@coywolf/emdash 0.0.0-stage → 0.35.13

package/src/search/title-match.ts

@@ -0,0 +1,192 @@
+/**
+ * Instant title matching in the browser (live results' title index): the
+ * matcher, title highlighting and the merge of local and server results.
+ * Plain ES2020 inside String.raw (no backticks or "${"), embedded in the live
+ * results script and evaluated as-is by the tests, so both run the same code.
+ *
+ * Matching folds case and diacritics ("ecole" finds "École"). Every typed
+ * word has to match. Ranking, best first:
+ *   0. the title starts with what was typed (word by word),
+ *   1. every word starts a word in the title,
+ *   2. every word (3+ characters) appears somewhere in the title,
+ * then the earlier the first match, the shorter the title, and the newer the
+ * entry (the index is newest first).
+ */
+export const MATCH_SOURCE = String.raw`function () {
+	"use strict";
+	var MARKS = /[̀-ͯ]/g;
+	var SPLIT = /[^\p{L}\p{N}]+/u;
+	var WORDCHAR = /[\p{L}\p{N}]/u;
+	var ASCII = /^[\x00-\x7f]*$/;
+
+	function fold(text) {
+		text = String(text || "");
+		return ASCII.test(text) ? text.toLowerCase() : text.normalize("NFD").replace(MARKS, "").toLowerCase();
+	}
+
+	/** Folded text and, for each folded position, the original position it came from. */
+	function foldMap(text) {
+		var out = "";
+		var map = [];
+		for (var i = 0; i < text.length; ) {
+			var cp = text.codePointAt(i);
+			var ch = String.fromCodePoint(cp);
+			var f = fold(ch);
+			for (var k = 0; k < f.length; k++) map.push(i);
+			out += f;
+			i += ch.length;
+		}
+		map.push(text.length);
+		return { text: out, map: map };
+	}
+
+	function words(folded) {
+		return folded.split(SPLIT).filter(Boolean);
+	}
+
+	/** Index rows ([title, url, typeIndex]) ready to match. */
+	function prepare(index) {
+		var types = (index && index.types) || [];
+		var rows = (index && index.entries) || [];
+		var out = [];
+		for (var i = 0; i < rows.length; i++) {
+			var r = rows[i];
+			if (!r || typeof r[0] !== "string" || typeof r[1] !== "string") continue;
+			var f = fold(r[0]);
+			out.push({ title: r[0], url: r[1], type: types[r[2]] || "", folded: f, spaced: " " + words(f).join(" ") });
+		}
+		return out;
+	}
+
+	function queryWords(query) {
+		var seen = {};
+		return words(fold(query)).filter(function (w) {
+			if (seen[w]) return false;
+			seen[w] = 1;
+			return true;
+		});
+	}
+
+	/** Ranked matches: [{ entry, tier }], at most limit. */
+	function match(prepared, query, limit) {
+		var terms = queryWords(query);
+		if (!terms.length) return [];
+		var phrase = " " + terms.join(" ");
+		var hits = [];
+		for (var i = 0; i < prepared.length; i++) {
+			var e = prepared[i];
+			var tier = -1;
+			if (e.spaced.indexOf(phrase) === 0) tier = 0;
+			else {
+				var prefix = true;
+				var loose = true;
+				for (var t = 0; t < terms.length; t++) {
+					var term = terms[t];
+					var starts = e.spaced.indexOf(" " + term) !== -1;
+					if (!starts) prefix = false;
+					if (!starts && (term.length < 3 || e.folded.indexOf(term) === -1)) loose = false;
+				}
+				tier = prefix ? 1 : loose ? 2 : -1;
+			}
+			if (tier < 0) continue;
+			var pos = tier === 2 ? e.folded.indexOf(terms[0]) : e.spaced.indexOf(" " + terms[0]);
+			hits.push({ entry: e, tier: tier, pos: pos < 0 ? 999 : pos, i: i });
+		}
+		hits.sort(function (a, b) {
+			return a.tier - b.tier || a.pos - b.pos || a.entry.title.length - b.entry.title.length || a.i - b.i;
+		});
+		return hits.slice(0, limit);
+	}
+
+	function escapeHtml(text) {
+		return String(text).replace(/[&<>"']/g, function (c) {
+			return { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c];
+		});
+	}
+
+	/** Words to highlight, as the server picks them: two or more characters, longest first, at most 10. */
+	function highlightTerms(query) {
+		return queryWords(query)
+			.filter(function (w) {
+				return Array.from(w).length >= 2;
+			})
+			.sort(function (a, b) {
+				return b.length - a.length;
+			})
+			.slice(0, 10);
+	}
+
+	/** The title, escaped, with matches in <mark>: at word starts, or anywhere when anywhere is true. */
+	function highlight(title, query, anywhere) {
+		var terms = highlightTerms(query);
+		if (!terms.length) return escapeHtml(title);
+		var fm = foldMap(title);
+		var ranges = [];
+		var at = 0;
+		while (at < fm.text.length) {
+			var found = null;
+			if (anywhere || at === 0 || !WORDCHAR.test(fm.text.charAt(at - 1))) {
+				for (var t = 0; t < terms.length; t++) {
+					if (fm.text.substr(at, terms[t].length) === terms[t]) {
+						found = terms[t];
+						break;
+					}
+				}
+			}
+			if (found) {
+				ranges.push([fm.map[at], fm.map[at + found.length]]);
+				at += found.length;
+			} else at++;
+		}
+		var out = "";
+		var last = 0;
+		for (var r = 0; r < ranges.length; r++) {
+			if (ranges[r][0] < last) continue;
+			out += escapeHtml(title.slice(last, ranges[r][0])) + "<mark>" + escapeHtml(title.slice(ranges[r][0], ranges[r][1])) + "</mark>";
+			last = ranges[r][1];
+		}
+		return out + escapeHtml(title.slice(last));
+	}
+
+	/** Local results in the server's item shape (no excerpt), marked local. */
+	function localItems(prepared, query, limit) {
+		return match(prepared, query, limit).map(function (h) {
+			return { title: h.entry.title, titleHtml: highlight(h.entry.title, query, h.tier === 2), url: h.entry.url, type: h.entry.type, snippet: "", local: true };
+		});
+	}
+
+	function urlKey(url) {
+		return String(url || "").replace(/[?#].*$/, "").replace(/\/+$/, "");
+	}
+
+	// Server results merged into the local ones without reshuffling them: a local row the server
+	// also found is replaced by the server's (with its excerpt) in place, the server's other results
+	// follow, and when that's too many, local rows the server didn't confirm give way from the bottom.
+	function merge(local, server, limit) {
+		var byUrl = {};
+		server.forEach(function (s) {
+			var k = urlKey(s.url);
+			if (!byUrl[k]) byUrl[k] = s;
+		});
+		var used = {};
+		var out = [];
+		local.forEach(function (l) {
+			var k = urlKey(l.url);
+			if (used[k]) return;
+			used[k] = 1;
+			out.push(byUrl[k] || l);
+		});
+		server.forEach(function (s) {
+			var k = urlKey(s.url);
+			if (used[k]) return;
+			used[k] = 1;
+			out.push(s);
+		});
+		for (var i = out.length - 1; out.length > limit && i >= 0; i--) {
+			if (out[i].local) out.splice(i, 1);
+		}
+		return out.slice(0, limit);
+	}
+
+	return { fold: fold, prepare: prepare, match: match, highlight: highlight, localItems: localItems, merge: merge };
+}`;

package/src/shared.ts

@@ -0,0 +1,71 @@
+import { PluginRouteError } from "emdash";
+import type { z } from "zod";
+
+interface Workers {
+	env: Record<string, unknown>;
+	waitUntil?: (p: Promise<unknown>) => void;
+}
+
+/**
+ * cloudflare:workers, loaded once when the isolate starts. A dynamic import,
+ * not a static one: astro.config.mjs loads the plugin in Node, where the module
+ * doesn't exist (`workers` stays null there). It's loaded long before the first
+ * request, so request-time callers never wait for it.
+ */
+let workers: Workers | null = null;
+const workersReady: Promise<Workers | null> = import("cloudflare:workers").then(
+	(module) => (workers = module as unknown as Workers),
+	() => null,
+);
+
+/** Cloudflare bindings. Rejects outside a Worker (callers catch). */
+export async function workerEnv(): Promise<Record<string, unknown>> {
+	const module = workers ?? (await workersReady);
+	if (!module) throw new Error("cloudflare:workers isn't available here");
+	return module.env;
+}
+
+/**
+ * Run `promise` after the response: hand it to waitUntil right now, before
+ * anything else happens. Synchronous on purpose. A Worker invocation ends as
+ * soon as its response is complete unless waitUntil holds it open, and work
+ * started from a hook EmDash doesn't await (media:afterUpload runs
+ * fire-and-forget right before the upload's response) has no time to spare: this
+ * used to await a dynamic import first, the hook awaited a settings read before
+ * that, and the request finished before waitUntil was reached, dropping the
+ * work with it without a word (0.30.0–0.33.0). Never throws: outside a Worker,
+ * or outside a request (waitUntil refuses), the promise just runs on its own; in
+ * the first instant of an isolate, before cloudflare:workers has loaded, it's
+ * handed over as soon as it has.
+ */
+export function afterResponse(promise: Promise<unknown>): void {
+	const handOver = (module: Workers | null) => {
+		try {
+			module?.waitUntil?.(promise);
+		} catch {
+			// No request to extend: the promise is already running.
+		}
+	};
+	if (workers) handOver(workers);
+	else void workersReady.then(handOver);
+}
+
+/** Read a Worker secret (env binding, or process.env under nodejs_compat). */
+export function secret(env: Record<string, unknown>, name: string): string | undefined {
+	return (env[name] as string | undefined) ?? (globalThis as { process?: { env?: Record<string, string> } }).process?.env?.[name];
+}
+
+/** Validate a route body, reporting problems to the admin instead of a generic 500. */
+export function parseInput<T>(schema: z.ZodType<T>, input: unknown): T {
+	const result = schema.safeParse(input);
+	if (!result.success) throw PluginRouteError.badRequest(result.error.issues.map((i) => i.message).join("; "));
+	return result.data;
+}
+
+export interface SettingsReader {
+	settings: { get<T>(key: string): Promise<T | null | undefined> };
+}
+
+export interface CronScheduler {
+	cron?: { schedule(name: string, opts: { schedule: string }): Promise<void> };
+}

package/src/version.ts

@@ -0,0 +1,2 @@
+/** The pack's version (keep in step with package.json). */
+export const VERSION = "0.35.13";

package/src/videos/date.ts

@@ -0,0 +1,40 @@
+/**
+ * Upload dates under a video: "Oct 6, 2026" or "7 months ago" (Video
+ * Manager's style). No imports, so the page script can use it to refresh a
+ * relative date on pages served from a cache.
+ */
+
+export type DateStyle = "absolute" | "relative";
+
+// UTC, as the site renders on Workers (also in the admin preview and tests).
+const absolute = new Intl.DateTimeFormat("en-US", { dateStyle: "medium", timeZone: "UTC" });
+
+const UNITS: Array<[string, number]> = [
+	["year", 365 * 86_400],
+	["month", 30 * 86_400],
+	["week", 7 * 86_400],
+	["day", 86_400],
+	["hour", 3_600],
+	["minute", 60],
+];
+
+/** "7 months ago", "1 day ago"; anything under a minute (or in the future) is "just now". */
+export function relativeDate(iso: string, now = Date.now()): string {
+	const at = new Date(iso).getTime();
+	if (Number.isNaN(at)) return "";
+	const seconds = Math.floor((now - at) / 1000);
+	for (const [unit, size] of UNITS) {
+		if (seconds < size) continue;
+		const n = Math.floor(seconds / size);
+		return `${n} ${unit}${n === 1 ? "" : "s"} ago`;
+	}
+	return "just now";
+}
+
+/** The date text for a video's upload date, or "" when it isn't a date. */
+export function videoDateText(iso: string | null | undefined, style: DateStyle, now = Date.now()): string {
+	if (!iso) return "";
+	const date = new Date(iso);
+	if (Number.isNaN(date.getTime())) return "";
+	return style === "relative" ? relativeDate(iso, now) : absolute.format(date);
+}

package/src/videos/engagement.ts

@@ -0,0 +1,75 @@
+/**
+ * Abuse limits for the public plays and likes routes (pure; unit tested in Node).
+ *
+ * Visitors are told apart by a daily-salted hash of the IP address alone: the
+ * user agent is set by the client, so mixing it in let one address count as
+ * any number of visitors. On top of that, each address may only play and like
+ * so often per minute (per isolate, like the search fallback limiter), and
+ * only add so many likes per day (counted in plugin KV, so across isolates).
+ */
+import { MemoryWindowCounter } from "../search/ratelimit-core.js";
+
+/**
+ * Sent by the Coywolf Video script with every play and like. A cross-site form
+ * or image can't set a custom header, and a cross-site fetch with one needs a
+ * CORS preflight the route never grants, so likes can't be forged from another site.
+ */
+export const ENGAGEMENT_HEADER = "x-coywolf-video";
+
+export const ENGAGEMENT_LIMITS = {
+	/** Play requests per address per minute. */
+	playsPerMinute: 10,
+	/** Like and unlike requests per address per minute. */
+	likesPerMinute: 20,
+	/** New likes per address per day. */
+	likesPerDay: 100,
+} as const;
+
+const DAY_MS = 86_400_000;
+
+export function hasEngagementHeader(headers: Headers): boolean {
+	return headers.get(ENGAGEMENT_HEADER) === "1";
+}
+
+/** Per-isolate counters for one address (by its visitor hash, never the address itself). */
+export class EngagementLimiter {
+	private readonly plays = new MemoryWindowCounter(10_000, 60_000);
+	private readonly likes = new MemoryWindowCounter(10_000, 60_000);
+	private readonly daily = new MemoryWindowCounter(10_000, DAY_MS);
+
+	/** Count a play request; false when the address is over its per-minute limit. */
+	play(visitor: string, now = Date.now()): boolean {
+		return this.plays.hit(visitor, ENGAGEMENT_LIMITS.playsPerMinute, now).allowed;
+	}
+
+	/** Count a like or unlike request; false when the address is over its per-minute limit. */
+	like(visitor: string, now = Date.now()): boolean {
+		return this.likes.hit(visitor, ENGAGEMENT_LIMITS.likesPerMinute, now).allowed;
+	}
+
+	/** Count a new like in this isolate; false once the address has used the day's likes. */
+	newLike(visitor: string, now = Date.now()): boolean {
+		return this.daily.hit(visitor, ENGAGEMENT_LIMITS.likesPerDay, now).allowed;
+	}
+}
+
+/** KV key for the number of likes one address added on `day` (pruned by the daily likes task). */
+export const LIKES_BY_PREFIX = "state:videos:likesBy:";
+export const likesByKey = (day: string, visitor: string) => `${LIKES_BY_PREFIX}${day}:${visitor}`;
+
+/** True when a likesBy key is from before `cutoff` (YYYY-MM-DD). */
+export function staleLikesByKey(key: string, cutoff: string): boolean {
+	const day = key.slice(LIKES_BY_PREFIX.length, LIKES_BY_PREFIX.length + 10);
+	return /^\d{4}-\d{2}-\d{2}$/.test(day) && day < cutoff;
+}
+
+/**
+ * What a like request does. New scripts send the state the visitor wants, so
+ * two people behind one address (who now share a visitor id) don't undo each
+ * other's like; without it the request toggles, as it always did.
+ */
+export function likeAction(liked: boolean | undefined, exists: boolean): "add" | "remove" | "keep" {
+	if (liked === undefined) return exists ? "remove" : "add";
+	if (liked) return exists ? "keep" : "add";
+	return exists ? "remove" : "keep";
+}