@acms-subir/core 0.0.1

package/cli.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// `acms` — tiny maintenance CLI installed with @acms-subir/core.
+//   acms update   check the registry, install the latest core, print what's new
+//   acms doctor   sanity-check the project setup
+import { spawnSync } from 'node:child_process';
+import { readFileSync, existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+
+const PKG = '@acms-subir/core';
+const cmd = process.argv[2];
+
+const read = (p) => { try { return readFileSync(p, 'utf8'); } catch { return ''; } };
+const installedVersion = () => {
+  try {
+    const require = createRequire(join(process.cwd(), 'package.json'));
+    return JSON.parse(readFileSync(require.resolve(`${PKG}/package.json`), 'utf8')).version;
+  } catch { return null; }
+};
+const latestVersion = async () => {
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`);
+  if (!res.ok) throw new Error(`registry responded ${res.status}`);
+  return (await res.json()).version;
+};
+const semverLt = (a, b) => {
+  const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
+  return false;
+};
+
+if (cmd === 'update') {
+  const current = installedVersion();
+  if (!current) { console.error(`✗ ${PKG} is not installed here — run this from your site's folder.`); process.exit(1); }
+  let latest;
+  try { latest = await latestVersion(); } catch (e) { console.error(`✗ Could not reach the npm registry (${e.message}).`); process.exit(1); }
+  if (!semverLt(current, latest)) {
+    console.log(`✓ Already up to date (${current}).`);
+    process.exit(0);
+  }
+  console.log(`Updating ${PKG} ${current} → ${latest}…`);
+  const res = spawnSync('npm', ['install', `${PKG}@latest`, '--no-audit', '--no-fund'], { stdio: 'inherit' });
+  if (res.status !== 0) process.exit(res.status ?? 1);
+  console.log(`
+✓ Updated to ${latest}. What's new: https://github.com/zurielbm/acms-subir/releases
+  Deploy when ready:  npm run deploy
+  (the database migrates itself on the first request — no manual steps)`);
+} else if (cmd === 'doctor') {
+  let bad = 0;
+  const check = (ok, label, hint) => {
+    console.log(`${ok ? '✓' : '✗'} ${label}${ok || !hint ? '' : `\n    ↳ ${hint}`}`);
+    if (!ok) bad++;
+  };
+  const major = Number(process.versions.node.split('.')[0]);
+  check(major >= 20, `Node ${process.versions.node} (need ≥20)`, 'Upgrade Node.');
+  check(installedVersion() !== null, `${PKG} resolvable`, 'npm install');
+  const cfg = read('astro.config.mjs') + read('astro.config.ts');
+  check(/@acms-subir\/core/.test(cfg), 'astro.config uses the acms integration', "import acms from '@acms-subir/core'");
+  check(/export\s+\{\s*server\s*\}/.test(read('src/actions/index.ts')), 'src/actions/index.ts re-exports core actions', "export { server } from '@acms-subir/core/actions';");
+  const wrangler = read('wrangler.jsonc') + read('wrangler.json') + read('wrangler.toml');
+  if (wrangler) {
+    check(!wrangler.includes('00000000-0000-0000-0000-000000000000'), 'wrangler D1 database_id is real', 'npx wrangler d1 create <name>-db, then paste the id.');
+  } else {
+    console.log('• no wrangler config (Node target?) — skipping Cloudflare checks');
+  }
+  check(existsSync('.dev.vars') || existsSync('.env'), 'local secrets file (.env / .dev.vars)', 'Set ADMIN_PASSWORD and SESSION_SECRET.');
+  console.log(bad === 0 ? '\nAll good.' : `\n${bad} issue${bad > 1 ? 's' : ''} found.`);
+  process.exit(bad === 0 ? 0 : 1);
+} else {
+  console.log(`acms — maintenance CLI for @acms-subir/core
+
+Usage:
+  acms update   Update the CMS core to the latest release
+  acms doctor   Check this project's setup`);
+  process.exit(cmd ? 1 : 0);
+}

package/integration.mjs

@@ -0,0 +1,286 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+// This file is loaded by Node while Astro evaluates the consumer's
+// astro.config, so it must stay plain .mjs — Node does not strip TypeScript
+// from node_modules. Everything it points at (routes, middleware, worker)
+// is processed by Vite inside the consumer's build, so those stay .ts/.astro.
+
+const entry = (p) => fileURLToPath(new URL(p, import.meta.url));
+
+const CORE_VERSION = JSON.parse(
+  readFileSync(new URL('./package.json', import.meta.url), 'utf8')
+).version;
+
+// The Workers entrypoint with the scheduled() cron handler. The adapter's
+// workerEntryPoint option needs a real file path, and only the consumer's
+// config can construct the adapter — so this is exported for it:
+//   cloudflare({ workerEntryPoint: { path: workerEntrypoint, namedExports: [] } })
+export const workerEntrypoint = entry('./src/worker.ts');
+
+// pattern → file under src/pages/, mirroring Astro's file-based conventions.
+// Project-local routes take precedence over injected ones, so a consumer can
+// override any public page by creating the same path in their own src/pages.
+const ROUTES = [
+  // public site (post + tag routes are built from config in acms() below)
+  ['/', 'index.astro'],
+  ['/[...slug]', '[...slug].astro'],
+  ['/author/[slug]', 'author/[slug].astro'],
+  ['/links', 'links.astro'],
+  ['/search', 'search.astro'],
+  ['/go/[id]', 'go/[id].ts'],
+  ['/media/[...key]', 'media/[...key].ts'],
+  ['/embed/[pageId]/[blockId]', 'embed/[pageId]/[blockId].ts'],
+  ['/preview/[type]/[id]', 'preview/[type]/[id].astro'],
+  ['/rss.xml', 'rss.xml.ts'],
+  ['/sitemap.xml', 'sitemap.xml.ts'],
+  ['/robots.txt', 'robots.txt.ts'],
+  ['/llms.txt', 'llms.txt.ts'],
+  // admin
+  ['/admin', 'admin/index.astro'],
+  ['/admin/design', 'admin/design.astro'],
+  ['/admin/links', 'admin/links.astro'],
+  ['/admin/login', 'admin/login.astro'],
+  ['/admin/logout', 'admin/logout.ts'],
+  ['/admin/media', 'admin/media.astro'],
+  ['/admin/navigation', 'admin/navigation.astro'],
+  ['/admin/pages', 'admin/pages/index.astro'],
+  ['/admin/pages/[id]', 'admin/pages/[id].astro'],
+  // collection-scoped content lists + editors; [collection] is the config key
+  ['/admin/c/[collection]', 'admin/c/[collection]/index.astro'],
+  ['/admin/c/[collection]/[id]', 'admin/c/[collection]/[id].astro'],
+  // legacy paths for the built-in collection — thin 301s to /admin/c/posts
+  ['/admin/posts', 'admin/posts/index.astro'],
+  ['/admin/posts/[id]', 'admin/posts/[id].astro'],
+  ['/admin/settings', 'admin/settings.astro'],
+  ['/admin/tags', 'admin/tags.astro'],
+  ['/admin/users', 'admin/users.astro'],
+  // API
+  ['/api/backup', 'api/backup.ts'],
+  ['/api/drafts', 'api/drafts.ts'],
+  ['/api/media/upload', 'api/media/upload.ts'],
+  ['/api/restore', 'api/restore.ts'],
+];
+
+// First segments of the fixed routes above — a configured base landing on one
+// of these would shadow a real page, so it's a build-time error.
+const RESERVED_BASES = new Set([
+  '/admin', '/api', '/author', '/embed', '/go', '/links', '/media', '/preview', '/search',
+]);
+
+// Collection keys that would collide with admin sections or read ambiguously.
+// The key is the permanent internal identifier (stored on rows, used in
+// /admin/c/<key> URLs) — labels and bases stay freely renameable instead.
+const RESERVED_COLLECTION_KEYS = new Set(['pages', 'tags', 'media', 'links', 'users', 'new']);
+
+// Defaults + validation for acms({ content }). Runs while astro.config is
+// evaluated, so a bad key or base fails the build with a fixable message
+// instead of deploying broken routes. The resolved object is what pages see
+// at runtime via virtual:acms-config, so lib/content.ts never re-validates.
+function resolveContent(content = {}) {
+  // Unknown keys fail loudly — a typo must never leave the config author
+  // staring at an unchanged UI.
+  const unknown = Object.keys(content).filter((k) => !['posts', 'collections', 'tags'].includes(k));
+  if (unknown.length > 0) {
+    throw new Error(
+      `acms: unknown content key${unknown.length > 1 ? 's' : ''} ${unknown.map((k) => `"${k}"`).join(', ')} — ` +
+        'collections go under content.collections; content.posts and content.tags are the other valid keys'
+    );
+  }
+  const extra = content.collections ?? {};
+  if (content.posts && extra.posts) {
+    throw new Error('acms: content.posts and content.collections.posts are both set — configure the built-in collection in one place');
+  }
+  // `posts` always exists (the built-in collection); content.posts is sugar
+  // for content.collections.posts. Insertion order drives sidebar/nav order.
+  const defs = { posts: content.posts ?? extra.posts ?? {}, ...Object.fromEntries(Object.entries(extra).filter(([k]) => k !== 'posts')) };
+
+  const collections = {};
+  for (const [key, def] of Object.entries(defs)) {
+    if (!/^[a-z0-9-]+$/.test(key)) {
+      throw new Error(`acms: collection key "${key}" must use lowercase letters, digits, and hyphens only`);
+    }
+    if (key !== 'posts' && RESERVED_COLLECTION_KEYS.has(key)) {
+      throw new Error(`acms: collection key "${key}" is reserved (it collides with an admin section) — pick another key`);
+    }
+    const fallbackPlural = key === 'posts' ? 'Posts' : key.charAt(0).toUpperCase() + key.slice(1);
+    const plural = def.plural ?? fallbackPlural;
+    collections[key] = {
+      singular: def.singular ?? (key === 'posts' ? 'Post' : plural.endsWith('s') ? plural.slice(0, -1) : plural),
+      plural,
+      base: def.base ?? (key === 'posts' ? '/blog' : `/${key}`),
+      redirectFrom: def.redirectFrom ?? [],
+    };
+  }
+  const resolved = { collections, tags: { base: (content.tags ?? {}).base ?? '/tag' } };
+
+  const seen = new Map();
+  const labeled = [
+    ...Object.entries(collections).map(([k, c]) => [`content.collections.${k}.base`, c.base]),
+    ['content.tags.base', resolved.tags.base],
+  ];
+  for (const [label, base] of labeled) {
+    if (!/^\/[a-z0-9-]+(\/[a-z0-9-]+)*$/.test(base)) {
+      throw new Error(
+        `acms: ${label} must start with "/" and use lowercase letters, digits, and hyphens (no trailing slash) — got "${base}"`
+      );
+    }
+    if (RESERVED_BASES.has(base)) {
+      throw new Error(`acms: ${label} "${base}" collides with a built-in route — pick another path`);
+    }
+    if (seen.has(base)) {
+      throw new Error(`acms: ${label} and ${seen.get(base)} are both "${base}" — bases must be unique`);
+    }
+    seen.set(base, label);
+  }
+  return resolved;
+}
+
+// Defaults + validation for acms({ i18n }). Locales are URL identifiers
+// (non-default locales are served under /<locale>), so they follow the same
+// build-time rules as collection bases: validated here, never re-checked at
+// runtime. Content stays in the DB — this only declares which languages exist
+// and which one owns the root URL.
+function resolveI18n(i18n, contentBases) {
+  if (i18n === undefined) return { locales: [], defaultLocale: '' };
+  const unknown = Object.keys(i18n).filter((k) => !['locales', 'defaultLocale'].includes(k));
+  if (unknown.length > 0) {
+    throw new Error(
+      `acms: unknown i18n key${unknown.length > 1 ? 's' : ''} ${unknown.map((k) => `"${k}"`).join(', ')} — ` +
+        'valid keys are i18n.locales and i18n.defaultLocale'
+    );
+  }
+  const locales = i18n.locales ?? [];
+  if (!Array.isArray(locales) || locales.length === 0) {
+    throw new Error('acms: i18n.locales must be a non-empty array of language codes, e.g. ["en", "es"]');
+  }
+  for (const l of locales) {
+    if (typeof l !== 'string' || !/^[a-z]{2,3}(-[a-z0-9]+)*$/.test(l)) {
+      throw new Error(`acms: i18n locale "${l}" must be a lowercase language code like "en", "es", or "pt-br"`);
+    }
+  }
+  if (new Set(locales).size !== locales.length) {
+    throw new Error('acms: i18n.locales contains duplicates');
+  }
+  const defaultLocale = i18n.defaultLocale ?? locales[0];
+  if (!locales.includes(defaultLocale)) {
+    throw new Error(`acms: i18n.defaultLocale "${defaultLocale}" is not in i18n.locales`);
+  }
+  // non-default locales become URL prefixes — they must not shadow a route
+  for (const l of locales) {
+    if (l === defaultLocale) continue;
+    const prefix = `/${l}`;
+    if (RESERVED_BASES.has(prefix)) {
+      throw new Error(`acms: i18n locale "${l}" would be served at "${prefix}", which collides with a built-in route`);
+    }
+    if (contentBases.has(prefix)) {
+      throw new Error(`acms: i18n locale "${l}" would be served at "${prefix}", which collides with ${contentBases.get(prefix)}`);
+    }
+  }
+  return { locales, defaultLocale };
+}
+
+const CONFIG_ID = 'virtual:acms-config';
+const THEMES_ID = 'virtual:acms-user-themes';
+
+// The consumer project's own themes, discovered with root-absolute globs so
+// they resolve against the consumer's src/ — the core's relative globs can't
+// see outside the package. Same folder contract as built-in themes.
+const USER_THEMES_CODE = `
+export const jsons = import.meta.glob('/src/themes/*/theme.json', { eager: true, import: 'default' });
+export const csses = import.meta.glob('/src/themes/*/theme.css', { eager: true, query: '?raw', import: 'default' });
+export const homes = import.meta.glob('/src/themes/*/templates/home.astro', { eager: true });
+export const postTpls = import.meta.glob('/src/themes/*/templates/post-*.astro', { eager: true });
+export const pageTpls = import.meta.glob('/src/themes/*/templates/page-*.astro', { eager: true });
+`;
+
+function acmsVitePlugin(userConfig) {
+  const configCode = `export const userConfig = ${JSON.stringify(userConfig)};`;
+  return {
+    name: 'acms-virtual-modules',
+    resolveId(id) {
+      // deliberately no \0 prefix: vite's import.meta.glob transform must
+      // still process the themes module
+      if (id === CONFIG_ID || id === THEMES_ID) return id;
+    },
+    load(id) {
+      if (id === CONFIG_ID) return configCode;
+      if (id === THEMES_ID) return USER_THEMES_CODE;
+    },
+  };
+}
+
+/**
+ * @param {object} [options]
+ * @param {{name?: string, version?: string, stack?: string}} [options.brand]
+ *   User-visible identity in the admin chrome (sidebar, titles, breadcrumb).
+ * @param {{siteTitle?: string, tagline?: string, heroHeading?: string, heroSub?: string}} [options.seed]
+ *   First-boot database seed content. Only read when the database is empty.
+ * @param {{posts?: {singular?: string, plural?: string, base?: string, redirectFrom?: string[]}, collections?: Record<string, {singular?: string, plural?: string, base?: string, redirectFrom?: string[]}>, tags?: {base?: string}}} [options.content]
+ *   Content collections. `collections` is a keyed map — each key gets its own
+ *   public routes at `base`, admin section at /admin/c/<key>, and labels from
+ *   `singular`/`plural`. The `posts` key is the built-in collection (default
+ *   base '/blog'); `content.posts` is shorthand for `collections.posts`.
+ *   `redirectFrom` 301s extra legacy bases. Tags are standalone at `tags.base`
+ *   (default '/tag'), shared across collections. Collection keys are permanent
+ *   internal identifiers (DB rows, backups, admin URLs) — never renamed.
+ * @param {{locales?: string[], defaultLocale?: string}} [options.i18n]
+ *   Site languages. The default locale (first entry unless `defaultLocale`
+ *   says otherwise) is served at `/`; every other locale gets its own home
+ *   page route at `/<locale>` plus a language switcher in the site header.
+ *   Home page content per language is authored in /admin as a normal page
+ *   marked "home" with that language selected. Omit for monolingual sites —
+ *   nothing changes.
+ * @returns {import('astro').AstroIntegration}
+ */
+export default function acms(options = {}) {
+  const content = resolveContent(options.content);
+  const contentBases = new Map([
+    ...Object.entries(content.collections).map(([k, c]) => [c.base, `content.collections.${k}.base`]),
+    [content.tags.base, 'content.tags.base'],
+  ]);
+  const i18n = resolveI18n(options.i18n, contentBases);
+  const userConfig = {
+    coreVersion: CORE_VERSION,
+    brand: options.brand ?? {},
+    seed: options.seed ?? {},
+    content,
+    i18n,
+  };
+  const routes = [...ROUTES];
+  for (const c of Object.values(content.collections)) {
+    routes.push([c.base, 'blog/index.astro'], [`${c.base}/[slug]`, 'blog/[slug].astro']);
+  }
+  routes.push([`${content.tags.base}/[slug]`, 'blog/tag/[slug].astro']);
+  // one home route per non-default locale; index.astro resolves the locale
+  // from the request path (injectRoute can't pass props)
+  for (const l of i18n.locales) {
+    if (l !== i18n.defaultLocale) routes.push([`/${l}`, 'index.astro']);
+  }
+  return {
+    name: 'acms',
+    hooks: {
+      'astro:config:setup': ({ command, injectRoute, addMiddleware, updateConfig }) => {
+        updateConfig({ vite: { plugins: [acmsVitePlugin(userConfig)] } });
+
+        for (const [pattern, file] of routes) {
+          injectRoute({ pattern, entrypoint: entry(`./src/pages/${file}`) });
+        }
+        // Auth gate, trailing-slash canonicalization, redirect fallback,
+        // publish sweep for targets without cron.
+        addMiddleware({ entrypoint: entry('./src/middleware.ts'), order: 'pre' });
+
+        // workerd has no MessageChannel at module scope, which react-dom's
+        // default server build touches. The edge build fixes that but its CJS
+        // wrapper breaks under Vite's dev module runner, so the alias applies
+        // only to built Worker bundles — same rule the pre-package config had.
+        const target = process.env.DEPLOY_TARGET ?? 'cloudflare';
+        if (target === 'cloudflare' && command === 'build') {
+          updateConfig({
+            vite: { resolve: { alias: { 'react-dom/server': 'react-dom/server.edge' } } },
+          });
+        }
+      },
+    },
+  };
+}

package/package.json

@@ -0,0 +1,89 @@
+{
+  "name": "@acms-subir/core",
+  "version": "0.0.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "Widget-based CMS for Astro on Cloudflare Workers \u2014 admin UI, content storage, themes, and APIs shipped as one integration.",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://acms.subir.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zurielbm/acms-subir.git",
+    "directory": "packages/core"
+  },
+  "keywords": [
+    "astro",
+    "astro-integration",
+    "cms",
+    "cloudflare",
+    "d1",
+    "workers"
+  ],
+  "bin": {
+    "acms": "./cli.mjs"
+  },
+  "exports": {
+    ".": "./integration.mjs",
+    "./package.json": "./package.json",
+    "./actions": "./src/actions/index.ts",
+    "./middleware": "./src/middleware.ts",
+    "./worker": "./src/worker.ts",
+    "./lib/*": "./src/lib/*",
+    "./pages/*": "./src/pages/*",
+    "./components/*": "./src/components/*",
+    "./layouts/*": "./src/layouts/*",
+    "./styles/*": "./src/styles/*",
+    "./themes/*": "./src/themes/*"
+  },
+  "files": [
+    "integration.mjs",
+    "cli.mjs",
+    "src"
+  ],
+  "dependencies": {
+    "@dnd-kit/core": "^6.3.1",
+    "@dnd-kit/sortable": "^10.0.0",
+    "@dnd-kit/utilities": "^3.2.2",
+    "@libsql/client": "^0.15.0",
+    "@tiptap/extension-code-block-lowlight": "^3.29.2",
+    "@tiptap/extension-table": "^3.29.2",
+    "@tiptap/extensions": "^3.29.2",
+    "@tiptap/pm": "^3.29.2",
+    "@tiptap/react": "^3.29.2",
+    "@tiptap/starter-kit": "^3.29.2",
+    "@tiptap/suggestion": "^3.29.2",
+    "hast-util-to-html": "^9.0.5",
+    "lowlight": "^3.3.0",
+    "marked": "^15.0.0",
+    "prismjs": "^1.30.0",
+    "simple-icons": "^16.27.1",
+    "zod": "^3.24.0"
+  },
+  "peerDependencies": {
+    "@astrojs/cloudflare": "^12.6.13",
+    "@astrojs/node": "^9.2.0",
+    "@astrojs/react": "^6.0.2",
+    "astro": "^5.7.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@astrojs/cloudflare": {
+      "optional": true
+    },
+    "@astrojs/node": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/prismjs": "^1.26.6",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "vitest": "^3.2.0"
+  },
+  "scripts": {
+    "test": "vitest run"
+  }
+}