INTEBUILD - DEVELOPER INSTALLATION HANDOVER

PRODUCT BOUNDARY
intebuild builds page content and reusable page templates inside an existing CMS.
Your CMS retains its header, footer, menus, routes, login and normal record writer.
Install the editor in a CMS content form and the published loader in that page's
content area. intebuild does not create or replace your entire website.

Service: https://intebuild.poweredbygravit-e.co.uk
Allowed website/admin origin: https://YOUR-EXISTING-WEBSITE
Public site identifier: PUBLIC_SITE_ID
Output field: content
Documentation: https://intebuild.poweredbygravit-e.co.uk/help/developers
Editor user guide: https://intebuild.poweredbygravit-e.co.uk/help/editing

1. BEFORE INSTALLATION
Back up the CMS record and test on a staging page. A developer must have access
to the CMS form, its trusted HTML output area, permission checks and CSP settings.
Match the registered origin exactly, including https/www/port. A second admin
origin requires its own appropriate site configuration. No wildcard origins.

2. SIMPLE CMS ADAPTER (INTEBUILD CUSTOMER SIGN-IN)
In the existing authorised CMS admin form, use the exact configured field:

<textarea name="content"></textarea>
<button type="button" data-intebuild-site="PUBLIC_SITE_ID"
 data-intebuild-create="true" data-intebuild-output="content"
 data-intebuild-ref="YOUR_STABLE_CMS_RECORD_ID">Open page editor</button>
<script async src="https://intebuild.poweredbygravit-e.co.uk/assets/embed.js"></script>

Use a stable record ID; never use one shared reference for all CMS pages. Each
record+field maps to its own central page. Populate the field with its current
CMS value when reopening the admin form. The generic default field is content;
choose another name in domain settings to match your CMS. Existing mappings keep
their field name. This adapter uses the customer's intebuild login in a popup.
It does not automatically trust the surrounding CMS login.

Publish writes a PUBLIC LOADER into that exact input/textarea and emits input
and change events. The button also emits intebuild-published with detail.field,
installation, pagePublic and applied. Save the CMS record through its normal
validated, CSRF-protected writer once to install the loader. Preserve scripts
in this trusted CMS content field. If your CMS strips scripts, add the central
embed.js once to the host page template and keep the generated content div.
Do not enable arbitrary user scripts throughout your CMS to make this work.
Later central publications update the installed content without another import.

3. BACKEND ADAPTER (EXISTING CMS STAFF PERMISSIONS)
Keep the once-shown ibk_ server credential in the CMS BACKEND only. Before every
session request, verify the current CMS user can edit the exact site/record/field,
check CSRF, and derive origin and stable record ID on the server. Do not trust
arbitrary page IDs or origins supplied by the browser.

POST https://intebuild.poweredbygravit-e.co.uk/api/server/page
Authorization: Bearer SERVER_CREDENTIAL
Content-Type: application/json
{"pageRef":"YOUR_STABLE_CMS_RECORD_ID","field":"content","name":"Page content"}
Response: pageId, source, draftVersion, publishedVersion.

POST https://intebuild.poweredbygravit-e.co.uk/api/server/session
Authorization: Bearer SERVER_CREDENTIAL
Content-Type: application/json
{"pageId":"RESOLVED_PAGE_ID","parentOrigin":"https://YOUR-EXISTING-WEBSITE"}
Response: token, expiresAt, editorUrl, parentOrigin, pageId, sitePublic, pagePublic,
field. This short-lived page-scoped grant may reach the authorised browser only.

Create an iframe using grant.editorUrl. Wait for intebuild-ready from the exact
service origin AND that iframe's contentWindow, then send:
iframe.contentWindow.postMessage({type:'intebuild-session',grant}, SERVICE_ORIGIN)
Never use '*' for a grant. Never put token/server secrets in URLs, storage,
installation code or logs. On intebuild-renew repeat the CMS permission/CSRF
check, then send intebuild-session-update with a newly issued matching grant.

On intebuild-published, derive the display loader from the known service origin
and returned public site/page IDs. Install it through your CMS's trusted normal
writer after checking current permissions and concurrent edits. Other events:
intebuild-dirty (dirty boolean) and intebuild-saved. Guard closing unsaved edits.
For Gravit-e7 use the supplied opt-in connector rather than another adapter:
https://intebuild.poweredbygravit-e.co.uk/help/gravite

4. PUBLIC CONTENT AREA (BASIC HTML OR CMS)
Use the PUBLIC_PAGE_ID from page details or the authenticated publish flow:

<div data-intebuild-site="PUBLIC_SITE_ID" data-intebuild-page="PUBLIC_PAGE_ID"></div>
<script async src="https://intebuild.poweredbygravit-e.co.uk/assets/embed.js"></script>

Place this between your existing header/footer, inside the intended content area.
Your CMS owns the rest of the page. Output is an isolated, auto-height iframe;
host CSS does not style its contents. This requires the hosted service/network
and differs from server-rendered HTML for SEO and availability.

5. SECURITY AND CSP
Public identifiers cannot edit content. Never expose the protected server key.
Host CSP: allow https://intebuild.poweredbygravit-e.co.uk in script-src and frame-src; allow connect-src for
optional browser activity reports. Allow popup sign-in. HTTPS is required in
production. Test tenant boundaries, credential revocation and existing CMS roles.
Keep existing access checks. Advanced editor mode does not grant admin rights.

6. ACCEPTANCE CHECKLIST
- Register/sign in, add the exact domain, choose field and stable record ID.
- Open the editor from the CMS. Change text, layout and an image.
- Save draft, close and reopen: saved text and image must remain.
- Preview desktop/tablet/mobile. Your site's header/footer/menus remain intact.
- Publish, save the CMS form once, then open the public CMS URL signed out.
- Publish a second central edit: the installed content updates without reimport.
- A different customer and an unauthorised CMS staff member cannot edit it.
- Existing CMS record save, navigation and native editor still work.

7. EVERYDAY EDITING HELP
https://intebuild.poweredbygravit-e.co.uk/help/editing
https://intebuild.poweredbygravit-e.co.uk/help/layouts
https://intebuild.poweredbygravit-e.co.uk/help/publishing
https://intebuild.poweredbygravit-e.co.uk/help/troubleshooting

Public demo: https://intebuild.poweredbygravit-e.co.uk/try (no login, temporary browser session only).
Uploads, persistent drafts, publishing and domain settings require an account.
AI, live stock-provider search, payments and CMS enquiry processing are not active.
This handover deliberately includes no protected server credentials.