@universalcms/connect 0.13.1 → 0.13.2

package/README.md

@@ -1,7 +1,7 @@
 # @universalcms/connect
 
 Local, deterministic website setup without AI. Universal CMS stays hosted; this
-package creates a website integration, not a CMS installation. Version 0.13.1 is
+package creates a website integration, not a CMS installation. Version 0.13.2 is
 prepared locally; this repository does not establish its public npm availability.
 
 ## Quick start
@@ -262,7 +262,7 @@ custom adapter still requires review, not forced overwriting.
 For an operator's downloaded artifact, the installation is:
 
 ```sh
-npm install --save-prod ./vendor/universalcms-connect-0.13.1.tgz
+npm install --save-prod ./vendor/universalcms-connect-0.13.2.tgz
 ```
 
 Use your project's package manager. These paths are examples for downloaded
@@ -539,7 +539,7 @@ npx --no-install universalcms-connect init \
   --environment 22222222-2222-4222-8222-222222222222
 ```
 
-After a public release, `npx @universalcms/connect@0.13.1 init` is the equivalent
+After a public release, `npx @universalcms/connect@0.13.2 init` is the equivalent
 registry entry point. Copy the real IDs/API origin from **Developer setup**.
 Missing values are prompted in a terminal; `--non-interactive` fails instead.
 Init prints a plan. Run the same command with `--apply` after reviewing it.
@@ -589,7 +589,7 @@ The CMS button reads the website's **`/api/cms-source`** endpoint. Current Next.
 prepares delivery scaffolding. React/Vite setup serves its reviewed public manifest through the normal dev command.
 Custom exporters need their explicit adapter; a delivery check alone is insufficient.
 
-Use the CMS's reviewed 0.13.1 package for the staged commands and current source
+Use the CMS's reviewed 0.13.2 package for the staged commands and current source
 discovery. Review source diagnostics and complete public
 mappings for unsupported pages. Restart the website using its normal server command, then run:
 

package/dist/cli.mjs

@@ -18,9 +18,9 @@ import { setupWebsiteSettings } from './website-setup.mjs';
 import { checkWebsiteSettings } from './website-check.mjs';
 import { WEBSITE_SECTIONS } from './website-http.mjs';
 import { setupSource, applySourcePlan, syncSource, readSourceSettings } from './source-setup.mjs';
-import { processIo, runGuided } from './guided.mjs';
+import { processIo, runCreate, runGuided } from './guided.mjs';
 
-const help = `Universal CMS connector 0.13.1
+const help = `Universal CMS connector 0.13.2
 
 Quick start (recommended) — run in your website folder:
   npx @universalcms/connect@latest --cms https://YOUR_CMS_ADDRESS
@@ -34,6 +34,9 @@ Quick start (recommended) — run in your website folder:
   --code <code>            One-time code from Developer setup → Connect without a browser
   --details                Show every file and technical message
 
+New website managed entirely from the CMS (pages, posts, menus, design):
+  npx @universalcms/connect@latest create my-website --cms https://YOUR_CMS_ADDRESS
+
 Individual steps (advanced):
 Usage: universalcms-connect <start|inspect-pages|review-pages|preflight|review-routes|review-layout|connect|setup|setup-settings|check-settings|server-key|setup-source|sync-source|finalize-source|analyze|init|check|check-source|check-publication> [options]
 
@@ -347,6 +350,14 @@ function guidedArguments(args) {
 async function main() {
   if (process.argv.slice(2).some(value => value === '--help' || value === '-h')) { process.stdout.write(help); return; }
   const first = process.argv[2];
+  if (first === 'create') {
+    const rest = process.argv.slice(3), name = rest[0] && !rest[0].startsWith('--') ? rest.shift() : undefined;
+    const options = guidedArguments(rest);
+    if (!process.stdin.isTTY || !process.stderr.isTTY) throw new SetupError('This setup needs an interactive terminal.');
+    const io = processIo({ ask, write: value => process.stdout.write(value) });
+    await runCreate(process.cwd(), name ?? (await ask('Folder name for the new website: ')).trim(), { cms: options['--cms'], code: options['--code'] }, io);
+    return;
+  }
   if (first === undefined || first === 'start' || first.startsWith('--')) {
     // The one-time pairing code is the only accepted credential-like argument:
     // it expires in ten minutes, works once and never reaches project files.

package/dist/guided.mjs

@@ -9,7 +9,7 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
-import { lstat, readFile } from 'node:fs/promises';
+import { cp, lstat, mkdir, readdir, readFile, rename, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { analyze, applyPlan, projectRoot, readProjectFile, SetupError } from './core.mjs';
@@ -22,6 +22,7 @@ import { finalizeSource } from './source-finalize.mjs';
 import { preflightSetup } from './preflight.mjs';
 import { planSettingsOnly, SETTINGS_ONLY_FILE } from './settings-only-setup.mjs';
 import { applyEnvironment, planEnvironment } from './setup-environment.mjs';
+import { themeConfiguration } from './theme.mjs';
 
 export const PAIRING_WAIT_MS = 10 * 60 * 1000;
 export const WEBSITE_WAIT_MS = 15 * 60 * 1000;
@@ -284,7 +285,8 @@ export async function redeem(cms, code, verifier, fetcher) {
   const data = body.data;
   const connection = validateConnection({ version: 1, apiOrigin: data.apiOrigin, siteId: data.siteId, environmentId: data.environmentId, locale: data.locale, websiteOrigin: data.websiteOrigin, adminOrigin: data.adminOrigin });
   if (typeof data.serverKey !== 'string' || !serverKey.test(data.serverKey)) fail('The CMS returned an unexpected response. No key was saved.');
-  return { connection, siteName: typeof data.siteName === 'string' ? data.siteName.slice(0, 100) : '', serverKey: data.serverKey };
+  const environment = { production: 'Live website', staging: 'Staging', development: 'Development' }[data.environment] ?? '';
+  return { connection, siteName: typeof data.siteName === 'string' ? data.siteName.slice(0, 100) : '', environment, serverKey: data.serverKey };
 }
 
 function describeRoute(route) { return route.path === '/' ? '/ (home page)' : route.path; }
@@ -377,6 +379,14 @@ export async function runGuided(directory, options, io) {
   const framework = typeof analysis.framework === 'string' && analysis.framework !== 'Unknown' ? analysis.framework : null;
   io.write(`✔ Found ${framework ? `a ${framework} website` : 'a website'} in ${path.basename(root)}\n`);
 
+  // A Universal CMS theme website only needs pairing and its private key.
+  if (await readProjectFile(root, THEME_FILE) !== null) {
+    const cms = cmsOrigin(options.cms ?? io.env.UNIVERSALCMS_URL ?? '') ?? fail('Add --cms with your Universal CMS address.');
+    const approval = options.code ? { code: options.code } : await waitForBrowserApproval({ cms, io, request: { origin: suggestedOrigin(manifest, null) ?? `http://localhost:${THEME_PORT}`, project: path.basename(root).slice(0, 80), framework: 'Universal CMS theme' } });
+    const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+    await connectTheme(root, paired, io);
+    return themeDone(root, paired.connection, await packageManager(root, manifest), false, io);
+  }
   const saved = await readConnection(root);
   const environment = await readSetupEnvironment(root);
   const installed = await readProjectFile(root, '.universalcms/website.integration.json') !== null;
@@ -413,7 +423,7 @@ export async function runGuided(directory, options, io) {
     mode = await prepareWebsite(root, approval.scope, manifest, framework, io);
   }
   const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
-  io.write(`✔ Connected to ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})\n`);
+  io.write(`✔ Connected to ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})${paired.environment ? ` · ${paired.environment} environment` : ''}\n`);
   if (mismatch(paired.connection)) fail(different);
   if (approval.scope && JSON.stringify(approval.scope) !== JSON.stringify(paired.connection)) fail('The approved website changed before connecting. Nothing was changed; run the same command again.');
   if (!approval.scope && !installed) mode = await prepareWebsite(root, paired.connection, manifest, framework, io);
@@ -442,6 +452,67 @@ export async function runGuided(directory, options, io) {
   return goLive(root, paired.connection, await manifestOf(root), io);
 }
 
+export const THEME_FILE = '.universalcms/theme.json';
+export const THEME_WEBSITE_FILE = '.universalcms/website.json';
+const THEME_PORT = 3100;
+
+/** Save the public theme connection and the private key after pairing. */
+async function connectTheme(root, paired, io) {
+  const { connection } = paired;
+  const environment = await planEnvironment(root, { ...Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, connection[name]])), apiKey: paired.serverKey });
+  await applyEnvironment(environment);
+  await mkdir(path.join(root, '.universalcms'), { recursive: true });
+  await writeFile(path.join(root, CONNECTION_FILE_PATH), `${JSON.stringify(connection, null, 2)}\n`);
+  await writeFile(path.join(root, THEME_WEBSITE_FILE), `${JSON.stringify(themeConfiguration(connection), null, 2)}\n`);
+  io.write('✔ Website connected and private key saved\n');
+}
+const CONNECTION_FILE_PATH = '.universalcms/connection.json';
+
+function themeDone(root, connection, manager, created, io) {
+  const pages = `${connection.adminOrigin}/sites/${connection.siteId}#setup?environmentId=${connection.environmentId}`;
+  io.write(`\n🎉 Your Universal CMS website is ready.\n\n   Start it:\n${created ? `     cd ${path.basename(root)}\n` : ''}     ${manager} run dev\n   Then open ${connection.websiteOrigin}\n\n`);
+  io.write(`   Manage everything from the CMS: ${pages}\n`);
+  io.write('   • Create a page with the slug "home" — it becomes your home page\n   • Pages and posts appear on the website when you publish them\n   • Menus, logo, colors and SEO: Appearance and SEO in the CMS\n');
+  return { connected: true, mode: 'theme', done: true };
+}
+
+/** `create <folder>`: start a new website rendered entirely from Universal CMS. */
+export async function runCreate(parent, name, options, io) {
+  if (typeof name !== 'string' || !/^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name)) fail('Choose a simple folder name for the new website, for example: my-website');
+  const root = path.resolve(parent, name);
+  try { if ((await readdir(root)).length) fail(`The folder ${name} already exists and is not empty. Choose another name.`); }
+  catch (error) { if (error instanceof SetupError) throw error; if (error.code !== 'ENOENT') throw error; }
+  const cms = cmsOrigin(options.cms ?? io.env.UNIVERSALCMS_URL ?? '') ?? await (async () => {
+    while (true) {
+      const value = cmsOrigin((await io.ask('Your Universal CMS address (for example https://cms.example.com): ')).trim());
+      if (value) return value;
+      io.write('Enter the address you use to sign in to the CMS.\n');
+    }
+  })();
+  io.write(`\nUniversal CMS · create a new website in ${name}\n`);
+  // Copy into a temporary sibling first so a failed copy never leaves a half-made folder.
+  const staging = `${root}.universalcms-${randomBytes(4).toString('hex')}`;
+  await cp(fileURLToPath(new URL('./templates/next-theme/', import.meta.url)), staging, { recursive: true, errorOnExist: true, force: false });
+  await rename(path.join(staging, 'gitignore.template'), path.join(staging, '.gitignore'));
+  const version = await connectorVersion();
+  const override = io.env.UNIVERSALCMS_CONNECT_PACKAGE;
+  if (override !== undefined && !/^[^\s'"`;&|<>$]{1,2048}$/.test(override)) fail('UNIVERSALCMS_CONNECT_PACKAGE must be a package spec, file path or URL without spaces.');
+  const manifest = { name: name.toLowerCase().replace(/[^a-z0-9._-]/g, '-'), private: true, version: '0.1.0', scripts: { dev: `next dev -p ${THEME_PORT}`, build: 'next build', start: `next start -p ${THEME_PORT}` },
+    dependencies: { '@universalcms/connect': override ?? `^${version}`, next: '^16.4.2', react: '^19.2.3', 'react-dom': '^19.2.3' },
+    devDependencies: { '@types/node': '^24.0.0', '@types/react': '^19.2.0', typescript: '^5.9.0' } };
+  await writeFile(path.join(staging, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+  await rename(staging, root);
+  io.write('✔ Website files created\n');
+  io.write('Installing packages (this can take a minute)…\n');
+  if (await io.run('npm', ['install', '--no-audit', '--no-fund'], root) !== 0) fail(`Packages could not be installed. Check your internet connection, then run:\n  cd ${name} && npm install\nand then: npx @universalcms/connect@latest`);
+  io.write('✔ Packages installed\n');
+  const approval = options.code ? { code: options.code } : await waitForBrowserApproval({ cms, io, request: { origin: `http://localhost:${THEME_PORT}`, project: name.slice(0, 80), framework: 'Universal CMS theme' } });
+  const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+  io.write(`✔ Approved: ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})\n`);
+  await connectTheme(root, paired, io);
+  return themeDone(root, paired.connection, 'npm', true, io);
+}
+
 /** Ask the running website's settings endpoint, as the CMS admin does. */
 async function settingsReady(connection, io) {
   try {
@@ -465,8 +536,8 @@ async function finishSettingsOnly(root, connection, manifest, io) {
     while (!ready && io.now() < deadline) { await io.sleep(3000); ready = await settingsReady(connection, io); }
     if (!ready) { io.write(`\nThe website at ${connection.websiteOrigin} is not serving CMS settings yet. Run this command again once it's running.\n`); return { connected: false, mode: 'settings-only' }; }
   }
-  const settings = `${connection.adminOrigin}/sites/${connection.siteId}`;
-  io.write(`✔ Your website is connected for site settings\n\n🎉 All done! Manage it from Universal CMS:\n   ${settings}\n`);
+  const settings = `${connection.adminOrigin}/sites/${connection.siteId}#setup?environmentId=${connection.environmentId}`;
+  io.write(`✔ Your website is connected for site settings\n\n🎉 All done! Manage it from Universal CMS (this link opens the right environment):\n   ${settings}\n`);
   io.write('   • SEO, branding, analytics, scripts, cookie consent and redirects apply automatically.\n');
   io.write('   • To show the CMS menu in your own header or footer, add one line where it should appear:\n');
   io.write("       import { CmsNavigation } from '@universalcms/connect/react-website';\n       <CmsNavigation location=\"header\" />   (or location=\"footer\")\n");

package/dist/settings-only.mjs

@@ -32,7 +32,12 @@ export function createSettingsOnlyHandler({ configuration, adminOrigin, env = ()
       if (origin !== admin || request.headers.has('authorization') || request.headers.has('cookie')) return reply({ error: 'Request not allowed' }, 403);
       const cors = { 'Access-Control-Allow-Origin': admin, Vary: 'Origin', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' };
       if (method === 'OPTIONS') return request.headers.get('access-control-request-method') === 'GET' && !request.headers.has('access-control-request-headers') ? reply(null, 204, cors) : reply({ error: 'Request not allowed' }, 403);
-      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) return reply({ error: 'Website scope mismatch' }, 409, cors);
+      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) {
+        // Tell the CMS which environment this website is connected to, so the
+        // admin can switch to it. Only public identifiers of the same website.
+        const sameSite = url.searchParams.get('siteId') === configuration.siteId;
+        return reply({ error: 'Website scope mismatch', ...(sameSite ? { siteId: configuration.siteId, environmentId: configuration.environmentId } : {}) }, 409, cors);
+      }
       const snapshot = await runtime.settings();
       return reply({ version: 1, mode: SETTINGS_ONLY_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false,
         settings: Object.fromEntries(WEBSITE_SECTIONS.map(section => [section, { installed: true, state: snapshot.sections[section]?.state ?? 'unavailable', version: snapshot.sections[section]?.version ?? 0 }])) }, 200, cors);

package/dist/templates/next-theme/.universalcms/theme.json

@@ -0,0 +1,4 @@
+{
+  "version": 1,
+  "theme": "next-starter"
+}

package/dist/templates/next-theme/README.md

@@ -0,0 +1,14 @@
+# Universal CMS website
+
+Every page, post, menu, logo and SEO setting of this website is managed in
+Universal CMS. Start it with:
+
+```sh
+npm run dev
+```
+
+The home page is the CMS page with the slug `home`. Pages and posts appear at
+the URLs set in the CMS (SEO → URL patterns) once they are published.
+
+Connection values live in `.universalcms/`; the private website key lives only in
+`.env.local`. To reconnect, run `npx @universalcms/connect@latest`.

package/dist/templates/next-theme/app/[[...cmsPath]]/page.tsx

@@ -0,0 +1,43 @@
+// Every URL is rendered from published Universal CMS content.
+import { cache } from 'react';
+import { connection } from 'next/server';
+import { notFound, permanentRedirect, redirect } from 'next/navigation';
+import { websiteMetadata } from '@universalcms/connect/website-runtime';
+import { CmsWebsitePage } from '@universalcms/connect/react-website';
+import { configuration, runtime, scope } from '../../lib/universalcms';
+
+const settings = cache(async () => { await connection(); return runtime.settings(); });
+const read = cache(async (pathname: string) => { await connection(); return runtime.page(pathname); });
+const load = cache(async (pathname: string) => {
+  const result = await read(pathname);
+  if (result.state === 'redirect') { const target = result as { location: string; status?: number }; if (target.status === 301 || target.status === 308) permanentRedirect(target.location); redirect(target.location); }
+  if (result.state === 'missing' || result.state === 'unmanaged' || result.state === 'gone') notFound();
+  if (result.state !== 'published' && result.state !== 'archive') throw new Error('Website content is temporarily unavailable');
+  return result;
+});
+type Props = { params: Promise<{ cmsPath?: string[] }> };
+const pathOf = async (params: Props['params']) => '/' + ((await params).cmsPath ?? []).join('/');
+
+export async function generateMetadata({ params }: Props) {
+  // Metadata never throws: the page itself decides between content, redirect and 404.
+  const pathname = await pathOf(params), result = await read(pathname), snapshot = await settings();
+  if (result.state !== 'published' && result.state !== 'archive') return {};
+  const entry = result.state === 'published' ? result.entry : null;
+  const archiveTitle = result.state === 'archive' ? (result as { title: string }).title : undefined;
+  if (snapshot.sections.seo.state !== 'ready') return { title: archiveTitle ?? entry?.document.title, description: entry?.document.excerpt };
+  const value = websiteMetadata(entry, snapshot, pathname, configuration.websiteOrigin);
+  return {
+    title: archiveTitle ?? value.title, description: value.description, robots: value.robots,
+    alternates: { canonical: value.canonical, languages: Object.fromEntries((value.alternates ?? []).map(item => [item.locale, item.url])) },
+    openGraph: value.openGraph ? { ...value.openGraph, images: value.openGraph.image ? [value.openGraph.image] : undefined } : undefined,
+  };
+}
+
+export default async function Page({ params }: Props) {
+  const pathname = await pathOf(params), result = await load(pathname), snapshot = await settings();
+  const structured = websiteMetadata(result.state === 'published' ? result.entry : null, snapshot, pathname, configuration.websiteOrigin).jsonLd;
+  return <>
+    {structured && <script type="application/ld+json" data-universalcms-setting="seo" dangerouslySetInnerHTML={{ __html: JSON.stringify(structured).replace(/</g, '\\u003c') }}/>}
+    <CmsWebsitePage pathname={pathname} scope={scope} initialResult={result} initialSettings={snapshot}/>
+  </>;
+}

package/dist/templates/next-theme/app/api/universalcms/[endpoint]/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/app/globals.css

@@ -0,0 +1,12 @@
+/* Universal CMS theme base styles. Brand colors come from CMS Branding. */
+:root { --cms-website-accent: #4f46e5; color-scheme: light; }
+* { box-sizing: border-box; }
+body { margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; line-height: 1.6; color: #0f172a; background: #fff; }
+.cms-website { min-height: 100vh; display: flex; flex-direction: column; }
+.cms-website > :not(header):not(footer) { flex: 1; width: 100%; max-width: 1100px; margin: 0 auto; padding: 32px 20px 64px; }
+.cms-website-header, .cms-website-footer { display: flex; flex-wrap: wrap; align-items: center; gap: 16px 28px; padding: 16px max(20px, calc((100% - 1100px) / 2)); }
+.cms-website-header { border-bottom: 1px solid #e2e8f0; }
+.cms-website-footer { border-top: 1px solid #e2e8f0; color: #475569; font-size: 14px; }
+a { color: var(--cms-website-accent); }
+img { max-width: 100%; height: auto; }
+h1 { font-size: clamp(2rem, 4vw, 3rem); line-height: 1.15; margin: 0 0 16px; }

package/dist/templates/next-theme/app/layout.tsx

@@ -0,0 +1,11 @@
+import type { ReactNode } from 'react';
+import '@universalcms/connect/website.css';
+import './globals.css';
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

package/dist/templates/next-theme/app/not-found.tsx

@@ -0,0 +1,9 @@
+import { connection } from 'next/server';
+import { CmsExperience, CmsWebsite } from '@universalcms/connect/react-website';
+import { runtime, scope } from '../lib/universalcms';
+
+export default async function NotFound() {
+  await connection();
+  const settings = await runtime.settings();
+  return <CmsWebsite scope={scope} initialSettings={settings} applyTemplate={false}><main><CmsExperience notFound /></main></CmsWebsite>;
+}

package/dist/templates/next-theme/app/robots.txt/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/app/sitemap.xml/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/gitignore.template

@@ -0,0 +1,4 @@
+node_modules
+.next
+.env.local
+/.universalcms-private-*.tmp

package/dist/templates/next-theme/lib/universalcms.ts

@@ -0,0 +1,10 @@
+// Universal CMS theme: shared runtime. Connection values are public; the
+// website key is read from .env.local on the server only.
+import { createThemeRuntime } from '@universalcms/connect/theme';
+import website from '../.universalcms/website.json';
+import connection from '../.universalcms/connection.json';
+
+export const configuration = website as Parameters<typeof createThemeRuntime>[0]['configuration'];
+export const adminOrigin = connection.adminOrigin;
+export const scope = `${website.siteId}:${website.environmentId}`;
+export const runtime = createThemeRuntime({ configuration });

package/dist/templates/next-theme/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/dev/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/dist/templates/next-theme/next.config.mjs

@@ -0,0 +1 @@
+export default { htmlLimitedBots: /.*/ };

package/dist/templates/next-theme/tsconfig.json

@@ -0,0 +1,35 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "incremental": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "allowJs": true
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/dist/theme.d.mts

@@ -0,0 +1,6 @@
+import type { createWebsiteRuntime } from './website-runtime.mjs';
+export const THEME_MODE: 'theme';
+export type ThemeConfiguration = { version: 1; apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; routes: { path: string; kind: string; slug: string; locale: string }[] };
+export function themeConfiguration(connection: { apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; locale?: string }): ThemeConfiguration;
+export function createThemeRuntime(options: { configuration: ThemeConfiguration; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): ReturnType<typeof createWebsiteRuntime>;
+export function createThemeHandler(options: { configuration: ThemeConfiguration; adminOrigin: string; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): (request: Request) => Promise<Response>;

package/dist/theme.mjs

@@ -0,0 +1,50 @@
+/**
+ * Universal CMS theme runtime: every URL of the website is rendered from
+ * published CMS content. The home page is the page with slug `home`; all other
+ * paths follow the CMS URL patterns (pages, posts, categories, tags).
+ */
+import { createWebsiteRuntime } from './website-runtime.mjs';
+import { createWebsiteRequestHandler, WEBSITE_SECTIONS, WEBSITE_SETTINGS_PATH } from './website-http.mjs';
+
+export const THEME_MODE = 'theme';
+
+/** Publication configuration for a theme website: only the home page needs a fixed route. */
+export function themeConfiguration({ apiOrigin, siteId, environmentId, websiteOrigin, locale = 'en' }) {
+  return { version: 1, apiOrigin, siteId, environmentId, websiteOrigin, routes: [{ path: '/', kind: 'page', slug: 'home', locale }] };
+}
+
+export function createThemeRuntime({ configuration, env = () => process.env, fetcher = globalThis.fetch }) {
+  return createWebsiteRuntime({ configuration, env, fetcher });
+}
+
+/**
+ * Serves /api/universalcms/{settings,page,document}, /sitemap.xml and /robots.txt
+ * through the shared website handler, and answers the CMS admin connection check.
+ */
+export function createThemeHandler({ configuration, adminOrigin, env = () => process.env, fetcher = globalThis.fetch }) {
+  const website = createWebsiteRequestHandler({ configuration, env, fetcher });
+  const runtime = createThemeRuntime({ configuration, env, fetcher });
+  const admin = new URL(adminOrigin).origin;
+  if (admin !== adminOrigin) throw new Error('Invalid CMS admin origin');
+  const json = (body, status, extra = {}) => new Response(body === null ? null : JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', ...extra } });
+  return async function handle(request) {
+    const url = new URL(request.url);
+    if (url.pathname === WEBSITE_SETTINGS_PATH && url.searchParams.get('check') === 'connection') {
+      const origin = request.headers.get('origin');
+      if (origin !== admin || request.headers.has('authorization') || request.headers.has('cookie')) return json({ error: 'Request not allowed' }, 403);
+      const cors = { 'Access-Control-Allow-Origin': admin, Vary: 'Origin', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' };
+      if (request.method === 'OPTIONS') return request.headers.get('access-control-request-method') === 'GET' && !request.headers.has('access-control-request-headers') ? json(null, 204, cors) : json({ error: 'Request not allowed' }, 403);
+      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) {
+        // Tell the CMS which environment this website is connected to, so the
+        // admin can switch to it. Only public identifiers of the same website.
+        const sameSite = url.searchParams.get('siteId') === configuration.siteId;
+        return json({ error: 'Website scope mismatch', ...(sameSite ? { siteId: configuration.siteId, environmentId: configuration.environmentId } : {}) }, 409, cors);
+      }
+      const snapshot = await runtime.settings();
+      return json({ version: 1, mode: THEME_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false,
+        settings: Object.fromEntries(WEBSITE_SECTIONS.map(section => [section, { installed: true, state: snapshot.sections[section]?.state ?? 'unavailable', version: snapshot.sections[section]?.version ?? 0 }])) }, 200, cors);
+    }
+    const result = await website(request);
+    return result instanceof Response ? result : json({ error: 'Not found' }, 404);
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@universalcms/connect",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "description": "Deterministic framework-aware Universal CMS setup for reviewed native websites",
   "type": "module",
   "bin": {
@@ -31,7 +31,8 @@
     "./static-runtime": "./dist/static-runtime.mjs",
     "./website.css": "./dist/website.css",
     "./public-bindings": "./dist/public-bindings.mjs",
-    "./settings-only": "./dist/settings-only.mjs"
+    "./settings-only": "./dist/settings-only.mjs",
+    "./theme": "./dist/theme.mjs"
   },
   "files": [
     "dist",
@@ -42,7 +43,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/settings-only.mjs && node --check src/settings-only-setup.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
+    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/settings-only.mjs && node --check src/theme.mjs && node --check src/settings-only-setup.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
     "prepack": "node scripts/build.mjs"
   },
   "publishConfig": {