@universalcms/connect 0.13.0 → 0.13.2

package/README.md

@@ -1,7 +1,7 @@
 # @universalcms/connect
 
 Local, deterministic website setup without AI. Universal CMS stays hosted; this
-package creates a website integration, not a CMS installation. Version 0.13.0 is
+package creates a website integration, not a CMS installation. Version 0.13.2 is
 prepared locally; this repository does not establish its public npm availability.
 
 ## Quick start
@@ -15,6 +15,11 @@ this package, connects pages, header/footer and settings, saves the website key
 privately in `.env.local`, then guides the restart, content import and final check.
 Run it again to continue where it stopped. Without a browser, create a one-time
 `--code` command in Developer setup. See [connector setup](../../docs/connector-setup.md#one-command-connection-recommended).
+When no page can be edited automatically, the command offers a settings-only
+connection (Next.js): the CMS manages menus, branding, SEO, analytics, scripts,
+consent and redirects while the site renders every page. Add
+`<CmsNavigation location="header" />` from `@universalcms/connect/react-website`
+where CMS menus should appear.
 The individual commands below remain for developers and reviewed integrations.
 
 Supported templates: **Next.js 16 App Router on Node**, **React 19.2+ with
@@ -257,7 +262,7 @@ custom adapter still requires review, not forced overwriting.
 For an operator's downloaded artifact, the installation is:
 
 ```sh
-npm install --save-prod ./vendor/universalcms-connect-0.13.0.tgz
+npm install --save-prod ./vendor/universalcms-connect-0.13.2.tgz
 ```
 
 Use your project's package manager. These paths are examples for downloaded
@@ -534,7 +539,7 @@ npx --no-install universalcms-connect init \
   --environment 22222222-2222-4222-8222-222222222222
 ```
 
-After a public release, `npx @universalcms/connect@0.13.0 init` is the equivalent
+After a public release, `npx @universalcms/connect@0.13.2 init` is the equivalent
 registry entry point. Copy the real IDs/API origin from **Developer setup**.
 Missing values are prompted in a terminal; `--non-interactive` fails instead.
 Init prints a plan. Run the same command with `--apply` after reviewing it.
@@ -584,7 +589,7 @@ The CMS button reads the website's **`/api/cms-source`** endpoint. Current Next.
 prepares delivery scaffolding. React/Vite setup serves its reviewed public manifest through the normal dev command.
 Custom exporters need their explicit adapter; a delivery check alone is insufficient.
 
-Use the CMS's reviewed 0.13.0 package for the staged commands and current source
+Use the CMS's reviewed 0.13.2 package for the staged commands and current source
 discovery. Review source diagnostics and complete public
 mappings for unsupported pages. Restart the website using its normal server command, then run:
 

package/dist/cli.mjs

@@ -18,9 +18,9 @@ import { setupWebsiteSettings } from './website-setup.mjs';
 import { checkWebsiteSettings } from './website-check.mjs';
 import { WEBSITE_SECTIONS } from './website-http.mjs';
 import { setupSource, applySourcePlan, syncSource, readSourceSettings } from './source-setup.mjs';
-import { processIo, runGuided } from './guided.mjs';
+import { processIo, runCreate, runGuided } from './guided.mjs';
 
-const help = `Universal CMS connector 0.13.0
+const help = `Universal CMS connector 0.13.2
 
 Quick start (recommended) — run in your website folder:
   npx @universalcms/connect@latest --cms https://YOUR_CMS_ADDRESS
@@ -34,6 +34,9 @@ Quick start (recommended) — run in your website folder:
   --code <code>            One-time code from Developer setup → Connect without a browser
   --details                Show every file and technical message
 
+New website managed entirely from the CMS (pages, posts, menus, design):
+  npx @universalcms/connect@latest create my-website --cms https://YOUR_CMS_ADDRESS
+
 Individual steps (advanced):
 Usage: universalcms-connect <start|inspect-pages|review-pages|preflight|review-routes|review-layout|connect|setup|setup-settings|check-settings|server-key|setup-source|sync-source|finalize-source|analyze|init|check|check-source|check-publication> [options]
 
@@ -347,6 +350,14 @@ function guidedArguments(args) {
 async function main() {
   if (process.argv.slice(2).some(value => value === '--help' || value === '-h')) { process.stdout.write(help); return; }
   const first = process.argv[2];
+  if (first === 'create') {
+    const rest = process.argv.slice(3), name = rest[0] && !rest[0].startsWith('--') ? rest.shift() : undefined;
+    const options = guidedArguments(rest);
+    if (!process.stdin.isTTY || !process.stderr.isTTY) throw new SetupError('This setup needs an interactive terminal.');
+    const io = processIo({ ask, write: value => process.stdout.write(value) });
+    await runCreate(process.cwd(), name ?? (await ask('Folder name for the new website: ')).trim(), { cms: options['--cms'], code: options['--code'] }, io);
+    return;
+  }
   if (first === undefined || first === 'start' || first.startsWith('--')) {
     // The one-time pairing code is the only accepted credential-like argument:
     // it expires in ten minutes, works once and never reaches project files.

package/dist/content-next-setup.mjs

@@ -12,7 +12,7 @@ import { CONTENT_BINDINGS_FILE, contentDigest, readContentRegistry, readFrozenCo
 import { inspectReviewedNativeOwnership } from './reviewed-native-ownership.mjs';
 import { matchesNativeRoutes } from './native-routes.mjs';
 import { inspectReviewedCommerceOwnership } from './reviewed-commerce-ownership.mjs';
-import { setupReviewError } from './preflight-recovery.mjs';
+import { setupReviewError, withReviewPaths } from './preflight-recovery.mjs';
 const json = value => `${JSON.stringify(value, null, 2)}\n`;
 const fail = message => { throw new SetupError(message); };
 const relative = (from, to) => { const value = path.posix.relative(path.posix.dirname(from), to); return value.startsWith('.') ? value : `./${value}`; };
@@ -54,7 +54,12 @@ function rewriteNextContentConfiguration(source, filename) {
   const file = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, filename.endsWith('.ts') ? ts.ScriptKind.TS : ts.ScriptKind.JS);
   const unbox = value => { while (value && (ts.isAsExpression(value) || ts.isSatisfiesExpression(value) || ts.isParenthesizedExpression(value))) value = value.expression; return value; };
   const exported = file.statements.find(statement => ts.isExportAssignment(statement));
-  let object = unbox(exported?.expression);
+  // CommonJS configs (`module.exports = {...}` or an inert const alias) are the
+  // same literal object in another export form.
+  const commonjs = exported ? undefined : file.statements.filter(ts.isExpressionStatement).map(statement => statement.expression)
+    .filter(expression => ts.isBinaryExpression(expression) && expression.operatorToken.kind === ts.SyntaxKind.EqualsToken && ts.isPropertyAccessExpression(expression.left) && ts.isIdentifier(expression.left.expression) && expression.left.expression.text === 'module' && expression.left.name.text === 'exports');
+  if (commonjs && commonjs.length > 1) fail('Multiple Next configuration exports need manual review.');
+  let object = unbox(exported?.expression ?? commonjs?.[0]?.right);
   if (object && ts.isIdentifier(object)) {
     const name = object.text;
     const declarations = file.statements.filter(ts.isVariableStatement).flatMap(statement => [...statement.declarationList.declarations]);
@@ -173,7 +178,9 @@ export async function planNextContent(directory, configuration) {
     const sourceFile = inventory.files[route.path === '/' ? 'home' : route.path.slice(1)];
     if (!sourceFile || !/\.[jt]sx$/.test(sourceFile)) fail('Automatic content bindings require a JSX/TSX source page for each route.');
     const source = await readProjectFile(root, sourceFile);
-    const transformed = transformSourcePublication({ source, slug: route.slug, locale: route.locale, filename: sourceFile, publicSource: true });
+    let transformed;
+    try { transformed = transformSourcePublication({ source, slug: route.slug, locale: route.locale, filename: sourceFile, publicSource: true }); }
+    catch (error) { throw withReviewPaths(error, [sourceFile]); }
     // Projection is part of planning, so unsupported source structure cannot
     // wait until a running page serializes its client provider properties.
     try { publicBindingInventory(transformed.inventory); }

package/dist/guided.mjs

@@ -9,7 +9,7 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
-import { lstat, readFile } from 'node:fs/promises';
+import { cp, lstat, mkdir, readdir, readFile, rename, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { analyze, applyPlan, projectRoot, readProjectFile, SetupError } from './core.mjs';
@@ -19,6 +19,10 @@ import { readSetupEnvironment } from './setup-environment.mjs';
 import { readSourceSettings } from './source-setup.mjs';
 import { checkPublication } from './publication-check.mjs';
 import { finalizeSource } from './source-finalize.mjs';
+import { preflightSetup } from './preflight.mjs';
+import { planSettingsOnly, SETTINGS_ONLY_FILE } from './settings-only-setup.mjs';
+import { applyEnvironment, planEnvironment } from './setup-environment.mjs';
+import { themeConfiguration } from './theme.mjs';
 
 export const PAIRING_WAIT_MS = 10 * 60 * 1000;
 export const WEBSITE_WAIT_MS = 15 * 60 * 1000;
@@ -110,17 +114,125 @@ async function reviewLayout(root, manifest, framework, io) {
     } else if (framework === 'Next.js') {
       const { planSettingsLayoutReview } = await import('./next-settings-layout.mjs');
       replan = () => planSettingsLayoutReview(root);
-    } else return;
+    } else return false;
     plan = await replan();
-  } catch { return; }
+  } catch { return false; }
   const changes = plan.files.filter(file => ['create', 'update'].includes(file.state));
-  if (!changes.length) return;
+  if (!changes.length) return false;
   const sources = [...new Set((plan.slots ?? plan.pages ?? []).map(item => item.path))];
   io.write(`\nYour website already has its own header and footer${sources.length ? ` (${sources.join(', ')})` : ''}.\nI'll keep them exactly as they are and add places where menus and settings from the CMS can appear.\n`);
   if (!yes(await io.ask('Okay? [Y/n] '))) fail('Nothing was changed. Run the same command again when you are ready.');
   if (JSON.stringify(await replan()) !== JSON.stringify(plan)) fail('Your website files changed while reviewing. Nothing was saved; run the same command again.');
   await applyPlan(plan);
   io.write('✔ Header and footer reviewed\n');
+  return true;
+}
+
+// Static paths that are usually interactive application screens rather than
+// editable pages. They are proposed as website-owned; the person can change it.
+export const ALL_APP_SCREENS = 'Every page in this website is an interactive app screen (built with state, tabs or data lists), so none of its page text can be made editable automatically yet.';
+const appScreen = /(^|\/)(cart|basket|bag|checkout|payment|pay|orders?|order-history|track(ing)?|account|my-account|profile|settings|login|log-in|signin|sign-in|signup|sign-up|register|logout|auth|dashboard|admin|portal|wishlist|favou?rites|search|upload[\w-]*|book(ing)?s?|reservations?|messages|inbox|notifications|api)(\/|$)/i;
+
+/** Propose which routes stay part of the website app; ask once; save the reviewed manifest. */
+async function reviewRoutes(root, blocker, io, reason) {
+  const { inspectNativeRouteCandidates, planNativeRouteReview } = await import('./native-route-review.mjs');
+  let inventory;
+  try { inventory = await inspectNativeRouteCandidates(root); } catch { return false; }
+  const files = new Set(blocker?.paths ?? []);
+  const flagged = new Set([...files].map(name => name.replace(/^(?:src\/)?app/, '')));
+  for (const row of inventory.candidates) if (files.has(row.file)) flagged.add(row.path);
+  const existing = await readProjectFile(root, '.universalcms/native.routes.json').then(text => text ? JSON.parse(text) : null).catch(() => null);
+  for (const path of [...existing?.nativePaths ?? [], ...existing?.nativePatterns ?? []]) flagged.add(path);
+  // Client components render from state, so their text cannot be bound to CMS content.
+  const client = new Set();
+  for (const row of inventory.candidates) {
+    const text = await readProjectFile(root, row.file).catch(() => null);
+    if (text && /^\s*(?:\/\/[^\n]*\n|\/\*[\s\S]*?\*\/\s*)*['"]use client['"]/.test(text)) client.add(row.path);
+  }
+  let owned = inventory.candidates.filter(row => row.kind === 'dynamic' || flagged.has(row.path) || client.has(row.path) || appScreen.test(row.path)).map(row => row.path);
+  if (!inventory.candidates.some(row => row.kind === 'static' && !owned.includes(row.path)) && inventory.candidates.filter(row => row.kind === 'static').every(row => client.has(row.path) || flagged.has(row.path) || appScreen.test(row.path)) && inventory.candidates.some(row => client.has(row.path) || flagged.has(row.path))) throw new SetupError(ALL_APP_SCREENS);
+  const cmsPages = () => inventory.candidates.filter(row => row.kind === 'static' && !owned.includes(row.path));
+  if (!cmsPages().length) {
+    if (reason) throw new SetupError(ALL_APP_SCREENS);
+    owned = owned.filter(path => path !== '/');
+  }
+  const show = () => {
+    io.write('\nI looked at every page in your website:\n');
+    inventory.candidates.forEach((row, index) => io.write(`  ${String(index + 1).padStart(2)}. ${row.path === '/' ? '/ (home page)' : row.path}${row.kind === 'dynamic' ? ' (one page per item)' : client.has(row.path) && owned.includes(row.path) ? ' (interactive)' : ''} — ${owned.includes(row.path) ? 'stays as part of your website app' : 'editable in the CMS'}\n`));
+  };
+  if (reason) io.write(`\n${reason}\n`);
+  show();
+  io.write('Pages that stay part of your website app keep working exactly as they do now (shopping, accounts, forms, product details).\nAll other pages become editable in the CMS. Header, footer and site settings are managed in the CMS either way.\n');
+  while (true) {
+    const answer = (await io.ask('Use this? [Y/n, or type page numbers to switch them, e.g. 3,5] ')).trim();
+    if (yes(answer)) break;
+    if (/^n(o)?$/i.test(answer)) fail('Nothing was changed. Run the same command again when you are ready.');
+    if (!/^\d+(\s*,\s*\d+)*$/.test(answer)) { io.write('Type Y, n, or page numbers separated by commas.\n'); continue; }
+    for (const index of answer.split(',').map(value => Number(value.trim()) - 1)) {
+      const row = inventory.candidates[index];
+      if (!row) continue;
+      owned = owned.includes(row.path) ? owned.filter(path => path !== row.path) : [...owned, row.path];
+    }
+    if (!cmsPages().length) { io.write('At least one page must stay editable in the CMS.\n'); owned = owned.filter(path => path !== '/'); }
+    show();
+  }
+  if (!owned.length) return false;
+  const plan = await planNativeRouteReview(root, owned);
+  if (JSON.stringify(await planNativeRouteReview(root, owned)) !== JSON.stringify(plan)) fail('Your website files changed while reviewing. Nothing was saved; run the same command again.');
+  await applyPlan(plan);
+  io.write('✔ Website app pages reviewed\n');
+  return true;
+}
+
+/** Plain-language guidance for what to change in the website when a blocker cannot be fixed automatically. */
+export function siteChangeAdvice(blocker) {
+  const message = blocker?.message ?? '', paths = blocker?.paths ?? [];
+  const where = paths.length ? ` (${paths.slice(0, 6).join(', ')}${paths.length > 6 ? ', …' : ''})` : '';
+  if (/next\.config|Configuration needs developer inspection|Dynamic Next configuration|configuration uses values/i.test(message)) return [`Your Next.js config is computed when it runs, so it can't be read safely. Make next.config export a plain object, for example:\n      module.exports = { reactStrictMode: true };`];
+  if (/static export|output:\s*'export'/i.test(message)) return ['Your site is built as static files only. The CMS needs your site to run its Node server: remove `output: "export"` from next.config and deploy with `next start` (or another Node host).'];
+  if (/Pages Router|pages\//.test(message)) return ['Your site uses the older Next.js Pages Router (pages/ folder). Move the pages you want editable into the App Router (app/ folder), or ask your developer for a custom integration.'];
+  if (/Workspaces|workspace/i.test(message)) return ['Run this command inside the single website folder (the one with its own package.json), not the monorepo root.'];
+  if (/version|Node\.js|supported/i.test(message) && /requires?|supports?|unsupported/i.test(message)) return [`A framework or Node.js version is outside the supported range. ${message}`];
+  if (message === ALL_APP_SCREENS) return [message, 'To make a page editable from the CMS, write its main text directly in the page file (headings, paragraphs, images as plain JSX in a server component, without \'use client\'), and keep interactive parts like carts, tabs and product lists in separate components. Then run this command again.', 'Ask your developer if you need a custom integration for data-driven pages.'];
+  if (blocker?.code === 'content-bindings-review' || /content adapter|bindings|repeated|data-driven|route props/i.test(message)) return [`Some pages${where} build their text from data, props or loops, so the CMS can't tell which words to make editable. Either keep those pages as part of your website app (rerun and switch them), or write the editable text directly in the page (headings, paragraphs and images as plain JSX).`];
+  if (/header|footer|layout|chrome/i.test(message)) return [`Your header or footer${where} is built from components or logic the CMS can't safely extend. Put the header and footer markup directly in the root layout (plain <header>/<footer> elements), then rerun.`];
+  if (/route|dynamic|parallel/i.test(message)) return [`Some routes${where} use patterns that need a developer: catch-all, parallel or intercepted routes. Keep them in your app and ask your developer for a reviewed adapter.`];
+  return ['This website uses a pattern the automatic setup does not support yet.'];
+}
+
+/**
+ * Check the website before anything is installed, fix what can be fixed safely
+ * with one plain question each, and explain the rest. Resolving one finding can
+ * reveal the next, so it loops a bounded number of times.
+ */
+async function prepareWebsite(root, connection, manifest, framework, io) {
+  const scope = Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, connection[name]]));
+  const attempted = new Set();
+  for (let round = 0; round < 6; round++) {
+    const result = await preflightSetup(root, scope);
+    if (result.status === 'planned') return 'full';
+    const blocker = result.blockers?.[0];
+    const key = `${blocker?.code}:${blocker?.message}:${(blocker?.paths ?? []).join(',')}`;
+    let advice = blocker;
+    if (blocker && !attempted.has(key)) try {
+      attempted.add(key);
+      if (blocker.code === 'next-route-ownership' && await reviewRoutes(root, blocker, io)) continue;
+      if (blocker.code === 'content-bindings-review' && framework === 'Next.js' && blocker.paths?.length && await reviewRoutes(root, blocker, io, `${blocker.paths.join(', ')} builds its text from data or loops, so its words can't be made editable automatically. I've switched it to stay part of your website app (it keeps working as it does now).`)) continue;
+      if (['native-chrome-layout', 'native-settings-layout'].includes(blocker.code) && await reviewLayout(root, manifest, framework, io)) continue;
+    } catch (error) { if (error?.message !== ALL_APP_SCREENS) throw error; advice = { message: ALL_APP_SCREENS }; }
+    // Pages that cannot be edited automatically can still have their site
+    // settings managed by the CMS while the website keeps rendering every page.
+    if (framework === 'Next.js' && (advice?.message === ALL_APP_SCREENS || ['content-bindings-review', 'next-route-ownership'].includes(blocker?.code))) {
+      io.write(`\n${advice?.message === ALL_APP_SCREENS ? ALL_APP_SCREENS : 'Some pages in this website can\'t be made editable automatically.'}\n`);
+      io.write('You can still connect it for site settings: the CMS manages your menus, logo and branding, SEO (titles, descriptions, social previews), analytics, scripts, cookie consent and redirects. Every page keeps working exactly as it does now.\n');
+      if (yes(await io.ask('Connect for site settings? [Y/n] '))) return 'settings-only';
+    }
+    io.write('\n✋ Your website needs a small change before it can connect:\n');
+    for (const line of siteChangeAdvice(advice)) io.write(`   • ${line}\n`);
+    io.write(`\nDetails for your developer:\n   ${result.message ?? blocker?.message ?? 'Preflight did not pass.'}\n`);
+    fail('Your website files were not changed (only the Universal CMS package was added). Make the change above, then run the same command again.');
+  }
+  fail('Setup found more items to review than it can handle automatically. Ask your developer to run the step-by-step setup in Developer setup.');
 }
 
 function pkce() {
@@ -141,7 +253,11 @@ export async function waitForBrowserApproval({ cms, request, io, timeoutMs = PAI
     const valid = returned.length === expected.length && timingSafeEqual(returned, expected) && codePattern.test(code);
     res.writeHead(valid ? 200 : 400, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Referrer-Policy': 'no-referrer' });
     res.end(valid ? page('Approved — back to your terminal', 'You can close this tab. Setup continues in your terminal.') : page('This link is not valid', 'Start the connection again from your terminal.'));
-    if (valid) settle.resolve(code);
+    if (valid) {
+      let scope = null;
+      try { scope = validateConnection({ version: 1, ...Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, url.searchParams.get(name) ?? undefined])) }); } catch { /* Older CMS: check after redemption. */ }
+      settle.resolve({ code, scope });
+    }
   });
   await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
   const timer = setTimeout(() => settle.reject(new SetupError('No approval arrived within 10 minutes. Run the same command again to start over.')), timeoutMs);
@@ -152,7 +268,8 @@ export async function waitForBrowserApproval({ cms, request, io, timeoutMs = PAI
     io.write('\nOpening your browser to approve this website…\n');
     if (!await io.openUrl(link)) io.write('Your browser did not open. Open this link to continue:\n');
     io.write(`  ${link}\n\nWaiting for approval… (no browser on this computer? In the CMS open Developer setup → “Connect without a browser”)\n`);
-    return { code: await result, verifier };
+    const { code, scope } = await result;
+    return { code, verifier, scope };
   } finally { clearTimeout(timer); server.close(); }
 }
 
@@ -168,7 +285,8 @@ export async function redeem(cms, code, verifier, fetcher) {
   const data = body.data;
   const connection = validateConnection({ version: 1, apiOrigin: data.apiOrigin, siteId: data.siteId, environmentId: data.environmentId, locale: data.locale, websiteOrigin: data.websiteOrigin, adminOrigin: data.adminOrigin });
   if (typeof data.serverKey !== 'string' || !serverKey.test(data.serverKey)) fail('The CMS returned an unexpected response. No key was saved.');
-  return { connection, siteName: typeof data.siteName === 'string' ? data.siteName.slice(0, 100) : '', serverKey: data.serverKey };
+  const environment = { production: 'Live website', staging: 'Staging', development: 'Development' }[data.environment] ?? '';
+  return { connection, siteName: typeof data.siteName === 'string' ? data.siteName.slice(0, 100) : '', environment, serverKey: data.serverKey };
 }
 
 function describeRoute(route) { return route.path === '/' ? '/ (home page)' : route.path; }
@@ -261,9 +379,21 @@ export async function runGuided(directory, options, io) {
   const framework = typeof analysis.framework === 'string' && analysis.framework !== 'Unknown' ? analysis.framework : null;
   io.write(`✔ Found ${framework ? `a ${framework} website` : 'a website'} in ${path.basename(root)}\n`);
 
+  // A Universal CMS theme website only needs pairing and its private key.
+  if (await readProjectFile(root, THEME_FILE) !== null) {
+    const cms = cmsOrigin(options.cms ?? io.env.UNIVERSALCMS_URL ?? '') ?? fail('Add --cms with your Universal CMS address.');
+    const approval = options.code ? { code: options.code } : await waitForBrowserApproval({ cms, io, request: { origin: suggestedOrigin(manifest, null) ?? `http://localhost:${THEME_PORT}`, project: path.basename(root).slice(0, 80), framework: 'Universal CMS theme' } });
+    const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+    await connectTheme(root, paired, io);
+    return themeDone(root, paired.connection, await packageManager(root, manifest), false, io);
+  }
   const saved = await readConnection(root);
   const environment = await readSetupEnvironment(root);
   const installed = await readProjectFile(root, '.universalcms/website.integration.json') !== null;
+  if (saved && environment.keyConfigured && !options.code && await readProjectFile(root, SETTINGS_ONLY_FILE) !== null) {
+    io.write(`✔ Already connected for site settings (${saved.websiteOrigin})\n`);
+    return finishSettingsOnly(root, saved, manifest, io);
+  }
   if (saved && installed && environment.keyConfigured && !options.code) {
     io.write(`✔ Already set up for ${saved.websiteOrigin}\n`);
     return goLive(root, saved, await manifestOf(root), io);
@@ -279,15 +409,25 @@ export async function runGuided(directory, options, io) {
   if (options.code !== undefined && !codePattern.test(options.code)) fail('That connection code is not valid. Copy the whole command from the CMS again.');
 
   await ensureConnector(root, manifest, io);
-  if (!installed) await reviewLayout(root, manifest, framework, io);
   const approval = options.code
     ? { code: options.code, verifier: undefined }
     : await waitForBrowserApproval({ cms, io, request: { origin: saved?.websiteOrigin ?? suggestedOrigin(manifest, framework) ?? '', project: path.basename(root).slice(0, 80), framework: framework ?? '' } });
-  const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
-  io.write(`✔ Approved: ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})\n`);
-  if (saved && (saved.siteId !== paired.connection.siteId || saved.environmentId !== paired.connection.environmentId)) {
-    fail('This folder is already connected to a different website or environment in the CMS. Choose the same website when approving, or ask your developer to review .universalcms/connection.json. Nothing was changed.');
+  let mode = 'full';
+  const mismatch = connection => saved && (saved.siteId !== connection.siteId || saved.environmentId !== connection.environmentId);
+  const different = 'This folder is already connected to a different website or environment in the CMS. Choose the same website when approving, or ask your developer to review .universalcms/connection.json. Nothing was changed.';
+  // Check (and safely fix) the website before redeeming, so a blocked site
+  // never leaves an unused key behind. The approval expires on its own.
+  if (approval.scope && !installed) {
+    if (mismatch(approval.scope)) fail(different);
+    io.write('✔ Approved in the CMS — checking your website…\n');
+    mode = await prepareWebsite(root, approval.scope, manifest, framework, io);
   }
+  const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+  io.write(`✔ Connected to ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})${paired.environment ? ` · ${paired.environment} environment` : ''}\n`);
+  if (mismatch(paired.connection)) fail(different);
+  if (approval.scope && JSON.stringify(approval.scope) !== JSON.stringify(paired.connection)) fail('The approved website changed before connecting. Nothing was changed; run the same command again.');
+  if (!approval.scope && !installed) mode = await prepareWebsite(root, paired.connection, manifest, framework, io);
+  if (mode === 'settings-only') return runSettingsOnly(root, paired, manifest, options, io);
 
   const adapter = setupIo(io, paired.serverKey, options.details === true);
   try {
@@ -312,6 +452,116 @@ export async function runGuided(directory, options, io) {
   return goLive(root, paired.connection, await manifestOf(root), io);
 }
 
+export const THEME_FILE = '.universalcms/theme.json';
+export const THEME_WEBSITE_FILE = '.universalcms/website.json';
+const THEME_PORT = 3100;
+
+/** Save the public theme connection and the private key after pairing. */
+async function connectTheme(root, paired, io) {
+  const { connection } = paired;
+  const environment = await planEnvironment(root, { ...Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, connection[name]])), apiKey: paired.serverKey });
+  await applyEnvironment(environment);
+  await mkdir(path.join(root, '.universalcms'), { recursive: true });
+  await writeFile(path.join(root, CONNECTION_FILE_PATH), `${JSON.stringify(connection, null, 2)}\n`);
+  await writeFile(path.join(root, THEME_WEBSITE_FILE), `${JSON.stringify(themeConfiguration(connection), null, 2)}\n`);
+  io.write('✔ Website connected and private key saved\n');
+}
+const CONNECTION_FILE_PATH = '.universalcms/connection.json';
+
+function themeDone(root, connection, manager, created, io) {
+  const pages = `${connection.adminOrigin}/sites/${connection.siteId}#setup?environmentId=${connection.environmentId}`;
+  io.write(`\n🎉 Your Universal CMS website is ready.\n\n   Start it:\n${created ? `     cd ${path.basename(root)}\n` : ''}     ${manager} run dev\n   Then open ${connection.websiteOrigin}\n\n`);
+  io.write(`   Manage everything from the CMS: ${pages}\n`);
+  io.write('   • Create a page with the slug "home" — it becomes your home page\n   • Pages and posts appear on the website when you publish them\n   • Menus, logo, colors and SEO: Appearance and SEO in the CMS\n');
+  return { connected: true, mode: 'theme', done: true };
+}
+
+/** `create <folder>`: start a new website rendered entirely from Universal CMS. */
+export async function runCreate(parent, name, options, io) {
+  if (typeof name !== 'string' || !/^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name)) fail('Choose a simple folder name for the new website, for example: my-website');
+  const root = path.resolve(parent, name);
+  try { if ((await readdir(root)).length) fail(`The folder ${name} already exists and is not empty. Choose another name.`); }
+  catch (error) { if (error instanceof SetupError) throw error; if (error.code !== 'ENOENT') throw error; }
+  const cms = cmsOrigin(options.cms ?? io.env.UNIVERSALCMS_URL ?? '') ?? await (async () => {
+    while (true) {
+      const value = cmsOrigin((await io.ask('Your Universal CMS address (for example https://cms.example.com): ')).trim());
+      if (value) return value;
+      io.write('Enter the address you use to sign in to the CMS.\n');
+    }
+  })();
+  io.write(`\nUniversal CMS · create a new website in ${name}\n`);
+  // Copy into a temporary sibling first so a failed copy never leaves a half-made folder.
+  const staging = `${root}.universalcms-${randomBytes(4).toString('hex')}`;
+  await cp(fileURLToPath(new URL('./templates/next-theme/', import.meta.url)), staging, { recursive: true, errorOnExist: true, force: false });
+  await rename(path.join(staging, 'gitignore.template'), path.join(staging, '.gitignore'));
+  const version = await connectorVersion();
+  const override = io.env.UNIVERSALCMS_CONNECT_PACKAGE;
+  if (override !== undefined && !/^[^\s'"`;&|<>$]{1,2048}$/.test(override)) fail('UNIVERSALCMS_CONNECT_PACKAGE must be a package spec, file path or URL without spaces.');
+  const manifest = { name: name.toLowerCase().replace(/[^a-z0-9._-]/g, '-'), private: true, version: '0.1.0', scripts: { dev: `next dev -p ${THEME_PORT}`, build: 'next build', start: `next start -p ${THEME_PORT}` },
+    dependencies: { '@universalcms/connect': override ?? `^${version}`, next: '^16.4.2', react: '^19.2.3', 'react-dom': '^19.2.3' },
+    devDependencies: { '@types/node': '^24.0.0', '@types/react': '^19.2.0', typescript: '^5.9.0' } };
+  await writeFile(path.join(staging, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+  await rename(staging, root);
+  io.write('✔ Website files created\n');
+  io.write('Installing packages (this can take a minute)…\n');
+  if (await io.run('npm', ['install', '--no-audit', '--no-fund'], root) !== 0) fail(`Packages could not be installed. Check your internet connection, then run:\n  cd ${name} && npm install\nand then: npx @universalcms/connect@latest`);
+  io.write('✔ Packages installed\n');
+  const approval = options.code ? { code: options.code } : await waitForBrowserApproval({ cms, io, request: { origin: `http://localhost:${THEME_PORT}`, project: name.slice(0, 80), framework: 'Universal CMS theme' } });
+  const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+  io.write(`✔ Approved: ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})\n`);
+  await connectTheme(root, paired, io);
+  return themeDone(root, paired.connection, 'npm', true, io);
+}
+
+/** Ask the running website's settings endpoint, as the CMS admin does. */
+async function settingsReady(connection, io) {
+  try {
+    const url = new URL('/api/universalcms/settings', connection.websiteOrigin);
+    url.search = new URLSearchParams({ check: 'connection', siteId: connection.siteId, environmentId: connection.environmentId }).toString();
+    const response = await io.fetch(url, { headers: { Origin: connection.adminOrigin, Accept: 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(10000) });
+    const body = response.ok ? await response.json() : null;
+    return body?.mode === 'settings-only' && body.siteId === connection.siteId && body.environmentId === connection.environmentId;
+  } catch { return false; }
+}
+
+async function finishSettingsOnly(root, connection, manifest, io) {
+  if (!await settingsReady(connection, io)) {
+    const local = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|$)/.test(connection.websiteOrigin), command = await restartHint(root, manifest);
+    io.write(local
+      ? `\n→ Restart your website so the changes take effect:\n   1. In the terminal where your website is running, press Ctrl+C\n   2. Start it again${command ? ` with: ${command}` : ''}\n   It must run at ${connection.websiteOrigin}\n`
+      : `\n→ Deploy your website the way you normally do. It must be reachable at ${connection.websiteOrigin}\n`);
+    io.write(`   Waiting for ${connection.websiteOrigin} … (Ctrl+C stops waiting; run this command again later to continue)\n`);
+    const deadline = io.now() + WEBSITE_WAIT_MS;
+    let ready = false;
+    while (!ready && io.now() < deadline) { await io.sleep(3000); ready = await settingsReady(connection, io); }
+    if (!ready) { io.write(`\nThe website at ${connection.websiteOrigin} is not serving CMS settings yet. Run this command again once it's running.\n`); return { connected: false, mode: 'settings-only' }; }
+  }
+  const settings = `${connection.adminOrigin}/sites/${connection.siteId}#setup?environmentId=${connection.environmentId}`;
+  io.write(`✔ Your website is connected for site settings\n\n🎉 All done! Manage it from Universal CMS (this link opens the right environment):\n   ${settings}\n`);
+  io.write('   • SEO, branding, analytics, scripts, cookie consent and redirects apply automatically.\n');
+  io.write('   • To show the CMS menu in your own header or footer, add one line where it should appear:\n');
+  io.write("       import { CmsNavigation } from '@universalcms/connect/react-website';\n       <CmsNavigation location=\"header\" />   (or location=\"footer\")\n");
+  io.write('     Other drop-ins: <CmsBranding />, <CmsSocialLinks />, and useWebsiteSettings() for anything custom.\n');
+  return { connected: true, mode: 'settings-only', done: true };
+}
+
+/** Install the settings-only integration and save the website key privately. */
+async function runSettingsOnly(root, paired, manifest, options, io) {
+  const plan = await planSettingsOnly(root, Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, paired.connection[name]])));
+  const environment = await planEnvironment(root, { ...Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, paired.connection[name]])), apiKey: paired.serverKey });
+  const added = plan.files.filter(file => file.state === 'create').length, changed = plan.files.filter(file => file.state === 'update').length;
+  io.write(`\nReady to connect your website for site settings:\n  • ${added} file${added === 1 ? '' : 's'} will be added${changed ? ` and ${changed} updated (your root layout gets one wrapper)` : ''} — your pages and design stay the same\n  • The website key is saved privately in .env.local (never committed to Git)\n`);
+  if (options.details) for (const file of plan.files) io.write(`      ${file.state}: ${file.path}\n`);
+  else io.write('  (run with --details to list every file)\n');
+  if (!yes(await io.ask('\nGo ahead? [Y/n] '))) { io.write('Cancelled. Nothing was changed.\n'); return { connected: false }; }
+  const current = await planSettingsOnly(root, plan.connection);
+  if (JSON.stringify(current.files) !== JSON.stringify(plan.files)) fail('Your website files changed while reviewing. Nothing was saved; run the same command again.');
+  await applyEnvironment(environment);
+  await applyPlan(plan);
+  io.write('✔ Website files and private key saved\n');
+  return finishSettingsOnly(root, paired.connection, await manifestOf(root), io);
+}
+
 /** Process-backed effects for the CLI. */
 export function processIo({ ask, write }) {
   return {

package/dist/preflight-recovery.mjs

@@ -60,6 +60,14 @@ export function setupReviewError(code, paths = []) {
   return error;
 }
 
+/** Attach sanitized source paths to a fixed planner reason, keeping its message and code. */
+export function withReviewPaths(error, paths) {
+  const fixed = error instanceof SetupError && fixedReasons.get(error.message);
+  if (!fixed || diagnostics.has(error)) return error;
+  diagnostics.set(error, { ...fixed, message: error.message, ...sanitizeSetupPaths(paths) });
+  return error;
+}
+
 export function setupReviewDiagnostic(error) {
   const value = diagnostics.get(error);
   if (value) return { ...value, paths: [...value.paths] };

package/dist/settings-only-setup.mjs

@@ -0,0 +1,100 @@
+/**
+ * Plans a settings-only connection for a Next.js App Router website: the site
+ * keeps every page, and the CMS manages navigation, branding, SEO, analytics,
+ * scripts, consent and other site settings. Only additive files plus one
+ * wrapper around the root layout's <body> children are written.
+ */
+import ts from './vendor/typescript.cjs';
+import { projectRoot, readProjectFile, SetupError } from './project-files.mjs';
+import { inspectSourceRoutes } from './source-routes.mjs';
+import { CONNECTION_FILE, validateConnection } from './staged-setup.mjs';
+
+export const SETTINGS_ONLY_FILE = '.universalcms/settings-only.json';
+const fail = message => { throw new SetupError(message); };
+const json = value => `${JSON.stringify(value, null, 2)}\n`;
+const relative = (from, to) => { const up = from.split('/').length - 1; return `${'../'.repeat(up) || './'}${to}`; };
+const MARK = '// Generated by @universalcms/connect (settings-only).';
+
+async function appDirectory(root) {
+  const inventory = await inspectSourceRoutes(root);
+  const first = Object.values(inventory.files)[0];
+  if (!first) fail('No App Router pages were found. Settings-only connection supports Next.js App Router websites.');
+  return first.startsWith('src/app/') ? 'src/app' : 'app';
+}
+
+function wrapBody(source, filename) {
+  const ast = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, /x$/.test(filename) ? ts.ScriptKind.TSX : ts.ScriptKind.JSX);
+  if (ast.parseDiagnostics.length) fail(`${filename} could not be read. Fix its syntax, then run the command again.`);
+  if (ast.statements[0] && ts.isExpressionStatement(ast.statements[0]) && ts.isStringLiteral(ast.statements[0].expression) && ast.statements[0].expression.text === 'use client') fail(`${filename} is a client component. The root layout must be a server component (remove 'use client' from the root layout and move interactive parts into their own components).`);
+  const bodies = [];
+  (function visit(node) { if (ts.isJsxElement(node) && node.openingElement.tagName.getText(ast) === 'body') bodies.push(node); ts.forEachChild(node, visit); })(ast);
+  if (bodies.length !== 1) fail(`${filename} needs exactly one literal <body> element so site settings can wrap the page. Write <body>…</body> directly in the root layout.`);
+  const body = bodies[0];
+  let insertion = 0;
+  for (const statement of ast.statements) { if (ts.isImportDeclaration(statement) || ts.isExpressionStatement(statement) && ts.isStringLiteral(statement.expression)) insertion = statement.end; else break; }
+  const edits = [
+    { at: body.closingElement.pos, text: '</UniversalCmsSettings>' },
+    { at: body.openingElement.end, text: '<UniversalCmsSettings>' },
+    { at: insertion, text: `\nimport UniversalCmsSettings from './universalcms.settings';` },
+  ];
+  for (const edit of edits.sort((a, b) => b.at - a.at)) source = source.slice(0, edit.at) + edit.text + source.slice(edit.at);
+  return source;
+}
+
+const settingsRoute = (app, file) => `${MARK} Site settings served to the website; no private value is returned.
+import { createSettingsOnlyHandler } from '@universalcms/connect/settings-only';
+import configuration from '${relative(file, SETTINGS_ONLY_FILE)}';
+import connection from '${relative(file, CONNECTION_FILE)}';
+
+const handle = createSettingsOnlyHandler({ configuration: configuration as Parameters<typeof createSettingsOnlyHandler>[0]['configuration'], adminOrigin: connection.adminOrigin });
+export const dynamic = 'force-dynamic';
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+`;
+
+const wrapperTemplate = (file, typed) => `${MARK} Supplies CMS site settings to the whole website.
+import { connection } from 'next/server';
+${typed ? "import type { ReactNode } from 'react';\n" : ''}import { WebsiteProvider } from '@universalcms/connect/react-website';
+import { createSettingsOnlyRuntime } from '@universalcms/connect/settings-only';
+import '@universalcms/connect/website.css';
+import configuration from '${relative(file, SETTINGS_ONLY_FILE)}';
+
+const runtime = createSettingsOnlyRuntime({ configuration${typed ? ': configuration as Parameters<typeof createSettingsOnlyRuntime>[0][\'configuration\']' : ''} });
+export default async function UniversalCmsSettings({ children }${typed ? ': { children: ReactNode }' : ''}) {
+  await connection();
+  const settings = await runtime.settings();
+  return <WebsiteProvider scope=${'{'}${'`'}\${configuration.siteId}:\${configuration.environmentId}${'`'}${'}'} initialSettings={settings}>{children}</WebsiteProvider>;
+}
+`;
+
+/** @returns {Promise<{ root: string, files: { path: string, content: string, state: string, previous?: string }[] }>} */
+export async function planSettingsOnly(directory, connectionInput) {
+  const root = await projectRoot(directory), connection = validateConnection({ version: 1, ...connectionInput });
+  const app = await appDirectory(root);
+  const layouts = [];
+  for (const ext of ['tsx', 'jsx', 'js', 'ts']) if (await readProjectFile(root, `${app}/layout.${ext}`) !== null) layouts.push(`${app}/layout.${ext}`);
+  if (layouts.length !== 1) fail(`Settings-only connection needs one root layout file in ${app}/.`);
+  const layout = layouts[0], typed = /\.tsx?$/.test(layout), ext = typed ? 'ts' : 'js';
+  const files = [];
+  const add = async (path, content) => {
+    const current = await readProjectFile(root, path);
+    if (current !== null && current !== content && !current.startsWith(MARK)) fail(`${path} already exists. Rename or remove it, then run the command again.`);
+    files.push({ path, content, state: current === null ? 'create' : current === content ? 'unchanged' : 'update', ...(current !== null && current !== content ? { previous: current } : {}) });
+  };
+  await add(CONNECTION_FILE, json(connection));
+  await add(SETTINGS_ONLY_FILE, json({ version: 1, apiOrigin: connection.apiOrigin, siteId: connection.siteId, environmentId: connection.environmentId, websiteOrigin: connection.websiteOrigin, routes: [] }));
+  for (const name of ['settings', 'page']) { const path = `${app}/api/universalcms/${name}/route.${ext}`; await add(path, settingsRoute(app, path).replace(typed ? '' : / as Parameters<[^>]+>\[0\]\['configuration'\]/, '')); }
+  const wrapper = `${app}/universalcms.settings.${typed ? 'tsx' : 'jsx'}`;
+  await add(wrapper, wrapperTemplate(wrapper, typed));
+  const source = await readProjectFile(root, layout);
+  if (!source.includes("import UniversalCmsSettings from './universalcms.settings';")) {
+    const content = wrapBody(source, layout);
+    files.push({ path: layout, content, state: 'update', previous: source });
+  } else files.push({ path: layout, content: source, state: 'unchanged' });
+  return { root, connection, app, files };
+}
+
+export async function isSettingsOnly(directory) {
+  return await readProjectFile(await projectRoot(directory), SETTINGS_ONLY_FILE) !== null;
+}

package/dist/settings-only.d.mts

@@ -0,0 +1,4 @@
+export const SETTINGS_ONLY_MODE: 'settings-only';
+export type SettingsOnlyConfiguration = { version: 1; apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; routes: [] };
+export function createSettingsOnlyHandler(options: { configuration: SettingsOnlyConfiguration; adminOrigin: string; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): (request: Request) => Promise<Response>;
+export function createSettingsOnlyRuntime(options: { configuration: SettingsOnlyConfiguration; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): { settings(): Promise<unknown> };

package/dist/settings-only.mjs

@@ -0,0 +1,54 @@
+/**
+ * Settings-only website runtime. The website keeps rendering every page itself;
+ * the CMS supplies header/footer navigation, branding, SEO, analytics, scripts,
+ * consent and other site settings. It serves the same settings endpoint as a
+ * full integration and reports every page as website-owned.
+ */
+import { createWebsiteRuntime } from './website-runtime.mjs';
+import { WEBSITE_PAGE_PATH, WEBSITE_SECTIONS, WEBSITE_SETTINGS_PATH } from './website-http.mjs';
+
+export const SETTINGS_ONLY_MODE = 'settings-only';
+const base = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer' };
+
+/**
+ * @param {{ configuration: { version: 1, apiOrigin: string, siteId: string, environmentId: string, websiteOrigin: string, routes: [] }, adminOrigin: string, env?: () => Record<string, string | undefined>, fetcher?: typeof fetch }} options
+ */
+export function createSettingsOnlyHandler({ configuration, adminOrigin, env = () => process.env, fetcher = globalThis.fetch }) {
+  const runtime = createWebsiteRuntime({ configuration, settingsOnly: true, env, fetcher });
+  const admin = new URL(adminOrigin).origin;
+  if (admin !== adminOrigin) throw new Error('Invalid CMS admin origin');
+  return async function handle(request) {
+    const method = request.method, url = new URL(request.url), origin = request.headers.get('origin');
+    const reply = (body, status = 200, extra = {}) => new Response(method === 'HEAD' || status === 204 ? null : JSON.stringify(body), { status, headers: { ...base, 'Content-Type': 'application/json', ...extra } });
+    if (url.pathname === WEBSITE_PAGE_PATH) {
+      // Every page belongs to the website in settings-only mode.
+      if (!['GET', 'HEAD'].includes(method)) return reply({ error: 'Method not allowed' }, 405, { Allow: 'GET, HEAD' });
+      return reply({ state: 'missing' }, 404);
+    }
+    if (url.pathname !== WEBSITE_SETTINGS_PATH) return reply({ error: 'Not found' }, 404);
+    const diagnostic = url.searchParams.get('check') === 'connection';
+    if (diagnostic) {
+      // The CMS admin reads this without credentials; nothing private is returned.
+      if (origin !== admin || request.headers.has('authorization') || request.headers.has('cookie')) return reply({ error: 'Request not allowed' }, 403);
+      const cors = { 'Access-Control-Allow-Origin': admin, Vary: 'Origin', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' };
+      if (method === 'OPTIONS') return request.headers.get('access-control-request-method') === 'GET' && !request.headers.has('access-control-request-headers') ? reply(null, 204, cors) : reply({ error: 'Request not allowed' }, 403);
+      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) {
+        // Tell the CMS which environment this website is connected to, so the
+        // admin can switch to it. Only public identifiers of the same website.
+        const sameSite = url.searchParams.get('siteId') === configuration.siteId;
+        return reply({ error: 'Website scope mismatch', ...(sameSite ? { siteId: configuration.siteId, environmentId: configuration.environmentId } : {}) }, 409, cors);
+      }
+      const snapshot = await runtime.settings();
+      return reply({ version: 1, mode: SETTINGS_ONLY_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false,
+        settings: Object.fromEntries(WEBSITE_SECTIONS.map(section => [section, { installed: true, state: snapshot.sections[section]?.state ?? 'unavailable', version: snapshot.sections[section]?.version ?? 0 }])) }, 200, cors);
+    }
+    if (!['GET', 'HEAD'].includes(method)) return reply({ error: 'Method not allowed' }, 405, { Allow: 'GET, HEAD' });
+    if (url.searchParams.size || origin && origin !== configuration.websiteOrigin || request.headers.get('sec-fetch-site') === 'cross-site') return reply({ error: 'Request not allowed' }, 403);
+    return reply(await runtime.settings());
+  };
+}
+
+/** Server-side settings snapshot for the generated root layout wrapper. */
+export function createSettingsOnlyRuntime({ configuration, env = () => process.env, fetcher = globalThis.fetch }) {
+  return createWebsiteRuntime({ configuration, settingsOnly: true, env, fetcher });
+}

package/dist/templates/next-theme/.universalcms/theme.json

@@ -0,0 +1,4 @@
+{
+  "version": 1,
+  "theme": "next-starter"
+}

package/dist/templates/next-theme/README.md

@@ -0,0 +1,14 @@
+# Universal CMS website
+
+Every page, post, menu, logo and SEO setting of this website is managed in
+Universal CMS. Start it with:
+
+```sh
+npm run dev
+```
+
+The home page is the CMS page with the slug `home`. Pages and posts appear at
+the URLs set in the CMS (SEO → URL patterns) once they are published.
+
+Connection values live in `.universalcms/`; the private website key lives only in
+`.env.local`. To reconnect, run `npx @universalcms/connect@latest`.

package/dist/templates/next-theme/app/[[...cmsPath]]/page.tsx

@@ -0,0 +1,43 @@
+// Every URL is rendered from published Universal CMS content.
+import { cache } from 'react';
+import { connection } from 'next/server';
+import { notFound, permanentRedirect, redirect } from 'next/navigation';
+import { websiteMetadata } from '@universalcms/connect/website-runtime';
+import { CmsWebsitePage } from '@universalcms/connect/react-website';
+import { configuration, runtime, scope } from '../../lib/universalcms';
+
+const settings = cache(async () => { await connection(); return runtime.settings(); });
+const read = cache(async (pathname: string) => { await connection(); return runtime.page(pathname); });
+const load = cache(async (pathname: string) => {
+  const result = await read(pathname);
+  if (result.state === 'redirect') { const target = result as { location: string; status?: number }; if (target.status === 301 || target.status === 308) permanentRedirect(target.location); redirect(target.location); }
+  if (result.state === 'missing' || result.state === 'unmanaged' || result.state === 'gone') notFound();
+  if (result.state !== 'published' && result.state !== 'archive') throw new Error('Website content is temporarily unavailable');
+  return result;
+});
+type Props = { params: Promise<{ cmsPath?: string[] }> };
+const pathOf = async (params: Props['params']) => '/' + ((await params).cmsPath ?? []).join('/');
+
+export async function generateMetadata({ params }: Props) {
+  // Metadata never throws: the page itself decides between content, redirect and 404.
+  const pathname = await pathOf(params), result = await read(pathname), snapshot = await settings();
+  if (result.state !== 'published' && result.state !== 'archive') return {};
+  const entry = result.state === 'published' ? result.entry : null;
+  const archiveTitle = result.state === 'archive' ? (result as { title: string }).title : undefined;
+  if (snapshot.sections.seo.state !== 'ready') return { title: archiveTitle ?? entry?.document.title, description: entry?.document.excerpt };
+  const value = websiteMetadata(entry, snapshot, pathname, configuration.websiteOrigin);
+  return {
+    title: archiveTitle ?? value.title, description: value.description, robots: value.robots,
+    alternates: { canonical: value.canonical, languages: Object.fromEntries((value.alternates ?? []).map(item => [item.locale, item.url])) },
+    openGraph: value.openGraph ? { ...value.openGraph, images: value.openGraph.image ? [value.openGraph.image] : undefined } : undefined,
+  };
+}
+
+export default async function Page({ params }: Props) {
+  const pathname = await pathOf(params), result = await load(pathname), snapshot = await settings();
+  const structured = websiteMetadata(result.state === 'published' ? result.entry : null, snapshot, pathname, configuration.websiteOrigin).jsonLd;
+  return <>
+    {structured && <script type="application/ld+json" data-universalcms-setting="seo" dangerouslySetInnerHTML={{ __html: JSON.stringify(structured).replace(/</g, '\\u003c') }}/>}
+    <CmsWebsitePage pathname={pathname} scope={scope} initialResult={result} initialSettings={snapshot}/>
+  </>;
+}

package/dist/templates/next-theme/app/api/universalcms/[endpoint]/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/app/globals.css

@@ -0,0 +1,12 @@
+/* Universal CMS theme base styles. Brand colors come from CMS Branding. */
+:root { --cms-website-accent: #4f46e5; color-scheme: light; }
+* { box-sizing: border-box; }
+body { margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; line-height: 1.6; color: #0f172a; background: #fff; }
+.cms-website { min-height: 100vh; display: flex; flex-direction: column; }
+.cms-website > :not(header):not(footer) { flex: 1; width: 100%; max-width: 1100px; margin: 0 auto; padding: 32px 20px 64px; }
+.cms-website-header, .cms-website-footer { display: flex; flex-wrap: wrap; align-items: center; gap: 16px 28px; padding: 16px max(20px, calc((100% - 1100px) / 2)); }
+.cms-website-header { border-bottom: 1px solid #e2e8f0; }
+.cms-website-footer { border-top: 1px solid #e2e8f0; color: #475569; font-size: 14px; }
+a { color: var(--cms-website-accent); }
+img { max-width: 100%; height: auto; }
+h1 { font-size: clamp(2rem, 4vw, 3rem); line-height: 1.15; margin: 0 0 16px; }

package/dist/templates/next-theme/app/layout.tsx

@@ -0,0 +1,11 @@
+import type { ReactNode } from 'react';
+import '@universalcms/connect/website.css';
+import './globals.css';
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

package/dist/templates/next-theme/app/not-found.tsx

@@ -0,0 +1,9 @@
+import { connection } from 'next/server';
+import { CmsExperience, CmsWebsite } from '@universalcms/connect/react-website';
+import { runtime, scope } from '../lib/universalcms';
+
+export default async function NotFound() {
+  await connection();
+  const settings = await runtime.settings();
+  return <CmsWebsite scope={scope} initialSettings={settings} applyTemplate={false}><main><CmsExperience notFound /></main></CmsWebsite>;
+}

package/dist/templates/next-theme/app/robots.txt/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/app/sitemap.xml/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/gitignore.template

@@ -0,0 +1,4 @@
+node_modules
+.next
+.env.local
+/.universalcms-private-*.tmp

package/dist/templates/next-theme/lib/universalcms.ts

@@ -0,0 +1,10 @@
+// Universal CMS theme: shared runtime. Connection values are public; the
+// website key is read from .env.local on the server only.
+import { createThemeRuntime } from '@universalcms/connect/theme';
+import website from '../.universalcms/website.json';
+import connection from '../.universalcms/connection.json';
+
+export const configuration = website as Parameters<typeof createThemeRuntime>[0]['configuration'];
+export const adminOrigin = connection.adminOrigin;
+export const scope = `${website.siteId}:${website.environmentId}`;
+export const runtime = createThemeRuntime({ configuration });

package/dist/templates/next-theme/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/dev/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/dist/templates/next-theme/next.config.mjs

@@ -0,0 +1 @@
+export default { htmlLimitedBots: /.*/ };

package/dist/templates/next-theme/tsconfig.json

@@ -0,0 +1,35 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "incremental": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "allowJs": true
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/dist/theme.d.mts

@@ -0,0 +1,6 @@
+import type { createWebsiteRuntime } from './website-runtime.mjs';
+export const THEME_MODE: 'theme';
+export type ThemeConfiguration = { version: 1; apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; routes: { path: string; kind: string; slug: string; locale: string }[] };
+export function themeConfiguration(connection: { apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; locale?: string }): ThemeConfiguration;
+export function createThemeRuntime(options: { configuration: ThemeConfiguration; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): ReturnType<typeof createWebsiteRuntime>;
+export function createThemeHandler(options: { configuration: ThemeConfiguration; adminOrigin: string; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): (request: Request) => Promise<Response>;

package/dist/theme.mjs

@@ -0,0 +1,50 @@
+/**
+ * Universal CMS theme runtime: every URL of the website is rendered from
+ * published CMS content. The home page is the page with slug `home`; all other
+ * paths follow the CMS URL patterns (pages, posts, categories, tags).
+ */
+import { createWebsiteRuntime } from './website-runtime.mjs';
+import { createWebsiteRequestHandler, WEBSITE_SECTIONS, WEBSITE_SETTINGS_PATH } from './website-http.mjs';
+
+export const THEME_MODE = 'theme';
+
+/** Publication configuration for a theme website: only the home page needs a fixed route. */
+export function themeConfiguration({ apiOrigin, siteId, environmentId, websiteOrigin, locale = 'en' }) {
+  return { version: 1, apiOrigin, siteId, environmentId, websiteOrigin, routes: [{ path: '/', kind: 'page', slug: 'home', locale }] };
+}
+
+export function createThemeRuntime({ configuration, env = () => process.env, fetcher = globalThis.fetch }) {
+  return createWebsiteRuntime({ configuration, env, fetcher });
+}
+
+/**
+ * Serves /api/universalcms/{settings,page,document}, /sitemap.xml and /robots.txt
+ * through the shared website handler, and answers the CMS admin connection check.
+ */
+export function createThemeHandler({ configuration, adminOrigin, env = () => process.env, fetcher = globalThis.fetch }) {
+  const website = createWebsiteRequestHandler({ configuration, env, fetcher });
+  const runtime = createThemeRuntime({ configuration, env, fetcher });
+  const admin = new URL(adminOrigin).origin;
+  if (admin !== adminOrigin) throw new Error('Invalid CMS admin origin');
+  const json = (body, status, extra = {}) => new Response(body === null ? null : JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', ...extra } });
+  return async function handle(request) {
+    const url = new URL(request.url);
+    if (url.pathname === WEBSITE_SETTINGS_PATH && url.searchParams.get('check') === 'connection') {
+      const origin = request.headers.get('origin');
+      if (origin !== admin || request.headers.has('authorization') || request.headers.has('cookie')) return json({ error: 'Request not allowed' }, 403);
+      const cors = { 'Access-Control-Allow-Origin': admin, Vary: 'Origin', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' };
+      if (request.method === 'OPTIONS') return request.headers.get('access-control-request-method') === 'GET' && !request.headers.has('access-control-request-headers') ? json(null, 204, cors) : json({ error: 'Request not allowed' }, 403);
+      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) {
+        // Tell the CMS which environment this website is connected to, so the
+        // admin can switch to it. Only public identifiers of the same website.
+        const sameSite = url.searchParams.get('siteId') === configuration.siteId;
+        return json({ error: 'Website scope mismatch', ...(sameSite ? { siteId: configuration.siteId, environmentId: configuration.environmentId } : {}) }, 409, cors);
+      }
+      const snapshot = await runtime.settings();
+      return json({ version: 1, mode: THEME_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false,
+        settings: Object.fromEntries(WEBSITE_SECTIONS.map(section => [section, { installed: true, state: snapshot.sections[section]?.state ?? 'unavailable', version: snapshot.sections[section]?.version ?? 0 }])) }, 200, cors);
+    }
+    const result = await website(request);
+    return result instanceof Response ? result : json({ error: 'Not found' }, 404);
+  };
+}

package/dist/vendor/project-analysis.mjs

@@ -197,10 +197,12 @@ function literalConfig(source, wrapper) {
   if (begin < 0) return { literals: {}, properties: {}, opaque: true, list };
   if (wrapper && list[begin]?.value === wrapper && list[begin + 1]?.value === '(') begin += 2;
   let aliasEnd = null;
-  // create-next-app emits a typed const followed by `export default config`.
-  // Resolve that one inert alias, never a function call, mutable assignment,
-  // imported runtime value, second declaration or conditional configuration.
-  if (!wrapper && list[begin]?.type === 'name' && list[begin - 1]?.value === 'default') {
+  // create-next-app emits a typed const followed by `export default config`
+  // (or `module.exports = config` in its JavaScript template). Resolve that one
+  // inert alias, never a function call, mutable assignment, imported runtime
+  // value, second declaration or conditional configuration.
+  const commonjs = list[begin - 1]?.value === '=' && list[begin - 2]?.value === 'exports' && list[begin - 3]?.value === '.' && list[begin - 4]?.value === 'module';
+  if (!wrapper && list[begin]?.type === 'name' && (list[begin - 1]?.value === 'default' || commonjs)) {
     const name = list[begin].value, declaration = list.findIndex(token => token.value === 'const');
     const prefix = list.slice(0, declaration);
     const typeImport = prefix.length === 0 || prefix[0]?.value === 'import' && prefix[1]?.value === 'type' && prefix.filter(token => token.value === 'import').length === 1 && prefix.filter(token => token.value === 'from').length === 1 && prefix.at(-1)?.value === ';' && prefix.at(-2)?.type === 'string' && prefix.at(-2)?.value === 'next' && prefix.at(-3)?.value === 'from' && prefix.slice(2,-3).every(token => token.type === 'name' || ['{','}',','].includes(token.value));
@@ -213,7 +215,7 @@ function literalConfig(source, wrapper) {
     }
     const tail = list.slice(begin + 1);
     if (declaration < 0 || !typeImport || list[declaration + 1]?.value !== name || list[initial]?.value !== '=' || list[initial + 1]?.value !== '{' || tail.some(token => token.value !== ';')) return { literals: {}, properties: {}, opaque: true, list };
-    aliasEnd = begin - 2;
+    aliasEnd = commonjs ? begin - 4 : begin - 2;
     begin = initial + 1;
   }
   if (list[begin]?.value !== '{') return { literals: {}, properties: {}, opaque: true, list };

package/dist/website-runtime.mjs

@@ -56,9 +56,16 @@ function publicEntry(raw, config) {
 }
 const summary = entry => ({ id: entry.id, kind: entry.kind, slug: entry.slug, locale: entry.locale, path: entry.path, title: entry.document.title, excerpt: entry.document.excerpt, publishedAt: entry.publishedAt });
 
-export function createWebsiteRuntime({ configuration, env = process.env, fetcher = globalThis.fetch, nativePaths = [], nativePatterns = [], nativePathPrefixes = [], installedSections = websiteSections, timeoutMs = 10_000, maxResponseBytes = 8 * 1024 * 1024, maxConcurrent = 16 } = {}) {
+function settingsOnlyConfig(value) {
+  if (!value || typeof value !== 'object' || !Array.isArray(value.routes) || value.routes.length) throw new Error('Invalid settings-only configuration');
+  // Reuse the full publication validator for origins and scope, then drop the probe route.
+  return { ...validatePublicationConfig({ ...value, routes: [{ path: '/', kind: 'page', slug: 'home', locale: 'en' }] }), routes: [] };
+}
+
+export function createWebsiteRuntime({ configuration, settingsOnly = false, env = process.env, fetcher = globalThis.fetch, nativePaths = [], nativePatterns = [], nativePathPrefixes = [], installedSections = websiteSections, timeoutMs = 10_000, maxResponseBytes = 8 * 1024 * 1024, maxConcurrent = 16 } = {}) {
   if (typeof window !== 'undefined') throw new Error('Website configuration requires a private server runtime.');
-  const config = validatePublicationConfig(configuration);
+  // Settings-only websites own every route; their configuration has no routes.
+  const config = settingsOnly ? settingsOnlyConfig(configuration) : validatePublicationConfig(configuration);
   if (typeof fetcher !== 'function' || !Array.isArray(nativePaths) || nativePaths.length > 1000 || !integer(timeoutMs, 1, 10000) || !integer(maxResponseBytes, 1, 8 * 1024 * 1024) || !integer(maxConcurrent, 1, 16)) return fail();
   const native = new Set(nativePaths.map(normalizePublicationPath));
   if (!Array.isArray(nativePatterns)) return fail();
@@ -209,7 +216,8 @@ export function createWebsiteRuntime({ configuration, env = process.env, fetcher
       const url=new URL(value,config.websiteOrigin);
       if(url.origin!==config.websiteOrigin)return {external:true};
       const path=normalizePublicationPath(url.pathname);
-      return {path,native:isNative(path)||isExcludedPublicationPath(path)};
+      // In settings-only mode the website renders every path itself.
+      return {path,native:settingsOnly||isNative(path)||isExcludedPublicationPath(path)};
     }catch{return null;}
   }
   async function publishedNavigation(sections,inventory) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@universalcms/connect",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Deterministic framework-aware Universal CMS setup for reviewed native websites",
   "type": "module",
   "bin": {
@@ -30,7 +30,9 @@
     "./svelte-runtime": "./dist/svelte-runtime.mjs",
     "./static-runtime": "./dist/static-runtime.mjs",
     "./website.css": "./dist/website.css",
-    "./public-bindings": "./dist/public-bindings.mjs"
+    "./public-bindings": "./dist/public-bindings.mjs",
+    "./settings-only": "./dist/settings-only.mjs",
+    "./theme": "./dist/theme.mjs"
   },
   "files": [
     "dist",
@@ -41,7 +43,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
+    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/settings-only.mjs && node --check src/theme.mjs && node --check src/settings-only-setup.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
     "prepack": "node scripts/build.mjs"
   },
   "publishConfig": {