@xexr/blog-platform 1.0.16 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.1.0
+
+### Minor Changes
+
+- Add authenticated config sync and public IndexNow key route support for Bloggy-managed search engine submission settings. Expose package-owned Drizzle schema exports plus setup/check helpers so host apps can generate or apply Bloggy table upgrades without copying table definitions.
+
 ## 1.0.15
 
 ### Patch Changes

package/README.md

@@ -328,6 +328,27 @@ export const OPTIONS = slugExistsOptionsHandler;
 
 > 🛈 When this route is missing, Bloggy’s dry-run validation falls back to a warning and your platform logs will show `GET /api/blog/slugs/... 404`. Adding the handler keeps the validation flow clean.
 
+**`app/api/blog/config/route.ts`** - Authenticated config sync used for search submission settings:
+
+```tsx
+import "@/lib/blog-platform";
+import { configHandler, configOptionsHandler } from "@xexr/blog-platform";
+
+export const POST = configHandler;
+export const OPTIONS = configOptionsHandler;
+```
+
+**`app/bloggy-indexnow-key.txt/route.ts`** - Public IndexNow key file route:
+
+```tsx
+import "@/lib/blog-platform";
+import { indexNowKeyRoute } from "@xexr/blog-platform";
+
+export const GET = indexNowKeyRoute;
+```
+
+Bloggy generates the IndexNow key, stores it against the site, and syncs it to this package through `/api/blog/config` using the same publishing token. The downstream app does not need an IndexNow env var.
+
 ### 3. Configure Durable Storage (Drizzle + Turso)
 
 By default, the package uses in-memory storage (not persistent). To persist published articles, plug in the Drizzle adapter.
@@ -338,12 +359,76 @@ By default, the package uses in-memory storage (not persistent). To persist publ
 pnpm add drizzle-orm @libsql/client
 ```
 
-2. Create the tables (run once via your migrations):
+2. Add the package-owned schema to your Drizzle schema exports.
+
+This is the recommended path for apps that use Drizzle Kit. The host app still owns generated migration files, but the table definitions stay package-owned so you do not copy/fork `bp_*` table shapes.
+
+**`src/db/schema/blogPlatform.ts`**:
+
+```ts
+export {
+  bpArticles,
+  bpMetadata,
+  bpOperations,
+} from "@xexr/blog-platform";
+```
+
+Then make sure your Drizzle config includes that schema file. For example:
+
+```ts
+// drizzle.config.ts
+import { defineConfig } from "drizzle-kit";
+
+export default defineConfig({
+  schema: "./src/db/schema/!(*.test).ts",
+  out: "drizzle",
+  dialect: "turso",
+  dbCredentials: {
+    url: process.env.BLOG_DATABASE_URL!,
+    authToken: process.env.BLOG_DATABASE_AUTH_TOKEN!,
+  },
+});
+```
+
+Run your normal migration flow after upgrading the package:
+
+```bash
+pnpm drizzle-kit generate
+pnpm drizzle-kit migrate
+```
+
+3. Manual setup or upgrade path.
+
+For apps that do not generate Drizzle migrations from schema files, use the ordered SQL helper. It is safe to run repeatedly because each statement uses `IF NOT EXISTS`.
 
 ```ts
 // e.g., scripts/createBlogPlatformTables.ts or inside your migration
 import { getDrizzleAdapterSql } from "@xexr/blog-platform";
 import { createClient } from "@libsql/client";
+
+const client = createClient({
+  url: process.env.BLOG_DATABASE_URL!,
+  authToken: process.env.BLOG_DATABASE_AUTH_TOKEN!,
+});
+
+const { createAll } = getDrizzleAdapterSql();
+for (const statement of createAll) {
+  await client.execute(statement);
+}
+```
+
+Existing installs upgrading from a package version before IndexNow/config sync can run the same `createAll` loop, or just `getDrizzleAdapterSql().createMetadata`, to add the `bp_metadata` table.
+
+4. Optional startup/schema health check.
+
+Use `ensureDrizzleAdapterSchema` during setup checks or deployment smoke tests when you want a clear package-level error for missing Bloggy tables.
+
+```ts
+import {
+  ensureDrizzleAdapterSchema,
+  getDrizzleAdapterSql,
+} from "@xexr/blog-platform";
+import { createClient } from "@libsql/client";
 import { drizzle } from "drizzle-orm/libsql";
 
 const client = createClient({
@@ -352,12 +437,16 @@ const client = createClient({
 });
 const db = drizzle(client);
 
-const { createArticles, createOperations } = getDrizzleAdapterSql();
-await db.run(createArticles);
-await db.run(createOperations);
+try {
+  await ensureDrizzleAdapterSchema(db);
+} catch (error) {
+  console.error(error);
+  console.info(getDrizzleAdapterSql().createAll.join("\n\n"));
+  throw error;
+}
 ```
 
-3. Wire the adapter at app startup:
+5. Wire the adapter at app startup:
 
 ```ts
 // app/(root)/layout.tsx or middleware.ts (server-only)

package/dist/app/api/blog/config/route.ts

@@ -0,0 +1,259 @@
+import type { NextRequest, NextResponse } from "next/server.js";
+
+import { getStorage } from "@/lib/database";
+import {
+  authenticateRequest,
+  createTokenFingerprint,
+  requireAuth,
+} from "@/lib/auth";
+import { createCorsResponse, handleCorsOptions } from "@/lib/cors";
+import { enforceRateLimit, getRateLimitHeaders } from "@/lib/ratelimit";
+import type { BlogPlatformConfigPayload } from "@/types/contracts";
+
+interface ConfigResponse {
+  success: boolean;
+  updated?: string[];
+  error?: {
+    code: string;
+    message: string;
+    details?: Record<string, unknown>;
+  };
+}
+
+const INDEXNOW_KEY_PATTERN = /^[A-Za-z0-9-]{8,128}$/;
+
+export async function POST(
+  request: NextRequest,
+): Promise<NextResponse<ConfigResponse>> {
+  const auth = await authenticateRequest(request);
+  if (!auth.authenticated) {
+    const authCheck = await requireAuth(request);
+    return createCorsResponse(
+      request,
+      {
+        success: false,
+        error: {
+          code: authCheck.error?.error?.code ?? "PUB005",
+          message: authCheck.error?.error?.message ?? "Authentication required",
+        },
+      },
+      { status: 401 },
+    );
+  }
+
+  const tokenFingerprint = createTokenFingerprint(auth.token ?? "anonymous");
+  const rateLimitCheck = await enforceRateLimit(tokenFingerprint);
+  if (!rateLimitCheck.allowed) {
+    const rateLimitHeaders = getRateLimitHeaders({
+      success: false,
+      remaining: 0,
+      reset: Date.now() + 60_000,
+      limit: 5,
+      count: 5,
+    });
+    return createCorsResponse(
+      request,
+      {
+        success: false,
+        error: rateLimitCheck.errorResponse.error ?? {
+          code: "PUB011",
+          message: "Rate limit exceeded",
+        },
+      },
+      { status: 429, headers: rateLimitHeaders },
+    );
+  }
+
+  const contentType = request.headers.get("content-type");
+  if (!contentType?.includes("application/json")) {
+    return createCorsResponse(request, invalidConfig("Expected JSON body"), {
+      status: 400,
+    });
+  }
+
+  let payload: unknown;
+  try {
+    payload = await request.json();
+  } catch {
+    return createCorsResponse(request, invalidConfig("Invalid JSON body"), {
+      status: 400,
+    });
+  }
+
+  const parsed = parseConfigPayload(payload);
+  if (!parsed.success) {
+    return createCorsResponse(request, invalidConfig(parsed.message), {
+      status: 400,
+    });
+  }
+
+  const updated: string[] = [];
+  if (parsed.config.searchSubmission) {
+    await getStorage().setMetadata(
+      "searchSubmission",
+      parsed.config.searchSubmission,
+    );
+    updated.push("searchSubmission");
+  }
+
+  return createCorsResponse(
+    request,
+    {
+      success: true,
+      updated,
+    },
+    {
+      status: 200,
+      headers: getRateLimitHeaders(rateLimitCheck.rateLimitResult),
+    },
+  );
+}
+
+export async function OPTIONS(request: NextRequest): Promise<NextResponse> {
+  return handleCorsOptions(request, ["POST"], {
+    allowedHeaders: [
+      "Content-Type",
+      "X-Bloggy-Version",
+      "Authorization",
+      "X-Requested-With",
+    ],
+  });
+}
+
+function invalidConfig(message: string): ConfigResponse {
+  return {
+    success: false,
+    error: {
+      code: "PUB001",
+      message,
+    },
+  };
+}
+
+function parseConfigPayload(payload: unknown):
+  | { success: true; config: BlogPlatformConfigPayload }
+  | {
+      success: false;
+      message: string;
+    } {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { success: false, message: "Request body must be an object" };
+  }
+
+  const record = payload as Record<string, unknown>;
+  const allowedKeys = new Set(["version", "searchSubmission"]);
+  const unknownKeys = Object.keys(record).filter(
+    (key) => !allowedKeys.has(key),
+  );
+  if (unknownKeys.length > 0) {
+    return {
+      success: false,
+      message: `Unsupported config section: ${unknownKeys.join(", ")}`,
+    };
+  }
+
+  if (record.version !== 1) {
+    return { success: false, message: "Config version must be 1" };
+  }
+
+  const config: BlogPlatformConfigPayload = { version: 1 };
+  if (record.searchSubmission !== undefined) {
+    const searchSubmission = parseSearchSubmission(record.searchSubmission);
+    if (!searchSubmission.success) {
+      return searchSubmission;
+    }
+    return {
+      success: true,
+      config: {
+        ...config,
+        searchSubmission: searchSubmission.config,
+      },
+    };
+  }
+
+  return {
+    success: false,
+    message: "At least one supported config section is required",
+  };
+}
+
+function parseSearchSubmission(value: unknown):
+  | {
+      success: true;
+      config: NonNullable<BlogPlatformConfigPayload["searchSubmission"]>;
+    }
+  | {
+      success: false;
+      message: string;
+    } {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { success: false, message: "searchSubmission must be an object" };
+  }
+
+  const record = value as Record<string, unknown>;
+  const allowedKeys = new Set(["indexNow"]);
+  const unknownKeys = Object.keys(record).filter(
+    (key) => !allowedKeys.has(key),
+  );
+  if (unknownKeys.length > 0) {
+    return {
+      success: false,
+      message: `Unsupported searchSubmission section: ${unknownKeys.join(", ")}`,
+    };
+  }
+
+  if (record.indexNow === undefined) {
+    return {
+      success: false,
+      message: "searchSubmission.indexNow is required",
+    };
+  }
+
+  const indexNow = record.indexNow;
+  if (!indexNow || typeof indexNow !== "object" || Array.isArray(indexNow)) {
+    return {
+      success: false,
+      message: "searchSubmission.indexNow must be an object",
+    };
+  }
+
+  const indexNowRecord = indexNow as Record<string, unknown>;
+  if (typeof indexNowRecord.enabled !== "boolean") {
+    return { success: false, message: "indexNow.enabled must be a boolean" };
+  }
+  if (
+    typeof indexNowRecord.key !== "string" ||
+    !INDEXNOW_KEY_PATTERN.test(indexNowRecord.key)
+  ) {
+    return {
+      success: false,
+      message:
+        "indexNow.key must be 8 to 128 characters using letters, numbers, or dashes",
+    };
+  }
+  if (typeof indexNowRecord.keyLocation !== "string") {
+    return { success: false, message: "indexNow.keyLocation must be a URL" };
+  }
+  try {
+    const keyLocation = new URL(indexNowRecord.keyLocation);
+    if (keyLocation.protocol !== "https:" && keyLocation.protocol !== "http:") {
+      return {
+        success: false,
+        message: "indexNow.keyLocation must use HTTP or HTTPS",
+      };
+    }
+  } catch {
+    return { success: false, message: "indexNow.keyLocation must be a URL" };
+  }
+
+  return {
+    success: true,
+    config: {
+      indexNow: {
+        enabled: indexNowRecord.enabled,
+        key: indexNowRecord.key,
+        keyLocation: indexNowRecord.keyLocation,
+      },
+    },
+  };
+}

package/dist/app/api/blog/publish/route.ts

@@ -1,4 +1,4 @@
-import type { NextRequest, NextResponse } from "next/server";
+import type { NextRequest, NextResponse } from "next/server.js";
 import { getStorage } from "@/lib/database";
 import { getBlogPlatformVersion, parseVersionHeader } from "@/lib/version";
 import {

package/dist/app/api/blog/slugs/[slug]/route.ts

@@ -1,4 +1,4 @@
-import { type NextRequest, NextResponse } from "next/server";
+import { type NextRequest, NextResponse } from "next/server.js";
 import { getStorage } from "@/lib/database";
 import { getBlogPlatformVersion, parseVersionHeader } from "@/lib/version";
 import {

package/dist/app/api/blog/unpublish/route.ts

@@ -1,4 +1,4 @@
-import { type NextRequest, NextResponse } from "next/server";
+import { type NextRequest, NextResponse } from "next/server.js";
 import { getStorage } from "@/lib/database";
 import { getBlogPlatformVersion, parseVersionHeader } from "@/lib/version";
 import {

package/dist/app/api/blog/version/route.ts

@@ -1,4 +1,4 @@
-import type { NextRequest, NextResponse } from "next/server";
+import type { NextRequest, NextResponse } from "next/server.js";
 import {
   getBlogPlatformVersion,
   parseVersionHeader,

package/dist/app/blog/[slug]/page.mdx-security.test.ts

@@ -0,0 +1,135 @@
+import React from "react";
+import { renderToPipeableStream } from "react-dom/server";
+import { PassThrough } from "stream";
+import { describe, expect, it } from "vitest";
+
+import ArticlePage from "./page";
+import type { PublishedArticle } from "../../../types/contracts";
+
+const article: PublishedArticle = {
+  id: "article-security",
+  slug: "mdx-security",
+  title: "MDX security",
+  excerpt: "Renderer hardening fixtures.",
+  content: "Safe content.",
+  readingSeconds: 60,
+  wordCount: 120,
+  publishedAt: "2026-05-13T09:00:00.000Z",
+  updatedAt: "2026-05-13T09:00:00.000Z",
+  author: null,
+  site: {
+    id: "site-1",
+    name: "Example Blog",
+    tagline: "Useful writing",
+    description: "Articles about useful systems.",
+    domain: "example.com",
+    toneAdjectives: [],
+    locale: "en",
+  },
+  topics: [],
+  meta: {
+    canonicalUrl: "https://example.com/blog/mdx-security",
+    keywords: [],
+  },
+  version: 1,
+};
+
+describe("ArticlePage MDX security", () => {
+  it("renders expected markdown and figure HTML through the real article renderer", async () => {
+    const html = await renderToHtml(
+      React.createElement(ArticlePage, {
+        article: {
+          ...article,
+          content: [
+            "## Safe section",
+            "",
+            "<figure>",
+            "",
+            "![Dashboard](https://example.com/dashboard.png)",
+            "",
+            '<figcaption>Dashboard caption <span class="blog-image-credit">Credit: Example</span></figcaption>',
+            "",
+            "</figure>",
+            "",
+            "[Read more](https://example.com/read-more)",
+          ].join("\n"),
+        },
+        showShareLinks: false,
+      }),
+    );
+
+    expect(html).toContain("Safe section");
+    expect(html).toContain("<figure>");
+    expect(html).toContain("<figcaption>");
+    expect(html).toContain("Dashboard caption");
+    expect(html).toContain('src="https://example.com/dashboard.png"');
+    expect(html).toContain('href="https://example.com/read-more"');
+  });
+
+  it("removes executable raw HTML and unsafe URL protocols from rendered articles", async () => {
+    const html = await renderToHtml(
+      React.createElement(ArticlePage, {
+        article: {
+          ...article,
+          content: [
+            "Safe paragraph.",
+            "",
+            "<script>alert('script')</script>",
+            '<img src="https://example.com/safe.png" onerror="alert(1)" alt="event handler" />',
+            '<a href="javascript:alert(2)">unsafe link</a>',
+            '<img src="data:text/html,<script>alert(3)</script>" alt="data url" />',
+            '<iframe src="https://example.com/embed"></iframe>',
+            '<object data="https://example.com/payload"></object>',
+            '<embed src="https://example.com/payload" />',
+          ].join("\n"),
+        },
+        showShareLinks: false,
+      }),
+    );
+
+    const articleBodyHtml = extractArticleBodyHtml(html);
+
+    expect(articleBodyHtml).toContain("Safe paragraph.");
+    expect(articleBodyHtml).toContain("unsafe link");
+    expect(articleBodyHtml).not.toContain("<script");
+    expect(articleBodyHtml).not.toContain("onerror");
+    expect(articleBodyHtml).not.toContain("javascript:");
+    expect(articleBodyHtml).not.toContain("data:text/html");
+    expect(articleBodyHtml).not.toContain("<iframe");
+    expect(articleBodyHtml).not.toContain("<object");
+    expect(articleBodyHtml).not.toContain("<embed");
+  });
+});
+
+function extractArticleBodyHtml(html: string): string {
+  const start = html.indexOf('id="article-body"');
+  const end = html.indexOf('<script type="application/ld+json"', start);
+
+  if (start === -1) {
+    throw new Error("Article body not found in rendered HTML");
+  }
+
+  return end === -1 ? html.slice(start) : html.slice(start, end);
+}
+
+function renderToHtml(element: React.ReactElement): Promise<string> {
+  return new Promise((resolve, reject) => {
+    let html = "";
+    const stream = new PassThrough();
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk: string) => {
+      html += chunk;
+    });
+    stream.on("end", () => resolve(html));
+    stream.on("error", reject);
+
+    const { pipe } = renderToPipeableStream(element, {
+      onAllReady() {
+        pipe(stream);
+      },
+      onError(error) {
+        reject(error instanceof Error ? error : new Error(String(error)));
+      },
+    });
+  });
+}

package/dist/app/blog/[slug]/page.tsx

@@ -1,6 +1,6 @@
 import React from "react";
-import Image from "next/image";
-import Link from "next/link";
+import Image from "next/image.js";
+import Link from "next/link.js";
 import { MDXRemote } from "next-mdx-remote-client/rsc";
 import {
   type PublishedArticle,

package/dist/app/blog/authors/[slug]/page.tsx

@@ -1,6 +1,6 @@
 import React from "react";
-import Image from "next/image";
-import Link from "next/link";
+import Image from "next/image.js";
+import Link from "next/link.js";
 import { ArrowLeft, Globe, Mail } from "lucide-react";
 import { formatDistanceToNow } from "date-fns";
 

package/dist/app/blog/page.tsx

@@ -1,6 +1,6 @@
 import React from "react";
-import Link from "next/link";
-import Image from "next/image";
+import Link from "next/link.js";
+import Image from "next/image.js";
 import {
   type PublishedArticle,
   type PublishedAuthor,

package/dist/app/bloggy-indexnow-key.txt/route.ts

@@ -0,0 +1,22 @@
+import { NextResponse, type NextRequest } from "next/server.js";
+
+import { getStorage } from "@/lib/database";
+import type { SearchSubmissionConfig } from "@/types/contracts";
+
+export async function GET(_request: NextRequest): Promise<NextResponse> {
+  const searchSubmission =
+    await getStorage().getMetadata<SearchSubmissionConfig>("searchSubmission");
+  const indexNow = searchSubmission?.indexNow;
+
+  if (!indexNow?.enabled || !indexNow.key) {
+    return new NextResponse("Not found", { status: 404 });
+  }
+
+  return new NextResponse(indexNow.key, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/plain; charset=utf-8",
+      "Cache-Control": "public, max-age=300, stale-while-revalidate=60",
+    },
+  });
+}

package/dist/components/AuthorByline.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import Image from "next/image";
+import Image from "next/image.js";
 import { Globe, Mail } from "lucide-react";
 import { FaGithub, FaLinkedinIn, FaXTwitter } from "react-icons/fa6";
 import { type PublishedAuthor } from "../types/contracts";

package/dist/components/AuthorPages.tsx

@@ -1,6 +1,6 @@
 import React from "react";
-import Image from "next/image";
-import Link from "next/link";
+import Image from "next/image.js";
+import Link from "next/link.js";
 
 import type { PublishedArticle, PublishedAuthor } from "../types/contracts";
 import type { BlogTheme } from "../lib/article-ui";

package/dist/components/TopicArchivePages.tsx

@@ -1,6 +1,6 @@
 import React from "react";
-import Link from "next/link";
-import Image from "next/image";
+import Link from "next/link.js";
+import Image from "next/image.js";
 import { formatDistanceToNow } from "date-fns";
 
 import type { PublishedArticle, PublishedTopic } from "../types/contracts";