meno-core 1.0.53 → 1.0.54

package/lib/server/providers/fileSystemCMSProvider.ts

@@ -8,7 +8,12 @@ import { join } from 'path';
 import type { CMSProvider, CMSSchemaInfo } from '../../shared/interfaces/contentProvider';
 import type { CMSSchema, CMSItem } from '../../shared/types';
 import { validateCMSItem, validateCMSDraftItem } from '../../shared/validation/validators';
-import { isSafePathSegment, isValidIdentifier, isReservedDraftFilename, CMS_DRAFT_SUFFIX } from '../../shared/pathSecurity';
+import {
+  isSafePathSegment,
+  isValidIdentifier,
+  isReservedDraftFilename,
+  CMS_DRAFT_SUFFIX,
+} from '../../shared/pathSecurity';
 import { readJsonFile, fileExists } from '../runtime';
 
 const DRAFT_FILE_SUFFIX = `${CMS_DRAFT_SUFFIX}.json`;
@@ -54,7 +59,9 @@ function normalizeItem(content: unknown, filename: string, isDraft = false): CMS
  * `_filename` differs from `_id` keep the field on disk so the on-disk
  * file-routing path can still find them.
  */
-function stripTransient<T extends Record<string, unknown>>(item: T): Omit<T, '_slug' | '_isDraft' | '_hasDraft' | '_url'> {
+function stripTransient<T extends Record<string, unknown>>(
+  item: T,
+): Omit<T, '_slug' | '_isDraft' | '_hasDraft' | '_url'> {
   const { _slug, _isDraft, _hasDraft, _url, _filename, ...rest } = item;
   const out = rest as Omit<T, '_slug' | '_isDraft' | '_hasDraft' | '_url'>;
   if (typeof _filename === 'string' && _filename !== (out as Record<string, unknown>)._id) {
@@ -72,7 +79,7 @@ export class FileSystemCMSProvider implements CMSProvider {
 
   constructor(
     private templatesDir: string, // e.g., './templates' - CMS template pages
-    private cmsDir: string        // e.g., './cms' - items stored here
+    private cmsDir: string, // e.g., './cms' - items stored here
   ) {}
 
   /**
@@ -81,7 +88,9 @@ export class FileSystemCMSProvider implements CMSProvider {
    */
   private validateCollection(collection: string): void {
     if (!isValidIdentifier(collection)) {
-      throw new Error(`Invalid collection name: "${collection}". Collection names must contain only letters, numbers, hyphens, and underscores.`);
+      throw new Error(
+        `Invalid collection name: "${collection}". Collection names must contain only letters, numbers, hyphens, and underscores.`,
+      );
     }
   }
 
@@ -91,7 +100,9 @@ export class FileSystemCMSProvider implements CMSProvider {
    */
   private validateFilename(filename: string): void {
     if (!isSafePathSegment(filename)) {
-      throw new Error(`Invalid filename: "${filename}". Filenames cannot contain path separators or traversal sequences.`);
+      throw new Error(
+        `Invalid filename: "${filename}". Filenames cannot contain path separators or traversal sequences.`,
+      );
     }
     if (isReservedDraftFilename(filename)) {
       throw new Error(`Invalid filename: "${filename}". The "${CMS_DRAFT_SUFFIX}" suffix is reserved for draft files.`);
@@ -114,14 +125,14 @@ export class FileSystemCMSProvider implements CMSProvider {
     }
 
     const files = readdirSync(this.templatesDir);
-    const jsonFiles = files.filter(f => f.endsWith('.json'));
+    const jsonFiles = files.filter((f) => f.endsWith('.json'));
 
     const results = await Promise.all(
-      jsonFiles.map(async file => {
+      jsonFiles.map(async (file) => {
         const filePath = join(this.templatesDir, file);
         const content = await loadJSONFile(filePath);
         return { filePath, content };
-      })
+      }),
     );
 
     for (const { filePath, content } of results) {
@@ -160,14 +171,14 @@ export class FileSystemCMSProvider implements CMSProvider {
 
     const files = readdirSync(collectionDir);
     // Published items only — exclude `*.draft.json` files (draft-version siblings)
-    const jsonFiles = files.filter(f => f.endsWith('.json') && !f.endsWith(DRAFT_FILE_SUFFIX));
+    const jsonFiles = files.filter((f) => f.endsWith('.json') && !f.endsWith(DRAFT_FILE_SUFFIX));
 
     const results = await Promise.all(
-      jsonFiles.map(async file => {
+      jsonFiles.map(async (file) => {
         const filePath = join(collectionDir, file);
         const content = await loadJSONFile(filePath);
         return { file, filePath, content };
-      })
+      }),
     );
 
     const items: CMSItem[] = [];
@@ -225,7 +236,7 @@ export class FileSystemCMSProvider implements CMSProvider {
    */
   async getItemById(collection: string, id: string): Promise<CMSItem | null> {
     const items = await this.getItems(collection);
-    return items.find(item => item._id === id) || null;
+    return items.find((item) => item._id === id) || null;
   }
 
   /**
@@ -340,14 +351,14 @@ export class FileSystemCMSProvider implements CMSProvider {
     const collectionDir = join(this.cmsDir, collection);
     if (!existsSync(collectionDir)) return [];
 
-    const files = readdirSync(collectionDir).filter(f => f.endsWith(DRAFT_FILE_SUFFIX));
+    const files = readdirSync(collectionDir).filter((f) => f.endsWith(DRAFT_FILE_SUFFIX));
 
     const results = await Promise.all(
-      files.map(async file => {
+      files.map(async (file) => {
         const filePath = join(collectionDir, file);
         const content = await loadJSONFile(filePath);
         return { file, content };
-      })
+      }),
     );
 
     const drafts: CMSItem[] = [];
@@ -415,7 +426,7 @@ export class FileSystemCMSProvider implements CMSProvider {
     // (validateCMSItem) runs on Publish.
     const validation = validateCMSDraftItem(itemData);
     if (!validation.valid) {
-      const messages = validation.errors.map(e => `${e.path}: ${e.message}`).join(', ');
+      const messages = validation.errors.map((e) => `${e.path}: ${e.message}`).join(', ');
       throw new Error(`Invalid draft: ${messages}`);
     }
 
@@ -460,7 +471,7 @@ export class FileSystemCMSProvider implements CMSProvider {
     const item = normalizeItem(content, filename);
     const validation = validateCMSItem(item);
     if (!validation.valid) {
-      const messages = validation.errors.map(e => `${e.path}: ${e.message}`).join(', ');
+      const messages = validation.errors.map((e) => `${e.path}: ${e.message}`).join(', ');
       throw new Error(`Cannot publish invalid draft: ${messages}`);
     }
 
@@ -495,7 +506,9 @@ export class FileSystemCMSProvider implements CMSProvider {
    */
   async saveSchema(collectionId: string, pageData: unknown): Promise<void> {
     if (!isValidIdentifier(collectionId)) {
-      throw new Error(`Invalid collection ID: "${collectionId}". Collection IDs must contain only letters, numbers, hyphens, and underscores.`);
+      throw new Error(
+        `Invalid collection ID: "${collectionId}". Collection IDs must contain only letters, numbers, hyphens, and underscores.`,
+      );
     }
     const { writeFile, mkdir } = await import('fs/promises');
 
@@ -531,7 +544,9 @@ export class FileSystemCMSProvider implements CMSProvider {
    */
   async updateSchema(collectionId: string, updates: Partial<CMSSchema>): Promise<void> {
     if (!isValidIdentifier(collectionId)) {
-      throw new Error(`Invalid collection ID: "${collectionId}". Collection IDs must contain only letters, numbers, hyphens, and underscores.`);
+      throw new Error(
+        `Invalid collection ID: "${collectionId}". Collection IDs must contain only letters, numbers, hyphens, and underscores.`,
+      );
     }
     const { readFile, writeFile } = await import('fs/promises');
 
@@ -552,7 +567,7 @@ export class FileSystemCMSProvider implements CMSProvider {
     pageData.meta.cms = {
       ...pageData.meta.cms,
       ...updates,
-      id: collectionId,  // ID cannot be changed
+      id: collectionId, // ID cannot be changed
     };
 
     await writeFile(pageFilePath, JSON.stringify(pageData, null, 2), 'utf-8');

package/lib/server/providers/fileSystemPageProvider.test.ts

@@ -0,0 +1,84 @@
+/**
+ * FileSystemPageProvider Tests
+ *
+ * Focus: normal nested page paths keep working, and page paths that try to escape the
+ * pages/templates directory (`..` traversal, NUL bytes) are rejected before any
+ * filesystem write/delete can touch an ancestor directory.
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'bun:test';
+import { FileSystemPageProvider } from './fileSystemPageProvider';
+import { existsSync, rmSync, mkdirSync } from 'fs';
+import { join } from 'path';
+
+const ROOT = join('/tmp', 'page-provider-test-' + Date.now());
+const PAGES_DIR = join(ROOT, 'project', 'pages');
+const TEMPLATES_DIR = join(ROOT, 'project', 'templates');
+// A sentinel directory OUTSIDE pagesDir that a traversal attack would try to reach.
+const OUTSIDE_DIR = join(ROOT, 'project');
+
+describe('FileSystemPageProvider', () => {
+  let provider: FileSystemPageProvider;
+
+  beforeEach(() => {
+    mkdirSync(PAGES_DIR, { recursive: true });
+    mkdirSync(TEMPLATES_DIR, { recursive: true });
+    provider = new FileSystemPageProvider(PAGES_DIR, TEMPLATES_DIR);
+  });
+
+  afterEach(() => {
+    rmSync(ROOT, { recursive: true, force: true });
+  });
+
+  describe('normal page paths', () => {
+    it('saves and reads a top-level page', async () => {
+      await provider.save('/about', '{"ok":true}');
+      expect(existsSync(join(PAGES_DIR, 'about.json'))).toBe(true);
+      expect(await provider.get('/about')).toBe('{"ok":true}');
+      expect(await provider.exists('/about')).toBe(true);
+    });
+
+    it('saves and reads a nested page, auto-creating folders', async () => {
+      await provider.save('/blog/post-1', '{"slug":"post-1"}');
+      expect(existsSync(join(PAGES_DIR, 'blog', 'post-1.json'))).toBe(true);
+      expect(await provider.get('/blog/post-1')).toBe('{"slug":"post-1"}');
+    });
+
+    it('maps the index route to index.json', async () => {
+      await provider.save('/', '{"home":true}');
+      expect(existsSync(join(PAGES_DIR, 'index.json'))).toBe(true);
+    });
+
+    it('routes template paths to the templates directory', async () => {
+      await provider.save('/templates/blog-post', '{"template":true}');
+      expect(existsSync(join(TEMPLATES_DIR, 'blog-post.json'))).toBe(true);
+      expect(await provider.get('/templates/blog-post')).toBe('{"template":true}');
+    });
+  });
+
+  describe('path traversal rejection', () => {
+    it('rejects save for a path escaping pagesDir', async () => {
+      await expect(provider.save('/../../evil', '{"x":1}')).rejects.toThrow(/resolves outside/);
+      // Nothing must have been written outside pagesDir.
+      expect(existsSync(join(ROOT, 'evil.json'))).toBe(false);
+      expect(existsSync(join(OUTSIDE_DIR, 'evil.json'))).toBe(false);
+    });
+
+    it('rejects delete for a path escaping pagesDir', async () => {
+      await expect(provider.delete('/../../evil')).rejects.toThrow(/resolves outside/);
+    });
+
+    it('rejects get/exists for a traversal path', async () => {
+      await expect(provider.get('/../../evil')).rejects.toThrow(/resolves outside/);
+      await expect(provider.exists('/../../evil')).rejects.toThrow(/resolves outside/);
+    });
+
+    it('rejects a template path escaping templatesDir', async () => {
+      await expect(provider.save('/templates/../../evil', '{"x":1}')).rejects.toThrow(/resolves outside/);
+    });
+
+    it('rejects a path containing a NUL byte', async () => {
+      await expect(provider.save('/foo\0bar', '{"x":1}')).rejects.toThrow(/NUL byte/);
+    });
+  });
+});

package/lib/server/providers/fileSystemPageProvider.ts

@@ -4,10 +4,11 @@
  */
 
 import { existsSync, readdirSync, mkdirSync, rmdirSync } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, resolve, sep } from 'path';
 import type { PageProvider } from '../../shared/interfaces/contentProvider';
 import { isJSONFile, stripExtension, mapPageNameToPath, mapPathToPageName } from '../../shared/utils/fileUtils';
 import { readTextFile, fileExists } from '../runtime';
+import { logRuntimeError } from '../../shared/errorLogger';
 
 /**
  * Load JSON file content from disk
@@ -18,7 +19,8 @@ async function loadJSONFile(filePath: string): Promise<string | null> {
       return await readTextFile(filePath);
     }
     return null;
-  } catch {
+  } catch (error) {
+    logRuntimeError('fileSystemPageProvider.loadJSONFile', error, { filePath });
     return null;
   }
 }
@@ -31,7 +33,7 @@ async function loadJSONFile(filePath: string): Promise<string | null> {
 export class FileSystemPageProvider implements PageProvider {
   constructor(
     private pagesDir: string,
-    private templatesDir?: string
+    private templatesDir?: string,
   ) {}
 
   async loadAll(): Promise<Map<string, string>> {
@@ -57,38 +59,55 @@ export class FileSystemPageProvider implements PageProvider {
   private async scanDirectory(dir: string, prefix: string, pages: Map<string, string>): Promise<void> {
     const entries = readdirSync(dir, { withFileTypes: true });
 
-    const fileEntries = entries.filter(e => e.isFile() && isJSONFile(e.name));
-    const dirEntries = entries.filter(e => e.isDirectory());
+    const fileEntries = entries.filter((e) => e.isFile() && isJSONFile(e.name));
+    const dirEntries = entries.filter((e) => e.isDirectory());
 
     await Promise.all([
-      ...fileEntries.map(async entry => {
-        const pageName = prefix
-          ? `${prefix}/${stripExtension(entry.name)}`
-          : stripExtension(entry.name);
+      ...fileEntries.map(async (entry) => {
+        const pageName = prefix ? `${prefix}/${stripExtension(entry.name)}` : stripExtension(entry.name);
         const content = await loadJSONFile(join(dir, entry.name));
         if (content) {
           const pagePath = mapPageNameToPath(pageName);
           pages.set(pagePath, content);
         }
       }),
-      ...dirEntries.map(entry => {
+      ...dirEntries.map((entry) => {
         const subPrefix = prefix ? `${prefix}/${entry.name}` : entry.name;
         return this.scanDirectory(join(dir, entry.name), subPrefix, pages);
       }),
     ]);
   }
 
+  /**
+   * Assert that `candidate` resolves inside `baseDir`. Without this a page path
+   * like `/../../foo` maps to pageName `../../foo` and would be joined OUTSIDE the
+   * pages/templates dir — letting save() write, and delete() (plus its empty-parent
+   * rmdir loop) operate on, arbitrary ancestor directories. Throws on escape.
+   */
+  private assertWithin(baseDir: string, candidate: string): string {
+    const baseResolved = resolve(baseDir);
+    const resolved = resolve(candidate);
+    if (resolved !== baseResolved && !resolved.startsWith(baseResolved + sep)) {
+      throw new Error(`Invalid page path: "${candidate}" resolves outside of "${baseDir}"`);
+    }
+    return candidate;
+  }
+
   /**
    * Resolve a page path to its filesystem file path
    * Routes /templates/* paths to the templates directory
    */
   private resolveFilePath(path: string): string {
     const pageName = mapPathToPageName(path);
+    // Reject NUL bytes outright (fs would throw, but fail fast with a clear error).
+    if (pageName.includes('\0')) {
+      throw new Error('Invalid page path: contains NUL byte');
+    }
     if (this.templatesDir && pageName.startsWith('templates/')) {
       const templateName = pageName.substring('templates/'.length);
-      return join(this.templatesDir, `${templateName}.json`);
+      return this.assertWithin(this.templatesDir, join(this.templatesDir, `${templateName}.json`));
     }
-    return join(this.pagesDir, `${pageName}.json`);
+    return this.assertWithin(this.pagesDir, join(this.pagesDir, `${pageName}.json`));
   }
 
   /**

package/lib/server/routes/api/cms.test.ts

@@ -7,12 +7,7 @@ import { describe, it, expect, beforeEach } from 'bun:test';
 import type { CMSProvider, CMSSchemaInfo } from '../../../shared/interfaces/contentProvider';
 import type { CMSItem, CMSSchema } from '../../../shared/types';
 import { CMSService } from '../../services/cmsService';
-import {
-  handleCollectionsRoute,
-  handleCollectionSchemaRoute,
-  handleItemsRoute,
-  handleItemRoute,
-} from './cms';
+import { handleCollectionsRoute, handleCollectionSchemaRoute, handleItemsRoute, handleItemRoute } from './cms';
 
 // Note: Write handler tests (handleCreateItemRoute, handleUpdateItemRoute, handleDeleteItemRoute)
 // moved to @meno/studio
@@ -55,7 +50,14 @@ const mockProductSchemaInfo: CMSSchemaInfo = {
 
 const mockBlogItems: CMSItem[] = [
   { _id: '1', _slug: 'hello-world', slug: 'hello-world', title: 'Hello World', content: 'First post', featured: true },
-  { _id: '2', _slug: 'getting-started', slug: 'getting-started', title: 'Getting Started', content: 'Guide', featured: false },
+  {
+    _id: '2',
+    _slug: 'getting-started',
+    slug: 'getting-started',
+    title: 'Getting Started',
+    content: 'Guide',
+    featured: false,
+  },
 ];
 
 describe('CMS API Routes - Read Operations', () => {
@@ -64,34 +66,44 @@ describe('CMS API Routes - Read Operations', () => {
 
   beforeEach(async () => {
     mockProvider = {
-      getAllSchemas: async () => new Map([
-        ['blog-posts', mockSchemaInfo],
-        ['products', mockProductSchemaInfo],
-      ]),
+      getAllSchemas: async () =>
+        new Map([
+          ['blog-posts', mockSchemaInfo],
+          ['products', mockProductSchemaInfo],
+        ]),
       getItems: async (collection: string) => {
         if (collection === 'blog-posts') return [...mockBlogItems];
         return [];
       },
       getItemBySlug: async (collection: string, slug: string) => {
         if (collection === 'blog-posts') {
-          return mockBlogItems.find(i => i._slug === slug) || null;
+          return mockBlogItems.find((i) => i._slug === slug) || null;
         }
         return null;
       },
       getItemByFilename: async (collection: string, filename: string) => {
         if (collection === 'blog-posts') {
-          return mockBlogItems.find(i => i._filename === filename || i._slug === filename) || null;
+          return mockBlogItems.find((i) => i._filename === filename || i._slug === filename) || null;
         }
         return null;
       },
       getItemById: async (collection: string, id: string) => {
         if (collection === 'blog-posts') {
-          return mockBlogItems.find(i => i._id === id) || null;
+          return mockBlogItems.find((i) => i._id === id) || null;
         }
         return null;
       },
       saveItem: async () => {},
       deleteItem: async () => {},
+      // Draft-model methods (no drafts exist in this mock)
+      getDraft: async () => null,
+      getAllDrafts: async () => [],
+      hasDraft: async () => false,
+      saveDraft: async () => {},
+      discardDraft: async () => {},
+      publishDraft: async () => {
+        throw new Error('No draft exists');
+      },
     };
 
     cmsService = new CMSService(mockProvider);

package/lib/server/routes/api/cms.ts

@@ -26,10 +26,7 @@ export function handleCollectionsRoute(cmsService: CMSService): Response {
 /**
  * GET /api/cms/collections/:collection - Get schema for specific collection
  */
-export function handleCollectionSchemaRoute(
-  collection: string,
-  cmsService: CMSService
-): Response {
+export function handleCollectionSchemaRoute(collection: string, cmsService: CMSService): Response {
   const schema = cmsService.getSchema(collection);
 
   if (!schema) {
@@ -51,7 +48,7 @@ export function handleCollectionSchemaRoute(
 export async function handleItemsRoute(
   collection: string,
   cmsService: CMSService,
-  searchParams?: URLSearchParams
+  searchParams?: URLSearchParams,
 ): Promise<Response> {
   // Parse pagination params
   const limit = searchParams?.get('limit') ? parseInt(searchParams.get('limit')!, 10) : undefined;
@@ -69,7 +66,7 @@ export async function handleItemsRoute(
     const schema = cmsService.getSchema(collection);
     const slugField = schema?.slugField || 'slug';
 
-    filteredItems = allItems.filter(item => {
+    filteredItems = allItems.filter((item) => {
       // Search in title, slug, and filename
       const title = extractStringValue(item.title || '').toLowerCase();
       const slug = extractStringValue(item[slugField] || item._slug || '').toLowerCase();
@@ -95,27 +92,25 @@ export async function handleItemsRoute(
     items: itemsWithUrl,
     total: search ? filteredItems.length : total,
     limit,
-    offset: offset || 0
+    offset: offset || 0,
   });
 }
 
 /**
  * GET /api/cms/:collection/:slug - Get specific item by slug
  */
-export async function handleItemRoute(
-  collection: string,
-  slug: string,
-  cmsService: CMSService
-): Promise<Response> {
+export async function handleItemRoute(collection: string, slug: string, cmsService: CMSService): Promise<Response> {
   const match = await cmsService.matchRoute(
-    cmsService.getSchema(collection)?.urlPattern.replace('{{slug}}', slug) || ''
+    cmsService.getSchema(collection)?.urlPattern.replace('{{slug}}', slug) || '',
   );
 
   // If no match via route, try direct provider access
   if (!match) {
     // For direct item access, we need to check if item exists
     const items = await cmsService.queryItems({ collection });
-    const item = items.find(i => i._slug === slug || i[cmsService.getSchema(collection)?.slugField || 'slug'] === slug);
+    const item = items.find(
+      (i) => i._slug === slug || i[cmsService.getSchema(collection)?.slugField || 'slug'] === slug,
+    );
 
     if (!item) {
       return errorResponse('Item not found', 404);

package/lib/server/routes/api/components.ts

@@ -16,10 +16,7 @@ import { formatJsonErrorMessage } from '../../../shared/jsonRepair';
  * Uses ETag revalidation so repeat page navigations get a 304 when the
  * registry hasn't changed.
  */
-export function handleComponentsRoute(
-  req: Request,
-  componentService: ComponentService,
-): Response {
+export function handleComponentsRoute(req: Request, componentService: ComponentService): Response {
   const componentsWithCategories = componentService.getAllComponentsWithCategories();
 
   // Transform to API format: { name: { ...definition, _category } }
@@ -27,7 +24,7 @@ export function handleComponentsRoute(
   for (const [name, info] of Object.entries(componentsWithCategories)) {
     result[name] = {
       ...info.definition,
-      _category: info.category
+      _category: info.category,
     };
   }
 
@@ -44,10 +41,7 @@ export function handleComponentsRoute(
  * Handle component data API endpoint - GET /api/component-data/:name
  * Validates that component has structure before returning
  */
-export function handleComponentDataRoute(
-  url: URL,
-  componentService: ComponentService
-): Response {
+export function handleComponentDataRoute(url: URL, componentService: ComponentService): Response {
   const componentName = url.pathname.replace('/api/component-data/', '');
   const componentDef = componentService.getComponent(componentName);
 
@@ -56,14 +50,12 @@ export function handleComponentDataRoute(
     const loadErrors = componentService.getLoadErrors();
     const diagnostic = loadErrors.get(componentName);
     if (diagnostic) {
-      const message = formatJsonErrorMessage(
-        `${diagnostic.componentName}.json`,
-        { message: diagnostic.description, line: diagnostic.line, column: diagnostic.column }
-      );
-      return jsonResponse(
-        { error: 'json_parse_error', message, errorCode: 'JSON_PARSE_ERROR' },
-        { status: 422 }
-      );
+      const message = formatJsonErrorMessage(`${diagnostic.componentName}.json`, {
+        message: diagnostic.description,
+        line: diagnostic.line,
+        column: diagnostic.column,
+      });
+      return jsonResponse({ error: 'json_parse_error', message, errorCode: 'JSON_PARSE_ERROR' }, { status: 422 });
     }
     return jsonResponse({ error: 'Component not found' }, { status: 404 });
   }
@@ -73,11 +65,11 @@ export function handleComponentDataRoute(
   // Validate that component has structure
   if (!componentService.validateComponentStructure(componentDef)) {
     return jsonResponse(
-      { 
+      {
         error: 'Component structure is missing',
-        message: `Component "${componentName}" does not have a valid structure definition. Please add a structure field to the component definition.`
-      }, 
-      { status: 400 }
+        message: `Component "${componentName}" does not have a valid structure definition. Please add a structure field to the component definition.`,
+      },
+      { status: 400 },
     );
   }
 
@@ -87,10 +79,7 @@ export function handleComponentDataRoute(
 /**
  * Handle component JavaScript API endpoint - GET /api/component-js/:name
  */
-export async function handleComponentJavaScriptRoute(
-  url: URL,
-  componentService: ComponentService
-): Promise<Response> {
+export async function handleComponentJavaScriptRoute(url: URL, componentService: ComponentService): Promise<Response> {
   const componentName = url.pathname.replace('/api/component-js/', '');
   const jsContent = await componentService.getComponentJavaScript(componentName);
   const corsHeaders = createCorsHeaders();
@@ -107,13 +96,18 @@ export async function handleComponentJavaScriptRoute(
  * Handle component usage API endpoint - GET /api/component-usage
  * Returns how many times each component is used across all pages and other components
  */
-export function handleComponentUsageRoute(
-  pageService: PageService,
-  componentService: ComponentService
-): Response {
-  const usageMap = new Map<string, { count: number; files: Map<string, { name: string; path: string; type: 'page' | 'component' }> }>();
-
-  function walkTree(node: ComponentNode | undefined | null, fileName: string, filePath: string, fileType: 'page' | 'component') {
+export function handleComponentUsageRoute(pageService: PageService, componentService: ComponentService): Response {
+  const usageMap = new Map<
+    string,
+    { count: number; files: Map<string, { name: string; path: string; type: 'page' | 'component' }> }
+  >();
+
+  function walkTree(
+    node: ComponentNode | undefined | null,
+    fileName: string,
+    filePath: string,
+    fileType: 'page' | 'component',
+  ) {
     if (!node || typeof node !== 'object') return;
     if (node.type === 'component' && 'component' in node && (node as any).component) {
       const compName = (node as any).component as string;
@@ -152,7 +146,10 @@ export function handleComponentUsageRoute(
   }
 
   // Convert to plain object
-  const result: Record<string, { count: number; files: Array<{ name: string; path: string; type: 'page' | 'component' }> }> = {};
+  const result: Record<
+    string,
+    { count: number; files: Array<{ name: string; path: string; type: 'page' | 'component' }> }
+  > = {};
   for (const [name, data] of usageMap) {
     result[name] = {
       count: data.count,
@@ -165,4 +162,3 @@ export function handleComponentUsageRoute(
 
 // Note: Write handlers (handleSaveComponentRoute, handleSaveComponentJavaScriptRoute,
 // handleSaveComponentCSSRoute, handleComponentCategoryRoute) moved to @meno/studio
-

package/lib/server/routes/api/config.ts

@@ -44,4 +44,3 @@ export async function handleComponentsConfigRoute(): Promise<Response> {
 
 // Note: handleSaveConfigRoute moved to @meno/studio
 // Note: handleSaveComponentsConfigRoute moved to @meno/studio
-