getfilepress 0.1.4 → 0.1.6

package/README.md

@@ -73,6 +73,8 @@ pnpm build:www           # → sites/getfilepress/build/
 pnpm ship                # build + Wrangler Pages deploy (project: getfilepress)
 ```
 
+Two `filepress dev` processes share Vite **5173** unless you pin the port. With [LocalBerth](https://www.npmjs.com/package/localberth) 0.2+, `filepress dev` reads a named lease. Claim once; see [docs/LOCALBERTH.md](docs/LOCALBERTH.md).
+
 ## Site configuration
 
 ```ts
@@ -194,7 +196,7 @@ Body content in **Markdown**.
 
 Pin the engine in the site `package.json` (`"getfilepress": "^0.1.3"` or `github:Catalyst-Forge-LLC/filepress#v0.1.3`). Do not use `link:` in CI. Set config `url` to the live origin.
 
-Any other static host works the same way: publish `build/` as the web root.
+Any other static host works the same way: publish `build/` as the web root. The build also writes a `_headers` file (HSTS, no framing, no wildcard CORS) for Cloudflare Pages; override it with `static/_headers`.
 
 Full notes (including an agent checklist): [`docs/DEPLOY.md`](docs/DEPLOY.md) · product page: [getfilepress.com/deploy](https://getfilepress.com/deploy).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getfilepress",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "private": false,
   "type": "module",
   "description": "FilePress — file-based Markdown blog engine. Link this package from a content-only site (config + posts), then run `filepress build`.",
@@ -36,6 +36,7 @@
     "scripts/filepress.mjs",
     "scripts/copy-path-mounts.mjs",
     "scripts/create-site.mjs",
+    "scripts/ensure-lease.mjs",
     "scripts/postinstall.mjs",
     "scripts/link-embedded-packages.mjs",
     "packages/core",
@@ -83,17 +84,18 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs",
     "filepress": "node scripts/filepress.mjs",
-    "test": "pnpm --filter @filepress/core test && pnpm --filter @filepress/import test && pnpm --filter @filepress/app test",
+    "test": "pnpm --filter @filepress/core test && pnpm --filter @filepress/import test && pnpm --filter @filepress/app test && tsx --test scripts/sync-sibling-sites.test.ts",
     "check": "pnpm filepress check --site demo",
     "build": "pnpm filepress build --site demo",
     "build:demo": "pnpm filepress build --site demo",
     "build:www": "pnpm filepress build --site getfilepress",
     "ship": "pnpm build:www && wrangler pages deploy sites/getfilepress/build --project-name getfilepress",
     "deploy:www": "pnpm ship",
-    "dev": "pnpm filepress dev --site demo",
-    "dev:demo": "pnpm filepress dev --site demo",
-    "dev:www": "pnpm filepress dev --site getfilepress",
+    "dev": "node scripts/ensure-lease.mjs demo 5179 && pnpm filepress dev --site demo",
+    "dev:demo": "node scripts/ensure-lease.mjs demo 5179 && pnpm filepress dev --site demo",
+    "dev:www": "node scripts/ensure-lease.mjs getfilepress 5180 && pnpm filepress dev --site getfilepress",
     "create-site": "node scripts/create-site.mjs",
+    "sync-siblings": "tsx scripts/sync-sibling-sites.ts",
     "import": "node scripts/filepress.mjs import",
     "pack:smoke": "node scripts/pack-smoke.mjs"
   }

package/packages/app/localberth-port.ts

@@ -0,0 +1,32 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { join } from 'node:path';
+
+/** `localberth get <name>` — undefined if the CLI or lease is missing. */
+export function localberthGet(name: string): number | undefined {
+	const r = spawnSync('localberth', ['get', name], {
+		encoding: 'utf8',
+		timeout: 5000,
+		windowsHide: true,
+		shell: process.platform === 'win32'
+	});
+	if (r.status !== 0) return undefined;
+	const n = Number((r.stdout || '').trim());
+	return Number.isInteger(n) && n > 0 && n <= 65535 ? n : undefined;
+}
+
+/** FILEPRESS_LEASE, then site package.json name, then the site folder name. */
+export function filepressLeaseName(siteRoot: string): string {
+	const fromEnv = process.env.FILEPRESS_LEASE?.trim();
+	if (fromEnv) return fromEnv;
+	const pkgPath = join(siteRoot, 'package.json');
+	if (existsSync(pkgPath)) {
+		try {
+			const name = JSON.parse(readFileSync(pkgPath, 'utf8')).name;
+			if (typeof name === 'string' && name.trim()) return name.trim();
+		} catch {
+			/* fall through */
+		}
+	}
+	return siteRoot.replace(/[/\\]+$/, '').split(/[/\\]/).pop() || 'filepress';
+}

package/packages/app/src/lib/prerender-empty-ok.ts

@@ -0,0 +1,15 @@
+/**
+ * Dynamic routes that may have zero `entries()` and still be a valid site:
+ * no extra index pages, no tags, no Markdown pages, or no posts (pages-only).
+ */
+export const prerenderEmptyOk = [
+	'/page/[n]',
+	'/tags/[tag]',
+	'/[slug]',
+	'/posts/[slug]'
+] as const;
+
+export function unexpectedUnseenPrerenderRoutes(routes: string[]): string[] {
+	const ok = new Set<string>(prerenderEmptyOk);
+	return routes.filter((route) => !ok.has(route));
+}

package/packages/app/vite.config.ts

@@ -10,7 +10,9 @@ import {
 } from './vite-plugin-critical-theme.ts';
 import { geniePlugin } from './vite-plugin-genie.ts';
 import { pathMountsPlugin } from './vite-plugin-path-mounts.ts';
+import { filepressLeaseName, localberthGet } from './localberth-port.ts';
 import type { PathMount } from '../core/src/lib/paths-shared.ts';
+import { unexpectedUnseenPrerenderRoutes } from './src/lib/prerender-empty-ok.ts';
 
 const appRoot = dirname(fileURLToPath(import.meta.url));
 const defaultSiteRoot = resolve(appRoot, '../../sites/demo');
@@ -84,9 +86,11 @@ async function loadPathMounts(): Promise<PathMount[]> {
 
 function resolvePort(): number | undefined {
 	const raw = process.env.FILEPRESS_PORT?.trim();
-	if (!raw) return undefined;
-	const n = Number(raw);
-	return Number.isInteger(n) && n > 0 && n <= 65535 ? n : undefined;
+	if (raw) {
+		const n = Number(raw);
+		return Number.isInteger(n) && n > 0 && n <= 65535 ? n : undefined;
+	}
+	return localberthGet(filepressLeaseName(siteRoot));
 }
 
 const fixedPort = resolvePort();
@@ -157,8 +161,7 @@ export default defineConfig(async () => {
 						throw new Error(message);
 					},
 					handleUnseenRoutes: ({ routes }) => {
-						const emptyOk = new Set(['/page/[n]', '/tags/[tag]', '/[slug]']);
-						const unexpected = routes.filter((r) => !emptyOk.has(r));
+						const unexpected = unexpectedUnseenPrerenderRoutes(routes);
 						if (unexpected.length > 0) {
 							throw new Error(
 								`Routes marked prerenderable but not prerendered: ${unexpected.join(', ')}`

package/packages/core/src/lib/default-headers.txt

@@ -0,0 +1,10 @@
+# Emitted by FilePress. Override by adding static/_headers in the site.
+# Cloudflare Pages and Netlify read this file; it is not served as a page.
+
+/*
+  Strict-Transport-Security: max-age=31536000
+  Content-Security-Policy: frame-ancestors 'none'
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  ! Access-Control-Allow-Origin

package/packages/core/src/lib/headers.ts

@@ -0,0 +1,134 @@
+/**
+ * Default Cloudflare Pages / Netlify `_headers` for a FilePress build.
+ * A site-owned `static/_headers` wins: adapter-static copies it first, and
+ * we refuse to overwrite `build/_headers`.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const templatePath = join(dirname(fileURLToPath(import.meta.url)), 'default-headers.txt');
+
+export function defaultSecurityHeaders(): string {
+	return readFileSync(templatePath, 'utf8');
+}
+
+export function writeBuildHeaders(buildDir: string): 'wrote' | 'kept' {
+	const dest = join(buildDir, '_headers');
+	if (existsSync(dest)) return 'kept';
+	writeFileSync(dest, defaultSecurityHeaders());
+	return 'wrote';
+}
+
+export type MergeSecurityHeadersResult = {
+	text: string;
+	changed: boolean;
+	added: string[];
+};
+
+type HeaderBlock = { path: string; lines: string[] };
+
+/** Header name from a `_headers` line (`Name: value` or `! Name`). */
+export function headerNameFromLine(line: string): string | null {
+	const t = line.trim();
+	if (!t || t.startsWith('#')) return null;
+	if (t.startsWith('! ')) return t.slice(2).trim().toLowerCase();
+	const colon = t.indexOf(':');
+	if (colon === -1) return null;
+	return t.slice(0, colon).trim().toLowerCase();
+}
+
+function isPathLine(line: string): boolean {
+	if (line.startsWith(' ') || line.startsWith('\t')) return false;
+	const t = line.trim();
+	return t.startsWith('/') || t.startsWith('http://') || t.startsWith('https://');
+}
+
+function parseHeadersFile(text: string): { preamble: string[]; blocks: HeaderBlock[] } {
+	const lines = text.replace(/\r\n/g, '\n').replace(/\r/g, '\n').split('\n');
+	const preamble: string[] = [];
+	const blocks: HeaderBlock[] = [];
+	let current: HeaderBlock | null = null;
+	let beforeFirst = true;
+
+	for (const line of lines) {
+		if (isPathLine(line)) {
+			current = { path: line.trim(), lines: [] };
+			blocks.push(current);
+			beforeFirst = false;
+			continue;
+		}
+		if (beforeFirst) preamble.push(line);
+		else if (current) current.lines.push(line);
+	}
+	return { preamble, blocks };
+}
+
+function serializeHeadersFile(preamble: string[], blocks: HeaderBlock[]): string {
+	const out: string[] = [...preamble];
+	for (const block of blocks) {
+		out.push(block.path);
+		out.push(...block.lines);
+	}
+	let text = out.join('\n');
+	if (!text.endsWith('\n')) text += '\n';
+	return text;
+}
+
+function starHeaderLines(defaults: string): string[] {
+	const { blocks } = parseHeadersFile(defaults);
+	const star = blocks.find((b) => b.path === '/*');
+	if (!star) {
+		throw new Error('default _headers template has no /* block');
+	}
+	return star.lines.filter((line) => headerNameFromLine(line));
+}
+
+function blockIndent(lines: string[]): string {
+	for (const line of lines) {
+		if (headerNameFromLine(line)) {
+			const match = /^(?<indent>[ \t]+)/.exec(line);
+			if (match?.groups?.indent) return match.groups.indent;
+		}
+	}
+	return '  ';
+}
+
+/**
+ * Fold FilePress default `/*` security rules into a site-owned `_headers`
+ * without dropping other path blocks. Existing values for the same header
+ * name win (including an explicit `Access-Control-Allow-Origin`).
+ */
+export function mergeSecurityHeaders(
+	existing: string,
+	defaults: string = defaultSecurityHeaders()
+): MergeSecurityHeadersResult {
+	const wanted = starHeaderLines(defaults);
+	const parsed = parseHeadersFile(existing);
+	const added: string[] = [];
+	let star = parsed.blocks.find((b) => b.path === '/*');
+	if (!star) {
+		star = { path: '/*', lines: [''] };
+		parsed.blocks.push(star);
+	}
+
+	const present = new Set(
+		star.lines.map((line) => headerNameFromLine(line)).filter((n): n is string => Boolean(n))
+	);
+	const indent = blockIndent(star.lines);
+
+	let insertAt = star.lines.length;
+	while (insertAt > 0 && star.lines[insertAt - 1].trim() === '') insertAt--;
+
+	for (const line of wanted) {
+		const name = headerNameFromLine(line);
+		if (!name || present.has(name)) continue;
+		star.lines.splice(insertAt, 0, `${indent}${line.trim()}`);
+		insertAt++;
+		present.add(name);
+		added.push(name);
+	}
+
+	const text = serializeHeadersFile(parsed.preamble, parsed.blocks);
+	return { text, changed: added.length > 0, added };
+}

package/packages/core/src/lib/server.ts

@@ -22,6 +22,8 @@ export {
 
 export { absoluteUrl, ogImageUrl } from './config';
 export type { SiteConfig, PathMount } from './config';
+export { defaultSecurityHeaders, writeBuildHeaders, mergeSecurityHeaders } from './headers';
+export type { MergeSecurityHeadersResult } from './headers';
 export {
 	normalizePathMounts,
 	pathMountReservedSlugs,

package/scripts/copy-path-mounts.mjs

@@ -1,21 +1,36 @@
 /**
- * Copy FilePress `paths` mounts into <site>/build after `vite build`.
- * Reads `.filepress/path-mounts.json` written when vite.config loads the site config.
+ * Post-`vite build` steps for a FilePress site:
+ *   1. Write default `build/_headers` unless the site already provided one
+ *   2. Copy `paths` mounts (from `.filepress/path-mounts.json`)
  *
  * Usage: node scripts/copy-path-mounts.mjs <siteRoot>
  */
-import { cpSync, existsSync, mkdirSync, readFileSync, statSync } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { cpSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 const siteRoot = resolve(process.argv[2] ?? '');
 const buildDir = join(siteRoot, 'build');
 const cachePath = join(siteRoot, '.filepress', 'path-mounts.json');
+const headersTemplate = join(
+	dirname(fileURLToPath(import.meta.url)),
+	'../packages/core/src/lib/default-headers.txt'
+);
 
-if (!existsSync(cachePath)) {
+if (!existsSync(buildDir)) {
+	console.warn(`filepress: post-build skipped — build dir missing (${buildDir})`);
 	process.exit(0);
 }
-if (!existsSync(buildDir)) {
-	console.warn(`filepress: path mounts skipped — build dir missing (${buildDir})`);
+
+const headersDest = join(buildDir, '_headers');
+if (existsSync(headersDest)) {
+	console.log('filepress: kept site _headers');
+} else if (existsSync(headersTemplate)) {
+	writeFileSync(headersDest, readFileSync(headersTemplate, 'utf8'));
+	console.log('filepress: wrote default _headers');
+}
+
+if (!existsSync(cachePath)) {
 	process.exit(0);
 }
 

package/scripts/ensure-lease.mjs

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * Idempotent LocalBerth claim for FilePress (and sibling) dev ports.
+ * Usage: node scripts/ensure-lease.mjs <name> <port>
+ * Missing CLI → one line, exit 0. Existing lease → keep it (do not rewrite).
+ */
+import { spawnSync } from 'node:child_process';
+
+const name = process.argv[2];
+const port = process.argv[3];
+if (!name || !port) {
+	console.error('usage: node scripts/ensure-lease.mjs <name> <port>');
+	process.exit(1);
+}
+
+const opt = { encoding: 'utf8', timeout: 8000, windowsHide: true, shell: process.platform === 'win32' };
+const got = spawnSync('localberth', ['get', name], { ...opt, stdio: ['ignore', 'pipe', 'ignore'] });
+if (got.status === 0 && String(got.stdout || '').trim()) {
+	process.exit(0);
+}
+const claim = spawnSync('localberth', ['claim', name, '--port', port], { ...opt, stdio: 'inherit' });
+if (claim.error || claim.status !== 0) {
+	console.warn(`localberth: skip claim ${name} (install the CLI to pin this site to ${port})`);
+}