# FAQ

Common questions about the Generic CMS Module. Operator-focused.

## 1. How do I add a new content type?

Create a file in `cms/schemas/{name}.js` that exports a `Schema` instance.
See `USAGE.md` → "Adding a content type" for the full example with a
9-field book schema. The schema auto-registers when the module loads.

## 2. Where is admin?

`/admin` on your site. Make sure your host redirects `/admin*` to
`admin.html` so the SPA route works on refresh. See
[MIGRATION.md step 6](../MIGRATION.md#step-6--deploy).

## 3. What if I forget my password?

Use the 12-word recovery phrase. The setup flow writes it down once and
asks you to save it offline. Without the phrase, the only reset is to
wipe the `cms:admin:auth` key in localStorage — and that **deletes
your admin user**. Save the phrase.

## 4. Can two people edit at once?

Not in v1.0. There is one admin per device. Each device has its own
localStorage admin. For shared editing, use the bulk export / import
flow (`USAGE.md` → "Backups and migrations"). v2.0 will add a remote
adapter.

## 5. What does this CMS store about me?

Activity log: every create / update / delete with a timestamp and the
admin's user id. It is local-only — never sent off-device. See
[SECURITY.md → Privacy](../SECURITY.md#privacy--gdpr) and `docs/A11Y.md`.

## 6. Why is my backup envelope not smaller?

The envelope stores *records*, not a database dump. A 1000-record book
schema with rich blurb text produces a ~1 MB envelope. See
`tests/test-backup-size.js` (BSZ1) — the limit is 5 MB to fit under
the typical localStorage quota.

## 7. Can I import data from Sanity / Contentful / Airtable?

Yes. Each source has a recipe in `MIGRATION.md`. The general flow is:
export from the source CMS, write to the matching storage key, run
`exportBackup()` to produce the envelope, then `applyImport()` on the
target site.

## 8. Why is the activity log capped at 5000?

The cap protects localStorage. Each entry is ~200 bytes after JSON,
so 5000 entries ≈ 1 MB. When the cap is hit, the oldest entries are
trimmed. Bump the cap in `activity.js` if you have a larger browser
quota. See TRACK-6-RETENTION in the Track 5 report.

## 9. Do I need HTTPS?

Strongly recommended. The auth flow uses sessionStorage + cookies over
HTTPS for `SameSite=Lax`. On plain HTTP, passwords are readable on the
wire. See [SECURITY.md → Transport](../SECURITY.md#security-checklist-operator).

## 10. Can I use this with a remote database?

Not in v1.0. The default storage adapter is `localStorage` and the
`MemoryStorageAdapter` is for tests. A `RemoteAdapter` (KV / D1 /
Supabase) is scheduled for v2.0. Until then, run the admin from a
single device or sync via backups.