emdash 0.21.0 → 0.23.0

package/src/api/handlers/api-tokens.ts

@@ -172,6 +172,25 @@ export async function handleApiTokenRevoke(
 	}
 }
 
+/**
+ * Delete every token with the given name for a user, returning how many were
+ * removed. Token names aren't unique, so this is a bulk delete — used by the
+ * dev-bypass flow to keep a single `dev-bypass-token` instead of minting a new
+ * one on every reset.
+ */
+export async function deleteApiTokensByName(
+	db: Kysely<Database>,
+	userId: string,
+	name: string,
+): Promise<number> {
+	const result = await db
+		.deleteFrom("_emdash_api_tokens")
+		.where("user_id", "=", userId)
+		.where("name", "=", name)
+		.executeTakeFirst();
+	return Number(result.numDeletedRows ?? 0n);
+}
+
 /**
  * Resolve a raw API token (ec_pat_...) to a user ID and scopes.
  * Updates last_used_at on successful lookup.

package/src/api/handlers/comment-reactions.ts

@@ -0,0 +1,165 @@
+/**
+ * Comment reaction handlers (Tier 1 of the best-in-class comments RFC).
+ *
+ * Business logic for toggling reactions and reading aggregate counts. Route
+ * files stay thin wrappers; these return `ApiResult<T>`.
+ */
+
+import type { Kysely } from "kysely";
+
+import {
+	CommentReactionRepository,
+	type ReactionCounts,
+} from "#db/repositories/comment-reaction.js";
+import type { Database } from "#db/types.js";
+
+import { invalidateCommentObjectCache } from "../../object-cache/index.js";
+import type { ApiResult } from "../types.js";
+
+/** Max reactions a single voter may register per window before throttling. */
+const REACTION_RATE_LIMIT = 30;
+const REACTION_RATE_WINDOW_MINUTES = 10;
+
+/**
+ * Reactions the system accepts. Positive-only for now (matches the shipped
+ * widget); kept as an allowlist so a voter can't spam arbitrary reaction
+ * strings and bloat a comment's count map. Extend (or make configurable) as
+ * the UI grows.
+ */
+const ALLOWED_REACTIONS: ReadonlySet<string> = new Set(["like"]);
+
+export interface ReactionToggleResult {
+	commentId: string;
+	reaction: string;
+	/** true if the reaction was added, false if an existing one was removed */
+	reacted: boolean;
+	/** updated counts for this comment after the toggle */
+	counts: ReactionCounts;
+}
+
+export interface ReactionCountsResult {
+	/** comment id -> reaction counts */
+	reactions: Record<string, ReactionCounts>;
+	/** comment id -> reactions the current voter has active (omitted if anonymous) */
+	viewer?: Record<string, string[]>;
+}
+
+/**
+ * Toggle a reaction for a voter on an approved comment belonging to the given
+ * content item. Rate-limited per voter.
+ */
+export async function handleReactionToggle(
+	db: Kysely<Database>,
+	params: {
+		collection: string;
+		contentId: string;
+		commentId: string;
+		reaction: string;
+		voterHash: string;
+	},
+): Promise<ApiResult<ReactionToggleResult>> {
+	try {
+		const { collection, contentId, commentId, reaction, voterHash } = params;
+
+		if (!ALLOWED_REACTIONS.has(reaction)) {
+			return {
+				success: false,
+				error: { code: "VALIDATION_ERROR", message: "Unsupported reaction" },
+			};
+		}
+
+		// The comment must exist, be approved, and belong to this content item.
+		const comment = await db
+			.selectFrom("_emdash_comments")
+			.select(["id", "status"])
+			.where("id", "=", commentId)
+			.where("collection", "=", collection)
+			.where("content_id", "=", contentId)
+			.executeTakeFirst();
+
+		if (!comment) {
+			return { success: false, error: { code: "NOT_FOUND", message: "Comment not found" } };
+		}
+		if (comment.status !== "approved") {
+			return {
+				success: false,
+				error: { code: "COMMENT_NOT_APPROVED", message: "Cannot react to this comment" },
+			};
+		}
+
+		const repo = new CommentReactionRepository(db);
+
+		const recent = await repo.countRecentByVoter(voterHash, REACTION_RATE_WINDOW_MINUTES);
+		if (recent >= REACTION_RATE_LIMIT) {
+			return {
+				success: false,
+				error: { code: "RATE_LIMITED", message: "Too many reactions. Please try again later." },
+			};
+		}
+
+		const { reacted } = await repo.toggle({ commentId, reaction, voterHash });
+		const countsMap = await repo.countsForComments([commentId]);
+
+		// Reaction counts (and `best` ordering) are folded into cached getComments
+		// reads, so a toggle must orphan them.
+		invalidateCommentObjectCache();
+
+		return {
+			success: true,
+			data: { commentId, reaction, reacted, counts: countsMap.get(commentId) ?? {} },
+		};
+	} catch {
+		return {
+			success: false,
+			error: { code: "REACTION_TOGGLE_ERROR", message: "Failed to toggle reaction" },
+		};
+	}
+}
+
+/**
+ * Read aggregate reaction counts for every approved comment on a content item,
+ * plus (optionally) which reactions the current voter has active.
+ */
+export async function handleReactionCounts(
+	db: Kysely<Database>,
+	collection: string,
+	contentId: string,
+	voterHash?: string,
+): Promise<ApiResult<ReactionCountsResult>> {
+	try {
+		const comments = await db
+			.selectFrom("_emdash_comments")
+			.select("id")
+			.where("collection", "=", collection)
+			.where("content_id", "=", contentId)
+			.where("status", "=", "approved")
+			.execute();
+
+		const ids = comments.map((c) => c.id);
+		const repo = new CommentReactionRepository(db);
+
+		const countsMap = await repo.countsForComments(ids);
+		const reactions: Record<string, ReactionCounts> = {};
+		for (const [id, counts] of countsMap) {
+			reactions[id] = counts;
+		}
+
+		const data: ReactionCountsResult = { reactions };
+
+		if (voterHash) {
+			const viewerMap = await repo.viewerReactions(ids, voterHash);
+			const viewer: Record<string, string[]> = {};
+			for (const [id, list] of viewerMap) {
+				viewer[id] = list;
+			}
+			data.viewer = viewer;
+		}
+
+		return { success: true, data };
+	} catch {
+		return {
+			success: false,
+			error: { code: "REACTION_COUNTS_ERROR", message: "Failed to read reactions" },
+		};
+	}
+}

package/src/api/handlers/schema.ts

@@ -5,6 +5,7 @@
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
+import { invalidateCollectionCache } from "../../object-cache/index.js";
 import {
 	SchemaRegistry,
 	SchemaError,
@@ -315,6 +316,9 @@ export async function handleSchemaFieldCreate(
 		const registry = new SchemaRegistry(db);
 		const item = await registry.createField(collectionSlug, input);
 
+		// Content snapshots embed field values; a column change invalidates them.
+		invalidateCollectionCache(collectionSlug);
+
 		return {
 			success: true,
 			data: { item },
@@ -353,6 +357,8 @@ export async function handleSchemaFieldUpdate(
 		const registry = new SchemaRegistry(db);
 		const item = await registry.updateField(collectionSlug, fieldSlug, input);
 
+		invalidateCollectionCache(collectionSlug);
+
 		return {
 			success: true,
 			data: { item },
@@ -390,6 +396,8 @@ export async function handleSchemaFieldDelete(
 		const registry = new SchemaRegistry(db);
 		await registry.deleteField(collectionSlug, fieldSlug);
 
+		invalidateCollectionCache(collectionSlug);
+
 		return {
 			success: true,
 			data: { success: true },

package/src/api/schemas/bylines.ts

@@ -19,6 +19,14 @@ export const bylineSummarySchema = z
 		 */
 		avatarStorageKey: z.string().nullish(),
 		avatarAlt: z.string().nullish(),
+		/**
+		 * Avatar media LQIP placeholder (blurhash + dominant colour, migration
+		 * 024), from the same media join. Lets clients render a placeholder
+		 * while the avatar loads. Null under the same conditions as
+		 * `avatarStorageKey`.
+		 */
+		avatarBlurhash: z.string().nullish(),
+		avatarDominantColor: z.string().nullish(),
 		websiteUrl: z.string().nullable(),
 		userId: z.string().nullable(),
 		isGuest: z.boolean(),

package/src/api/schemas/comments.ts

@@ -15,6 +15,16 @@ export const createCommentBody = z
 	})
 	.meta({ id: "CreateCommentBody" });
 
+export const createReactionBody = z
+	.object({
+		commentId: z.string().min(1),
+		/** Reaction name. Positive-only ("like") by default; extensible. */
+		reaction: z.string().min(1).max(20).default("like"),
+		/** Honeypot field — hidden in the form, filled only by bots */
+		website_url: z.string().optional(),
+	})
+	.meta({ id: "CreateReactionBody" });
+
 export const commentStatusBody = z
 	.object({
 		status: z.enum(["approved", "pending", "spam", "trash"]),

package/src/astro/image-endpoint.ts

@@ -0,0 +1,84 @@
+/**
+ * Node image endpoint -- the `image.endpoint` EmDash installs on non-Cloudflare
+ * platforms whose image service is local (sharp).
+ *
+ * It wraps Astro's generic endpoint: for an EmDash media URL it loads the source
+ * bytes straight from the storage adapter (no HTTP, so it works behind any auth
+ * gate) and runs the configured image service's `transform`; every other image
+ * is delegated to the stock endpoint unchanged.
+ */
+
+import type { APIRoute } from "astro";
+// @ts-ignore - astro/assets internal endpoint, resolved by the consumer's Astro build
+import { GET as genericGET } from "astro/assets/endpoint/generic";
+// @ts-ignore - astro:assets is resolved by the consumer's Astro build
+import { getConfiguredImageService, imageConfig } from "astro:assets";
+
+import {
+	IMMUTABLE_IMAGE_CACHE,
+	matchInternalMediaKey,
+	originalMediaHeaders,
+} from "../media/image-endpoint.js";
+
+export const prerender = false;
+
+const FORMAT_MIME: Record<string, string> = {
+	webp: "image/webp",
+	avif: "image/avif",
+	png: "image/png",
+	jpeg: "image/jpeg",
+	jpg: "image/jpeg",
+	gif: "image/gif",
+};
+
+function isNotFound(error: unknown): boolean {
+	return (
+		error instanceof Error &&
+		(error.message.includes("not found") || error.message.includes("NOT_FOUND"))
+	);
+}
+
+function streamOriginal(body: ReadableStream<Uint8Array>, contentType: string): Response {
+	return new Response(body, { status: 200, headers: originalMediaHeaders(contentType) });
+}
+
+export const GET: APIRoute = async (ctx) => {
+	const url = new URL(ctx.request.url);
+	const key = matchInternalMediaKey(url.searchParams.get("href"));
+	const storage = ctx.locals.emdash?.storage;
+
+	// Not EmDash media, or storage unavailable: let the stock endpoint handle it
+	// (bundled assets, allowed remote, `publicUrl` media).
+	if (!key || !storage) return genericGET(ctx);
+
+	const service = await getConfiguredImageService();
+	if (!("transform" in service)) return genericGET(ctx);
+
+	try {
+		const source = await storage.download(key);
+
+		// Only raster images are transformable; serve anything else unchanged.
+		if (!source.contentType.startsWith("image/")) {
+			return streamOriginal(source.body, source.contentType);
+		}
+
+		const transform = await service.parseURL(url, imageConfig);
+		if (!transform) return streamOriginal(source.body, source.contentType);
+
+		const inputBuffer = new Uint8Array(await new Response(source.body).arrayBuffer());
+		const { data, format } = await service.transform(inputBuffer, transform, imageConfig);
+
+		return new Response(data, {
+			status: 200,
+			headers: {
+				"Content-Type": FORMAT_MIME[format] ?? source.contentType,
+				"Cache-Control": IMMUTABLE_IMAGE_CACHE,
+				"X-Content-Type-Options": "nosniff",
+			},
+		});
+	} catch (error) {
+		if (isNotFound(error)) return new Response("Not Found", { status: 404 });
+		console.error("[emdash] image transform failed:", error);
+		return new Response("Internal Server Error", { status: 500 });
+	}
+};

package/src/astro/index.ts

@@ -21,6 +21,12 @@ export type {
 export { local, s3 } from "./storage/index.js";
 export type { StorageDescriptor, LocalStorageConfig, S3StorageConfig } from "./storage/index.js";
 
+// Object cache adapters (for integration config)
+// Note: For Cloudflare KV, use `kvCache()` from `@emdash-cms/cloudflare`
+export { memoryCache } from "./object-cache/adapters.js";
+export type { MemoryCacheOptions } from "./object-cache/adapters.js";
+export type { ObjectCacheDescriptor, ObjectCacheRuntimeConfig } from "../object-cache/types.js";
+
 // Integration (build-time only - the emdash() function uses Node.js APIs)
 export { default } from "./integration/index.js";
 export { getStoredConfig } from "./integration/runtime.js";

package/src/astro/integration/index.ts

@@ -70,26 +70,21 @@ interface ImageRemotePattern {
 /**
  * Build `image.remotePatterns` entries so Astro will optimize EmDash media.
  *
- * Astro's image services only transform **absolute** URLs whose host is
- * authorized; everything else is passed through unoptimized. We authorize the
- * media sources automatically:
+ * Astro's image services only build a transform URL for sources allowed via
+ * `image.domains` / `image.remotePatterns` (relative URLs are never optimized —
+ * see `isRemoteAllowed`). We authorize the media sources automatically:
  *
- *  1. The storage adapter's public URL host (R2 custom domain, S3/CDN), so
- *     media served directly from a public bucket is optimized.
+ *  1. The storage adapter's public URL host (R2 custom domain, S3/CDN).
  *  2. The site's own origin, scoped to the media proxy route
- *     (`/_emdash/api/media/file/**`), so same-origin proxied media (local
- *     storage, or R2 without a public URL) is optimized too. The pathname
- *     scope keeps Astro's image endpoint from acting as an open proxy for the
- *     whole origin. Only registered when `siteUrl` is known at build time;
- *     `getPublicOrigin` resolves the matching origin at render time.
- *  3. In `astro dev` the dev-server origin (`localhost:<port>`) isn't known at
- *     build time, so we register a host-agnostic pattern scoped to the media
- *     route. This is dev-only — it never ships in a production build — so the
- *     missing host check can't be abused on a deployed site.
+ *     (`/_emdash/api/media/file/**`), so same-origin proxied media is optimized.
+ *     The components absolutize the media URL against this origin; EmDash's
+ *     wrapped image endpoint then serves the bytes from storage (so the absolute
+ *     URL is never fetched). Only registered when `siteUrl` is known at build.
+ *  3. In `astro dev` the dev-server origin isn't known at build time, so we
+ *     register a host-agnostic pattern scoped to the media route. Dev-only.
  *
- * Returns an empty array when no source is statically known (e.g. a production
- * build using local storage with no `siteUrl`), in which case media renders as
- * a plain `<img>`.
+ * Returns an empty array when no source is statically known (production build,
+ * local storage, no `siteUrl`), in which case media renders as a plain `<img>`.
  *
  * @internal Exported for unit testing.
  */
@@ -147,6 +142,59 @@ export function buildImageRemotePatterns(
 	return patterns;
 }
 
+/**
+ * Stock image endpoints EmDash may safely replace with its storage-backed
+ * wrapper. Our wrapper delegates non-EmDash images to the platform's transform
+ * endpoint, so we only override endpoints whose transform we can delegate to.
+ */
+const OVERRIDABLE_IMAGE_ENDPOINTS = new Set([
+	"astro/assets/endpoint/generic",
+	"astro/assets/endpoint/node",
+	"astro/assets/endpoint/dev",
+	"@astrojs/cloudflare/image-transform-endpoint",
+]);
+
+/**
+ * Stock endpoints that deliberately don't transform (the user opted into
+ * passthrough). We leave these untouched -- and without a warning, since it's a
+ * supported choice, not a custom endpoint. Overriding would route non-EmDash
+ * images through a transformer the passthrough setup doesn't provide.
+ */
+const PASSTHROUGH_IMAGE_ENDPOINTS = new Set(["@astrojs/cloudflare/image-passthrough-endpoint"]);
+
+/**
+ * Decide which image endpoint to install (if any). EmDash wraps Astro's image
+ * endpoint so EmDash media bytes load from storage; the wrapper delegates other
+ * images back to the platform's stock endpoint.
+ *
+ * Returns `{ entrypoint }` to install, `{ warn }` to skip with a warning (a
+ * custom endpoint we can't delegate to), or `{}` to skip silently (opted out).
+ *
+ * @internal Exported for unit testing.
+ */
+export function resolveImageEndpoint(opts: {
+	imagesDisabled: boolean;
+	currentEntrypoint: string | undefined;
+	isCloudflare: boolean;
+}): { entrypoint?: string; warn?: string } {
+	if (opts.imagesDisabled) return {};
+	const current = opts.currentEntrypoint;
+	if (current === undefined || OVERRIDABLE_IMAGE_ENDPOINTS.has(current)) {
+		return {
+			entrypoint: opts.isCloudflare
+				? "@emdash-cms/cloudflare/image-endpoint"
+				: "emdash/image-endpoint",
+		};
+	}
+	// A deliberate passthrough setup: leave it alone, no warning.
+	if (PASSTHROUGH_IMAGE_ENDPOINTS.has(current)) return {};
+	return {
+		warn:
+			`A custom image.endpoint (${current}) is configured; EmDash will not wrap ` +
+			`it, so storage-backed media may render unoptimized.`,
+	};
+}
+
 // Terminal formatting
 const dim = (s: string) => `\x1b[2m${s}\x1b[22m`;
 const bold = (s: string) => `\x1b[1m${s}\x1b[22m`;
@@ -402,19 +450,32 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 								},
 							];
 
-				// Authorize media sources for Astro image optimization so the
-				// Image components can generate a responsive srcset for R2/S3 and
-				// same-origin proxied media. `updateConfig` merges arrays, so any
-				// user-configured remotePatterns are preserved.
+				// Authorize media sources so Astro's image service builds transform
+				// URLs for them (it won't optimize an un-allowed source). `updateConfig`
+				// merges arrays, so user-configured remotePatterns are preserved.
 				const imageRemotePatterns = buildImageRemotePatterns(
 					resolvedConfig.storage,
 					resolvedConfig.siteUrl,
 					command,
 				);
 
+				// Wrap Astro's image endpoint so EmDash media bytes load straight from
+				// storage (Access-safe) instead of over HTTP. Skip when the user opts
+				// out or has a custom endpoint we can't delegate back to.
+				const { entrypoint: imageEndpoint, warn: imageEndpointWarning } = resolveImageEndpoint({
+					imagesDisabled: resolvedConfig.images === false,
+					currentEntrypoint: astroConfig.image?.endpoint?.entrypoint,
+					isCloudflare: astroConfig.adapter?.name === "@astrojs/cloudflare",
+				});
+				if (imageEndpointWarning) logger.warn(imageEndpointWarning);
+
+				const imageConfig: Record<string, unknown> = {};
+				if (imageRemotePatterns.length) imageConfig.remotePatterns = imageRemotePatterns;
+				if (imageEndpoint) imageConfig.endpoint = { entrypoint: imageEndpoint };
+
 				updateConfig({
 					security: securityConfig,
-					...(imageRemotePatterns.length ? { image: { remotePatterns: imageRemotePatterns } } : {}),
+					...(Object.keys(imageConfig).length ? { image: imageConfig } : {}),
 					// fonts is a valid AstroConfig key but may not be in the
 					// type definition for the minimum supported Astro version
 					...({ fonts: emdashFonts } as Record<string, unknown>),

package/src/astro/integration/routes.ts

@@ -758,6 +758,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/comments/[collection]/[contentId]/index.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/comments/[collection]/[contentId]/reactions",
+		entrypoint: resolveRoute("api/comments/[collection]/[contentId]/reactions.ts"),
+	});
+
 	// Comment routes (admin)
 	injectRoute({
 		pattern: "/_emdash/api/admin/comments",

package/src/astro/integration/runtime.ts

@@ -10,7 +10,12 @@
 import type { AuthDescriptor, AuthProviderDescriptor } from "../../auth/types.js";
 import type { DatabaseDescriptor } from "../../db/adapters.js";
 import type { MediaProviderDescriptor } from "../../media/types.js";
-import type { ResolvedPlugin } from "../../plugins/types.js";
+import type { ObjectCacheDescriptor } from "../../object-cache/types.js";
+import type {
+	FieldWidgetConfig,
+	PortableTextBlockConfig,
+	ResolvedPlugin,
+} from "../../plugins/types.js";
 import type { ExperimentalConfig } from "../../registry/types.js";
 import type { StorageDescriptor } from "../storage/types.js";
 
@@ -98,6 +103,15 @@ export interface PluginDescriptor<TOptions = Record<string, unknown>> {
 	adminPages?: PluginAdminPage[];
 	/** Dashboard widgets */
 	adminWidgets?: PluginDashboardWidget[];
+	/**
+	 * Portable Text block types this plugin contributes to the editor.
+	 * Declarative (Block Kit) — surfaced in the admin slash menu and consumed
+	 * from the manifest, so standard/sandboxed plugins can contribute blocks
+	 * without a native render component.
+	 */
+	portableTextBlocks?: PortableTextBlockConfig[];
+	/** Field widget types this plugin contributes for schema-field editing UIs. */
+	fieldWidgets?: FieldWidgetConfig[];
 
 	// === Sandbox-specific fields (for sandboxed plugins) ===
 
@@ -151,6 +165,56 @@ export interface EmDashConfig {
 	 * Storage configuration (for media)
 	 */
 	storage?: StorageDescriptor;
+
+	/**
+	 * Optional distributed object cache for query results.
+	 *
+	 * Off by default. When configured, content and chrome (settings, menus,
+	 * taxonomies) reads are cached in a fast key/value store and served without
+	 * touching the database on repeat requests across isolates. This offloads
+	 * read pressure from D1/SQLite, which is especially valuable on Cloudflare
+	 * where D1 has far lower request capacity than KV.
+	 *
+	 * Use a backend adapter:
+	 * - `memoryCache()` from `emdash/astro` — in-isolate (Node / local dev)
+	 * - `kvCache({ binding: "CACHE" })` from `@emdash-cms/cloudflare` — KV
+	 *
+	 * Preview and visual-edit requests bypass the cache, so editors previewing
+	 * see live content. All other reads — including authenticated browsing outside
+	 * edit mode — are served from the cache, which only ever stores published
+	 * content. After an edit, anonymous visitors may see stale content until other
+	 * isolates pick up the bumped epoch: immediate with the memory backend, and on
+	 * KV bounded by KV's edge-cache propagation (eventual consistency, up to ~60s)
+	 * plus the isolate-local `revalidate` window (default 1s).
+	 *
+	 * Scheduled content becomes visible at query time (no write event fires when
+	 * its publish time passes), so a cached list/entry won't surface a newly-due
+	 * scheduled item until the next write to that collection or until the
+	 * entry's TTL lapses (`defaultTtl`, default 1h). Sites that rely on precise
+	 * scheduled publishing should lower `defaultTtl` accordingly.
+	 *
+	 * @example
+	 * ```ts
+	 * import { kvCache } from "@emdash-cms/cloudflare";
+	 *
+	 * emdash({
+	 *   database: d1({ binding: "DB" }),
+	 *   objectCache: kvCache({ binding: "CACHE" }),
+	 * })
+	 * ```
+	 */
+	objectCache?: ObjectCacheDescriptor;
+	/**
+	 * Image optimization.
+	 *
+	 * By default EmDash wraps Astro's image endpoint so media served from
+	 * storage is optimized through the normal `<Image>` / `getImage` pipeline,
+	 * loading source bytes directly from the storage adapter (works behind
+	 * Cloudflare Access). Set to `false` to leave Astro's image endpoint
+	 * untouched -- media then renders as a plain `<img>` unless your image
+	 * service can fetch it over HTTP.
+	 */
+	images?: boolean;
 	/**
 	 * Trusted plugins to load (run in main isolate)
 	 *