@universalcms/connect 0.1.0 → 0.13.1

package/dist/publication-check.mjs

@@ -0,0 +1,141 @@
+/** Bounded, read-only check of the running adapter and an original website URL.
+ * This command never sends a delivery credential or changes CMS content.
+ */
+import { readSourceSettings } from './source-setup.mjs';
+import { validatePublicationConfig, normalizePublicationPath } from './publication.mjs';
+
+const names = ['websiteOrigin', 'adminOrigin', 'siteId', 'environmentId'];
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const revision = /^[0-9a-f-]{36}:\d{1,16}(?::[0-9a-f-]{36})?$/;
+const fail = status => { throw { status }; };
+const messages = {
+  'configuration-error': 'Use the exact website origin, CMS admin origin, site and environment from Developer setup.',
+  'missing-adapter': 'The running website has no managed publication diagnostic at this exact origin. Confirm the website folder and port, then run scoped preflight to diagnose missing setup. Repair an existing adapter in place using its reviewed validation; preserve custom routes and layouts. For a new supported installation, complete setup only after preflight passes. Restart or deploy the completed adapter, then retry. Saving a key or importing content does not install this endpoint.',
+  'request-rejected': 'The running adapter rejected these origins or scope. Use the matching website folder and exact saved connection.',
+  'unavailable': 'Private published delivery is unavailable. Check the website server key and API connection; no content was imported or published.',
+  'invalid-response': 'The running publication diagnostic was redirected, invalid, oversized or did not match this connection.',
+  'bindings-incomplete': 'Publication checks are installed, but reviewed native content bindings are incomplete.',
+  'route-mismatch': 'The original website URL did not return its expected publication status and scoped runtime headers. Review routing, caches and deployment before claiming connection.',
+  'source-closure-unverified': 'The running source endpoint did not confirm that its public export is closed for this connection. Restart or deploy after finalize-source, then review /api/cms-source before claiming migration is complete.',
+  timeout: 'The website did not finish publication verification within 10 seconds.',
+  'transport-error': 'The website could not be reached at the saved origin. Start or deploy it, then retry.',
+  checked: 'The running publication adapter, registered bindings and this original URL passed. Actual rendered content still needs browser verification.',
+};
+const result = (status, details = {}) => ({ status, checked: status === 'checked', renderedVerified: false, ...details, message: messages[status] });
+export function publicationCachePolicy(headers, websiteOrigin) {
+  const directives = (headers.get('cache-control') ?? '').toLowerCase().split(',').map(value => value.trim());
+  if (directives.some(value => value === 'public' || /^stale-/.test(value) || /^(?:s-maxage|max-age)=/.test(value) && !/^(?:s-maxage|max-age)=0$/.test(value))) return false;
+  if (directives.includes('no-store')) return true;
+  // Next development overwrites the proxy's Cache-Control. Accept only its
+  // exact revalidation policy on HTTP loopback with both CDN stores disabled.
+  const url = new URL(websiteOrigin);
+  return url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname) &&
+    directives.length === 2 && directives.includes('no-cache') && directives.includes('must-revalidate') &&
+    ['cdn-cache-control', 'vercel-cdn-cache-control'].every(name => headers.get(name)?.trim().toLowerCase() === 'no-store');
+}
+function origin(value) {
+  try {
+    if (typeof value !== 'string' || value.length > 2048 || /[\s\\]|cms_server\.|sk-[\w-]{12,}|AIza[\w-]{20,}/i.test(value)) return null;
+    const url = new URL(value);
+    return !url.username && !url.password && !url.search && !url.hash && url.pathname === '/' &&
+      (url.protocol === 'https:' || url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)) ? url.origin : null;
+  } catch { return null; }
+}
+async function body(response, maximum, signal) {
+  const declared = response.headers.get('content-length');
+  if (declared !== null && (!/^\d+$/.test(declared) || Number(declared) > maximum) || !response.body) fail('invalid-response');
+  const reader = response.body.getReader(), decoder = new TextDecoder('utf-8', { fatal: true });
+  let text = '', bytes = 0;
+  try {
+    for (;;) {
+      const next = await abortable(reader.read(), signal);
+      if (next.done) break;
+      if ((bytes += next.value.byteLength) > maximum) fail('invalid-response');
+      text += decoder.decode(next.value, { stream: true });
+    }
+    return text + decoder.decode();
+  } finally { void reader.cancel().catch(() => {}); reader.releaseLock(); }
+}
+function abortable(pending, signal) {
+  return new Promise((resolve, reject) => {
+    const stop = () => reject({ status: 'timeout' });
+    signal.addEventListener('abort', stop, { once: true });
+    if (signal.aborted) stop();
+    Promise.resolve(pending).then(value => { signal.removeEventListener('abort', stop); resolve(value); }, error => { signal.removeEventListener('abort', stop); reject(error); });
+  });
+}
+
+export async function checkPublication(directory, options = {}, { fetcher = globalThis.fetch, timeoutMs = 10000 } = {}) {
+  if (!options || typeof options !== 'object' || Array.isArray(options) || Object.keys(options).some(name => ![...names, 'path'].includes(name)) ||
+      typeof fetcher !== 'function' || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 10000) return result('configuration-error');
+  let defaults = {};
+  try { if (names.some(name => options[name] === undefined)) defaults = await readSourceSettings(directory); } catch { return result('configuration-error'); }
+  const binding = Object.fromEntries(names.map(name => [name, options[name] ?? defaults[name]]));
+  binding.websiteOrigin = origin(binding.websiteOrigin); binding.adminOrigin = origin(binding.adminOrigin);
+  if (!binding.websiteOrigin || !binding.adminOrigin || binding.websiteOrigin === binding.adminOrigin || !['siteId', 'environmentId'].every(name => typeof binding[name] === 'string' && uuid.test(binding[name]))) return result('configuration-error');
+  binding.siteId = binding.siteId.toLowerCase(); binding.environmentId = binding.environmentId.toLowerCase();
+  let requestedPath;
+  try { if (options.path !== undefined) requestedPath = normalizePublicationPath(options.path); } catch { return result('configuration-error'); }
+  const url = new URL('/api/universalcms/publication', binding.websiteOrigin);
+  url.search = new URLSearchParams({ check: 'connection', siteId: binding.siteId, environmentId: binding.environmentId, ...(requestedPath ? { path: requestedPath } : {}) }).toString();
+  const controller = new AbortController(), timer = setTimeout(() => controller.abort(), timeoutMs);
+  let response;
+  const get = async target => {
+    const pending = Promise.resolve(fetcher(target, { method: 'GET', headers: { Accept: '*/*', Origin: binding.adminOrigin },
+      credentials: 'omit', redirect: 'error', cache: 'no-store', referrerPolicy: 'no-referrer', signal: controller.signal })).then(value => {
+      if (controller.signal.aborted) void value?.body?.cancel().catch(() => {});
+      return value;
+    });
+    const value = await abortable(pending, controller.signal);
+    if (!(value instanceof Response) || value.redirected || ['opaque', 'opaqueredirect'].includes(value.type) || value.url && value.url !== target.href) fail('invalid-response');
+    response = value;
+    return value;
+  };
+  try {
+    const probe = await get(url);
+    if (probe.status === 404) fail('missing-adapter');
+    if ([401, 403].includes(probe.status)) fail('request-rejected');
+    if (probe.status === 503) fail('unavailable');
+    if (probe.status !== 200 || probe.headers.get('content-type')?.split(';')[0] !== 'application/json' || probe.headers.get('access-control-allow-origin') !== binding.adminOrigin || probe.headers.has('access-control-allow-credentials')) fail('invalid-response');
+    const value = JSON.parse(await body(probe, 512 * 1024, controller.signal));
+    if (!value || Object.keys(value).sort().join() !== 'bindingFingerprint,check,contentBindings,coverage,environmentId,publication,routes,runtime,siteId,sourceExport,version' ||
+        value.version !== 1 || value.siteId !== binding.siteId || value.environmentId !== binding.environmentId || value.publication !== true || value.runtime !== 'server' || !['open', 'closed'].includes(value.sourceExport) ||
+        typeof value.contentBindings !== 'boolean' || !(value.bindingFingerprint === null || typeof value.bindingFingerprint === 'string' && /^[a-f0-9]{64}$/.test(value.bindingFingerprint))) fail('invalid-response');
+    try { validatePublicationConfig({ version: 1, apiOrigin: binding.websiteOrigin, websiteOrigin: binding.websiteOrigin, siteId: binding.siteId, environmentId: binding.environmentId, routes: value.routes }); } catch { fail('invalid-response'); }
+    if (!value.coverage || Object.keys(value.coverage).sort().join() !== 'complete,unmappedRoutes' || typeof value.coverage.complete !== 'boolean' || !Number.isInteger(value.coverage.unmappedRoutes) || value.coverage.unmappedRoutes < 0 || value.coverage.unmappedRoutes > value.routes.length ||
+        !value.check || Object.keys(value.check).some(name => !['path', 'state', 'revision'].includes(name)) || !value.routes.some(route => route.path === value.check.path) || requestedPath && value.check.path !== requestedPath ||
+        !['published', 'unpublished', 'unavailable'].includes(value.check.state) || value.check.state === 'published' && !revision.test(value.check.revision ?? '') || value.check.state !== 'published' && value.check.revision !== undefined) fail('invalid-response');
+    if (value.check.state === 'unavailable') fail('unavailable');
+    if (!value.contentBindings || !value.bindingFingerprint || !value.coverage.complete || value.coverage.unmappedRoutes) fail('bindings-incomplete');
+    const route = await get(new URL(value.check.path, binding.websiteOrigin)), expected = value.check.state === 'published' ? 200 : 404;
+    if (route.status !== expected || route.headers.get('content-type')?.split(';')[0] !== 'text/html' ||
+        route.headers.get('access-control-allow-origin') !== binding.adminOrigin || route.headers.has('access-control-allow-credentials') ||
+        route.headers.get('x-universalcms-site') !== binding.siteId || route.headers.get('x-universalcms-environment') !== binding.environmentId ||
+        route.headers.get('x-universalcms-route') !== encodeURIComponent(value.check.path) || route.headers.get('x-universalcms-state') !== value.check.state ||
+        value.check.state === 'published' && route.headers.get('x-universalcms-revision') !== value.check.revision || !publicationCachePolicy(route.headers, binding.websiteOrigin)) fail('route-mismatch');
+    await body(route, 2 * 1024 * 1024, controller.signal);
+    let sourceExportVerified = false;
+    if (value.sourceExport === 'closed') {
+      // Loaded configuration cannot prove that an older/custom source endpoint
+      // honored closure. Read the actual scoped endpoint on this deployment.
+      const sourceUrl = new URL('/api/cms-source', binding.websiteOrigin);
+      sourceUrl.search = new URLSearchParams({ siteId: binding.siteId, environmentId: binding.environmentId }).toString();
+      try {
+        const source = await get(sourceUrl);
+        if (source.status !== 410 || source.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase() !== 'application/json' ||
+            source.headers.get('access-control-allow-origin') !== binding.adminOrigin || source.headers.has('access-control-allow-credentials') ||
+            !source.headers.get('cache-control')?.toLowerCase().split(',').map(value => value.trim()).includes('no-store') ||
+            !publicationCachePolicy(source.headers, binding.websiteOrigin)) fail('source-closure-unverified');
+        const closed = JSON.parse(await body(source, 1024, controller.signal));
+        if (!closed || Object.keys(closed).sort().join() !== 'environmentId,siteId,sourceExport,version' || closed.version !== 1 ||
+            closed.siteId !== binding.siteId || closed.environmentId !== binding.environmentId || closed.sourceExport !== 'closed') fail('source-closure-unverified');
+        sourceExportVerified = true;
+      } catch (error) {
+        if (controller.signal.aborted) throw error;
+        fail('source-closure-unverified');
+      }
+    }
+    return result('checked', { originalRouteVerified: true, path: value.check.path, state: value.check.state, sourceExport: value.sourceExport, sourceExportVerified, bindingFingerprint: value.bindingFingerprint });
+  } catch (error) { return result(controller.signal.aborted ? 'timeout' : error?.status && messages[error.status] ? error.status : error instanceof SyntaxError ? 'invalid-response' : 'transport-error'); }
+  finally { clearTimeout(timer); controller.abort(); try { if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {}); } catch {} }
+}

package/dist/publication-document.d.mts

@@ -0,0 +1,2 @@
+import type { PublishedDocumentEntry } from './publication.mjs';
+export function validatePublishedDocumentEntry(value: unknown, identity: { kind: string; slug: string; locale: string }): PublishedDocumentEntry;

package/dist/publication-document.mjs

@@ -0,0 +1,59 @@
+const plain = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const supported = new Set(['paragraph', 'heading', 'quote', 'list', 'code', 'image', 'gallery', 'button', 'divider', 'spacer', 'faq', 'table', 'embed', 'form', 'section', 'columns']);
+/** The same-origin endpoint is the only browser authority. Reject malformed,
+ * cross-route, excessive, and ambiguous trees before rendering any native UI. */
+export function validatePublishedDocumentEntry(value, identity) {
+    if (!plain(value) || value.preview === true || value.status !== undefined && value.status !== 'published' || !uuid.test(value.id) || !Number.isSafeInteger(value.version) || value.version < 1 || value.kind !== identity.kind || value.slug !== identity.slug || value.locale !== identity.locale || value.revisionId !== undefined && !uuid.test(value.revisionId) || typeof value.publishedAt !== 'string' || !Number.isFinite(Date.parse(value.publishedAt)))
+        throw Error('Invalid published entry');
+    const doc = value.document;
+    if (!plain(doc) || doc.schemaVersion !== 1 || typeof doc.title !== 'string' || doc.title.length > 200 || typeof doc.excerpt !== 'string' || doc.excerpt.length > 1000 || !Array.isArray(doc.blocks))
+        throw Error('Invalid published document');
+    const ids = new Set();
+    let count = 0, nodes = 0;
+    function safeData(item, depth = 0) {
+        if (++nodes > 25000 || depth > 12)
+            throw Error('Invalid document budget');
+        if (item === null || typeof item === 'boolean' || typeof item === 'number' && Number.isFinite(item))
+            return;
+        if (typeof item === 'string' && item.length <= 30000)
+            return;
+        if (Array.isArray(item) && item.length <= 400) {
+            for (const child of item)
+                safeData(child, depth + 1);
+            return;
+        }
+        if (plain(item) && Object.keys(item).length <= 50 && !Object.keys(item).some(key => ['__proto__', 'constructor', 'prototype', 'notifyEmail', 'subscribe'].includes(key))) {
+            for (const child of Object.values(item))
+                safeData(child, depth + 1);
+            return;
+        }
+        throw Error('Invalid document data');
+    }
+    function inspect(blocks, parent = 'root') {
+        if (blocks.length > 400)
+            throw Error('Invalid block budget');
+        for (const block of blocks) {
+            if (!plain(block) || ++count > 400 || !uuid.test(block.id) || ids.has(block.id) || block.version !== 1 || !supported.has(block.type) || typeof block.text !== 'string' || block.text.length > 30000 || block.data !== undefined && !plain(block.data) || block.style !== undefined && !plain(block.style))
+                throw Error('Invalid published block');
+            ids.add(block.id);
+            if (block.data)
+                safeData(block.data);
+            if (block.style)
+                safeData(block.style);
+            if (block.type === 'section') {
+                if (parent !== 'root' || !Array.isArray(block.data?.blocks))
+                    throw Error('Invalid section');
+                inspect(block.data.blocks, 'section');
+            }
+            if (block.type === 'columns') {
+                if (parent === 'columns' || !Array.isArray(block.data?.columns) || block.data.columns.length > 4 || block.data.columns.some((column) => !Array.isArray(column)))
+                    throw Error('Invalid columns');
+                for (const column of block.data.columns)
+                    inspect(column, 'columns');
+            }
+        }
+    }
+    inspect(doc.blocks);
+    return value;
+}

package/dist/publication-next-setup.mjs

@@ -0,0 +1,134 @@
+/** Bounded source edits for the original Next routes. Never execute project code. */
+import ts from './vendor/typescript.cjs';
+import { projectRoot, readProjectFile, SetupError } from './project-files.mjs';
+import { inspectSourceRoutes } from './source-routes.mjs';
+import { validatePublicationConfig } from './publication.mjs';
+
+const script = '<script id="universalcms-publication-client" src="/.well-known/universalcms-publication-client.js"></script>';
+const fail = message => { throw new SetupError(message); };
+const unbox = node => {
+  while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node))) node = node.expression;
+  return node;
+};
+
+/** Exact bytes are also recognized by source discovery; arbitrary proxies remain private. */
+export function nextPublicationProxyTemplate(appDirectory, previous = false) {
+  if (!['app', 'src/app'].includes(appDirectory)) throw Error('Invalid application directory.');
+  const prefix = appDirectory === 'src/app' ? '../' : './';
+  const source = `// Generated by @universalcms/connect. Publication availability only; native application policy remains authoritative.\nimport { NextResponse, type NextRequest } from 'next/server';\nimport { createNextPublicationProxy } from '@universalcms/connect/next-publication';\nimport configuration from '${prefix}.universalcms/publication.config.json';\nimport sourceConfiguration from '${prefix}.universalcms/source.config.json';\nimport contentBindings from '${prefix}.universalcms/content.bindings.json';\n\nconst handle = createNextPublicationProxy({ configuration, sourceConfiguration, contentBindings });\nexport async function proxy(request: NextRequest) {\n  const result = await handle(request);\n  if (result.response) return result.response;\n  const response = NextResponse.next({ request: { headers: result.requestHeaders } });\n  for (const [name, value] of Object.entries(result.headers)) response.headers.set(name, value);\n  return response;\n}\n\n// All document and RSC requests use the same gate, including encoded paths.\nexport const config = { matcher: ['/((?!_next/static/|_next/image/).*)'] };\n`;
+  return previous ? source.replace(`import sourceConfiguration from '${prefix}.universalcms/source.config.json';\nimport contentBindings from '${prefix}.universalcms/content.bindings.json';\n`, '').replace('createNextPublicationProxy({ configuration, sourceConfiguration, contentBindings })', 'createNextPublicationProxy({ configuration })') : source;
+}
+
+/** The settings extension keeps the exact publication proxy boundary. */
+export function nextWebsiteProxyTemplate(appDirectory, { installedSections } = {}) {
+  if (installedSections !== undefined && (!Array.isArray(installedSections) || new Set(installedSections).size !== installedSections.length || installedSections.some(name => !['branding','social','seo','languages','analytics','navigation','experience','scripts','redirects','authors','templates','taxonomies'].includes(name)))) throw Error('Invalid installed website sections.');
+  let source = nextPublicationProxyTemplate(appDirectory)
+    .replaceAll('createNextPublicationProxy', 'createNextWebsiteProxy')
+    .replace('@universalcms/connect/next-publication', '@universalcms/connect/website-next');
+  if (installedSections !== undefined) source = source.replace('createNextWebsiteProxy({ configuration, sourceConfiguration, contentBindings })', `createNextWebsiteProxy({ configuration, sourceConfiguration, contentBindings, installedSections: ${JSON.stringify(installedSections)} })`);
+  return source;
+}
+
+function injectLayout(source, filename) {
+  const file = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  if (file.parseDiagnostics.length || file.statements.some(statement => ts.isExpressionStatement(statement) && ts.isStringLiteral(statement.expression) && statement.expression.text === 'use client')) fail('Publication setup requires a valid server root layout. Preserve this layout and integrate manually.');
+  let component;
+  for (const statement of file.statements) {
+    if (ts.isFunctionDeclaration(statement) && statement.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.DefaultKeyword)) component = statement;
+    if (ts.isExportAssignment(statement)) {
+      const value = unbox(statement.expression);
+      if (ts.isArrowFunction(value) || ts.isFunctionExpression(value)) component = value;
+      else if (ts.isIdentifier(value)) {
+        component = file.statements.find(candidate => ts.isFunctionDeclaration(candidate) && candidate.name?.text === value.text);
+        if (!component) for (const declaration of file.statements.filter(ts.isVariableStatement).flatMap(statement => [...statement.declarationList.declarations])) {
+          if (ts.isIdentifier(declaration.name) && declaration.name.text === value.text) component = unbox(declaration.initializer);
+        }
+      }
+    }
+  }
+  let root;
+  if (component?.body && ts.isBlock(component.body)) {
+    const returns = component.body.statements.filter(ts.isReturnStatement);
+    if (returns.length === 1) root = unbox(returns[0].expression);
+  } else root = unbox(component?.body);
+  if (!root || !ts.isJsxElement(root) || root.openingElement.tagName.getText(file) !== 'html') fail('Publication setup requires one literal html/body root layout. Dynamic or wrapped roots need manual integration.');
+  const elements = root.children.filter(ts.isJsxElement);
+  const heads = elements.filter(node => node.openingElement.tagName.getText(file) === 'head');
+  const bodies = elements.filter(node => node.openingElement.tagName.getText(file) === 'body');
+  if (heads.length > 1 || bodies.length !== 1 || elements.length !== heads.length + bodies.length || root.children.some(node => !ts.isJsxElement(node) && !ts.isJsxText(node) && !(ts.isJsxExpression(node) && !node.expression))) fail('Publication setup needs ordinary head/body layout children. Existing layout was preserved.');
+  const markerNodes = [];
+  function visit(node) {
+    if ((ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node)) && node.getText(file).includes('universalcms-publication-client')) {
+      const tag = ts.isJsxElement(node) ? node.openingElement : node;
+      if (tag.tagName.getText(file) === 'script') markerNodes.push(node);
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(root);
+  if (markerNodes.length) {
+    if (markerNodes.length !== 1 || markerNodes[0].getText(file) !== script || !heads.length || !heads[0].children.includes(markerNodes[0])) fail('The existing publication script was customized. Preserve your edits and integrate manually.');
+    return source;
+  }
+  if (source.includes('universalcms-publication-client')) fail('A publication script marker already exists outside the supported head. Review it manually.');
+  const index = heads.length ? heads[0].openingElement.end : root.openingElement.end;
+  const inserted = heads.length ? script : `<head>${script}</head>`;
+  return source.slice(0, index) + inserted + source.slice(index);
+}
+
+export async function planNextPublication(directory, configuration, { websiteSettings = false, installedSections } = {}) {
+  const root = await projectRoot(directory);
+  const config = validatePublicationConfig(configuration);
+  let manifest;
+  try { manifest = JSON.parse(await readProjectFile(root, 'package.json')); } catch { fail('Publication setup needs a valid website package.json.'); }
+  const next = manifest?.dependencies?.next ?? manifest?.devDependencies?.next;
+  if (manifest?.workspaces || typeof next !== 'string' || !/^(?:\^|~)?16\.\d+\.\d+$/.test(next)) fail('Automatic publication control supports one Next.js 16 App Router website.');
+  for (const extension of ['js', 'mjs', 'cjs', 'ts']) {
+    const source = await readProjectFile(root, `next.config.${extension}`);
+    if (source && /\b(?:pageExtensions|basePath|rewrites|redirects|i18n|headers|adapterPath|skipProxyUrlNormalize|skipMiddlewareUrlNormalize)\b|\boutput\s*:\s*['"]export['"]|\bruntime\s*:\s*['"]edge['"]/.test(source)) fail('Custom routes, headers, URL normalization or static/Edge hosting need manual publication integration. Cache Components is supported.');
+  }
+  let inventory;
+  try { inventory = await inspectSourceRoutes(root); } catch { fail('The original Next route inventory needs manual review before publication control.'); }
+  const native = new Set(inventory.routes.map(route => `/${route}`));
+  if (config.routes.some(route => !native.has(route.path))) fail('Each publication mapping must refer to an existing reviewed public route. Unknown routes were preserved.');
+  const roots = [...new Set(Object.values(inventory.files).map(filename => filename.startsWith('src/app/') ? 'src/app' : 'app'))];
+  if (roots.length !== 1) fail('Publication control requires exactly one App Router directory.');
+  const appDirectory = roots[0];
+  const proxyPath = appDirectory === 'src/app' ? 'src/proxy.ts' : 'proxy.ts';
+  const proxy = websiteSettings ? nextWebsiteProxyTemplate(appDirectory, {installedSections}) : nextPublicationProxyTemplate(appDirectory);
+  for (const stem of ['middleware', 'src/middleware', 'proxy', 'src/proxy']) for (const extension of ['js', 'ts']) {
+    const filename = `${stem}.${extension}`, current = await readProjectFile(root, filename);
+    const recognized = [proxy, nextWebsiteProxyTemplate(appDirectory), nextWebsiteProxyTemplate(appDirectory, {installedSections}), nextPublicationProxyTemplate(appDirectory), nextPublicationProxyTemplate(appDirectory, true)];
+    if (current !== null && (filename !== proxyPath || !recognized.includes(current))) fail('An existing middleware or proxy needs manual integration. It was not replaced.');
+  }
+  // A broad API route or static asset must never be silently shadowed by our endpoints.
+  for (const filename of [
+    'public/.well-known/universalcms-publication-client.js',
+    ...['js', 'jsx', 'ts', 'tsx'].flatMap(extension => [
+      `${appDirectory}/api/universalcms/publication/route.${extension}`,
+      `${appDirectory}/api/universalcms/document/route.${extension}`,
+      `${appDirectory}/api/[...slug]/route.${extension}`,
+      `${appDirectory}/api/[[...slug]]/route.${extension}`,
+      `${appDirectory}/api/universalcms/[...slug]/route.${extension}`,
+      `${appDirectory}/api/universalcms/[[...slug]]/route.${extension}`,
+    ]),
+  ]) if (await readProjectFile(root, filename) !== null) fail('The publication endpoint overlaps an existing website route or asset. Integrate it manually.');
+  const layouts = [];
+  for (const extension of ['js', 'jsx', 'ts', 'tsx']) {
+    const filename = `${appDirectory}/layout.${extension}`, source = await readProjectFile(root, filename);
+    if (source !== null) layouts.push({ filename, source });
+  }
+  if (layouts.length !== 1) fail('Publication setup needs exactly one server root layout.');
+  const { filename, source } = layouts[0];
+  if (/\bruntime\s*=\s*['"]edge['"]/.test(source)) fail('Publication setup requires a Node-capable Next deployment.');
+  const updated = injectLayout(source, filename);
+  const currentProxy = await readProjectFile(root, proxyPath);
+  return {
+    root, framework: 'next', appDirectory,
+    files: [
+      { path: proxyPath, content: proxy, state: currentProxy === null ? 'create' : currentProxy === proxy ? 'unchanged' : 'update', ...(currentProxy !== null && currentProxy !== proxy ? { previous: currentProxy } : {}) },
+      { path: filename, content: updated, state: updated === source ? 'unchanged' : 'update', ...(updated === source ? {} : { previous: source }) },
+    ],
+    unmanagedRoutes: inventory.routes.map(route => `/${route}`).filter(route => !config.routes.some(item => item.path === route)),
+    unresolvedRoutes: inventory.unresolved,
+  };
+}

package/dist/publication-setup.mjs

@@ -0,0 +1,138 @@
+/** Original-route publication setup. Public mappings only; no website code execution. */
+import { lstat } from 'node:fs/promises';
+import path from 'node:path';
+import { projectRoot, readProjectFile, SetupError } from './core.mjs';
+import { inspectSourceRoutes } from './source-routes.mjs';
+import { validatePublicationConfig } from './publication.mjs';
+import { planNextPublication } from './publication-next-setup.mjs';
+import { assertNextUnresolvedRouteOwnership, inspectOwnedDemo } from './content-next-setup.mjs';
+import { inspectReviewedNativeOwnership } from './reviewed-native-ownership.mjs';
+import { inspectReviewedCommerceOwnership } from './reviewed-commerce-ownership.mjs';
+import { validateInstalledAstro } from './astro-setup.mjs';
+import { viteSourceWrapper } from './source-setup.mjs';
+import { isNativeFramework, nativeFramework, validateInstalledNative } from './native-adapters.mjs';
+
+export const PUBLICATION_CONFIG_FILE = '.universalcms/publication.config.json';
+export const PUBLICATION_ROUTES_FILE = '.universalcms/publication.routes.json';
+const json = value => `${JSON.stringify(value, null, 2)}\n`;
+const fail = message => { throw new SetupError(message); };
+const identity = row => {
+  try { return `${row.kind}:${Intl.getCanonicalLocales(row.locale)[0]}:${row.slug}`; }
+  catch { fail('Public source identities need a valid content locale.'); }
+};
+
+export async function readPublicationConfiguration(root) {
+  const text = await readProjectFile(root, PUBLICATION_CONFIG_FILE);
+  if (text === null) return null;
+  if ((await lstat(path.join(root, PUBLICATION_CONFIG_FILE))).nlink !== 1) fail('Publication configuration must be an ordinary file without hard links.');
+  try { return validatePublicationConfig(JSON.parse(text)); }
+  catch { fail('The original-route publication configuration is invalid. Review it before continuing.'); }
+}
+
+export function viteServerTemplate() {
+  return `// Generated by @universalcms/connect. Run from the website root after its build.\nimport { createVitePublicationServer } from '@universalcms/connect/vite-publication-server';\nimport configuration from './publication.config.json' with { type: 'json' };\nimport sourceConfiguration from './source.config.json' with { type: 'json' };\nimport contentBindings from './content.bindings.json' with { type: 'json' };\n\nconst port = Number(process.env.PORT ?? (new URL(configuration.websiteOrigin).port || 3000));\nif (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error('Configure a valid website PORT.');\nconst server = createVitePublicationServer({ root: process.cwd(), configuration, sourceConfiguration, contentBindings });\nserver.listen(port, process.env.HOST ?? '0.0.0.0');\n`;
+}
+
+async function ownedFile(root, name, content, previous) {
+  const current = await readProjectFile(root, name);
+  if (current !== null && (await lstat(path.join(root, name))).nlink !== 1) fail('Publication setup cannot replace linked files.');
+  if (current !== null && current !== content && current !== previous) fail('A publication integration file contains custom changes. Preserve them and review the integration manually.');
+  return { path: name, content, state: current === content ? 'unchanged' : current === null ? 'create' : 'update', ...(current !== null && current !== content ? { previous: current } : {}) };
+}
+
+export async function planPublicationSetup(directory, connection, source) {
+  const root = await projectRoot(directory);
+  if (!source || source.retainedAdapter || !source.identities?.length) fail('Original-route publication setup needs a complete public source inventory. Review custom adapters or missing mappings before continuing.');
+  if (source.framework !== 'vite' && source.framework !== 'astro' && !isNativeFramework(source.framework)) {
+    const inventory = await inspectSourceRoutes(root);
+    const native = await inspectReviewedNativeOwnership(root) ?? await inspectReviewedCommerceOwnership(root);
+    assertNextUnresolvedRouteOwnership(inventory, native, await inspectOwnedDemo(root));
+  }
+  const prior = await readPublicationConfiguration(root);
+  const customText = await readProjectFile(root, PUBLICATION_ROUTES_FILE);
+  let routes;
+  if (customText !== null) {
+    if ((await lstat(path.join(root, PUBLICATION_ROUTES_FILE))).nlink !== 1) fail('Publication route mappings cannot be linked files.');
+    try { routes = JSON.parse(customText); if (!Array.isArray(routes)) throw Error(); }
+    catch { fail('Use a JSON array of explicit path, kind, slug and locale mappings in .universalcms/publication.routes.json.'); }
+  } else if (source.framework === 'astro' || isNativeFramework(source.framework)) {
+    routes = source.routes;
+  } else if (source.framework === 'vite') {
+    // The source contract uses original nested slugs. Display every mapping for
+    // review before Save; custom paths can be supplied in publication.routes.json.
+    routes = source.identities.map(entry => ({ path: entry.kind === 'page' && entry.slug === 'home' ? '/' : `/${entry.slug}`, ...entry }));
+  } else {
+    const inventory = await inspectSourceRoutes(root);
+    if (inventory.routes.includes('') && inventory.routes.includes('home')) fail('The home page and /home need explicit, distinct publication identities.');
+    const known = new Map(inventory.routes.map(route => [route || 'home', `/${route}`]));
+    routes = source.identities.map(entry => {
+      if (entry.kind !== 'page' || !known.has(entry.slug)) fail('A source entry has no exact original Next.js route. Add explicit publication.routes.json mappings before setup.');
+      return { path: known.get(entry.slug), ...entry };
+    });
+  }
+  let config;
+  try { config = validatePublicationConfig({ version: 1, apiOrigin: connection.apiOrigin, siteId: connection.siteId, environmentId: connection.environmentId, websiteOrigin: connection.websiteOrigin, routes }); }
+  catch { fail('Publication mappings must use unique public website paths and valid content identities. Review .universalcms/publication.routes.json; private, API, preview and framework routes cannot be managed.'); }
+  const sourceIdentities = new Set(source.identities.map(identity));
+  const mappedIdentities = new Set(config.routes.map(identity));
+  if ([...sourceIdentities].some(key => !mappedIdentities.has(key)) || [...mappedIdentities].some(key => !sourceIdentities.has(key))) fail('Every exported page/post needs an exact original URL mapping, and every mapping must refer to an exported identity.');
+  const homepage = source.identities.find(entry => entry.kind === 'page' && entry.slug === 'home');
+  if (homepage && !config.routes.some(route => route.path === '/' && identity(route) === identity(homepage))) fail('The exported home page must be mapped to /.');
+  // Reruns cannot silently remove protection from an already managed URL.
+  if (prior && prior.routes.some(route => !config.routes.some(next => next.path === route.path && next.kind === route.kind && next.slug === route.slug))) fail('Previously managed routes were removed or remapped. Review publication.config.json explicitly before changing route ownership.');
+  const files = [await ownedFile(root, PUBLICATION_CONFIG_FILE, json(config), prior ? await readProjectFile(root, PUBLICATION_CONFIG_FILE) : undefined)];
+  if (customText !== null) files.push({ path: PUBLICATION_ROUTES_FILE, content: customText, state: 'unchanged' });
+  if (source.framework === 'vite') {
+    // These server-owned paths must not silently replace existing public files
+    // (including extensionless files or directories used by a custom host).
+    for (const filename of ['public/api/universalcms/document', 'public/api/universalcms/publication', 'public/.well-known/universalcms-publication-client.js']) {
+      let exists = false;
+      try { await lstat(path.join(root, filename)); exists = true; }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      if (exists) fail('A publication endpoint overlaps an existing public website asset. Preserve it and integrate manually.');
+    }
+    files.push(await ownedFile(root, '.universalcms/serve.mjs', viteServerTemplate(), viteServerTemplate().replace("import contentBindings from './content.bindings.json' with { type: 'json' };\n", '').replace('configuration, sourceConfiguration, contentBindings', 'configuration, sourceConfiguration')));
+  }
+  else if (source.framework !== 'astro' && !isNativeFramework(source.framework)) files.push(...(await planNextPublication(root, config)).files);
+  return { root, config, framework: source.framework ?? 'next', files };
+}
+
+/** Recheck installed publication files before private key entry. */
+export async function planInstalledPublication(directory) {
+  const root = await projectRoot(directory), config = await readPublicationConfiguration(root);
+  if (!config) {
+    // A deleted configuration must not turn an installed original-route guard
+    // into an apparently valid demo-only key setup. Inspect fixed public files,
+    // never import website code or inspect its private environment.
+    for(const name of ['.universalcms/website.integration.json','.universalcms/content.bindings.json'])if(await readProjectFile(root,name)!==null)fail('The original-route publication configuration is missing. Restore the reviewed configuration before saving a server key.');
+    const names = ['.universalcms/astro.middleware.mjs', '.universalcms/source.vite.config.mjs', '.universalcms/serve.mjs',
+      ...['vue','nuxt','angular','svelte','static'].flatMap(name=>[`.universalcms/${name}.serve.mjs`,`.universalcms/${name}.runtime.mjs`]), 'src/hooks.server.ts', 'src/server.ts', 'proxy.ts', 'src/proxy.ts',
+      ...['app', 'src/app'].flatMap(root => ['js', 'jsx', 'ts', 'tsx'].map(extension => `${root}/layout.${extension}`))];
+    for (const name of names) {
+      const content = await readProjectFile(root, name);
+      if (content !== null && /@universalcms\/connect\/(?:next-publication|vite-publication|(?:astro|vue|nuxt|angular|svelte|static)-runtime|vue-server)|universalcms-publication-client/.test(content)) fail('The original-route publication configuration is missing. Rerun setup or restore the reviewed configuration before saving a server key.');
+    }
+    const manifest = await readProjectFile(root, 'package.json');
+    if (manifest !== null && /\.universalcms\/(?:serve|(?:vue|nuxt|angular|svelte|static)\.serve)\.mjs/.test(manifest)) fail('The original-route publication configuration is missing. Rerun setup or restore the reviewed configuration before saving a server key.');
+    return null;
+  }
+  const manifest = JSON.parse(await readProjectFile(root, 'package.json'));
+  if (await readProjectFile(root, '.universalcms/website.integration.json') !== null) {
+    const { planWebsiteSettings } = await import('./website-setup.mjs');
+    return planWebsiteSettings(root);
+  }
+  const next = manifest.dependencies?.next ?? manifest.devDependencies?.next;
+  const files = [await ownedFile(root, PUBLICATION_CONFIG_FILE, json(config))];
+  if (nativeFramework(manifest)) files.push(...(await validateInstalledNative(root, nativeFramework(manifest), config)).files);
+  else if (manifest.dependencies?.astro || manifest.devDependencies?.astro) files.push(...(await validateInstalledAstro(root, config)).files);
+  else if (next) files.push(...(await planNextPublication(root, config)).files);
+  else {
+    files.push(await ownedFile(root, '.universalcms/serve.mjs', viteServerTemplate(), viteServerTemplate().replace("import contentBindings from './content.bindings.json' with { type: 'json' };\n", '').replace('configuration, sourceConfiguration, contentBindings', 'configuration, sourceConfiguration')));
+    const wrapper = await readProjectFile(root, '.universalcms/source.vite.config.mjs');
+    if (wrapper !== viteSourceWrapper(true)) fail('The Vite publication plugin was changed or is not installed. Rerun setup or review it before saving a key.');
+    const suffix = ' --config .universalcms/source.vite.config.mjs';
+    if (!manifest.scripts?.dev?.endsWith(suffix) || !manifest.scripts?.build?.endsWith(suffix) || manifest.scripts.start !== 'node .universalcms/serve.mjs') fail('The Vite publication startup/build scripts changed. Review them before saving a key.');
+    files.push({ path: '.universalcms/source.vite.config.mjs', content: wrapper, state: 'unchanged' }, { path: 'package.json', content: await readProjectFile(root, 'package.json'), state: 'unchanged' });
+  }
+  return { root, config, files };
+}

package/dist/publication-verification.mjs

@@ -0,0 +1,85 @@
+/** Public, credential-free diagnostics for a privately installed publication adapter.
+ * A registry fingerprint proves which binding metadata the running adapter loaded;
+ * it is deliberately not a claim that a browser rendered those bindings.
+ */
+import { createHash } from 'node:crypto';
+import { validateContentRegistry } from './content-registry-validation.mjs';
+import { validateSourceConfiguration } from './source-config.mjs';
+import { normalizePublicationPath, publicationRevision } from './publication.mjs';
+
+export const VERIFICATION_HEADERS = ['X-UniversalCMS-Site', 'X-UniversalCMS-Environment', 'X-UniversalCMS-Route', 'X-UniversalCMS-State', 'X-UniversalCMS-Revision', 'CDN-Cache-Control', 'Vercel-CDN-Cache-Control'];
+const names = ['path', 'kind', 'slug', 'locale'];
+const sameRoute = (a, b) => names.every(name => a[name] === b[name]);
+
+export function publicationVerification(configuration, sourceConfiguration, contentBindings) {
+  if (!sourceConfiguration) return null;
+  const source = validateSourceConfiguration(sourceConfiguration);
+  if (['siteId', 'environmentId', 'websiteOrigin'].some(name => configuration[name] !== source[name])) throw Error('Publication diagnostics require matching source configuration.');
+  let registry = null;
+  try { registry = validateContentRegistry(contentBindings); } catch { /* Invalid bindings cannot report readiness. */ }
+  const unmappedRoutes = configuration.routes.filter(route => !registry?.routes.some(row => sameRoute(row, route))).length;
+  const complete = !!registry && !unmappedRoutes && registry.routes.length === configuration.routes.length;
+  return Object.freeze({
+    adminOrigin: source.adminOrigin,
+    // Validated profiles retain reviewed native paths and bounded single-segment
+    // patterns. Incomplete or overlapping registries grant no native ownership.
+    nativePaths: Object.freeze(complete ? [...(registry.nativePaths ?? [])] : []),
+    nativePatterns: Object.freeze(complete ? [...(registry.nativePatterns ?? [])] : []),
+    body: Object.freeze({ version: 1, siteId: configuration.siteId, environmentId: configuration.environmentId,
+      publication: true, contentBindings: complete, runtime: 'server',
+      sourceExport: source.exportClosed === true ? 'closed' : 'open',
+      bindingFingerprint: registry ? createHash('sha256').update(JSON.stringify(registry)).digest('hex') : null,
+      coverage: { complete, unmappedRoutes }, routes: configuration.routes.map(route => ({ ...route })),
+    }),
+  });
+}
+
+export function verificationCors(verification, origin) {
+  return verification && origin === verification.adminOrigin ? {
+    'Access-Control-Allow-Origin': verification.adminOrigin, Vary: 'Origin',
+    'Access-Control-Expose-Headers': VERIFICATION_HEADERS.join(', '),
+  } : {};
+}
+
+/** Resolve only a fixed diagnostic with exact scope. No visitor-supplied origin,
+ * credential, content or executable config is ever accepted by this endpoint.
+ */
+export function verificationRequest({ configuration, verification, url, method, headers }) {
+  if (url.searchParams.get('check') !== 'connection') return null;
+  if (!verification) return { status: 404 };
+  const origin = headers.get('origin');
+  const host = headers.get('host');
+  const website = new URL(configuration.websiteOrigin);
+  const internalLoopback = host === website.host && ['127.0.0.1', '[::1]'].includes(website.hostname) && url.hostname === 'localhost' && url.protocol === website.protocol && url.port === website.port;
+  if (url.origin !== configuration.websiteOrigin && !internalLoopback || host && host !== website.host ||
+      origin !== verification.adminOrigin || headers.has('authorization') || headers.has('cookie') ||
+      url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) return { status: 403 };
+  if (!['GET', 'HEAD', 'OPTIONS'].includes(method)) return { status: 405 };
+  const allowed = ['check', 'siteId', 'environmentId', 'path'];
+  if ([...url.searchParams.keys()].some(name => !allowed.includes(name) || url.searchParams.getAll(name).length !== 1)) return { status: 400 };
+  if (method === 'OPTIONS') {
+    if (!['GET', 'HEAD'].includes(headers.get('access-control-request-method')) || headers.has('access-control-request-headers')) return { status: 403 };
+    return { status: 204, headers: { ...verificationCors(verification, origin), 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' } };
+  }
+  let pathname;
+  try { pathname = url.searchParams.has('path') ? normalizePublicationPath(url.searchParams.get('path')) : configuration.routes[0].path; } catch { return { status: 400 }; }
+  if (!configuration.routes.some(route => route.path === pathname)) return { status: 400 };
+  return { pathname, headers: verificationCors(verification, origin) };
+}
+
+export function verificationBody(verification, pathname, result) {
+  return { ...verification.body, check: { path: pathname,
+    state: result.state === 'published' ? 'published' : result.state === 'missing' ? 'unpublished' : 'unavailable',
+    ...(result.state === 'published' && result.entry ? { revision: publicationRevision(result.entry) } : {}),
+  } };
+}
+
+export function publicationRouteHeaders(configuration, pathname, result, verification, origin, credentialed = false) {
+  return {
+    'X-UniversalCMS-Site': configuration.siteId, 'X-UniversalCMS-Environment': configuration.environmentId,
+    'X-UniversalCMS-Route': encodeURIComponent(pathname),
+    'X-UniversalCMS-State': result.state === 'published' ? 'published' : result.state === 'missing' ? 'unpublished' : 'unavailable',
+    ...(result.state === 'published' && result.entry ? { 'X-UniversalCMS-Revision': publicationRevision(result.entry) } : {}),
+    ...(!credentialed ? verificationCors(verification, origin) : {}),
+  };
+}

package/dist/publication.css

@@ -0,0 +1,6 @@
+.cms-document{overflow-wrap:anywhere}.cms-document img{max-width:100%;height:auto}.cms-document pre,.cms-table-scroll{overflow-x:auto}.cms-document figure{margin:0}.cms-document blockquote{border-inline-start:3px solid currentColor;padding-inline-start:1rem}.cms-document table{border-collapse:collapse;width:100%}.cms-document th,.cms-document td{border:1px solid #8886;padding:.6rem;text-align:start}.cms-gallery,.cms-columns{display:grid;gap:1rem}.cms-grid-2,.cms-layout-1-1{grid-template-columns:repeat(2,minmax(0,1fr))}.cms-grid-3,.cms-layout-1-1-1{grid-template-columns:repeat(3,minmax(0,1fr))}.cms-grid-4,.cms-layout-1-1-1-1{grid-template-columns:repeat(4,minmax(0,1fr))}.cms-layout-1-2{grid-template-columns:minmax(0,1fr) minmax(0,2fr)}.cms-layout-2-1{grid-template-columns:minmax(0,2fr) minmax(0,1fr)}.cms-gap-small{gap:.5rem}.cms-gap-large{gap:2rem}.cms-embed{border:0;width:100%;height:auto}.cms-button{display:inline-block;padding:.65rem 1rem;border:1px solid currentColor;border-radius:.4rem}.cms-button-link{border:0;padding:0}.cms-form fieldset{border:0;padding:0;display:grid;gap:1rem}.cms-form-field{display:grid;gap:.35rem}.cms-form input,.cms-form textarea,.cms-form select{font:inherit;max-width:100%;padding:.6rem}.cms-form input[type=checkbox]{margin-inline-end:.5rem}.cms-selected{outline:2px solid #2563eb;outline-offset:3px}.cms-align-left{text-align:left}.cms-align-center{text-align:center}.cms-align-right{text-align:right}.cms-size-small{font-size:.875em}.cms-size-large{font-size:1.25em}.cms-tone-muted{opacity:.75}.cms-tone-accent{color:var(--cms-accent,#2563eb)}.cms-tone-inverse,.cms-section-dark{background:#20242c;color:#fff}.cms-section-muted{background:#8881}.cms-section-accent{background:var(--cms-accent,#2563eb);color:#fff}.cms-padding-small{padding:.75rem}.cms-padding-medium{padding:1.5rem}.cms-padding-large{padding:3rem}.cms-width-normal{max-width:70rem;margin-inline:auto}.cms-width-wide{max-width:90rem;margin-inline:auto}.cms-spaceAbove-small{margin-top:.5rem}.cms-spaceAbove-medium{margin-top:1rem}.cms-spaceAbove-large{margin-top:2rem}.cms-spaceBelow-small{margin-bottom:.5rem}.cms-spaceBelow-medium{margin-bottom:1rem}.cms-spaceBelow-large{margin-bottom:2rem}.cms-spaceAbove-none{margin-top:0}.cms-spaceBelow-none{margin-bottom:0}@media(min-width:641px){.cms-hideOnDesktop-true{display:none}}@media(max-width:640px){.cms-hideOnMobile-true{display:none}.cms-stack,.cms-gallery{grid-template-columns:minmax(0,1fr)}.cms-padding-large{padding:1.5rem}}
+
+.cms-document .cms-block,.cms-document .cms-column{min-width:0}.cms-block-paragraph>p,.cms-block-heading>h2,.cms-block-heading>h3,.cms-block-heading>h4,.cms-block-quote>blockquote,.cms-document figcaption,.cms-block-faq p{white-space:pre-line}.cms-image-align-left{text-align:left}.cms-image-align-center{text-align:center}.cms-image-align-right{text-align:right}.cms-image-align-full img{width:100%}.cms-document .cms-image-align-left img,.cms-document .cms-image-align-center img,.cms-document .cms-image-align-right img{display:inline-block}.cms-gallery img{width:100%;height:auto}.cms-table-scroll:focus-visible{outline:2px solid var(--cms-accent,#2563eb);outline-offset:3px}
+
+@media(max-width:767px){.cms-hide-mobile{display:none!important}}@media(min-width:768px){.cms-hide-desktop{display:none!important}}
+.cms-additional-content{max-width:80rem;margin:2rem auto;padding:1rem}.cms-inline-bound{display:contents}