astro-dev-edit 0.11.0

package/src/server/editor.ts

@@ -0,0 +1,15 @@
+/**
+ * Launch the user's editor at a file spec — the one place the `launch-editor`
+ * package is invoked, shared by the /open and /inspect/open routes.
+ */
+
+/** Spawn the editor for `spec` (an abs path, or "abs:line" / "abs:line:col"). */
+export async function launchInEditor(spec: string, onError?: () => void): Promise<void> {
+  // launch-editor is CommonJS: the module IS the function. Interop may wrap it
+  // under .default depending on the loader, so handle both.
+  const mod = (await import('launch-editor')) as unknown as
+    | ((f: string, onError?: () => void) => void)
+    | { default: (f: string, onError?: () => void) => void };
+  const launch = typeof mod === 'function' ? mod : mod.default;
+  launch(spec, onError);
+}

package/src/server/entry-detect.ts

@@ -0,0 +1,110 @@
+import { readFile, stat } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import type { RouteManifest } from './route-manifest.ts';
+
+/**
+ * "Which collection does this page route render?" — the layer between a URL's
+ * page file and an entry file.
+ *
+ * Matching a URL's last segment against entry ids alone is not enough to be
+ * safe: two collections holding a `hello-world.md` are indistinguishable that
+ * way, and the honest answer would be a refusal on a site where nothing is
+ * actually ambiguous. Astro's own route file says which collection it renders —
+ * `getCollection('blog')` is right there in the frontmatter — so we read it.
+ *
+ * **A scan, not a parse.** The same stance `patcher/content-config.ts` takes,
+ * for the same reason: Vite's `parseAst` throws on `import type`, `satisfies`
+ * and type annotations, all legitimate in a page's frontmatter, and a parser
+ * that refuses real files is worse than a scanner that sometimes finds nothing.
+ * Finding nothing is a supported outcome here — a route that fetches through a
+ * helper names no collection, and the caller falls back to matching against
+ * every collection the user has switched on.
+ *
+ * Nothing here decides anything. It reports what the source says; the resolver
+ * decides, and refuses when the answer isn't unique.
+ */
+
+/**
+ * Collection names a page's source names, in first-seen order.
+ *
+ * Deliberately narrow: only the two calls that take a collection name as a
+ * string literal. `getCollection(name)` with a variable is not matched, and
+ * should not be — a name this cannot prove is a name it must not report.
+ */
+export function collectionsNamedIn(source: string): string[] {
+  const out: string[] = [];
+  const re = /\bget(?:Collection|Entry)\s*\(\s*(['"])([A-Za-z0-9_$-]+)\1/g;
+  for (const m of source.matchAll(re)) {
+    if (!out.includes(m[2])) out.push(m[2]);
+  }
+  return out;
+}
+
+export interface DetailRoutes {
+  /** Collections the page at this root-relative path names. Empty when it names
+   *  none — a route that fetches through a helper, or a file we can't read. */
+  collectionsIn(file: string): Promise<string[]>;
+  /** The first dynamic page route naming this collection, or null. What the
+   *  Collections panel shows beside a row so the binding is visible. */
+  patternFor(collection: string): Promise<string | null>;
+}
+
+export interface DetailRoutesDeps {
+  /** Project root (fsPath). */
+  root: string;
+  /** Astro's route manifest, or null when there is none — then nothing is
+   *  detected and every answer is empty, never a guess. */
+  routeManifest: RouteManifest | null;
+  /** Seam for tests. Defaults to reading the file; a throw reads as "names
+   *  nothing", since a page we cannot read cannot be said to name anything. */
+  readSource?: (abs: string) => Promise<string>;
+  /** Seam for tests; the mtime a cached scan is keyed on. */
+  mtimeOf?: (abs: string) => Promise<number>;
+}
+
+/**
+ * A scanner with a per-file cache keyed on mtime.
+ *
+ * The cache matters because both callers are on hot paths — the resolver runs
+ * on every page load, the panel on every open — while page frontmatter changes
+ * rarely. Keying on mtime rather than clearing on HMR keeps it correct without
+ * this module having to know when Astro re-fires anything.
+ */
+export function createDetailRoutes(deps: DetailRoutesDeps): DetailRoutes {
+  const { root, routeManifest } = deps;
+  const readSource = deps.readSource ?? ((abs: string) => readFile(abs, 'utf8'));
+  const mtimeOf = deps.mtimeOf ?? (async (abs: string) => (await stat(abs)).mtimeMs);
+
+  const cache = new Map<string, { mtime: number; names: string[] }>();
+
+  async function collectionsIn(file: string): Promise<string[]> {
+    const abs = resolve(root, file);
+    let mtime: number;
+    try {
+      mtime = await mtimeOf(abs);
+    } catch {
+      return [];
+    }
+    const hit = cache.get(abs);
+    if (hit && hit.mtime === mtime) return hit.names;
+    let names: string[];
+    try {
+      names = collectionsNamedIn(await readSource(abs));
+    } catch {
+      names = [];
+    }
+    cache.set(abs, { mtime, names });
+    return names;
+  }
+
+  return {
+    collectionsIn,
+
+    async patternFor(collection) {
+      for (const page of routeManifest?.dynamicPages() ?? []) {
+        if ((await collectionsIn(page.file)).includes(collection)) return page.pattern;
+      }
+      return null;
+    },
+  };
+}

package/src/server/entry-resolve-routes.ts

@@ -0,0 +1,218 @@
+import type { AstroIntegrationLogger } from 'astro';
+import { resolve } from 'node:path';
+import type { EntryResolveRefusal, EntryResolveRequest, EntryResolveResponse } from '../shared/protocol.ts';
+import { entryId, inContentRoots, listEntryFiles } from './collection-entries.ts';
+import type { EntryCollectionInfo, EntrySchemaProvider } from './content-config.ts';
+import type { DetailRoutes } from './entry-detect.ts';
+import { ENTRY_EXTENSIONS } from './entry-routes.ts';
+import type { OptionsResolver } from './options.ts';
+import type { RouteManifest } from './route-manifest.ts';
+import type { Route } from './router.ts';
+
+/**
+ * The entry-resolve route group (`/entry/resolve`) — "which content entry backs
+ * the page I am looking at?", answered so a project need not emit the
+ * `astro-dev-edit:page-source` meta tag by hand.
+ *
+ * Its own module rather than a corner of `entry-routes.ts`, for the reason
+ * `page-source-routes.ts` is its own module: that group's routes all take a
+ * **file** and write it, while this one takes a **pathname** and writes nothing.
+ * It is resolve-only — the file it names is handed back to the client, which
+ * POSTs it to `/entry` like any other, and passes that group's own path gate
+ * there. Nothing here opens, reads or writes an entry.
+ *
+ * **A refusal is an answer.** Every failure path names why, and the client keeps
+ * the entry button hidden — exactly the behaviour a page with no meta tag has
+ * today. The one refusal that carries data is `not-enabled`: the entry was
+ * found and its collection is switched off, so the refusal notice can name what
+ * it is offering to switch on.
+ *
+ * ## Why three layers
+ *
+ * Matching a URL's tail against entry ids alone would answer, but not safely.
+ * Two collections holding a `hello-world.md` are indistinguishable that way, and
+ * a dynamic pattern matches far more paths than it generates — the bug behind
+ * issue #8, where a dead URL resolved to a real route file. So:
+ *
+ *  1. **The route manifest** maps the pathname to a page file and a pattern, and
+ *     a pattern with no dynamic segment is refused outright: a listing route
+ *     renders a set of entries with no single backing file.
+ *  2. **The page file is scanned** for `getCollection('x')`, which binds route
+ *     to collection from the user's own source rather than by inference.
+ *  3. **The pathname's tail is matched** against those collections' entry ids.
+ *
+ * Layer 3 is what makes a dead URL safe: the id of a path nobody wrote is not a
+ * file on disk, so the answer is `no-entry` rather than someone else's entry.
+ */
+
+export interface EntryResolveRouteDeps {
+  logger: AstroIntegrationLogger;
+  /** Project root (fsPath). */
+  root: string;
+  /** Live options — `entryEditor` gates the group, `contentRoots` confines every
+   *  directory read, `editableExtensions` narrows which files count as entries. */
+  optionsResolver: OptionsResolver;
+  /** Collection lookup. Null → nothing resolves, answered as a refusal. */
+  schemaProvider: EntrySchemaProvider | null;
+  /** Astro's route manifest, or null when there is none. */
+  routeManifest: RouteManifest | null;
+  /** The route→collection scan. Null → every enabled collection stays a
+   *  candidate, and layer 3 alone has to be unique. */
+  detailRoutes: DetailRoutes | null;
+}
+
+/** A refusal, as the wire carries it. */
+function refuse(
+  refusal: EntryResolveRefusal,
+  extra: Partial<EntryResolveResponse> = {},
+): { status: 200; body: EntryResolveResponse } {
+  return {
+    status: 200,
+    body: {
+      file: null,
+      collection: null,
+      entryFile: null,
+      pageEditingLocked: false,
+      pattern: null,
+      refusal,
+      ...extra,
+    },
+  };
+}
+
+/**
+ * A browser pathname reduced to what an entry id could equal.
+ *
+ * Only the parts an id can carry: the base is already stripped by the route
+ * manifest's own matching, so what is left is percent-decoding, collapsing
+ * repeated slashes, and dropping the trailing one. An index route's pathname
+ * ends `/`, and after this it is the parent path — which is correct, since an
+ * entry named `index` sits at its parent's URL.
+ */
+function normalizePath(pathname: string): string {
+  let p = pathname;
+  const cut = p.search(/[?#]/);
+  if (cut !== -1) p = p.slice(0, cut);
+  try {
+    p = decodeURI(p);
+  } catch {
+    /* a malformed escape simply won't match anything */
+  }
+  p = p.normalize().replace(/\/{2,}/g, '/');
+  return p.length > 1 && p.endsWith('/') ? p.slice(0, -1) : p;
+}
+
+/** Whether a route pattern renders one of a set rather than exactly one page. */
+function isDynamic(pattern: string): boolean {
+  return pattern.includes('[');
+}
+
+interface Candidate {
+  collection: string;
+  file: string;
+  /** Length of the id that matched, so the most specific one can win. */
+  idLength: number;
+}
+
+export function createEntryResolveRoutes(deps: EntryResolveRouteDeps): Route[] {
+  const { logger, root, optionsResolver, schemaProvider, routeManifest, detailRoutes } = deps;
+
+  return [
+    {
+      method: 'POST',
+      path: '/entry/resolve',
+      maxBytes: 4 * 1024,
+      label: 'entry resolve',
+      handler: async (body) => {
+        const { options } = await optionsResolver.resolve();
+        if (options.entryEditor === false) return refuse('disabled');
+
+        const { pathname } = (body ?? {}) as EntryResolveRequest;
+        if (typeof pathname !== 'string' || pathname === '') {
+          throw new Error('pathname is required');
+        }
+
+        // --- layer 1: which page renders this URL --------------------------
+        const hit = routeManifest?.forPathname(pathname);
+        if (!hit) return refuse('no-routes');
+        if (!hit.ok) return refuse(hit.refusal === 'no-routes' ? 'no-routes' : 'no-match');
+        if (!isDynamic(hit.pattern)) return refuse('not-detail', { pattern: hit.pattern });
+
+        const all = (await schemaProvider?.listCollections()) ?? [];
+        if (all.length === 0) return refuse('no-entry', { pattern: hit.pattern });
+
+        // --- layer 2: which collection that page renders --------------------
+        // A name the scan reports but the project doesn't declare is dropped
+        // rather than trusted; finding none leaves every collection a candidate,
+        // which is the honest state for a route that fetches through a helper.
+        const named = (await detailRoutes?.collectionsIn(hit.file)) ?? [];
+        const declared = new Set(all.map((c) => c.collection));
+        const scoped = named.filter((n) => declared.has(n));
+        const candidates: EntryCollectionInfo[] =
+          scoped.length > 0 ? all.filter((c) => scoped.includes(c.collection)) : all;
+
+        // --- layer 3: which entry ------------------------------------------
+        const target = normalizePath(pathname);
+        const extensions = ENTRY_EXTENSIONS.filter((e) => options.editableExtensions.includes(e));
+        const matches: Candidate[] = [];
+        for (const info of candidates) {
+          const dirAbs = resolve(root, info.dir);
+          // The same confinement `/collection/entries` applies. A collection
+          // pointed outside the content roots is not listed, not refused: another
+          // collection may still answer.
+          if (!inContentRoots(root, dirAbs, options.contentRoots)) continue;
+          const { names } = await listEntryFiles(dirAbs, extensions);
+          for (const name of names) {
+            const id = entryId(name);
+            if (target === `/${id}` || target.endsWith(`/${id}`)) {
+              matches.push({ collection: info.collection, file: `${info.dir}/${name}`, idLength: id.length });
+            }
+          }
+        }
+
+        if (matches.length === 0) return refuse('no-entry', { pattern: hit.pattern });
+
+        // The longest id wins, which is how a nested id (`2026/hello`) beats a
+        // leaf of the same name (`hello`) on the URL they share a tail of. A tie
+        // is a genuine ambiguity and refuses rather than picking.
+        matches.sort((a, b) => b.idLength - a.idLength);
+        if (matches.length > 1 && matches[1].idLength === matches[0].idLength) {
+          logger.debug(
+            `entry resolve: ${pathname} matches ${matches
+              .filter((m) => m.idLength === matches[0].idLength)
+              .map((m) => m.file)
+              .join(', ')}`,
+          );
+          return refuse('ambiguous', { pattern: hit.pattern });
+        }
+
+        const best = matches[0];
+        const info = candidates.find((c) => c.collection === best.collection);
+        if (info?.pageEditing !== true) {
+          // Found it, and the user hasn't switched this collection on. Both
+          // names travel so the notice can offer exactly this, by name.
+          return refuse('not-enabled', {
+            collection: best.collection,
+            entryFile: best.file,
+            // Offering a switch whose write would be refused is worse than not
+            // offering it, so the notice is told not to.
+            pageEditingLocked:
+              optionsResolver.entryEditorConfig()?.collections?.[best.collection]?.pageEditing !==
+              undefined,
+            pattern: hit.pattern,
+          });
+        }
+
+        const found: EntryResolveResponse = {
+          file: best.file,
+          collection: best.collection,
+          entryFile: best.file,
+          pageEditingLocked: false,
+          pattern: hit.pattern,
+          refusal: null,
+        };
+        return { status: 200, body: found };
+      },
+    },
+  ];
+}

package/src/server/entry-routes.ts

@@ -0,0 +1,304 @@
+import { directWrite, type TextWriter } from './text-writes.ts';
+import type { AstroIntegrationLogger } from 'astro';
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { readdir, readFile, realpath, unlink } from 'node:fs/promises';
+import { basename, join, relative, resolve, sep } from 'node:path';
+import { applyEntryChanges, parseEntry, serializeEntry } from '../patcher/frontmatter.ts';
+import type {
+  EntryApplyRequest,
+  EntryCreateRequest,
+  EntryDeleteRequest,
+  EntryRequest,
+  FieldDescriptor,
+} from '../shared/protocol.ts';
+import { slugify } from '../shared/slug.ts';
+import type { EntryCollectionInfo, EntrySchemaProvider } from './content-config.ts';
+import type { OptionsResolver } from './options.ts';
+import { validateEditablePath } from './paths.ts';
+import type { Route } from './router.ts';
+import {
+  inferFields,
+  validateChanges,
+  validateFull,
+  zodToFields,
+} from './schema-introspect.ts';
+
+/**
+ * The entry-editor route group (/entry, /entry/apply, /entry/create,
+ * /entry/delete) — the CMS surface over content-collection entries. A feature
+ * route module: it exports a `Route[]` that the middleware concatenates into
+ * its table, so this file owns everything entry-specific (etag guards, schema
+ * validation, field assembly) and the middleware stays a thin composition
+ * point. Localhost rejection and dispatch plumbing stay with the middleware.
+ */
+
+export interface EntryRouteDeps {
+  writeText?: TextWriter;
+  logger: AstroIntegrationLogger;
+  /** Project root (fsPath). Every served path is confined to this. */
+  root: string;
+  /** Live options — `entryEditor` gates the group, and `contentRoots` /
+   *  `editableExtensions` are the confinement every path here passes through.
+   *  Resolved per request so a change from the Settings panel applies without a
+   *  dev-server restart. */
+  optionsResolver: OptionsResolver;
+  /** Collection/schema lookup; null → inference only. */
+  schemaProvider: EntrySchemaProvider | null;
+}
+
+/** Extensions the entry editor treats as collection entries. */
+export const ENTRY_EXTENSIONS = ['.md', '.mdx'];
+
+function sha256(text: string): string {
+  return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+
+/** Extension for a newly created entry: the collection's configured one wins;
+ *  otherwise, when every existing entry in the dir shares one extension, new
+ *  entries follow it; mixed or empty collections fall back to .md. */
+async function pickEntryExtension(info: EntryCollectionInfo, dirAbs: string): Promise<string> {
+  if (info.extension) return info.extension;
+  try {
+    const files = await readdir(dirAbs, { recursive: true });
+    const seen = new Set<string>();
+    for (const f of files) {
+      const ext = ENTRY_EXTENSIONS.find((e) => String(f).endsWith(e));
+      if (ext) seen.add(ext);
+    }
+    if (seen.size === 1) return [...seen][0];
+  } catch {
+    // Unreadable dir — the create itself will surface the real error.
+  }
+  return '.md';
+}
+
+/** Assemble the panel's field list: schema-derived when possible (with
+ *  presence marked and extra file keys appended as inferred), else inferred
+ *  entirely from the entry's values; config overrides applied last. */
+function assembleFields(
+  info: EntryCollectionInfo | null,
+  data: Record<string, unknown>,
+): FieldDescriptor[] {
+  let fields = info?.schema ? zodToFields(info.schema) : null;
+  if (fields) {
+    for (const f of fields) f.present = f.name in data;
+    const extras = Object.fromEntries(
+      Object.entries(data).filter(([k]) => !fields!.some((f) => f.name === k)),
+    );
+    fields = fields.concat(inferFields(extras));
+  } else {
+    fields = inferFields(data);
+  }
+  const overrides = info?.fieldConfig ?? {};
+  return fields
+    .filter((f) => !overrides[f.name]?.hidden)
+    .map((f) => {
+      const o = overrides[f.name];
+      if (!o) return f;
+      return { ...f, ...(o.widget ? { type: o.widget } : {}), ...(o.label ? { label: o.label } : {}) };
+    });
+}
+
+export function createEntryRoutes(deps: EntryRouteDeps): Route[] {
+  const { logger, root, optionsResolver, schemaProvider } = deps;
+  const writeText: TextWriter = deps.writeText ?? directWrite;
+
+  /** The effective options, plus the entry-specific extension allowlist derived
+   *  from them: same confinement as edits, but only markdown-family files are
+   *  collection entries. */
+  async function gate(): Promise<{
+    contentRoots: string[];
+    entryExtensions: string[];
+    enabled: boolean;
+  }> {
+    const { options } = await optionsResolver.resolve();
+    return {
+      contentRoots: options.contentRoots,
+      entryExtensions: ENTRY_EXTENSIONS.filter((e) => options.editableExtensions.includes(e)),
+      enabled: options.entryEditor !== false,
+    };
+  }
+
+  async function validateEntryPath(file: string): Promise<string> {
+    const { contentRoots, entryExtensions, enabled } = await gate();
+    if (!enabled) throw new Error('the entry editor is disabled by configuration');
+    if (typeof file !== 'string' || !file) throw new Error('file is required');
+    return validateEditablePath(root, contentRoots, entryExtensions, file);
+  }
+
+  // Paths coming back from validation are realpath'd; compare against the
+  // realpath'd root or symlinked roots (macOS /var → /private/var) mis-relativize.
+  let rootRealCache: string | null = null;
+  async function relToRoot(abs: string): Promise<string> {
+    rootRealCache ??= await realpath(root);
+    return relative(rootRealCache, abs).split(sep).join('/');
+  }
+
+  return [
+    // Read a collection entry as fields + body.
+    {
+      method: 'POST',
+      path: '/entry',
+      maxBytes: 64 * 1024,
+      label: 'entry read',
+      handler: async (body) => {
+        const { file } = body as EntryRequest;
+        const abs = await validateEntryPath(file);
+        const source = await readFile(abs, 'utf8');
+        const parsed = parseEntry(source);
+        const rel = await relToRoot(abs);
+        const info = (await schemaProvider?.forFile(rel)) ?? null;
+        return {
+          status: 200,
+          body: {
+            file: rel,
+            etag: sha256(source),
+            collection: info?.collection ?? null,
+            collectionDir: info?.dir ?? null,
+            fields: assembleFields(info, parsed.data),
+            values: parsed.data,
+            body: parsed.body,
+            bodyEditable: true,
+          },
+        };
+      },
+    },
+
+    // Verified, atomic multi-field write: etag guards against a file that
+    // changed since the panel read it; changed keys are validated against the
+    // project's own zod schema before anything touches disk.
+    {
+      method: 'POST',
+      path: '/entry/apply',
+      maxBytes: 1024 * 1024,
+      label: 'entry apply',
+      handler: async (body) => {
+        const { file, etag, changes } = body as EntryApplyRequest;
+        const abs = await validateEntryPath(file);
+        if (typeof etag !== 'string' || !etag) throw new Error('etag is required');
+        if (!changes || typeof changes !== 'object') throw new Error('changes are required');
+
+        const source = await readFile(abs, 'utf8');
+        if (sha256(source) !== etag) {
+          return {
+            status: 409,
+            body: { error: 'file changed on disk since it was loaded', code: 'conflict' },
+          };
+        }
+
+        const fmChanges = changes.frontmatter ?? {};
+        if (Object.keys(fmChanges).length > 0 && schemaProvider) {
+          const rel = await relToRoot(abs);
+          const info = await schemaProvider.forFile(rel);
+          if (info?.schema) {
+            const fieldErrors = validateChanges(info.schema, fmChanges);
+            if (Object.keys(fieldErrors).length > 0) {
+              return {
+                status: 422,
+                body: { error: 'validation failed', code: 'validation', fieldErrors },
+              };
+            }
+          }
+        }
+
+        const result = applyEntryChanges(source, changes);
+        if (!result.ok) {
+          return { status: 422, body: { error: result.error, code: 'unsupported' } };
+        }
+        await writeText(abs, result.newSource, source);
+        logger.info(`entry saved -> ${basename(abs)}`);
+        return { status: 200, body: { ok: true } };
+      },
+    },
+
+    // Create a new entry in a collection's directory. Full-object validation,
+    // sanitized slug, never overwrites. Extension: configured per collection,
+    // else inferred from existing entries, else .md.
+    {
+      method: 'POST',
+      path: '/entry/create',
+      maxBytes: 1024 * 1024,
+      label: 'entry create',
+      handler: async (body) => {
+        const { contentRoots, entryExtensions, enabled } = await gate();
+        if (!enabled) throw new Error('the entry editor is disabled by configuration');
+        const { collection, slug, frontmatter, body: entryBody } = body as EntryCreateRequest;
+        if (!collection || typeof collection !== 'string') throw new Error('collection is required');
+        const cleanSlug = slugify(String(slug ?? ''));
+        if (!cleanSlug) throw new Error('slug is required');
+        if (!frontmatter || typeof frontmatter !== 'object') throw new Error('frontmatter is required');
+
+        const info = (await schemaProvider?.forCollection(collection)) ?? null;
+        if (!info) {
+          return { status: 422, body: { error: `unknown collection "${collection}"` } };
+        }
+
+        // Confine the target dir exactly like an edit path would be.
+        const dirAbs = resolve(root, info.dir);
+        if (!existsSync(dirAbs)) {
+          return { status: 422, body: { error: `collection directory ${info.dir} does not exist` } };
+        }
+        const dirReal = await realpath(dirAbs);
+        const relDir = relative(await realpath(root), dirReal);
+        const inContentRoot = contentRoots.some(
+          (cr) => relDir === cr || relDir.startsWith(cr.endsWith(sep) ? cr : cr + sep),
+        );
+        if (relDir.startsWith('..') || !inContentRoot) {
+          throw new Error('collection directory is outside the editable content roots');
+        }
+        const ext = await pickEntryExtension(info, dirReal);
+        if (!entryExtensions.includes(ext)) {
+          return { status: 422, body: { error: `${ext} entries are not editable by configuration` } };
+        }
+
+        const abs = join(dirReal, `${cleanSlug}${ext}`);
+        if (existsSync(abs)) {
+          return { status: 409, body: { error: `${cleanSlug}${ext} already exists`, code: 'exists' } };
+        }
+
+        if (info.schema) {
+          const fieldErrors = validateFull(info.schema, frontmatter);
+          if (Object.keys(fieldErrors).length > 0) {
+            return {
+              status: 422,
+              body: { error: 'validation failed', code: 'validation', fieldErrors },
+            };
+          }
+        }
+
+        // Drop empty-string values so schema defaults apply instead.
+        const values = Object.fromEntries(
+          Object.entries(frontmatter).filter(([, v]) => v !== '' && v !== null && v !== undefined),
+        );
+        await writeText(abs, serializeEntry(values, String(entryBody ?? '')), null);
+        const rel = await relToRoot(abs);
+        logger.info(`entry created -> ${rel}`);
+        return { status: 200, body: { file: rel } };
+      },
+    },
+
+    // Delete an entry. Etag-guarded; undo is git.
+    {
+      method: 'POST',
+      path: '/entry/delete',
+      maxBytes: 64 * 1024,
+      label: 'entry delete',
+      handler: async (body) => {
+        const { file, etag } = body as EntryDeleteRequest;
+        const abs = await validateEntryPath(file);
+        if (typeof etag !== 'string' || !etag) throw new Error('etag is required');
+        const source = await readFile(abs, 'utf8');
+        if (sha256(source) !== etag) {
+          return {
+            status: 409,
+            body: { error: 'file changed on disk since it was loaded', code: 'conflict' },
+          };
+        }
+        await unlink(abs);
+        logger.info(`entry deleted -> ${basename(abs)}`);
+        return { status: 200, body: { ok: true } };
+      },
+    },
+  ];
+}