+  }
+
+  // The adapter and the security rules refuse the write too; this only keeps the screen
+  // from opening a form nobody may submit.
+  if (creating && !can(user, "create", { type })) {
+    return <UnauthorizedScreen action="create" role={user.role} />
+  }
+
+  if (creating || entryId !== undefined || type.kind === "singleton") {
+    return (
+      <EntryPanel
+        user={user}
+        slug={slug}
+        {...(entryId === undefined ? {} : { entryId })}
+      />
+    )
+  }
+
+  return <CollectionPanel user={user} slug={slug} />
+}
+`;
+}
+function collectionPanel(context, providerImport) {
+  return `"use client"
+
+import { CollectionList, DeleteEntriesDialog } from "@nonext/husk/admin/ui"
+import type { AuthUser } from "@nonext/husk/types"
+import { useRouter } from "next/navigation"
+import { useState } from "react"
+
+import { useHusk } from "${providerImport}"
+
+/**
+ * The host's half of a collection list: an adapter, the content type, and where a row leads.
+ *
+ * It reads in the browser through the signed-in Firebase session, so every query is subject
+ * to the same security rules as any other read. The screen is the package's, and it is the
+ * same screen for every content type.
+ */
+export function CollectionPanel({ user, slug }: { user: AuthUser; slug: string }) {
+  const router = useRouter()
+  /** The ids the confirmation dialog is pointed at. Empty means it is closed. */
+  const [deleting, setDeleting] = useState<readonly string[]>([])
+  /** Bumped after a delete, so the list re-reads the page it is on. */
+  const [refreshToken, setRefreshToken] = useState(0)
+
+  const { adapter, registry } = useHusk()
+  const type = registry.require(slug).type
+
+  return (
+    <>
+      <CollectionList
+        adapter={adapter}
+        type={type}
+        user={user}
+        refreshToken={refreshToken}
+        onOpen={(entryId) => router.push(\`${context.options.adminRoute}/content/\${slug}/\${entryId}\`)}
+        onCreate={() => router.push(\`${context.options.adminRoute}/content/\${slug}/new\`)}
+        onDelete={(entryIds) => setDeleting(entryIds)}
+      />
+
+      <DeleteEntriesDialog
+        adapter={adapter}
+        type={type}
+        role={user.role}
+        entryIds={deleting}
+        onCancel={() => setDeleting([])}
+        onDeleted={(_entryIds, complete) => {
+          // A batch that failed halfway keeps the dialog open to say so, and the list still
+          // re-reads, because the rows that did go are gone.
+          if (complete) setDeleting([])
+          setRefreshToken((token) => token + 1)
+        }}
+      />
+    </>
+  )
+}
+`;
+}
+function entryPanel(context, imports) {
+  const { media, adminRoute } = context.options;
+  const uiImports = media ? `import {
+  AdminMediaPickerProvider,
+  DeleteEntriesDialog,
+  EntryEditor,
+} from "@nonext/husk/admin/ui"` : `import { DeleteEntriesDialog, EntryEditor } from "@nonext/husk/admin/ui"`;
+  const huskImport = media ? `import { useContentTypeLabel, useHusk } from "${imports.provider}"` : `import { useHusk } from "${imports.provider}"`;
+  const uploaderLine = media ? `  const { adapter, uploader, registry } = useHusk()
+  const labelOf = useContentTypeLabel()` : `  const { adapter, registry } = useHusk()`;
+  const open = media ? `    // The real media picker, over the same adapter the editor writes through. Without it
+    // the image and file controls render their "library not available" state.
+    <AdminMediaPickerProvider
+      adapter={adapter}
+      user={user}
+      uploader={uploader}
+      contentTypeLabel={labelOf}
+    >` : `    <>`;
+  const close = media ? `    </AdminMediaPickerProvider>` : `    </>`;
+  return `"use client"
+
+${uiImports}
+import { isSingleton } from "@nonext/husk/core"
+import { readUser } from "@nonext/husk/firebase"
+import type { AuthUser } from "@nonext/husk/types"
+import { useRouter } from "next/navigation"
+import { useMemo, useState } from "react"
+
+import { huskFirestore } from "${imports.firebaseClient}"
+${huskImport}
+
+/**
+ * The host's half of the entry editor: an adapter, the content type, and the routes.
+ *
+ * The screen is the package's and it is the same screen for every content type, for both
+ * create and edit, and for a collection entry and a singleton. This file supplies what only
+ * a host can know: where "back" goes, where a freshly created entry lives, who can turn a
+ * uid into a name, and where the reader lands once an entry is gone.
+ *
+ * A singleton differs in configuration only. It has no list to cancel back to, no id in its
+ * URL and no delete, so those props are simply not passed.
+ */
+export function EntryPanel({
+  user,
+  slug,
+  entryId,
+}: {
+  user: AuthUser
+  slug: string
+  entryId?: string
+}) {
+  const router = useRouter()
+  /** The entry the confirmation dialog is pointed at. Empty means it is closed. */
+  const [deleting, setDeleting] = useState<readonly string[]>([])
+
+${uploaderLine}
+  const type = registry.require(slug).type
+  const getType = useMemo(
+    () => (candidate: string) => registry.get(candidate)?.type,
+    [registry],
+  )
+
+  const list = \`${adminRoute}/content/\${slug}\`
+  const single = isSingleton(type)
+
+  return (
+${open}
+      <EntryEditor
+        adapter={adapter}
+        type={type}
+        user={user}
+        getType={getType}
+        {...(entryId === undefined ? {} : { entryId })}
+        {...(single ? {} : { onCancel: () => router.push(list) })}
+        {...(single ? {} : { onDelete: (id: string) => setDeleting([id]) })}
+        onSaved={(entry, created) => {
+          // A created entry stops being a create screen the moment it exists, and the URL
+          // has to say so, or a reload would start a second one. A singleton is already at
+          // its own URL, because the derived id never appears in a route.
+          if (created && !single) router.replace(\`\${list}/\${entry.id}\`)
+        }}
+        resolveAuthor={async (uid) => {
+          const stored = await readUser(huskFirestore(), uid)
+          return stored === null
+            ? null
+            : { uid, displayName: stored.displayName, email: stored.email }
+        }}
+      />
+
+      <DeleteEntriesDialog
+        adapter={adapter}
+        type={type}
+        role={user.role}
+        entryIds={deleting}
+        onCancel={() => setDeleting([])}
+        onDeleted={(_entryIds, complete) => {
+          // Back to the list. Staying on the editor would leave the reader looking at a
+          // form for a document that no longer exists.
+          if (!complete) return
+          setDeleting([])
+          router.push(list)
+        }}
+      />
+${close}
+  )
+}
+`;
+}
+function mediaPage(context, imports) {
+  return `import type { Metadata } from "next"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { MediaPanel } from "${imports.panel}"
+
+export async function generateMetadata(): Promise<Metadata> {
+  return adminMetadata("${context.options.adminRoute}/media")
+}
+
+/**
+ * The media library.
+ *
+ * Every signed-in role reaches it. What each of them may then do differs, and it differs in
+ * the library itself rather than here: an author may upload and may replace their own
+ * files, and only an editor may delete. The rules enforce the same split a second time.
+ */
+export default async function MediaPage() {
+  const access = await adminAccess("${context.options.adminRoute}/media")
+  if (access.outcome === "sign-in") redirect(access.location)
+
+  return <MediaPanel user={access.user} />
+}
+`;
+}
+function mediaPanel(providerImport) {
+  return `"use client"
+
+import { MediaLibrary } from "@nonext/husk/admin/ui"
+import type { AuthUser } from "@nonext/husk/types"
+
+import { useContentTypeLabel, useHusk } from "${providerImport}"
+
+/**
+ * The host's half of the media library: an adapter, an uploader, and a way to name a
+ * content type in a usage list. The screen is the package's, and it is the same screen the
+ * media picker renders inside its modal.
+ */
+export function MediaPanel({ user }: { user: AuthUser }) {
+  const { adapter, uploader } = useHusk()
+  const contentTypeLabel = useContentTypeLabel()
+
+  return (
+    <MediaLibrary
+      adapter={adapter}
+      user={user}
+      uploader={uploader}
+      contentTypeLabel={contentTypeLabel}
+    />
+  )
+}
+`;
+}
+function developerPage(context, imports) {
+  const route = context.options.adminRoute;
+  return `import { adminPageTitle, buildAdminNavigation } from "@nonext/husk/admin"
+import { PageHeader, UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import { buildRegistry } from "@nonext/husk/core"
+import type { Metadata } from "next"
+import Link from "next/link"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { codeContentTypes } from "${imports.config}"
+import { adminAccess } from "${imports.session}"
+
+type DeveloperParams = { params: Promise<{ section?: string[] }> }
+
+/** Derived from the navigation, so each Developer screen titles its own tab. */
+export async function generateMetadata({ params }: DeveloperParams): Promise<Metadata> {
+  const { section } = await params
+  return adminMetadata(developerPath(section))
+}
+
+function developerPath(section: string[] | undefined): string {
+  return ["${route}/developer", ...(section ?? [])].join("/")
+}
+
+/**
+ * The Developer area boundary: an editor or author who navigates straight here gets the
+ * unauthorized screen rather than a redirect loop. The adapter and the security rules
+ * refuse the same actions independently.
+ *
+ * One optional catch-all stands in for the Developer screens that have no page of their
+ * own, so every item the sidebar generates leads somewhere. Content Types has its own
+ * route and takes precedence, because a static segment beats a catch-all.
+ */
+export default async function DeveloperPage({ params }: DeveloperParams) {
+  const { section } = await params
+  const access = await adminAccess(developerPath(section), "manage-schema")
+  if (access.outcome === "sign-in") redirect(access.location)
+
+  if (access.outcome === "unauthorized") {
+    return (
+      <UnauthorizedScreen action={access.action} role={access.user.role}>
+        <Link href="${route}" className="text-body-sm text-text-primary underline">
+          Back to the admin
+        </Link>
+      </UnauthorizedScreen>
+    )
+  }
+
+  // The heading and the trail come from the same navigation data as the sidebar and the
+  // document title, so a Developer screen never names itself in three places.
+  const navigation = buildAdminNavigation({
+    registry: buildRegistry(codeContentTypes, []),
+    user: access.user,
+  })
+  const label = adminPageTitle(navigation, developerPath(section))
+
+  return (
+    <PageHeader
+      title={label ?? "Developer"}
+      {...(label === undefined
+        ? {}
+        : {
+            breadcrumb: [
+              { label: "Developer", href: "${route}/developer" },
+              { label },
+            ],
+          })}
+    />
+  )
+}
+`;
+}
+function contentTypesPage(context, imports) {
+  const route = context.options.adminRoute;
+  return `import { UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import type { Metadata } from "next"
+import Link from "next/link"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { ContentTypesPanel } from "${imports.panel}"
+
+const PATH = "${route}/developer/content-types"
+
+export function generateMetadata(): Promise<Metadata> {
+  return adminMetadata(PATH)
+}
+
+/**
+ * The Schema Builder's Content Types list.
+ *
+ * The route guards \`manage-schema\`, which is admin only. Hiding the Developer group in the
+ * sidebar is presentation; this is the check that stops an editor who types the URL, and
+ * the adapter and the security rules refuse the same actions again below it.
+ */
+export default async function ContentTypesPage() {
+  const access = await adminAccess(PATH, "manage-schema")
+  if (access.outcome === "sign-in") redirect(access.location)
+
+  if (access.outcome === "unauthorized") {
+    return (
+      <UnauthorizedScreen action={access.action} role={access.user.role}>
+        <Link href="${route}" className="text-body-sm text-text-primary underline">
+          Back to the admin
+        </Link>
+      </UnauthorizedScreen>
+    )
+  }
+
+  return <ContentTypesPanel user={access.user} />
+}
+`;
+}
+function contentTypesPanel(context, providerImport) {
+  const route = context.options.adminRoute;
+  return `"use client"
+
+import { ContentTypesScreen } from "@nonext/husk/admin/ui"
+import type { AuthUser } from "@nonext/husk/types"
+import { useRouter } from "next/navigation"
+
+import { useHusk } from "${providerImport}"
+
+/**
+ * The host's half of the Content Types list: the live registry, the adapter, and where a
+ * row leads. A type created here reaches the sidebar through the same registry this screen
+ * renders from, so there is nothing to refresh and nothing to invalidate.
+ */
+export function ContentTypesPanel({ user }: { user: AuthUser }) {
+  const router = useRouter()
+  const { registry, adapter, liveError } = useHusk()
+
+  return (
+    <ContentTypesScreen
+      registry={registry}
+      adapter={adapter}
+      user={user}
+      liveError={liveError}
+      onOpen={(slug) => router.push(\`${route}/developer/content-types/\${slug}\`)}
+      onCreated={(slug) => router.push(\`${route}/developer/content-types/\${slug}\`)}
+    />
+  )
+}
+`;
+}
+function contentTypePage(context, imports) {
+  const route = context.options.adminRoute;
+  return `import { UnauthorizedScreen } from "@nonext/husk/admin/ui"
+import type { Metadata } from "next"
+import Link from "next/link"
+import { redirect } from "next/navigation"
+
+import { adminMetadata } from "${imports.metadata}"
+import { adminAccess } from "${imports.session}"
+
+import { ContentTypePanel } from "${imports.panel}"
+
+type TypeParams = { params: Promise<{ slug: string }> }
+
+export function generateMetadata(): Promise<Metadata> {
+  return adminMetadata("${route}/developer/content-types")
+}
+
+/**
+ * One content type in the Schema Builder.
+ *
+ * The slug is resolved in the browser rather than here, for the same reason the content
+ * routes are: a database-defined type lives in Firestore and the server has no session to
+ * read it with.
+ */
+export default async function ContentTypePage({ params }: TypeParams) {
+  const { slug } = await params
+  const access = await adminAccess(
+    \`${route}/developer/content-types/\${slug}\`,
+    "manage-schema",
+  )
+  if (access.outcome === "sign-in") redirect(access.location)
+
+  if (access.outcome === "unauthorized") {
+    return (
+      <UnauthorizedScreen action={access.action} role={access.user.role}>
+        <Link href="${route}" className="text-body-sm text-text-primary underline">
+          Back to the admin
+        </Link>
+      </UnauthorizedScreen>
+    )
+  }
+
+  return <ContentTypePanel user={access.user} slug={slug} />
+}
+`;
+}
+function contentTypePanel(context, imports) {
+  return `"use client"
+
+import { ContentTypeEditor, Skeleton } from "@nonext/husk/admin/ui"
+import type { AuthUser } from "@nonext/husk/types"
+
+import { AdminNotFoundScreen } from "${imports.notFound}"
+import { useHusk } from "${imports.provider}"
+
+/**
+ * The host's half of the Schema Builder editor.
+ *
+ * Whether the type may be edited is not decided here. \`ContentTypeEditor\` asks
+ * \`isSchemaReadOnly\`, which answers for a locked type and for every code-defined one, and
+ * the adapter refuses the write independently of both.
+ */
+export function ContentTypePanel({ user, slug }: { user: AuthUser; slug: string }) {
+  const { registry, adapter, synced } = useHusk()
+  const entry = registry.get(slug)
+
+  if (entry === undefined) {
+    // Until the first schemas snapshot lands, "unknown" and "not read yet" look the same.
+    return synced ? (
+      <AdminNotFoundScreen />
+    ) : (
+      <Skeleton line="heading-md" className="w-64" label="Reading the content types" />
+    )
+  }
+
+  return (
+    <ContentTypeEditor
+      adapter={adapter}
+      registry={registry}
+      entry={entry}
+      user={user}
+      backHref="${context.options.adminRoute}/developer/content-types"
+    />
+  )
+}
+`;
+}
+function loginPage(panelImport) {
+  return `import type { Metadata } from "next"
+
+import { LoginPanel } from "${panelImport}"
+
+export const metadata: Metadata = { title: "Sign in" }
+
+export default async function LoginPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ next?: string; reason?: string }>
+}) {
+  const { next, reason } = await searchParams
+
+  return <LoginPanel next={next ?? null} expired={reason === "expired"} />
+}
+`;
+}
+function loginPanel(_context, firebaseClientImport) {
+  return `"use client"
+
+import { safeReturnPath } from "@nonext/husk/admin"
+import { LoginScreen } from "@nonext/husk/admin/ui"
+import { useRouter } from "next/navigation"
+
+import { currentIdToken, huskAuth } from "${firebaseClientImport}"
+
+export function LoginPanel({ next, expired }: { next: string | null; expired: boolean }) {
+  const router = useRouter()
+  const destination = safeReturnPath(next)
+
+  return (
+    <LoginScreen
+      expired={expired}
+      onSignIn={async ({ email, password }) => {
+        await huskAuth().signIn(email, password)
+
+        // The Firebase session alone is invisible to the server, so the cookie is what
+        // actually ends the sign-in. A failure here has to surface as a failed sign-in.
+        const response = await fetch("/api/husk/session", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ idToken: await currentIdToken() }),
+        })
+        if (!response.ok) throw new Error("Could not start a server session.")
+
+        router.replace(destination)
+        router.refresh()
+      }}
+    />
+  )
+}
+`;
+}
+function sessionRoute(context) {
+  const { emulators, projectId } = context.options;
+  const verifierBody = emulators ? `  try {
+    return createEmulatorTokenVerifier({ projectId: PROJECT_ID })
+  } catch {
+    return createUnavailableTokenVerifier()
+  }` : `  void PROJECT_ID
+  return createUnavailableTokenVerifier()`;
+  return `import {
+  ${emulators ? "createEmulatorTokenVerifier,\n  " : ""}createSessionRoutes,
+  createUnavailableTokenVerifier,
+} from "@nonext/husk/admin"
+import type { TokenVerifier } from "@nonext/husk/admin"
+
+/**
+ * The browser signs in with the Firebase SDK, then posts the fresh ID token here so the
+ * server has something to read on the next navigation. Sign-out deletes the cookie.
+ */
+const PROJECT_ID = process.env["NEXT_PUBLIC_FIREBASE_PROJECT_ID"] ?? "${projectId}"
+
+function buildVerifier(): TokenVerifier {
+${verifierBody}
+}
+
+// ${emulators ? "Development runs on plain-HTTP localhost, which is the only case where the cookie may\n// be non-Secure. Flip this to true, or drop the option, before deploying." : "The cookie is Secure, so it is only sent over HTTPS."}
+const routes = createSessionRoutes({
+  verifier: buildVerifier(),
+  secure: ${emulators ? "false" : "true"},
+})
+
+export const POST = routes.POST
+export const DELETE = routes.DELETE
+`;
+}
+function globalError() {
+  return `"use client"
+
+import "@nonext/husk/admin.css"
+
+import { RouteError } from "@nonext/husk/admin/ui"
+
+/**
+ * The global fallback: the one failure a route boundary cannot catch.
+ *
+ * A segment's \`error.tsx\` renders inside its layout, which means it cannot catch a throw in
+ * the root layout itself, and this app has two root layouts. When one of them fails there is
+ * no chrome, no font and no stylesheet unless this file brings them, so it renders its own
+ * \`<html>\` and \`<body>\` and imports the admin stylesheet.
+ *
+ * Importing that stylesheet here is not a leak into the public site. Next scopes a CSS
+ * import to the segment that makes it, and this segment only ever renders in place of the
+ * entire document, after the document that was meant to render has already failed.
+ */
+export default function GlobalError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  return (
+    <html lang="en">
+      <body className="min-h-dvh bg-surface-base font-sans text-body text-text-secondary antialiased">
+        <main className="mx-auto max-w-reading px-6 py-12">
+          <RouteError error={error} reset={reset} title="Husk" />
+        </main>
+      </body>
+    </html>
+  )
+}
+`;
+}
+
+// src/cli/generate/lib-files.ts
+function libFiles(context) {
+  const { libDir } = context;
+  const session = projectJoin(libDir, "session.ts");
+  const cmsServer = projectJoin(libDir, "cms-server.ts");
+  const metadata = projectJoin(libDir, "admin-metadata.ts");
+  const config = "cms.config.ts";
+  return {
+    [projectJoin(libDir, "firebase-client.ts")]: firebaseClientFile(context),
+    [session]: sessionFile(context),
+    [cmsServer]: cmsServerFile(context, specifier(cmsServer, config)),
+    [metadata]: adminMetadataFile(
+      specifier(metadata, config),
+      specifier(metadata, session)
+    )
+  };
+}
+function firebaseClientFile(context) {
+  const { emulators, media, projectId, storageBucket } = context.options;
+  const storageImport = media ? `import { ${emulators ? "connectStorageEmulator, " : ""}getStorage } from "firebase/storage"
+import type { FirebaseStorage } from "firebase/storage"
+` : "";
+  const storageAccessor = media ? `
+let cachedStorage: FirebaseStorage | undefined
+
+/** The one Storage instance in the browser. Media uploads go through it. */
+export function huskStorage(): FirebaseStorage {
+  if (cachedStorage !== undefined) return cachedStorage
+
+  const storage = getStorage(huskApp())${emulators ? `
+  const [host, port] = STORAGE_HOST.split(":")
+  connectStorageEmulator(storage, host ?? "127.0.0.1", Number(port ?? "9199"))` : ""}
+
+  cachedStorage = storage
+  return storage
+}
+` : "";
+  const hosts = emulators ? `const AUTH_HOST = process.env["NEXT_PUBLIC_AUTH_EMULATOR_HOST"] ?? "127.0.0.1:9099"
+const FIRESTORE_HOST =
+  process.env["NEXT_PUBLIC_FIRESTORE_EMULATOR_HOST"] ?? "127.0.0.1:8085"
+${media ? 'const STORAGE_HOST = process.env["NEXT_PUBLIC_STORAGE_EMULATOR_HOST"] ?? "127.0.0.1:9199"\n' : ""}` : "";
+  const claimSync = emulators ? `    // The emulator claim writer. A real project needs a privileged one instead: a Cloud
+    // Function or an Admin SDK service that re-checks settings/bootstrap and users/{uid}
+    // itself rather than trusting a role sent from a browser.
+    claimSync: createEmulatorClaimSync({ authHost: AUTH_HOST, projectId: PROJECT_ID }),` : `    // Supply the privileged claim writer for this project. Without one, sign-in cannot
+    // mint the role claim firestore.rules reads, and every read is denied.
+    claimSync: createUnavailableClaimSync(),`;
+  const authImport = emulators ? "createEmulatorClaimSync, createHuskAuth" : "createHuskAuth, createUnavailableClaimSync";
+  return `"use client"
+
+import { ${authImport} } from "@nonext/husk/auth"
+import type { HuskAuth } from "@nonext/husk/auth"
+import { getApp, getApps, initializeApp } from "firebase/app"
+import type { FirebaseApp } from "firebase/app"
+import { ${emulators ? "connectAuthEmulator, " : ""}getAuth } from "firebase/auth"
+import { ${emulators ? "connectFirestoreEmulator, " : ""}getFirestore } from "firebase/firestore"
+import type { Firestore } from "firebase/firestore"
+${storageImport}
+/**
+ * This app's browser-side Firebase handles, and the Husk auth layer over them.
+ *
+ * Every instance is cached at module scope. The admin, the auth layer and the media
+ * uploader need the same Firestore instance, and the emulator connectors may only run
+ * before the client is used and only once.
+${emulators ? ` *
+ * Emulator wiring. Drop the connect calls, and the emulator variables in .env.local, when
+ * this app points at a real Firebase project.` : ""}
+ */
+const PROJECT_ID = process.env["NEXT_PUBLIC_FIREBASE_PROJECT_ID"] ?? "${projectId}"
+const API_KEY =
+  process.env["NEXT_PUBLIC_FIREBASE_API_KEY"] ?? "emulator-placeholder-key"
+const STORAGE_BUCKET =
+  process.env["NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET"] ?? "${storageBucket}"
+${hosts}
+let cachedAuth: HuskAuth | undefined
+let cachedDb: Firestore | undefined
+
+function huskApp(): FirebaseApp {
+  return getApps().length > 0
+    ? getApp()
+    : initializeApp({
+        projectId: PROJECT_ID,
+        apiKey: API_KEY,
+        storageBucket: STORAGE_BUCKET,
+      })
+}
+
+/** The one Firestore instance in the browser. */
+export function huskFirestore(): Firestore {
+  if (cachedDb !== undefined) return cachedDb
+
+  const db = getFirestore(huskApp())${emulators ? `
+  const [host, port] = FIRESTORE_HOST.split(":")
+  connectFirestoreEmulator(db, host ?? "127.0.0.1", Number(port ?? "8085"))` : ""}
+
+  cachedDb = db
+  return db
+}
+${storageAccessor}
+/** Sign-in, sign-up, roles and claim sync, over the handles above. */
+export function huskAuth(): HuskAuth {
+  if (cachedAuth !== undefined) return cachedAuth
+
+  const auth = getAuth(huskApp())${emulators ? `
+  connectAuthEmulator(auth, \`http://\${AUTH_HOST}\`, { disableWarnings: true })` : ""}
+
+  cachedAuth = createHuskAuth({
+    auth,
+    db: huskFirestore(),
+${claimSync}
+  })
+
+  return cachedAuth
+}
+
+/** The raw ID token. This is what the server session cookie carries. */
+export async function currentIdToken(): Promise<string> {
+  const auth = getAuth(getApp())
+  const user = auth.currentUser
+  if (user === null) throw new Error("Signed in without a Firebase session.")
+  return user.getIdToken(true)
+}
+`;
+}
+function sessionFile(context) {
+  const { emulators, projectId } = context.options;
+  const verifierBody = emulators ? `  try {
+    return createEmulatorTokenVerifier({ projectId: PROJECT_ID })
+  } catch {
+    return createUnavailableTokenVerifier()
+  }` : `  // Replace this with a verifier that checks the token signature against Google's
+  // public keys before this app leaves development. Until then every admin route
+  // redirects to the sign-in screen, which is the fail-closed half of the same seam.
+  void PROJECT_ID
+  return createUnavailableTokenVerifier()`;
+  const explanation = emulators ? "The emulator one checks issuer, audience, subject, expiry and the role claim, and\n * cannot check a signature, because emulator tokens are unsigned. It refuses to be\n * constructed unless FIREBASE_AUTH_EMULATOR_HOST points at loopback." : "No verifier is wired up for this project yet.";
+  return `import {
+  ${emulators ? "createEmulatorTokenVerifier,\n  " : ""}createUnavailableTokenVerifier,
+  readSession,
+  resolveAdminAccess,
+  SESSION_COOKIE,
+} from "@nonext/husk/admin"
+import type { AdminAccess, TokenVerifier } from "@nonext/husk/admin"
+import type { Action } from "@nonext/husk/types"
+import { cookies } from "next/headers"
+
+/**
+ * How this app answers "who is the visitor" on the server.
+ *
+ * The verifier is a seam. ${explanation}
+ * The fallback trusts nothing, so a misconfigured deployment locks everyone out instead of
+ * letting everyone in.
+ *
+ * Read the result as a presentation guard. What protects data is \`can()\` inside the
+ * adapter and firestore.rules, both of which run against a real Firebase session that a
+ * forged cookie does not produce.
+ */
+const PROJECT_ID = process.env["NEXT_PUBLIC_FIREBASE_PROJECT_ID"] ?? "${projectId}"
+
+function buildVerifier(): TokenVerifier {
+${verifierBody}
+}
+
+const verifier = buildVerifier()
+
+export async function adminAccess(
+  pathname: string,
+  action?: Action,
+): Promise<AdminAccess> {
+  const store = await cookies()
+  const session = await readSession(store, verifier, SESSION_COOKIE)
+
+  return resolveAdminAccess({
+    session,
+    pathname,
+    ...(action === undefined ? {} : { action }),
+  })
+}
+`;
+}
+function cmsServerFile(context, configImport) {
+  const { emulators, projectId } = context.options;
+  return `import { buildRegistry } from "@nonext/husk/core"
+import { createFirestoreAdapter } from "@nonext/husk/firebase"
+import { createServerCMS } from "@nonext/husk/server"
+import type { ServerCms } from "@nonext/husk/server"
+import type { AuthUser } from "@nonext/husk/types"
+import { initializeApp } from "firebase/app"
+import type { FirebaseApp } from "firebase/app"
+import { ${emulators ? "connectFirestoreEmulator, " : ""}getFirestore } from "firebase/firestore"
+import type { Firestore } from "firebase/firestore"
+
+import { codeContentTypes, siteContentTypes } from "${configImport}"
+import type { SiteContentTypes } from "${configImport}"
+
+/**
+ * The public website's reader, and the only file in your own code that knows Husk stores
+ * content in Firebase.
+ *
+ * Everything above it is written against \`cms.collection()\` and \`cms.single()\`. That is
+ * the trade the adapter boundary exists to make: a change to the internal Firestore layout
+ * costs a new version of the package, not a rewrite of your website.
+ *
+ * Three things are deliberate. A visitor has no session, so the connection is
+ * unauthenticated and \`currentUser\` throws; nothing on the read path calls it. There is no
+ * preview, so a draft cannot leak through a forwarded query or a URL parameter. And the
+ * Firebase app is a named second one, so it never shares an instance with the admin's.
+ */
+const PROJECT_ID = process.env["NEXT_PUBLIC_FIREBASE_PROJECT_ID"] ?? "${projectId}"
+${emulators ? `const FIRESTORE_HOST =
+  process.env["NEXT_PUBLIC_FIRESTORE_EMULATOR_HOST"] ?? "127.0.0.1:8085"
+` : ""}const SITE_APP = "husk-site-reader"
+
+let cachedDb: Firestore | undefined
+let cachedCms: ServerCms<SiteContentTypes> | undefined
+
+/**
+ * Code-defined types only. The admin also merges the database half from a live Firestore
+ * listener, which a website neither needs nor should pay for: a page renders the content
+ * types its own code names, and a type created in the Schema Builder has no page until
+ * somebody writes one.
+ */
+const registry = buildRegistry(codeContentTypes, [])
+
+function refuseUser(): AuthUser {
+  throw new Error(
+    "A public page asked Husk who the visitor is. Reads on this path are anonymous and published-only.",
+  )
+}
+
+function siteFirestore(): Firestore {
+  if (cachedDb !== undefined) return cachedDb
+
+  const app: FirebaseApp = initializeApp({ projectId: PROJECT_ID }, SITE_APP)
+  const db = getFirestore(app)${emulators ? `
+
+  const [host, port] = FIRESTORE_HOST.split(":")
+  connectFirestoreEmulator(db, host ?? "127.0.0.1", Number(port ?? "8085"))` : ""}
+
+  cachedDb = db
+  return db
+}
+
+/** The reader every public page uses. One instance per server process. */
+export function siteCms(): ServerCms<SiteContentTypes> {
+  if (typeof window !== "undefined") {
+    throw new Error(
+      "The site reader was built in a browser. It belongs to server components; a client component reads through an API route or props.",
+    )
+  }
+
+  if (cachedCms !== undefined) return cachedCms
+
+  cachedCms = createServerCMS({
+    adapter: createFirestoreAdapter({
+      db: siteFirestore(),
+      registry: () => registry,
+      currentUser: refuseUser,
+    }),
+    contentTypes: siteContentTypes,
+  })
+
+  return cachedCms
+}
+`;
+}
+function adminMetadataFile(configImport, sessionImport) {
+  return `import { adminPageTitle, buildAdminNavigation } from "@nonext/husk/admin"
+import { buildRegistry } from "@nonext/husk/core"
+import type { Metadata } from "next"
+
+import { codeContentTypes } from "${configImport}"
+import { adminAccess } from "${sessionImport}"
+
+/**
+ * The document title for an admin route, taken from the navigation the registry generated.
+ *
+ * No route writes its own title string, so the sidebar and the browser tab read the same
+ * data and cannot drift. An unknown route, or a visitor with no session, falls back to the
+ * root layout's default: a 404 must not leak the label of a page the visitor may not see.
+ */
+export async function adminMetadata(pathname: string): Promise<Metadata> {
+  const access = await adminAccess(pathname)
+  if (access.outcome !== "allow") return {}
+
+  const registry = buildRegistry(codeContentTypes, [])
+  const navigation = buildAdminNavigation({ registry, user: access.user })
+  const title = adminPageTitle(navigation, pathname)
+
+  return title === undefined ? {} : { title }
+}
+`;
+}
+
+// src/cli/generate/starter.ts
+function starterContentTypes(media) {
+  const pages = {
+    slug: "pages",
+    kind: "collection",
+    label: "Page",
+    labelPlural: "Pages",
+    icon: "file-text",
+    titleField: "title",
+    defaultSort: { field: "title", direction: "asc" },
+    fields: {
+      title: {
+        type: "text",
+        label: "Title",
+        validation: { required: true, maxLength: 120 }
+      },
+      slug: {
+        type: "slug",
+        label: "Slug",
+        from: "title",
+        validation: { required: true, unique: true }
+      },
+      section: {
+        type: "select",
+        label: "Section",
+        options: [
+          { value: "main", label: "Main" },
+          { value: "legal", label: "Legal" }
+        ],
+        validation: { required: true }
+      },
+      summary: { type: "textarea", label: "Summary", rows: 3 },
+      body: { type: "richtext", label: "Body" },
+      ...media ? {
+        cover: {
+          type: "image",
+          label: "Cover image",
+          accept: ["image/*"],
+          placeholder: "No cover chosen"
+        }
+      } : {}
+    }
+  };
+  const siteSettings = {
+    slug: "site-settings",
+    kind: "singleton",
+    label: "Site settings",
+    icon: "settings",
+    fields: {
+      siteName: { type: "text", label: "Site name", validation: { required: true } },
+      tagline: { type: "text", label: "Tagline" }
+    }
+  };
+  return [pages, siteSettings];
+}
+function printValue(value, indent = 0) {
+  const pad = "  ".repeat(indent);
+  const inner = "  ".repeat(indent + 1);
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) {
+    if (value.length === 0) return "[]";
+    const items = value.map((item) => `${inner}${printValue(item, indent + 1)},`);
+    return `[
+${items.join("\n")}
+${pad}]`;
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value).filter(
+      ([, item]) => item !== void 0
+    );
+    if (entries.length === 0) return "{}";
+    const lines2 = entries.map(
+      ([key, item]) => `${inner}${printKey(key)}: ${printValue(item, indent + 1)},`
+    );
+    return `{
+${lines2.join("\n")}
+${pad}}`;
+  }
+  throw new Error(`Cannot print a ${typeof value} into generated TypeScript.`);
+}
+function printKey(key) {
+  return /^[A-Za-z_$][\w$]*$/.test(key) ? key : JSON.stringify(key);
+}
+function exportName(slug) {
+  const camel = slug.replace(/[-_](.)/g, (_match, letter) => letter.toUpperCase());
+  return /^[a-z]/.test(camel) ? camel : `type${camel}`;
+}
+
+// src/cli/generate/project-files.ts
+function ownedProjectFiles(context) {
+  const files = { "cms.config.ts": cmsConfigFile(context) };
+  if (context.options.auth && context.options.emulators) {
+    files["scripts/husk-first-admin.mjs"] = firstAdminScript(context);
+  }
+  return files;
+}
+function firstAdminScript(context) {
+  return `/**
+ * Creates the first Husk account in the Auth emulator and makes it the admin.
+ *
+ *   node scripts/husk-first-admin.mjs you@example.com a-password
+ *
+ * The first account in an empty project claims settings/bootstrap and becomes admin; every
+ * account after it is created by that admin. The marker can be written exactly once, so
+ * running this twice does not mint a second admin.
+ */
+import { createEmulatorClaimSync, createHuskAuth } from "@nonext/husk/auth"
+import { initializeApp } from "firebase/app"
+import { connectAuthEmulator, getAuth } from "firebase/auth"
+import { connectFirestoreEmulator, getFirestore } from "firebase/firestore"
+
+const PROJECT_ID = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID ?? "${context.options.projectId}"
+const AUTH_HOST = process.env.NEXT_PUBLIC_AUTH_EMULATOR_HOST ?? "127.0.0.1:9099"
+const FIRESTORE_HOST = process.env.NEXT_PUBLIC_FIRESTORE_EMULATOR_HOST ?? "127.0.0.1:8085"
+
+const [email, password] = process.argv.slice(2)
+if (!email || !password) {
+  console.error("Usage: node scripts/husk-first-admin.mjs <email> <password>")
+  process.exit(2)
+}
+
+const app = initializeApp({ projectId: PROJECT_ID, apiKey: "emulator-placeholder-key" })
+
+const auth = getAuth(app)
+connectAuthEmulator(auth, \`http://\${AUTH_HOST}\`, { disableWarnings: true })
+
+const db = getFirestore(app)
+const [host, port] = FIRESTORE_HOST.split(":")
+connectFirestoreEmulator(db, host, Number(port))
+
+const husk = createHuskAuth({
+  auth,
+  db,
+  claimSync: createEmulatorClaimSync({ authHost: AUTH_HOST, projectId: PROJECT_ID }),
+})
+
+const user = await husk.signUp({ email, password, displayName: email })
+console.log(\`Created \${user.email} with role \${user.role}.\`)
+process.exit(0)
+`;
+}
+function createOnlyProjectFiles(context) {
+  const files = {
+    "firebase.json": firebaseJson(context),
+    ".firebaserc": firebaserc(context),
+    "firestore.indexes.json": indexesJson(context),
+    ".env.local": envLocal(context)
+  };
+  if (!context.project.hasPostcssConfig) {
+    files["postcss.config.mjs"] = postcssConfig();
+  }
+  return files;
+}
+function cmsConfigFile(context) {
+  const types = starterContentTypes(context.options.media);
+  const definitions = types.map(
+    (type) => `export const ${exportName(type.slug)} = defineContentType(${printValue(type)})`
+  ).join("\n\n");
+  const list = types.map((type) => exportName(type.slug)).join(", ");
+  const map = types.map((type) => {
+    const name = exportName(type.slug);
+    return type.slug === name ? `  ${name},` : `  ${JSON.stringify(type.slug)}: ${name},`;
+  }).join("\n");
+  return `import { defineContentType } from "@nonext/husk"
+import type { HuskConfig } from "@nonext/husk/types"
+
+/**
+ * Husk configuration and this project's code-defined content types.
+ *
+ * A type declared here lives in git, is reviewed like any other code, and always wins a
+ * slug conflict against one created in the admin Schema Builder. Add \`locked: true\` to a
+ * type whose structure your page components depend on and the Schema Builder will refuse to
+ * touch it, at the domain layer and in firestore.rules, not only in the interface.
+ *
+ * After changing a content type here, regenerate the composite indexes that its list view
+ * needs and check the installation:
+ *
+ *   npx nonext-husk doctor
+ */
+
+${definitions}
+
+/** Every code-defined type, as the registry and the admin sidebar read them. */
+export const codeContentTypes = [${list}]
+
+/**
+ * The same types keyed by slug, which is what carries inference into a read.
+ *
+ * \`cms.collection("${types[0]?.slug ?? "pages"}").findBySlug(slug)\` types its fields because the key is what
+ * the lookup is indexed by. The array above is what the registry merges; this map is what
+ * the SDK reads.
+ */
+export const siteContentTypes = {
+${map}
+} as const
+
+export type SiteContentTypes = typeof siteContentTypes
+
+/** Read by \`nonext-husk doctor\`. Everything else here is read by your own code. */
+export const huskConfig: HuskConfig = {
+  generatedWith: ${JSON.stringify(context.version)},
+  adminRoute: ${JSON.stringify(context.options.adminRoute)},
+  projectId: ${JSON.stringify(context.options.projectId)},
+  storageBucket: ${JSON.stringify(context.options.storageBucket)},
+  media: ${String(context.options.media)},
+  auth: ${String(context.options.auth)},
+  emulators: ${String(context.options.emulators)},
+}
+`;
+}
+function firebaseJson(context) {
+  const storage = context.options.media ? `,
+  "storage": {
+    "rules": "storage.rules"
+  }` : "";
+  const emulators = context.options.emulators ? `,
+  "emulators": {
+    "auth": { "port": 9099 },
+    "firestore": { "port": 8085 },${context.options.media ? `
+    "storage": { "port": 9199 },` : ""}
+    "ui": { "enabled": true, "port": 4000 },
+    "hub": { "port": 4400 },
+    "singleProjectMode": true
+  }` : "";
+  return `{
+  "firestore": {
+    "rules": "firestore.rules",
+    "indexes": "firestore.indexes.json"
+  }${storage}${emulators}
+}
+`;
+}
+function firebaserc(context) {
+  return `{
+  "projects": {
+    "default": "${context.options.projectId}"
+  }
+}
+`;
+}
+function indexesJson(context) {
+  const indexes = requiredEntryIndexes(starterContentTypes(context.options.media));
+  return `${JSON.stringify({ indexes, fieldOverrides: [] }, null, 2)}
+`;
+}
+function envLocal(context) {
+  const { projectId, storageBucket, emulators, media } = context.options;
+  const emulatorBlock = emulators ? `
+# The Firebase Emulator Suite. Delete this block when this app points at a real project.
+#
+# FIREBASE_AUTH_EMULATOR_HOST is read on the server. Without it the token verifier falls
+# back to the one that trusts nothing and every admin route redirects to sign-in.
+FIREBASE_AUTH_EMULATOR_HOST=127.0.0.1:9099
+NEXT_PUBLIC_AUTH_EMULATOR_HOST=127.0.0.1:9099
+NEXT_PUBLIC_FIRESTORE_EMULATOR_HOST=127.0.0.1:8085${media ? `
+NEXT_PUBLIC_STORAGE_EMULATOR_HOST=127.0.0.1:9199` : ""}
+` : "";
+  return `# Husk. Generated by nonext-husk init.
+#
+# Not committed: .env.local is in the Next.js .gitignore. A web API key is not a secret,
+# but the emulator hosts below are local to this machine.
+
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=${projectId}
+NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=${storageBucket}
+NEXT_PUBLIC_FIREBASE_API_KEY=${emulators ? "emulator-placeholder-key" : ""}
+${emulatorBlock}`;
+}
+function postcssConfig() {
+  return `const config = {
+  plugins: {
+    "@tailwindcss/postcss": {},
+  },
+}
+
+export default config
+`;
+}
+
+// src/cli/plan.ts
+function buildPlan(fs, project, options, version, templates) {
+  const context = createContext(options, project, version);
+  const owned = {
+    ...ownedProjectFiles(context),
+    ...libFiles(context),
+    ...adminFiles(context),
+    "firestore.rules": stampRules("firestore", templates.read("firestore")),
+    ...options.media ? { "storage.rules": stampRules("storage", templates.read("storage")) } : {}
+  };
+  const files = [
+    ...Object.entries(owned).map(([path, contents]) => ({
+      path,
+      contents,
+      kind: "owned"
+    })),
+    ...Object.entries(createOnlyProjectFiles(context)).map(([path, contents]) => ({
+      path,
+      contents,
+      kind: "create-only"
+    }))
+  ].sort((left, right) => left.path.localeCompare(right.path));
+  return { files, moves: planSiteMove(fs, project) };
+}
+function planSiteMove(fs, project) {
+  return project.siteFilesToMove.map((name) => {
+    const from = projectJoin(project.appDir, name);
+    return {
+      from,
+      to: projectJoin(project.appDir, "(site)", name),
+      contents: deepenRelativeImports(fs.read(from))
+    };
+  });
+}
+var SPECIFIER = /(\bfrom\s*|\bimport\s*|\brequire\(\s*)(["'])(\.{1,2}\/[^"']*)\2/g;
+function deepenRelativeImports(source) {
+  return source.replace(
+    SPECIFIER,
+    (_match, lead, quote, path) => {
+      const deepened = path.startsWith("./") ? `../${path.slice(2)}` : `../${path}`;
+      return `${lead}${quote}${deepened}${quote}`;
+    }
+  );
+}
+function classifyPlan(fs, plan) {
+  const create = [];
+  const unchanged = [];
+  const kept = [];
+  const conflicts = [];
+  for (const file of plan.files) {
+    if (!fs.exists(file.path)) {
+      create.push(file);
+      continue;
+    }
+    if (file.kind === "create-only") {
+      kept.push(file);
+      continue;
+    }
+    const existing = fs.read(file.path);
+    if (existing === file.contents) unchanged.push(file);
+    else conflicts.push({ path: file.path, existing, generated: file.contents });
+  }
+  return {
+    create,
+    unchanged,
+    kept,
+    conflicts,
+    moves: plan.moves,
+    moveConflicts: plan.moves.filter((move) => fs.exists(move.to)).map((move) => move.to)
+  };
+}
+function applyPlan(fs, outcome, force = false) {
+  for (const move of outcome.moves) {
+    fs.move(move.from, move.to);
+    fs.write(move.to, move.contents);
+  }
+  for (const file of outcome.create) {
+    fs.write(file.path, file.contents);
+  }
+  if (force) {
+    for (const conflict of outcome.conflicts) {
+      fs.write(conflict.path, conflict.generated);
+    }
+  }
+}
+
+// src/cli/project.ts
+var ROUTE_FILES = /* @__PURE__ */ new Set([
+  "page.tsx",
+  "page.ts",
+  "page.jsx",
+  "page.js",
+  "route.tsx",
+  "route.ts",
+  "route.jsx",
+  "route.js",
+  "default.tsx",
+  "default.ts"
+]);
+var ROOT_SEGMENT_FILES = [
+  "layout.tsx",
+  "page.tsx",
+  "loading.tsx",
+  "error.tsx",
+  "not-found.tsx",
+  "template.tsx",
+  "default.tsx"
+];
+var ProjectError = class extends Error {
+  name = "ProjectError";
+};
+function readManifest(fs) {
+  if (!fs.exists("package.json")) {
+    throw new ProjectError(
+      "No package.json here. Run `nonext-husk init` inside a Next.js project, or pass --cwd."
+    );
+  }
+  try {
+    return JSON.parse(fs.read("package.json"));
+  } catch {
+    throw new ProjectError("package.json is not valid JSON.");
+  }
+}
+function dependencyNames(manifest) {
+  return ["dependencies", "devDependencies", "peerDependencies"].flatMap((key) => {
+    const block = manifest[key];
+    return block === null || typeof block !== "object" ? [] : Object.keys(block);
+  });
+}
+function routeSegments(fs, appDir) {
+  const found = [];
+  const walk = (relativeDir) => {
+    const dir = projectJoin(appDir, relativeDir);
+    let routable = false;
+    for (const name of fs.list(dir)) {
+      const path = projectJoin(dir, name);
+      if (fs.isDirectory(path)) {
+        if (walk(projectJoin(relativeDir, name))) routable = true;
+      } else if (ROUTE_FILES.has(name)) {
+        routable = true;
+      }
+    }
+    return routable;
+  };
+  for (const name of fs.list(appDir)) {
+    if (!fs.isDirectory(projectJoin(appDir, name))) continue;
+    if (walk(name)) found.push(name);
+  }
+  return found;
+}
+function inspectProject(fs) {
+  const manifest = readManifest(fs);
+  const dependencies = dependencyNames(manifest);
+  if (!dependencies.includes("next")) {
+    throw new ProjectError(
+      "This project does not depend on next. Husk mounts inside a Next.js App Router app; create one with `npx create-next-app@latest` first."
+    );
+  }
+  if (!dependencies.includes("@nonext/husk")) {
+    throw new ProjectError(
+      "@nonext/husk is not installed here. Install the package first, then run `npx nonext-husk init`."
+    );
+  }
+  const missingTailwind = ["tailwindcss", "@tailwindcss/postcss"].filter(
+    (name) => !dependencies.includes(name)
+  );
+  if (missingTailwind.length > 0) {
+    throw new ProjectError(
+      `Husk's admin stylesheet needs Tailwind CSS v4. Install the missing package${missingTailwind.length === 1 ? "" : "s"} first:
+
+  npm install -D ${missingTailwind.join(" ")}
+`
+    );
+  }
+  const srcDir = fs.isDirectory("src/app");
+  const appDir = srcDir ? "src/app" : "app";
+  if (!fs.isDirectory(appDir)) {
+    throw new ProjectError(
+      "No app directory found. Husk needs the App Router; the Pages Router is not supported."
+    );
+  }
+  const rootLayout = fs.exists(projectJoin(appDir, "layout.tsx"));
+  const segments = routeSegments(fs, appDir).filter(
+    // A route group is not a segment with its own root layout requirement: whatever is
+    // inside it already sits under a group, so it is either already served by a grouped
+    // root layout or it is the group this run is about to create.
+    (name) => !name.startsWith("(")
+  );
+  return {
+    appDir,
+    libDir: srcDir ? "src/lib" : "lib",
+    srcDir,
+    siteFilesToMove: rootLayout ? ROOT_SEGMENT_FILES.filter((name) => fs.exists(projectJoin(appDir, name))) : [],
+    orphanedSegments: rootLayout ? segments : [],
+    rootLayoutAlreadyGrouped: !rootLayout,
+    hasPostcssConfig: [
+      "postcss.config.mjs",
+      "postcss.config.js",
+      "postcss.config.ts"
+    ].some((name) => fs.exists(name))
+  };
+}
+function rootLayoutBlocker(project) {
+  if (project.orphanedSegments.length === 0) return null;
+  const list = project.orphanedSegments.map((name) => `${project.appDir}/${name}/`).join(", ");
+  return [
+    "Husk needs its own root layout, so the website's root layout has to sit inside a route group.",
+    `Moving ${project.appDir}/layout.tsx into ${project.appDir}/(site)/ would leave these route segments with no root layout: ${list}.`,
+    "",
+    "Do this once by hand, then run init again:",
+    `  1. create ${project.appDir}/(site)/`,
+    `  2. move layout.tsx, page.tsx and every route segment of your website into it`,
+    `  3. fix the relative imports in the files you moved (../ instead of ./)`,
+    "",
+    "Why: the admin renders its own <html> and <body> so your stylesheet, fonts and providers never reach it, and nothing it loads leaks back into your site. Next allows one root layout per route, so both have to live in a group."
+  ].join("\n");
+}
+function createReadlinePrompter() {
+  const rl = createInterface({ input: stdin, output: stdout });
+  return {
+    async ask(question, fallback) {
+      const answer = (await rl.question(`${question} (${fallback}) `)).trim();
+      return answer.length === 0 ? fallback : answer;
+    },
+    async confirm(question, fallback) {
+      const answer = (await rl.question(`${question} (${fallback ? "Y/n" : "y/N"}) `)).trim().toLowerCase();
+      if (answer.length === 0) return fallback;
+      return answer.startsWith("y");
+    },
+    close() {
+      rl.close();
+    }
+  };
+}
+async function promptForOptions(prompter, args) {
+  const projectId = validateProjectId(
+    args.projectId ?? await prompter.ask("Firebase project id?", "husk-dev-project")
+  );
+  const adminRoute = normalizeAdminRoute(
+    args.adminRoute ?? await prompter.ask("Admin route?", DEFAULT_ADMIN_ROUTE)
+  );
+  const media = args.media ?? await prompter.confirm("Enable the media library?", true);
+  const auth = args.auth ?? await prompter.confirm("Generate the sign-in screen?", true);
+  const emulators = args.emulators ?? await prompter.confirm("Develop against the Firebase emulators?", true);
+  const storageBucket = args.storageBucket !== void 0 ? validateStorageBucket(args.storageBucket) : media ? validateStorageBucket(
+    await prompter.ask("Storage bucket?", defaultStorageBucket(projectId))
+  ) : defaultStorageBucket(projectId);
+  return { projectId, storageBucket, adminRoute, media, auth, emulators };
+}
+
+// src/cli/diff.ts
+var CONTEXT = 3;
+var MAX_HUNKS = 4;
+var MAX_HUNK_LINES = 24;
+function lines(text) {
+  const split = text.replace(/\r\n/g, "\n").split("\n");
+  return split.length > 0 && split[split.length - 1] === "" ? split.slice(0, -1) : split;
+}
+function commonSubsequence(left, right) {
+  const rows = left.length;
+  const columns = right.length;
+  const table = Array.from(
+    { length: rows + 1 },
+    () => new Array(columns + 1).fill(0)
+  );
+  for (let row2 = rows - 1; row2 >= 0; row2 -= 1) {
+    for (let column2 = columns - 1; column2 >= 0; column2 -= 1) {
+      const current = table[row2] ?? [];
+      const next = table[row2 + 1] ?? [];
+      current[column2] = left[row2] === right[column2] ? (next[column2 + 1] ?? 0) + 1 : Math.max(next[column2] ?? 0, current[column2 + 1] ?? 0);
+    }
+  }
+  const result = [];
+  let row = 0;
+  let column = 0;
+  while (row < rows && column < columns) {
+    if (left[row] === right[column]) {
+      result.push({ kind: "context", text: left[row] ?? "" });
+      row += 1;
+      column += 1;
+      continue;
+    }
+    const down = table[row + 1]?.[column] ?? 0;
+    const across = table[row]?.[column + 1] ?? 0;
+    if (down >= across) {
+      result.push({ kind: "yours", text: left[row] ?? "" });
+      row += 1;
+    } else {
+      result.push({ kind: "husk", text: right[column] ?? "" });
+      column += 1;
+    }
+  }
+  while (row < rows) {
+    result.push({ kind: "yours", text: left[row] ?? "" });
+    row += 1;
+  }
+  while (column < columns) {
+    result.push({ kind: "husk", text: right[column] ?? "" });
+    column += 1;
+  }
+  return result;
+}
+function diffFiles(existing, generated) {
+  const script = commonSubsequence(lines(existing), lines(generated));
+  const changed = script.filter((line) => line.kind !== "context").length;
+  if (changed === 0) return { hunks: [], changed: 0, omittedHunks: 0 };
+  const interesting = script.flatMap(
+    (line, index) => line.kind === "context" ? [] : [index]
+  );
+  const ranges = [];
+  for (const index of interesting) {
+    const from = Math.max(0, index - CONTEXT);
+    const to = Math.min(script.length - 1, index + CONTEXT);
+    const last = ranges[ranges.length - 1];
+    if (last !== void 0 && from <= last.to + 1) last.to = Math.max(last.to, to);
+    else ranges.push({ from, to });
+  }
+  let existingLine = 0;
+  const startAt = /* @__PURE__ */ new Map();
+  script.forEach((line, index) => {
+    startAt.set(index, existingLine + 1);
+    if (line.kind !== "husk") existingLine += 1;
+  });
+  const hunks = ranges.slice(0, MAX_HUNKS).map((range) => ({
+    start: startAt.get(range.from) ?? 1,
+    lines: script.slice(range.from, range.to + 1).slice(0, MAX_HUNK_LINES)
+  }));
+  return { hunks, changed, omittedHunks: Math.max(0, ranges.length - MAX_HUNKS) };
+}
+var MARK = {
+  context: "  ",
+  yours: "- ",
+  husk: "+ "
+};
+function renderDiff(path, diff) {
+  const header = `${path}  (${String(diff.changed)} line${diff.changed === 1 ? "" : "s"} differ, - yours / + Husk)`;
+  const body = diff.hunks.map(
+    (hunk) => `  @@ line ${String(hunk.start)}
+` + hunk.lines.map((line) => `  ${MARK[line.kind]}${line.text}`).join("\n")
+  );
+  const tail = diff.omittedHunks > 0 ? [
+    `  ... and ${String(diff.omittedHunks)} further change${diff.omittedHunks === 1 ? "" : "s"} in this file`
+  ] : [];
+  return [header, ...body, ...tail].join("\n");
+}
+
+// src/cli/report.ts
+function renderPlan(outcome, options) {
+  const lines2 = [];
+  for (const move of outcome.moves) {
+    lines2.push(`  move    ${move.from} -> ${move.to}`);
+  }
+  for (const file of outcome.create) {
+    lines2.push(`  create  ${file.path}`);
+  }
+  for (const file of outcome.kept) {
+    lines2.push(`  keep    ${file.path} (already here, left alone)`);
+  }
+  if (outcome.unchanged.length > 0) {
+    lines2.push(
+      `  same    ${String(outcome.unchanged.length)} file(s) already match what Husk would write`
+    );
+  }
+  lines2.push("");
+  lines2.push(
+    `  admin route ${options.adminRoute}, project ${options.projectId}, media ${options.media ? "on" : "off"}, auth ${options.auth ? "on" : "off"}, emulators ${options.emulators ? "on" : "off"}`
+  );
+  return lines2.join("\n");
+}
+function renderConflicts(outcome) {
+  const lines2 = [
+    "Husk did not write anything.",
+    "",
+    `${String(outcome.conflicts.length + outcome.moveConflicts.length)} file(s) already exist here and differ from what init would write:`,
+    ""
+  ];
+  for (const conflict of outcome.conflicts) {
+    lines2.push(
+      renderDiff(conflict.path, diffFiles(conflict.existing, conflict.generated))
+    );
+    lines2.push("");
+  }
+  for (const path of outcome.moveConflicts) {
+    lines2.push(
+      `${path}  (init wanted to move your root layout here and something is already there)`
+    );
+    lines2.push("");
+  }
+  lines2.push("What to do, in order of how much you want to keep:");
+  lines2.push("");
+  lines2.push("  - Keep yours: nothing to do. Husk has changed nothing.");
+  lines2.push("  - Take Husk's for one file: delete that file and run init again.");
+  lines2.push("  - Take Husk's for all of them: run `npx nonext-husk init --force`.");
+  lines2.push("");
+  lines2.push("`--dry-run` lists everything init would write without writing any of it.");
+  return lines2.join("\n");
+}
+var MARK2 = {
+  ok: "  ok       ",
+  problem: "  PROBLEM  ",
+  unchecked: "  unchecked"
+};
+function renderChecks(checks) {
+  const lines2 = [];
+  for (const check of checks) {
+    lines2.push(`${MARK2[check.status]} ${check.name}`);
+    for (const line of check.detail.split("\n")) lines2.push(`             ${line}`);
+    if (check.fix !== void 0 && check.status !== "ok") {
+      lines2.push(`             -> ${check.fix}`);
+    }
+    lines2.push("");
+  }
+  const problems = checks.filter((check) => check.status === "problem").length;
+  const unchecked = checks.filter((check) => check.status === "unchecked").length;
+  lines2.push(
+    problems === 0 ? `Nothing wrong that this can see. ${String(unchecked)} thing(s) it cannot check from files alone are listed above.` : `${String(problems)} problem(s). ${String(unchecked)} thing(s) it cannot check from files alone are listed above.`
+  );
+  return lines2.join("\n");
+}
+function renderNextSteps(options) {
+  const steps = [];
+  if (options.emulators) {
+    steps.push("  1. npx firebase emulators:start --only auth,firestore,storage");
+    if (options.auth) {
+      steps.push("  2. node scripts/husk-first-admin.mjs you@example.com a-password");
+      steps.push("  3. npm run dev");
+      steps.push(`  4. open http://localhost:3000${options.adminRoute} and sign in`);
+    } else {
+      steps.push("  2. npm run dev");
+      steps.push(`  3. open http://localhost:3000${options.adminRoute}`);
+    }
+  } else {
+    steps.push(
+      "  1. npx firebase deploy --only firestore:rules,firestore:indexes" + (options.media ? ",storage" : "")
+    );
+    steps.push("  2. create the first admin account in your Firebase project");
+    steps.push("  3. npm run dev");
+    steps.push(`  4. open http://localhost:3000${options.adminRoute}`);
+  }
+  return [
+    "Next:",
+    "",
+    ...steps,
+    "",
+    "Content types live in cms.config.ts. Change one, then run `npx nonext-husk doctor`",
+    "to see whether firestore.indexes.json still covers the queries the list views make."
+  ].join("\n");
+}
+
+// src/cli/nonext-husk.ts
+var HERE = import.meta.dirname;
+var PACKAGE_ROOT = resolve(HERE, "..", "..");
+function packageVersion() {
+  try {
+    const manifest = JSON.parse(
+      readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8")
+    );
+    return typeof manifest.version === "string" ? manifest.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function out(text) {
+  process.stdout.write(`${text}
+`);
+}
+function fail(text) {
+  process.stderr.write(`${text}
+`);
+}
+async function initCommand(args) {
+  const root = resolve(args.cwd ?? process.cwd());
+  const fs = createNodeFs(root);
+  const project = inspectProject(fs);
+  const blocker = rootLayoutBlocker(project);
+  if (blocker !== null) {
+    fail(blocker);
+    return 1;
+  }
+  const options = await collectOptions(args);
+  const templates = createFileTemplates(join(HERE, "templates"));
+  const version = packageVersion();
+  const plan = buildPlan(fs, project, options, version, templates);
+  const outcome = classifyPlan(fs, plan);
+  if (args.dryRun) {
+    out(`Husk ${version} would write, in ${root}:
+`);
+    out(renderPlan(outcome, options));
+    if (outcome.conflicts.length > 0 || outcome.moveConflicts.length > 0) {
+      out("");
+      out(renderConflicts(outcome));
+      return 1;
+    }
+    return 0;
+  }
+  const blocked = outcome.conflicts.length > 0 || outcome.moveConflicts.length > 0;
+  if (blocked && !args.force) {
+    fail(renderConflicts(outcome));
+    return 1;
+  }
+  applyPlan(fs, outcome, args.force);
+  out(`Husk ${version} scaffolded into ${root}:
+`);
+  out(renderPlan(outcome, options));
+  out("");
+  out(renderNextSteps(options));
+  return 0;
+}
+async function collectOptions(args) {
+  if (args.yes) return optionsFromArgs(args);
+  const prompter = createReadlinePrompter();
+  try {
+    return await promptForOptions(prompter, args);
+  } finally {
+    prompter.close();
+  }
+}
+async function doctorCommand(args) {
+  const root = resolve(args.cwd ?? process.cwd());
+  const fs = createNodeFs(root);
+  const loaded = await loadHuskConfig(root);
+  const checks = runChecks({
+    fs,
+    templates: createFileTemplates(join(HERE, "templates")),
+    installedVersion: installedVersion(root, packageVersion()),
+    config: loaded.config,
+    contentTypes: loaded.contentTypes
+  });
+  out(`Husk doctor, in ${root}:
+`);
+  out(renderChecks(checks));
+  return exitCode(checks);
+}
+async function main(argv) {
+  let args;
+  try {
+    args = parseArgs(argv);
+  } catch (thrown) {
+    fail(thrown instanceof ArgumentError ? thrown.message : String(thrown));
+    fail("");
+    fail(HELP);
+    return 2;
+  }
+  try {
+    switch (args.command) {
+      case "init":
+        return await initCommand(args);
+      case "doctor":
+        return await doctorCommand(args);
+      case "version":
+        out(packageVersion());
+        return 0;
+      case "help":
+        out(HELP);
+        return 0;
+    }
+  } catch (thrown) {
+    if (thrown instanceof ProjectError || thrown instanceof ArgumentError) {
+      fail(thrown.message);
+      return 1;
+    }
+    throw thrown;
+  }
+}
+process.exitCode = await main(process.argv.slice(2));
+
+export { main };
+//# sourceMappingURL=nonext-husk.js.map
+//# sourceMappingURL=nonext-husk.js.map