@acms-subir/core 0.0.1

package/src/lib/repo/sqlite.ts

@@ -0,0 +1,43 @@
+import type { Client, InArgs, InStatement } from '@libsql/client';
+import { SqlRepository, type SqlDriver, type SqlStatement } from './sql';
+import { env } from '../env';
+
+// libSQL file adapter (plain Node self-hosting). All queries and row mapping
+// live in the shared SqlRepository — this file only adapts the libSQL
+// execute/batch API and handles client creation.
+
+class LibsqlDriver implements SqlDriver {
+  constructor(private db: Client) {}
+
+  private stmt({ sql, args }: SqlStatement): InStatement {
+    return { sql, args: (args ?? []) as InArgs };
+  }
+  async all(sql: string, args?: unknown[]) {
+    const r = await this.db.execute(this.stmt({ sql, args }));
+    return r.rows as unknown as Record<string, unknown>[];
+  }
+  async run(sql: string, args?: unknown[]) {
+    await this.db.execute(this.stmt({ sql, args }));
+  }
+  async batch(stmts: SqlStatement[]) {
+    if (!stmts.length) return;
+    await this.db.batch(stmts.map((s) => this.stmt(s)), 'write');
+  }
+}
+
+export class SqliteRepository extends SqlRepository {
+  constructor() {
+    super(async () => {
+      // Dynamic (bundler-ignored) imports keep the native libSQL client and
+      // node:fs out of the Cloudflare Workers bundle — this adapter only ever
+      // runs on plain Node (self-hosted / astro dev without wrangler).
+      const { createClient } = await import(/* @vite-ignore */ '@libsql/client');
+      const url = env('SQLITE_URL', 'file:./data/acms.db');
+      if (url.startsWith('file:')) {
+        const { mkdirSync } = await import(/* @vite-ignore */ 'node:fs');
+        mkdirSync('./data', { recursive: true });
+      }
+      return new LibsqlDriver(createClient({ url }));
+    });
+  }
+}

package/src/lib/repo/types.ts

@@ -0,0 +1,132 @@
+import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, Role, WidgetInstance } from '../schema';
+
+export interface Stats {
+  publishedPages: number;
+  posts: number;
+  drafts: number;
+  linkClicks: number;
+}
+
+// The single contract both backends implement. The app only ever imports
+// this — never a concrete adapter.
+export interface ContentRepository {
+  // pages
+  listPages(): Promise<Page[]>;
+  getPage(id: string): Promise<Page | null>;
+  getPageBySlug(slug: string): Promise<Page | null>;
+  // omitted/'' = the default locale's home; non-default locales pass their code
+  getHomePage(locale?: string): Promise<Page | null>;
+  createPage(data: { title: string; slug: string }): Promise<Page>;
+  updatePage(
+    id: string,
+    data: Partial<Pick<Page, 'title' | 'slug' | 'status' | 'isHome' | 'locale' | 'seoTitle' | 'seoDesc' | 'bodyJson' | 'bodyHtml' | 'template'>> & {
+      blocks?: WidgetInstance[];
+    }
+  ): Promise<void>;
+  deletePage(id: string): Promise<void>;
+
+  // posts
+  // collection filters take the acms({ content.collections }) key; omitted =
+  // all collections (feeds, search). Slugs are unique per collection, so
+  // getPostBySlug needs the collection to be unambiguous — omitted matches any
+  // (single-collection sites, legacy callers).
+  listPosts(collection?: string): Promise<Post[]>;
+  listPublishedPosts(collection?: string): Promise<Post[]>;
+  getPost(id: string): Promise<Post | null>;
+  getPostBySlug(slug: string, collection?: string): Promise<Post | null>;
+  createPost(data: { title: string; slug: string; collection?: string }): Promise<Post>;
+  updatePost(
+    id: string,
+    data: Partial<
+      Pick<
+        Post,
+        | 'title' | 'slug' | 'collection' | 'body' | 'bodyJson' | 'bodyHtml' | 'excerpt'
+        | 'tags' | 'cover' | 'coverAlt' | 'seoTitle' | 'seoDesc'
+        | 'status' | 'featured' | 'authorId' | 'authorIds' | 'template'
+        | 'publishedAt' | 'scheduledAt'
+      >
+    >
+  ): Promise<void>;
+  deletePost(id: string): Promise<void>;
+  // flips scheduled posts whose time has passed to published; returns count
+  publishDuePosts(now: number): Promise<number>;
+
+  // media
+  listMedia(): Promise<Media[]>;
+  getMedia(id: string): Promise<Media | null>;
+  createMedia(data: Omit<Media, 'createdAt'>): Promise<Media>;
+  updateMedia(id: string, data: Partial<Pick<Media, 'alt'>>): Promise<void>;
+  deleteMedia(id: string): Promise<void>;
+
+  // links — typed link-in-bio blocks, one ordered list
+  listLinks(): Promise<Link[]>;
+  createLink(data: {
+    label: string;
+    url: string;
+    icon?: string;
+    kind?: Link['kind'];
+    html?: string;
+    meta?: Record<string, unknown>;
+  }): Promise<Link>;
+  updateLink(id: string, data: Partial<Pick<Link, 'label' | 'url' | 'icon' | 'html' | 'meta'>>): Promise<void>;
+  moveLink(id: string, dir: 'up' | 'down'): Promise<void>;
+  // full ordering in one call (drag-and-drop); ids in desired display order
+  reorderLinks(ids: string[]): Promise<void>;
+  deleteLink(id: string): Promise<void>;
+  trackClick(id: string): Promise<string | null>; // returns url to redirect to
+
+  // tags — registry of tag entities; posts store tag names, this table adds
+  // slugs/descriptions and powers archives
+  listTags(): Promise<Tag[]>;
+  getTagBySlug(slug: string): Promise<Tag | null>;
+  createTag(data: { name: string; slug: string; description?: string }): Promise<Tag>;
+  updateTag(id: string, data: Partial<Pick<Tag, 'name' | 'slug' | 'description'>>): Promise<void>;
+  deleteTag(id: string): Promise<void>;
+  // auto-register any names missing from the registry (called on post save)
+  ensureTags(names: string[]): Promise<void>;
+
+  // users — passHash stays inside the repo; getUserAuth is for login only
+  listUsers(): Promise<User[]>;
+  getUser(id: string): Promise<User | null>;
+  createUser(data: { name: string; email: string; role: Role; passHash: string }): Promise<User>;
+  updateUser(id: string, data: { name?: string; email?: string; role?: Role; passHash?: string; bio?: string; avatar?: string; slug?: string }): Promise<void>;
+  deleteUser(id: string): Promise<void>;
+  getUserAuth(email: string): Promise<{ user: User; passHash: string } | null>;
+
+  // navigation — managed header/footer/social items; empty header falls back
+  // to the legacy auto-list of published pages in Site.astro
+  listNavItems(): Promise<NavItem[]>;
+  createNavItem(data: { label: string; url: string; area: NavItem['area'] }): Promise<NavItem>;
+  updateNavItem(id: string, data: Partial<Pick<NavItem, 'label' | 'url' | 'area'>>): Promise<void>;
+  reorderNavItems(ids: string[]): Promise<void>;
+  deleteNavItem(id: string): Promise<void>;
+
+  // public search — ranked LIKE over published posts and pages (title >
+  // excerpt > body). Behind this method so FTS can replace it transparently.
+  searchPublished(query: string): Promise<{ posts: Post[]; pages: Page[] }>;
+
+  // backup restore — id-preserving replace-all from a backup's content.json.
+  // Users restore WITHOUT password hashes (backups never contain them).
+  restoreAll(content: {
+    settings: Partial<Settings>;
+    pages: Page[];
+    posts: Post[];
+    media: Media[];
+    links: Link[];
+    tags: Tag[];
+    navItems: NavItem[];
+    users: User[];
+    redirects: Redirect[];
+  }): Promise<void>;
+
+  // redirects — exact-path forwards, consulted when a request would 404.
+  // createRedirect upserts on fromPath and prunes self/loop entries.
+  listRedirects(): Promise<Redirect[]>;
+  createRedirect(data: { fromPath: string; toPath: string; code?: 301 | 302 }): Promise<Redirect>;
+  deleteRedirect(id: string): Promise<void>;
+
+  // settings & dashboard
+  getSettings(): Promise<Settings>;
+  updateSettings(data: Partial<Settings>): Promise<void>;
+  getStats(): Promise<Stats>;
+}

package/src/lib/schema.ts

@@ -0,0 +1,286 @@
+import { z } from 'zod';
+
+// ---- Widgets -------------------------------------------------------------
+// Each widget type has a zod config schema; pages store an ordered array of
+// WidgetInstance. Adding a widget type = extend this union + a render
+// component in src/components/widgets/ + an editor section in the admin.
+
+export const widgetConfigs = {
+  hero: z.object({
+    heading: z.string().default(''),
+    sub: z.string().default(''),
+    ctaLabel: z.string().default(''),
+    ctaHref: z.string().default(''),
+    align: z.enum(['left', 'center']).default('center'),
+  }),
+  text: z.object({
+    markdown: z.string().default(''),
+  }),
+  image: z.object({
+    src: z.string().default(''),
+    alt: z.string().default(''),
+    caption: z.string().default(''),
+  }),
+  button: z.object({
+    label: z.string().default(''),
+    href: z.string().default(''),
+    variant: z.enum(['primary', 'outline']).default('primary'),
+  }),
+  spacer: z.object({
+    size: z.enum(['s', 'm', 'l']).default('m'),
+  }),
+  embed: z.object({
+    url: z.string().default(''),
+    height: z.coerce.number().default(400),
+  }),
+  customHtml: z.object({
+    html: z.string().default(''),
+    css: z.string().default(''),
+    js: z.string().default(''),
+    height: z.coerce.number().default(300),
+  }),
+} as const;
+
+export type WidgetType = keyof typeof widgetConfigs;
+export const widgetTypes = Object.keys(widgetConfigs) as WidgetType[];
+
+export const WidgetInstance = z.object({
+  id: z.string(),
+  type: z.enum(Object.keys(widgetConfigs) as [WidgetType, ...WidgetType[]]),
+  config: z.record(z.any()),
+});
+export type WidgetInstance = z.infer<typeof WidgetInstance>;
+
+export function parseConfig<T extends WidgetType>(type: T, raw: unknown): z.infer<(typeof widgetConfigs)[T]> {
+  return widgetConfigs[type].parse(raw ?? {}) as z.infer<(typeof widgetConfigs)[T]>;
+}
+
+// ---- Content -------------------------------------------------------------
+
+export const Status = z.enum(['draft', 'scheduled', 'published', 'archived']);
+export type Status = z.infer<typeof Status>;
+
+export const Page = z.object({
+  id: z.string(),
+  slug: z.string(),
+  title: z.string(),
+  status: Status,
+  isHome: z.boolean().default(false),
+  // acms({ i18n }) locale code; '' = the default locale. Home pages are
+  // unique per locale, so a site can have one home per language.
+  locale: z.string().default(''),
+  // blocks is the legacy widget document; bodyJson (TipTap doc) is canonical
+  // once present, with bodyHtml the pre-rendered public markup.
+  blocks: z.array(WidgetInstance).default([]),
+  bodyJson: z.string().default(''),
+  bodyHtml: z.string().default(''),
+  seoTitle: z.string().default(''),
+  seoDesc: z.string().default(''),
+  // theme template name (templates/page-<name>.astro); empty = default layout
+  template: z.string().default(''),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type Page = z.infer<typeof Page>;
+
+export const Post = z.object({
+  id: z.string(),
+  // config key from acms({ content.collections }); 'posts' is the built-in.
+  // Permanent identifier — the collection's labels/base rename freely, this
+  // value never does.
+  collection: z.string().default('posts'),
+  slug: z.string(),
+  title: z.string(),
+  // body is legacy markdown; bodyJson (TipTap doc) is canonical once present,
+  // with bodyHtml the pre-rendered public markup.
+  body: z.string().default(''),
+  bodyJson: z.string().default(''),
+  bodyHtml: z.string().default(''),
+  excerpt: z.string().default(''),
+  tags: z.array(z.string()).default([]),
+  cover: z.string().default(''),
+  coverAlt: z.string().default(''),
+  seoTitle: z.string().default(''),
+  seoDesc: z.string().default(''),
+  status: Status,
+  featured: z.boolean().default(false),
+  // authorId stays as the primary author (first of authorIds) for
+  // backward compatibility; authorIds is the full ordered list
+  authorId: z.string().nullable().default(null),
+  authorIds: z.array(z.string()).default([]),
+  // theme template name (templates/post-<name>.astro); empty = default layout
+  template: z.string().default(''),
+  publishedAt: z.number().nullable(),
+  scheduledAt: z.number().nullable().default(null),
+  createdAt: z.number(),
+  updatedAt: z.number(),
+});
+export type Post = z.infer<typeof Post>;
+
+// Ghost-style internal tags: a leading '#' keeps a tag out of all public
+// surfaces (chips, archives, sitemap) while it stays usable for organizing
+// and for post-list blocks.
+export const isInternalTag = (name: string) => name.startsWith('#');
+export const publicTags = (names: string[]) => names.filter((n) => !isInternalTag(n));
+
+export const MediaVariant = z.object({ w: z.number(), key: z.string() });
+export type MediaVariant = z.infer<typeof MediaVariant>;
+
+export const Media = z.object({
+  id: z.string(),
+  key: z.string(), // storage key of the original upload
+  filename: z.string(),
+  mime: z.string(),
+  width: z.number(),
+  height: z.number(),
+  size: z.number(),
+  alt: z.string().default(''),
+  variants: z.array(MediaVariant).default([]),
+  createdAt: z.number(),
+});
+export type Media = z.infer<typeof Media>;
+
+// Tags are entities (Ghost-style): posts keep storing an array of tag NAMES
+// for backward compatibility, while the tags table is the registry that adds
+// slugs + descriptions and powers /blog/tag/[slug] archives. Unknown names
+// are auto-registered on post save.
+export const Tag = z.object({
+  id: z.string(),
+  name: z.string(),
+  slug: z.string(),
+  description: z.string().default(''),
+});
+export type Tag = z.infer<typeof Tag>;
+
+export const Role = z.enum(['owner', 'editor']);
+export type Role = z.infer<typeof Role>;
+
+// Password hashes never leave the repo layer — User is the public shape.
+export const User = z.object({
+  id: z.string(),
+  name: z.string(),
+  email: z.string(),
+  role: Role,
+  // public author profile: bio + avatar render on bylines/author cards;
+  // slug powers /author/<slug> (falls back to slugify(name) when empty)
+  bio: z.string().default(''),
+  avatar: z.string().default(''),
+  slug: z.string().default(''),
+  createdAt: z.number(),
+});
+export type User = z.infer<typeof User>;
+
+export const authorSlug = (u: Pick<User, 'name' | 'slug'>) => u.slug || slugify(u.name);
+
+// The links page is an ordered list of typed blocks: link buttons (custom or
+// brand-preset), mailto/tel buttons, a downloadable vcard, headings, static
+// text, spacers, and raw HTML/JS. `icon` holds an emoji, an image URL, inline
+// `<svg…>` markup (brand icons), or the keyword 'favicon'. `meta` is per-kind
+// extras: { color, textColor } button colors, { size } spacer height, vcard
+// fields, etc.
+export const LinkKind = z.enum(['link', 'email', 'phone', 'heading', 'text', 'spacer', 'vcard', 'html']);
+export type LinkKind = z.infer<typeof LinkKind>;
+
+export const Link = z.object({
+  id: z.string(),
+  kind: LinkKind.default('link'),
+  label: z.string(),
+  url: z.string(),
+  icon: z.string().default(''),
+  html: z.string().default(''),
+  meta: z.record(z.any()).default({}),
+  order: z.number(),
+  clicks: z.number().default(0),
+});
+export type Link = z.infer<typeof Link>;
+
+// Site navigation, managed at /admin/navigation. `header` renders in the top
+// nav (replacing the old auto-list of published pages), `footer` above the
+// footer text, `social` as the footer social row (also reused by share UIs).
+export const NavArea = z.enum(['header', 'footer', 'social']);
+export type NavArea = z.infer<typeof NavArea>;
+
+export const NavItem = z.object({
+  id: z.string(),
+  label: z.string(),
+  url: z.string(),
+  area: NavArea.default('header'),
+  order: z.number(),
+});
+export type NavItem = z.infer<typeof NavItem>;
+
+// URL redirects: exact-path forwards consulted when a request would 404.
+// Created by hand in Settings → Redirects, or automatically when a published
+// post/page slug changes (so old links never rot).
+export const Redirect = z.object({
+  id: z.string(),
+  fromPath: z.string(),
+  toPath: z.string(),
+  code: z.union([z.literal(301), z.literal(302)]).default(301),
+  createdAt: z.number(),
+});
+export type Redirect = z.infer<typeof Redirect>;
+
+// normalize a redirect path: leading slash, no trailing slash, no origin
+export function normalizeRedirectPath(input: string): string {
+  let p = input.trim();
+  if (!p) return '';
+  try {
+    if (/^https?:\/\//.test(p)) return p; // external target URLs pass through
+  } catch { /* fall through */ }
+  if (!p.startsWith('/')) p = `/${p}`;
+  if (p.length > 1) p = p.replace(/\/+$/, '');
+  return p;
+}
+
+export const Settings = z.object({
+  siteTitle: z.string().default('My Site'),
+  tagline: z.string().default(''),
+  // site-wide footer, markdown allowed; empty falls back to "title — tagline"
+  footerText: z.string().default(''),
+  // links-page identity; falls back to siteTitle/tagline until set
+  linksName: z.string().default(''),
+  linksBio: z.string().default(''),
+  linksAvatar: z.string().default(''),
+  // theme engine: which src/themes/ folder is active, plus sparse token
+  // overrides from the Design screen layered on top of the theme's defaults
+  activeTheme: z.string().default(''),
+  designOverrides: z.record(z.any()).default({}),
+  siteLogo: z.string().default(''),
+  // SEO foundation: canonical origin for absolute URLs (sitemap, feeds, OG
+  // tags — empty falls back to the request origin), favicon, and the default
+  // social-share image used when a post has no cover
+  siteUrl: z.string().default(''),
+  siteFavicon: z.string().default(''),
+  siteCover: z.string().default(''),
+  // code injection: raw HTML appended to <head> / before </body> (owner-only)
+  headCode: z.string().default(''),
+  footerCode: z.string().default(''),
+  // publication timezone (IANA name) and locale (BCP 47); empty = UTC / en-US
+  timezone: z.string().default(''),
+  locale: z.string().default(''),
+  // site-wide announcement bar above the header
+  announcement: z
+    .object({
+      enabled: z.boolean().default(false),
+      text: z.string().default(''),
+      link: z.string().default(''),
+      dismissible: z.boolean().default(true),
+    })
+    .default({}),
+  // external drafts API: bearer key for POST /api/drafts (empty = endpoint
+  // off) and the browser origins allowed to call it ('*' entry allows all,
+  // 'http://localhost:*' matches any port). Managed in /admin/settings.
+  draftsApiKey: z.string().default(''),
+  draftsAllowedOrigins: z.array(z.string()).default([]),
+});
+export type Settings = z.infer<typeof Settings>;
+
+export function slugify(input: string): string {
+  return input
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9\s-]/g, '')
+    .replace(/[\s_-]+/g, '-')
+    .replace(/^-+|-+$/g, '') || 'untitled';
+}

package/src/lib/seo.ts

@@ -0,0 +1,37 @@
+import type { Settings } from './schema';
+
+// Absolute-URL helpers shared by the layout head, sitemap, RSS, and robots
+// routes. The canonical origin is the siteUrl setting; a fresh install falls
+// back to the request origin so links still work before it's configured.
+
+export function siteOrigin(settings: Settings, requestUrl: URL): string {
+  const configured = settings.siteUrl.trim().replace(/\/+$/, '');
+  if (!configured) return requestUrl.origin;
+  try {
+    return new URL(configured.includes('://') ? configured : `https://${configured}`).origin;
+  } catch {
+    return requestUrl.origin;
+  }
+}
+
+export function absUrl(pathOrUrl: string, origin: string): string {
+  try {
+    return new URL(pathOrUrl, origin).href;
+  } catch {
+    return pathOrUrl;
+  }
+}
+
+export function xmlEscape(s: string): string {
+  return s
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+// canonical path: no trailing slash except the root
+export function canonicalPath(pathname: string): string {
+  return pathname !== '/' && pathname.endsWith('/') ? pathname.replace(/\/+$/, '') : pathname;
+}