domma-cms 0.21.0 → 0.22.2

package/scripts/build.js

@@ -1,246 +1,263 @@
-/**
- * Build script — creates a publishable staging copy in _publish/
- * Browser-facing JS/CSS is minified; server-side code is copied as-is.
- * Run: node scripts/build.js
- */
-
-import {cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync} from 'fs';
-import {readdir} from 'fs/promises';
-import {createHash} from 'crypto';
-import {dirname, join, relative} from 'path';
-import * as esbuild from 'esbuild';
-
-const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
-const OUT = join(ROOT, '_publish');
-
-// Files/dirs copied verbatim (server-side, config, docs)
-const COPY_AS_IS = [
-  'server',
-  'bin',
-  'config',
-  'scripts',
-  'package.json',
-  'public/js/package.json',
-  'README.md',
-  'CLAUDE.md',
-  'LICENSE',
-  '.npmignore',
-];
-
-// Glob patterns for browser-facing assets to minify
-const MINIFY_PATTERNS = [
-  'admin/js/**/*.js',
-  'admin/css/**/*.css',
-  'public/js/**/*.js',
-  'public/css/**/*.css',
-  'plugins/*/public/**/*.js',
-  'plugins/*/public/**/*.css',
-];
-
-// Files within plugins that are copied as-is (server-side plugin code)
-const PLUGIN_AS_IS_PATTERNS = [
-  'plugins/**/plugin.js',
-  'plugins/**/config.js',
-  'plugins/**/routes/**/*.js',
-  'plugins/**/services/**/*.js',
-  'plugins/**/views/**/*.js',
-  'plugins/**/*.json',
-  'plugins/**/*.html',
-];
-
-// HTML templates in admin (copied as-is)
-const ADMIN_HTML_PATTERNS = [
-  'admin/**/*.html',
-];
-
-/**
- * Recursively list all files under a directory, returning paths relative to ROOT.
- * @param {string} dir - Absolute path to the directory to scan.
- * @returns {Promise<string[]>}
- */
-async function listFilesRecursive(dir) {
-  const entries = await readdir(dir, {recursive: true, withFileTypes: true});
-  return entries
-    .filter(e => e.isFile())
-    .map(e => relative(ROOT, join(e.parentPath ?? e.path, e.name)));
-}
-
-/**
- * Match files relative to ROOT against a simple glob pattern.
- * Supports `**` (any path segment), `*` (any non-separator chars), and `{a,b}` alternation.
- * @param {string} pattern
- * @returns {Promise<string[]>}
- */
-async function collectFiles(pattern) {
-  // Expand top-level {a,b,...} alternation into individual patterns
-  const braceMatch = pattern.match(/^\{([^}]+)\}\/(.+)$/);
-  if (braceMatch) {
-    const alts = braceMatch[1].split(',');
-    const rest = braceMatch[2];
-    const results = await Promise.all(alts.map(a => collectFiles(a + '/' + rest)));
-    return [...new Set(results.flat())];
-  }
-
-  // Determine the top-level directory from the pattern (part before first wildcard)
-  const parts = pattern.split('/');
-  let baseDir = ROOT;
-  for (const part of parts) {
-    if (part.includes('*') || part.includes('{')) break;
-    baseDir = join(baseDir, part);
-  }
-
-  if (!existsSync(baseDir)) return [];
-
-  const allFiles = await listFilesRecursive(baseDir);
-
-  // Convert glob pattern to a RegExp
-  const reStr = pattern
-    .replace(/[.+^${}()|[\]\\]/g, (c) => (c === '{' || c === '}' ? c : '\\' + c))
-    .replace(/\{([^}]+)\}/g, (_, alts) => '(?:' + alts.split(',').join('|') + ')')
-    .replace(/\*\*\//g, '(?:[^/]+/){0,}')   // **/ → zero-or-more path segments
-    .replace(/\*\*/g, '(.+)')
-    .replace(/(?<!\()\*/g, '([^/]+)');
-  const re = new RegExp('^' + reStr + '$');
-
-  return allFiles.filter(f => re.test(f.replace(/\\/g, '/')));
-}
-
-async function minifyFile(relPath, loader) {
-  const src = readFileSync(join(ROOT, relPath), 'utf8');
-  const result = await esbuild.transform(src, {
-    loader,
-    minify: true,
-    target: 'es2020',
-  });
-  const outPath = join(OUT, relPath);
-  mkdirSync(dirname(outPath), {recursive: true});
-  writeFileSync(outPath, result.code);
-}
-
-/**
- * Compute a short content hash for a file, used for cache-busting view entries.
- * Returns the first 8 hex chars of SHA-256, or null if the file can't be read.
- *
- * @param {string} filePath - Absolute path to the file
- * @returns {string|null}
- */
-function contentHash(filePath) {
-    try {
-        const content = readFileSync(filePath);
-        return createHash('sha256').update(content).digest('hex').slice(0, 8);
-    } catch {
-        return null;
-    }
-}
-
-/**
- * Rewrite admin.views entry paths in every plugin.json under _publish/plugins/
- * with a content-hash version (?v=<hash>), eliminating the need for manual ?v=N bumps.
- */
-async function stampPluginVersions() {
-    const pluginJsonFiles = await collectFiles('plugins/*/plugin.json');
-    for (const rel of pluginJsonFiles) {
-        const outPath = join(OUT, rel);
-        if (!existsSync(outPath)) continue;
-
-        let manifest;
-        try { manifest = JSON.parse(readFileSync(outPath, 'utf8')); } catch { continue; }
-        if (!manifest.admin?.views) continue;
-
-        let changed = false;
-        for (const [viewName, viewDef] of Object.entries(manifest.admin.views)) {
-            const entryBase = viewDef.entry.split('?')[0];
-            const entryFilePath = join(OUT, 'plugins', entryBase);
-            const hash = contentHash(entryFilePath);
-            if (hash) {
-                manifest.admin.views[viewName] = { ...viewDef, entry: `${entryBase}?v=${hash}` };
-                changed = true;
-            }
-        }
-
-        if (changed) writeFileSync(outPath, JSON.stringify(manifest, null, 2) + '\n');
-    }
-}
-
-async function build() {
-  // Clean and recreate _publish/
-  if (existsSync(OUT)) rmSync(OUT, {recursive: true, force: true});
-  mkdirSync(OUT, {recursive: true});
-
-  // Copy server-side dirs/files verbatim
-  for (const item of COPY_AS_IS) {
-    const src = join(ROOT, item);
-    if (existsSync(src)) {
-      const dest = join(OUT, item);
-      mkdirSync(dirname(dest), {recursive: true});
-      cpSync(src, dest, {recursive: true});
-    }
-  }
-
-  // Strip prepublishOnly from _publish/package.json — the guard is for the
-  // source tree only; running npm publish inside _publish/ must succeed.
-  const pkgPath = join(OUT, 'package.json');
-  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
-  delete pkg.scripts?.prepublishOnly;
-  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
-
-  // Copy plugin server-side code verbatim
-  const pluginAsIs = await collectFiles('{' + PLUGIN_AS_IS_PATTERNS.join(',') + '}');
-  for (const rel of pluginAsIs) {
-    const outPath = join(OUT, rel);
-    mkdirSync(dirname(outPath), {recursive: true});
-    cpSync(join(ROOT, rel), outPath);
-  }
-
-  // Copy admin HTML templates verbatim
-  const adminHtml = await collectFiles(ADMIN_HTML_PATTERNS[0]);
-  for (const rel of adminHtml) {
-    const outPath = join(OUT, rel);
-    mkdirSync(dirname(outPath), {recursive: true});
-    cpSync(join(ROOT, rel), outPath);
-  }
-
-  // Copy Domma tools assets (gitignored but tracked for distribution)
-  const dommaTools = [
-    'admin/dist/domma/domma-tools.css',
-    'admin/dist/domma/domma-tools.min.js',
-  ];
-  for (const rel of dommaTools) {
-    const src = join(ROOT, rel);
-    if (existsSync(src)) {
-      const outPath = join(OUT, rel);
-      mkdirSync(dirname(outPath), {recursive: true});
-      cpSync(src, outPath);
-    }
-  }
-
-  // Minify browser-facing JS and CSS
-  let jsCount = 0;
-  let cssCount = 0;
-
-  // Collect all minify targets, deduplicate against plugin as-is
-  const pluginAsIsSet = new Set(pluginAsIs);
-
-  for (const pattern of MINIFY_PATTERNS) {
-    const files = await collectFiles(pattern);
-    for (const rel of files) {
-      if (pluginAsIsSet.has(rel)) continue; // skip plugin server-side JS
-      const loader = rel.endsWith('.css') ? 'css' : 'js';
-      await minifyFile(rel, loader);
-      if (loader === 'js') jsCount++;
-      else cssCount++;
-    }
-  }
-
-  const totalCopied = COPY_AS_IS.filter(i => existsSync(join(ROOT, i))).length
-    + pluginAsIs.length + adminHtml.length;
-
-  await stampPluginVersions();
-
-  console.log(`Built into _publish/ — JS: ${jsCount} minified, CSS: ${cssCount} minified, ${totalCopied} entries copied`);
-}
-
-build().catch(err => {
-  console.error('Build failed:', err.message);
-  process.exit(1);
-});
+/**
+ * Build script — creates a publishable staging copy in _publish/
+ * Browser-facing JS/CSS is minified; server-side code is copied as-is.
+ * Run: node scripts/build.js
+ */
+
+import {cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync} from 'fs';
+import {readdir} from 'fs/promises';
+import {createHash} from 'crypto';
+import {dirname, join, relative} from 'path';
+import * as esbuild from 'esbuild';
+import {verifyAssetImports, formatReport} from './verify-assets.mjs';
+
+const ROOT = new URL('..', import.meta.url).pathname.replace(/\/$/, '');
+const OUT = join(ROOT, '_publish');
+
+// Files/dirs copied verbatim (server-side, config, docs)
+const COPY_AS_IS = [
+  'server',
+  'bin',
+  'config',
+  'scripts',
+  'package.json',
+  'public/js/package.json',
+  'README.md',
+  'CLAUDE.md',
+  'LICENSE',
+  '.npmignore',
+];
+
+// Glob patterns for browser-facing assets to minify. NOTE: both .js AND .mjs
+// must be listed — the browser ESM modules served raw (e.g. public/js/*.mjs)
+// use the .mjs extension, and omitting it silently drops those files from the
+// published package (this is the bug that shipped 0.22.1 without menu-decor.mjs).
+const MINIFY_PATTERNS = [
+  'admin/js/**/*.js',
+  'admin/js/**/*.mjs',
+  'admin/css/**/*.css',
+  'public/js/**/*.js',
+  'public/js/**/*.mjs',
+  'public/css/**/*.css',
+  'plugins/*/public/**/*.js',
+  'plugins/*/public/**/*.mjs',
+  'plugins/*/public/**/*.css',
+];
+
+// Files within plugins that are copied as-is (server-side plugin code)
+const PLUGIN_AS_IS_PATTERNS = [
+  'plugins/**/plugin.js',
+  'plugins/**/config.js',
+  'plugins/**/routes/**/*.js',
+  'plugins/**/services/**/*.js',
+  'plugins/**/views/**/*.js',
+  'plugins/**/*.json',
+  'plugins/**/*.html',
+];
+
+// HTML templates in admin (copied as-is)
+const ADMIN_HTML_PATTERNS = [
+  'admin/**/*.html',
+];
+
+/**
+ * Recursively list all files under a directory, returning paths relative to ROOT.
+ * @param {string} dir - Absolute path to the directory to scan.
+ * @returns {Promise<string[]>}
+ */
+async function listFilesRecursive(dir) {
+  const entries = await readdir(dir, {recursive: true, withFileTypes: true});
+  return entries
+    .filter(e => e.isFile())
+    .map(e => relative(ROOT, join(e.parentPath ?? e.path, e.name)));
+}
+
+/**
+ * Match files relative to ROOT against a simple glob pattern.
+ * Supports `**` (any path segment), `*` (any non-separator chars), and `{a,b}` alternation.
+ * @param {string} pattern
+ * @returns {Promise<string[]>}
+ */
+async function collectFiles(pattern) {
+  // Expand top-level {a,b,...} alternation into individual patterns
+  const braceMatch = pattern.match(/^\{([^}]+)\}\/(.+)$/);
+  if (braceMatch) {
+    const alts = braceMatch[1].split(',');
+    const rest = braceMatch[2];
+    const results = await Promise.all(alts.map(a => collectFiles(a + '/' + rest)));
+    return [...new Set(results.flat())];
+  }
+
+  // Determine the top-level directory from the pattern (part before first wildcard)
+  const parts = pattern.split('/');
+  let baseDir = ROOT;
+  for (const part of parts) {
+    if (part.includes('*') || part.includes('{')) break;
+    baseDir = join(baseDir, part);
+  }
+
+  if (!existsSync(baseDir)) return [];
+
+  const allFiles = await listFilesRecursive(baseDir);
+
+  // Convert glob pattern to a RegExp
+  const reStr = pattern
+    .replace(/[.+^${}()|[\]\\]/g, (c) => (c === '{' || c === '}' ? c : '\\' + c))
+    .replace(/\{([^}]+)\}/g, (_, alts) => '(?:' + alts.split(',').join('|') + ')')
+    .replace(/\*\*\//g, '(?:[^/]+/){0,}')   // **/ → zero-or-more path segments
+    .replace(/\*\*/g, '(.+)')
+    .replace(/(?<!\()\*/g, '([^/]+)');
+  const re = new RegExp('^' + reStr + '$');
+
+  return allFiles.filter(f => re.test(f.replace(/\\/g, '/')));
+}
+
+async function minifyFile(relPath, loader) {
+  const src = readFileSync(join(ROOT, relPath), 'utf8');
+  const result = await esbuild.transform(src, {
+    loader,
+    minify: true,
+    target: 'es2020',
+  });
+  const outPath = join(OUT, relPath);
+  mkdirSync(dirname(outPath), {recursive: true});
+  writeFileSync(outPath, result.code);
+}
+
+/**
+ * Compute a short content hash for a file, used for cache-busting view entries.
+ * Returns the first 8 hex chars of SHA-256, or null if the file can't be read.
+ *
+ * @param {string} filePath - Absolute path to the file
+ * @returns {string|null}
+ */
+function contentHash(filePath) {
+    try {
+        const content = readFileSync(filePath);
+        return createHash('sha256').update(content).digest('hex').slice(0, 8);
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * Rewrite admin.views entry paths in every plugin.json under _publish/plugins/
+ * with a content-hash version (?v=<hash>), eliminating the need for manual ?v=N bumps.
+ */
+async function stampPluginVersions() {
+    const pluginJsonFiles = await collectFiles('plugins/*/plugin.json');
+    for (const rel of pluginJsonFiles) {
+        const outPath = join(OUT, rel);
+        if (!existsSync(outPath)) continue;
+
+        let manifest;
+        try { manifest = JSON.parse(readFileSync(outPath, 'utf8')); } catch { continue; }
+        if (!manifest.admin?.views) continue;
+
+        let changed = false;
+        for (const [viewName, viewDef] of Object.entries(manifest.admin.views)) {
+            const entryBase = viewDef.entry.split('?')[0];
+            const entryFilePath = join(OUT, 'plugins', entryBase);
+            const hash = contentHash(entryFilePath);
+            if (hash) {
+                manifest.admin.views[viewName] = { ...viewDef, entry: `${entryBase}?v=${hash}` };
+                changed = true;
+            }
+        }
+
+        if (changed) writeFileSync(outPath, JSON.stringify(manifest, null, 2) + '\n');
+    }
+}
+
+async function build() {
+  // Clean and recreate _publish/
+  if (existsSync(OUT)) rmSync(OUT, {recursive: true, force: true});
+  mkdirSync(OUT, {recursive: true});
+
+  // Copy server-side dirs/files verbatim
+  for (const item of COPY_AS_IS) {
+    const src = join(ROOT, item);
+    if (existsSync(src)) {
+      const dest = join(OUT, item);
+      mkdirSync(dirname(dest), {recursive: true});
+      cpSync(src, dest, {recursive: true});
+    }
+  }
+
+  // Strip prepublishOnly from _publish/package.json — the guard is for the
+  // source tree only; running npm publish inside _publish/ must succeed.
+  const pkgPath = join(OUT, 'package.json');
+  const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+  delete pkg.scripts?.prepublishOnly;
+  writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+
+  // Copy plugin server-side code verbatim
+  const pluginAsIs = await collectFiles('{' + PLUGIN_AS_IS_PATTERNS.join(',') + '}');
+  for (const rel of pluginAsIs) {
+    const outPath = join(OUT, rel);
+    mkdirSync(dirname(outPath), {recursive: true});
+    cpSync(join(ROOT, rel), outPath);
+  }
+
+  // Copy admin HTML templates verbatim
+  const adminHtml = await collectFiles(ADMIN_HTML_PATTERNS[0]);
+  for (const rel of adminHtml) {
+    const outPath = join(OUT, rel);
+    mkdirSync(dirname(outPath), {recursive: true});
+    cpSync(join(ROOT, rel), outPath);
+  }
+
+  // Copy Domma tools assets (gitignored but tracked for distribution)
+  const dommaTools = [
+    'admin/dist/domma/domma-tools.css',
+    'admin/dist/domma/domma-tools.min.js',
+  ];
+  for (const rel of dommaTools) {
+    const src = join(ROOT, rel);
+    if (existsSync(src)) {
+      const outPath = join(OUT, rel);
+      mkdirSync(dirname(outPath), {recursive: true});
+      cpSync(src, outPath);
+    }
+  }
+
+  // Minify browser-facing JS and CSS
+  let jsCount = 0;
+  let cssCount = 0;
+
+  // Collect all minify targets, deduplicate against plugin as-is
+  const pluginAsIsSet = new Set(pluginAsIs);
+
+  for (const pattern of MINIFY_PATTERNS) {
+    const files = await collectFiles(pattern);
+    for (const rel of files) {
+      if (pluginAsIsSet.has(rel)) continue; // skip plugin server-side JS
+      const loader = rel.endsWith('.css') ? 'css' : 'js';
+      await minifyFile(rel, loader);
+      if (loader === 'js') jsCount++;
+      else cssCount++;
+    }
+  }
+
+  const totalCopied = COPY_AS_IS.filter(i => existsSync(join(ROOT, i))).length
+    + pluginAsIs.length + adminHtml.length;
+
+  await stampPluginVersions();
+
+  console.log(`Built into _publish/ — JS: ${jsCount} minified, CSS: ${cssCount} minified, ${totalCopied} entries copied`);
+
+  // Integrity gate — fail the build (and therefore `make pack` / `make
+  // release-npm`) if the staged set ships any ESM import pointing at a file
+  // that isn't there. This is what stops a "shipped code that imports a missing
+  // file" release (the 0.22.1 menu-decor.mjs incident) from ever publishing.
+  const integrity = await verifyAssetImports({projectRoot: OUT});
+  console.log(formatReport(integrity, '_publish/'));
+  if (!integrity.ok) {
+    throw new Error(`asset integrity check failed — ${integrity.missing.length} dangling import(s); refusing to package a broken release`);
+  }
+}
+
+build().catch(err => {
+  console.error('Build failed:', err.message);
+  process.exit(1);
+});