getfilepress 0.1.23 → 0.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "getfilepress",
-	"version": "0.1.23",
+	"version": "0.1.25",
 	"private": false,
 	"type": "module",
 	"description": "FilePress — file-based Markdown blog engine. Link this package from a content-only site (config + posts), then run `filepress build`.",
@@ -37,6 +37,7 @@
 		"scripts/new-post.ts",
 		"scripts/preview.mjs",
 		"scripts/copy-path-mounts.mjs",
+		"scripts/assert-no-genie.mjs",
 		"scripts/create-site.mjs",
 		"scripts/ensure-lease.mjs",
 		"scripts/postinstall.mjs",
@@ -51,7 +52,7 @@
 	"scripts": {
 		"postinstall": "node scripts/postinstall.mjs",
 		"filepress": "node scripts/filepress.mjs",
-		"test": "pnpm --filter @filepress/core test && pnpm --filter @filepress/import test && pnpm --filter @filepress/app test && tsx --test scripts/sync-sibling-sites.test.ts scripts/siblings/discover.test.ts scripts/new-post.test.ts scripts/preview.test.ts",
+		"test": "pnpm --filter @filepress/core test && pnpm --filter @filepress/import test && pnpm --filter @filepress/app test && tsx --test scripts/sync-sibling-sites.test.ts scripts/siblings/discover.test.ts scripts/new-post.test.ts scripts/preview.test.ts scripts/assert-no-genie.test.ts scripts/published-files.test.ts",
 		"check": "pnpm filepress check --site demo",
 		"build": "pnpm filepress build --site demo",
 		"build:demo": "pnpm filepress build --site demo",

package/packages/app/src/lib/genie/GenieHost.svelte

@@ -1,12 +1,12 @@
 <script lang="ts">
+	import { browser } from '$app/environment';
+	import { shouldMountGenie } from './enabled';
+
 	/**
-	 * Mount Genie only in Vite DEV. Dynamic import keeps the panel out of
-	 * production client graphs when this host is tree-shaken / dead-coded.
+	 * Browser + Vite DEV only. Never prerender the FAB into static HTML.
+	 * FILEPRESS_GENIE must not force this on in a production build.
 	 */
-	const enabled =
-		import.meta.env.DEV ||
-		import.meta.env.FILEPRESS_GENIE === '1' ||
-		import.meta.env.FILEPRESS_GENIE === 'true';
+	const enabled = shouldMountGenie({ browser, viteDev: import.meta.env.DEV });
 </script>
 
 {#if enabled}

package/packages/app/src/lib/genie/GeniePanel.svelte

@@ -104,10 +104,16 @@
 			...init,
 			headers: {
 				'content-type': 'application/json',
+				accept: 'application/json',
 				...(init?.headers || {})
 			}
 		});
-		const data = await res.json();
+		const type = res.headers.get('content-type') ?? '';
+		const text = await res.text();
+		if (!type.includes('application/json')) {
+			throw new Error('Genie is only available in filepress dev.');
+		}
+		const data = JSON.parse(text) as { error?: string };
 		if (!res.ok) throw new Error(data.error || res.statusText);
 		return data;
 	}

package/packages/app/src/lib/genie/enabled.ts

@@ -0,0 +1,7 @@
+/**
+ * Genie is a local `filepress dev` cockpit. Production / preview / prerender
+ * must never mount it — the APIs live on the Vite serve plugin only.
+ */
+export function shouldMountGenie(input: { browser: boolean; viteDev: boolean }): boolean {
+	return input.browser && input.viteDev;
+}

package/packages/app/src/routes/+layout.svelte

@@ -3,7 +3,6 @@
 	import criticalTheme from '$critical-theme';
 	import { SiteHeader, SiteFooter, isPathMountHref } from '@filepress/core';
 	import config from '$site-config';
-	import GenieHost from '$lib/genie/GenieHost.svelte';
 
 	let { children } = $props();
 
@@ -35,5 +34,8 @@
 
 <SiteFooter site={config} />
 
-<!-- Dev-only Genie Mode (tree-shaken when import.meta.env.DEV is false). -->
-<GenieHost />
+{#if import.meta.env.DEV}
+	{#await import('$lib/genie/GenieHost.svelte') then { default: GenieHost }}
+		<GenieHost />
+	{/await}
+{/if}

package/packages/app/src/routes/+layout.ts

@@ -1,10 +1,8 @@
-import { dev } from '$app/environment';
-
 // Fully static site: prerender every route at build time (D2, adapter-static).
 export const prerender = true;
 export const trailingSlash = 'never';
 
-// Production ships plain HTML (no hydration). That avoids intermittent SvelteKit
-// "500 Internal Error" pages when CDN asset hashes race during deploys or when
-// client navigation can't load __data.json. Keep CSR in `pnpm dev` for Genie.
-export const csr = dev;
+// Production ships plain HTML (no hydration). Use Vite's DEV flag — not
+// `$app/environment` `dev` — so a static host cannot bake `csr: true` and
+// hydrate Genie. Keep CSR in `filepress dev` for the local cockpit.
+export const csr = import.meta.env.DEV;

package/scripts/assert-no-genie.mjs

@@ -0,0 +1,52 @@
+/**
+ * Fail a FilePress `build/` if Genie leaked into the static output.
+ * Genie is serve-only (`filepress dev`). Production must not ship the panel,
+ * its CSS/JS chunk names, or `/__filepress/genie` calls.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { extname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MARKERS = ['GeniePanel', 'GenieHost', 'genie-fab', '/__filepress/genie'];
+const TEXT_EXT = new Set(['.html', '.js', '.css', '.json', '.txt', '.svg', '.xml']);
+
+export function assertNoGenieInBuild(buildDir) {
+	if (!existsSync(buildDir)) {
+		throw new Error(`filepress: Genie leak check skipped — missing build dir ${buildDir}`);
+	}
+	const hits = [];
+	walk(buildDir, (file) => {
+		if (!TEXT_EXT.has(extname(file).toLowerCase())) return;
+		const text = readFileSync(file, 'utf8');
+		for (const marker of MARKERS) {
+			if (text.includes(marker)) {
+				hits.push(`${relative(buildDir, file)}: ${marker}`);
+			}
+		}
+	});
+	if (hits.length > 0) {
+		throw new Error(
+			`filepress: Genie leaked into the static build (dev-only).\n` +
+				hits.map((h) => `  ${h}`).join('\n')
+		);
+	}
+}
+
+function walk(dir, visit) {
+	for (const name of readdirSync(dir)) {
+		const abs = join(dir, name);
+		if (statSync(abs).isDirectory()) walk(abs, visit);
+		else visit(abs);
+	}
+}
+
+const isMain =
+	Boolean(process.argv[1]) && fileURLToPath(import.meta.url) === process.argv[1];
+if (isMain) {
+	try {
+		assertNoGenieInBuild(process.argv[2] ?? '');
+	} catch (err) {
+		console.error(err instanceof Error ? err.message : err);
+		process.exit(1);
+	}
+}

package/scripts/copy-path-mounts.mjs

@@ -9,6 +9,7 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { assertNoGenieInBuild } from './assert-no-genie.mjs';
 
 const siteRoot = resolve(process.argv[2] ?? '');
 const buildDir = join(siteRoot, 'build');
@@ -23,6 +24,13 @@ if (!existsSync(buildDir)) {
 	process.exit(0);
 }
 
+try {
+	assertNoGenieInBuild(buildDir);
+} catch (err) {
+	console.error(err instanceof Error ? err.message : err);
+	process.exit(1);
+}
+
 const headersDest = join(buildDir, '_headers');
 if (existsSync(headersDest)) {
 	console.log('filepress: kept site _headers');