@setzkasten-cms/astro-admin 1.4.6 → 1.5.0

package/dist/api-routes/setup-github-app-credentials.js

@@ -0,0 +1,43 @@
+import {
+  requireAdmin
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
+import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
+import "../chunk-5PIMDP4N.js";
+import "../chunk-45ARVNT3.js";
+import "../chunk-DP6RTINQ.js";
+import "../chunk-TJNJKPUL.js";
+import "../chunk-KH22FJO5.js";
+
+// src/api-routes/setup-github-app-credentials.ts
+var COOKIE_NAME = "sk_app_setup";
+var GET = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
+  const raw = cookies.get(COOKIE_NAME)?.value;
+  if (!raw) {
+    return Response.json({ available: false }, { status: 404 });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return Response.json({ available: false, error: "malformed" }, { status: 500 });
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return Response.json({ available: false }, { status: 404 });
+  }
+  return Response.json({ available: true, credentials: parsed });
+};
+var DELETE = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
+  cookies.delete(COOKIE_NAME, { path: "/" });
+  return Response.json({ ok: true });
+};
+export {
+  DELETE,
+  GET
+};

package/dist/api-routes/setup-github-app-installed.js

@@ -1,11 +1,25 @@
 import {
   getPublicOrigin
 } from "../chunk-5ZFTG4BW.js";
+import {
+  requireAdmin
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
+import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
+import "../chunk-5PIMDP4N.js";
+import "../chunk-45ARVNT3.js";
+import "../chunk-DP6RTINQ.js";
+import "../chunk-TJNJKPUL.js";
+import "../chunk-KH22FJO5.js";
 
 // src/api-routes/setup-github-app-installed.ts
 var COOKIE_NAME = "sk_app_setup";
 var COOKIE_MAX_AGE = 600;
 var GET = async ({ url, request, cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
   const config = globalThis.__SETZKASTEN_CONFIG__;
   const adminPath = config?.adminPath ?? "/admin";
   const adminUrl = new URL(adminPath, getPublicOrigin(request));
@@ -20,7 +34,14 @@ var GET = async ({ url, request, cookies }) => {
     cookies.set(
       COOKIE_NAME,
       JSON.stringify({ ...data, installationId }),
-      { httpOnly: false, sameSite: "lax", maxAge: COOKIE_MAX_AGE, path: "/" }
+      // C6: same httpOnly hardening as the callback route.
+      {
+        httpOnly: true,
+        secure: import.meta.env.PROD,
+        sameSite: "lax",
+        maxAge: COOKIE_MAX_AGE,
+        path: "/"
+      }
     );
   } catch {
     adminUrl.searchParams.set("github-app-error", "invalid_session");

package/dist/api-routes/setup-github-app-repos.js

@@ -1,10 +1,13 @@
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
-import "../chunk-NKDATSPA.js";
+import "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 

package/dist/api-routes/setup-github-app.d.ts

@@ -8,6 +8,10 @@ import { APIRoute } from 'astro';
  *
  * Credentials werden NICHT persistiert – der Nutzer setzt die env vars manuell.
  * Der POST-Endpunkt validiert die Verbindung durch einen echten Token-Request.
+ *
+ * Both methods are admin-only. Pre-fix the GET let any unauthenticated
+ * visitor probe whether a deployment was configured (reconnaissance for
+ * targeting half-set-up instances).
  */
 declare const GET: APIRoute;
 declare const POST: APIRoute;

package/dist/api-routes/setup-github-app.js

@@ -1,13 +1,30 @@
+import {
+  requireAdmin
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
+import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
+import "../chunk-5PIMDP4N.js";
+import "../chunk-45ARVNT3.js";
+import "../chunk-DP6RTINQ.js";
+import "../chunk-TJNJKPUL.js";
+import "../chunk-KH22FJO5.js";
+
 // src/api-routes/setup-github-app.ts
 import { GitHubAppClient } from "@setzkasten-cms/github-adapter";
-var GET = async () => {
+var GET = async ({ cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
   const appId = process.env.GITHUB_APP_ID;
   const privateKey = process.env.GITHUB_APP_PRIVATE_KEY;
   const installationId = process.env.GITHUB_APP_INSTALLATION_ID;
   const configured = Boolean(appId && privateKey && installationId);
   return Response.json({ configured, ...configured ? { appId } : {} });
 };
-var POST = async ({ request }) => {
+var POST = async ({ request, cookies }) => {
+  const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
+  if (denied) return denied;
   let body;
   try {
     body = await request.json();

package/dist/api-routes/updater-register.js

@@ -1,3 +1,7 @@
+import {
+  listAllWebsites
+} from "../chunk-V6IMPVF3.js";
+
 // src/api-routes/updater-register.ts
 var POST = async ({ cookies, request }) => {
   const session = cookies.get("setzkasten_session")?.value;
@@ -34,6 +38,8 @@ var POST = async ({ cookies, request }) => {
     }
   } catch {
   }
+  const websitesResult = await listAllWebsites();
+  const managedWebsites = websitesResult.ok ? websitesResult.value.map((w) => w.id) : [];
   try {
     const response = await fetch(`${updaterUrl}/api/register`, {
       method: "POST",
@@ -45,7 +51,7 @@ var POST = async ({ cookies, request }) => {
         licenseEmail,
         licenseKey,
         telemetryEnabled: true,
-        managedWebsites: []
+        managedWebsites
       }),
       signal: AbortSignal.timeout(5e3)
     });

package/dist/api-routes/webhooks-status.js

@@ -3,11 +3,14 @@ import {
 } from "../chunk-W3QHY5GW.js";
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
-import "../chunk-NKDATSPA.js";
+import "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 

package/dist/api-routes/webhooks-test.js

@@ -1,30 +1,31 @@
-import {
-  signPayload
-} from "../chunk-737TIZRU.js";
 import {
   recordWebhookFire
 } from "../chunk-W3QHY5GW.js";
+import {
+  signPayload
+} from "../chunk-737TIZRU.js";
 import {
   parseSession,
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import {
   resolveStorageConfigForRequest
 } from "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import {
   gateFeature
 } from "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
 import {
   resolveGitHubTokenForRequest
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 
 // src/api-routes/webhooks-test.ts
-import {
-  parseWebhooksFile
-} from "@setzkasten-cms/core";
+import { parseWebhooksFile } from "@setzkasten-cms/core";
 var WEBHOOKS_FILE = (contentPath) => `${contentPath}/_webhooks.json`;
 var TEST_TIMEOUT_MS = 1e4;
 var POST = async ({ request, cookies }) => {

package/dist/api-routes/webhooks.js

@@ -1,10 +1,13 @@
 import {
   parseSession,
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import {
   resolveStorageConfigForRequest
 } from "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import {
   gateFeature
 } from "../chunk-5PIMDP4N.js";
@@ -14,17 +17,14 @@ import {
 } from "../chunk-45ARVNT3.js";
 import {
   resolveGitHubTokenForRequest
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import {
   withTrailers
 } from "../chunk-KH22FJO5.js";
 
 // src/api-routes/webhooks.ts
-import {
-  parseWebhooksFile,
-  validateWebhookConfig
-} from "@setzkasten-cms/core";
+import { parseWebhooksFile, validateWebhookConfig } from "@setzkasten-cms/core";
 var WEBHOOKS_FILE = (contentPath) => `${contentPath}/_webhooks.json`;
 var GET = async ({ request, cookies }) => {
   const denied = requireAdmin(cookies.get("setzkasten_session")?.value);
@@ -82,10 +82,7 @@ var PUT = async ({ request, cookies }) => {
   for (let i = 0; i < body.webhooks.length; i++) {
     const result = validateWebhookConfig(body.webhooks[i]);
     if (!result.ok) {
-      return Response.json(
-        { error: result.error.message, index: i },
-        { status: 400 }
-      );
+      return Response.json({ error: result.error.message, index: i }, { status: 400 });
     }
     if (seenIds.has(result.value.id)) {
       return Response.json(
@@ -127,10 +124,11 @@ var PUT = async ({ request, cookies }) => {
     branch
   };
   if (currentSha) putBody.sha = currentSha;
-  const putRes = await fetch(
-    `https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`,
-    { method: "PUT", headers, body: JSON.stringify(putBody) }
-  );
+  const putRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/contents/${filePath}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(putBody)
+  });
   if (!putRes.ok) {
     const text = await putRes.text();
     return Response.json({ error: `Webhook write failed: ${text}` }, { status: 502 });

package/dist/api-routes/websites-add.js

@@ -5,13 +5,16 @@ import {
 } from "../chunk-35S35OIV.js";
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
 import {
   resolveConfigRepoToken
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import {
   resolveLicenseTier
 } from "../chunk-TJNJKPUL.js";

package/dist/api-routes/websites-remove.js

@@ -5,13 +5,16 @@ import {
 } from "../chunk-35S35OIV.js";
 import {
   requireAdmin
-} from "../chunk-INIWFKQ3.js";
+} from "../chunk-Q5HV47DW.js";
+import "../chunk-QVCW6EF3.js";
+import "../chunk-KENFINT4.js";
 import "../chunk-6UIKVKED.js";
+import "../chunk-ONP6BRZO.js";
 import "../chunk-5PIMDP4N.js";
 import "../chunk-45ARVNT3.js";
 import {
   resolveConfigRepoToken
-} from "../chunk-NKDATSPA.js";
+} from "../chunk-DP6RTINQ.js";
 import "../chunk-TJNJKPUL.js";
 import "../chunk-KH22FJO5.js";
 

package/dist/{chunk-ZQDGGWJP.js → chunk-5KMGSFCZ.js}

@@ -1,12 +1,12 @@
 import {
   readEditorsFileStatus
-} from "./chunk-INIWFKQ3.js";
+} from "./chunk-Q5HV47DW.js";
 import {
   resolveStorageConfig
 } from "./chunk-6UIKVKED.js";
 import {
   resolveConfigRepoToken
-} from "./chunk-NKDATSPA.js";
+} from "./chunk-DP6RTINQ.js";
 
 // src/api-routes/_role-resolver.ts
 import { resolveRoleForUser } from "@setzkasten-cms/core";

package/dist/{chunk-Q3N336KR.js → chunk-CDXCYYQR.js}

@@ -9,7 +9,8 @@ function findNormalizedText(haystack, needle, startFrom) {
   const escaped = normalized.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/ /g, "\\s+");
   const regex = new RegExp(escaped);
   const match = regex.exec(haystack.slice(startFrom));
-  if (match) return { start: startFrom + match.index, end: startFrom + match.index + match[0].length };
+  if (match)
+    return { start: startFrom + match.index, end: startFrom + match.index + match[0].length };
   return null;
 }
 async function patchTemplateForFields(source, sectionKey, fields, repeatedGroups = [], options) {
@@ -64,7 +65,13 @@ const { data: ${varName} } = Astro.props
         }
       }
     }
-    const patched2 = await patchTemplateForFields(modifiedSource, sectionKey, fields, repeatedGroups, options);
+    const patched2 = await patchTemplateForFields(
+      modifiedSource,
+      sectionKey,
+      fields,
+      repeatedGroups,
+      options
+    );
     return removeOldVarDeclarations(patched2, fields, repeatedGroups, varName);
   }
   const existingBindings = /* @__PURE__ */ new Set();
@@ -579,7 +586,7 @@ function patchArrayField(source, sectionKey, field, varName, mapExpressions, edi
       insert: `(${varName}?.${field.key} ?? [])`
     });
   } else {
-    const varMapRegex = new RegExp(`(\\w+)\\.map\\s*\\(`);
+    const varMapRegex = /(\w+)\.map\s*\(/;
     const varMapMatch = exprSource.match(varMapRegex);
     if (varMapMatch) {
       const varRef = varMapMatch[1];
@@ -802,7 +809,7 @@ function collectDynamicClassEdits(innerEdits, source, instances, tmpl, group) {
     if (!tmplPos) continue;
     const fieldTag = field.tag;
     let bestAttrIdx = -1;
-    let bestDist = Infinity;
+    let bestDist = Number.POSITIVE_INFINITY;
     for (let ai = 0; ai < tmplAttrs.length; ai++) {
       const pathParts = tmplAttrs[ai].path.split("/");
       const leafTag = (pathParts[pathParts.length - 1] ?? "").replace(/:\d+$/, "");
@@ -1091,7 +1098,7 @@ ${indent}))}`;
     for (let i = instances.length - 1; i >= 1; i--) {
       const inst = instances[i];
       let deleteStart = inst.start;
-      let deleteEnd = inst.end;
+      const deleteEnd = inst.end;
       while (deleteStart > 0 && /\s/.test(source[deleteStart - 1]) && source[deleteStart - 1] !== "\n") {
         deleteStart--;
       }
@@ -1351,7 +1358,8 @@ function removeOldVarDeclarations(source, fields, repeatedGroups, cmsVarName = "
   return source.slice(0, fmStart + 4) + frontmatter + source.slice(fmEnd);
 }
 function patchChildComponentForFieldPrefix(source, innerFields) {
-  if (source.includes("fieldPrefix?: string") || source.includes("fieldPrefix?:string")) return source;
+  if (source.includes("fieldPrefix?: string") || source.includes("fieldPrefix?:string"))
+    return source;
   const fmStart = source.indexOf("---");
   const fmEnd = source.indexOf("---", fmStart + 3);
   if (fmStart === -1 || fmEnd === -1) return source;
@@ -1365,15 +1373,12 @@ function patchChildComponentForFieldPrefix(source, innerFields) {
     const closeFm = result.indexOf("---", result.indexOf("---") + 3);
     result = result.slice(0, closeFm) + "interface Props { fieldPrefix?: string }\n" + result.slice(closeFm);
   }
-  result = result.replace(
-    /(\bconst\s*\{[^}]*)(}\s*=\s*Astro\.props)/,
-    (_m, before, after) => {
-      if (before.includes("fieldPrefix")) return _m;
-      const trimmed = before.trimEnd();
-      const sep = trimmed.endsWith(",") ? " " : ",\n  ";
-      return `${trimmed}${sep}fieldPrefix${after}`;
-    }
-  );
+  result = result.replace(/(\bconst\s*\{[^}]*)(}\s*=\s*Astro\.props)/, (_m, before, after) => {
+    if (before.includes("fieldPrefix")) return _m;
+    const trimmed = before.trimEnd();
+    const sep = trimmed.endsWith(",") ? " " : ",\n  ";
+    return `${trimmed}${sep}fieldPrefix${after}`;
+  });
   const closingFm = result.indexOf("---", result.indexOf("---") + 3);
   const frontmatterPart = result.slice(0, closingFm + 3);
   let templatePart = result.slice(closingFm + 3);
@@ -1399,10 +1404,7 @@ function patchChildComponentForFieldPrefix(source, innerFields) {
     });
   }
   for (const field of arrayFields) {
-    const mapParamRegex = new RegExp(
-      `(${field.key}\\.map\\s*\\(\\s*\\(\\s*)(\\w+)(\\s*\\))`,
-      "g"
-    );
+    const mapParamRegex = new RegExp(`(${field.key}\\.map\\s*\\(\\s*\\(\\s*)(\\w+)(\\s*\\))`, "g");
     templatePart = templatePart.replace(
       new RegExp(`(<(?:ul|ol)[^>]*?)(\\/?>)([\\s\\S]*?${field.key}\\.map)`, "g"),
       (_m, ulOpen, ulClose, rest) => {
@@ -1419,11 +1421,14 @@ function patchChildComponentForFieldPrefix(source, innerFields) {
       `(${field.key}\\.map\\s*\\([^)]*\\)\\s*=>\\s*\\([\\s\\S]*?)(<(?:span|li|td)\\b)([^>]*?>)([^<]*\\{\\w+\\})`,
       "g"
     );
-    templatePart = templatePart.replace(mapBlockRegex, (_m, mapHead, tagOpen, tagClose, content) => {
-      if (tagClose.includes("data-sk-field")) return _m;
-      const attr = ` data-sk-field={fieldPrefix ? \`\${fieldPrefix}.${field.key}.\${_fi}\` : undefined}`;
-      return `${mapHead}${tagOpen}${tagClose.slice(0, -1)}${attr}>${content}`;
-    });
+    templatePart = templatePart.replace(
+      mapBlockRegex,
+      (_m, mapHead, tagOpen, tagClose, content) => {
+        if (tagClose.includes("data-sk-field")) return _m;
+        const attr = ` data-sk-field={fieldPrefix ? \`\${fieldPrefix}.${field.key}.\${_fi}\` : undefined}`;
+        return `${mapHead}${tagOpen}${tagClose.slice(0, -1)}${attr}>${content}`;
+      }
+    );
   }
   return frontmatterPart + templatePart;
 }

package/dist/{chunk-NKDATSPA.js → chunk-DP6RTINQ.js}

@@ -1,5 +1,5 @@
 // src/api-routes/_github-token.ts
-import { err, authError } from "@setzkasten-cms/core";
+import { authError, err } from "@setzkasten-cms/core";
 import { GitHubAppClient } from "@setzkasten-cms/github-adapter";
 async function resolveConfigRepoToken() {
   const appId = process.env.GITHUB_APP_ID;

package/dist/chunk-KENFINT4.js

@@ -0,0 +1,76 @@
+// src/api-routes/_session-signing.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SEPARATOR = ".";
+function base64urlEncode(input) {
+  const buf = typeof input === "string" ? Buffer.from(input, "utf-8") : input;
+  return buf.toString("base64url");
+}
+function base64urlDecode(input) {
+  if (!/^[A-Za-z0-9_-]+$/.test(input)) return null;
+  try {
+    return Buffer.from(input, "base64url");
+  } catch {
+    return null;
+  }
+}
+function hmac(payload, secret) {
+  return createHmac("sha256", secret).update(payload).digest();
+}
+function signSession(session, secret) {
+  if (typeof secret !== "string" || secret.trim().length === 0) {
+    throw new Error("signSession: missing secret");
+  }
+  const json = JSON.stringify(session);
+  const payloadB64 = base64urlEncode(json);
+  const sigB64 = hmac(payloadB64, secret).toString("base64url");
+  return `${payloadB64}${SEPARATOR}${sigB64}`;
+}
+function verifySessionCookie(raw, secret, now = Date.now()) {
+  if (typeof raw !== "string" || raw.length === 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  if (typeof secret !== "string" || secret.trim().length === 0) {
+    return { ok: false, reason: "malformed" };
+  }
+  const segments = raw.split(SEPARATOR);
+  if (segments.length !== 2) return { ok: false, reason: "malformed" };
+  const [payloadB64, sigB64] = segments;
+  if (!payloadB64 || !sigB64) return { ok: false, reason: "malformed" };
+  const expected = hmac(payloadB64, secret);
+  const actual = base64urlDecode(sigB64);
+  if (!actual) return { ok: false, reason: "malformed" };
+  if (actual.length !== expected.length) return { ok: false, reason: "bad-signature" };
+  if (!timingSafeEqual(actual, expected)) return { ok: false, reason: "bad-signature" };
+  const payloadBuf = base64urlDecode(payloadB64);
+  if (!payloadBuf) return { ok: false, reason: "malformed" };
+  let parsed;
+  try {
+    parsed = JSON.parse(payloadBuf.toString("utf-8"));
+  } catch {
+    return { ok: false, reason: "invalid-payload" };
+  }
+  if (!isAuthSessionShape(parsed)) {
+    return { ok: false, reason: "invalid-payload" };
+  }
+  if (typeof parsed.expiresAt !== "number" || !Number.isFinite(parsed.expiresAt)) {
+    return { ok: false, reason: "missing-expiry" };
+  }
+  if (parsed.expiresAt <= now) {
+    return { ok: false, reason: "expired" };
+  }
+  return { ok: true, value: parsed };
+}
+function isAuthSessionShape(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  if (!v.user || typeof v.user !== "object") return false;
+  const u = v.user;
+  if (typeof u.email !== "string" || u.email.length === 0) return false;
+  if (u.role !== "admin" && u.role !== "editor") return false;
+  return true;
+}
+
+export {
+  signSession,
+  verifySessionCookie
+};

package/dist/chunk-ONP6BRZO.js

@@ -0,0 +1,47 @@
+// src/api-routes/_dev-session-secret.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+var DEV_SECRET_DIR = ".setzkasten";
+var DEV_SECRET_FILE = "dev-secret";
+var cachedSecret = null;
+function ensureDevSessionSecret() {
+  if (cachedSecret) return cachedSecret;
+  const dir = join(process.cwd(), DEV_SECRET_DIR);
+  const file = join(dir, DEV_SECRET_FILE);
+  if (existsSync(file)) {
+    const content = readFileSync(file, "utf-8").trim();
+    if (content.length >= 32) {
+      cachedSecret = content;
+      return content;
+    }
+  }
+  mkdirSync(dir, { recursive: true });
+  const fresh = randomBytes(32).toString("hex");
+  try {
+    writeFileSync(file, `${fresh}
+`, { flag: "wx", mode: 384 });
+  } catch (cause) {
+    if (cause?.code === "EEXIST") {
+      const content = readFileSync(file, "utf-8").trim();
+      if (content.length >= 32) {
+        cachedSecret = content;
+        return content;
+      }
+    }
+    throw cause;
+  }
+  console.warn(
+    `[setzkasten] Generated dev session secret at ${file} (mode 0600). Set SETZKASTEN_SESSION_SECRET in production. Delete the file to rotate.`
+  );
+  cachedSecret = fresh;
+  return fresh;
+}
+function __setDevSessionSecretForTests(secret) {
+  cachedSecret = secret;
+}
+
+export {
+  ensureDevSessionSecret,
+  __setDevSessionSecretForTests
+};