@contentrail/cloudflare 0.2.2 → 0.2.4

package/README.md

@@ -18,10 +18,10 @@ pnpm install
 pnpm --filter @contentrail/cloudflare build
 ```
 
-### From npm (`0.2.2`)
+### From npm (`0.2.4`)
 
 ```sh
-pnpm add @contentrail/core@0.2.2 @contentrail/publisher@0.2.2 @contentrail/cloudflare@0.2.2 zod@^4.6.7
+pnpm add @contentrail/core@0.2.4 @contentrail/publisher@0.2.4 @contentrail/cloudflare@0.2.4 zod@^4.6.7
 ```
 
 ## ADR 011b summary

package/dist/auth/password.d.ts

@@ -0,0 +1,36 @@
+import { type SessionSecrets } from "./session.js";
+import type { Authenticator, Identity } from "./types.js";
+export interface PasswordAuthOptions extends SessionSecrets {
+    readonly username: string;
+    readonly password: string;
+}
+/**
+ * Username/password admin auth. Sessions are HS256 JWTs (Bearer or cookie).
+ * Prefer this for small self-hosted sites; Cloudflare Access remains optional.
+ */
+export declare function createPasswordAuthenticator(options: PasswordAuthOptions): Authenticator;
+export interface PasswordLoginInput {
+    readonly username: string;
+    readonly password: string;
+}
+export declare function loginWithPassword(options: PasswordAuthOptions, input: PasswordLoginInput): Promise<{
+    ok: true;
+    token: string;
+    identity: Identity;
+} | {
+    ok: false;
+}>;
+/**
+ * Prefer password auth when admin credentials are configured.
+ * Fall back to Access when Access team+AUD are set and password is not.
+ */
+export declare function createPagesAuthenticator(env: {
+    readonly CONTENTRAIL_ADMIN_USERNAME?: string;
+    readonly CONTENTRAIL_ADMIN_PASSWORD?: string;
+    readonly CONTENTRAIL_SESSION_SECRET?: string;
+    readonly CONTENTRAIL_ACCESS_TEAM_DOMAIN?: string;
+    readonly CONTENTRAIL_ACCESS_AUD?: string;
+    readonly accessAuthenticator?: Authenticator;
+    readonly passwordAuthenticator?: Authenticator;
+}): Authenticator;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,mBAAoB,SAAQ,cAAc;IACzD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAkBD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,mBAAmB,GAC3B,aAAa,CA0Bf;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC,CAgB1E;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE;IAC5C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACjD,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC;IAC7C,QAAQ,CAAC,qBAAqB,CAAC,EAAE,aAAa,CAAC;CAChD,GAAG,aAAa,CA+BhB"}

package/dist/auth/password.js

@@ -0,0 +1,95 @@
+import { createSessionToken, readSessionTokenFromRequest, verifySessionToken, } from "./session.js";
+/** Workers-safe compare (no node:crypto). Length is normalized via SHA-256. */
+async function safeEqualString(left, right) {
+    const enc = new TextEncoder();
+    const [leftDigest, rightDigest] = await Promise.all([
+        crypto.subtle.digest("SHA-256", enc.encode(left)),
+        crypto.subtle.digest("SHA-256", enc.encode(right)),
+    ]);
+    const a = new Uint8Array(leftDigest);
+    const b = new Uint8Array(rightDigest);
+    let out = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        out |= a[i] ^ b[i];
+    }
+    return out === 0;
+}
+/**
+ * Username/password admin auth. Sessions are HS256 JWTs (Bearer or cookie).
+ * Prefer this for small self-hosted sites; Cloudflare Access remains optional.
+ */
+export function createPasswordAuthenticator(options) {
+    return {
+        async authenticate(request) {
+            const token = readSessionTokenFromRequest(request);
+            if (token === null) {
+                return {
+                    ok: false,
+                    status: 401,
+                    code: "MISSING_CREDENTIAL",
+                    message: "Missing admin session. Sign in with username and password.",
+                };
+            }
+            const identity = await verifySessionToken(token, {
+                sessionSecret: options.sessionSecret,
+            });
+            if (identity === null) {
+                return {
+                    ok: false,
+                    status: 401,
+                    code: "MALFORMED_CREDENTIAL",
+                    message: "Admin session is invalid or expired.",
+                };
+            }
+            return { ok: true, identity };
+        },
+    };
+}
+export async function loginWithPassword(options, input) {
+    const userOk = await safeEqualString(input.username, options.username);
+    const passOk = await safeEqualString(input.password, options.password);
+    if (!userOk || !passOk) {
+        return { ok: false };
+    }
+    const identity = {
+        subject: `password:${options.username}`,
+        issuer: "contentrail:password",
+        audience: "contentrail:admin",
+        ...(options.username.includes("@") ? { email: options.username } : {}),
+    };
+    const token = await createSessionToken(identity, {
+        sessionSecret: options.sessionSecret,
+    });
+    return { ok: true, token, identity };
+}
+/**
+ * Prefer password auth when admin credentials are configured.
+ * Fall back to Access when Access team+AUD are set and password is not.
+ */
+export function createPagesAuthenticator(env) {
+    const user = env.CONTENTRAIL_ADMIN_USERNAME?.trim() ?? "";
+    const password = env.CONTENTRAIL_ADMIN_PASSWORD ?? "";
+    const sessionSecret = env.CONTENTRAIL_SESSION_SECRET?.trim() ?? "";
+    if (user !== "" && password !== "" && sessionSecret !== "") {
+        return (env.passwordAuthenticator ??
+            createPasswordAuthenticator({
+                username: user,
+                password,
+                sessionSecret,
+            }));
+    }
+    if (env.accessAuthenticator !== undefined) {
+        return env.accessAuthenticator;
+    }
+    return {
+        async authenticate() {
+            return {
+                ok: false,
+                status: 401,
+                code: "KEY_UNAVAILABLE",
+                message: "Admin auth is not configured. Set CONTENTRAIL_ADMIN_USERNAME, CONTENTRAIL_ADMIN_PASSWORD, and CONTENTRAIL_SESSION_SECRET (or Cloudflare Access).",
+            };
+        },
+    };
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/auth/password.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAQtB,+EAA+E;AAC/E,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;KACnD,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA4B;IAE5B,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO;YACxB,MAAM,KAAK,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,oBAAoB;oBAC1B,OAAO,EAAE,4DAA4D;iBACtE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE;gBAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,sCAAsC;iBAChD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,KAAyB;IAEzB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,QAAQ,GAAa;QACzB,OAAO,EAAE,YAAY,OAAO,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,sBAAsB;QAC9B,QAAQ,EAAE,mBAAmB;QAC7B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE;QAC/C,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAQxC;IACC,MAAM,IAAI,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC;IACtD,MAAM,aAAa,GAAG,GAAG,CAAC,0BAA0B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEnE,IAAI,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,IAAI,aAAa,KAAK,EAAE,EAAE,CAAC;QAC3D,OAAO,CACL,GAAG,CAAC,qBAAqB;YACzB,2BAA2B,CAAC;gBAC1B,QAAQ,EAAE,IAAI;gBACd,QAAQ;gBACR,aAAa;aACd,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,mBAAmB,CAAC;IACjC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,YAAY;YAChB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EACL,kJAAkJ;aACrJ,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,15 @@
+import type { Identity } from "./types.js";
+export declare const SESSION_COOKIE_NAME = "contentrail_session";
+export declare const SESSION_TTL_SECONDS: number;
+export interface SessionSecrets {
+    readonly sessionSecret: string;
+}
+export declare function createSessionToken(identity: Identity, secrets: SessionSecrets, ttlSeconds?: number): Promise<string>;
+export declare function verifySessionToken(token: string, secrets: SessionSecrets): Promise<Identity | null>;
+export declare function readSessionTokenFromRequest(request: Request): string | null;
+export declare function sessionCookieHeader(token: string, options?: {
+    readonly maxAgeSeconds?: number;
+    readonly secure?: boolean;
+}): string;
+export declare function clearSessionCookieHeader(secure?: boolean): string;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD,eAAO,MAAM,mBAAmB,QAAe,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAMD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,cAAc,EACvB,UAAU,SAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyB1B;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAoB3E;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE,MAAM,CAcR;AAED,wBAAgB,wBAAwB,CAAC,MAAM,UAAO,GAAG,MAAM,CAY9D"}

package/dist/auth/session.js

@@ -0,0 +1,91 @@
+import * as jose from "jose";
+export const SESSION_COOKIE_NAME = "contentrail_session";
+export const SESSION_TTL_SECONDS = 60 * 60 * 12;
+function secretKey(secret) {
+    return new TextEncoder().encode(secret);
+}
+export async function createSessionToken(identity, secrets, ttlSeconds = SESSION_TTL_SECONDS) {
+    return new jose.SignJWT({
+        email: identity.email,
+    })
+        .setProtectedHeader({ alg: "HS256" })
+        .setSubject(identity.subject)
+        .setIssuer("contentrail:password")
+        .setAudience("contentrail:admin")
+        .setIssuedAt()
+        .setExpirationTime(`${ttlSeconds}s`)
+        .sign(secretKey(secrets.sessionSecret));
+}
+export async function verifySessionToken(token, secrets) {
+    try {
+        const { payload } = await jose.jwtVerify(token, secretKey(secrets.sessionSecret), {
+            issuer: "contentrail:password",
+            audience: "contentrail:admin",
+            clockTolerance: 5,
+        });
+        const subject = payload.sub;
+        if (typeof subject !== "string" || subject.trim() === "") {
+            return null;
+        }
+        const email = typeof payload.email === "string" ? payload.email : undefined;
+        return {
+            subject,
+            issuer: "contentrail:password",
+            audience: "contentrail:admin",
+            ...(email !== undefined ? { email } : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function readSessionTokenFromRequest(request) {
+    const authorization = request.headers.get("Authorization");
+    if (authorization !== null) {
+        const match = /^Bearer\s+(\S+)/i.exec(authorization);
+        if (match?.[1]) {
+            return match[1];
+        }
+    }
+    const cookie = request.headers.get("Cookie");
+    if (cookie === null || cookie.trim() === "") {
+        return null;
+    }
+    for (const part of cookie.split(";")) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(`${SESSION_COOKIE_NAME}=`)) {
+            const value = trimmed.slice(SESSION_COOKIE_NAME.length + 1);
+            return value === "" ? null : decodeURIComponent(value);
+        }
+    }
+    return null;
+}
+export function sessionCookieHeader(token, options) {
+    const maxAge = options?.maxAgeSeconds ?? SESSION_TTL_SECONDS;
+    const secure = options?.secure !== false;
+    const parts = [
+        `${SESSION_COOKIE_NAME}=${encodeURIComponent(token)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${maxAge}`,
+    ];
+    if (secure) {
+        parts.push("Secure");
+    }
+    return parts.join("; ");
+}
+export function clearSessionCookieHeader(secure = true) {
+    const parts = [
+        `${SESSION_COOKIE_NAME}=`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        "Max-Age=0",
+    ];
+    if (secure) {
+        parts.push("Secure");
+    }
+    return parts.join("; ");
+}
+//# sourceMappingURL=session.js.map

package/dist/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAG7B,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAMhD,SAAS,SAAS,CAAC,MAAc;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAkB,EAClB,OAAuB,EACvB,UAAU,GAAG,mBAAmB;IAEhC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;SAC5B,SAAS,CAAC,sBAAsB,CAAC;SACjC,WAAW,CAAC,mBAAmB,CAAC;SAChC,WAAW,EAAE;SACb,iBAAiB,CAAC,GAAG,UAAU,GAAG,CAAC;SACnC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,OAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,EAChC;YACE,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EAAE,mBAAmB;YAC7B,cAAc,EAAE,CAAC;SAClB,CACF,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,OAAO;YACL,OAAO;YACP,MAAM,EAAE,sBAAsB;YAC9B,QAAQ,EAAE,mBAAmB;YAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,mBAAmB,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5D,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,OAAwE;IAExE,MAAM,MAAM,GAAG,OAAO,EAAE,aAAa,IAAI,mBAAmB,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,KAAK,KAAK,CAAC;IACzC,MAAM,KAAK,GAAG;QACZ,GAAG,mBAAmB,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QACrD,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,MAAM,EAAE;KACpB,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAM,GAAG,IAAI;IACpD,MAAM,KAAK,GAAG;QACZ,GAAG,mBAAmB,GAAG;QACzB,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW;KACZ,CAAC;IACF,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,8 @@
  * Do not import from browser bundles. Secrets stay in Worker bindings.
  */
 export { createCloudflareAccessAuthenticator, type CloudflareAccessOptions, } from "./auth/access.js";
+export { createPasswordAuthenticator, createPagesAuthenticator, loginWithPassword, type PasswordAuthOptions, type PasswordLoginInput, } from "./auth/password.js";
+export { SESSION_COOKIE_NAME, clearSessionCookieHeader, createSessionToken, readSessionTokenFromRequest, sessionCookieHeader, verifySessionToken, } from "./auth/session.js";
 export type { AuthenticationFailure, AuthenticationFailureCode, AuthenticationResult, AuthenticationSuccess, Authenticator, Identity, } from "./auth/types.js";
 export { createSiteAuthorizer, type AccessibleSiteSummary, type AuthorizationFailure, type AuthorizationResult, type AuthorizationSuccess, type SiteAuthorizer, type SiteAuthorizationConfig, type SiteBinding, type SitePermission, } from "./authz/sites.js";
 export { createPublishFetchHandler, type PublishApiOptions, } from "./api/handler.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,mCAAmC,EACnC,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,mCAAmC,EACnC,KAAK,uBAAuB,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAC5B,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,EACjC,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -3,6 +3,8 @@
  * Do not import from browser bundles. Secrets stay in Worker bindings.
  */
 export { createCloudflareAccessAuthenticator, } from "./auth/access.js";
+export { createPasswordAuthenticator, createPagesAuthenticator, loginWithPassword, } from "./auth/password.js";
+export { SESSION_COOKIE_NAME, clearSessionCookieHeader, createSessionToken, readSessionTokenFromRequest, sessionCookieHeader, verifySessionToken, } from "./auth/session.js";
 export { createSiteAuthorizer, } from "./authz/sites.js";
 export { createPublishFetchHandler, } from "./api/handler.js";
 export { createMemoryRateLimiter, } from "./api/rate-limit.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,mCAAmC,GAEpC,MAAM,kBAAkB,CAAC;AAS1B,OAAO,EACL,oBAAoB,GASrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,2BAA2B,GAI5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,mCAAmC,GAEpC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,GAGlB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EACL,oBAAoB,GASrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,yBAAyB,GAE1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,2BAA2B,GAI5B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/pages/client.d.ts

@@ -56,6 +56,14 @@ export declare function createCloudflarePagesClient(options: CloudflarePagesClie
             };
         };
     }[]>;
+    /**
+     * Upsert production env vars. Secrets use type secret_text.
+     * Values are sent to Cloudflare only — never logged by this client.
+     */
+    upsertEnvironmentVariables(accountId: string, projectName: string, vars: Readonly<Record<string, {
+        readonly value: string;
+        readonly secret?: boolean;
+    }>>): Promise<void>;
     planProject: (accountId: string, input: PagesProjectInput) => Promise<PlannedPagesAction[]>;
     applyProjectPlan(accountId: string, input: PagesProjectInput, optionsApply: {
         confirm: boolean;

package/dist/pages/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/pages/client.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;CAM7D;AAmBD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B;;;;;;;YAwGN,MAAM;cAAQ,MAAM;;4BAGzB,MAAM;cACC,MAAM;YAAM,MAAM;;4BApEd,MAAM,QAAQ,MAAM;+BA4E5B,MAAM,eAAe,MAAM;YAG5C,MAAM;uBACK;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE;6BAC5B;YAAE,QAAQ,CAAC,EAAE;gBAAE,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE;;6BAzEvD,MAAM,SACV,iBAAiB,KACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC;gCAkFjB,MAAM,SACV,iBAAiB,gBACV;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,kBAAkB,EAAE,CAAA;KAAE,CAAC;EAkDlE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/pages/client.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;gBAEb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;CAM7D;AAmBD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B;;;;;;;YAwGN,MAAM;cAAQ,MAAM;;4BAGzB,MAAM;cACC,MAAM;YAAM,MAAM;;4BApEd,MAAM,QAAQ,MAAM;+BA4E5B,MAAM,eAAe,MAAM;YAG5C,MAAM;uBACK;YAAE,IAAI,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE;6BAC5B;YAAE,QAAQ,CAAC,EAAE;gBAAE,WAAW,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE;;IAQlE;;;OAGG;0CAEU,MAAM,eACJ,MAAM,QACb,QAAQ,CACZ,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CACtE,GACA,OAAO,CAAC,IAAI,CAAC;6BA3FL,MAAM,SACV,iBAAiB,KACvB,OAAO,CAAC,kBAAkB,EAAE,CAAC;gCAiHjB,MAAM,SACV,iBAAiB,gBACV;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAClD,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,kBAAkB,EAAE,CAAA;KAAE,CAAC;EAkDlE"}

package/dist/pages/client.js

@@ -109,6 +109,24 @@ export function createCloudflarePagesClient(options) {
         listDeployments(accountId, projectName) {
             return request("GET", `/accounts/${encodeURIComponent(accountId)}/pages/projects/${encodeURIComponent(projectName)}/deployments`);
         },
+        /**
+         * Upsert production env vars. Secrets use type secret_text.
+         * Values are sent to Cloudflare only — never logged by this client.
+         */
+        async upsertEnvironmentVariables(accountId, projectName, vars) {
+            const env_vars = Object.fromEntries(Object.entries(vars).map(([key, entry]) => [
+                key,
+                {
+                    type: entry.secret === true ? "secret_text" : "plain_text",
+                    value: entry.value,
+                },
+            ]));
+            await request("PATCH", `/accounts/${encodeURIComponent(accountId)}/pages/projects/${encodeURIComponent(projectName)}`, {
+                deployment_configs: {
+                    production: { env_vars },
+                },
+            });
+        },
         planProject,
         async applyProjectPlan(accountId, input, optionsApply) {
             const actions = await planProject(accountId, input);

package/dist/pages/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/pages/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,GAAG,GAAG,sCAAsC,CAAC;AA2BnD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,MAAM,CAAU;IAEzB,YAAY,OAAe,EAAE,MAAc,EAAE,MAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,UAAU,CACjB,OAAe,EACf,MAAc,EACd,MAAe;IAEf,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,QAAQ,IAAI,KAAK;QAChB,KAA4B,CAAC,MAAM,KAAK,GAAG,CAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7D,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YACpD,MAAM;YACN,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,UAAU,CACd,kBAAkB,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,EAC/D,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAW,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,IAAY;QACvD,OAAO,OAAO,CACZ,KAAK,EACL,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,KAAwB;QAExB,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,IAAI,QAAQ,GAAmC,IAAI,CAAC;QACpD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,GAAG;gBAC/C,OAAO,EAAE;oBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wBAAwB,KAAK,CAAC,IAAI,iCAAiC;gBAC5E,OAAO,EAAE;oBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,0IAA0I;gBAC5I,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,wIAAwI;SAC3I,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,YAAY,EAAE,6BAA6B;QAE3C,YAAY;YACV,OAAO,OAAO,CAAsC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1E,CAAC;QAED,YAAY,CAAC,SAAiB;YAC5B,OAAO,OAAO,CACZ,KAAK,EACL,aAAa,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,CAC5D,CAAC;QACJ,CAAC;QAED,UAAU;QAEV,eAAe,CAAC,SAAiB,EAAE,WAAmB;YACpD,OAAO,OAAO,CAOZ,KAAK,EACL,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,WAAW,CAAC,cAAc,CAC3G,CAAC;QACJ,CAAC;QAED,WAAW;QAEX,KAAK,CAAC,gBAAgB,CACpB,SAAiB,EACjB,KAAwB,EACxB,YAAmD;YAEnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;gBACzC,YAAY,EAAE;oBACZ,aAAa,EAAE,KAAK,CAAC,YAAY;oBACjC,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;iBAC9B;gBACD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;oBAC7B,CAAC,CAAC;wBACE,kBAAkB,EAAE;4BAClB,UAAU,EAAE;gCACV,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oCAClD,GAAG;oCACH,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;iCAC9B,CAAC,CACH;6BACF;yBACF;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,OAAO,CACX,OAAO,EACP,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAC7F,IAAI,CACL,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,OAAO,CACX,MAAM,EACN,aAAa,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,EAC3D,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/pages/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,GAAG,GAAG,sCAAsC,CAAC;AA2BnD,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,MAAM,CAAS;IACf,MAAM,CAAU;IAEzB,YAAY,OAAe,EAAE,MAAc,EAAE,MAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,UAAU,CACjB,OAAe,EACf,MAAc,EACd,MAAe;IAEf,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,QAAQ,IAAI,KAAK;QAChB,KAA4B,CAAC,MAAM,KAAK,GAAG,CAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7D,KAAK,UAAU,OAAO,CACpB,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;YAC1B,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE;YACpD,MAAM;YACN,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,UAAU,CACd,kBAAkB,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,EAC/D,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAW,CAAC;IAC1B,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,SAAiB,EAAE,IAAY;QACvD,OAAO,OAAO,CACZ,KAAK,EACL,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CACxB,SAAiB,EACjB,KAAwB;QAExB,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,IAAI,QAAQ,GAAmC,IAAI,CAAC;QACpD,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,yBAAyB,KAAK,CAAC,IAAI,GAAG;gBAC/C,OAAO,EAAE;oBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wBAAwB,KAAK,CAAC,IAAI,iCAAiC;gBAC5E,OAAO,EAAE;oBACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,0IAA0I;gBAC5I,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,wIAAwI;SAC3I,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO;QACL,YAAY,EAAE,6BAA6B;QAE3C,YAAY;YACV,OAAO,OAAO,CAAsC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC1E,CAAC;QAED,YAAY,CAAC,SAAiB;YAC5B,OAAO,OAAO,CACZ,KAAK,EACL,aAAa,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,CAC5D,CAAC;QACJ,CAAC;QAED,UAAU;QAEV,eAAe,CAAC,SAAiB,EAAE,WAAmB;YACpD,OAAO,OAAO,CAOZ,KAAK,EACL,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,WAAW,CAAC,cAAc,CAC3G,CAAC;QACJ,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,0BAA0B,CAC9B,SAAiB,EACjB,WAAmB,EACnB,IAEC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBACzC,GAAG;gBACH;oBACE,IAAI,EAAE,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;oBAC1D,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF,CAAC,CACH,CAAC;YACF,MAAM,OAAO,CACX,OAAO,EACP,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAC9F;gBACE,kBAAkB,EAAE;oBAClB,UAAU,EAAE,EAAE,QAAQ,EAAE;iBACzB;aACF,CACF,CAAC;QACJ,CAAC;QAED,WAAW;QAEX,KAAK,CAAC,gBAAgB,CACpB,SAAiB,EACjB,KAAwB,EACxB,YAAmD;YAEnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;YACrC,CAAC;YAED,MAAM,IAAI,GAAG;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,iBAAiB,EAAE,KAAK,CAAC,gBAAgB;gBACzC,YAAY,EAAE;oBACZ,aAAa,EAAE,KAAK,CAAC,YAAY;oBACjC,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,QAAQ,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;iBAC9B;gBACD,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;oBAC7B,CAAC,CAAC;wBACE,kBAAkB,EAAE;4BAClB,UAAU,EAAE;gCACV,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oCAClD,GAAG;oCACH,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;iCAC9B,CAAC,CACH;6BACF;yBACF;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YAEF,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,MAAM,OAAO,CACX,OAAO,EACP,aAAa,kBAAkB,CAAC,SAAS,CAAC,mBAAmB,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAC7F,IAAI,CACL,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACvB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,OAAO,CACX,MAAM,EACN,aAAa,kBAAkB,CAAC,SAAS,CAAC,iBAAiB,EAC3D,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pages/site-handler.d.ts

@@ -1,20 +1,28 @@
+import { type PasswordAuthOptions } from "../auth/password.js";
 import { type PublishApiOptions } from "../api/handler.js";
 export interface PagesSiteHandlerOptions extends PublishApiOptions {
     /** Server-bound site id. Never taken from the URL. */
     readonly siteId: string;
+    /**
+     * Username/password admin login. When set, POST /api/login issues a session.
+     * Prefer this over Cloudflare Access for simple sites.
+     */
+    readonly passwordAuth?: PasswordAuthOptions;
 }
 /**
  * Pages Functions fetch adapter.
  *
  * Maps self-hosted routes onto the existing Worker publisher:
  * - GET /api/health
+ * - POST /api/login | POST /api/logout
  * - GET /api/content/:collection
  * - GET /api/content/:collection/:id
  * - POST /api/publish
  * - GET /api/publish/status?collection=
  *
  * `/v1/*` continues to work for the Worker-shaped API.
- * Static `/admin` HTML is not handled here — protect it with Cloudflare Access.
+ * Static `/admin` HTML is gated by the editor login UI + /api auth
+ * (Cloudflare Access remains optional).
  */
 export declare function createPagesSiteHandler(options: PagesSiteHandlerOptions): (request: Request) => Promise<Response>;
 //# sourceMappingURL=site-handler.d.ts.map

package/dist/pages/site-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site-handler.d.ts","sourceRoot":"","sources":["../../src/pages/site-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAmCzC"}
+{"version":3,"file":"site-handler.d.ts","sourceRoot":"","sources":["../../src/pages/site-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,sDAAsD;IACtD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,GAC/B,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAoEzC"}

package/dist/pages/site-handler.js

@@ -1,3 +1,5 @@
+import { loginWithPassword, } from "../auth/password.js";
+import { clearSessionCookieHeader, sessionCookieHeader, } from "../auth/session.js";
 import { applyCors, getRequestId, jsonResponse } from "../api/http.js";
 import { createPublishFetchHandler, } from "../api/handler.js";
 import { checkMutationOrigin } from "./csrf.js";
@@ -6,20 +8,47 @@ import { checkMutationOrigin } from "./csrf.js";
  *
  * Maps self-hosted routes onto the existing Worker publisher:
  * - GET /api/health
+ * - POST /api/login | POST /api/logout
  * - GET /api/content/:collection
  * - GET /api/content/:collection/:id
  * - POST /api/publish
  * - GET /api/publish/status?collection=
  *
  * `/v1/*` continues to work for the Worker-shaped API.
- * Static `/admin` HTML is not handled here — protect it with Cloudflare Access.
+ * Static `/admin` HTML is gated by the editor login UI + /api auth
+ * (Cloudflare Access remains optional).
  */
 export function createPagesSiteHandler(options) {
     const inner = createPublishFetchHandler(options);
     const corsAllowedOrigins = options.corsAllowedOrigins ?? [];
     return async (request) => {
         const requestId = getRequestId(request);
-        const respond = (status, body) => applyCors(jsonResponse(status, body, { requestId }), request, corsAllowedOrigins);
+        const respond = (status, body, init) => {
+            const base = applyCors(jsonResponse(status, body, { requestId }), request, corsAllowedOrigins);
+            if (init?.headers === undefined) {
+                return base;
+            }
+            const headers = new Headers(base.headers);
+            const extra = new Headers(init.headers);
+            extra.forEach((value, key) => {
+                headers.append(key, value);
+            });
+            return new Response(base.body, {
+                status: base.status,
+                statusText: base.statusText,
+                headers,
+            });
+        };
+        const url = new URL(request.url);
+        if (url.pathname === "/api/login" &&
+            request.method.toUpperCase() === "POST") {
+            return handleLogin(request, options, respond, requestId);
+        }
+        if (url.pathname === "/api/logout" &&
+            request.method.toUpperCase() === "POST") {
+            const secure = url.protocol === "https:";
+            return respond(200, { ok: true }, { headers: { "Set-Cookie": clearSessionCookieHeader(secure) } });
+        }
         const method = request.method.toUpperCase();
         if (method === "POST" ||
             method === "PUT" ||
@@ -40,6 +69,81 @@ export function createPagesSiteHandler(options) {
         return inner(mapped);
     };
 }
+async function handleLogin(request, options, respond, requestId) {
+    if (options.passwordAuth === undefined) {
+        return respond(503, {
+            error: {
+                code: "PASSWORD_AUTH_DISABLED",
+                message: "Password login is not configured. Set CONTENTRAIL_ADMIN_USERNAME, CONTENTRAIL_ADMIN_PASSWORD, and CONTENTRAIL_SESSION_SECRET.",
+            },
+            requestId,
+        });
+    }
+    const csrf = checkMutationOrigin(request, options.corsAllowedOrigins ?? []);
+    if (!csrf.ok) {
+        return respond(403, {
+            error: { code: "CSRF", message: csrf.message },
+            requestId,
+        });
+    }
+    let body;
+    try {
+        body = await request.json();
+    }
+    catch {
+        return respond(400, {
+            error: {
+                code: "INVALID_JSON",
+                message: "Request body is not valid JSON.",
+            },
+            requestId,
+        });
+    }
+    if (body === null || typeof body !== "object") {
+        return respond(400, {
+            error: { code: "INVALID_BODY", message: "JSON object required." },
+            requestId,
+        });
+    }
+    const record = body;
+    const username = typeof record.username === "string" ? record.username : "";
+    const password = typeof record.password === "string" ? record.password : "";
+    if (username.trim() === "" || password === "") {
+        return respond(400, {
+            error: {
+                code: "INVALID_BODY",
+                message: 'Fields "username" and "password" are required.',
+            },
+            requestId,
+        });
+    }
+    const result = await loginWithPassword(options.passwordAuth, {
+        username,
+        password,
+    });
+    if (!result.ok) {
+        return respond(401, {
+            error: {
+                code: "INVALID_CREDENTIALS",
+                message: "Invalid username or password.",
+            },
+            requestId,
+        });
+    }
+    const secure = new URL(request.url).protocol === "https:";
+    return respond(200, {
+        ok: true,
+        token: result.token,
+        identity: {
+            subject: result.identity.subject,
+            ...(result.identity.email !== undefined
+                ? { email: result.identity.email }
+                : {}),
+        },
+    }, {
+        headers: { "Set-Cookie": sessionCookieHeader(result.token, { secure }) },
+    });
+}
 async function mapPagesRequest(request, siteId, respond) {
     const url = new URL(request.url);
     if (url.pathname === "/api/health") {

package/dist/pages/site-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-handler.js","sourceRoot":"","sources":["../../src/pages/site-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAOhD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAE5D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,EAAE,CAChD,SAAS,CACP,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,EACzC,OAAO,EACP,kBAAkB,CACnB,CAAC;QAEJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IACE,MAAM,KAAK,MAAM;YACjB,MAAM,KAAK,KAAK;YAChB,MAAM,KAAK,OAAO;YAClB,MAAM,KAAK,QAAQ,EACnB,CAAC;YACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;oBAC9C,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM,YAAY,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,MAAc,EACd,OAAoD;IAEpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,YAAY,GAAG,yCAAyC,CAAC,IAAI,CACjE,GAAG,CAAC,QAAQ,CACb,CAAC;IACF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,GAAG,aAAa,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/G,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,2CAA2C;iBACrD;aACF,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,aAAa,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9G,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAC/B,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC;QACvB,GAAG,CAAC,QAAQ,GAAG,aAAa,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAChD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"site-handler.js","sourceRoot":"","sources":["../../src/pages/site-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,yBAAyB,GAE1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAYhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC;IAEhC,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAE5D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,IAAmB,EAAE,EAAE;YACrE,MAAM,IAAI,GAAG,SAAS,CACpB,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,EACzC,OAAO,EACP,kBAAkB,CACnB,CAAC;YACF,IAAI,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO;aACR,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IACE,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7B,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EACvC,CAAC;YACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QACD,IACE,GAAG,CAAC,QAAQ,KAAK,aAAa;YAC9B,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,EACvC,CAAC;YACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACzC,OAAO,OAAO,CACZ,GAAG,EACH,EAAE,EAAE,EAAE,IAAI,EAAE,EACZ,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE,EAAE,CAChE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5C,IACE,MAAM,KAAK,MAAM;YACjB,MAAM,KAAK,KAAK;YAChB,MAAM,KAAK,OAAO;YAClB,MAAM,KAAK,QAAQ,EACnB,CAAC;YACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC,GAAG,EAAE;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;oBAC9C,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM,YAAY,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAgB,EAChB,OAAgC,EAChC,OAAyE,EACzE,SAAiB;IAEjB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,+HAA+H;aAClI;YACD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;YAC9C,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,iCAAiC;aAC3C;YACD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;YACjE,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,gDAAgD;aAC1D;YACD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE;QAC3D,QAAQ;QACR,QAAQ;KACT,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,GAAG,EAAE;YAClB,KAAK,EAAE;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,+BAA+B;aACzC;YACD,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC1D,OAAO,OAAO,CACZ,GAAG,EACH;QACE,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE;YACR,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;YAChC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE;gBAClC,CAAC,CAAC,EAAE,CAAC;SACR;KACF,EACD;QACE,OAAO,EAAE,EAAE,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE;KACzE,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,MAAc,EACd,OAAoD;IAEpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,GAAG,SAAS,CAAC;QACzB,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,YAAY,GAAG,yCAAyC,CAAC,IAAI,CACjE,GAAG,CAAC,QAAQ,CACb,CAAC;IACF,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,QAAQ,GAAG,aAAa,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/G,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,UAAU,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,2CAA2C;iBACrD;aACF,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,aAAa,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9G,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,uBAAuB,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,IACE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACrC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAC/B,CAAC;YACD,OAAO,OAAO,CAAC,GAAG,EAAE;gBAClB,KAAK,EAAE;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,iCAAiC;iBAC3C;aACF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,UAAU,CAAC;QACvB,GAAG,CAAC,QAAQ,GAAG,aAAa,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,kBAAkB,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAChD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;YACtB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/pages/templates.d.ts

@@ -2,7 +2,7 @@
  * Source templates for Cloudflare Pages Functions.
  * Secrets are named only — never inlined.
  */
-export declare const PAGES_DEV_VARS_EXAMPLE = "# Local Pages Functions secrets (gitignored as .dev.vars).\n# Copy to .dev.vars and fill values. Never commit real secrets.\n# Do not prefix secrets with PUBLIC_ or VITE_.\n\nCONTENTRAIL_ACCESS_TEAM_DOMAIN=\nCONTENTRAIL_ACCESS_AUD=\nCONTENTRAIL_SITE_ID=\nCONTENTRAIL_GIT_OWNER=\nCONTENTRAIL_GIT_REPO=\nCONTENTRAIL_GIT_BRANCH=main\nCONTENTRAIL_CONTENT_ROOT=content\nCONTENTRAIL_ADMIN_ORIGIN=http://localhost:4321\nCONTENTRAIL_GITHUB_TOKEN=\n";
+export declare const PAGES_DEV_VARS_EXAMPLE = "# Local Pages Functions secrets (gitignored as .dev.vars).\n# Copy to .dev.vars and fill values. Never commit real secrets.\n# Do not prefix secrets with PUBLIC_ or VITE_.\n\n# Default: username/password admin (no Zero Trust required)\nCONTENTRAIL_ADMIN_USERNAME=admin\nCONTENTRAIL_ADMIN_PASSWORD=\nCONTENTRAIL_SESSION_SECRET=\n\n# Site + Git publish\nCONTENTRAIL_SITE_ID=site\nCONTENTRAIL_GIT_OWNER=\nCONTENTRAIL_GIT_REPO=\nCONTENTRAIL_GIT_BRANCH=main\nCONTENTRAIL_CONTENT_ROOT=content\nCONTENTRAIL_ADMIN_ORIGIN=http://localhost:8788\nCONTENTRAIL_GITHUB_TOKEN=\n\n# Optional: Cloudflare Access instead of (or in addition to) password auth\n# CONTENTRAIL_ACCESS_TEAM_DOMAIN=\n# CONTENTRAIL_ACCESS_AUD=\n";
 export declare function pagesApiFunctionSource(collectionsImport: string): string;
-export declare const PAGES_MIDDLEWARE_SOURCE = "/**\n * Rejects unauthenticated API mutations early.\n * Static /admin HTML is NOT covered \u2014 configure Cloudflare Access on /admin* as well.\n */\nexport const onRequest: PagesFunction = async (context) => {\n  const url = new URL(context.request.url);\n  if (\n    url.pathname.startsWith(\"/api/\") &&\n    url.pathname !== \"/api/health\" &&\n    context.request.method !== \"OPTIONS\"\n  ) {\n    const access = context.request.headers.get(\"Cf-Access-Jwt-Assertion\");\n    const authorization = context.request.headers.get(\"Authorization\");\n    const hasBearer =\n      authorization !== null && /^Bearer\\s+\\S+/i.test(authorization);\n    if ((access === null || access.trim() === \"\") && !hasBearer) {\n      return new Response(\n        JSON.stringify({\n          error: {\n            code: \"MISSING_CREDENTIAL\",\n            message: \"Missing Access JWT credential.\",\n          },\n        }),\n        { status: 401, headers: { \"content-type\": \"application/json\" } },\n      );\n    }\n  }\n  return context.next();\n};\n";
+export declare const PAGES_MIDDLEWARE_SOURCE = "/**\n * Early reject for /api without a session cookie, Bearer token, or Access JWT.\n * /api/login and /api/health stay public. Static /admin HTML shows the login UI.\n */\nexport const onRequest: PagesFunction = async (context) => {\n  const url = new URL(context.request.url);\n  if (\n    url.pathname.startsWith(\"/api/\") &&\n    url.pathname !== \"/api/health\" &&\n    url.pathname !== \"/api/login\" &&\n    context.request.method !== \"OPTIONS\"\n  ) {\n    const access = context.request.headers.get(\"Cf-Access-Jwt-Assertion\");\n    const authorization = context.request.headers.get(\"Authorization\");\n    const cookie = context.request.headers.get(\"Cookie\") ?? \"\";\n    const hasBearer =\n      authorization !== null && /^Bearer\\s+\\S+/i.test(authorization);\n    const hasSession = /(?:^|;\\s*)contentrail_session=/.test(cookie);\n    if (\n      (access === null || access.trim() === \"\") &&\n      !hasBearer &&\n      !hasSession\n    ) {\n      return new Response(\n        JSON.stringify({\n          error: {\n            code: \"MISSING_CREDENTIAL\",\n            message: \"Missing admin session. Sign in at /admin.\",\n          },\n        }),\n        { status: 401, headers: { \"content-type\": \"application/json\" } },\n      );\n    }\n  }\n  return context.next();\n};\n";
 //# sourceMappingURL=templates.d.ts.map

package/dist/pages/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/pages/templates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,sBAAsB,6bAalC,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAiExE;AAED,eAAO,MAAM,uBAAuB,miCA6BnC,CAAC"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../src/pages/templates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,eAAO,MAAM,sBAAsB,osBAqBlC,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAuGxE;AAED,eAAO,MAAM,uBAAuB,oyCAoCnC,CAAC"}

package/dist/pages/templates.js

@@ -6,24 +6,34 @@ export const PAGES_DEV_VARS_EXAMPLE = `# Local Pages Functions secrets (gitignor
 # Copy to .dev.vars and fill values. Never commit real secrets.
 # Do not prefix secrets with PUBLIC_ or VITE_.
 
-CONTENTRAIL_ACCESS_TEAM_DOMAIN=
-CONTENTRAIL_ACCESS_AUD=
-CONTENTRAIL_SITE_ID=
+# Default: username/password admin (no Zero Trust required)
+CONTENTRAIL_ADMIN_USERNAME=admin
+CONTENTRAIL_ADMIN_PASSWORD=
+CONTENTRAIL_SESSION_SECRET=
+
+# Site + Git publish
+CONTENTRAIL_SITE_ID=site
 CONTENTRAIL_GIT_OWNER=
 CONTENTRAIL_GIT_REPO=
 CONTENTRAIL_GIT_BRANCH=main
 CONTENTRAIL_CONTENT_ROOT=content
-CONTENTRAIL_ADMIN_ORIGIN=http://localhost:4321
+CONTENTRAIL_ADMIN_ORIGIN=http://localhost:8788
 CONTENTRAIL_GITHUB_TOKEN=
+
+# Optional: Cloudflare Access instead of (or in addition to) password auth
+# CONTENTRAIL_ACCESS_TEAM_DOMAIN=
+# CONTENTRAIL_ACCESS_AUD=
 `;
 export function pagesApiFunctionSource(collectionsImport) {
     return `/**
  * ContentRail Pages Functions API.
  * Server-only. Secrets come from Pages bindings / .dev.vars — never PUBLIC_* or VITE_*.
+ * Default auth: username/password session. Cloudflare Access is optional.
  */
 import {
   createCloudflareAccessAuthenticator,
   createPagesSiteHandler,
+  createPasswordAuthenticator,
   createSiteAuthorizer,
 } from "@contentrail/cloudflare";
 import {
@@ -34,8 +44,11 @@ import {
 ${collectionsImport}
 
 interface Env {
-  CONTENTRAIL_ACCESS_TEAM_DOMAIN: string;
-  CONTENTRAIL_ACCESS_AUD: string;
+  CONTENTRAIL_ADMIN_USERNAME?: string;
+  CONTENTRAIL_ADMIN_PASSWORD?: string;
+  CONTENTRAIL_SESSION_SECRET?: string;
+  CONTENTRAIL_ACCESS_TEAM_DOMAIN?: string;
+  CONTENTRAIL_ACCESS_AUD?: string;
   CONTENTRAIL_SITE_ID: string;
   CONTENTRAIL_GIT_OWNER: string;
   CONTENTRAIL_GIT_REPO: string;
@@ -47,12 +60,45 @@ interface Env {
 
 export const onRequest: PagesFunction<Env> = async (context) => {
   const env = context.env;
+  const passwordReady =
+    Boolean(env.CONTENTRAIL_ADMIN_USERNAME?.trim()) &&
+    Boolean(env.CONTENTRAIL_ADMIN_PASSWORD) &&
+    Boolean(env.CONTENTRAIL_SESSION_SECRET?.trim());
+  const accessReady =
+    Boolean(env.CONTENTRAIL_ACCESS_TEAM_DOMAIN?.trim()) &&
+    Boolean(env.CONTENTRAIL_ACCESS_AUD?.trim());
+
+  const passwordAuth = passwordReady
+    ? {
+        username: env.CONTENTRAIL_ADMIN_USERNAME!.trim(),
+        password: env.CONTENTRAIL_ADMIN_PASSWORD!,
+        sessionSecret: env.CONTENTRAIL_SESSION_SECRET!.trim(),
+      }
+    : undefined;
+
+  const authenticator = passwordReady
+    ? createPasswordAuthenticator(passwordAuth!)
+    : accessReady
+      ? createCloudflareAccessAuthenticator({
+          teamDomain: env.CONTENTRAIL_ACCESS_TEAM_DOMAIN!,
+          audience: env.CONTENTRAIL_ACCESS_AUD!,
+        })
+      : {
+          async authenticate() {
+            return {
+              ok: false as const,
+              status: 401 as const,
+              code: "KEY_UNAVAILABLE" as const,
+              message:
+                "Configure CONTENTRAIL_ADMIN_USERNAME/PASSWORD/SESSION_SECRET (recommended) or Cloudflare Access.",
+            };
+          },
+        };
+
   const handler = createPagesSiteHandler({
     siteId: env.CONTENTRAIL_SITE_ID,
-    authenticator: createCloudflareAccessAuthenticator({
-      teamDomain: env.CONTENTRAIL_ACCESS_TEAM_DOMAIN,
-      audience: env.CONTENTRAIL_ACCESS_AUD,
-    }),
+    authenticator,
+    ...(passwordAuth !== undefined ? { passwordAuth } : {}),
     authorizer: createSiteAuthorizer({
       sites: {
         [env.CONTENTRAIL_SITE_ID]: {
@@ -83,26 +129,33 @@ export const onRequest: PagesFunction<Env> = async (context) => {
 `;
 }
 export const PAGES_MIDDLEWARE_SOURCE = `/**
- * Rejects unauthenticated API mutations early.
- * Static /admin HTML is NOT covered — configure Cloudflare Access on /admin* as well.
+ * Early reject for /api without a session cookie, Bearer token, or Access JWT.
+ * /api/login and /api/health stay public. Static /admin HTML shows the login UI.
  */
 export const onRequest: PagesFunction = async (context) => {
   const url = new URL(context.request.url);
   if (
     url.pathname.startsWith("/api/") &&
     url.pathname !== "/api/health" &&
+    url.pathname !== "/api/login" &&
     context.request.method !== "OPTIONS"
   ) {
     const access = context.request.headers.get("Cf-Access-Jwt-Assertion");
     const authorization = context.request.headers.get("Authorization");
+    const cookie = context.request.headers.get("Cookie") ?? "";
     const hasBearer =
       authorization !== null && /^Bearer\\s+\\S+/i.test(authorization);
-    if ((access === null || access.trim() === "") && !hasBearer) {
+    const hasSession = /(?:^|;\\s*)contentrail_session=/.test(cookie);
+    if (
+      (access === null || access.trim() === "") &&
+      !hasBearer &&
+      !hasSession
+    ) {
       return new Response(
         JSON.stringify({
           error: {
             code: "MISSING_CREDENTIAL",
-            message: "Missing Access JWT credential.",
+            message: "Missing admin session. Sign in at /admin.",
           },
         }),
         { status: 401, headers: { "content-type": "application/json" } },

package/dist/pages/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/pages/templates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;CAarC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,iBAAyB;IAC9D,OAAO;;;;;;;;;;;;;;EAcP,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDlB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BtC,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../src/pages/templates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBrC,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,iBAAyB;IAC9D,OAAO;;;;;;;;;;;;;;;;EAgBP,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqFlB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCtC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contentrail/cloudflare",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "private": false,
   "type": "module",
   "description": "Server-only Cloudflare Worker and Pages Functions publishing API with Access auth and Pages setup helpers.",
@@ -29,8 +29,8 @@
   ],
   "dependencies": {
     "jose": "^6.2.14",
-    "@contentrail/core": "0.2.2",
-    "@contentrail/publisher": "0.2.2"
+    "@contentrail/core": "0.2.4",
+    "@contentrail/publisher": "0.2.4"
   },
   "devDependencies": {
     "@types/node": "^22.20.5",