@acms-subir/core 0.0.1

package/src/lib/calendar/src.ts

@@ -0,0 +1,68 @@
+// Calendar source normalization: turn whatever the author pastes — a Google
+// Calendar embed/share URL, a bare calendar ID, a webcal:// link, any .ics
+// feed — into a canonical ICS URL, plus the reverse (a human-facing Google
+// Calendar page for the widget footer). Pure string logic, imported by both
+// the editor card (client) and the server-side fetcher.
+
+const googleIcs = (id: string) =>
+  `https://calendar.google.com/calendar/ical/${encodeURIComponent(id)}/public/basic.ics`;
+
+export function normalizeCalendarSrc(raw: string): string | null {
+  const input = raw.trim();
+  if (!input) return null;
+
+  // bare calendar ID (email-shaped): church@gmail.com, xyz@group.calendar.google.com
+  if (!input.includes('/') && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input)) return googleIcs(input);
+
+  let url: URL;
+  try {
+    url = new URL(input.replace(/^webcal:\/\//i, 'https://'));
+  } catch {
+    return null;
+  }
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') return null;
+
+  if (url.hostname === 'calendar.google.com') {
+    if (url.pathname.includes('/ical/')) return url.href; // already a feed
+    const src = url.searchParams.get('src');
+    if (src) return googleIcs(src);
+    const cid = url.searchParams.get('cid'); // share links: base64url-encoded calendar ID
+    if (cid) {
+      try {
+        return googleIcs(atob(cid.replace(/-/g, '+').replace(/_/g, '/')));
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+
+  // any other host must point at an actual ICS document
+  if (/\.ics$/i.test(url.pathname) || url.pathname.includes('/ical/')) return url.href;
+  return null;
+}
+
+// Google ICS feed URL → the calendar's public embed page, for the footer
+// link. Non-Google feeds have no canonical page; callers hide the link.
+export function calendarPageUrl(icsUrl: string): string {
+  const m = icsUrl.match(/^https:\/\/calendar\.google\.com\/calendar\/ical\/([^/]+)\//);
+  if (!m) return '';
+  return `https://calendar.google.com/calendar/embed?src=${m[1]}`;
+}
+
+// Short human label for a source, used in the editor's source chips.
+export function calendarSrcLabel(icsUrl: string): string {
+  const m = icsUrl.match(/^https:\/\/calendar\.google\.com\/calendar\/ical\/([^/]+)\//);
+  if (m) {
+    try {
+      return decodeURIComponent(m[1]);
+    } catch {
+      return m[1];
+    }
+  }
+  try {
+    return new URL(icsUrl).hostname;
+  } catch {
+    return icsUrl;
+  }
+}

package/src/lib/content.ts

@@ -0,0 +1,53 @@
+// Content collections: user-visible naming and public URL structure,
+// configured per project via the integration's options in astro.config:
+//   acms({ content: { collections: { posts: {...}, docs: { base: '/docs' } } } })
+// integration.mjs validates and fills defaults before serializing, so the
+// values here are always complete; the fallback only guards stale builds.
+// Collection keys are permanent internal identifiers (DB rows, backup format,
+// /admin/c/<key>) — same rule as brand.ts: renaming protocol identifiers
+// would invalidate existing sessions and backups. Only labels and bases are
+// renameable.
+import { userConfig } from 'virtual:acms-config';
+
+export interface CollectionConfig {
+  singular: string;
+  plural: string;
+  base: string;
+  redirectFrom: string[];
+}
+
+const FALLBACK_POSTS: CollectionConfig = { singular: 'Post', plural: 'Posts', base: '/blog', redirectFrom: [] };
+
+const collections: Record<string, CollectionConfig> =
+  userConfig.content?.collections ?? { posts: FALLBACK_POSTS };
+
+export const CONTENT = {
+  collections,
+  // the built-in collection, always present — most call sites only need this
+  posts: collections.posts ?? FALLBACK_POSTS,
+  tags: { base: userConfig.content?.tags?.base ?? '/tag' },
+};
+
+export const collectionUrl = (key: string, slug?: string) => {
+  const base = (collections[key] ?? CONTENT.posts).base;
+  return slug ? `${base}/${slug}` : base;
+};
+
+// Which collection a public URL belongs to — injected routes share one page
+// file per shape (blog/index.astro, blog/[slug].astro), and Astro's
+// injectRoute can't attach props, so pages resolve their collection from the
+// request path. Longest base wins so nested bases can't shadow each other.
+export function collectionFromPath(pathname: string): (CollectionConfig & { key: string }) | null {
+  let best: (CollectionConfig & { key: string }) | null = null;
+  for (const [key, c] of Object.entries(collections)) {
+    if (pathname === c.base || pathname.startsWith(`${c.base}/`)) {
+      if (!best || c.base.length > best.base.length) best = { key, ...c };
+    }
+  }
+  return best;
+}
+
+// Aliases for the built-in collection — the bulk of call sites.
+export const postsIndexUrl = () => CONTENT.posts.base;
+export const postUrl = (slug: string) => `${CONTENT.posts.base}/${slug}`;
+export const tagUrl = (slug: string) => `${CONTENT.tags.base}/${slug}`;

package/src/lib/dates.ts

@@ -0,0 +1,34 @@
+import type { Settings } from './schema';
+
+// One date formatter for every public surface, honoring the publication
+// timezone + locale settings (Settings → "Timezone & language"). Before this,
+// each page hardcoded its own locale (a mix of en-US and en-GB).
+
+const FALLBACK_LOCALE = 'en-US';
+
+export function siteLocale(settings: Pick<Settings, 'locale'>): string {
+  return settings.locale || FALLBACK_LOCALE;
+}
+
+export function siteLang(settings: Pick<Settings, 'locale'>): string {
+  return siteLocale(settings).split('-')[0] || 'en';
+}
+
+export function formatDate(
+  ts: number | null,
+  settings: Pick<Settings, 'timezone' | 'locale'>,
+  style: 'long' | 'short' = 'long'
+): string {
+  if (!ts) return '';
+  try {
+    return new Date(ts).toLocaleDateString(siteLocale(settings), {
+      year: 'numeric',
+      month: style === 'long' ? 'long' : 'short',
+      day: 'numeric',
+      ...(settings.timezone ? { timeZone: settings.timezone } : {}),
+    });
+  } catch {
+    // bad timezone/locale string: never break rendering over a setting
+    return new Date(ts).toLocaleDateString(FALLBACK_LOCALE, { year: 'numeric', month: 'long', day: 'numeric' });
+  }
+}

package/src/lib/dynamicBlocks.ts

@@ -0,0 +1,115 @@
+import type { ContentRepository } from './repo';
+import type { Post, Settings } from './schema';
+import { slugify } from './schema';
+import { formatDate } from './dates';
+import { CONTENT, collectionUrl } from './content';
+import { renderCalendarBlock } from './calendar/render';
+
+// Dynamic blocks: bodyHtml is a save-time cache, so cards whose content must
+// stay fresh (post lists, calendars) serialize as placeholder divs and get
+// expanded here at request time, right before set:html. Same trusted-author
+// model as the rest of bodyHtml.
+//
+//   <div data-dyn="post-list" data-source="tag" data-tag="projects"
+//        data-layout="grid" data-limit="3" data-show-image="1" data-show-excerpt="1"></div>
+//   <div data-dyn="calendar" data-sources="[…ics urls]" data-view="month"
+//        data-title="…" data-subtitle="…" data-limit="6" data-open-link="1"></div>
+
+const PLACEHOLDER = /<div[^>]*data-dyn="(?:post-list|calendar)"[^>]*>\s*<\/div>/g;
+
+const esc = (s: string) =>
+  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+const attr = (tag: string, name: string) => {
+  const m = tag.match(new RegExp(`data-${name}="([^"]*)"`));
+  return m ? m[1].replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"') : '';
+};
+
+const readMins = (p: Post) =>
+  Math.max(1, Math.round((p.bodyHtml || p.body).replace(/<[^>]+>/g, ' ').split(/\s+/).filter(Boolean).length / 220));
+
+function renderList(posts: Post[], layout: string, showImage: boolean, showExcerpt: boolean, settings: Settings, plural: string): string {
+  if (!posts.length) {
+    return `<section class="dyn-postlist is-empty"><p>No ${esc(plural.toLowerCase())} yet.</p></section>`;
+  }
+  const items = posts
+    .map((p) => {
+      const url = collectionUrl(p.collection, esc(p.slug));
+      const img =
+        showImage && p.cover
+          ? `<a class="dp-thumb" href="${url}"><img src="${esc(p.cover)}" alt="${esc(p.coverAlt)}" loading="lazy" /></a>`
+          : '';
+      const excerpt = showExcerpt && p.excerpt ? `<p class="dp-excerpt">${esc(p.excerpt)}</p>` : '';
+      return (
+        `<article class="dp-item">${img}<div class="dp-body">` +
+        `<div class="dp-meta">${[formatDate(p.publishedAt, settings, 'short'), `${readMins(p)} min read`].filter(Boolean).join(' · ')}</div>` +
+        `<h3 class="dp-title"><a href="${url}">${esc(p.title)}</a></h3>` +
+        `${excerpt}</div></article>`
+      );
+    })
+    .join('');
+  return `<section class="dyn-postlist" data-layout="${esc(layout)}">${items}</section>`;
+}
+
+function calendarAttrs(tag: string) {
+  let sources: string[] = [];
+  try {
+    const parsed = JSON.parse(attr(tag, 'sources') || '[]');
+    if (Array.isArray(parsed)) sources = parsed.filter((s): s is string => typeof s === 'string' && s.startsWith('http'));
+  } catch {
+    /* malformed attr: render the empty state rather than break the page */
+  }
+  const view = ['month', 'week', 'upcoming'].includes(attr(tag, 'view')) ? attr(tag, 'view') : 'month';
+  return {
+    sources,
+    view: view as 'month' | 'week' | 'upcoming',
+    title: attr(tag, 'title'),
+    subtitle: attr(tag, 'subtitle'),
+    limit: Number(attr(tag, 'limit')) || 6,
+    showOpenLink: attr(tag, 'open-link') !== '0',
+  };
+}
+
+export async function expandDynamicBlocks(html: string, repo: ContentRepository): Promise<string> {
+  const hasPostList = html.includes('data-dyn="post-list"');
+  const hasCalendar = html.includes('data-dyn="calendar"');
+  if (!hasPostList && !hasCalendar) return html;
+  const [posts, settings] = await Promise.all([
+    hasPostList ? repo.listPublishedPosts() : Promise.resolve([] as Post[]), // newest first; shared by all blocks on the page
+    repo.getSettings(),
+  ]);
+
+  // String.replace can't await, so calendar blocks (which fetch feeds) are
+  // rendered up front, then spliced in during the synchronous pass.
+  const calendarHtml = new Map<string, string>();
+  if (hasCalendar) {
+    const tags = [...new Set((html.match(PLACEHOLDER) ?? []).filter((t) => t.includes('data-dyn="calendar"')))];
+    const now = Date.now();
+    await Promise.all(
+      tags.map(async (tag) => calendarHtml.set(tag, await renderCalendarBlock(calendarAttrs(tag), settings, now)))
+    );
+  }
+
+  return html.replace(PLACEHOLDER, (tag) => {
+    if (tag.includes('data-dyn="calendar"')) return calendarHtml.get(tag) ?? '';
+    const source = attr(tag, 'source') || 'latest';
+    const tagName = attr(tag, 'tag');
+    // which collection the block draws from; 'posts' unless the card says otherwise
+    const collection = attr(tag, 'collection') || 'posts';
+    const layout = ['list', 'grid', 'feature'].includes(attr(tag, 'layout')) ? attr(tag, 'layout') : 'list';
+    const limit = Math.min(12, Math.max(1, Number(attr(tag, 'limit')) || 3));
+    const showImage = attr(tag, 'show-image') !== '0';
+    const showExcerpt = attr(tag, 'show-excerpt') !== '0';
+    let filtered = posts.filter((p) => p.collection === collection);
+    if (source === 'featured') filtered = filtered.filter((p) => p.featured);
+    if (source === 'tag' && tagName) {
+      filtered = filtered.filter((p) =>
+        p.tags.some((t) => t.toLowerCase() === tagName.toLowerCase() || slugify(t) === slugify(tagName))
+      );
+    }
+    return renderList(
+      filtered.slice(0, limit), layout, showImage, showExcerpt, settings,
+      CONTENT.collections[collection]?.plural ?? CONTENT.posts.plural
+    );
+  });
+}

package/src/lib/env.ts

@@ -0,0 +1,6 @@
+/// <reference types="astro/client" />
+
+export function env(key: string, fallback = ''): string {
+  const v = (import.meta.env as Record<string, string | undefined>)[key] ?? process.env[key];
+  return v ?? fallback;
+}

package/src/lib/highlightCode.ts

@@ -0,0 +1,44 @@
+import { createLowlight, common } from 'lowlight';
+import { toHtml } from 'hast-util-to-html';
+
+// Server-side syntax highlighting for saved post/page HTML. Both the TipTap
+// code block (extensions/codeBlock.tsx) and marked emit
+// `<pre><code class="language-x">…</code></pre>` with entity-escaped text, so
+// one regex pass covers the editor and legacy-markdown pipelines. Runs on
+// Workers — lowlight is pure JS. The published page ships no highlighter JS;
+// token colors come from site.css.
+
+const lowlight = createLowlight(common);
+
+// Text inside <code> was escaped by the serializer; &amp; must be decoded last.
+const decode = (s: string) =>
+  s
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#0?39;/g, "'")
+    .replace(/&#x27;/gi, "'")
+    .replace(/&amp;/g, '&');
+
+// grammar name → reader-facing badge label
+const BADGE: Record<string, string> = {
+  xml: 'html',
+  javascript: 'js',
+  typescript: 'ts',
+  python: 'py',
+  markdown: 'md',
+  csharp: 'c#',
+};
+
+export function highlightCodeHtml(html: string): string {
+  if (!html.includes('<pre><code class="language-')) return html;
+  return html.replace(
+    /<pre><code class="language-([\w#+-]+)">([\s\S]*?)<\/code><\/pre>/g,
+    (match, lang: string, code: string) => {
+      if (!lowlight.registered(lang)) return match;
+      const tree = lowlight.highlight(lang, decode(code));
+      // data-language feeds the pure-CSS corner badge on the public page
+      return `<pre data-language="${BADGE[lang] ?? lang}"><code class="hljs language-${lang}">${toHtml(tree)}</code></pre>`;
+    }
+  );
+}

package/src/lib/i18n.ts

@@ -0,0 +1,40 @@
+// Site languages, configured per project via the integration's options:
+//   acms({ i18n: { locales: ['en', 'es'], defaultLocale: 'en' } })
+// integration.mjs validates before serializing (locale format, URL prefix
+// collisions), so the values here are always trustworthy. The default locale
+// owns the root URL; every other locale is served under /<locale>. On page
+// rows the default locale is stored as '' (the pre-i18n value), so existing
+// databases need no data migration.
+import { userConfig } from 'virtual:acms-config';
+
+const cfg = userConfig.i18n ?? { locales: [], defaultLocale: '' };
+
+export const I18N = {
+  locales: cfg.locales,
+  defaultLocale: cfg.defaultLocale,
+  // one configured locale is legal but changes nothing user-visible
+  enabled: cfg.locales.length > 1,
+};
+
+// Which locale a public URL belongs to — same path-derivation trick as
+// collectionFromPath: injected routes can't carry props, so /es resolves its
+// locale from the request path. Non-home paths fall through to the default.
+export function localeFromPath(pathname: string): string {
+  for (const l of I18N.locales) {
+    if (l === I18N.defaultLocale) continue;
+    if (pathname === `/${l}` || pathname.startsWith(`/${l}/`)) return l;
+  }
+  return I18N.defaultLocale;
+}
+
+// the home URL for a locale: '/' for the default, '/<locale>' otherwise
+export function localeHomeUrl(locale: string): string {
+  return !locale || locale === I18N.defaultLocale ? '/' : `/${locale}`;
+}
+
+// page rows store '' for the default locale; normalize admin input to that
+// convention and drop values that aren't configured locales
+export function normalizePageLocale(locale: string): string {
+  if (!locale || locale === I18N.defaultLocale) return '';
+  return I18N.locales.includes(locale) ? locale : '';
+}

package/src/lib/markdown.ts

@@ -0,0 +1,7 @@
+import { marked } from 'marked';
+
+// Single-admin CMS: content authors are trusted, so raw HTML in markdown is
+// allowed (matches the trusted-widget model). Revisit if multi-user lands.
+export function renderMarkdown(md: string): string {
+  return marked.parse(md, { async: false }) as string;
+}

package/src/lib/media/store.ts

@@ -0,0 +1,95 @@
+// Binary storage behind the media rows — R2 on Workers, ./data/media on
+// plain Node. Mirrors the repo adapter pattern: routes only ever import
+// getMediaStore().
+
+export interface StoredObject {
+  body: BodyInit;
+  contentType: string;
+  size?: number;
+}
+
+export interface MediaStore {
+  put(key: string, data: ArrayBuffer, contentType: string): Promise<void>;
+  get(key: string): Promise<StoredObject | null>;
+  delete(key: string): Promise<void>;
+}
+
+interface R2Bucket {
+  put(key: string, value: ArrayBuffer, opts?: { httpMetadata?: { contentType?: string } }): Promise<unknown>;
+  get(key: string): Promise<{ body: ReadableStream; httpMetadata?: { contentType?: string }; size: number } | null>;
+  delete(key: string): Promise<void>;
+}
+
+class R2Store implements MediaStore {
+  constructor(private bucket: R2Bucket) {}
+  async put(key: string, data: ArrayBuffer, contentType: string) {
+    await this.bucket.put(key, data, { httpMetadata: { contentType } });
+  }
+  async get(key: string) {
+    const obj = await this.bucket.get(key);
+    if (!obj) return null;
+    return {
+      body: obj.body,
+      contentType: obj.httpMetadata?.contentType ?? contentTypeFromKey(key),
+      size: obj.size,
+    };
+  }
+  async delete(key: string) {
+    await this.bucket.delete(key);
+  }
+}
+
+class FsStore implements MediaStore {
+  private root = './data/media';
+  private safe(key: string) {
+    if (key.includes('..') || key.startsWith('/')) throw new Error('bad media key');
+    return `${this.root}/${key}`;
+  }
+  async put(key: string, data: ArrayBuffer, _contentType: string) {
+    const fs = await import(/* @vite-ignore */ 'node:fs/promises');
+    const path = this.safe(key);
+    await fs.mkdir(path.slice(0, path.lastIndexOf('/')), { recursive: true });
+    await fs.writeFile(path, new Uint8Array(data));
+  }
+  async get(key: string) {
+    const fs = await import(/* @vite-ignore */ 'node:fs/promises');
+    try {
+      const buf = await fs.readFile(this.safe(key));
+      return {
+        body: new Uint8Array(buf).buffer as ArrayBuffer,
+        contentType: contentTypeFromKey(key),
+        size: buf.byteLength,
+      };
+    } catch {
+      return null;
+    }
+  }
+  async delete(key: string) {
+    const fs = await import(/* @vite-ignore */ 'node:fs/promises');
+    await fs.rm(this.safe(key), { force: true });
+  }
+}
+
+function contentTypeFromKey(key: string): string {
+  const ext = key.slice(key.lastIndexOf('.') + 1).toLowerCase();
+  const map: Record<string, string> = {
+    webp: 'image/webp', jpg: 'image/jpeg', jpeg: 'image/jpeg', png: 'image/png',
+    gif: 'image/gif', svg: 'image/svg+xml', avif: 'image/avif',
+    pdf: 'application/pdf', zip: 'application/zip', json: 'application/json',
+    txt: 'text/plain', csv: 'text/csv', md: 'text/markdown',
+    doc: 'application/msword', docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+    xls: 'application/vnd.ms-excel', xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+    ppt: 'application/vnd.ms-powerpoint', pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+    epub: 'application/epub+zip',
+  };
+  return map[ext] ?? 'application/octet-stream';
+}
+
+let store: MediaStore | null = null;
+
+export function getMediaStore(locals?: unknown): MediaStore {
+  if (store) return store;
+  const bucket = (locals as { runtime?: { env?: { MEDIA?: unknown } } } | undefined)?.runtime?.env?.MEDIA;
+  store = bucket ? new R2Store(bucket as R2Bucket) : new FsStore();
+  return store;
+}

package/src/lib/net.ts

@@ -0,0 +1,51 @@
+// SSRF guard shared by every server-side fetch of a user-supplied URL (the
+// bookmark card's metadata scrape, the calendar card's ICS feed): block
+// loopback, RFC1918, CGNAT, link-local and IPv6 ULA hosts so a pasted URL —
+// or a redirect hop — can never reach the Worker's own network.
+export function isPrivateHost(hostname: string): boolean {
+  const h = hostname.toLowerCase();
+  if (h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')) return true;
+  const v4 = h.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const [a, b] = [Number(v4[1]), Number(v4[2])];
+    return (
+      a === 0 || a === 10 || a === 127 || (a === 100 && b >= 64 && b <= 127) ||
+      (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168)
+    );
+  }
+  if (h.includes(':')) return h === '::1' || h.startsWith('fe80') || h.startsWith('fc') || h.startsWith('fd') || h.startsWith('[');
+  return false;
+}
+
+// Fetch that follows redirects manually so EVERY hop is re-checked against the
+// private-host guard (a public URL 302ing to 127.0.0.1 or a cloud metadata IP
+// must not slip through). Returns null on unreachable/blocked.
+export async function fetchPublicUrl(
+  url: string,
+  init: { accept: string; userAgent: string; timeoutMs?: number }
+): Promise<{ res: Response; finalUrl: string } | null> {
+  let current = url;
+  for (let hop = 0; hop < 5; hop++) {
+    let u: URL;
+    try {
+      u = new URL(current);
+    } catch {
+      return null;
+    }
+    if (!/^https?:$/.test(u.protocol) || isPrivateHost(u.hostname)) return null;
+    const res = await fetch(u.href, {
+      redirect: 'manual',
+      signal: AbortSignal.timeout(init.timeoutMs ?? 8000),
+      headers: { 'User-Agent': init.userAgent, Accept: init.accept },
+    }).catch(() => null);
+    if (!res) return null;
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers.get('location');
+      if (!loc) return null;
+      current = new URL(loc, u.href).href;
+      continue;
+    }
+    return { res, finalUrl: current };
+  }
+  return null;
+}

package/src/lib/preview.ts

@@ -0,0 +1,28 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { env } from './env';
+
+// Signed, shareable preview links: /preview/<type>/<id>?token=<exp>.<sig>
+// Works logged-out (send to a reviewer), expires after a week by default.
+
+const WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+
+function sig(payload: string): string {
+  const secret = env('SESSION_SECRET');
+  if (!secret) throw new Error('SESSION_SECRET is not set — add it to .env');
+  return createHmac('sha256', secret).update(`preview.${payload}`).digest('hex');
+}
+
+export function createPreviewToken(type: 'post' | 'page', id: string, ttlMs = WEEK_MS): string {
+  const exp = Date.now() + ttlMs;
+  return `${exp}.${sig(`${type}.${id}.${exp}`)}`;
+}
+
+export function verifyPreviewToken(type: string, id: string, token: string | undefined): boolean {
+  if (!token) return false;
+  const [expStr, s] = token.split('.');
+  if (!expStr || !s) return false;
+  if (Number(expStr) < Date.now()) return false;
+  const expected = sig(`${type}.${id}.${expStr}`);
+  if (s.length !== expected.length) return false;
+  return timingSafeEqual(Buffer.from(s), Buffer.from(expected));
+}

package/src/lib/repo/d1.ts

@@ -0,0 +1,44 @@
+import { SqlRepository, type SqlDriver, type SqlStatement } from './sql';
+
+// Cloudflare D1 (SQLite on Workers). All queries and row mapping live in the
+// shared SqlRepository — this file only adapts D1's prepare/bind/batch API.
+
+type Row = Record<string, unknown>;
+
+interface D1Result { results: Row[] }
+interface D1Stmt {
+  bind(...args: unknown[]): D1Stmt;
+  all(): Promise<D1Result>;
+  first<T = Row>(): Promise<T | null>;
+  run(): Promise<unknown>;
+}
+export interface D1Database {
+  prepare(sql: string): D1Stmt;
+  batch(stmts: D1Stmt[]): Promise<unknown>;
+}
+
+class D1Driver implements SqlDriver {
+  constructor(private db: D1Database) {}
+
+  private stmt({ sql, args }: SqlStatement): D1Stmt {
+    const s = this.db.prepare(sql);
+    return args?.length ? s.bind(...args) : s;
+  }
+  async all(sql: string, args?: unknown[]) {
+    const { results } = await this.stmt({ sql, args }).all();
+    return results;
+  }
+  async run(sql: string, args?: unknown[]) {
+    await this.stmt({ sql, args }).run();
+  }
+  async batch(stmts: SqlStatement[]) {
+    if (!stmts.length) return;
+    await this.db.batch(stmts.map((s) => this.stmt(s)));
+  }
+}
+
+export class D1Repository extends SqlRepository {
+  constructor(db: D1Database) {
+    super(new D1Driver(db));
+  }
+}

package/src/lib/repo/index.ts

@@ -0,0 +1,23 @@
+import type { ContentRepository } from './types';
+
+let repo: ContentRepository | null = null;
+
+// Adapter priority: Cloudflare D1 (when the Worker binding exists —
+// production on Workers and local wrangler/astro dev via platformProxy)
+// → libSQL file (plain Node self-hosting).
+// Pass Astro.locals (or the endpoint's `locals`) so the D1 binding is
+// reachable; the chosen adapter is cached for the isolate's lifetime.
+export async function getRepo(locals?: unknown): Promise<ContentRepository> {
+  if (repo) return repo;
+  const d1 = (locals as { runtime?: { env?: { DB?: unknown } } } | undefined)?.runtime?.env?.DB;
+  if (d1) {
+    const { D1Repository } = await import('./d1');
+    repo = new D1Repository(d1 as import('./d1').D1Database);
+  } else {
+    const { SqliteRepository } = await import('./sqlite');
+    repo = new SqliteRepository();
+  }
+  return repo;
+}
+
+export type { ContentRepository };