@sprid/cli 0.1.2

package/src/post/json-worker.mjs

@@ -0,0 +1,12 @@
+// Executed only by the post command's JSON adapter. Never writes JSON to stdout.
+import { run } from "./cli.mjs";
+try {
+  const result = await run(process.argv.slice(2));
+  const exitCode = result?.exitCode ?? 0;
+  process.send({ ok: exitCode === 0, ...result, exitCode });
+  process.exitCode = exitCode;
+} catch (error) {
+  process.send({ ok: false, error: error.message, exitCode: 1 });
+  process.exitCode = 1;
+}
+process.disconnect();

package/src/post/preview-server.mjs

@@ -0,0 +1,58 @@
+import { createReadStream, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+const loopback = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+export function previewHandler({ directory, account, clients }) {
+  return (req, res) => {
+    try {
+      const base = new URL(`http://${req.headers.host}`);
+      if (!loopback.has(base.hostname) || req.headers['sec-fetch-site'] === 'cross-site') return res.writeHead(403).end('forbidden');
+      if (req.headers.origin && new URL(req.headers.origin).origin !== base.origin) return res.writeHead(403).end('forbidden');
+      if (!['GET', 'HEAD'].includes(req.method)) return res.writeHead(405, { Allow: 'GET, HEAD' }).end();
+      const url = new URL(req.url, base);
+      if (url.origin !== base.origin) return res.writeHead(400).end('invalid URL');
+      const path = decodeURIComponent(url.pathname);
+      if (path === '/__whoami') {
+        res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        return res.end(req.method === 'HEAD' ? undefined : JSON.stringify({ account }));
+      }
+      if (path === '/__reload') {
+        res.writeHead(200, { 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-store', Connection: 'keep-alive' });
+        if (req.method === 'HEAD') return res.end();
+        res.write('retry: 1000\n\n'); clients.add(res);
+        req.on('close', () => clients.delete(res));
+        return;
+      }
+      // Only generated HTML and individually named media are public. Media links
+      // intentionally target the user's selected source files outside this dir.
+      const isIndex = path === '/' || path === '/index.html';
+      if (!isIndex && !/^\/media\/[a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*\.(?:mp4|mov|webm|png|jpe?g|webp)$/i.test(path)) return res.writeHead(404).end('not found');
+      const file = join(directory, isIndex ? 'index.html' : path.slice(1));
+      const stat = statSync(file);
+      if (!stat.isFile()) return res.writeHead(404).end('not found');
+      const extension = file.split('.').pop().toLowerCase();
+      const types = { html: 'text/html; charset=utf-8', mp4: 'video/mp4', mov: 'video/quicktime', webm: 'video/webm', png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', webp: 'image/webp' };
+      const headers = { 'Content-Type': types[extension], 'X-Content-Type-Options': 'nosniff', 'Cache-Control': 'no-store', 'Accept-Ranges': 'bytes' };
+      let start = 0, end = stat.size - 1, status = 200;
+      if (req.headers.range) {
+        const range = /^bytes=(\d*)-(\d*)$/.exec(req.headers.range);
+        if (!range || (!range[1] && !range[2]) || !stat.size) return res.writeHead(416, { 'Content-Range': `bytes */${stat.size}` }).end();
+        start = range[1] ? Number(range[1]) : Math.max(0, stat.size - Number(range[2]));
+        end = range[1] && range[2] ? Math.min(Number(range[2]), stat.size - 1) : stat.size - 1;
+        if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start > end || start >= stat.size) return res.writeHead(416, { 'Content-Range': `bytes */${stat.size}` }).end();
+        status = 206; headers['Content-Range'] = `bytes ${start}-${end}/${stat.size}`;
+      }
+      headers['Content-Length'] = stat.size ? end - start + 1 : 0;
+      res.writeHead(status, headers);
+      if (req.method === 'HEAD' || !stat.size) return res.end();
+      const stream = createReadStream(file, { start, end });
+      stream.on('error', () => res.destroy());
+      res.on('close', () => stream.destroy());
+      stream.pipe(res);
+    } catch (error) {
+      if (!res.headersSent) res.writeHead(error.code === 'ENOENT' ? 404 : 400).end('invalid request');
+      else res.destroy();
+    }
+  };
+}