emdash 0.18.0 → 0.20.0

package/src/media/responsive.ts

@@ -0,0 +1,125 @@
+/**
+ * Responsive image helpers shared by the public Image components.
+ *
+ * These build a `srcset` for locally-stored / R2-stored media by delegating to
+ * Astro's configured image service (`astro:assets`). On Cloudflare that is the
+ * Images binding; on Node it is sharp; if neither is available it is a no-op
+ * passthrough. The calling `.astro` component passes Astro's `getImage` in so
+ * this module stays free of the `astro:assets` virtual import (which only
+ * resolves inside an Astro project, not in this precompiled package).
+ */
+
+/** Standard responsive breakpoints. Matches CDN-provider srcset generation. */
+export const RESPONSIVE_BREAKPOINTS = [640, 750, 828, 960, 1080, 1280, 1600, 1920];
+
+/** Matches absolute http(s) URLs — the only shape Astro's image services optimize. */
+const ABSOLUTE_HTTP_URL = /^https?:\/\//i;
+
+/**
+ * Pick the srcset widths to generate for an image rendered at `maxWidth`.
+ * Includes breakpoints up to 2x (retina) plus the rendered width itself, so the
+ * browser always has an exact-fit candidate.
+ */
+export function responsiveWidths(maxWidth: number): number[] {
+	const cap = maxWidth * 2;
+	const widths = new Set(RESPONSIVE_BREAKPOINTS.filter((w) => w <= cap));
+	widths.add(maxWidth);
+	return [...widths].toSorted((a, b) => a - b);
+}
+
+/** Build the `sizes` attribute for an image with a known display width. */
+export function responsiveSizes(width: number | undefined): string {
+	return width ? `(min-width: ${width}px) ${width}px, 100vw` : "100vw";
+}
+
+/**
+ * Make a same-origin media URL absolute so Astro's image service can optimize it.
+ *
+ * Astro only optimizes absolute http(s) URLs; a same-origin proxy path like
+ * `/_emdash/api/media/file/x.jpg` is otherwise treated as an unoptimizable
+ * public asset. Resolving it against the site's public origin (and authorizing
+ * that origin via `image.remotePatterns`) lets the service transform it.
+ *
+ * Only **same-origin** root-relative paths are resolved. Protocol-relative
+ * URLs (`//evil.com/x`) and backslash tricks (`/\evil.com`) also start with `/`
+ * but resolve to a different origin -- a classic SSRF vector once a
+ * remotePattern authorizes the media path -- so anything that escapes the
+ * origin is returned unchanged (and then skipped by `buildResponsiveImage`,
+ * which only accepts absolute http(s) URLs). Already-absolute URLs (CDN/public
+ * bucket) and non-path values (`data:`, `blob:`) are returned unchanged too.
+ */
+export function toAbsoluteMediaUrl(src: string, origin: string | undefined): string {
+	if (!src || !origin || !src.startsWith("/")) return src;
+	try {
+		const resolved = new URL(src, origin);
+		if (resolved.origin !== new URL(origin).origin) return src;
+		return resolved.href;
+	} catch {
+		return src;
+	}
+}
+
+/**
+ * Minimal structural subset of Astro's `getImage`. Astro's `ImageTransform`
+ * carries a `[key: string]: any` index signature, so the real `getImage` is
+ * assignable to this narrower type.
+ */
+export type GetImage = (options: {
+	src: string;
+	width?: number;
+	height?: number;
+	widths?: number[];
+	sizes?: string;
+}) => Promise<{ src: string; srcSet?: { attribute?: string } | undefined }>;
+
+export interface ResponsiveImage {
+	src: string;
+	srcset?: string;
+	sizes?: string;
+}
+
+/**
+ * Generate a responsive `src`/`srcset`/`sizes` for a media URL via Astro's
+ * configured image service.
+ *
+ * Astro's image services (sharp, Cloudflare `/cdn-cgi/image`, and the default
+ * Cloudflare `cloudflare-binding` service) only optimize **absolute** URLs whose
+ * host is authorized via `image.domains` / `image.remotePatterns`. Anything else
+ * is passed through unchanged, which would yield a useless srcset (the same URL
+ * at every width descriptor). We therefore only attempt optimization for
+ * absolute http(s) URLs and verify the service actually rewrote the URL.
+ *
+ * Returns `null` so callers fall back to a plain `<img>` when:
+ *  - dimensions are unknown (avoids an inferSize fetch on every render),
+ *  - the URL is relative (a same-origin proxy/public asset Astro won't optimize),
+ *  - the host isn't authorized (the service passed the URL through unchanged),
+ *  - no image service is configured / `getImage` throws.
+ */
+export async function buildResponsiveImage(
+	getImage: GetImage,
+	opts: { src: string; width?: number; height?: number },
+): Promise<ResponsiveImage | null> {
+	const { src, width, height } = opts;
+	if (!src || !width || !height) return null;
+	if (!ABSOLUTE_HTTP_URL.test(src)) return null;
+	try {
+		const sizes = responsiveSizes(width);
+		const result = await getImage({
+			src,
+			width,
+			height,
+			widths: responsiveWidths(width),
+			sizes,
+		});
+		// Passthrough: the service returned the source unchanged (unauthorized
+		// host or no optimization available). Don't emit a no-op srcset.
+		if (!result.src || result.src === src) return null;
+		return {
+			src: result.src,
+			srcset: result.srcSet?.attribute || undefined,
+			sizes,
+		};
+	} catch {
+		return null;
+	}
+}

package/src/plugins/cron.ts

@@ -34,8 +34,9 @@ export type RescheduleFn = () => void;
 /**
  * Executes overdue cron tasks.
  *
- * Called by platform-specific schedulers (NodeCronScheduler, EmDashScheduler DO,
- * PiggybackScheduler). Stateless — all state lives in the database.
+ * Called by the platform driver: the NodeCronScheduler timer on Node, or the
+ * Worker's `scheduled()` handler (via runScheduledTasks) on Cloudflare.
+ * Stateless — all state lives in the database.
  */
 export class CronExecutor {
 	constructor(

package/src/plugins/index.ts

@@ -63,6 +63,11 @@ export type { RouteResult, InvokeRouteOptions } from "./routes.js";
 export { PluginManager, createPluginManager } from "./manager.js";
 export type { PluginManagerOptions, PluginState } from "./manager.js";
 
+// Scheduler (Node timer-based heartbeat; consumed by the generated
+// virtual:emdash/scheduler module on non-serverless adapters)
+export { NodeCronScheduler } from "./scheduler/node.js";
+export type { CronScheduler, SystemCleanupFn } from "./scheduler/types.js";
+
 // Sandbox
 export {
 	NoopSandboxRunner,

package/src/plugins/manifest-schema.ts

@@ -8,8 +8,14 @@
  * - Marketplace ingest extends this with publishing-specific fields
  */
 
+import {
+	capabilitiesToDeclaredAccess,
+	declaredAccessToCapabilities,
+} from "@emdash-cms/plugin-types";
 import { z } from "zod";
 
+import type { PluginManifest } from "./types.js";
+
 // ── Enum values (must stay in sync with types.ts) ───────────────
 
 /**
@@ -219,16 +225,63 @@ const pluginAdminConfigSchema = z.object({
 		.optional(),
 });
 
+// ── declaredAccess ──────────────────────────────────────────────
+
+/**
+ * An operation's constraint object. Open vocabulary: keys the runtime
+ * recognises are enforced, others are advisory. The bundler emits `{}` for a
+ * granted operation; presence (not value) signals the grant.
+ */
+const accessConstraints = z.record(z.string(), z.unknown());
+
+/**
+ * Structured trust contract embedded in the bundle manifest. Mirrors
+ * `DeclaredAccess` in `@emdash-cms/plugin-types`. Categories are host
+ * subsystems; operations are modes of participation.
+ */
+const declaredAccessSchema = z.object({
+	content: z
+		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
+		.optional(),
+	media: z
+		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
+		.optional(),
+	network: z
+		.object({
+			// allowedHosts: absent = unrestricted; present = host-restricted. Reject
+			// an empty array (which the decoder would otherwise have to treat as
+			// deny-all) to match the record lexicon's `minLength: 1` and keep the
+			// "absent vs empty" distinction from ever reaching enforcement ambiguous.
+			request: z.object({ allowedHosts: z.array(z.string()).min(1).optional() }).optional(),
+		})
+		.optional(),
+	email: z
+		.object({
+			send: accessConstraints.optional(),
+			events: accessConstraints.optional(),
+			transport: accessConstraints.optional(),
+		})
+		.optional(),
+	page: z.object({ fragments: accessConstraints.optional() }).optional(),
+	users: z.object({ read: accessConstraints.optional() }).optional(),
+});
+
 // ── Main schema ─────────────────────────────────────────────────
 
 /**
  * Zod schema matching the PluginManifest interface from types.ts.
  *
  * Every JSON.parse of a manifest.json should validate through this.
+ *
+ * `declaredAccess` is the trust contract; `capabilities`/`allowedHosts` are the
+ * runtime's enforcement currency. Apply `reconcileManifestAccess` after parsing
+ * to make them consistent (declaredAccess authoritative when present). Kept a
+ * plain object (no `.transform`) because callers `.pick()`/`.extend()` it.
  */
 export const pluginManifestSchema = z.object({
 	id: z.string().min(1),
 	version: z.string().min(1),
+	declaredAccess: declaredAccessSchema.optional(),
 	capabilities: z.array(z.enum(PLUGIN_CAPABILITIES)),
 	allowedHosts: z.array(z.string()),
 	storage: z.record(z.string(), storageCollectionSchema),
@@ -254,6 +307,28 @@ export const pluginManifestSchema = z.object({
 
 export type ValidatedPluginManifest = z.infer<typeof pluginManifestSchema>;
 
+/**
+ * Reconcile a parsed manifest's trust contract with its enforcement currency.
+ * `declaredAccess` is authoritative: when present, `capabilities`/`allowedHosts`
+ * are re-derived from it so what the runtime enforces always matches what was
+ * recorded and consented to. A pre-migration bundle without `declaredAccess`
+ * has it derived from the legacy capability list instead. The result always
+ * carries both, mutually consistent. Apply this at every bundle-parse site.
+ */
+export function reconcileManifestAccess(manifest: ValidatedPluginManifest): PluginManifest {
+	const reconciled: ValidatedPluginManifest = manifest.declaredAccess
+		? { ...manifest, ...declaredAccessToCapabilities(manifest.declaredAccess) }
+		: {
+				...manifest,
+				declaredAccess: capabilitiesToDeclaredAccess(manifest.capabilities, manifest.allowedHosts),
+			};
+	// Block Kit admin elements are typed as `unknown` by the Zod schema (their
+	// Element shape is validated at render time), so the validated manifest
+	// needs a structural cast up to the runtime PluginManifest.
+	// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- admin elements are unknown[] in Zod; Element type checked at render time
+	return reconciled as unknown as PluginManifest;
+}
+
 /**
  * Normalize a manifest hook entry — plain strings become `{ name }` objects.
  */

package/src/plugins/marketplace.ts

@@ -8,7 +8,7 @@
 
 import { createGzipDecoder, unpackTar } from "modern-tar";
 
-import { pluginManifestSchema } from "./manifest-schema.js";
+import { pluginManifestSchema, reconcileManifestAccess } from "./manifest-schema.js";
 import type { PluginManifest } from "./types.js";
 
 // ── Module-level regex patterns ───────────────────────────────────
@@ -495,10 +495,7 @@ export async function extractBundle(tarballBytes: Uint8Array): Promise<PluginBun
 				"INVALID_BUNDLE",
 			);
 		}
-		// Elements are validated as unknown[] by Zod; cast to PluginManifest
-		// for the Element[] type (Block Kit validation happens at render time).
-		// eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Zod types elements as unknown[]; Element type validated at render time
-		manifest = result.data as unknown as PluginManifest;
+		manifest = reconcileManifestAccess(result.data);
 	} catch (err) {
 		if (err instanceof MarketplaceError) throw err;
 		throw new MarketplaceError(

package/src/plugins/scheduler/node.ts

@@ -15,8 +15,15 @@ import type { CronScheduler, SystemCleanupFn } from "./types.js";
 /** Minimum polling interval (ms) — prevents tight loops if next_run_at is in the past */
 const MIN_INTERVAL_MS = 1000;
 
-/** Maximum polling interval (ms) — wake up periodically to check for stale locks */
-const MAX_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * Maximum polling interval (ms). Each wake runs the maintenance pass — stale
+ * lock recovery *and* the scheduled-publishing sweep + system cleanup. The cap
+ * is the worst-case latency for scheduled content when no plugin cron task is
+ * due sooner (`getNextDueTime()` only knows about cron tasks, not content
+ * `scheduled_at`). Held at 60s so Node publish latency matches the Cloudflare
+ * Cron Trigger cadence (`* * * * *`) rather than lagging up to five minutes.
+ */
+const MAX_INTERVAL_MS = 60 * 1000;
 
 export class NodeCronScheduler implements CronScheduler {
 	private timer: ReturnType<typeof setTimeout> | null = null;

package/src/plugins/types.ts

@@ -19,10 +19,13 @@ import type { Element } from "@emdash-cms/blocks";
 // (e.g. `import { PluginCapability } from "../plugins/types.js"`).
 import {
 	CAPABILITY_RENAMES,
+	capabilitiesToDeclaredAccess,
+	declaredAccessToCapabilities,
 	isDeprecatedCapability,
 	normalizeCapabilities,
 	normalizeCapability,
 	type CurrentPluginCapability,
+	type DeclaredAccess,
 	type DeprecatedPluginCapability,
 	type ManifestHookEntry,
 	type ManifestRouteEntry,
@@ -40,10 +43,13 @@ import type { FieldType } from "../schema/types.js";
 
 export {
 	CAPABILITY_RENAMES,
+	capabilitiesToDeclaredAccess,
+	declaredAccessToCapabilities,
 	isDeprecatedCapability,
 	normalizeCapabilities,
 	normalizeCapability,
 	type CurrentPluginCapability,
+	type DeclaredAccess,
 	type DeprecatedPluginCapability,
 	type ManifestHookEntry,
 	type ManifestRouteEntry,
@@ -1336,6 +1342,12 @@ export interface PluginAdminExports {
 export interface PluginManifest {
 	id: string;
 	version: string;
+	/**
+	 * The trust contract (see `@emdash-cms/plugin-types`). Authoritative;
+	 * `capabilities`/`allowedHosts` are derived from it at the parse boundary
+	 * via `reconcileManifestAccess`. Optional during the wire-format migration.
+	 */
+	declaredAccess?: DeclaredAccess;
 	capabilities: PluginCapability[];
 	allowedHosts: string[];
 	storage: PluginStorageConfig;

package/src/query.ts

@@ -101,13 +101,19 @@ export interface CollectionFilter {
 	 */
 	cursor?: string;
 	/**
-	 * Filter by field values, taxonomy terms, or ranges.
+	 * Filter by field values, taxonomy terms, byline credits, or ranges.
 	 *
 	 * Taxonomy names are detected automatically and filtered via JOIN.
+	 * The reserved `byline` key filters by byline credit (any credit, not
+	 * just the primary one) via the `_emdash_content_bylines` junction
+	 * table; its value is one or more byline translation groups. This
+	 * matches co-authored entries, which `primary_byline_id` alone misses.
 	 * Other keys are treated as column filters on the content table.
 	 *
 	 * @example { category: 'news' } - Filter by taxonomy term
 	 * @example { category: ['news', 'featured'] } - Filter by multiple terms (OR)
+	 * @example { byline: '01HXYZ...' } - Entries credited to a byline (any position)
+	 * @example { byline: ['01HXYZ...', '01HABC...'] } - Credited to any of these bylines (OR)
 	 * @example { series: 'main' } - Exact match on a content field
 	 * @example { published_at: { gte: '2024-01-01', lt: '2025-01-01' } } - Date range
 	 */
@@ -241,6 +247,17 @@ function dataStr(data: Record<string, unknown>, key: string, fallback = ""): str
 	return typeof val === "string" ? val : fallback;
 }
 
+/** Safely read a date-like field from a Record */
+function dataDate(data: Record<string, unknown>, key: string): Date | undefined {
+	const val = data[key];
+	if (val instanceof Date) {
+		return Number.isNaN(val.getTime()) ? undefined : val;
+	}
+	if (typeof val !== "string" && typeof val !== "number") return undefined;
+	const date = new Date(val);
+	return Number.isNaN(date.getTime()) ? undefined : date;
+}
+
 /** Type guard for Record<string, unknown> */
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -533,7 +550,9 @@ async function getEmDashCollectionUncached<T extends string, D = InferCollection
 	// round-trip cost on remote databases (D1 replicas, etc.).
 	await Promise.all([
 		hydrateEntryBylines(type, entriesWithEdit),
-		hydrateEntryTerms(type, entriesWithEdit),
+		// Hydrate terms in the same locale the content rows were resolved to,
+		// otherwise localized entries get default-locale taxonomy terms (#1441).
+		hydrateEntryTerms(type, entriesWithEdit, resolvedLocale),
 	]);
 
 	return { entries: entriesWithEdit, nextCursor, cacheHint: cacheHint ?? {} };
@@ -594,10 +613,10 @@ export async function getEmDashEntry<T extends string, D = InferCollectionData<T
 	function isVisible(entry: ContentEntry<D>): boolean {
 		const data = entryData(entry);
 		const status = dataStr(data, "status");
-		const scheduledAt = dataStr(data, "scheduledAt") || undefined;
+		const scheduledAt = dataDate(data, "scheduledAt");
 		const isPublished = status === "published";
 		const isScheduledAndReady =
-			status === "scheduled" && scheduledAt && new Date(scheduledAt) <= new Date();
+			status === "scheduled" && scheduledAt !== undefined && scheduledAt.getTime() <= Date.now();
 		return isPublished || !!isScheduledAndReady;
 	}
 
@@ -611,7 +630,17 @@ export async function getEmDashEntry<T extends string, D = InferCollectionData<T
 		wrapped: ContentEntry<D>,
 		opts: { isPreview: boolean; fallbackLocale?: string; cacheHint: CacheHint },
 	): Promise<EntryResult<D>> {
-		await Promise.all([hydrateEntryBylines(type, [wrapped]), hydrateEntryTerms(type, [wrapped])]);
+		// Hydrate terms in the entry's resolved locale (fallback-aware) so a
+		// localized entry never picks up default-locale taxonomy terms (#1441).
+		// When i18n is disabled we leave the locale unset to preserve the
+		// legacy "do not filter by locale" behaviour.
+		const termLocale = isI18nEnabled()
+			? dataStr(entryData(wrapped), "locale") || undefined
+			: undefined;
+		await Promise.all([
+			hydrateEntryBylines(type, [wrapped]),
+			hydrateEntryTerms(type, [wrapped], termLocale),
+		]);
 		return {
 			entry: wrapped,
 			isPreview: opts.isPreview,
@@ -788,9 +817,18 @@ async function hydrateEntryBylines<D>(type: string, entries: ContentEntry<D>[]):
  * results and call getEntryTerms() per entry. With hydration, the list page
  * stays at a single round-trip for term data.
  *
+ * `locale` must be the locale the entries were resolved to. It is forwarded to
+ * `getAllTermsForEntries` so terms are returned in the entry's locale rather
+ * than falling back to the request-context / default locale (#1441). Pass
+ * `undefined` to keep the legacy "do not filter by locale" behaviour.
+ *
  * Fails silently if the taxonomy tables don't exist yet (pre-migration).
  */
-async function hydrateEntryTerms<D>(type: string, entries: ContentEntry<D>[]): Promise<void> {
+async function hydrateEntryTerms<D>(
+	type: string,
+	entries: ContentEntry<D>[],
+	locale?: string,
+): Promise<void> {
 	if (entries.length === 0) return;
 
 	try {
@@ -799,7 +837,7 @@ async function hydrateEntryTerms<D>(type: string, entries: ContentEntry<D>[]): P
 		const ids = entries.map((e) => dataStr(entryData(e), "id")).filter(Boolean);
 		if (ids.length === 0) return;
 
-		const termsMap = await getAllTermsForEntries(type, ids);
+		const termsMap = await getAllTermsForEntries(type, ids, { locale });
 
 		for (const entry of entries) {
 			const data = entryData(entry);

package/src/request-context.ts

@@ -39,6 +39,13 @@ export interface RequestMetrics {
 	dbLastOffset: number | null;
 	cacheHits: number;
 	cacheMisses: number;
+	/**
+	 * Physical database round trips. Differs from `dbCount` (logical queries)
+	 * when a backend batches: the DO SQL driver coalesces same-turn SELECTs into
+	 * one RPC, so `rpcCount` can be far lower than `dbCount`. Bumped by the
+	 * adapter, not the Kysely log hook.
+	 */
+	rpcCount: number;
 }
 
 export function createRequestMetrics(start: number): RequestMetrics {
@@ -50,6 +57,7 @@ export function createRequestMetrics(start: number): RequestMetrics {
 		dbLastOffset: null,
 		cacheHits: 0,
 		cacheMisses: 0,
+		rpcCount: 0,
 	};
 }
 

package/src/scheduled-publish.ts

@@ -0,0 +1,153 @@
+/**
+ * Scheduled publishing sweep
+ *
+ * Promotes content whose scheduled publish time has passed. Driven by the
+ * platform scheduler alongside cron ticks and system cleanup — never by a
+ * request. On Node the cron scheduler's maintenance pass calls it; on
+ * Cloudflare the Worker's `scheduled()` handler does.
+ *
+ * Like `runSystemCleanup`, each collection sweep is independent and non-fatal:
+ * one collection failing must not stop the rest.
+ */
+
+import type { Kysely } from "kysely";
+
+import { handleContentPublish } from "./api/handlers/content.js";
+import { ContentRepository } from "./database/repositories/content.js";
+import type { Database } from "./database/types.js";
+import { SchemaRegistry } from "./schema/registry.js";
+
+/** A content item that was promoted to published by a sweep. */
+export interface PublishedRef {
+	collection: string;
+	id: string;
+}
+
+/**
+ * Default cap on items promoted per collection in a single sweep. Bounds the
+ * publish/webhook fan-out of one tick so a large backlog can't exhaust a Worker
+ * invocation's CPU/subrequest budget; the remainder drains on later ticks.
+ */
+export const SCHEDULED_PUBLISH_BATCH_LIMIT = 100;
+
+/**
+ * Publishes a single content item. Mirrors the relevant subset of
+ * `handleContentPublish`'s return shape. Production callers pass
+ * `EmDashRuntime.handleContentPublish` so `content:afterPublish` hooks fire
+ * (search indexing, webhooks, syndication); the default falls back to the raw
+ * handler (no hooks) for callers that have only a `db`.
+ */
+export type ScheduledPublishFn = (
+	collection: string,
+	id: string,
+	options: { publishedAt?: string; requireScheduledDue?: boolean },
+) => Promise<{ success: boolean; error?: { code?: string } }>;
+
+export interface PublishDueContentOptions {
+	/**
+	 * Publish callback. Production callers pass the runtime's
+	 * `handleContentPublish` so `content:afterPublish` hooks fire (search
+	 * indexing, webhooks, syndication). Defaults to the raw DB handler (no hooks).
+	 */
+	publish?: ScheduledPublishFn;
+	/**
+	 * Invoked after each collection's batch with the items promoted in that
+	 * batch. Lets request-less callers (the Cloudflare `scheduled()` handler)
+	 * purge edge-cache tags incrementally instead of only after the whole sweep,
+	 * so a runtime killed mid-sweep strands at most one batch behind stale cache
+	 * rather than everything published so far. Failures are logged, never fatal.
+	 */
+	onPublished?: (refs: PublishedRef[]) => Promise<void>;
+	/**
+	 * Maximum items promoted per collection per sweep. Defaults to
+	 * `SCHEDULED_PUBLISH_BATCH_LIMIT`. Pass `0` (or a negative) for unbounded.
+	 */
+	limit?: number;
+}
+
+/**
+ * Publish every content item whose `scheduled_at` is in the past.
+ *
+ * Iterates all collections, finds due items (`findReadyToPublish` returns both
+ * scheduled drafts and published entries with pending scheduled changes), and
+ * publishes each. `publish()` clears `scheduled_at`, so a second sweep is a
+ * no-op — safe to run on every tick.
+ *
+ * Bounded per collection by `limit` (default `SCHEDULED_PUBLISH_BATCH_LIMIT`):
+ * a large backlog drains across successive ticks rather than in one unbounded
+ * pass. After each collection's batch, `onPublished` (if given) is awaited so
+ * cache-tag invalidation happens incrementally, not just at the very end.
+ *
+ * Returns every item it promoted so request-less callers (the Cloudflare
+ * `scheduled()` handler) can also act on the full set.
+ */
+export async function publishDueContent(
+	db: Kysely<Database>,
+	options: PublishDueContentOptions = {},
+): Promise<PublishedRef[]> {
+	const { publish, onPublished, limit = SCHEDULED_PUBLISH_BATCH_LIMIT } = options;
+	const published: PublishedRef[] = [];
+
+	let collections;
+	try {
+		collections = await new SchemaRegistry(db).listCollections();
+	} catch (error) {
+		console.error("[scheduled-publish] Failed to list collections:", error);
+		return published;
+	}
+
+	const repo = new ContentRepository(db);
+	const doPublish: ScheduledPublishFn =
+		publish ?? ((collection, id, opts) => handleContentPublish(db, collection, id, opts));
+	// 0 / negative means unbounded; findReadyToPublish treats that as "no LIMIT".
+	const batchLimit = limit > 0 ? limit : undefined;
+
+	for (const collection of collections) {
+		try {
+			const due = await repo.findReadyToPublish(collection.slug, batchLimit);
+			const batch: PublishedRef[] = [];
+			for (const item of due) {
+				// First publication of a scheduled draft should record the intended
+				// scheduled time, not the (later) sweep time. Items already published
+				// with pending draft changes keep their original published_at.
+				const publishedAt = item.publishedAt == null ? (item.scheduledAt ?? undefined) : undefined;
+				const result = await doPublish(collection.slug, item.id, {
+					publishedAt,
+					requireScheduledDue: true,
+				});
+				if (result.success) {
+					batch.push({ collection: collection.slug, id: item.id });
+				} else if (result.error?.code === "NOT_DUE") {
+					// Unscheduled or rescheduled between selection and publish — the
+					// editor changed their mind; skip quietly, not a failure.
+				} else {
+					console.error(
+						`[scheduled-publish] Failed to publish ${collection.slug}/${item.id}:`,
+						result.error,
+					);
+				}
+			}
+
+			if (batch.length > 0) {
+				published.push(...batch);
+				if (onPublished) {
+					// Purge this batch's cache tags before moving to the next
+					// collection, so a mid-sweep kill can't strand already-published
+					// content behind stale cache.
+					try {
+						await onPublished(batch);
+					} catch (error) {
+						console.error(
+							`[scheduled-publish] onPublished failed after "${collection.slug}" batch:`,
+							error,
+						);
+					}
+				}
+			}
+		} catch (error) {
+			console.error(`[scheduled-publish] Sweep failed for "${collection.slug}":`, error);
+		}
+	}
+
+	return published;
+}

package/src/schema/types.ts

@@ -102,7 +102,16 @@ export type CollectionSource =
 /** Sub-field definition for repeater fields */
 export interface RepeaterSubField {
 	slug: string;
-	type: "string" | "text" | "url" | "number" | "integer" | "boolean" | "datetime" | "select";
+	type:
+		| "string"
+		| "text"
+		| "url"
+		| "number"
+		| "integer"
+		| "boolean"
+		| "datetime"
+		| "select"
+		| "image";
 	label: string;
 	required?: boolean;
 	options?: string[]; // For select sub-fields
@@ -118,6 +127,7 @@ export const REPEATER_SUB_FIELD_TYPES = [
 	"boolean",
 	"datetime",
 	"select",
+	"image",
 ] as const;
 
 export interface FieldValidation {