emdash 0.0.0-a → 0.0.1

package/src/cleanup.ts

@@ -0,0 +1,153 @@
+/**
+ * System cleanup
+ *
+ * Runs periodic maintenance tasks that prevent unbounded accumulation of
+ * expired or stale data. Called from cron scheduler ticks and (for latency-
+ * sensitive subsystems) inline during relevant requests.
+ *
+ * Each subsystem cleanup is independent and non-fatal -- if one fails, the
+ * rest still run. Failures are logged but never surface to callers.
+ */
+
+import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/kysely";
+import { sql, type Kysely } from "kysely";
+
+import { cleanupExpiredChallenges } from "./auth/challenge-store.js";
+import { MediaRepository } from "./database/repositories/media.js";
+import { RevisionRepository } from "./database/repositories/revision.js";
+import type { Database } from "./database/types.js";
+import type { Storage } from "./storage/types.js";
+
+/**
+ * Result of a system cleanup run.
+ * Each field is the number of rows deleted, or -1 if the cleanup failed.
+ */
+export interface CleanupResult {
+	challenges: number;
+	expiredTokens: number;
+	pendingUploads: number;
+	pendingUploadFiles: number;
+	revisionsPruned: number;
+}
+
+/** Max revisions to keep per entry during periodic pruning */
+const REVISION_KEEP_COUNT = 50;
+
+/** Only prune entries that exceed this threshold */
+const REVISION_PRUNE_THRESHOLD = REVISION_KEEP_COUNT;
+
+/**
+ * Run all system cleanup tasks.
+ *
+ * Safe to call frequently -- each task is a single DELETE with a WHERE clause,
+ * so repeated calls with nothing to clean are cheap (no-op queries).
+ *
+ * @param db - The database instance
+ * @param storage - Optional storage backend for deleting orphaned files.
+ *   When omitted, pending upload DB rows are still deleted but the
+ *   corresponding files in object storage are not removed.
+ */
+export async function runSystemCleanup(
+	db: Kysely<Database>,
+	storage?: Storage,
+): Promise<CleanupResult> {
+	const result: CleanupResult = {
+		challenges: -1,
+		expiredTokens: -1,
+		pendingUploads: -1,
+		pendingUploadFiles: -1,
+		revisionsPruned: -1,
+	};
+
+	// 1. Passkey challenges (expire after 60s, clean anything past 5 min)
+	try {
+		result.challenges = await cleanupExpiredChallenges(db);
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired challenges:", error);
+	}
+
+	// 2. Magic link / invite / signup tokens
+	try {
+		// Cast needed: Database extends AuthTables but uses Generated<> wrappers
+		// that confuse structural checks. The adapter casts internally anyway.
+		// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Database uses Generated<> wrappers incompatible with AuthTables structurally; safe at runtime
+		const authAdapter = createKyselyAdapter(db as unknown as Kysely<AuthTables>);
+		await authAdapter.deleteExpiredTokens();
+		result.expiredTokens = 0; // deleteExpiredTokens returns void
+	} catch (error) {
+		console.error("[cleanup] Failed to clean expired tokens:", error);
+	}
+
+	// 3. Pending media uploads (abandoned after 1 hour)
+	//    Delete DB rows first, then remove corresponding files from storage.
+	try {
+		const mediaRepo = new MediaRepository(db);
+		const orphanedKeys = await mediaRepo.cleanupPendingUploads();
+		result.pendingUploads = orphanedKeys.length;
+
+		// Delete orphaned files from object storage
+		if (storage && orphanedKeys.length > 0) {
+			let filesDeleted = 0;
+			for (const key of orphanedKeys) {
+				try {
+					await storage.delete(key);
+					filesDeleted++;
+				} catch (error) {
+					// Log per-file failures but continue -- storage.delete is
+					// documented as idempotent, so this is an unexpected error.
+					console.error(`[cleanup] Failed to delete storage file ${key}:`, error);
+				}
+			}
+			result.pendingUploadFiles = filesDeleted;
+		} else {
+			result.pendingUploadFiles = 0;
+		}
+	} catch (error) {
+		console.error("[cleanup] Failed to clean pending uploads:", error);
+	}
+
+	// 4. Revision pruning -- trim entries with excessive revision counts
+	try {
+		result.revisionsPruned = await pruneExcessiveRevisions(db);
+	} catch (error) {
+		console.error("[cleanup] Failed to prune revisions:", error);
+	}
+
+	return result;
+}
+
+/**
+ * Find entries with more than REVISION_PRUNE_THRESHOLD revisions and prune
+ * them down to REVISION_KEEP_COUNT.
+ */
+async function pruneExcessiveRevisions(db: Kysely<Database>): Promise<number> {
+	const entries = await sql<{ collection: string; entry_id: string; cnt: number }>`
+		SELECT collection, entry_id, COUNT(*) as cnt
+		FROM revisions
+		GROUP BY collection, entry_id
+		HAVING cnt > ${REVISION_PRUNE_THRESHOLD}
+	`.execute(db);
+
+	if (entries.rows.length === 0) return 0;
+
+	const revisionRepo = new RevisionRepository(db);
+	let totalPruned = 0;
+
+	for (const row of entries.rows) {
+		try {
+			const pruned = await revisionRepo.pruneOldRevisions(
+				row.collection,
+				row.entry_id,
+				REVISION_KEEP_COUNT,
+			);
+			totalPruned += pruned;
+		} catch (error) {
+			console.error(
+				`[cleanup] Failed to prune revisions for ${row.collection}/${row.entry_id}:`,
+				error,
+			);
+		}
+	}
+
+	return totalPruned;
+}

package/src/cli/client-factory.ts

@@ -0,0 +1,100 @@
+import { customHeadersInterceptor, resolveCustomHeaders } from "../client/cf-access.js";
+import { EmDashClient } from "../client/index.js";
+import type { Interceptor } from "../client/transport.js";
+import { getCredentials, saveCredentials } from "./credentials.js";
+
+export interface ClientArgs {
+	url?: string;
+	token?: string;
+}
+
+/**
+ * Shared connection args for all CLI commands that talk to an EmDash instance.
+ * Spread into each command's `args` definition.
+ */
+export const connectionArgs = {
+	url: {
+		type: "string" as const,
+		alias: "u",
+		description: "EmDash instance URL",
+		default: "http://localhost:4321",
+	},
+	token: {
+		type: "string" as const,
+		alias: "t",
+		description: "Auth token",
+	},
+	header: {
+		type: "string" as const,
+		alias: "H",
+		description: 'Custom header "Name: Value" (repeatable, or use EMDASH_HEADERS env)',
+	},
+	json: {
+		type: "boolean" as const,
+		description: "Output as JSON",
+	},
+};
+
+/**
+ * Create an EmDashClient from CLI args, env vars, and stored credentials.
+ *
+ * Auth resolution order:
+ * 1. --token flag
+ * 2. EMDASH_TOKEN env var
+ * 3. Stored credentials (~/.config/emdash/auth.json)
+ * 4. Dev bypass (if URL is localhost)
+ *
+ * Custom headers are merged from (in priority order):
+ * 1. Stored credentials (persisted during `emdash login --header`)
+ * 2. EMDASH_HEADERS env var
+ * 3. --header CLI flags
+ */
+export function createClientFromArgs(args: ClientArgs): EmDashClient {
+	const baseUrl = args.url || process.env["EMDASH_URL"] || "http://localhost:4321";
+	let token = args.token || process.env["EMDASH_TOKEN"];
+
+	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
+	const cred = !token ? getCredentials(baseUrl) : null;
+
+	// Merge custom headers: stored credentials < env var < CLI flags
+	const customHeaders = {
+		...cred?.customHeaders,
+		...resolveCustomHeaders(),
+	};
+
+	const extraInterceptors: Interceptor[] = [];
+	if (Object.keys(customHeaders).length > 0) {
+		extraInterceptors.push(customHeadersInterceptor(customHeaders));
+	}
+
+	// Check stored credentials if no explicit token
+	if (!token && cred) {
+		// Check if access token is expired
+		if (new Date(cred.expiresAt) > new Date()) {
+			token = cred.accessToken;
+		} else {
+			// Token expired — use the refresh interceptor in the client
+			// Pass the refresh token so the client can auto-refresh
+			return new EmDashClient({
+				baseUrl,
+				token: cred.accessToken,
+				refreshToken: cred.refreshToken,
+				onTokenRefresh: (newAccessToken, expiresIn) => {
+					saveCredentials(baseUrl, {
+						...cred,
+						accessToken: newAccessToken,
+						expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString(),
+					});
+				},
+				interceptors: extraInterceptors,
+			});
+		}
+	}
+
+	return new EmDashClient({
+		baseUrl,
+		token,
+		devBypass: !token && isLocal,
+		interceptors: extraInterceptors,
+	});
+}

package/src/cli/commands/auth.ts

@@ -0,0 +1,46 @@
+/**
+ * Auth CLI commands
+ */
+
+import { defineCommand } from "citty";
+import { consola } from "consola";
+import pc from "picocolors";
+
+import { encodeBase64url } from "../../utils/base64.js";
+
+/**
+ * Generate a cryptographically secure auth secret
+ */
+function generateAuthSecret(): string {
+	const bytes = new Uint8Array(32);
+	crypto.getRandomValues(bytes);
+	return encodeBase64url(bytes);
+}
+
+const secretCommand = defineCommand({
+	meta: {
+		name: "secret",
+		description: "Generate a secure auth secret",
+	},
+	run() {
+		const secret = generateAuthSecret();
+
+		consola.log("");
+		consola.log(pc.bold("Generated auth secret:"));
+		consola.log("");
+		consola.log(`  ${pc.cyan("EMDASH_AUTH_SECRET")}=${pc.green(secret)}`);
+		consola.log("");
+		consola.log(pc.dim("Add this to your environment variables."));
+		consola.log("");
+	},
+});
+
+export const authCommand = defineCommand({
+	meta: {
+		name: "auth",
+		description: "Authentication utilities",
+	},
+	subCommands: {
+		secret: secretCommand,
+	},
+});

package/src/cli/commands/bundle-utils.ts

@@ -0,0 +1,247 @@
+/**
+ * Bundle utility functions
+ *
+ * Shared logic extracted from the bundle command so it can be tested
+ * without the CLI harness and tsdown dependency.
+ */
+
+import { createWriteStream } from "node:fs";
+import { readdir, stat, access } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { pipeline } from "node:stream/promises";
+
+import { imageSize } from "image-size";
+import { packTar } from "modern-tar/fs";
+
+import type {
+	PluginManifest,
+	ResolvedPlugin,
+	HookName,
+	ManifestHookEntry,
+} from "../../plugins/types.js";
+
+// ── Constants ────────────────────────────────────────────────────────────────
+
+export const MAX_BUNDLE_SIZE = 5 * 1024 * 1024;
+export const MAX_SCREENSHOTS = 5;
+export const MAX_SCREENSHOT_WIDTH = 1920;
+export const MAX_SCREENSHOT_HEIGHT = 1080;
+export const ICON_SIZE = 256;
+
+// ── Regex patterns (module-scope to avoid re-compilation) ────────────────────
+
+/** Matches require("node:xxx") / require("xxx") / import("node:xxx") in bundled output */
+const NODE_BUILTIN_IMPORT_RE = /(?:import|require)\s*\(?["'](?:node:)?([a-z_]+)["']\)?/g;
+const LEADING_DOT_SLASH_RE = /^\.\//;
+const DIST_PREFIX_RE = /^dist\//;
+const MJS_EXT_RE = /\.m?js$/;
+const TS_TO_TSX_RE = /\.ts$/;
+
+/** Node.js built-in modules that shouldn't appear in sandbox code */
+const NODE_BUILTINS = new Set([
+	"assert",
+	"buffer",
+	"child_process",
+	"cluster",
+	"crypto",
+	"dgram",
+	"dns",
+	"domain",
+	"events",
+	"fs",
+	"http",
+	"http2",
+	"https",
+	"inspector",
+	"module",
+	"net",
+	"os",
+	"path",
+	"perf_hooks",
+	"process",
+	"punycode",
+	"querystring",
+	"readline",
+	"repl",
+	"stream",
+	"string_decoder",
+	"sys",
+	"timers",
+	"tls",
+	"trace_events",
+	"tty",
+	"url",
+	"util",
+	"v8",
+	"vm",
+	"wasi",
+	"worker_threads",
+	"zlib",
+]);
+
+// ── File helpers ─────────────────────────────────────────────────────────────
+
+export async function fileExists(path: string): Promise<boolean> {
+	try {
+		await access(path);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+// ── Image dimension readers ──────────────────────────────────────────────────
+
+/**
+ * Read image dimensions from a buffer.
+ * Returns [width, height] or null if the format is unrecognized.
+ */
+export function readImageDimensions(buf: Uint8Array): [number, number] | null {
+	try {
+		const result = imageSize(buf);
+		if (result.width != null && result.height != null) {
+			return [result.width, result.height];
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+
+// ── Manifest extraction ──────────────────────────────────────────────────────
+
+/**
+ * Extract manifest metadata from a ResolvedPlugin.
+ * Strips functions (hooks, route handlers) and keeps only serializable metadata.
+ */
+export function extractManifest(plugin: ResolvedPlugin): PluginManifest {
+	// Build hook entries preserving exclusive/priority/timeout metadata.
+	// Plain HookName strings are emitted for hooks with default settings;
+	// structured ManifestHookEntry objects are emitted when metadata differs.
+	const hooks: Array<ManifestHookEntry | HookName> = [];
+	for (const [name, resolved] of Object.entries(plugin.hooks)) {
+		if (!resolved) continue;
+		const hasMetadata =
+			resolved.exclusive || resolved.priority !== 100 || resolved.timeout !== 5000;
+		if (hasMetadata) {
+			const entry: ManifestHookEntry = { name };
+			if (resolved.exclusive) entry.exclusive = true;
+			if (resolved.priority !== 100) entry.priority = resolved.priority;
+			if (resolved.timeout !== 5000) entry.timeout = resolved.timeout;
+			hooks.push(entry);
+		} else {
+			hooks.push(name as HookName);
+		}
+	}
+
+	return {
+		id: plugin.id,
+		version: plugin.version,
+		capabilities: plugin.capabilities,
+		allowedHosts: plugin.allowedHosts,
+		storage: plugin.storage,
+		hooks,
+		routes: Object.keys(plugin.routes),
+		admin: {
+			// Omit entry (it's a module specifier for the host, not relevant in bundles)
+			settingsSchema: plugin.admin.settingsSchema,
+			pages: plugin.admin.pages,
+			widgets: plugin.admin.widgets,
+		},
+	};
+}
+
+// ── Node.js built-in detection ───────────────────────────────────────────────
+
+/**
+ * Scan bundled code for Node.js built-in imports.
+ * Matches require("node:xxx"), require("xxx"), import("node:xxx") — the patterns
+ * that appear in bundled ESM/CJS output (not source-level named imports).
+ * Returns deduplicated array of built-in module names found.
+ */
+export function findNodeBuiltinImports(code: string): string[] {
+	const found: string[] = [];
+	NODE_BUILTIN_IMPORT_RE.lastIndex = 0;
+	let match;
+	while ((match = NODE_BUILTIN_IMPORT_RE.exec(code)) !== null) {
+		const mod = match[1];
+		if (NODE_BUILTINS.has(mod)) {
+			found.push(mod);
+		}
+	}
+	return [...new Set(found)];
+}
+
+// ── Path resolution ──────────────────────────────────────────────────────────
+
+/**
+ * Find a build output file by base name, checking common extensions.
+ * tsdown may output .mjs, .js, or .cjs depending on format and config.
+ */
+export async function findBuildOutput(dir: string, baseName: string): Promise<string | undefined> {
+	for (const ext of [".mjs", ".js", ".cjs"]) {
+		const candidate = join(dir, `${baseName}${ext}`);
+		if (await fileExists(candidate)) return candidate;
+	}
+	return undefined;
+}
+
+/**
+ * Resolve a dist/built path back to its source .ts/.tsx equivalent.
+ * E.g., "./dist/index.mjs" → "src/index.ts"
+ */
+export async function resolveSourceEntry(
+	pluginDir: string,
+	distPath: string,
+): Promise<string | undefined> {
+	const cleaned = distPath.replace(LEADING_DOT_SLASH_RE, "");
+
+	// Try the path directly (might be source already)
+	const direct = resolve(pluginDir, cleaned);
+	if (await fileExists(direct)) return direct;
+
+	// Convert dist path to src: dist/foo.mjs → src/foo.ts
+	const srcPath = cleaned.replace(DIST_PREFIX_RE, "src/").replace(MJS_EXT_RE, ".ts");
+	const srcFull = resolve(pluginDir, srcPath);
+	if (await fileExists(srcFull)) return srcFull;
+
+	// Try .tsx
+	const tsxPath = srcPath.replace(TS_TO_TSX_RE, ".tsx");
+	const tsxFull = resolve(pluginDir, tsxPath);
+	if (await fileExists(tsxFull)) return tsxFull;
+
+	return undefined;
+}
+
+// ── Directory helpers ────────────────────────────────────────────────────────
+
+/**
+ * Recursively calculate the total size of all files in a directory.
+ */
+export async function calculateDirectorySize(dir: string): Promise<number> {
+	let total = 0;
+	const items = await readdir(dir, { withFileTypes: true });
+	for (const item of items) {
+		const fullPath = join(dir, item.name);
+		if (item.isFile()) {
+			const s = await stat(fullPath);
+			total += s.size;
+		} else if (item.isDirectory()) {
+			total += await calculateDirectorySize(fullPath);
+		}
+	}
+	return total;
+}
+
+// ── Tarball creation ─────────────────────────────────────────────────────────
+
+/**
+ * Create a gzipped tarball from a directory.
+ */
+export async function createTarball(sourceDir: string, outputPath: string): Promise<void> {
+	const { createGzip } = await import("node:zlib");
+	const tarStream = packTar(sourceDir);
+	const gzip = createGzip({ level: 9 });
+	const out = createWriteStream(outputPath);
+	await pipeline(tarStream, gzip, out);
+}