@rigel-cms/rigel 0.0.0-stage → 0.1.0-beta.1

package/src/preview.ts

@@ -0,0 +1,167 @@
+import MarkdownIt from "markdown-it";
+import DOMPurify from "dompurify";
+import { pageRoute } from "./schema/paths";
+import { renderArticle } from "./article-render";
+import { safePreviewUrl } from "./preview-urls";
+export { safePreviewUrl } from "./preview-urls";
+
+export interface PreviewDocumentMapping {
+  url: string;
+  index?: string;
+}
+
+export interface PreviewConfig {
+  pages?: Record<string, string>;
+  collections?: Record<string, { url: string; new: string }>;
+  documents?: Record<string, PreviewDocumentMapping>;
+}
+export interface PreviewTarget {
+  kind: "page" | "post" | "menu" | "document";
+  slug: string;
+  collection?: string;
+  type?: string;
+}
+
+export function previewPath(config: PreviewConfig, target: PreviewTarget, isNew = false): string | null {
+  if (target.kind === "document") return pageRoute(target.slug, config.documents?.[target.type ?? ""]);
+  const mapping = target.kind === "post" ? config.collections?.[target.collection ?? ""] : undefined;
+  const path = target.kind === "page" ? config.pages?.[target.slug] : mapping ? (isNew ? mapping.new : mapping.url.replaceAll("{slug}", encodeURIComponent(target.slug))) : undefined;
+  return typeof path === "string" && /^\/(?!\/)/.test(path) && !/[\\\s?#]/.test(path) && !path.split("/").includes("..") && !/^\/rigel(?:\/|$)/.test(path) ? path : null;
+}
+
+export function anchorValue(values: unknown, path: string): { found: boolean; value: unknown } {
+  let value = values;
+  for (const key of path.split(".")) {
+    if (!value || typeof value !== "object") return { found: false, value: undefined };
+    if (Array.isArray(value)) {
+      const item = (value as Record<string, unknown>[]).find((entry) => entry && typeof entry === "object" && entry._key === key);
+      if (item === undefined) return { found: false, value: undefined };
+      value = item;
+      continue;
+    }
+    if (["__proto__", "constructor", "prototype"].includes(key) || !Object.hasOwn(value, key)) return { found: false, value: undefined };
+    value = (value as Record<string, unknown>)[key];
+  }
+  return { found: true, value };
+}
+
+
+const markdown = new MarkdownIt({ html: false, linkify: false });
+const rendered = new WeakMap<Element, string>();
+
+export interface PatchDocuments {
+  editingBody?: Element | null;
+  documents?: Record<string, Record<string, unknown>>;
+  primary?: string;
+}
+
+function rebindTree(root: Element | DocumentFragment, update: (element: Element) => void) {
+  if (root.nodeType === 1) update(root as Element);
+  for (const child of root.children) {
+    rebindTree(child, update);
+    if (child.tagName === "TEMPLATE") rebindTree((child as HTMLTemplateElement).content, update);
+  }
+}
+
+export function patchPreview(doc: Document, values: Record<string, unknown>, body: "" | import("./article-body").ArticleBody, options: PatchDocuments = {}) {
+  const sourceFor = (element: Element): Record<string, unknown> | undefined => {
+    const id = element.getAttribute("data-rigel-doc");
+    if (id === "") return {};
+    if (id === null || id === options.primary) return values;
+    if (options.documents && Object.hasOwn(options.documents, id)) return options.documents[id];
+    return !options.primary ? values : undefined;
+  };
+  const get = (element: Element, path: string) => {
+    const source = sourceFor(element);
+    if (source === undefined) return { found: false, value: undefined };
+    if (path === "$body") return { found: true, value: body };
+    return { found: true, value: anchorValue(source, path).value };
+  };
+  const syncStructure = (root: Element) => {
+    if (root.hasAttribute("data-rigel-reference")) {
+      const reference = get(root, root.getAttribute("data-rigel-reference")!).value;
+      const id = reference && typeof reference === "object" && "_ref" in reference ? String(reference._ref) : "";
+      const target = root.querySelector("[data-rigel-reference-target]");
+      for (const child of target ? [target] : [...root.children]) rebindTree(child, element => {
+        if (element.hasAttribute("data-rigel-doc")) element.setAttribute("data-rigel-doc", id);
+      });
+    }
+    const path = root.getAttribute("data-rigel-each");
+    if (path) {
+      const result = get(root, path);
+      if (result.found) {
+        const items = Array.isArray(result.value) ? result.value as Record<string, unknown>[] : [];
+        const templates = [...root.children].filter(element => element.hasAttribute("data-rigel-item-template")) as HTMLTemplateElement[];
+        const keyOf = (element: Element) => element.getAttribute("data-rigel-item") ?? element.getAttribute("data-rigel-key");
+        const existing = new Map([...root.children].filter(element => keyOf(element) !== null).map(element => [keyOf(element)!, element]));
+        const keep = new Set<Element>();
+        let previous: Element | null = null;
+        for (const item of items) {
+          if (!item || typeof item._key !== "string") continue;
+          const key = item._key;
+          let element = existing.get(key);
+          if (element?.hasAttribute("data-rigel-section") && element.getAttribute("data-rigel-section") !== item._type) { element.remove(); element = undefined; }
+          if (!element) {
+            const template = templates.find(template => template.getAttribute("data-rigel-item-template") === (item._type ?? ""));
+            element = template?.content.firstElementChild?.cloneNode(true) as Element | undefined;
+            if (!element) continue;
+            rebindTree(element, node => {
+              for (const attr of [...node.attributes]) {
+                if (!attr.name.startsWith("data-rigel-")) continue;
+                const prefix = `${path}.__item__`;
+                if (attr.value === prefix || attr.value.startsWith(`${prefix}.`)) node.setAttribute(attr.name, `${path}.${key}${attr.value.slice(prefix.length)}`);
+              }
+            });
+            element.setAttribute(element.hasAttribute("data-rigel-section") ? "data-rigel-key" : "data-rigel-item", key);
+          }
+          const next: Element | null = previous ? previous.nextElementSibling : root.firstElementChild;
+          if (next !== element) root.insertBefore(element, next);
+          keep.add(element);
+          previous = element;
+        }
+        for (const element of existing.values()) if (!keep.has(element)) element.remove();
+      }
+    }
+    for (const child of [...root.children]) if (child.tagName !== "TEMPLATE") syncStructure(child);
+  };
+  syncStructure(doc.documentElement);
+  for (const element of doc.querySelectorAll<HTMLElement>("[data-rigel-if]")) {
+    const result = get(element, element.getAttribute("data-rigel-if")!);
+    if (result.found) element.hidden = !result.value;
+  }
+  for (const el of doc.querySelectorAll<HTMLElement>("[data-rigel-text]")) {
+    const result = get(el, el.dataset.rigelText!);
+    if (!result.found) continue;
+    const text = result.value === null || result.value === undefined ? "" : String(result.value);
+    if (el.textContent !== text) el.textContent = text;
+  }
+  for (const el of doc.querySelectorAll<HTMLElement>("[data-rigel-richtext]")) {
+    if (el === options.editingBody) continue;
+    const result = get(el, el.dataset.rigelRichtext!);
+    if (!result.found) continue;
+    const blocks = el.dataset.rigelRichtext === "$body";
+    const source = blocks ? JSON.stringify(result.value) : typeof result.value === "string" ? result.value : "";
+    if (rendered.get(el) === source) continue;
+    rendered.set(el, source);
+    const fragment = DOMPurify.sanitize(blocks ? (result.value ? renderArticle(result.value as import("./article-body").ArticleBody) : "") : markdown.render(source), {
+      RETURN_DOM_FRAGMENT: true,
+      ALLOWED_TAGS: ["p", "h1", "h2", "h3", "h4", "h5", "h6", "ul", "ol", "li", "blockquote", "aside", "figure", "figcaption", "pre", "code", "strong", "em", "s", "u", "mark", "sub", "sup", "a", "img", "br", "hr", "table", "thead", "tbody", "tr", "th", "td"],
+      ALLOWED_ATTR: ["href", "src", "alt", "title", "start", "scope"],
+    });
+    for (const link of fragment.querySelectorAll("[href], [src]")) {
+      for (const attr of ["href", "src"]) if (link.hasAttribute(attr) && !safePreviewUrl(link.getAttribute(attr)!, attr === "src")) link.removeAttribute(attr);
+    }
+    el.replaceChildren(fragment);
+  }
+  for (const [anchor, attr, tag] of [["image", "src", "IMG"], ["alt", "alt", "IMG"], ["href", "href", "A"]]) {
+    for (const el of doc.querySelectorAll(`[data-rigel-${anchor}]`)) {
+      if (el.tagName !== tag) continue;
+      const result = get(el, el.getAttribute(`data-rigel-${anchor}`)!);
+      if (!result.found) continue;
+      const value = result.value === null || result.value === undefined ? "" : String(result.value);
+      if (attr === "alt" || safePreviewUrl(value, attr === "src")) {
+        if (el.getAttribute(attr) !== value) el.setAttribute(attr, value);
+      } else el.removeAttribute(attr);
+    }
+  }
+}

package/src/routes/local-api.ts

@@ -0,0 +1,42 @@
+import type { APIRoute } from "astro";
+import { writeFile, readFile } from "node:fs/promises";
+import path from "node:path";
+import { applyValues } from "./serialize";
+
+export const prerender = false;
+
+export const POST: APIRoute = async ({ request }) => {
+  if (import.meta.env.PROD) {
+    return new Response("Local backend is dev-only", { status: 404 });
+  }
+
+  let body: { slug?: string; values?: Record<string, unknown> };
+  try {
+    body = await request.json();
+  } catch {
+    return new Response("Invalid JSON", { status: 400 });
+  }
+  const slug = String(body.slug ?? "");
+  const values = body.values ?? {};
+  if (!slug) return new Response("Missing slug", { status: 400 });
+
+  const file = path.resolve("src/content/copy", `${slug}.ts`);
+  let source: string;
+  try {
+    source = await readFile(file, "utf8");
+  } catch {
+    return new Response(`No copy module for ${slug}`, { status: 404 });
+  }
+
+  let next: string;
+  try {
+    next = applyValues(source, values);
+  } catch {
+    return new Response(`Could not locate values block in ${slug}.ts`, {
+      status: 422,
+    });
+  }
+
+  await writeFile(file, next, "utf8");
+  return new Response(null, { status: 204 });
+};

package/src/routes/local-documents.ts

@@ -0,0 +1,83 @@
+import type { APIRoute } from "astro";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import config from "virtual:rigel-config";
+import { DocumentStoreError, readDocuments, writeDocument } from "../schema/store";
+import { SchemaError, isPlainObject, validateDocument, validateDocumentId } from "../schema/validate";
+import type { Schema } from "../schema/types";
+
+export const prerender = false;
+
+const MAX_BODY = 1024 * 1024;
+
+function guard(): { schema: Schema; root: string } | Response {
+  if (import.meta.env.PROD || config.backend !== "local" || !config.schema || !config.root)
+    return new Response("Local documents are not enabled", { status: 404 });
+  return { schema: config.schema as Schema, root: fileURLToPath(config.root) };
+}
+
+async function readBody(request: Request): Promise<Record<string, unknown>> {
+  const length = Number(request.headers.get("content-length") ?? "0");
+  if (length > MAX_BODY) throw new DocumentStoreError("Document exceeds the 1 MiB limit", 413);
+  const raw = await request.text();
+  if (Buffer.byteLength(raw) > MAX_BODY) throw new DocumentStoreError("Document exceeds the 1 MiB limit", 413);
+  let body: unknown;
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    throw new DocumentStoreError("Invalid JSON", 400);
+  }
+  if (!isPlainObject(body) || !isPlainObject(body.data)) throw new DocumentStoreError("Body requires a data object", 400);
+  return body.data;
+}
+
+function decodeParam(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
+export const GET: APIRoute = async ({ params }) => {
+  const guarded = guard();
+  if (guarded instanceof Response) return guarded;
+  const id = decodeParam(String(params.id ?? ""));
+  const target = validateDocumentId(guarded.schema, id);
+  if (!target) return new Response("Unknown document", { status: 404 });
+  try {
+    const documents = await readDocuments(guarded.schema, guarded.root);
+    const document = documents.find((entry) => entry.id === id);
+    if (!document) return new Response("Unknown document", { status: 404 });
+    return Response.json(document);
+  } catch (error) {
+    if (error instanceof DocumentStoreError) return new Response(error.message, { status: error.status });
+    return new Response("Could not read document", { status: 500 });
+  }
+};
+
+const handle: APIRoute = async ({ request, params }) => {
+  const guarded = guard();
+  if (guarded instanceof Response) return guarded;
+  if (request.method === "DELETE") return new Response("Documents are created and removed by the site developer", { status: 405, headers: { Allow: "GET, POST, PUT" } });
+  if (request.headers.get("Origin") !== new URL(request.url).origin) return new Response("Same-origin request required", { status: 403 });
+  const id = decodeParam(String(params.id ?? ""));
+  const target = validateDocumentId(guarded.schema, id);
+  if (!target) return new Response("Unknown document type or slug", { status: 400 });
+  try {
+    const data = await readBody(request);
+    const documents = await readDocuments(guarded.schema, guarded.root);
+    const next = { ...data, _id: id, _type: target.type.name, slug: target.slug };
+    validateDocument(guarded.schema, target.type.name, target.slug, next, documents);
+    await writeDocument(guarded.schema, guarded.root, target.type.name, target.slug, next, request.method === "POST" ? "create" : "update");
+    return new Response(null, { status: 204 });
+  } catch (error) {
+    if (error instanceof DocumentStoreError) return new Response(error.message, { status: error.status });
+    if (error instanceof SchemaError) return new Response(error.message, { status: 400 });
+    return new Response("Could not save document", { status: 500 });
+  }
+};
+
+export const POST = handle;
+export const PUT = handle;
+export const DELETE = handle;

package/src/routes/local-media.ts

@@ -0,0 +1,124 @@
+import type { APIRoute } from "astro";
+import { createHash } from "node:crypto";
+import { lstat, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { mediaDirectory, listMedia, loadMediaSidecar, writeMediaSidecar, validateMetaUpdate } from "./media-files";
+import { mediaMetadata, safeMediaName } from "../media-types";
+import { validMediaBytes } from "./media-validation";
+import config from "virtual:rigel-config";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params }) => {
+  const filename = params.filename ?? "";
+  if (import.meta.env.PROD || !safeMediaName(filename) || filename.startsWith(".") || /[/\\\u0000]/.test(filename)) {
+    return new Response("Not found", { status: 404 });
+  }
+  try {
+    const file = path.join(await mediaDirectory(config.publicDir!, config.mediaDir), filename);
+    if (!(await lstat(file)).isFile() || (await lstat(file)).isSymbolicLink()) throw new Error();
+    const bytes = await readFile(file);
+    const metadata = mediaMetadata(filename)!;
+    return new Response(new Uint8Array(bytes), { headers: {
+      "Content-Type": metadata.type,
+      "Content-Disposition": `${metadata.category === "Images" ? "inline" : "attachment"}; filename="${filename}"`,
+      "X-Content-Type-Options": "nosniff",
+    } });
+  } catch {
+    return new Response("Not found", { status: 404 });
+  }
+};
+
+export const POST: APIRoute = async ({ request }) => {
+  if (import.meta.env.PROD) {
+    return new Response("Local backend is dev-only", { status: 404 });
+  }
+  if (request.headers.get("Origin") !== new URL(request.url).origin) {
+    return new Response("Same-origin request required", { status: 403 });
+  }
+  const mime = request.headers.get("Content-Type")?.split(";")[0].trim().toLowerCase();
+  const supplied = request.headers.get("X-Rigel-Filename");
+  const fallback = ({ "image/jpeg": "jpg", "image/png": "png", "image/webp": "webp" } as Record<string, string>)[mime ?? ""];
+  const metadata = supplied ? (safeMediaName(supplied) ? mediaMetadata(supplied) : undefined) : fallback ? mediaMetadata(`image.${fallback}`) : undefined;
+  if (!metadata || metadata.type !== mime) return new Response("Unsupported or mismatched media type/filename", { status: 415 });
+  const limit = 10 * 1024 * 1024;
+  const length = request.headers.get("Content-Length");
+  if (length !== null && !/^\d+$/.test(length)) {
+    return new Response("Invalid Content-Length", { status: 400 });
+  }
+  if (length !== null && Number(length) > limit) {
+    return new Response("Image exceeds 10 MiB", { status: 413 });
+  }
+  if (!request.body) return new Response("Empty image body", { status: 400 });
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  const reader = request.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > limit) {
+        void reader.cancel().catch(() => {});
+        return new Response("Image exceeds 10 MiB", { status: 413 });
+      }
+      chunks.push(value);
+    }
+  } catch {
+    return new Response("Could not read image body", { status: 400 });
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = Buffer.concat(chunks, size);
+  if (!bytes.length) return new Response("Empty image body", { status: 400 });
+  const extension = metadata.extension === "jpeg" ? "jpg" : metadata.extension;
+  if (!validMediaBytes(bytes, extension)) return new Response("Media type does not match its bytes", { status: 415 });
+  const filename = `${createHash("sha256").update(bytes).digest("hex")}.${extension}`;
+  let url = "";
+  try {
+    const directory = await mediaDirectory(config.publicDir!, config.mediaDir, true);
+    const existing = await lstat(path.join(directory, filename)).catch(error => { if (error.code !== "ENOENT") throw error; });
+    if (existing && (!existing.isFile() || existing.isSymbolicLink())) throw new Error();
+    try {
+      await writeFile(path.join(directory, filename), bytes, { flag: "wx" });
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+    }
+    url = `/${(config.mediaDir ?? "rigel-media").split("/").map(encodeURIComponent).join("/")}/${filename}`;
+    const author = (request.headers.get("X-Rigel-Author") ?? "").trim().replace(/[\u0000-\u001f\u007f]/g, "").slice(0, 80);
+    if (author) {
+      const record = await loadMediaSidecar(directory);
+      record[url] = { ...(record[url] ?? {}), author };
+      await writeMediaSidecar(directory, record);
+    }
+  } catch {
+    return new Response("Could not save image", { status: 500 });
+  }
+  return Response.json({ url });
+  };
+
+  export const PUT: APIRoute = async ({ request }) => {
+    if (import.meta.env.PROD) {
+      return new Response("Local backend is dev-only", { status: 404 });
+    }
+    if (request.headers.get("Origin") !== new URL(request.url).origin) {
+      return new Response("Same-origin request required", { status: 403 });
+    }
+    let body: unknown;
+    try { body = await request.json(); } catch { return new Response("Invalid JSON body", { status: 400 }); }
+    let directory: string;
+    try { directory = await mediaDirectory(config.publicDir!, config.mediaDir, true); }
+    catch { return new Response("Media directory unavailable", { status: 500 }); }
+    const assets = await listMedia(config.publicDir!, config.mediaDir);
+    const valid = validateMetaUpdate(body, new Set(assets.map(asset => asset.url)));
+    if (!valid.ok) return new Response(valid.error, { status: 400 });
+    const record = await loadMediaSidecar(directory);
+    const patch: { name?: string; title?: string; description?: string; alt?: string } = {};
+    if (valid.value.name !== undefined) patch.name = valid.value.name;
+    if (valid.value.title !== undefined) patch.title = valid.value.title;
+    if (valid.value.description !== undefined) patch.description = valid.value.description;
+    if (valid.value.alt !== undefined) patch.alt = valid.value.alt;
+    record[valid.value.url] = { ...(record[valid.value.url] ?? {}), ...patch };
+    await writeMediaSidecar(directory, record);
+    return Response.json((await listMedia(config.publicDir!, config.mediaDir)).find(asset => asset.url === valid.value.url) ?? { url: valid.value.url });
+  };

package/src/routes/local-menu.ts

@@ -0,0 +1,81 @@
+import type { APIRoute } from "astro";
+import { constants } from "node:fs";
+import { lstat, open, realpath, rename, unlink } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { randomUUID } from "node:crypto";
+import { parseConfig } from "../config";
+import { MENU_SLUG, validateMenu, type MenuDocument } from "../manifest/menu";
+import config from "virtual:rigel-config";
+
+export const prerender = false;
+
+async function menuFile(slug: string): Promise<string> {
+  const menus = parseConfig({ menus: config.menus }).menus!;
+  if (!config.root) throw new Error("Missing site root");
+  let directory = await realpath(fileURLToPath(config.root));
+  for (const part of menus.folder.split("/")) {
+    directory = path.join(directory, part);
+    const info = await lstat(directory);
+    if (info.isSymbolicLink() || !info.isDirectory())
+      throw new Error("Menu folder must contain only real directories");
+  }
+  const file = path.join(directory, `${slug}.json`);
+  const info = await lstat(file);
+  if (info.isSymbolicLink() || !info.isFile()) throw new Error("Menu must be a regular file");
+  return file;
+}
+
+const handle: APIRoute = async ({ request, params }) => {
+  if (import.meta.env.PROD || config.backend !== "local" || !config.menus)
+    return new Response("Local menus are not enabled", { status: 404 });
+  const slug = params.slug ?? "";
+  if (!MENU_SLUG.test(slug)) return new Response("Invalid menu slug", { status: 400 });
+  const method = request.method;
+  if (method !== "GET" && method !== "PUT")
+    return new Response("Menus are declared by the site developer. Only existing menus can be edited.", { status: 405, headers: { Allow: "GET, PUT" } });
+  if (method !== "GET" && request.headers.get("Origin") !== new URL(request.url).origin)
+    return new Response("Same-origin request required", { status: 403 });
+  let menu: MenuDocument | undefined;
+  if (method === "PUT") {
+    try {
+      menu = validateMenu(await request.json(), config.menus.maxDepth ?? 3);
+      if (menu.slug !== slug) throw new Error("Menu slug must match the request slug");
+    } catch (error) {
+      return new Response(error instanceof SyntaxError ? "Invalid JSON" : (error as Error).message, { status: 400 });
+    }
+  }
+  let temporary: string | undefined;
+  try {
+    const file = await menuFile(slug);
+    if (method === "GET") {
+      const input = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+      try {
+        const result = validateMenu(JSON.parse(await input.readFile("utf8")), config.menus.maxDepth ?? 3);
+        if (result.slug !== slug) throw new Error("Stored menu slug does not match filename");
+        return Response.json(result);
+      } finally { await input.close(); }
+    }
+
+    temporary = path.join(path.dirname(file), `.${slug}-${randomUUID()}.tmp`);
+    const output = await open(temporary, "wx", 0o600);
+    try {
+      await output.writeFile(JSON.stringify(menu, null, 2) + "\n", "utf8");
+      await output.sync();
+    } finally { await output.close(); }
+    await menuFile(slug);
+    await rename(temporary, file);
+    return new Response(null, { status: 204 });
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === "ENOENT") return new Response("No such menu", { status: 404 });
+    return new Response("Could not access menu: invalid stored data or unsafe/unavailable storage", { status: 500 });
+  } finally {
+    if (temporary) await unlink(temporary).catch(() => {});
+  }
+};
+
+export const GET = handle;
+export const POST = handle;
+export const PUT = handle;
+export const DELETE = handle;

package/src/routes/local-post.ts

@@ -0,0 +1,80 @@
+import type { APIRoute } from "astro";
+import { writeFile, mkdir, rm, readFile, rename } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+
+import { validateBody, type ArticleBody } from "../article-body";
+import config from "virtual:rigel-config";
+import { validateCollectionReferences } from "../manifest/references";
+import { readDocuments } from "../schema/store";
+import { fileURLToPath } from "node:url";
+import type { CollectionConfig } from "../config";
+
+export const prerender = false;
+
+function collectionFolder(name: string): string | null {
+  const col = (config.collections ?? []).find(
+    (c: { name: string }) => c.name === name,
+  );
+  return col ? col.folder : null;
+}
+
+function safeSlug(slug: string): string | null {
+  return /^[a-z0-9][a-z0-9_-]*$/.test(slug) ? slug : null;
+}
+
+export const POST: APIRoute = async ({ request, params }) => {
+  if (import.meta.env.PROD) {
+    return new Response("Local backend is dev-only", { status: 404 });
+  }
+  const folder = collectionFolder(String(params.collection ?? ""));
+  const slug = safeSlug(String(params.slug ?? ""));
+  if (!folder || !slug) {
+    return new Response("Unknown collection/slug", { status: 404 });
+  }
+
+  let body: { frontmatter: Record<string, unknown>; body: ArticleBody };
+  try {
+    body = await request.json();
+    if (!body || typeof body !== "object" || !body.frontmatter || typeof body.frontmatter !== "object" || Array.isArray(body.frontmatter)) throw new Error("Invalid article");
+  } catch {
+    return new Response("Invalid JSON", { status: 400 });
+  }
+
+  const file = path.resolve(folder, `${slug}.json`);
+  try {
+    validateBody(body.body);
+    const fields = config.collections?.find((collection: CollectionConfig) => collection.name === params.collection)?.fields ?? [];
+    const documents = config.schema && config.root ? await readDocuments(config.schema, fileURLToPath(config.root)) : [];
+    validateCollectionReferences(fields, body.frontmatter, documents);
+  } catch (error) {
+    return new Response(error instanceof Error ? error.message : "Invalid references", { status: 400 });
+  }
+  await mkdir(path.dirname(file), { recursive: true });
+  const fm = { ...body.frontmatter, slug };
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, JSON.stringify({ frontmatter: fm, body: body.body }, null, 2) + "\n", { flag: "wx" });
+    await rename(temporary, file);
+  } finally { await rm(temporary, { force: true }); }
+  return new Response(null, { status: 204 });
+};
+
+export const DELETE: APIRoute = async ({ params }) => {
+  if (import.meta.env.PROD) {
+    return new Response("Local backend is dev-only", { status: 404 });
+  }
+  const folder = collectionFolder(String(params.collection ?? ""));
+  const slug = safeSlug(String(params.slug ?? ""));
+  if (!folder || !slug) {
+    return new Response("Unknown collection/slug", { status: 404 });
+  }
+  const file = path.resolve(folder, `${slug}.json`);
+  try {
+    await readFile(file); // only delete existing files
+  } catch {
+    return new Response("No such post", { status: 404 });
+  }
+  await rm(file);
+  return new Response(null, { status: 204 });
+};

package/src/routes/manifest.json.ts

@@ -0,0 +1,15 @@
+import type { APIRoute } from "astro";
+import manifest from "virtual:rigel-manifest";
+
+export const GET: APIRoute = async () => {
+  const editorManifest = manifest.backend === "github" ? {
+    ...manifest,
+    pages: manifest.pages.map(page => ({ ...page, values: {} })),
+    collections: manifest.collections?.map(collection => ({ ...collection, posts: [] })),
+    documents: [],
+    ...(manifest.menus ? { menus: { ...manifest.menus, entries: [] } } : {}),
+  } : manifest;
+  return new Response(JSON.stringify(editorManifest), {
+    headers: { "Content-Type": "application/json" },
+  });
+};