@cancia/astro 0.11.0 → 0.12.0

package/dist/{upload-DwCGjXbz.d.ts → email-BRK4WAO2.d.ts}

@@ -10,4 +10,12 @@ declare function makeLocalUploadHandler(opts: {
     maxMB?: number;
 }): UploadHandler;
 
-export { type UploadHandler as U, makeLocalUploadHandler as m };
+interface LoginEmailPayload {
+    to: string;
+    /** The full, ready-to-click URL. */
+    url: string;
+    site: string;
+}
+type SendLoginEmail = (payload: LoginEmailPayload) => Promise<void>;
+
+export { type SendLoginEmail as S, type UploadHandler as U, makeLocalUploadHandler as m };

package/dist/endpoints/auth-callback.d.ts

@@ -0,0 +1 @@
+export { c as POST } from './auth-request.js';

package/dist/endpoints/auth-callback.js

@@ -0,0 +1,9 @@
+import {
+  callback
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  callback as POST
+};

package/dist/endpoints/auth-logout.d.ts

@@ -0,0 +1 @@
+export { l as POST } from './auth-request.js';

package/dist/endpoints/auth-logout.js

@@ -0,0 +1,9 @@
+import {
+  logout
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  logout as POST
+};

package/dist/endpoints/auth-request.d.ts

@@ -0,0 +1,18 @@
+/** POST /api/cancia/auth/request — { email } */
+declare function requestLink({ request }: {
+    request: Request;
+}): Promise<Response>;
+/** POST /api/cancia/auth/callback — { token } */
+declare function callback({ request }: {
+    request: Request;
+}): Promise<Response>;
+/** POST /api/cancia/auth/logout */
+declare function logout({ request }: {
+    request: Request;
+}): Promise<Response>;
+/** GET /api/cancia/auth/session — "am I signed in?" */
+declare function session({ request }: {
+    request: Request;
+}): Promise<Response>;
+
+export { requestLink as POST, callback as c, logout as l, session as s };

package/dist/endpoints/auth-request.js

@@ -0,0 +1,9 @@
+import {
+  requestLink
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  requestLink as POST
+};

package/dist/endpoints/auth-session.d.ts

@@ -0,0 +1 @@
+export { s as GET } from './auth-request.js';

package/dist/endpoints/auth-session.js

@@ -0,0 +1,9 @@
+import {
+  session
+} from "../chunk-DEI3FBNY.js";
+import "../chunk-XZCXWILA.js";
+import "../chunk-ECPYHIAW.js";
+import "../chunk-6GUOGDWO.js";
+export {
+  session as GET
+};

package/dist/endpoints/auth.js

@@ -1,13 +1,21 @@
 import {
   createRateLimiter,
   runAuth
-} from "../chunk-GJIX7MWC.js";
+} from "../chunk-ECPYHIAW.js";
 
 // src/endpoints/auth.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";
 var limiter = createRateLimiter();
 async function POST({ request }) {
-  const { secret } = getCanciaRuntime();
+  const { secret, auth } = getCanciaRuntime();
+  if (auth) {
+    return new Response(
+      JSON.stringify({
+        error: "This site uses email login. Open the site and request a link instead."
+      }),
+      { status: 403, headers: { "Content-Type": "application/json" } }
+    );
+  }
   return runAuth({ request, secret, limiter });
 }
 export {

package/dist/endpoints/content.js

@@ -2,20 +2,20 @@ import {
   extractRoute,
   invalidateOnSave
 } from "../chunk-VGRG5DN7.js";
+import {
+  guardRequest
+} from "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-X6ZFFGIA.js";
 
 // src/endpoints/content.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";
-function checkAuth(req, secret) {
-  if (!secret) return null;
-  const token = req.headers.get("Authorization")?.replace("Bearer ", "").trim();
-  if (token !== secret)
-    return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-  return null;
+async function checkAuth(req, secret, auth) {
+  return (await guardRequest(req, { secret, auth })).deny;
 }
 async function GET({ request }) {
-  const { storage, secret } = getCanciaRuntime();
-  const deny = checkAuth(request, secret);
+  const { storage, secret, auth } = getCanciaRuntime();
+  const deny = await checkAuth(request, secret, auth);
   if (deny) return deny;
   const site = new URL(request.url).searchParams.get("site");
   if (!site)
@@ -27,8 +27,8 @@ async function GET({ request }) {
 }
 async function POST(context) {
   const { request } = context;
-  const { storage, secret, publishMode } = getCanciaRuntime();
-  const deny = checkAuth(request, secret);
+  const { storage, secret, publishMode, auth } = getCanciaRuntime();
+  const deny = await checkAuth(request, secret, auth);
   if (deny) return deny;
   const body = await request.json().catch(() => null);
   if (!body?.site || !body?.key || !body?.lang || body?.value === void 0)
@@ -43,8 +43,8 @@ async function POST(context) {
   });
 }
 async function DELETE({ request }) {
-  const { storage, secret } = getCanciaRuntime();
-  const deny = checkAuth(request, secret);
+  const { storage, secret, auth } = getCanciaRuntime();
+  const deny = await checkAuth(request, secret, auth);
   if (deny) return deny;
   const body = await request.json().catch(() => null);
   if (!body?.site || !body?.key || !body?.lang)

package/dist/endpoints/lists.js

@@ -4,7 +4,9 @@ import {
 } from "../chunk-VGRG5DN7.js";
 import {
   makeListsRoutes
-} from "../chunk-GD37XVES.js";
+} from "../chunk-5R3I5RLT.js";
+import "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-X6ZFFGIA.js";
 import "../chunk-VL6FO446.js";
 import "../chunk-7IA5B5CF.js";
@@ -18,6 +20,7 @@ function getRoutes() {
     projectRoot: rt.projectRoot,
     schemasPath: rt.schemasPath,
     secret: rt.secret,
+    auth: rt.auth,
     defaultLocale: rt.defaultLocale
   });
 }

package/dist/endpoints/publish.js

@@ -1,6 +1,10 @@
 import {
   runPublish
 } from "../chunk-5RCLBWRH.js";
+import {
+  guardRequest
+} from "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-U7V53JX7.js";
 
 // src/endpoints/publish.ts
@@ -14,13 +18,11 @@ async function POST({ request }) {
     publishRepo,
     publishGithubToken,
     publishMode,
-    secret
+    secret,
+    auth
   } = getCanciaRuntime();
-  if (secret) {
-    const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-    if (token !== secret)
-      return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-  }
+  const deny = (await guardRequest(request, { secret, auth })).deny;
+  if (deny) return deny;
   const hook = deployHook ?? process.env.CANCIA_DEPLOY_HOOK;
   const ghToken = publishGithubToken ?? process.env.CANCIA_GITHUB_TOKEN?.trim();
   return runPublish({

package/dist/endpoints/schemas.js

@@ -1,6 +1,8 @@
 import {
   makeSchemasRoute
-} from "../chunk-T2GDBQJ7.js";
+} from "../chunk-DOFLZ7KG.js";
+import "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 import "../chunk-VL6FO446.js";
 import "../chunk-QQEUCOXQ.js";
 import "../chunk-KHCFVVYV.js";
@@ -12,7 +14,8 @@ async function GET({ request }) {
   const route = makeSchemasRoute({
     projectRoot: rt.projectRoot,
     schemasPath: rt.schemasPath,
-    secret: rt.secret
+    secret: rt.secret,
+    auth: rt.auth
   });
   return route(request);
 }

package/dist/endpoints/upload.js

@@ -2,16 +2,17 @@ import {
   detectUploadType,
   isValidSite
 } from "../chunk-RHFTQW4W.js";
+import {
+  guardRequest
+} from "../chunk-4PYVIIOO.js";
+import "../chunk-6GUOGDWO.js";
 
 // src/endpoints/upload.ts
 import { getCanciaRuntime } from "virtual:cancia/runtime";
 async function POST({ request }) {
-  const { uploadHandler, secret, maxUploadMB } = getCanciaRuntime();
-  if (secret) {
-    const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-    if (token !== secret)
-      return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-  }
+  const { uploadHandler, secret, maxUploadMB, auth } = getCanciaRuntime();
+  const deny = (await guardRequest(request, { secret, auth })).deny;
+  if (deny) return deny;
   const form = await request.formData().catch(() => null);
   const file = form?.get("file");
   const site = form?.get("site");

package/dist/{git-backed-DtiH52EI.d.ts → git-backed-CwTFfUS4.d.ts}

@@ -1,5 +1,5 @@
-import { C as CanciaStorage, a as CanciaStorageV2 } from './types-BMlLS-OS.js';
-import { G as GitHubCommitter, a as GitHubClient, F as FetchLike } from './github-client-Db0pIrqE.js';
+import { d as CanciaStorage, C as CanciaStorageV2 } from './types-CKzfz5iu.js';
+import { b as GitHubCommitter, G as GitHubClient, F as FetchLike } from './github-client-Db5EPcSL.js';
 
 declare function createJsonFileAdapter(filePath?: string): CanciaStorage;
 

package/dist/{github-client-Db0pIrqE.d.ts → github-client-Db5EPcSL.d.ts}

@@ -54,4 +54,4 @@ interface GitHubClient {
 }
 declare function createGitHubClient(opts: GitHubClientOptions): GitHubClient;
 
-export { type CommitFile as C, type FetchLike as F, type GitHubCommitter as G, type GitHubClient as a, type GitHubClientOptions as b, createGitHubClient as c };
+export { type CommitFile as C, type FetchLike as F, type GitHubClient as G, type GitHubClientOptions as a, type GitHubCommitter as b, createGitHubClient as c };

package/dist/index.d.ts

@@ -1,12 +1,12 @@
 import { AstroIntegration } from 'astro';
-import { C as CanciaStorage, a as CanciaStorageV2 } from './types-BMlLS-OS.js';
-export { b as CanciaKVStore, c as CanciaListStore, d as CanciaPageStore, L as ListEntry, P as PageMeta, e as PageRecord, f as PageSEO, R as Rev, g as RevConflictError } from './types-BMlLS-OS.js';
-import { U as UploadHandler } from './upload-DwCGjXbz.js';
-export { m as makeLocalUploadHandler } from './upload-DwCGjXbz.js';
-import { G as GitHubCommitter } from './github-client-Db0pIrqE.js';
+import { d as CanciaStorage, C as CanciaStorageV2 } from './types-CKzfz5iu.js';
+export { a as CanciaKVStore, b as CanciaListStore, c as CanciaPageStore, L as ListEntry, P as PageMeta, e as PageRecord, f as PageSEO, R as Rev, g as RevConflictError } from './types-CKzfz5iu.js';
+import { U as UploadHandler, S as SendLoginEmail } from './email-BRK4WAO2.js';
+export { m as makeLocalUploadHandler } from './email-BRK4WAO2.js';
+import { b as GitHubCommitter } from './github-client-Db5EPcSL.js';
 export { CanciaLoaderOptions, canciaLoader } from './loader/index.js';
 export { FieldDescription, FieldMeta, FieldMetaBase, FieldWidget, ListDescription, ListSchema, SchemasModule, defineField, defineList, describeList } from './schema/index.js';
-export { G as GitBackedContentPaths, a as GitBackedControls, b as GitBackedOptions, c as GitBackedStorage, S as SqliteV2Options, d as closeSqliteAdapterV2, e as createGitBackedAdapter, f as createJsonFileAdapter, g as createJsonFileAdapterV2, h as createSQLiteAdapter, i as createSqliteAdapterV2 } from './git-backed-DtiH52EI.js';
+export { G as GitBackedContentPaths, a as GitBackedControls, b as GitBackedOptions, c as GitBackedStorage, S as SqliteV2Options, d as closeSqliteAdapterV2, e as createGitBackedAdapter, f as createJsonFileAdapter, g as createJsonFileAdapterV2, h as createSQLiteAdapter, i as createSqliteAdapterV2 } from './git-backed-CwTFfUS4.js';
 export { z } from 'zod';
 import 'astro/loaders';
 import './portable-text-D74aIuHn.js';
@@ -139,6 +139,32 @@ interface CanciaIntegrationOptions {
      * Use for public demos only — anyone can edit if this is enabled.
      */
     public?: boolean;
+    /**
+     * Email addresses allowed to sign in (042).
+     *
+     * Setting this switches the site to magic-link login: the client asks for a
+     * link, proves they own the address, and gets a session cookie. It also
+     * TURNS OFF the legacy `?cancia=<token>` URL login for humans — that token
+     * is a permanent password in a URL, and once a real login exists there is no
+     * reason to keep accepting it from a person. `CANCIA_TOKEN` stays valid as a
+     * machine credential for the build-time content fetch.
+     *
+     * Leaving it unset preserves the pre-042 behaviour exactly, so upgrading the
+     * package never changes how an existing deployment authenticates.
+     *
+     *     cancia({ editors: ["client@theirsite.com"] })
+     *
+     * Adding someone is a config change plus a redeploy — the right friction for
+     * granting write access to a live site.
+     */
+    editors?: string[];
+    /**
+     * Send the login email. Defaults to Loops when LOOPS_API_KEY and
+     * CANCIA_LOGIN_TID are set, and otherwise logs the link to the server
+     * console (which is also the dev behaviour — no email vendor is needed to
+     * work on the CMS locally).
+     */
+    sendLoginEmail?: SendLoginEmail;
     /**
      * v2 storage adapter (KV + pages + lists). When omitted, Cancia builds a
      * JSON-file v2 adapter automatically at <projectRoot>/.cancia/. List/page

package/dist/index.js

@@ -1,23 +1,37 @@
 import {
   makeSchemasRoute
-} from "./chunk-T2GDBQJ7.js";
+} from "./chunk-DOFLZ7KG.js";
+import {
+  handleLoginCallback,
+  handleLoginRequest,
+  handleLogout,
+  handleSessionCheck,
+  resolveLoginEmailSender
+} from "./chunk-XZCXWILA.js";
 import {
   runPublish
 } from "./chunk-5RCLBWRH.js";
 import {
   createRateLimiter,
   runAuth
-} from "./chunk-GJIX7MWC.js";
+} from "./chunk-ECPYHIAW.js";
 import {
   makeListsRoutes
-} from "./chunk-GD37XVES.js";
+} from "./chunk-5R3I5RLT.js";
 import {
+  createSqliteAuthStore,
   makeLocalUploadHandler,
   makeR2UploadHandler,
   makeUploadRoute,
   setCanciaRuntime
-} from "./chunk-ZPXMPLQU.js";
+} from "./chunk-VF3EXXEM.js";
 import "./chunk-RHFTQW4W.js";
+import {
+  guardRequest
+} from "./chunk-4PYVIIOO.js";
+import {
+  authorizeRequest
+} from "./chunk-6GUOGDWO.js";
 import {
   createSQLiteAdapter
 } from "./chunk-CJDIVWO3.js";
@@ -28,7 +42,7 @@ import "./chunk-U7V53JX7.js";
 import "./chunk-VL6FO446.js";
 import {
   canciaLoader
-} from "./chunk-TUZNTXZR.js";
+} from "./chunk-R7VA3Z5N.js";
 import {
   closeSqliteAdapterV2,
   createJsonFileAdapter,
@@ -53,16 +67,13 @@ import { readFile } from "fs/promises";
 import { isAbsolute, join as join2 } from "path";
 
 // src/routes/content.ts
-function makeContentRoute(storage, secret) {
-  function checkAuth(req) {
-    if (!secret) return null;
-    const token = req.headers.get("Authorization")?.replace("Bearer ", "").trim();
-    if (token !== secret) return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-    return null;
+function makeContentRoute(storage, secret, auth) {
+  async function checkAuth(req) {
+    return (await guardRequest(req, { secret, auth })).deny;
   }
   return {
     GET: async ({ request }) => {
-      const deny = checkAuth(request);
+      const deny = await checkAuth(request);
       if (deny) return deny;
       const site = new URL(request.url).searchParams.get("site");
       if (!site) return new Response(JSON.stringify({ error: "Missing ?site=" }), { status: 400 });
@@ -72,7 +83,7 @@ function makeContentRoute(storage, secret) {
       });
     },
     POST: async ({ request }) => {
-      const deny = checkAuth(request);
+      const deny = await checkAuth(request);
       if (deny) return deny;
       const body = await request.json().catch(() => null);
       if (!body?.site || !body?.key || !body?.lang || body?.value === void 0) {
@@ -84,7 +95,7 @@ function makeContentRoute(storage, secret) {
       });
     },
     DELETE: async ({ request }) => {
-      const deny = checkAuth(request);
+      const deny = await checkAuth(request);
       if (deny) return deny;
       const body = await request.json().catch(() => null);
       if (!body?.site || !body?.key || !body?.lang) {
@@ -99,14 +110,10 @@ function makeContentRoute(storage, secret) {
 }
 
 // src/routes/publish.ts
-function makePublishRoute(deployHook, secret, hookOptions, dispatch, mode) {
+function makePublishRoute(deployHook, secret, hookOptions, dispatch, mode, auth) {
   return async ({ request }) => {
-    if (secret) {
-      const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-      if (token !== secret) {
-        return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-      }
-    }
+    const deny = (await guardRequest(request, { secret, auth })).deny;
+    if (deny) return deny;
     const hook = deployHook ?? process.env.CANCIA_DEPLOY_HOOK;
     return runPublish({
       mode,
@@ -357,6 +364,34 @@ ${code}`;
 ${code.slice(at)}`;
 }
 
+// src/routes/auth-magic.ts
+function makeMagicAuthRoutes(ctx) {
+  const limiter = createRateLimiter();
+  const shared = { store: ctx.store, site: ctx.site, sendEmail: ctx.sendEmail, limiter };
+  return {
+    async request(req) {
+      return handleLoginRequest(req, shared, new URL(req.url).origin);
+    },
+    async callback(req) {
+      return handleLoginCallback(req, shared);
+    },
+    async logout(req) {
+      return handleLogout(req, shared);
+    },
+    async session(req) {
+      return handleSessionCheck(
+        req,
+        shared,
+        () => authorizeRequest({
+          request: req,
+          secret: ctx.secret,
+          auth: { store: ctx.store, site: ctx.site }
+        })
+      );
+    }
+  };
+}
+
 // src/integration.ts
 function resolvePublish(opts, hasDeployHookEnv) {
   const publish = opts.publish;
@@ -386,6 +421,15 @@ function buildDefaultV2Store(opts, projectRoot) {
   }
   return createJsonFileAdapterV2({ projectRoot });
 }
+function buildAuthContext(opts, projectRoot) {
+  const editors = opts.editors?.map((e) => e.trim().toLowerCase()).filter(Boolean) ?? [];
+  if (editors.length === 0) return void 0;
+  const dbPath = opts.db?.kind === "sqlite" && opts.db.path ? isAbsolute(opts.db.path) ? opts.db.path : join2(projectRoot, opts.db.path) : join2(projectRoot, "cancia.db");
+  const store = createSqliteAuthStore({ dbPath });
+  const site = opts.site ?? "default";
+  void store.seedEditors(site, editors);
+  return { store, site };
+}
 function canciaIntegration(opts = {}) {
   let storage;
   let resolvedToken = "";
@@ -459,8 +503,12 @@ function canciaIntegration(opts = {}) {
             prefix: r2Opts.prefix
           };
         }
+        const bakedEditors = opts.editors?.map((e) => e.trim().toLowerCase()).filter(Boolean) ?? [];
         bakedConfig = {
           projectRoot: resolvedRootPath,
+          site,
+          editors: bakedEditors,
+          authDbPath: opts.db?.kind === "sqlite" && opts.db.path ? opts.db.path : "cancia.db",
           schemasPath: opts.schemasPath,
           defaultLocale: resolvedLocales[0],
           locales: resolvedLocales,
@@ -485,7 +533,12 @@ function canciaIntegration(opts = {}) {
             languages,
             page: "unknown",
             public: opts.public ?? false,
-            canPublish
+            canPublish,
+            // Whether to offer the email login box. The ADDRESSES are never
+            // sent to the browser — publishing a client's staff list on every
+            // page would be a disclosure, and the server checks the allow-list
+            // anyway. The toolbar only needs to know the flow exists.
+            magicLink: bakedEditors.length > 0
           })};`
         );
         injectScript("page", `import "@cancia/toolbar";`);
@@ -497,6 +550,10 @@ function canciaIntegration(opts = {}) {
         injectRoute({ pattern: "/api/cancia/publish", entrypoint: endpointPath("publish"), prerender: false });
         injectRoute({ pattern: "/api/cancia/auth", entrypoint: endpointPath("auth"), prerender: false });
         injectRoute({ pattern: "/api/cancia/health", entrypoint: endpointPath("health"), prerender: false });
+        injectRoute({ pattern: "/api/cancia/auth/request", entrypoint: endpointPath("auth-request"), prerender: false });
+        injectRoute({ pattern: "/api/cancia/auth/callback", entrypoint: endpointPath("auth-callback"), prerender: false });
+        injectRoute({ pattern: "/api/cancia/auth/logout", entrypoint: endpointPath("auth-logout"), prerender: false });
+        injectRoute({ pattern: "/api/cancia/auth/session", entrypoint: endpointPath("auth-session"), prerender: false });
         injectRoute({ pattern: "/api/cancia/schemas", entrypoint: endpointPath("schemas"), prerender: false });
         injectRoute({ pattern: "/api/cancia/lists/[listName]", entrypoint: endpointPath("lists"), prerender: false });
         injectRoute({ pattern: "/api/cancia/lists/[listName]/[id]", entrypoint: endpointPath("lists"), prerender: false });
@@ -616,6 +673,9 @@ function canciaIntegration(opts = {}) {
           defaultLocale: resolvedLocales[0],
           locales: resolvedLocales,
           secret: routeSecret,
+          site: opts.site ?? "default",
+          auth: buildAuthContext(opts, resolvedRootPath),
+          sendLoginEmail: resolveLoginEmailSender(opts.sendLoginEmail),
           uploadHandler,
           deployHook,
           deployHookToken,
@@ -627,8 +687,9 @@ function canciaIntegration(opts = {}) {
           redeployHook: resolvedRedeployHook,
           maxUploadMB: opts.maxUploadMB ?? 10
         });
-        const contentRoutes = makeContentRoute(storage, routeSecret);
-        const uploadRoute = makeUploadRoute(uploadHandler, routeSecret, opts.maxUploadMB);
+        const devAuthCtx = buildAuthContext(opts, resolvedRootPath);
+        const contentRoutes = makeContentRoute(storage, routeSecret, devAuthCtx);
+        const uploadRoute = makeUploadRoute(uploadHandler, routeSecret, opts.maxUploadMB, devAuthCtx);
         const publishRoute = makePublishRoute(
           deployHook,
           routeSecret,
@@ -638,20 +699,33 @@ function canciaIntegration(opts = {}) {
             headers: opts.deployHookHeaders
           },
           { repo: resolvedPublishRepo, token: publishGithubToken },
-          resolvedPublishMode
+          resolvedPublishMode,
+          devAuthCtx
         );
         const authRoute = makeAuthRoute(secret);
+        const magicRoutes = devAuthCtx ? makeMagicAuthRoutes({
+          store: devAuthCtx.store,
+          site: devAuthCtx.site,
+          sendEmail: resolveLoginEmailSender(opts.sendLoginEmail),
+          secret: routeSecret
+        }) : void 0;
+        const magicNotConfigured = () => new Response(
+          JSON.stringify({ error: "Magic-link login is not configured for this site." }),
+          { status: 404, headers: { "Content-Type": "application/json" } }
+        );
         const listsRoutes = makeListsRoutes({
           storageV2,
           projectRoot: resolvedRootPath,
           schemasPath: opts.schemasPath,
           secret: routeSecret,
+          auth: devAuthCtx,
           defaultLocale: resolvedLocales[0]
         });
         const schemasRoute = makeSchemasRoute({
           projectRoot: resolvedRootPath,
           schemasPath: opts.schemasPath,
-          secret: routeSecret
+          secret: routeSecret,
+          auth: devAuthCtx
         });
         server.middlewares.use(async (req, res, next) => {
           const url = req.url ?? "";
@@ -716,8 +790,21 @@ function canciaIntegration(opts = {}) {
             response = await publishRoute(ctx);
           } else if (url === "/api/cancia/health") {
             response = new Response(JSON.stringify({ ok: true }), { status: 200 });
+          } else if (url === "/api/cancia/auth/request" && method === "POST") {
+            response = magicRoutes ? await magicRoutes.request(webReq) : magicNotConfigured();
+          } else if (url === "/api/cancia/auth/callback" && method === "POST") {
+            response = magicRoutes ? await magicRoutes.callback(webReq) : magicNotConfigured();
+          } else if (url === "/api/cancia/auth/logout" && method === "POST") {
+            response = magicRoutes ? await magicRoutes.logout(webReq) : magicNotConfigured();
+          } else if (url === "/api/cancia/auth/session" && method === "GET") {
+            response = magicRoutes ? await magicRoutes.session(webReq) : magicNotConfigured();
           } else if (url === "/api/cancia/auth" && method === "POST") {
-            response = await authRoute(webReq);
+            response = magicRoutes ? new Response(
+              JSON.stringify({
+                error: "This site uses email login. Open the site and request a link instead."
+              }),
+              { status: 403, headers: { "Content-Type": "application/json" } }
+            ) : await authRoute(webReq);
           }
           if (!response) return next();
           res.statusCode = response.status;
@@ -782,6 +869,9 @@ function canciaIntegration(opts = {}) {
           defaultLocale: resolvedLocales[0],
           locales: resolvedLocales,
           secret: routeSecret,
+          site: opts.site ?? "default",
+          auth: buildAuthContext(opts, resolvedRootPath),
+          sendLoginEmail: resolveLoginEmailSender(opts.sendLoginEmail),
           uploadHandler,
           deployHook,
           deployHookToken,

package/dist/loader/index.d.ts

@@ -1,5 +1,5 @@
 import { Loader } from 'astro/loaders';
-import { a as CanciaStorageV2 } from '../types-BMlLS-OS.js';
+import { C as CanciaStorageV2 } from '../types-CKzfz5iu.js';
 import { ListSchema } from '../schema/index.js';
 import 'zod';
 import '../portable-text-D74aIuHn.js';
@@ -13,7 +13,17 @@ interface CanciaLoaderOptions {
      */
     site: string;
     /**
-     * Where this site's content lives — MIRROR THE INTEGRATION'S `db` OPTION.
+     * Where this site's content lives.
+     *
+     * USUALLY UNNECESSARY. A `cancia.db` at the project root — where the
+     * integration's `db: { kind: "sqlite" }` puts it — is detected automatically,
+     * so a fresh project needs nothing here.
+     *
+     * Set it when the site uses a CUSTOM `db.path` (autodetection deliberately
+     * checks only the default location and never searches), or to force the
+     * JSON-file backend on a project that also has a stray .db.
+     *
+     * When set, MIRROR THE INTEGRATION'S `db` OPTION.
      *
      *     cancia({ db: { kind: "sqlite" } })          // astro.config.mjs
      *     canciaLoader({ …, db: { kind: "sqlite" } }) // content.config.ts

package/dist/loader/index.js

@@ -1,6 +1,6 @@
 import {
   canciaLoader
-} from "../chunk-TUZNTXZR.js";
+} from "../chunk-R7VA3Z5N.js";
 import "../chunk-S5YLB6P3.js";
 import "../chunk-7IA5B5CF.js";
 import "../chunk-QQEUCOXQ.js";