@universalcms/connect 0.1.0 → 0.13.1

package/dist/source-check.mjs

@@ -0,0 +1,149 @@
+/** Read-only website source diagnostic. Never sends CMS credentials or changes content. */
+import { readSetupEnvironment } from './setup-environment.mjs';
+import { readSourceSettings } from './source-setup.mjs';
+import { createSourceManifestProvider } from './vendor/source-manifest-provider.mjs';
+import { inspectSourceRoutes, compareSourceRoutes } from './source-routes.mjs';
+
+export const SOURCE_CHECK_TIMEOUT_MS = 10_000;
+export const SOURCE_CHECK_MAX_BYTES = 20 * 1024 * 1024;
+export const SOURCE_CHECK_MESSAGES = Object.freeze({
+  checked: 'The source endpoint returned matching scope, exact-origin CORS and a valid manifest envelope, identity and taxonomy structure. Full block-schema validation, complete source inventory and access from the CMS browser still need verification. No content was imported.',
+  'configuration-error': 'Source was not checked. Supply --website-origin, --admin-origin, --site and --environment from Developer setup, or save matching public values locally. Use exact HTTPS origins or HTTP loopback origins. No delivery key is needed.',
+  'saved-settings-error': 'Saved connection values could not be read safely. Supply all four public flags explicitly to check the source without loading local settings.',
+  'missing-route': 'The website returned 404 for /api/cms-source. Installing the connector or saving a key does not create this endpoint. If full setup stopped on a review blocker, finish the reviewed source, publication, content and settings adapter first. For an import-only workflow, setup-source prepares a supported public export; it does not render published CMS edits or install website settings. After the chosen adapter is installed, stop the old server and restart or deploy the website, then run check-source with the exact public scope. Unsupported layouts require a reviewed source adapter.',
+  'request-rejected': 'The source endpoint rejected the request. Match its configured website origin, CMS admin origin, site and environment exactly, then restart or deploy. localhost and 127.0.0.1 are different origins. Do not add a delivery key or relax CORS.',
+  'http-error': 'The source endpoint returned an unsuccessful HTTP response. Check the website server and source adapter, then restart or deploy it.',
+  'cors-error': 'The source response must allow exactly the configured CMS admin origin and must not enable credentials. Verify the source adapter CORS configuration; a command-line response alone does not prove browser access.',
+  'not-json': 'The source endpoint did not return application/json. A website page or SPA fallback is not a source export. Mount /api/cms-source before the website fallback and restart or deploy.',
+  'scope-error': 'The source response does not match the selected site and environment. Configure the source adapter with the exact IDs from Developer setup and restart or deploy it.',
+  'manifest-error': 'The source manifest envelope, document shape, identity or taxonomy is invalid. Validate every exported entry against the v1 source contract. Keep complete content; do not replace it with samples or silently rename terms.',
+  'empty-source': 'The source endpoint returned no entries. This does not verify migration of an existing website. Prepare its complete public page and post inventory before using Connect & fetch content.',
+  'missing-pages': 'Some static page routes have no matching source export. For automatic Next.js discovery, review sync-source diagnostics and rebuild deployed websites. Protected routes, unsupported content and custom exporters need explicit public mappings. Existing CMS entries are preserved when reconnecting.',
+  'routes-unverified': 'The source route inventory could not be fully verified. Use an ordinary Next.js App Router project with default route filenames and paths. Dynamic, custom or ambiguous routes require an explicit public-content review; no pages were automatically exported or imported.',
+  'invalid-response': 'The source response was redirected, malformed, unsafe or exceeded the response budget. Serve the exact source endpoint directly with bounded valid JSON.',
+  'transport-error': 'The source endpoint could not be reached. Start the website at its saved origin and check the port and source route. A browser may also require local-network permission after this CLI check passes.',
+  timeout: 'The source endpoint did not finish within the verification deadline. Check that the website server and source adapter are running and responsive.',
+});
+
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const invalid = Symbol('Invalid source response');
+const result = (status, counts) => ({ status, checked: status === 'checked', browserVerified: false, fullDocumentValidation: false, ...(counts ? { counts } : {}), message: SOURCE_CHECK_MESSAGES[status] });
+const positiveBound = (value, max) => Number.isSafeInteger(value) && value > 0 && value <= max;
+function exactOrigin(value) {
+  if (typeof value !== 'string' || value.length > 2048 || /[\s\\]|cms_server\.|sk-[A-Za-z0-9_-]{12,}|AIza[A-Za-z0-9_-]{20,}/i.test(value)) return null;
+  try {
+    const url = new URL(value);
+    return !url.username && !url.password && !url.search && !url.hash && url.pathname === '/' &&
+      (url.protocol === 'https:' || (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) ? url.origin : null;
+  } catch { return null; }
+}
+function untilAborted(pending, signal) {
+  return new Promise((resolve, reject) => {
+    const cancel = () => reject(invalid);
+    if (signal.aborted) { cancel(); return; }
+    signal.addEventListener('abort', cancel, { once: true });
+    pending.then(value => { signal.removeEventListener('abort', cancel); resolve(value); }, error => { signal.removeEventListener('abort', cancel); reject(error); });
+  });
+}
+function cancelBody(response) {
+  try { if (response?.body && !response.body.locked) void response.body.cancel().catch(() => {}); }
+  catch { /* Cleanup never exposes an upstream error. */ }
+}
+async function boundedBody(response, maxBytes, signal, deadline) {
+  const length = response.headers.get('content-length');
+  if (length !== null && (!/^\d+$/.test(length) || Number(length) > maxBytes)) throw invalid;
+  if (!response.body) throw invalid;
+  const reader = response.body.getReader(), body = new Uint8Array(maxBytes);
+  let bytes = 0;
+  try {
+    while (true) {
+      const chunk = await untilAborted(reader.read(), signal);
+      deadline();
+      if (chunk.done) break;
+      bytes += chunk.value.byteLength;
+      if (bytes > maxBytes) throw invalid;
+      body.set(chunk.value, bytes - chunk.value.byteLength);
+    }
+    try { return new TextDecoder('utf-8', { fatal: true }).decode(body.subarray(0, bytes)); }
+    catch { throw invalid; }
+  } finally { void reader.cancel().catch(() => {}); reader.releaseLock(); }
+}
+function sourceManifest(raw, binding, inventory) {
+  let manifest;
+  try { manifest = JSON.parse(raw); } catch { return result('manifest-error'); }
+  if (!object(manifest) || Object.keys(manifest).length !== 4 || Object.keys(manifest).some(name => !['version', 'siteId', 'environmentId', 'entries'].includes(name))) return result('manifest-error');
+  if (manifest.siteId !== binding.siteId || manifest.environmentId !== binding.environmentId) return result('scope-error');
+  // Bound nesting and reserved keys before passing the entire inventory through
+  // the same envelope/identity/taxonomy validator used by the public provider.
+  // This deliberately does not claim full authoring block-schema validation.
+  let nodes = 0;
+  const walk = (value, depth = 0) => {
+    if (++nodes > 300_000 || depth > 20) throw invalid;
+    if (value && typeof value === 'object') for (const [name, child] of Object.entries(value)) {
+      if (['__proto__', 'prototype', 'constructor'].includes(name)) throw invalid;
+      walk(child, depth + 1);
+    }
+  };
+  try {
+    walk(manifest);
+    createSourceManifestProvider({ manifestJson: JSON.stringify({ version: manifest.version, entries: manifest.entries }), sourceOrigin: binding.websiteOrigin, adminOrigin: binding.adminOrigin, siteId: binding.siteId, environmentId: binding.environmentId, publicContent: true });
+  } catch { return result('manifest-error'); }
+  const counts = { entries: manifest.entries.length, pages: manifest.entries.filter(entry => entry.kind === 'page').length, posts: manifest.entries.filter(entry => entry.kind === 'post').length };
+  if (counts.entries && inventory) {
+    const routeInventory = compareSourceRoutes(inventory, manifest.entries);
+    const status = routeInventory.missingPages ? 'missing-pages' : routeInventory.unresolvedRoutes ? 'routes-unverified' : 'checked';
+    return { ...result(status, counts), routeInventory };
+  }
+  return result(counts.entries ? 'checked' : 'empty-source', counts);
+}
+
+/** Explicit public options bypass local configuration, including unsupported scaffold frameworks. */
+export async function checkSource(directory, options = {}, { fetcher = globalThis.fetch, timeoutMs = SOURCE_CHECK_TIMEOUT_MS, maxResponseBytes = SOURCE_CHECK_MAX_BYTES } = {}) {
+  const names = ['websiteOrigin', 'adminOrigin', 'siteId', 'environmentId'];
+  if (!object(options) || Object.keys(options).some(name => ![...names, 'checkRoutes'].includes(name)) || (options.checkRoutes !== undefined && typeof options.checkRoutes !== 'boolean') || typeof fetcher !== 'function' || !positiveBound(timeoutMs, SOURCE_CHECK_TIMEOUT_MS) || !positiveBound(maxResponseBytes, SOURCE_CHECK_MAX_BYTES)) return result('configuration-error');
+  let defaults = {};
+  if (names.some(name => options[name] === undefined)) {
+    try {
+      defaults = await readSourceSettings(directory);
+      // Source-only setup never needs private settings. Keep the legacy fallback
+      // only when a required public value is still missing.
+      if (names.some(name => options[name] === undefined && defaults[name] === undefined)) defaults = { ...(await readSetupEnvironment(directory)).defaults, ...defaults };
+    }
+    catch { return result('saved-settings-error'); }
+  }
+  const values = Object.fromEntries(names.map(name => [name, options[name] ?? defaults[name]]));
+  const websiteOrigin = exactOrigin(values.websiteOrigin), adminOrigin = exactOrigin(values.adminOrigin);
+  if (!websiteOrigin || !adminOrigin || !['siteId', 'environmentId'].every(name => typeof values[name] === 'string' && uuid.test(values[name]))) return result('configuration-error');
+  let inventory;
+  if (options.checkRoutes) {
+    try { inventory = await inspectSourceRoutes(directory); }
+    catch { return result('routes-unverified'); }
+  }
+  const binding = { websiteOrigin, adminOrigin, siteId: values.siteId.toLowerCase(), environmentId: values.environmentId.toLowerCase() };
+  const url = new URL('/api/cms-source', websiteOrigin);
+  url.search = new URLSearchParams({ siteId: binding.siteId, environmentId: binding.environmentId }).toString();
+  const controller = new AbortController();
+  let timedOut = false, response;
+  const expires = Date.now() + timeoutMs;
+  const deadline = () => { if (Date.now() >= expires) { timedOut = true; controller.abort(); throw invalid; } };
+  const timer = setTimeout(() => { timedOut = true; controller.abort(); }, timeoutMs);
+  try {
+    response = await untilAborted(fetcher(url, {
+      method: 'GET', headers: { Accept: 'application/json', Origin: adminOrigin }, credentials: 'omit',
+      redirect: 'error', cache: 'no-store', referrerPolicy: 'no-referrer', signal: controller.signal,
+    }), controller.signal);
+    deadline();
+    if (!(response instanceof Response) || response.redirected || ['opaque', 'opaqueredirect'].includes(response.type) || (response.url && response.url !== url.href) || (response.status >= 300 && response.status < 400)) return result('invalid-response');
+    if (response.status === 404) return result('missing-route');
+    if ([401, 403].includes(response.status)) return result('request-rejected');
+    if (!response.ok) return result('http-error');
+    if (response.status !== 200) return result('invalid-response');
+    if (response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase() !== 'application/json') return result('not-json');
+    if (response.headers.get('access-control-allow-origin') !== adminOrigin || response.headers.has('access-control-allow-credentials')) return result('cors-error');
+    const outcome = sourceManifest(await boundedBody(response, maxResponseBytes, controller.signal, deadline), binding, inventory);
+    deadline();
+    return outcome;
+  } catch (error) { return result(timedOut ? 'timeout' : error === invalid ? 'invalid-response' : 'transport-error'); }
+  finally { clearTimeout(timer); controller.abort(); cancelBody(response); }
+}

package/dist/source-collect.mjs

@@ -0,0 +1,80 @@
+import { projectRoot, readProjectFile } from './project-files.mjs';
+import { inspectSourceRoutes } from './source-routes.mjs';
+import { extractStaticPage } from './source-extract.mjs';
+import { nextPublicationProxyTemplate } from './publication-next-setup.mjs';
+import { readContentRegistry, readFrozenContent } from './content-registry.mjs';
+import { inspectReviewedNativeOwnership } from './reviewed-native-ownership.mjs';
+import { REVIEWED_NEXT_NATIVE_PROFILE } from './native-routes.mjs';
+import { inspectReviewedCommerceOwnership } from './reviewed-commerce-ownership.mjs';
+
+const protectedSegment = /^(?:admin|account|dashboard|profile|auth|login|register|checkout|orders|settings|billing|portal|patient|patients|vault|records)(?:-|$)|(?:^|-)vault$|^(?:medical|health)-records(?:-|$)/;
+const accessLogic = /\b(?:cookies|headers|useSession|getServerSession|auth|requireAuth|currentUser|redirect)\s*\(/;
+
+/** Parse public static source only. No page execution, HTML fetching or CMS writes. */
+export async function collectSource({ root: directory, locale = 'en', skipSlugs = [], excludedRoutes = [] }) {
+  const root = await projectRoot(directory), inventory = await inspectSourceRoutes(root);
+  if (inventory.routes.includes('') && inventory.routes.includes('home')) throw Error('Ambiguous home identity');
+  const entries = [], warnings = [];
+  const content = await readContentRegistry(root);
+  let websiteSettings = null;
+  if (await readProjectFile(root, '.universalcms/website.integration.json') !== null) {
+    // Website runtimes (for example a bundled Next source route) must not bundle
+    // the setup toolchain and its framework compilers. Node resolves it on demand.
+    // A non-literal specifier keeps bundlers from copying the module as an asset.
+    const setup = new URL(['.', 'website-setup.mjs'].join('/'), import.meta.url).href;
+    const { planWebsiteSettings } = await import(/* webpackIgnore: true */ /* turbopackIgnore: true */ /* @vite-ignore */ setup);
+    websiteSettings = await planWebsiteSettings(root);
+  }
+  const nativeOwnership = await inspectReviewedNativeOwnership(root) ?? await inspectReviewedCommerceOwnership(root);
+  // The reviewed product detail module accounts for exactly one dynamic route.
+  // Any other unresolved route remains in the diagnostic count for review.
+  const reviewedDynamic = name => nativeOwnership?.dynamicDirectories?.includes(name) || nativeOwnership?.profile === 'reviewed-icecream-commerce-2026-10-15' && name === 'src/app/menu/[id]' || websiteSettings?.files.some(file => ['js','jsx','ts','tsx'].some(ext => file.path === `${name}/page.${ext}`));
+  let skippedPages = 0, unsupportedRoutes = inventory.unresolvedPaths.filter(name => !reviewedDynamic(name)).length, bytes = 0;
+  const hasMiddleware = (await Promise.all(['middleware', 'src/middleware', 'proxy', 'src/proxy'].flatMap(name => ['js', 'ts'].map(async extension => {
+    const content = await readProjectFile(root, `${name}.${extension}`);
+    if (!content) return false;
+    if (websiteSettings?.files.some(file => file.path === `${name}.${extension}` && file.content === content)) return false;
+    // Our exact generated proxy only filters publications; it adds no private
+    // application content. Every other middleware still requires access review.
+    return !(extension === 'ts' && (name === 'proxy' && [nextPublicationProxyTemplate('app'), nextPublicationProxyTemplate('app', true)].includes(content) || name === 'src/proxy' && [nextPublicationProxyTemplate('src/app'), nextPublicationProxyTemplate('src/app', true)].includes(content)));
+  })))).some(Boolean);
+  const excludes = pathname => excludedRoutes.some(route => route === '/' || pathname === route || pathname.startsWith(`${route}/`));
+  const started = Date.now();
+  for (const route of [...inventory.routes].sort()) {
+    if (Date.now() - started > 8000) throw Error('Source inspection deadline');
+    const slug = route || 'home', filename = inventory.files[slug];
+    if (nativeOwnership?.nativePaths.includes(`/${route}`)) { skippedPages++; continue; }
+    if (skipSlugs.includes(slug) || excludes(`/${route}`)) { skippedPages++; continue; }
+    // Conservative guards, not a replacement for choosing a public-content root.
+    if (hasMiddleware || route.split('/').some(segment => protectedSegment.test(segment))) {
+      unsupportedRoutes++; warnings.push({ slug, codes: ['access-review-required'] }); continue;
+    }
+    const bound = content?.routes.find(row => row.sourceFile === filename && row.path === `/${route}` && row.kind === 'page' && row.slug === slug && row.locale === locale);
+    const source = await readProjectFile(root, filename);
+    if (source === null) throw Error('Source changed during inspection');
+    bytes += Buffer.byteLength(source);
+    if (bytes > 8 * 1024 * 1024) throw Error('Source inventory byte budget');
+    let guarded = accessLogic.test(source);
+    const parts = filename.split('/'); parts.pop();
+    while (parts.length) {
+      for (const ext of ['js', 'jsx', 'ts', 'tsx']) {
+        const layout = await readProjectFile(root, `${parts.join('/')}/layout.${ext}`);
+        if (layout && accessLogic.test(layout)) guarded = true;
+      }
+      if (parts.at(-1) === 'app') break;
+      parts.pop();
+    }
+    if (guarded) { unsupportedRoutes++; warnings.push({ slug, codes: ['access-review-required'] }); continue; }
+    // A frozen baseline does not freeze authorization. Ancestor layouts remain
+    // current application policy and must be checked before exporting its text.
+    if (bound) { entries.push((await readFrozenContent(root, bound)).entry); continue; }
+    const result = extractStaticPage({ source, slug, locale, filename });
+    if (Date.now() - started > 8000) throw Error('Source inspection deadline');
+    if (result.entry) entries.push(result.entry); else unsupportedRoutes++;
+    const codes = [...(result.warnings ?? []), ...(result.entry && content ? ['content-binding-required'] : [])];
+    if (codes.length) warnings.push({ slug, codes });
+  }
+  const snapshot = { version: 1, entries, diagnostics: { discoveredPages: inventory.routes.length, automaticPages: entries.length, skippedPages, unsupportedRoutes, warnings, ...(nativeOwnership && nativeOwnership.profile !== REVIEWED_NEXT_NATIVE_PROFILE ? { nativeOwnership: { profile:nativeOwnership.profile,paths:nativeOwnership.nativePaths } } : {}) } };
+  if (Buffer.byteLength(JSON.stringify(snapshot)) > 20 * 1024 * 1024) throw Error('Source response byte budget');
+  return snapshot;
+}

package/dist/source-config.mjs

@@ -0,0 +1,20 @@
+const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const slug = /^[a-z0-9]+(?:[-/][a-z0-9]+)*$/;
+const fail = () => { throw Error('Invalid automatic source configuration'); };
+function origin(value) {
+  if (typeof value !== 'string' || value.length > 2048 || /[\s\\]|cms_server\.|sk-[\w-]{12,}/i.test(value)) return fail();
+  const url = new URL(value);
+  if (url.username || url.password || url.search || url.hash || url.pathname !== '/' ||
+      !(url.protocol === 'https:' || url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname))) return fail();
+  return url.origin;
+}
+export function validateSourceConfiguration(value) {
+  const names = ['version', 'siteId', 'environmentId', 'websiteOrigin', 'adminOrigin', 'locale', 'skipSlugs', 'excludedRoutes', 'publicStaticPages', 'exportClosed'];
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !names.includes(key)) || (value.exportClosed !== undefined && value.exportClosed !== true) || value.version !== 1 || value.publicStaticPages !== true || typeof value.siteId !== 'string' || typeof value.environmentId !== 'string' || !uuid.test(value.siteId) || !uuid.test(value.environmentId)) return fail();
+  const locale = value.locale ?? 'en';
+  if (typeof locale !== 'string' || locale.length > 35 || Intl.getCanonicalLocales(locale).length !== 1) return fail();
+  const skipSlugs = value.skipSlugs ?? [], excludedRoutes = value.excludedRoutes ?? [];
+  if (!Array.isArray(skipSlugs) || skipSlugs.length > 1000 || skipSlugs.some(item => typeof item !== 'string' || item.length > 160 || !slug.test(item)) || new Set(skipSlugs).size !== skipSlugs.length) return fail();
+  if (!Array.isArray(excludedRoutes) || excludedRoutes.length > 1000 || excludedRoutes.some(item => typeof item !== 'string' || item.length > 161 || item !== '/' && (!item.startsWith('/') || !slug.test(item.slice(1)))) || new Set(excludedRoutes).size !== excludedRoutes.length) return fail();
+  return { version: 1, siteId: value.siteId.toLowerCase(), environmentId: value.environmentId.toLowerCase(), websiteOrigin: origin(value.websiteOrigin), adminOrigin: origin(value.adminOrigin), locale: Intl.getCanonicalLocales(locale)[0], skipSlugs: [...skipSlugs], excludedRoutes: [...excludedRoutes], publicStaticPages: true, ...(value.exportClosed ? { exportClosed: true } : {}) };
+}