@loomhelix-cms/node 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 loomhelix
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,29 @@
-# Temporary Holding Version
+# @loomhelix-cms/node
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`createCms`: an optional adapter of [loomhelix-cms](https://github.com/loomhelix/loomhelix-cms) for a Node.js site. One handler gives the editor page,
+the content API, the preview, and the pages of the site at their paths.
+
+Status: draft. The API can change before version 1.0.
+
+```sh
+npm install @loomhelix-cms/node @loomhelix-cms/render-html @loomhelix-cms/schema
+```
+
+```ts
+import { createServer } from 'node:http';
+import { createCms, createFolderStore } from '@loomhelix-cms/node';
+import { templates } from './templates.ts';
+
+const cms = await createCms({
+  schemaFile: 'blocks.ts',
+  templates,
+  store: createFolderStore('pages'),
+  canEdit: (request) => request.headers.host === 'localhost:3000',
+});
+
+createServer(cms.handle).listen(3000, '127.0.0.1');
+```
+
+`canEdit` decides who can use the editor. On a real site, check the session of your login in it. The handler checks
+the `Origin` header and the size of each save. [Add it to a Node.js site](https://github.com/loomhelix/loomhelix-cms#add-it-to-a-nodejs-site) gives all
+steps.

package/dist/index.d.mts

@@ -0,0 +1,66 @@
+import { Template } from "@loomhelix-cms/render-html";
+import { RecordReader } from "@loomhelix-cms/schema";
+import { IncomingMessage, ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+interface StoredPage {
+  readonly id: string;
+  readonly text: string;
+}
+interface PageStore {
+  list(): Promise<readonly StoredPage[]>;
+  read(id: string): Promise<string | undefined>;
+  write(id: string, text: string): Promise<void>;
+}
+interface RecordSummary {
+  readonly id: string;
+  readonly label: string;
+}
+type RecordQuery = {
+  readonly text: string;
+} | {
+  readonly ids: readonly string[];
+};
+interface RecordSource {
+  readonly lookup: (query: RecordQuery) => Promise<readonly RecordSummary[]>;
+  readonly read: RecordReader;
+}
+type RecordSources = Readonly<Record<string, RecordSource>>;
+type ImageType = 'image/png' | 'image/jpeg' | 'image/webp' | 'image/gif' | 'image/avif';
+interface ImageFormat {
+  readonly type: ImageType;
+  readonly extension: string;
+}
+interface UploadedImage extends ImageFormat {
+  readonly bytes: Uint8Array;
+}
+interface UploadedFile {
+  readonly size: number;
+  readonly stream: () => Readable;
+}
+interface UploadedFiles {
+  readonly path: string;
+  readonly open: (name: string) => Promise<UploadedFile | undefined>;
+}
+interface UploadStore {
+  readonly save: (image: UploadedImage) => Promise<string>;
+  readonly files?: UploadedFiles;
+}
+export declare function createFolderUploads(folder: string, path: string): UploadStore;
+interface CmsOptions {
+  readonly schemaFile: string;
+  readonly templates: Readonly<Record<string, Template>>;
+  readonly store: PageStore;
+  readonly canEdit: (request: IncomingMessage) => boolean | Promise<boolean>;
+  readonly blockPreviewPage?: (blockHtml: string) => string;
+  readonly records?: RecordSources;
+  readonly uploads?: UploadStore;
+}
+type Next = (error?: unknown) => void;
+type Handle = (request: IncomingMessage, response: ServerResponse, next?: Next) => Promise<void>;
+interface Cms {
+  readonly handle: Handle;
+  readonly renderBlock: (id: string) => Promise<string | undefined>;
+}
+export declare function createCms(options: CmsOptions): Promise<Cms>;
+export declare function createFolderStore(folder: string): PageStore;
+export type { Cms, CmsOptions, Handle, ImageFormat, ImageType, Next, PageStore, RecordQuery, RecordSource, RecordSummary, StoredPage, UploadStore, UploadedFile, UploadedFiles, UploadedImage };

package/dist/index.mjs

@@ -0,0 +1,798 @@
+import { createRequire } from "node:module";
+import { readSchemaSource } from "@loomhelix-cms/cli";
+import { RenderError, createRenderer } from "@loomhelix-cms/render-html";
+import { DocumentError, currentTypeName, loadDocument, loadDocumentSet, loadRecords, parseSchema } from "@loomhelix-cms/schema";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, readdir, rename, stat, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { createReadStream } from "node:fs";
+import { pipeline } from "node:stream/promises";
+// src/block-preview-page.ts
+function defaultBlockPreviewPage(blockHtml) {
+	return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Block preview</title>
+  </head>
+  <body>
+    ${blockHtml}
+  </body>
+</html>
+`;
+}
+// src/cms-paths.ts
+const CMS_PATH = "/cms";
+const API_PATH = "/cms/api";
+const PREVIEW_PATH = "/cms/preview";
+const SCHEMA_PATH = "/cms/blocks.json";
+const EDITOR_SCRIPT_PATH = "/cms/editor.js";
+const BRIDGE_SCRIPT_PATH = "/cms/bridge.js";
+const STORAGE_SCRIPT_PATH = "/cms/storage.js";
+// src/page-rules.ts
+const PAGE_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+function isPageId(text) {
+	return PAGE_ID_PATTERN.test(text);
+}
+function summarizePages(pages) {
+	return pages.map(({ id, document }) => ({
+		id,
+		type: rootTypeOf(document),
+		title: rootProp(document, "title"),
+		path: pathOf(document)
+	})).toSorted((first, second) => String(first.path).localeCompare(String(second.path)));
+}
+function readPageBody(schema, body, id) {
+	let json;
+	let document;
+	try {
+		json = JSON.parse(body);
+		document = loadDocument(schema, json).document;
+	} catch (error) {
+		if (error instanceof SyntaxError || error instanceof DocumentError) return { error: error.message };
+		throw error;
+	}
+	if (document.root.id !== id) return { error: `The root block has the id "${document.root.id}", but the address has the page id "${id}".` };
+	return {
+		json,
+		document
+	};
+}
+function findSaveError({ conditions, currentTag, paths, document }) {
+	if (isOutdated(conditions, currentTag)) return {
+		status: 412,
+		message: "The page changed after the editor read it, or it exists already."
+	};
+	const { id } = document.root;
+	const path = document.root.props.path;
+	if (typeof path !== "string") return;
+	const pageWithPath = paths.get(path);
+	if (pageWithPath !== void 0 && pageWithPath !== id) return {
+		status: 409,
+		message: `The page "${pageWithPath}" has the path ${path} already.`
+	};
+}
+function indexPaths(pages) {
+	const paths = /* @__PURE__ */ new Map();
+	for (const page of pages) {
+		const path = pathOf(page.document);
+		if (typeof path === "string" && !paths.has(path)) paths.set(path, page.id);
+	}
+	return paths;
+}
+function withPagePath(paths, id, path) {
+	const otherPaths = new Map([...paths].filter(([, pageId]) => pageId !== id));
+	if (typeof path === "string" && !otherPaths.has(path)) otherPaths.set(path, id);
+	return otherPaths;
+}
+function findPageByPath(pages, path) {
+	return pages.find((page) => pathOf(page.document) === path);
+}
+function rootTypeOf(document) {
+	return propertyOf(propertyOf(document, "root"), "type");
+}
+function pathOf(document) {
+	return rootProp(document, "path");
+}
+function rootProp(document, name) {
+	return propertyOf(propertyOf(propertyOf(document, "root"), "props"), name);
+}
+function propertyOf(value, name) {
+	return typeof value === "object" && value !== null ? Object.getOwnPropertyDescriptor(value, name)?.value : void 0;
+}
+function isOutdated({ ifMatch, ifNoneMatch }, currentTag) {
+	if (ifNoneMatch === "*" && currentTag !== void 0) return true;
+	return ifMatch !== void 0 && ifMatch !== currentTag;
+}
+// src/page-store.ts
+async function readStoredDocument(store, id) {
+	const text = await store.read(id);
+	return text === void 0 ? void 0 : {
+		id,
+		document: parseStoredText(text)
+	};
+}
+async function readStoredDocuments(store) {
+	return (await store.list()).map(({ id, text }) => ({
+		id,
+		document: parseStoredText(text)
+	}));
+}
+function parseStoredText(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+// src/request-checks.ts
+const WEB_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function hasSiteOrigin(request) {
+	const { origin, host } = request.headers;
+	if (origin === void 0 || host === void 0) return false;
+	try {
+		const url = new URL(origin);
+		return WEB_PROTOCOLS.has(url.protocol) && url.host === host;
+	} catch {
+		return false;
+	}
+}
+function hasBodyType(request, type) {
+	return request.headers["content-type"]?.split(";")[0]?.trim().toLowerCase() === type;
+}
+async function readBody(request, maxBytes) {
+	return (await readBytes(request, maxBytes))?.toString("utf8");
+}
+async function readBytes(request, maxBytes) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of request) {
+		size += chunk.length;
+		if (size <= maxBytes) chunks.push(chunk);
+	}
+	return size > maxBytes ? void 0 : Buffer.concat(chunks);
+}
+// src/responses.ts
+const EDITOR_HEADERS = {
+	"content-security-policy": "default-src 'self'; img-src 'self' https: data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'",
+	"referrer-policy": "same-origin",
+	"x-content-type-options": "nosniff"
+};
+const HTML_TYPE = "text/html; charset=utf-8";
+const JSON_TYPE = "application/json; charset=utf-8";
+const TEXT_TYPE = "text/plain; charset=utf-8";
+function send(response, status, headers, body) {
+	response.writeHead(status, {
+		...EDITOR_HEADERS,
+		...headers
+	});
+	response.end(body);
+}
+function sendText(response, status, text, headers = {}) {
+	send(response, status, {
+		...headers,
+		"content-type": TEXT_TYPE
+	}, text);
+}
+function sendNoContent(response, headers) {
+	response.writeHead(204, {
+		...EDITOR_HEADERS,
+		...headers
+	});
+	response.end();
+}
+function sendPage(response, html, headers = {}) {
+	response.writeHead(200, {
+		...headers,
+		"content-type": HTML_TYPE,
+		"x-content-type-options": "nosniff"
+	});
+	response.end(html);
+}
+// src/content-api.ts
+const PAGES_PATH = "/pages";
+const MAX_PAGE_BYTES = 1048576;
+function createContentApi(schema, store, pagePaths) {
+	let pendingWrite = Promise.resolve();
+	async function listPages(response) {
+		const pages = summarizePages(await readStoredDocuments(store));
+		send(response, 200, { "content-type": JSON_TYPE }, JSON.stringify({ pages }));
+	}
+	async function getPage(response, id) {
+		const text = await store.read(id);
+		if (text === void 0) {
+			sendText(response, 404, "The page does not exist.");
+			return;
+		}
+		send(response, 200, {
+			"content-type": JSON_TYPE,
+			etag: entityTag(text)
+		}, text);
+	}
+	async function putPage(request, response, id) {
+		if (!hasSiteOrigin(request)) {
+			sendText(response, 403, "The request must come from a page of this site.");
+			return;
+		}
+		if (!hasBodyType(request, "application/json")) {
+			sendText(response, 415, "The body must have the type application/json.");
+			return;
+		}
+		const body = await readBody(request, MAX_PAGE_BYTES);
+		if (body === void 0) {
+			sendText(response, 413, "The body is larger than 1 MB.");
+			return;
+		}
+		const page = readPageBody(schema, body, id);
+		if ("error" in page) {
+			sendText(response, 400, page.error);
+			return;
+		}
+		const write = pendingWrite.then(() => savePage(request, response, page.json, page.document));
+		pendingWrite = write.catch(() => void 0);
+		await write;
+	}
+	async function savePage(request, response, json, document) {
+		const { id } = document.root;
+		const currentText = await store.read(id);
+		const saveError = findSaveError({
+			conditions: {
+				ifMatch: request.headers["if-match"],
+				ifNoneMatch: request.headers["if-none-match"]
+			},
+			currentTag: currentText === void 0 ? void 0 : entityTag(currentText),
+			paths: await pagePaths.read(),
+			document
+		});
+		if (saveError !== void 0) {
+			sendText(response, saveError.status, saveError.message);
+			return;
+		}
+		const text = `${JSON.stringify(json, null, 2)}\n`;
+		await store.write(id, text);
+		pagePaths.change(id, document.root.props.path);
+		sendNoContent(response, { etag: entityTag(text) });
+	}
+	return async (request, response, path) => {
+		if (path === PAGES_PATH) {
+			if (request.method !== "GET") {
+				sendText(response, 405, "This address accepts only GET.", { allow: "GET" });
+				return;
+			}
+			await listPages(response);
+			return;
+		}
+		const id = path.startsWith(`${PAGES_PATH}/`) ? path.slice(7) : "";
+		if (!isPageId(id)) {
+			sendText(response, 404, "The page does not exist.");
+			return;
+		}
+		if (request.method === "GET") {
+			await getPage(response, id);
+			return;
+		}
+		if (request.method === "PUT") {
+			await putPage(request, response, id);
+			return;
+		}
+		sendText(response, 405, "This address accepts only GET and PUT.", { allow: "GET, PUT" });
+	};
+}
+function entityTag(text) {
+	return `"${createHash("sha256").update(text).digest("base64url")}"`;
+}
+// src/editor-page.ts
+const EDITOR_PAGE = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Edit the site</title>
+    <style>
+      html,
+      body {
+        height: 100%;
+        margin: 0;
+      }
+    </style>
+    <script type="module" src="${EDITOR_SCRIPT_PATH}"><\/script>
+    <script type="module" src="${STORAGE_SCRIPT_PATH}"><\/script>
+  </head>
+  <body>
+    <lhcms-editor
+      schema-url="${SCHEMA_PATH}"
+      preview-url="${PREVIEW_PATH}"
+    ></lhcms-editor>
+  </body>
+</html>
+`;
+// src/bridge-script.ts
+const BODY_END = "</body>";
+function withBridgeScript(html, scriptPath) {
+	const tag = `<script type="module" src="${scriptPath}"><\/script>`;
+	const bodyEnd = html.lastIndexOf(BODY_END);
+	if (bodyEnd === -1) return `${html}${tag}`;
+	return `${html.slice(0, bodyEnd)}${tag}${html.slice(bodyEnd)}`;
+}
+// src/preview.ts
+const FORM_TYPE = "application/x-www-form-urlencoded";
+const DOCUMENT_FIELD = "document";
+const MAX_PREVIEW_BYTES = 2097152;
+const PREVIEW_HEADERS = {
+	"cache-control": "no-store",
+	"x-frame-options": "SAMEORIGIN"
+};
+async function sendPreview(renderPreview, request, response) {
+	if (request.method !== "POST") {
+		sendText(response, 405, "This address accepts only POST.", { allow: "POST" });
+		return;
+	}
+	if (!hasSiteOrigin(request)) {
+		sendText(response, 403, "The request must come from a page of this site.");
+		return;
+	}
+	if (!hasBodyType(request, FORM_TYPE)) {
+		sendText(response, 415, `The body must have the type ${FORM_TYPE}.`);
+		return;
+	}
+	const body = await readBody(request, MAX_PREVIEW_BYTES);
+	if (body === void 0) {
+		sendText(response, 413, "The body is larger than 2 MB.");
+		return;
+	}
+	const documentText = new URLSearchParams(body).get(DOCUMENT_FIELD);
+	if (documentText === null) {
+		sendText(response, 400, `The form must have the field "${DOCUMENT_FIELD}".`);
+		return;
+	}
+	let html;
+	try {
+		html = await renderPreview(JSON.parse(documentText));
+	} catch (error) {
+		if (error instanceof SyntaxError || error instanceof DocumentError || error instanceof RenderError) {
+			sendText(response, 400, error.message);
+			return;
+		}
+		throw error;
+	}
+	sendPage(response, withBridgeScript(html, BRIDGE_SCRIPT_PATH), PREVIEW_HEADERS);
+}
+// src/records-api.ts
+function findMissingSource(schema, sources) {
+	return [...schema.pages.values(), ...schema.blocks.values()].flatMap((type) => [...type.fields.values()]).flatMap((field) => field.type === "record" ? [field.source] : []).find((source) => !hasFunctions(Object.hasOwn(sources, source) ? sources[source] : void 0));
+}
+function hasFunctions(source) {
+	return typeof source?.lookup === "function" && typeof source.read === "function";
+}
+function readersOf(sources) {
+	return Object.fromEntries(Object.entries(sources).map(([name, { read }]) => [name, read]));
+}
+function readRecordQuery(search) {
+	const ids = search.getAll("id");
+	return ids.length > 0 ? { ids } : { text: search.get("text") ?? "" };
+}
+function createRecordsApi(sources) {
+	return async (request, response, source) => {
+		if (request.method !== "GET") {
+			sendText(response, 405, "This address accepts only GET.", { allow: "GET" });
+			return;
+		}
+		const recordSource = Object.hasOwn(sources, source) ? sources[source] : void 0;
+		if (recordSource === void 0) {
+			sendText(response, 404, "The site has no record source with this name.");
+			return;
+		}
+		const query = readRecordQuery(new URL(request.url ?? "", "http://localhost").searchParams);
+		const records = (await recordSource.lookup(query)).map(({ id, label }) => ({
+			id,
+			label
+		}));
+		send(response, 200, { "content-type": JSON_TYPE }, JSON.stringify({ records }));
+	};
+}
+// src/script-files.ts
+const SCRIPT_TYPE = "text/javascript; charset=utf-8";
+const require = createRequire(import.meta.url);
+const SCRIPT_FILES = /* @__PURE__ */ new Map([[EDITOR_SCRIPT_PATH, builtFile("@loomhelix-cms/editor", "editor.js")], [BRIDGE_SCRIPT_PATH, builtFile("@loomhelix-cms/bridge", "bridge.js")]]);
+async function sendScriptFile(response, { packageName, file }) {
+	let script;
+	try {
+		script = await readFile(file);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+			sendText(response, 404, `The script is not built. Run the build of ${packageName}.`);
+			return;
+		}
+		throw error;
+	}
+	send(response, 200, { "content-type": SCRIPT_TYPE }, script);
+}
+function builtFile(packageName, fileName) {
+	const packageFolder = dirname(require.resolve(`${packageName}/package.json`));
+	return {
+		packageName,
+		file: join(packageFolder, "dist", fileName)
+	};
+}
+// src/storage-script.ts
+function storageScript(acceptsUploads) {
+	return `import { createHttpStorage } from '${EDITOR_SCRIPT_PATH}';
+
+const storage = ${acceptsUploads ? `createHttpStorage('${API_PATH}')` : `{ ...createHttpStorage('${API_PATH}'), upload: undefined }`};
+for (const editor of document.querySelectorAll('lhcms-editor')) {
+  editor.storage ??= storage;
+}
+`;
+}
+// src/image-files.ts
+const PNG_START = [
+	137,
+	80,
+	78,
+	71,
+	13,
+	10,
+	26,
+	10
+];
+const JPEG_START = [
+	255,
+	216,
+	255
+];
+const UPLOAD_NAME_PATTERN = /^[0-9a-f]{32}\.(?:png|jpg|webp|gif|avif)$/;
+const KNOWN_FORMATS = [
+	{
+		type: "image/png",
+		extension: ".png",
+		signatures: [[{
+			offset: 0,
+			bytes: PNG_START
+		}]]
+	},
+	{
+		type: "image/jpeg",
+		extension: ".jpg",
+		signatures: [[{
+			offset: 0,
+			bytes: JPEG_START
+		}]]
+	},
+	{
+		type: "image/gif",
+		extension: ".gif",
+		signatures: [[{
+			offset: 0,
+			bytes: ascii("GIF87a")
+		}], [{
+			offset: 0,
+			bytes: ascii("GIF89a")
+		}]]
+	},
+	{
+		type: "image/webp",
+		extension: ".webp",
+		signatures: [[{
+			offset: 0,
+			bytes: ascii("RIFF")
+		}, {
+			offset: 8,
+			bytes: ascii("WEBP")
+		}]]
+	},
+	{
+		type: "image/avif",
+		extension: ".avif",
+		signatures: [[{
+			offset: 4,
+			bytes: ascii("ftypavif")
+		}], [{
+			offset: 4,
+			bytes: ascii("ftypavis")
+		}]]
+	}
+];
+function findImageFormat(bytes) {
+	const format = KNOWN_FORMATS.find(({ signatures }) => signatures.some((signature) => signature.every((part) => hasBytes(bytes, part))));
+	return format === void 0 ? void 0 : {
+		type: format.type,
+		extension: format.extension
+	};
+}
+function imageTypeOfName(name) {
+	if (!UPLOAD_NAME_PATTERN.test(name)) return;
+	return KNOWN_FORMATS.find(({ extension }) => name.endsWith(extension))?.type;
+}
+function ascii(text) {
+	return Array.from({ length: text.length }, (_, index) => text.charCodeAt(index));
+}
+function hasBytes(bytes, { offset, bytes: expected }) {
+	return expected.every((byte, index) => bytes[offset + index] === byte);
+}
+// src/uploads.ts
+const MAX_UPLOAD_BYTES = 10485760;
+const CLOSED_BY_CLIENT = "ERR_STREAM_PREMATURE_CLOSE";
+const FILE_HEADERS = {
+	"cache-control": "public, max-age=31536000, immutable",
+	"content-security-policy": "default-src 'none'",
+	"x-content-type-options": "nosniff"
+};
+function createFolderUploads(folder, path) {
+	const basePath = path.replace(/\/+$/, "");
+	if (!basePath.startsWith("/")) throw new TypeError(`The path of the uploaded files must start with / and contain a folder name, for example /uploads, got ${JSON.stringify(path)}.`);
+	return {
+		save: async ({ bytes, extension }) => {
+			const name = `${randomUUID().replaceAll("-", "")}${extension}`;
+			await mkdir(folder, { recursive: true });
+			await writeFile(join(folder, name), bytes, { flag: "wx" });
+			return `${basePath}/${name}`;
+		},
+		files: {
+			path: basePath,
+			open: async (name) => imageTypeOfName(name) === void 0 ? void 0 : openExistingFile(join(folder, name))
+		}
+	};
+}
+async function openExistingFile(file) {
+	try {
+		const { size } = await stat(file);
+		return {
+			size,
+			stream: () => createReadStream(file)
+		};
+	} catch (error) {
+		if (error.code === "ENOENT") return;
+		throw error;
+	}
+}
+function createUploadsApi(store) {
+	return async (request, response) => {
+		if (request.method !== "POST") {
+			sendText(response, 405, "This address accepts only POST.", { allow: "POST" });
+			return;
+		}
+		if (store === void 0) {
+			sendText(response, 404, "The site does not accept uploads.");
+			return;
+		}
+		if (!hasSiteOrigin(request)) {
+			sendText(response, 403, "The request must come from a page of this site.");
+			return;
+		}
+		const bytes = await readBytes(request, MAX_UPLOAD_BYTES);
+		if (bytes === void 0) {
+			sendText(response, 413, "The file is larger than 10 MB.");
+			return;
+		}
+		const format = findImageFormat(bytes);
+		if (format === void 0) {
+			sendText(response, 415, "The file is not a PNG, JPEG, WebP, GIF, or AVIF image.");
+			return;
+		}
+		const src = await store.save({
+			...format,
+			bytes
+		});
+		send(response, 201, { "content-type": JSON_TYPE }, JSON.stringify({ src }));
+	};
+}
+async function sendUploadedFile(request, response, files, name) {
+	const type = imageTypeOfName(name);
+	const file = type === void 0 ? void 0 : await files.open(name);
+	if (type === void 0 || file === void 0) {
+		sendText(response, 404, "The file does not exist.");
+		return;
+	}
+	const entityTag = `"${name}"`;
+	const headers = {
+		...FILE_HEADERS,
+		etag: entityTag
+	};
+	if (hasEntityTag(request.headers["if-none-match"], entityTag)) {
+		response.writeHead(304, headers);
+		response.end();
+		return;
+	}
+	response.writeHead(200, {
+		...headers,
+		"content-type": type,
+		"content-length": file.size
+	});
+	if (request.method === "HEAD") {
+		response.end();
+		return;
+	}
+	try {
+		await pipeline(file.stream(), response);
+	} catch (error) {
+		if (error.code !== CLOSED_BY_CLIENT) throw error;
+	}
+}
+function hasEntityTag(header, entityTag) {
+	return (header ?? "").split(",").map((tag) => tag.trim().replace(/^W\//, "")).some((tag) => tag === entityTag || tag === "*");
+}
+// src/create-cms.ts
+const PATH_INDEX_LIFETIME = 5e3;
+const READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+async function createCms(options) {
+	if (typeof options.canEdit !== "function") throw new TypeError("createCms needs the option \"canEdit\": a function that tells if a request can use the editor.");
+	const schemaJson = await readSchemaSource(process.cwd(), options.schemaFile);
+	const schema = parseSchema(schemaJson);
+	const recordSources = options.records ?? {};
+	const missingSource = findMissingSource(schema, recordSources);
+	if (missingSource !== void 0) throw new TypeError(`The schema has a record field with the source "${missingSource}". Give createCms the option "records" with the functions lookup and read for "${missingSource}".`);
+	const schemaText = JSON.stringify(schemaJson);
+	const render = createRenderer(schema, options.templates);
+	const blockPreviewPage = options.blockPreviewPage ?? defaultBlockPreviewPage;
+	const isBlockDocument = (json) => schema.blocks.has(currentTypeName(schema, String(rootTypeOf(json))));
+	const readShownDocument = async (id) => (await readStoredDocument(options.store, id))?.document;
+	const recordReaders = readersOf(recordSources);
+	const renderDocument = async (json, mode) => {
+		const documents = await loadDocumentSet(schema, json, readShownDocument);
+		return render(await loadRecords(schema, documents, recordReaders), mode);
+	};
+	const renderPreview = async (json) => {
+		const html = await renderDocument(json, "preview");
+		return isBlockDocument(json) ? blockPreviewPage(html) : html;
+	};
+	let pathIndex;
+	const contentApi = createContentApi(schema, options.store, {
+		read: readPathIndex,
+		change: (id, path) => {
+			if (pathIndex !== void 0) keepPathIndex(pathIndex.paths.then((paths) => withPagePath(paths, id, path)), pathIndex.readAt);
+		}
+	});
+	const recordsApi = createRecordsApi(recordSources);
+	const uploadsApi = createUploadsApi(options.uploads);
+	const uploadedFiles = options.uploads?.files;
+	const sendEditorPage = (response) => send(response, 200, { "content-type": HTML_TYPE }, EDITOR_PAGE);
+	const editorFiles = new Map([
+		[CMS_PATH, sendEditorPage],
+		[`${CMS_PATH}/`, sendEditorPage],
+		[SCHEMA_PATH, (response) => send(response, 200, { "content-type": JSON_TYPE }, schemaText)],
+		[STORAGE_SCRIPT_PATH, (response) => send(response, 200, { "content-type": SCRIPT_TYPE }, storageScript(options.uploads !== void 0))],
+		...[...SCRIPT_FILES].map(([path, script]) => [path, (response) => sendScriptFile(response, script)])
+	]);
+	async function handleCmsRequest(request, response, pathname) {
+		if (!await options.canEdit(request)) {
+			sendText(response, 403, "This request cannot use the editor. Sign in as an editor first.");
+			return;
+		}
+		if (pathname === "/cms/api/uploads") {
+			await uploadsApi(request, response);
+			return;
+		}
+		if (pathname.startsWith("/cms/api/records/")) {
+			await recordsApi(request, response, pathname.slice(17));
+			return;
+		}
+		if (pathname === "/cms/api" || pathname.startsWith(`/cms/api/`)) {
+			await contentApi(request, response, pathname.slice(8));
+			return;
+		}
+		if (pathname === "/cms/preview") {
+			await sendPreview(renderPreview, request, response);
+			return;
+		}
+		const sendFile = editorFiles.get(pathname);
+		if (sendFile === void 0) {
+			sendText(response, 404, "The editor has nothing at this address.");
+			return;
+		}
+		if (request.method !== "GET") {
+			sendText(response, 405, "This address accepts only GET.", { allow: "GET" });
+			return;
+		}
+		await sendFile(response);
+	}
+	function readPathIndex() {
+		const now = Date.now();
+		if (pathIndex === void 0 || now - pathIndex.readAt >= PATH_INDEX_LIFETIME) return keepPathIndex(readStoredDocuments(options.store).then(indexPaths), now);
+		return pathIndex.paths;
+	}
+	function keepPathIndex(paths, readAt) {
+		pathIndex = {
+			paths,
+			readAt
+		};
+		paths.catch(() => {
+			if (pathIndex?.paths === paths) pathIndex = void 0;
+		});
+		return paths;
+	}
+	async function findLivePage(pathname) {
+		const path = decodePath(pathname);
+		const id = path === void 0 ? void 0 : (await readPathIndex()).get(path);
+		if (path === void 0 || id === void 0) return;
+		const page = await readStoredDocument(options.store, id);
+		return page === void 0 ? void 0 : findPageByPath([page], path);
+	}
+	async function route(request, response, next) {
+		const { pathname } = new URL(request.url ?? "/", "http://localhost");
+		if (pathname === "/cms" || pathname.startsWith(`/cms/`)) {
+			await handleCmsRequest(request, response, pathname);
+			return;
+		}
+		const isRead = READ_METHODS.has(request.method ?? "");
+		if (uploadedFiles !== void 0 && isRead && pathname.startsWith(`${uploadedFiles.path}/`)) {
+			const name = pathname.slice(uploadedFiles.path.length + 1);
+			await sendUploadedFile(request, response, uploadedFiles, name);
+			return;
+		}
+		const page = isRead ? await findLivePage(pathname) : void 0;
+		if (page !== void 0) {
+			sendPage(response, await renderDocument(page.document, "live"));
+			return;
+		}
+		if (next === void 0) {
+			sendText(response, 404, "The page does not exist.");
+			return;
+		}
+		next();
+	}
+	async function renderBlock(id) {
+		const text = await options.store.read(id);
+		if (text === void 0) return;
+		const json = JSON.parse(text);
+		if (!isBlockDocument(json)) throw new TypeError(`The document "${id}" is not a block document. renderBlock renders a document with a block type at the root.`);
+		return renderDocument(json, "live");
+	}
+	return {
+		renderBlock,
+		handle: async (request, response, next) => {
+			try {
+				await route(request, response, next);
+			} catch (error) {
+				if (next !== void 0) {
+					next(error);
+					return;
+				}
+				console.error(error);
+				if (!response.headersSent) sendText(response, 500, "The server cannot answer this request.");
+			}
+		}
+	};
+}
+function decodePath(pathname) {
+	try {
+		return decodeURIComponent(pathname);
+	} catch {
+		return;
+	}
+}
+// src/folder-store.ts
+const PAGE_FILE_EXTENSION = ".json";
+function createFolderStore(folder) {
+	return {
+		list: () => listPages(folder),
+		read: (id) => readPage(folder, id),
+		write: (id, text) => writePage(folder, id, text)
+	};
+}
+async function listPages(folder) {
+	const ids = (await readdir(folder)).filter((name) => name.endsWith(PAGE_FILE_EXTENSION)).map((name) => name.slice(0, -5)).filter(isPageId).toSorted();
+	return Promise.all(ids.map(async (id) => ({
+		id,
+		text: await readFile(pageFile(folder, id), "utf8")
+	})));
+}
+async function readPage(folder, id) {
+	try {
+		return await readFile(pageFile(folder, id), "utf8");
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return;
+		throw error;
+	}
+}
+async function writePage(folder, id, text) {
+	const file = pageFile(folder, id);
+	const temporaryFile = `${file}.${randomUUID()}.tmp`;
+	await writeFile(temporaryFile, text, "utf8");
+	await rename(temporaryFile, file);
+}
+function pageFile(folder, id) {
+	if (!isPageId(id)) throw new TypeError(`The page id ${JSON.stringify(id)} can contain only letters, digits, hyphens, and underscores.`);
+	return join(folder, `${id}${PAGE_FILE_EXTENSION}`);
+}
+export { createCms, createFolderStore, createFolderUploads };

package/package.json

@@ -1,6 +1,43 @@
 {
   "name": "@loomhelix-cms/node",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "The server part for a Node.js site: the editor page, the content API, the preview, and the stored pages.",
+  "homepage": "https://github.com/loomhelix/loomhelix-cms/tree/main/packages/node#readme",
+  "bugs": "https://github.com/loomhelix/loomhelix-cms/issues",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/loomhelix/loomhelix-cms.git",
+    "directory": "packages/node"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": "./dist/index.mjs",
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@loomhelix-cms/bridge": "^0.1.0",
+    "@loomhelix-cms/cli": "^0.1.0",
+    "@loomhelix-cms/editor": "^0.1.0",
+    "@loomhelix-cms/render-html": "^0.1.0",
+    "@loomhelix-cms/schema": "^0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.5",
+    "typescript": "^7.0.2",
+    "vite-plus": "1.5.0"
+  },
+  "engines": {
+    "node": "^22.18.0 || ^24.11.0 || >=26.0.0"
+  },
+  "scripts": {
+    "build": "vp pack"
+  }
 }