# Club Page Studio

A narrow one-page club/event editor using bundled GrapesJS core 0.23.9 and
fflate 0.8.3. Edit nine text fields, choose one of three palettes and three local
illustrations (or none), then save editable JSON or export an HTML/CSS/SVG ZIP.
It does not host or publish a site, register a domain, provide a CMS or shop,
collect registrations, run custom scripts, import HTML, or accept other assets.
Shared Keep & reopen accepts this native editable JSON at most 20,000 bytes.
Website ZIP and HTML are separate outputs, not imports. Nothing transfers automatically.

## Run the included source

All runtime files are already bundled; no package install or build is needed to
serve them. From this folder, run `python3 verify-source.py`, then serve the
complete `site/` folder through a local or chosen static HTTP server. For example,
`python3 -m http.server 8000 --bind 127.0.0.1 --directory site` starts a local
server. Open http://127.0.0.1:8000/ in a current browser. Keep relative files
together. Local file opening has not been browser-qualified.

The downloadable source is this standalone editor, not the older Hub shell.
`public-source-files.json` is its exact packaging allowlist. `SOURCE-MANIFEST.json`
pins every other allowlisted file. The Python verification uses only the standard
library and checks file hashes, vendor locks, dependency integrity metadata and
incorporated notices without an install or network request.

## Reproduce the deeper tests

With a supported current Node/npm environment, install the exact lockfile with
`npm ci --ignore-scripts`. Run `npm run verify-vendor`, `npm test`, and
`npm run check`. Those tests need the separately installed development packages.
They check actual pinned GrapesJS in jsdom, not a substitute engine. No download
occurs in the test runner. To restore vendor copies from the verified installed
packages, run `node evidence/hardening/verify-vendor.cjs --copy`.

The narrow adapter preserves each first standards-mode doctype write and disables
repeated writes in GrapesJS's visible and internal parsing canvases. It checks
version and initialization shape, then fails closed on unexpected behavior.
Requalify every engine upgrade. See PUBLIC-QA.txt for completed checks and limits.

## Browser checks and limits

The isolated Cloud Chromium desktop workflow completed actual JSON save,
fresh reviewed reopen, revision and final reopen, plus actual ZIP export and
static-HTTP rendering of its page. The Hub release preview separately passed
search-to-editor navigation, first-Tab Skip/Return focus, clean desktop layout,
review/Cancel preservation, review/Replace restoration, byte-exact JSON re-export
and ZIP validation with identical included JSON. A 360px iframe wrapper layout
check found no horizontal overflow.

The isolated narrow editor's save request did not yield a confirmed download.
Neither narrow check is a completed phone workflow. Physical-phone,
screen-reader, IME, full network-capture and file:// compatibility are not
certified. These are agent-run fictional-task checks, not real-user outcomes.
See PUBLIC-QA.txt for the precise scope and remaining limitations.

## Keep and share carefully

JSON and ZIP downloads are unencrypted. Both retain all supported fields,
including hidden What-to-bring text, and the ZIP contains editable JSON.
Hiding a section does not delete it. Inspect all fields and remove private
content before sharing. Nothing publishes automatically. To revise a page,
return here and open the editable JSON, review it and explicitly replace the
current page. Save again before closing; there is no automatic recovery or sync.

The original wrapper, template, CSS and illustrations use `site/LICENSE.txt`
(scoped MIT). Dependencies retain `site/THIRD-PARTY-NOTICES.txt`, including
GrapesJS BSD-3-Clause and fflate MIT. Visitor content keeps its own rights.

## Focused comparison

Webflow code export is included in paid Workspace plans; exported sites can be
hosted elsewhere without keeping that plan. Club Page Studio offers a much
narrower one-page HTML/CSS/SVG ZIP without an account. Hosting is separate.
Official evidence: https://help.webflow.com/hc/en-us/articles/33961386739347-How-do-I-export-my-Webflow-site-code
No price, feature-parity, realized savings or real-user outcome claim is made.

## Shared project-file continuity

`site/project.mjs` is the authoritative, dependency-free native validator.
`studio.js` imports it as a browser module; serve the complete folder over HTTP.
The bundle pins an exact copy plus the scoped MIT notice, without loading
GrapesJS, fflate, the editor or any native replacement controller. The native
file handler retains both File.size and re-encoded text checks at 20,000 bytes.
The validator checks nine original UTF-16 field lengths and settings before
returning its normalized clone. Bundle transport discards that clone and keeps
exact original bytes under its stricter fatal UTF-8 and BOM rules.

Choose Club Page Studio editable JSON in Keep & reopen, add the saved file,
download a bundle, and reopen that download before relying on it. Extract the
neutral `club-page-N.json` file, open it manually here, review every field and
choose Keep editing or Replace page. Hidden text, titles and filenames are not
shown in the bundle UI. Hiding a section does not remove its text.

The extracted-module change passed the 75 real-GrapesJS jsdom contract checks
and automated bundle tests. A separate Cloud Chromium desktop preview then
verified actual module loading and the full fictional continuity workflow.
Earlier native-browser results above describe the pre-extraction release.

The Cloud Chromium desktop preview passed the fictional Learn → Club Page →
bundle → native revision workflow with actual downloads. A manually written
Learn brief and a manually composed Club Page were exported, bundled, reopened
in a fresh session and extracted with exact original bytes. The unchanged bundle
copy also matched. Club Page showed all incoming values, including hidden text;
Keep editing preserved a revised time, and explicit Replace page restored the
reviewed data. Editing the actual canvas time from 2–3 pm to 3–4 pm updated the
sidebar. Revised JSON and website ZIP downloaded; their included JSON matched,
and a fresh native review/replace/re-export matched the revised JSON exactly.
Learn also passed fresh native review, restore and exact re-export with Remember
off and no checked learning-outcome or mastery flags. Hidden What-to-bring text
remained in JSON and was absent from visible exported HTML. Corrupt-checksum
reopening failed generically and cleared extraction controls; cancel did too.

This was an agent-run fictional task, not a real-user or learning-outcome study.
The actual Club fixture used LF. Bundle transport preserves exact bytes; native
reopening can normalize CRLF or older Mac line endings, so whole-chain byte
identity is not claimed for arbitrary inputs. Neutral extraction filenames are
verified by source and tests; the browser download API exposed opaque saved
paths rather than suggested names. Public release smoke checks are still pending.
No new physical-phone, screen-reader, IME, full network-capture or file:// claim
is added. Website ZIP/HTML remain separate outputs, not imports or publication.