@universalcms/connect 0.0.0-stage → 0.13.0

package/dist/svelte-setup.mjs

@@ -0,0 +1,135 @@
+/** Bounded SvelteKit Node setup. Reads literal public project evidence only. */
+import path from 'node:path';
+import {lstat,readdir,realpath} from 'node:fs/promises';
+import ts from './vendor/typescript.cjs';
+import {projectRoot,readProjectFile,SetupError} from './core.mjs';
+import {contentDigest,readContentRegistry,readFrozenContent,validateContentRegistry,CONTENT_BINDINGS_FILE} from './content-registry.mjs';
+import {validatePublicationConfig,isExcludedPublicationPath} from './publication.mjs';
+import {WEBSITE_SECTIONS} from './website-http.mjs';
+import {transformNativeTemplate} from './svelte-template.mjs';
+export const SVELTE_MANIFEST='.universalcms/svelte.integration.json';
+const json=value=>JSON.stringify(value,null,2)+'\n', fail=message=>{throw new SetupError(`SvelteKit automatic setup needs review: ${message}. Existing files were preserved.`);};
+import {readNativeChromeReview,reviewedNativeChrome,nativeChromeObservation} from './native-chrome-review.mjs';
+const inspections=new WeakMap();
+export async function svelteRead(root,file){const text=await readProjectFile(root,file);if(text!==null&&(await lstat(path.join(root,file))).nlink!==1)fail('linked files');return text;}
+export function supportsNativeNode(framework,version){const m=/^(\d+)\.(\d+)\.(\d+)$/.exec(version??'');if(!m)return false;const [,major,minor,patch]=m.map(Number);return framework==='angular'?major>=26||major===24&&minor>=15||major===22&&(minor>22||minor===22&&patch>=3):framework==='svelte'&&(major>22||major===22&&minor>=17);}
+export function svelteVersion(value,major,minor=0,patch=0){const m=typeof value==='string'&&/^[~^]?(\d+)\.(\d+)\.(\d+)$/.exec(value);return !!m&&+m[1]===major&&(+m[2]>minor||+m[2]===minor&&+m[3]>=patch);}
+export async function inspectSvelteAssets(root,directory='static') {
+  let count=0;const walk=async(relative,depth=0)=>{let stat;try{stat=await lstat(path.join(root,relative));}catch(e){if(e.code==='ENOENT')return;throw e;}
+    if(depth>12||stat.isSymbolicLink()||!stat.isDirectory()||await realpath(path.join(root,relative))!==path.join(root,relative))fail('static assets have unsafe ownership');
+    for(const item of await readdir(path.join(root,relative),{withFileTypes:true})){if(++count>5000||item.isSymbolicLink()||!/^[-a-zA-Z0-9_.]+$/.test(item.name)||item.name.startsWith('.')||/^(?:api|admin|private|internal|login|auth|robots\.txt|sitemap\.xml|.*(?:secret|credential|\.env).*)$/i.test(item.name))fail('static assets could shadow private or CMS routes');const filename=relative+'/'+item.name;if(item.isDirectory())await walk(filename,depth+1);else{const info=await lstat(path.join(root,filename));if(!info.isFile()||info.nlink!==1||! /\.(?:css|js|mjs|map|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|pdf|txt|webmanifest|mp[34]|webm|ogg)$/i.test(item.name))fail('static HTML, extensionless or non-asset files');}}
+  };await walk(directory);
+}
+function configReview(source,filename) {
+  if(typeof source!=='string')fail('missing Vite configuration');
+  const file=ts.createSourceFile(filename,source,ts.ScriptTarget.Latest,true,ts.ScriptKind.TS);if(file.parseDiagnostics.length)fail('configuration syntax');
+  const imports=new Map();let config;
+  for(const statement of file.statements){
+    if(ts.isImportDeclaration(statement)&&ts.isStringLiteral(statement.moduleSpecifier)){
+      const module=statement.moduleSpecifier.text,clause=statement.importClause;
+      if(['@sveltejs/adapter-node','@sveltejs/adapter-auto'].includes(module)&&clause?.name&&!clause.namedBindings)imports.set(clause.name.text,'adapter');
+      else if(['vite','@sveltejs/kit/vite'].includes(module)&&!clause?.name&&clause?.namedBindings&&ts.isNamedImports(clause.namedBindings)&&clause.namedBindings.elements.length===1){const item=clause.namedBindings.elements[0],expected=module==='vite'?'defineConfig':'sveltekit';if((item.propertyName?.text??item.name.text)!==expected)fail('custom configuration import');imports.set(item.name.text,expected);}
+      else fail('custom configuration import');continue;
+    }
+    if(ts.isExportAssignment(statement)&&ts.isCallExpression(statement.expression)&&imports.get(statement.expression.expression.getText(file))==='defineConfig'&&statement.expression.arguments.length===1){config=statement.expression.arguments[0];continue;}
+    if(!ts.isEmptyStatement(statement))fail('custom configuration code');
+  }
+  if(!config||!ts.isObjectLiteralExpression(config)||config.properties.length!==1)fail('custom Vite configuration');
+  const plugins=config.properties[0];if(!ts.isPropertyAssignment(plugins)||plugins.name.getText(file)!=='plugins'||!ts.isArrayLiteralExpression(plugins.initializer)||plugins.initializer.elements.length!==1)fail('custom Vite plugins');
+  const kit=plugins.initializer.elements[0];if(!ts.isCallExpression(kit)||imports.get(kit.expression.getText(file))!=='sveltekit'||kit.arguments.length!==1||!ts.isObjectLiteralExpression(kit.arguments[0])||kit.arguments[0].properties.length!==1)fail('custom Kit options');
+  const adapter=kit.arguments[0].properties[0];if(!ts.isPropertyAssignment(adapter)||adapter.name.getText(file)!=='adapter'||!ts.isCallExpression(adapter.initializer)||imports.get(adapter.initializer.expression.getText(file))!=='adapter'||adapter.initializer.arguments.length)fail('ordinary Node adapter required');
+}
+export async function inspectSvelteProject(directory){
+  if(!supportsNativeNode('svelte',process.versions.node))fail('Node.js 22.17 or newer is required before setup');
+  const root=await projectRoot(directory),manifest=JSON.parse(await svelteRead(root,'package.json')??'null'),deps={...manifest?.devDependencies,...manifest?.dependencies};
+  for(const [name,major,minor,patch=0] of [['@sveltejs/kit',3,1],['svelte',5,57,1],['@sveltejs/adapter-node',6,0],['@sveltejs/vite-plugin-svelte',7,3],['vite',8,0,12],['typescript',6,0,2]]){
+    if(!svelteVersion(deps[name],major,minor,patch))fail(`requires declared ${name} ${major}.${minor}+`);
+    const installed=JSON.parse(await svelteRead(root,`node_modules/${name}/package.json`)??'null');if(installed?.name!==name||!svelteVersion(installed.version,major,minor,patch))fail(`install compatible ${name}`);
+  }
+  if(manifest.workspaces||['next','nuxt','astro','@angular/core','vue'].some(name=>deps[name]))fail('competing frameworks or workspace');
+  const config='';
+  for(const name of ['svelte.config.js','svelte.config.ts','svelte.config.mjs','svelte.config.cjs','src/hooks.js','src/hooks.ts','src/hooks.client.js','src/hooks.client.ts','src/hooks.server.ts','src/service-worker.js','src/service-worker.ts'])if(await svelteRead(root,name)!==null)fail('custom hooks or alternative configuration');
+  let viteFile=null,viteSource=null;for(const name of ['vite.config.js','vite.config.ts']){const text=await svelteRead(root,name);if(text!==null){if(viteFile)fail('multiple Vite configurations');viteFile=name;viteSource=text;}}
+  configReview(viteSource,viteFile);
+  await inspectSvelteAssets(root);
+  return {root,manifest,config,configFile:viteFile,viteFile,viteSource};
+}
+async function routes(root){const ownershipText=await svelteRead(root,SVELTE_MANIFEST),ownership=ownershipText?JSON.parse(ownershipText):null;const rows=[];let count=0;const walk=async(directory,segments=[])=>{const stat=await lstat(path.join(root,directory));if(stat.isSymbolicLink()||!stat.isDirectory()||await realpath(path.join(root,directory))!==path.join(root,directory))fail('linked route directory');for(const item of (await readdir(path.join(root,directory),{withFileTypes:true})).sort((a,b)=>a.name.localeCompare(b.name))){if(++count>1000||segments.length>10||item.isSymbolicLink())fail('route inventory budget or linked route');const filename=directory+'/'+item.name;
+    if(item.isDirectory()){if(item.name==='[...cmsPath]'){if(segments.length||!ownership?.publication)fail('unowned CMS catch-all route');const children=await readdir(path.join(root,filename),{withFileTypes:true});if(children.length!==2||children.some(child=>!child.isFile()||!['+page.svelte','+page.server.js'].includes(child.name)))fail('custom CMS catch-all files');for(const child of children){const file=filename+'/'+child.name,expected=ownership.files?.find(row=>row.path===file);if(!expected||contentDigest(await svelteRead(root,file))!==expected.sha256)fail('changed CMS catch-all');}continue;}if(!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(item.name)||isExcludedPublicationPath('/'+item.name))fail('dynamic/private route');await walk(filename,[...segments,item.name]);}
+    else if(item.name==='+page.svelte')rows.push({path:'/'+segments.join('/'),kind:'page',slug:segments.length?segments.join('/'):'home',sourceFile:filename});
+    else if(item.name!=='+page.server.js')fail('custom server/layout route');
+  }};await walk('src/routes');if(!rows.length||rows.some(r=>r.path==='/home')&&rows.some(r=>r.path==='/'))fail('missing or duplicate home identity');return rows;}
+function pageTemplate(content){return `<script>\nimport { onMount } from 'svelte';\nimport { defineNativeWebsite } from '@universalcms/connect/native-website';\nlet { data } = $props();\nlet host;\nonMount(() => { defineNativeWebsite(); const cms=data.universalcms; host.cms={pathname:cms.pathname,scope:cms.scope,initialResult:cms.result,initialSettings:cms.settings,...(cms.publicInventory?{inventory:cms.publicInventory}:{})}; });\n</script>\n<universalcms-website bind:this={host}>${content}</universalcms-website>\n`;}
+export async function inspectSvelteSource(directory,{locale='en',websiteOrigin}={}){
+  const root=await projectRoot(directory),list=await routes(root),registry=await readContentRegistry(root),prepared=[],entries=[],inventories={};
+  const chromeReview=await readNativeChromeReview(root,'svelte');
+  if(registry?.profile||registry?.routes.some(row=>!row.sourceFile.endsWith('.svelte')))fail('existing content belongs to another adapter');
+  for(const route of list){const current=await svelteRead(root,route.sourceFile),installed=registry?.routes.find(row=>row.path===route.path),original=installed?(await readFrozenContent(root,installed)).texts.original:current;
+    const allowNativeChrome=reviewedNativeChrome(chromeReview,route.sourceFile,original);
+    let extracted;
+    try {
+      extracted=await transformNativeTemplate({source:original,slug:route.slug,locale,websiteOrigin,framework:'svelte',allowNativeChrome});
+    } catch(error) {
+      if(error instanceof SetupError)fail('automatic content binding requires a supported literal Svelte template; review dynamic components, controls and content ownership before setup');
+      throw error;
+    }
+    extracted.source = pageTemplate(extracted.source);
+    if(installed&&(installed.sourceFile!==route.sourceFile||installed.locale!==locale||current!==extracted.source))fail('changed native content ownership');
+    prepared.push({...route,locale,current,original,installed,extracted});entries.push(extracted.entry);inventories[route.path]=extracted.inventory;
+  }
+  if(registry&&registry.routes.length!==list.length)fail('removed installed route');
+  const result={entries,routes:prepared.map(({path,kind,slug,locale})=>({path,kind,slug,locale})),snapshot:{version:1,entries,inventories},sourceFiles:[...prepared.map(row=>({path:row.sourceFile,sha256:contentDigest(row.current)})),...(chromeReview?[{path:chromeReview.path,sha256:chromeReview.sha256}]:[])],diagnostics:{discoveredPages:list.length,automaticPages:list.length,skippedPages:0,unsupportedRoutes:0,warnings:[]}};
+  inspections.set(result,{root,prepared,chromeReview,digest:contentDigest(json(result))});return result;
+}
+export async function planSvelteContent(directory,configuration,inspection){
+  const root=await projectRoot(directory),config=validatePublicationConfig(configuration);inspection??=await inspectSvelteSource(root,{locale:config.routes[0]?.locale,websiteOrigin:config.websiteOrigin});const state=inspections.get(inspection);
+  if(!state||state.root!==root||state.digest!==contentDigest(json(inspection))||json(inspection.routes)!==json(config.routes))fail('source/publication inspection changed');
+  const files=await nativeChromeObservation(root,state.chromeReview),rows=[];for(const item of state.prepared){if(await svelteRead(root,item.sourceFile)!==item.current)fail('source changed after inspection');
+    if(item.installed){const frozen=await readFrozenContent(root,item.installed);for(const name of ['original','native','inventory','source'])files.push({path:item.installed[name+'File'],content:frozen.texts[name],state:'unchanged'});rows.push(item.installed);continue;}
+    const token=contentDigest(item.path+item.locale).slice(0,20),originalFile=`.universalcms/content/${token}.original.txt`,nativeFile=`.universalcms/content/${token}.native.txt`,inventoryFile=`.universalcms/content/${token}.json`,source=item.extracted.source,inventory=json(item.extracted.inventory);
+    for(const file of [originalFile,nativeFile,inventoryFile])if(await svelteRead(root,file)!==null)fail('frozen content collision');
+    files.push({path:originalFile,content:item.original,state:'create'},{path:nativeFile,content:source,state:'create'},{path:inventoryFile,content:inventory,state:'create'},{path:item.sourceFile,content:source,state:'update',previous:item.current});
+    rows.push({...Object.fromEntries(['path','kind','slug','locale','sourceFile'].map(key=>[key,item[key]])),originalFile,nativeFile,inventoryFile,sourceHash:contentDigest(source),nativeHash:contentDigest(source),originalHash:contentDigest(item.original),inventoryHash:contentDigest(inventory)});
+  }
+  const registry=validateContentRegistry({version:1,routes:rows}),text=json(registry),previous=await svelteRead(root,CONTENT_BINDINGS_FILE);if(previous!==null&&previous!==text)fail('content registry changed');files.push({path:CONTENT_BINDINGS_FILE,content:text,state:previous===null?'create':'unchanged'});return{root,framework:'svelte',files,routes:rows,entries:inspection.entries,snapshot:inspection.snapshot};
+}
+export async function planSvelteIntegration(directory,{publication=false,sourceConfiguration}={}){
+  const project=await inspectSvelteProject(directory),{root}=project,manifestText=await svelteRead(root,SVELTE_MANIFEST),prior=manifestText?JSON.parse(manifestText):null;
+  if(prior?.publication)publication=true;
+  const app=await svelteRead(root,'src/app.html');if(!app||!app.includes('%sveltekit.head%')||!app.includes('%sveltekit.body%')||/<script\b|\son\w+\s*=/i.test(app))fail('custom application shell');
+  const appSource=prior?.originalApp??app;if(prior&&prior.originalAppHash!==contentDigest(appSource))fail('application ownership changed');
+  const appOutput=appSource.replace(/<body\b([^>]*)>/,(_m,attrs)=>`<body${attrs.replace(/\sdata-sveltekit-(?:reload|preload-data)(?:=(?:"[^"]*"|'[^']*'))?/g,'')} data-sveltekit-reload data-sveltekit-preload-data="false">`);
+  const hook=`import { createSvelteRuntime } from '@universalcms/connect/svelte-runtime';\nimport { renderNativeWebsite } from '@universalcms/connect/native-website-server';\nimport sourceConfiguration from '../.universalcms/source.config.json';\nimport snapshot from '../.universalcms/source.generated.json';\n${publication?"import configuration from '../.universalcms/publication.config.json';\nimport contentBindings from '../.universalcms/content.bindings.json';\n":''}const runtime=createSvelteRuntime({${publication?'configuration,contentBindings,':''}sourceConfiguration,snapshot,sourceRoot:process.cwd(),renderWebsite:renderNativeWebsite});\nexport const handle=runtime.handle;\n`;
+  const load=`export const prerender=false;\nexport const load=({locals})=>({universalcms:locals.universalcms});\n`;
+  const generated=[['src/hooks.server.js',hook],['src/app.html',appOutput],['.universalcms/svelte.vite.config.mjs',`import adapter from '@sveltejs/adapter-node';\nimport {sveltekit} from '@sveltejs/kit/vite';\nimport config from './source.config.json' with {type:'json'};\nconst port=Number(new URL(config.websiteOrigin).port||(config.websiteOrigin.startsWith('https:')?443:80));\nconst privateFiles={name:'universalcms-private-files',enforce:'pre',configureServer(server){server.middlewares.use((request,response,next)=>{try{const pathname=decodeURIComponent(new URL(request.url,'http://localhost').pathname);if(pathname.includes('%')||pathname.split('/').some(part=>['.universalcms','.git','.ssh','.aws'].includes(part)||/\\.(?:crt|pem|key)$/i.test(part)||part==='.env'||part.startsWith('.env.'))){response.statusCode=404;response.setHeader('Cache-Control','no-store');response.end('Not found');return;}}catch{response.statusCode=400;response.end('Invalid URL');return;}next();});}};\nexport default {plugins:[privateFiles,sveltekit({adapter:adapter(),paths:{origin:config.websiteOrigin}})],server:{port,strictPort:true,fs:{deny:['**/.env','**/.env.*','**/.universalcms/**','**/.git/**','**/.ssh/**','**/.aws/**','**/*.{crt,pem,key}']}},preview:{port,strictPort:true}};\n`],['.universalcms/svelte.serve.mjs',`import {fileURLToPath} from 'node:url';\nprocess.chdir(fileURLToPath(new URL('../',import.meta.url)));\nimport config from './source.config.json' with {type:'json'};\nprocess.env.ORIGIN=config.websiteOrigin;process.env.PORT=String(new URL(config.websiteOrigin).port||(config.websiteOrigin.startsWith('https:')?443:80));\nawait import('../build/index.js');\n`]];
+  if(publication){for(const row of await routes(root))generated.push([path.posix.dirname(row.sourceFile)+'/+page.server.js',load]);generated.push(['src/routes/[...cmsPath]/+page.svelte',pageTemplate('')],['src/routes/[...cmsPath]/+page.server.js',load]);}
+  const scripts={...project.manifest.scripts};for(const name of ['dev','build','preview']){const expected=name==='build'?'vite build':`vite ${name==='dev'?'':name}`.trim(),generated=expected+' --config .universalcms/svelte.vite.config.mjs';if(scripts[name]!==undefined&&scripts[name]!==expected&&scripts[name]!==generated)fail('custom startup/build scripts');if(name!=='preview'&&scripts[name]===undefined)fail('missing startup/build scripts');if(scripts[name]!==undefined)scripts[name]=generated;}
+  const start='node .universalcms/svelte.serve.mjs';if(scripts.start&&scripts.start!==start&&scripts.start!=='node build')fail('custom production startup');scripts.start=start;
+  const verify='universalcms-connect sync-source';for(const name of ['predev','prebuild','prestart','prepreview']){if(scripts[name]&&scripts[name]!==verify)fail('custom lifecycle hooks');scripts[name]=verify;}
+  const oldFiles=new Map((prior?.files??[]).map(item=>[item.path,item.sha256])),files=[];
+  if(prior&&(prior.version!==1||prior.configHash!==contentDigest(project.config)||prior.viteHash!==contentDigest(project.viteSource)))fail('framework configuration changed');
+  for(const [file,content]of generated){const before=await svelteRead(root,file),owned=oldFiles.get(file);if(file==='src/app.html'){if(before!==appSource&&before!==appOutput)fail('application shell changed');}else if(before!==null&&(!owned||contentDigest(before)!==owned))fail('custom runtime or load file');files.push({path:file,content,state:before===content?'unchanged':before===null?'create':'update',...(before!==null&&before!==content?{previous:before}:{})});}
+  files.push({path:project.viteFile,content:project.viteSource,state:'unchanged'});
+  const packageBefore=await svelteRead(root,'package.json'),packageAfter=json({...project.manifest,scripts});files.push({path:'package.json',content:packageAfter,state:packageBefore===packageAfter?'unchanged':'update',previous:packageBefore});
+  const ownership={version:1,publication,configHash:contentDigest(project.config),viteHash:contentDigest(project.viteSource),originalApp:appSource,originalAppHash:contentDigest(appSource),files:generated.map(([path,content])=>({path,sha256:contentDigest(content)}))};
+  files.push({path:SVELTE_MANIFEST,content:json(ownership),state:manifestText===json(ownership)?'unchanged':manifestText===null?'create':'update',...(manifestText?{previous:manifestText}:{})});
+  return{root,framework:'svelte',files,project};
+}
+export async function validateInstalledSvelte(directory,configuration){
+  const plan=await planSvelteIntegration(directory,{publication:true,sourceConfiguration:configuration});
+  if(plan.files.some(file=>file.state!=='unchanged'))fail('integration incomplete or changed');
+  const inspection=await inspectSvelteSource(directory,{locale:configuration.routes[0]?.locale,websiteOrigin:configuration.websiteOrigin});
+  if(json(inspection.routes)!==json(configuration.routes)||await svelteRead(plan.root,'.universalcms/source.generated.json')!==json(inspection.snapshot))fail('published route or frozen source inventory changed');
+  const registry=await readContentRegistry(plan.root);if(!registry||registry.routes.length!==configuration.routes.length)fail('published-content bindings incomplete');
+  const content=await planSvelteContent(directory,configuration,inspection);if(content.files.some(file=>file.state!=='unchanged'))fail('native content bindings incomplete');
+  plan.files.push(...content.files);return{...plan,config:configuration};
+}
+export async function planSvelteSettings(directory,{config,source}){
+  const plan=await validateInstalledSvelte(directory,config),name='.universalcms/website.integration.json';
+  const unique=new Map(plan.files.filter(file=>file.path!=='package.json').map(file=>[file.path,{path:file.path,sha256:contentDigest(file.content)}]));
+  const content=json({version:1,framework:'svelte',siteId:config.siteId,environmentId:config.environmentId,apiOrigin:config.apiOrigin,websiteOrigin:config.websiteOrigin,adminOrigin:source.adminOrigin,sections:WEBSITE_SECTIONS,files:[...unique.values()]}),previous=await svelteRead(plan.root,name);
+  if(previous!==null&&previous!==content)fail('settings ownership or scope changed');
+  plan.files.push({path:name,content,state:previous===null?'create':'unchanged'});
+  for(const name of ['.universalcms/publication.config.json','.universalcms/source.config.json','.universalcms/source.generated.json'])plan.files.push({path:name,content:await svelteRead(plan.root,name),state:'unchanged'});
+  return{...plan,sections:[...WEBSITE_SECTIONS]};
+}

package/dist/svelte-template.mjs

@@ -0,0 +1,48 @@
+/** Literal native HTML projection shared by the Svelte and Angular adapters.
+ * The bundled parser validates inert source; customer modules are never loaded. */
+import { parse } from './vendor/astro-compiler/node/index.js';
+import { extractAstroPage } from './astro-source.mjs';
+import { SetupError } from './core.mjs';
+const fail = () => { throw new SetupError('Native template requires a reviewed adapter. Automatic setup accepts literal editorial HTML and styles; custom components, expressions, scripts and chrome are preserved for review.'); };
+const escape = value => JSON.stringify(value);
+export async function transformNativeTemplate({source,slug,locale='en',websiteOrigin,framework,allowNativeChrome=false}) {
+  if (!['svelte','angular'].includes(framework) || typeof source !== 'string' || /[{}]|<(?:script|svelte:|ng-|router-|slot\b)|\s(?:on\w+|\[[^\]]+\]|\([^)]*\)|\*\w+)\s*=/i.test(source.replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi,''))) fail();
+  const extracted = await extractAstroPage({source,slug,locale,websiteOrigin,allowNativeChrome});
+  const parsed = await parse(source,{position:true}), edits=[]; let cursor=0;
+  const offsets=new Map([[0,0]]); let bytes=0,chars=0;
+  for(const character of source){bytes+=Buffer.byteLength(character);chars+=character.length;offsets.set(bytes,chars);}
+  const start=node=>{let at=offsets.get(node.position?.start?.offset);if(source[at]!=='<'&&source[at-1]==='<')at--;if(!Number.isInteger(at)||!source.startsWith('<'+node.name,at))fail();return at;};
+  const opening=node=>{const at=start(node);let quote=null;for(let i=at;i<source.length;i++){const c=source[i];if(quote){if(c===quote)quote=null;}else if(c==='"'||c==="'")quote=c;else if(c==='>')return i+1;}fail();};
+  const end=node=>node.name==='img'?opening(node):offsets.get(node.position?.end?.offset);
+  const visit=node=>{
+    if(node.type!=='element'){for(const child of node.children??[])visit(child);return;}
+    if(node.name==='style'||node.name==='head'||extracted.inventory.nativeChrome&&['header','footer'].includes(node.name))return;
+    if(!/^(?:h[1-6]|p|ul|ol|img)$/.test(node.name)){for(const child of node.children??[])visit(child);return;}
+    const block=extracted.entry.document.blocks[cursor++];if(!block)fail();
+    const from=start(node),to=end(node);if(!Number.isInteger(to)||to<=from)fail();
+    const lookup=framework==='svelte'?`data.universalcms.bindings[${escape(block.id)}]`:`cms.binding(${escape(block.id)})`;
+    let native=source.slice(from,to),open=source.slice(from,opening(node)),close=node.name==='img'?'':`</${node.name}>`;
+    if(block.type==='image') {
+      open=open.replace(/\s(?:src|alt)\s*=\s*(?:"[^"]*"|'[^']*')/g,'');
+      const attrs=framework==='svelte'?` src={${lookup}.url} alt={${lookup}.alt}`:` [src]="${lookup.replaceAll('"',"'")}!.url" [alt]="${lookup.replaceAll('"',"'")}!.alt"`;
+      native=open.replace(/\s*\/?>$/,attrs+' />');
+    } else if(block.type==='list') {
+      const first=node.children.find(child=>child.type==='element'&&child.name==='li'),itemOpen=source.slice(start(first),opening(first));
+      const item=framework==='svelte'?`{#each ${lookup}.text.split('\\n') as item}${itemOpen}{item}</li>{/each}`:`@for (item of ${lookup.replaceAll('"',"'")}!.text.split('\\n'); track $index) {${itemOpen}{{item}}</li>}`;
+      native=open+item+close;
+    } else {
+      // Native wrappers retain their order. Editorial text is projected once;
+      // no frozen source copy is emitted into the browser bundle.
+      const value=framework==='svelte'?`{${lookup}.text}`:`{{${lookup.replaceAll('"',"'")}!.text}}`;
+      const replacements=[];let first=true;
+      const visitText=child=>{if(child.type==='text'&&child.value.trim()){const at=offsets.get(child.position?.start?.offset),to=offsets.get(child.position?.end?.offset);if(!Number.isInteger(at)||!Number.isInteger(to)||source.slice(at,to)!==child.value)fail();replacements.push({from:at-from,to:to-from,value:first?value:''});first=false;}else for(const nested of child.children??[])visitText(nested);};
+      for(const child of node.children??[])visitText(child);
+      if(first)fail();
+      for(const change of replacements.sort((a,b)=>b.from-a.from))native=native.slice(0,change.from)+change.value+native.slice(change.to);
+    }
+    edits.push({from,to,value:framework==='svelte'?`{#if ${lookup}}${native}{/if}`:`@if (${lookup.replaceAll('"',"'")}) {${native}}`});
+  };
+  visit(parsed.ast);if(cursor!==extracted.entry.document.blocks.length)fail();
+  let output=source;for(const edit of edits.sort((a,b)=>b.from-a.from))output=output.slice(0,edit.from)+edit.value+output.slice(edit.to);
+  return {...extracted,source:output};
+}

package/dist/templates.mjs

@@ -0,0 +1,248 @@
+import { readFile } from 'node:fs/promises';
+
+export async function createTemplates(config, { existingNodeServer = false } = {}) {
+  const json = value => JSON.stringify(value);
+  const env = `# Set these in your PRIVATE hosting/server environment. This file contains no key.\nCMS_API_BASE_URL=${config.apiOrigin}\nCMS_SITE_ID=${config.siteId}\nCMS_ENVIRONMENT_ID=${config.environmentId}\nCMS_API_KEY=\n${config.framework === 'vite' ? 'CMS_WEBSITE_ORIGIN=http://localhost:5173\nCMS_CONNECT_PORT=4318\nCMS_CONNECT_HOST=127.0.0.1\n' : ''}`;
+  const common = [
+    { path: '.universalcms/server.env.example', content: env },
+    { path: '.universalcms/SETUP.md', content: stagedSetupGuide(instructions(config, existingNodeServer)) },
+  ];
+  const clientOptions = `baseUrl: process.env.CMS_API_BASE_URL ?? ${json(config.apiOrigin)},\n    siteId: ${json(config.siteId)},\n    environmentId: ${json(config.environmentId)},\n    apiKey: process.env.CMS_API_KEY,\n    retries: 0,`;
+  if (config.framework === 'next') {
+    const route = `${config.appDirectory}${config.mount}`;
+    return [...common,
+      { path: `${route}/cms.server.js`, content: `import 'server-only';\nimport { createNextCmsClient } from '@universalcms/next';\n\n// Called during a server request; never imported into a client component.\nexport function getCms() {\n  return createNextCmsClient({\n    ${clientOptions}\n  });\n}\n` },
+      { path: `${route}/[...slug]/page.jsx`, content: `import { notFound } from 'next/navigation';\nimport { CmsDocument } from '@universalcms/react';\nimport '@universalcms/react/styles.css';\nimport { getCms } from '../cms.server.js';\n\nexport const runtime = 'nodejs';\nexport const dynamic = 'force-dynamic';\n\nexport default async function CmsPage({ params }) {\n  const { slug: segments } = await params;\n  const slug = Array.isArray(segments) ? segments.join('/') : '';\n  if (slug.length > 160 || !/^[a-z0-9]+(?:[-/][a-z0-9]+)*$/.test(slug)) notFound();\n  const entry = await getCms().content.getBySlug(slug, { kind: 'page', locale: ${json(config.locale)} });\n  if (!entry) notFound();\n  return <article><h1>{entry.document.title}</h1>\n    <CmsDocument document={entry.document} entryId={entry.id} />\n  </article>;\n}\n` },
+      { path: `${route}/[...slug]/error.jsx`, content: `'use client';\nexport default function CmsError({ reset }) {\n  return <section role="alert"><h1>Content is temporarily unavailable</h1>\n    <button type="button" onClick={reset}>Try again</button></section>;\n}\n` },
+    ];
+  }
+  const handler = await readFile(new URL('./vite-handler.mjs', import.meta.url), 'utf8');
+  return [...common,
+    { path: '.universalcms/page-handler.mjs', content: handler },
+    { path: '.universalcms/server.mjs', content: `import { createServer } from 'node:http';\nimport { createCmsClient } from '@universalcms/sdk';\nimport { createPageHandler } from './page-handler.mjs';\n\ntry {\n  const cms = createCmsClient({\n    ${clientOptions}\n  });\n  const port = Number(process.env.CMS_CONNECT_PORT ?? '4318');\n  if (!Number.isInteger(port) || port < 1 || port > 65535) throw Error();\n  const handler = createPageHandler(cms, { locale: ${json(config.locale)}, websiteOrigin: process.env.CMS_WEBSITE_ORIGIN });\n  const server = createServer({ requestTimeout: 15_000, headersTimeout: 10_000, maxHeaderSize: 8192 }, (req, res) => { void handler(req, res); });\n  server.on('error', () => { console.error('CMS connector could not start. Check server configuration.'); process.exitCode = 1; });\n  server.listen(port, process.env.CMS_CONNECT_HOST ?? '127.0.0.1', () => console.log('CMS connector listening. Route /api/universalcms/page through your website proxy.'));\n  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { server.close(); server.closeAllConnections(); });\n} catch { console.error('CMS connector requires valid private server configuration.'); process.exitCode = 1; }\n` },
+    { path: '.universalcms/CmsPage.jsx', content: `import React, { useEffect, useState } from 'react';\nimport { CmsDocument } from '@universalcms/react';\nimport '@universalcms/react/styles.css';\n\n// Mount in your existing router; this module contains no CMS credentials.\nexport default function CmsPage({ slug = 'home' }) {\n  const [result, setResult] = useState({ slug: '', state: 'loading', entry: null });\n  useEffect(() => {\n    const controller = new AbortController();\n    let current = true;\n    setResult({ slug, state: 'loading', entry: null });\n    async function load() {\n      try {\n        const response = await fetch('/api/universalcms/page?slug=' + encodeURIComponent(slug), { credentials: 'omit', cache: 'no-store', redirect: 'error', signal: controller.signal });\n        if (response.status === 404) { if (current) setResult({ slug, state: 'missing', entry: null }); return; }\n        if (!response.ok || !response.headers.get('content-type')?.startsWith('application/json')) throw Error();\n        const body = await response.json();\n        if (!body.entry?.document || typeof body.entry.document.title !== 'string' || !Array.isArray(body.entry.document.blocks)) throw Error();\n        if (current) setResult({ slug, state: 'ready', entry: body.entry });\n      } catch { if (current) setResult({ slug, state: 'error', entry: null }); }\n    }\n    void load();\n    return () => { current = false; controller.abort(); };\n  }, [slug]);\n  if (result.slug !== slug || result.state === 'loading') return <p role="status">Loading content…</p>;\n  if (result.state === 'missing') return <h1>Page not found</h1>;\n  if (result.state === 'error') return <p role="alert">Content is temporarily unavailable.</p>;\n  return <article><h1>{result.entry.document.title}</h1><CmsDocument document={result.entry.document} entryId={result.entry.id} /></article>;\n}\n` },
+    { path: '.universalcms/vite.config.mjs', content: sourceAwareViteWrapper(`import { defineConfig, loadConfigFromFile } from 'vite';\n\n// Explicit wrapper: preserves the project's config without editing it.\n// Run only when you choose: npx vite --config .universalcms/vite.config.mjs\nexport default defineConfig(async env => {\n  const existing = (await loadConfigFromFile(env, undefined, process.cwd()))?.config ?? {};\n  const proxies = existing.server?.proxy ?? {};\n  const endpoint = '^/api/universalcms/page(?:[?]|$)';\n  if (Object.hasOwn(proxies, '/api/universalcms/page') || Object.hasOwn(proxies, endpoint)) throw new Error('The CMS proxy endpoint already exists. Review it manually before using this wrapper.');\n  // Vite selects the first matching proxy. The exact CMS endpoint must precede\n  // an existing broad /api proxy; all unrelated routes retain their destinations.\n  return { ...existing, server: { ...existing.server, proxy: { [endpoint]: { target: 'http://127.0.0.1:4318', changeOrigin: false }, ...proxies } } };\n});\n`) },
+    { path: 'universalcms-demo.html', content: '<!doctype html>\n<html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CMS connection demo</title><meta name="robots" content="noindex,nofollow"></head><body><div id="universalcms-demo"></div><script type="module" src="/.universalcms/demo.jsx"></script></body></html>\n' },
+    { path: '.universalcms/demo.jsx', content: `import React from 'react';\nimport { createRoot } from 'react-dom/client';\nimport CmsPage from './CmsPage.jsx';\nconst slug = new URLSearchParams(window.location.search).get('slug') || 'home';\ncreateRoot(document.getElementById('universalcms-demo')).render(<CmsPage slug={slug} />);\n` },
+  ];
+}
+
+// The optional demo wrapper must retain original-route publication protection
+// after full setup. Switching to this documented wrapper cannot bypass the gate.
+const sourceImport = "import { readFile } from 'node:fs/promises';\n";
+const legacySourceStartup = `  let sourcePlugins = [];
+  try {
+    const configuration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));
+    const { universalCmsSource } = await import('@universalcms/connect/vite-source');
+    sourcePlugins = [universalCmsSource({ configuration })];
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+`;
+const sourceStartup = `  const sourcePlugins = [];
+  let publicationText;
+  try { publicationText = await readFile(new URL('./publication.config.json', import.meta.url), 'utf8'); }
+  catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    for (const filename of ['./source.vite.config.mjs', './serve.mjs']) {
+      try {
+        const source = await readFile(new URL(filename, import.meta.url), 'utf8');
+        if (/@universalcms\\/connect\\/vite-publication|universalcms-publication-client/.test(source)) throw new Error('Original-route publication configuration is missing. Restore the reviewed setup before starting the website.');
+      } catch (inspectionError) { if (inspectionError.code !== 'ENOENT') throw inspectionError; }
+    }
+  }
+  if (publicationText !== undefined) {
+    const configuration = JSON.parse(publicationText);
+    const sourceConfiguration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));
+    let contentBindings;
+    try { contentBindings = JSON.parse(await readFile(new URL('./content.bindings.json', import.meta.url), 'utf8')); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const { universalCmsPublication } = await import('@universalcms/connect/vite-publication');
+    sourcePlugins.push(universalCmsPublication({ configuration, sourceConfiguration, contentBindings }));
+  }
+  try {
+    const configuration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));
+    const { universalCmsSource } = await import('@universalcms/connect/vite-source');
+    sourcePlugins.push(universalCmsSource({ configuration }));
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+`;
+function sourceAwareViteWrapper(content) {
+  return sourceImport + content.replace('  const proxies =', sourceStartup + '  const proxies =')
+    .replace('return { ...existing, server:', 'return { ...existing, plugins: [...sourcePlugins, ...(existing.plugins ?? [])], server:');
+}
+export function previousViteSourceWrapper(content) {
+  return content.replace(sourceImport, '').replace(sourceStartup, '')
+    .replace('return { ...existing, plugins: [...sourcePlugins, ...(existing.plugins ?? [])], server:', 'return { ...existing, server:');
+}
+export function previousPublicationViteWrapper(content) {
+  return content.replace(sourceStartup, legacySourceStartup);
+}
+export function previousDiagnosticViteWrapper(content) {
+  return content.replace("    const sourceConfiguration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));\n    let contentBindings;\n    try { contentBindings = JSON.parse(await readFile(new URL('./content.bindings.json', import.meta.url), 'utf8')); }\n    catch (error) { if (error.code !== 'ENOENT') throw error; }\n", '')
+    .replace('universalCmsPublication({ configuration, sourceConfiguration, contentBindings })', 'universalCmsPublication({ configuration })');
+}
+
+// Exact prior prerelease guide variant, used only to recognize an untouched
+// generated document during guided upgrades. Custom bytes still fail closed.
+const priorSetupInstruction = 'Run npx --no-install universalcms-connect setup to enter and save connection values locally.';
+const stagedSetupInstruction = 'After connect and setup, run npx --no-install universalcms-connect server-key to save the delivery key through hidden input. If this project has no saved connect record, setup retains its all-in-one guided flow.';
+const priorPrivateInstruction = 'Guided setup saves the entered values in private .env.local.';
+const stagedPrivateInstruction = 'The server-key command (or the legacy all-in-one setup flow) saves entered values in private .env.local.';
+const legacyPublicationGuide = `## Connect publication to the original website URLs
+
+Source export and importing drafts do not hide the original website content.
+The scaffold does not connect existing routes to CMS publication automatically.
+Review the imported public route inventory and map each original URL to its exact
+CMS kind, slug and locale in the fixed site/environment. Map the home URL explicitly
+(for example, / to the imported home slug); do not guess from titles or route names.
+Exclude private/account, API, admin, preview and framework paths from this mapping.
+
+For every reviewed managed public route, check published delivery before rendering
+any original page content. A missing or unpublished page must return 404; a failed
+delivery request must show an unavailable response without original or stale
+content. When all managed pages are unpublished, all their original URLs must be
+unavailable, including the home page. Never use draft content as a fallback.
+Publication checks are independent of body/design mapping: preserve existing
+components and interactions behind the check while mapping CMS blocks deliberately.
+A source-only setup still needs this integration before publication governs pages.
+
+Use fixtures or a disposable staging site to verify published, all-unpublished and
+publish-to-unpublish transitions on the original URLs, including direct requests,
+client navigation, reload and cached/prefetched routes. Test upstream failures too.
+Do not publish or unpublish customer content merely to test. For static hosting,
+verify the required rebuild, cache invalidation and deployment before claiming the
+URLs changed. A successful API check or demo route does not verify original pages.
+Report unmanaged public routes and unfinished deployments explicitly. Existing
+public source exports and assets are separate from page-rendering checks.
+
+`;
+const availabilityGuide = `## Connect publication to the original website URLs
+
+Source export and importing drafts do not hide the original website content.
+The full universalcms-connect setup command separately installs publication checks
+for its reviewed original URL mappings. Confirm the printed kind, slug and locale,
+including / for the home page, before saving. Custom mappings belong in
+.universalcms/publication.routes.json; rerun setup after adding public routes.
+Exclude private/account, API, admin, preview and framework paths from this mapping.
+
+After full setup, use your normal dev and preview commands. For a supported Vite
+website, run your normal build command and then npm start (or your package-manager
+equivalent) to serve the build with the generated private Node publication server.
+Deploy that server with its private environment. A static-only host cannot enforce
+the request-time publication checks. Next.js keeps its ordinary dev/build/start
+commands and uses the generated server proxy before HTML and RSC responses.
+
+The preceding /cms or universalcms-demo instructions apply to standalone init or
+source-only installations. After full setup, verify the reviewed original URLs;
+unmapped demo page URLs return 404. Their standalone page API is not the original
+website's production host. The optional Vite wrapper retains installed original-
+route publication checks and refuses to start when their configuration is missing.
+
+A missing or unpublished page returns 404; failed delivery returns 503 without
+original or stale content. When all managed pages are unpublished, all their original URLs must be
+unavailable, including the home page. Never use draft content as a fallback.
+Publication checks are independent of body/design mapping: published pages retain
+their native components. CMS document edits need deliberate component mapping.
+Source-only setup and unsupported custom servers still require manual integration.
+
+Use fixtures or a disposable staging site to verify published, all-unpublished and
+publish-to-unpublish transitions on the original URLs, including direct requests,
+client navigation, reload and cached/prefetched routes. Test upstream failures too.
+Do not publish or unpublish customer content merely to test. A successful API check
+or demo route does not verify original pages. Report unmanaged public routes and
+unfinished deployments explicitly. Existing public source exports and assets are
+separate from page-rendering checks.
+
+`;
+const publicationGuide = availabilityGuide.replace(
+  'Publication checks are independent of body/design mapping: published pages retain\ntheir native components. CMS document edits need deliberate component mapping.\nSource-only setup and unsupported custom servers still require manual integration.',
+  `Full setup also binds supported native JSX/TSX components to the current published
+document. Existing block IDs and source baselines stay frozen across reconnects and
+builds. Edited and deleted blocks update in place; new blocks appear after the
+bound native content. Source-only setup and unsupported custom components require
+an explicit integration through @universalcms/connect/react-publication.
+
+Vite routes need reviewed path/sourceFile pairs in .universalcms/content.routes.json
+unless a single homepage maps unambiguously to src/App.jsx or src/App.tsx. The
+entire source block structure must match before imported IDs can be reused.
+Native layout positions and interactions remain in their components. Arbitrary
+layout reordering and private/runtime application data are not inferred.
+
+Save draft leaves the published revision unchanged. Update live / Publish changes
+public content. Open tabs check every 15 seconds and on focus; a published revision
+refreshes bound content without resetting native state. Missing or failed reads
+remove stale managed content. Test published A, saved draft B, then published B on
+the original URL, including removed blocks and a published empty document.
+
+Existing installations must upgrade this package, rerun setup and deploy the
+updated website code and private runtime settings to each live host. A local
+setup does not deploy remote websites. Verify actual changed page text separately
+on local and live origins; an API or source-import check cannot prove rendering.`
+);
+export function previousRenderingSetupGuide(content) {
+  return content.replace(publicationGuide, availabilityGuide);
+}
+function stagedSetupGuide(content) {
+  return content.replace(priorSetupInstruction, stagedSetupInstruction).replace(priorPrivateInstruction, stagedPrivateInstruction)
+    .replace('## What remains deliberate', publicationGuide + '## What remains deliberate');
+}
+export function priorPublicationSetupGuide(content) {
+  return content.replace(publicationGuide, '');
+}
+export function previousPublicationSetupGuide(content) {
+  return content.replace(publicationGuide, legacyPublicationGuide);
+}
+export function previousSetupGuide(content) {
+  return priorPublicationSetupGuide(content).replace(stagedSetupInstruction, priorSetupInstruction).replace(stagedPrivateInstruction, priorPrivateInstruction);
+}
+export function legacySetupGuide(content) {
+  return previousSetupGuide(content)
+    .replace('Guided setup saves the entered values in private .env.local. The analyze, init and check commands do not load that file automatically.', 'The CLI neither saves nor reads an .env file.')
+    .replace('node --env-file=.env.local .universalcms/server.mjs', 'node .universalcms/server.mjs')
+    .replace('Run npx --no-install universalcms-connect setup to enter and save connection values locally. For hosted deployment, copy the nonsecret values in server.env.example into the private server/hosting', 'Copy the nonsecret values in server.env.example into the private server/hosting')
+    .replace('Init preserves existing project files. Guided setup can update its unchanged generated files and the entered connection values in .env.local; unrelated settings and custom edits are preserved.', 'Existing project configuration and source are never overwritten.');
+}
+
+function instructions(config, existingNodeServer) {
+  const next = config.framework === 'next';
+  return `# Connect this website to Universal CMS\n\nThe scaffold is created, but connection and rendering are not yet verified. No\nexisting source was replaced and no content was imported or published.\n\n## Install the runtime packages\n\nAfter the platform operator publishes the 0.1.0 packages, run:\n\n\`\`\`sh\nnpm install @universalcms/sdk@0.1.0 @universalcms/react@0.1.0${next ? ' @universalcms/next@0.1.0' : ''}\n\`\`\`\n\nFor a prerelease, install the operator's SDK and React${next ? ' and Next' : ''} tarballs together instead.\nDo not run the registry command until those reviewed packages are available.\nUse your project's package manager and commit its reviewed lockfile.\n\n## Configure server secrets and verify\n\nRun npx --no-install universalcms-connect setup to enter and save connection values locally. For hosted deployment, copy the nonsecret values in server.env.example into the private server/hosting\nenvironment. Obtain an environment-scoped server delivery key from this site's\nDeveloper setup and set CMS_API_KEY using your secret manager. Never use a\nNEXT_PUBLIC_ or VITE_ variable. Guided setup saves the entered values in private .env.local. The analyze, init and check commands do not load that file automatically.\nIf using a local env file, keep it ignored by Git and outside public directories.\nThe site/environment in generated server code are fixed; create separate reviewed\nconfiguration for another environment. CMS_API_BASE_URL may override the API\norigin only in the private server environment.\n\nRun \`npx --no-install universalcms-connect check --slug YOUR_PUBLISHED_PAGE\` from this project.\nIt uses CMS_API_KEY from the process environment or a hidden terminal prompt.\nIt honors the same private CMS_API_BASE_URL override as the generated server.\nRun it with the same private environment used by that server.\nA successful check verifies one published API response, not deployment or rendering.\n\n${next ? `## Next.js\n\nStart your existing Next.js app. Visit \`${config.mount}/YOUR_PUBLISHED_PAGE\`. Nested\nslugs retain their slash separators. The generated page uses request-time delivery\nand no persistent cache; missing/unpublished pages return 404, upstream failures\nshow a retry state. This route is an additive connection demo under ${config.mount};\nit does not replace your existing routes or imply the CMS's canonical paths changed.\nProduction requires a Node-capable Next deployment and private server secrets.\nStatic export and Edge runtimes are unsupported by this scaffold.\n` : `## React/Vite\n\n${existingNodeServer ? existingServerInstructions(config) : ""}Set CMS_WEBSITE_ORIGIN to the exact browser-facing origin (localhost:5173 during\ndevelopment). Start the private server in one terminal:\n\n\`\`\`sh\nnode --env-file=.env.local .universalcms/server.mjs\n\`\`\`\n\nStart Vite with the supplied wrapper in another terminal:\n\n\`\`\`sh\nnpx vite --config .universalcms/vite.config.mjs\n\`\`\`\n\nThe wrapper merges your existing Vite configuration and proxies only\n/api/universalcms/page to port 4318. If changing the connector port, update the\nreviewed wrapper target too. Visit\n/universalcms-demo.html?slug=YOUR_PUBLISHED_PAGE to verify rendering. The wrapper\nloads your normal Vite config only when you explicitly run Vite, never during\nanalysis/setup. No private key is passed to Vite or included in the demo.\n\nImport .universalcms/CmsPage.jsx into your existing React router and give it the\npage slug, or map the returned public document to your own components. The demo\nHTML is a development entry and is not automatically included in Vite's production\nbuild. Production needs both your normal Vite static build AND this Node server\nor an equivalent serverless handler. The host/reverse proxy must route the exact\n/api/universalcms/page path to the private connector and other paths to your static\nsite; Vite dev proxy settings do not configure a production proxy. Keep the server\non a private network, set the exact HTTPS CMS_WEBSITE_ORIGIN, apply ingress request\nlimits, and do not expose a general-purpose CMS proxy or server environment.\nThe handler provides no CORS, bounds input/concurrency, and forwards only a fixed\nsite/environment/locale published page lookup. It returns 404 for a missing page\nand 503 for upstream failure; the client clears stale content. It does not provide\nSSR or production HTTP 404 status for a client-only router.\n`}\n## What remains deliberate\n\nThis first scaffold renders published pages in one configured locale. Posts,\ncustom collections, taxonomy archive routes, navigation, forms, previews, SEO\nmetadata and existing design/content mapping use the SDK's documented APIs and\nneed explicit integration. Form blocks are displayed disabled until a reviewed\nsubmission endpoint is supplied. No existing source is sent to the platform.\n\nRun your website typecheck/build and review rendered pages before deployment.\nA backend connection does not mean existing content has been imported. Use the\nCMS's authorized import-as-drafts flow for that separate step. Nothing here\npublishes content or installs the Universal CMS backend on the website.\n\n## Optional assistance\n\n\`npx --no-install universalcms-connect analyze\` prints a sanitized local report. You may choose\nto supply that report in the CMS's setup assistant. This command never uploads\nsource or calls a model. Platform AI provider keys, limits and metering remain on\nthe platform; the deterministic/manual instructions above work without AI.\n\n## Reruns and removal\n\nThe same init command preserves identical files. Differing files stop setup before\nwriting; inspect and merge your edits manually. Remove only the generated files\nlisted by init to uninstall this scaffold, then review any router/proxy changes\nyou made. Init preserves existing project files. Guided setup can update its unchanged generated files and the entered connection values in .env.local; unrelated settings and custom edits are preserved.\n`;
+}
+
+function existingServerInstructions(config) {
+  return `### Existing Node server detected
+
+Keep your current website startup (for example, npm run dev), SSR bootstrap and
+production server. Starting raw Vite replaces that server and can break an SSR
+website. The separate server/Vite commands below are optional connection-demo
+diagnostics on unused ports, not a replacement for your website startup.
+
+For the real website, register the published-page handler inside its existing
+private server before a generic /api handler or SSR catch-all. Reuse that server's
+fixed site/environment SDK client and deploy @universalcms/connect as a production
+dependency when importing its Node entry point. For this prerelease, install the
+reviewed connector tarball with npm install --save-prod (not --save-dev).
+
+\`\`\`js
+import { createPageHandler } from '@universalcms/connect/node';
+// cms is the existing private, fixed-scope SDK client, never a browser client.
+const cmsPage = createPageHandler(cms, {
+  locale: ${JSON.stringify(config.locale)},
+  websiteOrigin: process.env.CMS_WEBSITE_ORIGIN,
+});
+// In the existing request listener, BEFORE its /api or SSR fallback:
+if (req.url?.split('?')[0] === '/api/universalcms/page') {
+  await cmsPage(req, res);
+  return;
+}
+\`\`\`
+
+Mount the supplied CmsPage component explicitly through your router, or keep your
+existing CMS renderer. The CLI does not replace an existing integration. Confirm
+both direct page loads and client navigation using the normal website server.
+The standalone demo verifies rendering separately; it does not prove SSR,
+existing routes, navigation, or production routing work.
+
+If using the optional raw-Vite demo, choose an unused port explicitly and set
+CMS_WEBSITE_ORIGIN to that exact origin. Do not visit the SSR website root through
+that diagnostic server; use /universalcms-demo.html?slug=YOUR_PUBLISHED_PAGE.
+
+`;
+}

package/dist/vendor/analyze-project.mjs

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/** Local read-only inspection; neither installs dependencies nor runs project code. */
+import { constants } from 'node:fs';
+import { lstat, realpath, open, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { analyzeProjectFiles, PROJECT_ANALYSIS_FILES, MAX_ANALYSIS_FILE_BYTES, MAX_ANALYSIS_TOTAL_BYTES } from './project-analysis.mjs';
+import { inspectInstalledDependencies } from './inspect-installed-dependencies.mjs';
+
+function inside(root, target) { const relative = path.relative(root, target); return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative); }
+
+/** A missing file is fine; unreadable, symlinked or excessive evidence is never silently trusted. */
+export async function analyzeProjectDirectory(directory) {
+  const requested = path.resolve(directory);
+  const rootStat = await lstat(requested);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw Error('Select an ordinary project directory, not a symbolic link.');
+  const root = await realpath(requested), files = Object.create(null);
+  let total = 0;
+  for (const name of PROJECT_ANALYSIS_FILES) {
+    const segments = name.split('/');
+    let target = root, missing = false, unsafe = false;
+    for (let index = 0; index < segments.length; index++) {
+      target = path.join(target, segments[index]);
+      let info;
+      try { info = await lstat(target); }
+      catch (error) { if (error.code === 'ENOENT' || error.code === 'ENOTDIR') { missing = true; break; } unsafe = true; break; }
+      if (info.isSymbolicLink() || (index < segments.length - 1 && !info.isDirectory()) || (index === segments.length - 1 && !info.isFile())) { unsafe = true; break; }
+      if (index === segments.length - 1 && (info.size > MAX_ANALYSIS_FILE_BYTES || total + info.size > MAX_ANALYSIS_TOTAL_BYTES)) { unsafe = true; break; }
+    }
+    if (missing) continue;
+    if (unsafe) { files[name] = null; continue; }
+    let handle;
+    try {
+      const actual = await realpath(target);
+      if (!inside(root, actual) || actual !== target) { files[name] = null; continue; }
+      handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW);
+      const opened = await handle.stat(), current = await lstat(target);
+      if (!opened.isFile() || opened.ino !== current.ino || opened.dev !== current.dev || current.isSymbolicLink() || opened.size > MAX_ANALYSIS_FILE_BYTES || total + opened.size > MAX_ANALYSIS_TOTAL_BYTES || await realpath(target) !== target) { files[name] = null; continue; }
+      // Read at most the budget plus one, even if the file grows after stat.
+      const buffer = Buffer.alloc(MAX_ANALYSIS_FILE_BYTES + 1);
+      let count = 0;
+      while (count < buffer.length) {
+        const { bytesRead } = await handle.read(buffer, count, buffer.length - count, count);
+        if (!bytesRead) break;
+        count += bytesRead;
+      }
+      total += count;
+      if (count > MAX_ANALYSIS_FILE_BYTES || total > MAX_ANALYSIS_TOTAL_BYTES) files[name] = null;
+      else files[name] = new TextDecoder('utf-8', { fatal: true }).decode(buffer.subarray(0, count));
+    } catch { files[name] = null; }
+    finally { await handle?.close(); }
+  }
+  const core = analyzeProjectFiles(files);
+  const diagnostics = await inspectInstalledDependencies(root, files['package.json']);
+  return { ...core, version: 2, diagnostics };
+}
+
+async function main(args) {
+  if (args.includes('--help') || args.includes('-h')) {
+    process.stdout.write('Usage: node analyze-project.mjs [project-directory] [--output report.json]\nReads allowlisted project files and exact installed package metadata locally. Does not execute code, install packages, read .env, contact websites, or upload source. Reports contain timestamped, sanitized setup evidence and dependency diagnostics, without package versions. Existing output files are never overwritten.\n');
+    return;
+  }
+  let directory = null, output = null;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === '--output' && !output && args[i + 1] && !args[i + 1].startsWith('-')) output = args[++i];
+    else if (!arg.startsWith('-') && directory === null) directory = arg;
+    else throw Error('Use one project directory and an optional --output filename.');
+  }
+  const report = await analyzeProjectDirectory(directory ?? process.cwd());
+  const result = `${JSON.stringify(report, null, 2)}\n`;
+  if (output) await writeFile(path.resolve(output), result, { flag: 'wx', mode: 0o600 });
+  else process.stdout.write(result);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2)).catch(() => {
+    // Filesystem and parse errors can contain paths or source. Never echo them.
+    process.stderr.write('Project analysis could not finish. Check the directory, file permissions and output filename. Existing output files are not overwritten.\n');
+    process.exitCode = 1;
+  });
+}

package/dist/vendor/astro-compiler/LICENSE

@@ -0,0 +1,53 @@
+MIT License
+
+Copyright (c) 2021 [Astro contributors](https://github.com/withastro/compiler/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+"""
+This license applies to parts of the `internal/` subdirectory originating from 
+the https://cs.opensource.google/go/x/net/+/master:html/ repository:
+
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.