@universalcms/connect 0.1.0 → 0.13.1

package/dist/svelte-setup.mjs

@@ -0,0 +1,135 @@
+/** Bounded SvelteKit Node setup. Reads literal public project evidence only. */
+import path from 'node:path';
+import {lstat,readdir,realpath} from 'node:fs/promises';
+import ts from './vendor/typescript.cjs';
+import {projectRoot,readProjectFile,SetupError} from './core.mjs';
+import {contentDigest,readContentRegistry,readFrozenContent,validateContentRegistry,CONTENT_BINDINGS_FILE} from './content-registry.mjs';
+import {validatePublicationConfig,isExcludedPublicationPath} from './publication.mjs';
+import {WEBSITE_SECTIONS} from './website-http.mjs';
+import {transformNativeTemplate} from './svelte-template.mjs';
+export const SVELTE_MANIFEST='.universalcms/svelte.integration.json';
+const json=value=>JSON.stringify(value,null,2)+'\n', fail=message=>{throw new SetupError(`SvelteKit automatic setup needs review: ${message}. Existing files were preserved.`);};
+import {readNativeChromeReview,reviewedNativeChrome,nativeChromeObservation} from './native-chrome-review.mjs';
+const inspections=new WeakMap();
+export async function svelteRead(root,file){const text=await readProjectFile(root,file);if(text!==null&&(await lstat(path.join(root,file))).nlink!==1)fail('linked files');return text;}
+export function supportsNativeNode(framework,version){const m=/^(\d+)\.(\d+)\.(\d+)$/.exec(version??'');if(!m)return false;const [,major,minor,patch]=m.map(Number);return framework==='angular'?major>=26||major===24&&minor>=15||major===22&&(minor>22||minor===22&&patch>=3):framework==='svelte'&&(major>22||major===22&&minor>=17);}
+export function svelteVersion(value,major,minor=0,patch=0){const m=typeof value==='string'&&/^[~^]?(\d+)\.(\d+)\.(\d+)$/.exec(value);return !!m&&+m[1]===major&&(+m[2]>minor||+m[2]===minor&&+m[3]>=patch);}
+export async function inspectSvelteAssets(root,directory='static') {
+  let count=0;const walk=async(relative,depth=0)=>{let stat;try{stat=await lstat(path.join(root,relative));}catch(e){if(e.code==='ENOENT')return;throw e;}
+    if(depth>12||stat.isSymbolicLink()||!stat.isDirectory()||await realpath(path.join(root,relative))!==path.join(root,relative))fail('static assets have unsafe ownership');
+    for(const item of await readdir(path.join(root,relative),{withFileTypes:true})){if(++count>5000||item.isSymbolicLink()||!/^[-a-zA-Z0-9_.]+$/.test(item.name)||item.name.startsWith('.')||/^(?:api|admin|private|internal|login|auth|robots\.txt|sitemap\.xml|.*(?:secret|credential|\.env).*)$/i.test(item.name))fail('static assets could shadow private or CMS routes');const filename=relative+'/'+item.name;if(item.isDirectory())await walk(filename,depth+1);else{const info=await lstat(path.join(root,filename));if(!info.isFile()||info.nlink!==1||! /\.(?:css|js|mjs|map|svg|png|jpe?g|gif|webp|avif|ico|woff2?|ttf|pdf|txt|webmanifest|mp[34]|webm|ogg)$/i.test(item.name))fail('static HTML, extensionless or non-asset files');}}
+  };await walk(directory);
+}
+function configReview(source,filename) {
+  if(typeof source!=='string')fail('missing Vite configuration');
+  const file=ts.createSourceFile(filename,source,ts.ScriptTarget.Latest,true,ts.ScriptKind.TS);if(file.parseDiagnostics.length)fail('configuration syntax');
+  const imports=new Map();let config;
+  for(const statement of file.statements){
+    if(ts.isImportDeclaration(statement)&&ts.isStringLiteral(statement.moduleSpecifier)){
+      const module=statement.moduleSpecifier.text,clause=statement.importClause;
+      if(['@sveltejs/adapter-node','@sveltejs/adapter-auto'].includes(module)&&clause?.name&&!clause.namedBindings)imports.set(clause.name.text,'adapter');
+      else if(['vite','@sveltejs/kit/vite'].includes(module)&&!clause?.name&&clause?.namedBindings&&ts.isNamedImports(clause.namedBindings)&&clause.namedBindings.elements.length===1){const item=clause.namedBindings.elements[0],expected=module==='vite'?'defineConfig':'sveltekit';if((item.propertyName?.text??item.name.text)!==expected)fail('custom configuration import');imports.set(item.name.text,expected);}
+      else fail('custom configuration import');continue;
+    }
+    if(ts.isExportAssignment(statement)&&ts.isCallExpression(statement.expression)&&imports.get(statement.expression.expression.getText(file))==='defineConfig'&&statement.expression.arguments.length===1){config=statement.expression.arguments[0];continue;}
+    if(!ts.isEmptyStatement(statement))fail('custom configuration code');
+  }
+  if(!config||!ts.isObjectLiteralExpression(config)||config.properties.length!==1)fail('custom Vite configuration');
+  const plugins=config.properties[0];if(!ts.isPropertyAssignment(plugins)||plugins.name.getText(file)!=='plugins'||!ts.isArrayLiteralExpression(plugins.initializer)||plugins.initializer.elements.length!==1)fail('custom Vite plugins');
+  const kit=plugins.initializer.elements[0];if(!ts.isCallExpression(kit)||imports.get(kit.expression.getText(file))!=='sveltekit'||kit.arguments.length!==1||!ts.isObjectLiteralExpression(kit.arguments[0])||kit.arguments[0].properties.length!==1)fail('custom Kit options');
+  const adapter=kit.arguments[0].properties[0];if(!ts.isPropertyAssignment(adapter)||adapter.name.getText(file)!=='adapter'||!ts.isCallExpression(adapter.initializer)||imports.get(adapter.initializer.expression.getText(file))!=='adapter'||adapter.initializer.arguments.length)fail('ordinary Node adapter required');
+}
+export async function inspectSvelteProject(directory){
+  if(!supportsNativeNode('svelte',process.versions.node))fail('Node.js 22.17 or newer is required before setup');
+  const root=await projectRoot(directory),manifest=JSON.parse(await svelteRead(root,'package.json')??'null'),deps={...manifest?.devDependencies,...manifest?.dependencies};
+  for(const [name,major,minor,patch=0] of [['@sveltejs/kit',3,1],['svelte',5,57,1],['@sveltejs/adapter-node',6,0],['@sveltejs/vite-plugin-svelte',7,3],['vite',8,0,12],['typescript',6,0,2]]){
+    if(!svelteVersion(deps[name],major,minor,patch))fail(`requires declared ${name} ${major}.${minor}+`);
+    const installed=JSON.parse(await svelteRead(root,`node_modules/${name}/package.json`)??'null');if(installed?.name!==name||!svelteVersion(installed.version,major,minor,patch))fail(`install compatible ${name}`);
+  }
+  if(manifest.workspaces||['next','nuxt','astro','@angular/core','vue'].some(name=>deps[name]))fail('competing frameworks or workspace');
+  const config='';
+  for(const name of ['svelte.config.js','svelte.config.ts','svelte.config.mjs','svelte.config.cjs','src/hooks.js','src/hooks.ts','src/hooks.client.js','src/hooks.client.ts','src/hooks.server.ts','src/service-worker.js','src/service-worker.ts'])if(await svelteRead(root,name)!==null)fail('custom hooks or alternative configuration');
+  let viteFile=null,viteSource=null;for(const name of ['vite.config.js','vite.config.ts']){const text=await svelteRead(root,name);if(text!==null){if(viteFile)fail('multiple Vite configurations');viteFile=name;viteSource=text;}}
+  configReview(viteSource,viteFile);
+  await inspectSvelteAssets(root);
+  return {root,manifest,config,configFile:viteFile,viteFile,viteSource};
+}
+async function routes(root){const ownershipText=await svelteRead(root,SVELTE_MANIFEST),ownership=ownershipText?JSON.parse(ownershipText):null;const rows=[];let count=0;const walk=async(directory,segments=[])=>{const stat=await lstat(path.join(root,directory));if(stat.isSymbolicLink()||!stat.isDirectory()||await realpath(path.join(root,directory))!==path.join(root,directory))fail('linked route directory');for(const item of (await readdir(path.join(root,directory),{withFileTypes:true})).sort((a,b)=>a.name.localeCompare(b.name))){if(++count>1000||segments.length>10||item.isSymbolicLink())fail('route inventory budget or linked route');const filename=directory+'/'+item.name;
+    if(item.isDirectory()){if(item.name==='[...cmsPath]'){if(segments.length||!ownership?.publication)fail('unowned CMS catch-all route');const children=await readdir(path.join(root,filename),{withFileTypes:true});if(children.length!==2||children.some(child=>!child.isFile()||!['+page.svelte','+page.server.js'].includes(child.name)))fail('custom CMS catch-all files');for(const child of children){const file=filename+'/'+child.name,expected=ownership.files?.find(row=>row.path===file);if(!expected||contentDigest(await svelteRead(root,file))!==expected.sha256)fail('changed CMS catch-all');}continue;}if(!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(item.name)||isExcludedPublicationPath('/'+item.name))fail('dynamic/private route');await walk(filename,[...segments,item.name]);}
+    else if(item.name==='+page.svelte')rows.push({path:'/'+segments.join('/'),kind:'page',slug:segments.length?segments.join('/'):'home',sourceFile:filename});
+    else if(item.name!=='+page.server.js')fail('custom server/layout route');
+  }};await walk('src/routes');if(!rows.length||rows.some(r=>r.path==='/home')&&rows.some(r=>r.path==='/'))fail('missing or duplicate home identity');return rows;}
+function pageTemplate(content){return `<script>\nimport { onMount } from 'svelte';\nimport { defineNativeWebsite } from '@universalcms/connect/native-website';\nlet { data } = $props();\nlet host;\nonMount(() => { defineNativeWebsite(); const cms=data.universalcms; host.cms={pathname:cms.pathname,scope:cms.scope,initialResult:cms.result,initialSettings:cms.settings,...(cms.publicInventory?{inventory:cms.publicInventory}:{})}; });\n</script>\n<universalcms-website bind:this={host}>${content}</universalcms-website>\n`;}
+export async function inspectSvelteSource(directory,{locale='en',websiteOrigin}={}){
+  const root=await projectRoot(directory),list=await routes(root),registry=await readContentRegistry(root),prepared=[],entries=[],inventories={};
+  const chromeReview=await readNativeChromeReview(root,'svelte');
+  if(registry?.profile||registry?.routes.some(row=>!row.sourceFile.endsWith('.svelte')))fail('existing content belongs to another adapter');
+  for(const route of list){const current=await svelteRead(root,route.sourceFile),installed=registry?.routes.find(row=>row.path===route.path),original=installed?(await readFrozenContent(root,installed)).texts.original:current;
+    const allowNativeChrome=reviewedNativeChrome(chromeReview,route.sourceFile,original);
+    let extracted;
+    try {
+      extracted=await transformNativeTemplate({source:original,slug:route.slug,locale,websiteOrigin,framework:'svelte',allowNativeChrome});
+    } catch(error) {
+      if(error instanceof SetupError)fail('automatic content binding requires a supported literal Svelte template; review dynamic components, controls and content ownership before setup');
+      throw error;
+    }
+    extracted.source = pageTemplate(extracted.source);
+    if(installed&&(installed.sourceFile!==route.sourceFile||installed.locale!==locale||current!==extracted.source))fail('changed native content ownership');
+    prepared.push({...route,locale,current,original,installed,extracted});entries.push(extracted.entry);inventories[route.path]=extracted.inventory;
+  }
+  if(registry&&registry.routes.length!==list.length)fail('removed installed route');
+  const result={entries,routes:prepared.map(({path,kind,slug,locale})=>({path,kind,slug,locale})),snapshot:{version:1,entries,inventories},sourceFiles:[...prepared.map(row=>({path:row.sourceFile,sha256:contentDigest(row.current)})),...(chromeReview?[{path:chromeReview.path,sha256:chromeReview.sha256}]:[])],diagnostics:{discoveredPages:list.length,automaticPages:list.length,skippedPages:0,unsupportedRoutes:0,warnings:[]}};
+  inspections.set(result,{root,prepared,chromeReview,digest:contentDigest(json(result))});return result;
+}
+export async function planSvelteContent(directory,configuration,inspection){
+  const root=await projectRoot(directory),config=validatePublicationConfig(configuration);inspection??=await inspectSvelteSource(root,{locale:config.routes[0]?.locale,websiteOrigin:config.websiteOrigin});const state=inspections.get(inspection);
+  if(!state||state.root!==root||state.digest!==contentDigest(json(inspection))||json(inspection.routes)!==json(config.routes))fail('source/publication inspection changed');
+  const files=await nativeChromeObservation(root,state.chromeReview),rows=[];for(const item of state.prepared){if(await svelteRead(root,item.sourceFile)!==item.current)fail('source changed after inspection');
+    if(item.installed){const frozen=await readFrozenContent(root,item.installed);for(const name of ['original','native','inventory','source'])files.push({path:item.installed[name+'File'],content:frozen.texts[name],state:'unchanged'});rows.push(item.installed);continue;}
+    const token=contentDigest(item.path+item.locale).slice(0,20),originalFile=`.universalcms/content/${token}.original.txt`,nativeFile=`.universalcms/content/${token}.native.txt`,inventoryFile=`.universalcms/content/${token}.json`,source=item.extracted.source,inventory=json(item.extracted.inventory);
+    for(const file of [originalFile,nativeFile,inventoryFile])if(await svelteRead(root,file)!==null)fail('frozen content collision');
+    files.push({path:originalFile,content:item.original,state:'create'},{path:nativeFile,content:source,state:'create'},{path:inventoryFile,content:inventory,state:'create'},{path:item.sourceFile,content:source,state:'update',previous:item.current});
+    rows.push({...Object.fromEntries(['path','kind','slug','locale','sourceFile'].map(key=>[key,item[key]])),originalFile,nativeFile,inventoryFile,sourceHash:contentDigest(source),nativeHash:contentDigest(source),originalHash:contentDigest(item.original),inventoryHash:contentDigest(inventory)});
+  }
+  const registry=validateContentRegistry({version:1,routes:rows}),text=json(registry),previous=await svelteRead(root,CONTENT_BINDINGS_FILE);if(previous!==null&&previous!==text)fail('content registry changed');files.push({path:CONTENT_BINDINGS_FILE,content:text,state:previous===null?'create':'unchanged'});return{root,framework:'svelte',files,routes:rows,entries:inspection.entries,snapshot:inspection.snapshot};
+}
+export async function planSvelteIntegration(directory,{publication=false,sourceConfiguration}={}){
+  const project=await inspectSvelteProject(directory),{root}=project,manifestText=await svelteRead(root,SVELTE_MANIFEST),prior=manifestText?JSON.parse(manifestText):null;
+  if(prior?.publication)publication=true;
+  const app=await svelteRead(root,'src/app.html');if(!app||!app.includes('%sveltekit.head%')||!app.includes('%sveltekit.body%')||/<script\b|\son\w+\s*=/i.test(app))fail('custom application shell');
+  const appSource=prior?.originalApp??app;if(prior&&prior.originalAppHash!==contentDigest(appSource))fail('application ownership changed');
+  const appOutput=appSource.replace(/<body\b([^>]*)>/,(_m,attrs)=>`<body${attrs.replace(/\sdata-sveltekit-(?:reload|preload-data)(?:=(?:"[^"]*"|'[^']*'))?/g,'')} data-sveltekit-reload data-sveltekit-preload-data="false">`);
+  const hook=`import { createSvelteRuntime } from '@universalcms/connect/svelte-runtime';\nimport { renderNativeWebsite } from '@universalcms/connect/native-website-server';\nimport sourceConfiguration from '../.universalcms/source.config.json';\nimport snapshot from '../.universalcms/source.generated.json';\n${publication?"import configuration from '../.universalcms/publication.config.json';\nimport contentBindings from '../.universalcms/content.bindings.json';\n":''}const runtime=createSvelteRuntime({${publication?'configuration,contentBindings,':''}sourceConfiguration,snapshot,sourceRoot:process.cwd(),renderWebsite:renderNativeWebsite});\nexport const handle=runtime.handle;\n`;
+  const load=`export const prerender=false;\nexport const load=({locals})=>({universalcms:locals.universalcms});\n`;
+  const generated=[['src/hooks.server.js',hook],['src/app.html',appOutput],['.universalcms/svelte.vite.config.mjs',`import adapter from '@sveltejs/adapter-node';\nimport {sveltekit} from '@sveltejs/kit/vite';\nimport config from './source.config.json' with {type:'json'};\nconst port=Number(new URL(config.websiteOrigin).port||(config.websiteOrigin.startsWith('https:')?443:80));\nconst privateFiles={name:'universalcms-private-files',enforce:'pre',configureServer(server){server.middlewares.use((request,response,next)=>{try{const pathname=decodeURIComponent(new URL(request.url,'http://localhost').pathname);if(pathname.includes('%')||pathname.split('/').some(part=>['.universalcms','.git','.ssh','.aws'].includes(part)||/\\.(?:crt|pem|key)$/i.test(part)||part==='.env'||part.startsWith('.env.'))){response.statusCode=404;response.setHeader('Cache-Control','no-store');response.end('Not found');return;}}catch{response.statusCode=400;response.end('Invalid URL');return;}next();});}};\nexport default {plugins:[privateFiles,sveltekit({adapter:adapter(),paths:{origin:config.websiteOrigin}})],server:{port,strictPort:true,fs:{deny:['**/.env','**/.env.*','**/.universalcms/**','**/.git/**','**/.ssh/**','**/.aws/**','**/*.{crt,pem,key}']}},preview:{port,strictPort:true}};\n`],['.universalcms/svelte.serve.mjs',`import {fileURLToPath} from 'node:url';\nprocess.chdir(fileURLToPath(new URL('../',import.meta.url)));\nimport config from './source.config.json' with {type:'json'};\nprocess.env.ORIGIN=config.websiteOrigin;process.env.PORT=String(new URL(config.websiteOrigin).port||(config.websiteOrigin.startsWith('https:')?443:80));\nawait import('../build/index.js');\n`]];
+  if(publication){for(const row of await routes(root))generated.push([path.posix.dirname(row.sourceFile)+'/+page.server.js',load]);generated.push(['src/routes/[...cmsPath]/+page.svelte',pageTemplate('')],['src/routes/[...cmsPath]/+page.server.js',load]);}
+  const scripts={...project.manifest.scripts};for(const name of ['dev','build','preview']){const expected=name==='build'?'vite build':`vite ${name==='dev'?'':name}`.trim(),generated=expected+' --config .universalcms/svelte.vite.config.mjs';if(scripts[name]!==undefined&&scripts[name]!==expected&&scripts[name]!==generated)fail('custom startup/build scripts');if(name!=='preview'&&scripts[name]===undefined)fail('missing startup/build scripts');if(scripts[name]!==undefined)scripts[name]=generated;}
+  const start='node .universalcms/svelte.serve.mjs';if(scripts.start&&scripts.start!==start&&scripts.start!=='node build')fail('custom production startup');scripts.start=start;
+  const verify='universalcms-connect sync-source';for(const name of ['predev','prebuild','prestart','prepreview']){if(scripts[name]&&scripts[name]!==verify)fail('custom lifecycle hooks');scripts[name]=verify;}
+  const oldFiles=new Map((prior?.files??[]).map(item=>[item.path,item.sha256])),files=[];
+  if(prior&&(prior.version!==1||prior.configHash!==contentDigest(project.config)||prior.viteHash!==contentDigest(project.viteSource)))fail('framework configuration changed');
+  for(const [file,content]of generated){const before=await svelteRead(root,file),owned=oldFiles.get(file);if(file==='src/app.html'){if(before!==appSource&&before!==appOutput)fail('application shell changed');}else if(before!==null&&(!owned||contentDigest(before)!==owned))fail('custom runtime or load file');files.push({path:file,content,state:before===content?'unchanged':before===null?'create':'update',...(before!==null&&before!==content?{previous:before}:{})});}
+  files.push({path:project.viteFile,content:project.viteSource,state:'unchanged'});
+  const packageBefore=await svelteRead(root,'package.json'),packageAfter=json({...project.manifest,scripts});files.push({path:'package.json',content:packageAfter,state:packageBefore===packageAfter?'unchanged':'update',previous:packageBefore});
+  const ownership={version:1,publication,configHash:contentDigest(project.config),viteHash:contentDigest(project.viteSource),originalApp:appSource,originalAppHash:contentDigest(appSource),files:generated.map(([path,content])=>({path,sha256:contentDigest(content)}))};
+  files.push({path:SVELTE_MANIFEST,content:json(ownership),state:manifestText===json(ownership)?'unchanged':manifestText===null?'create':'update',...(manifestText?{previous:manifestText}:{})});
+  return{root,framework:'svelte',files,project};
+}
+export async function validateInstalledSvelte(directory,configuration){
+  const plan=await planSvelteIntegration(directory,{publication:true,sourceConfiguration:configuration});
+  if(plan.files.some(file=>file.state!=='unchanged'))fail('integration incomplete or changed');
+  const inspection=await inspectSvelteSource(directory,{locale:configuration.routes[0]?.locale,websiteOrigin:configuration.websiteOrigin});
+  if(json(inspection.routes)!==json(configuration.routes)||await svelteRead(plan.root,'.universalcms/source.generated.json')!==json(inspection.snapshot))fail('published route or frozen source inventory changed');
+  const registry=await readContentRegistry(plan.root);if(!registry||registry.routes.length!==configuration.routes.length)fail('published-content bindings incomplete');
+  const content=await planSvelteContent(directory,configuration,inspection);if(content.files.some(file=>file.state!=='unchanged'))fail('native content bindings incomplete');
+  plan.files.push(...content.files);return{...plan,config:configuration};
+}
+export async function planSvelteSettings(directory,{config,source}){
+  const plan=await validateInstalledSvelte(directory,config),name='.universalcms/website.integration.json';
+  const unique=new Map(plan.files.filter(file=>file.path!=='package.json').map(file=>[file.path,{path:file.path,sha256:contentDigest(file.content)}]));
+  const content=json({version:1,framework:'svelte',siteId:config.siteId,environmentId:config.environmentId,apiOrigin:config.apiOrigin,websiteOrigin:config.websiteOrigin,adminOrigin:source.adminOrigin,sections:WEBSITE_SECTIONS,files:[...unique.values()]}),previous=await svelteRead(plan.root,name);
+  if(previous!==null&&previous!==content)fail('settings ownership or scope changed');
+  plan.files.push({path:name,content,state:previous===null?'create':'unchanged'});
+  for(const name of ['.universalcms/publication.config.json','.universalcms/source.config.json','.universalcms/source.generated.json'])plan.files.push({path:name,content:await svelteRead(plan.root,name),state:'unchanged'});
+  return{...plan,sections:[...WEBSITE_SECTIONS]};
+}

package/dist/svelte-template.mjs

@@ -0,0 +1,48 @@
+/** Literal native HTML projection shared by the Svelte and Angular adapters.
+ * The bundled parser validates inert source; customer modules are never loaded. */
+import { parse } from './vendor/astro-compiler/node/index.js';
+import { extractAstroPage } from './astro-source.mjs';
+import { SetupError } from './core.mjs';
+const fail = () => { throw new SetupError('Native template requires a reviewed adapter. Automatic setup accepts literal editorial HTML and styles; custom components, expressions, scripts and chrome are preserved for review.'); };
+const escape = value => JSON.stringify(value);
+export async function transformNativeTemplate({source,slug,locale='en',websiteOrigin,framework,allowNativeChrome=false}) {
+  if (!['svelte','angular'].includes(framework) || typeof source !== 'string' || /[{}]|<(?:script|svelte:|ng-|router-|slot\b)|\s(?:on\w+|\[[^\]]+\]|\([^)]*\)|\*\w+)\s*=/i.test(source.replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi,''))) fail();
+  const extracted = await extractAstroPage({source,slug,locale,websiteOrigin,allowNativeChrome});
+  const parsed = await parse(source,{position:true}), edits=[]; let cursor=0;
+  const offsets=new Map([[0,0]]); let bytes=0,chars=0;
+  for(const character of source){bytes+=Buffer.byteLength(character);chars+=character.length;offsets.set(bytes,chars);}
+  const start=node=>{let at=offsets.get(node.position?.start?.offset);if(source[at]!=='<'&&source[at-1]==='<')at--;if(!Number.isInteger(at)||!source.startsWith('<'+node.name,at))fail();return at;};
+  const opening=node=>{const at=start(node);let quote=null;for(let i=at;i<source.length;i++){const c=source[i];if(quote){if(c===quote)quote=null;}else if(c==='"'||c==="'")quote=c;else if(c==='>')return i+1;}fail();};
+  const end=node=>node.name==='img'?opening(node):offsets.get(node.position?.end?.offset);
+  const visit=node=>{
+    if(node.type!=='element'){for(const child of node.children??[])visit(child);return;}
+    if(node.name==='style'||node.name==='head'||extracted.inventory.nativeChrome&&['header','footer'].includes(node.name))return;
+    if(!/^(?:h[1-6]|p|ul|ol|img)$/.test(node.name)){for(const child of node.children??[])visit(child);return;}
+    const block=extracted.entry.document.blocks[cursor++];if(!block)fail();
+    const from=start(node),to=end(node);if(!Number.isInteger(to)||to<=from)fail();
+    const lookup=framework==='svelte'?`data.universalcms.bindings[${escape(block.id)}]`:`cms.binding(${escape(block.id)})`;
+    let native=source.slice(from,to),open=source.slice(from,opening(node)),close=node.name==='img'?'':`</${node.name}>`;
+    if(block.type==='image') {
+      open=open.replace(/\s(?:src|alt)\s*=\s*(?:"[^"]*"|'[^']*')/g,'');
+      const attrs=framework==='svelte'?` src={${lookup}.url} alt={${lookup}.alt}`:` [src]="${lookup.replaceAll('"',"'")}!.url" [alt]="${lookup.replaceAll('"',"'")}!.alt"`;
+      native=open.replace(/\s*\/?>$/,attrs+' />');
+    } else if(block.type==='list') {
+      const first=node.children.find(child=>child.type==='element'&&child.name==='li'),itemOpen=source.slice(start(first),opening(first));
+      const item=framework==='svelte'?`{#each ${lookup}.text.split('\\n') as item}${itemOpen}{item}</li>{/each}`:`@for (item of ${lookup.replaceAll('"',"'")}!.text.split('\\n'); track $index) {${itemOpen}{{item}}</li>}`;
+      native=open+item+close;
+    } else {
+      // Native wrappers retain their order. Editorial text is projected once;
+      // no frozen source copy is emitted into the browser bundle.
+      const value=framework==='svelte'?`{${lookup}.text}`:`{{${lookup.replaceAll('"',"'")}!.text}}`;
+      const replacements=[];let first=true;
+      const visitText=child=>{if(child.type==='text'&&child.value.trim()){const at=offsets.get(child.position?.start?.offset),to=offsets.get(child.position?.end?.offset);if(!Number.isInteger(at)||!Number.isInteger(to)||source.slice(at,to)!==child.value)fail();replacements.push({from:at-from,to:to-from,value:first?value:''});first=false;}else for(const nested of child.children??[])visitText(nested);};
+      for(const child of node.children??[])visitText(child);
+      if(first)fail();
+      for(const change of replacements.sort((a,b)=>b.from-a.from))native=native.slice(0,change.from)+change.value+native.slice(change.to);
+    }
+    edits.push({from,to,value:framework==='svelte'?`{#if ${lookup}}${native}{/if}`:`@if (${lookup.replaceAll('"',"'")}) {${native}}`});
+  };
+  visit(parsed.ast);if(cursor!==extracted.entry.document.blocks.length)fail();
+  let output=source;for(const edit of edits.sort((a,b)=>b.from-a.from))output=output.slice(0,edit.from)+edit.value+output.slice(edit.to);
+  return {...extracted,source:output};
+}

package/dist/templates.mjs

@@ -5,7 +5,7 @@ export async function createTemplates(config, { existingNodeServer = false } = {
   const env = `# Set these in your PRIVATE hosting/server environment. This file contains no key.\nCMS_API_BASE_URL=${config.apiOrigin}\nCMS_SITE_ID=${config.siteId}\nCMS_ENVIRONMENT_ID=${config.environmentId}\nCMS_API_KEY=\n${config.framework === 'vite' ? 'CMS_WEBSITE_ORIGIN=http://localhost:5173\nCMS_CONNECT_PORT=4318\nCMS_CONNECT_HOST=127.0.0.1\n' : ''}`;
   const common = [
     { path: '.universalcms/server.env.example', content: env },
-    { path: '.universalcms/SETUP.md', content: instructions(config, existingNodeServer) },
+    { path: '.universalcms/SETUP.md', content: stagedSetupGuide(instructions(config, existingNodeServer)) },
   ];
   const clientOptions = `baseUrl: process.env.CMS_API_BASE_URL ?? ${json(config.apiOrigin)},\n    siteId: ${json(config.siteId)},\n    environmentId: ${json(config.environmentId)},\n    apiKey: process.env.CMS_API_KEY,\n    retries: 0,`;
   if (config.framework === 'next') {
@@ -21,16 +21,180 @@ export async function createTemplates(config, { existingNodeServer = false } = {
     { path: '.universalcms/page-handler.mjs', content: handler },
     { path: '.universalcms/server.mjs', content: `import { createServer } from 'node:http';\nimport { createCmsClient } from '@universalcms/sdk';\nimport { createPageHandler } from './page-handler.mjs';\n\ntry {\n  const cms = createCmsClient({\n    ${clientOptions}\n  });\n  const port = Number(process.env.CMS_CONNECT_PORT ?? '4318');\n  if (!Number.isInteger(port) || port < 1 || port > 65535) throw Error();\n  const handler = createPageHandler(cms, { locale: ${json(config.locale)}, websiteOrigin: process.env.CMS_WEBSITE_ORIGIN });\n  const server = createServer({ requestTimeout: 15_000, headersTimeout: 10_000, maxHeaderSize: 8192 }, (req, res) => { void handler(req, res); });\n  server.on('error', () => { console.error('CMS connector could not start. Check server configuration.'); process.exitCode = 1; });\n  server.listen(port, process.env.CMS_CONNECT_HOST ?? '127.0.0.1', () => console.log('CMS connector listening. Route /api/universalcms/page through your website proxy.'));\n  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { server.close(); server.closeAllConnections(); });\n} catch { console.error('CMS connector requires valid private server configuration.'); process.exitCode = 1; }\n` },
     { path: '.universalcms/CmsPage.jsx', content: `import React, { useEffect, useState } from 'react';\nimport { CmsDocument } from '@universalcms/react';\nimport '@universalcms/react/styles.css';\n\n// Mount in your existing router; this module contains no CMS credentials.\nexport default function CmsPage({ slug = 'home' }) {\n  const [result, setResult] = useState({ slug: '', state: 'loading', entry: null });\n  useEffect(() => {\n    const controller = new AbortController();\n    let current = true;\n    setResult({ slug, state: 'loading', entry: null });\n    async function load() {\n      try {\n        const response = await fetch('/api/universalcms/page?slug=' + encodeURIComponent(slug), { credentials: 'omit', cache: 'no-store', redirect: 'error', signal: controller.signal });\n        if (response.status === 404) { if (current) setResult({ slug, state: 'missing', entry: null }); return; }\n        if (!response.ok || !response.headers.get('content-type')?.startsWith('application/json')) throw Error();\n        const body = await response.json();\n        if (!body.entry?.document || typeof body.entry.document.title !== 'string' || !Array.isArray(body.entry.document.blocks)) throw Error();\n        if (current) setResult({ slug, state: 'ready', entry: body.entry });\n      } catch { if (current) setResult({ slug, state: 'error', entry: null }); }\n    }\n    void load();\n    return () => { current = false; controller.abort(); };\n  }, [slug]);\n  if (result.slug !== slug || result.state === 'loading') return <p role="status">Loading content…</p>;\n  if (result.state === 'missing') return <h1>Page not found</h1>;\n  if (result.state === 'error') return <p role="alert">Content is temporarily unavailable.</p>;\n  return <article><h1>{result.entry.document.title}</h1><CmsDocument document={result.entry.document} entryId={result.entry.id} /></article>;\n}\n` },
-    { path: '.universalcms/vite.config.mjs', content: `import { defineConfig, loadConfigFromFile } from 'vite';\n\n// Explicit wrapper: preserves the project's config without editing it.\n// Run only when you choose: npx vite --config .universalcms/vite.config.mjs\nexport default defineConfig(async env => {\n  const existing = (await loadConfigFromFile(env, undefined, process.cwd()))?.config ?? {};\n  const proxies = existing.server?.proxy ?? {};\n  const endpoint = '^/api/universalcms/page(?:[?]|$)';\n  if (Object.hasOwn(proxies, '/api/universalcms/page') || Object.hasOwn(proxies, endpoint)) throw new Error('The CMS proxy endpoint already exists. Review it manually before using this wrapper.');\n  // Vite selects the first matching proxy. The exact CMS endpoint must precede\n  // an existing broad /api proxy; all unrelated routes retain their destinations.\n  return { ...existing, server: { ...existing.server, proxy: { [endpoint]: { target: 'http://127.0.0.1:4318', changeOrigin: false }, ...proxies } } };\n});\n` },
+    { path: '.universalcms/vite.config.mjs', content: sourceAwareViteWrapper(`import { defineConfig, loadConfigFromFile } from 'vite';\n\n// Explicit wrapper: preserves the project's config without editing it.\n// Run only when you choose: npx vite --config .universalcms/vite.config.mjs\nexport default defineConfig(async env => {\n  const existing = (await loadConfigFromFile(env, undefined, process.cwd()))?.config ?? {};\n  const proxies = existing.server?.proxy ?? {};\n  const endpoint = '^/api/universalcms/page(?:[?]|$)';\n  if (Object.hasOwn(proxies, '/api/universalcms/page') || Object.hasOwn(proxies, endpoint)) throw new Error('The CMS proxy endpoint already exists. Review it manually before using this wrapper.');\n  // Vite selects the first matching proxy. The exact CMS endpoint must precede\n  // an existing broad /api proxy; all unrelated routes retain their destinations.\n  return { ...existing, server: { ...existing.server, proxy: { [endpoint]: { target: 'http://127.0.0.1:4318', changeOrigin: false }, ...proxies } } };\n});\n`) },
     { path: 'universalcms-demo.html', content: '<!doctype html>\n<html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CMS connection demo</title><meta name="robots" content="noindex,nofollow"></head><body><div id="universalcms-demo"></div><script type="module" src="/.universalcms/demo.jsx"></script></body></html>\n' },
     { path: '.universalcms/demo.jsx', content: `import React from 'react';\nimport { createRoot } from 'react-dom/client';\nimport CmsPage from './CmsPage.jsx';\nconst slug = new URLSearchParams(window.location.search).get('slug') || 'home';\ncreateRoot(document.getElementById('universalcms-demo')).render(<CmsPage slug={slug} />);\n` },
   ];
 }
 
+// The optional demo wrapper must retain original-route publication protection
+// after full setup. Switching to this documented wrapper cannot bypass the gate.
+const sourceImport = "import { readFile } from 'node:fs/promises';\n";
+const legacySourceStartup = `  let sourcePlugins = [];
+  try {
+    const configuration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));
+    const { universalCmsSource } = await import('@universalcms/connect/vite-source');
+    sourcePlugins = [universalCmsSource({ configuration })];
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+`;
+const sourceStartup = `  const sourcePlugins = [];
+  let publicationText;
+  try { publicationText = await readFile(new URL('./publication.config.json', import.meta.url), 'utf8'); }
+  catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    for (const filename of ['./source.vite.config.mjs', './serve.mjs']) {
+      try {
+        const source = await readFile(new URL(filename, import.meta.url), 'utf8');
+        if (/@universalcms\\/connect\\/vite-publication|universalcms-publication-client/.test(source)) throw new Error('Original-route publication configuration is missing. Restore the reviewed setup before starting the website.');
+      } catch (inspectionError) { if (inspectionError.code !== 'ENOENT') throw inspectionError; }
+    }
+  }
+  if (publicationText !== undefined) {
+    const configuration = JSON.parse(publicationText);
+    const sourceConfiguration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));
+    let contentBindings;
+    try { contentBindings = JSON.parse(await readFile(new URL('./content.bindings.json', import.meta.url), 'utf8')); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const { universalCmsPublication } = await import('@universalcms/connect/vite-publication');
+    sourcePlugins.push(universalCmsPublication({ configuration, sourceConfiguration, contentBindings }));
+  }
+  try {
+    const configuration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));
+    const { universalCmsSource } = await import('@universalcms/connect/vite-source');
+    sourcePlugins.push(universalCmsSource({ configuration }));
+  } catch (error) { if (error.code !== 'ENOENT') throw error; }
+`;
+function sourceAwareViteWrapper(content) {
+  return sourceImport + content.replace('  const proxies =', sourceStartup + '  const proxies =')
+    .replace('return { ...existing, server:', 'return { ...existing, plugins: [...sourcePlugins, ...(existing.plugins ?? [])], server:');
+}
+export function previousViteSourceWrapper(content) {
+  return content.replace(sourceImport, '').replace(sourceStartup, '')
+    .replace('return { ...existing, plugins: [...sourcePlugins, ...(existing.plugins ?? [])], server:', 'return { ...existing, server:');
+}
+export function previousPublicationViteWrapper(content) {
+  return content.replace(sourceStartup, legacySourceStartup);
+}
+export function previousDiagnosticViteWrapper(content) {
+  return content.replace("    const sourceConfiguration = JSON.parse(await readFile(new URL('./source.config.json', import.meta.url), 'utf8'));\n    let contentBindings;\n    try { contentBindings = JSON.parse(await readFile(new URL('./content.bindings.json', import.meta.url), 'utf8')); }\n    catch (error) { if (error.code !== 'ENOENT') throw error; }\n", '')
+    .replace('universalCmsPublication({ configuration, sourceConfiguration, contentBindings })', 'universalCmsPublication({ configuration })');
+}
+
 // Exact prior prerelease guide variant, used only to recognize an untouched
 // generated document during guided upgrades. Custom bytes still fail closed.
+const priorSetupInstruction = 'Run npx --no-install universalcms-connect setup to enter and save connection values locally.';
+const stagedSetupInstruction = 'After connect and setup, run npx --no-install universalcms-connect server-key to save the delivery key through hidden input. If this project has no saved connect record, setup retains its all-in-one guided flow.';
+const priorPrivateInstruction = 'Guided setup saves the entered values in private .env.local.';
+const stagedPrivateInstruction = 'The server-key command (or the legacy all-in-one setup flow) saves entered values in private .env.local.';
+const legacyPublicationGuide = `## Connect publication to the original website URLs
+
+Source export and importing drafts do not hide the original website content.
+The scaffold does not connect existing routes to CMS publication automatically.
+Review the imported public route inventory and map each original URL to its exact
+CMS kind, slug and locale in the fixed site/environment. Map the home URL explicitly
+(for example, / to the imported home slug); do not guess from titles or route names.
+Exclude private/account, API, admin, preview and framework paths from this mapping.
+
+For every reviewed managed public route, check published delivery before rendering
+any original page content. A missing or unpublished page must return 404; a failed
+delivery request must show an unavailable response without original or stale
+content. When all managed pages are unpublished, all their original URLs must be
+unavailable, including the home page. Never use draft content as a fallback.
+Publication checks are independent of body/design mapping: preserve existing
+components and interactions behind the check while mapping CMS blocks deliberately.
+A source-only setup still needs this integration before publication governs pages.
+
+Use fixtures or a disposable staging site to verify published, all-unpublished and
+publish-to-unpublish transitions on the original URLs, including direct requests,
+client navigation, reload and cached/prefetched routes. Test upstream failures too.
+Do not publish or unpublish customer content merely to test. For static hosting,
+verify the required rebuild, cache invalidation and deployment before claiming the
+URLs changed. A successful API check or demo route does not verify original pages.
+Report unmanaged public routes and unfinished deployments explicitly. Existing
+public source exports and assets are separate from page-rendering checks.
+
+`;
+const availabilityGuide = `## Connect publication to the original website URLs
+
+Source export and importing drafts do not hide the original website content.
+The full universalcms-connect setup command separately installs publication checks
+for its reviewed original URL mappings. Confirm the printed kind, slug and locale,
+including / for the home page, before saving. Custom mappings belong in
+.universalcms/publication.routes.json; rerun setup after adding public routes.
+Exclude private/account, API, admin, preview and framework paths from this mapping.
+
+After full setup, use your normal dev and preview commands. For a supported Vite
+website, run your normal build command and then npm start (or your package-manager
+equivalent) to serve the build with the generated private Node publication server.
+Deploy that server with its private environment. A static-only host cannot enforce
+the request-time publication checks. Next.js keeps its ordinary dev/build/start
+commands and uses the generated server proxy before HTML and RSC responses.
+
+The preceding /cms or universalcms-demo instructions apply to standalone init or
+source-only installations. After full setup, verify the reviewed original URLs;
+unmapped demo page URLs return 404. Their standalone page API is not the original
+website's production host. The optional Vite wrapper retains installed original-
+route publication checks and refuses to start when their configuration is missing.
+
+A missing or unpublished page returns 404; failed delivery returns 503 without
+original or stale content. When all managed pages are unpublished, all their original URLs must be
+unavailable, including the home page. Never use draft content as a fallback.
+Publication checks are independent of body/design mapping: published pages retain
+their native components. CMS document edits need deliberate component mapping.
+Source-only setup and unsupported custom servers still require manual integration.
+
+Use fixtures or a disposable staging site to verify published, all-unpublished and
+publish-to-unpublish transitions on the original URLs, including direct requests,
+client navigation, reload and cached/prefetched routes. Test upstream failures too.
+Do not publish or unpublish customer content merely to test. A successful API check
+or demo route does not verify original pages. Report unmanaged public routes and
+unfinished deployments explicitly. Existing public source exports and assets are
+separate from page-rendering checks.
+
+`;
+const publicationGuide = availabilityGuide.replace(
+  'Publication checks are independent of body/design mapping: published pages retain\ntheir native components. CMS document edits need deliberate component mapping.\nSource-only setup and unsupported custom servers still require manual integration.',
+  `Full setup also binds supported native JSX/TSX components to the current published
+document. Existing block IDs and source baselines stay frozen across reconnects and
+builds. Edited and deleted blocks update in place; new blocks appear after the
+bound native content. Source-only setup and unsupported custom components require
+an explicit integration through @universalcms/connect/react-publication.
+
+Vite routes need reviewed path/sourceFile pairs in .universalcms/content.routes.json
+unless a single homepage maps unambiguously to src/App.jsx or src/App.tsx. The
+entire source block structure must match before imported IDs can be reused.
+Native layout positions and interactions remain in their components. Arbitrary
+layout reordering and private/runtime application data are not inferred.
+
+Save draft leaves the published revision unchanged. Update live / Publish changes
+public content. Open tabs check every 15 seconds and on focus; a published revision
+refreshes bound content without resetting native state. Missing or failed reads
+remove stale managed content. Test published A, saved draft B, then published B on
+the original URL, including removed blocks and a published empty document.
+
+Existing installations must upgrade this package, rerun setup and deploy the
+updated website code and private runtime settings to each live host. A local
+setup does not deploy remote websites. Verify actual changed page text separately
+on local and live origins; an API or source-import check cannot prove rendering.`
+);
+export function previousRenderingSetupGuide(content) {
+  return content.replace(publicationGuide, availabilityGuide);
+}
+function stagedSetupGuide(content) {
+  return content.replace(priorSetupInstruction, stagedSetupInstruction).replace(priorPrivateInstruction, stagedPrivateInstruction)
+    .replace('## What remains deliberate', publicationGuide + '## What remains deliberate');
+}
+export function priorPublicationSetupGuide(content) {
+  return content.replace(publicationGuide, '');
+}
+export function previousPublicationSetupGuide(content) {
+  return content.replace(publicationGuide, legacyPublicationGuide);
+}
+export function previousSetupGuide(content) {
+  return priorPublicationSetupGuide(content).replace(stagedSetupInstruction, priorSetupInstruction).replace(stagedPrivateInstruction, priorPrivateInstruction);
+}
 export function legacySetupGuide(content) {
-  return content
+  return previousSetupGuide(content)
     .replace('Guided setup saves the entered values in private .env.local. The analyze, init and check commands do not load that file automatically.', 'The CLI neither saves nor reads an .env file.')
     .replace('node --env-file=.env.local .universalcms/server.mjs', 'node .universalcms/server.mjs')
     .replace('Run npx --no-install universalcms-connect setup to enter and save connection values locally. For hosted deployment, copy the nonsecret values in server.env.example into the private server/hosting', 'Copy the nonsecret values in server.env.example into the private server/hosting')

package/dist/vendor/astro-compiler/LICENSE

@@ -0,0 +1,53 @@
+MIT License
+
+Copyright (c) 2021 [Astro contributors](https://github.com/withastro/compiler/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+"""
+This license applies to parts of the `internal/` subdirectory originating from 
+the https://cs.opensource.google/go/x/net/+/master:html/ repository:
+
+Copyright (c) 2009 The Go Authors. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google Inc. nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package/dist/vendor/astro-compiler/chunk-W5DTLHV4.js

@@ -0,0 +1 @@
+import g from"crypto";import _ from"fs";import{TextDecoder as b,TextEncoder as v}from"util";globalThis.fs||Object.defineProperty(globalThis,"fs",{value:_});globalThis.process||Object.defineProperties(globalThis,"process",{value:process});globalThis.crypto||Object.defineProperty(globalThis,"crypto",{value:g.webcrypto?g.webcrypto:{getRandomValues(m){return g.randomFillSync(m)}}});globalThis.performance||Object.defineProperty(globalThis,"performance",{value:{now(){let[m,o]=process.hrtime();return m*1e3+o/1e6}}});var y=new v("utf-8"),w=new b("utf-8");var d=class{constructor(){this.argv=["js"],this.env={},this.exit=t=>{t!==0&&console.warn("exit code:",t)},this._exitPromise=new Promise(t=>{this._resolveExitPromise=t}),this._pendingEvent=null,this._scheduledTimeouts=new Map,this._nextCallbackTimeoutID=1;let o=(t,e)=>{this.mem.setUint32(t+0,e,!0),this.mem.setUint32(t+4,Math.floor(e/4294967296),!0)},n=t=>{let e=this.mem.getUint32(t+0,!0),s=this.mem.getInt32(t+4,!0);return e+s*4294967296},r=t=>{let e=this.mem.getFloat64(t,!0);if(e===0)return;if(!isNaN(e))return e;let s=this.mem.getUint32(t,!0);return this._values[s]},l=(t,e)=>{if(typeof e=="number"&&e!==0){if(isNaN(e)){this.mem.setUint32(t+4,2146959360,!0),this.mem.setUint32(t,0,!0);return}this.mem.setFloat64(t,e,!0);return}if(e===void 0){this.mem.setFloat64(t,0,!0);return}let i=this._ids.get(e);i===void 0&&(i=this._idPool.pop(),i===void 0&&(i=this._values.length),this._values[i]=e,this._goRefCounts[i]=0,this._ids.set(e,i)),this._goRefCounts[i]++;let a=0;switch(typeof e){case"object":e!==null&&(a=1);break;case"string":a=2;break;case"symbol":a=3;break;case"function":a=4;break}this.mem.setUint32(t+4,2146959360|a,!0),this.mem.setUint32(t,i,!0)},c=t=>{let e=n(t+0),s=n(t+8);return new Uint8Array(this._inst.exports.mem.buffer,e,s)},f=t=>{let e=n(t+0),s=n(t+8),i=new Array(s);for(let a=0;a<s;a++)i[a]=r(e+a*8);return i},u=t=>{let e=n(t+0),s=n(t+8);return w.decode(new DataView(this._inst.exports.mem.buffer,e,s))},h=Date.now()-performance.now();this.importObject={gojs:{"runtime.wasmExit":t=>{t>>>=0;let e=this.mem.getInt32(t+8,!0);this.exited=!0,delete this._inst,delete this._values,delete this._goRefCounts,delete this._ids,delete this._idPool,this.exit(e)},"runtime.wasmWrite":t=>{t>>>=0;let e=n(t+8),s=n(t+16),i=this.mem.getInt32(t+24,!0);_.writeSync(e,new Uint8Array(this._inst.exports.mem.buffer,s,i))},"runtime.resetMemoryDataView":t=>{t>>>=0,this.mem=new DataView(this._inst.exports.mem.buffer)},"runtime.nanotime1":t=>{t>>>=0,o(t+8,(h+performance.now())*1e6)},"runtime.walltime":t=>{t>>>=0;let e=new Date().getTime();o(t+8,e/1e3),this.mem.setInt32(t+16,e%1e3*1e6,!0)},"runtime.scheduleTimeoutEvent":t=>{t>>>=0;let e=this._nextCallbackTimeoutID;this._nextCallbackTimeoutID++,this._scheduledTimeouts.set(e,setTimeout(()=>{for(this._resume();this._scheduledTimeouts.has(e);)console.warn("scheduleTimeoutEvent: missed timeout event"),this._resume()},n(t+8)+1)),this.mem.setInt32(t+16,e,!0)},"runtime.clearTimeoutEvent":t=>{t>>>=0;let e=this.mem.getInt32(t+8,!0);clearTimeout(this._scheduledTimeouts.get(e)),this._scheduledTimeouts.delete(e)},"runtime.getRandomData":t=>{t>>>=0,globalThis.crypto.getRandomValues(c(t+8))},"syscall/js.finalizeRef":t=>{t>>>=0;let e=this.mem.getUint32(t+8,!0);if(this._goRefCounts[e]--,this._goRefCounts[e]===0){let s=this._values[e];this._values[e]=null,this._ids.delete(s),this._idPool.push(e)}},"syscall/js.stringVal":t=>{t>>>=0,l(t+24,u(t+8))},"syscall/js.valueGet":t=>{t>>>=0;let e=Reflect.get(r(t+8),u(t+16));t=this._inst.exports.getsp()>>>0,l(t+32,e)},"syscall/js.valueSet":t=>{t>>>=0,Reflect.set(r(t+8),u(t+16),r(t+32))},"syscall/js.valueDelete":t=>{t>>>=0,Reflect.deleteProperty(r(t+8),u(t+16))},"syscall/js.valueIndex":t=>{t>>>=0,l(t+24,Reflect.get(r(t+8),n(t+16)))},"syscall/js.valueSetIndex":t=>{t>>>=0,Reflect.set(r(t+8),n(t+16),r(t+24))},"syscall/js.valueCall":t=>{t>>>=0;try{let e=r(t+8),s=Reflect.get(e,u(t+16)),i=f(t+32),a=Reflect.apply(s,e,i);t=this._inst.exports.getsp()>>>0,l(t+56,a),this.mem.setUint8(t+64,1)}catch(e){t=this._inst.exports.getsp()>>>0,l(t+56,e),this.mem.setUint8(t+64,0)}},"syscall/js.valueInvoke":t=>{t>>>=0;try{let e=r(t+8),s=f(t+16),i=Reflect.apply(e,void 0,s);t=this._inst.exports.getsp()>>>0,l(t+40,i),this.mem.setUint8(t+48,1)}catch(e){t=this._inst.exports.getsp()>>>0,l(t+40,e),this.mem.setUint8(t+48,0)}},"syscall/js.valueNew":t=>{t>>>=0;try{let e=r(t+8),s=f(t+16),i=Reflect.construct(e,s);t=this._inst.exports.getsp()>>>0,l(t+40,i),this.mem.setUint8(t+48,1)}catch(e){t=this._inst.exports.getsp()>>>0,l(t+40,e),this.mem.setUint8(t+48,0)}},"syscall/js.valueLength":t=>{t>>>=0,o(t+16,Number.parseInt(r(t+8).length))},"syscall/js.valuePrepareString":t=>{t>>>=0;let e=y.encode(String(r(t+8)));l(t+16,e),o(t+24,e.length)},"syscall/js.valueLoadString":t=>{t>>>=0;let e=r(t+8);c(t+16).set(e)},"syscall/js.valueInstanceOf":t=>{t>>>=0,this.mem.setUint8(t+24,r(t+8)instanceof r(t+16)?1:0)},"syscall/js.copyBytesToGo":t=>{t>>>=0;let e=c(t+8),s=r(t+32);if(!(s instanceof Uint8Array||s instanceof Uint8ClampedArray)){this.mem.setUint8(t+48,0);return}let i=s.subarray(0,e.length);e.set(i),o(t+40,i.length),this.mem.setUint8(t+48,1)},"syscall/js.copyBytesToJS":t=>{t>>>=0;let e=r(t+8),s=c(t+16);if(!(e instanceof Uint8Array||e instanceof Uint8ClampedArray)){this.mem.setUint8(t+48,0);return}let i=s.subarray(0,e.length);e.set(i),o(t+40,i.length),this.mem.setUint8(t+48,1)},debug:t=>{console.log(t)}}}}async run(o){if(!(o instanceof WebAssembly.Instance))throw new Error("Go.run: WebAssembly.Instance expected");this._inst=o,this.mem=new DataView(this._inst.exports.mem.buffer),this._values=[Number.NaN,0,null,!0,!1,globalThis,this],this._goRefCounts=new Array(this._values.length).fill(Number.POSITIVE_INFINITY),this._ids=new Map([[0,1],[null,2],[!0,3],[!1,4],[globalThis,5],[this,6]]),this._idPool=[],this.exited=!1;let n=4096,r=h=>{let t=n,e=y.encode(`${h}\0`);return new Uint8Array(this.mem.buffer,n,e.length).set(e),n+=e.length,n%8!==0&&(n+=8-n%8),t},l=this.argv.length,c=[];this.argv.forEach(h=>{c.push(r(h))}),c.push(0),Object.keys(this.env).sort().forEach(h=>{c.push(r(`${h}=${this.env[h]}`))}),c.push(0);let u=n;c.forEach(h=>{this.mem.setUint32(n,h,!0),this.mem.setUint32(n+4,0,!0),n+=8}),this._inst.exports.run(l,u),this.exited&&this._resolveExitPromise(),await this._exitPromise}_resume(){if(this.exited)throw new Error("Go program has already exited");this._inst.exports.resume(),this.exited&&this._resolveExitPromise()}_makeFuncWrapper(o){let n=this;return function(){let r={id:o,this:this,args:arguments};return n._pendingEvent=r,n._resume(),r.result}}};export{d as a};

package/dist/vendor/astro-compiler/node/index.js

@@ -0,0 +1 @@
+import{a as c}from"../chunk-W5DTLHV4.js";import{promises as m}from"fs";import{fileURLToPath as f}from"url";var w=async(t,s)=>i().then(r=>r.transform(t,s)),l=async(t,s)=>i().then(r=>r.parse(t,s)),b=async(t,s)=>i().then(r=>r.convertToTSX(t,s)),P=async t=>{let{default:s}=await import(`data:text/javascript;charset=utf-8;base64,${Buffer.from(t).toString("base64")}`);return s},n,g=()=>{n=void 0,globalThis["@astrojs/compiler"]=void 0},i=()=>(n||(n=d().catch(t=>{throw n=void 0,t})),n),y=async(t,s)=>{let r;return r=await(async()=>{let o=await m.readFile(t).then(e=>e.buffer);return WebAssembly.instantiate(new Uint8Array(o),s)})(),r},d=async()=>{let t=new c,s=await y(f(new URL("../astro.wasm",import.meta.url)),t.importObject);t.run(s.instance);let r=globalThis["@astrojs/compiler"];return{transform:(a,o)=>new Promise(e=>{try{e(r.transform(a,o||{}))}catch(p){throw n=void 0,p}}),parse:(a,o)=>new Promise(e=>e(r.parse(a,o||{}))).catch(e=>{throw n=void 0,e}).then(e=>({...e,ast:JSON.parse(e.ast)})),convertToTSX:(a,o)=>new Promise(e=>e(r.convertToTSX(a,o||{}))).catch(e=>{throw n=void 0,e}).then(e=>({...e,map:JSON.parse(e.map)}))}};export{P as compile,b as convertToTSX,l as parse,g as teardown,w as transform};

package/dist/vendor/project-analysis.mjs

@@ -91,15 +91,15 @@ function tokens(source) {
     if (c === '/' && next === '*') { const end = source.indexOf('*/', i + 2); i = end < 0 ? source.length : end + 2; continue; }
     if (c === '/' && (!result.length || ['=', '(', ':', ',', '[', '{', '!', '?', ';', '>', 'return', 'case', 'yield'].includes(result.at(-1)?.value))) {
       // A regexp may contain quotes, comment-like text and fake source tokens.
-      let inClass = false;
+      let inClass = false, closed = false;
       for (i++; i < source.length; i++) {
         if (source[i] === '\\') { i++; continue; }
         if (source[i] === '[') inClass = true;
         if (source[i] === ']') inClass = false;
-        if (source[i] === '/' && !inClass) { i++; while (/[a-z]/i.test(source[i] ?? '') && i < source.length) i++; break; }
+        if (source[i] === '/' && !inClass) { closed = true; i++; while (/[a-z]/i.test(source[i] ?? '') && i < source.length) i++; break; }
         if (source[i] === '\n' || source[i] === '\r') break;
       }
-      result.push({ type: 'dynamic', value: '' }); continue;
+      result.push({ type: closed ? 'regexp' : 'dynamic', value: '' }); continue;
     }
     if (c === '`') {
       i = skipTemplate(source, i);
@@ -119,6 +119,10 @@ function tokens(source) {
       while (i < source.length && /[A-Za-z0-9_$]/.test(source[i])) i++;
       result.push({ type: 'name', value: source.slice(start, i) }); continue;
     }
+    if (/\d/.test(c)) {
+      const value = source.slice(i).match(/^\d+(?:\.\d*)?(?:[eE][+-]?\d+)?/)[0];
+      result.push({ type: 'number', value }); i += value.length; continue;
+    }
     result.push({ type: 'punctuation', value: c }); i++;
   }
   return result;
@@ -192,9 +196,59 @@ function literalConfig(source, wrapper) {
   }
   if (begin < 0) return { literals: {}, properties: {}, opaque: true, list };
   if (wrapper && list[begin]?.value === wrapper && list[begin + 1]?.value === '(') begin += 2;
+  let aliasEnd = null;
+  // create-next-app emits a typed const followed by `export default config`
+  // (or `module.exports = config` in its JavaScript template). Resolve that one
+  // inert alias, never a function call, mutable assignment, imported runtime
+  // value, second declaration or conditional configuration.
+  const commonjs = list[begin - 1]?.value === '=' && list[begin - 2]?.value === 'exports' && list[begin - 3]?.value === '.' && list[begin - 4]?.value === 'module';
+  if (!wrapper && list[begin]?.type === 'name' && (list[begin - 1]?.value === 'default' || commonjs)) {
+    const name = list[begin].value, declaration = list.findIndex(token => token.value === 'const');
+    const prefix = list.slice(0, declaration);
+    const typeImport = prefix.length === 0 || prefix[0]?.value === 'import' && prefix[1]?.value === 'type' && prefix.filter(token => token.value === 'import').length === 1 && prefix.filter(token => token.value === 'from').length === 1 && prefix.at(-1)?.value === ';' && prefix.at(-2)?.type === 'string' && prefix.at(-2)?.value === 'next' && prefix.at(-3)?.value === 'from' && prefix.slice(2,-3).every(token => token.type === 'name' || ['{','}',','].includes(token.value));
+    let initial = declaration + 2;
+    if (list[initial]?.value === ':') {
+      initial++;
+      // Ordinary type names only. Types are erased, not executed.
+      if (list[initial]?.type !== 'name') initial = -1;
+      else { initial++; while (list[initial]?.value === '.' && list[initial + 1]?.type === 'name') initial += 2; }
+    }
+    const tail = list.slice(begin + 1);
+    if (declaration < 0 || !typeImport || list[declaration + 1]?.value !== name || list[initial]?.value !== '=' || list[initial + 1]?.value !== '{' || tail.some(token => token.value !== ';')) return { literals: {}, properties: {}, opaque: true, list };
+    aliasEnd = commonjs ? begin - 4 : begin - 2;
+    begin = initial + 1;
+  }
   if (list[begin]?.value !== '{') return { literals: {}, properties: {}, opaque: true, list };
   const parsed = readObject(list, begin), literals = {};
   let opaque = parsed.opaque;
+  if (aliasEnd !== null) {
+    const literal = (expression, key, depth = 0) => {
+      if (depth > 24 || !expression.length) return false;
+      if (expression.length === 1) return ['string','number'].includes(expression[0].type) || ['true','false','null'].includes(expression[0].value) || key === 'htmlLimitedBots' && expression[0].type === 'regexp';
+      if (expression.length === 2 && ['-','+'].includes(expression[0].value) && expression[1].type === 'number') return true;
+      if (expression[0]?.value === '{') {
+        const object = readObject(expression,0,depth + 1);
+        return !object.opaque && object.end === expression.length - 1 && Object.entries(object.properties).every(([name, property]) => literal(property.expression,name,depth + 1));
+      }
+      if (expression[0]?.value === '[' && expression.at(-1)?.value === ']') {
+        let start = 1, nesting = 0;
+        for (let index = 1; index < expression.length; index++) {
+          const value = expression[index].value;
+          if (index === expression.length - 1 || value === ',' && nesting === 0) {
+            if (start !== index && !literal(expression.slice(start,index),key,depth + 1)) return false;
+            if (start === index && index !== expression.length - 1) return false;
+            start = index + 1;
+          } else if (['{','['].includes(value)) nesting++;
+          else if (['}',']'].includes(value)) nesting--;
+          else if (['(',')'].includes(value)) return false;
+          if (nesting < 0) return false;
+        }
+        return nesting === 0;
+      }
+      return false;
+    };
+    if (list.slice(parsed.end + 1,aliasEnd).some(token => token.value !== ';') || !Object.entries(parsed.properties).every(([name, property]) => literal(property.expression,name))) opaque = true;
+  }
   for (const key of ['output', 'ssr', 'preset']) {
     const expression = parsed.properties[key]?.expression;
     if (!expression) continue;
@@ -202,7 +256,7 @@ function literalConfig(source, wrapper) {
     else opaque = true;
   }
   // Assignment, a second export or condition after the object can override it.
-  if (list.slice(parsed.end + 1).some(token => ![')', ';'].includes(token.value))) opaque = true;
+  if (aliasEnd === null && list.slice(parsed.end + 1).some(token => ![')', ';'].includes(token.value))) opaque = true;
   return { literals, properties: parsed.properties, opaque, list };
 }