emdash 0.0.0-a → 0.0.1

package/package.json

@@ -1,20 +1,234 @@
 {
-	"name": "emdash",
-	"version": "0.0.0-a",
-	"description": "Simple blogging with node/iojs + GitHub",
-	"repository": {
-		"type": "git",
-		"url": "git://github.com/getify/emdash.git"
-	},
-	"keywords": [
-		"blog",
-		"static site"
-	],
-	"bugs": {
-		"url": "https://github.com/getify/emdash/issues",
-		"email": "getify@gmail.com"
-	},
-	"homepage": "http://github.com/getify/emdash",
-	"author": "Kyle Simpson <getify@gmail.com>",
-	"license": "MIT"
-}
+  "name": "emdash",
+  "version": "0.0.1",
+  "description": "Astro-native CMS with WordPress migration support",
+  "type": "module",
+  "main": "dist/index.mjs",
+  "bin": {
+    "emdash": "./dist/cli/index.mjs",
+    "em": "./dist/cli/index.mjs"
+  },
+  "files": [
+    "dist",
+    "src",
+    "locals.d.ts"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "default": "./dist/index.mjs"
+    },
+    "./astro": {
+      "types": "./dist/astro/index.d.mts",
+      "default": "./dist/astro/index.mjs"
+    },
+    "./middleware": {
+      "types": "./dist/astro/middleware.d.mts",
+      "default": "./dist/astro/middleware.mjs"
+    },
+    "./middleware/setup": {
+      "types": "./dist/astro/middleware/setup.d.mts",
+      "default": "./dist/astro/middleware/setup.mjs"
+    },
+    "./middleware/auth": {
+      "types": "./dist/astro/middleware/auth.d.mts",
+      "default": "./dist/astro/middleware/auth.mjs"
+    },
+    "./middleware/redirect": {
+      "types": "./dist/astro/middleware/redirect.d.mts",
+      "default": "./dist/astro/middleware/redirect.mjs"
+    },
+    "./ui": "./src/ui.ts",
+    "./ui/search": "./src/components/LiveSearch.astro",
+    "./cli": {
+      "types": "./dist/cli/index.d.mts",
+      "default": "./dist/cli/index.mjs"
+    },
+    "./routes/*": "./src/astro/routes/*",
+    "./db": {
+      "types": "./dist/db/index.d.mts",
+      "default": "./dist/db/index.mjs"
+    },
+    "./db/sqlite": {
+      "types": "./dist/db/sqlite.d.mts",
+      "default": "./dist/db/sqlite.mjs"
+    },
+    "./db/libsql": {
+      "types": "./dist/db/libsql.d.mts",
+      "default": "./dist/db/libsql.mjs"
+    },
+    "./db/postgres": {
+      "types": "./dist/db/postgres.d.mts",
+      "default": "./dist/db/postgres.mjs"
+    },
+    "./storage/local": {
+      "types": "./dist/storage/local.d.mts",
+      "default": "./dist/storage/local.mjs"
+    },
+    "./storage/s3": {
+      "types": "./dist/storage/s3.d.mts",
+      "default": "./dist/storage/s3.mjs"
+    },
+    "./media": {
+      "types": "./dist/media/index.d.mts",
+      "default": "./dist/media/index.mjs"
+    },
+    "./media/local-runtime": {
+      "types": "./dist/media/local-runtime.d.mts",
+      "default": "./dist/media/local-runtime.mjs"
+    },
+    "./runtime": {
+      "types": "./dist/runtime.d.mts",
+      "default": "./dist/runtime.mjs"
+    },
+    "./request-context": {
+      "types": "./dist/request-context.d.mts",
+      "default": "./dist/request-context.mjs"
+    },
+    "./seed": {
+      "types": "./dist/seed/index.d.mts",
+      "default": "./dist/seed/index.mjs"
+    },
+    "./middleware/request-context": {
+      "types": "./dist/astro/middleware/request-context.d.mts",
+      "default": "./dist/astro/middleware/request-context.mjs"
+    },
+    "./locals": {
+      "types": "./locals.d.ts"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.mts",
+      "default": "./dist/client/index.mjs"
+    },
+    "./client/cf-access": {
+      "types": "./dist/client/cf-access.d.mts",
+      "default": "./dist/client/cf-access.mjs"
+    },
+    "./seo": {
+      "types": "./dist/seo/index.d.mts",
+      "default": "./dist/seo/index.mjs"
+    },
+    "./page": {
+      "types": "./dist/page/index.d.mts",
+      "default": "./dist/page/index.mjs"
+    },
+    "./plugin-utils": {
+      "types": "./dist/plugin-utils.d.mts",
+      "default": "./dist/plugin-utils.mjs"
+    },
+    "./plugins/adapt-sandbox-entry": {
+      "types": "./dist/plugins/adapt-sandbox-entry.d.mts",
+      "default": "./dist/plugins/adapt-sandbox-entry.mjs"
+    }
+  },
+  "imports": {
+    "#api/schemas.js": "./src/api/schemas/index.js",
+    "#api/*": "./src/api/*",
+    "#db/*": "./src/database/*",
+    "#auth/*": "./src/auth/*",
+    "#schema/*": "./src/schema/*",
+    "#search/*": "./src/search/*",
+    "#sections/*": "./src/sections/*",
+    "#menus/*": "./src/menus/*",
+    "#widgets/*": "./src/widgets/*",
+    "#import/*": "./src/import/*",
+    "#utils/*": "./src/utils/*",
+    "#preview/*": "./src/preview/*",
+    "#seed/*": "./src/seed/*",
+    "#settings/*": "./src/settings/*",
+    "#seo/*": "./src/seo/*",
+    "#plugins/*": "./src/plugins/*",
+    "#media/*": "./src/media/*",
+    "#mcp/*": "./src/mcp/*",
+    "#comments/*": "./src/comments/*",
+    "#types": "./src/astro/types.js"
+  },
+  "dependencies": {
+    "@floating-ui/react": "^0.27.16",
+    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@portabletext/toolkit": "^5.0.1",
+    "@tiptap/core": "^3.20.0",
+    "@tiptap/extension-focus": "^3.20.0",
+    "@tiptap/extension-image": "^3.20.0",
+    "@tiptap/extension-link": "^3.20.0",
+    "@tiptap/extension-placeholder": "^3.20.0",
+    "@tiptap/extension-text-align": "^3.20.0",
+    "@tiptap/extension-typography": "^3.20.0",
+    "@tiptap/extension-underline": "^3.20.0",
+    "@tiptap/react": "^3.20.0",
+    "@tiptap/starter-kit": "^3.20.0",
+    "@tiptap/suggestion": "^3.20.0",
+    "@unpic/placeholder": "^0.1.2",
+    "arctic": "^3.7.0",
+    "astro-portabletext": "^0.11.0",
+    "better-sqlite3": "^11.10.0",
+    "blurhash": "^2.0.5",
+    "citty": "^0.1.6",
+    "consola": "^3.4.2",
+    "croner": "^10.0.1",
+    "image-size": "^2.0.2",
+    "jose": "^6.1.3",
+    "jpeg-js": "^0.4.4",
+    "kysely": "^0.27.0",
+    "mime": "^4.1.0",
+    "modern-tar": "^0.7.5",
+    "picocolors": "^1.1.1",
+    "sanitize-html": "^2.17.1",
+    "sax": "^1.4.1",
+    "ulidx": "^2.4.1",
+    "upng-js": "^2.1.0",
+    "zod": "^4.3.5",
+    "@emdash-cms/gutenberg-to-portable-text": "0.0.1",
+    "@emdash-cms/auth": "0.0.1",
+    "@emdash-cms/admin": "0.0.1"
+  },
+  "optionalDependencies": {
+    "@libsql/kysely-libsql": "^0.4.0",
+    "pg": "^8.0.0"
+  },
+  "peerDependencies": {
+    "@astrojs/react": ">=5.0.0-beta.0",
+    "@tanstack/react-query": ">=5.0.0",
+    "@tanstack/react-router": ">=1.100.0",
+    "astro": ">=6.0.0-beta.0",
+    "react": ">=18.0.0",
+    "react-dom": ">=18.0.0"
+  },
+  "devDependencies": {
+    "@apidevtools/swagger-parser": "^12.1.0",
+    "@arethetypeswrong/cli": "^0.18.2",
+    "@types/better-sqlite3": "^7.6.12",
+    "@types/pg": "^8.16.0",
+    "@types/sanitize-html": "^2.16.0",
+    "@types/sax": "^1.2.7",
+    "@vitest/ui": "^4.0.17",
+    "publint": "0.3.17",
+    "tsdown": "0.20.3",
+    "typescript": "^5.9.3",
+    "vite": "^6.0.0",
+    "vitest": "^4.0.18",
+    "zod-openapi": "^5.4.6",
+    "@emdash-cms/blocks": "0.0.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cloudflare/emdash.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/cloudflare/emdash",
+  "keywords": [
+    "astro",
+    "cms",
+    "content",
+    "wordpress"
+  ],
+  "author": "Matt Kane",
+  "license": "MIT",
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "typecheck": "tsgo --noEmit",
+    "check": "publint && attw --pack --ignore-rules=cjs-resolves-to-esm --ignore-rules=no-resolution --ignore-rules=internal-resolution-error",
+    "test": "vitest"
+  }
+}

package/src/api/authorize.ts

@@ -0,0 +1,63 @@
+/**
+ * Authorization helpers for API routes
+ *
+ * Thin wrappers around @emdash-cms/auth RBAC that return HTTP responses.
+ * Auth middleware handles authentication; these handle authorization.
+ */
+
+import type { Permission, RoleLevel } from "@emdash-cms/auth";
+import { hasPermission, canActOnOwn } from "@emdash-cms/auth";
+
+import { apiError } from "./error.js";
+
+interface UserLike {
+	id: string;
+	role: RoleLevel;
+}
+
+/**
+ * Check if user has a permission. Returns a 401/403 Response if not, or null if authorized.
+ *
+ * Usage:
+ * ```ts
+ * const denied = requirePerm(user, "schema:manage");
+ * if (denied) return denied;
+ * ```
+ */
+export function requirePerm(
+	user: UserLike | null | undefined,
+	permission: Permission,
+): Response | null {
+	if (!user) {
+		return apiError("UNAUTHORIZED", "Authentication required", 401);
+	}
+	if (!hasPermission(user, permission)) {
+		return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	}
+	return null;
+}
+
+/**
+ * Check if user can act on a resource, considering ownership.
+ * Returns a 401/403 Response if not, or null if authorized.
+ *
+ * Usage:
+ * ```ts
+ * const denied = requireOwnerPerm(user, item.authorId, "content:edit_own", "content:edit_any");
+ * if (denied) return denied;
+ * ```
+ */
+export function requireOwnerPerm(
+	user: UserLike | null | undefined,
+	ownerId: string,
+	ownPermission: Permission,
+	anyPermission: Permission,
+): Response | null {
+	if (!user) {
+		return apiError("UNAUTHORIZED", "Authentication required", 401);
+	}
+	if (!canActOnOwn(user, ownerId, ownPermission, anyPermission)) {
+		return apiError("FORBIDDEN", "Insufficient permissions", 403);
+	}
+	return null;
+}

package/src/api/csrf.ts

@@ -0,0 +1,48 @@
+/**
+ * CSRF protection utilities.
+ *
+ * Two mechanisms:
+ * 1. Custom header check (X-EmDash-Request: 1) — used for authenticated API routes.
+ *    Browsers block cross-origin custom headers, so presence proves same-origin.
+ * 2. Origin check — used for public API routes that skip auth. Compares the Origin
+ *    header against the request origin. Same approach as Astro's `checkOrigin`.
+ */
+
+import { apiError } from "./error.js";
+
+/**
+ * Origin-based CSRF check for public API routes that skip auth.
+ *
+ * State-changing requests (POST/PUT/DELETE) to public endpoints must either:
+ *   1. Include the X-EmDash-Request: 1 header (custom header blocked cross-origin), OR
+ *   2. Have an Origin header matching the request origin
+ *
+ * This prevents cross-origin form submissions (which can't set custom headers)
+ * and cross-origin fetch (blocked by CORS unless allowed). Same-origin requests
+ * always include a matching Origin header.
+ *
+ * Returns a 403 Response if the check fails, or null if allowed.
+ */
+export function checkPublicCsrf(request: Request, url: URL): Response | null {
+	// Custom header present — browser blocks cross-origin custom headers
+	const csrfHeader = request.headers.get("X-EmDash-Request");
+	if (csrfHeader === "1") return null;
+
+	// Check Origin header — present on all POST/PUT/DELETE from browsers
+	const origin = request.headers.get("Origin");
+	if (origin) {
+		try {
+			const originUrl = new URL(origin);
+			if (originUrl.origin === url.origin) return null;
+		} catch {
+			// Malformed Origin — fall through to reject
+		}
+
+		return apiError("CSRF_REJECTED", "Cross-origin request blocked", 403);
+	}
+
+	// No Origin header — non-browser client (curl, server-to-server).
+	// Allow these through since CSRF is a browser-specific attack vector.
+	// Server-to-server requests don't carry ambient credentials (cookies).
+	return null;
+}

package/src/api/error.ts

@@ -0,0 +1,99 @@
+/**
+ * Standardized API error responses.
+ *
+ * All API routes should use these utilities instead of inline
+ * `new Response(JSON.stringify({ error: ... }), ...)` patterns.
+ */
+
+import { mapErrorStatus } from "./errors.js";
+import type { ApiResult } from "./types.js";
+
+// Re-export everything from errors.ts so existing `import { mapErrorStatus } from "./error.js"` still works
+export * from "./errors.js";
+
+/**
+ * Standard cache headers for all API responses.
+ *
+ * Cache-Control: private, no-store -- prevents CDN/proxy caching of authenticated data.
+ * no-store already tells caches not to store the response, so Vary is unnecessary.
+ */
+const API_CACHE_HEADERS: HeadersInit = {
+	"Cache-Control": "private, no-store",
+};
+
+/**
+ * Create a standardized error response.
+ *
+ * Always returns `{ error: { code, message } }` with correct Content-Type.
+ * Use this for all error responses in API routes.
+ */
+export function apiError(code: string, message: string, status: number): Response {
+	return Response.json({ error: { code, message } }, { status, headers: API_CACHE_HEADERS });
+}
+
+/**
+ * Create a standardized success response.
+ *
+ * Always returns `{ data: T }` with correct status code.
+ * Use this for all success responses in API routes.
+ */
+export function apiSuccess<T>(data: T, status = 200): Response {
+	return Response.json({ data }, { status, headers: API_CACHE_HEADERS });
+}
+
+/**
+ * Handle an unknown error in a catch block.
+ *
+ * - Logs the full error server-side
+ * - Returns a generic message to the client (never leaks error.message)
+ * - Use `fallbackMessage` for the public-facing message
+ * - Use `fallbackCode` for the error code
+ */
+export function handleError(
+	error: unknown,
+	fallbackMessage: string,
+	fallbackCode: string,
+): Response {
+	console.error(`[${fallbackCode}]`, error);
+	return apiError(fallbackCode, fallbackMessage, 500);
+}
+
+/**
+ * Standard initialization check.
+ *
+ * Returns an error response if EmDash is not initialized, or null if OK.
+ * Usage: `const err = requireInit(emdash); if (err) return err;`
+ */
+export function requireInit(emdash: unknown): Response | null {
+	if (!emdash || typeof emdash !== "object") {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	return null;
+}
+
+/**
+ * Standard database check.
+ *
+ * Returns an error response if the database is not available, or null if OK.
+ * Usage: `const err = requireDb(emdash?.db); if (err) return err;`
+ */
+export function requireDb(db: unknown): Response | null {
+	if (!db) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	return null;
+}
+
+/**
+ * Convert an ApiResult into an HTTP Response.
+ *
+ * Collapses the handler-to-response boilerplate:
+ * - Success: returns `apiSuccess(result.data, successStatus)`
+ * - Error: returns `apiError(code, message, mapErrorStatus(code))`
+ */
+export function unwrapResult<T>(result: ApiResult<T>, successStatus = 200): Response {
+	if (!result.success) {
+		return apiError(result.error.code, result.error.message, mapErrorStatus(result.error.code));
+	}
+	return apiSuccess(result.data, successStatus);
+}