@universalcms/connect 0.0.0-stage → 0.13.0

package/dist/vite-handler.mjs

@@ -0,0 +1,54 @@
+/** Public published-page projection. Supply the fixed, private SDK client. */
+export function createPageHandler(cms, { locale, websiteOrigin, maxConcurrent = 16 }) {
+  const origin = new URL(websiteOrigin);
+  if (origin.origin !== websiteOrigin || (origin.protocol !== 'https:' && !(origin.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname)))) throw Error('Configure the website HTTPS origin.');
+  const canonicalLocale = value => {
+    if (typeof value !== 'string' || !value) return null;
+    try { return Intl.getCanonicalLocales(value)[0] ?? null; } catch { return null; }
+  };
+  const requestedLocale = canonicalLocale(locale);
+  if (!requestedLocale) throw Error('Configure a valid content locale.');
+  let active = 0, count = 0, windowStart = Date.now();
+  function publicBlock(block) {
+    if (block.type === 'form') { const { notifyEmail, subscribe, ...data } = block.data; return { ...block, data }; }
+    if (block.type === 'section') return { ...block, data: { ...block.data, blocks: block.data.blocks.map(publicBlock) } };
+    if (block.type === 'columns') return { ...block, data: { ...block.data, columns: block.data.columns.map(column => column.map(publicBlock)) } };
+    return block;
+  }
+  return async function pageHandler(req, res) {
+    const send = (status, value) => {
+      if (res.destroyed || res.writableEnded) return;
+      res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer' });
+      res.end(JSON.stringify(value));
+    };
+    let url;
+    try {
+      if (typeof req.url !== 'string' || req.url.length > 512 || !req.url.startsWith('/') || req.url.startsWith('//') || req.url.includes('\\')) throw Error();
+      url = new URL(req.url, websiteOrigin);
+    } catch { send(400, { error: 'Invalid request.' }); return; }
+    if (url.pathname !== '/api/universalcms/page') { send(404, { error: 'Not found.' }); return; }
+    if (req.method !== 'GET') { send(405, { error: 'Method not allowed.' }); return; }
+    if (req.headers.origin && req.headers.origin !== websiteOrigin) { send(403, { error: 'Origin not allowed.' }); return; }
+    if ([...url.searchParams.keys()].some(key => key !== 'slug') || url.searchParams.getAll('slug').length !== 1) { send(400, { error: 'One page slug is required.' }); return; }
+    const slug = url.searchParams.get('slug');
+    if (!slug || slug.length > 160 || !/^[a-z0-9]+(?:[-/][a-z0-9]+)*$/.test(slug)) { send(400, { error: 'Invalid page slug.' }); return; }
+    const now = Date.now();
+    if (now - windowStart >= 60_000) { windowStart = now; count = 0; }
+    if (active >= maxConcurrent || ++count > 600) { send(429, { error: 'Try again later.' }); return; }
+    active++;
+    const controller = new AbortController();
+    const cancel = () => { if (!res.writableEnded) controller.abort(); };
+    res.on('close', cancel);
+    try {
+      const entry = await cms.content.getBySlug(slug, { kind: 'page', locale: requestedLocale }, { signal: controller.signal });
+      if (!entry) { send(404, { error: 'Page not found.' }); return; }
+      // Keep the response bound to the same query even if a delivery adapter
+      // returns a valid entry for a different slug, type or language.
+      if (entry.kind !== 'page' || entry.slug !== slug || canonicalLocale(entry.locale) !== requestedLocale) throw Error('Invalid delivery identity.');
+      // Browser receives only public renderer fields. No custom fields, form
+      // notification destinations, request headers, config or SDK credentials.
+      send(200, { entry: { id: entry.id, document: { title: entry.document.title, excerpt: entry.document.excerpt, blocks: entry.document.blocks.map(publicBlock) } } });
+    } catch { send(503, { error: 'Content is temporarily unavailable.' }); }
+    finally { active--; res.off('close', cancel); }
+  };
+}

package/dist/vite-publication-server.d.mts

@@ -0,0 +1,3 @@
+import type { Server } from 'node:http';
+/** Private runtime Node host; call listen only after configuring the deployed origin. */
+export function createVitePublicationServer(options: { root: string; configuration: unknown; sourceConfiguration?: unknown; contentBindings?: unknown; env?: Record<string, string | undefined>; fetcher?: typeof fetch }): Server;

package/dist/vite-publication-server.mjs

@@ -0,0 +1,82 @@
+import { createServer } from 'node:http';
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { createVitePublicationHandler } from './vite-publication.mjs';
+import { createViteSourceHandler } from './vite-source.mjs';
+import { publicationErrorHtml, resolvePublicationRoute, validatePublicationConfig } from './publication.mjs';
+import { publicationVerification } from './publication-verification.mjs';
+
+const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.mjs': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.json': 'application/json; charset=utf-8', '.svg': 'image/svg+xml', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp', '.avif': 'image/avif', '.gif': 'image/gif', '.ico': 'image/x-icon', '.woff': 'font/woff', '.woff2': 'font/woff2', '.ttf': 'font/ttf', '.txt': 'text/plain; charset=utf-8', '.xml': 'application/xml; charset=utf-8', '.webm': 'video/webm', '.mp4': 'video/mp4', '.mp3': 'audio/mpeg', '.pdf': 'application/pdf' };
+const noStore = { 'Cache-Control': 'private, no-store, max-age=0', 'CDN-Cache-Control': 'no-store', 'Surrogate-Control': 'no-store', 'X-Content-Type-Options': 'nosniff' };
+const stamp = stat => [stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs, stat.nlink].join(':');
+
+async function asset(root, relative) {
+  const dist = path.join(root, 'dist');
+  const resolved = await realpath(root);
+  let target = resolved;
+  for (const part of ['dist', ...relative.split('/')]) {
+    target = path.join(target, part);
+    const stat = await lstat(target);
+    if (stat.isSymbolicLink() || await realpath(target) !== target || (target === path.join(resolved, 'dist', relative) ? !stat.isFile() || stat.nlink !== 1 : !stat.isDirectory())) throw Error('Invalid public file');
+  }
+  const file = await open(path.join(dist, relative), constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = await file.stat();
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > 64 * 1024 * 1024) throw Error('Invalid public file');
+    const buffer = Buffer.alloc(stat.size);
+    let size = 0;
+    while (size < buffer.length) {
+      const result = await file.read(buffer, size, buffer.length - size, size);
+      if (!result.bytesRead) break;
+      size += result.bytesRead;
+    }
+    if (size !== stat.size || stamp(await file.stat()) !== stamp(stat) || stamp(await lstat(target)) !== stamp(stat)) throw Error('Public file changed');
+    return buffer;
+  } finally { await file.close(); }
+}
+
+function sendError(request, response, status) {
+  if (response.destroyed || response.writableEnded) return;
+  const body = publicationErrorHtml(status);
+  response.writeHead(status, { ...noStore, 'Content-Type': 'text/html; charset=utf-8', 'Content-Length': Buffer.byteLength(body) });
+  response.end(request.method === 'HEAD' ? undefined : body);
+}
+
+/**
+ * Deployable Node host for the Vite dist folder. Unknown routes and missing files
+ * never fall back to the app shell. Finite native paths from an exact reviewed
+ * profile retain their existing application UI. Private/preview/custom server routes
+ * require reviewed composition with createVitePublicationHandler instead.
+ */
+export function createVitePublicationServer({ root, configuration, sourceConfiguration, contentBindings, env, fetcher = globalThis.fetch }) {
+  const config = validatePublicationConfig(configuration), sourceRoot = path.resolve(root);
+  const verification = publicationVerification(config, sourceConfiguration, contentBindings);
+  const publication = createVitePublicationHandler({ sourceRoot, configuration: config, sourceConfiguration, contentBindings, env, fetcher });
+  const source = sourceConfiguration ? createViteSourceHandler({ sourceRoot, configuration: sourceConfiguration }) : null;
+  async function handle(request, response) {
+    if (source && await source(request, response)) return;
+    if (await publication(request, response)) return;
+    if (!['GET', 'HEAD'].includes(request.method)) { sendError(request, response, 404); return; }
+    const pathname = decodeURIComponent(request.url.split('?')[0]);
+    let route;
+    try { route = resolvePublicationRoute(config, pathname === '/index.html' ? '/' : pathname); } catch { route = null; }
+    const native = verification?.nativePaths.includes(pathname.length > 1 ? pathname.replace(/\/$/, '') : pathname) === true;
+    const relative = route || native ? 'index.html' : pathname.slice(1);
+    // The manifest/source endpoint is the only reviewed way to export source.
+    // Dotfiles, source maps, arbitrary HTML and extensionless SPA paths are not
+    // public assets, even if an accidental build copied them into dist.
+    const extension = path.extname(relative).toLowerCase();
+    if (!relative || relative.split('/').some(part => !part || part.startsWith('.') || ['node_modules', 'src', 'api'].includes(part)) || !MIME[extension] || !route && !native && extension === '.html') {
+      sendError(request, response, 404); return;
+    }
+    try {
+      const body = await asset(sourceRoot, relative);
+      response.writeHead(200, { ...noStore, 'Content-Type': MIME[extension], 'Content-Length': body.length });
+      response.end(request.method === 'HEAD' ? undefined : body);
+    } catch { sendError(request, response, route || native ? 503 : 404); }
+  }
+  return createServer({ requestTimeout: 15000, headersTimeout: 10000, maxHeaderSize: 8192 }, (request, response) => {
+    void handle(request, response).catch(() => { sendError(request, response, 503); });
+  });
+}

package/dist/vite-publication.d.mts

@@ -0,0 +1,15 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+type Middleware = (request: IncomingMessage, response: ServerResponse, next: () => void) => void;
+type VitePublicationServerOptions = { port?: number; strictPort?: boolean; proxy?: Record<string, unknown> };
+export const PUBLICATION_DOCUMENT_PATH: '/api/universalcms/document';
+/** Mount before every static/SPA/proxy handler. Private .env.local is server-only. */
+export function createVitePublicationHandler(options: { sourceRoot: string; configuration: unknown; sourceConfiguration?: unknown; contentBindings?: unknown; env?: Record<string, string | undefined>; fetcher?: typeof fetch }): (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
+export function universalCmsPublication(options: { configuration: unknown; sourceConfiguration?: unknown; contentBindings?: unknown }): {
+  name: string;
+  enforce: 'pre';
+  config(config: { server?: VitePublicationServerOptions; preview?: VitePublicationServerOptions }, environment: { command: 'build' | 'serve' }): { server: VitePublicationServerOptions & { port: number; strictPort: true }; preview: VitePublicationServerOptions & { port: number; strictPort: true } } | undefined;
+  configResolved(config: { root: string; base?: string; appType?: string; publicDir?: string | false; command?: 'build' | 'serve'; server?: VitePublicationServerOptions; preview?: VitePublicationServerOptions }): void;
+  configureServer(server: { middlewares: { use(handler: Middleware): unknown } }): void;
+  configurePreviewServer(server: { middlewares: { use(handler: Middleware): unknown } }): void;
+  transformIndexHtml: { order: 'pre'; handler(): { tag: 'script'; attrs: { src: string }; injectTo: 'head-prepend' }[] };
+};

package/dist/vite-publication.mjs

@@ -0,0 +1,241 @@
+import { constants, lstatSync } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { parseEnv } from 'node:util';
+import { createPublishedDocumentReader, isExcludedPublicationPath, normalizePublicationPath, publicationErrorHtml, resolvePublicationRoute, validatePublicationConfig, publicationRevision, publicPublishedEntry } from './publication.mjs';
+import { createPublicationBrowserScript, PUBLICATION_SCRIPT_PATH, PUBLICATION_STATUS_PATH, PUBLICATION_DOCUMENT_PATH } from './publication-browser.mjs';
+import { publicationVerification, verificationRequest, verificationBody, publicationRouteHeaders } from './publication-verification.mjs';
+export { PUBLICATION_DOCUMENT_PATH };
+
+const PRIVATE_ENV_KEYS = ['CMS_API_KEY', 'CMS_API_BASE_URL', 'CMS_SITE_ID', 'CMS_ENVIRONMENT_ID', 'CMS_WEBSITE_ORIGIN', 'CMS_LOCALE'];
+const stamp = stat => [stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs, stat.nlink].join(':');
+const privateHeaders = { 'Cache-Control': 'private, no-store, max-age=0', 'CDN-Cache-Control': 'no-store', 'Surrogate-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer' };
+const reservedPaths = [PUBLICATION_DOCUMENT_PATH, PUBLICATION_STATUS_PATH, PUBLICATION_SCRIPT_PATH];
+const collision = () => { throw Error('A reserved Universal CMS publication endpoint overlaps an existing website proxy or public asset. Preserve the existing endpoint and integrate publication manually.'); };
+
+function checkProxyOwnership(proxy) {
+  if (!proxy || typeof proxy !== 'object') return;
+  for (const key of Object.keys(proxy)) for (const endpoint of reservedPaths) {
+    if (key === endpoint || key.startsWith(`${endpoint}?`) || key.startsWith(`${endpoint}/`)) collision();
+    if (!key.startsWith('^')) continue;
+    let pattern;
+    try { pattern = new RegExp(key); } catch { continue; } // Vite reports invalid proxy expressions itself.
+    const matches = pattern.test(endpoint) || pattern.test(`${endpoint}?path=%2F`) || pattern.test(`${endpoint}/`);
+    // Preserve broad /api or /.well-known proxies: our explicitly reserved
+    // endpoints precede them. A pattern selecting this endpoint specifically
+    // needs review, including exact regex alternatives/query boundaries.
+    const sibling = `${endpoint.slice(0, endpoint.lastIndexOf('/'))}/__universalcms_ownership_probe__`;
+    if (matches && !pattern.test(sibling) && !pattern.test(`${sibling}?path=%2F`)) collision();
+  }
+}
+
+function checkPublicOwnership(resolved) {
+  if (resolved.publicDir === false) return;
+  const directory = path.resolve(resolved.root, resolved.publicDir ?? 'public');
+  for (const endpoint of reservedPaths) {
+    try { lstatSync(path.join(directory, endpoint.slice(1))); }
+    catch (error) { if (error?.code === 'ENOENT') continue; throw Error('Could not verify reserved publication endpoint ownership.'); }
+    collision();
+  }
+}
+
+/** Read the fixed private server file without Vite env injection or interpolation. */
+export async function readServerEnvironment(root) {
+  const sourceRoot = path.resolve(root), rootStat = await lstat(sourceRoot);
+  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw Error('Invalid website root');
+  const actualRoot = await realpath(sourceRoot), filename = path.join(actualRoot, '.env.local');
+  let local = {};
+  try {
+    const stat = await lstat(filename);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1 || stat.size > 128 * 1024) throw Error('Invalid private configuration');
+    const file = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+      const before = await file.stat();
+      if (stamp(before) !== stamp(stat)) throw Error('Private configuration changed');
+      const buffer = Buffer.alloc(128 * 1024 + 1);
+      let size = 0;
+      while (size < buffer.length) {
+        const result = await file.read(buffer, size, buffer.length - size, size);
+        if (!result.bytesRead) break;
+        size += result.bytesRead;
+      }
+      if (size > 128 * 1024 || stamp(await file.stat()) !== stamp(before) || stamp(await lstat(filename)) !== stamp(before)) throw Error('Private configuration changed');
+      local = parseEnv(new TextDecoder('utf-8', { fatal: true }).decode(buffer.subarray(0, size)));
+    } finally { await file.close(); }
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw Error('Invalid private configuration');
+  }
+  // An explicit server process environment has standard precedence. Neither
+  // map is assigned to process.env, returned to the browser or logged.
+  return Object.fromEntries(PRIVATE_ENV_KEYS.filter(key => process.env[key] !== undefined || local[key] !== undefined).map(key => [key, process.env[key] ?? local[key]]));
+}
+
+function send(response, method, status, type, body, headers = {}) {
+  if (response.destroyed || response.writableEnded) return;
+  response.writeHead(status, { ...privateHeaders, ...headers, 'Content-Type': type, 'Content-Length': Buffer.byteLength(body) });
+  response.end(method === 'HEAD' ? undefined : body);
+}
+
+/** Node middleware: install before static serving, user proxies and SPA fallback. */
+export function createVitePublicationHandler({ sourceRoot, configuration, sourceConfiguration, contentBindings, env, fetcher = globalThis.fetch }) {
+  const config = validatePublicationConfig(configuration);
+  const verification = publicationVerification(config, sourceConfiguration, contentBindings);
+  const authority = new URL(config.websiteOrigin).host;
+  const script = createPublicationBrowserScript(config);
+  const fixedEnv = env ? { ...env } : null;
+  let checker, lastEnvironment;
+  return async function handle(request, response) {
+    const raw = request.url;
+    // Do not let URL's dot-segment normalization turn a tampered request into a
+    // route outside the registry before its publication check.
+    const rawPath = typeof raw === 'string' ? raw.split('?')[0] : '';
+    let pathname;
+    try {
+      if (!rawPath.startsWith('/') || rawPath.startsWith('//') || rawPath.length > 1500 || /[\\\s#\u0000-\u001f\u007f]/.test(rawPath) || /%(?![0-9a-f]{2})|%(?:2f|5c|2e|25|3f|23|0[0-9a-f]|1[0-9a-f]|7f)/i.test(rawPath)) throw Error('Invalid path');
+      pathname = decodeURIComponent(rawPath);
+      if (pathname.split('/').some(part => part === '.' || part === '..') || pathname.includes('//')) throw Error('Invalid path');
+      if (pathname.length > 1) pathname = pathname.replace(/\/$/, '');
+    }
+    catch {
+      send(response, request.method, 400, 'text/plain; charset=utf-8', 'Invalid request');
+      return true;
+    }
+    const statusEndpoint = pathname === PUBLICATION_STATUS_PATH, documentEndpoint = pathname === PUBLICATION_DOCUMENT_PATH, scriptEndpoint = pathname === PUBLICATION_SCRIPT_PATH;
+    const dataEndpoint = statusEndpoint || documentEndpoint;
+    let route = null;
+    try { route = resolvePublicationRoute(config, pathname === '/index.html' ? '/' : pathname); } catch { /* Ordinary asset names are not publication paths. */ }
+    if (!dataEndpoint && !scriptEndpoint && !route) {
+      if (verification?.nativePaths.includes(pathname)) {
+        if (request.headers?.host !== authority) { send(response, request.method, 403, 'text/plain; charset=utf-8', 'Forbidden'); return true; }
+        if (!['GET', 'HEAD'].includes(request.method)) { send(response, request.method, 405, 'text/plain; charset=utf-8', 'Method not allowed'); return true; }
+        return false;
+      }
+      // Vite's virtual module identifiers may contain colons. They remain under
+      // Vite's existing filesystem/host boundary and never select a CMS route.
+      if (/^\/@(?:vite|id|fs)(?:\/|$)/.test(pathname) || pathname === '/@react-refresh') return false;
+      try { if (isExcludedPublicationPath(pathname)) return false; } catch { /* Unsupported document URLs fail closed below. */ }
+      send(response, request.method, 404, 'text/html; charset=utf-8', publicationErrorHtml(404));
+      return true;
+    }
+    const origin = request.headers?.origin;
+    const probe = statusEndpoint ? verificationRequest({ configuration: config, verification, url: new URL(raw, config.websiteOrigin), method: request.method, headers: new Headers(request.headers) }) : null;
+    if (probe?.status) {
+      send(response, request.method, probe.status, 'application/json; charset=utf-8', probe.status === 204 ? '' : '{"error":"Publication verification unavailable."}', probe.headers);
+      return true;
+    }
+    if (request.headers?.host !== authority || !probe && (dataEndpoint || scriptEndpoint) && (origin !== undefined && origin !== config.websiteOrigin || request.headers?.['sec-fetch-site'] === 'cross-site')) {
+      send(response, request.method, 403, 'text/plain; charset=utf-8', 'Forbidden');
+      return true;
+    }
+    if (!['GET', 'HEAD'].includes(request.method)) {
+      send(response, request.method, 405, 'text/plain; charset=utf-8', 'Method not allowed');
+      return true;
+    }
+    if (scriptEndpoint) {
+      if (raw !== PUBLICATION_SCRIPT_PATH) send(response, request.method, 400, 'text/plain; charset=utf-8', 'Invalid request');
+      else send(response, request.method, 200, 'text/javascript; charset=utf-8', script);
+      return true;
+    }
+    let target = probe?.pathname ?? route?.path ?? pathname;
+    if (dataEndpoint && !probe) {
+      const query = new URLSearchParams(raw.slice(raw.indexOf('?') + 1));
+      if (!raw.includes('?') || query.size !== 1 || !query.has('path')) {
+        send(response, request.method, 400, 'application/json; charset=utf-8', JSON.stringify({ state: 'unavailable' }));
+        return true;
+      }
+      try {
+        target = normalizePublicationPath(query.get('path'));
+        if (target === '/index.html') target = '/';
+      }
+      catch {
+        send(response, request.method, 400, 'application/json; charset=utf-8', JSON.stringify({ state: 'unavailable' }));
+        return true;
+      }
+    }
+    let result;
+    try {
+      const runtimeEnv = fixedEnv ?? await readServerEnvironment(sourceRoot);
+      const identity = PRIVATE_ENV_KEYS.map(key => runtimeEnv[key]);
+      if (!checker || identity.some((value, index) => value !== lastEnvironment[index])) {
+        checker = createPublishedDocumentReader({ configuration: config, env: runtimeEnv, fetcher });
+        lastEnvironment = identity;
+      }
+      result = await checker(target);
+    } catch { result = { state: 'unavailable', status: 503 }; }
+    if (probe) {
+      const extraHeaders = result.reason ? { 'X-UniversalCMS-Delivery-Status': result.reason } : {};
+      send(response, request.method, result.state === 'unavailable' ? 503 : 200, 'application/json; charset=utf-8', JSON.stringify(verificationBody(verification, target, result)), { ...probe.headers, ...extraHeaders });
+      return true;
+    }
+    if (dataEndpoint) {
+      const state = result.state === 'unmanaged' ? 'missing' : result.state;
+      const extraHeaders = result.reason ? { 'X-UniversalCMS-Delivery-Status': result.reason } : {};
+      // Keep the original one-key envelope for already-open 0.5.0 browser tabs.
+      const includeRevision = documentEndpoint || request.headers?.['x-universalcms-include-revision'] === '1';
+      const body = { state, ...(result.entry && includeRevision ? { revision: publicationRevision(result.entry), ...(documentEndpoint ? { entry: publicPublishedEntry(result.entry) } : {}) } : {}) };
+      send(response, request.method, state === 'published' ? 200 : state === 'missing' ? 404 : 503, 'application/json; charset=utf-8', JSON.stringify(body), extraHeaders);
+      return true;
+    }
+    if (result.state !== 'published') {
+      const status = result.state === 'missing' ? 404 : 503;
+      send(response, request.method, status, 'text/html; charset=utf-8', publicationErrorHtml(status), publicationRouteHeaders(config, target, result, verification, origin, !!request.headers.authorization || !!request.headers.cookie));
+      return true;
+    }
+    // Preserve no-store even when downstream static middleware chooses its own
+    // cache policy or receives an If-None-Match/If-Modified-Since request.
+    const managedHeaders = { ...privateHeaders, ...publicationRouteHeaders(config, target, result, verification, origin, !!request.headers.authorization || !!request.headers.cookie) };
+    for (const [name, value] of Object.entries(managedHeaders)) response.setHeader(name, value);
+    delete request.headers['if-none-match']; delete request.headers['if-modified-since'];
+    const writeHead = response.writeHead;
+    response.writeHead = function (status, reason, headers) {
+      const values = typeof reason === 'object' ? reason : headers;
+      if (values) for (const name of Object.keys(values)) if (['cache-control', 'cdn-cache-control', 'surrogate-control', 'etag', 'last-modified'].includes(name.toLowerCase())) delete values[name];
+      for (const [name, value] of Object.entries(managedHeaders)) this.setHeader(name, value);
+      this.removeHeader?.('ETag'); this.removeHeader?.('Last-Modified');
+      return writeHead.call(this, status, reason, headers);
+    };
+    return false;
+  };
+}
+
+/** Builds inject the same client; production still needs the Node middleware. */
+export function universalCmsPublication({ configuration, sourceConfiguration, contentBindings }) {
+  const config = validatePublicationConfig(configuration);
+  const origin = new URL(config.websiteOrigin);
+  const localPort = origin.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(origin.hostname) ? Number(origin.port || 80) : null;
+  const portError = () => { throw Error(`Universal CMS publication requires the registered website port ${localPort} with strictPort enabled. Remove conflicting Vite port overrides or update the reviewed website origin.`); };
+  let sourceRoot;
+  function install(server) {
+    if (!sourceRoot) throw Error('Universal CMS publication requires the resolved website root');
+    const handle = createVitePublicationHandler({ sourceRoot, configuration: config, sourceConfiguration, contentBindings });
+    server.middlewares.use((request, response, next) => {
+      void handle(request, response).then(handled => { if (!handled) next(); }, () => {
+        send(response, request.method, 503, 'text/html; charset=utf-8', publicationErrorHtml(503));
+      });
+    });
+  }
+  return {
+    name: 'universalcms-publication', enforce: 'pre',
+    config(value, environment) {
+      checkProxyOwnership(value.server?.proxy); checkProxyOwnership(value.preview?.proxy);
+      if (localPort === null) return;
+      // Vite preview otherwise defaults to 4173 and dev may silently move to the
+      // next port. Both would violate the exact registered authority boundary.
+      if (environment.command === 'serve' && [value.server?.port, value.preview?.port].some(port => port !== undefined && port !== localPort)) portError();
+      return {
+        server: { ...value.server, port: localPort, strictPort: true },
+        preview: { ...value.preview, port: localPort, strictPort: true },
+      };
+    },
+    configResolved(resolved) {
+      if (resolved.base && resolved.base !== '/' || resolved.appType === 'custom') throw Error('Custom Vite base paths and servers need reviewed publication integration');
+      checkProxyOwnership(resolved.server?.proxy); checkProxyOwnership(resolved.preview?.proxy);
+      checkPublicOwnership(resolved);
+      if (localPort !== null && resolved.command === 'serve' && [resolved.server, resolved.preview].some(server => server?.port !== localPort || server?.strictPort !== true)) portError();
+      sourceRoot = resolved.root;
+    },
+    configureServer: install,
+    configurePreviewServer: install,
+    transformIndexHtml: { order: 'pre', handler() { return [{ tag: 'script', attrs: { src: PUBLICATION_SCRIPT_PATH }, injectTo: 'head-prepend' }]; } },
+  };
+}