vestrycms 0.1.0 → 0.2.0

package/README.md

@@ -132,6 +132,16 @@ shows both and the editor's account never needs push access.
 "d1_databases": [{ "binding": "VESTRY_DB", "database_name": "my-site-vestry" }]
 ```
 
+Several sites can share one D1 database (handy on the free plan's database
+limit): give each a different `auth.tablePrefix` (lowercase, e.g. `"mysite_"`), and bind
+the same `database_id` as `VESTRY_DB` in each site's `wrangler.jsonc`. Each
+site then gets its own tables (`mysite_user`, `mysite_session`, …), so users,
+roles and sessions stay separate. Without a prefix the tables keep Better
+Auth's plain names, so don't let two sites share a database unprefixed: they
+would share one user list, and anyone invited to one could sign in to both.
+Changing the prefix on a live site starts it with an empty user list (config
+admins can still sign in and invite everyone again).
+
 In `astro dev` no sign-in is needed by default: the panel edits the project
 directory and you commit with git. `VESTRY_MODE=auth` keeps the local source
 but requires sign-in, with users in git-ignored `.vestry/auth.sqlite`, for
@@ -326,14 +336,39 @@ pnpm link ../vestrycms
 
 ### Tests
 
+Tests use [Vitest](https://vitest.dev). Files matching `test/**/*.test.ts`
+run in CI; `pnpm typecheck` covers everything under `test/`.
+
+```sh
+pnpm test                    # run the suite once
+pnpm test:watch              # re-run on change
+pnpm test mdx                # only files whose path matches "mdx"
+pnpm test -u                 # update snapshots after an intended change
+```
+
+- `test/auth.test.ts`: sign-in, users and guards over HTTP (memory adapter).
+- `test/shared-database.test.ts`: `auth.tablePrefix` keeping sites apart in one
+  database (`node:sqlite`, real migrations).
+- `test/github-source.test.ts`: commit sequencing against a fake Git Data API.
+- `test/github-app.test.ts`: GitHub App JWT and installation token cache.
+- `test/mdx.test.ts`: MDX round trips. Each file in `test/fixtures/mdx` must
+  survive parse → serialize byte for byte, so write fixtures in the
+  serializer's canonical style (`_emphasis_`, `-` bullets, blank lines around
+  component children). Prettier skips that directory. Record a known gap as
+  an `it.fails` test and move it into the fixtures once fixed.
+- `test/editor-schema.test.ts`: the same fixtures pass through the editor's
+  Tiptap schema (`src/ui/components/editor/schema.ts`) without losing node
+  types or attributes, so a page saved from the editor matches its source.
+
+The auth and GitHub source tests are ordered scenarios that build on shared
+state, so filter them by file, not by test name (`-t`).
+
+`test/manual` holds scripts that run outside the suite:
+
 ```sh
-pnpm test                                                  # github-mock, auth, github-app
-node --import tsx/esm test/auth.ts                         # sign-in, users and guards over HTTP (memory adapter)
-node --import tsx/esm test/github-app.ts                   # GitHub App JWT + installation token cache
-node --import tsx/esm test/roundtrip.ts path/to/file.mdx   # MDX round-trip
-node --import tsx/esm test/github-mock.ts                  # commit sequencing against a fake API
-GH_TOKEN=… node --import tsx/esm test/github-read.ts       # live read path
-GH_TOKEN=… node --import tsx/esm test/github-write.ts      # live commits on a throwaway branch
+pnpm test:roundtrip path/to/file.mdx                       # round-trip a site's content through Prettier
+GH_TOKEN=… node --import tsx/esm test/manual/github-read.ts path/to/site  # time the live read path
+GH_TOKEN=… node --import tsx/esm test/manual/github-write.ts  # live commits on a throwaway branch
 ```
 
 ### Releasing

package/dist/config/types.d.ts

@@ -366,6 +366,15 @@ export interface AuthConfig {
      * be removed or demoted from the control panel.
      */
     admins?: string[];
+    /**
+     * Prefix for the sign-in tables (`user`, `session`, `account`,
+     * `verification`, `rateLimit`), e.g. `mysite_` for `mysite_user`. Lets
+     * several sites share one D1 database, each with its own users and
+     * sessions. Lowercase letters, digits and underscores, starting with a
+     * letter (table names ignore case, so `Site_` would clash with `site_`).
+     * Changing it on a live site starts it with an empty user list.
+     */
+    tablePrefix?: string;
 }
 export interface MailConfig {
     /**

package/dist/core/api.js

@@ -1,5 +1,5 @@
 import { isAPIError } from "better-auth/api";
-import { createVestryAuth, nameFromEmail, normalizeEmail, } from "./auth.js";
+import { createVestryAuth, nameFromEmail, normalizeEmail, tablePrefixError, } from "./auth.js";
 import { MailError, consoleMailer, resendMailer } from "./mail.js";
 import { isRole } from "./roles.js";
 import { ContentService } from "./service.js";
@@ -115,6 +115,10 @@ export function createApi(options) {
         const secret = resolveSecret();
         if (typeof secret !== "string")
             return secret;
+        const tablePrefix = config.auth?.tablePrefix;
+        const prefixError = tablePrefixError(tablePrefix);
+        if (prefixError)
+            return { error: prefixError };
         // Invitation links point at the configured site, not whatever host the
         // inviting admin happened to use (a preview or workers.dev URL).
         const siteOrigin = !options.auth?.dev && config.siteUrl
@@ -132,6 +136,7 @@ export function createApi(options) {
             admins: config.auth?.admins ?? [],
             dev: options.auth?.dev,
             migrate: options.auth?.migrate,
+            tablePrefix,
         });
         if (authByOrigin.size >= MAX_ORIGINS) {
             const oldest = authByOrigin.keys().next().value;

package/dist/core/auth.d.ts

@@ -33,12 +33,18 @@ export interface VestryAuthOptions {
     dev?: boolean;
     /** Create or update the tables on first use (Kysely-backed databases only). */
     migrate?: boolean;
+    /** Prefix for the table names, so several sites can share one database. */
+    tablePrefix?: string;
 }
 export declare const SESSION_TTL_SECONDS: number;
 export declare const CODE_TTL_SECONDS: number;
 export declare function normalizeEmail(email: string): string;
 /** Display name fallback: the part before the `@`, title-cased a little. */
 export declare function nameFromEmail(email: string): string;
+/** The tables Better Auth (with Vestry's plugins) keeps. */
+export declare const AUTH_TABLES: readonly ["user", "session", "account", "verification", "rateLimit"];
+/** Why a `tablePrefix` is unusable, or undefined when it is fine. */
+export declare function tablePrefixError(prefix: string | undefined): string | undefined;
 export declare function createVestryAuth(opts: VestryAuthOptions): {
     auth: import("better-auth").Auth<{
         appName: string;
@@ -49,10 +55,30 @@ export declare function createVestryAuth(opts: VestryAuthOptions): {
         session: {
             expiresIn: number;
             updateAge: number;
+            modelName: string;
+        } | {
+            expiresIn: number;
+            updateAge: number;
+            modelName?: undefined;
+        };
+        account: {
+            modelName: string;
+        } | {
+            modelName?: undefined;
+        };
+        verification: {
+            modelName: string;
+        } | {
+            modelName?: undefined;
         };
         rateLimit: {
             enabled: boolean;
             storage: "database";
+            modelName: string;
+        } | {
+            enabled: boolean;
+            storage: "database";
+            modelName?: undefined;
         };
         advanced: {
             cookiePrefix: string;
@@ -72,6 +98,16 @@ export declare function createVestryAuth(opts: VestryAuthOptions): {
                     input: false;
                 };
             };
+            modelName: string;
+        } | {
+            additionalFields: {
+                lastLoginAt: {
+                    type: "date";
+                    required: false;
+                    input: false;
+                };
+            };
+            modelName?: undefined;
         };
         databaseHooks: {
             session: {

package/dist/core/auth.js

@@ -41,14 +41,36 @@ export function nameFromEmail(email) {
     // Commit authors need a non-empty name; fall back to the address itself.
     return pretty || local || email;
 }
+/** The tables Better Auth (with Vestry's plugins) keeps. */
+export const AUTH_TABLES = [
+    "user",
+    "session",
+    "account",
+    "verification",
+    "rateLimit",
+];
+// Lowercase only: SQLite (and so D1) table names ignore case, so `Site_`
+// and `site_` would silently name the same tables.
+const TABLE_PREFIX = /^[a-z][a-z0-9_]*$/;
+/** Why a `tablePrefix` is unusable, or undefined when it is fine. */
+export function tablePrefixError(prefix) {
+    if (prefix === undefined || prefix === "" || TABLE_PREFIX.test(prefix))
+        return undefined;
+    return `auth.tablePrefix ${JSON.stringify(prefix)} must be lowercase letters, digits and underscores, starting with a letter.`;
+}
 /**
- * Migrations run once per database per isolate, whichever origin asked
- * first (the instances per origin share the database).
+ * Migrations run once per database and table prefix per isolate, whichever
+ * origin asked first (the instances per origin share the database).
  */
 const migratedByDatabase = new WeakMap();
 export function createVestryAuth(opts) {
     const admins = (opts.admins ?? []).map(normalizeEmail);
     const isConfigAdmin = (email) => admins.includes(normalizeEmail(email));
+    const prefixError = tablePrefixError(opts.tablePrefix);
+    if (prefixError)
+        throw new Error(prefixError);
+    const prefix = opts.tablePrefix ?? "";
+    const modelName = (table) => prefix ? { modelName: `${prefix}${table}` } : {};
     const auth = betterAuth({
         appName: opts.siteName,
         secret: opts.secret,
@@ -56,10 +78,14 @@ export function createVestryAuth(opts) {
         basePath: opts.basePath,
         database: opts.database,
         session: {
+            ...modelName("session"),
             expiresIn: SESSION_TTL_SECONDS,
             updateAge: 60 * 60 * 24,
         },
+        account: modelName("account"),
+        verification: modelName("verification"),
         rateLimit: {
+            ...modelName("rateLimit"),
             enabled: !opts.dev,
             storage: "database",
         },
@@ -75,6 +101,7 @@ export function createVestryAuth(opts) {
             },
         },
         user: {
+            ...modelName("user"),
             additionalFields: {
                 lastLoginAt: { type: "date", required: false, input: false },
             },
@@ -153,7 +180,10 @@ export function createVestryAuth(opts) {
         if (opts.migrate === false)
             return Promise.resolve();
         const key = opts.database;
-        const pending = migratedByDatabase.get(key);
+        let byPrefix = migratedByDatabase.get(key);
+        if (!byPrefix)
+            migratedByDatabase.set(key, (byPrefix = new Map()));
+        const pending = byPrefix.get(prefix);
         if (pending)
             return pending;
         const run = (async () => {
@@ -170,10 +200,10 @@ export function createVestryAuth(opts) {
                     throw e;
             }
         })().catch((e) => {
-            migratedByDatabase.delete(key);
+            byPrefix.delete(prefix);
             throw e;
         });
-        migratedByDatabase.set(key, run);
+        byPrefix.set(prefix, run);
         return run;
     };
     /** The `PublicUser` view of a Better Auth user record. */

package/dist/mdx/parse.js

@@ -68,13 +68,14 @@ function block(node, ctx) {
             };
         case "list": {
             const items = node.children.map((item) => listItem(item, ctx));
+            const spread = Boolean(node.spread);
             return node.ordered
                 ? {
                     type: "orderedList",
-                    attrs: { start: node.start ?? 1 },
+                    attrs: { start: node.start ?? 1, spread },
                     content: items,
                 }
-                : { type: "bulletList", content: items };
+                : { type: "bulletList", attrs: { spread }, content: items };
         }
         case "code":
             return {
@@ -87,8 +88,13 @@ function block(node, ctx) {
         case "table":
             return table(node, ctx);
         case "definition":
-        case "footnoteDefinition":
             return null;
+        case "footnoteDefinition":
+            return {
+                type: "footnoteDefinition",
+                attrs: footnoteAttrs(node),
+                content: ensureBlocks(blocks(node.children, ctx)),
+            };
         case "mdxJsxFlowElement":
             return jsxElement(node, ctx, false);
         case "mdxFlowExpression":
@@ -107,6 +113,9 @@ function block(node, ctx) {
 function ensureBlocks(content) {
     return content.length ? content : [{ type: "paragraph" }];
 }
+function footnoteAttrs(node) {
+    return { identifier: node.identifier, label: node.label ?? node.identifier };
+}
 function listItem(item, ctx) {
     const content = ensureBlocks(blocks(item.children, ctx));
     return {
@@ -135,51 +144,65 @@ function table(node, ctx) {
 }
 function esm(node, ctx) {
     const program = node.data?.estree;
-    const leftovers = [];
-    if (program) {
-        for (const stmt of program.body) {
-            if (stmt.type === "ImportDeclaration" &&
-                typeof stmt.source.value === "string") {
-                let recognized = true;
-                for (const spec of stmt.specifiers) {
-                    if (spec.type === "ImportDefaultSpecifier") {
-                        ctx.imports[spec.local.name] = {
-                            name: spec.local.name,
-                            from: stmt.source.value,
-                        };
-                    }
-                    else if (spec.type === "ImportSpecifier") {
-                        const imported = spec.imported.type === "Identifier"
-                            ? spec.imported.name
-                            : String(spec.imported.value);
-                        ctx.imports[spec.local.name] = {
-                            name: spec.local.name,
-                            from: stmt.source.value,
-                            named: imported === spec.local.name ? true : undefined,
-                        };
-                        if (imported !== spec.local.name)
-                            recognized = false;
-                    }
-                    else {
-                        recognized = false;
-                    }
-                }
-                if (recognized && stmt.specifiers.length)
-                    continue;
-            }
-            const start = stmt.start;
-            const end = stmt.end;
-            leftovers.push(typeof start === "number" && typeof end === "number"
-                ? node.value.slice(start, end)
-                : node.value);
-        }
+    // Estree offsets count from the start of the file, not of this block.
+    const base = node.position?.start.offset;
+    if (!program || typeof base !== "number")
+        return { type: "mdxEsm", attrs: { value: node.value } };
+    // Cut recognized imports out of the block's source; everything else,
+    // comments and blank lines included, stays as written.
+    let rest = "";
+    let pos = 0;
+    for (const stmt of program.body) {
+        const { start, end } = stmt;
+        if (typeof start !== "number" || typeof end !== "number")
+            continue;
+        if (!recordImport(stmt, ctx))
+            continue;
+        rest += node.value.slice(pos, start - base);
+        pos = end - base;
+        // Drop the rest of the line when only whitespace follows the import.
+        const eol = /^[ \t]*(\r?\n|$)/.exec(node.value.slice(pos));
+        if (eol)
+            pos += eol[0].length;
     }
-    else {
-        leftovers.push(node.value);
+    rest = (rest + node.value.slice(pos)).trim();
+    return rest ? { type: "mdxEsm", attrs: { value: rest } } : null;
+}
+/**
+ * Record an import statement's bindings if all of them can be re-emitted from
+ * ImportSpecs; the caller then drops the statement. Otherwise it is kept
+ * verbatim.
+ */
+function recordImport(stmt, ctx) {
+    if (stmt.type !== "ImportDeclaration" ||
+        typeof stmt.source.value !== "string")
+        return false;
+    const from = stmt.source.value;
+    const specs = [];
+    for (const spec of stmt.specifiers) {
+        if (spec.type === "ImportDefaultSpecifier") {
+            specs.push({ name: spec.local.name, from });
+        }
+        else if (spec.type === "ImportSpecifier") {
+            const imported = spec.imported.type === "Identifier"
+                ? spec.imported.name
+                : String(spec.imported.value);
+            specs.push({
+                name: spec.local.name,
+                from,
+                named: true,
+                ...(imported === spec.local.name ? {} : { imported }),
+            });
+        }
+        else {
+            return false;
+        }
     }
-    if (!leftovers.length)
-        return null;
-    return { type: "mdxEsm", attrs: { value: leftovers.join("\n") } };
+    if (!specs.length)
+        return false;
+    for (const spec of specs)
+        ctx.imports[spec.name] = spec;
+    return true;
 }
 function attrsToProps(attributes) {
     const props = {};
@@ -337,7 +360,7 @@ function inlineNode(node, ctx, marks) {
             return [{ type: "rawInlineHtml", attrs: { value: node.value } }];
         case "footnoteReference":
             return [
-                withMarks({ type: "text", text: `[^${node.identifier}]` }, marks),
+                withMarks({ type: "footnoteReference", attrs: footnoteAttrs(node) }, marks),
             ];
         case "mdxJsxTextElement": {
             const converted = jsxElement(node, ctx, true);

package/dist/mdx/serialize.js

@@ -1,10 +1,21 @@
 import { gfmToMarkdown } from "mdast-util-gfm";
 import { mdxToMarkdown } from "mdast-util-mdx";
-import { toMarkdown } from "mdast-util-to-markdown";
+import { defaultHandlers, toMarkdown, } from "mdast-util-to-markdown";
 import { isPlainString, valueToSource } from "./expressions.js";
+/**
+ * Note every identifier-like word in a piece of JS source. Words inside
+ * strings or comments count too, which at worst keeps an unused import.
+ */
+function scan(source, used) {
+    for (const m of source.matchAll(IDENTIFIERS))
+        used.identifiers.add(m[0]);
+}
+const IDENTIFIER = "[\\p{ID_Start}$_][\\p{ID_Continue}$\\u200c\\u200d]*";
+const IDENTIFIERS = new RegExp(IDENTIFIER, "gu");
+const IS_IDENTIFIER = new RegExp(`^${IDENTIFIER}$`, "u");
 export function serializeMdx(doc, options = {}) {
     const isMdx = options.format !== "md";
-    const used = new Set();
+    const used = { components: new Set(), identifiers: new Set() };
     const root = {
         type: "root",
         children: blocks(doc.content ?? [], used),
@@ -32,6 +43,7 @@ export function serializeMdx(doc, options = {}) {
             rawHtml: (node) => node.value,
             rawInlineHtml: (node) => node.value,
             ...(libFlow ? { mdxJsxFlowElement: flowElementHandler(libFlow) } : {}),
+            list: listHandler(defaultHandlers.list),
         },
     });
     // Place a blank line after the import block like Prettier/MDX conventions.
@@ -72,20 +84,63 @@ function flowElementHandler(lib) {
         return `${open}\n\n${children}\n\n</${el.name ?? ""}>`;
     };
 }
+/**
+ * A tight list is written without blank lines, but some neighbouring blocks
+ * need one to stay apart (two paragraphs would merge, kind 7 HTML would join
+ * the paragraph before it, ...), and a blank line anywhere in a list makes it
+ * loose when read back. Ask the serializer's own join rules whether any
+ * neighbours in the list or its items need a blank line, and if so write the
+ * whole list loose.
+ */
+function listHandler(lib) {
+    return (node, parent, state, info) => {
+        const list = node;
+        if (!list.spread &&
+            [list, ...list.children].some((p) => needsBlankLine(p, state))) {
+            list.spread = true;
+            for (const item of list.children)
+                item.spread = true;
+        }
+        return lib(node, parent, state, info);
+    };
+}
+/** Mirrors mdast-util-to-markdown's `between`: tight only if a join says 0. */
+function needsBlankLine(parent, state) {
+    const children = parent.children;
+    for (let i = 1; i < children.length; i++) {
+        let index = state.join.length;
+        let lines;
+        while (index--) {
+            const result = state.join[index](children[i - 1], children[i], parent, state);
+            if (result === true || result === 1)
+                break;
+            if (typeof result === "number" || result === false) {
+                lines = result === false ? 1 : result;
+                break;
+            }
+        }
+        if (lines !== 0)
+            return true;
+    }
+    return false;
+}
 function importStatements(used, options) {
     const lines = new Map();
-    for (const name of used) {
+    const add = (name, spec) => {
+        if (spec)
+            lines.set(name, importLine(spec));
+    };
+    // Components get the registry's import, falling back to the source's.
+    for (const name of used.components) {
         const reg = options.components?.[name];
-        const spec = reg?.import
+        add(name, reg?.import
             ? { name, from: reg.import, named: reg.namedImport }
-            : options.existingImports?.[name];
-        if (!spec)
-            continue;
-        const line = spec.named
-            ? `import { ${spec.name} } from "${spec.from}";`
-            : `import ${spec.name} from "${spec.from}";`;
-        lines.set(name, line);
+            : options.existingImports?.[name]);
     }
+    // Anything else the source imported stays while it is still referenced.
+    for (const [name, spec] of Object.entries(options.existingImports ?? {}))
+        if (!lines.has(name) && used.identifiers.has(name))
+            add(name, spec);
     const originalOrder = Object.keys(options.existingImports ?? {});
     return [...lines.entries()]
         .sort(([a], [b]) => {
@@ -101,6 +156,17 @@ function importStatements(used, options) {
     })
         .map(([, l]) => l);
 }
+function importLine(spec) {
+    const from = JSON.stringify(spec.from);
+    if (!spec.named)
+        return `import ${spec.name} from ${from};`;
+    const imported = spec.imported === undefined || spec.imported === spec.name
+        ? ""
+        : IS_IDENTIFIER.test(spec.imported)
+            ? `${spec.imported} as `
+            : `${JSON.stringify(spec.imported)} as `;
+    return `import { ${imported}${spec.name} } from ${from};`;
+}
 function blocks(nodes, used) {
     const out = [];
     for (const node of nodes) {
@@ -134,11 +200,14 @@ function block(node, used) {
         case "bulletList":
         case "orderedList": {
             const ordered = node.type === "orderedList";
+            // Lists that must be loose to keep their content apart are loosened
+            // while serializing; see listHandler.
+            const spread = node.attrs?.spread === true;
             const items = (node.content ?? []).map((item) => {
                 const checked = item.attrs?.checked;
                 return {
                     type: "listItem",
-                    spread: false,
+                    spread,
                     checked: typeof checked === "boolean" ? checked : null,
                     children: blocks(item.content ?? [], used),
                 };
@@ -147,7 +216,7 @@ function block(node, used) {
                 type: "list",
                 ordered,
                 start: ordered ? Number(node.attrs?.start ?? 1) : null,
-                spread: false,
+                spread,
                 children: items,
             };
         }
@@ -164,13 +233,22 @@ function block(node, used) {
             return table(node, used);
         case "mdxComponent":
             return jsxElement(node, used, false);
-        case "mdxExpression":
+        case "footnoteDefinition":
             return {
-                type: "mdxFlowExpression",
-                value: String(node.attrs?.value ?? ""),
+                type: "footnoteDefinition",
+                ...footnoteLabel(node),
+                children: blocks(node.content ?? [], used),
             };
-        case "mdxEsm":
-            return { type: "mdxjsEsm", value: String(node.attrs?.value ?? "") };
+        case "mdxExpression": {
+            const value = String(node.attrs?.value ?? "");
+            scan(value, used);
+            return { type: "mdxFlowExpression", value };
+        }
+        case "mdxEsm": {
+            const value = String(node.attrs?.value ?? "");
+            scan(value, used);
+            return { type: "mdxjsEsm", value };
+        }
         case "image":
             return {
                 type: "paragraph",
@@ -184,6 +262,11 @@ function block(node, used) {
         }
     }
 }
+function footnoteLabel(node) {
+    const label = String(node.attrs?.label ?? node.attrs?.identifier ?? "");
+    const identifier = String(node.attrs?.identifier ?? label.toLowerCase());
+    return { identifier, label };
+}
 function clampDepth(n) {
     return Math.min(6, Math.max(1, Math.round(n)));
 }
@@ -210,7 +293,7 @@ function table(node, used) {
     }));
     return { type: "table", align, children };
 }
-function propsToAttributes(node, inline = false) {
+function propsToAttributes(node, used, inline = false) {
     const props = (node.attrs?.props ?? {});
     const spreads = (node.attrs?.spreads ?? []);
     const attrs = [];
@@ -224,27 +307,30 @@ function propsToAttributes(node, inline = false) {
             attrs.push({ type: "mdxJsxAttribute", name, value });
         }
         else {
+            // Block components print each attribute on its own line, indented
+            // two spaces, so nested lines are indented relative to that.
+            const source = valueToSource(value, inline ? "" : "  ");
+            scan(source, used);
             attrs.push({
                 type: "mdxJsxAttribute",
                 name,
-                value: {
-                    type: "mdxJsxAttributeValueExpression",
-                    // Block components print each attribute on its own line, indented
-                    // two spaces, so nested lines are indented relative to that.
-                    value: valueToSource(value, inline ? "" : "  "),
-                },
+                value: { type: "mdxJsxAttributeValueExpression", value: source },
             });
         }
     }
-    for (const s of spreads)
+    for (const s of spreads) {
+        scan(s, used);
         attrs.push({ type: "mdxJsxExpressionAttribute", value: s });
+    }
     return attrs;
 }
 function jsxElement(node, used, inline) {
     const name = String(node.attrs?.name ?? "");
     if (name && /^[A-Z]/.test(name))
-        used.add(name);
-    const attributes = propsToAttributes(node, inline);
+        used.components.add(name);
+    // `<ui.Card />` needs the import of `ui`.
+    scan(name, used);
+    const attributes = propsToAttributes(node, used, inline);
     if (inline) {
         return {
             type: "mdxJsxTextElement",
@@ -384,10 +470,13 @@ function leaf(node, used) {
             return [{ type: "html", value: String(node.attrs?.value ?? "") }];
         case "mdxInlineComponent":
             return [jsxElement(node, used, true)];
-        case "mdxInlineExpression":
-            return [
-                { type: "mdxTextExpression", value: String(node.attrs?.value ?? "") },
-            ];
+        case "mdxInlineExpression": {
+            const value = String(node.attrs?.value ?? "");
+            scan(value, used);
+            return [{ type: "mdxTextExpression", value }];
+        }
+        case "footnoteReference":
+            return [{ type: "footnoteReference", ...footnoteLabel(node) }];
         case "mdxComponent":
             return [jsxElement(node, used, true)];
         default:

package/dist/mdx/types.d.ts

@@ -23,6 +23,8 @@ export interface ImportSpec {
     from: string;
     /** Default or named import. */
     named?: boolean;
+    /** Exported name of a named import when it differs from `name` (`import { imported as name }`). */
+    imported?: string;
 }
 export interface ParsedDocument {
     doc: PMNode;

package/dist/ui/components/editor/RichTextEditor.js

@@ -1,10 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { TableKit } from "@tiptap/extension-table";
-import Subscript from "@tiptap/extension-subscript";
-import Superscript from "@tiptap/extension-superscript";
-import { Placeholder } from "@tiptap/extensions";
 import { EditorContent, useEditor, useEditorState, } from "@tiptap/react";
-import StarterKit from "@tiptap/starter-kit";
 import { Bold, Code, Code2, Eye, Heading1, Heading2, Heading3, Image as ImageIcon, Italic, Link as LinkIcon, List, ListOrdered, Minus, Plus, Quote, Redo2, Strikethrough, Subscript as SubIcon, Superscript as SupIcon, Table as TableIcon, Undo2, Unlink, } from "lucide-react";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { parseMdx, serializeMdx } from "../../../mdx/index.js";
@@ -14,7 +9,7 @@ import { Icon } from "../Icon.js";
 import { CodeInput } from "../fields/CodeInput.js";
 import { Button, Menu, Modal } from "../ui.js";
 import { EditorEnvContext, useEditorEnv, } from "./EditorContext.js";
-import { MdxComponent, MdxEsm, MdxExpression, MdxImage, MdxInlineComponent, MdxInlineExpression, RawHtml, RawInlineHtml, } from "./extensions.js";
+import { editorExtensions } from "./schema.js";
 /**
  * Tiptap editor that reads and writes MDX. The document is parsed once on
  * load; edits are serialized back (debounced) and reported through `onChange`.
@@ -58,28 +53,10 @@ function EditorInner({ value, onChange, components, env, format = "mdx", placeho
         existingImports: importsRef.current,
     }), [format, registry]);
     const initialDoc = useMemo(() => parse(value), []); // eslint-disable-line react-hooks/exhaustive-deps
-    const extensions = useMemo(() => [
-        StarterKit.configure({
-            heading: { levels: [1, 2, 3, 4] },
-            link: { openOnClick: false, autolink: true, defaultProtocol: "https" },
-            codeBlock: { languageClassPrefix: "language-" },
-            dropcursor: { color: "var(--v-primary)", width: 2 },
-        }),
-        Superscript,
-        Subscript,
-        MdxImage.configure({
-            resolveSrc: (src) => env.resolveImage?.(src) ?? src,
-        }),
-        TableKit.configure({ table: { resizable: false } }),
-        Placeholder.configure({ placeholder: placeholder ?? "Start writing…" }),
-        MdxComponent,
-        MdxInlineComponent,
-        MdxExpression,
-        MdxInlineExpression,
-        MdxEsm,
-        RawHtml,
-        RawInlineHtml,
-    ], [env, placeholder]);
+    const extensions = useMemo(() => editorExtensions({
+        resolveSrc: (src) => env.resolveImage?.(src) ?? src,
+        placeholder,
+    }), [env, placeholder]);
     const timer = useRef(null);
     const editor = useEditor({
         extensions,

package/dist/ui/components/editor/extensions.d.ts

@@ -1,4 +1,4 @@
-import { Node } from "@tiptap/core";
+import { Extension, Node } from "@tiptap/core";
 /** A block-level MDX component, e.g. `<Highlights items={[...]} />`. */
 export declare const MdxComponent: Node<any, any>;
 /** An inline MDX component, e.g. `<Abbr title="...">WELS</Abbr>`. */
@@ -18,3 +18,13 @@ export declare const RawInlineHtml: Node<any, any>;
 export declare const MdxImage: Node<{
     resolveSrc: (src: string) => string;
 } & Record<string, unknown>, any>;
+/**
+ * List attributes from Markdown that StarterKit's lists lack: whether a list
+ * is loose (blank lines between items; tightening it changes the rendered
+ * HTML) and a task item's checkbox (`- [ ]` / `- [x]`).
+ */
+export declare const ListAttributes: Extension<any, any>;
+/** A GFM footnote definition, `[^label]: ...`. */
+export declare const FootnoteDefinition: Node<any, any>;
+/** A GFM footnote reference, `[^label]`. */
+export declare const FootnoteReference: Node<any, any>;

package/dist/ui/components/editor/extensions.js

@@ -1,4 +1,4 @@
-import { Node, mergeAttributes } from "@tiptap/core";
+import { Extension, Node, mergeAttributes } from "@tiptap/core";
 import Image from "@tiptap/extension-image";
 import { ReactNodeViewRenderer } from "@tiptap/react";
 import { ComponentNodeView, InlineComponentNodeView, RawBlockNodeView, } from "./NodeViews.js";
@@ -154,3 +154,95 @@ export const MdxImage = Image.extend({
         ];
     },
 });
+/**
+ * List attributes from Markdown that StarterKit's lists lack: whether a list
+ * is loose (blank lines between items; tightening it changes the rendered
+ * HTML) and a task item's checkbox (`- [ ]` / `- [x]`).
+ */
+export const ListAttributes = Extension.create({
+    name: "listAttributes",
+    addGlobalAttributes() {
+        return [
+            {
+                types: ["bulletList", "orderedList"],
+                attributes: {
+                    spread: {
+                        default: false,
+                        parseHTML: (el) => el.hasAttribute("data-spread"),
+                        renderHTML: (attrs) => (attrs.spread ? { "data-spread": "" } : {}),
+                    },
+                },
+            },
+            {
+                types: ["listItem"],
+                attributes: {
+                    checked: {
+                        default: null,
+                        parseHTML: (el) => {
+                            const v = el.getAttribute("data-checked");
+                            return v === null ? null : v === "true";
+                        },
+                        renderHTML: (attrs) => typeof attrs.checked === "boolean"
+                            ? { "data-checked": String(attrs.checked) }
+                            : {},
+                    },
+                },
+            },
+        ];
+    },
+});
+const footnoteAttributes = {
+    identifier: { default: "" },
+    label: { default: "" },
+};
+/** A GFM footnote definition, `[^label]: ...`. */
+export const FootnoteDefinition = Node.create({
+    name: "footnoteDefinition",
+    group: "block",
+    content: "block+",
+    defining: true,
+    isolating: true,
+    addAttributes() {
+        return footnoteAttributes;
+    },
+    parseHTML() {
+        return [{ tag: "div[data-footnote-definition]" }];
+    },
+    renderHTML({ HTMLAttributes, node }) {
+        return [
+            "div",
+            mergeAttributes(HTMLAttributes, {
+                "data-footnote-definition": "",
+                "data-label": `[^${node.attrs.label}]`,
+                class: "v-footnote-definition",
+            }),
+            0,
+        ];
+    },
+});
+/** A GFM footnote reference, `[^label]`. */
+export const FootnoteReference = Node.create({
+    name: "footnoteReference",
+    group: "inline",
+    inline: true,
+    atom: true,
+    selectable: true,
+    addAttributes() {
+        return footnoteAttributes;
+    },
+    parseHTML() {
+        // Ahead of Superscript's `sup` rule, or a pasted reference turns into
+        // superscript text.
+        return [{ tag: "sup[data-footnote-reference]", priority: 60 }];
+    },
+    renderHTML({ HTMLAttributes, node }) {
+        return [
+            "sup",
+            mergeAttributes(HTMLAttributes, {
+                "data-footnote-reference": "",
+                class: "v-footnote-reference",
+            }),
+            `[^${node.attrs.label}]`,
+        ];
+    },
+});

package/dist/ui/components/editor/schema.d.ts

@@ -0,0 +1,12 @@
+export interface EditorExtensionOptions {
+    /** Maps a stored image path to a URL the browser can load. */
+    resolveSrc?: (src: string) => string;
+    placeholder?: string;
+}
+/**
+ * The rich text editor's extensions. Its schema must accept every node type
+ * and attribute `parseMdx` produces, or they are lost when a page is saved.
+ */
+export declare function editorExtensions(options?: EditorExtensionOptions): (import("@tiptap/core").Node<any, any> | import("@tiptap/core").Node<{
+    resolveSrc: (src: string) => string;
+} & Record<string, unknown>, any> | import("@tiptap/core").Extension<any, any> | import("@tiptap/core").Extension<import("@tiptap/starter-kit").StarterKitOptions, any> | import("@tiptap/core").Mark<import("@tiptap/extension-superscript").SuperscriptExtensionOptions, any> | import("@tiptap/core").Extension<import("@tiptap/extension-table").TableKitOptions, any> | import("@tiptap/core").Extension<import("@tiptap/extensions").PlaceholderOptions, any>)[];

package/dist/ui/components/editor/schema.js

@@ -0,0 +1,37 @@
+import { TableKit } from "@tiptap/extension-table";
+import Subscript from "@tiptap/extension-subscript";
+import Superscript from "@tiptap/extension-superscript";
+import { Placeholder } from "@tiptap/extensions";
+import StarterKit from "@tiptap/starter-kit";
+import { FootnoteDefinition, FootnoteReference, ListAttributes, MdxComponent, MdxEsm, MdxExpression, MdxImage, MdxInlineComponent, MdxInlineExpression, RawHtml, RawInlineHtml, } from "./extensions.js";
+/**
+ * The rich text editor's extensions. Its schema must accept every node type
+ * and attribute `parseMdx` produces, or they are lost when a page is saved.
+ */
+export function editorExtensions(options = {}) {
+    return [
+        StarterKit.configure({
+            heading: { levels: [1, 2, 3, 4] },
+            link: { openOnClick: false, autolink: true, defaultProtocol: "https" },
+            codeBlock: { languageClassPrefix: "language-" },
+            dropcursor: { color: "var(--v-primary)", width: 2 },
+        }),
+        Superscript,
+        Subscript,
+        MdxImage.configure({ resolveSrc: options.resolveSrc ?? ((src) => src) }),
+        TableKit.configure({ table: { resizable: false } }),
+        Placeholder.configure({
+            placeholder: options.placeholder ?? "Start writing…",
+        }),
+        MdxComponent,
+        MdxInlineComponent,
+        MdxExpression,
+        MdxInlineExpression,
+        MdxEsm,
+        RawHtml,
+        RawInlineHtml,
+        ListAttributes,
+        FootnoteDefinition,
+        FootnoteReference,
+    ];
+}

package/dist/ui/styles.css

@@ -1696,6 +1696,24 @@ a.v-chrome__chip:hover {
   padding: 0 4px;
   border-radius: 3px;
 }
+.v-footnote-reference {
+  font-family: var(--v-mono);
+  font-size: 0.7em;
+  color: #4338ca;
+}
+.v-footnote-definition {
+  position: relative;
+  margin: 0.75em 0;
+  padding-left: 1em;
+  border-left: 2px solid #c7d2fe;
+}
+.v-footnote-definition::before {
+  content: attr(data-label);
+  display: block;
+  font-family: var(--v-mono);
+  font-size: 0.75em;
+  color: #4338ca;
+}
 
 /* source editor */
 .v-source-editor .cm-editor {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vestrycms",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A git-backed CMS for Astro. Content, assets and configuration live in your repository; the control panel runs as an Astro integration.",
   "license": "MIT",
   "author": "Michael Spencer",
@@ -107,7 +107,8 @@
     "prettier-plugin-astro": "^1.1.2",
     "tsx": "^4.23.15",
     "typescript": "^6.0.3",
-    "vite": "^8.3.5"
+    "vite": "^8.3.5",
+    "vitest": "^5.1.0"
   },
   "publishConfig": {
     "access": "public"
@@ -116,8 +117,9 @@
     "build": "node scripts/build.mjs",
     "dev": "node scripts/build.mjs --watch",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "test": "node --import tsx/esm test/github-mock.ts && node --import tsx/esm test/auth.ts && node --import tsx/esm test/github-app.ts",
-    "test:roundtrip": "node --import tsx/esm test/roundtrip.ts",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:roundtrip": "node --import tsx/esm test/manual/roundtrip.ts",
     "format": "prettier --write .",
     "format:check": "prettier --check ."
   }