@universalcms/connect 0.0.0-stage → 0.13.0

package/dist/wizard.mjs

@@ -0,0 +1,298 @@
+import { analyze, applyPlan, CONFIG_FILE, planSetup, projectRoot, readProjectFile, SetupError, validateConfig, validatePlan } from './core.mjs';
+import { applyEnvironment, planEnvironment, readSetupEnvironment, validateEnvironmentPlan, verifyEnvironment } from './setup-environment.mjs';
+import { setupSource, readSourceSettings, validateSourcePlan, applySourcePlan } from './source-setup.mjs';
+import { planPublicationSetup, planInstalledPublication } from './publication-setup.mjs';
+import { planContentSetup } from './content-setup.mjs';
+import { CONNECTION_FILE, readConnection, assertConnectionMatches, assertSavedConnection, runServerKey, validateConnection } from './staged-setup.mjs';
+import { assertRuntimeDependencies } from './runtime-dependencies.mjs';
+import { assertConnectorRuntime } from './connector-runtime.mjs';
+import { inspectSetupFramework } from './framework.mjs';
+import { planWebsiteSettings, assertPlannedSettingsCompatibility } from './website-setup.mjs';
+import { WEBSITE_SECTIONS } from './website-http.mjs';
+import { isNativeFramework } from './native-adapters.mjs';
+
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const key = /^cms_server\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.[A-Za-z0-9_-]{43}$/;
+function origin(value) {
+  try {
+    const url = new URL(value);
+    return value.length <= 2048 && !/[\s\\]/.test(value) && !url.username && !url.password && !url.search && !url.hash && url.pathname === '/' &&
+      (url.protocol === 'https:' || (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) ? url.origin : null;
+  } catch { return null; }
+}
+function locale(value) { try { return value.length <= 35 ? Intl.getCanonicalLocales(value)[0] : null; } catch { return null; } }
+
+// Settings depend on the reviewed, installed content registry. Keep this a
+// separate review in the same command instead of guessing a future filesystem
+// or silently completing setup after publication alone. It never receives a key.
+async function installWebsiteSettings(root, io, expected) {
+  let plan;
+  const connectionBefore = await readConnection(root);
+  const checkScope = async () => {
+    const connection = await readConnection(root), source = await readSourceSettings(root);
+    if (JSON.stringify(connection) !== JSON.stringify(connectionBefore) ||
+      connection && ['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].some(name => connection[name] !== expected[name]) ||
+      ['siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].some(name => source[name] !== expected[name])) {
+      throw new SetupError('The saved public connection changed during header/footer setup. Review the website scope and rerun setup-settings --apply.');
+    }
+  };
+  try {
+    await checkScope();
+    const framework = await inspectSetupFramework(root);
+    await assertConnectorRuntime(root, framework.framework);
+    plan = await planWebsiteSettings(root);
+  }
+  catch (error) {
+    const reason = error instanceof SetupError ? ` ${error.message}` : '';
+    throw new SetupError(`SETUP INCOMPLETE: Original-page integration was saved, but header/footer integration could not be installed.${reason} Preserve the saved files and finish the reviewed website settings adapter, then run npx --no-install universalcms-connect setup-settings --apply. Do not replace a server key to repair a missing adapter.`);
+  }
+  if (['apiOrigin', 'siteId', 'environmentId', 'websiteOrigin'].some(name => plan.config[name] !== expected[name]) || plan.config.routes.some(route => route.locale !== expected.locale)) throw new SetupError('The saved publication scope changed before header/footer setup. Review the website connection before installing settings.');
+  if (!plan.sections.includes('navigation')) throw new SetupError('SETUP INCOMPLETE: The reviewed settings adapter does not install header/footer navigation. Finish its native navigation slots before connecting the website.');
+  const missingSections = WEBSITE_SECTIONS.filter(name => !plan.sections.includes(name));
+  const changed = plan.files.some(file => file.state !== 'unchanged');
+  if (changed) {
+    io.write('\nHEADER & FOOTER INTEGRATION REQUIRED: Review the website settings files below. Saved CMS links are added alongside original website links; access still requires Navigation on the website server key.\n');
+    for (const file of plan.files) io.write(`  ${file.state}: ${file.path}\n`);
+    io.write(`Installed settings sections after this step: ${plan.sections.join(', ')}. This step changes website integration files only; it does not create, replace or grant access to a server key.\n`);
+    if (missingSections.length) io.write(`Unsupported settings adapters: ${missingSections.join(', ')}. Full setup will remain incomplete until reviewed website integrations are available for these sections.\n`);
+    const answer = (await io.ask('Install header/footer and website settings? [Y/n] ')).trim().toLowerCase();
+    if (answer && !['y', 'yes'].includes(answer)) {
+      io.write('SETUP INCOMPLETE: Original-page files remain saved, but header/footer integration was deferred. Run npx --no-install universalcms-connect setup-settings --apply before checking the connection. Your server key was not changed by this step.\n');
+      return false;
+    }
+  }
+  // Replanning verifies layout/route observations as well as reviewed file
+  // bytes. Reject any confirmation-time change rather than install a new plan
+  // which the user never reviewed.
+  const current = await planWebsiteSettings(root);
+  if (JSON.stringify(current) !== JSON.stringify(plan)) throw new SetupError('The website settings plan changed during review. Header/footer setup remains incomplete; review the website files and rerun setup-settings --apply.');
+  const framework = await inspectSetupFramework(root);
+  await assertConnectorRuntime(root, framework.framework);
+  await checkScope();
+  await validatePlan(plan);
+  await applyPlan(plan);
+  io.write('Header/footer integration is installed. Restart or deploy the website, then run npx --no-install universalcms-connect check-settings. Verify a saved header link and a saved footer link in the actual desktop and mobile menus; file installation alone does not verify their appearance.\n');
+  if (missingSections.length) {
+    io.write(`SETUP INCOMPLETE: Website settings adapters are not installed for ${missingSections.join(', ')}. Key access cannot install these adapters. Preserve the installed files and finish reviewed integration before claiming full setup.\n`);
+    return false;
+  }
+  return true;
+}
+
+/** Interactive effects are injected so cancellation and secret handling are testable. */
+export async function runSetup(directory, options, io) {
+  if (options.originalRoutesOnly !== undefined && typeof options.originalRoutesOnly !== 'boolean') throw new SetupError('Choose a valid original-route setup mode.');
+  const root = await projectRoot(directory);
+  let connection = await readConnection(root), connectionPlan;
+  if (connection) {
+    const publicOptions = Object.fromEntries(Object.entries(options).filter(([name, value]) => value !== undefined && ['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].includes(name)));
+    if (JSON.stringify(validateConnection({ ...connection, ...publicOptions })) !== JSON.stringify(connection)) throw new SetupError('Setup options differ from the saved connection. Review the existing integration before changing scope or origins.');
+    await assertSavedConnection(root, connection);
+    options = { ...options, ...connection };
+  }
+  io.write(`Website project: ${JSON.stringify(root)}\n`);
+  io.write('Setup prepares public source export, publication checks and published-content rendering for the reviewed original website URLs, followed by a required header/footer and website settings review.\n');
+  io.write(connection
+    ? 'Using the saved public connection. After saving a supported delivery template, setup offers a hidden server-key prompt.\n'
+    : options.originalRoutesOnly
+      ? 'Setup will review the complete original-route integration, save its public connection and then offer hidden server-key input. No AI is used.\n'
+    : 'No saved connect record was found. Guided setup asks for public connection values and, when a supported delivery template is prepared, a hidden server key.\n');
+  const analysis = await analyze(root);
+  const detected = await inspectSetupFramework(root, { analysis });
+  await assertConnectorRuntime(root, detected.framework);
+  io.write(`Detected framework: ${detected.label}. Validating source routes and rendering before saving files or asking for a key.\n`);
+  const saved = await readSetupEnvironment(root);
+  let prior;
+  const configText = await readProjectFile(root, CONFIG_FILE);
+  if (configText) {
+    try { prior = validateConfig(JSON.parse(configText)); }
+    catch { throw new SetupError('The saved connector configuration is invalid. Restore it before running setup.'); }
+  }
+  if (options.originalRoutesOnly && !prior) {
+    for (const filename of ['.universalcms/CmsPage.jsx', '.universalcms/demo.jsx', 'universalcms-demo.html']) {
+      if (await readProjectFile(root, filename) !== null) throw new SetupError('Existing delivery demo files have no connector configuration. Restore their reviewed configuration or complete a developer repair before original-route setup; existing files were preserved.');
+    }
+  }
+  // Only the environment helper's sanitized defaults may reach terminal text.
+  const framework = detected.framework;
+  const sourceDefaults = await readSourceSettings(root);
+  const defaults = { ...saved.defaults, ...sourceDefaults, ...(connection ?? {}) };
+  const cacheComponents = framework === 'next' && (await Promise.all(['js', 'mjs', 'cjs', 'ts'].map(extension => readProjectFile(root, `next.config.${extension}`)))).some(source => source && /\bcacheComponents\b/.test(source));
+  const field = async (name, label, validate, fallback, message) => {
+    if (options[name] !== undefined) {
+      const value = validate(options[name]);
+      if (!value) throw new SetupError(message);
+      return value;
+    }
+    while (true) {
+      const answer = (await io.ask(`${label}${fallback ? ` [${fallback}]` : ''}: `)).trim();
+      const value = validate(answer || fallback || '');
+      if (value) return value;
+      io.write(`${message}\n`);
+    }
+  };
+  io.write('Connect this website without AI. Enter the connection values from Developer setup.\n');
+  const apiOrigin = await field('apiOrigin', 'CMS API origin', origin, defaults.apiOrigin, 'Use an HTTPS origin, or HTTP localhost for development.');
+  const siteId = await field('siteId', 'Website ID', value => uuid.test(value) && value.toLowerCase(), defaults.siteId, 'Enter a valid website UUID.');
+  const environmentId = await field('environmentId', 'Environment ID', value => uuid.test(value) && value.toLowerCase(), defaults.environmentId, 'Enter a valid environment UUID.');
+  const contentLocale = await field('locale', 'Content locale', locale, defaults.locale || 'en', 'Enter a valid content locale, such as en.');
+  const websiteOrigin = await field('websiteOrigin', 'Website origin', origin, defaults.websiteOrigin || (framework === 'vite' ? 'http://localhost:5173' : framework === 'astro' ? 'http://localhost:4321' : undefined), 'Use the exact website HTTPS origin, or HTTP localhost during development.');
+  const adminOrigin = await field('adminOrigin', 'CMS admin origin', origin, defaults.adminOrigin, 'Use the exact CMS admin HTTPS origin, or HTTP localhost during development.');
+  if (options.originalRoutesOnly && !connection) {
+    connection = validateConnection({ version: 1, apiOrigin, siteId, environmentId, locale: contentLocale, websiteOrigin, adminOrigin });
+    await assertConnectionMatches(root, connection);
+    connectionPlan = { root, files: [{ path: CONNECTION_FILE, content: `${JSON.stringify(connection, null, 2)}\n`, state: 'create' }] };
+  }
+  const mount = options.mount ?? prior?.mount ?? '/cms';
+  let plan, source, publication, content, environment, previouslyInstalledSettings = false;
+  // The original-route renderer is bundled with the connector. Keep existing
+  // demo files/dependencies intact, but do not require a new SDK demo to connect.
+  if ((framework === 'astro' || isNativeFramework(framework)) && prior) throw new SetupError('Existing delivery demo configuration needs review; native framework setup preserves it.');
+  if (framework !== 'astro' && !isNativeFramework(framework) && !cacheComponents && (!options.originalRoutesOnly || prior)) {
+    try { plan = await planSetup(root, { apiOrigin, siteId, environmentId, locale: contentLocale, mount }, { reconfigure: true }); }
+    catch (error) {
+      const optionalDemoConflict = !prior && error instanceof SetupError && /^(?:Route groups, parallel routes or dynamic root routes need a manual route review before setup\.|The chosen Next\.js mount already exists\.)/.test(error.message);
+      if (framework !== 'next' || !(error instanceof SetupError) || !optionalDemoConflict && !/Automatic setup requires Next\.js 16 with a confirmed Node runtime|Cache Components/.test(error.message)) throw error;
+      io.write('The optional CMS demo route was skipped. Public source and original-route publication setup will validate this website independently.\n');
+    }
+  }
+  if (await readProjectFile(root, '.universalcms/website.integration.json') !== null) {
+    // A settings adapter composes publication and content. Revalidate the owned
+    // installation; running the older publication-only planners here would
+    // downgrade its proxy, Vite server or native page wrappers on every rerun.
+    await assertConnectionMatches(root, validateConnection({ version: 1, apiOrigin, siteId, environmentId, locale: contentLocale, websiteOrigin, adminOrigin }));
+    publication = { ...await planInstalledPublication(root), framework };
+    previouslyInstalledSettings = true;
+    io.write('Existing header/footer, publication and content integration is being checked and preserved. New native routes or customized files require a reviewed adapter update.\n');
+  } else {
+    source = await setupSource(root, { siteId, environmentId, websiteOrigin, adminOrigin, locale: contentLocale, publication: true });
+    publication = await planPublicationSetup(root, { apiOrigin, siteId, environmentId, websiteOrigin }, source);
+    content = await planContentSetup(root, publication, source);
+    await assertPlannedSettingsCompatibility(root, content, publication);
+  }
+  if (plan || prior) await assertRuntimeDependencies(root, framework, adminOrigin);
+  const hasDelivery = Boolean(plan || publication);
+  if (cacheComponents && publication) io.write('The reviewed Next plan disables Cache Components for request-time published content and renders metadata in the initial HTML. Original pages are also checked before HTML or RSC delivery.\n');
+  if (hasDelivery && !connection) {
+    let apiKey;
+    while (true) {
+      const answer = await io.hidden(saved.keyConfigured ? 'Server delivery key (hidden; Enter keeps the saved key): ' : 'Server delivery key (hidden): ');
+      if (!answer && saved.keyConfigured) break;
+      if (key.test(answer)) { apiKey = answer; break; }
+      io.write('Enter a valid server delivery key from Developer setup. It is not an AI provider key.\n');
+    }
+    environment = await planEnvironment(root, { apiOrigin, siteId, environmentId, locale: contentLocale, websiteOrigin, adminOrigin, ...(apiKey ? { apiKey } : {}) });
+    apiKey = undefined;
+  }
+  let slug;
+  while (hasDelivery && !connection) {
+    slug = (await io.ask('Published page slug to verify (optional; Enter skips): ')).trim();
+    if (!slug || (slug.length <= 160 && /^[a-z0-9]+(?:[-/][a-z0-9]+)*$/.test(slug))) break;
+    io.write('Enter a page slug without a leading slash, or leave it empty.\n');
+  }
+  io.write(`\nWebsite: ${siteId}\nEnvironment: ${environmentId}\n${apiOrigin ? `API: ${apiOrigin}\n` : ''}Locale: ${contentLocale}\n`);
+  for (const file of connectionPlan?.files ?? []) io.write(`  ${file.state}: ${file.path}\n`);
+  for (const file of plan?.files ?? []) io.write(`  ${file.state}: ${file.path}\n`);
+  for (const file of publication?.files ?? []) io.write(`  ${file.state}: ${file.path}\n`);
+  for (const file of content?.files ?? []) io.write(`  ${file.state}: ${file.path}\n`);
+  if (publication) {
+    io.write('Review these original URLs before saving. Each one will return 404 until its matching CMS entry is published:\n');
+    for (const route of publication.config.routes) io.write(`  ${route.path} -> ${route.kind} / ${route.slug} / ${route.locale}\n`);
+    io.write('For different URL mappings, cancel and edit .universalcms/publication.routes.json before rerunning. Published pages retain their native design; errors show unavailable content.\n');
+    io.write('The reviewed source blocks will render from published CMS documents. Native interactions remain in their components; new CMS blocks appear after the bound content. Draft saves do not change public pages.\n');
+  }
+  for (const file of environment?.files ?? []) io.write(`  ${file.action}: ${file.path}\n`);
+  if (environment) io.write('The delivery key is saved only in private .env.local (owner access), excluded from Git.\n');
+  if (connection && hasDelivery) io.write('First save the integration files. Setup will then offer to save the delivery key through hidden input; you can also defer it and run server-key later.\n');
+  if (source) {
+    for (const file of source.files) io.write(`  ${file.state}: ${file.path}\n`);
+    io.write(framework === 'astro'
+      ? 'Astro source export uses the reviewed literal public pages and preserves their original layout and style. Private, dynamic or custom routes require a reviewed adapter.\n'
+      : framework === 'vite'
+      ? 'Source export uses the reviewed public pages/posts in .universalcms/source.entries.json. The normal dev and preview commands will serve /api/cms-source after restarting.\n'
+      : 'Automatic source export copies public static page text. Exclude private paths in .universalcms/source.config.json. Dynamic content and unresolved components require explicit mapping and review.\n');
+    io.write(`Source snapshot diagnostics (import data only; publication and content bindings are reviewed separately):\n${JSON.stringify(source.diagnostics)}\n`);
+    if (source.retainedAdapter) io.write('Existing source adapter retained. Its reviewed base mappings are preserved; verify that it serves the refreshed automatic snapshot with check-source.\n');
+  }
+  // The one-command flow presents the same reviewed files and routes in plain
+  // language; it receives only paths, states and routes, never file contents.
+  const confirmation = io.review
+    ? (await io.review({
+      framework: detected.label,
+      routes: (publication?.config.routes ?? []).map(route => ({ path: route.path, kind: route.kind, slug: route.slug })),
+      files: [...connectionPlan?.files ?? [], ...plan?.files ?? [], ...publication?.files ?? [], ...content?.files ?? [], ...source?.files ?? []].map(file => ({ path: file.path, state: file.state }))
+        .concat((environment?.files ?? []).map(file => ({ path: file.path, state: file.action }))),
+    }) ? 'y' : 'n')
+    : (await io.ask('Save this setup? [Y/n] ')).trim().toLowerCase();
+  if (confirmation && confirmation !== 'y' && confirmation !== 'yes') {
+    io.write('Setup cancelled. No files changed.\n'); return { saved: false };
+  }
+  if (plan) await validatePlan(plan);
+  if (publication) await validatePlan(publication);
+  if (content) {
+    await assertPlannedSettingsCompatibility(root, content, publication);
+    await validatePlan(content);
+  }
+  if (environment) await validateEnvironmentPlan(environment);
+  if (source) await validateSourcePlan(source);
+  if (connectionPlan) {
+    await validatePlan(connectionPlan);
+    await assertConnectionMatches(root, connection);
+  } else if (connection) await assertSavedConnection(root, connection);
+  if (options.originalRoutesOnly) {
+    if (await readProjectFile(root, CONFIG_FILE) !== configText) throw new SetupError('The delivery demo configuration changed while reviewing setup. No new integration files or keys were saved; review the existing files and rerun setup.');
+    if (!prior) for (const filename of ['.universalcms/CmsPage.jsx', '.universalcms/demo.jsx', 'universalcms-demo.html']) {
+      if (await readProjectFile(root, filename) !== null) throw new SetupError('Delivery demo files appeared while reviewing original-route setup. Existing files were preserved; review them before rerunning setup.');
+    }
+  }
+  await inspectSetupFramework(root);
+  await assertConnectorRuntime(root, framework);
+  if (plan || prior) await assertRuntimeDependencies(root, framework, adminOrigin);
+  if (environment) await applyEnvironment(environment);
+  let scaffold = { created: [], updated: [] };
+  try { if (plan) scaffold = await applyPlan(plan); if (source) { const applied = await applySourcePlan(source); scaffold.created.push(...applied.created); scaffold.updated.push(...applied.updated); } if (publication) { const applied = await applyPlan(publication); scaffold.created.push(...applied.created); scaffold.updated.push(...applied.updated); } if (content) { const applied = await applyPlan(content); scaffold.created.push(...applied.created); scaffold.updated.push(...applied.updated); } if (connectionPlan) { const applied = await applyPlan(connectionPlan); scaffold.created.push(...applied.created); scaffold.updated.push(...applied.updated); } }
+  catch { throw new SetupError('Setup did not finish saving all generated files. Existing custom edits were preserved; inspect any saved connection/source files and rerun setup.'); }
+  io.write(`Saved connection settings. Created ${scaffold.created.length} files; updated ${scaffold.updated.length} generated files.\n`);
+  if (!await installWebsiteSettings(root, io, { apiOrigin, siteId, environmentId, locale: contentLocale, websiteOrigin, adminOrigin })) return { saved: true, settingsInstalled: false };
+  if (slug) {
+    const verification = await verifyEnvironment(environment, { slug });
+    io.write(`${verification.message}\n`);
+    if (!verification.verified) io.write('Settings were saved, but delivery is not verified. Correct the connection or publish the requested page, then rerun setup.\n');
+  } else if (hasDelivery) io.write(connection ? 'Delivery was not checked. The server-key step follows the source instructions below.\n' : 'Delivery was not checked. Rerun setup with a published page slug when ready.\n');
+  if (plan || prior) io.write('Runtime packages and renderer stylesheet are installed and compatible.\n');
+  io.write('Restart the website using its normal command.\n');
+  if (plan) io.write('See .universalcms/SETUP.md for rendering and deployment steps.\n');
+  io.write(publication
+    ? 'Original URL publication checks are installed, including the mapped home page. Missing or unpublished pages return 404; failed delivery returns 503 without original content. Restart or deploy the updated website and verify both states.\n'
+    : 'SETUP INCOMPLETE: Original website URLs still need publication checks. The saved scaffold alone cannot control their availability.\n');
+  if (content || previouslyInstalledSettings) io.write('Published-content bindings are installed on the reviewed routes. Publish a revised document in disposable staging and verify changed text, removed blocks and draft isolation. Open pages check for published revisions every 15 seconds and on focus. Deploy the same updated code and private runtime configuration to each live host; local setup does not deploy a remote website.\n');
+  if (source) io.write(isNativeFramework(framework)
+    ? 'Source export, published native pages and website settings use the reviewed private Node server. Run the generated package scripts and verify the exact registered origin. Static-only hosting cannot run this server. No content was imported or published.\n'
+    : framework === 'astro'
+    ? 'Astro source export and original routes use the reviewed Node server. Run the updated dev command, or build then start for production; static-only hosting cannot serve the managed routes. The frozen original source snapshot remains stable after binding. No content was imported or published.\n'
+    : framework === 'vite'
+    ? 'Public source export is prepared. Restart with your normal dev command, then click Connect & fetch content. Static hosting still requires a server for /api/cms-source; vite build alone cannot serve an API. No content was imported or published.\n'
+    : 'Public static source export is prepared. New static pages are discovered on each development request; production builds refresh the bundled snapshot with the prebuild hook. Review the diagnostics for omitted routes and unresolved content. No content was imported or published.\n');
+  const quote = value => `'${value.replaceAll("'", "'\\''")}'`;
+  io.write(`After preparing and starting the source endpoint, run:\nnpx --no-install universalcms-connect check-source${framework === 'next' ? ' --check-routes' : ''} --website-origin ${quote(websiteOrigin || defaults.websiteOrigin || 'YOUR_WEBSITE_ORIGIN')} --admin-origin ${quote(adminOrigin || defaults.adminOrigin || 'YOUR_CMS_ADMIN_ORIGIN')} --site ${siteId} --environment ${environmentId}\n`);
+  io.write('Verify the manifest and access from the CMS browser before clicking Connect & fetch content. No server key is used for that source read.\n');
+  if (hasDelivery && connection) {
+    io.write(saved.keyConfigured
+      ? '\nSERVER KEY: Your existing local delivery key was preserved. You can keep it or replace it through hidden input.\n'
+      : '\nSERVER KEY REQUIRED: The delivery files are prepared. Create a server delivery key in Developer setup, or use one you saved securely.\n');
+    io.write('Enter the key now or choose n to save it later. The integration files are already saved; canceling key entry leaves them in place.\n');
+    try {
+      const answer = (await io.ask('Save a server key now? [Y/n] ')).trim().toLowerCase();
+      if (answer && !['y', 'yes'].includes(answer)) {
+        io.write('Server key deferred. Integration files remain saved.\nNext run: npx --no-install universalcms-connect server-key\n');
+      } else {
+        const result = await runServerKey(root, io);
+        if (!result.saved) io.write('Integration files remain saved. To retry: npx --no-install universalcms-connect server-key\n');
+      }
+    } catch (error) {
+      io.write('Integration files remain saved. The server-key step did not finish; review private settings before retrying: npx --no-install universalcms-connect server-key\n');
+      throw error;
+    }
+  }
+  return { saved: true };
+}

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@universalcms/connect",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.13.0",
+  "description": "Deterministic framework-aware Universal CMS setup for reviewed native websites",
+  "type": "module",
+  "bin": {
+    "universalcms-connect": "dist/cli.mjs"
+  },
+  "exports": {
+    "./node": "./dist/vite-handler.mjs",
+    "./next-source": "./dist/next-source.mjs",
+    "./vite-source": "./dist/vite-source.mjs",
+    "./publication": "./dist/publication.mjs",
+    "./next-publication": "./dist/next-publication.mjs",
+    "./vite-publication": "./dist/vite-publication.mjs",
+    "./vite-publication-server": "./dist/vite-publication-server.mjs",
+    "./react-publication": "./dist/react-publication.mjs",
+    "./publication.css": "./dist/publication.css",
+    "./website-runtime": "./dist/website-runtime.mjs",
+    "./website-node": "./dist/website-node.mjs",
+    "./website-next": "./dist/website-next.mjs",
+    "./react-website": "./dist/react-website.mjs",
+    "./astro-runtime": "./dist/astro-runtime.mjs",
+    "./astro-website": "./dist/astro-website.mjs",
+    "./native-website": "./dist/native-website.mjs",
+    "./native-website-server": "./dist/native-website-server.mjs",
+    "./vue-runtime": "./dist/vue-runtime.mjs",
+    "./vue-server": "./dist/vue-server.mjs",
+    "./angular-runtime": "./dist/angular-runtime.mjs",
+    "./svelte-runtime": "./dist/svelte-runtime.mjs",
+    "./static-runtime": "./dist/static-runtime.mjs",
+    "./website.css": "./dist/website.css",
+    "./public-bindings": "./dist/public-bindings.mjs"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.12 <27"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
+    "prepack": "node scripts/build.mjs"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "react": "^19.2.0"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@astrojs/compiler": "2.13.0",
+    "@universalcms/react": "workspace:*"
+  }
+}