emdash 0.2.0 → 0.4.0

package/src/redirects/loops.ts

@@ -0,0 +1,318 @@
+/**
+ * Redirect loop and chain detection utilities.
+ *
+ * Builds a directed graph from redirect rules and detects:
+ * - Cycles (loops): /a → /b → /c → /a
+ * - Long chains: /a → /b → /c → /d → /e (exceeding a warning threshold)
+ *
+ * Handles both exact and pattern redirects. When the walker encounters
+ * a path with no exact source match, it tests against compiled pattern
+ * sources and resolves the destination using captured parameters.
+ */
+
+import {
+	compilePattern,
+	matchPattern,
+	interpolateDestination,
+	type CompiledPattern,
+} from "./patterns.js";
+
+export interface RedirectEdge {
+	id: string;
+	source: string;
+	destination: string;
+	enabled: boolean;
+	isPattern: boolean;
+}
+
+interface CompiledPatternRedirect {
+	id: string;
+	compiled: CompiledPattern;
+	destination: string;
+}
+
+/**
+ * Compile all enabled pattern redirects for matching during graph walks.
+ */
+function compilePatterns(edges: RedirectEdge[]): CompiledPatternRedirect[] {
+	const result: CompiledPatternRedirect[] = [];
+	for (const edge of edges) {
+		if (edge.enabled && edge.isPattern) {
+			result.push({
+				id: edge.id,
+				compiled: compilePattern(edge.source),
+				destination: edge.destination,
+			});
+		}
+	}
+	return result;
+}
+
+/** Single-segment dummy value for representative path generation */
+const DUMMY_SEGMENT = "__p__";
+
+/** Splat pattern: [...paramName] */
+const SPLAT_RE = /\[\.\.\.(\w+)\]/g;
+
+/** Param pattern: [paramName] */
+const PARAM_RE = /\[(\w+)\]/g;
+
+/**
+ * Extract the literal prefix from a pattern source (everything before the
+ * first placeholder), stripped of leading segments shared with a base path.
+ * e.g., "/new/docs/[slug]" → "docs/__p__" (the part after "/new/")
+ */
+function extractPatternSuffix(patternSource: string): string {
+	// Replace placeholders with dummy values
+	let result = patternSource.replace(SPLAT_RE, DUMMY_SEGMENT);
+	SPLAT_RE.lastIndex = 0;
+	result = result.replace(PARAM_RE, DUMMY_SEGMENT);
+	// Strip leading slash and first segment (e.g., "/new/docs/__p__" → "docs/__p__")
+	const parts = result.split("/").filter(Boolean);
+	return parts.slice(1).join("/");
+}
+
+/**
+ * Generate representative concrete paths from a template string.
+ * Replaces [param] with a dummy segment and [...rest] with multiple
+ * depth variants. For catch-alls, also generates representatives using
+ * literal prefixes from existing pattern sources to catch cross-pattern loops.
+ */
+function generateRepresentatives(template: string, existingEdges?: RedirectEdge[]): string[] {
+	const hasSplat = SPLAT_RE.test(template);
+	SPLAT_RE.lastIndex = 0;
+
+	if (hasSplat) {
+		// Extract the static prefix before the catch-all (e.g., "/old/" from "/old/[...path]")
+		const splatIndex = template.indexOf("[...");
+		const prefix = template.slice(0, splatIndex);
+
+		const reps = [
+			template.replace(SPLAT_RE, DUMMY_SEGMENT).replace(PARAM_RE, DUMMY_SEGMENT),
+			template
+				.replace(SPLAT_RE, `${DUMMY_SEGMENT}/${DUMMY_SEGMENT}`)
+				.replace(PARAM_RE, DUMMY_SEGMENT),
+			template
+				.replace(SPLAT_RE, `${DUMMY_SEGMENT}/${DUMMY_SEGMENT}/${DUMMY_SEGMENT}`)
+				.replace(PARAM_RE, DUMMY_SEGMENT),
+		];
+
+		// Add representatives derived from existing pattern sources' literal prefixes
+		if (existingEdges) {
+			for (const edge of existingEdges) {
+				if (edge.enabled && edge.isPattern && edge.source !== template) {
+					const suffix = extractPatternSuffix(edge.source);
+					if (suffix) {
+						reps.push(`${prefix}${suffix}`);
+					}
+				}
+			}
+		}
+
+		return reps;
+	}
+
+	return [template.replace(PARAM_RE, DUMMY_SEGMENT)];
+}
+
+/**
+ * Resolve the next hop for a given path. Tries exact match first,
+ * then pattern matching with parameter interpolation for concrete paths,
+ * then representative-based matching for template strings.
+ */
+function resolveNext(
+	path: string,
+	graph: Map<string, { destination: string; id: string }>,
+	patterns: CompiledPatternRedirect[],
+	edges?: RedirectEdge[],
+): { destination: string; id: string } | null {
+	// Exact match (fast) — works for both real paths and template strings
+	const exact = graph.get(path);
+	if (exact) return exact;
+
+	if (!path.includes("[")) {
+		// Concrete path — try pattern matching directly
+		for (const pr of patterns) {
+			const params = matchPattern(pr.compiled, path);
+			if (params) {
+				const resolved = interpolateDestination(pr.destination, params);
+				return { destination: resolved, id: pr.id };
+			}
+		}
+	} else {
+		// Template string — generate representative paths and test against patterns
+		const representatives = generateRepresentatives(path, edges);
+		for (const pr of patterns) {
+			for (const rep of representatives) {
+				const params = matchPattern(pr.compiled, rep);
+				if (params) {
+					const resolved = interpolateDestination(pr.destination, params);
+					return { destination: resolved, id: pr.id };
+				}
+			}
+		}
+	}
+
+	return null;
+}
+
+/**
+ * Build an adjacency map from redirect edges.
+ * Includes both exact and pattern redirects — pattern redirects use their
+ * template strings as literal graph edges, which works because EmDash
+ * patterns pass parameters through without transformation.
+ */
+function buildGraph(edges: RedirectEdge[]): Map<string, { destination: string; id: string }> {
+	const graph = new Map<string, { destination: string; id: string }>();
+	for (const edge of edges) {
+		if (edge.enabled) {
+			graph.set(edge.source, { destination: edge.destination, id: edge.id });
+		}
+	}
+	return graph;
+}
+
+/**
+ * Detect all redirect IDs that participate in cycles.
+ * Walks every node in the graph once, collecting IDs from any cycles found.
+ *
+ * @returns Array of redirect IDs that are part of a loop
+ */
+export function detectLoops(edges: RedirectEdge[]): string[] {
+	const graph = buildGraph(edges);
+	const patterns = compilePatterns(edges);
+	const visited = new Set<string>();
+	const loopRedirectIds = new Set<string>();
+
+	for (const [startSource] of graph) {
+		if (visited.has(startSource)) continue;
+
+		const path: string[] = [];
+		const pathSet = new Set<string>();
+		const pathIds: string[] = [];
+		let current: string | undefined = startSource;
+
+		while (current) {
+			if (pathSet.has(current)) {
+				// Found a cycle — collect IDs of redirects in the loop
+				const loopStart = path.indexOf(current);
+				for (const id of pathIds.slice(loopStart)) loopRedirectIds.add(id);
+				break;
+			}
+
+			if (visited.has(current)) {
+				break;
+			}
+
+			const next = resolveNext(current, graph, patterns, edges);
+			if (!next) break;
+
+			path.push(current);
+			pathSet.add(current);
+			pathIds.push(next.id);
+			current = next.destination;
+		}
+
+		for (const node of path) visited.add(node);
+	}
+
+	return [...loopRedirectIds];
+}
+
+/**
+ * Find a compiled pattern redirect whose source matches the given resolved path,
+ * returning the source template string for display purposes.
+ */
+function findMatchingTemplate(
+	resolvedPath: string,
+	patterns: CompiledPatternRedirect[],
+): string | null {
+	for (const pr of patterns) {
+		if (matchPattern(pr.compiled, resolvedPath) !== null) {
+			return pr.compiled.source;
+		}
+	}
+	return null;
+}
+
+/**
+ * Check if adding or updating a redirect would create a loop.
+ *
+ * Walks the chain from `destination` through existing redirects.
+ * If it reaches `source`, a cycle would form.
+ *
+ * @returns The loop path if a cycle would be created, or null if safe
+ */
+export function wouldCreateLoop(
+	source: string,
+	destination: string,
+	existingEdges: RedirectEdge[],
+	excludeId?: string,
+): string[] | null {
+	const filtered = excludeId ? existingEdges.filter((e) => e.id !== excludeId) : existingEdges;
+	const graph = buildGraph(filtered);
+	const patterns = compilePatterns(filtered);
+
+	// If the proposed source is a pattern, compile it so we can check
+	// whether resolved paths would match it (not just string equality)
+	const sourceIsPattern = source.includes("[");
+	const compiledSource = sourceIsPattern ? compilePattern(source) : null;
+
+	// Determine starting points for the walk. If the destination is a
+	// template, generate representative concrete paths AND find existing
+	// exact sources in the graph that match the template.
+	let startingPoints: string[];
+	if (destination.includes("[")) {
+		const reps = generateRepresentatives(destination, filtered);
+		// Also find existing exact graph keys that match this template
+		const compiled = compilePattern(destination);
+		for (const [key] of graph) {
+			if (!key.includes("[") && matchPattern(compiled, key) !== null) {
+				reps.push(key);
+			}
+		}
+		// Always include the destination itself — it may be an exact graph key
+		// (e.g., /a/sub/[...path] exists as a literal source in the graph)
+		reps.push(destination);
+		startingPoints = reps;
+	} else {
+		startingPoints = [destination];
+	}
+
+	for (const start of startingPoints) {
+		const path = [source, destination];
+		let current = start;
+		const seen = new Set<string>([source, destination, start]);
+
+		// Walk the chain until it ends or we revisit a node
+		// eslint-disable-next-line no-constant-condition -- terminates via return/break when chain ends or cycle found
+		while (true) {
+			const next = resolveNext(current, graph, patterns, filtered);
+			if (!next) break; // chain ends, try next starting point
+
+			// Check if we've looped back — either exact match or pattern match
+			const loopsBack =
+				seen.has(next.destination) ||
+				(compiledSource !== null && matchPattern(compiledSource, next.destination) !== null);
+
+			if (loopsBack) {
+				// Show the source template instead of dummy resolved path
+				const displayPath =
+					!seen.has(next.destination) && compiledSource !== null ? source : next.destination;
+				path.push(displayPath);
+				return path; // cycle found
+			}
+
+			// If the resolved path contains dummy segments, try to find the
+			// original pattern template that produced it for cleaner display
+			const cleanDest = next.destination.includes(DUMMY_SEGMENT)
+				? (findMatchingTemplate(next.destination, patterns) ?? next.destination)
+				: next.destination;
+			path.push(cleanDest);
+			seen.add(next.destination);
+			current = next.destination;
+		}
+	}
+
+	return null;
+}

package/src/schema/registry.ts

@@ -6,6 +6,7 @@ import { ulid } from "ulidx";
 import { currentTimestamp, listTablesLike, tableExists } from "../database/dialect-helpers.js";
 import { withTransaction } from "../database/transaction.js";
 import type { CollectionTable, Database, FieldTable } from "../database/types.js";
+import { validateIdentifier } from "../database/validate.js";
 import { FTSManager } from "../search/fts-manager.js";
 import {
 	type Collection,
@@ -684,6 +685,7 @@ export class SchemaRegistry {
 	 * Get table name for a collection
 	 */
 	private getTableName(slug: string): string {
+		validateIdentifier(slug, "collection slug");
 		return `ec_${slug}`;
 	}
 
@@ -691,6 +693,7 @@ export class SchemaRegistry {
 	 * Get column name for a field
 	 */
 	private getColumnName(slug: string): string {
+		validateIdentifier(slug, "field slug");
 		return slug;
 	}
 

package/src/search/fts-manager.ts

@@ -39,6 +39,7 @@ export class FTSManager {
 	 * Uses _emdash_ prefix to clearly mark as internal/system table
 	 */
 	getFtsTableName(collectionSlug: string): string {
+		validateIdentifier(collectionSlug, "collection slug");
 		return `_emdash_fts_${collectionSlug}`;
 	}
 
@@ -46,6 +47,7 @@ export class FTSManager {
 	 * Get the content table name for a collection
 	 */
 	getContentTableName(collectionSlug: string): string {
+		validateIdentifier(collectionSlug, "collection slug");
 		return `ec_${collectionSlug}`;
 	}
 
@@ -98,19 +100,26 @@ export class FTSManager {
 	}
 
 	/**
-	 * Create triggers to keep FTS table in sync with content table
+	 * Create triggers to keep FTS table in sync with content table.
+	 *
+	 * The insert and update triggers only add rows to the FTS index when
+	 * `deleted_at IS NULL`. This keeps soft-deleted content out of the
+	 * search index and ensures the FTS row count matches the non-deleted
+	 * content count (which `verifyAndRepairIndex` relies on).
 	 */
 	private async createTriggers(collectionSlug: string, searchableFields: string[]): Promise<void> {
+		this.validateInputs(collectionSlug, searchableFields);
 		const ftsTable = this.getFtsTableName(collectionSlug);
 		const contentTable = this.getContentTableName(collectionSlug);
 		const fieldList = searchableFields.join(", ");
 		const newFieldList = searchableFields.map((f) => `NEW.${f}`).join(", ");
 
-		// Insert trigger
+		// Insert trigger - only index non-deleted content
 		await sql
 			.raw(`
 			CREATE TRIGGER IF NOT EXISTS "${ftsTable}_insert" 
 			AFTER INSERT ON "${contentTable}" 
+			WHEN NEW.deleted_at IS NULL
 			BEGIN
 				INSERT INTO "${ftsTable}"(rowid, id, locale, ${fieldList})
 				VALUES (NEW.rowid, NEW.id, NEW.locale, ${newFieldList});
@@ -118,7 +127,9 @@ export class FTSManager {
 		`)
 			.execute(this.db);
 
-		// Update trigger - delete old, insert new
+		// Update trigger - always remove the old FTS row, only re-insert
+		// if the row is not soft-deleted. This handles both content edits
+		// and soft-delete operations (UPDATE SET deleted_at = ...).
 		await sql
 			.raw(`
 			CREATE TRIGGER IF NOT EXISTS "${ftsTable}_update" 
@@ -126,7 +137,8 @@ export class FTSManager {
 			BEGIN
 				DELETE FROM "${ftsTable}" WHERE rowid = OLD.rowid;
 				INSERT INTO "${ftsTable}"(rowid, id, locale, ${fieldList})
-				VALUES (NEW.rowid, NEW.id, NEW.locale, ${newFieldList});
+				SELECT NEW.rowid, NEW.id, NEW.locale, ${newFieldList}
+				WHERE NEW.deleted_at IS NULL;
 			END
 		`)
 			.execute(this.db);
@@ -147,6 +159,7 @@ export class FTSManager {
 	 * Drop triggers for a collection
 	 */
 	private async dropTriggers(collectionSlug: string): Promise<void> {
+		this.validateInputs(collectionSlug);
 		const ftsTable = this.getFtsTableName(collectionSlug);
 
 		await sql.raw(`DROP TRIGGER IF EXISTS "${ftsTable}_insert"`).execute(this.db);
@@ -287,9 +300,12 @@ export class FTSManager {
 	}
 
 	/**
-	 * Enable search for a collection
+	 * Enable search for a collection.
 	 *
-	 * Creates the FTS table and triggers, and populates from existing content.
+	 * Uses rebuildIndex to ensure a clean state -- drop any existing FTS
+	 * table/triggers, recreate them, and populate from content. This avoids
+	 * duplicate rows when triggers have already populated the index (e.g.
+	 * during seeding where content is inserted before search is enabled).
 	 */
 	async enableSearch(
 		collectionSlug: string,
@@ -308,11 +324,8 @@ export class FTSManager {
 			);
 		}
 
-		// Create FTS table
-		await this.createFtsTable(collectionSlug, searchableFields, options?.weights);
-
-		// Populate from existing content
-		await this.populateFromContent(collectionSlug, searchableFields);
+		// Rebuild from scratch to ensure clean state (no duplicate rows)
+		await this.rebuildIndex(collectionSlug, searchableFields, options?.weights);
 
 		// Update search config
 		await this.setSearchConfig(collectionSlug, {

package/src/search/query.ts

@@ -368,22 +368,21 @@ function escapeQuery(query: string): string {
 		return "";
 	}
 
-	// FTS5 special characters that need escaping in terms: " * ^
-	// We'll wrap terms in quotes to handle most cases
-	// But first, escape any existing quotes
+	// If already a quoted phrase, escape only interior quotes and preserve phrase syntax
+	if (query.startsWith('"') && query.endsWith('"') && query.length >= 2) {
+		const inner = query.slice(1, -1);
+		return `"${inner.replace(DOUBLE_QUOTE_PATTERN, '""')}"`;
+	}
+
+	// Escape any existing quotes
 	const escaped = query.replace(DOUBLE_QUOTE_PATTERN, '""');
 
 	// If the query contains FTS5 operators (AND, OR, NOT, NEAR),
-	// pass through as-is (user knows what they're doing)
+	// pass through with quotes escaped but operators preserved
 	if (FTS_OPERATORS_PATTERN.test(query)) {
 		return escaped;
 	}
 
-	// If already quoted, pass through
-	if (query.startsWith('"') && query.endsWith('"')) {
-		return query;
-	}
-
 	// For simple queries, wrap each word to handle special chars
 	const terms = escaped.split(WHITESPACE_SPLIT_PATTERN).filter((t) => t.length > 0);
 	if (terms.length === 0) {

package/src/seed/apply.ts

@@ -15,6 +15,7 @@ import { ContentRepository } from "../database/repositories/content.js";
 import { MediaRepository } from "../database/repositories/media.js";
 import { RedirectRepository } from "../database/repositories/redirect.js";
 import { TaxonomyRepository } from "../database/repositories/taxonomy.js";
+import { withTransaction } from "../database/transaction.js";
 import type { Database } from "../database/types.js";
 import type { MediaValue } from "../fields/types.js";
 import { ssrfSafeFetch, validateExternalUrl } from "../import/ssrf.js";
@@ -342,7 +343,6 @@ export async function applySeed(
 	// 7. Content (created before menus so refs can resolve)
 	if (includeContent && seed.content) {
 		const contentRepo = new ContentRepository(db);
-		const bylineRepo = new BylineRepository(db);
 
 		// Create content entries
 		for (const [collectionSlug, entries] of Object.entries(seed.content)) {
@@ -366,25 +366,30 @@ export async function applySeed(
 							result,
 						);
 
+						// Update content + bylines + taxonomies atomically
 						const status = entry.status || "published";
-						await contentRepo.update(collectionSlug, existing.id, {
-							status,
-							data: resolvedData,
+						await withTransaction(db, async (trx) => {
+							const trxContentRepo = new ContentRepository(trx);
+							const trxBylineRepo = new BylineRepository(trx);
+
+							await trxContentRepo.update(collectionSlug, existing.id, {
+								status,
+								data: resolvedData,
+							});
+
+							await applyContentBylines(
+								trxBylineRepo,
+								collectionSlug,
+								existing.id,
+								entry,
+								seedBylineIdMap,
+								true,
+							);
+							await applyContentTaxonomies(trx, collectionSlug, existing.id, entry, true);
 						});
 
 						seedIdMap.set(entry.id, existing.id);
 						result.content.updated++;
-
-						// Update bylines and taxonomy assignments
-						await applyContentBylines(
-							bylineRepo,
-							collectionSlug,
-							existing.id,
-							entry,
-							seedBylineIdMap,
-							true,
-						);
-						await applyContentTaxonomies(db, collectionSlug, existing.id, entry, true);
 						continue;
 					}
 
@@ -410,24 +415,30 @@ export async function applySeed(
 					}
 				}
 
-				// Create entry
+				// Create entry + bylines + taxonomies atomically
 				const status = entry.status || "published";
-				const created = await contentRepo.create({
-					type: collectionSlug,
-					slug: entry.slug,
-					status,
-					data: resolvedData,
-					locale: entry.locale,
-					translationOf,
-					// Set published_at for published content so RSS/Archives work correctly
-					publishedAt: status === "published" ? new Date().toISOString() : null,
+				const created = await withTransaction(db, async (trx) => {
+					const trxContentRepo = new ContentRepository(trx);
+					const trxBylineRepo = new BylineRepository(trx);
+
+					const item = await trxContentRepo.create({
+						type: collectionSlug,
+						slug: entry.slug,
+						status,
+						data: resolvedData,
+						locale: entry.locale,
+						translationOf,
+						publishedAt: status === "published" ? new Date().toISOString() : null,
+					});
+
+					await applyContentBylines(trxBylineRepo, collectionSlug, item.id, entry, seedBylineIdMap);
+					await applyContentTaxonomies(trx, collectionSlug, item.id, entry, false);
+
+					return item;
 				});
 
 				seedIdMap.set(entry.id, created.id);
 				result.content.created++;
-
-				await applyContentBylines(bylineRepo, collectionSlug, created.id, entry, seedBylineIdMap);
-				await applyContentTaxonomies(db, collectionSlug, created.id, entry, false);
 			}
 		}
 	}
@@ -636,6 +647,16 @@ export async function applySeed(
 		}
 	}
 
+	// Invalidate caches that may have been affected by seed data.
+	// Seed creates bylines, redirects, and collections, all of which
+	// have module-level caches in the hot path.
+	const { invalidateBylineCache } = await import("../bylines/index.js");
+	const { invalidateRedirectCache } = await import("../redirects/cache.js");
+	const { invalidateUrlPatternCache } = await import("../query.js");
+	invalidateBylineCache();
+	invalidateRedirectCache();
+	invalidateUrlPatternCache();
+
 	return result;
 }