@jant/core 0.7.0 → 0.7.1

package/src/services/github-app-installations.ts

@@ -9,6 +9,15 @@
  * Routes call these methods instead of touching the settings table to
  * keep the model relational (one entry per (installation_id, site_id)
  * pair) instead of serialising a JSON list into a single settings row.
+ *
+ * Two scopes matter and they are not interchangeable. A *site* scope
+ * answers "which accounts is this blog syncing through". A *user* scope
+ * answers "which accounts has this person already authorized anywhere",
+ * which is what the connect flow needs: a GitHub App installs once per
+ * GitHub account, so someone who connected their first site can never
+ * install it a second time — GitHub sends them to the installation's
+ * Configure page and never calls back. Their other sites have to be able
+ * to reuse that installation without leaving Jant.
  */
 
 import { and, eq, inArray } from "drizzle-orm";
@@ -35,11 +44,56 @@ export interface StoredGitHubAppInstallation {
   addedAt: number;
 }
 
+/**
+ * An installation as seen by one person rather than by one site: the
+ * same installation may back several of their sites, so the site id
+ * drops out and `addedAt` carries the most recent binding.
+ */
+export interface VisibleGitHubAppInstallation {
+  installationId: string;
+  account: GitHubInstallationAccount;
+  /** Unix seconds — most recent binding of this installation to any of the user's sites. */
+  addedAt: number;
+}
+
 export interface GitHubAppInstallationsService {
   /** Installations this site has authorized, newest-first by `addedAt`. */
   listInstallationsForSite(
     siteId: string,
   ): Promise<StoredGitHubAppInstallation[]>;
+  /**
+   * Installations authorized on any site this user is a member of,
+   * deduplicated by installation and newest-first by `addedAt`.
+   *
+   * This is the set the connect flow may offer and act on: membership is
+   * the tenancy boundary, so one person's sites share their GitHub
+   * accounts while other tenants' installations stay invisible.
+   */
+  listInstallationsForUser(
+    userId: string,
+  ): Promise<VisibleGitHubAppInstallation[]>;
+  /**
+   * One installation from `listInstallationsForUser`, or `null` when the
+   * user has no site bound to it. Routes use this to authorize an
+   * `installationId` that arrived in a request.
+   */
+  findInstallationForUser(
+    installationId: string,
+    userId: string,
+  ): Promise<VisibleGitHubAppInstallation | null>;
+  /**
+   * Installations the user's sites are *actively syncing through*, read
+   * from each site's settings rather than from the junction table.
+   *
+   * The two can disagree: settings are written when a site connects,
+   * the binding when it was installed, and a site that connected while
+   * the binding write failed keeps syncing with nothing to show for it.
+   * Callers use this to rebuild the missing row — they have to fetch the
+   * account from GitHub, which is why this returns ids and not accounts.
+   */
+  listSyncingInstallationsForUser(
+    userId: string,
+  ): Promise<Array<{ siteId: string; installationId: string }>>;
   /** Site ids that share the given installation. */
   listSitesForInstallation(installationId: string): Promise<string[]>;
   /**
@@ -56,6 +110,19 @@ export interface GitHubAppInstallationsService {
   ): Promise<void>;
   /** Remove a single (installation, site) binding. */
   removeInstallation(installationId: string, siteId: string): Promise<void>;
+  /**
+   * Remove the installation from every site this user is a member of.
+   *
+   * Used when GitHub reports the installation as gone (401/404): the
+   * binding that made it visible may live on another of the user's
+   * sites, so clearing only the current site would leave a dead account
+   * in their picker forever. Other tenants' bindings are left to the
+   * App-level webhook, which sees the authoritative `installation.deleted`.
+   */
+  removeInstallationForUser(
+    installationId: string,
+    userId: string,
+  ): Promise<void>;
   /**
    * Remove the installation from every site it's bound to and return
    * the previously-bound site ids so callers can fan out side effects
@@ -94,7 +161,63 @@ export function createGitHubAppInstallationsService(
   db: Database,
   databaseSchema: DatabaseSchema = sqliteSchemaBundle,
 ): GitHubAppInstallationsService {
-  const { githubAppInstallation, settings } = databaseSchema;
+  const { githubAppInstallation, settings, siteMembers } = databaseSchema;
+
+  /**
+   * Rows for every binding on a site the user belongs to. One join, not
+   * a per-site fan-out — a user has few sites but the query shape is
+   * what gets copied.
+   */
+  function selectUserBindings(userId: string, installationId?: string) {
+    const scope = eq(siteMembers.userId, userId);
+    return db
+      .select({
+        installationId: githubAppInstallation.installationId,
+        accountLogin: githubAppInstallation.accountLogin,
+        accountType: githubAppInstallation.accountType,
+        accountAvatarUrl: githubAppInstallation.accountAvatarUrl,
+        addedAt: githubAppInstallation.addedAt,
+      })
+      .from(githubAppInstallation)
+      .innerJoin(
+        siteMembers,
+        eq(siteMembers.siteId, githubAppInstallation.siteId),
+      )
+      .where(
+        installationId
+          ? and(scope, eq(githubAppInstallation.installationId, installationId))
+          : scope,
+      );
+  }
+
+  /** Collapse per-site bindings into one entry per installation. */
+  function toVisible(
+    rows: Array<{
+      installationId: string;
+      accountLogin: string;
+      accountType: string;
+      accountAvatarUrl: string;
+      addedAt: number;
+    }>,
+  ): VisibleGitHubAppInstallation[] {
+    const byInstallation = new Map<string, VisibleGitHubAppInstallation>();
+    for (const row of rows) {
+      const entry = {
+        installationId: row.installationId,
+        account: {
+          login: row.accountLogin,
+          type: toAccountType(row.accountType),
+          avatarUrl: row.accountAvatarUrl,
+        },
+        addedAt: row.addedAt,
+      };
+      const existing = byInstallation.get(row.installationId);
+      if (!existing || existing.addedAt < entry.addedAt) {
+        byInstallation.set(row.installationId, entry);
+      }
+    }
+    return [...byInstallation.values()].sort((a, b) => b.addedAt - a.addedAt);
+  }
 
   // Per-site settings mutation helpers. These sit alongside the
   // junction-table operations because the webhook fan-out inherently
@@ -152,6 +275,32 @@ export function createGitHubAppInstallationsService(
       return rows.map(toStored).sort((a, b) => b.addedAt - a.addedAt);
     },
 
+    async listInstallationsForUser(userId) {
+      return toVisible(await selectUserBindings(userId));
+    },
+
+    async findInstallationForUser(installationId, userId) {
+      const rows = await selectUserBindings(userId, installationId);
+      return toVisible(rows)[0] ?? null;
+    },
+
+    async listSyncingInstallationsForUser(userId) {
+      const rows = await db
+        .select({
+          siteId: settings.siteId,
+          installationId: settings.value,
+        })
+        .from(settings)
+        .innerJoin(siteMembers, eq(siteMembers.siteId, settings.siteId))
+        .where(
+          and(
+            eq(siteMembers.userId, userId),
+            eq(settings.key, "GITHUB_SYNC_APP_INSTALLATION_ID"),
+          ),
+        );
+      return rows.filter((row) => row.installationId.trim().length > 0);
+    },
+
     async listSitesForInstallation(installationId) {
       const rows = await db
         .select({ siteId: githubAppInstallation.siteId })
@@ -198,6 +347,21 @@ export function createGitHubAppInstallationsService(
         );
     },
 
+    async removeInstallationForUser(installationId, userId) {
+      const memberSites = db
+        .select({ siteId: siteMembers.siteId })
+        .from(siteMembers)
+        .where(eq(siteMembers.userId, userId));
+      await db
+        .delete(githubAppInstallation)
+        .where(
+          and(
+            eq(githubAppInstallation.installationId, installationId),
+            inArray(githubAppInstallation.siteId, memberSites),
+          ),
+        );
+    },
+
     async removeInstallationEverywhere(installationId) {
       const rows = await db
         .select({ siteId: githubAppInstallation.siteId })
@@ -277,6 +441,11 @@ export function createGitHubAppInstallationsService(
   };
 }
 
+/** The column is a checked enum; narrow it without trusting the read. */
+function toAccountType(value: string): GitHubAccountType {
+  return value === "Organization" ? "Organization" : "User";
+}
+
 function toStored(row: {
   installationId: string;
   siteId: string;
@@ -285,14 +454,12 @@ function toStored(row: {
   accountAvatarUrl: string;
   addedAt: number;
 }): StoredGitHubAppInstallation {
-  const type: GitHubAccountType =
-    row.accountType === "Organization" ? "Organization" : "User";
   return {
     installationId: row.installationId,
     siteId: row.siteId,
     account: {
       login: row.accountLogin,
-      type,
+      type: toAccountType(row.accountType),
       avatarUrl: row.accountAvatarUrl,
     },
     addedAt: row.addedAt,

package/src/services/github-sync.ts

@@ -32,7 +32,13 @@ import { getInstallationToken } from "../lib/github-app.js";
 import type { GitHubAppEnvConfig } from "../lib/env.js";
 import { parseFrontMatter } from "../lib/hugo-markdown.js";
 import { markdownToTiptapJson } from "../lib/markdown-to-tiptap.js";
-import { createExportService, type SiteConfig } from "./export.js";
+import {
+  createExportService,
+  isStoredExportFile,
+  readStoredExportFile,
+  type ExportFile,
+  type SiteConfig,
+} from "./export.js";
 import type { PostService } from "./post.js";
 import type { PathService } from "./path.js";
 import type { CollectionService } from "./collection.js";
@@ -116,6 +122,33 @@ export function isManagedPath(path: string): boolean {
   return JANT_MANAGED_GLOBS.some((g) => pathMatchesManagedGlob(path, g));
 }
 
+/**
+ * Pick the export files this push should write.
+ *
+ * Everything is written every push except scaffolding the repo already has.
+ * `wrangler.jsonc` is the case that needs this: its Worker name defaults to
+ * the repository name, and a user whose Worker is named differently has to
+ * correct it by hand. Rewriting the file every push would revert that, and
+ * every build after it would fail on the name mismatch.
+ *
+ * @param exportFiles - Everything the export generated.
+ * @param existingPaths - Repo-relative paths already present on the remote.
+ * @returns The subset to include in the commit.
+ * @example
+ * selectFilesToWrite(files, new Set(["wrangler.jsonc"]));
+ */
+export function selectFilesToWrite(
+  exportFiles: readonly ExportFile[],
+  existingPaths: ReadonlySet<string>,
+): ExportFile[] {
+  return exportFiles.filter(
+    (file) =>
+      isStoredExportFile(file) ||
+      !file.scaffoldOnce ||
+      !existingPaths.has(file.path),
+  );
+}
+
 /**
  * Compute the tree items that should null-out files on the remote HEAD
  * which Jant claims ownership of (matches `JANT_MANAGED_GLOBS`) but is
@@ -458,6 +491,9 @@ export function createGitHubSyncService(
       const exportService = createExportService(services, siteConfig, {
         storage: deps.storage,
         bundleMedia: false,
+        // Cloudflare names a Worker imported from this repository after it,
+        // so the deploy config's Worker name matches with no editing.
+        repoName: repo,
       });
       const exportFiles = await exportService.generateHugoFiles();
 
@@ -488,6 +524,26 @@ export function createGitHubSyncService(
         marker,
       );
 
+      // The HEAD tree is needed twice: to decide which scaffold files the
+      // repo already has, and (below) to delete managed files this push no
+      // longer generates. Reading it once, before the tree is assembled,
+      // covers both.
+      const headCommit = await client.getCommit(owner, repo, headSha);
+      const headTree = await client.getTree(owner, repo, headCommit.treeSha, {
+        recursive: true,
+      });
+      if (headTree.truncated) {
+        throw new Error(
+          "GitHub tree exceeds API limits (>100k entries or >7MB); " +
+            "incremental deletion cannot run safely against this repo.",
+        );
+      }
+      const existingPaths = new Set<string>(
+        headTree.tree
+          .filter((item) => item.type === "blob")
+          .map((item) => item.path),
+      );
+
       // Convert to Git tree items. The ownership marker is always emitted;
       // `created_at` is preserved across pushes (Git dedupes identical
       // blobs by SHA, so a no-op marker push is still cheap).
@@ -500,20 +556,28 @@ export function createGitHubSyncService(
         },
       ];
 
-      for (const file of exportFiles) {
-        if (typeof file.content === "string") {
+      for (const file of selectFilesToWrite(exportFiles, existingPaths)) {
+        // Sync links media by URL, so a stored file only turns up when the
+        // site URL is unknown and the export falls back to bundling.
+        const content = isStoredExportFile(file)
+          ? deps.storage
+            ? await readStoredExportFile(file, deps.storage)
+            : null
+          : file.content;
+        if (content === null) continue;
+        if (typeof content === "string") {
           treeItems.push({
             path: file.path,
             mode: "100644",
             type: "blob",
-            content: file.content,
+            content,
           });
         } else {
           // Binary files need to be created as blobs first
           const blob = await client.createBlob(
             owner,
             repo,
-            uint8ArrayToBase64(file.content),
+            uint8ArrayToBase64(content),
             "base64",
           );
           treeItems.push({
@@ -530,16 +594,6 @@ export function createGitHubSyncService(
       // removed. Without this, deleting a post in Jant would leave the
       // old file behind on GitHub, because base_tree preserves everything
       // we don't explicitly overwrite.
-      const headCommit = await client.getCommit(owner, repo, headSha);
-      const headTree = await client.getTree(owner, repo, headCommit.treeSha, {
-        recursive: true,
-      });
-      if (headTree.truncated) {
-        throw new Error(
-          "GitHub tree exceeds API limits (>100k entries or >7MB); " +
-            "incremental deletion cannot run safely against this repo.",
-        );
-      }
       const writtenPaths = new Set<string>(treeItems.map((item) => item.path));
       treeItems.push(...computeManagedDeletions(headTree.tree, writtenPaths));
 

package/src/services/mcp.ts

@@ -102,6 +102,7 @@ const SearchPostsToolSchema = z.object({
 
 const ListMediaToolSchema = z.object({
   limit: z.coerce.number().int().min(1).max(200).optional().default(50),
+  cursor: z.string().optional(),
   mimePrefix: z.string().trim().min(1).optional(),
 });
 
@@ -244,6 +245,16 @@ const mcpTools: McpToolDefinition[] = [
         replyToId: { type: "string" },
         quietReply: { type: "boolean" },
         publishedAt: { type: "integer" },
+        createdAt: {
+          type: "integer",
+          description:
+            "Unix seconds. When moving a post from another site, the time it was written.",
+        },
+        updatedAt: {
+          type: "integer",
+          description:
+            "Unix seconds. When moving a post from another site, the time it was last edited.",
+        },
         attachments: {
           type: "array",
           items: { type: "object" },
@@ -276,6 +287,8 @@ const mcpTools: McpToolDefinition[] = [
           replyToId: input.replyToId,
           quietReply: input.quietReply,
           publishedAt: input.publishedAt,
+          createdAt: input.createdAt,
+          updatedAt: input.updatedAt,
         },
         input.attachments,
         {
@@ -542,12 +555,14 @@ const mcpTools: McpToolDefinition[] = [
   },
   {
     name: "jant_media_list",
-    description: "List uploaded media, optionally filtered by MIME prefix.",
+    description:
+      "List uploaded media, newest first, optionally filtered by MIME prefix. Pass nextCursor back as cursor for the next page.",
     inputSchema: {
       type: "object",
       properties: {
         limit: { type: "integer", minimum: 1, maximum: 200, default: 50 },
         mimePrefix: { type: "string" },
+        cursor: { type: "string" },
       },
       additionalProperties: false,
     },
@@ -556,10 +571,13 @@ const mcpTools: McpToolDefinition[] = [
       const media = await context.services.media.list({
         limit: input.limit,
         mimePrefix: input.mimePrefix,
+        cursor: input.cursor,
       });
 
       return {
         media: media.map((item) => serializeMedia(item, context.appConfig)),
+        nextCursor:
+          media.length === input.limit ? (media.at(-1)?.id ?? null) : null,
       };
     },
   },

package/src/services/media.ts

@@ -205,6 +205,8 @@ export interface MediaFilters {
   limit?: number;
   /** Filter by MIME type prefix, e.g. "image/" */
   mimePrefix?: string;
+  /** Exclusive media ID cursor: the last item of the previous page. */
+  cursor?: string;
 }
 
 export interface CreateTextAttachmentData {
@@ -774,11 +776,16 @@ export function createMediaService(
           sql`${media.mimeType} LIKE ${filters.mimePrefix + "%"}`,
         );
       }
+      if (filters?.cursor) {
+        conditions.push(lt(media.id, filters.cursor));
+      }
+      // Newest first. A TypeID sorts by the time it was minted, so the ID
+      // orders like `created_at` and never ties, which a cursor needs.
       const rows = await db
         .select()
         .from(media)
         .where(conditions.length > 0 ? and(...conditions) : undefined)
-        .orderBy(desc(media.createdAt))
+        .orderBy(desc(media.id))
         .limit(limit);
       return rows.map(toMedia);
     },

package/src/services/path.ts

@@ -6,7 +6,17 @@
  * slash (for example: "hello-world" or "collections/reading+tools").
  */
 
-import { and, asc, eq, inArray, isNotNull, ne, or, sql } from "drizzle-orm";
+import {
+  and,
+  asc,
+  eq,
+  inArray,
+  isNotNull,
+  isNull,
+  ne,
+  or,
+  sql,
+} from "drizzle-orm";
 import { type Database, batchQuery } from "../db/index.js";
 import {
   sqliteSchemaBundle,
@@ -83,6 +93,12 @@ export interface PathService {
    * not have its feed identity reassigned to the newer one.
    */
   getPostAliases(postIds: string[]): Promise<Map<string, string[]>>;
+  /**
+   * Custom URLs that stand on their own rather than naming a post or a
+   * collection: redirects to another path, and legacy archive views. Oldest
+   * first.
+   */
+  listStandalonePaths(): Promise<PathRecord[]>;
   listNavigableItems(): Promise<NavigableItem[]>;
   /**
    * Find registered paths that a URL segment would shadow: the segment itself
@@ -491,6 +507,23 @@ export function createPathService(
         );
     },
 
+    async listStandalonePaths() {
+      const rows = await db
+        .select()
+        .from(pathRegistry)
+        .where(
+          and(
+            eq(pathRegistry.siteId, siteId),
+            inArray(pathRegistry.kind, ["redirect", "archive"]),
+            isNull(pathRegistry.postId),
+            isNull(pathRegistry.collectionId),
+            isNull(pathRegistry.smartCollectionId),
+          ),
+        )
+        .orderBy(asc(pathRegistry.createdAt), asc(pathRegistry.id));
+      return rows.map(toPathRecord);
+    },
+
     async getPostAliases(postIds) {
       if (postIds.length === 0) return new Map<string, string[]>();