@acms-subir/core 0.0.1

package/src/lib/theme.ts

@@ -0,0 +1,206 @@
+import { z } from 'zod';
+import type { Settings } from './schema';
+
+// Code-first theme engine. A theme is a folder under src/themes/<slug>/:
+//   theme.json            — { name, description, tokens } (tokens below)
+//   theme.css             — optional extra CSS beyond what tokens express
+//   templates/home.astro  — optional coded homepage; wins over the isHome
+//                           content page unless settings force 'content'
+// Themes are discovered at build time via import.meta.glob, so adding one is
+// just adding a folder — no registry edit. The admin Design screen layers
+// sparse per-token overrides (settings.designOverrides) on top; resolveDesign
+// merges the two and emits CSS variables consumed by site.css.
+
+export const ThemeTokens = z.object({
+  bg: z.string().default('#faf9f7'),
+  ink: z.string().default('#1e1f24'),
+  muted: z.string().default('#6b6e78'),
+  line: z.string().default('#e5e3de'),
+  accent: z.string().default('#4f46e5'),
+  panel: z.string().default('#ffffff'),
+  soft: z.string().default('#eceae5'),
+  headingFont: z.string().default("'Inter', system-ui, sans-serif"),
+  bodyFont: z.string().default("'Inter', system-ui, sans-serif"),
+  // the `family=` query for fonts.googleapis.com/css2; empty = no webfont
+  googleFonts: z.string().default('family=Inter:wght@400;600;700'),
+  width: z.coerce.number().default(760),
+});
+export type ThemeTokens = z.infer<typeof ThemeTokens>;
+
+// Token keys the Design screen may override individually.
+export const OVERRIDE_KEYS = ['bg', 'ink', 'muted', 'line', 'accent', 'panel', 'soft', 'width'] as const;
+
+// Post-page display options. Themes set defaults in theme.json under `post`;
+// the Design screen overrides individual fields via designOverrides
+// (postCover: 'normal'|'full'|'hidden', the rest as 'show'|'hide' strings).
+export const PostOptions = z.object({
+  cover: z.enum(['normal', 'full', 'overlay', 'hidden']).default('normal'),
+  showDate: z.boolean().default(true),
+  showReadingTime: z.boolean().default(true),
+  byline: z.boolean().default(true),
+  authorCard: z.boolean().default(true),
+  share: z.boolean().default(true),
+  related: z.boolean().default(true),
+});
+export type PostOptions = z.infer<typeof PostOptions>;
+
+// override key in designOverrides → PostOptions boolean field
+const POST_TOGGLES: [string, keyof PostOptions][] = [
+  ['postDate', 'showDate'],
+  ['postReadingTime', 'showReadingTime'],
+  ['postByline', 'byline'],
+  ['postAuthorCard', 'authorCard'],
+  ['postShare', 'share'],
+  ['postRelated', 'related'],
+];
+
+// Curated heading/body pairings the UI can swap in (override key: fontPairing).
+// Agent-authored themes set headingFont/bodyFont/googleFonts directly instead.
+export const FONT_PAIRINGS = [
+  { key: 'inter', label: 'Inter (sans)', headingFont: "'Inter', system-ui, sans-serif", bodyFont: "'Inter', system-ui, sans-serif", googleFonts: 'family=Inter:wght@400;600;700' },
+  { key: 'fraunces', label: 'Fraunces + Inter (editorial serif)', headingFont: "'Fraunces', Georgia, serif", bodyFont: "'Inter', system-ui, sans-serif", googleFonts: 'family=Fraunces:ital,opsz,wght@0,9..144,400;0,9..144,600;1,9..144,400&family=Inter:wght@400;500;600' },
+  { key: 'playfair', label: 'Playfair Display + Inter', headingFont: "'Playfair Display', Georgia, serif", bodyFont: "'Inter', system-ui, sans-serif", googleFonts: 'family=Playfair+Display:ital,wght@0,500;0,600;1,500&family=Inter:wght@400;500;600' },
+  { key: 'spectral', label: 'Spectral (serif)', headingFont: "'Spectral', Georgia, serif", bodyFont: "'Spectral', Georgia, serif", googleFonts: 'family=Spectral:ital,wght@0,400;0,600;1,400' },
+  { key: 'space', label: 'Space Grotesk + Inter', headingFont: "'Space Grotesk', system-ui, sans-serif", bodyFont: "'Inter', system-ui, sans-serif", googleFonts: 'family=Space+Grotesk:wght@500;700&family=Inter:wght@400;500;600' },
+  { key: 'lora', label: 'Lora + Inter', headingFont: "'Lora', Georgia, serif", bodyFont: "'Inter', system-ui, sans-serif", googleFonts: 'family=Lora:ital,wght@0,500;0,600;1,500&family=Inter:wght@400;500;600' },
+  { key: 'system', label: 'System UI (no webfont)', headingFont: 'system-ui, sans-serif', bodyFont: 'system-ui, sans-serif', googleFonts: '' },
+] as const;
+
+export interface Theme {
+  slug: string;
+  name: string;
+  description: string;
+  tokens: ThemeTokens;
+  post: PostOptions;
+  css: string;
+  // Astro component (module default) when the theme ships templates/home.astro
+  HomeTemplate: unknown | null;
+  // optional per-document templates: templates/post-<name>.astro and
+  // templates/page-<name>.astro, selectable in the editor sidebar
+  postTemplates: Record<string, unknown>;
+  pageTemplates: Record<string, unknown>;
+}
+
+interface ThemeJson { name?: string; description?: string; tokens?: Record<string, unknown>; post?: Record<string, unknown> }
+
+// Built-in themes ship inside the package (relative globs); project themes
+// come from the consumer's src/themes via the integration's virtual module
+// (root-absolute globs — a package can't glob outside itself). A project
+// theme whose slug matches a built-in replaces it.
+import * as user from 'virtual:acms-user-themes';
+
+const jsons = import.meta.glob('../themes/*/theme.json', { eager: true, import: 'default' }) as Record<string, ThemeJson>;
+const csses = import.meta.glob('../themes/*/theme.css', { eager: true, query: '?raw', import: 'default' }) as Record<string, string>;
+const homes = import.meta.glob('../themes/*/templates/home.astro', { eager: true }) as Record<string, { default: unknown }>;
+const postTpls = import.meta.glob('../themes/*/templates/post-*.astro', { eager: true }) as Record<string, { default: unknown }>;
+const pageTpls = import.meta.glob('../themes/*/templates/page-*.astro', { eager: true }) as Record<string, { default: unknown }>;
+
+// works for both '../themes/<slug>/…' and '/src/themes/<slug>/…'
+const slugOf = (path: string) => /themes\/([^/]+)\//.exec(path)?.[1] ?? path.split('/')[2];
+const tplName = (path: string, kind: 'post' | 'page') =>
+  path.split('/').pop()!.replace(`${kind}-`, '').replace('.astro', '');
+
+function templatesFor(slug: string, glob: Record<string, { default: unknown }>, kind: 'post' | 'page') {
+  return Object.fromEntries(
+    Object.entries(glob)
+      .filter(([p]) => slugOf(p) === slug)
+      .map(([p, mod]) => [tplName(p, kind), mod.default])
+  );
+}
+
+export const DEFAULT_THEME = 'ink';
+
+function buildThemes(
+  jsonMap: Record<string, ThemeJson>,
+  cssMap: Record<string, string>,
+  homeMap: Record<string, { default: unknown }>,
+  postMap: Record<string, { default: unknown }>,
+  pageMap: Record<string, { default: unknown }>
+): Theme[] {
+  return Object.entries(jsonMap).map(([path, raw]) => {
+    const slug = slugOf(path);
+    return {
+      slug,
+      name: raw.name ?? slug,
+      description: raw.description ?? '',
+      tokens: ThemeTokens.parse(raw.tokens ?? {}),
+      post: PostOptions.parse(raw.post ?? {}),
+      css: Object.entries(cssMap).find(([p]) => slugOf(p) === slug)?.[1] ?? '',
+      HomeTemplate: Object.entries(homeMap).find(([p]) => slugOf(p) === slug)?.[1]?.default ?? null,
+      postTemplates: templatesFor(slug, postMap, 'post'),
+      pageTemplates: templatesFor(slug, pageMap, 'page'),
+    };
+  });
+}
+
+const builtins = buildThemes(jsons, csses, homes, postTpls, pageTpls);
+const projectThemes = buildThemes(
+  user.jsons as Record<string, ThemeJson>,
+  user.csses,
+  user.homes,
+  user.postTpls,
+  user.pageTpls
+);
+const projectSlugs = new Set(projectThemes.map((t) => t.slug));
+
+const themes: Theme[] = [...builtins.filter((t) => !projectSlugs.has(t.slug)), ...projectThemes].sort(
+  (a, b) => (a.slug === DEFAULT_THEME ? -1 : b.slug === DEFAULT_THEME ? 1 : a.name.localeCompare(b.name))
+);
+
+export function listThemes(): Theme[] {
+  return themes;
+}
+
+export function getTheme(slug: string): Theme {
+  return themes.find((t) => t.slug === slug) ?? themes.find((t) => t.slug === DEFAULT_THEME) ?? themes[0];
+}
+
+export interface ResolvedDesign {
+  theme: Theme;
+  tokens: ThemeTokens;
+  post: PostOptions;
+  css: string; // ready-to-inline <style> content: :root vars + theme.css
+  fontsHref: string | null;
+  homeMode: 'auto' | 'content';
+  HomeTemplate: unknown | null;
+}
+
+export function resolveDesign(settings: Settings): ResolvedDesign {
+  const theme = getTheme(settings.activeTheme || DEFAULT_THEME);
+  const o = (settings.designOverrides ?? {}) as Record<string, unknown>;
+  const merged: Record<string, unknown> = { ...theme.tokens };
+  for (const k of OVERRIDE_KEYS) {
+    const v = o[k];
+    if (v !== undefined && v !== null && v !== '') merged[k] = v;
+  }
+  if (typeof o.fontPairing === 'string' && o.fontPairing) {
+    const p = FONT_PAIRINGS.find((f) => f.key === o.fontPairing);
+    if (p) {
+      merged.headingFont = p.headingFont;
+      merged.bodyFont = p.bodyFont;
+      merged.googleFonts = p.googleFonts;
+    }
+  }
+  const tokens = ThemeTokens.parse(merged);
+  const post: PostOptions = { ...theme.post };
+  if (o.postCover === 'normal' || o.postCover === 'full' || o.postCover === 'overlay' || o.postCover === 'hidden') post.cover = o.postCover;
+  for (const [key, field] of POST_TOGGLES) {
+    if (o[key] === 'show') (post[field] as boolean) = true;
+    if (o[key] === 'hide') (post[field] as boolean) = false;
+  }
+  const vars = [
+    `--bg:${tokens.bg}`, `--ink:${tokens.ink}`, `--muted:${tokens.muted}`,
+    `--line:${tokens.line}`, `--accent:${tokens.accent}`, `--panel:${tokens.panel}`,
+    `--soft:${tokens.soft}`, `--font-heading:${tokens.headingFont}`,
+    `--font-body:${tokens.bodyFont}`, `--content-width:${tokens.width}px`,
+  ].join(';');
+  return {
+    theme,
+    tokens,
+    post,
+    css: `:root{${vars}}\n${theme.css}`,
+    fontsHref: tokens.googleFonts ? `https://fonts.googleapis.com/css2?${tokens.googleFonts}&display=swap` : null,
+    homeMode: o.homeMode === 'content' ? 'content' : 'auto',
+    HomeTemplate: theme.HomeTemplate,
+  };
+}

package/src/lib/widgets.ts

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+import { widgetConfigs, type WidgetType } from './schema';
+
+// Client-safe widget registry: display metadata for the builder palette and
+// field specs derived from the Zod configs (single source of truth — adding
+// a field to a schema makes it appear in the inspector automatically).
+
+export interface WidgetMeta {
+  label: string;
+  description: string;
+  group: 'Layout' | 'Content' | 'Advanced';
+  icon: string; // svg path, 24 viewBox, stroked
+}
+
+export const widgetMeta: Record<WidgetType, WidgetMeta> = {
+  hero: {
+    label: 'Hero',
+    description: 'Headline, subtitle + CTA',
+    group: 'Layout',
+    icon: 'M4 5h16M6 10h12M9 15h6M10.5 19h3',
+  },
+  text: {
+    label: 'Text',
+    description: 'Markdown prose',
+    group: 'Content',
+    icon: 'M4 6h16M4 11h16M4 16h10',
+  },
+  image: {
+    label: 'Image',
+    description: 'Single image + caption',
+    group: 'Content',
+    icon: 'M3 5h18v14H3zM3 15l5-5 4 4 3-3 6 6M15.5 9.5h0',
+  },
+  button: {
+    label: 'Button',
+    description: 'Call-to-action link',
+    group: 'Content',
+    icon: 'M4 8h16v8H4zM8 12h8',
+  },
+  spacer: {
+    label: 'Spacer',
+    description: 'Vertical breathing room',
+    group: 'Layout',
+    icon: 'M12 4v16M8 7l4-3 4 3M8 17l4 3 4-3',
+  },
+  embed: {
+    label: 'Embed',
+    description: 'Iframe any URL',
+    group: 'Advanced',
+    icon: 'M4 5h16v14H4zM10 9.5l5 2.5-5 2.5z',
+  },
+  customHtml: {
+    label: 'Custom HTML',
+    description: 'Sandboxed HTML/CSS/JS',
+    group: 'Advanced',
+    icon: 'M8 6l-5 6 5 6M16 6l5 6-5 6',
+  },
+};
+
+export interface FieldSpec {
+  key: string;
+  label: string;
+  kind: 'text' | 'textarea' | 'code' | 'number' | 'select' | 'image';
+  options?: string[];
+}
+
+const TEXTAREA_KEYS = new Set(['markdown']);
+const CODE_KEYS = new Set(['html', 'css', 'js']);
+const IMAGE_KEYS = new Set(['src']);
+
+function humanize(key: string): string {
+  return key
+    .replace(/([A-Z])/g, ' $1')
+    .replace(/^./, (c) => c.toUpperCase())
+    .replace('Cta', 'CTA')
+    .replace('Href', 'link')
+    .replace(/\bUrl\b/i, 'URL');
+}
+
+function unwrap(schema: z.ZodTypeAny): z.ZodTypeAny {
+  let s = schema;
+  while (s instanceof z.ZodDefault || s instanceof z.ZodOptional || s instanceof z.ZodEffects) {
+    s = s instanceof z.ZodEffects ? s.innerType() : s._def.innerType;
+  }
+  return s;
+}
+
+export function fieldSpecs(type: WidgetType): FieldSpec[] {
+  const shape = (widgetConfigs[type] as z.ZodObject<z.ZodRawShape>).shape;
+  return Object.entries(shape).map(([key, schema]) => {
+    const inner = unwrap(schema as z.ZodTypeAny);
+    let kind: FieldSpec['kind'] = 'text';
+    let options: string[] | undefined;
+    if (inner instanceof z.ZodEnum) {
+      kind = 'select';
+      options = inner.options as string[];
+    } else if (inner instanceof z.ZodNumber) {
+      kind = 'number';
+    } else if (TEXTAREA_KEYS.has(key)) {
+      kind = 'textarea';
+    } else if (CODE_KEYS.has(key)) {
+      kind = 'code';
+    } else if (IMAGE_KEYS.has(key)) {
+      kind = 'image';
+    }
+    return { key, label: humanize(key), kind, options };
+  });
+}

package/src/middleware.ts

@@ -0,0 +1,109 @@
+import { defineMiddleware } from 'astro:middleware';
+import { verifySessionToken, SESSION_COOKIE } from './lib/auth';
+import { getRepo } from './lib/repo';
+import { CONTENT } from './lib/content';
+
+// Legacy content-URL redirects, checked only on would-be 404s (below) so they
+// can never shadow real content. Tags moved from `${base}/tag/` to a
+// standalone base for every site, so tag sources include every collection
+// base; per-collection sources only exist when a base was renamed away from a
+// legacy one ('/blog' is the built-in collection's historic default).
+const TAG_SOURCES = [
+  ...new Set([
+    ...Object.values(CONTENT.collections).map((c) => c.base),
+    '/blog',
+    ...Object.values(CONTENT.collections).flatMap((c) => c.redirectFrom),
+  ]),
+];
+const COLLECTION_SOURCES: Array<{ from: string; to: string }> = Object.entries(CONTENT.collections).flatMap(
+  ([key, c]) =>
+    [...new Set([...(key === 'posts' ? ['/blog'] : []), ...c.redirectFrom])]
+      .filter((from) => from !== c.base)
+      .map((from) => ({ from, to: c.base }))
+);
+
+export function legacyContentRedirect(pathname: string): string | null {
+  for (const src of TAG_SOURCES) {
+    if (pathname.startsWith(`${src}/tag/`)) {
+      return `${CONTENT.tags.base}/${pathname.slice(src.length + '/tag/'.length)}`;
+    }
+  }
+  for (const { from, to } of COLLECTION_SOURCES) {
+    if (pathname === from) return to;
+    if (pathname.startsWith(`${from}/`)) return to + pathname.slice(from.length);
+  }
+  return null;
+}
+
+// Scheduled publishing fallback: on normal page traffic, at most once a
+// minute per isolate, flip due scheduled posts to published. On Workers the
+// cron trigger in src/worker.ts is the primary path; this sweep covers the
+// Node target and local dev.
+let lastPublishCheck = 0;
+
+export const onRequest = defineMiddleware(async (context, next) => {
+  const { pathname } = context.url;
+
+  // one canonical URL per page: trailing-slash variants 301 to the bare path.
+  // GET pages only — the astro:actions client POSTs to /_actions/<name>/ with
+  // a trailing slash, and a 301 would downgrade that POST to a GET.
+  if (
+    pathname !== '/' &&
+    pathname.endsWith('/') &&
+    context.request.method === 'GET' &&
+    !pathname.startsWith('/_')
+  ) {
+    return context.redirect(pathname.replace(/\/+$/, '') + context.url.search, 301);
+  }
+
+  if (pathname.startsWith('/admin') && pathname !== '/admin/login') {
+    const token = context.cookies.get(SESSION_COOKIE)?.value;
+    if (!verifySessionToken(token)) {
+      return context.redirect('/admin/login');
+    }
+  }
+
+  const now = Date.now();
+  if (now - lastPublishCheck > 60_000 && !pathname.startsWith('/media/')) {
+    lastPublishCheck = now;
+    try {
+      const repo = await getRepo(context.locals);
+      await repo.publishDuePosts(now);
+    } catch {
+      // never let the publish sweep break a request
+    }
+  }
+
+  const response = await next();
+
+  // Redirects fire only when the request would otherwise 404, so a rule can
+  // never shadow real content. The table is cached per isolate for a minute.
+  if (response.status === 404 && !pathname.startsWith('/admin') && !pathname.startsWith('/api')) {
+    try {
+      const hit = (await getRedirects(context.locals, now)).get(pathname);
+      if (hit) return context.redirect(hit.toPath + context.url.search, hit.code);
+    } catch {
+      // a broken redirect lookup must never break the 404 itself
+    }
+    // admin-authored rules win; config-derived legacy moves are the fallback
+    const legacy = legacyContentRedirect(pathname);
+    if (legacy) return context.redirect(legacy + context.url.search, 301);
+  }
+
+  return response;
+});
+
+let redirectCache: { at: number; map: Map<string, { toPath: string; code: 301 | 302 }> } | null = null;
+
+// called by the admin mutations so new rules fire immediately in this isolate
+export function invalidateRedirectCache() {
+  redirectCache = null;
+}
+
+async function getRedirects(locals: App.Locals, now: number) {
+  if (redirectCache && now - redirectCache.at < 60_000) return redirectCache.map;
+  const repo = await getRepo(locals);
+  const map = new Map((await repo.listRedirects()).map((r) => [r.fromPath, { toPath: r.toPath, code: r.code }]));
+  redirectCache = { at: now, map };
+  return map;
+}

package/src/pages/[...slug].astro

@@ -0,0 +1,43 @@
+---
+import Site from '../layouts/Site.astro';
+import WidgetRenderer from '../components/WidgetRenderer.astro';
+import { getRepo } from '../lib/repo';
+import { verifySessionToken, SESSION_COOKIE } from '../lib/auth';
+import { expandDynamicBlocks } from '../lib/dynamicBlocks';
+import { highlightCodeHtml } from '../lib/highlightCode';
+import { resolveDesign } from '../lib/theme';
+
+const { slug } = Astro.params;
+const repo = await getRepo(Astro.locals);
+const page = slug ? await repo.getPageBySlug(slug) : null;
+
+// Drafts are visible only to a logged-in admin (doubles as draft preview).
+const isAdmin = verifySessionToken(Astro.cookies.get(SESSION_COOKIE)?.value);
+if (!page || (page.status !== 'published' && !isAdmin)) {
+  return new Response(null, { status: 404, statusText: 'Not found' });
+}
+const bodyHtml = page.bodyHtml ? highlightCodeHtml(await expandDynamicBlocks(page.bodyHtml, repo)) : '';
+const settings = await repo.getSettings();
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const PageTemplate = (page.template ? resolveDesign(settings).theme.pageTemplates[page.template] : null) as any;
+---
+
+<Site
+  title={page.seoTitle || page.title}
+  exactTitle={Boolean(page.seoTitle)}
+  description={page.seoDesc || undefined}
+  noindex={page.status !== 'published'}
+>
+  {page.status !== 'published' && (
+    <p style="background:#fff3cd;border:1px solid #ffe08a;border-radius:8px;padding:8px 14px;font-size:14px;">
+      Draft preview — only you can see this page.
+    </p>
+  )}
+  {PageTemplate ? (
+    <PageTemplate page={page} html={bodyHtml} settings={settings} />
+  ) : page.bodyHtml ? (
+    <article class="page-body" set:html={bodyHtml} />
+  ) : (
+    <WidgetRenderer pageId={page.id} blocks={page.blocks} />
+  )}
+</Site>

package/src/pages/admin/c/[collection]/[id].astro

@@ -0,0 +1,56 @@
+---
+import { getRepo } from '../../../../lib/repo';
+import { renderMarkdown } from '../../../../lib/markdown';
+import { createPreviewToken } from '../../../../lib/preview';
+import { resolveDesign } from '../../../../lib/theme';
+import { env } from '../../../../lib/env';
+import { BRAND } from '../../../../lib/brand';
+import { CONTENT } from '../../../../lib/content';
+import PostEditor from '../../../../components/editor/PostEditor';
+import '../../../../styles/admin.css';
+import '../../../../styles/editor.css';
+
+// Shared editor page for every collection. The editor itself reads the
+// collection off the post row; the URL segment is canonicalized so links
+// always point at the collection the post actually lives in.
+const key = Astro.params.collection!;
+if (!CONTENT.collections[key]) return new Response(null, { status: 404, statusText: 'Not found' });
+
+const repo = await getRepo(Astro.locals);
+const id = Astro.params.id!;
+const post = await repo.getPost(id);
+if (!post) return new Response(null, { status: 404 });
+if (post.collection !== key) return Astro.redirect(`/admin/c/${post.collection}/${post.id}`);
+
+// Canonical content is the TipTap doc (as HTML). Legacy markdown posts are
+// converted on first open and become rich content on next save.
+const initialHTML = post.bodyHtml || (post.body ? renderMarkdown(post.body) : '');
+const previewPath = `/preview/post/${post.id}`;
+const sharePath = `${previewPath}?token=${createPreviewToken('post', post.id)}`;
+const unsplashEnabled = Boolean(env('UNSPLASH_ACCESS_KEY'));
+const settings = await repo.getSettings();
+const templates = Object.keys(resolveDesign(settings).theme.postTemplates);
+---
+
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <meta name="robots" content="noindex" />
+    <title>{post.title || 'Untitled'} · {BRAND.name} editor</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet" />
+  </head>
+  <body>
+    <PostEditor
+      client:only="react"
+      post={post}
+      initialHTML={initialHTML}
+      unsplashEnabled={unsplashEnabled}
+      previewPath={previewPath}
+      sharePath={sharePath}
+      templates={templates}
+    />
+  </body>
+</html>