@acms-subir/core 0.3.2 → 0.3.3-next.20260929113209

package/src/lib/import/ghost.ts

@@ -0,0 +1,247 @@
+import { slugify } from '../schema';
+import {
+  BUNDLE_FORMAT, BUNDLE_VERSION, assetPlaceholder,
+  type ImportAsset, type ImportAuthor, type ImportBundle, type ImportIdentity, type ImportItem, type ImportNav, type ImportTag, type ImportWarning,
+} from './bundle';
+import { lexicalToHtml, type LexicalContext } from './lexical';
+
+// Ghost JSON export (Settings → Labs → Export) → Import Bundle.
+//
+// The export is a database dump: db[0].data holds ~20 tables, including
+// Ghost's private keys and session/member secrets in `settings`. Only an
+// allow-list of settings keys is read, and the raw file never leaves the
+// browser — just the bundle built here is sent to the server.
+//
+// Images and files are NOT in the export; content references them as
+// `__GHOST_URL__/content/(images|files|media)/…`. Each becomes an asset whose
+// url is that content-relative path, fetched later from the old site or read
+// from Ghost's content folder ZIP.
+
+type Row = Record<string, unknown>;
+
+export function isGhostExport(json: unknown): boolean {
+  const db = (json as { db?: unknown })?.db;
+  const first = Array.isArray(db) ? (db[0] as Row | undefined) : undefined;
+  const meta = first?.meta as Row | undefined;
+  const data = first?.data as Row | undefined;
+  return typeof meta?.version === 'string' && Array.isArray(data?.posts);
+}
+
+export interface GhostOptions {
+  // the old site's public origin, used to resolve absolute links back to
+  // relative ones and to build asset download URLs
+  siteUrl?: string;
+  // markdown card renderer (the app's `marked` setup)
+  markdown: (md: string) => string;
+}
+
+const str = (v: unknown) => (typeof v === 'string' ? v : '');
+const time = (v: unknown): number | null => {
+  const t = typeof v === 'string' || typeof v === 'number' ? new Date(v).getTime() : NaN;
+  return Number.isFinite(t) ? t : null;
+};
+
+// Ghost serves resized copies under content/images/size/w600/ (and
+// format/webp/); the original is the same path without those segments.
+export function ghostContentPath(url: string, siteUrl = ''): string | null {
+  let path: string | null = null;
+  if (url.startsWith('__GHOST_URL__/')) path = url.slice('__GHOST_URL__/'.length);
+  else if (siteUrl && url.startsWith(siteUrl.replace(/\/+$/, '') + '/')) path = url.slice(siteUrl.replace(/\/+$/, '').length + 1);
+  if (path === null || !/^content\/(images|files|media)\//.test(path)) return null;
+  path = path.split(/[?#]/)[0].replace(/^content\/images\/size\/[^/]+\/(format\/[^/]+\/)?/, 'content/images/');
+  try { path = decodeURI(path); } catch { /* keep as-is */ }
+  return path;
+}
+
+export function ghostToBundle(json: unknown, options: GhostOptions): ImportBundle {
+  if (!isGhostExport(json)) throw new Error('This is not a Ghost export (expected db[0].data.posts).');
+  const first = (json as { db: Row[] }).db[0];
+  const meta = first.meta as Row;
+  const data = first.data as Record<string, Row[] | undefined>;
+  const table = (name: string) => (Array.isArray(data[name]) ? data[name]! : []);
+  const siteUrl = str(options.siteUrl).replace(/\/+$/, '');
+
+  const warnings: ImportWarning[] = [];
+  const assets = new Map<string, ImportAsset>();
+  function asset(url: string, kind: ImportAsset['kind'], m: { filename?: string; alt?: string } = {}): string {
+    const path = ghostContentPath(url, siteUrl);
+    if (!path) return url.startsWith('__GHOST_URL__') ? url.slice('__GHOST_URL__'.length) || '/' : url;
+    let a = assets.get(path);
+    if (!a) {
+      // the folder decides the kind: images/ get resized, files/ are
+      // documents, media/ is video/audio (not re-hosted yet)
+      const folder = path.split('/')[1];
+      kind = folder === 'images' ? 'image' : folder === 'media' ? 'media' : 'file';
+      a = { ref: `a${assets.size + 1}`, url: path, kind, filename: m.filename || path.split('/').pop() || '', alt: m.alt ?? '' };
+      assets.set(path, a);
+    } else if (!a.alt && m.alt) a.alt = m.alt;
+    return assetPlaceholder(a.ref);
+  }
+  function link(url: string): string {
+    if (!url) return '';
+    if (ghostContentPath(url, siteUrl)) return asset(url, 'file');
+    if (url.startsWith('__GHOST_URL__')) return url.slice('__GHOST_URL__'.length) || '/';
+    if (siteUrl && (url === siteUrl || url.startsWith(siteUrl + '/'))) return url.slice(siteUrl.length) || '/';
+    return url;
+  }
+  const ghostUrlRe = new RegExp(`(?:__GHOST_URL__${siteUrl ? `|${siteUrl.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}` : ''})(/[^\\s"'<>)&]*)?`, 'g');
+  let rawWarn: ((code: string, message: string) => void) | null = null;
+  function rawHtml(html: string): string {
+    return html.replace(ghostUrlRe, (m, _path, offset: number) => {
+      // a URL passed inside another URL (…/viewer?url=https://old/file.pdf)
+      // must stay absolute; a /media path would mean nothing to that service
+      if (html[offset - 1] === '=' && /^https?:/.test(m)) {
+        rawWarn?.('nested-url', `An embed loads ${m} through another service, so it still points at the old site. Re-link it after the import.`);
+        return m;
+      }
+      return ghostContentPath(m, siteUrl) ? asset(m, 'file') : link(m);
+    });
+  }
+
+  // ---- settings (allow-list) ----
+  const settings = new Map(table('settings').map((s) => [str(s.key), s.value]));
+  const setting = (key: string) => str(settings.get(key)).trim();
+  const identity: ImportIdentity = {};
+  if (setting('title')) identity.siteTitle = setting('title');
+  if (setting('description')) identity.tagline = setting('description');
+  if (setting('logo')) identity.siteLogo = asset(setting('logo'), 'image');
+  if (setting('icon')) identity.siteFavicon = asset(setting('icon'), 'image');
+  if (setting('cover_image')) identity.siteCover = asset(setting('cover_image'), 'image');
+  if (setting('timezone')) identity.timezone = setting('timezone');
+  if (setting('locale')) identity.locale = setting('locale');
+  if (setting('codeinjection_head')) identity.headCode = setting('codeinjection_head');
+
+  const nav: ImportNav[] = [];
+  for (const [key, area] of [['navigation', 'header'], ['secondary_navigation', 'footer']] as const) {
+    let items: unknown;
+    try { items = JSON.parse(setting(key) || '[]'); } catch { items = []; }
+    for (const it of Array.isArray(items) ? (items as Row[]) : []) {
+      const label = str(it.label).trim();
+      const url = link(str(it.url).trim());
+      // #/portal/… links open Ghost's members portal, which doesn't exist here
+      if (!label || !url || url.includes('#/portal')) continue;
+      nav.push({ label, url, area });
+    }
+  }
+  const facebook = setting('facebook'), twitter = setting('twitter');
+  if (facebook && facebook !== 'null') nav.push({ label: 'Facebook', url: `https://www.facebook.com/${facebook.replace(/^@/, '')}`, area: 'social' });
+  if (twitter && twitter !== 'null') nav.push({ label: 'X', url: `https://x.com/${twitter.replace(/^@/, '')}`, area: 'social' });
+
+  // ---- authors ----
+  const authors: ImportAuthor[] = table('users').map((u) => ({
+    sourceId: str(u.id),
+    name: str(u.name).trim() || str(u.slug) || 'Author',
+    slug: str(u.slug),
+    email: str(u.email).trim().toLowerCase(),
+    bio: str(u.bio),
+    avatar: str(u.profile_image) ? asset(str(u.profile_image), 'image') : '',
+    inactive: ['locked', 'inactive'].includes(str(u.status)),
+  }));
+
+  // ---- tags ----
+  const tagById = new Map<string, ImportTag>();
+  for (const t of table('tags')) {
+    const name = str(t.name).trim();
+    if (!name) continue;
+    tagById.set(str(t.id), { name, slug: str(t.slug) || slugify(name), description: str(t.description) });
+  }
+
+  // ---- joins, in Ghost's sort order ----
+  const joined = (tableName: string, key: string) => {
+    const map = new Map<string, string[]>();
+    const rows = [...table(tableName)].sort((a, b) => Number(a.sort_order ?? 0) - Number(b.sort_order ?? 0));
+    for (const r of rows) {
+      const list = map.get(str(r.post_id)) ?? [];
+      list.push(str(r[key]));
+      map.set(str(r.post_id), list);
+    }
+    return map;
+  };
+  const postTags = joined('posts_tags', 'tag_id');
+  const postAuthors = joined('posts_authors', 'author_id');
+  const postMeta = new Map(table('posts_meta').map((m) => [str(m.post_id), m]));
+
+  // ---- posts & pages ----
+  const items: ImportItem[] = [];
+  for (const p of table('posts')) {
+    const id = str(p.id);
+    const title = str(p.title) || 'Untitled';
+    const warn = (code: string, message: string) => warnings.push({ item: id, code, message: `${title}: ${message}` });
+    const ctx: LexicalContext = { asset, link, rawHtml, markdown: options.markdown, warn };
+    rawWarn = warn;
+
+    let html = '';
+    if (str(p.lexical)) {
+      try { html = lexicalToHtml(JSON.parse(str(p.lexical)), ctx); }
+      catch { warn('unreadable-body', 'The Lexical body could not be read, so Ghost’s rendered HTML was used instead.'); html = rawHtml(str(p.html)); }
+    } else if (str(p.html)) {
+      // pre-Lexical (mobiledoc) posts: Ghost's rendered HTML still loads in
+      // the editor, but its kg-card markup won't become acms cards
+      warn('legacy-body', 'Written in Ghost’s older editor. Text and images import; check any cards.');
+      html = rawHtml(str(p.html));
+    }
+
+    let status = str(p.status);
+    if (status === 'sent') {
+      warn('email-only', 'This was an email-only newsletter, so it imports as a draft.');
+      status = 'draft';
+    }
+    if (!['draft', 'published', 'scheduled'].includes(status)) status = 'draft';
+    if (str(p.visibility) && str(p.visibility) !== 'public') {
+      warn('visibility', `Was visible to “${str(p.visibility)}” members only; acms has no memberships, so it will be public once published.`);
+    }
+    if (str(p.codeinjection_head) || str(p.codeinjection_foot)) {
+      warn('post-code', 'Has per-post code injection, which acms doesn’t support. Move it into the post as an HTML card if it’s still needed.');
+    }
+
+    const m = postMeta.get(id) ?? {};
+    const created = time(p.created_at) ?? Date.now();
+    const published = time(p.published_at);
+    const slug = str(p.slug) || slugify(title);
+    items.push({
+      sourceId: id,
+      type: str(p.type) === 'page' ? 'page' : 'post',
+      collection: 'posts',
+      slug,
+      title,
+      status: status as ImportItem['status'],
+      html,
+      excerpt: str(p.custom_excerpt),
+      cover: str(p.feature_image) ? asset(str(p.feature_image), 'image', { alt: str(m.feature_image_alt) }) : '',
+      coverAlt: str(m.feature_image_alt),
+      seoTitle: str(m.meta_title),
+      seoDesc: str(m.meta_description),
+      featured: Boolean(p.featured),
+      template: '',
+      locale: '',
+      tags: (postTags.get(id) ?? []).map((t) => tagById.get(t)?.name).filter((n): n is string => Boolean(n)),
+      authors: postAuthors.get(id) ?? [],
+      publishedAt: status === 'draft' ? null : published,
+      scheduledAt: status === 'scheduled' ? published : null,
+      createdAt: created,
+      updatedAt: time(p.updated_at) ?? created,
+      legacyPath: `/${slug}/`,
+    });
+  }
+
+  return {
+    format: BUNDLE_FORMAT,
+    version: BUNDLE_VERSION,
+    source: {
+      kind: 'ghost',
+      version: str(meta.version),
+      title: identity.siteTitle ?? '',
+      siteUrl,
+      exportedAt: time(meta.exported_on) ? new Date(time(meta.exported_on)!).toISOString() : '',
+    },
+    identity,
+    authors,
+    tags: [...tagById.values()],
+    items,
+    assets: [...assets.values()],
+    media: [],
+    nav,
+    redirects: [],
+    warnings,
+  };
+}

package/src/lib/import/lexical.ts

@@ -0,0 +1,290 @@
+import { detectEmbed } from '../embeds';
+import { escapeAttr, escapeHtml } from './bundle';
+
+// Ghost's Lexical document (posts.lexical) → editor-compatible HTML. Every
+// card is emitted as the exact markup its acms editor node renders (see
+// components/editor/extensions/*), so the public page renders it with the
+// same styles and the editor's parseHTML rules load it back as that card.
+// Pure string building, no DOM: runs in the browser, in Workers and in tests.
+
+export interface LexicalNode {
+  type?: string;
+  children?: LexicalNode[];
+  [key: string]: unknown;
+}
+
+export interface LexicalContext {
+  // a file hosted by the source site → acms-asset placeholder (or the URL
+  // itself when it isn't the source's own file)
+  asset(url: string, kind: 'image' | 'file' | 'media', meta?: { filename?: string; alt?: string }): string;
+  // an ordinary link target (internal source links become relative paths)
+  link(url: string): string;
+  // raw HTML from an HTML/markdown card, with the source's file URLs swapped
+  rawHtml(html: string): string;
+  markdown(md: string): string;
+  warn(code: string, message: string): void;
+}
+
+// Lexical text format bitmask
+const BOLD = 1, ITALIC = 2, STRIKE = 4, UNDERLINE = 8, CODE = 16, HIGHLIGHT = 128;
+
+const str = (v: unknown) => (typeof v === 'string' ? v : '');
+const num = (v: unknown) => (typeof v === 'number' && Number.isFinite(v) ? v : 0);
+
+// Ghost stores captions and a few card fields as small HTML fragments; acms
+// card captions are plain text.
+export function htmlToText(html: string): string {
+  return decodeEntities(html.replace(/<br\s*\/?>/gi, ' ').replace(/<[^>]*>/g, ''))
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+function decodeEntities(s: string): string {
+  return s
+    .replace(/&nbsp;/g, ' ')
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;|&#x27;/g, "'")
+    .replace(/&#(\d+);/g, (_, d: string) => String.fromCodePoint(Number(d)))
+    .replace(/&amp;/g, '&');
+}
+
+// Block content for containers that require it (toggle bodies): wrap bare
+// inline HTML in a paragraph.
+function asBlocks(html: string): string {
+  const t = html.trim();
+  if (!t) return '<p></p>';
+  return /^<(p|h[1-6]|ul|ol|blockquote|pre|figure|hr|table|div|aside|details)\b/i.test(t) ? t : `<p>${t}</p>`;
+}
+
+export function lexicalToHtml(doc: unknown, ctx: LexicalContext): string {
+  const root = (doc && typeof doc === 'object' && 'root' in doc ? (doc as { root: LexicalNode }).root : doc) as LexicalNode | null;
+  if (!root || !Array.isArray(root.children)) return '';
+  return blocks(root.children, ctx);
+}
+
+function blocks(nodes: LexicalNode[], ctx: LexicalContext): string {
+  return nodes.map((n) => block(n, ctx)).join('');
+}
+
+function inline(nodes: LexicalNode[] | undefined, ctx: LexicalContext): string {
+  let out = '';
+  for (const n of nodes ?? []) {
+    switch (n.type) {
+      case 'text':
+      case 'extended-text': {
+        let t = escapeHtml(str(n.text));
+        const f = num(n.format);
+        if (f & CODE) t = `<code>${t}</code>`;
+        if (f & HIGHLIGHT) t = `<mark>${t}</mark>`;
+        if (f & STRIKE) t = `<s>${t}</s>`;
+        if (f & UNDERLINE) t = `<u>${t}</u>`;
+        if (f & ITALIC) t = `<em>${t}</em>`;
+        if (f & BOLD) t = `<strong>${t}</strong>`;
+        out += t;
+        break;
+      }
+      case 'linebreak':
+        out += '<br>';
+        break;
+      case 'tab':
+        out += ' ';
+        break;
+      case 'link':
+      case 'autolink': {
+        const href = ctx.link(str(n.url));
+        out += href ? `<a href="${escapeAttr(href)}">${inline(n.children, ctx)}</a>` : inline(n.children, ctx);
+        break;
+      }
+      default:
+        // unknown inline wrappers (hashtags, mentions…) keep their text
+        out += n.children ? inline(n.children, ctx) : escapeHtml(str(n.text));
+    }
+  }
+  return out;
+}
+
+function list(n: LexicalNode, ctx: LexicalContext): string {
+  const ordered = n.listType === 'number' || n.tag === 'ol';
+  // Lexical nests a sub-list as its own listitem holding only the list; in
+  // HTML (and the editor) it belongs inside the previous item.
+  const items: string[] = [];
+  for (const li of n.children ?? []) {
+    const kids = li.children ?? [];
+    const nested = kids.filter((k) => k.type === 'list');
+    const body = kids.filter((k) => k.type !== 'list');
+    const sub = nested.map((k) => list(k, ctx)).join('');
+    if (!body.length && sub && items.length) {
+      items[items.length - 1] = items[items.length - 1].replace(/<\/li>$/, `${sub}</li>`);
+      continue;
+    }
+    items.push(`<li><p>${inline(body, ctx)}</p>${sub}</li>`);
+  }
+  if (!items.length) return '';
+  const start = ordered && num(n.start) > 1 ? ` start="${num(n.start)}"` : '';
+  return ordered ? `<ol${start}>${items.join('')}</ol>` : `<ul>${items.join('')}</ul>`;
+}
+
+function figureCaption(caption: unknown): string {
+  const t = htmlToText(str(caption));
+  return t ? `<figcaption>${escapeHtml(t)}</figcaption>` : '';
+}
+
+function imageTag(src: string, alt: string, width: number, height: number): string {
+  const dims = width && height ? ` width="${width}" height="${height}"` : '';
+  return `<img src="${escapeAttr(src)}" alt="${escapeAttr(alt)}" loading="lazy"${dims}>`;
+}
+
+function embedCard(url: string, caption: unknown): string | null {
+  const info = detectEmbed(url);
+  if (!info || info.provider === 'iframe') return null;
+  const frame = `<div class="pc-embed-frame" style="aspect-ratio:16/9"><iframe src="${escapeAttr(info.embedSrc)}" loading="lazy" allowfullscreen="" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture"></iframe></div>`;
+  return `<figure class="pc-embed" data-provider="${info.provider}" data-url="${escapeAttr(url)}" data-height="400">${frame}${figureCaption(caption)}</figure>`;
+}
+
+function htmlCard(html: string): string {
+  return html.trim() ? `<div class="pc-html">${html}</div>` : '';
+}
+
+// A table pasted into Ghost's HTML card becomes a real table: the editor's
+// table extension parses plain <table> markup, so it stays editable.
+const TABLE_ONLY = /^\s*<table\b[^>]*>[\s\S]*<\/table>\s*$/i;
+function plainTable(html: string): string | null {
+  if (!TABLE_ONLY.test(html) || /<table\b[\s\S]*<table\b/i.test(html)) return null;
+  // styled tables keep their look as an HTML card
+  if (/<(script|style|iframe|form|input|img)\b|\s(on\w+|style|class)=/i.test(html)) return null;
+  return html.trim();
+}
+
+function block(n: LexicalNode, ctx: LexicalContext): string {
+  switch (n.type) {
+    case 'paragraph':
+      return `<p>${inline(n.children, ctx)}</p>`;
+    case 'heading':
+    case 'extended-heading': {
+      const body = inline(n.children, ctx);
+      if (!body.trim()) return '';
+      // the editor's deepest heading is h3
+      const level = Math.min(3, Math.max(1, Number(str(n.tag).slice(1)) || 2));
+      return `<h${level}>${body}</h${level}>`;
+    }
+    case 'quote':
+    case 'extended-quote':
+    // Ghost's "aside" is its second quote style (the large pull quote)
+    case 'aside':
+      return `<blockquote><p>${inline(n.children, ctx)}</p></blockquote>`;
+    case 'list':
+      return list(n, ctx);
+    case 'horizontalrule':
+      return '<hr>';
+    case 'codeblock': {
+      const lang = str(n.language).replace(/[^a-z0-9+#-]/gi, '');
+      const code = `<pre><code${lang ? ` class="language-${lang}"` : ''}>${escapeHtml(str(n.code))}</code></pre>`;
+      return code;
+    }
+    case 'image': {
+      const src = str(n.src);
+      if (!src) return '';
+      const alt = str(n.alt);
+      const url = ctx.asset(src, 'image', { alt });
+      const width = n.cardWidth === 'wide' ? ' data-width="wide"' : n.cardWidth === 'full' ? ' data-width="full"' : '';
+      return `<figure class="pc-image"${width}>${imageTag(url, alt, num(n.width), num(n.height))}${figureCaption(n.caption)}</figure>`;
+    }
+    case 'gallery': {
+      const images = (Array.isArray(n.images) ? n.images : []) as LexicalNode[];
+      const tags = images
+        .filter((img) => str(img.src))
+        .map((img) => `<img src="${escapeAttr(ctx.asset(str(img.src), 'image', { alt: str(img.alt) }))}" alt="${escapeAttr(str(img.alt))}" loading="lazy">`);
+      if (!tags.length) return '';
+      return `<figure class="pc-gallery"><div class="pc-gallery-grid" data-count="${tags.length}">${tags.join('')}</div>${figureCaption(n.caption)}</figure>`;
+    }
+    case 'embed': {
+      const url = str(n.url);
+      const card = url ? embedCard(url, n.caption) : null;
+      if (card) return card;
+      // non-video embeds (tweets, Spotify…) keep Ghost's oEmbed markup
+      const html = str(n.html);
+      if (html) return htmlCard(ctx.rawHtml(html));
+      return url ? `<p><a href="${escapeAttr(url)}">${escapeHtml(url)}</a></p>` : '';
+    }
+    case 'bookmark': {
+      const url = str(n.url);
+      if (!url) return '';
+      const meta = (n.metadata ?? {}) as Record<string, unknown>;
+      const title = str(meta.title) || url;
+      let host = '';
+      try { host = new URL(url).hostname; } catch { /* keep empty */ }
+      const favicon = str(meta.icon) ? `<img class="pc-bookmark-favicon" src="${escapeAttr(str(meta.icon))}" alt="" loading="lazy">` : '';
+      const desc = str(meta.description) ? `<div class="pc-bookmark-desc">${escapeHtml(str(meta.description))}</div>` : '';
+      const thumb = str(meta.thumbnail) ? `<div class="pc-bookmark-thumb"><img src="${escapeAttr(str(meta.thumbnail))}" alt="" loading="lazy"></div>` : '';
+      return `<a class="pc-bookmark" href="${escapeAttr(url)}" target="_blank" rel="noopener"><div class="pc-bookmark-content"><div class="pc-bookmark-title">${escapeHtml(title)}</div>${desc}<div class="pc-bookmark-meta">${favicon}<span class="pc-bookmark-site">${escapeHtml(str(meta.publisher) || host)}</span></div></div>${thumb}</a>`;
+    }
+    case 'callout': {
+      const emoji = str(n.calloutEmoji) || '💡';
+      const body = ctx.rawHtml(str(n.calloutText)).replace(/<\/?p\b[^>]*>/gi, '');
+      return `<aside class="pc-callout" data-emoji="${escapeAttr(emoji)}"><span class="pc-callout-emoji">${escapeHtml(emoji)}</span><div class="pc-callout-body">${body}</div></aside>`;
+    }
+    case 'toggle': {
+      const summary = htmlToText(str(n.heading));
+      return `<details class="pc-toggle"><summary>${escapeHtml(summary)}</summary><div class="pc-toggle-body">${asBlocks(ctx.rawHtml(str(n.content)))}</div></details>`;
+    }
+    case 'button': {
+      const align = n.alignment === 'left' ? 'left' : 'center';
+      const href = ctx.link(str(n.buttonUrl));
+      return `<div class="pc-buttoncard" data-align="${align}" style="text-align:${align}"><a class="pc-btncard" href="${escapeAttr(href)}">${escapeHtml(str(n.buttonText) || 'Button')}</a></div>`;
+    }
+    case 'file': {
+      const src = str(n.src);
+      if (!src) return '';
+      const filename = str(n.fileName) || str(n.fileTitle) || 'Download';
+      const href = ctx.asset(src, 'file', { filename });
+      const size = num(n.fileSize);
+      return `<a class="pc-filecard" href="${escapeAttr(href)}" download="${escapeAttr(filename)}" data-size="${size}"><span class="pc-file-icon" aria-hidden="true">↓</span><span class="pc-file-text"><span class="pc-file-name">${escapeHtml(filename)}</span><span class="pc-file-meta">${formatBytes(size)}</span></span></a>`;
+    }
+    case 'html': {
+      const html = ctx.rawHtml(str(n.html));
+      return plainTable(html) ?? htmlCard(html);
+    }
+    case 'markdown':
+      return htmlCard(ctx.rawHtml(ctx.markdown(str(n.markdown))));
+    case 'video':
+    case 'audio': {
+      // acms has no video/audio uploads yet: keep a player pointing at the
+      // original file so nothing disappears, and flag it for replacement
+      const src = str(n.src);
+      if (!src) return '';
+      const url = ctx.asset(src, 'media', { filename: str(n.fileName) });
+      const name = str(n.fileName) || str(n.title) || n.type;
+      ctx.warn(`${n.type}-card`, `“${name}” is a ${n.type} upload, which acms can't host yet. It still plays from the old site; replace it with an embed (for example YouTube) before that site goes away.`);
+      const tag = n.type === 'video'
+        ? `<video controls preload="metadata" src="${escapeAttr(url)}" style="width:100%;height:auto"></video>`
+        : `<audio controls preload="metadata" src="${escapeAttr(url)}" style="width:100%"></audio>`;
+      return htmlCard(tag);
+    }
+    case 'header': {
+      const title = htmlToText(str(n.header) || str(n.heading));
+      const sub = htmlToText(str(n.subheader) || str(n.subheading));
+      return (title ? `<h2>${escapeHtml(title)}</h2>` : '') + (sub ? `<p>${escapeHtml(sub)}</p>` : '');
+    }
+    // members/newsletter-only cards have no public equivalent
+    case 'paywall':
+    case 'signup':
+    case 'email':
+    case 'email-cta':
+    case 'call-to-action':
+    case 'product':
+      ctx.warn('skipped-card', `A Ghost “${n.type}” card was left out: it only works with Ghost memberships or newsletters.`);
+      return '';
+    default:
+      if (Array.isArray(n.children)) return `<p>${inline(n.children, ctx)}</p>`;
+      ctx.warn('unknown-card', `An unsupported Ghost “${String(n.type)}” card was left out.`);
+      return '';
+  }
+}
+
+function formatBytes(n: number): string {
+  if (!n) return '';
+  if (n < 1024) return `${n} B`;
+  if (n < 1024 * 1024) return `${Math.round(n / 1024)} KB`;
+  return `${(n / 1024 / 1024).toFixed(1)} MB`;
+}

package/src/lib/import/migration.ts

@@ -0,0 +1,27 @@
+// Import runs: one row per import, plus a record of every entity each run
+// created or updated (source id ↔ acms id). Records make re-running an
+// import idempotent (the same Ghost post maps back to the same acms post)
+// and let a run be undone. `stamp` is the entity's updated_at right after
+// the import, so undo can leave alone anything edited since.
+export const IMPORT_MIGRATION = { version: 35, statements: [
+  `CREATE TABLE IF NOT EXISTS import_runs (
+    id TEXT PRIMARY KEY,
+    source TEXT NOT NULL,
+    label TEXT NOT NULL DEFAULT '',
+    status TEXT NOT NULL DEFAULT 'running',
+    report TEXT NOT NULL DEFAULT '{}',
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  )`,
+  `CREATE TABLE IF NOT EXISTS import_records (
+    run_id TEXT NOT NULL,
+    kind TEXT NOT NULL,
+    source_id TEXT NOT NULL,
+    acms_id TEXT NOT NULL,
+    action TEXT NOT NULL,
+    stamp INTEGER NOT NULL DEFAULT 0,
+    created_at INTEGER NOT NULL,
+    PRIMARY KEY (run_id, kind, source_id)
+  )`,
+  `CREATE INDEX IF NOT EXISTS import_records_source ON import_records (kind, source_id)`,
+] };

package/src/lib/import/zipread.ts

@@ -0,0 +1,72 @@
+import { crc32 } from '../backup/zip';
+
+// Lazy ZIP reader for import sources: acms exports (stored) and archives made
+// by Finder, Windows or `zip` (deflated). Only the central directory is read
+// up front; entries inflate on demand through the platform's
+// DecompressionStream('deflate-raw'), available in browsers, Workers and
+// Node, so a large Ghost content folder never inflates all at once.
+
+export interface ZipIndex {
+  names: string[];
+  has(name: string): boolean;
+  read(name: string): Promise<Uint8Array<ArrayBuffer>>;
+}
+
+export function openZip(buf: ArrayBuffer): ZipIndex {
+  const bytes = new Uint8Array(buf);
+  const view = new DataView(buf);
+  let eocd = -1;
+  for (let i = bytes.length - 22; i >= Math.max(0, bytes.length - 22 - 65536); i--) {
+    if (view.getUint32(i, true) === 0x06054b50) { eocd = i; break; }
+  }
+  if (eocd < 0) throw new Error('Not a ZIP file.');
+  const count = view.getUint16(eocd + 10, true);
+  const dirSize = view.getUint32(eocd + 12, true);
+  let off = view.getUint32(eocd + 16, true);
+  if (count === 0xffff || off === 0xffffffff) throw new Error('ZIP64 archives are not supported. Split the folder into smaller ZIPs.');
+  if (off + dirSize > eocd) throw new Error('Corrupt ZIP directory.');
+
+  const entries = new Map<string, { method: number; crc: number; size: number; compSize: number; header: number }>();
+  for (let n = 0; n < count; n++) {
+    if (off + 46 > eocd || view.getUint32(off, true) !== 0x02014b50) throw new Error('Corrupt ZIP central directory.');
+    const flags = view.getUint16(off + 8, true);
+    const method = view.getUint16(off + 10, true);
+    const nameLen = view.getUint16(off + 28, true);
+    const extraLen = view.getUint16(off + 30, true);
+    const commentLen = view.getUint16(off + 32, true);
+    const name = new TextDecoder().decode(bytes.subarray(off + 46, off + 46 + nameLen));
+    if (!(flags & 1) && !name.endsWith('/') && !name.split('/').includes('..') && !name.startsWith('/')) {
+      entries.set(name, {
+        method,
+        crc: view.getUint32(off + 16, true),
+        compSize: view.getUint32(off + 20, true),
+        size: view.getUint32(off + 24, true),
+        header: view.getUint32(off + 42, true),
+      });
+    }
+    off += 46 + nameLen + extraLen + commentLen;
+  }
+
+  return {
+    names: [...entries.keys()],
+    has: (name) => entries.has(name),
+    async read(name) {
+      const e = entries.get(name);
+      if (!e) throw new Error(`${name} is not in the ZIP.`);
+      if (view.getUint32(e.header, true) !== 0x04034b50) throw new Error('Corrupt ZIP entry.');
+      const start = e.header + 30 + view.getUint16(e.header + 26, true) + view.getUint16(e.header + 28, true);
+      const raw = bytes.subarray(start, start + e.compSize);
+      let data: Uint8Array<ArrayBuffer>;
+      if (e.method === 0) data = raw;
+      else if (e.method === 8) data = await inflate(raw);
+      else throw new Error(`${name} uses an unsupported compression method.`);
+      if (data.length !== e.size || crc32(data) !== e.crc) throw new Error(`${name} is damaged (checksum mismatch).`);
+      return data;
+    },
+  };
+}
+
+async function inflate(raw: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>> {
+  const stream = new Blob([raw]).stream().pipeThrough(new DecompressionStream('deflate-raw'));
+  return new Uint8Array(await new Response(stream).arrayBuffer());
+}

package/src/lib/repo/migrations.ts

@@ -1,4 +1,5 @@
 import { LIVE_MIGRATION } from '../live/migration';
+import { IMPORT_MIGRATION } from '../import/migration';
 import { EMAIL_MIGRATION } from '../email/migration';
 import { WEBHOOK_MIGRATION } from '../webhook-sql';
 // Versioned schema migrations shared by the two SQLite-dialect adapters
@@ -499,6 +500,7 @@ export const MIGRATIONS: Migration[] = [
   ] },
   WEBHOOK_MIGRATION,
   LIVE_MIGRATION,
+  IMPORT_MIGRATION,
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;