@cancia/astro 0.2.0 → 0.2.1

package/dist/{chunk-SXKZ2WUL.js → chunk-5ELSN6LI.js}

@@ -1,63 +1,3 @@
-// src/storage/sqlite.ts
-import { createRequire } from "module";
-var require2 = createRequire(import.meta.url);
-var _db = null;
-function createDB(dbPath) {
-  const Database = require2("better-sqlite3");
-  const sqlite = new Database(dbPath);
-  sqlite.pragma("journal_mode = WAL");
-  sqlite.exec(`
-    CREATE TABLE IF NOT EXISTS cancia_content (
-      id         INTEGER PRIMARY KEY AUTOINCREMENT,
-      site       TEXT NOT NULL,
-      key        TEXT NOT NULL,
-      lang       TEXT NOT NULL,
-      value      TEXT NOT NULL,
-      updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
-      UNIQUE(site, key, lang)
-    )
-  `);
-  return {
-    get: sqlite.prepare(
-      "SELECT value FROM cancia_content WHERE site=? AND key=? AND lang=?"
-    ),
-    set: sqlite.prepare(
-      `INSERT INTO cancia_content (site, key, lang, value, updated_at)
-       VALUES (?, ?, ?, ?, unixepoch())
-       ON CONFLICT(site, key, lang) DO UPDATE SET value=excluded.value, updated_at=unixepoch()`
-    ),
-    getAll: sqlite.prepare(
-      "SELECT key, lang, value FROM cancia_content WHERE site=?"
-    ),
-    delete: sqlite.prepare(
-      "DELETE FROM cancia_content WHERE site=? AND key=? AND lang=?"
-    )
-  };
-}
-function getDB(dbPath) {
-  if (!_db) _db = createDB(dbPath);
-  return _db;
-}
-function createSQLiteAdapter(dbPath) {
-  const path = dbPath ?? process.cwd() + "/cancia.db";
-  return {
-    async get(site, key, lang) {
-      const row = getDB(path).get.get(site, key, lang);
-      return row?.value ?? null;
-    },
-    async set(site, key, lang, value) {
-      getDB(path).set.run(site, key, lang, value);
-    },
-    async getAll(site) {
-      const rows = getDB(path).getAll.all(site);
-      return Object.fromEntries(rows.map((r) => [`${r.key}.${r.lang}`, r.value]));
-    },
-    async delete(site, key, lang) {
-      getDB(path).delete.run(site, key, lang);
-    }
-  };
-}
-
 // src/storage/github-client.ts
 function toBase64(text) {
   if (typeof Buffer !== "undefined") {
@@ -299,7 +239,6 @@ function createGitBackedAdapter(opts) {
 }
 
 export {
-  createSQLiteAdapter,
   createGitHubClient,
   createGitBackedAdapter
 };

package/dist/chunk-7MPOERVU.js

@@ -0,0 +1,245 @@
+import {
+  createGitBackedAdapter
+} from "./chunk-5ELSN6LI.js";
+import {
+  createJsonFileAdapter,
+  createJsonFileAdapterV2
+} from "./chunk-ST44VULL.js";
+import {
+  detectImageType,
+  isValidSite
+} from "./chunk-5IPHDIC6.js";
+
+// src/routes/upload.ts
+import { writeFile, mkdir } from "fs/promises";
+import { join } from "path";
+import { randomUUID } from "crypto";
+function makeLocalUploadHandler(opts) {
+  const uploadDir = opts.uploadDir ?? join(process.cwd(), "public/uploads");
+  const publicUrlBase = opts.publicUrlBase ?? "/uploads";
+  const maxBytes = (opts.maxMB ?? 10) * 1024 * 1024;
+  return async (file, site, detected) => {
+    const dest = join(uploadDir, site);
+    await mkdir(dest, { recursive: true });
+    const name = `${randomUUID()}.${detected.ext}`;
+    await writeFile(join(dest, name), Buffer.from(await file.arrayBuffer()));
+    return `${publicUrlBase}/${site}/${name}`;
+  };
+}
+function makeUploadRoute(uploadHandler, secret, maxMB = 10) {
+  return async ({ request }) => {
+    if (secret) {
+      const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
+      if (token !== secret) {
+        return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
+      }
+    }
+    const form = await request.formData().catch(() => null);
+    const file = form?.get("file");
+    const site = form?.get("site");
+    if (!(file instanceof File)) {
+      return new Response(JSON.stringify({ error: "Missing file field" }), { status: 400 });
+    }
+    if (typeof site !== "string" || !isValidSite(site)) {
+      return new Response(
+        JSON.stringify({ error: "Invalid site (allowed: a-z, 0-9, and . _ -; must start alphanumeric)" }),
+        { status: 400 }
+      );
+    }
+    if (file.size > maxMB * 1024 * 1024) {
+      return new Response(JSON.stringify({ error: `File too large (max ${maxMB}MB)` }), { status: 413 });
+    }
+    const buf = new Uint8Array(await file.arrayBuffer());
+    const detected = detectImageType(buf);
+    if (!detected) {
+      return new Response(JSON.stringify({ error: "File type not allowed" }), { status: 415 });
+    }
+    const url = await uploadHandler(file, site, detected);
+    return new Response(JSON.stringify({ url }), {
+      headers: { "Content-Type": "application/json" }
+    });
+  };
+}
+
+// src/routes/upload-r2.ts
+import { createHmac, createHash } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
+function sha256hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+function hmacSha256(key, data) {
+  return createHmac("sha256", key).update(data).digest();
+}
+function getSigningKey(secretKey, date, region, service) {
+  const kDate = hmacSha256(Buffer.from(`AWS4${secretKey}`, "utf8"), date);
+  const kRegion = hmacSha256(kDate, region);
+  const kService = hmacSha256(kRegion, service);
+  const kSigning = hmacSha256(kService, "aws4_request");
+  return kSigning;
+}
+async function signedPutRequest(opts) {
+  const { endpoint, bucket, key, body, contentType, accessKeyId, secretAccessKey } = opts;
+  const region = "auto";
+  const service = "s3";
+  const now = /* @__PURE__ */ new Date();
+  const isoDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "").slice(0, 15) + "Z";
+  const shortDate = isoDate.slice(0, 8);
+  const url = `${endpoint}/${bucket}/${key}`;
+  const host = new URL(endpoint).host;
+  const payloadHash = sha256hex(body);
+  const headers = {
+    "content-type": contentType,
+    "host": host,
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": isoDate
+  };
+  const signedHeaders = Object.keys(headers).sort().join(";");
+  const canonicalHeaders = Object.keys(headers).sort().map((k) => `${k}:${headers[k]}
+`).join("");
+  const canonicalRequest = [
+    "PUT",
+    `/${bucket}/${key}`,
+    "",
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash
+  ].join("\n");
+  const credentialScope = `${shortDate}/${region}/${service}/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    isoDate,
+    credentialScope,
+    sha256hex(canonicalRequest)
+  ].join("\n");
+  const signingKey = getSigningKey(secretAccessKey, shortDate, region, service);
+  const signature = createHmac("sha256", signingKey).update(stringToSign).digest("hex");
+  const authHeader = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method: "PUT",
+      headers: { ...headers, Authorization: authHeader },
+      body: new Uint8Array(body)
+    });
+  } catch (err) {
+    throw new Error(`R2 upload: network error reaching ${url} \u2014 ${err}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => res.statusText);
+    throw new Error(`R2 upload failed (${res.status}): ${text}`);
+  }
+}
+function makeR2UploadHandler(opts) {
+  const {
+    accountId,
+    bucket,
+    accessKeyId,
+    secretAccessKey,
+    publicUrl,
+    prefix = "uploads"
+  } = opts;
+  const endpoint = `https://${accountId}.r2.cloudflarestorage.com`;
+  return async (file, _site, detected) => {
+    const key = `${prefix}/${randomUUID2()}.${detected.ext}`;
+    const body = Buffer.from(await file.arrayBuffer());
+    await signedPutRequest({
+      endpoint,
+      bucket,
+      key,
+      body,
+      contentType: file.type,
+      accessKeyId,
+      secretAccessKey
+    });
+    return `${publicUrl.replace(/\/$/, "")}/${key}`;
+  };
+}
+
+// src/runtime.ts
+var _runtime = null;
+var _bakedConfig = null;
+function setBakedConfig(config) {
+  _bakedConfig = config;
+}
+function setCanciaRuntime(runtime) {
+  _runtime = runtime;
+}
+function buildRuntimeFromBaked(baked) {
+  const projectRoot = baked.projectRoot || process.cwd();
+  const token = process.env.CANCIA_TOKEN?.trim() || "";
+  const secret = baked.public ? void 0 : token || void 0;
+  const deployHook = process.env.CANCIA_DEPLOY_HOOK || void 0;
+  const storageV2 = buildStorageV2(baked, projectRoot);
+  const storage = storageV2 ? storageV2.kv : lazyJsonFileAdapter(projectRoot);
+  const uploadHandler = buildUploadHandler(baked, projectRoot);
+  return {
+    storage,
+    storageV2,
+    projectRoot,
+    schemasPath: baked.schemasPath,
+    defaultLocale: baked.defaultLocale,
+    locales: baked.locales,
+    secret,
+    uploadHandler,
+    deployHook,
+    maxUploadMB: baked.maxUploadMB
+  };
+}
+function lazyJsonFileAdapter(projectRoot) {
+  return createJsonFileAdapter(projectRoot + "/cancia-content.json");
+}
+function buildStorageV2(baked, projectRoot) {
+  const desc = baked.storage;
+  if (!desc) return void 0;
+  if (desc.kind === "git-backed") {
+    const local = createJsonFileAdapterV2({ projectRoot });
+    return createGitBackedAdapter({
+      local,
+      repo: desc.repo,
+      branch: desc.branch,
+      token: process.env.CANCIA_GITHUB_TOKEN,
+      committer: desc.committer,
+      projectRoot,
+      debounceMs: desc.debounceMs,
+      commitMessage: desc.commitMessage
+    });
+  }
+  return createJsonFileAdapterV2({ projectRoot });
+}
+function buildUploadHandler(baked, projectRoot) {
+  if (baked.r2) {
+    const env = process.env;
+    const resolved = {
+      accountId: baked.r2.accountId ?? env.R2_ACCOUNT_ID ?? "",
+      bucket: baked.r2.bucket ?? env.R2_BUCKET_NAME ?? env.R2_BUCKET ?? "",
+      accessKeyId: env.R2_ACCESS_KEY_ID ?? "",
+      secretAccessKey: env.R2_SECRET_ACCESS_KEY ?? "",
+      publicUrl: baked.r2.publicUrl ?? env.R2_PUBLIC_URL ?? "",
+      prefix: baked.r2.prefix
+    };
+    return makeR2UploadHandler(resolved);
+  }
+  return makeLocalUploadHandler({
+    uploadDir: projectRoot + "/public/uploads",
+    maxMB: baked.maxUploadMB
+  });
+}
+function getCanciaRuntime() {
+  if (_runtime) return _runtime;
+  if (_bakedConfig) {
+    _runtime = buildRuntimeFromBaked(_bakedConfig);
+    return _runtime;
+  }
+  throw new Error(
+    "[cancia] Runtime not initialised and no baked config available. This is a bug \u2014 the virtual:cancia/runtime module should have called setBakedConfig() at import time."
+  );
+}
+
+export {
+  makeLocalUploadHandler,
+  makeUploadRoute,
+  makeR2UploadHandler,
+  setBakedConfig,
+  setCanciaRuntime,
+  getCanciaRuntime
+};

package/dist/chunk-AE4SIY24.js

@@ -0,0 +1,63 @@
+// src/storage/sqlite.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var _db = null;
+function createDB(dbPath) {
+  const Database = require2("better-sqlite3");
+  const sqlite = new Database(dbPath);
+  sqlite.pragma("journal_mode = WAL");
+  sqlite.exec(`
+    CREATE TABLE IF NOT EXISTS cancia_content (
+      id         INTEGER PRIMARY KEY AUTOINCREMENT,
+      site       TEXT NOT NULL,
+      key        TEXT NOT NULL,
+      lang       TEXT NOT NULL,
+      value      TEXT NOT NULL,
+      updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+      UNIQUE(site, key, lang)
+    )
+  `);
+  return {
+    get: sqlite.prepare(
+      "SELECT value FROM cancia_content WHERE site=? AND key=? AND lang=?"
+    ),
+    set: sqlite.prepare(
+      `INSERT INTO cancia_content (site, key, lang, value, updated_at)
+       VALUES (?, ?, ?, ?, unixepoch())
+       ON CONFLICT(site, key, lang) DO UPDATE SET value=excluded.value, updated_at=unixepoch()`
+    ),
+    getAll: sqlite.prepare(
+      "SELECT key, lang, value FROM cancia_content WHERE site=?"
+    ),
+    delete: sqlite.prepare(
+      "DELETE FROM cancia_content WHERE site=? AND key=? AND lang=?"
+    )
+  };
+}
+function getDB(dbPath) {
+  if (!_db) _db = createDB(dbPath);
+  return _db;
+}
+function createSQLiteAdapter(dbPath) {
+  const path = dbPath ?? process.cwd() + "/cancia.db";
+  return {
+    async get(site, key, lang) {
+      const row = getDB(path).get.get(site, key, lang);
+      return row?.value ?? null;
+    },
+    async set(site, key, lang, value) {
+      getDB(path).set.run(site, key, lang, value);
+    },
+    async getAll(site) {
+      const rows = getDB(path).getAll.all(site);
+      return Object.fromEntries(rows.map((r) => [`${r.key}.${r.lang}`, r.value]));
+    },
+    async delete(site, key, lang) {
+      getDB(path).delete.run(site, key, lang);
+    }
+  };
+}
+
+export {
+  createSQLiteAdapter
+};

package/dist/github-client-BAZ1pW24.d.ts

@@ -0,0 +1,48 @@
+/** Minimal fetch signature — matches the global `fetch` we depend on. */
+type FetchLike = (input: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}>;
+interface GitHubCommitter {
+    name: string;
+    email: string;
+}
+interface GitHubClientOptions {
+    /** "owner/name" */
+    repo: string;
+    /** Branch to commit onto, e.g. "main". */
+    branch: string;
+    /** Fine-grained PAT with contents:write on the one repo. */
+    token: string;
+    /** Optional committer identity. GitHub uses the token's user if omitted. */
+    committer?: GitHubCommitter;
+    /** Injectable fetch (defaults to global fetch) — tests mock this. */
+    fetch?: FetchLike;
+    /** API base — defaults to https://api.github.com. Overridable for tests. */
+    apiBase?: string;
+}
+interface CommitFile {
+    /** Repo-relative path, forward slashes, no leading slash. */
+    path: string;
+    /** Raw file content (UTF-8 text). Encoded to base64 before PUT. */
+    content: string;
+}
+interface GitHubClient {
+    /** Current blob sha for `path`, or null if the file doesn't exist yet. */
+    getFileSha(path: string): Promise<string | null>;
+    /**
+     * Commit each file to the branch. Updates pass the current sha; creates omit
+     * it. Resolves once every PUT succeeds; rejects (without partial silence) if
+     * any PUT fails so the caller can keep the batch dirty and retry.
+     */
+    commitFiles(files: CommitFile[], message: string): Promise<void>;
+}
+declare function createGitHubClient(opts: GitHubClientOptions): GitHubClient;
+
+export { type CommitFile as C, type FetchLike as F, type GitHubCommitter as G, type GitHubClient as a, type GitHubClientOptions as b, createGitHubClient as c };

package/dist/index.d.ts

@@ -3,6 +3,7 @@ import { C as CanciaStorage, a as CanciaStorageV2 } from './types-BMlLS-OS.js';
 export { b as CanciaKVStore, c as CanciaListStore, d as CanciaPageStore, L as ListEntry, P as PageMeta, e as PageRecord, f as PageSEO, R as Rev, g as RevConflictError } from './types-BMlLS-OS.js';
 import { U as UploadHandler } from './upload-DwCGjXbz.js';
 export { m as makeLocalUploadHandler } from './upload-DwCGjXbz.js';
+import { G as GitHubCommitter } from './github-client-BAZ1pW24.js';
 export { CanciaLoaderOptions, canciaLoader } from './loader/index.js';
 export { FieldDescription, FieldMeta, FieldMetaBase, FieldWidget, ListDescription, ListSchema, SchemasModule, defineField, defineList, describeList } from './schema/index.js';
 export { GitBackedContentPaths, GitBackedControls, GitBackedOptions, GitBackedStorage, createGitBackedAdapter, createJsonFileAdapter, createJsonFileAdapterV2, createSQLiteAdapter } from './storage/index.js';
@@ -89,6 +90,29 @@ interface CanciaIntegrationOptions {
      * (named or default) — a record of list name → defineList() output.
      */
     schemasPath?: string;
+    /**
+     * Git-backed storage, described SERIALISABLY so a production SSR server can
+     * reconstruct the adapter in its own (fresh) process from this config + the
+     * `CANCIA_GITHUB_TOKEN` env var. Prefer this over passing a live
+     * `storageV2: createGitBackedAdapter(...)` object: a live adapter constructed
+     * during config evaluation cannot cross the build→deploy process boundary,
+     * so it would silently degrade to local-only in production. When `git` is
+     * set, Cancia builds the git-backed adapter (wrapping a JSON-file v2 local
+     * store) lazily at first request. The token is NEVER baked — it is read from
+     * `process.env.CANCIA_GITHUB_TOKEN` at runtime.
+     */
+    git?: {
+        /** "owner/name" of the GitHub repo whose builds carry the content. */
+        repo: string;
+        /** Branch to commit onto. Default "main". */
+        branch?: string;
+        /** Optional committer identity for commits. */
+        committer?: GitHubCommitter;
+        /** Quiet window (ms) before a flush fires. Default 3000. */
+        debounceMs?: number;
+        /** Commit message for content updates. */
+        commitMessage?: string;
+    };
 }
 declare function canciaIntegration(opts?: CanciaIntegrationOptions): AstroIntegration;
 

package/dist/index.js

@@ -6,8 +6,11 @@ import {
 } from "./chunk-IIGDU5SV.js";
 import "./chunk-NG5GJME5.js";
 import {
+  makeLocalUploadHandler,
+  makeR2UploadHandler,
+  makeUploadRoute,
   setCanciaRuntime
-} from "./chunk-DGCGIEFD.js";
+} from "./chunk-7MPOERVU.js";
 import {
   defineField,
   defineList,
@@ -18,9 +21,11 @@ import {
   canciaLoader
 } from "./chunk-337LJIKX.js";
 import {
-  createGitBackedAdapter,
   createSQLiteAdapter
-} from "./chunk-SXKZ2WUL.js";
+} from "./chunk-AE4SIY24.js";
+import {
+  createGitBackedAdapter
+} from "./chunk-5ELSN6LI.js";
 import {
   createJsonFileAdapter,
   createJsonFileAdapterV2
@@ -29,14 +34,11 @@ import {
   RevConflictError
 } from "./chunk-7IA5B5CF.js";
 import "./chunk-BOIQNZAO.js";
-import {
-  detectImageType,
-  isValidSite
-} from "./chunk-5IPHDIC6.js";
+import "./chunk-5IPHDIC6.js";
 
 // src/integration.ts
 import { loadEnv } from "vite";
-import { fileURLToPath } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
 
 // src/routes/content.ts
 function makeContentRoute(storage, secret) {
@@ -84,57 +86,6 @@ function makeContentRoute(storage, secret) {
   };
 }
 
-// src/routes/upload.ts
-import { writeFile, mkdir } from "fs/promises";
-import { join } from "path";
-import { randomUUID } from "crypto";
-function makeLocalUploadHandler(opts) {
-  const uploadDir = opts.uploadDir ?? join(process.cwd(), "public/uploads");
-  const publicUrlBase = opts.publicUrlBase ?? "/uploads";
-  const maxBytes = (opts.maxMB ?? 10) * 1024 * 1024;
-  return async (file, site, detected) => {
-    const dest = join(uploadDir, site);
-    await mkdir(dest, { recursive: true });
-    const name = `${randomUUID()}.${detected.ext}`;
-    await writeFile(join(dest, name), Buffer.from(await file.arrayBuffer()));
-    return `${publicUrlBase}/${site}/${name}`;
-  };
-}
-function makeUploadRoute(uploadHandler, secret, maxMB = 10) {
-  return async ({ request }) => {
-    if (secret) {
-      const token = request.headers.get("Authorization")?.replace("Bearer ", "").trim();
-      if (token !== secret) {
-        return new Response(JSON.stringify({ error: "Unauthorized" }), { status: 401 });
-      }
-    }
-    const form = await request.formData().catch(() => null);
-    const file = form?.get("file");
-    const site = form?.get("site");
-    if (!(file instanceof File)) {
-      return new Response(JSON.stringify({ error: "Missing file field" }), { status: 400 });
-    }
-    if (typeof site !== "string" || !isValidSite(site)) {
-      return new Response(
-        JSON.stringify({ error: "Invalid site (allowed: a-z, 0-9, and . _ -; must start alphanumeric)" }),
-        { status: 400 }
-      );
-    }
-    if (file.size > maxMB * 1024 * 1024) {
-      return new Response(JSON.stringify({ error: `File too large (max ${maxMB}MB)` }), { status: 413 });
-    }
-    const buf = new Uint8Array(await file.arrayBuffer());
-    const detected = detectImageType(buf);
-    if (!detected) {
-      return new Response(JSON.stringify({ error: "File type not allowed" }), { status: 415 });
-    }
-    const url = await uploadHandler(file, site, detected);
-    return new Response(JSON.stringify({ url }), {
-      headers: { "Content-Type": "application/json" }
-    });
-  };
-}
-
 // src/routes/publish.ts
 function makePublishRoute(deployHook, secret) {
   return async ({ request }) => {
@@ -227,109 +178,15 @@ function makeAuthRoute(secret) {
   };
 }
 
-// src/routes/upload-r2.ts
-import { createHmac, createHash } from "crypto";
-import { randomUUID as randomUUID2 } from "crypto";
-function sha256hex(data) {
-  return createHash("sha256").update(data).digest("hex");
-}
-function hmacSha256(key, data) {
-  return createHmac("sha256", key).update(data).digest();
-}
-function getSigningKey(secretKey, date, region, service) {
-  const kDate = hmacSha256(Buffer.from(`AWS4${secretKey}`, "utf8"), date);
-  const kRegion = hmacSha256(kDate, region);
-  const kService = hmacSha256(kRegion, service);
-  const kSigning = hmacSha256(kService, "aws4_request");
-  return kSigning;
-}
-async function signedPutRequest(opts) {
-  const { endpoint, bucket, key, body, contentType, accessKeyId, secretAccessKey } = opts;
-  const region = "auto";
-  const service = "s3";
-  const now = /* @__PURE__ */ new Date();
-  const isoDate = now.toISOString().replace(/[:-]|\.\d{3}/g, "").slice(0, 15) + "Z";
-  const shortDate = isoDate.slice(0, 8);
-  const url = `${endpoint}/${bucket}/${key}`;
-  const host = new URL(endpoint).host;
-  const payloadHash = sha256hex(body);
-  const headers = {
-    "content-type": contentType,
-    "host": host,
-    "x-amz-content-sha256": payloadHash,
-    "x-amz-date": isoDate
-  };
-  const signedHeaders = Object.keys(headers).sort().join(";");
-  const canonicalHeaders = Object.keys(headers).sort().map((k) => `${k}:${headers[k]}
-`).join("");
-  const canonicalRequest = [
-    "PUT",
-    `/${bucket}/${key}`,
-    "",
-    canonicalHeaders,
-    signedHeaders,
-    payloadHash
-  ].join("\n");
-  const credentialScope = `${shortDate}/${region}/${service}/aws4_request`;
-  const stringToSign = [
-    "AWS4-HMAC-SHA256",
-    isoDate,
-    credentialScope,
-    sha256hex(canonicalRequest)
-  ].join("\n");
-  const signingKey = getSigningKey(secretAccessKey, shortDate, region, service);
-  const signature = createHmac("sha256", signingKey).update(stringToSign).digest("hex");
-  const authHeader = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
-  let res;
-  try {
-    res = await fetch(url, {
-      method: "PUT",
-      headers: { ...headers, Authorization: authHeader },
-      body: new Uint8Array(body)
-    });
-  } catch (err) {
-    throw new Error(`R2 upload: network error reaching ${url} \u2014 ${err}`);
-  }
-  if (!res.ok) {
-    const text = await res.text().catch(() => res.statusText);
-    throw new Error(`R2 upload failed (${res.status}): ${text}`);
-  }
-}
-function makeR2UploadHandler(opts) {
-  const {
-    accountId,
-    bucket,
-    accessKeyId,
-    secretAccessKey,
-    publicUrl,
-    prefix = "uploads"
-  } = opts;
-  const endpoint = `https://${accountId}.r2.cloudflarestorage.com`;
-  return async (file, _site, detected) => {
-    const key = `${prefix}/${randomUUID2()}.${detected.ext}`;
-    const body = Buffer.from(await file.arrayBuffer());
-    await signedPutRequest({
-      endpoint,
-      bucket,
-      key,
-      body,
-      contentType: file.type,
-      accessKeyId,
-      secretAccessKey
-    });
-    return `${publicUrl.replace(/\/$/, "")}/${key}`;
-  };
-}
-
 // src/token.ts
 import { randomBytes } from "crypto";
 import { readFileSync, writeFileSync, existsSync } from "fs";
-import { join as join2 } from "path";
+import { join } from "path";
 function generateToken() {
   return randomBytes(32).toString("hex");
 }
 function ensureToken(rootPath) {
-  const envPath = join2(rootPath, ".env");
+  const envPath = join(rootPath, ".env");
   let contents = "";
   if (existsSync(envPath)) {
     contents = readFileSync(envPath, "utf-8");
@@ -356,6 +213,7 @@ function canciaIntegration(opts = {}) {
   let resolvedUploadHandler;
   let resolvedDeployHook;
   let resolvedLocales = ["en"];
+  let bakedConfig = null;
   return {
     name: "@cancia/astro",
     hooks: {
@@ -385,6 +243,42 @@ function canciaIntegration(opts = {}) {
   \x1B[32mcancia\x1B[0m  No CANCIA_TOKEN found \u2014 generated one for you.`);
         }
         const hasDeployHook = !!(opts.deployHook ?? env.CANCIA_DEPLOY_HOOK ?? process.env.CANCIA_DEPLOY_HOOK);
+        let storageDescriptor;
+        if (opts.git) {
+          storageDescriptor = {
+            kind: "git-backed",
+            repo: opts.git.repo,
+            branch: opts.git.branch,
+            committer: opts.git.committer,
+            debounceMs: opts.git.debounceMs,
+            commitMessage: opts.git.commitMessage
+          };
+        } else if (opts.storageV2 === null) {
+          storageDescriptor = void 0;
+        } else {
+          storageDescriptor = { kind: "json-file", dbPath: opts.dbPath };
+        }
+        let r2Baked;
+        if (opts.r2) {
+          const r2Opts = typeof opts.r2 === "function" ? opts.r2() : opts.r2;
+          r2Baked = {
+            accountId: r2Opts.accountId,
+            bucket: r2Opts.bucket,
+            publicUrl: r2Opts.publicUrl,
+            prefix: r2Opts.prefix
+          };
+        }
+        bakedConfig = {
+          projectRoot: resolvedRootPath,
+          schemasPath: opts.schemasPath,
+          defaultLocale: resolvedLocales[0],
+          locales: resolvedLocales,
+          maxUploadMB: opts.maxUploadMB ?? 10,
+          public: opts.public ?? false,
+          hasDeployHook,
+          storage: storageDescriptor,
+          r2: r2Baked
+        };
         injectScript(
           "head-inline",
           `window.__CANCIA__=${JSON.stringify({
@@ -410,6 +304,8 @@ function canciaIntegration(opts = {}) {
         injectRoute({ pattern: "/api/cancia/schemas", entrypoint: endpointPath("schemas"), prerender: false });
         injectRoute({ pattern: "/api/cancia/lists/[listName]", entrypoint: endpointPath("lists"), prerender: false });
         injectRoute({ pattern: "/api/cancia/lists/[listName]/[id]", entrypoint: endpointPath("lists"), prerender: false });
+        const runtimeModulePath = fileURLToPath(new URL("./runtime.js", import.meta.url));
+        const RESOLVED_VIRTUAL_ID = "\0virtual:cancia/runtime";
         updateConfig({
           vite: {
             plugins: [
@@ -417,8 +313,18 @@ function canciaIntegration(opts = {}) {
                 name: "vite-plugin-cancia-runtime",
                 resolveId(id) {
                   if (id === "virtual:cancia/runtime") {
-                    return fileURLToPath(new URL("./runtime.js", import.meta.url));
+                    return RESOLVED_VIRTUAL_ID;
                   }
+                },
+                load(id) {
+                  if (id !== RESOLVED_VIRTUAL_ID) return;
+                  const importUrl = pathToFileURL(runtimeModulePath).href;
+                  const bakedLiteral = JSON.stringify(bakedConfig ?? null);
+                  return [
+                    `import { setBakedConfig, getCanciaRuntime } from ${JSON.stringify(importUrl)};`,
+                    `setBakedConfig(${bakedLiteral});`,
+                    `export { getCanciaRuntime };`
+                  ].join("\n");
                 }
               }
             ]

package/dist/runtime.d.ts

@@ -1,5 +1,6 @@
 import { C as CanciaStorage, a as CanciaStorageV2 } from './types-BMlLS-OS.js';
 import { U as UploadHandler } from './upload-DwCGjXbz.js';
+import { G as GitHubCommitter } from './github-client-BAZ1pW24.js';
 
 interface CanciaRuntime {
     /** v1 KV-only storage. Kept for the existing /content endpoint. */
@@ -28,7 +29,51 @@ interface CanciaRuntime {
     deployHook: string | undefined;
     maxUploadMB: number;
 }
+/** Describes which storage adapter to build lazily in the server process. */
+type BakedStorageDescriptor = {
+    kind: "json-file";
+    dbPath?: string;
+} | {
+    kind: "git-backed";
+    repo: string;
+    branch?: string;
+    committer?: GitHubCommitter;
+    debounceMs?: number;
+    commitMessage?: string;
+};
+/** R2 config baked minus its secrets (accessKeyId/secretAccessKey come from env). */
+interface BakedR2Config {
+    accountId?: string;
+    bucket?: string;
+    publicUrl?: string;
+    prefix?: string;
+}
+interface BakedConfig {
+    projectRoot: string;
+    schemasPath: string | undefined;
+    defaultLocale: string;
+    locales: string[];
+    maxUploadMB: number;
+    /** When true, endpoints skip auth (public demos). Baked, never a secret. */
+    public: boolean;
+    /** Whether a deploy hook exists — the value itself is read from env. */
+    hasDeployHook: boolean;
+    /** How to build the v2 storage adapter at runtime. Absent = no v2 storage. */
+    storage: BakedStorageDescriptor | undefined;
+    /** When set, build an R2 upload handler; secrets come from env at runtime. */
+    r2: BakedR2Config | undefined;
+}
+/**
+ * Called by the generated virtual:cancia/runtime module at import time with the
+ * build-baked, non-secret config. Enables lazy self-init in a fresh process.
+ */
+declare function setBakedConfig(config: BakedConfig): void;
+/**
+ * Eagerly set the runtime. Used in dev (astro:server:setup) and in-process
+ * builds where the resolved runtime already exists. Production falls through
+ * to lazy init instead.
+ */
 declare function setCanciaRuntime(runtime: CanciaRuntime): void;
 declare function getCanciaRuntime(): CanciaRuntime;
 
-export { type CanciaRuntime, getCanciaRuntime, setCanciaRuntime };
+export { type BakedConfig, type BakedR2Config, type BakedStorageDescriptor, type CanciaRuntime, getCanciaRuntime, setBakedConfig, setCanciaRuntime };

package/dist/runtime.js

@@ -1,8 +1,14 @@
 import {
   getCanciaRuntime,
+  setBakedConfig,
   setCanciaRuntime
-} from "./chunk-DGCGIEFD.js";
+} from "./chunk-7MPOERVU.js";
+import "./chunk-5ELSN6LI.js";
+import "./chunk-ST44VULL.js";
+import "./chunk-7IA5B5CF.js";
+import "./chunk-5IPHDIC6.js";
 export {
   getCanciaRuntime,
+  setBakedConfig,
   setCanciaRuntime
 };

package/dist/storage/index.d.ts

@@ -1,5 +1,7 @@
 import { C as CanciaStorage, a as CanciaStorageV2 } from '../types-BMlLS-OS.js';
 export { b as CanciaKVStore, c as CanciaListStore, d as CanciaPageStore, L as ListEntry, P as PageMeta, e as PageRecord, f as PageSEO, R as Rev, g as RevConflictError } from '../types-BMlLS-OS.js';
+import { G as GitHubCommitter, a as GitHubClient, F as FetchLike } from '../github-client-BAZ1pW24.js';
+export { C as CommitFile, b as GitHubClientOptions, c as createGitHubClient } from '../github-client-BAZ1pW24.js';
 
 declare function createJsonFileAdapter(filePath?: string): CanciaStorage;
 
@@ -17,53 +19,6 @@ declare function createJsonFileAdapterV2(opts?: JsonFileV2Options): CanciaStorag
 
 declare function createSQLiteAdapter(dbPath?: string): CanciaStorage;
 
-/** Minimal fetch signature — matches the global `fetch` we depend on. */
-type FetchLike = (input: string, init?: {
-    method?: string;
-    headers?: Record<string, string>;
-    body?: string;
-}) => Promise<{
-    ok: boolean;
-    status: number;
-    json(): Promise<unknown>;
-    text(): Promise<string>;
-}>;
-interface GitHubCommitter {
-    name: string;
-    email: string;
-}
-interface GitHubClientOptions {
-    /** "owner/name" */
-    repo: string;
-    /** Branch to commit onto, e.g. "main". */
-    branch: string;
-    /** Fine-grained PAT with contents:write on the one repo. */
-    token: string;
-    /** Optional committer identity. GitHub uses the token's user if omitted. */
-    committer?: GitHubCommitter;
-    /** Injectable fetch (defaults to global fetch) — tests mock this. */
-    fetch?: FetchLike;
-    /** API base — defaults to https://api.github.com. Overridable for tests. */
-    apiBase?: string;
-}
-interface CommitFile {
-    /** Repo-relative path, forward slashes, no leading slash. */
-    path: string;
-    /** Raw file content (UTF-8 text). Encoded to base64 before PUT. */
-    content: string;
-}
-interface GitHubClient {
-    /** Current blob sha for `path`, or null if the file doesn't exist yet. */
-    getFileSha(path: string): Promise<string | null>;
-    /**
-     * Commit each file to the branch. Updates pass the current sha; creates omit
-     * it. Resolves once every PUT succeeds; rejects (without partial silence) if
-     * any PUT fails so the caller can keep the batch dirty and retry.
-     */
-    commitFiles(files: CommitFile[], message: string): Promise<void>;
-}
-declare function createGitHubClient(opts: GitHubClientOptions): GitHubClient;
-
 interface GitBackedContentPaths {
     /** KV file path. Default <projectRoot>/cancia-content.json. */
     kvPath?: string;
@@ -126,4 +81,4 @@ type GitBackedStorage = CanciaStorageV2 & {
 };
 declare function createGitBackedAdapter(opts: GitBackedOptions): GitBackedStorage;
 
-export { CanciaStorage, CanciaStorageV2, type CommitFile, type GitBackedContentPaths, type GitBackedControls, type GitBackedOptions, type GitBackedStorage, type GitHubClient, type GitHubClientOptions, type GitHubCommitter, createGitBackedAdapter, createGitHubClient, createJsonFileAdapter, createJsonFileAdapterV2, createSQLiteAdapter };
+export { CanciaStorage, CanciaStorageV2, type GitBackedContentPaths, type GitBackedControls, type GitBackedOptions, type GitBackedStorage, GitHubClient, GitHubCommitter, createGitBackedAdapter, createJsonFileAdapter, createJsonFileAdapterV2, createSQLiteAdapter };

package/dist/storage/index.js

@@ -1,8 +1,10 @@
 import {
-  createGitBackedAdapter,
-  createGitHubClient,
   createSQLiteAdapter
-} from "../chunk-SXKZ2WUL.js";
+} from "../chunk-AE4SIY24.js";
+import {
+  createGitBackedAdapter,
+  createGitHubClient
+} from "../chunk-5ELSN6LI.js";
 import {
   createJsonFileAdapter,
   createJsonFileAdapterV2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cancia/astro",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Astro integration for Cancia CMS — inline editing with zero separate server",
   "license": "MIT",
   "repository": {

package/dist/chunk-DGCGIEFD.js

@@ -1,14 +0,0 @@
-// src/runtime.ts
-var _runtime = null;
-function setCanciaRuntime(runtime) {
-  _runtime = runtime;
-}
-function getCanciaRuntime() {
-  if (!_runtime) throw new Error("[cancia] Runtime not initialised. This is a bug.");
-  return _runtime;
-}
-
-export {
-  setCanciaRuntime,
-  getCanciaRuntime
-};