// emdash.config.ts — AWS deployment
import { defineConfig } from "emdash";
import { awsAdapter } from "emdash/adapters/aws";

export default defineConfig({
  site: {
    name: "My EmDash Site",
    url: "https://cms.example.com",
  },
  adapter: awsAdapter({
    database: {
      type: "postgres",
      connectionString: process.env.DATABASE_URL,
    },
    storage: {
      type: "s3",
      bucket: process.env.S3_BUCKET,
      region: process.env.AWS_REGION,
    },
    kv: {
      type: "dynamodb",
      tableName: process.env.DYNAMODB_TABLE,
    },
  }),
  plugins: [
    "./plugins/my-analytics-plugin",
  ],
});

# Dockerfile
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./
COPY --from=builder /app/plugins ./plugins

EXPOSE 4321
CMD ["node", "dist/server/entry.mjs"]

{
  "family": "emdash-site",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "256",
  "memory": "512",
  "containerDefinitions": [
    {
      "name": "emdash",
      "image": "<account-id>.dkr.ecr.<region>.amazonaws.com/emdash:latest",
      "portMappings": [
        { "containerPort": 4321, "protocol": "tcp" }
      ],
      "environment": [
        { "name": "NODE_ENV", "value": "production" },
        { "name": "AWS_REGION", "value": "us-east-1" },
        { "name": "S3_BUCKET", "value": "emdash-media" },
        { "name": "DYNAMODB_TABLE", "value": "emdash-plugin-kv" }
      ],
      "secrets": [
        {
          "name": "DATABASE_URL",
          "valueFrom": "arn:aws:secretsmanager:<region>:<account>:secret:emdash/db-url"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/emdash",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "emdash"
        }
      }
    }
  ]
}

# Create ECR repository
aws ecr create-repository --repository-name emdash

# Build and push Docker image
docker build -t emdash .
docker tag emdash:latest <account-id>.dkr.ecr.<region>.amazonaws.com/emdash:latest
aws ecr get-login-password | docker login --username AWS --password-stdin <account-id>.dkr.ecr.<region>.amazonaws.com
docker push <account-id>.dkr.ecr.<region>.amazonaws.com/emdash:latest

# Register task definition
aws ecs register-task-definition --cli-input-json file://task-definition.json

# Create ECS service with ALB
aws ecs create-service \
  --cluster emdash-cluster \
  --service-name emdash-service \
  --task-definition emdash-site \
  --desired-count 1 \
  --launch-type FARGATE \
  --network-configuration "awsvpcConfiguration={subnets=[subnet-xxx],securityGroups=[sg-xxx],assignPublicIp=ENABLED}" \
  --load-balancers "targetGroupArn=arn:aws:elasticloadbalancing:...,containerName=emdash,containerPort=4321"

# Launch an EC2 instance (Amazon Linux 2023, t4g.small)
# t4g.small: 2 vCPU, 2 GB RAM, ~$12/month

# SSH in and install Node.js 20
sudo dnf install -y nodejs20

# Clone your EmDash site
git clone https://github.com/your-org/emdash-site.git
cd emdash-site

# Install dependencies and build
npm ci
npm run build

# Install pm2 for process management
npm install -g pm2

# Start EmDash with pm2
pm2 start dist/server/entry.mjs --name emdash
pm2 save
pm2 startup

# /etc/nginx/conf.d/emdash.conf
server {
    listen 80;
    server_name cms.example.com;

    location / {
        proxy_pass http://127.0.0.1:4321;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

# Enable HTTPS with Let's Encrypt
# sudo certbot --nginx -d cms.example.com

// lambda-handler.ts
import { handler as astroHandler } from "./dist/server/entry.mjs";

export const handler = async (event, context) => {
  // Convert API Gateway event to standard Request
  const request = new Request(
    `https://${event.headers.host}${event.rawPath}`,
    {
      method: event.requestContext.http.method,
      headers: event.headers,
      body: event.body ? event.body : undefined,
    }
  );

  const response = await astroHandler(request);

  return {
    statusCode: response.status,
    headers: Object.fromEntries(response.headers.entries()),
    body: await response.text(),
    isBase64Encoded: false,
  };
};

# Deploy with AWS SAM
# template.yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  EmDashFunction:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda-handler.handler
      Runtime: nodejs20.x
      MemorySize: 512
      Timeout: 30
      Environment:
        Variables:
          DATABASE_URL: !Sub '{{resolve:secretsmanager:emdash/db-url}}'
          S3_BUCKET: !Ref MediaBucket
          DYNAMODB_TABLE: !Ref PluginKVTable
      Events:
        Api:
          Type: HttpApi

# Create an RDS PostgreSQL instance
aws rds create-db-instance \
  --db-instance-identifier emdash-db \
  --db-instance-class db.t4g.micro \
  --engine postgres \
  --engine-version 16.4 \
  --master-username emdash_admin \
  --master-user-password <secure-password> \
  --allocated-storage 20 \
  --storage-type gp3 \
  --vpc-security-group-ids sg-xxx \
  --db-subnet-group-name emdash-db-subnet \
  --no-publicly-accessible

# Store the connection string in Secrets Manager
aws secretsmanager create-secret \
  --name emdash/db-url \
  --secret-string "postgresql://emdash_admin:<password>@<endpoint>:5432/emdash"

# Run migrations (from your local machine or CI)
DATABASE_URL="postgresql://..." npx emdash db migrate

# Seed initial content (optional)
DATABASE_URL="postgresql://..." npx emdash db seed

# Create S3 bucket for media
aws s3 mb s3://emdash-media-<account-id>

# Block public access (serve via CloudFront OAC)
aws s3api put-public-access-block \
  --bucket emdash-media-<account-id> \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,\
    BlockPublicPolicy=true,RestrictPublicBuckets=true

# Create CloudFront distribution with OAC
aws cloudfront create-distribution \
  --origin-domain-name emdash-media-<account-id>.s3.us-east-1.amazonaws.com \
  --default-cache-behavior '{"ViewerProtocolPolicy":"redirect-to-https","AllowedMethods":{"Quantity":2,"Items":["GET","HEAD"]},"CachedMethods":{"Quantity":2,"Items":["GET","HEAD"]},"TargetOriginId":"S3","ForwardedValues":{"QueryString":false,"Cookies":{"Forward":"none"}}}'

adapter: awsAdapter({
  storage: {
    type: "s3",
    bucket: "emdash-media-123456789",
    region: "us-east-1",
    cdnUrl: "https://d1234abcdef.cloudfront.net",
  },
}),

# Create DynamoDB table for plugin KV
aws dynamodb create-table \
  --table-name emdash-plugin-kv \
  --attribute-definitions \
    AttributeName=pk,AttributeType=S \
    AttributeName=sk,AttributeType=S \
  --key-schema \
    AttributeName=pk,KeyType=HASH \
    AttributeName=sk,KeyType=RANGE \
  --billing-mode PAY_PER_REQUEST

# Table schema:
# pk = "plugin:<plugin-name>"
# sk = "<key>"
# value = "<value>"
# ttl = <optional-expiry-timestamp>

// Plugin code — identical on Cloudflare and AWS
await kv.put("views:hello-world", "42");
const views = await kv.get("views:hello-world");

// On Cloudflare: Workers KV namespace "my-analytics-plugin"
// On AWS: DynamoDB item { pk: "plugin:my-analytics-plugin", sk: "views:hello-world", value: "42" }

// How EmDash enforces capabilities on Node.js (simplified)
// The plugin receives a Proxy-wrapped context object

const pluginContext = new Proxy(fullContext, {
  get(target, prop) {
    // Plugin declared "content:read" but not "content:write"
    if (prop === "content") {
      return new Proxy(target.content, {
        get(contentTarget, contentProp) {
          if (["create", "update", "delete"].includes(contentProp)) {
            throw new Error(
              `CapabilityViolation: Plugin "${pluginName}" \
attempted to use "content:write" (${contentProp}) \
but only "content:read" is declared.`
            );
          }
          return contentTarget[contentProp];
        },
      });
    }
    // Block undeclared capabilities entirely
    if (prop === "email" && !capabilities.includes("email:send")) {
      return undefined;
    }
    return target[prop];
  },
});

// emdash.config.ts — enable process isolation for plugins
adapter: awsAdapter({
  plugins: {
    isolation: "worker_thread", // "none" | "worker_thread" | "process"
    // "none": same process (fastest, weakest isolation)
    // "worker_thread": separate V8 context (good balance)
    // "process": child process (strongest, most overhead)
  },
}),

# .github/workflows/deploy.yml
name: Deploy EmDash to ECS
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::<account>:role/github-deploy
          aws-region: us-east-1

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push image
        run: |
          docker build -t emdash .
          docker tag emdash:latest <account>.dkr.ecr.us-east-1.amazonaws.com/emdash:latest
          docker push <account>.dkr.ecr.us-east-1.amazonaws.com/emdash:latest

      - name: Run database migrations
        run: |
          DATABASE_URL=${{ secrets.DATABASE_URL }} npx emdash db migrate

      - name: Deploy to ECS
        uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          task-definition: task-definition.json
          service: emdash-service
          cluster: emdash-cluster
          wait-for-service-stability: true