getfilepress 0.1.4 → 0.1.5

package/README.md

@@ -73,6 +73,8 @@ pnpm build:www           # → sites/getfilepress/build/
 pnpm ship                # build + Wrangler Pages deploy (project: getfilepress)
 ```
 
+Two `filepress dev` processes share Vite **5173** unless you pin the port. With [LocalBerth](https://www.npmjs.com/package/localberth) 0.2+, `filepress dev` reads a named lease. Claim once; see [docs/LOCALBERTH.md](docs/LOCALBERTH.md).
+
 ## Site configuration
 
 ```ts
@@ -194,7 +196,7 @@ Body content in **Markdown**.
 
 Pin the engine in the site `package.json` (`"getfilepress": "^0.1.3"` or `github:Catalyst-Forge-LLC/filepress#v0.1.3`). Do not use `link:` in CI. Set config `url` to the live origin.
 
-Any other static host works the same way: publish `build/` as the web root.
+Any other static host works the same way: publish `build/` as the web root. The build also writes a `_headers` file (HSTS, no framing, no wildcard CORS) for Cloudflare Pages; override it with `static/_headers`.
 
 Full notes (including an agent checklist): [`docs/DEPLOY.md`](docs/DEPLOY.md) · product page: [getfilepress.com/deploy](https://getfilepress.com/deploy).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getfilepress",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": false,
   "type": "module",
   "description": "FilePress — file-based Markdown blog engine. Link this package from a content-only site (config + posts), then run `filepress build`.",
@@ -36,6 +36,7 @@
     "scripts/filepress.mjs",
     "scripts/copy-path-mounts.mjs",
     "scripts/create-site.mjs",
+    "scripts/ensure-lease.mjs",
     "scripts/postinstall.mjs",
     "scripts/link-embedded-packages.mjs",
     "packages/core",
@@ -90,9 +91,9 @@
     "build:www": "pnpm filepress build --site getfilepress",
     "ship": "pnpm build:www && wrangler pages deploy sites/getfilepress/build --project-name getfilepress",
     "deploy:www": "pnpm ship",
-    "dev": "pnpm filepress dev --site demo",
-    "dev:demo": "pnpm filepress dev --site demo",
-    "dev:www": "pnpm filepress dev --site getfilepress",
+    "dev": "node scripts/ensure-lease.mjs demo 5179 && pnpm filepress dev --site demo",
+    "dev:demo": "node scripts/ensure-lease.mjs demo 5179 && pnpm filepress dev --site demo",
+    "dev:www": "node scripts/ensure-lease.mjs getfilepress 5180 && pnpm filepress dev --site getfilepress",
     "create-site": "node scripts/create-site.mjs",
     "import": "node scripts/filepress.mjs import",
     "pack:smoke": "node scripts/pack-smoke.mjs"

package/packages/app/localberth-port.ts

@@ -0,0 +1,32 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+
+/** `localberth get <name>` — undefined if the CLI or lease is missing. */
+export function localberthGet(name: string): number | undefined {
+	const r = spawnSync('localberth', ['get', name], {
+		encoding: 'utf8',
+		timeout: 5000,
+		windowsHide: true,
+		shell: process.platform === 'win32'
+	});
+	if (r.status !== 0) return undefined;
+	const n = Number((r.stdout || '').trim());
+	return Number.isInteger(n) && n > 0 && n <= 65535 ? n : undefined;
+}
+
+/** FILEPRESS_LEASE, then site package.json name, then the site folder name. */
+export function filepressLeaseName(siteRoot: string): string {
+	const fromEnv = process.env.FILEPRESS_LEASE?.trim();
+	if (fromEnv) return fromEnv;
+	const pkgPath = join(siteRoot, 'package.json');
+	if (existsSync(pkgPath)) {
+		try {
+			const name = JSON.parse(readFileSync(pkgPath, 'utf8')).name;
+			if (typeof name === 'string' && name.trim()) return name.trim();
+		} catch {
+			/* fall through */
+		}
+	}
+	return siteRoot.replace(/[/\\]+$/, '').split(/[/\\]/).pop() || 'filepress';
+}

package/packages/app/vite.config.ts

@@ -10,6 +10,7 @@ import {
 } from './vite-plugin-critical-theme.ts';
 import { geniePlugin } from './vite-plugin-genie.ts';
 import { pathMountsPlugin } from './vite-plugin-path-mounts.ts';
+import { filepressLeaseName, localberthGet } from './localberth-port.ts';
 import type { PathMount } from '../core/src/lib/paths-shared.ts';
 
 const appRoot = dirname(fileURLToPath(import.meta.url));
@@ -84,9 +85,11 @@ async function loadPathMounts(): Promise<PathMount[]> {
 
 function resolvePort(): number | undefined {
 	const raw = process.env.FILEPRESS_PORT?.trim();
-	if (!raw) return undefined;
-	const n = Number(raw);
-	return Number.isInteger(n) && n > 0 && n <= 65535 ? n : undefined;
+	if (raw) {
+		const n = Number(raw);
+		return Number.isInteger(n) && n > 0 && n <= 65535 ? n : undefined;
+	}
+	return localberthGet(filepressLeaseName(siteRoot));
 }
 
 const fixedPort = resolvePort();

package/packages/core/src/lib/default-headers.txt

@@ -0,0 +1,10 @@
+# Emitted by FilePress. Override by adding static/_headers in the site.
+# Cloudflare Pages and Netlify read this file; it is not served as a page.
+
+/*
+  Strict-Transport-Security: max-age=31536000
+  Content-Security-Policy: frame-ancestors 'none'
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  ! Access-Control-Allow-Origin

package/packages/core/src/lib/headers.ts

@@ -0,0 +1,21 @@
+/**
+ * Default Cloudflare Pages / Netlify `_headers` for a FilePress build.
+ * A site-owned `static/_headers` wins: adapter-static copies it first, and
+ * we refuse to overwrite `build/_headers`.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const templatePath = join(dirname(fileURLToPath(import.meta.url)), 'default-headers.txt');
+
+export function defaultSecurityHeaders(): string {
+	return readFileSync(templatePath, 'utf8');
+}
+
+export function writeBuildHeaders(buildDir: string): 'wrote' | 'kept' {
+	const dest = join(buildDir, '_headers');
+	if (existsSync(dest)) return 'kept';
+	writeFileSync(dest, defaultSecurityHeaders());
+	return 'wrote';
+}

package/packages/core/src/lib/server.ts

@@ -22,6 +22,7 @@ export {
 
 export { absoluteUrl, ogImageUrl } from './config';
 export type { SiteConfig, PathMount } from './config';
+export { defaultSecurityHeaders, writeBuildHeaders } from './headers';
 export {
 	normalizePathMounts,
 	pathMountReservedSlugs,

package/scripts/copy-path-mounts.mjs

@@ -1,21 +1,36 @@
 /**
- * Copy FilePress `paths` mounts into <site>/build after `vite build`.
- * Reads `.filepress/path-mounts.json` written when vite.config loads the site config.
+ * Post-`vite build` steps for a FilePress site:
+ *   1. Write default `build/_headers` unless the site already provided one
+ *   2. Copy `paths` mounts (from `.filepress/path-mounts.json`)
  *
  * Usage: node scripts/copy-path-mounts.mjs <siteRoot>
  */
-import { cpSync, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { cpSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 const siteRoot = resolve(process.argv[2] ?? '');
 const buildDir = join(siteRoot, 'build');
 const cachePath = join(siteRoot, '.filepress', 'path-mounts.json');
+const headersTemplate = join(
+	dirname(fileURLToPath(import.meta.url)),
+	'../packages/core/src/lib/default-headers.txt'
+);
 
-if (!existsSync(cachePath)) {
+if (!existsSync(buildDir)) {
+	console.warn(`filepress: post-build skipped — build dir missing (${buildDir})`);
 	process.exit(0);
 }
-if (!existsSync(buildDir)) {
-	console.warn(`filepress: path mounts skipped — build dir missing (${buildDir})`);
+
+const headersDest = join(buildDir, '_headers');
+if (existsSync(headersDest)) {
+	console.log('filepress: kept site _headers');
+} else if (existsSync(headersTemplate)) {
+	writeFileSync(headersDest, readFileSync(headersTemplate, 'utf8'));
+	console.log('filepress: wrote default _headers');
+}
+
+if (!existsSync(cachePath)) {
 	process.exit(0);
 }
 

package/scripts/ensure-lease.mjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * Idempotent LocalBerth claim for FilePress (and sibling) dev ports.
+ * Usage: node scripts/ensure-lease.mjs <name> <port>
+ * Missing CLI → one line, exit 0. Existing lease → keep it (do not rewrite).
+ */
+import { spawnSync } from 'node:child_process';
+
+const name = process.argv[2];
+const port = process.argv[3];
+if (!name || !port) {
+	console.error('usage: node scripts/ensure-lease.mjs <name> <port>');
+	process.exit(1);
+}
+
+const opt = { encoding: 'utf8', timeout: 8000, windowsHide: true, shell: process.platform === 'win32' };
+const got = spawnSync('localberth', ['get', name], { ...opt, stdio: ['ignore', 'pipe', 'ignore'] });
+if (got.status === 0 && String(got.stdout || '').trim()) {
+	process.exit(0);
+}
+const claim = spawnSync('localberth', ['claim', name, '--port', port], { ...opt, stdio: 'inherit' });
+if (claim.error || claim.status !== 0) {
+	console.warn(`localberth: skip claim ${name} (install the CLI to pin this site to ${port})`);
+}