excalidrop 0.1.1

package/src/utils/github.ts

@@ -0,0 +1,93 @@
+/** GitHub as source of truth. Scene = canvas.excalidraw on main; viewer copy on gh-pages. No Actions. */
+import logger from './logger.js';
+import { execSync } from 'node:child_process';
+
+const API = 'https://api.github.com';
+/** Zero-config: GITHUB_TOKEN env, else `gh auth token`, else '' (public reads still work). */
+export function token(): string {
+  if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
+  try {
+    return execSync('gh auth token', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+  } catch { return ''; }
+}
+/** Zero-config: current repo from git remote. Empty allowlist = current repo only. */
+export function currentRepo(): string {
+  try {
+    const url = execSync('git config --get remote.origin.url', { encoding: 'utf8' }).trim();
+    const m = url.match(/github\.com[:/]([^/]+\/[^/]+?)(\.git)?$/);
+    return (m?.[1] || '').toLowerCase();
+  } catch { return ''; }
+}
+export const SCENE_PATH = process.env.SCENE_PATH || 'canvas.excalidraw';
+
+export function allowedRepos(): string[] {
+  const list = (process.env.ALLOWED_REPOS || '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
+  if (list.length) return list;
+  const cur = currentRepo();
+  return cur ? [cur] : [];
+}
+/** Legacy allowlist hook (hosted multi-tenant remote only). Local MCP paths do not
+ *  gate on it: the user's own token + GitHub's API enforcement is the real
+ *  gate, and any user must be able to work on any repo they can access. */
+export function assertRepo(_repo: string): void {
+  // intentionally no-op — see above
+}
+function headers(): Record<string, string> {
+  return { Authorization: `Bearer ${token()}`, Accept: 'application/vnd.github+json', 'User-Agent': 'excalidrop', 'Content-Type': 'application/json' };
+}
+export async function getFile(repo: string, path: string, ref = 'main'): Promise<{ sha: string; content: any } | null> {
+  assertRepo(repo);
+  const r = await fetch(`${API}/repos/${repo}/contents/${path}?ref=${ref}`, { headers: headers() });
+  if (r.status === 404) return null;
+  if (!r.ok) throw new Error(`GitHub get ${r.status}: ${await r.text()}`);
+  const j = await r.json() as any;
+  const text = Buffer.from(j.content, 'base64').toString('utf8');
+  return { sha: j.sha, content: JSON.parse(text) };
+}
+export async function putFile(repo: string, path: string, data: any, message: string, branch = 'main', sha?: string): Promise<string> {
+  assertRepo(repo);
+  if (!token()) throw new Error('GITHUB_TOKEN missing');
+  const body: any = { message, content: Buffer.from(JSON.stringify(data, null, 2)).toString('base64'), branch };
+  if (sha) body.sha = sha;
+  let r = await fetch(`${API}/repos/${repo}/contents/${path}`, { method: 'PUT', headers: headers(), body: JSON.stringify(body) });
+  if (r.status === 404 && branch === 'main') {
+    // 404 on PUT usually means the branch doesn't exist yet (empty repo —
+    // GitHub says plain "Not Found", not "branch missing"). Fork main off
+    // gh-pages (or the default branch) then retry.
+    const branchExists = await fetch(`${API}/repos/${repo}/git/ref/heads/main`, { headers: headers() });
+    if (branchExists.ok) throw new Error(`GitHub put 404: ${await r.text()}`.slice(0, 200));
+    const repoInfo = await (await fetch(`${API}/repos/${repo}`, { headers: headers() })).json() as any;
+    const from = repoInfo.default_branch && repoInfo.default_branch !== 'main' ? repoInfo.default_branch : 'gh-pages';
+    const ref = await (await fetch(`${API}/repos/${repo}/git/ref/heads/${from}`, { headers: headers() })).json() as any;
+    if (!ref.object?.sha) throw new Error(`cannot bootstrap main: no ${from} branch`);
+    const mkRef = await fetch(`${API}/repos/${repo}/git/refs`, { method: 'POST', headers: headers(), body: JSON.stringify({ ref: 'refs/heads/main', sha: ref.object.sha }) });
+    if (!mkRef.ok) throw new Error(`cannot bootstrap main: ${(await mkRef.text()).slice(0, 200)}`);
+    // main bootstrapped from another branch may already contain the file — attach its sha
+    const existing = await (await fetch(`${API}/repos/${repo}/contents/${path}?ref=main`, { headers: headers() })).json() as any;
+    if (existing.sha) body.sha = existing.sha;
+    r = await fetch(`${API}/repos/${repo}/contents/${path}`, { method: 'PUT', headers: headers(), body: JSON.stringify(body) });
+  }
+  if (r.status === 409) throw new Error('CONFLICT: file changed upstream, refetch sha and retry');
+  if (!r.ok) throw new Error(`GitHub put ${r.status}: ${await r.text()}`);
+  const j = await r.json() as any;
+  logger.info(`Committed ${path}@${branch} in ${repo}`);
+  return j.content.sha;
+}
+/** Load scene with sha for optimistic concurrency. */
+export async function loadScene(repo: string): Promise<{ elements: any[]; files: any[]; sha: string | null }> {
+  assertRepo(repo);
+  const f = await getFile(repo, SCENE_PATH, 'main').catch(() => null);
+  if (!f) return { elements: [], files: [], sha: null };
+  return { elements: f.content.elements || [], files: f.content.files || [], sha: f.sha };
+}
+/** Save scene to main (1 commit per batch). Returns new sha. */
+export async function saveScene(repo: string, elements: any[], files: any[], sha: string | null, msg: string): Promise<string> {
+  return putFile(repo, SCENE_PATH, { type: 'excalidraw', version: 2, source: 'excalidrop', elements, files: {} , _files: files }, msg, 'main', sha || undefined);
+}
+/** Sync prebuilt viewer + scene copy straight to gh-pages branch (direct push via Contents API, no Actions). */
+export async function syncPages(repo: string, scene: any): Promise<void> {
+  assertRepo(repo);
+  // scene copy (viewer reads same-branch file: instant, no raw cache)
+  const cur = await getFile(repo, SCENE_PATH, 'gh-pages').catch(() => null);
+  await putFile(repo, SCENE_PATH, scene, 'excalidrop: sync scene to gh-pages', 'gh-pages', cur?.sha);
+}

package/src/utils/logger.ts

@@ -0,0 +1,35 @@
+import winston from 'winston';
+import { tmpdir } from 'os';
+import { join } from 'path';
+
+const LOG_FILE_PATH = process.env.LOG_FILE_PATH || join(tmpdir(), 'excalidraw.log');
+
+const logger: winston.Logger = winston.createLogger({
+  level: process.env.LOG_LEVEL || 'info',
+
+  format: winston.format.combine(
+    winston.format.timestamp({ format: 'YYYY-MM-DD HH:mm:ss.SSS' }),
+    winston.format.uncolorize(),
+    winston.format.metadata({ fillExcept: ['message', 'level', 'timestamp'] }),
+    winston.format.printf(info => {
+      const extra = info.metadata && Object.keys(info.metadata).length
+        ? ` ${JSON.stringify(info.metadata)}`
+        : '';
+      return `${info.timestamp} [${info.level}] ${info.message}${extra}`
+    })
+  ),
+
+  transports: [
+    new winston.transports.Console({
+      level: 'warn',                 // only warn+error to stderr
+      stderrLevels: ['warn','error']
+    }),
+
+    new winston.transports.File({
+      filename: LOG_FILE_PATH,    // all levels to file
+      level: 'debug'
+    })
+  ]
+});
+
+export default logger;

package/src/utils/r2store.ts

@@ -0,0 +1,76 @@
+import crypto from 'node:crypto';
+
+/**
+ * Minimal S3-compatible R2 client over fetch with AWS SigV4.
+ * Reads creds from env (GH Actions secrets):
+ *  R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET, R2_KEY_PREFIX
+ *  CLOUDFLARER2TOKEN supported as "accountId:keyId:secret" or "keyId:secret" or raw secret
+ *  (with R2_ACCOUNT_ID also set) for seamless setup.
+ */
+export interface R2Config {
+  accountId: string; keyId: string; secret: string; bucket: string; prefix: string; endpoint: string;
+}
+
+export function getR2Config(): R2Config | null {
+  let accountId = process.env.R2_ACCOUNT_ID || '';
+  let keyId = process.env.R2_ACCESS_KEY_ID || '';
+  let secret = process.env.R2_SECRET_ACCESS_KEY || '';
+  const raw = process.env.CLOUDFLARER2TOKEN || '';
+  if ((!keyId || !secret || !accountId) && raw) {
+    const parts: string[] = raw.trim().split(':');
+    if (parts.length >= 3) { accountId = accountId || (parts[0] as string); keyId = keyId || (parts[1] as string); secret = secret || parts.slice(2).join(':'); }
+    else if (parts.length === 2) { keyId = keyId || (parts[0] as string); secret = secret || (parts[1] as string); }
+    else { secret = secret || raw.trim(); }
+  }
+  const bucket = process.env.R2_BUCKET || 'excalidrop';
+  const prefix = process.env.R2_KEY_PREFIX || 'scenes/';
+  if (!accountId || !keyId || !secret) return null;
+  return { accountId, keyId, secret, bucket, prefix, endpoint: `https://${accountId}.r2.cloudflarestorage.com` };
+}
+
+async function sha256Hex(data: string | Buffer): Promise<string> {
+  return crypto.createHash('sha256').update(data).digest('hex');
+}
+function hmac(key: Buffer | string, data: string): Buffer {
+  return crypto.createHmac('sha256', key).update(data).digest();
+}
+
+function sign(method: string, urlStr: string, keyId: string, secret: string, region = 'auto', payloadHash?: string, contentType?: string): { Authorization: string; 'x-amz-date': string; 'x-amz-content-sha256': string } {
+  const url = new URL(urlStr);
+  const now = new Date();
+  const amzDate = now.toISOString().replace(/[-:]/g, '').split('.')[0] + 'Z';
+  const dateStamp = amzDate.slice(0, 8);
+  const hash = payloadHash ?? '';
+  const headers: Record<string, string> = { host: url.host, 'x-amz-content-sha256': hash, 'x-amz-date': amzDate };
+  if (contentType) headers['content-type'] = contentType;
+  const signedHeaders = Object.keys(headers).sort().join(';');
+  const canonicalHeaders = Object.keys(headers).sort().map(k => `${k}:${headers[k]}\n`).join('');
+  const canonical = [method, url.pathname + (url.search ? '' : ''), url.searchParams.toString(), canonicalHeaders, signedHeaders, hash].join('\n');
+  const scope = `${dateStamp}/${region}/s3/aws4_request`;
+  const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, crypto.createHash('sha256').update(canonical).digest('hex')].join('\n');
+  const kDate = hmac('AWS4' + secret, dateStamp);
+  const kRegion = hmac(kDate, region);
+  const kService = hmac(kRegion, 's3');
+  const kSign = hmac(kService, 'aws4_request');
+  const sig = hmac(kSign, toSign).toString('hex');
+  return { Authorization: `AWS4-HMAC-SHA256 Credential=${keyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${sig}`, 'x-amz-date': amzDate, 'x-amz-content-sha256': hash };
+}
+
+export async function r2Get(cfg: R2Config, key: string): Promise<any | null> {
+  const url = `${cfg.endpoint}/${cfg.bucket}/${cfg.prefix}${key}`;
+  const empty = await sha256Hex('');
+  const s = sign('GET', url, cfg.keyId, cfg.secret, 'auto', empty);
+  const r = await fetch(url, { headers: { Authorization: s.Authorization, 'x-amz-date': s['x-amz-date'], 'x-amz-content-sha256': empty } });
+  if (r.status === 404 || r.status === 403) return null;
+  if (!r.ok) throw new Error(`R2 GET ${r.status}: ${await r.text()}`);
+  return r.json();
+}
+
+export async function r2Put(cfg: R2Config, key: string, body: any): Promise<void> {
+  const data = typeof body === 'string' ? body : JSON.stringify(body);
+  const url = `${cfg.endpoint}/${cfg.bucket}/${cfg.prefix}${key}`;
+  const hash = await sha256Hex(data);
+  const s = sign('PUT', url, cfg.keyId, cfg.secret, 'auto', hash, 'application/json');
+  const r = await fetch(url, { method: 'PUT', body: data, headers: { Authorization: s.Authorization, 'x-amz-date': s['x-amz-date'], 'x-amz-content-sha256': hash, 'Content-Type': 'application/json' } });
+  if (!r.ok) throw new Error(`R2 PUT ${r.status}: ${await r.text()}`);
+}

package/tsconfig.json

@@ -0,0 +1,50 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "node",
+    "allowJs": false,
+    "checkJs": false,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "strictFunctionTypes": true,
+    "strictBindCallApply": true,
+    "strictPropertyInitialization": true,
+    "noImplicitThis": true,
+    "noImplicitReturns": false,
+    "noFallthroughCasesInSwitch": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "noEmitOnError": false,
+    "preserveConstEnums": true,
+    "removeComments": false,
+    "types": ["node"]
+  },
+  "include": [
+    "src/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "dist",
+    "frontend",
+    "**/*.test.ts",
+    "**/*.spec.ts",
+    "**/*.js",
+    "**/*.jsx"
+  ],
+  "ts-node": {
+    "esm": true
+  }
+} 

package/vite.config.js

@@ -0,0 +1,37 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+export default defineConfig({
+  root: 'frontend',
+  base: process.env.VITE_BASE || './',
+  plugins: [react()],
+  build: {
+    outDir: '../dist/frontend',
+    emptyOutDir: true,
+    rollupOptions: {
+      output: {
+        // Excalidraw's font subsetting worker looks for these files by their
+        // original (unhashed) names. Preserve them so the 404 doesn't break export.
+        chunkFileNames: (chunkInfo) => {
+          if (chunkInfo.name.startsWith('subset-')) {
+            return 'assets/[name].js'
+          }
+          return 'assets/[name]-[hash].js'
+        },
+      },
+    },
+  },
+  server: {
+    port: 5173,
+    proxy: {
+      '/api': {
+        target: 'http://127.0.0.1:3000',
+        changeOrigin: true,
+      },
+      '/health': {
+        target: 'http://127.0.0.1:3000',
+        changeOrigin: true,
+      },
+    },
+  },
+})