emdash 0.26.0 → 0.28.0

package/src/astro/integration/vite-config.ts

@@ -444,7 +444,18 @@ export function createViteConfig(
 						// during pre-bundling and can't resolve them. Vite's exclude
 						// uses prefix matching (id.startsWith(m + "/")), so
 						// "virtual:emdash" matches all "virtual:emdash/*" imports.
-						exclude: ["virtual:emdash"],
+						//
+						// First-party packages must also stay excluded. In a
+						// real install (unlike the workspace symlink, which Vite never
+						// optimizes), the optimizer bundles their dist and code-splits
+						// lazily-executed dynamic imports (MCP tools, content
+						// validation) into hashed chunks. A mid-session re-optimization
+						// deletes those chunks while loaded modules still reference
+						// them, so every content write fails with "The file does not
+						// exist at .../deps_ssr/..." until the dev server restarts.
+						// Their CJS deps are still pre-bundled via the "parent > dep"
+						// include entries below, which resolve through excluded parents.
+						exclude: ["virtual:emdash", "emdash", "@emdash-cms/admin", "@emdash-cms/cloudflare"],
 						include: [
 							// EmDash direct deps
 							"emdash > @portabletext/toolkit",
@@ -455,6 +466,9 @@ export function createViteConfig(
 							"emdash > jose",
 							"emdash > jpeg-js",
 							"emdash > kysely",
+							// Only imported by the migration runner, so the first
+							// dev-bypass/setup request would otherwise discover it.
+							"emdash > kysely/migration",
 							"emdash > mime/lite",
 							"emdash > modern-tar",
 							"emdash > sanitize-html",
@@ -496,6 +510,7 @@ export function createViteConfig(
 							// Top-level deps (use astro > path for pnpm compat)
 							"astro > zod/v4",
 							"astro > zod/v4/core",
+							"astro/zod",
 							// zod-generator imports the bare `zod` entry, not `zod/v4`
 							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
@@ -507,6 +522,9 @@ export function createViteConfig(
 							"astro/assets/fonts/runtime.js",
 							"astro/assets/services/noop",
 							"@astrojs/cloudflare/image-service",
+							// Only imported by the /_image route, so the first image
+							// request would otherwise discover it.
+							"@astrojs/cloudflare/image-transform-endpoint",
 						],
 					},
 				}

package/src/astro/middleware/auth.ts

@@ -34,7 +34,7 @@ import { getAuthMode, type ExternalAuthMode } from "../../auth/mode.js";
 import type { ExternalAuthConfig } from "../../auth/types.js";
 import { resolveSessionUser } from "../session-user.js";
 import type { EmDashHandlers } from "../types.js";
-import { buildEmDashCsp } from "./csp.js";
+import { buildEmDashCsp, getConfiguredStorageEndpoint } from "./csp.js";
 
 declare global {
 	namespace App {
@@ -120,6 +120,7 @@ const PUBLIC_API_EXACT = new Set([
 	// so unauthenticated callers only see published content. Admin endpoints
 	// (/enable, /rebuild, /stats) remain private because they're not in this set.
 	"/_emdash/api/search",
+	"/_emdash/api/search/suggest",
 ]);
 
 // Build merged public routes at module load from auth provider descriptors.
@@ -305,7 +306,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		if (!import.meta.env.DEV) {
 			response.headers.set(
 				"Content-Security-Policy",
-				buildEmDashCsp(context.locals.emdash?.config.experimental?.registry),
+				buildEmDashCsp(
+					context.locals.emdash?.config.experimental?.registry,
+					getConfiguredStorageEndpoint(context.locals.emdash?.config.storage),
+				),
 			);
 		}
 		return response;
@@ -317,7 +321,10 @@ export const onRequest = defineMiddleware(async (context, next) => {
 	if (!import.meta.env.DEV) {
 		response.headers.set(
 			"Content-Security-Policy",
-			buildEmDashCsp(context.locals.emdash?.config.experimental?.registry),
+			buildEmDashCsp(
+				context.locals.emdash?.config.experimental?.registry,
+				getConfiguredStorageEndpoint(context.locals.emdash?.config.storage),
+			),
 		);
 	}
 

package/src/astro/middleware/csp.ts

@@ -9,9 +9,44 @@
  * may reference external images (migrations, external hosting, embeds).
  * Plugin security does not rely on img-src -- plugins run in V8 isolates with
  * no DOM access. connect-src stays at 'self' unless the experimental registry
- * is configured, in which case the configured aggregator origin is allowed.
+ * and/or the configured storage endpoint (for direct-to-S3 signed uploads)
+ * are configured, in which case those origins are allowed too.
  */
 import type { RegistryConfigInput } from "../../registry/types.js";
+import type { StorageDescriptor } from "../storage/types.js";
+
+/** Entrypoint constant used by the `s3()` adapter (see `astro/storage/adapters.ts`). */
+const S3_ADAPTER_ENTRYPOINT = "emdash/storage/s3";
+
+/**
+ * Storage entrypoints are free to shape their config however they like, so
+ * `endpoint` isn't a known field on `StorageDescriptor["config"]` -- only
+ * S3-compatible adapters (R2, S3, Minio, ...) set it. Anything else (e.g.
+ * local filesystem storage) simply has no `endpoint` to allow.
+ *
+ * The `s3()` adapter resolves any field omitted from its config -- including
+ * `endpoint` -- from the matching `S3_*` env var at runtime (see
+ * `storage/s3.ts`'s `resolveS3Config`). A site configured as `s3({ ... })`
+ * with only `S3_ENDPOINT` set has no `endpoint` in the descriptor's config,
+ * so fall back to that env var for S3-adapter storage before giving up.
+ */
+export function getConfiguredStorageEndpoint(
+	storage: StorageDescriptor | undefined,
+): string | undefined {
+	const config = storage?.config;
+	if (typeof config === "object" && config !== null && "endpoint" in config) {
+		const endpoint = config.endpoint;
+		if (typeof endpoint === "string") return endpoint;
+	}
+
+	if (storage?.entrypoint === S3_ADAPTER_ENTRYPOINT) {
+		const envEndpoint =
+			typeof process !== "undefined" && process.env ? process.env.S3_ENDPOINT : undefined;
+		if (envEndpoint) return envEndpoint;
+	}
+
+	return undefined;
+}
 
 function getRegistryAggregatorOrigin(
 	registry: RegistryConfigInput | undefined,
@@ -28,10 +63,26 @@ function getRegistryAggregatorOrigin(
 	}
 }
 
-export function buildEmDashCsp(registry?: RegistryConfigInput): string {
+function getHttpOrigin(rawUrl: string | undefined): string | undefined {
+	if (!rawUrl) return undefined;
+
+	try {
+		const url = new URL(rawUrl);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return undefined;
+		return url.origin;
+	} catch {
+		return undefined;
+	}
+}
+
+export function buildEmDashCsp(registry?: RegistryConfigInput, storageEndpoint?: string): string {
 	const connectSrc = ["connect-src 'self'"];
+	const origins = new Set<string>();
 	const registryAggregatorOrigin = getRegistryAggregatorOrigin(registry);
-	if (registryAggregatorOrigin) connectSrc.push(registryAggregatorOrigin);
+	if (registryAggregatorOrigin) origins.add(registryAggregatorOrigin);
+	const storageOrigin = getHttpOrigin(storageEndpoint);
+	if (storageOrigin) origins.add(storageOrigin);
+	connectSrc.push(...origins);
 
 	return [
 		"default-src 'self'",

package/src/astro/middleware.ts

@@ -752,6 +752,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					hooks: runtime.hooks,
 					email: runtime.email,
 					configuredPlugins: runtime.configuredPlugins,
+					sandboxedPluginEntries: runtime.sandboxedPluginEntries,
 
 					// Configuration (for checking database type, auth mode, etc.)
 					config,

package/src/astro/routes/admin.astro

@@ -24,6 +24,15 @@ const messages = await loadMessages(resolvedLocale);
 
 const adminConfig = Astro.locals.emdash?.config?.admin;
 const pageTitle = adminConfig?.siteName ? `${adminConfig.siteName} Admin` : "EmDash Admin";
+
+// The admin shell must never be stored by a shared cache. Without an explicit
+// Cache-Control, caches fall back to RFC 9111 heuristic freshness — e.g.
+// Cloudflare's Workers Cache stores header-less 200s for 2 hours — so an
+// authenticated editor's 200 could be replayed to anonymous visitors instead
+// of the login redirect. The shell is also personalized per request (locale
+// via cookie/Accept-Language). API routes already send `private, no-store`
+// (API_CACHE_HEADERS); this closes the same gap for the admin HTML.
+Astro.response.headers.set("Cache-Control", "private, no-store");
 ---
 
 <!doctype html>

package/src/astro/routes/api/admin/plugins/[id]/disable.ts

@@ -28,7 +28,12 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginDisable(emdash.db, emdash.configuredPlugins, id);
+	const result = await handlePluginDisable(
+		emdash.db,
+		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
+		id,
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/admin/plugins/[id]/enable.ts

@@ -28,7 +28,12 @@ export const POST: APIRoute = async ({ params, locals }) => {
 		return apiError("INVALID_REQUEST", "Plugin ID required", 400);
 	}
 
-	const result = await handlePluginEnable(emdash.db, emdash.configuredPlugins, id);
+	const result = await handlePluginEnable(
+		emdash.db,
+		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
+		id,
+	);
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/admin/plugins/[id]/index.ts

@@ -30,6 +30,7 @@ export const GET: APIRoute = async ({ params, locals }) => {
 	const result = await handlePluginGet(
 		emdash.db,
 		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
 		id,
 		emdash.config.marketplace,
 	);

package/src/astro/routes/api/admin/plugins/index.ts

@@ -25,6 +25,7 @@ export const GET: APIRoute = async ({ locals }) => {
 	const result = await handlePluginList(
 		emdash.db,
 		emdash.configuredPlugins,
+		emdash.sandboxedPluginEntries,
 		emdash.config.marketplace,
 	);
 

package/src/astro/routes/api/import/wordpress/rewrite-urls.ts

@@ -20,6 +20,7 @@ import { wpRewriteUrlsBody } from "#api/schemas.js";
 import { validateIdentifier } from "#db/validate.js";
 import { normalizeMediaValue } from "#media/normalize.js";
 import type { MediaProvider } from "#media/types.js";
+import { markContentMediaUsageCollectionStaleSafely } from "#media/usage/content-refresh.js";
 import type { EmDashHandlers } from "#types";
 
 import {
@@ -77,11 +78,12 @@ export const POST: APIRoute = async ({ request, locals }) => {
 	}
 };
 
-async function rewriteUrls(
+export async function rewriteUrls(
 	db: NonNullable<EmDashHandlers["db"]>,
 	urlMap: Record<string, string>,
 	getProvider: (id: string) => MediaProvider | undefined,
 	collections?: string[],
+	markUsageCollectionStale: typeof markContentMediaUsageCollectionStaleSafely = markContentMediaUsageCollectionStaleSafely,
 ): Promise<RewriteUrlsResult> {
 	const { SchemaRegistry } = await import("#schema/registry.js");
 	const registry = new SchemaRegistry(db);
@@ -92,6 +94,18 @@ async function rewriteUrls(
 		urlsRewritten: 0,
 		errors: [],
 	};
+	const staleMarkedCollections = new Set<string>();
+	const staleMarkFailedCollections = new Set<string>();
+	const markCollectionStale = async (collectionSlug: string): Promise<void> => {
+		if (staleMarkedCollections.has(collectionSlug)) return;
+		const marked = await markUsageCollectionStale(db, collectionSlug, "CONTENT_USAGE_STALE");
+		if (marked) {
+			staleMarkedCollections.add(collectionSlug);
+			staleMarkFailedCollections.delete(collectionSlug);
+		} else {
+			staleMarkFailedCollections.add(collectionSlug);
+		}
+	};
 
 	// Build base URL map for flexible matching
 	const baseMap = buildBaseUrlMap(urlMap);
@@ -102,52 +116,67 @@ async function rewriteUrls(
 		? allCollections.filter((c) => collections.includes(c.slug))
 		: allCollections;
 
-	for (const collection of targetCollections) {
-		// Get fields that might contain URLs
-		const fields = await registry.listFields(collection.id);
-		const portableTextFields = fields.filter((f) => f.type === "portableText");
-		const stringFields = fields.filter((f) => ["text", "string"].includes(f.type));
-		// Image and file fields store URLs directly as TEXT
-		const mediaFields = fields.filter((f) => ["image", "file"].includes(f.type));
-
-		if (portableTextFields.length === 0 && stringFields.length === 0 && mediaFields.length === 0)
-			continue;
-
-		// Get table name
-		validateIdentifier(collection.slug, "collection slug");
-		const tableName = `ec_${collection.slug}`;
-
-		try {
-			// Query all rows
-			const rows = await sql<{ id: string; [key: string]: unknown }>`
+	try {
+		for (const collection of targetCollections) {
+			// Get fields that might contain URLs
+			const fields = await registry.listFields(collection.id);
+			const portableTextFields = fields.filter((f) => f.type === "portableText");
+			const stringFields = fields.filter((f) => ["text", "string"].includes(f.type));
+			// Image and file fields store URLs directly as TEXT
+			const mediaFields = fields.filter((f) => ["image", "file"].includes(f.type));
+
+			if (portableTextFields.length === 0 && stringFields.length === 0 && mediaFields.length === 0)
+				continue;
+
+			// Get table name
+			validateIdentifier(collection.slug, "collection slug");
+			const tableName = `ec_${collection.slug}`;
+
+			try {
+				// Query all rows
+				const rows = await sql<{ id: string; [key: string]: unknown }>`
 				SELECT * FROM ${sql.ref(tableName)}
 				WHERE deleted_at IS NULL
 			`.execute(db);
 
-			for (const row of rows.rows) {
-				let rowUpdated = false;
-				const updates: Record<string, unknown> = {};
-				let rowUrlsRewritten = 0;
+				for (const row of rows.rows) {
+					let rowUpdated = false;
+					const updates: Record<string, unknown> = {};
+					let rowUrlsRewritten = 0;
 
-				// Handle Portable Text fields - parse JSON and rewrite URLs in blocks
-				for (const field of portableTextFields) {
-					const value = row[field.slug];
-					if (!value || typeof value !== "string") continue;
+					// Handle Portable Text fields - parse JSON and rewrite URLs in blocks
+					for (const field of portableTextFields) {
+						const value = row[field.slug];
+						if (!value || typeof value !== "string") continue;
 
-					try {
-						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- JSON.parse returns unknown; validated by Array.isArray below
-						const blocks = JSON.parse(value) as PortableTextBlock[];
-						if (!Array.isArray(blocks)) continue;
+						try {
+							// eslint-disable-next-line typescript/no-unsafe-type-assertion -- JSON.parse returns unknown; validated by Array.isArray below
+							const blocks = JSON.parse(value) as PortableTextBlock[];
+							if (!Array.isArray(blocks)) continue;
 
-						const rewriteResult = rewritePortableTextUrls(blocks, urlMap, baseMap);
+							const rewriteResult = rewritePortableTextUrls(blocks, urlMap, baseMap);
 
-						if (rewriteResult.changed) {
-							updates[field.slug] = JSON.stringify(blocks);
-							rowUpdated = true;
-							rowUrlsRewritten += rewriteResult.urlsRewritten;
+							if (rewriteResult.changed) {
+								updates[field.slug] = JSON.stringify(blocks);
+								rowUpdated = true;
+								rowUrlsRewritten += rewriteResult.urlsRewritten;
+							}
+						} catch {
+							// Not valid JSON, try string replacement as fallback
+							const stringResult = rewriteStringUrls(value, urlMap, baseMap);
+							if (stringResult.changed) {
+								updates[field.slug] = stringResult.newValue;
+								rowUpdated = true;
+								rowUrlsRewritten += stringResult.urlsRewritten;
+							}
 						}
-					} catch {
-						// Not valid JSON, try string replacement as fallback
+					}
+
+					// Handle string/text fields - simple string replacement
+					for (const field of stringFields) {
+						const value = row[field.slug];
+						if (!value || typeof value !== "string") continue;
+
 						const stringResult = rewriteStringUrls(value, urlMap, baseMap);
 						if (stringResult.changed) {
 							updates[field.slug] = stringResult.newValue;
@@ -155,74 +184,69 @@ async function rewriteUrls(
 							rowUrlsRewritten += stringResult.urlsRewritten;
 						}
 					}
-				}
-
-				// Handle string/text fields - simple string replacement
-				for (const field of stringFields) {
-					const value = row[field.slug];
-					if (!value || typeof value !== "string") continue;
-
-					const stringResult = rewriteStringUrls(value, urlMap, baseMap);
-					if (stringResult.changed) {
-						updates[field.slug] = stringResult.newValue;
-						rowUpdated = true;
-						rowUrlsRewritten += stringResult.urlsRewritten;
-					}
-				}
 
-				// Handle image/file fields - normalize to MediaValue objects
-				for (const field of mediaFields) {
-					const value = row[field.slug];
-					if (!value || typeof value !== "string") continue;
-
-					// Values are stored as JSON MediaValue objects (e.g. featured_image from
-					// import normalizes to {"provider":"external","src":"<wp url>"}). Match on the
-					// inner `src`, falling back to the raw value for legacy bare-URL rows.
-					const newUrl = findMatchingUrl(extractMediaUrl(value), urlMap, baseMap);
-					if (newUrl) {
-						// Normalize into a proper MediaValue instead of storing a bare URL
-						try {
-							const normalized = await normalizeMediaValue(newUrl, getProvider);
-							updates[field.slug] = normalized ? JSON.stringify(normalized) : newUrl;
-						} catch {
-							updates[field.slug] = newUrl;
+					// Handle image/file fields - normalize to MediaValue objects
+					for (const field of mediaFields) {
+						const value = row[field.slug];
+						if (!value || typeof value !== "string") continue;
+
+						// Values are stored as JSON MediaValue objects (e.g. featured_image from
+						// import normalizes to {"provider":"external","src":"<wp url>"}). Match on the
+						// inner `src`, falling back to the raw value for legacy bare-URL rows.
+						const newUrl = findMatchingUrl(extractMediaUrl(value), urlMap, baseMap);
+						if (newUrl) {
+							// Normalize into a proper MediaValue instead of storing a bare URL
+							try {
+								const normalized = await normalizeMediaValue(newUrl, getProvider);
+								updates[field.slug] = normalized ? JSON.stringify(normalized) : newUrl;
+							} catch {
+								updates[field.slug] = newUrl;
+							}
+							rowUpdated = true;
+							rowUrlsRewritten++;
 						}
-						rowUpdated = true;
-						rowUrlsRewritten++;
 					}
-				}
-
-				if (rowUpdated) {
-					try {
-						// Build update query dynamically
-						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Kysely dynamic table requires type assertion
-						let query = db.updateTable(tableName as any).where("id", "=", row.id);
 
-						for (const [key, value] of Object.entries(updates)) {
-							// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Kysely dynamic column update requires type assertion
-							query = query.set({ [key]: value } as any);
+					if (rowUpdated) {
+						try {
+							// Build update query dynamically
+							// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Kysely dynamic table requires type assertion
+							let query = db.updateTable(tableName as any).where("id", "=", row.id);
+
+							for (const [key, value] of Object.entries(updates)) {
+								// eslint-disable-next-line typescript/no-unsafe-type-assertion -- Kysely dynamic column update requires type assertion
+								query = query.set({ [key]: value } as any);
+							}
+
+							await query.execute();
+
+							result.updated++;
+							result.urlsRewritten += rowUrlsRewritten;
+							result.byCollection[collection.slug] =
+								(result.byCollection[collection.slug] || 0) + 1;
+							await markCollectionStale(collection.slug);
+						} catch (updateError) {
+							result.errors.push({
+								collection: collection.slug,
+								id: row.id,
+								error: updateError instanceof Error ? updateError.message : "Update failed",
+							});
 						}
-
-						await query.execute();
-
-						result.updated++;
-						result.urlsRewritten += rowUrlsRewritten;
-						result.byCollection[collection.slug] = (result.byCollection[collection.slug] || 0) + 1;
-					} catch (updateError) {
-						result.errors.push({
-							collection: collection.slug,
-							id: row.id,
-							error: updateError instanceof Error ? updateError.message : "Update failed",
-						});
 					}
 				}
+			} catch (queryError) {
+				result.errors.push({
+					collection: collection.slug,
+					id: "*",
+					error: queryError instanceof Error ? queryError.message : "Query failed for collection",
+				});
 			}
-		} catch (queryError) {
-			result.errors.push({
-				collection: collection.slug,
-				id: "*",
-				error: queryError instanceof Error ? queryError.message : "Query failed for collection",
-			});
+		}
+	} finally {
+		for (const collectionSlug of staleMarkFailedCollections) {
+			if (staleMarkedCollections.has(collectionSlug)) continue;
+			const marked = await markUsageCollectionStale(db, collectionSlug, "CONTENT_USAGE_STALE");
+			if (marked) staleMarkedCollections.add(collectionSlug);
 		}
 	}