@universalcms/connect 0.13.1 → 0.13.3

package/README.md

@@ -1,7 +1,7 @@
 # @universalcms/connect
 
 Local, deterministic website setup without AI. Universal CMS stays hosted; this
-package creates a website integration, not a CMS installation. Version 0.13.1 is
+package creates a website integration, not a CMS installation. Version 0.13.3 is
 prepared locally; this repository does not establish its public npm availability.
 
 ## Quick start
@@ -262,7 +262,7 @@ custom adapter still requires review, not forced overwriting.
 For an operator's downloaded artifact, the installation is:
 
 ```sh
-npm install --save-prod ./vendor/universalcms-connect-0.13.1.tgz
+npm install --save-prod ./vendor/universalcms-connect-0.13.3.tgz
 ```
 
 Use your project's package manager. These paths are examples for downloaded
@@ -539,7 +539,7 @@ npx --no-install universalcms-connect init \
   --environment 22222222-2222-4222-8222-222222222222
 ```
 
-After a public release, `npx @universalcms/connect@0.13.1 init` is the equivalent
+After a public release, `npx @universalcms/connect@0.13.3 init` is the equivalent
 registry entry point. Copy the real IDs/API origin from **Developer setup**.
 Missing values are prompted in a terminal; `--non-interactive` fails instead.
 Init prints a plan. Run the same command with `--apply` after reviewing it.
@@ -589,7 +589,7 @@ The CMS button reads the website's **`/api/cms-source`** endpoint. Current Next.
 prepares delivery scaffolding. React/Vite setup serves its reviewed public manifest through the normal dev command.
 Custom exporters need their explicit adapter; a delivery check alone is insufficient.
 
-Use the CMS's reviewed 0.13.1 package for the staged commands and current source
+Use the CMS's reviewed 0.13.3 package for the staged commands and current source
 discovery. Review source diagnostics and complete public
 mappings for unsupported pages. Restart the website using its normal server command, then run:
 

package/dist/cli.mjs

@@ -18,9 +18,9 @@ import { setupWebsiteSettings } from './website-setup.mjs';
 import { checkWebsiteSettings } from './website-check.mjs';
 import { WEBSITE_SECTIONS } from './website-http.mjs';
 import { setupSource, applySourcePlan, syncSource, readSourceSettings } from './source-setup.mjs';
-import { processIo, runGuided } from './guided.mjs';
+import { processIo, runCreate, runGuided } from './guided.mjs';
 
-const help = `Universal CMS connector 0.13.1
+const help = `Universal CMS connector 0.13.3
 
 Quick start (recommended) — run in your website folder:
   npx @universalcms/connect@latest --cms https://YOUR_CMS_ADDRESS
@@ -34,6 +34,9 @@ Quick start (recommended) — run in your website folder:
   --code <code>            One-time code from Developer setup → Connect without a browser
   --details                Show every file and technical message
 
+New website managed entirely from the CMS (pages, posts, menus, design):
+  npx @universalcms/connect@latest create my-website --cms https://YOUR_CMS_ADDRESS
+
 Individual steps (advanced):
 Usage: universalcms-connect <start|inspect-pages|review-pages|preflight|review-routes|review-layout|connect|setup|setup-settings|check-settings|server-key|setup-source|sync-source|finalize-source|analyze|init|check|check-source|check-publication> [options]
 
@@ -347,6 +350,14 @@ function guidedArguments(args) {
 async function main() {
   if (process.argv.slice(2).some(value => value === '--help' || value === '-h')) { process.stdout.write(help); return; }
   const first = process.argv[2];
+  if (first === 'create') {
+    const rest = process.argv.slice(3), name = rest[0] && !rest[0].startsWith('--') ? rest.shift() : undefined;
+    const options = guidedArguments(rest);
+    if (!process.stdin.isTTY || !process.stderr.isTTY) throw new SetupError('This setup needs an interactive terminal.');
+    const io = processIo({ ask, write: value => process.stdout.write(value) });
+    await runCreate(process.cwd(), name ?? (await ask('Folder name for the new website: ')).trim(), { cms: options['--cms'], code: options['--code'] }, io);
+    return;
+  }
   if (first === undefined || first === 'start' || first.startsWith('--')) {
     // The one-time pairing code is the only accepted credential-like argument:
     // it expires in ten minutes, works once and never reaches project files.

package/dist/guided.mjs

@@ -9,7 +9,7 @@
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
-import { lstat, readFile } from 'node:fs/promises';
+import { cp, lstat, mkdir, readdir, readFile, rename, writeFile } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { analyze, applyPlan, projectRoot, readProjectFile, SetupError } from './core.mjs';
@@ -22,6 +22,7 @@ import { finalizeSource } from './source-finalize.mjs';
 import { preflightSetup } from './preflight.mjs';
 import { planSettingsOnly, SETTINGS_ONLY_FILE } from './settings-only-setup.mjs';
 import { applyEnvironment, planEnvironment } from './setup-environment.mjs';
+import { themeConfiguration } from './theme.mjs';
 
 export const PAIRING_WAIT_MS = 10 * 60 * 1000;
 export const WEBSITE_WAIT_MS = 15 * 60 * 1000;
@@ -284,7 +285,8 @@ export async function redeem(cms, code, verifier, fetcher) {
   const data = body.data;
   const connection = validateConnection({ version: 1, apiOrigin: data.apiOrigin, siteId: data.siteId, environmentId: data.environmentId, locale: data.locale, websiteOrigin: data.websiteOrigin, adminOrigin: data.adminOrigin });
   if (typeof data.serverKey !== 'string' || !serverKey.test(data.serverKey)) fail('The CMS returned an unexpected response. No key was saved.');
-  return { connection, siteName: typeof data.siteName === 'string' ? data.siteName.slice(0, 100) : '', serverKey: data.serverKey };
+  const environment = { production: 'Live website', staging: 'Staging', development: 'Development' }[data.environment] ?? '';
+  return { connection, siteName: typeof data.siteName === 'string' ? data.siteName.slice(0, 100) : '', environment, serverKey: data.serverKey };
 }
 
 function describeRoute(route) { return route.path === '/' ? '/ (home page)' : route.path; }
@@ -377,11 +379,34 @@ export async function runGuided(directory, options, io) {
   const framework = typeof analysis.framework === 'string' && analysis.framework !== 'Unknown' ? analysis.framework : null;
   io.write(`✔ Found ${framework ? `a ${framework} website` : 'a website'} in ${path.basename(root)}\n`);
 
+  // A Universal CMS theme website only needs pairing and its private key.
+  if (await readProjectFile(root, THEME_FILE) !== null) {
+    const cms = cmsOrigin(options.cms ?? io.env.UNIVERSALCMS_URL ?? '') ?? fail('Add --cms with your Universal CMS address.');
+    const approval = options.code ? { code: options.code } : await waitForBrowserApproval({ cms, io, request: { origin: suggestedOrigin(manifest, null) ?? `http://localhost:${THEME_PORT}`, project: path.basename(root).slice(0, 80), framework: 'Universal CMS theme' } });
+    const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+    await connectTheme(root, paired, io);
+    return themeDone(root, paired.connection, await packageManager(root, manifest), false, io);
+  }
   const saved = await readConnection(root);
   const environment = await readSetupEnvironment(root);
   const installed = await readProjectFile(root, '.universalcms/website.integration.json') !== null;
   if (saved && environment.keyConfigured && !options.code && await readProjectFile(root, SETTINGS_ONLY_FILE) !== null) {
     io.write(`✔ Already connected for site settings (${saved.websiteOrigin})\n`);
+    // Bring generated files up to date with this connector version.
+    const update = await planSettingsOnly(root, Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, saved[name]])));
+    const stale = update.files.filter(file => file.state !== 'unchanged');
+    if (stale.length) {
+      await ensureConnector(root, manifest, io);
+      io.write(`\nThis connector version updates ${stale.length} Universal CMS file${stale.length === 1 ? '' : 's'} in your website (your pages and design stay the same):\n`);
+      for (const file of stale) io.write(`  ${file.state}: ${file.path}\n`);
+      if (yes(await io.ask('Update them? [Y/n] '))) {
+        const again = await planSettingsOnly(root, update.connection);
+        if (JSON.stringify(again.files) !== JSON.stringify(update.files)) fail('Your website files changed while reviewing. Nothing was saved; run the same command again.');
+        await applyPlan(update);
+        io.write('✔ Universal CMS files updated — restart your website to load them\n');
+        return finishSettingsOnly(root, saved, await manifestOf(root), io, true);
+      }
+    }
     return finishSettingsOnly(root, saved, manifest, io);
   }
   if (saved && installed && environment.keyConfigured && !options.code) {
@@ -413,7 +438,7 @@ export async function runGuided(directory, options, io) {
     mode = await prepareWebsite(root, approval.scope, manifest, framework, io);
   }
   const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
-  io.write(`✔ Connected to ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})\n`);
+  io.write(`✔ Connected to ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})${paired.environment ? ` · ${paired.environment} environment` : ''}\n`);
   if (mismatch(paired.connection)) fail(different);
   if (approval.scope && JSON.stringify(approval.scope) !== JSON.stringify(paired.connection)) fail('The approved website changed before connecting. Nothing was changed; run the same command again.');
   if (!approval.scope && !installed) mode = await prepareWebsite(root, paired.connection, manifest, framework, io);
@@ -442,6 +467,67 @@ export async function runGuided(directory, options, io) {
   return goLive(root, paired.connection, await manifestOf(root), io);
 }
 
+export const THEME_FILE = '.universalcms/theme.json';
+export const THEME_WEBSITE_FILE = '.universalcms/website.json';
+const THEME_PORT = 3100;
+
+/** Save the public theme connection and the private key after pairing. */
+async function connectTheme(root, paired, io) {
+  const { connection } = paired;
+  const environment = await planEnvironment(root, { ...Object.fromEntries(['apiOrigin', 'siteId', 'environmentId', 'locale', 'websiteOrigin', 'adminOrigin'].map(name => [name, connection[name]])), apiKey: paired.serverKey });
+  await applyEnvironment(environment);
+  await mkdir(path.join(root, '.universalcms'), { recursive: true });
+  await writeFile(path.join(root, CONNECTION_FILE_PATH), `${JSON.stringify(connection, null, 2)}\n`);
+  await writeFile(path.join(root, THEME_WEBSITE_FILE), `${JSON.stringify(themeConfiguration(connection), null, 2)}\n`);
+  io.write('✔ Website connected and private key saved\n');
+}
+const CONNECTION_FILE_PATH = '.universalcms/connection.json';
+
+function themeDone(root, connection, manager, created, io) {
+  const pages = `${connection.adminOrigin}/sites/${connection.siteId}#setup?environmentId=${connection.environmentId}`;
+  io.write(`\n🎉 Your Universal CMS website is ready.\n\n   Start it:\n${created ? `     cd ${path.basename(root)}\n` : ''}     ${manager} run dev\n   Then open ${connection.websiteOrigin}\n\n`);
+  io.write(`   Manage everything from the CMS: ${pages}\n`);
+  io.write('   • Create a page with the slug "home" — it becomes your home page\n   • Pages and posts appear on the website when you publish them\n   • Menus, logo, colors and SEO: Appearance and SEO in the CMS\n');
+  return { connected: true, mode: 'theme', done: true };
+}
+
+/** `create <folder>`: start a new website rendered entirely from Universal CMS. */
+export async function runCreate(parent, name, options, io) {
+  if (typeof name !== 'string' || !/^[a-z0-9][a-z0-9._-]{0,63}$/i.test(name)) fail('Choose a simple folder name for the new website, for example: my-website');
+  const root = path.resolve(parent, name);
+  try { if ((await readdir(root)).length) fail(`The folder ${name} already exists and is not empty. Choose another name.`); }
+  catch (error) { if (error instanceof SetupError) throw error; if (error.code !== 'ENOENT') throw error; }
+  const cms = cmsOrigin(options.cms ?? io.env.UNIVERSALCMS_URL ?? '') ?? await (async () => {
+    while (true) {
+      const value = cmsOrigin((await io.ask('Your Universal CMS address (for example https://cms.example.com): ')).trim());
+      if (value) return value;
+      io.write('Enter the address you use to sign in to the CMS.\n');
+    }
+  })();
+  io.write(`\nUniversal CMS · create a new website in ${name}\n`);
+  // Copy into a temporary sibling first so a failed copy never leaves a half-made folder.
+  const staging = `${root}.universalcms-${randomBytes(4).toString('hex')}`;
+  await cp(fileURLToPath(new URL('./templates/next-theme/', import.meta.url)), staging, { recursive: true, errorOnExist: true, force: false });
+  await rename(path.join(staging, 'gitignore.template'), path.join(staging, '.gitignore'));
+  const version = await connectorVersion();
+  const override = io.env.UNIVERSALCMS_CONNECT_PACKAGE;
+  if (override !== undefined && !/^[^\s'"`;&|<>$]{1,2048}$/.test(override)) fail('UNIVERSALCMS_CONNECT_PACKAGE must be a package spec, file path or URL without spaces.');
+  const manifest = { name: name.toLowerCase().replace(/[^a-z0-9._-]/g, '-'), private: true, version: '0.1.0', scripts: { dev: `next dev -p ${THEME_PORT}`, build: 'next build', start: `next start -p ${THEME_PORT}` },
+    dependencies: { '@universalcms/connect': override ?? `^${version}`, next: '^16.4.2', react: '^19.2.3', 'react-dom': '^19.2.3' },
+    devDependencies: { '@types/node': '^24.0.0', '@types/react': '^19.2.0', typescript: '^5.9.0' } };
+  await writeFile(path.join(staging, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+  await rename(staging, root);
+  io.write('✔ Website files created\n');
+  io.write('Installing packages (this can take a minute)…\n');
+  if (await io.run('npm', ['install', '--no-audit', '--no-fund'], root) !== 0) fail(`Packages could not be installed. Check your internet connection, then run:\n  cd ${name} && npm install\nand then: npx @universalcms/connect@latest`);
+  io.write('✔ Packages installed\n');
+  const approval = options.code ? { code: options.code } : await waitForBrowserApproval({ cms, io, request: { origin: `http://localhost:${THEME_PORT}`, project: name.slice(0, 80), framework: 'Universal CMS theme' } });
+  const paired = await redeem(cms, approval.code, approval.verifier, io.fetch);
+  io.write(`✔ Approved: ${paired.siteName || 'your website'} (${paired.connection.websiteOrigin})\n`);
+  await connectTheme(root, paired, io);
+  return themeDone(root, paired.connection, 'npm', true, io);
+}
+
 /** Ask the running website's settings endpoint, as the CMS admin does. */
 async function settingsReady(connection, io) {
   try {
@@ -449,12 +535,12 @@ async function settingsReady(connection, io) {
     url.search = new URLSearchParams({ check: 'connection', siteId: connection.siteId, environmentId: connection.environmentId }).toString();
     const response = await io.fetch(url, { headers: { Origin: connection.adminOrigin, Accept: 'application/json' }, redirect: 'error', signal: AbortSignal.timeout(10000) });
     const body = response.ok ? await response.json() : null;
-    return body?.mode === 'settings-only' && body.siteId === connection.siteId && body.environmentId === connection.environmentId;
+    return body?.mode === 'settings-only' && body.siteId === connection.siteId && body.environmentId === connection.environmentId && body.discovered?.version === 1;
   } catch { return false; }
 }
 
-async function finishSettingsOnly(root, connection, manifest, io) {
-  if (!await settingsReady(connection, io)) {
+async function finishSettingsOnly(root, connection, manifest, io, restart = false) {
+  if (restart || !await settingsReady(connection, io)) {
     const local = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:|$)/.test(connection.websiteOrigin), command = await restartHint(root, manifest);
     io.write(local
       ? `\n→ Restart your website so the changes take effect:\n   1. In the terminal where your website is running, press Ctrl+C\n   2. Start it again${command ? ` with: ${command}` : ''}\n   It must run at ${connection.websiteOrigin}\n`
@@ -465,9 +551,9 @@ async function finishSettingsOnly(root, connection, manifest, io) {
     while (!ready && io.now() < deadline) { await io.sleep(3000); ready = await settingsReady(connection, io); }
     if (!ready) { io.write(`\nThe website at ${connection.websiteOrigin} is not serving CMS settings yet. Run this command again once it's running.\n`); return { connected: false, mode: 'settings-only' }; }
   }
-  const settings = `${connection.adminOrigin}/sites/${connection.siteId}`;
-  io.write(`✔ Your website is connected for site settings\n\n🎉 All done! Manage it from Universal CMS:\n   ${settings}\n`);
-  io.write('   • SEO, branding, analytics, scripts, cookie consent and redirects apply automatically.\n');
+  const settings = `${connection.adminOrigin}/sites/${connection.siteId}#setup?environmentId=${connection.environmentId}`;
+  io.write(`✔ Your website is connected for site settings\n\n🎉 All done! Manage it from Universal CMS (this link opens the right environment):\n   ${settings}\n`);
+  io.write('   • In Developer setup, import the pages and header/footer links found on your website, so they appear in the CMS.\n   • Page text stays in your website\'s code; each page\'s SEO (title, description, social image) and your menus, logo, analytics, scripts and redirects are managed in the CMS.\n');
   io.write('   • To show the CMS menu in your own header or footer, add one line where it should appear:\n');
   io.write("       import { CmsNavigation } from '@universalcms/connect/react-website';\n       <CmsNavigation location=\"header\" />   (or location=\"footer\")\n");
   io.write('     Other drop-ins: <CmsBranding />, <CmsSocialLinks />, and useWebsiteSettings() for anything custom.\n');

package/dist/settings-only-setup.mjs

@@ -8,6 +8,7 @@ import ts from './vendor/typescript.cjs';
 import { projectRoot, readProjectFile, SetupError } from './project-files.mjs';
 import { inspectSourceRoutes } from './source-routes.mjs';
 import { CONNECTION_FILE, validateConnection } from './staged-setup.mjs';
+import { discoverSite, DISCOVERED_FILE } from './site-discovery.mjs';
 
 export const SETTINGS_ONLY_FILE = '.universalcms/settings-only.json';
 const fail = message => { throw new SetupError(message); };
@@ -45,8 +46,9 @@ const settingsRoute = (app, file) => `${MARK} Site settings served to the websit
 import { createSettingsOnlyHandler } from '@universalcms/connect/settings-only';
 import configuration from '${relative(file, SETTINGS_ONLY_FILE)}';
 import connection from '${relative(file, CONNECTION_FILE)}';
+import discovered from '${relative(file, DISCOVERED_FILE)}';
 
-const handle = createSettingsOnlyHandler({ configuration: configuration as Parameters<typeof createSettingsOnlyHandler>[0]['configuration'], adminOrigin: connection.adminOrigin });
+const handle = createSettingsOnlyHandler({ configuration: configuration as Parameters<typeof createSettingsOnlyHandler>[0]['configuration'], adminOrigin: connection.adminOrigin, discovered });
 export const dynamic = 'force-dynamic';
 export const GET = handle;
 export const HEAD = handle;
@@ -84,6 +86,10 @@ export async function planSettingsOnly(directory, connectionInput) {
   };
   await add(CONNECTION_FILE, json(connection));
   await add(SETTINGS_ONLY_FILE, json({ version: 1, apiOrigin: connection.apiOrigin, siteId: connection.siteId, environmentId: connection.environmentId, websiteOrigin: connection.websiteOrigin, routes: [] }));
+  // Public page titles and header/footer links found in the source; the CMS offers to import them.
+  const discovered = await discoverSite(root);
+  const previousDiscovery = await readProjectFile(root, DISCOVERED_FILE), discoveryContent = json(discovered);
+  files.push({ path: DISCOVERED_FILE, content: discoveryContent, state: previousDiscovery === null ? 'create' : previousDiscovery === discoveryContent ? 'unchanged' : 'update', ...(previousDiscovery !== null && previousDiscovery !== discoveryContent ? { previous: previousDiscovery } : {}) });
   for (const name of ['settings', 'page']) { const path = `${app}/api/universalcms/${name}/route.${ext}`; await add(path, settingsRoute(app, path).replace(typed ? '' : / as Parameters<[^>]+>\[0\]\['configuration'\]/, '')); }
   const wrapper = `${app}/universalcms.settings.${typed ? 'tsx' : 'jsx'}`;
   await add(wrapper, wrapperTemplate(wrapper, typed));

package/dist/settings-only.d.mts

@@ -1,4 +1,4 @@
 export const SETTINGS_ONLY_MODE: 'settings-only';
 export type SettingsOnlyConfiguration = { version: 1; apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; routes: [] };
-export function createSettingsOnlyHandler(options: { configuration: SettingsOnlyConfiguration; adminOrigin: string; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): (request: Request) => Promise<Response>;
+export function createSettingsOnlyHandler(options: { configuration: SettingsOnlyConfiguration; adminOrigin: string; discovered?: unknown; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): (request: Request) => Promise<Response>;
 export function createSettingsOnlyRuntime(options: { configuration: SettingsOnlyConfiguration; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): { settings(): Promise<unknown> };

package/dist/settings-only.mjs

@@ -6,6 +6,7 @@
  */
 import { createWebsiteRuntime } from './website-runtime.mjs';
 import { WEBSITE_PAGE_PATH, WEBSITE_SECTIONS, WEBSITE_SETTINGS_PATH } from './website-http.mjs';
+import { normalizePublicationPath, publicationRevision } from './publication.mjs';
 
 export const SETTINGS_ONLY_MODE = 'settings-only';
 const base = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', 'Referrer-Policy': 'no-referrer' };
@@ -13,7 +14,17 @@ const base = { 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff',
 /**
  * @param {{ configuration: { version: 1, apiOrigin: string, siteId: string, environmentId: string, websiteOrigin: string, routes: [] }, adminOrigin: string, env?: () => Record<string, string | undefined>, fetcher?: typeof fetch }} options
  */
-export function createSettingsOnlyHandler({ configuration, adminOrigin, env = () => process.env, fetcher = globalThis.fetch }) {
+const short = (value, max) => typeof value === 'string' ? value.slice(0, max) : '';
+/** Only bounded public strings from the website source reach the admin. */
+function publicDiscovery(value) {
+  if (!value || value.version !== 1) return undefined;
+  const link = item => ({ label: short(item?.label, 80), url: short(item?.url, 200) });
+  return { version: 1, pages: (Array.isArray(value.pages) ? value.pages : []).slice(0, 100).map(page => ({ path: short(page?.path, 200), title: short(page?.title, 120), description: short(page?.description, 320) })),
+    navigation: { header: (value.navigation?.header ?? []).slice(0, 20).map(link), footer: (value.navigation?.footer ?? []).slice(0, 20).map(link) } };
+}
+
+export function createSettingsOnlyHandler({ configuration, adminOrigin, discovered, env = () => process.env, fetcher = globalThis.fetch }) {
+  const discovery = publicDiscovery(discovered);
   const runtime = createWebsiteRuntime({ configuration, settingsOnly: true, env, fetcher });
   const admin = new URL(adminOrigin).origin;
   if (admin !== adminOrigin) throw new Error('Invalid CMS admin origin');
@@ -21,9 +32,16 @@ export function createSettingsOnlyHandler({ configuration, adminOrigin, env = ()
     const method = request.method, url = new URL(request.url), origin = request.headers.get('origin');
     const reply = (body, status = 200, extra = {}) => new Response(method === 'HEAD' || status === 204 ? null : JSON.stringify(body), { status, headers: { ...base, 'Content-Type': 'application/json', ...extra } });
     if (url.pathname === WEBSITE_PAGE_PATH) {
-      // Every page belongs to the website in settings-only mode.
+      // The website renders every page. A published CMS page at the same path
+      // supplies only its SEO metadata (title, description, social tags).
       if (!['GET', 'HEAD'].includes(method)) return reply({ error: 'Method not allowed' }, 405, { Allow: 'GET, HEAD' });
-      return reply({ state: 'missing' }, 404);
+      if (origin && origin !== configuration.websiteOrigin || request.headers.get('sec-fetch-site') === 'cross-site') return reply({ error: 'Request not allowed' }, 403);
+      let pathname;
+      try { pathname = normalizePublicationPath(url.searchParams.get('path') ?? ''); } catch { return reply({ state: 'missing' }, 404); }
+      const result = await runtime.page(pathname === '/' ? '/home' : pathname);
+      if (result.state !== 'published') return reply({ state: result.state === 'unavailable' ? 'unavailable' : 'missing' }, result.state === 'unavailable' ? 503 : 404);
+      const entry = { ...result.entry, path: pathname };
+      return reply({ ...result, path: pathname, entry, revision: publicationRevision(entry) });
     }
     if (url.pathname !== WEBSITE_SETTINGS_PATH) return reply({ error: 'Not found' }, 404);
     const diagnostic = url.searchParams.get('check') === 'connection';
@@ -32,9 +50,14 @@ export function createSettingsOnlyHandler({ configuration, adminOrigin, env = ()
       if (origin !== admin || request.headers.has('authorization') || request.headers.has('cookie')) return reply({ error: 'Request not allowed' }, 403);
       const cors = { 'Access-Control-Allow-Origin': admin, Vary: 'Origin', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' };
       if (method === 'OPTIONS') return request.headers.get('access-control-request-method') === 'GET' && !request.headers.has('access-control-request-headers') ? reply(null, 204, cors) : reply({ error: 'Request not allowed' }, 403);
-      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) return reply({ error: 'Website scope mismatch' }, 409, cors);
+      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) {
+        // Tell the CMS which environment this website is connected to, so the
+        // admin can switch to it. Only public identifiers of the same website.
+        const sameSite = url.searchParams.get('siteId') === configuration.siteId;
+        return reply({ error: 'Website scope mismatch', ...(sameSite ? { siteId: configuration.siteId, environmentId: configuration.environmentId } : {}) }, 409, cors);
+      }
       const snapshot = await runtime.settings();
-      return reply({ version: 1, mode: SETTINGS_ONLY_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false,
+      return reply({ version: 1, mode: SETTINGS_ONLY_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false, ...(discovery ? { discovered: discovery } : {}),
         settings: Object.fromEntries(WEBSITE_SECTIONS.map(section => [section, { installed: true, state: snapshot.sections[section]?.state ?? 'unavailable', version: snapshot.sections[section]?.version ?? 0 }])) }, 200, cors);
     }
     if (!['GET', 'HEAD'].includes(method)) return reply({ error: 'Method not allowed' }, 405, { Allow: 'GET, HEAD' });

package/dist/site-discovery.mjs

@@ -0,0 +1,130 @@
+/**
+ * Reads a Next.js App Router website's public structure without running it:
+ * its static pages (path, title, description) and the literal links in its
+ * header and footer. The result seeds the CMS for settings-only websites and
+ * contains only public text already present in the website source.
+ */
+import path from 'node:path';
+import ts from './vendor/typescript.cjs';
+import { projectRoot, readProjectFile } from './project-files.mjs';
+import { inspectSourceRoutes } from './source-routes.mjs';
+
+export const DISCOVERED_FILE = '.universalcms/discovered.json';
+const MAX_PAGES = 100, MAX_LINKS = 20;
+const entities = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", rsquo: '’', lsquo: '‘', rdquo: '”', ldquo: '“', nbsp: ' ', ndash: '–', mdash: '—', hellip: '…', copy: '©', reg: '®', trade: '™' };
+const decode = value => value.replace(/&(#\d+|#x[0-9a-f]+|[a-z]+);/gi, (match, name) => name[0] === '#' ? String.fromCodePoint(Number.parseInt(name.slice(name[1] === 'x' || name[1] === 'X' ? 2 : 1), name[1] === 'x' || name[1] === 'X' ? 16 : 10)) : entities[name.toLowerCase()] ?? match);
+const clean = (value, max) => typeof value === 'string' ? decode(value).replace(/\s+/g, ' ').trim().slice(0, max) : '';
+const parse = (filename, text) => ts.createSourceFile(filename, text, ts.ScriptTarget.Latest, true, /x$/.test(filename) ? ts.ScriptKind.TSX : ts.ScriptKind.TS);
+// Same rule as CMS navigation: plain site paths (no query or fragment) or HTTPS URLs.
+const publicUrl = value => typeof value === 'string' && value.length <= 200 && (/^\/(?!\/)[a-zA-Z0-9/_\-]*$/.test(value) || /^https:\/\/[^\s<>"'`]+$/.test(value)) && !/^\/(api|_next)(\/|$)/.test(value);
+
+/** Literal string of a property in `export const metadata = { ... }` (title may be a string or { default }). */
+function metadataOf(ast) {
+  for (const statement of ast.statements) {
+    if (!ts.isVariableStatement(statement) || !statement.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.ExportKeyword)) continue;
+    for (const declaration of statement.declarationList.declarations) {
+      if (!ts.isIdentifier(declaration.name) || declaration.name.text !== 'metadata' || !declaration.initializer || !ts.isObjectLiteralExpression(declaration.initializer)) continue;
+      const read = name => {
+        const property = declaration.initializer.properties.find(item => ts.isPropertyAssignment(item) && item.name.getText(ast) === name);
+        if (!property) return '';
+        const value = property.initializer;
+        if (ts.isStringLiteralLike(value)) return value.text;
+        if (ts.isObjectLiteralExpression(value)) { const fallback = value.properties.find(item => ts.isPropertyAssignment(item) && item.name.getText(ast) === 'default'); return fallback && ts.isStringLiteralLike(fallback.initializer) ? fallback.initializer.text : ''; }
+        return '';
+      };
+      return { title: clean(read('title'), 120), description: clean(read('description'), 320) };
+    }
+  }
+  return { title: '', description: '' };
+}
+
+/** Text written directly inside a JSX element (ignores expressions and icons). */
+function literalText(node) {
+  let text = '';
+  (function visit(child) { if (ts.isJsxText(child)) text += ` ${child.text}`; else if (ts.isJsxExpression(child) && child.expression && ts.isStringLiteralLike(child.expression)) text += ` ${child.expression.text}`; else ts.forEachChild(child, visit); })(node);
+  return clean(text, 60);
+}
+
+function firstHeading(ast) {
+  let found = '';
+  (function visit(node) { if (found) return; if (ts.isJsxElement(node) && node.openingElement.tagName.getText(ast) === 'h1') { found = literalText(node); return; } ts.forEachChild(node, visit); })(ast);
+  return found;
+}
+
+/** Literal <Link href> / <a href> elements, labelled by their nearest <header>/<footer> ancestor. */
+function linksOf(ast, fallbackArea) {
+  const links = [];
+  (function visit(node, area) {
+    if (ts.isJsxElement(node)) {
+      const tag = node.openingElement.tagName.getText(ast);
+      if (tag === 'header' || tag === 'nav' && !area) area = 'header';
+      if (tag === 'footer') area = 'footer';
+      if (tag === 'Link' || tag === 'a') {
+        const href = node.openingElement.attributes.properties.find(attribute => ts.isJsxAttribute(attribute) && attribute.name.getText(ast) === 'href');
+        const value = href && ts.isJsxAttribute(href) && href.initializer && (ts.isStringLiteral(href.initializer) ? href.initializer.text : ts.isJsxExpression(href.initializer) && href.initializer.expression && ts.isStringLiteralLike(href.initializer.expression) ? href.initializer.expression.text : null);
+        const label = literalText(node);
+        if (publicUrl(value) && label && (area ?? fallbackArea)) links.push({ area: area ?? fallbackArea, label, url: value });
+        return;
+      }
+    }
+    ts.forEachChild(node, child => visit(child, area));
+  })(ast, null);
+  return links;
+}
+
+/** Local components imported by the root layout (one level), with their likely area. */
+function layoutComponents(ast, layoutFile, app) {
+  const result = [];
+  for (const statement of ast.statements) {
+    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) || !statement.importClause?.name && !statement.importClause?.namedBindings) continue;
+    const specifier = statement.moduleSpecifier.text, name = statement.importClause.name?.text ?? specifier.split('/').at(-1);
+    const area = /footer/i.test(name) ? 'footer' : /header|nav|menu/i.test(name) ? 'header' : null;
+    if (!area) continue;
+    const base = specifier.startsWith('@/') ? `${app.startsWith('src/') ? 'src/' : ''}${specifier.slice(2)}` : specifier.startsWith('.') ? path.posix.normalize(path.posix.join(path.posix.dirname(layoutFile), specifier)) : null;
+    if (base) result.push({ base, area });
+  }
+  return result;
+}
+
+async function readFirst(root, base) {
+  for (const candidate of [base, ...['.tsx', '.jsx', '.ts', '.js', '/index.tsx', '/index.jsx'].map(suffix => base + suffix)]) {
+    try { const text = await readProjectFile(root, candidate); if (text !== null) return { file: candidate, text }; } catch { /* Not this candidate. */ }
+  }
+  return null;
+}
+
+const titleFromPath = route => route === '/' ? 'Home' : clean(route.split('/').filter(Boolean).at(-1).replace(/[-_]+/g, ' ').replace(/\b\w/g, letter => letter.toUpperCase()), 120);
+
+export async function discoverSite(directory) {
+  const root = await projectRoot(directory), inventory = await inspectSourceRoutes(root);
+  const files = Object.entries(inventory.files);
+  const app = files[0]?.[1].startsWith('src/app/') ? 'src/app' : 'app';
+  const pages = [];
+  for (const [route, file] of files.slice(0, MAX_PAGES)) {
+    const pathname = route === 'home' || route === '' ? '/' : `/${route}`;
+    const text = await readProjectFile(root, file).catch(() => null);
+    const ast = text ? parse(file, text) : null;
+    const meta = ast ? metadataOf(ast) : { title: '', description: '' };
+    pages.push({ path: pathname, title: meta.title || (ast && firstHeading(ast)) || titleFromPath(pathname), description: meta.description });
+  }
+  pages.sort((a, b) => a.path.localeCompare(b.path));
+  const links = [];
+  for (const ext of ['tsx', 'jsx', 'js', 'ts']) {
+    const layoutFile = `${app}/layout.${ext}`, text = await readProjectFile(root, layoutFile).catch(() => null);
+    if (!text) continue;
+    const ast = parse(layoutFile, text);
+    links.push(...linksOf(ast, null));
+    for (const component of layoutComponents(ast, layoutFile, app)) {
+      const found = await readFirst(root, component.base);
+      if (found) links.push(...linksOf(parse(found.file, found.text), component.area));
+    }
+    break;
+  }
+  const navigation = { header: [], footer: [] }, seen = { header: new Set(), footer: new Set() };
+  for (const link of links) {
+    const key = `${link.label}\n${link.url}`;
+    if (seen[link.area].has(key) || navigation[link.area].length >= MAX_LINKS) continue;
+    seen[link.area].add(key); navigation[link.area].push({ label: link.label, url: link.url });
+  }
+  return { version: 1, pages, navigation };
+}

package/dist/templates/next-theme/.universalcms/theme.json

@@ -0,0 +1,4 @@
+{
+  "version": 1,
+  "theme": "next-starter"
+}

package/dist/templates/next-theme/README.md

@@ -0,0 +1,14 @@
+# Universal CMS website
+
+Every page, post, menu, logo and SEO setting of this website is managed in
+Universal CMS. Start it with:
+
+```sh
+npm run dev
+```
+
+The home page is the CMS page with the slug `home`. Pages and posts appear at
+the URLs set in the CMS (SEO → URL patterns) once they are published.
+
+Connection values live in `.universalcms/`; the private website key lives only in
+`.env.local`. To reconnect, run `npx @universalcms/connect@latest`.

package/dist/templates/next-theme/app/[[...cmsPath]]/page.tsx

@@ -0,0 +1,43 @@
+// Every URL is rendered from published Universal CMS content.
+import { cache } from 'react';
+import { connection } from 'next/server';
+import { notFound, permanentRedirect, redirect } from 'next/navigation';
+import { websiteMetadata } from '@universalcms/connect/website-runtime';
+import { CmsWebsitePage } from '@universalcms/connect/react-website';
+import { configuration, runtime, scope } from '../../lib/universalcms';
+
+const settings = cache(async () => { await connection(); return runtime.settings(); });
+const read = cache(async (pathname: string) => { await connection(); return runtime.page(pathname); });
+const load = cache(async (pathname: string) => {
+  const result = await read(pathname);
+  if (result.state === 'redirect') { const target = result as { location: string; status?: number }; if (target.status === 301 || target.status === 308) permanentRedirect(target.location); redirect(target.location); }
+  if (result.state === 'missing' || result.state === 'unmanaged' || result.state === 'gone') notFound();
+  if (result.state !== 'published' && result.state !== 'archive') throw new Error('Website content is temporarily unavailable');
+  return result;
+});
+type Props = { params: Promise<{ cmsPath?: string[] }> };
+const pathOf = async (params: Props['params']) => '/' + ((await params).cmsPath ?? []).join('/');
+
+export async function generateMetadata({ params }: Props) {
+  // Metadata never throws: the page itself decides between content, redirect and 404.
+  const pathname = await pathOf(params), result = await read(pathname), snapshot = await settings();
+  if (result.state !== 'published' && result.state !== 'archive') return {};
+  const entry = result.state === 'published' ? result.entry : null;
+  const archiveTitle = result.state === 'archive' ? (result as { title: string }).title : undefined;
+  if (snapshot.sections.seo.state !== 'ready') return { title: archiveTitle ?? entry?.document.title, description: entry?.document.excerpt };
+  const value = websiteMetadata(entry, snapshot, pathname, configuration.websiteOrigin);
+  return {
+    title: archiveTitle ?? value.title, description: value.description, robots: value.robots,
+    alternates: { canonical: value.canonical, languages: Object.fromEntries((value.alternates ?? []).map(item => [item.locale, item.url])) },
+    openGraph: value.openGraph ? { ...value.openGraph, images: value.openGraph.image ? [value.openGraph.image] : undefined } : undefined,
+  };
+}
+
+export default async function Page({ params }: Props) {
+  const pathname = await pathOf(params), result = await load(pathname), snapshot = await settings();
+  const structured = websiteMetadata(result.state === 'published' ? result.entry : null, snapshot, pathname, configuration.websiteOrigin).jsonLd;
+  return <>
+    {structured && <script type="application/ld+json" data-universalcms-setting="seo" dangerouslySetInnerHTML={{ __html: JSON.stringify(structured).replace(/</g, '\\u003c') }}/>}
+    <CmsWebsitePage pathname={pathname} scope={scope} initialResult={result} initialSettings={snapshot}/>
+  </>;
+}

package/dist/templates/next-theme/app/api/universalcms/[endpoint]/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/app/globals.css

@@ -0,0 +1,12 @@
+/* Universal CMS theme base styles. Brand colors come from CMS Branding. */
+:root { --cms-website-accent: #4f46e5; color-scheme: light; }
+* { box-sizing: border-box; }
+body { margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; line-height: 1.6; color: #0f172a; background: #fff; }
+.cms-website { min-height: 100vh; display: flex; flex-direction: column; }
+.cms-website > :not(header):not(footer) { flex: 1; width: 100%; max-width: 1100px; margin: 0 auto; padding: 32px 20px 64px; }
+.cms-website-header, .cms-website-footer { display: flex; flex-wrap: wrap; align-items: center; gap: 16px 28px; padding: 16px max(20px, calc((100% - 1100px) / 2)); }
+.cms-website-header { border-bottom: 1px solid #e2e8f0; }
+.cms-website-footer { border-top: 1px solid #e2e8f0; color: #475569; font-size: 14px; }
+a { color: var(--cms-website-accent); }
+img { max-width: 100%; height: auto; }
+h1 { font-size: clamp(2rem, 4vw, 3rem); line-height: 1.15; margin: 0 0 16px; }

package/dist/templates/next-theme/app/layout.tsx

@@ -0,0 +1,11 @@
+import type { ReactNode } from 'react';
+import '@universalcms/connect/website.css';
+import './globals.css';
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

package/dist/templates/next-theme/app/not-found.tsx

@@ -0,0 +1,9 @@
+import { connection } from 'next/server';
+import { CmsExperience, CmsWebsite } from '@universalcms/connect/react-website';
+import { runtime, scope } from '../lib/universalcms';
+
+export default async function NotFound() {
+  await connection();
+  const settings = await runtime.settings();
+  return <CmsWebsite scope={scope} initialSettings={settings} applyTemplate={false}><main><CmsExperience notFound /></main></CmsWebsite>;
+}

package/dist/templates/next-theme/app/robots.txt/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/app/sitemap.xml/route.ts

@@ -0,0 +1,10 @@
+// Universal CMS website endpoints (settings, live page updates, sitemap, robots).
+import { createThemeHandler } from "@universalcms/connect/theme";
+import { adminOrigin, configuration } from "../../lib/universalcms";
+
+const handle = createThemeHandler({ configuration, adminOrigin });
+export const dynamic = "force-dynamic";
+export const GET = handle;
+export const HEAD = handle;
+export const OPTIONS = handle;
+

package/dist/templates/next-theme/gitignore.template

@@ -0,0 +1,4 @@
+node_modules
+.next
+.env.local
+/.universalcms-private-*.tmp

package/dist/templates/next-theme/lib/universalcms.ts

@@ -0,0 +1,10 @@
+// Universal CMS theme: shared runtime. Connection values are public; the
+// website key is read from .env.local on the server only.
+import { createThemeRuntime } from '@universalcms/connect/theme';
+import website from '../.universalcms/website.json';
+import connection from '../.universalcms/connection.json';
+
+export const configuration = website as Parameters<typeof createThemeRuntime>[0]['configuration'];
+export const adminOrigin = connection.adminOrigin;
+export const scope = `${website.siteId}:${website.environmentId}`;
+export const runtime = createThemeRuntime({ configuration });

package/dist/templates/next-theme/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/dev/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/dist/templates/next-theme/next.config.mjs

@@ -0,0 +1 @@
+export default { htmlLimitedBots: /.*/ };

package/dist/templates/next-theme/tsconfig.json

@@ -0,0 +1,35 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "incremental": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "allowJs": true
+  },
+  "include": [
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}

package/dist/theme.d.mts

@@ -0,0 +1,6 @@
+import type { createWebsiteRuntime } from './website-runtime.mjs';
+export const THEME_MODE: 'theme';
+export type ThemeConfiguration = { version: 1; apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; routes: { path: string; kind: string; slug: string; locale: string }[] };
+export function themeConfiguration(connection: { apiOrigin: string; siteId: string; environmentId: string; websiteOrigin: string; locale?: string }): ThemeConfiguration;
+export function createThemeRuntime(options: { configuration: ThemeConfiguration; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): ReturnType<typeof createWebsiteRuntime>;
+export function createThemeHandler(options: { configuration: ThemeConfiguration; adminOrigin: string; env?: () => Record<string, string | undefined>; fetcher?: typeof fetch }): (request: Request) => Promise<Response>;

package/dist/theme.mjs

@@ -0,0 +1,50 @@
+/**
+ * Universal CMS theme runtime: every URL of the website is rendered from
+ * published CMS content. The home page is the page with slug `home`; all other
+ * paths follow the CMS URL patterns (pages, posts, categories, tags).
+ */
+import { createWebsiteRuntime } from './website-runtime.mjs';
+import { createWebsiteRequestHandler, WEBSITE_SECTIONS, WEBSITE_SETTINGS_PATH } from './website-http.mjs';
+
+export const THEME_MODE = 'theme';
+
+/** Publication configuration for a theme website: only the home page needs a fixed route. */
+export function themeConfiguration({ apiOrigin, siteId, environmentId, websiteOrigin, locale = 'en' }) {
+  return { version: 1, apiOrigin, siteId, environmentId, websiteOrigin, routes: [{ path: '/', kind: 'page', slug: 'home', locale }] };
+}
+
+export function createThemeRuntime({ configuration, env = () => process.env, fetcher = globalThis.fetch }) {
+  return createWebsiteRuntime({ configuration, env, fetcher });
+}
+
+/**
+ * Serves /api/universalcms/{settings,page,document}, /sitemap.xml and /robots.txt
+ * through the shared website handler, and answers the CMS admin connection check.
+ */
+export function createThemeHandler({ configuration, adminOrigin, env = () => process.env, fetcher = globalThis.fetch }) {
+  const website = createWebsiteRequestHandler({ configuration, env, fetcher });
+  const runtime = createThemeRuntime({ configuration, env, fetcher });
+  const admin = new URL(adminOrigin).origin;
+  if (admin !== adminOrigin) throw new Error('Invalid CMS admin origin');
+  const json = (body, status, extra = {}) => new Response(body === null ? null : JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'X-Content-Type-Options': 'nosniff', ...extra } });
+  return async function handle(request) {
+    const url = new URL(request.url);
+    if (url.pathname === WEBSITE_SETTINGS_PATH && url.searchParams.get('check') === 'connection') {
+      const origin = request.headers.get('origin');
+      if (origin !== admin || request.headers.has('authorization') || request.headers.has('cookie')) return json({ error: 'Request not allowed' }, 403);
+      const cors = { 'Access-Control-Allow-Origin': admin, Vary: 'Origin', 'Access-Control-Allow-Methods': 'GET, HEAD, OPTIONS' };
+      if (request.method === 'OPTIONS') return request.headers.get('access-control-request-method') === 'GET' && !request.headers.has('access-control-request-headers') ? json(null, 204, cors) : json({ error: 'Request not allowed' }, 403);
+      if (url.searchParams.size !== 3 || url.searchParams.get('siteId') !== configuration.siteId || url.searchParams.get('environmentId') !== configuration.environmentId) {
+        // Tell the CMS which environment this website is connected to, so the
+        // admin can switch to it. Only public identifiers of the same website.
+        const sameSite = url.searchParams.get('siteId') === configuration.siteId;
+        return json({ error: 'Website scope mismatch', ...(sameSite ? { siteId: configuration.siteId, environmentId: configuration.environmentId } : {}) }, 409, cors);
+      }
+      const snapshot = await runtime.settings();
+      return json({ version: 1, mode: THEME_MODE, siteId: configuration.siteId, environmentId: configuration.environmentId, renderedVerified: false,
+        settings: Object.fromEntries(WEBSITE_SECTIONS.map(section => [section, { installed: true, state: snapshot.sections[section]?.state ?? 'unavailable', version: snapshot.sections[section]?.version ?? 0 }])) }, 200, cors);
+    }
+    const result = await website(request);
+    return result instanceof Response ? result : json({ error: 'Not found' }, 404);
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@universalcms/connect",
-  "version": "0.13.1",
+  "version": "0.13.3",
   "description": "Deterministic framework-aware Universal CMS setup for reviewed native websites",
   "type": "module",
   "bin": {
@@ -31,7 +31,8 @@
     "./static-runtime": "./dist/static-runtime.mjs",
     "./website.css": "./dist/website.css",
     "./public-bindings": "./dist/public-bindings.mjs",
-    "./settings-only": "./dist/settings-only.mjs"
+    "./settings-only": "./dist/settings-only.mjs",
+    "./theme": "./dist/theme.mjs"
   },
   "files": [
     "dist",
@@ -42,7 +43,7 @@
   },
   "scripts": {
     "build": "node scripts/build.mjs",
-    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/settings-only.mjs && node --check src/settings-only-setup.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
+    "typecheck": "node --check src/cli.mjs && node --check src/core.mjs && node --check src/project-files.mjs && node --check src/templates.mjs && node --check src/vite-handler.mjs && node --check src/wizard.mjs && node --check src/guided.mjs && node --check src/settings-only.mjs && node --check src/theme.mjs && node --check src/settings-only-setup.mjs && node --check src/framework.mjs && node --check src/framework-ownership.mjs && node --check src/preflight.mjs && node --check src/preflight-recovery.mjs && node --check src/native-route-review.mjs && node --check src/page-discovery.mjs && node --check src/page-mapping-review.mjs && node --check src/native-chrome-model.mjs && node --check src/native-chrome-source.mjs && node --check src/native-chrome-review.mjs && node --check src/next-settings-layout.mjs && node --check src/vite-source-discovery.mjs && node --check src/reviewed-storefront-source.mjs && node --check src/reviewed-commerce-ownership.mjs && node --check src/native-routes.mjs && node --check src/reviewed-native-ownership.mjs && node --check src/runtime-dependencies.mjs && node --check src/connector-runtime.mjs && node --check src/staged-setup.mjs && node --check src/setup-environment.mjs && node --check src/source-check.mjs && node --check src/source-finalize.mjs && node --check src/source-routes.mjs && node --check src/source-config.mjs && node --check src/source-collect.mjs && node --check src/source-extract.mjs && node --check src/source-setup.mjs && node --check src/next-source.mjs && node --check src/vite-source.mjs && node --check src/publication.mjs && node --check src/publication-verification.mjs && node --check src/publication-check.mjs && node --check src/publication-document.mjs && node --check src/publication-browser.mjs && node --check src/publication-setup.mjs && node --check src/publication-next-setup.mjs && node --check src/next-publication.mjs && node --check src/vite-publication.mjs && node --check src/vite-publication-server.mjs && node --check src/source-bindings.mjs && node --check src/content-registry.mjs && node --check src/content-registry-validation.mjs && node --check src/content-next-setup.mjs && node --check src/content-vite-setup.mjs && node --check src/content-storefront-setup.mjs && node --check src/content-setup.mjs && tsc --noEmit -p tsconfig.react.json && node --check src/website-http.mjs && node --check src/website-node.mjs && node --check src/website-next.mjs && node --check src/website-setup.mjs && node --check src/reviewed-commerce-settings-setup.mjs && node --check src/website-runtime.mjs && node --check src/website-check.mjs && node --check src/astro-source.mjs && node --check src/astro-setup.mjs && node --check src/astro-runtime.mjs && node --check src/native-adapters.mjs && node --check src/native-website-model.mjs && node --check src/vue-source.mjs && node --check src/vue-setup.mjs && node --check src/vue-runtime.mjs && node --check src/vue-server.mjs && node --check src/svelte-template.mjs && node --check src/svelte-setup.mjs && node --check src/svelte-runtime.mjs && node --check src/angular-setup.mjs && node --check src/angular-runtime.mjs && node --check src/static-setup.mjs && node --check src/static-runtime.mjs",
     "prepack": "node scripts/build.mjs"
   },
   "publishConfig": {