@velastack/cms 0.1.0 → 0.2.0

package/README.md

@@ -635,7 +635,7 @@ plugin/src/      Vite plugin (route discovery, AST parse, manifest builder, tran
 src/lib/         Public library
   components/cms/      Display + editable components, scope helpers, store
   components/admin-bar/ Admin bar wrapper + async internal + SEO panel
-  srv/                 loadCms, mockAdapter, types
+  server/              loadCms, mockAdapter, types
 src/routes/      Test harness / showcase
 ```
 

package/dist/backend/auth/editors.d.ts

@@ -0,0 +1,51 @@
+import type { SqliteDb } from '../store/sqlite.js';
+import type { CmsEditor } from '../types.js';
+import { type ScryptParams } from './scrypt.js';
+export type EditorRow = {
+    id: string;
+    email: string;
+    name: string;
+    password_hash: string;
+    created_at: string;
+    disabled_at: string | null;
+};
+export type CreateEditorInput = {
+    email: string;
+    password: string;
+    name?: string;
+    /** Projects to grant immediately. Equivalent to `grant()` per id. */
+    projects?: string[];
+};
+export declare const createEditorStore: (db: SqliteDb, scryptParams?: ScryptParams) => {
+    /** Create an account. Throws on a duplicate email (the unique index on
+     * `email_lower` is the arbiter, so case doesn't let one through). */
+    create(input: CreateEditorInput): Promise<CmsEditor>;
+    setPassword(idOrEmail: string, password: string): Promise<void>;
+    /** Verify credentials. `null` for an unknown email, a wrong password, or
+     * a disabled account — callers must not distinguish between them. */
+    verify(email: string, password: string): Promise<CmsEditor | null>;
+    find: (idOrEmail: string) => CmsEditor | null;
+    list: () => CmsEditor[];
+    listForProject: (projectId: string) => CmsEditor[];
+    delete: (idOrEmail: string) => boolean;
+    setDisabled: (idOrEmail: string, disabled: boolean) => void;
+    grant: (idOrEmail: string, projectId: string) => void;
+    revoke: (idOrEmail: string, projectId: string) => boolean;
+    can: (editorId: string, projectId: string) => boolean;
+    projectsFor: (idOrEmail: string) => string[];
+    /** Mint a session and return the raw token for the cookie. Only the
+     * digest is stored. */
+    createSession: (editorId: string, opts?: {
+        ttlMs?: number;
+    }) => CmsSessionToken;
+    /** Resolve a raw token to its editor, or `null` when unknown, expired, or
+     * belonging to a disabled account. */
+    resolveSession: (token: string) => CmsEditor | null;
+    destroySession: (token: string) => void;
+    purgeExpiredSessions: () => number;
+};
+export type CmsSessionToken = {
+    token: string;
+    expiresAt: Date;
+};
+export type CmsEditorStore = ReturnType<typeof createEditorStore>;

package/dist/backend/auth/editors.js

@@ -0,0 +1,157 @@
+/**
+ * The CMS's own editor directory: accounts, per-project grants, and sessions.
+ *
+ * Bound to one database, like the content store. Everything here is
+ * synchronous except the two password paths, which go through scrypt.
+ */
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { hashPassword, verifyPassword } from './scrypt.js';
+const nowIso = () => new Date().toISOString();
+/** Sessions are keyed by digest, never by the token itself, so the table is
+ * useless to anyone who reads it. */
+const tokenHash = (token) => createHash('sha256').update(token).digest('hex');
+const toEditor = (row) => ({
+    id: row.id,
+    email: row.email,
+    name: row.name
+});
+const DEFAULT_SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+export const createEditorStore = (db, scryptParams) => {
+    const insertEditor = db.prepare(`INSERT INTO cms_editors (id, email, email_lower, name, password_hash, created_at)
+		 VALUES (?, ?, ?, ?, ?, ?)`);
+    const byEmail = db.prepare('SELECT id, email, name, password_hash, created_at, disabled_at FROM cms_editors WHERE email_lower = ?');
+    const byId = db.prepare('SELECT id, email, name, password_hash, created_at, disabled_at FROM cms_editors WHERE id = ?');
+    const listAll = db.prepare('SELECT id, email, name, password_hash, created_at, disabled_at FROM cms_editors ORDER BY created_at, id');
+    const updateHash = db.prepare('UPDATE cms_editors SET password_hash = ? WHERE id = ?');
+    const removeEditor = db.prepare('DELETE FROM cms_editors WHERE id = ?');
+    const setDisabled = db.prepare('UPDATE cms_editors SET disabled_at = ? WHERE id = ?');
+    const insertGrant = db.prepare(`INSERT INTO cms_project_editors (project_id, editor_id, role, granted_at)
+		 VALUES (?, ?, ?, ?)
+		 ON CONFLICT (project_id, editor_id) DO NOTHING`);
+    const removeGrant = db.prepare('DELETE FROM cms_project_editors WHERE project_id = ? AND editor_id = ?');
+    const hasGrant = db.prepare('SELECT 1 AS one FROM cms_project_editors WHERE project_id = ? AND editor_id = ?');
+    const grantsFor = db.prepare('SELECT project_id FROM cms_project_editors WHERE editor_id = ? ORDER BY project_id');
+    const editorsFor = db.prepare(`SELECT e.id, e.email, e.name, e.password_hash, e.created_at, e.disabled_at
+		 FROM cms_editors e
+		 JOIN cms_project_editors pe ON pe.editor_id = e.id
+		 WHERE pe.project_id = ?
+		 ORDER BY e.created_at, e.id`);
+    const insertSession = db.prepare('INSERT INTO cms_sessions (token_hash, editor_id, created_at, expires_at) VALUES (?, ?, ?, ?)');
+    const sessionEditor = db.prepare(`SELECT e.id, e.email, e.name, e.password_hash, e.created_at, e.disabled_at
+		 FROM cms_sessions s
+		 JOIN cms_editors e ON e.id = s.editor_id
+		 WHERE s.token_hash = ? AND s.expires_at > ?`);
+    const removeSession = db.prepare('DELETE FROM cms_sessions WHERE token_hash = ?');
+    const removeEditorSessions = db.prepare('DELETE FROM cms_sessions WHERE editor_id = ?');
+    const removeExpired = db.prepare('DELETE FROM cms_sessions WHERE expires_at <= ?');
+    const find = (idOrEmail) => byId.get(idOrEmail) ?? byEmail.get(idOrEmail.toLowerCase());
+    return {
+        /** Create an account. Throws on a duplicate email (the unique index on
+         * `email_lower` is the arbiter, so case doesn't let one through). */
+        async create(input) {
+            const email = input.email.trim();
+            if (!email.includes('@'))
+                throw new Error(`invalid email: ${input.email}`);
+            if (input.password.length === 0)
+                throw new Error('password required');
+            if (byEmail.get(email.toLowerCase())) {
+                throw new Error(`an editor with the email ${email} already exists`);
+            }
+            const id = randomUUID();
+            const hash = await hashPassword(input.password, scryptParams);
+            insertEditor.run(id, email, email.toLowerCase(), input.name ?? email, hash, nowIso());
+            for (const projectId of input.projects ?? []) {
+                insertGrant.run(projectId, id, 'editor', nowIso());
+            }
+            return { id, email, name: input.name ?? email };
+        },
+        async setPassword(idOrEmail, password) {
+            const row = find(idOrEmail);
+            if (!row)
+                throw new Error(`no such editor: ${idOrEmail}`);
+            if (password.length === 0)
+                throw new Error('password required');
+            updateHash.run(await hashPassword(password, scryptParams), row.id);
+            // A password change ends every existing session for that editor.
+            removeEditorSessions.run(row.id);
+        },
+        /** Verify credentials. `null` for an unknown email, a wrong password, or
+         * a disabled account — callers must not distinguish between them. */
+        async verify(email, password) {
+            const row = byEmail.get(email.trim().toLowerCase());
+            if (!row) {
+                // Hash anyway so a missing account isn't measurably faster than a
+                // wrong password.
+                await verifyPassword(password, 'scrypt$16384$8$1$AAAA$AAAA');
+                return null;
+            }
+            if (row.disabled_at)
+                return null;
+            if (!(await verifyPassword(password, row.password_hash)))
+                return null;
+            return toEditor(row);
+        },
+        find: (idOrEmail) => {
+            const row = find(idOrEmail);
+            return row ? toEditor(row) : null;
+        },
+        list: () => listAll.all().map(toEditor),
+        listForProject: (projectId) => editorsFor.all(projectId).map(toEditor),
+        delete: (idOrEmail) => {
+            const row = find(idOrEmail);
+            if (!row)
+                return false;
+            return removeEditor.run(row.id).changes > 0;
+        },
+        setDisabled: (idOrEmail, disabled) => {
+            const row = find(idOrEmail);
+            if (!row)
+                throw new Error(`no such editor: ${idOrEmail}`);
+            setDisabled.run(disabled ? nowIso() : null, row.id);
+            if (disabled)
+                removeEditorSessions.run(row.id);
+        },
+        grant: (idOrEmail, projectId) => {
+            const row = find(idOrEmail);
+            if (!row)
+                throw new Error(`no such editor: ${idOrEmail}`);
+            insertGrant.run(projectId, row.id, 'editor', nowIso());
+        },
+        revoke: (idOrEmail, projectId) => {
+            const row = find(idOrEmail);
+            if (!row)
+                return false;
+            return removeGrant.run(projectId, row.id).changes > 0;
+        },
+        can: (editorId, projectId) => hasGrant.get(projectId, editorId) !== undefined,
+        projectsFor: (idOrEmail) => {
+            const row = find(idOrEmail);
+            if (!row)
+                return [];
+            return grantsFor.all(row.id).map((r) => r.project_id);
+        },
+        /** Mint a session and return the raw token for the cookie. Only the
+         * digest is stored. */
+        createSession: (editorId, opts = {}) => {
+            const token = randomBytes(32).toString('base64url');
+            const expiresAt = new Date(Date.now() + (opts.ttlMs ?? DEFAULT_SESSION_TTL_MS));
+            insertSession.run(tokenHash(token), editorId, nowIso(), expiresAt.toISOString());
+            return { token, expiresAt };
+        },
+        /** Resolve a raw token to its editor, or `null` when unknown, expired, or
+         * belonging to a disabled account. */
+        resolveSession: (token) => {
+            if (!token)
+                return null;
+            const row = sessionEditor.get(tokenHash(token), nowIso());
+            if (!row || row.disabled_at)
+                return null;
+            return toEditor(row);
+        },
+        destroySession: (token) => {
+            if (token)
+                removeSession.run(tokenHash(token));
+        },
+        purgeExpiredSessions: () => removeExpired.run(nowIso()).changes
+    };
+};

package/dist/backend/auth/local-editors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The built-in {@link CmsAuthAdapter}: the CMS owns its editors.
+ *
+ * Self-contained — no external identity provider, no second service — which is
+ * what makes a single-tenant mount work out of the box. A host that already has
+ * accounts writes its own adapter instead; the router only ever sees this
+ * interface.
+ */
+import type { CmsAuthAdapter } from '../types.js';
+import type { ScryptParams } from './scrypt.js';
+export type LocalEditorsOptions = {
+    /** Session lifetime. Defaults to 30 days, matching the cookie's `maxAge`. */
+    sessionTtlMs?: number;
+    /** Password work factor. Lower it only in tests. */
+    scrypt?: ScryptParams;
+};
+/**
+ * The adapter caches one editor store per database. `resolve` runs on every
+ * request, and re-preparing a dozen statements each time would be wasteful; the
+ * store's own statements are prepared once and reused.
+ */
+export declare const localEditors: (options?: LocalEditorsOptions) => CmsAuthAdapter;

package/dist/backend/auth/local-editors.js

@@ -0,0 +1,44 @@
+import { createEditorStore } from './editors.js';
+/**
+ * The adapter caches one editor store per database. `resolve` runs on every
+ * request, and re-preparing a dozen statements each time would be wasteful; the
+ * store's own statements are prepared once and reused.
+ */
+export const localEditors = (options = {}) => {
+    const stores = new WeakMap();
+    const storeFor = (ctx) => {
+        const key = ctx.db;
+        let store = stores.get(key);
+        if (!store) {
+            store = createEditorStore(ctx.db, options.scrypt);
+            stores.set(key, store);
+        }
+        return store;
+    };
+    return {
+        async resolve(event, ctx) {
+            const token = event.cookies.get(ctx.cookieName);
+            if (!token)
+                return null;
+            return storeFor(ctx).resolveSession(token);
+        },
+        async authorize(user, projectId, ctx) {
+            return storeFor(ctx).can(user.id, projectId);
+        },
+        async login(email, password, ctx) {
+            const store = storeFor(ctx);
+            const user = await store.verify(email, password);
+            if (!user)
+                return null;
+            const { token, expiresAt } = store.createSession(user.id, {
+                ttlMs: options.sessionTtlMs
+            });
+            return { user, token, expiresAt };
+        },
+        async logout(event, ctx) {
+            const token = event.cookies.get(ctx.cookieName);
+            if (token)
+                storeFor(ctx).destroySession(token);
+        }
+    };
+};

package/dist/backend/auth/scrypt.d.ts

@@ -0,0 +1,20 @@
+export type ScryptParams = {
+    /** CPU/memory cost. Must be a power of two. */
+    N: number;
+    /** Block size. */
+    r: number;
+    /** Parallelisation. */
+    p: number;
+};
+/** OWASP's floor for scrypt at the time of writing. */
+export declare const DEFAULT_PARAMS: ScryptParams;
+/**
+ * `scrypt$N$r$p$salt$hash`, salt and hash base64url. Self-describing, so
+ * {@link verifyPassword} needs no configuration to read one back.
+ */
+export declare const hashPassword: (password: string, params?: ScryptParams) => Promise<string>;
+/**
+ * Constant-time verify. Returns `false` rather than throwing for a malformed or
+ * unrecognised hash, so a corrupt row denies access instead of 500ing.
+ */
+export declare const verifyPassword: (password: string, stored: string) => Promise<boolean>;

package/dist/backend/auth/scrypt.js

@@ -0,0 +1,80 @@
+/**
+ * Password hashing on `node:crypto` alone — no dependency, native or otherwise.
+ *
+ * scrypt is memory-hard, which is what makes a stolen `cms_editors` table
+ * expensive to attack offline. The parameters are stored alongside each hash so
+ * they can be raised later without invalidating existing passwords: a verify
+ * reads the cost the hash was written with, and a re-hash on next login is a
+ * separate, additive change.
+ *
+ * The async form is used on the login path deliberately. `scryptSync` at these
+ * parameters blocks the event loop for ~100ms, which on a shared server is a
+ * denial-of-service vector against every other in-flight request.
+ */
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+/** OWASP's floor for scrypt at the time of writing. */
+export const DEFAULT_PARAMS = { N: 16384, r: 8, p: 1 };
+const KEY_LENGTH = 64;
+const derive = (password, salt, params) => new Promise((resolve, reject) => {
+    scrypt(password, salt, KEY_LENGTH, {
+        N: params.N,
+        r: params.r,
+        p: params.p,
+        // Node's default cap is 32 MB, which N=16384/r=8 exceeds.
+        maxmem: 256 * 1024 * 1024
+    }, (err, key) => (err ? reject(err) : resolve(key)));
+});
+/**
+ * `scrypt$N$r$p$salt$hash`, salt and hash base64url. Self-describing, so
+ * {@link verifyPassword} needs no configuration to read one back.
+ */
+export const hashPassword = async (password, params = DEFAULT_PARAMS) => {
+    const salt = randomBytes(16);
+    const key = await derive(password, salt, params);
+    return [
+        'scrypt',
+        params.N,
+        params.r,
+        params.p,
+        salt.toString('base64url'),
+        key.toString('base64url')
+    ].join('$');
+};
+/**
+ * Constant-time verify. Returns `false` rather than throwing for a malformed or
+ * unrecognised hash, so a corrupt row denies access instead of 500ing.
+ */
+export const verifyPassword = async (password, stored) => {
+    const parts = stored.split('$');
+    if (parts.length !== 6 || parts[0] !== 'scrypt')
+        return false;
+    const N = Number(parts[1]);
+    const r = Number(parts[2]);
+    const p = Number(parts[3]);
+    if (!Number.isInteger(N) || !Number.isInteger(r) || !Number.isInteger(p))
+        return false;
+    let salt;
+    let expected;
+    try {
+        salt = Buffer.from(parts[4], 'base64url');
+        expected = Buffer.from(parts[5], 'base64url');
+    }
+    catch {
+        return false;
+    }
+    if (salt.length === 0 || expected.length === 0)
+        return false;
+    let actual;
+    try {
+        actual = await derive(password, salt, { N, r, p });
+    }
+    catch {
+        return false;
+    }
+    // timingSafeEqual throws on a length mismatch, which is itself public
+    // information (it's in the stored hash), so comparing lengths first leaks
+    // nothing.
+    if (actual.length !== expected.length)
+        return false;
+    return timingSafeEqual(actual, expected);
+};

package/dist/backend/factory.d.ts

@@ -0,0 +1,25 @@
+import type { RequestEvent, RequestHandler } from '@sveltejs/kit';
+import { type CmsStore } from './store/queries.js';
+import { type ReadCache } from './store/cache.js';
+import type { SqliteDb } from './store/sqlite.js';
+import { type CmsEditorStore } from './auth/editors.js';
+import { type SeedInput } from './routes/test-reset.js';
+import type { CmsBackendOptions } from './types.js';
+export type CmsBackend = {
+    /** Drop into a catch-all `+server.ts` as `export const fallback`. */
+    handler: RequestHandler;
+    /** For a host-level `/uploads/[filename]` route. Reads `params.filename`. */
+    serveUpload: RequestHandler;
+    /** Same as `handler`, for callers holding a `RequestEvent` directly. */
+    handle: (event: RequestEvent) => Promise<Response>;
+    editors: CmsEditorStore;
+    store: CmsStore;
+    db: SqliteDb;
+    cache: ReadCache;
+    /** Test-only. Throws unless `testReset` is enabled. */
+    testing: {
+        reset: (projectId: string, seed?: SeedInput) => Promise<void>;
+    };
+    close: () => void;
+};
+export declare const createCmsBackend: (options?: CmsBackendOptions) => CmsBackend;

package/dist/backend/factory.js

@@ -0,0 +1,202 @@
+/**
+ * `createCmsBackend` — everything the HTTP layer needs, bound to one database.
+ *
+ * The whole point of this shape is that the application's mount file is three
+ * lines and never changes: the route table, the auth pipeline, CORS, and the
+ * cache contract all live in the package, so a fix ships as an npm update
+ * rather than a re-vendoring.
+ */
+import { dirname, join, resolve as resolvePath } from 'node:path';
+import { createStore } from './store/queries.js';
+import { createReadCache } from './store/cache.js';
+import { openDatabase } from './store/db.js';
+import { runMigrations } from './store/migrate.js';
+import { MIGRATIONS } from './store/migrations/index.js';
+import { createResponders } from './http.js';
+import { createStorage } from './storage.js';
+import { serveUploadBytes } from './routes/media.js';
+import { createEditorStore } from './auth/editors.js';
+import { localEditors } from './auth/local-editors.js';
+import { lookupRoute, methodNotAllowed, normalizeMethod, notFound, splitPath } from './router.js';
+import { ROUTES } from './routes/table.js';
+import { clearUploads, normalizeSeed } from './routes/test-reset.js';
+/** `vela` sets `VELA_DATA_DIR` wherever it runs an app; the fallback covers a
+ * bare `vitest` or a script run by hand, where the project root is right. */
+const defaultDataDir = () => process.env.VELA_DATA_DIR ?? resolvePath(process.cwd(), 'data');
+export const createCmsBackend = (options = {}) => {
+    const dbPath = options.dbPath ?? join(defaultDataDir(), 'cms.sqlite');
+    const db = options.db ?? openDatabase(dbPath);
+    // An injected connection may not have been migrated yet.
+    if (options.db)
+        runMigrations(db, MIGRATIONS);
+    const uploadDir = options.uploadDir ??
+        (dbPath === ':memory:' ? join(defaultDataDir(), 'uploads') : join(dirname(dbPath), 'uploads'));
+    const store = createStore(db);
+    const cache = createReadCache();
+    const respond = createResponders(store, cache);
+    const storage = createStorage(uploadDir);
+    const editors = createEditorStore(db);
+    const auth = options.auth ?? localEditors();
+    const restParam = options.restParam ?? 'path';
+    const cookieName = options.cookie?.name ?? 'cms_session';
+    const resolveProject = options.resolveProject ?? (() => 'default');
+    const frameAncestors = options.frameAncestors ?? "'self'";
+    const cors = options.cors ?? false;
+    const testReset = options.testReset ?? false;
+    /**
+     * The path the backend is mounted at: the request path with the matched rest
+     * segments trimmed off the end. Derived per request so the same code works
+     * at `/cms` and `/v1/projects/x/cms` with no configuration.
+     */
+    const mountPathFor = (event, restPath) => {
+        const pathname = event.url.pathname.replace(/\/$/, '');
+        if (!restPath)
+            return pathname;
+        const suffix = `/${restPath}`;
+        return pathname.endsWith(suffix) ? pathname.slice(0, -suffix.length) : pathname;
+    };
+    const mediaUrlFor = (event, mountPath) => {
+        const base = options.mediaBaseUrl;
+        const resolved = typeof base === 'function'
+            ? base(event)
+            : (base ?? `${new URL(mountPath, event.url).origin}/uploads`);
+        const trimmed = resolved.replace(/\/$/, '');
+        return (filename) => `${trimmed}/${filename}`;
+    };
+    /**
+     * Cookie attributes. `sameSite: 'none'` is required for the cross-origin
+     * iframe login and wrong for a same-origin mount on plain http, so the
+     * default follows whether CORS is configured rather than being hardcoded
+     * one way.
+     */
+    const cookieOptionsFor = (event) => {
+        const crossOrigin = cors !== false;
+        const isHttps = event.url.protocol === 'https:';
+        return {
+            path: options.cookie?.path ?? '/',
+            httpOnly: true,
+            sameSite: options.cookie?.sameSite ?? (crossOrigin ? 'none' : 'lax'),
+            secure: options.cookie?.secure ?? (crossOrigin ? true : isHttps),
+            ...(options.cookie?.partitioned ? { partitioned: true } : {}),
+            maxAge: options.cookie?.maxAge ?? 60 * 60 * 24 * 30
+        };
+    };
+    const applyCors = (event, response) => {
+        if (cors === false)
+            return response;
+        // Appended, not set, and always — a cached response must not be reused
+        // for a different origin.
+        response.headers.append('vary', 'Origin');
+        const origin = event.request.headers.get('origin');
+        if (origin && cors.origin(origin, event)) {
+            response.headers.set('access-control-allow-origin', origin);
+            if (cors.credentials !== false) {
+                response.headers.set('access-control-allow-credentials', 'true');
+            }
+        }
+        return response;
+    };
+    const preflight = (event) => {
+        if (cors === false)
+            return new Response(null, { status: 204 });
+        const headers = new Headers({
+            'access-control-allow-methods': (cors.methods ?? ['GET', 'POST', 'DELETE', 'OPTIONS']).join(','),
+            'access-control-allow-headers': (cors.headers ?? ['content-type', 'authorization']).join(', ')
+        });
+        const response = new Response(null, { status: 204, headers });
+        return applyCors(event, response);
+    };
+    const handle = async (event) => {
+        const restPath = event.params[restParam] ?? '';
+        const segments = splitPath(restPath);
+        const method = normalizeMethod(event);
+        // Preflight is answered before auth and before any database access.
+        if (method === 'OPTIONS')
+            return preflight(event);
+        const lookup = lookupRoute(ROUTES, method, segments);
+        if (lookup.kind === 'not-found')
+            return applyCors(event, notFound());
+        if (lookup.kind === 'method-not-allowed') {
+            return applyCors(event, methodNotAllowed(lookup.allowed));
+        }
+        const { route, params } = lookup.match;
+        if (route.handler === undefined)
+            return applyCors(event, notFound());
+        if (route.segments[0] === '__test_reset__' && !testReset) {
+            return applyCors(event, notFound());
+        }
+        const projectId = resolveProject(event);
+        if (projectId === null)
+            return applyCors(event, notFound());
+        const authCtx = { db, projectId, cookieName };
+        // Resolve, then authorize, then dispatch. Both checks happen before any
+        // handler body runs, which is what keeps a cross-project write from
+        // touching the database at all.
+        let user = null;
+        try {
+            user = await auth.resolve(event, authCtx);
+        }
+        catch {
+            user = null;
+        }
+        if (user && route.auth !== 'exempt' && !(await auth.authorize(user, projectId, authCtx))) {
+            return applyCors(event, new Response(null, { status: 403 }));
+        }
+        if (route.auth === 'required' && !user) {
+            return applyCors(event, new Response(null, { status: 403 }));
+        }
+        const mountPath = mountPathFor(event, restPath);
+        const ctx = {
+            event,
+            projectId,
+            user,
+            params,
+            store,
+            cache,
+            respond,
+            storage,
+            auth,
+            authCtx,
+            mediaUrl: mediaUrlFor(event, mountPath),
+            mountPath,
+            frameAncestors,
+            setSessionCookie: (token, expiresAt) => {
+                const opts = cookieOptionsFor(event);
+                event.cookies.set(cookieName, token, {
+                    ...opts,
+                    maxAge: Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000))
+                });
+            },
+            clearSessionCookie: () => {
+                event.cookies.set(cookieName, '', { ...cookieOptionsFor(event), maxAge: 0 });
+            }
+        };
+        return applyCors(event, await route.handler(ctx));
+    };
+    const handler = (event) => handle(event);
+    const serveUpload = (event) => serveUploadBytes(storage, event.params.filename);
+    return {
+        handler,
+        serveUpload,
+        handle,
+        editors,
+        store,
+        db,
+        cache,
+        testing: {
+            reset: async (projectId, seed = {}) => {
+                if (!testReset) {
+                    throw new Error('createCmsBackend({ testReset: true }) is required to call reset()');
+                }
+                store.__resetProjectForTests(projectId);
+                cache.clear();
+                await clearUploads(uploadDir);
+                const { layouts, pages } = normalizeSeed(seed);
+                if (Object.keys(layouts).length > 0 || Object.keys(pages).length > 0) {
+                    store.seedPublishedDocs(projectId, layouts, pages);
+                }
+            }
+        },
+        close: () => db.close()
+    };
+};

package/dist/backend/http.d.ts

@@ -0,0 +1,34 @@
+import type { ReadCache } from './store/cache.js';
+import type { CmsStore } from './store/queries.js';
+type CacheEvent = {
+    request: Request;
+    setHeaders: (headers: Record<string, string>) => void;
+};
+export type PublicCachePass = {
+    hit: false;
+    version: number;
+    etag: string;
+};
+type PublicCacheHit = {
+    hit: true;
+    response: Response;
+};
+/**
+ * Bind the cache-aware responders to one store and one read cache.
+ *
+ * The bodies are a verbatim move: the header values, the ETag basis, the
+ * positive-only caching, and the branch order are the contract the shipped
+ * client already depends on, so none of it is re-derived here.
+ *
+ * Note these take a duck-typed `{ request, setHeaders }` rather than a full
+ * `RequestEvent`, which is what lets the tests drive them directly.
+ */
+export declare const createResponders: (store: CmsStore, cache: ReadCache) => {
+    tryPublicCache: (event: CacheEvent, projectId: string, scope: string) => PublicCacheHit | PublicCachePass;
+    servePublicJson: (event: CacheEvent, projectId: string, scope: string, pass: PublicCachePass, payload: unknown) => Response;
+    servePublicNotFound: (event: CacheEvent, pass: PublicCachePass) => Response;
+    serveImmutableJson: (event: CacheEvent, payload: unknown) => Response;
+    serveImmutableNotFound: (event: CacheEvent) => Response;
+};
+export type CmsResponders = ReturnType<typeof createResponders>;
+export {};