feat(cmsblock): first iteration of composable CMS block editor and Express service

launcher/scripts/widget-complexity.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Run from the platform root, independently of the caller's working directory.
+root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)"
+widget="${1:-}"
+
+if [[ ! "$widget" =~ ^[a-z][a-z0-9_-]*$ ]]; then
+    echo "Usage: mise run complexity -- <widget>" >&2
+    echo "Widget must be a single name such as cmsblock or productgallery." >&2
+    exit 2
+fi
+
+widget_dir="$root/widgets/$widget"
+if [[ ! -d "$widget_dir" ]]; then
+    echo "Unknown widget '$widget': $widget_dir does not exist." >&2
+    exit 2
+fi
+
+targets=()
+for directory in src api; do
+    if [[ -d "$widget_dir/$directory" ]]; then
+        targets+=("$directory")
+    fi
+done
+
+if [[ ${#targets[@]} -eq 0 ]]; then
+    echo "Widget '$widget' has neither src nor api to analyze." >&2
+    exit 2
+fi
+
+if ! command -v lizard >/dev/null 2>&1; then
+    echo "Lizard not found. Run this check through mise to install the pinned tool." >&2
+    exit 2
+fi
+
+cd "$widget_dir"
+exec lizard "${targets[@]}" -C 10 -a 5

mise.toml

@@ -45,3 +45,8 @@ run = "./launcher/scripts/widgets-deploy.sh"
 [tasks."widgets-test"]
 description = "Test the ReactEdge deployed widgets"
 run = "./launcher/scripts/widgets-test.sh"
+
+[tasks.complexity]
+description = "Check Lizard complexity for one widget: mise run complexity -- <widget>"
+tools = {uv = "latest", "pipx:lizard" = "1.24.1"}
+run = "./launcher/scripts/widget-complexity.sh {{arg(name='widget', required=true)}}"

services/cmsblock/.env.sample

@@ -0,0 +1,4 @@
+PORT=4190
+FRONTEND_URL=http://localhost:3000
+OTEL_HOST=http://localhost:4318
+OTEL_SERVICE_NAME=reactedge-cmsblock

services/cmsblock/.gitignore

@@ -0,0 +1,3 @@
+# CMSBlock drafts and environment secrets are runtime data.
+data/
+.env

services/cmsblock/README.md

@@ -0,0 +1,69 @@
+# CMSBlock — first iteration
+
+This service was scaffolded from Operational Intelligence's `create_server`
+MCP template, like ReactEdge's ListingRecord service. It uses Express,
+TypeScript, request/route OpenTelemetry spans and separate access, controller,
+routes, and model layers.
+
+This **development-only** iteration supports a single block, `demo`,
+with a deterministic generator (not an AI model).
+
+## Start locally
+
+```bash
+npm --prefix services/cmsblock ci
+npm --prefix services/cmsblock start
+```
+
+Default HTTP address: `http://127.0.0.1:4190`.
+
+For local development, start the CMSBlock widget separately:
+
+```bash
+npm --prefix widgets/cmsblock dev
+```
+
+The widget uses `http://127.0.0.1:4190/cmsblock/blocks/demo` by default.
+Set `VITE_CMSBLOCK_URL` to override the service origin.
+
+## API
+
+| Method | Path | Action |
+| --- | --- | --- |
+| GET | `/cmsblock/status` | Scaffold status |
+| GET | `/cmsblock/blocks/demo` | Read saved block |
+| PUT | `/cmsblock/blocks/demo` | Save source, style and layout |
+| POST | `/cmsblock/blocks/demo/generate` | Generate a revision for review |
+| POST | `/cmsblock/blocks/demo/approve` | Publish the pending revision |
+| POST | `/cmsblock/blocks/demo/reject` | Discard the pending revision |
+
+Source content remains separate from pending and approved HTML/CSS. New
+drafts do not change the approved revision until approval. The JSON store
+uses `data/demo.json` by default and is compatible with the old prototype.
+The generator supports three editorial styles and three image arrangements.
+
+Set `PORT`, `CMSBLOCK_DATA_DIR`, `FRONTEND_URL` (comma-separated CORS
+origins), `OTEL_HOST`, and `OTEL_SERVICE_NAME` as needed.
+
+## Checks
+
+```bash
+npm --prefix services/cmsblock run typecheck
+npm --prefix services/cmsblock test
+mise run complexity -- cmsblock
+```
+
+Run these checks locally when changing the service. To verify startup, call
+`curl --fail http://127.0.0.1:4190/cmsblock/status` after starting it.
+
+## Limitations
+
+**Do not expose this API to the public internet.** It has no authentication,
+authorization or rate limiting. It listens on loopback by default; CORS is
+not an authentication mechanism. The deterministic generator converts
+supplied HTML to escaped text and retains up to three HTTPS image URLs;
+it does not preserve arbitrary HTML or interpret style reference images.
+The widget uses sandboxed iframe previews. Published output will require
+separate security review and sanitisation before it can be served directly
+as SSR markup. Telemetry exporter delivery is not covered by the current
+HTTP lifecycle test.