@acms-subir/core 0.0.2 → 0.2.0

package/src/lib/analytics.ts

@@ -0,0 +1,121 @@
+// Analytics providers (Umami, Meta Pixel, TikTok Pixel): builds the script
+// markup Site.astro renders into the public <head> via set:html. Because the
+// output bypasses Astro's escaping, nothing is emitted unless the stored
+// ID/URL passes its validator — a bad value renders nothing, never broken or
+// injected markup. The admin form rejects invalid values with the same rules.
+import type { Settings } from './schema';
+
+export const UMAMI_ID_RE = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+export const META_PIXEL_ID_RE = /^\d{5,20}$/;
+export const TIKTOK_PIXEL_ID_RE = /^[A-Z0-9_-]{8,40}$/i;
+
+// https only (self-hosted instances included); returns the normalized href,
+// whose serialization percent-encodes quotes/angle brackets, so the value is
+// attribute-safe. Belt and braces: reject anything still risky post-encode.
+export function normalizeScriptUrl(url: string): string {
+  try {
+    const href = new URL(url).href;
+    if (new URL(url).protocol !== 'https:' || /["'<>\s]/.test(href)) return '';
+    return href;
+  } catch {
+    return '';
+  }
+}
+
+type Analytics = Settings['analytics'];
+
+function umamiTag(a: Analytics['umami']): string {
+  const src = normalizeScriptUrl(a.scriptUrl);
+  if (!a.enabled || !UMAMI_ID_RE.test(a.websiteId) || !src) return '';
+  return `<script defer src="${src}" data-website-id="${a.websiteId.toLowerCase()}"></script>`;
+}
+
+// The replay recorder lives next to the tracker on the same instance:
+// swap the URL's last path segment for recorder.js and re-validate.
+export function umamiRecorderUrl(scriptUrl: string): string {
+  const src = normalizeScriptUrl(scriptUrl);
+  if (!src) return '';
+  const url = new URL(src);
+  url.pathname = url.pathname.replace(/[^/]*$/, 'recorder.js');
+  return normalizeScriptUrl(url.href);
+}
+
+// Session replay (Umami v3.1+): a second tag mirroring the dashboard-generated
+// snippet. Attributes are re-clamped here because, like the rest of this file,
+// the output bypasses Astro escaping — schema-invalid values render defaults,
+// never broken markup.
+function umamiReplayTag(a: Analytics['umami']): string {
+  const src = umamiRecorderUrl(a.scriptUrl);
+  if (!a.enabled || !a.replay.enabled || !UMAMI_ID_RE.test(a.websiteId) || !src) return '';
+  const rate =
+    Number.isFinite(a.replay.sampleRate) && a.replay.sampleRate >= 0.01 && a.replay.sampleRate <= 1
+      ? a.replay.sampleRate
+      : 0.15;
+  const mask = a.replay.maskLevel === 'strict' ? 'strict' : 'moderate';
+  const duration =
+    Number.isInteger(a.replay.maxDuration) && a.replay.maxDuration > 0 ? a.replay.maxDuration : 300000;
+  return `<script defer src="${src}" data-website-id="${a.websiteId.toLowerCase()}" data-sample-rate="${rate}" data-mask-level="${mask}" data-max-duration="${duration}"></script>`;
+}
+
+// Meta's standard base code: fbq loader + PageView, with the no-JS pixel
+// image fallback. The ID is digits-only by validation, so safe to inline.
+function metaPixelTag(a: Analytics['metaPixel']): string {
+  if (!a.enabled || !META_PIXEL_ID_RE.test(a.pixelId)) return '';
+  return `<script>
+!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
+n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
+n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
+t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,
+document,'script','https://connect.facebook.net/en_US/fbevents.js');
+fbq('init', '${a.pixelId}');
+fbq('track', 'PageView');
+</script>
+<noscript><img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=${a.pixelId}&ev=PageView&noscript=1"/></noscript>`;
+}
+
+// TikTok's published base code (experimental — untested live): ttq loader +
+// page(). ID is restricted to [A-Z0-9_-] by validation.
+function tiktokPixelTag(a: Analytics['tiktokPixel']): string {
+  if (!a.enabled || !TIKTOK_PIXEL_ID_RE.test(a.pixelId)) return '';
+  return `<script>
+!function (w, d, t) {
+w.TiktokAnalyticsObject=t;var ttq=w[t]=w[t]||[];ttq.methods=["page","track","identify","instances","debug","on","off","once","ready","alias","group","enableCookie","disableCookie"],ttq.setAndDefer=function(t,e){t[e]=function(){t.push([e].concat(Array.prototype.slice.call(arguments,0)))}};for(var i=0;i<ttq.methods.length;i++)ttq.setAndDefer(ttq,ttq.methods[i]);ttq.instance=function(t){for(var e=ttq._i[t]||[],n=0;n<e.length;n++)ttq.setAndDefer(e[n],ttq.methods[n]);return e},ttq.load=function(e,n){var i="https://analytics.tiktok.com/i18n/pixel/events.js";ttq._i=ttq._i||{},ttq._i[e]=[],ttq._i[e]._u=i,ttq._t=ttq._t||{},ttq._t[e]=+new Date,ttq._o=ttq._o||{},ttq._o[e]=n||{};var o=document.createElement("script");o.type="text/javascript",o.async=!0,o.src=i+"?sdkid="+e+"&lib="+t;var a=document.getElementsByTagName("script")[0];a.parentNode.insertBefore(o,a)};
+ttq.load('${a.pixelId}');
+ttq.page();
+}(window, document, 'ttq');
+</script>`;
+}
+
+export function analyticsHead(settings: Settings): string {
+  const a = settings.analytics;
+  return [umamiTag(a.umami), umamiReplayTag(a.umami), metaPixelTag(a.metaPixel), tiktokPixelTag(a.tiktokPixel)]
+    .filter(Boolean)
+    .join('\n');
+}
+
+// Event names are author-typed; collapse whitespace so "Sign  up " and
+// "Sign up" count as one event in the dashboards.
+export function cleanEventName(name: string): string {
+  return name.replace(/\s+/g, ' ').trim();
+}
+
+// Click-event bridge: elements carrying data-umami-event (editor cards, the
+// links page) are counted by Umami natively — this dispatcher only exists to
+// forward the same clicks to the ad pixels, so it is emitted solely when one
+// of them is actually enabled. Umami-only sites ship zero extra JS.
+export function analyticsBody(settings: Settings): string {
+  const a = settings.analytics;
+  const meta = a.metaPixel.enabled && META_PIXEL_ID_RE.test(a.metaPixel.pixelId);
+  const tiktok = a.tiktokPixel.enabled && TIKTOK_PIXEL_ID_RE.test(a.tiktokPixel.pixelId);
+  if (!meta && !tiktok) return '';
+  return `<script>
+document.addEventListener('click', function (e) {
+  var el = e.target && e.target.closest && e.target.closest('[data-umami-event]');
+  if (!el) return;
+  var name = el.getAttribute('data-umami-event');
+  if (!name) return;
+  if (window.fbq) window.fbq('trackCustom', name);
+  if (window.ttq) window.ttq.track(name);
+});
+</script>`;
+}

package/src/lib/designPreview.ts

@@ -0,0 +1,14 @@
+import type { AstroCookies } from 'astro';
+import type { Settings } from './schema';
+import { mergeDesignDraft } from './drafts';
+import { verifySessionToken, SESSION_COOKIE } from './auth';
+
+// The Design screen's preview iframe appends ?designPreview=1 so admins see
+// the STAGED design (settings.draftDesign) while every normal request keeps
+// rendering the live one. Session-gated: the flag is inert for visitors.
+export function effectiveSettings(settings: Settings, url: URL, cookies: AstroCookies): Settings {
+  if (!settings.draftDesign) return settings;
+  if (!url.searchParams.has('designPreview')) return settings;
+  if (!verifySessionToken(cookies.get(SESSION_COOKIE)?.value)) return settings;
+  return mergeDesignDraft(settings);
+}

package/src/lib/drafts.ts

@@ -0,0 +1,77 @@
+import type { Page, Post, Settings } from './schema';
+
+// Pending-edit ("draft") snapshots for live documents. A published or
+// scheduled post/page never receives content edits directly: they accumulate
+// in the row's `draft` JSON column and only reach the live columns when the
+// user hits Update (repo.applyPostDraft / applyPageDraft).
+//
+// The snapshot stores the same camelCase field names the save actions accept,
+// plus `savedAt`. Status transitions, schedule times and the publish sweep
+// never live in a snapshot — those stay deliberate, immediate actions.
+
+export const POST_DRAFT_KEYS = [
+  'title', 'slug', 'collection', 'body', 'bodyJson', 'bodyHtml', 'excerpt',
+  'tags', 'cover', 'coverAlt', 'seoTitle', 'seoDesc', 'featured',
+  'authorIds', 'template', 'publishedAt',
+] as const;
+
+export const PAGE_DRAFT_KEYS = [
+  'title', 'slug', 'locale', 'isHome', 'seoTitle', 'seoDesc', 'template',
+  'bodyJson', 'bodyHtml', 'blocks',
+] as const;
+
+type PostDraftKey = (typeof POST_DRAFT_KEYS)[number];
+type PageDraftKey = (typeof PAGE_DRAFT_KEYS)[number];
+
+function pick(draft: Record<string, unknown>, keys: readonly string[]) {
+  const out: Record<string, unknown> = {};
+  for (const k of keys) if (draft[k] !== undefined) out[k] = draft[k];
+  return out;
+}
+
+// Only known editable fields survive the pick — a hand-edited or legacy
+// snapshot can never smuggle status/id/timestamps into an UPDATE.
+export function pickPostDraft(draft: Record<string, unknown>): Partial<Pick<Post, PostDraftKey>> {
+  return pick(draft, POST_DRAFT_KEYS) as Partial<Pick<Post, PostDraftKey>>;
+}
+export function pickPageDraft(draft: Record<string, unknown>): Partial<Pick<Page, PageDraftKey>> {
+  return pick(draft, PAGE_DRAFT_KEYS) as Partial<Pick<Page, PageDraftKey>>;
+}
+
+// The document as it will look after Update — what the editor hydrates from
+// and what /preview renders. Live rows pass through untouched.
+export function mergePostDraft(post: Post): Post {
+  if (!post.draft) return post;
+  const staged = pickPostDraft(post.draft);
+  const merged = { ...post, ...staged };
+  if (staged.authorIds) merged.authorId = staged.authorIds[0] ?? null;
+  return merged;
+}
+export function mergePageDraft(page: Page): Page {
+  if (!page.draft) return page;
+  return { ...page, ...pickPageDraft(page.draft) };
+}
+
+export function draftSavedAt(doc: Pick<Post | Page, 'draft'>): number | null {
+  const ts = doc.draft?.savedAt;
+  return typeof ts === 'number' ? ts : null;
+}
+
+// Design-screen staging: the same shape, stored in settings.draftDesign and
+// applied by the "Publish design" button.
+export const DESIGN_DRAFT_KEYS = [
+  'activeTheme', 'designOverrides', 'siteLogo', 'siteFavicon', 'siteCover',
+] as const;
+
+type DesignDraftKey = (typeof DESIGN_DRAFT_KEYS)[number];
+
+export function pickDesignDraft(draft: Record<string, unknown>): Partial<Pick<Settings, DesignDraftKey>> {
+  return pick(draft, DESIGN_DRAFT_KEYS) as Partial<Pick<Settings, DesignDraftKey>>;
+}
+
+// Settings as they will look after Publish design — what ?designPreview=1
+// renders for admins while visitors keep the live design.
+export function mergeDesignDraft(settings: Settings): Settings {
+  if (!settings.draftDesign) return settings;
+  return { ...settings, ...pickDesignDraft(settings.draftDesign) };
+}

package/src/lib/dynamicBlocks.ts

@@ -14,8 +14,9 @@ import { renderCalendarBlock } from './calendar/render';
 //        data-layout="grid" data-limit="3" data-show-image="1" data-show-excerpt="1"></div>
 //   <div data-dyn="calendar" data-sources="[…ics urls]" data-view="month"
 //        data-title="…" data-subtitle="…" data-limit="6" data-open-link="1"></div>
+//   <div data-dyn="toc" data-title="In this article"></div>
 
-const PLACEHOLDER = /<div[^>]*data-dyn="(?:post-list|calendar)"[^>]*>\s*<\/div>/g;
+const PLACEHOLDER = /<div[^>]*data-dyn="(?:post-list|calendar|toc)"[^>]*>\s*<\/div>/g;
 
 const esc = (s: string) =>
   s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
@@ -51,6 +52,41 @@ function renderList(posts: Post[], layout: string, showImage: boolean, showExcer
   return `<section class="dyn-postlist" data-layout="${esc(layout)}">${items}</section>`;
 }
 
+// Heading anchors: body h1–h3 get stable slugified ids so sections are
+// deep-linkable and the TOC block has targets. Headings that already carry an
+// id (e.g. hand-written in an HTML card) are left alone.
+export function stampHeadingAnchors(html: string): string {
+  const seen = new Map<string, number>();
+  return html.replace(/<h([1-3])(\s[^>]*)?>([\s\S]*?)<\/h\1>/g, (m, lvl: string, attrs: string | undefined, inner: string) => {
+    if (attrs && /\bid=/.test(attrs)) return m;
+    const text = inner.replace(/<[^>]+>/g, '').replace(/&amp;/g, '&').replace(/&#0?39;|&apos;/g, "'");
+    const base = slugify(text);
+    const n = (seen.get(base) ?? 0) + 1;
+    seen.set(base, n);
+    const id = n > 1 ? `${base}-${n}` : base;
+    return `<h${lvl}${attrs ?? ''} id="${id}">${inner}</h${lvl}>`;
+  });
+}
+
+// Table of contents: rebuilt from the body's (already anchored) headings on
+// every request, so it can never go stale. Depth is relative to the shallowest
+// heading present.
+function renderToc(html: string, title: string): string {
+  const items: { level: number; id: string; text: string }[] = [];
+  const re = /<h([1-3])[^>]*\bid="([^"]+)"[^>]*>([\s\S]*?)<\/h\1>/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(html))) {
+    const text = m[3].replace(/<[^>]+>/g, '').trim();
+    if (text) items.push({ level: Number(m[1]), id: m[2], text });
+  }
+  if (!items.length) return '';
+  const min = Math.min(...items.map((i) => i.level));
+  const links = items
+    .map((i) => `<a class="pc-toc-link" data-depth="${i.level - min}" href="#${esc(i.id)}">${i.text}</a>`)
+    .join('');
+  return `<nav class="pc-toc">${title ? `<span class="pc-toc-title">${esc(title)}</span>` : ''}${links}</nav>`;
+}
+
 function calendarAttrs(tag: string) {
   let sources: string[] = [];
   try {
@@ -71,9 +107,11 @@ function calendarAttrs(tag: string) {
 }
 
 export async function expandDynamicBlocks(html: string, repo: ContentRepository): Promise<string> {
+  html = stampHeadingAnchors(html);
   const hasPostList = html.includes('data-dyn="post-list"');
   const hasCalendar = html.includes('data-dyn="calendar"');
-  if (!hasPostList && !hasCalendar) return html;
+  const hasToc = html.includes('data-dyn="toc"');
+  if (!hasPostList && !hasCalendar && !hasToc) return html;
   const [posts, settings] = await Promise.all([
     hasPostList ? repo.listPublishedPosts() : Promise.resolve([] as Post[]), // newest first; shared by all blocks on the page
     repo.getSettings(),
@@ -83,15 +121,17 @@ export async function expandDynamicBlocks(html: string, repo: ContentRepository)
   // rendered up front, then spliced in during the synchronous pass.
   const calendarHtml = new Map<string, string>();
   if (hasCalendar) {
-    const tags = [...new Set((html.match(PLACEHOLDER) ?? []).filter((t) => t.includes('data-dyn="calendar"')))];
+    const tags = [...new Set((html.match(PLACEHOLDER) ?? ([] as string[])).filter((t) => t.includes('data-dyn="calendar"')))];
     const now = Date.now();
     await Promise.all(
       tags.map(async (tag) => calendarHtml.set(tag, await renderCalendarBlock(calendarAttrs(tag), settings, now)))
     );
   }
 
+  const anchored = html;
   return html.replace(PLACEHOLDER, (tag) => {
     if (tag.includes('data-dyn="calendar"')) return calendarHtml.get(tag) ?? '';
+    if (tag.includes('data-dyn="toc"')) return renderToc(anchored, attr(tag, 'title'));
     const source = attr(tag, 'source') || 'latest';
     const tagName = attr(tag, 'tag');
     // which collection the block draws from; 'posts' unless the card says otherwise

package/src/lib/plaintext.ts

@@ -0,0 +1,22 @@
+// Searchable plain text from rendered body_html: the FTS index stores this
+// instead of a posts column, derived once per write. Dynamic-block
+// placeholders (<div data-dyn>) carry no text, so tag-stripping drops them;
+// script/style bodies are removed explicitly. Entity decoding covers what
+// the editor emits — the named basics plus numeric escapes.
+const codePoint = (n: number) => (n > 0 && n <= 0x10ffff ? String.fromCodePoint(n) : ' ');
+
+export function htmlToPlaintext(html: string): string {
+  if (!html) return '';
+  return html
+    .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&#x([0-9a-f]+);/gi, (_, h: string) => codePoint(parseInt(h, 16)))
+    .replace(/&#(\d+);/g, (_, n: string) => codePoint(Number(n)))
+    .replace(/&nbsp;/gi, ' ')
+    .replace(/&amp;/gi, '&')
+    .replace(/&lt;/gi, '<')
+    .replace(/&gt;/gi, '>')
+    .replace(/&quot;/gi, '"')
+    .replace(/\s+/g, ' ')
+    .trim();
+}

package/src/lib/repo/migrations.ts

@@ -226,6 +226,58 @@ export const MIGRATIONS: Migration[] = [
     version: 20,
     statements: [`ALTER TABLE pages ADD COLUMN locale TEXT NOT NULL DEFAULT ''`],
   },
+  {
+    // Public search: one FTS5 row per published post/page (title, excerpt,
+    // stripped body text, public tag names). Rows are synced by the repo on
+    // every write — no SQL triggers — and backfilled in code right after
+    // this version applies, since plaintext can't be derived in SQL.
+    // remove_diacritics makes "cafe" match "café" (matters for es content).
+    version: 21,
+    statements: [
+      `CREATE VIRTUAL TABLE IF NOT EXISTS search_index USING fts5(
+        kind UNINDEXED, ref_id UNINDEXED, locale UNINDEXED,
+        title, excerpt, plaintext, tags,
+        tokenize = 'unicode61 remove_diacritics 2'
+      )`,
+    ],
+  },
+  {
+    // Manual publish: live (published/scheduled) documents stage their edits
+    // in a `draft` JSON snapshot; the live columns only change when the user
+    // hits Update. NULL = no pending edits.
+    version: 22,
+    statements: [
+      `ALTER TABLE posts ADD COLUMN draft TEXT`,
+      `ALTER TABLE pages ADD COLUMN draft TEXT`,
+    ],
+  },
+  {
+    // Manual publish for the Design screen: theme/token/logo changes stage in
+    // a `draft_design` JSON snapshot (previewed with ?designPreview=1) until
+    // the user hits Publish design. NULL = no staged design.
+    version: 23,
+    statements: [`ALTER TABLE settings ADD COLUMN draft_design TEXT`],
+  },
+  {
+    // Snippets: named, reusable fragments of editor content ("Save as
+    // snippet" on a selection; re-inserted from the "/" menu).
+    version: 24,
+    statements: [
+      `CREATE TABLE IF NOT EXISTS snippets (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        content_json TEXT NOT NULL,
+        created_at INTEGER NOT NULL
+      )`,
+    ],
+  },
+  {
+    // Analytics providers (Umami, Meta Pixel, TikTok Pixel): structured
+    // per-provider settings rendered into the public <head>. JSON object,
+    // '{}' = every provider disabled (schema defaults).
+    version: 25,
+    statements: [`ALTER TABLE settings ADD COLUMN analytics TEXT DEFAULT '{}'`],
+  },
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;