@o-a/cms-agent 0.2.1 → 0.3.0

package/dist/site-check/run-check.js

@@ -0,0 +1,109 @@
+import { existsSync } from 'node:fs';
+import { bootSite } from "../boot.js";
+import { renderPage } from "../renderer/render-page.js";
+import { PathSafetyError, sanitisePath } from "../services/path-safety.js";
+import { buildSitemapUrls } from "../routes/sitemap.js";
+import { urlToPagePath } from "../services/urls.js";
+// A reference this project's own theme conventions actually produce:
+// src="...", srcset="w1 480w, w2 960w" (comma-separated, each entry a
+// url then a space then a width descriptor - strip the descriptor),
+// href="...". Not a full HTML parser - matching SchemaField.tsx's own
+// "the schema surface here is narrow and flat... a library would be
+// heavier than the problem warrants" precedent for the equivalent
+// choice on the admin side.
+const ATTR_PATTERN = /\b(?:src|href)="([^"]*)"|\bsrcset="([^"]*)"/g;
+function extractReferences(html) {
+    const refs = [];
+    for (const match of html.matchAll(ATTR_PATTERN)) {
+        const [, single, srcset] = match;
+        if (single !== undefined) {
+            refs.push(single);
+        }
+        else if (srcset !== undefined) {
+            for (const entry of srcset.split(',')) {
+                const url = entry.trim().split(/\s+/)[0];
+                if (url) {
+                    refs.push(url);
+                }
+            }
+        }
+    }
+    return refs;
+}
+// True for a root-relative static path that looks like a real file
+// (has a "." in its last path segment - /favicon.ico, /robots.txt),
+// as opposed to a page URL like /about or /blog/hello-world, which
+// never do. Doesn't need to be perfect - a page URL with a literal dot
+// in its own slug is vanishingly unlikely and, worst case, just gets
+// checked against the wrong bucket and reported as the wrong kind of
+// finding, never silently skipped.
+function looksLikeStaticFile(path) {
+    const lastSegment = path.split('/').pop() ?? '';
+    return lastSegment.includes('.');
+}
+// A rendered reference is theme/content-derived, not a live HTTP
+// request's own :path - but the same traversal concern still applies
+// (constraint 7), so it still goes through sanitisePath rather than a
+// bare join+existsSync. A reference that fails to sanitise (a "../"
+// escaping root) is exactly as real a finding as one that's simply
+// missing - reported the same way, not silently skipped.
+function checkStaticReference(findings, root, relativePath, originalPath, rootLabel, pageUrl) {
+    try {
+        const filePath = sanitisePath(root, relativePath);
+        if (!existsSync(filePath)) {
+            findings.push({ kind: 'missing-asset', message: `${originalPath} does not exist under ${rootLabel}`, pageUrl });
+        }
+    }
+    catch (error) {
+        if (error instanceof PathSafetyError) {
+            findings.push({ kind: 'missing-asset', message: `${originalPath} is not a safe reference under ${rootLabel} (${error.message})`, pageUrl });
+            return;
+        }
+        throw error;
+    }
+}
+export async function runSiteCheck(siteRoot) {
+    const booted = bootSite(siteRoot);
+    const findings = [];
+    for (const warning of booted.themeSchemas.warnings ?? []) {
+        findings.push({ kind: 'schema', message: warning });
+    }
+    const publishedUrls = buildSitemapUrls(booted.config);
+    const publishedUrlSet = new Set(publishedUrls);
+    for (const pageUrl of publishedUrls) {
+        // urlToPagePath's own result is relative to pagesRoot (e.g.
+        // "about.json"), but renderPage's own relativePath is relative to
+        // contentRoot - the same "pages/" prefix routes/public.ts's own
+        // toRenderPath helper adds before every one of its renderPage
+        // calls.
+        const relativePath = `pages/${urlToPagePath(pageUrl)}`;
+        let html;
+        try {
+            html = await renderPage(booted.config, booted.themeTemplates, booted.layouts, booted.engine, relativePath, 'public');
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            findings.push({ kind: 'render-error', message: detail, pageUrl });
+            continue;
+        }
+        for (const ref of extractReferences(html)) {
+            if (ref.startsWith('http://') || ref.startsWith('https://') || ref.startsWith('data:') || ref.startsWith('//')) {
+                continue;
+            }
+            const path = ref.split(/[?#]/)[0] ?? ref;
+            if (path.startsWith('/media/')) {
+                checkStaticReference(findings, booted.config.mediaRoot, path.slice('/media/'.length), path, 'media/', pageUrl);
+            }
+            else if (path.startsWith('/assets/')) {
+                checkStaticReference(findings, booted.config.assetsRoot, path.slice('/assets/'.length), path, 'theme/assets/', pageUrl);
+            }
+            else if (looksLikeStaticFile(path)) {
+                checkStaticReference(findings, booted.config.rootMirrorRoot, path.slice(1), path, 'theme/root/', pageUrl);
+            }
+            else if (path !== '' && !publishedUrlSet.has(path)) {
+                findings.push({ kind: 'broken-link', message: `${path} does not point at a published page`, pageUrl });
+            }
+        }
+    }
+    return { ok: findings.length === 0, findings };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o-a/cms-agent",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -23,7 +23,9 @@
   },
   "bin": {
     "create-site": "dist/create-site/cli.js",
-    "mint-token": "dist/create-site/mint-token-cli.js"
+    "mint-token": "dist/create-site/mint-token-cli.js",
+    "check-site": "dist/site-check/cli.js",
+    "seed-media": "dist/media/seed-media-cli.js"
   },
   "files": [
     "dist"
@@ -35,7 +37,7 @@
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "lint": "eslint .",
     "test": "node --experimental-strip-types --test",
-    "test:packaging": "node --experimental-strip-types --test e2e/create-site-packaging.check.ts",
+    "test:packaging": "node --experimental-strip-types --test --test-concurrency=1 e2e/create-site-packaging.check.ts e2e/dev-watch.check.ts",
     "build": "tsc -p tsconfig.build.json && rm -rf dist/schemas dist/create-site/template && cp -r src/schemas/. dist/schemas/ && cp -r src/create-site/template/. dist/create-site/template/",
     "prepack": "npm run build"
   },

package/dist/search/query-index.d.ts

@@ -1,5 +0,0 @@
-export interface SearchResult {
-    url: string;
-    title: string;
-}
-export declare function queryIndex(searchIndexPath: string, term: string): SearchResult[];

package/dist/search/query-index.js

@@ -1,21 +0,0 @@
-import { openNodeSqliteDriver } from "./drivers/node-sqlite-driver.js";
-// Never queued: an in-flight query holding an open handle during a
-// concurrent rebuild's unlink just keeps reading the pre-rebuild inode
-// (stale but consistent, never torn) - queuing a read against the same
-// queue as writes would only add latency for no correctness benefit.
-export function queryIndex(searchIndexPath, term) {
-    const driver = openNodeSqliteDriver(searchIndexPath);
-    try {
-        const rows = driver.prepare('SELECT url, title FROM pages_fts WHERE pages_fts MATCH ?').all(term);
-        // node:sqlite returns rows as [Object: null prototype] instances;
-        // rebuilt here as plain objects so callers (and assert.deepEqual)
-        // never have to know that's a driver implementation detail.
-        return rows.map((row) => {
-            const { url, title } = row;
-            return { url, title };
-        });
-    }
-    finally {
-        driver.close();
-    }
-}

package/dist/services/post-urls.d.ts

@@ -1,3 +0,0 @@
-export declare function isBlogUrl(url: string): boolean;
-export declare function urlToPostPath(url: string): string | null;
-export declare function postPathToUrl(relativePostPath: string): string;

package/dist/services/post-urls.js

@@ -1,27 +0,0 @@
-// Pure, filesystem-free mapping between a /blog/<slug> URL and a
-// post's path relative to postsRoot. Unlike pages' arbitrary nested
-// paths (about.json beside a sibling about/ directory), posts are
-// flat only - a URL with more than one segment after /blog/ is never
-// a valid post URL, enforced here rather than left to sanitisePath.
-const BLOG_PREFIX = '/blog/';
-// /blog is a permanently reserved namespace: both "/blog" itself (no
-// slug) and every "/blog/..." URL are recognised here, so a caller can
-// route the whole namespace to post resolution before ever checking
-// for a page, matching the confirmed reserved-namespace decision.
-export function isBlogUrl(url) {
-    return url === '/blog' || url.startsWith(BLOG_PREFIX);
-}
-export function urlToPostPath(url) {
-    if (!url.startsWith(BLOG_PREFIX)) {
-        return null;
-    }
-    const slug = url.slice(BLOG_PREFIX.length);
-    if (slug === '' || slug.includes('/')) {
-        return null;
-    }
-    return `${slug}.json`;
-}
-export function postPathToUrl(relativePostPath) {
-    const withoutExtension = relativePostPath.replace(/\.json$/, '');
-    return `${BLOG_PREFIX}${withoutExtension}`;
-}

package/dist/services/resolve-blog-url.d.ts

@@ -1,11 +0,0 @@
-import type { SiteConfig } from '../config.ts';
-export type ResolvedBlogUrl = {
-    kind: 'post';
-    relativePath: string;
-} | {
-    kind: 'redirect';
-    to: string;
-} | {
-    kind: 'not-found';
-};
-export declare function resolveBlogUrl(config: SiteConfig, url: string): ResolvedBlogUrl;

package/dist/services/resolve-blog-url.js

@@ -1,31 +0,0 @@
-import { existsSync } from 'node:fs';
-import { sanitisePath } from "./path-safety.js";
-import { buildRedirectLookup, loadRedirects } from "./redirects.js";
-import { urlToPostPath } from "./post-urls.js";
-// Mirrors resolve-url.ts's shape exactly (a live post always wins over
-// a redirect at the same URL), kept as its own distinct result type
-// rather than reusing ResolvedUrl - clearer branching at the call site
-// and avoids touching Group C's already-tested resolve-url.ts.
-//
-// Unlike pagesRoot (always expected to exist on a real site),
-// postsRoot is optional - a site that has never used blog posts has
-// no content/posts/ directory at all. sanitisePath calls realpathSync
-// directly on its root argument, which throws a raw, uncaught ENOENT
-// if that root itself is missing - so postsRoot's existence is checked
-// first, before ever calling sanitisePath, rather than letting a
-// perfectly ordinary "no posts yet" site crash on its first /blog/ hit.
-export function resolveBlogUrl(config, url) {
-    const relativePath = urlToPostPath(url);
-    if (relativePath !== null && existsSync(config.postsRoot)) {
-        const postFile = sanitisePath(config.postsRoot, relativePath);
-        if (existsSync(postFile)) {
-            return { kind: 'post', relativePath };
-        }
-    }
-    const lookup = buildRedirectLookup(loadRedirects(config).entries);
-    const to = lookup.get(url);
-    if (to !== undefined) {
-        return { kind: 'redirect', to };
-    }
-    return { kind: 'not-found' };
-}