emdash 0.26.0 → 0.27.0

package/src/api/handlers/plugins.ts

@@ -5,6 +5,7 @@
 import type { Kysely } from "kysely";
 
 import type { Database } from "../../database/types.js";
+import type { SandboxedPluginEntry } from "../../emdash-runtime.js";
 import { PluginStateRepository, type PluginState, type PluginStatus } from "../../plugins/state.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import type { ApiResult } from "../types.js";
@@ -17,6 +18,8 @@ export interface PluginInfo {
 	enabled: boolean;
 	status: PluginStatus;
 	source?: "config" | "marketplace" | "registry";
+	/** True for statically-sandboxed plugins (registered via `sandboxed: []`) */
+	sandboxed?: boolean;
 	marketplaceVersion?: string;
 	/** Publisher DID, for registry-source plugins */
 	registryPublisherDid?: string;
@@ -84,12 +87,43 @@ function buildPluginInfo(
 	};
 }
 
+/**
+ * Build plugin info for a statically-sandboxed plugin entry
+ */
+function buildSandboxedPluginInfo(
+	entry: SandboxedPluginEntry,
+	state: PluginState | null,
+): PluginInfo {
+	const status = state?.status ?? "active";
+	const enabled = status === "active";
+
+	return {
+		id: entry.id,
+		name: state?.displayName || entry.id,
+		version: entry.version,
+		package: undefined, // v2 doesn't have package field
+		enabled,
+		status,
+		source: "config",
+		sandboxed: true,
+		capabilities: entry.capabilities,
+		hasAdminPages: (entry.adminPages?.length ?? 0) > 0,
+		hasDashboardWidgets: (entry.adminWidgets?.length ?? 0) > 0,
+		hasHooks: false,
+		installedAt: state?.installedAt?.toISOString(),
+		activatedAt: state?.activatedAt?.toISOString() ?? undefined,
+		deactivatedAt: state?.deactivatedAt?.toISOString() ?? undefined,
+		description: state?.description ?? undefined,
+	};
+}
+
 /**
  * List all configured plugins with their state
  */
 export async function handlePluginList(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	marketplaceUrl?: string,
 ): Promise<ApiResult<PluginListResponse>> {
 	try {
@@ -104,6 +138,14 @@ export async function handlePluginList(
 			return buildPluginInfo(plugin, state, marketplaceUrl);
 		});
 
+		// Include statically-sandboxed plugins (registered via `sandboxed: []`
+		// in astro.config.mjs).
+		for (const entry of sandboxedPluginEntries) {
+			if (configuredIds.has(entry.id)) continue;
+			configuredIds.add(entry.id);
+			items.push(buildSandboxedPluginInfo(entry, stateMap.get(entry.id) ?? null));
+		}
+
 		// Include runtime-installed plugins (marketplace or registry) that
 		// aren't in the configured plugins list.
 		for (const state of allStates) {
@@ -156,27 +198,37 @@ export async function handlePluginList(
 export async function handlePluginGet(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 	marketplaceUrl?: string,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
+		const stateRepo = new PluginStateRepository(db);
 		const plugin = configuredPlugins.find((p) => p.id === pluginId);
-		if (!plugin) {
+
+		if (plugin) {
+			const state = await stateRepo.get(pluginId);
 			return {
-				success: false,
-				error: {
-					code: "NOT_FOUND",
-					message: `Plugin not found: ${pluginId}`,
-				},
+				success: true,
+				data: { item: buildPluginInfo(plugin, state, marketplaceUrl) },
 			};
 		}
 
-		const stateRepo = new PluginStateRepository(db);
-		const state = await stateRepo.get(pluginId);
+		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+		if (sandboxed) {
+			const state = await stateRepo.get(pluginId);
+			return {
+				success: true,
+				data: { item: buildSandboxedPluginInfo(sandboxed, state) },
+			};
+		}
 
 		return {
-			success: true,
-			data: { item: buildPluginInfo(plugin, state, marketplaceUrl) },
+			success: false,
+			error: {
+				code: "NOT_FOUND",
+				message: `Plugin not found: ${pluginId}`,
+			},
 		};
 	} catch {
 		return {
@@ -227,6 +279,7 @@ function buildStateOnlyPluginInfo(
 export async function handlePluginEnable(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
@@ -239,6 +292,13 @@ export async function handlePluginEnable(
 			return { success: true, data: { item: buildPluginInfo(plugin, state) } };
 		}
 
+		// Statically-sandboxed plugin: addressable via its build-time entry.
+		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+		if (sandboxed) {
+			const state = await stateRepo.enable(pluginId, sandboxed.version);
+			return { success: true, data: { item: buildSandboxedPluginInfo(sandboxed, state) } };
+		}
+
 		// Runtime-installed plugin (marketplace or registry): only
 		// addressable through the state row. Fall back to the existing
 		// version recorded there.
@@ -268,6 +328,7 @@ export async function handlePluginEnable(
 export async function handlePluginDisable(
 	db: Kysely<Database>,
 	configuredPlugins: ResolvedPlugin[],
+	sandboxedPluginEntries: SandboxedPluginEntry[],
 	pluginId: string,
 ): Promise<ApiResult<PluginResponse>> {
 	try {
@@ -279,6 +340,12 @@ export async function handlePluginDisable(
 			return { success: true, data: { item: buildPluginInfo(plugin, state) } };
 		}
 
+		const sandboxed = sandboxedPluginEntries.find((e) => e.id === pluginId);
+		if (sandboxed) {
+			const state = await stateRepo.disable(pluginId, sandboxed.version);
+			return { success: true, data: { item: buildSandboxedPluginInfo(sandboxed, state) } };
+		}
+
 		const existing = await stateRepo.get(pluginId);
 		if (!existing || (existing.source !== "marketplace" && existing.source !== "registry")) {
 			return {

package/src/astro/integration/vite-config.ts

@@ -444,7 +444,18 @@ export function createViteConfig(
 						// during pre-bundling and can't resolve them. Vite's exclude
 						// uses prefix matching (id.startsWith(m + "/")), so
 						// "virtual:emdash" matches all "virtual:emdash/*" imports.
-						exclude: ["virtual:emdash"],
+						//
+						// First-party packages must also stay excluded. In a
+						// real install (unlike the workspace symlink, which Vite never
+						// optimizes), the optimizer bundles their dist and code-splits
+						// lazily-executed dynamic imports (MCP tools, content
+						// validation) into hashed chunks. A mid-session re-optimization
+						// deletes those chunks while loaded modules still reference
+						// them, so every content write fails with "The file does not
+						// exist at .../deps_ssr/..." until the dev server restarts.
+						// Their CJS deps are still pre-bundled via the "parent > dep"
+						// include entries below, which resolve through excluded parents.
+						exclude: ["virtual:emdash", "emdash", "@emdash-cms/admin", "@emdash-cms/cloudflare"],
 						include: [
 							// EmDash direct deps
 							"emdash > @portabletext/toolkit",
@@ -455,6 +466,9 @@ export function createViteConfig(
 							"emdash > jose",
 							"emdash > jpeg-js",
 							"emdash > kysely",
+							// Only imported by the migration runner, so the first
+							// dev-bypass/setup request would otherwise discover it.
+							"emdash > kysely/migration",
 							"emdash > mime/lite",
 							"emdash > modern-tar",
 							"emdash > sanitize-html",
@@ -496,6 +510,7 @@ export function createViteConfig(
 							// Top-level deps (use astro > path for pnpm compat)
 							"astro > zod/v4",
 							"astro > zod/v4/core",
+							"astro/zod",
 							// zod-generator imports the bare `zod` entry, not `zod/v4`
 							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
@@ -507,6 +522,9 @@ export function createViteConfig(
 							"astro/assets/fonts/runtime.js",
 							"astro/assets/services/noop",
 							"@astrojs/cloudflare/image-service",
+							// Only imported by the /_image route, so the first image
+							// request would otherwise discover it.
+							"@astrojs/cloudflare/image-transform-endpoint",
 						],
 					},
 				}

package/src/astro/middleware/auth.ts

@@ -120,6 +120,7 @@ const PUBLIC_API_EXACT = new Set([
 	// so unauthenticated callers only see published content. Admin endpoints
 	// (/enable, /rebuild, /stats) remain private because they're not in this set.
 	"/_emdash/api/search",
+	"/_emdash/api/search/suggest",
 ]);
 
 // Build merged public routes at module load from auth provider descriptors.

package/src/astro/middleware.ts

@@ -752,6 +752,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					hooks: runtime.hooks,
 					email: runtime.email,
 					configuredPlugins: runtime.configuredPlugins,
+					sandboxedPluginEntries: runtime.sandboxedPluginEntries,
 
 					// Configuration (for checking database type, auth mode, etc.)
 					config,

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -28,7 +28,12 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginDisable(emdash.db, emdash.configuredPlugins, id);
+	const result = await handlePluginDisable(
+		emdash.db,
+		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
+		id,
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -28,7 +28,12 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginEnable(emdash.db, emdash.configuredPlugins, id);
+	const result = await handlePluginEnable(
+		emdash.db,
+		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
+		id,
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/admin/plugins/[id]/index.ts

@@ -30,6 +30,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const result = await handlePluginGet(
 		emdash.db,
 		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
 		id,
 		emdash.config.marketplace,
 	);

package/src/astro/routes/api/admin/plugins/index.ts

@@ -25,6 +25,7 @@ export const GET: APIRoute = async ({ locals }) => {
 	const result = await handlePluginList(
 		emdash.db,
 		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
 		emdash.config.marketplace,
 	);
 

package/src/astro/routes/api/manifest.ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { handleError } from "#api/error.js";
 import { getAuthMode } from "#auth/mode.js";
+import { OptionsRepository } from "#db/repositories/options.js";
 
 import { COMMIT, VERSION } from "../../../version.js";
 import type { EmDashManifest } from "../../types.js";
@@ -39,7 +40,25 @@ export const GET: APIRoute = async ({ locals }) => {
 		// doesn't assign it to globalThis, so getStoredConfig() always returned
 		// null and the React SPA never received custom logo/siteName/favicon.
 		// See issue #835.
-		const adminBranding = emdash?.config?.admin;
+		let adminBranding = emdash?.config?.admin;
+
+		// When no build-time `admin.siteName` is configured, brand the admin with
+		// the site's own title so multi-site operators can tell backends apart
+		// (WordPress-style: wp-admin always shows the site name). Precedence:
+		// explicit `admin.siteName` → Site Title (Settings → General) → the title
+		// captured by the setup wizard → the bundled "EmDash" default in the SPA.
+		if (!adminBranding?.siteName && emdash?.db) {
+			try {
+				const options = new OptionsRepository(emdash.db);
+				const titles = await options.getMany<string>(["site:title", "emdash:site_title"]);
+				const siteTitle = titles.get("site:title") || titles.get("emdash:site_title");
+				if (siteTitle) {
+					adminBranding = { ...adminBranding, siteName: siteTitle };
+				}
+			} catch {
+				// options table may not exist yet (pre-setup) — keep the default.
+			}
+		}
 
 		// Check if self-signup is enabled (any allowed domain with enabled = 1)
 		// Only relevant for passkey auth — external auth providers handle their own signup

package/src/astro/routes/api/setup/dev-bypass.ts

@@ -10,6 +10,8 @@
  * Usage:
  * - GET with redirect: /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin
  * - POST for API: Returns JSON with setup info
+ * - ?content=0 (or ?content=false): apply schema/structure only, skipping
+ *   sample content entries, bylines, and taxonomy terms
  *
  * For agent/browser testing, navigate to:
  *   /_emdash/api/setup/dev-bypass?redirect=/_emdash/admin
@@ -57,12 +59,15 @@ async function handleDevBypass(context: Parameters<APIRoute>[0]): Promise<Respon
 		const migrations = await runMigrations(emdash.db);
 		console.log("[setup-dev-bypass] Migrations applied:", migrations.applied);
 
-		// Apply seed (user seed or built-in default)
+		// Apply seed (user seed or built-in default). `?content=0` (or `false`)
+		// applies schema/structure only — no sample content, bylines, or terms.
+		const contentParam = url.searchParams.get("content");
+		const includeContent = contentParam !== "0" && contentParam !== "false";
 		const seed = await loadSeed();
 		const validation = validateSeed(seed);
 		if (validation.valid) {
 			const seedResult = await applySeed(emdash.db, seed, {
-				includeContent: true,
+				includeContent,
 				onConflict: "skip",
 				storage: emdash.storage ?? undefined,
 			});

package/src/astro/types.ts

@@ -434,6 +434,10 @@ export interface EmDashHandlers {
 	// Configured plugins (for plugin management)
 	configuredPlugins: import("../plugins/types.js").ResolvedPlugin[];
 
+	// Statically-sandboxed plugin entries (registered via `sandboxed: []`),
+	// surfaced through the admin plugin management API alongside configured plugins.
+	sandboxedPluginEntries: import("../emdash-runtime.js").SandboxedPluginEntry[];
+
 	// Configuration (for checking database type, auth mode, etc.)
 	config: import("./integration/runtime.js").EmDashConfig;
 

package/src/cli/commands/seed.ts

@@ -108,7 +108,7 @@ export const seedCommand = defineCommand({
 		},
 		"no-content": {
 			type: "boolean",
-			description: "Skip sample content",
+			description: "Skip sample data (content entries, bylines, taxonomy terms)",
 			default: false,
 		},
 		"on-conflict": {

package/src/components/LiveSearch.astro

@@ -34,6 +34,8 @@ export interface Props {
 	limit?: number;
 	/** CSS class for the container */
 	class?: string;
+	/** Inline style for the container */
+	style?: string;
 	/** CSS class for the input */
 	inputClass?: string;
 	/** CSS class for the results container */
@@ -48,6 +50,10 @@ export interface Props {
 	suggestMode?: boolean;
 	/** Expand input width on focus (provide collapsed and expanded widths) */
 	expandOnFocus?: { collapsed: string; expanded: string };
+	/** Search results page to navigate to when pressing Enter without a focused result */
+	searchPage?: string;
+	/** Per-collection URL templates, e.g. { posts: "/blog/:path" } */
+	routeMap?: Record<string, string>;
 }
 
 const {
@@ -57,6 +63,7 @@ const {
 	debounce = 300,
 	limit = 10,
 	class: className = "",
+	style: styleAttr = "",
 	inputClass = "",
 	resultsClass = "",
 	resultClass = "",
@@ -64,6 +71,8 @@ const {
 	autofocus = false,
 	suggestMode = false,
 	expandOnFocus,
+	searchPage = "",
+	routeMap = {},
 } = Astro.props;
 
 const config = {
@@ -74,11 +83,14 @@ const config = {
 	showSnippets,
 	suggestMode,
 	expandOnFocus: expandOnFocus ?? null,
+	searchPage,
+	routeMap,
 };
 ---
 
 <emdash-live-search
 	class:list={["emdash-live-search", className]}
+	style={styleAttr}
 	data-config={JSON.stringify(config)}
 >
 	<input
@@ -109,6 +121,12 @@ const config = {
 </emdash-live-search>
 
 <script>
+	import {
+		buildLiveSearchResultUrl,
+		type LiveSearchRouteMap,
+		type LiveSearchRoutableResult,
+	} from "./live-search-routing.js";
+
 	interface SearchResult {
 		collection: string;
 		id: string;
@@ -121,6 +139,7 @@ const config = {
 	interface Suggestion {
 		collection: string;
 		id: string;
+		slug?: string | null;
 		title: string;
 	}
 
@@ -132,6 +151,8 @@ const config = {
 		showSnippets: boolean;
 		suggestMode: boolean;
 		expandOnFocus: { collapsed: string; expanded: string } | null;
+		searchPage: string;
+		routeMap: LiveSearchRouteMap;
 	}
 
 	class EmDashLiveSearch extends HTMLElement {
@@ -149,6 +170,8 @@ const config = {
 			showSnippets: true,
 			suggestMode: false,
 			expandOnFocus: null,
+			searchPage: "",
+			routeMap: {},
 		};
 		private debounceTimer: ReturnType<typeof setTimeout> | null = null;
 		private abortController: AbortController | null = null;
@@ -268,11 +291,25 @@ const config = {
 					".emdash-live-search-result:focus, .emdash-live-search-result.focused"
 				) as HTMLAnchorElement | null;
 				if (focused?.href) {
+					e.preventDefault();
 					window.location.href = focused.href;
+					return;
+				}
+
+				const query = this.input?.value.trim();
+				if (query && this.config.searchPage) {
+					e.preventDefault();
+					const url = new URL(this.config.searchPage, window.location.origin);
+					url.searchParams.set("q", query);
+					window.location.href = url.toString();
 				}
 			}
 		}
 
+		private buildResultUrl(result: LiveSearchRoutableResult): string {
+			return buildLiveSearchResultUrl(result, this.config.routeMap);
+		}
+
 		private navigateResults(direction: number) {
 			if (!this.resultsList) return;
 
@@ -369,9 +406,7 @@ const config = {
 				const link = clone.querySelector("a");
 
 				if (link) {
-					// Build URL - use slug if available, otherwise id
-					const path = result.slug ?? result.id;
-					link.href = `/${result.collection}/${path}`;
+					link.href = this.buildResultUrl(result);
 
 					// Fill in title
 					const titleEl = link.querySelector(
@@ -430,7 +465,7 @@ const config = {
 				const link = clone.querySelector("a");
 
 				if (link) {
-					link.href = `/${suggestion.collection}/${suggestion.id}`;
+					link.href = this.buildResultUrl(suggestion);
 
 					const titleEl = link.querySelector(
 						".emdash-live-search-result-title"
@@ -456,6 +491,7 @@ const config = {
 
 					link.dataset.id = suggestion.id;
 					link.dataset.collection = suggestion.collection;
+					link.dataset.slug = suggestion.slug ?? "";
 				}
 
 				this.resultsList.appendChild(clone);

package/src/components/live-search-routing.ts

@@ -0,0 +1,30 @@
+export interface LiveSearchRoutableResult {
+	collection: string;
+	id: string;
+	slug?: string | null;
+}
+
+export type LiveSearchRouteMap = Record<string, string>;
+
+function replaceRouteToken(template: string, token: string, value: string): string {
+	return template.split(token).join(value);
+}
+
+export function buildLiveSearchResultUrl(
+	result: LiveSearchRoutableResult,
+	routeMap: LiveSearchRouteMap = {},
+): string {
+	const path = result.slug ?? result.id;
+	const template = routeMap[result.collection];
+
+	if (!template) {
+		return `/${result.collection}/${path}`;
+	}
+
+	return [
+		[":collection", result.collection],
+		[":id", result.id],
+		[":slug", result.slug ?? result.id],
+		[":path", path],
+	].reduce((url, [token, value]) => replaceRouteToken(url, token, value), template);
+}

package/src/database/migrations/036_i18n_menus_and_taxonomies.ts

@@ -259,27 +259,32 @@ async function rebuildContentTaxonomies(db: Kysely<unknown>): Promise<void> {
 	// is load-bearing — if the translation_group seed ever changes, this needs
 	// an explicit remap *after* `rebuildTaxonomies` runs.
 	const fks = await sql<{ id: number }>`PRAGMA foreign_key_list(content_taxonomies)`.execute(db);
-	if (fks.rows.length === 0) return;
+	if (fks.rows.length > 0) {
+		await sql.raw(`DROP TABLE IF EXISTS "content_taxonomies_new"`).execute(db);
+		await db.schema
+			.createTable("content_taxonomies_new")
+			.addColumn("collection", "text", (c) => c.notNull())
+			.addColumn("entry_id", "text", (c) => c.notNull())
+			.addColumn("taxonomy_id", "text", (c) => c.notNull())
+			.addPrimaryKeyConstraint("content_taxonomies_pk", ["collection", "entry_id", "taxonomy_id"])
+			.execute();
 
-	await sql.raw(`DROP TABLE IF EXISTS "content_taxonomies_new"`).execute(db);
-	await db.schema
-		.createTable("content_taxonomies_new")
-		.addColumn("collection", "text", (c) => c.notNull())
-		.addColumn("entry_id", "text", (c) => c.notNull())
-		.addColumn("taxonomy_id", "text", (c) => c.notNull())
-		.addPrimaryKeyConstraint("content_taxonomies_pk", ["collection", "entry_id", "taxonomy_id"])
-		.execute();
-
-	await sql`
-		INSERT OR IGNORE INTO content_taxonomies_new (collection, entry_id, taxonomy_id)
-		SELECT collection, entry_id, taxonomy_id FROM content_taxonomies
-	`.execute(db);
+		await sql`
+			INSERT OR IGNORE INTO content_taxonomies_new (collection, entry_id, taxonomy_id)
+			SELECT collection, entry_id, taxonomy_id FROM content_taxonomies
+		`.execute(db);
 
-	await db.schema.dropTable("content_taxonomies").execute();
-	await sql`ALTER TABLE content_taxonomies_new RENAME TO content_taxonomies`.execute(db);
+		await db.schema.dropTable("content_taxonomies").execute();
+		await sql`ALTER TABLE content_taxonomies_new RENAME TO content_taxonomies`.execute(db);
+	}
 
-	// SQLite drops indexes when the underlying table is dropped. Restore the
-	// taxonomy_id index from migration 015.
+	// Recreate the taxonomy_id index from migration 015 unconditionally, OUTSIDE
+	// the FK-presence guard above. The rebuild both strips the FK and drops the
+	// old table's indexes, but D1 auto-commits each DDL statement — so a first
+	// run that failed after the drop leaves the table with no FK and no index.
+	// The retry then finds zero FKs and skips the rebuild; if the index recreate
+	// lived inside that guard it would never run and the index would be lost for
+	// good (#1701). `IF NOT EXISTS` keeps this a no-op once present.
 	await sql`CREATE INDEX IF NOT EXISTS idx_content_taxonomies_term ON content_taxonomies(taxonomy_id)`.execute(
 		db,
 	);

package/src/database/migrations/048_restore_content_taxonomies_term_index.ts

@@ -0,0 +1,32 @@
+import type { Kysely } from "kysely";
+
+/**
+ * Restore `idx_content_taxonomies_term` on `content_taxonomies(taxonomy_id)` (#1701).
+ *
+ * Migration 015 created this index. 036's SQLite/D1 table rebuild recreated it,
+ * but the recreate was gated behind an FK-presence early-return: if a first run
+ * committed the rebuild (stripping the FK and dropping the old index) and then
+ * failed before the recreate, the retry saw zero FKs, skipped the whole body,
+ * and never restored the index — while 036 was still recorded as applied. The
+ * result was an install missing only this one index, with no forward migration
+ * to recover it (the sibling `idx_taxonomies_parent` case was fixed by 047).
+ *
+ * 036 has since been fixed to recreate the index unconditionally, so fresh
+ * installs are fine. This recovers the index on installs that hit the trap
+ * before that fix. The Postgres path in 036 alters in place and keeps its
+ * indexes, so it is unaffected; `ifNotExists` makes this a no-op there.
+ *
+ * Forward-only.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createIndex("idx_content_taxonomies_term")
+		.ifNotExists()
+		.on("content_taxonomies")
+		.column("taxonomy_id")
+		.execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.dropIndex("idx_content_taxonomies_term").ifExists().execute();
+}

package/src/database/migrations/runner.ts

@@ -49,6 +49,7 @@ import * as m044 from "./044_comment_reactions.js";
 import * as m045 from "./045_taxonomy_parent_group.js";
 import * as m046 from "./046_media_usage_index.js";
 import * as m047 from "./047_restore_taxonomy_parent_index.js";
+import * as m048 from "./048_restore_content_taxonomies_term_index.js";
 
 const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"001_initial": m001,
@@ -97,6 +98,7 @@ const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"045_taxonomy_parent_group": m045,
 	"046_media_usage_index": m046,
 	"047_restore_taxonomy_parent_index": m047,
+	"048_restore_content_taxonomies_term_index": m048,
 });
 
 /** Total number of registered migrations. Exported for use in tests. */

package/src/search/query.ts

@@ -359,10 +359,12 @@ export async function getSuggestions(
 		try {
 			results = await sql<{
 				id: string;
+				slug: string | null;
 				title: string;
 			}>`
 				SELECT 
 					c.id,
+					c.slug,
 					c.title
 				FROM "${sql.raw(ftsTable)}" f
 				JOIN "${sql.raw(contentTable)}" c ON f.id = c.id
@@ -389,6 +391,7 @@ export async function getSuggestions(
 			suggestions.push({
 				collection,
 				id: row.id,
+				slug: row.slug,
 				title: row.title,
 			});
 		}

package/src/search/types.ts

@@ -101,6 +101,8 @@ export interface Suggestion {
 	collection: string;
 	/** Entry ID */
 	id: string;
+	/** Entry slug, when available */
+	slug?: string | null;
 	/** Entry title */
 	title: string;
 }