npm - create-kywi-app - Versions diffs - 0.1.0 → 0.2.0 - Mend

create-kywi-app 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/README.md CHANGED Viewed

@@ -47,9 +47,11 @@ Set via `--mode` (and written into the generated `kywi.config.ts`'s
 ## What gets generated
 A generated project **boots and works with zero manual edits**:
-`pnpm install && pnpm migrate && pnpm seed && pnpm dev` gives you a working admin
-at `/admin` (sign in, create + publish a page) and — in `coupled` mode — a public
-site that renders published pages at their slug.
+`pnpm install && pnpm migrate && pnpm seed && pnpm dev` gives you a working
+`/admin` — the **full** Kywi admin (dashboard, site tree, media, users, forms,
+audiences, settings, and every other core surface, sign in and create +
+publish a page) — and, in `coupled` mode, a public site that renders published
+pages at their slug.
 `buildFileSet()` writes (`lib/templates.mjs`):
@@ -57,31 +59,35 @@ site that renders published pages at their slug.
 package.json                       scripts (dev/build/start/migrate/seed) + deps incl. drizzle-kit + tsx
 kywi.config.ts                     defineKywiConfig/Site/Theme + a default "Page" content type
 tsconfig.json
-next.config.mjs                    the FULL config to consume core (extensionAlias, serverExternalPackages,
-                                   isomorphic-dompurify stub) — every line is load-bearing
+next.config.mjs                    the FULL config to consume core (transpilePackages, extensionAlias,
+                                   serverExternalPackages) — every line is load-bearing
 .env.example                       DATABASE_URL + AUTH_SECRET
 .gitignore
-README.md                          project-specific quick start (createdb, migrate, seed, dev, /admin)
-lib/dompurify-stub.js              webpack stub referenced by next.config
+README.md                          project-specific quick start (createdb, migrate, seed, dev, /admin, admin.features)
 lib/kywi.ts                        server runtime: DB, API handler, content scope (memoised)
 lib/config.ts                      re-export of kywi.config
-lib/admin-auth.ts                  client admin helpers, re-exported from @kywi-software/core/host-client
-lib/content-types.ts               config + built-in (page/folder/link) content-type resolver
 middleware.ts                      auth gate + session refresh + cookie→bearer bridge (over core/host)
 app/api/v1/[...kywi]/route.ts      the versioned API (delegates to core; lifts tokens into httpOnly cookies)
 app/layout.tsx                     root <html>/<body>
-components/admin-shell.tsx         minimal admin chrome (your app's own layer)
-app/admin/layout.tsx               pass-through admin segment layout
-app/admin/page.tsx                 redirect → /admin/content
-app/admin/login/page.tsx           sign-in form
-app/admin/content/page.tsx         content-type picker
-app/admin/content/[type]/…         list / new / edit + publish (core's ContentEditForm)
+app/icon.svg                       favicon
+app/admin/[[...admin]]/page.tsx    mounts the FULL core admin (KywiAdminApp, every surface) at /admin
 ```
 **coupled** additionally gets `app/(site)/layout.tsx` + `app/(site)/[[...slug]]/page.tsx`
 (the public site — renders "/" and every published page at its slug). **headless**
 and **decoupled** instead get `app/page.tsx` (returns 404 — no public rendering).
+Note what's *not* in this list: there is no `components/admin-shell.tsx`, no
+per-route `app/admin/content/**`, no `lib/admin-auth.ts`. Since 0.2.0 the whole
+admin is one component (`KywiAdminApp`) shipped by `@kywi-software/core` — the
+generated project mounts it with the single catch-all page above instead of
+hand-rolling admin pages. See [`docs/hosting.md`](../../docs/hosting.md) §3
+for exactly what that mount does, and
+[`docs/admin-configuration.md`](../../docs/admin-configuration.md) for
+disabling surfaces you don't want (per deployment via `admin.features` in
+`kywi.config.ts`, or per site at runtime via the superAdmin "Admin Features"
+surface — no redeploy).
 The security-critical session plumbing (JWT verify, the httpOnly cookie contract,
 the cookie→bearer bridge) is NOT copied into every project. It lives once in
 `@kywi-software/core/host` (+ `/host-client`); the generated `middleware.ts` and

package/lib/templates.mjs CHANGED Viewed

@@ -7,9 +7,16 @@
  * CLI writes, which is what the tests assert against.
  *
  * A generated project boots and works as documented with ZERO manual edits:
- * `pnpm install && pnpm migrate && pnpm seed && pnpm dev` gives a working admin
- * at /admin (log in with the seeded credentials, create + publish a page) and,
- * in coupled mode, a public site that renders published pages at their slug.
+ * `pnpm install && pnpm migrate && pnpm seed && pnpm dev` gives the COMPLETE
+ * admin at /admin (log in with the seeded credentials — every surface is present:
+ * dashboard, site tree, media, users, forms, categories, tags, audiences,
+ * settings, …) and, in coupled mode, a public site that renders published pages
+ * at their slug.
+ *
+ * The whole admin is core's `KywiAdminApp`, mounted by ONE optional-catch-all
+ * host page (app/admin/[[...admin]]/page.tsx). The scaffold does NOT hand-write
+ * per-surface admin pages, a bespoke shell, or a login page — core provides all
+ * of them, so `npm update @kywi-software/core` upgrades the entire admin.
  *
  * The three deployment modes differ only in the public surface:
  *   - coupled:   renders the public site (app/(site)) AND serves the admin + API.
@@ -73,6 +80,12 @@ function packageJson(a) {
       // interactive approval prompt (no-op for npm/yarn).
       pnpm: {
         onlyBuiltDependencies: ['esbuild', 'sharp'],
+        // @auth/core lists nodemailer as an OPTIONAL peer capped at ^7; core ships
+        // nodemailer 8 (its createTransport/sendMail usage is identical). Tell pnpm
+        // 8 is fine so a fresh install prints no unmet-peer warning.
+        peerDependencyRules: {
+          allowedVersions: { nodemailer: '8' },
+        },
       },
     },
     null,
@@ -182,12 +195,7 @@ function tsconfig() {
 // ── next.config.mjs ───────────────────────────────────────────────────────────
 function nextConfig() {
-  return `import { createRequire } from 'node:module'
-// require() is needed for require.resolve() of the local dompurify stub below.
-const require = createRequire(import.meta.url)
-/**
+  return `/**
  * Next.js config for a Kywi app. Every setting here is required to consume
  * @kywi-software/core; removing any of them breaks the build:
  *
@@ -196,10 +204,10 @@ const require = createRequire(import.meta.url)
  *                       must resolve those specifiers to the real \`.ts\`/\`.tsx\`.
  *  - serverExternalPackages: core's server deps (sharp, drizzle, postgres, …)
  *                       stay server-side and out of the client bundle.
- *  - isomorphic-dompurify stub: jsdom fails when webpack bundles it on the
- *                       server, and its CJS/ESM interop breaks client transpile;
- *                       the stub passes content through (sanitisation is
- *                       defense-in-depth — CMS-authored content is trusted).
+ *
+ * Note: core sanitizes all CMS HTML itself with a DOM-free sanitizer
+ * (sanitize-html), so there is no jsdom-based sanitizer to work around and no
+ * client-side sanitizer stub to wire up here.
  */
 /** @type {import('next').NextConfig} */
 const nextConfig = {
@@ -211,8 +219,6 @@ const nextConfig = {
     'nodemailer',
     'bcryptjs',
     '@aws-sdk/client-s3',
-    'jsdom',
-    'isomorphic-dompurify',
   ],
   webpack(config) {
     config.resolve.extensionAlias = {
@@ -220,10 +226,6 @@ const nextConfig = {
       '.js': ['.ts', '.tsx', '.js'],
       '.jsx': ['.tsx', '.jsx'],
     }
-    config.resolve.alias = {
-      ...config.resolve.alias,
-      'isomorphic-dompurify': require.resolve('./lib/dompurify-stub.js'),
-    }
     return config
   },
 }
@@ -232,30 +234,6 @@ export default nextConfig
 `
 }
-function dompurifyStub() {
-  return `/**
- * Stub for isomorphic-dompurify used in both server and client webpack bundles.
- * Server: isomorphic-dompurify uses jsdom, which fails when webpack bundles it.
- * Client: its CJS/ESM interop breaks when @kywi-software/core is transpiled.
- * This stub passes content through unchanged — DOMPurify sanitisation is
- * defense-in-depth; CMS-authored content is trusted.
- */
-const DOMPurify = {
-  sanitize: (dirty) => dirty,
-  addHook: () => {},
-  removeHook: () => {},
-  removeHooks: () => {},
-  removeAllHooks: () => {},
-  isValidAttribute: () => true,
-  setConfig: () => {},
-  clearConfig: () => {},
-}
-export default DOMPurify
-export const sanitize = DOMPurify.sanitize
-`
-}
 // ── env / gitignore ───────────────────────────────────────────────────────────
 function envExample() {
@@ -271,6 +249,17 @@ AUTH_SECRET=CHANGE_ME
 `
 }
+// A simple, neutral favicon. Next's App Router auto-serves app/icon.svg and
+// injects <link rel="icon">, so the browser stops requesting /favicon.ico (no
+// more 404 in the console on a fresh boot).
+function faviconSvg() {
+  return `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+  <rect width="32" height="32" rx="7" fill="#0f172a"/>
+  <path d="M11 8v16M11 16l8-8M11 16l8 8" fill="none" stroke="#e2e8f0" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
+`
+}
 function gitignore() {
   return `node_modules
 .next
@@ -345,26 +334,6 @@ export default config
 `
 }
-function libAdminAuth() {
-  return `/**
- * Client-side admin helpers. Re-exported from @kywi-software/core/host-client so
- * every admin surface imports them from one local path — swap the source here if
- * you ever want to customise them.
- */
-export {
-  adminFetch,
-  getAdminUser,
-  setAuth,
-  clearAuth,
-  signOut,
-  getActiveSiteId,
-  setActiveSiteId,
-  clearActiveSiteId,
-  type AdminUser,
-} from '@kywi-software/core/host-client'
-`
-}
 // ── middleware.ts (thin framework wiring over @kywi-software/core/host) ───────
 function middleware() {
@@ -638,603 +607,70 @@ export const dynamic = 'force-dynamic'
 `
 }
-// ── admin ─────────────────────────────────────────────────────────────────────
-function adminLayout() {
-  return `import React from 'react'
-// Pass-through: the root layout provides <html>/<body>; admin pages bring their
-// own chrome (AdminShell for authed pages, nothing extra for the login page).
-export default function AdminLayout({ children }: { children: React.ReactNode }) {
-  return <>{children}</>
-}
-`
-}
-function adminIndexPage() {
-  return `import { redirect } from 'next/navigation'
-export default function AdminIndexPage() {
-  redirect('/admin/content')
-}
-`
-}
-function adminShellComponent() {
-  return `'use client'
-import React, { useEffect, useState } from 'react'
-import { usePathname } from 'next/navigation'
-import '@kywi-software/core/admin/styles.css'
-import { getAdminUser, signOut, type AdminUser } from '../lib/admin-auth'
+// ── admin (the full core admin, mounted at /admin) ─────────────────────────────
 /**
- * Minimal admin chrome: a sidebar + top bar around the authed admin pages. The
- * server middleware is the real access gate (a valid session cookie was already
- * verified to reach here); this only loads the user descriptor for display and
- * bounces to /admin/login if it's gone (e.g. signed out in another tab).
+ * The single optional-catch-all host page that mounts the ENTIRE core admin
+ * (all surfaces) at /admin. Modeled on apps/reference — the whole scaffolded
+ * admin is `KywiAdminApp`, upgraded via `npm update @kywi-software/core`, not
+ * hand-written per-surface pages.
+ */
+function adminCatchAllPage() {
+  return `/**
+ * Host page for the core-mounted admin (\`KywiAdminApp\`).
+ *
+ * This ONE optional-catch-all serves your entire admin at /admin — dashboard,
+ * site tree, media, users, forms, categories, tags, audiences, settings, and
+ * every other surface. It is a server component: it projects the full,
+ * server-side kywi.config.ts down to the secret-free AdminRuntimeConfig
+ * (toAdminRuntimeConfig), extracts ?next= for the login surface, and renders the
+ * one client KywiAdminApp, which maps the URL segments to a surface and mounts
+ * it inside the core admin chrome.
  *
- * Extend this as you grow the admin — it's your app's own layer over core's
- * admin components (ContentEditForm etc.).
+ * The @kywi-software/core/admin/styles.css import is LOAD-BEARING: the admin
+ * design-system tokens/inputs live there, so without it every surface (and the
+ * login page) renders unstyled. Do not remove it.
+ *
+ * Server-side 404: before rendering, the segments are checked against the config
+ * ceiling with the pure resolveSurface helper, calling Next's notFound() for a
+ * true HTTP 404 on an unknown or config-disabled path. The \`login\` segment is
+ * exempt (it is not a registry surface — the middleware's auth exception renders
+ * it chrome-less through KywiAdminApp); the bare /admin index (segments === [])
+ * resolves to the dashboard, so it never 404s.
+ *
+ * You should not need to edit this file. To disable surfaces per deployment, set
+ * \`admin.features\` in kywi.config.ts; superAdmins can also toggle surfaces at
+ * runtime from the "Admin Features" surface.
  */
-const NAV = [
-  { href: '/admin/content', label: 'Content' },
-]
-export function AdminShell({ children }: { children: React.ReactNode }) {
-  const pathname = usePathname()
-  const [user, setUser] = useState<AdminUser | null>(null)
-  const [checked, setChecked] = useState(false)
-  useEffect(() => {
-    const u = getAdminUser()
-    if (!u) {
-      window.location.href = '/admin/login'
-      return
-    }
-    setUser(u)
-    setChecked(true)
-  }, [])
-  async function handleSignOut() {
-    await signOut()
-    window.location.href = '/admin/login'
-  }
-  if (!checked) {
-    return (
-      <div style={{ display: 'flex', justifyContent: 'center', alignItems: 'center', minHeight: '100vh' }}>
-        Loading…
-      </div>
-    )
-  }
-  return (
-    <div style={{ display: 'flex', minHeight: '100vh', background: '#f8fafc' }}>
-      <aside style={{ width: 220, background: '#0f172a', color: '#e2e8f0', padding: '1.25rem 0', flexShrink: 0 }}>
-        <div style={{ padding: '0 1.25rem 1rem', fontWeight: 700, fontSize: '1.0625rem' }}>Kywi Admin</div>
-        <nav>
-          {NAV.map((item) => {
-            const active = pathname === item.href || pathname.startsWith(item.href + '/')
-            return (
-              <a
-                key={item.href}
-                href={item.href}
-                style={{
-                  display: 'block',
-                  padding: '0.5rem 1.25rem',
-                  color: active ? '#fff' : '#cbd5e1',
-                  background: active ? '#1e293b' : 'transparent',
-                  textDecoration: 'none',
-                  fontSize: '0.9375rem',
-                }}
-              >
-                {item.label}
-              </a>
-            )
-          })}
-        </nav>
-      </aside>
-      <div style={{ flex: 1, display: 'flex', flexDirection: 'column' }}>
-        <header
-          style={{
-            display: 'flex',
-            justifyContent: 'flex-end',
-            alignItems: 'center',
-            gap: '1rem',
-            padding: '0.75rem 1.5rem',
-            borderBottom: '1px solid #e2e8f0',
-            background: '#fff',
-          }}
-        >
-          <a href="/" style={{ color: '#64748b', fontSize: '0.875rem', textDecoration: 'none' }}>View site ↗</a>
-          <span style={{ color: '#64748b', fontSize: '0.875rem' }}>{user?.role}</span>
-          <button type="button" onClick={handleSignOut} className="kywi-btn kywi-btn-secondary kywi-btn-sm">
-            Sign out
-          </button>
-        </header>
-        <main style={{ padding: '1.5rem', flex: 1 }}>{children}</main>
-      </div>
-    </div>
-  )
-}
-`
-}
-function adminLoginPage() {
-  return `'use client'
-import React, { useState } from 'react'
-import { setAuth } from '../../../lib/admin-auth'
+import { notFound } from 'next/navigation'
+import { KywiAdminApp } from '@kywi-software/core/admin/app'
+import { toAdminRuntimeConfig, resolveSurface } from '@kywi-software/core/admin/server'
+// CRITICAL: load the admin design system once for the whole mount.
 import '@kywi-software/core/admin/styles.css'
-/** Honor a safe internal ?next= (set by middleware.ts), else the content list. */
-function safeNext(): string {
-  const fallback = '/admin/content'
-  if (typeof window === 'undefined') return fallback
-  const next = new URLSearchParams(window.location.search).get('next')
-  if (next && next.startsWith('/admin/') && !next.startsWith('//') && next !== '/admin/login') {
-    return next
-  }
-  return fallback
-}
-export default function AdminLoginPage() {
-  const [email, setEmail] = useState('')
-  const [password, setPassword] = useState('')
-  const [error, setError] = useState('')
-  const [loading, setLoading] = useState(false)
-  async function handleSubmit(e: React.FormEvent) {
-    e.preventDefault()
-    setError('')
-    setLoading(true)
-    try {
-      const res = await fetch('/api/v1/auth/login', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email, password }),
-      })
-      const body = await res.json()
-      if (!res.ok) {
-        setError(body.error?.message ?? 'Login failed')
-        return
-      }
-      if (!body.data?.user || !body.data?.accessToken) {
-        setError('This account requires an unsupported login step.')
-        return
-      }
-      // The token is set by the server as an httpOnly cookie; we keep only the
-      // (non-sensitive) user descriptor for rendering the chrome.
-      setAuth(body.data.user)
-      window.location.href = safeNext()
-    } catch {
-      setError('Network error — is the server running?')
-    } finally {
-      setLoading(false)
-    }
-  }
-  return (
-    <div className="kywi-admin-shell kywi-admin-login">
-      <form onSubmit={handleSubmit} className="kywi-admin-login-card">
-        <div className="kywi-admin-login-brand">
-          <span aria-hidden="true" className="kywi-admin-login-dot" />
-          <h1>Kywi Admin</h1>
-        </div>
-        <p className="kywi-admin-login-subtitle">Sign in to your workspace</p>
-        {error && (
-          <div className="kywi-admin-callout kywi-admin-callout-danger" role="alert">
-            {error}
-          </div>
-        )}
-        <label className="kywi-admin-login-field">
-          <span className="kywi-admin-login-label">Email</span>
-          <input type="email" className="kywi-input" value={email} onChange={(e) => setEmail(e.target.value)} required autoFocus />
-        </label>
-        <label className="kywi-admin-login-field">
-          <span className="kywi-admin-login-label">Password</span>
-          <input type="password" className="kywi-input" value={password} onChange={(e) => setPassword(e.target.value)} required />
-        </label>
-        <button type="submit" disabled={loading} className="kywi-btn kywi-btn-primary kywi-admin-login-submit">
-          {loading ? 'Signing in…' : 'Sign in'}
-        </button>
-      </form>
-    </div>
-  )
-}
-`
-}
-/** Shared client helper (bundled into pages that import it): resolve a content
- * type by name from config + the built-ins. Emitted as a lib file. */
-function libContentTypes() {
-  return `import type { ContentTypeConfig } from '@kywi-software/core/config'
-import config from './config'
-/** Built-in types always available in the editor even if not in kywi.config.ts. */
-export const BUILT_IN_CONTENT_TYPES: ContentTypeConfig[] = [
-  { name: 'page', label: 'Page', baseType: 'content', fields: [] },
-  { name: 'folder', label: 'Folder', baseType: 'folder', fields: [] },
-  { name: 'link', label: 'Link', baseType: 'link', fields: [] },
-]
-/** All content types the admin can author: config-defined win over built-ins by name. */
-export function allContentTypes(): ContentTypeConfig[] {
-  const byName = new Map<string, ContentTypeConfig>()
-  for (const ct of BUILT_IN_CONTENT_TYPES) byName.set(ct.name, ct)
-  for (const ct of config.contentTypes) byName.set(ct.name, ct)
-  return [...byName.values()]
-}
-export function resolveContentType(name: string): ContentTypeConfig | null {
-  return allContentTypes().find((ct) => ct.name === name) ?? null
-}
-`
-}
-function adminContentLandingPage() {
-  return `'use client'
-import React from 'react'
-import { useRouter } from 'next/navigation'
-import { AdminShell } from '../../../components/admin-shell'
-import { allContentTypes } from '../../../lib/content-types'
-// Pick a content type to browse/author. Types come from kywi.config.ts plus the
-// always-available built-ins (page/folder/link).
-export default function ContentLandingPage() {
-  const router = useRouter()
-  const types = allContentTypes()
-  return (
-    <AdminShell>
-      <h1 style={{ margin: '0 0 1.5rem', fontSize: '1.25rem', fontWeight: 600 }}>Content</h1>
-      <div style={{ display: 'grid', gridTemplateColumns: 'repeat(auto-fill, minmax(220px, 1fr))', gap: '1rem' }}>
-        {types.map((ct) => (
-          <button
-            key={ct.name}
-            onClick={() => router.push('/admin/content/' + ct.name)}
-            style={{
-              display: 'flex',
-              flexDirection: 'column',
-              alignItems: 'flex-start',
-              padding: '1.25rem',
-              background: '#fff',
-              border: '1px solid #e2e8f0',
-              borderRadius: 8,
-              cursor: 'pointer',
-              textAlign: 'left',
-            }}
-          >
-            <span style={{ fontSize: '1rem', fontWeight: 600, color: '#1e293b' }}>{ct.label}</span>
-            <span style={{ fontSize: '0.8125rem', color: '#64748b', marginTop: '0.25rem' }}>
-              {ct.fields.length} custom field{ct.fields.length !== 1 ? 's' : ''}
-            </span>
-          </button>
-        ))}
-      </div>
-    </AdminShell>
-  )
-}
-`
-}
-function adminContentListPage() {
-  return `'use client'
-import React, { useEffect, useState } from 'react'
-import { useParams, useRouter } from 'next/navigation'
-import { AdminShell } from '../../../../components/admin-shell'
-import { adminFetch } from '../../../../lib/admin-auth'
-import { resolveContentType } from '../../../../lib/content-types'
-interface Row {
-  id: string
-  title?: string
-  slug?: string
-  path?: string
-  status?: string
-}
-export default function ContentListPage() {
-  const params = useParams<{ type: string }>()
-  const router = useRouter()
-  const typeName = params.type
-  const contentType = resolveContentType(typeName)
-  const [rows, setRows] = useState<Row[] | null>(null)
-  useEffect(() => {
-    let cancelled = false
-    adminFetch('/api/v1/content/' + typeName)
-      .then((res) => (res.ok ? res.json() : { data: [] }))
-      .then((body) => {
-        if (!cancelled) setRows((body?.data ?? []) as Row[])
-      })
-      .catch(() => {
-        if (!cancelled) setRows([])
-      })
-    return () => {
-      cancelled = true
-    }
-  }, [typeName])
-  return (
-    <AdminShell>
-      <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '1.5rem' }}>
-        <h1 style={{ margin: 0, fontSize: '1.25rem', fontWeight: 600 }}>{contentType?.label ?? typeName}</h1>
-        <button className="kywi-btn kywi-btn-primary" onClick={() => router.push('/admin/content/' + typeName + '/new')}>
-          + New {contentType?.label ?? typeName}
-        </button>
-      </div>
-      {rows === null ? (
-        <p style={{ color: '#64748b' }}>Loading…</p>
-      ) : rows.length === 0 ? (
-        <p style={{ color: '#64748b' }}>Nothing here yet. Create your first {contentType?.label ?? typeName}.</p>
-      ) : (
-        <div className="kywi-table-scroll" style={{ background: '#fff', border: '1px solid #e2e8f0', borderRadius: 8 }}>
-          <table className="kywi-table" style={{ width: '100%' }}>
-            <thead>
-              <tr>
-                <th>Title</th>
-                <th>Slug</th>
-                <th>Status</th>
-                <th />
-              </tr>
-            </thead>
-            <tbody>
-              {rows.map((r) => (
-                <tr key={r.id}>
-                  <td>
-                    <a href={'/admin/content/' + typeName + '/' + r.id}>{r.title || '(untitled)'}</a>
-                  </td>
-                  <td>{r.slug}</td>
-                  <td>
-                    {r.status && <span className={'kywi-status-badge kywi-status-' + r.status}>{r.status}</span>}
-                  </td>
-                  <td style={{ textAlign: 'right' }}>
-                    {r.status === 'published' && r.path && (
-                      <a href={r.path} target="_blank" rel="noreferrer" style={{ fontSize: '0.875rem' }}>
-                        View ↗
-                      </a>
-                    )}
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        </div>
-      )}
-    </AdminShell>
-  )
-}
-`
-}
-function adminContentNewPage() {
-  return `'use client'
-import React, { useState } from 'react'
-import { useParams, useRouter } from 'next/navigation'
-import { AdminShell } from '../../../../../components/admin-shell'
-import { ContentEditForm, buildWritablePayload } from '@kywi-software/core/admin'
-import { adminFetch } from '../../../../../lib/admin-auth'
-import { resolveContentType } from '../../../../../lib/content-types'
-export default function ContentNewPage() {
-  const params = useParams<{ type: string }>()
-  const router = useRouter()
-  const typeName = params.type
-  const contentType = resolveContentType(typeName)
-  const [isSubmitting, setIsSubmitting] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  if (!contentType) {
-    return (
-      <AdminShell>
-        <h1>Content type "{typeName}" not found</h1>
-        <p>It is not defined in kywi.config.ts.</p>
-      </AdminShell>
-    )
-  }
-  const fieldNames = contentType.fields.map((f) => f.name)
-  async function handleSubmit(data: Record<string, unknown>) {
-    setIsSubmitting(true)
-    setError(null)
-    try {
-      const payload = buildWritablePayload(data, fieldNames)
-      const res = await adminFetch('/api/v1/content/' + typeName, {
-        method: 'POST',
-        body: JSON.stringify(payload),
-      })
-      if (!res.ok) {
-        const body = await res.json().catch(() => ({}))
-        throw new Error(body.error?.message ?? 'HTTP ' + res.status)
-      }
-      const created = await res.json()
-      const id = created.data?.id ?? created.id
-      router.push(id ? '/admin/content/' + typeName + '/' + id : '/admin/content/' + typeName)
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to create content')
-      setIsSubmitting(false)
-    }
-  }
-  return (
-    <AdminShell>
-      <div style={{ marginBottom: '1rem' }}>
-        <button className="kywi-btn kywi-btn-ghost kywi-btn-sm" onClick={() => router.push('/admin/content/' + typeName)}>
-          ← {contentType.label}
-        </button>
-      </div>
-      {error && (
-        <div className="kywi-admin-callout kywi-admin-callout-danger" style={{ marginBottom: '1rem' }}>
-          {error}
-        </div>
-      )}
-      <ContentEditForm
-        contentType={contentType}
-        mode="create"
-        isSubmitting={isSubmitting}
-        onSubmit={handleSubmit}
-        onCancel={() => router.push('/admin/content/' + typeName)}
-      />
-    </AdminShell>
-  )
-}
-`
-}
-function adminContentEditPage() {
-  return `'use client'
-import React, { useEffect, useState } from 'react'
-import { useParams, useRouter } from 'next/navigation'
-import { AdminShell } from '../../../../../components/admin-shell'
-import { ContentEditForm, buildWritablePayload, mapContentToInitialValues } from '@kywi-software/core/admin'
-import { adminFetch } from '../../../../../lib/admin-auth'
-import { resolveContentType } from '../../../../../lib/content-types'
-export default function ContentEditPage() {
-  const params = useParams<{ type: string; id: string }>()
-  const router = useRouter()
-  const typeName = params.type
-  const id = params.id
-  const contentType = resolveContentType(typeName)
-  const [node, setNode] = useState<Record<string, unknown> | null>(null)
-  const [loaded, setLoaded] = useState(false)
-  const [isSubmitting, setIsSubmitting] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [notice, setNotice] = useState<string | null>(null)
-  useEffect(() => {
-    let cancelled = false
-    adminFetch('/api/v1/content/' + typeName + '/' + id)
-      .then((res) => (res.ok ? res.json() : null))
-      .then((body) => {
-        if (cancelled) return
-        setNode((body?.data ?? null) as Record<string, unknown> | null)
-        setLoaded(true)
-      })
-      .catch(() => {
-        if (!cancelled) setLoaded(true)
-      })
-    return () => {
-      cancelled = true
-    }
-  }, [typeName, id])
-  if (!contentType) {
-    return (
-      <AdminShell>
-        <h1>Content type "{typeName}" not found</h1>
-      </AdminShell>
-    )
-  }
-  if (!loaded) {
-    return (
-      <AdminShell>
-        <p style={{ color: '#64748b' }}>Loading…</p>
-      </AdminShell>
-    )
-  }
-  if (!node) {
-    return (
-      <AdminShell>
-        <h1>Not found</h1>
-        <p>This content no longer exists.</p>
-      </AdminShell>
-    )
-  }
-  const fieldNames = contentType.fields.map((f) => f.name)
-  const status = String(node['status'] ?? 'draft')
-  const path = node['path'] as string | undefined
-  async function patch(payload: Record<string, unknown>): Promise<Record<string, unknown> | null> {
-    const res = await adminFetch('/api/v1/content/' + typeName + '/' + id, {
-      method: 'PATCH',
-      body: JSON.stringify(payload),
-    })
-    if (!res.ok) {
-      const body = await res.json().catch(() => ({}))
-      throw new Error(body.error?.message ?? 'HTTP ' + res.status)
-    }
-    const body = await res.json().catch(() => ({}))
-    return (body?.data ?? null) as Record<string, unknown> | null
+import kywiConfig from '../../../lib/config'
+export default async function AdminCatchAll({
+  params,
+  searchParams,
+}: {
+  params: Promise<{ admin?: string[] }>
+  searchParams: Promise<Record<string, string | string[] | undefined>>
+}) {
+  const { admin = [] } = await params
+  const sp = await searchParams
+  const next = typeof sp.next === 'string' ? sp.next : null
+  const runtime = toAdminRuntimeConfig(kywiConfig)
+  // Hard, server-side config ceiling → real HTTP 404. The login segment is not a
+  // surface (chrome-less middleware exception); the bare index resolves to the
+  // dashboard, so both skip the 404 pre-check.
+  const isLogin = admin.length === 1 && admin[0] === 'login'
+  if (!isLogin && resolveSurface(admin, runtime.admin) === null) {
+    notFound()
   }
-  async function handleSubmit(data: Record<string, unknown>) {
-    setIsSubmitting(true)
-    setError(null)
-    setNotice(null)
-    try {
-      const updated = await patch(buildWritablePayload(data, fieldNames))
-      if (updated) setNode(updated)
-      setNotice('Saved.')
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to save')
-    } finally {
-      setIsSubmitting(false)
-    }
-  }
-  // Publish/unpublish directly, so it works regardless of how you fill the form.
-  async function togglePublish() {
-    setError(null)
-    setNotice(null)
-    try {
-      const next = status === 'published' ? 'draft' : 'published'
-      const updated = await patch({ status: next })
-      if (updated) setNode(updated)
-      setNotice(next === 'published' ? 'Published.' : 'Unpublished.')
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to change status')
-    }
-  }
-  return (
-    <AdminShell>
-      <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '1rem', gap: '1rem' }}>
-        <button className="kywi-btn kywi-btn-ghost kywi-btn-sm" onClick={() => router.push('/admin/content/' + typeName)}>
-          ← {contentType.label}
-        </button>
-        <div style={{ display: 'flex', gap: '0.75rem', alignItems: 'center' }}>
-          <span className={'kywi-status-badge kywi-status-' + status}>{status}</span>
-          {status === 'published' && path && (
-            <a href={path} target="_blank" rel="noreferrer" className="kywi-btn kywi-btn-secondary kywi-btn-sm">
-              View ↗
-            </a>
-          )}
-          <button className="kywi-btn kywi-btn-primary kywi-btn-sm" onClick={togglePublish}>
-            {status === 'published' ? 'Unpublish' : 'Publish'}
-          </button>
-        </div>
-      </div>
-      {error && (
-        <div className="kywi-admin-callout kywi-admin-callout-danger" style={{ marginBottom: '1rem' }}>
-          {error}
-        </div>
-      )}
-      {notice && (
-        <div className="kywi-admin-callout" style={{ marginBottom: '1rem' }}>
-          {notice}
-        </div>
-      )}
-      <ContentEditForm
-        contentType={contentType}
-        mode="edit"
-        initialValues={mapContentToInitialValues(node)}
-        isSubmitting={isSubmitting}
-        onSubmit={handleSubmit}
-        onCancel={() => router.push('/admin/content/' + typeName)}
-      />
-    </AdminShell>
-  )
+  return <KywiAdminApp runtime={runtime} segments={admin} loginNext={next} />
 }
 `
 }
@@ -1279,18 +715,38 @@ pnpm seed           # prints the generated superadmin credentials
 # 4. Start the dev server
 pnpm dev            # http://localhost:3000
+#                   # use another port with: pnpm dev -p <port>
 \`\`\`
 Then open:
-- \`http://localhost:3000/admin\` — the admin UI. Sign in with the credentials
-  \`pnpm seed\` printed (default \`admin@kywi.dev\` / \`admin123\` unless you set
-  \`KYWI_ADMIN_EMAIL\` / \`KYWI_ADMIN_PASSWORD\`).
+- \`http://localhost:3000/admin\` — the **full admin UI**. Sign in with the
+  credentials \`pnpm seed\` printed (default \`admin@kywi.dev\` / \`admin123\`
+  unless you set \`KYWI_ADMIN_EMAIL\` / \`KYWI_ADMIN_PASSWORD\`). Every surface is
+  there out of the box — dashboard, site tree, media library, users, forms,
+  categories, tags, audiences, settings, and more.
 ${publicLine}
 ${decoupledBlock}
+### The admin
+The entire admin at \`/admin\` is **Kywi's own admin app** (\`KywiAdminApp\`),
+mounted by one host page (\`app/admin/[[...admin]]/page.tsx\`). You did not have to
+build any of it, and you upgrade the whole thing — new surfaces, fixes, polish —
+with:
+\`\`\`bash
+npm update @kywi-software/core   # (or pnpm/yarn up)
+\`\`\`
+**Turn surfaces off per deployment.** Add \`admin.features\` to \`kywi.config.ts\`
+to disable surfaces you don't want in this deployment (e.g. hide Forms or
+Audiences). SuperAdmins can also toggle surfaces at runtime from the
+**Admin Features** surface inside the admin — no redeploy needed.
 ### Create your first page
-In the admin: **Content → Page → + New Page**, fill in a title and slug, save,
-then **Publish**.${a.mode === 'coupled' ? ' Open its slug (e.g. `/about`) to see it live.' : ' Fetch it from `/api/v1/content/page`.'}
+In the admin, open **Site Tree** (or **Content**), create a new **Page**, enter a
+title (the slug is auto-generated from it — or type your own), then click
+**Create**. Open the new page and click **Publish**.${a.mode === 'coupled' ? ' The published page lives at `/<slug>` (e.g. a page with slug `about` is served at `/about`) — open it to see it live.' : ' Fetch it from `/api/v1/content/page`.'}
 ## Notes
@@ -1298,20 +754,19 @@ then **Publish**.${a.mode === 'coupled' ? ' Open its slug (e.g. `/about`) to see
   \`NOTICE: identifier "..." will be truncated\` lines for a few long foreign-key
   names. They are informational — the migration still applies cleanly.
 - **Config lives in \`kywi.config.ts\`** — sites, themes, content types, auth
-  providers and the deployment mode. Edit it (add content types, etc.) and
-  re-run \`pnpm migrate\`, then restart the dev server.
+  providers, the deployment mode, and \`admin.features\`. Edit it (add content
+  types, etc.) and re-run \`pnpm migrate\`, then restart the dev server.
 ## Project layout
 \`\`\`
-kywi.config.ts                    your config: sites, themes, content types, auth, mode
+kywi.config.ts                    your config: sites, themes, content types, auth, mode, admin.features
 middleware.ts                     auth gate + session refresh + cookie→bearer bridge
 next.config.mjs                   required Next config to consume @kywi-software/core
 lib/kywi.ts                       server runtime (DB, API handler, content scope)
-lib/admin-auth.ts                 client admin helpers (re-exported from core)
+lib/config.ts                     single import path for kywi.config.ts
 app/api/v1/[...kywi]/route.ts     the versioned API (delegates to core)
-app/admin/…                       the admin UI (login + content authoring)
-components/admin-shell.tsx        your admin chrome${a.mode === 'coupled' ? '\napp/(site)/…                       your public site (renders published pages)' : '\napp/page.tsx                       returns 404 (no public rendering in this mode)'}
+app/admin/[[...admin]]/page.tsx   mounts the FULL core admin (all surfaces) at /admin${a.mode === 'coupled' ? '\napp/(site)/…                       your public site (renders published pages)' : '\napp/page.tsx                       returns 404 (no public rendering in this mode)'}
 \`\`\`
 `
 }
@@ -1346,26 +801,17 @@ export function buildFileSet(answers) {
     '.env.example': envExample(),
     '.gitignore': gitignore(),
     'README.md': readme(answers),
-    'lib/dompurify-stub.js': dompurifyStub(),
-    // server runtime + client helpers
+    // server runtime + config
     'lib/kywi.ts': libKywi(),
     'lib/config.ts': libConfig(),
-    'lib/admin-auth.ts': libAdminAuth(),
-    'lib/content-types.ts': libContentTypes(),
     // host wiring (thin, over @kywi-software/core/host)
     'middleware.ts': middleware(),
     'app/api/v1/[...kywi]/route.ts': apiRoute(),
     // root
     'app/layout.tsx': rootLayout(),
-    // admin (all modes)
-    'components/admin-shell.tsx': adminShellComponent(),
-    'app/admin/layout.tsx': adminLayout(),
-    'app/admin/page.tsx': adminIndexPage(),
-    'app/admin/login/page.tsx': adminLoginPage(),
-    'app/admin/content/page.tsx': adminContentLandingPage(),
-    'app/admin/content/[type]/page.tsx': adminContentListPage(),
-    'app/admin/content/[type]/new/page.tsx': adminContentNewPage(),
-    'app/admin/content/[type]/[id]/page.tsx': adminContentEditPage(),
+    'app/icon.svg': faviconSvg(),
+    // admin (all modes): the FULL core admin (all surfaces) via one catch-all.
+    'app/admin/[[...admin]]/page.tsx': adminCatchAllPage(),
   }
   if (answers.mode === 'coupled') {

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "create-kywi-app",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Scaffold a new Kywi CMS project — npx create-kywi-app my-site",
   "type": "module",
   "homepage": "https://github.com/Kywi-Software/kywi-cms#readme",