@universalcms/connect 0.0.0-stage → 0.13.0

package/dist/vendor/astro-compiler/chunk-W5DTLHV4.js

@@ -0,0 +1 @@
+import g from"crypto";import _ from"fs";import{TextDecoder as b,TextEncoder as v}from"util";globalThis.fs||Object.defineProperty(globalThis,"fs",{value:_});globalThis.process||Object.defineProperties(globalThis,"process",{value:process});globalThis.crypto||Object.defineProperty(globalThis,"crypto",{value:g.webcrypto?g.webcrypto:{getRandomValues(m){return g.randomFillSync(m)}}});globalThis.performance||Object.defineProperty(globalThis,"performance",{value:{now(){let[m,o]=process.hrtime();return m*1e3+o/1e6}}});var y=new v("utf-8"),w=new b("utf-8");var d=class{constructor(){this.argv=["js"],this.env={},this.exit=t=>{t!==0&&console.warn("exit code:",t)},this._exitPromise=new Promise(t=>{this._resolveExitPromise=t}),this._pendingEvent=null,this._scheduledTimeouts=new Map,this._nextCallbackTimeoutID=1;let o=(t,e)=>{this.mem.setUint32(t+0,e,!0),this.mem.setUint32(t+4,Math.floor(e/4294967296),!0)},n=t=>{let e=this.mem.getUint32(t+0,!0),s=this.mem.getInt32(t+4,!0);return e+s*4294967296},r=t=>{let e=this.mem.getFloat64(t,!0);if(e===0)return;if(!isNaN(e))return e;let s=this.mem.getUint32(t,!0);return this._values[s]},l=(t,e)=>{if(typeof e=="number"&&e!==0){if(isNaN(e)){this.mem.setUint32(t+4,2146959360,!0),this.mem.setUint32(t,0,!0);return}this.mem.setFloat64(t,e,!0);return}if(e===void 0){this.mem.setFloat64(t,0,!0);return}let i=this._ids.get(e);i===void 0&&(i=this._idPool.pop(),i===void 0&&(i=this._values.length),this._values[i]=e,this._goRefCounts[i]=0,this._ids.set(e,i)),this._goRefCounts[i]++;let a=0;switch(typeof e){case"object":e!==null&&(a=1);break;case"string":a=2;break;case"symbol":a=3;break;case"function":a=4;break}this.mem.setUint32(t+4,2146959360|a,!0),this.mem.setUint32(t,i,!0)},c=t=>{let e=n(t+0),s=n(t+8);return new Uint8Array(this._inst.exports.mem.buffer,e,s)},f=t=>{let e=n(t+0),s=n(t+8),i=new Array(s);for(let a=0;a<s;a++)i[a]=r(e+a*8);return i},u=t=>{let e=n(t+0),s=n(t+8);return w.decode(new DataView(this._inst.exports.mem.buffer,e,s))},h=Date.now()-performance.now();this.importObject={gojs:{"runtime.wasmExit":t=>{t>>>=0;let e=this.mem.getInt32(t+8,!0);this.exited=!0,delete this._inst,delete this._values,delete this._goRefCounts,delete this._ids,delete this._idPool,this.exit(e)},"runtime.wasmWrite":t=>{t>>>=0;let e=n(t+8),s=n(t+16),i=this.mem.getInt32(t+24,!0);_.writeSync(e,new Uint8Array(this._inst.exports.mem.buffer,s,i))},"runtime.resetMemoryDataView":t=>{t>>>=0,this.mem=new DataView(this._inst.exports.mem.buffer)},"runtime.nanotime1":t=>{t>>>=0,o(t+8,(h+performance.now())*1e6)},"runtime.walltime":t=>{t>>>=0;let e=new Date().getTime();o(t+8,e/1e3),this.mem.setInt32(t+16,e%1e3*1e6,!0)},"runtime.scheduleTimeoutEvent":t=>{t>>>=0;let e=this._nextCallbackTimeoutID;this._nextCallbackTimeoutID++,this._scheduledTimeouts.set(e,setTimeout(()=>{for(this._resume();this._scheduledTimeouts.has(e);)console.warn("scheduleTimeoutEvent: missed timeout event"),this._resume()},n(t+8)+1)),this.mem.setInt32(t+16,e,!0)},"runtime.clearTimeoutEvent":t=>{t>>>=0;let e=this.mem.getInt32(t+8,!0);clearTimeout(this._scheduledTimeouts.get(e)),this._scheduledTimeouts.delete(e)},"runtime.getRandomData":t=>{t>>>=0,globalThis.crypto.getRandomValues(c(t+8))},"syscall/js.finalizeRef":t=>{t>>>=0;let e=this.mem.getUint32(t+8,!0);if(this._goRefCounts[e]--,this._goRefCounts[e]===0){let s=this._values[e];this._values[e]=null,this._ids.delete(s),this._idPool.push(e)}},"syscall/js.stringVal":t=>{t>>>=0,l(t+24,u(t+8))},"syscall/js.valueGet":t=>{t>>>=0;let e=Reflect.get(r(t+8),u(t+16));t=this._inst.exports.getsp()>>>0,l(t+32,e)},"syscall/js.valueSet":t=>{t>>>=0,Reflect.set(r(t+8),u(t+16),r(t+32))},"syscall/js.valueDelete":t=>{t>>>=0,Reflect.deleteProperty(r(t+8),u(t+16))},"syscall/js.valueIndex":t=>{t>>>=0,l(t+24,Reflect.get(r(t+8),n(t+16)))},"syscall/js.valueSetIndex":t=>{t>>>=0,Reflect.set(r(t+8),n(t+16),r(t+24))},"syscall/js.valueCall":t=>{t>>>=0;try{let e=r(t+8),s=Reflect.get(e,u(t+16)),i=f(t+32),a=Reflect.apply(s,e,i);t=this._inst.exports.getsp()>>>0,l(t+56,a),this.mem.setUint8(t+64,1)}catch(e){t=this._inst.exports.getsp()>>>0,l(t+56,e),this.mem.setUint8(t+64,0)}},"syscall/js.valueInvoke":t=>{t>>>=0;try{let e=r(t+8),s=f(t+16),i=Reflect.apply(e,void 0,s);t=this._inst.exports.getsp()>>>0,l(t+40,i),this.mem.setUint8(t+48,1)}catch(e){t=this._inst.exports.getsp()>>>0,l(t+40,e),this.mem.setUint8(t+48,0)}},"syscall/js.valueNew":t=>{t>>>=0;try{let e=r(t+8),s=f(t+16),i=Reflect.construct(e,s);t=this._inst.exports.getsp()>>>0,l(t+40,i),this.mem.setUint8(t+48,1)}catch(e){t=this._inst.exports.getsp()>>>0,l(t+40,e),this.mem.setUint8(t+48,0)}},"syscall/js.valueLength":t=>{t>>>=0,o(t+16,Number.parseInt(r(t+8).length))},"syscall/js.valuePrepareString":t=>{t>>>=0;let e=y.encode(String(r(t+8)));l(t+16,e),o(t+24,e.length)},"syscall/js.valueLoadString":t=>{t>>>=0;let e=r(t+8);c(t+16).set(e)},"syscall/js.valueInstanceOf":t=>{t>>>=0,this.mem.setUint8(t+24,r(t+8)instanceof r(t+16)?1:0)},"syscall/js.copyBytesToGo":t=>{t>>>=0;let e=c(t+8),s=r(t+32);if(!(s instanceof Uint8Array||s instanceof Uint8ClampedArray)){this.mem.setUint8(t+48,0);return}let i=s.subarray(0,e.length);e.set(i),o(t+40,i.length),this.mem.setUint8(t+48,1)},"syscall/js.copyBytesToJS":t=>{t>>>=0;let e=r(t+8),s=c(t+16);if(!(e instanceof Uint8Array||e instanceof Uint8ClampedArray)){this.mem.setUint8(t+48,0);return}let i=s.subarray(0,e.length);e.set(i),o(t+40,i.length),this.mem.setUint8(t+48,1)},debug:t=>{console.log(t)}}}}async run(o){if(!(o instanceof WebAssembly.Instance))throw new Error("Go.run: WebAssembly.Instance expected");this._inst=o,this.mem=new DataView(this._inst.exports.mem.buffer),this._values=[Number.NaN,0,null,!0,!1,globalThis,this],this._goRefCounts=new Array(this._values.length).fill(Number.POSITIVE_INFINITY),this._ids=new Map([[0,1],[null,2],[!0,3],[!1,4],[globalThis,5],[this,6]]),this._idPool=[],this.exited=!1;let n=4096,r=h=>{let t=n,e=y.encode(`${h}\0`);return new Uint8Array(this.mem.buffer,n,e.length).set(e),n+=e.length,n%8!==0&&(n+=8-n%8),t},l=this.argv.length,c=[];this.argv.forEach(h=>{c.push(r(h))}),c.push(0),Object.keys(this.env).sort().forEach(h=>{c.push(r(`${h}=${this.env[h]}`))}),c.push(0);let u=n;c.forEach(h=>{this.mem.setUint32(n,h,!0),this.mem.setUint32(n+4,0,!0),n+=8}),this._inst.exports.run(l,u),this.exited&&this._resolveExitPromise(),await this._exitPromise}_resume(){if(this.exited)throw new Error("Go program has already exited");this._inst.exports.resume(),this.exited&&this._resolveExitPromise()}_makeFuncWrapper(o){let n=this;return function(){let r={id:o,this:this,args:arguments};return n._pendingEvent=r,n._resume(),r.result}}};export{d as a};

package/dist/vendor/astro-compiler/node/index.js

@@ -0,0 +1 @@
+import{a as c}from"../chunk-W5DTLHV4.js";import{promises as m}from"fs";import{fileURLToPath as f}from"url";var w=async(t,s)=>i().then(r=>r.transform(t,s)),l=async(t,s)=>i().then(r=>r.parse(t,s)),b=async(t,s)=>i().then(r=>r.convertToTSX(t,s)),P=async t=>{let{default:s}=await import(`data:text/javascript;charset=utf-8;base64,${Buffer.from(t).toString("base64")}`);return s},n,g=()=>{n=void 0,globalThis["@astrojs/compiler"]=void 0},i=()=>(n||(n=d().catch(t=>{throw n=void 0,t})),n),y=async(t,s)=>{let r;return r=await(async()=>{let o=await m.readFile(t).then(e=>e.buffer);return WebAssembly.instantiate(new Uint8Array(o),s)})(),r},d=async()=>{let t=new c,s=await y(f(new URL("../astro.wasm",import.meta.url)),t.importObject);t.run(s.instance);let r=globalThis["@astrojs/compiler"];return{transform:(a,o)=>new Promise(e=>{try{e(r.transform(a,o||{}))}catch(p){throw n=void 0,p}}),parse:(a,o)=>new Promise(e=>e(r.parse(a,o||{}))).catch(e=>{throw n=void 0,e}).then(e=>({...e,ast:JSON.parse(e.ast)})),convertToTSX:(a,o)=>new Promise(e=>e(r.convertToTSX(a,o||{}))).catch(e=>{throw n=void 0,e}).then(e=>({...e,map:JSON.parse(e.map)}))}};export{P as compile,b as convertToTSX,l as parse,g as teardown,w as transform};

package/dist/vendor/check-delivery.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+/** Private, read-only delivery check. Never reads .env or imports website code. */
+import { pathToFileURL } from 'node:url';
+
+export const DELIVERY_CHECK_TIMEOUT_MS = 10_000;
+export const DELIVERY_CHECK_MAX_BYTES = 8 * 1024 * 1024;
+export const DELIVERY_CHECK_MESSAGES = Object.freeze({
+  verified: 'The requested published page was returned. Website rendering, installed dependencies and content updates need separate checks.',
+  'not-published': 'No matching published page was returned. Verify the slug, locale and publication in the selected environment.',
+  'missing-key': 'Delivery was not checked. Set CMS_API_KEY in the private verification process.',
+  'configuration-error': 'Delivery was not checked. Configure a valid API origin, site, environment, server key, page slug and locale.',
+  'authorization-rejected': 'Delivery authorization was rejected. Check the server key, its environment, expiry, revocation and current issuer access.',
+  'invalid-response': 'Delivery was not verified. The API returned an unexpected, redirected, ambiguous or oversized response.',
+  'http-error': 'Delivery was not verified. The API rejected the read request or is unavailable.',
+  'transport-error': 'Delivery was not verified. The private process could not complete the API request.',
+  timeout: 'Delivery was not verified. The API request exceeded the verification deadline.',
+});
+
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const keyPattern = /^cms_server\.([0-9a-f-]{36})\.([0-9a-f-]{36})\.[A-Za-z0-9_-]{43}$/;
+const object = value => !!value && typeof value === 'object' && !Array.isArray(value);
+const invalid = Symbol('Invalid delivery response');
+const result = status => ({ status, verified: status === 'verified', message: DELIVERY_CHECK_MESSAGES[status] });
+const positiveBoundedInteger = (value, limit) => Number.isSafeInteger(value) && value > 0 && value <= limit;
+
+function apiOrigin(value) {
+  if (typeof value !== 'string') return null;
+  try {
+    const url = new URL(value);
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (!url.username && !url.password && !url.search && !url.hash && url.pathname === '/' &&
+      (url.protocol === 'https:' || (url.protocol === 'http:' && loopback))) return url.origin;
+  } catch { /* Configuration is never echoed. */ }
+  return null;
+}
+
+function untilAborted(pending, signal) {
+  return new Promise((resolve, reject) => {
+    const cancel = () => reject(new Error('Delivery check canceled'));
+    if (signal.aborted) { cancel(); return; }
+    signal.addEventListener('abort', cancel, { once: true });
+    pending.then(value => { signal.removeEventListener('abort', cancel); resolve(value); }, error => { signal.removeEventListener('abort', cancel); reject(error); });
+  });
+}
+
+function cancelBody(response) {
+  try { if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {}); }
+  catch { /* Cleanup must not replace the sanitized outcome. */ }
+}
+
+async function boundedBody(response, maxBytes, signal, checkDeadline) {
+  const declared = response.headers.get('content-length');
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > maxBytes)) throw invalid;
+  if (!response.body) throw invalid;
+  const reader = response.body.getReader(), body = new Uint8Array(maxBytes);
+  let bytes = 0;
+  try {
+    while (true) {
+      const chunk = await untilAborted(reader.read(), signal);
+      checkDeadline();
+      if (chunk.done) break;
+      bytes += chunk.value.byteLength;
+      if (bytes > maxBytes) throw invalid;
+      body.set(chunk.value, bytes - chunk.value.byteLength);
+    }
+    try { return new TextDecoder('utf-8', { fatal: true }).decode(body.subarray(0, bytes)); }
+    catch { throw invalid; }
+  } finally {
+    // Even a stalled cancellation cannot hold the verification deadline open.
+    void reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+
+function publishedPage(raw, slug, locale) {
+  let envelope;
+  try { envelope = JSON.parse(raw); } catch { throw invalid; }
+  const data = envelope?.data;
+  if (!object(envelope) || !object(data) || !Array.isArray(data.items) || !Number.isSafeInteger(data.total) || data.total < 0) throw invalid;
+  if (data.items.length === 0 && data.total === 0) return 'not-published';
+  if (data.items.length !== 1 || data.total !== 1) throw invalid;
+  const item = data.items[0], document = item?.document;
+  // Check the published-delivery envelope, not renderer or full block compatibility.
+  if (!object(item) || !uuid.test(item.id) || item.kind !== 'page' || item.slug !== slug || item.locale !== locale ||
+    !Number.isSafeInteger(item.version) || item.version < 0 || typeof item.publishedAt !== 'string' || !Number.isFinite(Date.parse(item.publishedAt)) ||
+    item.preview === true || (item.status !== undefined && item.status !== 'published') || !object(document) || document.schemaVersion !== 1 ||
+    typeof document.title !== 'string' || !document.title.trim() || document.title.length > 200 ||
+    typeof document.excerpt !== 'string' || document.excerpt.length > 1000 || !Array.isArray(document.blocks) || document.blocks.length > 200) throw invalid;
+  return 'verified';
+}
+
+/** Returns constant outcomes only; neither configuration nor response content is returned or printed. */
+export async function verifyPublishedDelivery({ env = process.env, slug, locale = 'en', fetcher = globalThis.fetch, timeoutMs = DELIVERY_CHECK_TIMEOUT_MS, maxResponseBytes = DELIVERY_CHECK_MAX_BYTES } = {}) {
+  let origin, siteId, environmentId, key, canonicalLocale;
+  try {
+    key = env?.CMS_API_KEY;
+    if (typeof key !== 'string' || !key.trim()) return result('missing-key');
+    origin = apiOrigin(env?.CMS_API_BASE_URL); siteId = env?.CMS_SITE_ID; environmentId = env?.CMS_ENVIRONMENT_ID;
+    const keyParts = keyPattern.exec(key);
+    if (!origin || typeof siteId !== 'string' || !uuid.test(siteId) || typeof environmentId !== 'string' || !uuid.test(environmentId) ||
+      !keyParts || !uuid.test(keyParts[1]) || !uuid.test(keyParts[2]) || typeof slug !== 'string' || slug.length > 160 || !/^[a-z0-9]+(?:[-/][a-z0-9]+)*$/.test(slug) ||
+      typeof locale !== 'string' || locale.length < 2 || locale.length > 35 || typeof fetcher !== 'function' ||
+      !positiveBoundedInteger(timeoutMs, DELIVERY_CHECK_TIMEOUT_MS) || !positiveBoundedInteger(maxResponseBytes, DELIVERY_CHECK_MAX_BYTES)) return result('configuration-error');
+    canonicalLocale = Intl.getCanonicalLocales(locale)[0];
+    if (!canonicalLocale) return result('configuration-error');
+  } catch { return result('configuration-error'); }
+  const url = new URL(`/api/v1/delivery/sites/${siteId}/content`, origin);
+  url.search = new URLSearchParams({ environmentId, kind: 'page', slug, locale: canonicalLocale, limit: '2' }).toString();
+  const controller = new AbortController();
+  let timedOut = false, response;
+  const deadline = Date.now() + timeoutMs;
+  const checkDeadline = () => { if (Date.now() >= deadline) { timedOut = true; controller.abort(); throw new Error('Delivery check deadline'); } };
+  const timer = setTimeout(() => { timedOut = true; controller.abort(); }, timeoutMs);
+  try {
+    response = await untilAborted(fetcher(url, {
+      method: 'GET', headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' },
+      credentials: 'omit', redirect: 'error', cache: 'no-store', referrerPolicy: 'no-referrer', signal: controller.signal,
+    }), controller.signal);
+    checkDeadline();
+    if (!(response instanceof Response) || response.redirected || ['opaque', 'opaqueredirect'].includes(response.type) ||
+      (response.url && response.url !== url.href) || (response.status >= 300 && response.status < 400)) return result('invalid-response');
+    if ([401, 403].includes(response.status)) return result('authorization-rejected');
+    if (!response.ok) return result('http-error');
+    if (response.status !== 200 || response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase() !== 'application/json') throw invalid;
+    const status = publishedPage(await boundedBody(response, maxResponseBytes, controller.signal, checkDeadline), slug, canonicalLocale);
+    checkDeadline();
+    return result(status);
+  } catch (error) {
+    return result(timedOut ? 'timeout' : error === invalid ? 'invalid-response' : 'transport-error');
+  } finally { clearTimeout(timer); controller.abort(); cancelBody(response); }
+}
+
+export function parseDeliveryArguments(args) {
+  if (!Array.isArray(args)) return null;
+  const options = {};
+  for (let index = 0; index < args.length; index += 2) {
+    const name = args[index], value = args[index + 1];
+    if (!['--slug', '--locale'].includes(name) || typeof value !== 'string' || !value || value.startsWith('-') || Object.hasOwn(options, name.slice(2))) return null;
+    options[name.slice(2)] = value;
+  }
+  return options.slug ? options : null;
+}
+
+async function main() {
+  if (process.argv.length === 3 && process.argv[2] === '--help') {
+    process.stdout.write('Usage: check-delivery --slug <published-page-slug> [--locale <locale>]\nUses private CMS_API_BASE_URL, CMS_SITE_ID, CMS_ENVIRONMENT_ID and CMS_API_KEY. Reads published content only; does not read .env or verify website rendering.\n');
+    return;
+  }
+  let outcome;
+  try {
+    const options = parseDeliveryArguments(process.argv.slice(2));
+    outcome = options ? await verifyPublishedDelivery(options) : result('configuration-error');
+  } catch { outcome = result('configuration-error'); }
+  process.stdout.write(JSON.stringify(outcome) + '\n');
+  if (!outcome.verified) process.exitCode = 1;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) await main();

package/dist/vendor/dependency-diagnostics.mjs

@@ -0,0 +1,72 @@
+/** Sanitized dependency advice. Browser-safe: no filesystem, modules or network. */
+export const CMS_DEPENDENCY_NAMES = Object.freeze({
+  sdk: '@universalcms/sdk', react: '@universalcms/react', next: '@universalcms/next',
+});
+const packageKeys = Object.keys(CMS_DEPENDENCY_NAMES);
+const declarations = ['runtime', 'development', 'missing', 'unknown'];
+const installations = ['present', 'missing', 'unknown'];
+const compatibility = ['compatible', 'incompatible', 'unknown'];
+
+function values(value, keys) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Object.keys(descriptors).length !== keys.length || keys.some(key => !descriptors[key] || !('value' in descriptors[key]))) return null;
+  return Object.fromEntries(keys.map(key => [key, descriptors[key].value]));
+}
+
+/** Reject arbitrary labels, paths, package versions, credentials and getters. */
+export function validateDependencyDiagnostics(value) {
+  try {
+    const diagnostic = values(value, ['generatedAt', 'packages', 'node']);
+    if (!diagnostic || typeof diagnostic.generatedAt !== 'string' ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(diagnostic.generatedAt) ||
+        new Date(diagnostic.generatedAt).toISOString() !== diagnostic.generatedAt ||
+        !compatibility.includes(diagnostic.node)) return null;
+    const candidates = values(diagnostic.packages, packageKeys);
+    if (!candidates) return null;
+    const packages = {};
+    for (const key of packageKeys) {
+      const candidate = values(candidates[key], ['declared', 'installed', 'compatibility']);
+      if (!candidate || !declarations.includes(candidate.declared) || !installations.includes(candidate.installed) ||
+          !compatibility.includes(candidate.compatibility) ||
+          (candidate.installed !== 'present' && candidate.compatibility !== 'unknown')) return null;
+      packages[key] = { declared: candidate.declared, installed: candidate.installed, compatibility: candidate.compatibility };
+    }
+    if (packages.sdk.compatibility === 'compatible' && diagnostic.node !== 'compatible') return null;
+    if (packages.next.compatibility === 'compatible' && (diagnostic.node !== 'compatible' || packages.sdk.compatibility !== 'compatible')) return null;
+    // The React renderer may run in a browser even when the inspection process
+    // cannot run the credentialed Node client. Its package dependency must exist.
+    if (packages.react.compatibility === 'compatible' && packages.sdk.installed !== 'present') return null;
+    return { generatedAt: diagnostic.generatedAt, packages, node: diagnostic.node };
+  } catch { return null; }
+}
+
+/** A manifest establishes declarations only, never installation or runtime health. */
+export function createManifestDependencyDiagnostics(packageJsonText, now = new Date()) {
+  let manifest = null;
+  try {
+    if (typeof packageJsonText === 'string' && new TextEncoder().encode(packageJsonText).byteLength <= 128 * 1024) {
+      const parsed = JSON.parse(packageJsonText);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) manifest = parsed;
+    }
+  } catch { /* Keep declaration confidence unknown, without reflecting source. */ }
+  const sections = ['dependencies', 'devDependencies', 'optionalDependencies'];
+  const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+  const invalidSections = manifest && sections.some(key => own(manifest, key) && (!manifest[key] || typeof manifest[key] !== 'object' || Array.isArray(manifest[key])));
+  const declaration = name => {
+    if (!manifest || invalidSections) return 'unknown';
+    for (const section of sections) {
+      if (manifest[section] && own(manifest[section], name) && (typeof manifest[section][name] !== 'string' || !manifest[section][name].trim())) return 'unknown';
+    }
+    if (['dependencies', 'optionalDependencies'].some(key => manifest[key] && own(manifest[key], name))) return 'runtime';
+    if (manifest.devDependencies && own(manifest.devDependencies, name)) return 'development';
+    return 'missing';
+  };
+  const packages = {};
+  for (const [key, name] of Object.entries(CMS_DEPENDENCY_NAMES)) {
+    const declared = declaration(name);
+    packages[key] = { declared, installed: 'unknown', compatibility: 'unknown' };
+  }
+  const generatedAt = new Date(now).toISOString();
+  return { generatedAt, packages, node: 'unknown' };
+}

package/dist/vendor/inspect-installed-dependencies.mjs

@@ -0,0 +1,125 @@
+/** Bounded local metadata inspection. Never executes website modules or scripts. */
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { createManifestDependencyDiagnostics, CMS_DEPENDENCY_NAMES } from './dependency-diagnostics.mjs';
+
+const MAX_METADATA_BYTES = 128 * 1024;
+const packages = [
+  { key: 'sdk', name: CMS_DEPENDENCY_NAMES.sdk, entry: 'dist/index.js', exportCondition: 'default' },
+  { key: 'react', name: CMS_DEPENDENCY_NAMES.react, entry: 'dist/index.js', exportCondition: 'import' },
+  { key: 'next', name: CMS_DEPENDENCY_NAMES.next, entry: 'dist/index.js', exportCondition: 'import' },
+  { key: 'reactPeer', name: 'react', entry: 'index.js' },
+  { key: 'nextPeer', name: 'next', entry: 'dist/server/next.js' },
+];
+const inside = (root, target) => {
+  const relative = path.relative(root, target);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+};
+const plain = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+async function readMetadata(filename, directory) {
+  let handle;
+  try {
+    const before = await lstat(filename);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_METADATA_BYTES || await realpath(filename) !== filename || !inside(directory, filename)) return null;
+    handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const opened = await handle.stat(), current = await lstat(filename);
+    if (!opened.isFile() || current.isSymbolicLink() || opened.ino !== current.ino || opened.dev !== current.dev ||
+        opened.size > MAX_METADATA_BYTES || await realpath(filename) !== filename) return null;
+    const buffer = Buffer.alloc(MAX_METADATA_BYTES + 1);
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const part = await handle.read(buffer, bytes, buffer.length - bytes, bytes);
+      if (!part.bytesRead) break;
+      bytes += part.bytesRead;
+    }
+    if (bytes > MAX_METADATA_BYTES) return null;
+    const parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(buffer.subarray(0, bytes)));
+    return plain(parsed) ? parsed : null;
+  } catch { return null; }
+  finally { await handle?.close(); }
+}
+
+function numericVersion(value) {
+  if (typeof value !== 'string') return null;
+  const match = /^(?:v)?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value);
+  if (!match) return null;
+  const numbers = match.slice(1).map(Number);
+  return numbers.every(Number.isSafeInteger) ? numbers : null;
+}
+function nodeCompatibility(value) {
+  const version = numericVersion(value);
+  return !version ? 'unknown' : version[0] > 20 || (version[0] === 20 && version[1] >= 19) ? 'compatible' : 'incompatible';
+}
+function peerCompatibility(value, major, minimumMinor = 0) {
+  const version = numericVersion(value);
+  return !version ? 'unknown' : version[0] === major && version[1] >= minimumMinor ? 'compatible' : 'incompatible';
+}
+function allCompatible(states) {
+  return states.includes('incompatible') ? 'incompatible' : states.every(value => value === 'compatible') ? 'compatible' : 'unknown';
+}
+
+async function inspectPackage(modules, descriptor) {
+  const directory = path.join(modules, ...descriptor.name.split('/'));
+  let info;
+  // Validate a scoped package's parent before even probing its child. A scope
+  // link outside node_modules must not leak whether that external child exists.
+  if (descriptor.name.startsWith('@')) {
+    try {
+      const scope = await realpath(path.dirname(directory));
+      if (!inside(modules, scope) || !(await lstat(scope)).isDirectory()) return { installed: 'unknown', version: null };
+    } catch (error) { return { installed: error.code === 'ENOENT' || error.code === 'ENOTDIR' ? 'missing' : 'unknown', version: null }; }
+  }
+  try { info = await lstat(directory); }
+  catch (error) { return { installed: error.code === 'ENOENT' || error.code === 'ENOTDIR' ? 'missing' : 'unknown', version: null }; }
+  try {
+    if (!info.isDirectory() && !info.isSymbolicLink()) return { installed: 'unknown', version: null };
+    // pnpm stores package directories behind symlinks inside node_modules/.pnpm.
+    // External links and shared workspaces are outside this bounded inspection.
+    const actual = await realpath(directory);
+    if (!inside(modules, actual) || actual === modules || !(await lstat(actual)).isDirectory()) return { installed: 'unknown', version: null };
+    const metadata = await readMetadata(path.join(actual, 'package.json'), actual);
+    if (!metadata || metadata.name !== descriptor.name || typeof metadata.version !== 'string') return { installed: 'unknown', version: null };
+    const entry = path.join(actual, descriptor.entry), entryInfo = await lstat(entry);
+    if (!entryInfo.isFile() || entryInfo.isSymbolicLink() || await realpath(entry) !== entry || !inside(actual, entry)) return { installed: 'unknown', version: null };
+    if (descriptor.exportCondition) {
+      if (!plain(metadata.exports) || !plain(metadata.exports['.']) || metadata.exports['.'][descriptor.exportCondition] !== `./${descriptor.entry}`) return { installed: 'unknown', version: null };
+    } else if (descriptor.name === 'next' && ![`./${descriptor.entry}`, descriptor.entry].includes(metadata.main)) return { installed: 'unknown', version: null };
+    return { installed: 'present', version: metadata.version };
+  } catch { return { installed: 'unknown', version: null }; }
+}
+
+/** Inspect one selected project; public output never contains versions or paths. */
+export async function inspectInstalledDependencies(directory, packageJsonText, { now = new Date(), nodeVersion = process.version } = {}) {
+  const diagnostics = createManifestDependencyDiagnostics(packageJsonText, now);
+  diagnostics.node = nodeCompatibility(nodeVersion);
+  let root;
+  try {
+    const requested = path.resolve(directory), rootInfo = await lstat(requested);
+    if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) return diagnostics;
+    root = await realpath(requested);
+  } catch { return diagnostics; }
+  const modules = path.join(root, 'node_modules');
+  let modulesInfo;
+  try { modulesInfo = await lstat(modules); }
+  catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+      for (const candidate of Object.values(diagnostics.packages)) candidate.installed = 'missing';
+    }
+    return diagnostics;
+  }
+  try {
+    if (!modulesInfo.isDirectory() || modulesInfo.isSymbolicLink() || await realpath(modules) !== modules) return diagnostics;
+  } catch { return diagnostics; }
+  const observed = {};
+  for (const descriptor of packages) observed[descriptor.key] = await inspectPackage(modules, descriptor);
+  for (const key of Object.keys(CMS_DEPENDENCY_NAMES)) diagnostics.packages[key].installed = observed[key].installed;
+  const release = key => observed[key].installed === 'present' && observed[key].version === '0.1.0' ? 'compatible' : 'unknown';
+  const reactPeer = observed.reactPeer.installed === 'present' ? peerCompatibility(observed.reactPeer.version, 19, 2) : 'unknown';
+  const nextPeer = observed.nextPeer.installed === 'present' ? peerCompatibility(observed.nextPeer.version, 16) : 'unknown';
+  if (observed.sdk.installed === 'present') diagnostics.packages.sdk.compatibility = allCompatible([release('sdk'), diagnostics.node]);
+  if (observed.react.installed === 'present') diagnostics.packages.react.compatibility = allCompatible([release('react'), release('sdk'), reactPeer]);
+  if (observed.next.installed === 'present') diagnostics.packages.next.compatibility = allCompatible([release('next'), release('sdk'), diagnostics.node, reactPeer, nextPeer]);
+  return diagnostics;
+}