@universalcms/connect 0.1.0 → 0.13.1

package/dist/vue-setup.mjs

@@ -0,0 +1,127 @@
+/** Reviewed ordinary Vue 3/Vite and Nuxt 4 Node deployment plans. */
+import { lstat } from 'node:fs/promises';
+import path from 'node:path';
+import ts from './vendor/typescript.cjs';
+import { projectRoot, readProjectFile, SetupError } from './core.mjs';
+import { inspectAstroPublicAssets } from './astro-setup.mjs';
+import { inspectVueSource } from './vue-source.mjs';
+import { contentDigest, readContentRegistry, readFrozenContent, CONTENT_BINDINGS_FILE } from './content-registry.mjs';
+import { WEBSITE_SECTIONS } from './website-http.mjs';
+const json=v=>JSON.stringify(v,null,2)+'\n';
+const fail=reason=>{throw new SetupError('Vue/Nuxt setup needs review: '+reason+'. Existing files were preserved.');};
+const version=(value,major)=>typeof value==='string'&&new RegExp('^(?:\\^|~)?'+major+'\\.\\d+\\.\\d+$').test(value);
+async function ordinary(root,name){const text=await readProjectFile(root,name);if(text!==null&&(await lstat(path.join(root,name))).nlink!==1)fail('linked source/configuration');return text;}
+async function absent(root,name){try{await lstat(path.join(root,name));}catch(e){if(e.code==='ENOENT')return;throw e;}fail('existing '+name+' needs explicit route and lifecycle ownership');}
+function literalConfig(source,filename,framework){
+  if(source===null)return;
+  const file=ts.createSourceFile(filename,source,ts.ScriptTarget.Latest,true,ts.ScriptKind.TS);if(file.parseDiagnostics.length)fail('invalid framework configuration');
+  const imports=new Map();let config;
+  for(const node of file.statements){
+    if(ts.isImportDeclaration(node)&&ts.isStringLiteral(node.moduleSpecifier)){
+      if(framework!=='vue'||node.attributes)fail('custom configuration imports');
+      const clause=node.importClause,spec=node.moduleSpecifier.text;
+      if(spec==='vite'&&!clause?.name&&clause?.namedBindings&&ts.isNamedImports(clause.namedBindings)&&clause.namedBindings.elements.length===1&&clause.namedBindings.elements[0].name.text==='defineConfig')imports.set('defineConfig','vite');
+      else if(spec==='@vitejs/plugin-vue'&&clause?.name&&!clause.namedBindings)imports.set(clause.name.text,'vue');else fail('custom Vite plugins');
+    }else if(ts.isExportAssignment(node)&&!node.isExportEquals&&!config){const e=node.expression;config=ts.isCallExpression(e)&&ts.isIdentifier(e.expression)&&e.expression.text===(framework==='nuxt'?'defineNuxtConfig':'defineConfig')&&e.arguments.length===1?e.arguments[0]:e;}
+    else if(!ts.isEmptyStatement(node))fail('executable framework configuration');
+  }
+  if(!config||!ts.isObjectLiteralExpression(config))fail('literal configuration required');
+  const seen=new Set();for(const member of config.properties){
+    const name=ts.isPropertyAssignment(member)&&(ts.isIdentifier(member.name)||ts.isStringLiteral(member.name))?member.name.text:null;
+    if(!name||seen.has(name))fail('spread/computed/duplicate configuration');seen.add(name);const v=member.initializer;
+    if(framework==='vue'&&name==='plugins'&&ts.isArrayLiteralExpression(v)&&v.elements.length===1){const p=v.elements[0];if(ts.isCallExpression(p)&&ts.isIdentifier(p.expression)&&imports.get(p.expression.text)==='vue'&&!p.arguments.length)continue;}
+    if(framework==='nuxt'&&name==='compatibilityDate'&&ts.isStringLiteral(v)&&/^\d{4}-\d{2}-\d{2}$/.test(v.text))continue;
+    if(framework==='nuxt'&&name==='devtools'&&ts.isObjectLiteralExpression(v)&&v.properties.length===1){const p=v.properties[0];if(ts.isPropertyAssignment(p)&&p.name.getText(file)==='enabled'&&[ts.SyntaxKind.TrueKeyword,ts.SyntaxKind.FalseKeyword].includes(p.initializer.kind))continue;}
+    fail('custom routing, modules, hooks, aliases or output configuration');
+  }
+}
+function scripts(manifest,framework){
+  const generated=framework==='vue'?{dev:'node .universalcms/vue.serve.mjs',build:'node .universalcms/vue.build.mjs',preview:'node .universalcms/vue.serve.mjs --production',start:'node .universalcms/vue.serve.mjs --production'}:{dev:'nuxt dev --extends ./.universalcms',build:'nuxt build --extends ./.universalcms',preview:'node .universalcms/nuxt.serve.mjs',start:'node .universalcms/nuxt.serve.mjs'};
+  const allowed=framework==='vue'?{dev:['vite'],build:['vite build'],preview:['vite preview'],start:[]}:{dev:['nuxt dev'],build:['nuxt build'],preview:['nuxt preview'],start:['node .output/server/index.mjs']};
+  const result={...manifest.scripts};for(const [name,value]of Object.entries(generated)){if(result[name]!==undefined&&result[name]!==value&&!allowed[name].includes(result[name]))fail('custom '+name+' command');result[name]=value;const hook='pre'+name;if(result[hook]!==undefined&&result[hook]!=='universalcms-connect sync-source')fail('custom lifecycle hook');result[hook]='universalcms-connect sync-source';}
+  if(typeof manifest.scripts?.dev!=='string'||typeof manifest.scripts?.build!=='string')fail('ordinary dev/build commands required');
+  return {...manifest,scripts:result};
+}
+export async function inspectVueProject(directory,suppliedManifest,framework='vue'){
+  if(!['vue','nuxt'].includes(framework))fail('unsupported framework');
+  const root=await projectRoot(directory),packageText=await ordinary(root,'package.json');let manifest;try{manifest=suppliedManifest??JSON.parse(packageText);}catch{fail('invalid package manifest');}
+  const deps={...manifest.devDependencies,...manifest.dependencies};
+  if(manifest.type!=='module'||manifest.workspaces||!version(deps.vue,3)||Number(deps.vue.replace(/^[~^]/,'').split('.')[1])<5||framework==='vue'&&(![7,8].some(n=>version(deps.vite,n))||!version(deps['@vitejs/plugin-vue'],6))||framework==='nuxt'&&!version(deps.nuxt,4))fail('supported versions are Vue 3 + Vite 7/8 + official Vue plugin 6, or Nuxt 4, in one ESM Node project');
+  const node=process.versions.node.split('.').map(Number);
+  if(framework==='nuxt'&&!(node[0]===22&&node[1]>=18||node[0]===24&&node[1]>=11||node[0]===25||node[0]===26))fail('Nuxt 4 dependencies require Node 22.18+, 24.11+, 25 or 26');
+  await inspectAstroPublicAssets(root);
+  let configFile=null,configText=null;for(const ext of ['ts','js','mjs','mts','cjs','cts']){const name=(framework==='vue'?'vite':'nuxt')+'.config.'+ext,text=await ordinary(root,name);if(text!==null){if(configFile||['cjs','cts'].includes(ext))fail('multiple/CommonJS configurations');configFile=name;configText=text;}}
+  literalConfig(configText,configFile??'config.ts',framework);
+  const originals=[];
+  if(framework==='vue'){
+    let entryFile,entry;for(const name of ['src/main.js','src/main.ts']){const text=await ordinary(root,name);if(text!==null){if(entryFile)fail('multiple Vue entrypoints');entryFile=name;entry=text;}}
+    if(!entryFile)fail('ordinary src/main.js or src/main.ts required');
+    const stripped=entry.replace(/import\s+['"]([^'"]+\.css)['"];?/g,(_,file)=>{if(!/^\.\/[a-zA-Z0-9_./-]+\.css$/.test(file)||file.includes('..'))fail('CSS imports need review');originals.push({path:'src/'+file.slice(2),css:true});return '';}).replace(/\s|;/g,'');
+    if(!/^import\{createApp\}from['"]vue['"]importAppfrom['"]\.\/App\.vue['"]createApp\(App\)\.mount\(['"]#app['"]\)$/.test(stripped))fail('custom Vue router, stores or bootstrap');
+    const html=await ordinary(root,'index.html');if(!html||!/<head\b[^>]*>[\s\S]*?<\/head>/.test(html)||!new RegExp('<body>\\s*<div id=["\']app["\']><\\/div>\\s*<script type=["\']module["\'] src=["\']/'+entryFile.replace('.','\\.')+'["\']><\\/script>\\s*<\\/body>').test(html)||/<(?:base|iframe)|http-equiv|<script\b/.test(html.replace(/<body>[\s\S]*<\/body>/,'')))fail('custom HTML shell or scripts');
+    originals.push({path:entryFile,content:entry},{path:'index.html',content:html});
+    for(const item of originals)if(item.css){item.content=await ordinary(root,item.path);if(item.content===null||/@import|url\s*\(/i.test(item.content))fail('CSS import/asset ownership');}
+  }else{
+    for(const name of ['server','app/plugins','app/middleware','app/layouts','layers','pages','plugins','middleware','.nuxtrc','app/error.vue','app/app.config.ts','app/app.config.js','app.config.ts','app.config.js'])await absent(root,name);
+    const app=await ordinary(root,'app/app.vue');if(app!==null&&!/^\s*<template>\s*<NuxtPage\s*\/>\s*<\/template>\s*$/.test(app))fail('custom Nuxt root needs explicit layout review');
+    originals.push({path:'app/app.vue',content:app});
+  }
+  return {root,framework,manifest,packageText,configFile,configText,originals,runtimeDependencies:framework==='vue'?[{name:'vue',majors:[3],minimumMinor:5,production:true,assets:['dist/vue.runtime.esm-bundler.js','server-renderer/index.mjs']},{name:'vite',majors:[7,8],assets:['dist/node/index.js']},{name:'@vitejs/plugin-vue',majors:[6],assets:['dist/index.mjs']}]:[{name:'vue',production:true,majors:[3],minimumMinor:5,assets:['dist/vue.runtime.esm-bundler.js']},{name:'nuxt',majors:[4],assets:['dist/index.mjs','bin/nuxt.mjs']}],nextPackage:scripts(manifest,framework)};
+}
+function generated(project,publication){
+  const common=`import sourceConfiguration from './source.config.json' with {type:'json'};\nimport snapshot from './source.generated.json' with {type:'json'};\n${publication?"import configuration from './publication.config.json' with {type:'json'};\nimport contentBindings from './content.bindings.json' with {type:'json'};\n":''}`;
+  if(project.framework==='vue'){
+    const css=project.originals.filter(item=>item.css).map(item=>`import '../${item.path}';`).join('\n');
+    const html=project.originals.find(item=>item.path==='index.html').content.replace(/<body>[\s\S]*<\/body>/,'<body><!--universalcms-app--><!--universalcms-state--><script type="module" src="/.universalcms/vue.client.mjs"></script></body>');
+    return [
+      ['.universalcms/vue.config.mjs',`import {defineConfig} from 'vite';\nimport vue from '@vitejs/plugin-vue';\nimport {fileURLToPath} from 'node:url';\nexport default defineConfig({root:fileURLToPath(new URL('../',import.meta.url)),plugins:[vue()],appType:'custom',server:{fs:{allow:[fileURLToPath(new URL('../',import.meta.url))],deny:['.env','.env.*','*.{crt,pem}','**/.git/**','**/.universalcms/content/**','**/.universalcms/*.json','**/.universalcms/*.txt','**/.universalcms/*.serve.mjs','**/.universalcms/*.build.mjs','**/.universalcms/*.entry-server.mjs','**/.universalcms/*.config.mjs']}},build:{manifest:true,rollupOptions:{input:fileURLToPath(new URL('./vue.index.html',import.meta.url))}}});\n`],
+      ['.universalcms/vue.index.html',html],
+      ['.universalcms/vue.app.mjs',`import {createSSRApp} from 'vue';\nimport App from '../src/App.vue';\n${css}\nexport function createApplication(payload){const app=createSSRApp(App);app.provide('universalcms',payload);return app;}\n`],
+      ['.universalcms/vue.entry-server.mjs',`import {renderToString} from 'vue/server-renderer';\nimport {createApplication} from './vue.app.mjs';\nexport async function render(payload){return renderToString(createApplication(payload));}\n`],
+      ['.universalcms/vue.client.mjs',`import {defineNativeWebsite} from '@universalcms/connect/native-website';\nimport {createApplication} from './vue.app.mjs';\nconst script=document.getElementById('universalcms-vue-state');\nconst payload=JSON.parse(script.textContent);script.remove();defineNativeWebsite();\nif(!payload||payload.inventory)createApplication(payload).mount(payload?'#universalcms-native':'#app');\n`],
+      ['.universalcms/vue.build.mjs',`import {build} from 'vite';\nimport {fileURLToPath} from 'node:url';\nconst root=fileURLToPath(new URL('../',import.meta.url));process.chdir(root);\nconst configFile=fileURLToPath(new URL('./vue.config.mjs',import.meta.url));\nawait build({root,configFile,build:{outDir:'.universalcms/dist/client',emptyOutDir:true}});\nawait build({root,configFile,build:{ssr:'.universalcms/vue.entry-server.mjs',outDir:'.universalcms/dist/server',emptyOutDir:true,rollupOptions:{output:{entryFileNames:'vue.entry-server.mjs'}}}});\n`],
+      ['.universalcms/vue.serve.mjs',`import {fileURLToPath} from 'node:url';\nimport {startVueWebsite} from '@universalcms/connect/vue-server';\nconst root=fileURLToPath(new URL('../',import.meta.url));process.chdir(root);\nconst production=process.argv.includes('--production');\nawait startVueWebsite({root,production,vite:production?undefined:await import('vite')});\n`],
+    ];
+  }
+  return [
+    ['.universalcms/nuxt.config.ts',`import {fileURLToPath} from 'node:url';\n${project.configFile?`import existing from '../${project.configFile}';`:'const existing={};'}\nimport sourceConfiguration from './source.config.json';\nconst local=(name:string)=>fileURLToPath(new URL(name,import.meta.url));\nexport default defineNuxtConfig({...existing,rootDir:local('../'),srcDir:local('../app'),serverDir:local('./nuxt.server'),ssr:true,devServer:{host:'0.0.0.0',port:Number(new URL(sourceConfiguration.websiteOrigin).port||80)},plugins:[local('./nuxt.plugin.ts')],vue:{compilerOptions:{isCustomElement:tag=>tag==='universalcms-website'}},nitro:{preset:'node-server',prerender:{routes:[],crawlLinks:false}},hooks:{'vite:extendConfig'(config){config.server??={};config.server.fs={...config.server.fs,allow:[local('../')],deny:['.env','.env.*','*.{crt,pem}','**/.git/**','**/.universalcms/content/**','**/.universalcms/*.json','**/.universalcms/*.txt','**/.universalcms/nuxt.server/**','**/.universalcms/*.serve.mjs','**/.universalcms/*.config.ts','**/.nuxt/dev/**','**/.nuxt/dist/server/**','**/.output/**']};},'app:resolve'(app){app.mainComponent=local('./nuxt.app.vue');},'pages:extend'(pages){pages.push({name:'universalcms-new-page',path:'/:cmsPath(.*)*',file:local('./nuxt.page.vue')});}}});\n`],
+    ['.universalcms/nuxt.app.vue',`<script>\nimport {defineComponent,h,inject} from 'vue';\nimport {NuxtPage} from '#components';\nexport default defineComponent({setup(){const cms=inject('universalcms');return ()=>cms?h('universalcms-website',{'data-universalcms-native':'','.cms':cms},cms.inventory?[h(NuxtPage)]:[]):h(NuxtPage);}});\n</script>\n`],
+    ['.universalcms/nuxt.page.vue',`<script setup>\nimport {inject} from 'vue';\nimport {createError} from '#app';\nif(!inject('universalcms'))throw createError({statusCode:404,statusMessage:'Page not found'});\n</script>\n<template><div></div></template>\n`],
+    ['.universalcms/nuxt.plugin.ts',`import {defineNuxtPlugin,useState,useRequestEvent} from '#app';\nimport {defineNativeWebsite} from '@universalcms/connect/native-website';\nexport default defineNuxtPlugin(nuxt=>{const state=useState('universalcms',()=>import.meta.server?useRequestEvent()?.context.universalcms?.payload??null:null);nuxt.vueApp.provide('universalcms',state.value);if(import.meta.client)defineNativeWebsite();});\n`],
+    ['.universalcms/nuxt.server/middleware/universalcms.ts',`import {defineEventHandler,getRequestURL,getRequestHeaders,sendWebResponse,setResponseHeader} from 'h3';\nimport {createVueRuntime} from '@universalcms/connect/vue-runtime';\n${common.replaceAll("'./","'../../")}const runtime=createVueRuntime({${publication?"configuration:configuration as Parameters<typeof createVueRuntime>[0]['configuration'],contentBindings,":''}sourceConfiguration,snapshot,sourceRoot:process.cwd()});\nexport default defineEventHandler(async event=>{const raw=event.node.req.url?.split('?')[0]??'';if(raw.split('/').some(part=>part==='.'||part==='..')||/%(?:2e|2f|5c|25)/i.test(raw))return sendWebResponse(event,new Response(null,{status:400,headers:{'Cache-Control':'no-store'}}));const request=new Request(getRequestURL(event,{xForwardedHost:false,xForwardedProto:false}),{method:event.method,headers:getRequestHeaders(event) as HeadersInit});const result=await runtime.prepare(request);if(!result.pass)return sendWebResponse(event,result.response);event.context.universalcms=result;if(result.payload)for(const [name,value]of Object.entries(result.headers))if(!['content-length','content-type'].includes(name))setResponseHeader(event,name,value as string);});\n`],
+    ['.universalcms/nuxt.server/plugins/universalcms.ts',`import {finishNuxtHtml} from '@universalcms/connect/vue-runtime';\nexport default defineNitroPlugin(nitro=>{nitro.hooks.hook('render:response',(response,{event})=>{if(event.context.universalcms?.payload){response.body=finishNuxtHtml(response.body,event.context.universalcms);if(response.headers)delete response.headers['content-length'];}});});\n`],
+    ['.universalcms/nuxt.serve.mjs',`import {fileURLToPath} from 'node:url';\nimport source from './source.config.json' with {type:'json'};\nprocess.chdir(fileURLToPath(new URL('../',import.meta.url)));process.env.NITRO_PORT=String(Number(new URL(source.websiteOrigin).port||80));process.env.NITRO_HOST='0.0.0.0';\nawait import('../.output/server/index.mjs');\n`],
+  ];
+}
+export async function planVueIntegration(root,{framework='vue',publication=false,sourceConfiguration}={}){
+  const project=await inspectVueProject(root,undefined,framework),manifestFile=`.universalcms/${framework}.integration.json`,previousText=await ordinary(root,manifestFile);
+  let previous;if(previousText!==null){try{previous=JSON.parse(previousText);}catch{fail('invalid ownership manifest');}
+    if(previous.version!==1||previous.framework!==framework||previous.configFile!==project.configFile||previous.configHash!==(project.configText===null?null:contentDigest(project.configText))||!Array.isArray(previous.files)||JSON.stringify(previous.originals)!==JSON.stringify(project.originals.map(item=>({path:item.path,sha256:item.content===null?null:contentDigest(item.content)}))))fail('original configuration/bootstrap ownership changed');
+    const expected=generated(project,previous.publication).map(([path,content])=>({path,sha256:contentDigest(content)}));if(JSON.stringify(expected)!==JSON.stringify(previous.files))fail('generated ownership manifest changed');
+    for(const file of previous.files)if(contentDigest(await ordinary(root,file.path)??'')!==file.sha256)fail('generated runtime changed');
+    publication ||= previous.publication;
+  }
+  const desired=generated(project,publication),files=[];
+  for(const [name,content]of desired){const current=await ordinary(root,name);if(current!==null&&!previous)fail('existing generated path '+name);files.push({path:name,content,state:current===content?'unchanged':current===null?'create':'update',...(current!==null&&current!==content?{previous:current}:{})});}
+  const manifest=json({version:1,framework,publication,configFile:project.configFile,configHash:project.configText===null?null:contentDigest(project.configText),originals:project.originals.map(item=>({path:item.path,sha256:item.content===null?null:contentDigest(item.content)})),files:desired.map(([path,content])=>({path,sha256:contentDigest(content)}))});
+  files.push({path:manifestFile,content:manifest,state:previousText===manifest?'unchanged':previousText===null?'create':'update',...(previousText!==null&&previousText!==manifest?{previous:previousText}:{})});
+  if(framework==='nuxt'){project.nextPackage.scripts.start=project.nextPackage.scripts.preview='node .universalcms/nuxt.serve.mjs';}
+  const pkg=JSON.stringify(project.nextPackage)===JSON.stringify(project.manifest)?project.packageText:json(project.nextPackage);
+  files.push({path:'package.json',content:pkg,state:pkg===project.packageText?'unchanged':'update',...(pkg!==project.packageText?{previous:project.packageText}:{})});
+  for(const item of project.originals)if(item.content!==null)files.push({path:item.path,content:item.content,state:'unchanged'});
+  if(project.configFile)files.push({path:project.configFile,content:project.configText,state:'unchanged'});
+  return {root:project.root,framework,files};
+}
+export async function validateInstalledVue(root,config,framework='vue'){
+  const plan=await planVueIntegration(root,{framework,publication:true});if(plan.files.some(file=>file.state!=='unchanged'))fail('complete native runtime setup first');
+  const source=await inspectVueSource(root,{framework,locale:config.routes[0]?.locale??'en',websiteOrigin:config.websiteOrigin});
+  if(JSON.stringify(source.routes)!==JSON.stringify(config.routes)||await ordinary(root,'.universalcms/source.generated.json')!==json(source.snapshot))fail('source routes/snapshot changed');
+  const registry=await readContentRegistry(root);if(!registry||registry.routes.length!==config.routes.length)fail('native content bindings incomplete');
+  for(const row of registry.routes){const frozen=await readFrozenContent(root,row);for(const [key,content]of Object.entries(frozen.texts))plan.files.push({path:row[key+'File'],content,state:'unchanged'});}
+  plan.files.push({path:CONTENT_BINDINGS_FILE,content:await ordinary(root,CONTENT_BINDINGS_FILE),state:'unchanged'});return {...plan,config};
+}
+export async function planVueSettings(root,{config,source,framework='vue'}){
+  const plan=await validateInstalledVue(root,config,framework),name='.universalcms/website.integration.json';
+  const content=json({version:1,framework,siteId:config.siteId,environmentId:config.environmentId,apiOrigin:config.apiOrigin,websiteOrigin:config.websiteOrigin,adminOrigin:source.adminOrigin,sections:WEBSITE_SECTIONS,files:plan.files.filter(file=>file.path!=='package.json').map(file=>({path:file.path,sha256:contentDigest(file.content)}))});
+  const previous=await ordinary(root,name);if(previous!==null&&previous!==content)fail('settings scope or ownership changed');plan.files.push({path:name,content,state:previous===null?'create':'unchanged'});return {...plan,sections:[...WEBSITE_SECTIONS]};
+}

package/dist/vue-source.mjs

@@ -0,0 +1,168 @@
+/** Bounded Vue/Nuxt native SFC extraction. Project JavaScript is never evaluated. */
+import path from 'node:path';
+import { lstat, readdir, realpath } from 'node:fs/promises';
+import { parse } from './vendor/astro-compiler/node/index.js';
+import { extractAstroPage, ASTRO_SOURCE_LIMITS } from './astro-source.mjs';
+import { projectRoot, readProjectFile, SetupError } from './core.mjs';
+import { CONTENT_BINDINGS_FILE, contentDigest, readContentRegistry, readFrozenContent, validateContentRegistry } from './content-registry.mjs';
+import { isExcludedPublicationPath, validatePublicationConfig } from './publication.mjs';
+import { readNativeChromeReview, reviewedNativeChrome, nativeChromeObservation } from './native-chrome-review.mjs';
+const fail = reason => { throw new SetupError(`Vue/Nuxt source needs reviewed integration: ${reason} Existing files were preserved.`); };
+const json = value => JSON.stringify(value,null,2)+'\n';
+const token = value => contentDigest(value).slice(0,20);
+const inspections = new WeakMap();
+async function ordinary(root,name) { const text=await readProjectFile(root,name); if(text!==null&&(await lstat(path.join(root,name))).nlink!==1)fail('linked public source'); return text; }
+function openingEnd(source,start) { let quote; for(let i=start;i<source.length;i++){const c=source[i];if(quote){if(c===quote)quote=null;}else if(c==='"'||c==="'")quote=c;else if(c==='>')return i+1;}fail('incomplete tag'); }
+
+export async function extractVuePage({source,slug,locale='en',websiteOrigin,allowNativeChrome=false}={}) {
+  if(typeof source!=='string'||Buffer.byteLength(source)>ASTRO_SOURCE_LIMITS.bytes)fail('page byte budget');
+  const sfc=/^\s*(?:<script\s+setup(?:\s+lang="(?:ts|js)")?\s*>\s*<\/script>\s*)?<template\s*>([\s\S]*?)<\/template>\s*((?:<style(?:\s+scoped)?\s*>[\s\S]*?<\/style>\s*)*)$/.exec(source);
+  if(!sfc)fail('use a literal template with optional empty script setup and ordinary CSS styles');
+  const template=sfc[1];
+  if(/\{\{|\}\}|\s(?:v-|[:@#])|<\/?template\b/i.test(template))fail('computed Vue templates, directives and slots require explicit ownership');
+  const extracted=await extractAstroPage({source:template,slug,locale,websiteOrigin,allowNativeChrome});
+  const parsed=await parse(template,{position:true});
+  if(parsed.diagnostics.some(d=>d.severity===1))fail('invalid native template');
+  const offsets=new Map([[0,0]]);let byte=0,character=0;
+  for(const c of template){byte+=Buffer.byteLength(c);character+=c.length;offsets.set(byte,character);}
+  let index=0;const edits=[];
+  const visit=node=>{
+    if(extracted.inventory.nativeChrome && node.type==='element' && ['header','footer'].includes(node.name))return;
+    if(node.type==='element'&&(/^(?:h[1-6]|p|ul|ol|img)$/.test(node.name))){
+      const block=extracted.entry.document.blocks[index++];
+      const type=node.name==='p'?'paragraph':/^h/.test(node.name)?'heading':node.name==='img'?'image':'list';
+      if(!block||block.type!==type)fail('native binding order is ambiguous');
+      let start=offsets.get(node.position?.start?.offset),end=offsets.get(node.position?.end?.offset);
+      if(start!==undefined&&template[start]!=='<'&&template[start-1]==='<')start--;
+      if(start===undefined||!template.startsWith('<'+node.name,start))fail('native source offset mismatch');
+      const openEnd=openingEnd(template,start),opening=template.slice(start,openEnd);
+      if(type==='image')end=openEnd;
+      if(end===undefined||type!=='image'&&!template.slice(start,end).endsWith('</'+node.name+'>'))fail('native closing tag mismatch');
+      const expression=`__cms.bindings['${block.id}']`;
+      let output;
+      if(type==='image'){
+        output=opening;
+        for(const name of ['src','alt']){
+          const attr=node.attributes.find(a=>a.name===name),position=offsets.get(attr?.position?.start?.offset);
+          if(position===undefined||attr.kind!=='quoted')fail('image attributes require exact quoted positions');
+          const match=new RegExp('^'+name+'\\s*=\\s*').exec(template.slice(position));
+          if(!match||template.slice(position+match[0].length,position+match[0].length+attr.raw.length)!==attr.raw)fail('image attribute position mismatch');
+        }
+        const attrs=node.attributes.filter(a=>['src','alt'].includes(a.name)).map(a=>({start:offsets.get(a.position.start.offset)-start,end:offsets.get(a.position.start.offset)-start+new RegExp('^'+a.name+'\\s*=\\s*').exec(template.slice(offsets.get(a.position.start.offset)))[0].length+a.raw.length,text:`:${a.name}="${expression}.${a.name==='src'?'url':'alt'}"`}));
+        for(const edit of attrs.sort((a,b)=>b.start-a.start))output=output.slice(0,edit.start)+edit.text+output.slice(edit.end);
+      } else if(type==='list'){
+        const item=node.children.find(child=>child.type==='element');
+        const itemStart=offsets.get(item.position.start.offset),itemOpen=template.slice(itemStart,openingEnd(template,itemStart));
+        output=opening+itemOpen.replace('<li',`<li v-for="(__item, __index) in ${expression}.text.split('\\n')" :key="__index"`)+`{{ __item }}</li></${node.name}>`;
+      } else {
+        if(node.children.some(child=>child.type!=='text'&&child.type!=='comment'))fail('formatted text requires explicit native bindings');
+        output=opening+`{{ ${expression}.text }}</${node.name}>`;
+      }
+      output=output.replace('<'+node.name,'<'+node.name+` v-if="${expression}"`);
+      edits.push({start,end,text:output});return;
+    }
+    for(const child of node.children??[])visit(child);
+  };
+  visit(parsed.ast);
+  if(index!==extracted.entry.document.blocks.length)fail('incomplete native bindings');
+  let output=template;for(const edit of edits.sort((a,b)=>b.start-a.start))output=output.slice(0,edit.start)+edit.text+output.slice(edit.end);
+  return {...extracted,source:`<script setup>\nimport { inject } from 'vue';\nconst __cms = inject('universalcms');\n</script>\n<template>${output}</template>\n${sfc[2]}`,imports:[]};
+}
+
+async function routeFiles(root,framework) {
+  if(framework==='vue'){
+    if(await ordinary(root,'src/App.vue')===null)fail('ordinary Vue setup needs src/App.vue');
+    for(const dir of ['src/router','src/pages','src/views']){try{await lstat(path.join(root,dir));fail('existing Vue route ownership needs explicit review');}catch(error){if(error.code!=='ENOENT')throw error;}}
+    return [{path:'/',sourceFile:'src/App.vue',kind:'page',slug:'home'}];
+  }
+  if(framework!=='nuxt')fail('select vue or nuxt');
+  const routes=[],seen=new Set();let dirs=0,files=0;
+  const walk=async(directory,segments=[])=>{
+    if(++dirs>256||segments.length>12)fail('route inventory budget');
+    const target=path.join(root,directory),info=await lstat(target);
+    if(!info.isDirectory()||info.isSymbolicLink()||await realpath(target)!==target)fail('linked route directory');
+    for(const item of (await readdir(target,{withFileTypes:true})).sort((a,b)=>a.name.localeCompare(b.name))){
+      if(++files>1000)fail('route inventory budget');
+      if(!/^[a-z0-9]+(?:-[a-z0-9]+)*(?:\.vue)?$/.test(item.name)||item.isSymbolicLink())fail('nonliteral Nuxt routes need review');
+      const file=directory+'/'+item.name;
+      if(item.isDirectory()){await walk(file,[...segments,item.name]);continue;}
+      if(!item.isFile()||!item.name.endsWith('.vue'))fail('non-page Nuxt routes need review');
+      const base=item.name.slice(0,-4),pathname='/'+[...segments,...(base==='index'?[]:[base])].join('/');
+      if(pathname.split('/').some(part=>/^(?:private|patient|patients|vault|records|account|auth|admin|dashboard|billing|checkout|orders)(?:-|$)/.test(part))||isExcludedPublicationPath(pathname)||['404','500'].includes(base)||seen.has(pathname))fail('private, error or duplicate routes need review');
+      seen.add(pathname);routes.push({path:pathname,sourceFile:file,kind:'page',slug:pathname==='/'?'home':pathname.slice(1)});
+    }
+  };
+  await walk('app/pages');
+  if(!routes.length||seen.has('/')&&seen.has('/home'))fail('missing or ambiguous page identity');
+  return routes;
+}
+/** Read public pages and immutable originals; never execute Vue/Nuxt/project code. */
+export async function inspectVueSource(directory,{framework='vue',locale='en',websiteOrigin}={}) {
+  const root=await projectRoot(directory), routes=await routeFiles(root,framework), registry=await readContentRegistry(root);
+  if (registry?.profile || registry?.routes.some(row=>!row.sourceFile.endsWith('.vue'))) fail('existing content ownership belongs to another adapter');
+  const chromeReview=await readNativeChromeReview(root,framework);
+  const entries=[], inventories={}, prepared=[], observed=new Map(); let totalBytes=0;
+  for (const route of routes) {
+    const current=await ordinary(root,route.sourceFile); if(current===null)fail('page disappeared during inspection');
+    const installed=registry?.routes.find(row=>row.path===route.path);
+    let original=current;
+    if (installed) {
+      if (installed.sourceFile!==route.sourceFile || installed.slug!==route.slug || installed.locale!==locale || installed.kind!=='page') fail('saved Vue/Nuxt route identity changed');
+      original=(await readFrozenContent(root,installed)).texts.original;
+    }
+    const allowNativeChrome=reviewedNativeChrome(chromeReview,route.sourceFile,original);
+    let extracted;
+    try {
+      extracted=await extractVuePage({source:original,slug:route.slug,locale,filename:route.sourceFile,root,websiteOrigin,allowNativeChrome});
+    } catch(error) {
+      if(error instanceof SetupError)fail('automatic content binding requires a supported literal Vue/Nuxt template. Review dynamic components, controls and content ownership before setup.');
+      throw error;
+    }
+    if (installed && extracted.source!==current) fail('generated Vue/Nuxt page changed');
+    totalBytes+=Buffer.byteLength(original);
+    observed.set(route.sourceFile,{path:route.sourceFile,content:current,state:'unchanged',sha256:contentDigest(current)});
+    for (const item of extracted.imports) { observed.set(item.path,item); totalBytes+=Buffer.byteLength(item.content); }
+    if(totalBytes>ASTRO_SOURCE_LIMITS.totalBytes)fail('source inventory exceeds its byte budget');
+    entries.push(extracted.entry); inventories[route.path]=extracted.inventory;
+    prepared.push({...route,locale,original,current,installed,extracted});
+  }
+  if(registry && registry.routes.length!==routes.length)fail('previously bound routes were removed');
+  if(chromeReview)observed.set(chromeReview.path,chromeReview);
+  const diagnostics={discoveredPages:routes.length,automaticPages:entries.length,skippedPages:0,unsupportedRoutes:0,warnings:[]};
+  const result={entries,snapshot:{version:1,entries,inventories},routes:prepared.map(({path,kind,slug,locale})=>({path,kind,slug,locale})),sourceFiles:[...observed.values()].map(({path,sha256})=>({path,sha256})),diagnostics};
+  inspections.set(result,{root,prepared,observed,registry,digest:contentDigest(json(result)),routeFiles:routes,websiteOrigin,framework});
+  return result;
+}
+
+/** Core-compatible plan; originals and inventories precede all page replacement. */
+export async function planVueContent(directory,configuration,inspection,framework='vue') {
+  const root=await projectRoot(directory),config=validatePublicationConfig(configuration);
+  inspection ??= await inspectVueSource(root,{locale:config.routes[0]?.locale,websiteOrigin:config.websiteOrigin,framework});
+  const state=inspections.get(inspection);
+  if(!state || state.root!==root)fail('use the current inspection for this website');
+  if(state.websiteOrigin !== undefined && state.websiteOrigin !== config.websiteOrigin)fail('source and publication website origins must match');
+  if(contentDigest(json(inspection))!==state.digest)fail('the public source inspection changed before planning');
+  if(json(await routeFiles(root,state.framework))!==json(state.routeFiles))fail('route inventory changed after inspection');
+  if(config.routes.length!==inspection.routes.length || config.routes.some(row=>!inspection.routes.some(other=>['path','kind','slug','locale'].every(key=>row[key]===other[key]))))fail('publication identities must match exact Vue/Nuxt source routes');
+  const files=[],rows=[];
+  for(const observed of state.observed.values()) if(await ordinary(root,observed.path)!==observed.content)fail('source changed after inspection');
+  for(const item of state.prepared) {
+    if(item.installed) {
+      const frozen=await readFrozenContent(root,item.installed);
+      if(json(frozen.inventory)!==json(item.extracted.inventory))fail('frozen Vue/Nuxt inventory or layout imports changed');
+      for(const name of ['original','native','inventory','source'])files.push({path:item.installed[`${name}File`],content:frozen.texts[name],state:'unchanged'});
+      rows.push(item.installed);continue;
+    }
+    const suffix=token(`${item.path}:${item.kind}:${item.slug}:${item.locale}`),nativeFile=`.universalcms/content/${suffix}.native.txt`,originalFile=`.universalcms/content/${suffix}.original.txt`,inventoryFile=`.universalcms/content/${suffix}.json`;
+    for(const filename of [nativeFile,originalFile,inventoryFile])if(await ordinary(root,filename)!==null)fail('a prospective frozen content file already exists');
+    const inventoryText=json(item.extracted.inventory),source=item.extracted.source;
+    const row={path:item.path,kind:item.kind,slug:item.slug,locale:item.locale,sourceFile:item.sourceFile,nativeFile,originalFile,inventoryFile,sourceHash:contentDigest(source),nativeHash:contentDigest(source),originalHash:contentDigest(item.original),inventoryHash:contentDigest(inventoryText)};
+    files.push({path:originalFile,content:item.original,state:'create'},{path:nativeFile,content:source,state:'create'},{path:inventoryFile,content:inventoryText,state:'create'},{path:item.sourceFile,content:source,state:'update',previous:item.current});rows.push(row);
+  }
+  for(const observed of state.observed.values())if(!files.some(file=>file.path===observed.path))files.push({path:observed.path,content:observed.content,state:'unchanged'});
+  const registry=validateContentRegistry({version:1,routes:rows}),text=json(registry),before=await ordinary(root,CONTENT_BINDINGS_FILE);
+  if(before!==null && before!==text)fail('saved Vue/Nuxt content registry changed');
+  files.push({path:CONTENT_BINDINGS_FILE,content:text,state:before===null?'create':'unchanged'});
+  if(files.some(file=>Buffer.byteLength(file.content)>ASTRO_SOURCE_LIMITS.bytes))fail('generated binding exceeds its per-file budget');
+  return {root,framework:state.framework,files,routes:rows,entries:inspection.entries,snapshot:inspection.snapshot};
+}

package/dist/website-check.mjs

@@ -0,0 +1,41 @@
+import { readSourceSettings } from './source-setup.mjs';
+import { validateSourceConfiguration } from './source-config.mjs';
+import { WEBSITE_SECTIONS } from './website-http.mjs';
+import { publicationCachePolicy } from './publication-check.mjs';
+const names=['websiteOrigin','adminOrigin','siteId','environmentId'];
+const object=value=>value!==null&&typeof value==='object'&&!Array.isArray(value);
+const exact=(value,keys)=>object(value)&&Object.keys(value).length===keys.length&&Object.keys(value).every(key=>keys.includes(key));
+function untilAborted(pending,signal){
+  return new Promise((resolve,reject)=>{
+    const abort=()=>reject(Error('Settings diagnostic unavailable'));
+    signal.addEventListener('abort',abort,{once:true});if(signal.aborted)abort();
+    Promise.resolve(pending).then(value=>{signal.removeEventListener('abort',abort);resolve(value);},error=>{signal.removeEventListener('abort',abort);reject(error);});
+  });
+}
+function cancel(response){try{if(response?.body&&!response.body.locked)void response.body.cancel().catch(()=>{});}catch{/* Cleanup only. */}}
+export async function checkWebsiteSettings(directory,options={},fetcher=globalThis.fetch,{timeoutMs=10000,maxResponseBytes=128*1024}={}) {
+  const failure=message=>({checked:false,renderedVerified:false,message});
+  if(!object(options)||Object.keys(options).some(name=>!names.includes(name))||typeof fetcher!=='function'||!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>10000||!Number.isSafeInteger(maxResponseBytes)||maxResponseBytes<1||maxResponseBytes>128*1024)return failure('Use the exact public website, CMS origin, site and environment from Developer setup.');
+  let controller,timer,response;
+  try {
+    const saved=names.some(name=>options[name]===undefined)?await readSourceSettings(directory):{};
+    const config=validateSourceConfiguration({version:1,publicStaticPages:true,...Object.fromEntries(names.map(name=>[name,options[name]??saved[name]]))});
+    if(config.websiteOrigin===config.adminOrigin)return failure('Website and CMS origins must identify their separate servers.');
+    const url=new URL('/api/universalcms/settings',config.websiteOrigin);
+    url.search=new URLSearchParams({check:'connection',siteId:config.siteId,environmentId:config.environmentId}).toString();
+    controller=new AbortController();timer=setTimeout(()=>controller.abort(),timeoutMs);
+    const pending=Promise.resolve(fetcher(url,{method:'GET',headers:{Origin:config.adminOrigin,Accept:'application/json'},credentials:'omit',redirect:'error',cache:'no-store',referrerPolicy:'no-referrer',signal:controller.signal})).then(value=>{if(controller.signal.aborted)cancel(value);return value;});
+    response=await untilAborted(pending,controller.signal);
+    const directives=(response?.headers?.get('cache-control')??'').toLowerCase().split(',').map(value=>value.trim());
+    if(!(response instanceof Response)||response.redirected||['opaque','opaqueredirect'].includes(response.type)||response.url&&response.url!==url.href||response.status!==200||response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase()!=='application/json'||response.headers.get('access-control-allow-origin')!==config.adminOrigin||response.headers.has('access-control-allow-credentials')||!directives.includes('no-store')||!publicationCachePolicy(response.headers,config.websiteOrigin))return failure('Settings endpoint is not ready at this exact website and CMS origin. Run setup-settings, restart or deploy, then check again.');
+    const length=response.headers.get('content-length');if(length!==null&&(!/^\d+$/.test(length)||Number(length)>maxResponseBytes))return failure('Settings diagnostic exceeded its response limit.');
+    const reader=response.body?.getReader();if(!reader)return failure('Settings diagnostic response is empty.');
+    let bytes=0,text='',decoder=new TextDecoder('utf-8',{fatal:true});try{while(true){const {done,value}=await untilAborted(reader.read(),controller.signal);if(controller.signal.aborted)throw Error();if(done)break;if(!(value instanceof Uint8Array)||(bytes+=value.byteLength)>maxResponseBytes)throw Error();text+=decoder.decode(value,{stream:true});}text+=decoder.decode();}finally{void reader.cancel().catch(()=>{});reader.releaseLock();}
+    const body=JSON.parse(text);
+    if(!exact(body,['version','siteId','environmentId','renderedVerified','settings'])||body.version!==1||body.siteId!==config.siteId||body.environmentId!==config.environmentId||body.renderedVerified!==false||!exact(body.settings,WEBSITE_SECTIONS))return failure('The settings diagnostic does not match this connection.');
+    const sections={};
+    for(const name of WEBSITE_SECTIONS){const row=body.settings[name];if(!exact(row,['installed','state','version'])||typeof row.installed!=='boolean'||!['ready','missing','denied','unavailable'].includes(row.state)||!Number.isSafeInteger(row.version)||(row.state==='ready'?row.version<1:row.version!==0)||(!row.installed&&(row.state!=='missing'||row.version!==0)))return failure('A settings integration is missing or invalid.');sections[name]={installed:row.installed,state:row.state,version:row.version};}
+    return {checked:true,renderedVerified:false,sections,message:'Settings diagnostic checked. Each section reports whether its adapter is installed. Missing adapters require reviewed website integration; denied sections need the intended key access; installed sections marked missing have no saved configuration. Verify each intended feature in the actual website. No settings or content were changed.'};
+  }catch{return failure('Cannot read the settings diagnostic. Check the exact saved origins and restart or deploy the website.');}
+  finally{clearTimeout(timer);controller?.abort();cancel(response);}
+}

package/dist/website-http.mjs

@@ -0,0 +1,149 @@
+/** Optional all-section website integration. Credentials stay in this server module. */
+import { createWebsiteRuntime, websiteMetadata } from './website-runtime.mjs';
+import { isExcludedPublicationPath, normalizePublicationPath, publicationErrorHtml, publicationRevision, validatePublicationConfig } from './publication.mjs';
+import { nativePatternMatches } from './native-routes.mjs';
+import { publicationVerification, publicationRouteHeaders } from './publication-verification.mjs';
+import { REVIEWED_ICECREAM_PROFILE } from './content-registry-validation.mjs';
+export const WEBSITE_SETTINGS_PATH = '/api/universalcms/settings';
+export const WEBSITE_PAGE_PATH = '/api/universalcms/page';
+export const WEBSITE_SECTIONS = Object.freeze(['branding','social','seo','languages','analytics','navigation','experience','scripts','redirects','authors','templates','taxonomies']);
+const headers = { 'Cache-Control':'private, no-store, max-age=0', 'CDN-Cache-Control':'no-store', 'Surrogate-Control':'no-store', 'Vercel-CDN-Cache-Control':'no-store', 'X-Content-Type-Options':'nosniff', 'Referrer-Policy':'no-referrer' };
+const escape = value => String(value ?? '').replace(/[&<>"']/g, character => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[character]));
+function attribute(tag, name) {
+  const match = new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, 'i').exec(tag);
+  return (match?.[1] ?? match?.[2] ?? match?.[3] ?? '').toLowerCase();
+}
+// Raw-text elements are one token, so strings inside native scripts/styles are
+// never mistaken for metadata markup and rewritten.
+function headTags(html, transform) {
+  return html.replace(/<(script|style|title)\b(?:[^>"']|"[^"]*"|'[^']*')*>[\s\S]*?<\/\1\s*>|<(?:meta|link)\b(?:[^>"']|"[^"]*"|'[^']*')*>/gi, transform);
+}
+export function websiteHtml(html, metadata, {seo=true,branding}={}) {
+  return html.replace(/(<head\b[^>]*>)([\s\S]*?)(<\/head>)/i,(_match,opening,source,closing)=>{
+  let output=source;
+  if(metadata){
+  output=headTags(output,tag=>{
+    if(/^<title\b/i.test(tag))return '';
+    if(/^<script\b/i.test(tag)&&seo&&attribute(tag.slice(0,tag.indexOf('>')+1),'data-universalcms-setting')==='seo')return '';
+    if(!/^<(?:meta|link)\b/i.test(tag))return tag;
+    const name=attribute(tag,'name'),property=attribute(tag,'property'),rel=attribute(tag,'rel');
+    return name==='description'||seo&&(name==='robots'||name.startsWith('twitter:')||property.startsWith('og:')||rel==='canonical'||metadata.alternates&&rel==='alternate'&&attribute(tag,'hreflang'))?'':tag;
+  });
+  const marker=`data-universalcms-setting="${seo?'seo':'content'}"`;
+  const tags = [`<title ${marker}>${escape(metadata.title)}</title>`, `<meta ${marker} name="description" content="${escape(metadata.description)}">`];
+  if(seo){
+  if(metadata.canonical) tags.push(`<link ${marker} rel="canonical" href="${escape(metadata.canonical)}">`);
+  if(metadata.robots) tags.push(`<meta ${marker} name="robots" content="${metadata.robots.index ? 'index':'noindex'},${metadata.robots.follow ? 'follow':'nofollow'}">`);
+  for(const [name,value] of Object.entries(metadata.openGraph ?? {})) if(typeof value === 'string') tags.push(`<meta ${marker} property="og:${escape(name==='imageAlt'?'image:alt':name)}" content="${escape(value)}">`);
+  for(const [name,value] of Object.entries(metadata.twitter ?? {})) if(typeof value === 'string')tags.push(`<meta ${marker} name="twitter:${escape(name)}" content="${escape(value)}">`);
+  for(const alternate of metadata.alternates ?? [])tags.push(`<link ${marker} rel="alternate" hreflang="${escape(alternate.locale)}" href="${escape(alternate.url)}">`);
+  if(metadata.jsonLd) tags.push(`<script ${marker} type="application/ld+json">${JSON.stringify(metadata.jsonLd).replace(/</g,'\\u003c').replace(/\u2028/g,'\\u2028').replace(/\u2029/g,'\\u2029')}</script>`);
+  }
+  output+=tags.join('');
+  }
+  if(branding){
+    output=headTags(output,tag=>/^<link\b/i.test(tag)&&/^(?:shortcut\s+)?icon$/.test(attribute(tag,'rel'))?'':tag);
+    if(branding.faviconUrl)output+=`<link data-universalcms-setting="branding" rel="icon" href="${escape(branding.faviconUrl)}">`;
+  }
+  return opening+output+closing;
+  });
+}
+function experienceHtml(snapshot) {
+  const setting=snapshot.sections.experience;
+  if(setting.state!=='ready')return publicationErrorHtml(404);
+  const data=setting.data,languages=snapshot.sections.languages;
+  const locale=languages.state==='ready'?languages.data.fallback:'en';
+  const localized=data.translations?.find(value=>value.locale.toLowerCase()===locale.toLowerCase());
+  const copy={...data,...localized},action=copy.notFoundAction;
+  return `<!doctype html><html lang="${escape(locale)}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex,nofollow"><title>${escape(copy.notFoundTitle||'Page not found')}</title></head><body><main><h1>${escape(copy.notFoundTitle||'Page not found')}</h1><p>${escape(copy.notFoundMessage)}</p>${action?`<a href="${escape(action.url)}">${escape(action.label)}</a>`:''}</main></body></html>`;
+}
+export function createWebsiteRequestHandler({configuration, sourceConfiguration, contentBindings, env = () => process.env, fetcher = globalThis.fetch, renderHtml, installedSections, nativePathPrefixes} = {}) {
+  const config = validatePublicationConfig(configuration);
+  const verification = publicationVerification(config, sourceConfiguration, contentBindings);
+  const nativePaths = verification?.nativePaths ?? [];
+  const nativePatterns = verification?.nativePatterns ?? [];
+  const reviewedCommerce = verification?.body.contentBindings === true && contentBindings?.profile === REVIEWED_ICECREAM_PROFILE;
+  installedSections ??= WEBSITE_SECTIONS;
+  nativePathPrefixes ??= reviewedCommerce ? ['/menu/', '/cart/', '/checkout/', '/order-success/'] : [];
+  const runtime=createWebsiteRuntime({configuration:config,env,fetcher,nativePaths,nativePatterns,nativePathPrefixes,installedSections});
+  const installed = new Set(installedSections);
+  const website=new URL(config.websiteOrigin);
+  return async function handle(request) {
+    const method=request.method;
+    const reply = (body,status=200,type='application/json',extra={}) => new Response(method==='HEAD'||status===204 ? null : typeof body==='string' ? body : JSON.stringify(body), {status,headers:{...headers,'Content-Type':type,...extra}});
+    let url,path;
+    try{url=new URL(request.url);path=normalizePublicationPath(url.pathname);}catch{return reply({error:'Invalid website path'},400);}
+    const endpoint = [WEBSITE_SETTINGS_PATH,WEBSITE_PAGE_PATH,'/api/universalcms/document'].includes(url.pathname);
+    const seoFile=['/sitemap.xml','/robots.txt'].includes(url.pathname);
+    // The composed Next guard otherwise blocks unknown public routes. Preserve
+    // the whole reviewed native family, including products added after setup.
+    if (nativePatterns.some(pattern => nativePatternMatches(pattern,path)) || nativePathPrefixes.some(prefix => path.startsWith(prefix))) return {pass:true};
+    if (path.startsWith('/@') || !endpoint && !seoFile && isExcludedPublicationPath(path) || nativePaths.includes(path) || seoFile && !installed.has('seo')) return null;
+    const host=request.headers.get('host');
+    const internalLoopback=host===website.host&&['127.0.0.1','[::1]'].includes(website.hostname)&&url.hostname==='localhost'&&url.protocol===website.protocol&&url.port===website.port;
+    if (url.origin !== config.websiteOrigin&&!internalLoopback || host&&host!==website.host) return reply({error:'Website origin mismatch'},403);
+    if (!['GET','HEAD','OPTIONS'].includes(method)) return reply({error:'Method not allowed'},405,'application/json',{Allow:'GET, HEAD'});
+    const diagnostic = url.pathname===WEBSITE_SETTINGS_PATH && url.searchParams.get('check')==='connection';
+    const origin=request.headers.get('origin');
+    const publicationHeaders=(pathname,value)=>config.routes.some(route=>route.path===pathname)?publicationRouteHeaders(config,pathname,value,verification,origin,request.headers.has('authorization')||request.headers.has('cookie')):{};
+    let cors={};
+    if(diagnostic) {
+      if(!verification || origin!==verification.adminOrigin || request.headers.has('authorization') || request.headers.has('cookie')) return reply({error:'Request not allowed'},403);
+      cors={'Access-Control-Allow-Origin':origin,'Vary':'Origin','Access-Control-Allow-Methods':'GET, HEAD, OPTIONS'};
+      if(url.searchParams.size!==3 || ['check','siteId','environmentId'].some(name=>url.searchParams.getAll(name).length!==1) || url.searchParams.get('siteId')!==config.siteId || url.searchParams.get('environmentId')!==config.environmentId) return reply({error:'Connection scope mismatch'},400,'application/json',cors);
+      if(method==='OPTIONS'){
+        if(!['GET','HEAD'].includes(request.headers.get('access-control-request-method'))||request.headers.has('access-control-request-headers'))return reply({error:'Request not allowed'},403);
+        return reply(null,204,'application/json',cors);
+      }
+    } else if(endpoint && (origin && origin!==config.websiteOrigin || request.headers.get('sec-fetch-site')==='cross-site')) return reply({error:'Request not allowed'},403);
+    if(method==='OPTIONS') return reply({error:'Method not allowed'},405);
+    try {
+      if(seoFile){
+        if(url.searchParams.size)return reply('Invalid request',400,'text/plain');
+        const result=url.pathname==='/robots.txt'?await runtime.robots():await runtime.sitemap();
+        if(result.state!=='ready')return reply('Unavailable',result.state==='unavailable'?503:404,'text/plain');
+        if(url.pathname==='/robots.txt')return reply(result.body,200,'text/plain; charset=utf-8');
+        if(!result.enabled)return reply('Not found',404,'text/plain');
+        return reply(`<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">${result.entries.map(entry=>`<url><loc>${escape(entry.url)}</loc><lastmod>${escape(entry.lastModified)}</lastmod></url>`).join('')}</urlset>`,200,'application/xml; charset=utf-8');
+      }
+      if(url.pathname===WEBSITE_SETTINGS_PATH) {
+        if(!diagnostic && url.searchParams.size) return reply({error:'Invalid settings request'},400);
+        const snapshot=await runtime.settings();
+        if(!diagnostic) return reply(snapshot);
+        return reply({version:1,siteId:config.siteId,environmentId:config.environmentId,renderedVerified:false,
+          settings:Object.fromEntries(WEBSITE_SECTIONS.map(section=>[section,{installed:installed.has(section),state:installed.has(section)?snapshot.sections[section].state:'missing',version:installed.has(section)?snapshot.sections[section].version:0}]))},200,'application/json',cors);
+      }
+      let pathname;
+      if(endpoint) {
+        if(url.searchParams.size!==1||url.searchParams.getAll('path').length!==1) return reply({error:'Invalid page request'},400);
+        try {pathname=normalizePublicationPath(url.searchParams.get('path'));} catch {return reply({error:'Invalid path'},400);}
+      } else {try {pathname=normalizePublicationPath(url.pathname==='/index.html'?'/':url.pathname);} catch {return reply(publicationErrorHtml(404),404,'text/html');}}
+      const original=config.routes.some(route=>route.path===pathname);
+      const result=url.pathname===WEBSITE_PAGE_PATH||!endpoint&&renderHtml?await runtime.page(pathname):await runtime.resolve(pathname);
+      if(result.state==='unmanaged') {
+        return null;
+      }
+      if(result.state==='redirect') return reply('',result.status??302,'text/plain',{Location:result.location});
+      if(result.state==='gone') return reply('This page is no longer available.',410,'text/plain',{'X-Robots-Tag':'noindex'});
+      if(endpoint) {
+        if(result.state==='published') return reply({...result,revision:publicationRevision(result.entry)});
+        if(result.state==='archive' && url.pathname===WEBSITE_PAGE_PATH) return reply(result);
+        return reply({state:result.state==='unavailable'?'unavailable':'missing'},result.state==='unavailable'?503:404);
+      }
+      if(result.state!=='published'&&result.state!=='archive') {
+        if(result.state==='unavailable')return reply(publicationErrorHtml(503),503,'text/html; charset=utf-8',{'X-Robots-Tag':'noindex',...publicationHeaders(pathname,result)});
+        const snapshot=await runtime.settings(),status=snapshot.state==='unavailable'?503:404;
+        return reply(status===503?publicationErrorHtml(503):experienceHtml(snapshot),status,'text/html; charset=utf-8',{'X-Robots-Tag':'noindex',...publicationHeaders(pathname,{state:status===503?'unavailable':'missing'})});
+      }
+      if(!renderHtml) return {pass:true};
+      const settings=await runtime.settings();
+      if(settings.state==='unavailable')return reply(publicationErrorHtml(503),503,'text/html; charset=utf-8',{'X-Robots-Tag':'noindex',...publicationHeaders(pathname,{state:'unavailable'})});
+      const entry=result.entry ?? {document:{title:result.title,excerpt:result.description}};
+      const seo=settings.sections.seo.state==='ready';
+      const metadata=seo||!original?websiteMetadata(entry,settings,pathname,config.websiteOrigin):null;
+      const body=websiteHtml(await renderHtml(pathname),metadata,{seo,branding:settings.sections.branding.state==='ready'?settings.sections.branding.data:undefined});
+      const routeHeaders=publicationHeaders(pathname,result);
+      return reply(body,200,'text/html; charset=utf-8',routeHeaders);
+    } catch {return reply(endpoint?{state:'unavailable'}:publicationErrorHtml(503),503,endpoint?'application/json':'text/html; charset=utf-8',{...cors,...(!endpoint?publicationHeaders(path==='/'||path==='/index.html'?'/':path,{state:'unavailable'}):{})});}
+  };
+}

package/dist/website-model.d.mts

@@ -0,0 +1,20 @@
+export const WEBSITE_SECTIONS: readonly string[];
+export type WebsiteSettings = { version: 1; state: 'ready' | 'unavailable'; sections: Record<string, { state: 'ready' | 'missing' | 'denied' | 'unavailable'; version: number; data?: Record<string, any> }> };
+export type Consent = { version: string; analytics: boolean; marketing: boolean; savedAt: number; expiresAt: number };
+export type ScriptDescriptor = { src: string; placement: string; category: string; provider: string; id?: string; tracker?: string; attributes: Record<string, string> };
+export function record(value: unknown): Record<string, any>;
+export function text(value: unknown, limit?: number): string;
+export function emptyWebsiteSettings(): WebsiteSettings;
+export function parseWebsiteSettings(value: unknown): WebsiteSettings;
+export function sectionData(settings: unknown, name: string): Record<string, any> | null;
+export function publicHref(value: unknown, options?: { mail?: boolean; relative?: boolean }): string | null;
+export function navigationLinks(settings: unknown, location: string, originalLinks?: unknown[], excludeUrls?: string[]): Array<{ label: string; url?: string; children?: Array<{ label: string; url: string }> }>;
+export function languageLinks(settings: unknown, entry: unknown): Array<{ locale: string; path: string; title: string; current: boolean }>;
+export function experienceCopy(settings: unknown, language?: string): Record<string, any> | null;
+export function consentPolicy(settings: unknown): { version: string; maxAgeDays: number } | null;
+export function parseConsent(value: unknown, policy: ReturnType<typeof consentPolicy>, now?: number): Consent | null;
+export function createConsent(policy: ReturnType<typeof consentPolicy>, choices: { analytics?: boolean; marketing?: boolean }, now?: number): Consent | null;
+export function scriptDescriptors(settings: unknown, decision: unknown, privacySignal?: boolean, now?: number): ScriptDescriptor[];
+export function pagePresentation(settings: unknown, entry: unknown): Record<string, any>;
+export function websiteJsonLd(settings: unknown, entry: unknown, fields?: { title?: string; description?: string; canonical?: string | null; image?: string | null }): Record<string, any> | null;
+export function readWebsiteJson(response: Response, signal?: AbortSignal, limit?: number): Promise<any>;