npm - @seedvault/server - Versions diffs - 0.1.3 → 0.1.5 - Mend

@seedvault/server 0.1.3 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.html CHANGED Viewed

@@ -74,6 +74,33 @@
 			cursor: pointer;
 		}
+		#menu-toggle {
+			display: none;
+			font-size: 18px;
+			padding: 4px 10px;
+		}
+		#nav-close {
+			display: none;
+			float: right;
+			border: none;
+			font-size: 16px;
+			padding: 0 4px;
+			line-height: 1;
+		}
+		#backdrop {
+			display: none;
+			position: fixed;
+			inset: 0;
+			background: rgba(0, 0, 0, 0.4);
+			z-index: 90;
+		}
+		#backdrop.visible {
+			display: block;
+		}
 		.grid {
 			display: flex;
 			gap: 0;
@@ -103,8 +130,32 @@
 		}
 		@media (max-width: 600px) {
+			#menu-toggle {
+				display: block;
+			}
+			#nav-close {
+				display: block;
+			}
 			.grid {
 				flex-direction: column;
+				position: relative;
+			}
+			#nav {
+				position: fixed;
+				top: 0;
+				left: -100vw;
+				width: 100vw !important;
+				height: 100%;
+				z-index: 100;
+				background: Canvas;
+				transition: transform 0.2s ease;
+			}
+			#nav.open {
+				transform: translateX(100vw);
 			}
 			.grid>.panel:first-child {
@@ -178,17 +229,31 @@
 		}
 		.tree-row {
-			display: block;
+			display: flex;
+			align-items: baseline;
 			width: 100%;
 			text-align: left;
 			border: none;
 			padding: 4px 8px;
 			white-space: nowrap;
 			overflow: hidden;
-			text-overflow: ellipsis;
 			cursor: pointer;
 		}
+		.tree-row .name {
+			overflow: hidden;
+			text-overflow: ellipsis;
+			flex: 1;
+			min-width: 0;
+		}
+		.tree-row .ctime {
+			flex-shrink: 0;
+			margin-left: 8px;
+			opacity: 0.45;
+			font-size: 10px;
+		}
 		.tree-row:hover {
 			background: color-mix(in srgb, currentColor 8%, transparent);
 		}
@@ -335,12 +400,14 @@
 <body>
 	<div class="top">
+		<button id="menu-toggle" aria-label="Toggle navigation">&#9776;</button>
 		<input id="token" type="password" placeholder="API key (&quot;sv_...&quot;)" />
 		<button id="connect">Load</button>
 	</div>
+	<div id="backdrop"></div>
 	<div class="grid">
 		<section id="nav" class="panel" style="width:220px">
-			<div class="panel-head">Files</div>
+			<div class="panel-head">Files<button id="nav-close" aria-label="Close navigation">&times;</button></div>
 			<div class="panel-body" id="nav-body" tabindex="0">
 				<ul id="files" class="tree"></ul>
 			</div>
@@ -358,6 +425,7 @@
 		const { marked } = await import("https://cdn.jsdelivr.net/npm/marked/lib/marked.esm.js");
 		const matter = (await import("https://cdn.jsdelivr.net/npm/gray-matter@4.0.3/+esm")).default;
 		const DOMPurify = (await import("https://cdn.jsdelivr.net/npm/dompurify@3.0.9/+esm")).default;
+		const morphdom = (await import("https://cdn.jsdelivr.net/npm/morphdom@2.7.4/+esm")).default;
 		function renderMarkdown(raw) {
 			if (typeof raw !== "string") return "";
@@ -380,6 +448,22 @@
 		const filesEl = $("files");
 		const contentEl = $("content");
 		const statusEl = $("status");
+		const backdropEl = $("backdrop");
+		const menuToggleEl = $("menu-toggle");
+		function closeSidebar() {
+			$("nav").classList.remove("open");
+			backdropEl.classList.remove("visible");
+		}
+		menuToggleEl.addEventListener("click", () => {
+			const nav = $("nav");
+			nav.classList.toggle("open");
+			backdropEl.classList.toggle("visible", nav.classList.contains("open"));
+		});
+		backdropEl.addEventListener("click", closeSidebar);
+		$("nav-close").addEventListener("click", closeSidebar);
 		let token = localStorage.getItem("sv-token") || "";
 		tokenEl.value = token;
@@ -404,20 +488,50 @@
 		const savedContributor = localStorage.getItem("sv-contributor") || "";
 		const savedFile = localStorage.getItem("sv-file") || "";
-		function buildTree(paths) {
+		function getExpandedKeys() {
+			try {
+				return new Set(JSON.parse(localStorage.getItem("sv-expanded") || "[]"));
+			} catch { return new Set(); }
+		}
+		function saveExpandedKeys(keys) {
+			localStorage.setItem("sv-expanded", JSON.stringify([...keys]));
+		}
+		function buildTree(fileEntries) {
 			const root = {};
-			for (const p of paths) {
-				const parts = p.split("/");
+			for (const f of fileEntries) {
+				const parts = f.path.split("/");
 				let node = root;
 				for (const part of parts) {
 					if (!node[part]) node[part] = {};
 					node = node[part];
 				}
-				node.__file = p;
+				node.__file = f;
 			}
 			return root;
 		}
+		function formatCtime(iso) {
+			if (!iso) return "";
+			const d = new Date(iso);
+			const mon = d.toLocaleString(undefined, { month: "short" });
+			const day = d.getDate();
+			const now = new Date();
+			if (d.getFullYear() === now.getFullYear()) return mon + " " + day;
+			return mon + " " + day + ", " + d.getFullYear();
+		}
+		function getNewestCtime(node) {
+			if (node.__file) return node.__file.createdAt || "";
+			let newest = "";
+			for (const key of Object.keys(node)) {
+				if (key === "__file") continue;
+				const t = getNewestCtime(node[key]);
+				if (t > newest) newest = t;
+			}
+			return newest;
+		}
 		function countFiles(node) {
 			let count = 0;
 			for (const key of Object.keys(node)) {
@@ -427,35 +541,42 @@
 			return count;
 		}
-		function renderTree(node, parentUl, username, depth) {
+		function renderTree(node, parentUl, username, depth, pathPrefix = "") {
 			const keys = Object.keys(node).filter((k) => k !== "__file").sort((a, b) => {
 				const aDir = Object.keys(node[a]).some((k) => k !== "__file");
 				const bDir = Object.keys(node[b]).some((k) => k !== "__file");
 				if (aDir !== bDir) return aDir ? -1 : 1;
+				const aTime = getNewestCtime(node[a]);
+				const bTime = getNewestCtime(node[b]);
+				if (aTime !== bTime) return bTime.localeCompare(aTime);
 				return a.localeCompare(b);
 			});
 			for (const key of keys) {
 				const child = node[key];
+				const nodePath = pathPrefix ? pathPrefix + "/" + key : key;
 				const isFile = child.__file && Object.keys(child).length === 1;
 				const li = document.createElement("li");
+				li.dataset.key = nodePath;
 				const row = document.createElement("div");
 				row.className = "tree-row";
 				row.style.paddingLeft = (depth * 12 + 8) + "px";
 				if (isFile) {
-					row.innerHTML = '<span class="arrow">&nbsp;</span><i class="ph ph-file-text"></i> ' + key;
-					row.dataset.path = child.__file;
+					const ctime = child.__file.createdAt || "";
+					row.innerHTML = '<span class="name"><span class="arrow">&nbsp;</span><i class="ph ph-file-text"></i> ' + key + '</span><span class="ctime">' + formatCtime(ctime) + '</span>';
+					row.dataset.path = child.__file.path;
 					row.dataset.contributor = username;
-					row.onclick = () => loadContent(username, child.__file, row);
+					row.dataset.action = "open";
 				} else {
 					const sub = document.createElement("ul");
 					const fileCount = countFiles(child);
-					row.innerHTML = '<span class="arrow">&#9660;</span><i class="ph ph-folder"></i> ' + key + ' <span style="opacity:0.5">(' + fileCount + ')</span>';
-					row.onclick = () => {
-						sub.classList.toggle("collapsed");
-						row.querySelector(".arrow").innerHTML = sub.classList.contains("collapsed") ? "&#9654;" : "&#9660;";
-					};
-					renderTree(child, sub, username, depth + 1);
+					const expanded = getExpandedKeys().has(username + ":" + nodePath);
+					const arrow = expanded ? "&#9660;" : "&#9654;";
+					if (!expanded) sub.classList.add("collapsed");
+					row.innerHTML = '<span class="name"><span class="arrow">' + arrow + '</span><i class="ph ph-folder"></i> ' + key + ' <span style="opacity:0.5">(' + fileCount + ')</span></span>';
+					row.dataset.action = "toggle";
+					row.dataset.toggleKey = username + ":" + nodePath;
+					renderTree(child, sub, username, depth + 1, nodePath);
 					li.appendChild(row);
 					li.appendChild(sub);
 					parentUl.appendChild(li);
@@ -516,21 +637,71 @@
 			);
 		}
+		filesEl.addEventListener("click", (e) => {
+			const row = e.target.closest(".tree-row");
+			if (!row) return;
+			const action = row.dataset.action;
+			if (action === "open") {
+				loadContent(row.dataset.contributor, row.dataset.path, row);
+			} else if (action === "toggle") {
+				const sub = row.nextElementSibling;
+				if (!sub) return;
+				sub.classList.toggle("collapsed");
+				const arrow = row.querySelector(".arrow");
+				if (arrow) arrow.innerHTML = sub.classList.contains("collapsed") ? "&#9654;" : "&#9660;";
+				const keys = getExpandedKeys();
+				const toggleKey = row.dataset.toggleKey;
+				if (toggleKey) {
+					if (sub.classList.contains("collapsed")) keys.delete(toggleKey);
+					else keys.add(toggleKey);
+					saveExpandedKeys(keys);
+				}
+			} else if (action === "contributor") {
+				const sub = row.nextElementSibling;
+				if (!sub) return;
+				const collapsed = sub.classList.contains("collapsed");
+				const keys = getExpandedKeys();
+				const toggleKey = "contributor:" + row.dataset.contributor;
+				if (collapsed) {
+					sub.classList.remove("collapsed");
+					row.querySelector(".arrow").innerHTML = "&#9660;";
+					keys.add(toggleKey);
+				} else {
+					sub.classList.add("collapsed");
+					row.querySelector(".arrow").innerHTML = "&#9654;";
+					keys.delete(toggleKey);
+				}
+				saveExpandedKeys(keys);
+			}
+		});
 		async function loadContributorFiles(username, sub, opts = {}) {
 			const silent = !!opts.silent;
-			sub.innerHTML = "";
 			if (!silent) status("Loading files...");
 			const { files } = await (await api("/v1/files?prefix=" + encodeURIComponent(username + "/"))).json();
 			const prefix = username + "/";
-			const tree = buildTree(files.map((f) => f.path.startsWith(prefix) ? f.path.slice(prefix.length) : f.path));
-			renderTree(tree, sub, username, 1);
+			const tree = buildTree(files.map((f) => ({
+				...f,
+				path: f.path.startsWith(prefix) ? f.path.slice(prefix.length) : f.path,
+			})));
+			const tmp = document.createElement("ul");
+			renderTree(tree, tmp, username, 1);
+			if (sub.hasChildNodes()) {
+				morphdom(sub, tmp, {
+					childrenOnly: true,
+					getNodeKey(node) {
+						return node.dataset?.key || "";
+					},
+				});
+			} else {
+				sub.append(...tmp.childNodes);
+			}
 			markActiveRow();
 			if (!silent) status(files.length + " file(s)");
-			// Update contributor row with file count
 			const row = sub.parentElement && sub.parentElement.querySelector(".tree-row");
 			if (row) {
 				const arrow = row.querySelector(".arrow").outerHTML;
-				row.innerHTML = arrow + '<i class="ph ph-user"></i> ' + username + ' <span style="opacity:0.5">(' + files.length + ')</span>';
+				row.innerHTML = '<span class="name">' + arrow + '<i class="ph ph-user"></i> ' + username + ' <span style="opacity:0.5">(' + files.length + ')</span></span>';
 			}
 		}
@@ -539,6 +710,7 @@
 			contentEl.innerHTML = "";
 			status("Loading contributors...");
 			const { contributors } = await (await api("/v1/contributors")).json();
+			const expandedKeys = getExpandedKeys();
 			for (const b of contributors) {
 				const li = document.createElement("li");
@@ -547,40 +719,28 @@
 				row.style.paddingLeft = "8px";
 				const sub = document.createElement("ul");
 				sub.dataset.contributor = b.username;
-				sub.dataset.loaded = "false";
-				let loaded = false;
-				row.innerHTML = '<span class="arrow">&#9654;</span><i class="ph ph-user"></i> ' + b.username;
-				row.onclick = async () => {
-					const collapsed = sub.classList.contains("collapsed") || !sub.hasChildNodes();
-					if (collapsed) {
-						sub.classList.remove("collapsed");
-						row.querySelector(".arrow").innerHTML = "&#9660;";
-						if (!loaded) {
-							loaded = true;
-							sub.dataset.loaded = "true";
-							await loadContributorFiles(b.username, sub);
-						}
-					} else {
-						sub.classList.add("collapsed");
-						row.querySelector(".arrow").innerHTML = "&#9654;";
-					}
-				};
+				sub.dataset.loaded = "true";
+				const expanded = expandedKeys.has("contributor:" + b.username);
+				if (!expanded) sub.classList.add("collapsed");
+				const arrow = expanded ? "&#9660;" : "&#9654;";
+				row.innerHTML = '<span class="name"><span class="arrow">' + arrow + '</span><i class="ph ph-user"></i> ' + b.username + '</span>';
+				row.dataset.action = "contributor";
+				row.dataset.contributor = b.username;
 				li.appendChild(row);
 				li.appendChild(sub);
 				filesEl.appendChild(li);
+			}
-				if (b.username === savedContributor) {
-					sub.classList.remove("collapsed");
-					row.querySelector(".arrow").innerHTML = "&#9660;";
-					loaded = true;
-					sub.dataset.loaded = "true";
-					await loadContributorFiles(b.username, sub);
-					if (savedFile) {
-						const match = filesEl.querySelector('[data-path="' + CSS.escape(savedFile) + '"]');
-						if (match) await loadContent(b.username, savedFile, match);
-					}
-				}
+			await Promise.all(contributors.map((b) => {
+				const sub = getLoadedContributorList(b.username);
+				return sub ? loadContributorFiles(b.username, sub, { silent: true }) : null;
+			}));
+			if (savedFile && savedContributor) {
+				const match = filesEl.querySelector('[data-path="' + CSS.escape(savedFile) + '"]');
+				if (match) await loadContent(savedContributor, savedFile, match);
 			}
 			status(contributors.length + " contributor(s)");
 		}
@@ -590,12 +750,10 @@
 			row.scrollIntoView({ block: "nearest", behavior: "smooth" });
 			localStorage.setItem("sv-contributor", username);
 			localStorage.setItem("sv-file", path);
+			closeSidebar();
 			status("Loading " + path + "...");
-			const res = await api("/v1/sh", {
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({ cmd: 'cat "' + username + "/" + path + '"' }),
-			});
+			const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+			const res = await api("/v1/files/" + encodeURIComponent(username) + "/" + encodedPath);
 			const text = await res.text();
 			contentEl.innerHTML = renderMarkdown(text);
 			contentEl.parentElement.scrollTop = 0;
@@ -639,11 +797,8 @@
 				scheduleContributorReload(contributor);
 				// If this file is currently open, reload its content
 				if (localStorage.getItem("sv-file") === path && localStorage.getItem("sv-contributor") === contributor) {
-					api("/v1/sh", {
-						method: "POST",
-						headers: { "Content-Type": "application/json" },
-						body: JSON.stringify({ cmd: 'cat "' + contributor + "/" + path + '"' }),
-					})
+					const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+					api("/v1/files/" + encodeURIComponent(contributor) + "/" + encodedPath)
 						.then((res) => res.text())
 						.then((text) => { contentEl.innerHTML = renderMarkdown(text); });
 				}

package/dist/server.js CHANGED Viewed

@@ -1,8 +1,8 @@
 // @bun
 // src/index.ts
-import { join as join2 } from "path";
+import { join } from "path";
 import { homedir } from "os";
-import { mkdir as mkdir2 } from "fs/promises";
+import { mkdir } from "fs/promises";
 // src/db.ts
 import { Database } from "bun:sqlite";
@@ -20,7 +20,7 @@ function initDb(dbPath) {
   db.exec(`
     CREATE TABLE IF NOT EXISTS contributors (
       username TEXT PRIMARY KEY,
-      is_operator BOOLEAN NOT NULL DEFAULT FALSE,
+      is_admin BOOLEAN NOT NULL DEFAULT FALSE,
       created_at TEXT NOT NULL
     );
@@ -40,7 +40,42 @@ function initDb(dbPath) {
       used_at TEXT,
       used_by TEXT REFERENCES contributors(username)
     );
+    CREATE TABLE IF NOT EXISTS items (
+      contributor TEXT NOT NULL,
+      path TEXT NOT NULL,
+      content TEXT NOT NULL,
+      created_at TEXT NOT NULL,
+      modified_at TEXT NOT NULL,
+      PRIMARY KEY (contributor, path),
+      FOREIGN KEY (contributor) REFERENCES contributors(username)
+    );
   `);
+  const hasFts = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='items_fts'").get();
+  if (!hasFts) {
+    db.exec(`
+      CREATE VIRTUAL TABLE items_fts USING fts5(
+        path, content, content=items, content_rowid=rowid
+      );
+      CREATE TRIGGER items_ai AFTER INSERT ON items BEGIN
+        INSERT INTO items_fts(rowid, path, content)
+        VALUES (new.rowid, new.path, new.content);
+      END;
+      CREATE TRIGGER items_ad AFTER DELETE ON items BEGIN
+        INSERT INTO items_fts(items_fts, rowid, path, content)
+        VALUES ('delete', old.rowid, old.path, old.content);
+      END;
+      CREATE TRIGGER items_au AFTER UPDATE ON items BEGIN
+        INSERT INTO items_fts(items_fts, rowid, path, content)
+        VALUES ('delete', old.rowid, old.path, old.content);
+        INSERT INTO items_fts(rowid, path, content)
+        VALUES (new.rowid, new.path, new.content);
+      END;
+    `);
+  }
   return db;
 }
 function validateUsername(username) {
@@ -55,20 +90,57 @@ function validateUsername(username) {
   }
   return null;
 }
-function createContributor(username, isOperator) {
+function validatePath(filePath) {
+  if (!filePath || filePath.length === 0) {
+    return "Path cannot be empty";
+  }
+  if (filePath.startsWith("/")) {
+    return "Path cannot start with /";
+  }
+  if (filePath.includes("\\")) {
+    return "Path cannot contain backslashes";
+  }
+  if (filePath.includes("//")) {
+    return "Path cannot contain double slashes";
+  }
+  if (!filePath.endsWith(".md")) {
+    return "Path must end in .md";
+  }
+  const segments = filePath.split("/");
+  for (const seg of segments) {
+    if (seg === "." || seg === "..") {
+      return "Path cannot contain . or .. segments";
+    }
+    if (seg.length === 0) {
+      return "Path cannot contain empty segments";
+    }
+  }
+  return null;
+}
+function createContributor(username, isAdmin) {
   const now = new Date().toISOString();
-  getDb().prepare("INSERT INTO contributors (username, is_operator, created_at) VALUES (?, ?, ?)").run(username, isOperator ? 1 : 0, now);
-  return { username, is_operator: isOperator, created_at: now };
+  getDb().prepare("INSERT INTO contributors (username, is_admin, created_at) VALUES (?, ?, ?)").run(username, isAdmin ? 1 : 0, now);
+  return { username, is_admin: isAdmin, created_at: now };
 }
 function getContributor(username) {
-  const row = getDb().prepare("SELECT username, is_operator, created_at FROM contributors WHERE username = ?").get(username);
+  const row = getDb().prepare("SELECT username, is_admin, created_at FROM contributors WHERE username = ?").get(username);
   if (row)
-    row.is_operator = Boolean(row.is_operator);
+    row.is_admin = Boolean(row.is_admin);
   return row;
 }
 function listContributors() {
-  const rows = getDb().prepare("SELECT username, is_operator, created_at FROM contributors ORDER BY created_at ASC").all();
-  return rows.map((r) => ({ ...r, is_operator: Boolean(r.is_operator) }));
+  const rows = getDb().prepare("SELECT username, is_admin, created_at FROM contributors ORDER BY created_at ASC").all();
+  return rows.map((r) => ({ ...r, is_admin: Boolean(r.is_admin) }));
+}
+function deleteContributor(username) {
+  const d = getDb();
+  const exists = d.prepare("SELECT 1 FROM contributors WHERE username = ?").get(username);
+  if (!exists)
+    return false;
+  d.prepare("DELETE FROM items WHERE contributor = ?").run(username);
+  d.prepare("DELETE FROM api_keys WHERE contributor = ?").run(username);
+  d.prepare("DELETE FROM contributors WHERE username = ?").run(username);
+  return true;
 }
 function hasAnyContributor() {
   const row = getDb().prepare("SELECT COUNT(*) as count FROM contributors").get();
@@ -78,7 +150,14 @@ function createApiKey(keyHash, label, contributor) {
   const id = `key_${randomUUID().replace(/-/g, "").slice(0, 12)}`;
   const now = new Date().toISOString();
   getDb().prepare("INSERT INTO api_keys (id, key_hash, label, contributor, created_at) VALUES (?, ?, ?, ?, ?)").run(id, keyHash, label, contributor, now);
-  return { id, key_hash: keyHash, label, contributor, created_at: now, last_used_at: null };
+  return {
+    id,
+    key_hash: keyHash,
+    label,
+    contributor,
+    created_at: now,
+    last_used_at: null
+  };
 }
 function getApiKeyByHash(keyHash) {
   return getDb().prepare("SELECT * FROM api_keys WHERE key_hash = ?").get(keyHash);
@@ -90,7 +169,13 @@ function createInvite(createdBy) {
   const id = randomUUID().replace(/-/g, "").slice(0, 12);
   const now = new Date().toISOString();
   getDb().prepare("INSERT INTO invites (id, created_by, created_at) VALUES (?, ?, ?)").run(id, createdBy, now);
-  return { id, created_by: createdBy, created_at: now, used_at: null, used_by: null };
+  return {
+    id,
+    created_by: createdBy,
+    created_at: now,
+    used_at: null,
+    used_by: null
+  };
 }
 function getInvite(id) {
   return getDb().prepare("SELECT * FROM invites WHERE id = ?").get(id);
@@ -98,6 +183,84 @@ function getInvite(id) {
 function markInviteUsed(id, usedBy) {
   getDb().prepare("UPDATE invites SET used_at = ?, used_by = ? WHERE id = ?").run(new Date().toISOString(), usedBy, id);
 }
+function validateOriginCtime(originCtime, originMtime) {
+  if (originCtime) {
+    const ms = new Date(originCtime).getTime();
+    if (ms > 0 && !isNaN(ms))
+      return originCtime;
+  }
+  if (originMtime) {
+    const ms = new Date(originMtime).getTime();
+    if (ms > 0 && !isNaN(ms))
+      return originMtime;
+  }
+  return new Date().toISOString();
+}
+var MAX_CONTENT_SIZE = 10 * 1024 * 1024;
+function upsertItem(contributor, path, content, originCtime, originMtime) {
+  if (Buffer.byteLength(content) > MAX_CONTENT_SIZE) {
+    throw new ItemTooLargeError(Buffer.byteLength(content));
+  }
+  const now = new Date().toISOString();
+  const createdAt = validateOriginCtime(originCtime, originMtime);
+  const modifiedAt = originMtime || now;
+  getDb().prepare(`INSERT INTO items (contributor, path, content, created_at, modified_at)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT (contributor, path) DO UPDATE SET
+         content = excluded.content,
+         modified_at = excluded.modified_at`).run(contributor, path, content, createdAt, modifiedAt);
+  return getItem(contributor, path);
+}
+function getItem(contributor, path) {
+  return getDb().prepare("SELECT contributor, path, content, created_at, modified_at FROM items WHERE contributor = ? AND path = ?").get(contributor, path);
+}
+function listItems(contributor, prefix) {
+  let rows;
+  if (prefix) {
+    rows = getDb().prepare(`SELECT path, length(content) as size, created_at, modified_at
+         FROM items WHERE contributor = ? AND path LIKE ?
+         ORDER BY modified_at DESC`).all(contributor, prefix + "%");
+  } else {
+    rows = getDb().prepare(`SELECT path, length(content) as size, created_at, modified_at
+         FROM items WHERE contributor = ?
+         ORDER BY modified_at DESC`).all(contributor);
+  }
+  return rows;
+}
+function deleteItem(contributor, path) {
+  const result = getDb().prepare("DELETE FROM items WHERE contributor = ? AND path = ?").run(contributor, path);
+  return result.changes > 0;
+}
+function searchItems(query, contributor, limit = 10) {
+  if (contributor) {
+    return getDb().prepare(`SELECT i.contributor, i.path,
+                snippet(items_fts, 1, '<b>', '</b>', '...', 32) as snippet,
+                rank
+         FROM items_fts
+         JOIN items i ON items_fts.rowid = i.rowid
+         WHERE items_fts MATCH ?
+           AND i.contributor = ?
+         ORDER BY rank
+         LIMIT ?`).all(query, contributor, limit);
+  }
+  return getDb().prepare(`SELECT i.contributor, i.path,
+              snippet(items_fts, 1, '<b>', '</b>', '...', 32) as snippet,
+              rank
+       FROM items_fts
+       JOIN items i ON items_fts.rowid = i.rowid
+       WHERE items_fts MATCH ?
+       ORDER BY rank
+       LIMIT ?`).all(query, limit);
+}
+class ItemTooLargeError extends Error {
+  size;
+  constructor(size) {
+    super(`Content too large: ${size} bytes (max ${MAX_CONTENT_SIZE})`);
+    this.name = "ItemTooLargeError";
+    this.size = size;
+  }
+}
 // ../node_modules/.bun/hono@4.11.9/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -1661,140 +1824,6 @@ function getAuthCtx(c) {
   return c.get("authCtx");
 }
-// src/storage.ts
-import { join, dirname, relative, sep } from "path";
-import { mkdir, writeFile, unlink, readdir, stat, readFile, rename, rmdir } from "fs/promises";
-import { existsSync } from "fs";
-import { randomUUID as randomUUID2 } from "crypto";
-var MAX_FILE_SIZE = 10 * 1024 * 1024;
-function validatePath(filePath) {
-  if (!filePath || filePath.length === 0) {
-    return "Path cannot be empty";
-  }
-  if (filePath.startsWith("/")) {
-    return "Path cannot start with /";
-  }
-  if (filePath.includes("\\")) {
-    return "Path cannot contain backslashes";
-  }
-  if (filePath.includes("//")) {
-    return "Path cannot contain double slashes";
-  }
-  if (!filePath.endsWith(".md")) {
-    return "Path must end in .md";
-  }
-  const segments = filePath.split("/");
-  for (const seg of segments) {
-    if (seg === "." || seg === "..") {
-      return "Path cannot contain . or .. segments";
-    }
-    if (seg.length === 0) {
-      return "Path cannot contain empty segments";
-    }
-  }
-  return null;
-}
-function resolvePath(storageRoot, contributor, filePath) {
-  return join(storageRoot, contributor, filePath);
-}
-async function ensureContributorDir(storageRoot, contributor) {
-  const dir = join(storageRoot, contributor);
-  await mkdir(dir, { recursive: true });
-}
-async function writeFileAtomic(storageRoot, contributor, filePath, content) {
-  const contentBuf = typeof content === "string" ? Buffer.from(content) : content;
-  if (contentBuf.length > MAX_FILE_SIZE) {
-    throw new FileTooLargeError(contentBuf.length);
-  }
-  const absPath = resolvePath(storageRoot, contributor, filePath);
-  const dir = dirname(absPath);
-  await mkdir(dir, { recursive: true });
-  const tmpPath = `${absPath}.tmp.${randomUUID2().slice(0, 8)}`;
-  try {
-    await writeFile(tmpPath, contentBuf);
-    await rename(tmpPath, absPath);
-  } catch (e) {
-    try {
-      await unlink(tmpPath);
-    } catch {}
-    throw e;
-  }
-  const fileStat = await stat(absPath);
-  return {
-    path: filePath,
-    size: fileStat.size,
-    modifiedAt: fileStat.mtime.toISOString()
-  };
-}
-async function deleteFile(storageRoot, contributor, filePath) {
-  const absPath = resolvePath(storageRoot, contributor, filePath);
-  if (!existsSync(absPath)) {
-    throw new FileNotFoundError(filePath);
-  }
-  await unlink(absPath);
-  const contributorRoot = join(storageRoot, contributor);
-  let dir = dirname(absPath);
-  while (dir !== contributorRoot && dir.startsWith(contributorRoot)) {
-    try {
-      await rmdir(dir);
-      dir = dirname(dir);
-    } catch {
-      break;
-    }
-  }
-}
-async function listFiles(storageRoot, contributor, prefix) {
-  const contributorRoot = join(storageRoot, contributor);
-  if (!existsSync(contributorRoot)) {
-    return [];
-  }
-  const files = [];
-  await walkDir(contributorRoot, contributorRoot, prefix, files);
-  files.sort((a, b) => b.modifiedAt.localeCompare(a.modifiedAt));
-  return files;
-}
-async function walkDir(dir, contributorRoot, prefix, results) {
-  let entries;
-  try {
-    entries = await readdir(dir, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const fullPath = join(dir, entry.name);
-    if (entry.isDirectory()) {
-      await walkDir(fullPath, contributorRoot, prefix, results);
-    } else if (entry.isFile() && entry.name.endsWith(".md")) {
-      const relPath = relative(contributorRoot, fullPath).split(sep).join("/");
-      if (prefix && !relPath.startsWith(prefix)) {
-        continue;
-      }
-      const fileStat = await stat(fullPath);
-      results.push({
-        path: relPath,
-        size: fileStat.size,
-        modifiedAt: fileStat.mtime.toISOString()
-      });
-    }
-  }
-}
-class FileNotFoundError extends Error {
-  constructor(path) {
-    super(`File not found: ${path}`);
-    this.name = "FileNotFoundError";
-  }
-}
-class FileTooLargeError extends Error {
-  size;
-  constructor(size) {
-    super(`File too large: ${size} bytes (max ${MAX_FILE_SIZE})`);
-    this.name = "FileTooLargeError";
-    this.size = size;
-  }
-}
 // src/sse.ts
 var clients = new Set;
 function addClient(controller) {
@@ -1818,178 +1847,6 @@ data: ${JSON.stringify(data)}
   }
 }
-// src/qmd.ts
-async function isQmdAvailable() {
-  try {
-    const proc = Bun.spawn(["qmd", "status"], { stdout: "pipe", stderr: "pipe" });
-    await proc.exited;
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function addCollection(storageRoot, contributor) {
-  const dir = `${storageRoot}/${contributor.username}`;
-  const proc = Bun.spawn(["qmd", "collection", "add", dir, "--name", contributor.username, "--mask", "**/*.md"], { stdout: "pipe", stderr: "pipe" });
-  const exitCode = await proc.exited;
-  if (exitCode !== 0) {
-    const stderr = await new Response(proc.stderr).text();
-    if (!stderr.includes("already exists")) {
-      console.error(`QMD collection add failed for ${contributor.username}:`, stderr);
-    }
-  }
-}
-var updateInFlight = false;
-var updateQueued = false;
-function triggerUpdate() {
-  if (updateInFlight) {
-    updateQueued = true;
-    return;
-  }
-  runUpdate();
-}
-async function runUpdate() {
-  updateInFlight = true;
-  try {
-    const proc = Bun.spawn(["qmd", "update"], { stdout: "pipe", stderr: "pipe" });
-    const exitCode = await proc.exited;
-    if (exitCode !== 0) {
-      const stderr = await new Response(proc.stderr).text();
-      console.error("QMD update failed:", stderr);
-    }
-  } catch (e) {
-    console.error("QMD update error:", e);
-  } finally {
-    updateInFlight = false;
-    if (updateQueued) {
-      updateQueued = false;
-      runUpdate();
-    }
-  }
-}
-async function search(query, options = {}) {
-  const limit = options.limit ?? 10;
-  const args = ["search", query, "--json", "-n", String(limit)];
-  if (options.collection) {
-    args.push("-c", options.collection);
-  }
-  try {
-    const proc = Bun.spawn(["qmd", ...args], { stdout: "pipe", stderr: "pipe" });
-    const stdout = await new Response(proc.stdout).text();
-    const exitCode = await proc.exited;
-    if (exitCode !== 0) {
-      const stderr = await new Response(proc.stderr).text();
-      console.error("QMD search failed:", stderr);
-      return [];
-    }
-    if (!stdout.trim())
-      return [];
-    return JSON.parse(stdout);
-  } catch (e) {
-    console.error("QMD search error:", e);
-    return [];
-  }
-}
-async function syncContributors(storageRoot, contributors) {
-  for (const contributor of contributors) {
-    await addCollection(storageRoot, contributor);
-  }
-}
-// src/shell.ts
-var ALLOWED_COMMANDS = new Set([
-  "ls",
-  "cat",
-  "head",
-  "tail",
-  "find",
-  "grep",
-  "wc",
-  "tree",
-  "stat"
-]);
-var MAX_STDOUT = 1024 * 1024;
-var TIMEOUT_MS = 1e4;
-function parseCommand(cmd) {
-  const args = [];
-  let current = "";
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0;i < cmd.length; i++) {
-    const ch = cmd[i];
-    if (ch === "'" && !inDouble) {
-      inSingle = !inSingle;
-    } else if (ch === '"' && !inSingle) {
-      inDouble = !inDouble;
-    } else if (ch === " " && !inSingle && !inDouble) {
-      if (current.length > 0) {
-        args.push(current);
-        current = "";
-      }
-    } else {
-      current += ch;
-    }
-  }
-  if (current.length > 0) {
-    args.push(current);
-  }
-  return args;
-}
-async function executeCommand(cmd, storageRoot) {
-  const argv = parseCommand(cmd.trim());
-  if (argv.length === 0) {
-    throw new ShellValidationError("Empty command");
-  }
-  const command = argv[0];
-  if (!ALLOWED_COMMANDS.has(command)) {
-    throw new ShellValidationError(`Command not allowed: ${command}. Allowed: ${[...ALLOWED_COMMANDS].join(", ")}`);
-  }
-  for (const arg of argv.slice(1)) {
-    if (arg.includes("..")) {
-      throw new ShellValidationError("Path traversal (..) is not allowed");
-    }
-  }
-  const proc = Bun.spawn(argv, {
-    cwd: storageRoot,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: {}
-  });
-  const timeout = setTimeout(() => {
-    proc.kill();
-  }, TIMEOUT_MS);
-  try {
-    const [stdoutBuf, stderrBuf] = await Promise.all([
-      new Response(proc.stdout).arrayBuffer(),
-      new Response(proc.stderr).arrayBuffer()
-    ]);
-    await proc.exited;
-    const truncated = stdoutBuf.byteLength > MAX_STDOUT;
-    const stdoutBytes = truncated ? stdoutBuf.slice(0, MAX_STDOUT) : stdoutBuf;
-    let stdout = new TextDecoder().decode(stdoutBytes);
-    if (truncated) {
-      stdout += `
-[truncated]`;
-    }
-    const stderr = new TextDecoder().decode(stderrBuf);
-    return {
-      stdout,
-      stderr,
-      exitCode: proc.exitCode ?? 1,
-      truncated
-    };
-  } finally {
-    clearTimeout(timeout);
-  }
-}
-class ShellValidationError extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ShellValidationError";
-  }
-}
 // src/routes.ts
 var uiPath = resolve(import.meta.dirname, "index.html");
 var isDev = true;
@@ -2010,7 +1867,7 @@ function extractFileInfo(reqPath) {
     filePath: decoded.slice(slashIdx + 1)
   };
 }
-function createApp(storageRoot) {
+function createApp() {
   const app = new Hono2;
   app.get("/", (c) => {
     return c.html(isDev ? readFileSync(uiPath, "utf-8") : uiHtmlCached);
@@ -2045,8 +1902,6 @@ function createApp(storageRoot) {
       return c.json({ error: "A contributor with that username already exists" }, 409);
     }
     const contributor = createContributor(username, isFirstUser);
-    await ensureContributorDir(storageRoot, contributor.username);
-    addCollection(storageRoot, contributor).catch((e) => console.error("Failed to register QMD collection:", e));
     const rawToken = generateToken();
     createApiKey(hashToken(rawToken), `${username}-default`, contributor.username);
     if (!isFirstUser && body.invite) {
@@ -2071,8 +1926,8 @@ function createApp(storageRoot) {
   });
   authed.post("/v1/invites", (c) => {
     const { contributor } = getAuthCtx(c);
-    if (!contributor.is_operator) {
-      return c.json({ error: "Only the operator can generate invite codes" }, 403);
+    if (!contributor.is_admin) {
+      return c.json({ error: "Only the admin can generate invite codes" }, 403);
     }
     const invite = createInvite(contributor.username);
     return c.json({
@@ -2089,27 +1944,20 @@ function createApp(storageRoot) {
       }))
     });
   });
-  authed.post("/v1/sh", async (c) => {
-    const body = await c.req.json();
-    if (!body.cmd || typeof body.cmd !== "string") {
-      return c.json({ error: "cmd is required" }, 400);
+  authed.delete("/v1/contributors/:username", (c) => {
+    const { contributor } = getAuthCtx(c);
+    const target = c.req.param("username");
+    if (!contributor.is_admin) {
+      return c.json({ error: "Only the admin can delete contributors" }, 403);
     }
-    try {
-      const result = await executeCommand(body.cmd, storageRoot);
-      return new Response(result.stdout, {
-        status: 200,
-        headers: {
-          "Content-Type": "text/plain; charset=utf-8",
-          "X-Exit-Code": String(result.exitCode),
-          "X-Stderr": encodeURIComponent(result.stderr)
-        }
-      });
-    } catch (e) {
-      if (e instanceof ShellValidationError) {
-        return c.json({ error: e.message }, 400);
-      }
-      throw e;
+    if (target === contributor.username) {
+      return c.json({ error: "Cannot delete yourself" }, 400);
+    }
+    const found = deleteContributor(target);
+    if (!found) {
+      return c.json({ error: "Contributor not found" }, 404);
     }
+    return c.body(null, 204);
   });
   authed.put("/v1/files/*", async (c) => {
     const { contributor } = getAuthCtx(c);
@@ -2128,24 +1976,31 @@ function createApp(storageRoot) {
       return c.json({ error: pathError }, 400);
     }
     const content = await c.req.text();
+    const now = new Date().toISOString();
+    const originCtime = c.req.header("X-Origin-Ctime") || now;
+    const originMtime = c.req.header("X-Origin-Mtime") || now;
     try {
-      const result = await writeFileAtomic(storageRoot, parsed.username, parsed.filePath, content);
+      const item = upsertItem(parsed.username, parsed.filePath, content, originCtime, originMtime);
       broadcast("file_updated", {
         contributor: parsed.username,
-        path: result.path,
-        size: result.size,
-        modifiedAt: result.modifiedAt
+        path: item.path,
+        size: Buffer.byteLength(item.content),
+        modifiedAt: item.modified_at
+      });
+      return c.json({
+        path: item.path,
+        size: Buffer.byteLength(item.content),
+        createdAt: item.created_at,
+        modifiedAt: item.modified_at
       });
-      triggerUpdate();
-      return c.json(result);
     } catch (e) {
-      if (e instanceof FileTooLargeError) {
+      if (e instanceof ItemTooLargeError) {
         return c.json({ error: e.message }, 413);
       }
       throw e;
     }
   });
-  authed.delete("/v1/files/*", async (c) => {
+  authed.delete("/v1/files/*", (c) => {
     const { contributor } = getAuthCtx(c);
     const parsed = extractFileInfo(c.req.path);
     if (!parsed) {
@@ -2158,22 +2013,17 @@ function createApp(storageRoot) {
     if (pathError) {
       return c.json({ error: pathError }, 400);
     }
-    try {
-      await deleteFile(storageRoot, parsed.username, parsed.filePath);
-      broadcast("file_deleted", {
-        contributor: parsed.username,
-        path: parsed.filePath
-      });
-      triggerUpdate();
-      return c.body(null, 204);
-    } catch (e) {
-      if (e instanceof FileNotFoundError) {
-        return c.json({ error: "File not found" }, 404);
-      }
-      throw e;
+    const found = deleteItem(parsed.username, parsed.filePath);
+    if (!found) {
+      return c.json({ error: "File not found" }, 404);
     }
+    broadcast("file_deleted", {
+      contributor: parsed.username,
+      path: parsed.filePath
+    });
+    return c.body(null, 204);
   });
-  authed.get("/v1/files", async (c) => {
+  authed.get("/v1/files", (c) => {
     const prefix = c.req.query("prefix") || "";
     if (!prefix) {
       return c.json({ error: "prefix query parameter is required" }, 400);
@@ -2184,14 +2034,35 @@ function createApp(storageRoot) {
     if (!getContributor(username)) {
       return c.json({ error: "Contributor not found" }, 404);
     }
-    const files = await listFiles(storageRoot, username, subPrefix);
+    const items = listItems(username, subPrefix);
     return c.json({
-      files: files.map((f) => ({
-        ...f,
-        path: `${username}/${f.path}`
+      files: items.map((f) => ({
+        path: `${username}/${f.path}`,
+        size: f.size,
+        createdAt: f.created_at,
+        modifiedAt: f.modified_at
       }))
     });
   });
+  authed.get("/v1/files/*", (c) => {
+    const parsed = extractFileInfo(c.req.path);
+    if (!parsed) {
+      return c.json({ error: "Invalid file path" }, 400);
+    }
+    const item = getItem(parsed.username, parsed.filePath);
+    if (!item) {
+      return c.json({ error: "File not found" }, 404);
+    }
+    return new Response(item.content, {
+      status: 200,
+      headers: {
+        "Content-Type": "text/markdown; charset=utf-8",
+        "X-Created-At": item.created_at,
+        "X-Modified-At": item.modified_at,
+        "X-Size": String(Buffer.byteLength(item.content))
+      }
+    });
+  });
   authed.get("/v1/events", (c) => {
     let ctrl;
     let heartbeat;
@@ -2227,22 +2098,17 @@ data: {}
       }
     });
   });
-  authed.get("/v1/search", async (c) => {
+  authed.get("/v1/search", (c) => {
     const q = c.req.query("q");
     if (!q) {
       return c.json({ error: "q parameter is required" }, 400);
     }
     const contributorParam = c.req.query("contributor") || undefined;
     const limit = parseInt(c.req.query("limit") || "10", 10);
-    let collectionName;
-    if (contributorParam) {
-      const contributor = getContributor(contributorParam);
-      if (!contributor) {
-        return c.json({ error: "Contributor not found" }, 404);
-      }
-      collectionName = contributor.username;
+    if (contributorParam && !getContributor(contributorParam)) {
+      return c.json({ error: "Contributor not found" }, 404);
     }
-    const results = await search(q, { collection: collectionName, limit });
+    const results = searchItems(q, contributorParam, limit);
     return c.json({ results });
   });
   app.route("/", authed);
@@ -2251,28 +2117,14 @@ data: {}
 // src/index.ts
 var PORT = parseInt(process.env.PORT || "3000", 10);
-var DATA_DIR = process.env.DATA_DIR || join2(homedir(), ".seedvault", "data");
-var dbPath = join2(DATA_DIR, "seedvault.db");
-var storageRoot = join2(DATA_DIR, "files");
-await mkdir2(DATA_DIR, { recursive: true });
-await mkdir2(storageRoot, { recursive: true });
+var DATA_DIR = process.env.DATA_DIR || join(homedir(), ".seedvault", "data");
+var dbPath = join(DATA_DIR, "seedvault.db");
+await mkdir(DATA_DIR, { recursive: true });
 initDb(dbPath);
-var app = createApp(storageRoot);
+var app = createApp();
 console.log(`Seedvault server starting on port ${PORT}`);
 console.log(`  Data dir: ${DATA_DIR}`);
 console.log(`  Database: ${dbPath}`);
-console.log(`  Storage:  ${storageRoot}`);
-var qmdAvailable = await isQmdAvailable();
-if (qmdAvailable) {
-  console.log("  QMD:      available");
-  const contributors = listContributors();
-  if (contributors.length > 0) {
-    await syncContributors(storageRoot, contributors);
-    console.log(`  QMD:      synced ${contributors.length} collection(s)`);
-  }
-} else {
-  console.log("  QMD:      not found (search disabled)");
-}
 var server = Bun.serve({
   port: PORT,
   fetch: app.fetch

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@seedvault/server",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "bin": {
     "seedvault-server": "bin/seedvault-server.mjs"