@universalcms/connect 0.0.0-stage → 0.13.0

package/dist/angular-runtime.d.mts

@@ -0,0 +1,4 @@
+import type { NativeRuntimeOptions, NativePublicContext } from './svelte-runtime.mjs';
+export function createAngularRuntime(options: NativeRuntimeOptions): {
+  handle(request: Request, render: (context: NativePublicContext | null) => Promise<Response | null>): Promise<Response>;
+};

package/dist/angular-runtime.mjs

@@ -0,0 +1,7 @@
+/** Angular SSR composition; current public projection is request-local. */
+import {createAstroRuntime} from './astro-runtime.mjs';
+import {nativePublicContext,renderNativeResponse} from './svelte-runtime.mjs';
+export function createAngularRuntime(options){
+  const runtime=createAstroRuntime(options);
+  return {async handle(request,render){const context={request,locals:{}};return runtime.onRequest(context,async()=>{const cms=nativePublicContext(context.locals.universalcms);const response=await render(cms);if(!response)return new Response('Not found',{status:404,headers:{'Cache-Control':'no-store'}});return renderNativeResponse(response,cms,options.renderWebsite);});}};
+}

package/dist/angular-setup.mjs

@@ -0,0 +1,124 @@
+/** Bounded single native Angular root-page setup with an ordinary SSR build. */
+import path from 'node:path';
+import ts from './vendor/typescript.cjs';
+import {projectRoot,SetupError} from './core.mjs';
+import {contentDigest,readContentRegistry,readFrozenContent,validateContentRegistry,CONTENT_BINDINGS_FILE} from './content-registry.mjs';
+import {validatePublicationConfig} from './publication.mjs';
+import {WEBSITE_SECTIONS} from './website-http.mjs';
+import {svelteRead,svelteVersion,inspectSvelteAssets,supportsNativeNode} from './svelte-setup.mjs';
+import {transformNativeTemplate} from './svelte-template.mjs';
+const json=value=>JSON.stringify(value,null,2)+'\n',fail=message=>{throw new SetupError(`Angular automatic setup needs review: ${message}. Existing files were preserved.`);};
+export const ANGULAR_MANIFEST='.universalcms/angular.integration.json';
+import {readNativeChromeReview,reviewedNativeChrome,nativeChromeObservation} from './native-chrome-review.mjs';
+const inspections=new WeakMap();
+export const ANGULAR_DEFAULT_SERVER="import {\n  AngularNodeAppEngine,\n  createNodeRequestHandler,\n  isMainModule,\n  writeResponseToNodeResponse,\n} from '@angular/ssr/node';\nimport express from 'express';\nimport { join } from 'node:path';\n\nconst browserDistFolder = join(import.meta.dirname, '../browser');\n\nconst app = express();\nconst angularApp = new AngularNodeAppEngine();\n\n/**\n * Example Express Rest API endpoints can be defined here.\n * Uncomment and define endpoints as necessary.\n *\n * Example:\n * ```ts\n * app.get('/api/{*splat}', (req, res) => {\n *   // Handle API request\n * });\n * ```\n */\n\n/**\n * Serve static files from /browser\n */\napp.use(\n  express.static(browserDistFolder, {\n    maxAge: '1y',\n    index: false,\n    redirect: false,\n  }),\n);\n\n/**\n * Handle all other requests by rendering the Angular application.\n */\napp.use((req, res, next) => {\n  angularApp\n    .handle(req)\n    .then((response) =>\n      response ? writeResponseToNodeResponse(response, res) : next(),\n    )\n    .catch(next);\n});\n\n/**\n * Start the server if this module is the main entry point, or it is ran via PM2.\n * The server listens on the port defined by the `PORT` environment variable, or defaults to 4000.\n */\nif (isMainModule(import.meta.url) || process.env['pm_id']) {\n  const port = process.env['PORT'] || 4000;\n  app.listen(port, (error) => {\n    if (error) {\n      throw error;\n    }\n\n    console.log(`Node Express server listening on http://localhost:${port}`);\n  });\n}\n\n/**\n * Request handler used by the Angular CLI (for dev-server and during build) or Firebase Cloud Functions.\n */\nexport const reqHandler = createNodeRequestHandler(app);\n";
+function serverTokens(source){const scanner=ts.createScanner(ts.ScriptTarget.Latest,true,ts.LanguageVariant.Standard,source);const tokens=[];for(let token=scanner.scan();token!==ts.SyntaxKind.EndOfFileToken;token=scanner.scan())tokens.push([token,token===ts.SyntaxKind.StringLiteral?scanner.getTokenValue():scanner.getTokenText()]);return JSON.stringify(tokens.filter((item,index)=>!(item[0]===ts.SyntaxKind.CommaToken&&[ts.SyntaxKind.CloseBraceToken,ts.SyntaxKind.CloseBracketToken,ts.SyntaxKind.CloseParenToken].includes(tokens[index+1]?.[0]))));}
+
+function component(source,filename){const file=ts.createSourceFile(filename,source,ts.ScriptTarget.Latest,true,ts.ScriptKind.TS);if(file.parseDiagnostics.length)fail('component syntax');let klass,metadata;
+  for(const statement of file.statements){if(ts.isImportDeclaration(statement)){if(!ts.isStringLiteral(statement.moduleSpecifier)||statement.moduleSpecifier.text!=='@angular/core')fail('root component imports require explicit review');continue;}if(ts.isClassDeclaration(statement)){if(klass)fail('multiple component classes');klass=statement;for(const decorator of ts.getDecorators(statement)??[])if(ts.isCallExpression(decorator.expression)&&decorator.expression.expression.getText(file)==='Component'&&decorator.expression.arguments.length===1&&ts.isObjectLiteralExpression(decorator.expression.arguments[0]))metadata=decorator.expression.arguments[0];continue;}if(!ts.isEmptyStatement(statement))fail('executable module statements');}
+  if(!klass||!metadata||klass.members.some(member=>member.name?.getText(file)==='cms'))fail('custom component ownership');
+  const props=new Map();for(const member of metadata.properties){if(!ts.isPropertyAssignment(member)||!ts.isIdentifier(member.name)||props.has(member.name.text))fail('dynamic component metadata');props.set(member.name.text,member.initializer);}
+  if([...props.keys()].some(key=>!['selector','templateUrl','styleUrl','styleUrls','standalone','imports','changeDetection'].includes(key))||!ts.isStringLiteral(props.get('selector'))||props.get('selector').text!=='app-root'||!ts.isStringLiteral(props.get('templateUrl'))||!/^\.\/[a-z.-]+\.html$/.test(props.get('templateUrl').text))fail('literal root selector and external template required');
+  const imports=props.get('imports');if(imports&&(!ts.isArrayLiteralExpression(imports)||imports.elements.length))fail('custom child components or routes');
+  const metadataEnd=metadata.end-1,classStart=source.indexOf('{',klass.members.pos-1);if(classStart<0)fail('class source range');
+  let transformed=source.slice(0,classStart+1)+`\n  readonly cms=__cmsInject(UniversalCms);\n`+source.slice(classStart+1);
+  transformed=transformed.slice(0,metadataEnd)+`${metadata.properties.hasTrailingComma?'':','} schemas:[CUSTOM_ELEMENTS_SCHEMA]`+transformed.slice(metadataEnd);
+  transformed=`import { inject as __cmsInject, CUSTOM_ELEMENTS_SCHEMA } from '@angular/core';\nimport { UniversalCms } from './universalcms';\n`+transformed;
+  return{className:klass.name?.text,template:path.posix.join(path.posix.dirname(filename),props.get('templateUrl').text),transformed};
+}
+function inspectBootstrap(source,fileName,rootClass,componentFile,server){
+  if(typeof source!=='string'||!rootClass)fail('missing native bootstrap');
+  const file=ts.createSourceFile(fileName,source,ts.ScriptTarget.Latest,true,ts.ScriptKind.TS),imports=new Map(),body=[];
+  if(file.parseDiagnostics.length)fail('native bootstrap syntax');
+  const expected=new Map([['bootstrapApplication','@angular/platform-browser'],[rootClass,'./app/'+path.posix.basename(componentFile,'.ts')],[server?'config':'appConfig',server?'./app/app.config.server':'./app/app.config'],...(server?[['BootstrapContext','@angular/platform-browser']]:[])]);
+  for(const statement of file.statements){if(ts.isImportDeclaration(statement)){const clause=statement.importClause;if(!ts.isStringLiteral(statement.moduleSpecifier)||clause?.name||!clause?.namedBindings||!ts.isNamedImports(clause.namedBindings))fail('custom native bootstrap imports');for(const item of clause.namedBindings.elements){if(item.propertyName||imports.has(item.name.text)||expected.get(item.name.text)!==statement.moduleSpecifier.text)fail('custom native bootstrap imports');imports.set(item.name.text,statement.moduleSpecifier.text);}}else body.push(statement.getText(file));}
+  if(imports.size!==expected.size)fail('native bootstrap does not match the inspected root');
+  const call=`bootstrapApplication(${rootClass},${server?'config,context':'appConfig'})`;
+  const variants=server?[`const bootstrap=(context:BootstrapContext)=>${call};export default bootstrap;`,`export default (context:BootstrapContext)=>${call};`]:[`${call};`,`${call}.catch((err)=>console.error(err));`];
+  if(!variants.some(text=>serverTokens(text)===serverTokens(body.join('\n'))))fail('custom native bootstrap code');
+}
+export async function inspectAngularProject(directory){if(!supportsNativeNode('angular',process.versions.node))fail('Node.js 22.22.3+, 24.15+ or 26+ is required before setup');const root=await projectRoot(directory),manifest=JSON.parse(await svelteRead(root,'package.json')??'null'),deps={...manifest?.devDependencies,...manifest?.dependencies};
+  for(const name of ['@angular/core','@angular/common','@angular/compiler','@angular/compiler-cli','@angular/platform-browser','@angular/platform-server','@angular/router','@angular/ssr','@angular/build','@angular/cli']){if(!svelteVersion(deps[name],22,2,3))fail(`requires declared ${name} 22.2+`);const installed=JSON.parse(await svelteRead(root,`node_modules/${name}/package.json`)??'null');if(installed?.name!==name||!svelteVersion(installed.version,22,2,3))fail(`install compatible ${name}`);}
+  for(const [name,major,minor,patch]of [['express',5,1,0],['@types/express',5,0,1]]){const installed=JSON.parse(await svelteRead(root,`node_modules/${name}/package.json`)??'null');if(!svelteVersion(deps[name],major,minor,patch)||installed?.name!==name||!svelteVersion(installed.version,major,minor,patch))fail(`install compatible ${name}`);}
+  const typescript=JSON.parse(await svelteRead(root,'node_modules/typescript/package.json')??'null');if(!svelteVersion(deps.typescript,6,0,2)||!svelteVersion(typescript?.version,6,0,2)||!/^6\.0\./.test(typescript.version))fail('install compatible TypeScript 6.0.2');
+  if(manifest?.workspaces||['next','nuxt','astro','vue','svelte'].some(name=>deps[name]))fail('competing framework or workspace');
+  const angularText=await svelteRead(root,'angular.json'),angular=JSON.parse(angularText??'null');if(!angular||Object.keys(angular.projects??{}).length!==1)fail('one Angular application required');const [projectName,project]=Object.entries(angular.projects)[0],build=project.architect?.build;
+  if(project.projectType!=='application'||project.root!==''||project.sourceRoot!=='src'||build?.builder!=='@angular/build:application'||build.options?.browser!=='src/main.ts'||build.options?.server!=='src/main.server.ts'||build.options?.ssr?.entry!=='src/server.ts'||build.options?.outputMode==='static')fail('ordinary Angular Node SSR application required');
+  if(Object.keys(build.options).some(key=>!['browser','server','ssr','outputMode','polyfills','tsConfig','assets','styles','index','outputPath','inlineStyleLanguage'].includes(key))||Object.keys(build.options.ssr).some(key=>key!=='entry')||build.options.assets?.some(item=>typeof item!=='object'||item.glob!=='**/*'||!['public','public/'].includes(item.input)||item.output&&item.output!=='/'))fail('custom SSR build, asset or security options');
+  for(const configuration of Object.values(build.configurations??{}))if(Object.keys(configuration).some(key=>!['budgets','outputHashing','optimization','extractLicenses','sourceMap','namedChunks'].includes(key)))fail('custom build configurations');
+  const priorText=await svelteRead(root,ANGULAR_MANIFEST),prior=priorText?JSON.parse(priorText):null;let appFile;
+  for(const name of ['src/app/app.ts','src/app/app.component.ts'])if(await svelteRead(root,name)!==null){if(appFile)fail('multiple root components');appFile=name;}if(!appFile)fail('missing root component');
+  const current=await svelteRead(root,appFile),original=prior?.originalComponent??current,review=component(original,appFile);if(prior&&(prior.componentFile!==appFile||prior.componentHash!==contentDigest(original)||current!==review.transformed))fail('root component changed');
+  const routeSource=await svelteRead(root,'src/app/app.routes.ts');if(routeSource!==null&&!/^\s*import\s*\{\s*(?:type\s+)?Routes\s*\}\s*from\s*['"]@angular\/router['"];?\s*export\s+const\s+routes\s*:\s*Routes\s*=\s*\[\s*\];?\s*$/.test(routeSource))fail('only a single literal native root page is currently automatic; routed applications need reviewed mappings');
+  const observations=[];for(const file of ['src/main.ts','src/main.server.ts']){const content=await svelteRead(root,file);inspectBootstrap(content,file,review.className,appFile,file.endsWith('.server.ts'));observations.push({path:file,content,state:'unchanged'});}
+  const shell=await svelteRead(root,'src/index.html');if(build.options.index&&build.options.index!=='src/index.html'||!shell||/<script\b|\son\w+\s*=/i.test(shell)||!/^\s*<app-root>\s*<\/app-root>\s*$/.test(/<body\b[^>]*>([\s\S]*?)<\/body>/i.exec(shell)?.[1]??''))fail('custom native document shell');observations.push({path:'src/index.html',content:shell,state:'unchanged'});
+  await inspectSvelteAssets(root,'public');return{root,manifest,angular,angularText,projectName,appFile,current,original,review,prior,priorText,observations};
+}
+export async function inspectAngularSource(directory,{locale='en',websiteOrigin}={}){const project=await inspectAngularProject(directory),{root}=project,sourceFile=project.review.template,current=await svelteRead(root,sourceFile),registry=await readContentRegistry(root);
+  if(registry?.profile||registry&&registry.routes.length!==1||registry?.routes[0].sourceFile!==undefined&&registry.routes[0].sourceFile!==sourceFile)fail('content ownership belongs to another adapter');
+  const chromeReview=await readNativeChromeReview(root,'angular');
+  const installed=registry?.routes[0],original=installed?(await readFrozenContent(root,installed)).texts.original:current;
+  const allowNativeChrome=reviewedNativeChrome(chromeReview,sourceFile,original);
+  let extracted;
+  try {
+    extracted=await transformNativeTemplate({source:original,slug:'home',locale,websiteOrigin,framework:'angular',allowNativeChrome});
+  } catch(error) {
+    if(error instanceof SetupError)fail('automatic content binding requires a supported literal Angular template; review dynamic components, controls and content ownership before setup');
+    throw error;
+  }
+  extracted.source=`<universalcms-website [cms]="cms.payload">@if(cms.hasInventory){${extracted.source}}</universalcms-website>\n`;
+  if(installed&&(current!==extracted.source||installed.locale!==locale||installed.path!=='/'))fail('native page changed');
+  const routes=[{path:'/',kind:'page',slug:'home',locale}],entries=[extracted.entry],result={entries,routes,snapshot:{version:1,entries,inventories:{'/':extracted.inventory}},sourceFiles:[{path:sourceFile,sha256:contentDigest(current)},...(chromeReview?[{path:chromeReview.path,sha256:chromeReview.sha256}]:[])],diagnostics:{discoveredPages:1,automaticPages:1,skippedPages:0,unsupportedRoutes:0,warnings:[]}};
+  inspections.set(result,{root,chromeReview,sourceFile,current,original,installed,extracted,digest:contentDigest(json(result))});return result;
+}
+export async function planAngularContent(directory,configuration,inspection){const root=await projectRoot(directory),config=validatePublicationConfig(configuration);inspection??=await inspectAngularSource(root,{locale:config.routes[0]?.locale,websiteOrigin:config.websiteOrigin});const state=inspections.get(inspection);if(!state||state.root!==root||state.digest!==contentDigest(json(inspection))||json(config.routes)!==json(inspection.routes)||await svelteRead(root,state.sourceFile)!==state.current)fail('source/publication inspection changed');
+  const files=await nativeChromeObservation(root,state.chromeReview);let row=state.installed;
+  if(row){const frozen=await readFrozenContent(root,row);for(const name of ['source','native','original','inventory'])files.push({path:row[name+'File'],content:frozen.texts[name],state:'unchanged'});}
+  else {const token=contentDigest('/'+config.routes[0].locale).slice(0,20),originalFile=`.universalcms/content/${token}.original.txt`,nativeFile=`.universalcms/content/${token}.native.txt`,inventoryFile=`.universalcms/content/${token}.json`,source=state.extracted.source,inventory=json(state.extracted.inventory);for(const name of [originalFile,nativeFile,inventoryFile])if(await svelteRead(root,name)!==null)fail('frozen content collision');
+    row={...config.routes[0],sourceFile:state.sourceFile,originalFile,nativeFile,inventoryFile,sourceHash:contentDigest(source),nativeHash:contentDigest(source),originalHash:contentDigest(state.original),inventoryHash:contentDigest(inventory)};
+    files.push({path:originalFile,content:state.original,state:'create'},{path:nativeFile,content:source,state:'create'},{path:inventoryFile,content:inventory,state:'create'},{path:state.sourceFile,content:source,state:'update',previous:state.current});}
+  const registry=validateContentRegistry({version:1,routes:[row]}),text=json(registry),before=await svelteRead(root,CONTENT_BINDINGS_FILE);if(before!==null&&before!==text)fail('registry changed');files.push({path:CONTENT_BINDINGS_FILE,content:text,state:before===null?'create':'unchanged'});return{root,framework:'angular',files,routes:[row],entries:inspection.entries,snapshot:inspection.snapshot};
+}
+function service(){return `import { Injectable, inject, REQUEST_CONTEXT, TransferState, makeStateKey } from '@angular/core';\nimport { defineNativeWebsite } from '@universalcms/connect/native-website';\nconst key=makeStateKey<any>('universalcms-public-page');\n@Injectable({providedIn:'root'})\nexport class UniversalCms {\n private state=inject(TransferState);\n private context:any=inject(REQUEST_CONTEXT,{optional:true});\n private value:any=this.context??this.state.get(key,null);\n constructor(){if(this.context)this.state.set(key,this.context);if(typeof window!=='undefined')defineNativeWebsite();}\n get hasInventory(){return !!this.value?.publicInventory;}\n get payload(){const v=this.value;return v?{pathname:v.pathname,scope:v.scope,initialResult:v.result,initialSettings:v.settings,...(v.publicInventory?{inventory:v.publicInventory}:{})}:null;}\n binding(id:string):any{return this.value?.bindings?.[id]??null;}\n}\n`;}
+export async function planAngularIntegration(directory,{publication=false,sourceConfiguration}={}){const project=await inspectAngularProject(directory),{root,prior}=project;if(prior?.publication)publication=true;if(!publication)fail('source-only automatic setup is not supported; review full publication setup');
+  const server=`import { AngularNodeAppEngine, createNodeRequestHandler, createWebRequestFromNodeRequest, writeResponseToNodeResponse, isMainModule } from '@angular/ssr/node';\nimport express from 'express';\nimport { dirname, resolve } from 'node:path';\nimport { readFileSync } from 'node:fs';\nimport { createAngularRuntime } from '@universalcms/connect/angular-runtime';\nimport { renderNativeWebsite } from '@universalcms/connect/native-website-server';\nconst readConfiguration=(name:string)=>JSON.parse(readFileSync(resolve(process.cwd(),'.universalcms',name),'utf8'));\nconst configuration=readConfiguration('publication.config.json');\nconst sourceConfiguration=readConfiguration('source.config.json');\nconst contentBindings=readConfiguration('content.bindings.json');\nconst snapshot=readConfiguration('source.generated.json');\nconst app=express();const engine=new AngularNodeAppEngine();\nconst expected=new URL(sourceConfiguration.websiteOrigin);const assets=express.static(resolve(import.meta.dirname,'../browser'),{index:false,redirect:false,dotfiles:'deny'});\napp.use((req,res,next)=>{const url=new URL(req.originalUrl,expected);if(req.headers.host!==expected.host||url.origin!==expected.origin){res.status(400).end();return;}if(/\\.(?:js|mjs|css|map|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|pdf|txt|webmanifest|mp[34]|webm|ogg)$/.test(url.pathname)&&!/[\\\\%]/.test(url.pathname)&&!url.pathname.split('/').some(part=>part.startsWith('.')||/^(?:api|admin|private|internal|auth|login)$/.test(part))&&!['/robots.txt','/sitemap.xml'].includes(url.pathname)){assets(req,res,next);return;}next();});\nconst runtime=createAngularRuntime({configuration,sourceConfiguration,contentBindings,snapshot,sourceRoot:process.cwd(),renderWebsite:renderNativeWebsite});\napp.use(async(req,res,next)=>{try{const request=createWebRequestFromNodeRequest(req);const response=await runtime.handle(request,(cms)=>engine.handle(cms?new Request(new URL('/',request.url),{method:request.method,headers:request.headers}):request,cms));await writeResponseToNodeResponse(response,res);}catch{res.status(503).send('Website unavailable');}});\nexport const reqHandler=createNodeRequestHandler(app);\nif(isMainModule(import.meta.url)||process.env['UNIVERSALCMS_ANGULAR_START']==='1'){const port=Number(new URL(sourceConfiguration.websiteOrigin).port||(sourceConfiguration.websiteOrigin.startsWith('https:')?443:80));app.listen(port,'0.0.0.0');}\n`;
+  // Original server is replaced only after its ordinary generated shape is
+  // checked. Its bytes remain in the ownership manifest for review/recovery.
+  const serverBefore=await svelteRead(root,'src/server.ts'),serverOriginal=prior?.originalServer??serverBefore;
+  if(typeof serverOriginal!=='string'||serverTokens(serverOriginal)!==serverTokens(ANGULAR_DEFAULT_SERVER))fail('custom server entrypoint');
+  const serverRoutes=`import { RenderMode, ServerRoute } from '@angular/ssr';\nexport const serverRoutes: ServerRoute[] = [{ path:'**', renderMode:RenderMode.Server }];\n`;
+  const routesBefore=await svelteRead(root,'src/app/app.routes.server.ts'),routesOriginal=prior?.originalServerRoutes??routesBefore;
+  if(!routesOriginal||!/^\s*import\s*\{[^}]*\bRenderMode\b[^}]*\}\s*from\s*['"]@angular\/ssr['"];?\s*export\s+const\s+serverRoutes\s*:\s*ServerRoute\[\]\s*=\s*\[\s*\{\s*path\s*:\s*['"]\*\*['"]\s*,\s*renderMode\s*:\s*RenderMode\.(?:Prerender|Server)\s*,?\s*\}\s*,?\s*\];?\s*$/.test(routesOriginal))fail('custom server route modes');
+  const generated=[[project.appFile,project.review.transformed],['src/app/universalcms.ts',service()],['src/server.ts',server],['src/app/app.routes.server.ts',serverRoutes]];
+  const dev='node .universalcms/angular.dev.mjs';
+  const scripts={...project.manifest.scripts};if(scripts.build!=='ng build'||scripts.start!=='ng serve'&&scripts.start!=='node .universalcms/angular.serve.mjs'||scripts.dev&&scripts.dev!=='ng serve'&&scripts.dev!==dev)fail('ordinary Angular scripts required');scripts.dev=dev;scripts.start='node .universalcms/angular.serve.mjs';
+  for(const name of ['predev','prebuild','prestart']){if(scripts[name]&&scripts[name]!=='universalcms-connect sync-source')fail('custom lifecycle hooks');scripts[name]='universalcms-connect sync-source';}
+  const output=typeof project.angular.projects[project.projectName].architect.build.options.outputPath==='string'?project.angular.projects[project.projectName].architect.build.options.outputPath:`dist/${project.projectName}`;
+  if(!/^dist\/[a-z0-9-]+$/.test(output))fail('custom build output path');
+  generated.push(['.universalcms/angular.dev.mjs',`import {fileURLToPath} from 'node:url';\nimport {spawnSync} from 'node:child_process';\nprocess.chdir(fileURLToPath(new URL('../',import.meta.url)));\nconst result=spawnSync(process.execPath,['node_modules/@angular/cli/bin/ng.js','build'],{stdio:'inherit',env:process.env});\nif(result.error)throw result.error;\nif(result.status!==0)process.exit(result.status??1);\nawait import('./angular.serve.mjs');\n`]);
+  generated.push(['.universalcms/angular.serve.mjs',`import {fileURLToPath} from 'node:url';\nprocess.chdir(fileURLToPath(new URL('../',import.meta.url)));\nprocess.env.UNIVERSALCMS_ANGULAR_START='1';\nawait import(${JSON.stringify('../'+output+'/server/server.mjs')});\n`]);
+  const oldFiles=new Map((prior?.files??[]).map(row=>[row.path,row.sha256])),files=[];
+  for(const [file,content]of generated){const before=await svelteRead(root,file),known=[project.appFile,'src/server.ts','src/app/app.routes.server.ts'].includes(file);if(prior?before===null||contentDigest(before)!==oldFiles.get(file):before!==null&&!known)fail('runtime file ownership changed');files.push({path:file,content,state:before===content?'unchanged':before===null?'create':'update',...(before!==null&&before!==content?{previous:before}:{})});}
+  files.push({path:'angular.json',content:project.angularText,state:'unchanged'},...project.observations);
+  const packageBefore=await svelteRead(root,'package.json'),packageAfter=json({...project.manifest,scripts});files.push({path:'package.json',content:packageAfter,state:packageBefore===packageAfter?'unchanged':'update',previous:packageBefore});
+  const ownership={version:1,publication:true,componentFile:project.appFile,originalComponent:project.original,componentHash:contentDigest(project.original),originalServer:serverOriginal,originalServerRoutes:routesOriginal,angularHash:contentDigest(project.angularText),files:generated.map(([path,content])=>({path,sha256:contentDigest(content)}))};
+  if(prior&&prior.angularHash!==ownership.angularHash)fail('Angular build configuration changed');const text=json(ownership);files.push({path:ANGULAR_MANIFEST,content:text,state:project.priorText===text?'unchanged':project.priorText===null?'create':'update',...(project.priorText?{previous:project.priorText}:{})});return{root,framework:'angular',files,project};
+}
+export async function validateInstalledAngular(directory,configuration){
+  const plan=await planAngularIntegration(directory,{publication:true,sourceConfiguration:configuration});
+  if(plan.files.some(file=>file.state!=='unchanged'))fail('integration incomplete or changed');
+  const inspection=await inspectAngularSource(directory,{locale:configuration.routes[0]?.locale,websiteOrigin:configuration.websiteOrigin});
+  if(json(inspection.routes)!==json(configuration.routes)||await svelteRead(plan.root,'.universalcms/source.generated.json')!==json(inspection.snapshot))fail('published route or frozen source inventory changed');
+  const registry=await readContentRegistry(plan.root);if(!registry||registry.routes.length!==configuration.routes.length)fail('published-content bindings incomplete');
+  const content=await planAngularContent(directory,configuration,inspection);if(content.files.some(file=>file.state!=='unchanged'))fail('native content bindings incomplete');
+  plan.files.push(...content.files);return{...plan,config:configuration};
+}
+export async function planAngularSettings(directory,{config,source}){
+  const plan=await validateInstalledAngular(directory,config),name='.universalcms/website.integration.json';
+  const unique=new Map(plan.files.filter(file=>file.path!=='package.json').map(file=>[file.path,{path:file.path,sha256:contentDigest(file.content)}]));
+  const content=json({version:1,framework:'angular',siteId:config.siteId,environmentId:config.environmentId,apiOrigin:config.apiOrigin,websiteOrigin:config.websiteOrigin,adminOrigin:source.adminOrigin,sections:WEBSITE_SECTIONS,files:[...unique.values()]}),previous=await svelteRead(plan.root,name);
+  if(previous!==null&&previous!==content)fail('settings ownership or scope changed');
+  plan.files.push({path:name,content,state:previous===null?'create':'unchanged'});
+  for(const name of ['.universalcms/publication.config.json','.universalcms/source.config.json','.universalcms/source.generated.json'])plan.files.push({path:name,content:await svelteRead(plan.root,name),state:'unchanged'});
+  return{...plan,sections:[...WEBSITE_SECTIONS]};
+}

package/dist/astro-runtime.d.mts

@@ -0,0 +1,6 @@
+import type { PublicationConfiguration } from './publication.mjs';
+import type { WebsiteResult, WebsiteSnapshot, WebsiteMetadata } from './website-runtime.mjs';
+import type { Inventory } from './react-publication.mjs';
+export type AstroWebsiteContext = { pathname: string; scope: string; result: WebsiteResult; settings: WebsiteSnapshot; metadata: WebsiteMetadata; inventory?: Inventory; publicInventory?: Inventory };
+export function astroBound(context: AstroWebsiteContext, id: string, type: string): (Inventory['baseline']['blocks'][number] & { url?: string; alt?: string }) | null;
+export function createAstroRuntime(options: { configuration?: PublicationConfiguration; sourceConfiguration: unknown; contentBindings?: unknown; snapshot: unknown; sourceRoot: string; env?: Record<string, string | undefined> | (() => Record<string, string | undefined> | Promise<Record<string, string | undefined>>); fetcher?: typeof fetch }): { onRequest(context: { request: Request; locals: { universalcms?: AstroWebsiteContext; [key: string]: unknown } }, next: () => Promise<Response>): Promise<Response> };

package/dist/astro-runtime.mjs

@@ -0,0 +1,255 @@
+/** Astro Node middleware. Only validated public snapshots enter Astro.locals. */
+import { createSourceManifestProvider } from './vendor/source-manifest-provider.mjs';
+import { validateSourceConfiguration } from './source-config.mjs';
+import { createWebsiteRuntime, websiteMetadata } from './website-runtime.mjs';
+import { createWebsiteRequestHandler, websiteHtml } from './website-http.mjs';
+import { validatePublicationConfig, normalizePublicationPath, isExcludedPublicationPath, publicationErrorHtml, publicationRevision } from './publication.mjs';
+import { publicationVerification, verificationRequest, verificationBody, publicationRouteHeaders } from './publication-verification.mjs';
+import { PUBLICATION_STATUS_PATH, PUBLICATION_SCRIPT_PATH, createPublicationBrowserScript } from './publication-browser.mjs';
+import { readServerEnvironment } from './vite-publication.mjs';
+import { nativeChromeDescriptor } from './native-chrome-model.mjs';
+import { publicHref, experienceCopy } from './website-model.mjs';
+
+const responseHeaders = { 'Cache-Control': 'private, no-store, max-age=0', 'CDN-Cache-Control': 'no-store', 'Vercel-CDN-Cache-Control': 'no-store', 'Surrogate-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer' };
+const flatten = blocks => blocks.flatMap(block => [block, ...(block.type === 'section' && Array.isArray(block.data?.blocks) ? flatten(block.data.blocks) : block.type === 'columns' && Array.isArray(block.data?.columns) ? flatten(block.data.columns.flat()) : [])]);
+const escape = value => String(value ?? '').replace(/[&<>"']/g, char => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[char]));
+const fail = () => { throw Error('Astro CMS integration needs review.'); };
+const MAX_HTML_BYTES = 8 * 1024 * 1024;
+
+// Vite's reviewed dev server owns these paths, including colon-bearing virtual
+// module IDs. Validate their shape separately from public editorial URLs, only
+// after the exact website origin/Host check. Native Vite filesystem policy still
+// decides whether an @fs request can be served.
+function astroAssetPath(pathname) {
+  if (pathname.length > 4096 || /%(?![0-9a-f]{2})|%(?:2f|5c|2e|25|3f|23|0[0-9a-f]|1[0-9a-f]|7f)/i.test(pathname)) return false;
+  let path; try { path = decodeURIComponent(pathname); } catch { return false; }
+  if (!/^\/(?:@(?:id|fs|vite)\/|@react-refresh$|_astro\/|src\/|node_modules\/)/.test(path) || !/^[\p{L}\p{N}_./@:+ -]+$/u.test(path) || path.split('/').slice(1).some(part => !part || part === '.' || part === '..')) return false;
+  return true;
+}
+
+async function readHtml(response) {
+  const declared = response.headers.get('content-length');
+  if (!response.body || declared !== null && (!/^\d+$/.test(declared) || Number(declared) > MAX_HTML_BYTES)) { void response.body?.cancel().catch(() => {}); fail(); }
+  const reader = response.body.getReader(), decoder = new TextDecoder('utf-8', { fatal: true });
+  let bytes = 0, html = '', timer;
+  const deadline = new Promise((_, reject) => { timer = setTimeout(() => reject(Error('Astro rendering unavailable.')), 10_000); });
+  try {
+    for (;;) {
+      const chunk = await Promise.race([reader.read(), deadline]);
+      if (chunk.done) break;
+      if (!(chunk.value instanceof Uint8Array) || (bytes += chunk.value.byteLength) > MAX_HTML_BYTES) fail();
+      html += decoder.decode(chunk.value, { stream: true });
+    }
+    return html + decoder.decode();
+  } finally { clearTimeout(timer); void reader.cancel().catch(() => {}); reader.releaseLock(); }
+}
+
+/** Same-kind native slots retain their original layout. Changed kinds belong to
+ * the hydrated additional-content renderer; missing IDs never restore source. */
+export function astroBound(context, id, type) {
+  const entry = context?.result?.state === 'published' ? context.result.entry : null;
+  const baseline = context?.inventory?.baseline;
+  if (!entry || !baseline || typeof id !== 'string' || typeof type !== 'string') return null;
+  const original = flatten(baseline.blocks).find(block => block.id === id);
+  const block = flatten(entry.document.blocks).find(block => block.id === id);
+  if (!original || !block || original.type !== type || block.type !== type) return null;
+  let text = block.text;
+  if (block.text === original.text && id === context.inventory.titleBlockId && entry.document.title !== baseline.title) text = entry.document.title;
+  const excerptBlockId = context.inventory.excerptBlockId ?? baseline.blocks.find(candidate => candidate.type === 'paragraph')?.id;
+  if (block.text === original.text && id === excerptBlockId && entry.document.excerpt !== baseline.excerpt) text = entry.document.excerpt;
+  const data = { ...block.data };
+  if (type === 'image') {
+    data.url = publicHref(data.url, { relative: false });
+    data.link = publicHref(data.link);
+    if (!data.url) return null;
+    data.alt = typeof data.alt === 'string' ? data.alt.slice(0, 300) : '';
+  }
+  return { ...block, text, data, ...(type === 'image' ? { url: data.url, alt: data.alt } : {}) };
+}
+
+function sourceResponse(provider, request) {
+  let status = 404, headers = responseHeaders, body;
+  provider({ method: request.method, url: request.url, headers: Object.fromEntries(request.headers) }, {
+    writeHead(code, value) { status = code; headers = value; }, end(value) { body = value; },
+  });
+  return new Response(request.method === 'HEAD' || status === 204 ? null : body, { status, headers });
+}
+
+function validateSnapshot(snapshot, configuration) {
+  if (!snapshot || snapshot.version !== 1 || !Array.isArray(snapshot.entries) || !snapshot.inventories || typeof snapshot.inventories !== 'object' || Array.isArray(snapshot.inventories)) fail();
+  if (Object.keys(snapshot.inventories).length !== configuration.routes.length || snapshot.entries.length !== configuration.routes.length) fail();
+  for (const route of configuration.routes) {
+    const inventory = snapshot.inventories[route.path];
+    const entry = snapshot.entries.find(value => ['kind', 'slug', 'locale'].every(key => value[key] === route[key]));
+    if (!inventory || !entry || ['kind', 'slug', 'locale'].some(key => inventory.identity?.[key] !== route[key]) || JSON.stringify(entry.document) !== JSON.stringify(inventory.baseline) || !inventory.bindings || typeof inventory.bindings !== 'object' || Array.isArray(inventory.bindings)) fail();
+    const ids = new Set(flatten(inventory.baseline.blocks).map(block => block.id));
+    if (Object.values(inventory.bindings).some(slot => !Array.isArray(slot?.variants) || slot.variants.some(value => !ids.has(value.id) || !Array.isArray(value.values)))) fail();
+  }
+  return JSON.parse(JSON.stringify(snapshot));
+}
+
+// Astro serializes client:load props into HTML. The frozen source document is
+// server-only: the island needs only the IDs/types it must leave in native slots.
+function publicInventory(inventory, entry) {
+  const current = new Map(flatten(entry.document.blocks).map(block => [block.id, block.type]));
+  const original = new Map(flatten(inventory.baseline.blocks).map(block => [block.id, block.type]));
+  const bindings = Object.fromEntries(Object.entries(inventory.bindings).map(([name, slot]) => [name, { variants: slot.variants.filter(value => current.has(value.id) && current.get(value.id) === original.get(value.id)).map(value => ({ id: value.id, values: [] })) }]).filter(([, slot]) => slot.variants.length));
+  const ids = new Set(Object.values(bindings).flatMap(slot => slot.variants.map(value => value.id)));
+  return { identity: { ...inventory.identity }, baseline: { schemaVersion: 1, title: '', excerpt: '', blocks: [...ids].map(id => ({ id, version: 1, type: original.get(id), text: '' })) }, bindings, ...(inventory.nativeChrome ? {nativeChrome:nativeChromeDescriptor(inventory.nativeChrome)} : {}) };
+}
+
+/** A settings read and a page read share immutable upstream responses within
+ * this request only. No credential, authorization or publication cache survives it. */
+function requestFetcher(fetcher) {
+  const responses = new Map();
+  let bytes = 0;
+  const buffer = async (input, init) => {
+    const response = await fetcher(input, init);
+    if (!(response instanceof Response) || response.redirected || ['opaque', 'opaqueredirect'].includes(response.type) || response.url && response.url !== String(input)) { void response?.body?.cancel?.().catch(() => {}); fail(); }
+    const options = { status: response.status, statusText: response.statusText, headers: new Headers(response.headers) };
+    // Failed reads need only their status. Never retain an upstream error body.
+    if (response.status !== 200) { void response.body?.cancel().catch(() => {}); return { body: null, options }; }
+    const declared = response.headers.get('content-length');
+    if (init.signal?.aborted || !response.body || declared !== null && (!/^\d+$/.test(declared) || Number(declared) > MAX_HTML_BYTES - bytes)) { void response.body?.cancel().catch(() => {}); fail(); }
+    const reader = response.body.getReader(), chunks = [];
+    let length = 0;
+    try {
+      for (;;) {
+        const chunk = await new Promise((resolve, reject) => {
+          const aborted = () => reject(Error('Astro configuration unavailable.'));
+          init.signal?.addEventListener('abort', aborted, { once: true });
+          if (init.signal?.aborted) aborted();
+          reader.read().then(value => { init.signal?.removeEventListener('abort', aborted); resolve(value); }, error => { init.signal?.removeEventListener('abort', aborted); reject(error); });
+        });
+        if (init.signal?.aborted) fail();
+        if (chunk.done) break;
+        if (!(chunk.value instanceof Uint8Array) || (bytes += chunk.value.byteLength) > MAX_HTML_BYTES) fail();
+        length += chunk.value.byteLength; chunks.push(chunk.value);
+      }
+    } finally { void reader.cancel().catch(() => {}); reader.releaseLock(); }
+    const body = new Uint8Array(length); let offset = 0;
+    for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
+    return { body, options };
+  };
+  return async (input, init) => {
+    const key = String(input);
+    let pending = responses.get(key);
+    if (!pending) { pending = buffer(input, init); responses.set(key, pending); }
+    // Runtime operations abort their own signal when complete. Fresh Responses
+    // from fully consumed bytes are independent of that now-aborted transport.
+    const saved = await pending;
+    return new Response(saved.body, saved.options);
+  };
+}
+
+export function createAstroRuntime({ configuration, sourceConfiguration, contentBindings, snapshot, sourceRoot, env, fetcher = globalThis.fetch } = {}) {
+  if (configuration === undefined) {
+    const source = validateSourceConfiguration(sourceConfiguration);
+    const provider = createSourceManifestProvider({ siteId: source.siteId, environmentId: source.environmentId, sourceOrigin: source.websiteOrigin, adminOrigin: source.adminOrigin, publicContent: true, manifestJson: JSON.stringify({ version: 1, entries: snapshot?.entries }) });
+    return { async onRequest(context, next) {
+      const request = context.request;
+      let url; try { url = new URL(request.url); } catch { return new Response(null, { status: 400 }); }
+      if (url.pathname !== '/api/cms-source') return next();
+      const response = sourceResponse(provider, request);
+      if (!source.exportClosed || response.status !== 200) return response;
+      const headers = new Headers(response.headers); headers.delete('Content-Length'); headers.delete('ETag');
+      return new Response(request.method === 'HEAD' ? null : JSON.stringify({ version: 1, siteId: source.siteId, environmentId: source.environmentId, sourceExport: 'closed' }), { status: 410, headers });
+    } };
+  }
+  const config = validatePublicationConfig(configuration), source = validateSourceConfiguration(sourceConfiguration);
+  const verification = publicationVerification(config, source, contentBindings);
+  if (!verification?.body.contentBindings || typeof sourceRoot !== 'string' || !sourceRoot) fail();
+  const frozen = validateSnapshot(snapshot, config);
+  const provider = createSourceManifestProvider({ siteId: config.siteId, environmentId: config.environmentId, sourceOrigin: config.websiteOrigin, adminOrigin: source.adminOrigin, publicContent: true, manifestJson: JSON.stringify({ version: 1, entries: frozen.entries }) });
+  const script = createPublicationBrowserScript(config), website = new URL(config.websiteOrigin);
+  const scope = `${config.siteId}:${config.environmentId}`;
+  let active = 0;
+  const reply = (request, body, status = 200, type = 'application/json', extra = {}) => new Response(request.method === 'HEAD' || status === 204 ? null : typeof body === 'string' ? body : JSON.stringify(body), { status, headers: { ...responseHeaders, 'Content-Type': type, ...extra } });
+  return { async onRequest(context, next) {
+    const request = context.request;
+    let url, pathname;
+    try {
+      url = new URL(request.url);
+      if (url.origin !== config.websiteOrigin || request.headers.get('host') && request.headers.get('host') !== website.host || url.username || url.password || url.hash) return reply(request, { error: 'Website origin mismatch' }, 403);
+      if (astroAssetPath(url.pathname) && url.search.length <= 4096 && ['GET', 'HEAD'].includes(request.method)) return next();
+      pathname = normalizePublicationPath(url.pathname);
+      if (url.pathname.includes('%')) return reply(request, publicationErrorHtml(404), 404, 'text/html; charset=utf-8');
+    } catch { return reply(request, publicationErrorHtml(404), 404, 'text/html; charset=utf-8'); }
+    if (url.pathname === '/api/cms-source') {
+      const response = sourceResponse(provider, request);
+      if (response.status !== 200 || !source.exportClosed) return response;
+      const headers = new Headers(response.headers); headers.delete('Content-Length'); headers.delete('ETag');
+      return new Response(request.method === 'HEAD' ? null : JSON.stringify({ version: 1, siteId: config.siteId, environmentId: config.environmentId, sourceExport: 'closed' }), { status: 410, headers });
+    }
+    if (url.pathname === PUBLICATION_SCRIPT_PATH) {
+      if (!['GET', 'HEAD'].includes(request.method) || url.search || request.headers.get('sec-fetch-site') === 'cross-site' || request.headers.get('origin') && request.headers.get('origin') !== config.websiteOrigin) return reply(request, { error: 'Request not allowed' }, 403);
+      return reply(request, script, 200, 'text/javascript; charset=utf-8');
+    }
+    const endpoint = ['/api/universalcms/settings', '/api/universalcms/page', '/api/universalcms/document', '/sitemap.xml', '/robots.txt'].includes(url.pathname);
+    if (!endpoint && url.pathname !== PUBLICATION_STATUS_PATH && isExcludedPublicationPath(pathname)) return next();
+    if (active >= 16) return reply(request, endpoint || url.pathname === PUBLICATION_STATUS_PATH ? { state: 'unavailable' } : publicationErrorHtml(503), 503, endpoint || url.pathname === PUBLICATION_STATUS_PATH ? 'application/json' : 'text/html; charset=utf-8');
+    active++;
+    try {
+      // Read private environment once, before composing either public projection.
+      const values = { ...(typeof env === 'function' ? await env() : env ?? await readServerEnvironment(sourceRoot)) };
+      const fetch = requestFetcher(fetcher);
+      const runtime = createWebsiteRuntime({ configuration: config, env: values, fetcher: fetch, nativePaths: verification.nativePaths, nativePatterns: verification.nativePatterns });
+      if (url.pathname === '/api/universalcms/document') {
+        if (!['GET', 'HEAD'].includes(request.method) || request.headers.get('sec-fetch-site') === 'cross-site' || request.headers.get('origin') && request.headers.get('origin') !== config.websiteOrigin) return reply(request, { error: 'Request not allowed' }, 403);
+        if (url.searchParams.size !== 1 || url.searchParams.getAll('path').length !== 1) return reply(request, { error: 'Invalid page request' }, 400);
+        let path; try { path = normalizePublicationPath(url.searchParams.get('path')); } catch { return reply(request, { error: 'Invalid page request' }, 400); }
+        const result = await runtime.page(path);
+        return result.state === 'published' ? reply(request, { ...result, revision: publicationRevision(result.entry) }) : reply(request, { state: result.state === 'unavailable' ? 'unavailable' : 'missing' }, result.state === 'unavailable' ? 503 : 404);
+      }
+      if (endpoint) {
+        const handler = createWebsiteRequestHandler({ configuration: config, sourceConfiguration: source, contentBindings, env: values, fetcher: fetch });
+        return await handler(request) ?? reply(request, { state: 'missing' }, 404);
+      }
+      if (url.pathname === PUBLICATION_STATUS_PATH) {
+        const probe = verificationRequest({ configuration: config, verification, url, method: request.method, headers: request.headers });
+        if (probe?.status) return reply(request, probe.status === 204 ? null : { error: 'Publication check unavailable' }, probe.status, 'application/json', probe.headers);
+        if (!probe && (!['GET', 'HEAD'].includes(request.method) || request.headers.get('sec-fetch-site') === 'cross-site' || request.headers.get('origin') && request.headers.get('origin') !== config.websiteOrigin)) return reply(request, { error: 'Request not allowed' }, 403);
+        if (!probe && (url.searchParams.size !== 1 || url.searchParams.getAll('path').length !== 1)) return reply(request, { error: 'Invalid publication request' }, 400);
+        let path; try { path = probe?.pathname ?? normalizePublicationPath(url.searchParams.get('path')); } catch { return reply(request, { error: 'Invalid publication request' }, 400); }
+        if (!config.routes.some(route => route.path === path)) return reply(request, { state: 'missing' }, 404);
+        const result = await runtime.page(path);
+        if (probe) {
+          const probeHeaders = { ...probe.headers, ...(result.reason ? { 'X-UniversalCMS-Delivery-Status': result.reason } : {}) };
+          return reply(request, verificationBody(verification, path, result), result.state === 'unavailable' ? 503 : 200, 'application/json', probeHeaders);
+        }
+        const extraHeaders = result.reason ? { 'X-UniversalCMS-Delivery-Status': result.reason } : {};
+        return reply(request, { state: result.state === 'published' ? 'published' : result.state === 'unavailable' ? 'unavailable' : 'missing', ...(result.state === 'published' && request.headers.get('x-universalcms-include-revision') === '1' ? { revision: publicationRevision(result.entry) } : {}) }, result.state === 'published' ? 200 : result.state === 'unavailable' ? 503 : 404, 'application/json', extraHeaders);
+      }
+      if (!['GET', 'HEAD'].includes(request.method)) return reply(request, { error: 'Method not allowed' }, 405, 'application/json', { Allow: 'GET, HEAD' });
+      const path = pathname === '/index.html' && config.routes.some(route => route.path === '/') ? '/' : pathname;
+      const result = await runtime.page(path);
+      if (result.state === 'unmanaged') return next();
+      if (result.state === 'redirect') return reply(request, '', result.status, 'text/plain', { Location: new URL(result.location, config.websiteOrigin).href });
+      if (result.state === 'gone') return reply(request, 'This page is no longer available.', 410, 'text/plain', { 'X-Robots-Tag': 'noindex' });
+      const settings = await runtime.settings();
+      const routeHeaders = config.routes.some(route => route.path === path) ? publicationRouteHeaders(config, path, result, verification, request.headers.get('origin'), request.headers.has('authorization') || request.headers.has('cookie')) : {};
+      if (settings.state === 'unavailable' || result.state === 'unavailable') return reply(request, publicationErrorHtml(503), 503, 'text/html; charset=utf-8', { ...routeHeaders, 'X-Robots-Tag': 'noindex', 'Retry-After': '30' });
+      if (!['published', 'archive'].includes(result.state)) {
+        const copy = experienceCopy(settings, source.locale), href = publicHref(copy?.notFoundAction?.url);
+        const body = copy ? `<!doctype html><html><head><title>${escape(copy.notFoundTitle || 'Page not found')}</title><meta name="robots" content="noindex,nofollow"></head><body><main><h1>${escape(copy.notFoundTitle || 'Page not found')}</h1><p>${escape(copy.notFoundMessage)}</p>${href ? `<a href="${escape(href)}">${escape(copy.notFoundAction.label)}</a>` : ''}</main></body></html>` : publicationErrorHtml(404);
+        return reply(request, body, 404, 'text/html; charset=utf-8', { ...routeHeaders, 'X-Robots-Tag': 'noindex' });
+      }
+      const editorial = result.state === 'published' ? result.entry : { document: { title: result.title, excerpt: result.description } };
+      const metadata = websiteMetadata(editorial, settings, path, config.websiteOrigin);
+      context.locals.universalcms = { pathname: path, scope, result, settings, metadata, ...(frozen.inventories[path] ? { inventory: frozen.inventories[path], publicInventory: publicInventory(frozen.inventories[path], result.entry) } : {}) };
+      const response = await next();
+      if (!(response instanceof Response) || response.status !== 200 || !response.headers.get('content-type')?.includes('text/html')) return reply(request, publicationErrorHtml(503), 503, 'text/html; charset=utf-8', { 'X-Robots-Tag': 'noindex' });
+      const headers = new Headers(response.headers); headers.delete('Content-Length'); headers.delete('ETag');
+      for (const [name, value] of Object.entries({ ...responseHeaders, ...routeHeaders })) headers.set(name, value);
+      if (request.method === 'HEAD') { void response.body?.cancel().catch(() => {}); return new Response(null, { status: 200, headers }); }
+      const html = await readHtml(response);
+      if (!/<head\b[^>]*>[\s\S]*?<\/head>/i.test(html)) fail();
+      const seo = settings.sections.seo.state === 'ready';
+      let body = websiteHtml(html, seo || !frozen.inventories[path] ? metadata : null, { seo, branding: settings.sections.branding.state === 'ready' ? settings.sections.branding.data : undefined });
+      // The blocking guard must run before hydrating the static native children.
+      body = body.replace(/<head\b[^>]*>/i, match => `${match}<script src="${PUBLICATION_SCRIPT_PATH}"></script>`);
+      return new Response(request.method === 'HEAD' ? null : body, { status: 200, headers });
+    } catch { return reply(request, endpoint || url.pathname === PUBLICATION_STATUS_PATH ? { state: 'unavailable' } : publicationErrorHtml(503), 503, endpoint || url.pathname === PUBLICATION_STATUS_PATH ? 'application/json' : 'text/html; charset=utf-8', { 'X-Robots-Tag': 'noindex' }); }
+    finally { active--; }
+  } };
+}