emdash 0.1.1 → 0.2.0

package/src/emdash-runtime.ts

@@ -9,6 +9,7 @@
 
 import type { Element } from "@emdash-cms/blocks";
 import { Kysely, sql, type Dialect } from "kysely";
+import virtualConfig from "virtual:emdash/config";
 
 import { validateRev } from "./api/rev.js";
 import type {
@@ -400,11 +401,14 @@ export class EmDashRuntime {
 		this.pluginStates.set(pluginId, status);
 		if (status === "active") {
 			this.enabledPlugins.add(pluginId);
+			await this.rebuildHookPipeline();
+			await this._hooks.runPluginActivate(pluginId);
 		} else {
+			// Fire deactivate on the current pipeline while the plugin is still in it
+			await this._hooks.runPluginDeactivate(pluginId);
 			this.enabledPlugins.delete(pluginId);
+			await this.rebuildHookPipeline();
 		}
-
-		await this.rebuildHookPipeline();
 	}
 
 	/**
@@ -1153,7 +1157,10 @@ export class EmDashRuntime {
 						label?: string;
 						required?: boolean;
 						widget?: string;
-						options?: Array<{ value: string; label: string }>;
+						// Two shapes: legacy enum-style `[{ value, label }]` for select widgets,
+						// or arbitrary `Record<string, unknown>` for plugin field widgets that
+						// need per-field config (e.g. a checkbox grid receiving its column defs).
+						options?: Array<{ value: string; label: string }> | Record<string, unknown>;
 					}
 				> = {};
 
@@ -1165,7 +1172,14 @@ export class EmDashRuntime {
 							required: field.required,
 						};
 						if (field.widget) entry.widget = field.widget;
-						// Include select/multiSelect options from validation
+						// Plugin field widgets read their per-field config from `field.options`,
+						// which the seed schema types as `Record<string, unknown>`. Pass it
+						// through to the manifest so plugin widgets in the admin SPA receive it.
+						if (field.options) {
+							entry.options = field.options;
+						}
+						// Legacy: select/multiSelect enum options live on `field.validation.options`.
+						// Wins over `field.options` to preserve existing behavior for enum widgets.
 						if (field.validation?.options) {
 							entry.options = field.validation.options.map((v) => ({
 								value: v,
@@ -1243,8 +1257,8 @@ export class EmDashRuntime {
 				version: plugin.version,
 				enabled,
 				adminMode,
-				adminPages: plugin.admin?.pages,
-				dashboardWidgets: plugin.admin?.widgets,
+				adminPages: plugin.admin?.pages ?? [],
+				dashboardWidgets: plugin.admin?.widgets ?? [],
 				portableTextBlocks: plugin.admin?.portableTextBlocks,
 				fieldWidgets: plugin.admin?.fieldWidgets,
 			};
@@ -1266,8 +1280,8 @@ export class EmDashRuntime {
 				enabled,
 				sandboxed: true,
 				adminMode: hasAdminPages || hasWidgets ? "blocks" : "none",
-				adminPages: entry.adminPages,
-				dashboardWidgets: entry.adminWidgets,
+				adminPages: entry.adminPages ?? [],
+				dashboardWidgets: entry.adminWidgets ?? [],
 			};
 		}
 
@@ -1289,26 +1303,51 @@ export class EmDashRuntime {
 				enabled,
 				sandboxed: true,
 				adminMode: hasAdminPages || hasWidgets ? "blocks" : "none",
-				adminPages: pages,
-				dashboardWidgets: widgets,
+				adminPages: pages ?? [],
+				dashboardWidgets: widgets ?? [],
 			};
 		}
 
-		// Generate hash from both collections and plugins so cache invalidates
-		// when plugins are enabled/disabled or their config changes
+		// Build taxonomies from database
+		let manifestTaxonomies: Array<{
+			name: string;
+			label: string;
+			labelSingular?: string;
+			hierarchical: boolean;
+			collections: string[];
+		}> = [];
+		try {
+			const rows = await this.db
+				.selectFrom("_emdash_taxonomy_defs")
+				.selectAll()
+				.orderBy("name")
+				.execute();
+			manifestTaxonomies = rows.map((row) => ({
+				name: row.name,
+				label: row.label,
+				labelSingular: row.label_singular ?? undefined,
+				hierarchical: row.hierarchical === 1,
+				collections: row.collections ? (JSON.parse(row.collections) as string[]).toSorted() : [],
+			}));
+		} catch (error) {
+			console.debug("EmDash: Could not load taxonomy definitions:", error);
+		}
+
+		// Build manifest hash
 		const manifestHash = await hashString(
-			JSON.stringify(manifestCollections) + JSON.stringify(manifestPlugins),
+			JSON.stringify(manifestCollections) +
+				JSON.stringify(manifestPlugins) +
+				JSON.stringify(manifestTaxonomies),
 		);
 
 		// Determine auth mode
 		const authMode = getAuthMode(this.config);
 		const authModeValue = authMode.type === "external" ? authMode.providerType : "passkey";
 
-		// Include i18n config if enabled
-		const { getI18nConfig, isI18nEnabled } = await import("./i18n/config.js");
-		const i18nConfig = getI18nConfig();
+		// Include i18n config if enabled (read from virtual module to avoid SSR module singleton mismatch)
+		const i18nConfig = virtualConfig?.i18n;
 		const i18n =
-			isI18nEnabled() && i18nConfig
+			i18nConfig && i18nConfig.locales && i18nConfig.locales.length > 1
 				? { defaultLocale: i18nConfig.defaultLocale, locales: i18nConfig.locales }
 				: undefined;
 
@@ -1317,6 +1356,7 @@ export class EmDashRuntime {
 			hash: manifestHash,
 			collections: manifestCollections,
 			plugins: manifestPlugins,
+			taxonomies: manifestTaxonomies,
 			authMode: authModeValue,
 			i18n,
 			marketplace: !!this.config.marketplace,
@@ -1805,7 +1845,10 @@ export class EmDashRuntime {
 		// resolution order in getPluginRouteMeta to avoid auth/execution mismatches.
 		const trustedPlugin = this.configuredPlugins.find((p) => p.id === pluginId);
 		if (trustedPlugin && this.enabledPlugins.has(trustedPlugin.id)) {
-			const routeRegistry = new PluginRouteRegistry({ db: this.db });
+			const routeRegistry = new PluginRouteRegistry({
+				db: this.db,
+				emailPipeline: this.email ?? undefined,
+			});
 			routeRegistry.register(trustedPlugin);
 
 			const routeKey = path.replace(LEADING_SLASH_PATTERN, "");

package/src/import/index.ts

@@ -68,7 +68,7 @@ export {
 export { validateExternalUrl, ssrfSafeFetch, SsrfError } from "./ssrf.js";
 
 // Sources
-export { wxrSource } from "./sources/wxr.js";
+export { wxrSource, parseWxrDate } from "./sources/wxr.js";
 export { wordpressRestSource } from "./sources/wordpress-rest.js";
 export {
 	wordpressPluginSource,

package/src/import/sources/wxr.ts

@@ -302,8 +302,8 @@ function wxrPostToNormalizedItem(
 		title: post.title || "Untitled",
 		content,
 		excerpt: post.excerpt,
-		date: post.postDate ? new Date(post.postDate) : new Date(),
-		modified: post.postModified ? new Date(post.postModified) : undefined,
+		date: parseWxrDate(post.postDateGmt, post.pubDate, post.postDate) ?? new Date(),
+		modified: parseWxrDate(post.postModifiedGmt, undefined, post.postModified),
 		author: post.creator,
 		categories: post.categories,
 		tags: post.tags,
@@ -317,6 +317,49 @@ function wxrPostToNormalizedItem(
 	};
 }
 
+/**
+ * WordPress uses "0000-00-00 00:00:00" as a sentinel for missing GMT dates
+ * (e.g. unpublished drafts). This must be treated as absent.
+ */
+export const WXR_ZERO_DATE = "0000-00-00 00:00:00";
+
+/**
+ * Parse a WXR date with the correct fallback chain:
+ * 1. GMT date (always UTC, most reliable)
+ * 2. pubDate (RFC 2822, includes timezone offset)
+ * 3. Site-local date (MySQL datetime without timezone, imprecise but best available)
+ *
+ * Returns undefined when none of the inputs yield a valid date.
+ * Callers that need a guaranteed Date should use `?? new Date()`.
+ */
+export function parseWxrDate(
+	gmtDate: string | undefined,
+	pubDate: string | undefined,
+	localDate: string | undefined,
+): Date | undefined {
+	if (gmtDate && gmtDate !== WXR_ZERO_DATE) {
+		// GMT dates from WordPress are "YYYY-MM-DD HH:MM:SS" in UTC.
+		// Append "Z" so the JS Date constructor treats them as UTC.
+		return new Date(gmtDate.replace(" ", "T") + "Z");
+	}
+
+	if (pubDate) {
+		// RFC 2822 format includes timezone offset, JS Date parses it correctly
+		const d = new Date(pubDate);
+		if (!isNaN(d.getTime())) return d;
+	}
+
+	if (localDate) {
+		// Site-local time without timezone. Normalize to ISO-like form so
+		// runtimes that reject "YYYY-MM-DD HH:MM:SS" can still parse it as
+		// local time. If parsing still fails, return undefined.
+		const d = new Date(localDate.replace(" ", "T"));
+		if (!isNaN(d.getTime())) return d;
+	}
+
+	return undefined;
+}
+
 // Export for use in other sources
 export { analyzeWxrData, wxrPostToNormalizedItem };
 

package/src/index.ts

@@ -290,6 +290,7 @@ export {
 	probeUrl,
 	clearSources,
 	wxrSource,
+	parseWxrDate,
 	wordpressRestSource,
 	importReusableBlocksAsSections,
 } from "./import/index.js";
@@ -336,7 +337,13 @@ export type {
 	GetPreviewUrlOptions,
 } from "./preview/index.js";
 // Site Settings
-export { getSiteSetting, getSiteSettings, setSiteSettings } from "./settings/index.js";
+export {
+	getPluginSetting,
+	getPluginSettings,
+	getSiteSetting,
+	getSiteSettings,
+	setSiteSettings,
+} from "./settings/index.js";
 export type {
 	SiteSettings,
 	SiteSettingKey,
@@ -352,6 +359,7 @@ export type { SeoMeta, SeoMetaOptions } from "./seo/index.js";
 export type {
 	PagePlacement,
 	PublicPageContext,
+	BreadcrumbItem,
 	PageMetadataEvent,
 	PageMetadataContribution,
 	PageMetadataHandler,

package/src/mcp/server.ts

@@ -10,7 +10,7 @@
  */
 
 import type { Permission, RoleLevel } from "@emdash-cms/auth";
-import { canActOnOwn, Role } from "@emdash-cms/auth";
+import { canActOnOwn, hasPermission, Role } from "@emdash-cms/auth";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
@@ -299,7 +299,7 @@ export function createMcpServer(): McpServer {
 				status: z
 					.enum(["draft", "published"])
 					.optional()
-					.describe("Initial status (default 'draft')"),
+					.describe("Initial status (default 'draft'). Requires publish permission."),
 				locale: z
 					.string()
 					.optional()
@@ -317,11 +317,47 @@ export function createMcpServer(): McpServer {
 			requireScope(extra, "content:write");
 			requireRole(extra, Role.CONTRIBUTOR);
 			const { emdash, userId } = getExtra(extra);
+
+			// Creating a translation requires edit permission on the source item
+			if (args.translationOf) {
+				const source = await emdash.handleContentGet(args.collection, args.translationOf);
+				if (!source.success) return unwrap(source);
+				requireOwnership(
+					extra,
+					extractContentAuthorId(source.data),
+					"content:edit_own",
+					"content:edit_any",
+				);
+			}
+
+			// Publishing requires publish permission — create as draft then publish
+			if (args.status === "published") {
+				const user = { id: userId, role: getExtra(extra).userRole };
+				if (!hasPermission(user, "content:publish_own" as Permission)) {
+					throw new McpError(
+						ErrorCode.InvalidRequest,
+						"Insufficient permissions: publishing requires content:publish_own",
+					);
+				}
+				const result = await emdash.handleContentCreate(args.collection, {
+					data: args.data,
+					slug: args.slug,
+					authorId: userId,
+					locale: args.locale,
+					translationOf: args.translationOf,
+				});
+				if (!result.success) return unwrap(result);
+				const itemId = extractContentId(result.data);
+				if (itemId) {
+					return unwrap(await emdash.handleContentPublish(args.collection, itemId));
+				}
+				return unwrap(result);
+			}
+
 			return unwrap(
 				await emdash.handleContentCreate(args.collection, {
 					data: args.data,
 					slug: args.slug,
-					status: args.status,
 					authorId: userId,
 					locale: args.locale,
 					translationOf: args.translationOf,
@@ -347,7 +383,12 @@ export function createMcpServer(): McpServer {
 					.optional()
 					.describe("Field values to update (only include changed fields)"),
 				slug: z.string().optional().describe("New URL slug"),
-				status: z.enum(["draft", "published"]).optional().describe("New status"),
+				status: z
+					.enum(["draft", "published"])
+					.optional()
+					.describe(
+						"New status. Setting to 'published' requires publish permission. Setting to 'draft' unpublishes the item and also requires publish permission.",
+					),
 				_rev: z
 					.string()
 					.optional()
@@ -372,11 +413,50 @@ export function createMcpServer(): McpServer {
 			);
 
 			const resolvedId = extractContentId(existing.data) ?? args.id;
+
+			// Status transitions route through dedicated handlers for proper revision management
+			if (args.status === "published") {
+				requireOwnership(
+					extra,
+					extractContentAuthorId(existing.data),
+					"content:publish_own",
+					"content:publish_any",
+				);
+				if (args.data || args.slug) {
+					const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
+						data: args.data,
+						slug: args.slug,
+						authorId: userId,
+						_rev: args._rev,
+					});
+					if (!updateResult.success) return unwrap(updateResult);
+				}
+				return unwrap(await emdash.handleContentPublish(args.collection, resolvedId));
+			}
+
+			if (args.status === "draft") {
+				requireOwnership(
+					extra,
+					extractContentAuthorId(existing.data),
+					"content:publish_own",
+					"content:publish_any",
+				);
+				if (args.data || args.slug) {
+					const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
+						data: args.data,
+						slug: args.slug,
+						authorId: userId,
+						_rev: args._rev,
+					});
+					if (!updateResult.success) return unwrap(updateResult);
+				}
+				return unwrap(await emdash.handleContentUnpublish(args.collection, resolvedId));
+			}
+
 			return unwrap(
 				await emdash.handleContentUpdate(args.collection, resolvedId, {
 					data: args.data,
 					slug: args.slug,
-					status: args.status,
 					authorId: userId,
 					_rev: args._rev,
 				}),

package/src/menus/index.ts

@@ -9,6 +9,7 @@ import { sql } from "kysely";
 
 import type { Database } from "../database/types.js";
 import { getDb } from "../loader.js";
+import { sanitizeHref } from "../utils/url.js";
 import type { Menu, MenuItem, MenuItemRow } from "./types.js";
 
 /**
@@ -235,7 +236,7 @@ async function resolveMenuItem(
 	return {
 		id: item.id,
 		label: item.label,
-		url,
+		url: sanitizeHref(url),
 		target: item.target || undefined,
 		titleAttr: item.title_attr || undefined,
 		cssClasses: item.css_classes || undefined,

package/src/page/context.ts

@@ -5,13 +5,14 @@
  * The resulting context is passed to EmDashHead / EmDashBodyStart / EmDashBodyEnd.
  */
 
-import type { PublicPageContext } from "../plugins/types.js";
+import type { BreadcrumbItem, PublicPageContext } from "../plugins/types.js";
 
 /** Fields shared by both input forms */
 interface PageContextFields {
 	kind: "content" | "custom";
 	pageType?: string;
 	title?: string | null;
+	pageTitle?: string | null;
 	description?: string | null;
 	canonical?: string | null;
 	image?: string | null;
@@ -31,6 +32,14 @@ interface PageContextFields {
 	};
 	/** Site name for structured data and og:site_name */
 	siteName?: string;
+	/**
+	 * Breadcrumb trail for this page, root first. Pass an empty array
+	 * to explicitly opt out of breadcrumbs (e.g. homepage), or omit the
+	 * field to let consumers fall back to their own derivation.
+	 */
+	breadcrumbs?: BreadcrumbItem[];
+	/** Public-facing site URL (origin) for structured data */
+	siteUrl?: string;
 }
 
 /** Input with Astro global -- used in .astro files */
@@ -76,6 +85,7 @@ export function createPublicPageContext(input: CreatePublicPageContextInput): Pu
 		kind: input.kind,
 		pageType: input.pageType ?? (input.kind === "content" ? "article" : "website"),
 		title: input.title ?? null,
+		pageTitle: input.pageTitle ?? null,
 		description: input.description ?? null,
 		canonical: input.canonical ?? null,
 		image: input.image ?? null,
@@ -89,5 +99,7 @@ export function createPublicPageContext(input: CreatePublicPageContextInput): Pu
 		seo: input.seo,
 		articleMeta: input.articleMeta,
 		siteName: input.siteName,
+		breadcrumbs: input.breadcrumbs,
+		siteUrl: input.siteUrl,
 	};
 }

package/src/page/jsonld.ts

@@ -33,7 +33,7 @@ export function cleanJsonLd(obj: Record<string, unknown>): Record<string, unknow
 export function buildBlogPostingJsonLd(page: PublicPageContext): Record<string, unknown> | null {
 	if (page.pageType !== "article" || !page.canonical) return null;
 
-	const ogTitle = page.seo?.ogTitle || page.title;
+	const ogTitle = page.seo?.ogTitle ?? page.pageTitle ?? page.title;
 	const description = page.seo?.ogDescription || page.description;
 	const ogImage = page.seo?.ogImage || page.image;
 	const publishedTime = page.articleMeta?.publishedTime;
@@ -77,12 +77,16 @@ export function buildWebSiteJsonLd(page: PublicPageContext): Record<string, unkn
 	const siteName = page.siteName;
 	if (!siteName) return null;
 
-	// Use origin from the page URL for the site URL
+	// Use configured public origin, falling back to page URL origin
 	let siteUrl: string;
-	try {
-		siteUrl = new URL(page.url).origin;
-	} catch {
-		siteUrl = page.canonical || page.url;
+	if (page.siteUrl) {
+		siteUrl = page.siteUrl;
+	} else {
+		try {
+			siteUrl = new URL(page.url).origin;
+		} catch {
+			siteUrl = page.canonical || page.url;
+		}
 	}
 
 	return cleanJsonLd({

package/src/page/seo-contributions.ts

@@ -20,7 +20,7 @@ export function generateBaseSeoContributions(page: PublicPageContext): PageMetad
 	const contributions: PageMetadataContribution[] = [];
 
 	const description = page.description;
-	const ogTitle = page.seo?.ogTitle || page.title;
+	const ogTitle = page.seo?.ogTitle ?? page.pageTitle ?? page.title;
 	const ogDescription = page.seo?.ogDescription || description;
 	const ogImage = page.seo?.ogImage || page.image;
 	const robots = page.seo?.robots;