@strifeapp/astro 1.0.30-beta.0 → 1.3.0

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026 Strife
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -1,86 +1,179 @@
 # @strifeapp/astro
 
-## ⚠️ Important Notes
+[![npm version](https://img.shields.io/npm/v/@strifeapp/astro.svg)](https://www.npmjs.com/package/@strifeapp/astro)
 
-2. **indexMapping.js**: This file should NOT be converted to TypeScript as it runs inside RavenDB's JavaScript indexing engine. Keep it as plain JavaScript.
+Official [Strife](https://strife.app) integration for [Astro](https://astro.build). It connects your Astro site to a Strife (RavenDB-backed) content store and exposes an initialized document store to your pages through a `strife:store` virtual module — resolved at runtime, so the same build runs against any environment and secrets are never baked into the bundle.
 
-3. **Module References**: The vite plugin reads `indexMapping.js` at build time using `readFileSync`, so make sure the path resolution in `vite-plugin-strife-store.ts` is correct for your build setup.
+## Contents
 
-## Structure
+- [Installation](#installation)
+- [Requirements](#requirements)
+- [Usage](#usage)
+  - [Reading content](#reading-content)
+  - [TypeScript: typing `strife:store`](#typescript-typing-strifestore)
+  - [Direct Vite plugin](#direct-vite-plugin)
+- [Configuration](#configuration)
+  - [Environment variables](#environment-variables)
+  - [Generating `STRIFE_SECRET`](#generating-strife_secret)
+  - [Platform size limits](#platform-size-limits)
+- [How it works](#how-it-works)
+- [License](#license)
 
-```
-src/
-├── index.ts                           # Main Astro integration export
-├── vite-plugin-strife-store.ts        # Vite plugin for virtual module
-├── vite-plugin-strife-store-entry.ts  # Entry point for standalone plugin export
-├── env.ts                              # Environment variable loader
-├── indexMapping.js                     # RavenDB index mapping functions (JavaScript!)
-└── services/
-    └── ImageService.ts                 # Image service (needs implementation)
+## Installation
+
+```bash
+npx astro add @strifeapp/astro
 ```
 
-## Building
+Or install manually and add the integration to your config yourself:
 
 ```bash
-npm install
-npm run build
+npm install @strifeapp/astro
 ```
 
-This will compile TypeScript and generate type definitions in the `dist/` folder.
+## Requirements
 
-## Environment Variables
+- **Astro 5 or 6** — `astro` is a peer dependency (`^5.0.0 || ^6.0.0`). Astro 5+ is required because the integration uses [`astro:env`](https://docs.astro.build/en/guides/environment-variables/) for runtime-safe secret resolution.
+- **Node 22.12+**.
+- A **Strife / RavenDB content store** and a **client certificate** registered with it (PFX, any key type — RSA or ECDSA).
 
-Required environment variables:
-
-- `STRIFE_DATABASE_URLS` - Comma-separated list of RavenDB URLs
-- `STRIFE_DATABASE` - Database name
-- `STRIFE_CERTIFICATE` - Base64-encoded PFX certificate (optional for development)
-- `STRIFE_CERTIFICATE_PASSWORD` - Certificate password (optional for development)
+`ravendb` is installed as a dependency; you do not need to install it yourself.
 
 ## Usage
 
-In your Astro project:
+Register the integration in your Astro config:
 
 ```typescript
 import { defineConfig } from 'astro/config';
-import strifeIntegration from '@strifeapp/astro';
+import strife from '@strifeapp/astro';
 
 export default defineConfig({
   integrations: [
-    strifeIntegration({
-      // Optional: Override environment variables
-      urls: ['https://your-ravendb.com'],
+    strife({
+      // All fields are optional; environment variables take precedence (see Configuration).
+      urls: ['https://your-ravendb.example.com'],
       database: 'your-database',
-      collections: [
-        { name: 'Posts' },
-        { name: 'Pages' },
-      ],
+      collections: [{ name: 'Posts' }, { name: 'Pages' }],
     }),
   ],
 });
 ```
 
-## What This Integration Does
+### Reading content
+
+Read from the store anywhere in your site through the `strife:store` virtual module:
+
+```typescript
+---
+import { store } from 'strife:store';
+
+const session = store.openSession();
+// The integration deploys a `Content/ByUrl` index for URL-based lookups.
+const page = await session
+  .query({ indexName: 'Content/ByUrl' })
+  .whereEquals('url', Astro.url.pathname)
+  .firstOrNull();
+---
+```
+
+### TypeScript: typing `strife:store`
+
+Typed ambient declarations for the `strife:store` virtual module are not bundled in this release. Until a typed surface is published, add your own declaration (e.g. in `src/env.d.ts`):
+
+```typescript
+declare module 'strife:store' {
+  import type { DocumentStore } from 'ravendb';
+  export const store: DocumentStore;
+}
+```
+
+### Direct Vite plugin
+
+The underlying Vite plugin is also exported standalone:
+
+```typescript
+import { vitePluginStrifeStore } from '@strifeapp/astro/vite-plugin-strife-store';
+```
+
+## Configuration
+
+`strife(options?)` accepts:
+
+| Option | Type | Description |
+| --- | --- | --- |
+| `urls` | `string[]` | RavenDB server URLs. |
+| `database` | `string` | Database name. |
+| `collections` | `{ name: string }[]` | Collections to index (default: `Posts`). |
+
+> **Credentials are not build-time options.** `certificate` and `password` are **not** accepted as integration options — passing them would bake the secret into the built bundle. Provide them at runtime via `STRIFE_SECRET` or the `STRIFE_CERTIFICATE` / `STRIFE_CERTIFICATE_PASSWORD` env vars (below). The integration strips any `certificate`/`password` it receives as options before generating the store module.
+
+### Environment variables
+
+The integration registers `STRIFE_*` as [`astro:env`](https://docs.astro.build/en/guides/environment-variables/) **server secret** variables, so you do not need `import 'dotenv/config'` or any other loader — just set them:
+
+| Variable | Maps to |
+| --- | --- |
+| `STRIFE_SECRET` | All of the below, packed into one value (see [Generating `STRIFE_SECRET`](#generating-strife_secret)) |
+| `STRIFE_DATABASE_URLS` | `urls` (comma-separated) |
+| `STRIFE_DATABASE` | `database` |
+| `STRIFE_CERTIFICATE` | base64-encoded PFX (optional in development) |
+| `STRIFE_CERTIFICATE_PASSWORD` | certificate password |
+
+Set them in a local `.env` for development, or in your host's environment (Vercel project settings, Kubernetes secrets, etc.) for deployment. Because they are `astro:env` server secrets, they are **read at runtime via `getSecret` and never inlined into the built bundle**.
+
+`STRIFE_SECRET` is a single, compact value that bundles the URLs, database, certificate, and password — convenient when one secret is easier to manage than four. It is **additive**: when set, each field it carries takes priority; when unset, the four individual variables work exactly as before.
+
+**Resolution order, per field:** `STRIFE_SECRET` → individual `STRIFE_*` env var → non-secret integration option (`urls`/`database` only) → built-in default.
+
+> Reading via `astro:env` (rather than `process.env`) is deliberate: in `astro dev`, Astro does **not** populate `process.env` from `.env`, so a `process.env`-based read would be empty locally. `astro:env`'s `getSecret` reads `.env` in dev and the host environment in production, with no extra setup.
+
+### Generating `STRIFE_SECRET`
+
+`STRIFE_SECRET` has the form `v1.<meta>.<cert>`: a version tag, your `urls`/`database`/`password` as base64url-encoded JSON, and your PFX certificate as base64url-encoded **raw bytes** (encoded once — ~33% smaller than embedding an already-base64 cert in JSON). The format is key-algorithm-agnostic: the same `STRIFE_SECRET` works whether the certificate inside is RSA or ECDSA.
+
+The blob format is stable, so you can generate it yourself in a few lines: base64url-encode `JSON.stringify({ urls, database, password })`, base64url-encode the raw `.pfx` bytes, and join them as `v1.<meta>.<cert>`. Contributors working in the [repository](https://github.com/wieldyapp/wieldy) can use the bundled helper:
+
+```bash
+# password via env var (recommended)
+STRIFE_PFX_PASSWORD='your-cert-password' node --experimental-strip-types \
+  scripts/pack-secrets.mjs \
+  --pfx ./client.pfx \
+  --urls https://your-ravendb.example.com \
+  --database your-database
+
+# …or pipe the password instead of putting it in the environment
+printf '%s' "$PFX_PW" | node --experimental-strip-types \
+  scripts/pack-secrets.mjs --pfx ./client.pfx --urls … --database … --password-stdin
+```
+
+The password is read only from `STRIFE_PFX_PASSWORD` or `--password-stdin` — never a CLI flag, since process arguments are world-readable. The helper prints `STRIFE_SECRET=<blob>`; pipe it straight into your host's secret store rather than echoing it (it otherwise lands in shell history). `--experimental-strip-types` is unnecessary on Node ≥ 23.6 / 22.18. (The helper script ships with the repository, not the published package; a `strife secrets pack` CLI command is planned.)
+
+### Platform size limits
+
+The certificate dominates the value's size, and base64 of an encrypted PFX is incompressible — so a large certificate may not fit a platform's per-variable env limit. This is a property of the certificate, not of `STRIFE_SECRET` (the standalone `STRIFE_CERTIFICATE` has the same ceiling).
+
+| Platform | Per-variable limit | A ~2 KB ECDSA cert (~1.8 KB blob) | A ~4 KB RSA-4096 cert (~5.5 KB blob) |
+| --- | --- | --- | --- |
+| Kubernetes secret | ~1 MiB | ✅ | ✅ |
+| Vercel (serverless) | 64 KB total | ✅ | ✅ |
+| Vercel (edge) / Cloudflare Workers | ~5 KB | ✅ | ❌ |
+| Netlify build-time | 5,000 chars | ✅ | ❌ |
+| AWS Lambda / Netlify Functions (SSR) | 256 chars / 4 KB total | ❌ | ❌ |
+
+If you hit a limit, the fix is a **smaller certificate** — RavenDB authenticates clients by thumbprint, not key algorithm, so you can register a compact **ECDSA P-256** client certificate (≈1.2 KB PFX) and use it instead of an RSA-4096 one. No encoding change helps a large cert; a smaller key does.
 
-1. **Connects to RavenDB** using environment variables or provided config
-2. **Deploys a search index** called `Content_ByUrl` for content search
-3. **Indexes documents** from specified collections (default: Posts)
-4. **Creates a virtual module** `strife:store` that exports the RavenDB DocumentStore
-5. **Bulk inserts templates** into the Templates collection
+## How it works
 
-## Recovery Process
+On `astro:config:setup` the integration registers the `STRIFE_*` env schema and a Vite plugin. When the `strife:store` module is first evaluated (at build for prerendered pages, at request time for SSR), the plugin:
 
-The source was recovered by:
+1. Resolves configuration at runtime via `getSecret` (never baked into the bundle).
+2. Connects to RavenDB using the resolved URLs, database, and client certificate.
+3. Deploys a `Content/ByUrl` multi-map index (`deploymentMode: 'Rolling'`) for URL-based content lookup.
+4. Bulk-inserts the configured collections into the `Templates` collection.
+5. Exposes the initialized RavenDB `DocumentStore` through the `strife:store` virtual module.
 
-1. Analyzing the minified compiled output
-2. Identifying variable names and function patterns
-3. Extracting the embedded index mapping source code
-4. Reconstructing TypeScript types from `.d.ts` files
-5. Reverse engineering the build configuration
+> The `Content/ByUrl` index is deployed with a bundled helper source (`localized-content-index.js`) that runs inside RavenDB's Jint engine. It is intentionally plain ES5 — do not transpile it.
 
-## Next Steps
+## License
 
-- [ ] Implement the ImageService if needed
-- [ ] Verify the build output matches the original
-- [ ] Add tests
-- [ ] Update version number if making changes
+ISC © [Strife](https://strife.app)

package/dist/LivePreview.astro

@@ -0,0 +1,17 @@
+---
+/**
+ * Loads the Strife live-preview client (`@strifeapp/strife`) — but only when the
+ * request is an authenticated editor preview, i.e. `Astro.locals.editMode` is
+ * `true` (set by the edit-mode middleware). Place it once in your layout, the
+ * same way you'd add Astro's <ClientRouter />:
+ *
+ *   ---
+ *   import LivePreview from '@strifeapp/astro/LivePreview.astro';
+ *   ---
+ *   <head>…<LivePreview /></head>
+ *
+ * Normal visitors get nothing; the SDK chunk is fetched only in edit mode.
+ */
+const editMode = Astro.locals.editMode ?? false;
+---
+{editMode && <script>import '@strifeapp/strife';</script>}

package/dist/edit-mode-middleware.d.ts

@@ -0,0 +1,9 @@
+import { MiddlewareHandler } from 'astro';
+/**
+ * Sets `Astro.locals.editMode` on every request so pages can branch their SSR
+ * output (draft vs published). Registered automatically by the integration via
+ * `addMiddleware` (see src/index.ts); also exported for manual wiring if a
+ * consumer prefers to compose middleware explicitly.
+ */
+export declare const onRequest: MiddlewareHandler;
+//# sourceMappingURL=edit-mode-middleware.d.ts.map

package/dist/edit-mode-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-mode-middleware.d.ts","sourceRoot":"","sources":["../src/edit-mode-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAG/C;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,iBAGvB,CAAC"}

package/dist/edit-mode-middleware.js

@@ -0,0 +1,5 @@
+import { editMode as t } from "./edit-mode.js";
+const a = async (e, o) => (e.locals.editMode = await t(e), o());
+export {
+  a as onRequest
+};

package/dist/edit-mode-token.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Verify a Strife preview (edit-mode) token.
+ *
+ * Mirrors `Strife.Security.Tokenizer.Verify` on the backend: an HS256 JWT
+ * signed with the team's secret, carrying a `workspace` claim equal to the
+ * team id. A valid signature AND a matching workspace claim means the request
+ * is an authenticated editor previewing THIS team's content.
+ *
+ * Pure (no Astro / `astro:env` imports) so it is unit-testable in isolation.
+ *
+ * Note: the backend signs with ASCII bytes; for ASCII secrets `TextEncoder`
+ * (UTF-8) produces identical bytes, so verification matches.
+ */
+export declare function verifyEditModeToken(token: string, secret: string, teamId: string): Promise<boolean>;
+/**
+ * Resolve the (secret, teamId) pair used to verify a preview token, from either
+ * source the integration supports — blob first, then the legacy env vars:
+ *
+ *   1. the consolidated `STRIFE_SECRET` blob, when it packs `teamId` + `previewSecret`;
+ *   2. the legacy individual `SECRET` + `TEAM_ID` env vars (the older format).
+ *
+ * Falls through to (2) when the blob is absent, malformed, or does not carry the
+ * preview fields — mirroring the store's blob-first / individual-vars resolution.
+ * Pure (only `decodeSecrets`) so it is unit-testable in isolation.
+ */
+export declare function resolveEditModeCreds(sources: {
+    blob?: string | null;
+    envSecret?: string | null;
+    envTeamId?: string | null;
+}): {
+    secret: string;
+    teamId: string;
+} | null;
+//# sourceMappingURL=edit-mode-token.d.ts.map

package/dist/edit-mode-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-mode-token.d.ts","sourceRoot":"","sources":["../src/edit-mode-token.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiB5C"}

package/dist/edit-mode.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolve edit mode for the current request, server-side.
+ *
+ * Reads the `?token=` preview token from the URL and verifies it against the
+ * team's secret + id, resolved from EITHER the consolidated `STRIFE_SECRET`
+ * blob (when it packs `teamId` + `previewSecret`) OR the legacy individual
+ * `SECRET` + `TEAM_ID` env vars. Returns `false` for normal visitors (no token,
+ * bad token) and `true` for an authenticated Strife editor previewing this team:
+ *
+ *   const edit = await editMode(Astro);
+ *   { edit ? <DraftView /> : <PublishedView /> }
+ */
+export declare function editMode(astro: {
+    url: URL;
+}): Promise<boolean>;
+//# sourceMappingURL=edit-mode.d.ts.map

package/dist/edit-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edit-mode.d.ts","sourceRoot":"","sources":["../src/edit-mode.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AACH,wBAAsB,QAAQ,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,GAAG,CAAA;CAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAYpE"}

package/dist/edit-mode.js

@@ -0,0 +1,36 @@
+import { getSecret as n } from "astro:env/server";
+import { jwtVerify as c } from "jose";
+import { decodeSecrets as o } from "@strifeapp/strife/secrets";
+async function d(e, t, r) {
+  try {
+    const { payload: a } = await c(e, new TextEncoder().encode(t), {
+      algorithms: ["HS256"]
+    });
+    return a.workspace === r;
+  } catch {
+    return !1;
+  }
+}
+function i(e) {
+  if (e.blob)
+    try {
+      const t = o(e.blob);
+      if (t?.previewSecret && t.teamId)
+        return { secret: t.previewSecret, teamId: t.teamId };
+    } catch {
+    }
+  return e.envSecret && e.envTeamId ? { secret: e.envSecret, teamId: e.envTeamId } : null;
+}
+async function S(e) {
+  const t = e.url.searchParams.get("token");
+  if (!t) return !1;
+  const r = i({
+    blob: n("STRIFE_SECRET"),
+    envSecret: n("SECRET"),
+    envTeamId: n("TEAM_ID")
+  });
+  return r ? d(t, r.secret, r.teamId) : !1;
+}
+export {
+  S as editMode
+};

package/dist/index.d.ts

@@ -11,5 +11,18 @@ export interface Collection {
     name: string;
     [key: string]: any;
 }
+declare global {
+    namespace App {
+        interface Locals {
+            /**
+             * `true` when the current request is an authenticated Strife editor
+             * previewing this team's content (a valid `?token=` was verified). Set on
+             * every request by the edit-mode middleware. Use it to branch SSR output,
+             * e.g. render draft vs published content.
+             */
+            editMode?: boolean;
+        }
+    }
+}
 export default function strifeIntegration(options?: IntegrationOptions): AstroIntegration;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG5C,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAMD,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAwBxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,OAAO,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5C,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,GAAG,CAAC;QACZ,UAAU,MAAM;YACd;;;;;eAKG;YACH,QAAQ,CAAC,EAAE,OAAO,CAAC;SACpB;KACF;CACF;AAMD,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,gBAAgB,CAwDxF"}

package/dist/index.js

@@ -1,27 +1,47 @@
-import { v as n } from "./vite-plugin-strife-store-DkxIFvv2.js";
-const o = {
+import { envField as e } from "astro/config";
+import { v as c } from "./vite-plugin-strife-store-B-B_HXbA.js";
+const i = {
   type: "pfx"
 };
-function s(t) {
+function p(t) {
   return {
     name: "@strife/astro",
     hooks: {
-      "astro:config:setup": ({ updateConfig: i }) => {
-        const r = {
-          ...o,
+      "astro:config:setup": ({ updateConfig: r, addMiddleware: s }) => {
+        const n = {
+          ...i,
           ...t ? Object.fromEntries(
-            Object.entries(t).filter(([, e]) => e != null)
+            Object.entries(t).filter(([, o]) => o != null)
           ) : {}
         };
-        i({
+        r({
+          env: {
+            schema: {
+              // Consolidated single-var secret (packs urls/database/certificate/password,
+              // plus teamId/previewSecret for edit-mode token verification).
+              // Resolved first, ahead of the individual vars below; see vite-plugin-strife-store.
+              STRIFE_SECRET: e.string({ context: "server", access: "secret", optional: !0 }),
+              STRIFE_DATABASE_URLS: e.string({ context: "server", access: "secret", optional: !0 }),
+              STRIFE_DATABASE: e.string({ context: "server", access: "secret", optional: !0 }),
+              STRIFE_CERTIFICATE: e.string({ context: "server", access: "secret", optional: !0 }),
+              STRIFE_CERTIFICATE_PASSWORD: e.string({ context: "server", access: "secret", optional: !0 }),
+              // Legacy individual edit-mode token vars (the older format). editMode falls
+              // back to these when STRIFE_SECRET does not pack teamId/previewSecret.
+              SECRET: e.string({ context: "server", access: "secret", optional: !0 }),
+              TEAM_ID: e.string({ context: "server", access: "secret", optional: !0 })
+            }
+          },
           vite: {
-            plugins: [n(r)]
+            plugins: [c(n)]
           }
+        }), s({
+          entrypoint: "@strifeapp/astro/edit-mode-middleware",
+          order: "pre"
         });
       }
     }
   };
 }
 export {
-  s as default
+  p as default
 };

package/dist/vite-plugin-strife-store-B-B_HXbA.js

@@ -0,0 +1,105 @@
+import a from "serialize-javascript";
+const s = "strife:store", r = "\0" + s;
+function n(o) {
+  const e = { ...o };
+  return delete e.certificate, delete e.password, {
+    name: "strife:store",
+    resolveId(t) {
+      if (t === s)
+        return r;
+    },
+    load(t) {
+      if (t === r)
+        return `
+          import { DocumentStore } from "ravendb";
+          import { getSecret } from "astro:env/server";
+
+          const defaultConfig = ${a(e)};
+
+          // --- STRIFE_SECRET decode (keep in sync with @strifeapp/strife/secrets; format v1.<meta>.<cert>) ---
+          function decodeStrifeSecrets(value) {
+            const sections = value.split('.');
+            if (sections.length !== 3) {
+              throw new Error('STRIFE_SECRET: expected 3 dot-separated sections, got ' + sections.length);
+            }
+            const version = sections[0];
+            if (version !== 'v1') {
+              if (/^v\\d+$/.test(version)) return null; // known-shape future version -> treat as unset
+              throw new Error('STRIFE_SECRET: unrecognised format (missing version prefix)');
+            }
+            const b64url = /^[A-Za-z0-9_-]+$/;
+            if (!b64url.test(sections[1])) throw new Error('STRIFE_SECRET: meta section is not valid base64url');
+            if (!b64url.test(sections[2])) throw new Error('STRIFE_SECRET: cert section is not valid base64url');
+            let meta;
+            try {
+              meta = JSON.parse(Buffer.from(sections[1], 'base64url').toString('utf8'));
+            } catch (e) {
+              throw new Error('STRIFE_SECRET: meta section is not valid JSON'); // never echo the (secret) content
+            }
+            if (typeof meta !== 'object' || meta === null || !Array.isArray(meta.urls) || typeof meta.database !== 'string') {
+              throw new Error('STRIFE_SECRET: meta section missing required fields (urls, database)');
+            }
+            return {
+              urls: meta.urls,
+              database: meta.database,
+              password: meta.password,
+              type: meta.type,
+              certificate: Buffer.from(sections[2], 'base64url'), // raw PFX bytes, decoded once
+            };
+          }
+
+          const strifeSecretsBlob = getSecret('STRIFE_SECRET');
+          // null = known-shape future version -> treat as unset and fall back to the four vars.
+          const secrets = strifeSecretsBlob ? (decodeStrifeSecrets(strifeSecretsBlob) || {}) : {};
+
+          // Resolution priority: STRIFE_SECRET field -> individual STRIFE_* var -> integration option.
+          // Operator pinned to || with an empty string treated as unset (matches prior behaviour).
+          const urlsFromEnv = getSecret('STRIFE_DATABASE_URLS');
+          const urls = (secrets.urls && secrets.urls.length)
+            ? secrets.urls
+            : (urlsFromEnv ? urlsFromEnv.split(',') : (defaultConfig.urls || []));
+
+          const database = secrets.database || getSecret('STRIFE_DATABASE') || defaultConfig.database || '';
+
+          // From the blob the certificate is already raw PFX bytes (Buffer); from an env var or
+          // option it is a base64 string, decoded once here. Normalise to a Buffer either way.
+          let certificate;
+          if (secrets.certificate) {
+            certificate = secrets.certificate;
+          } else {
+            const certBase64 = getSecret('STRIFE_CERTIFICATE') || defaultConfig.certificate;
+            certificate = certBase64 ? Buffer.from(certBase64, 'base64') : undefined;
+          }
+
+          const password = secrets.password || getSecret('STRIFE_CERTIFICATE_PASSWORD') || defaultConfig.password;
+
+          // R9: a certificate without a password must not silently initialise an unauthenticated store.
+          if (certificate && !password) {
+            throw new Error('STRIFE_SECRET: a certificate was provided without a password (set STRIFE_CERTIFICATE_PASSWORD or include the password in STRIFE_SECRET)');
+          }
+
+          const hasAuth = certificate && password;
+
+          const authOptions = hasAuth ? {
+            type: secrets.type || defaultConfig.type || 'pfx',
+            certificate: certificate,
+            password,
+          } : null;
+
+          const store = new DocumentStore(
+            urls,
+            database,
+            authOptions || undefined,
+          ).initialize();
+
+          // Content/ByUrl + templates are deployed by 'strife push' (the versioned,
+          // operator-controlled path). The store only connects and reads — Astro no
+          // longer deploys the index or seeds templates.
+          export { store };
+        `;
+    }
+  };
+}
+export {
+  n as v
+};

package/dist/vite-plugin-strife-store-entry.js

@@ -1,4 +1,4 @@
-import { v as t } from "./vite-plugin-strife-store-DkxIFvv2.js";
+import { v as t } from "./vite-plugin-strife-store-B-B_HXbA.js";
 export {
   t as vitePluginStrifeStore
 };

package/dist/vite-plugin-strife-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-strife-store.d.ts","sourceRoot":"","sources":["../src/vite-plugin-strife-store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKlD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAsF9E"}
+{"version":3,"file":"vite-plugin-strife-store.d.ts","sourceRoot":"","sources":["../src/vite-plugin-strife-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAKlD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA6G9E"}