emdash 0.28.0 → 0.29.0

package/src/astro/routes/api/content/[collection]/[id]/references/[relation]/children.ts

@@ -0,0 +1,97 @@
+/**
+ * Content-entry reference children endpoint (parent side)
+ *
+ * GET  /_emdash/api/content/:collection/:id/references/:relation/children
+ * POST /_emdash/api/content/:collection/:id/references/:relation/children
+ */
+
+import { hasPermission } from "@emdash-cms/auth";
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReferenceChildrenGet, handleReferenceChildrenSet } from "#api/handlers/relations.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { cursorPaginationQuery, setReferenceChildrenBody } from "#api/schemas.js";
+import { ContentRepository } from "#db/repositories/content.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, relation } = params;
+
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+
+	if (!collection || !id || !relation) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const query = parseQuery(new URL(request.url), cursorPaginationQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const result = await handleReferenceChildrenGet(
+			emdash.db,
+			collection,
+			id,
+			relation,
+			{ limit: query.limit, cursor: query.cursor },
+			hasPermission(user, "content:read_drafts"),
+		);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get references", "REFERENCES_GET_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, relation } = params;
+
+	if (!collection || !id || !relation) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
+	}
+
+	// Gate on the base edit capability BEFORE the existence lookup. Resolving the
+	// entry first would let a user with no edit permission distinguish real ids
+	// (403) from missing ids (404) — an existence oracle. Mirrors the taxonomy
+	// edge POST, which checks `content:edit_own` before fetching the entry.
+	const denied = requirePerm(user, "content:edit_own");
+	if (denied) return denied;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	// Resolve the parent entry to gate on its author (ownership-aware write).
+	const parent = await new ContentRepository(emdash.db).findByIdOrSlug(collection, id);
+	if (!parent) return apiError("NOT_FOUND", "Content not found", 404);
+
+	const editDenied = requireOwnerPerm(
+		user,
+		parent.authorId ?? "",
+		"content:edit_own",
+		"content:edit_any",
+	);
+	if (editDenied) return editDenied;
+
+	try {
+		const body = await parseBody(request, setReferenceChildrenBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleReferenceChildrenSet(
+			emdash.db,
+			collection,
+			id,
+			relation,
+			body.childIds,
+		);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to set references", "REFERENCES_SET_ERROR");
+	}
+};

package/src/astro/routes/api/content/[collection]/[id]/references/[relation]/parents.ts

@@ -0,0 +1,48 @@
+/**
+ * Content-entry reference parents endpoint (child side, read-only backlink)
+ *
+ * GET /_emdash/api/content/:collection/:id/references/:relation/parents
+ */
+
+import { hasPermission } from "@emdash-cms/auth";
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleReferenceParentsGet } from "#api/handlers/relations.js";
+import { isParseError, parseQuery } from "#api/parse.js";
+import { cursorPaginationQuery } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { collection, id, relation } = params;
+
+	const denied = requirePerm(user, "content:read");
+	if (denied) return denied;
+
+	if (!collection || !id || !relation) {
+		return apiError("VALIDATION_ERROR", "Collection, id, and relation required", 400);
+	}
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const query = parseQuery(new URL(request.url), cursorPaginationQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const result = await handleReferenceParentsGet(
+			emdash.db,
+			collection,
+			id,
+			relation,
+			{ limit: query.limit, cursor: query.cursor },
+			hasPermission(user, "content:read_drafts"),
+		);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get references", "REFERENCES_GET_ERROR");
+	}
+};

package/src/astro/routes/api/plugins/[pluginId]/[...path].ts

@@ -39,11 +39,16 @@ const handleRequest: APIRoute = async ({ params, request, locals }) => {
 
 	// Public routes skip auth, CSRF, and scope checks entirely
 	if (!routeMeta.public) {
-		// Private routes require authentication and permission checks
-		const permission = ["GET", "HEAD", "OPTIONS"].includes(method)
-			? "plugins:read"
-			: "plugins:manage";
-		const denied = requirePerm(user, permission);
+		// Plugin routes are dispatched by name only — the HTTP method never
+		// selects a different handler, so a route reached via GET or HEAD runs
+		// exactly the same code (and side effects) as one reached via POST.
+		// Method-based tiering is therefore unsafe: gating GET/HEAD/OPTIONS on
+		// `plugins:read` with no CSRF let an editor (or a cross-origin page,
+		// since HEAD is CORS-safe) invoke a mutating admin route by choosing the
+		// method (#1853). Astro also dispatches HEAD to the GET export, so no
+		// explicit HEAD handler is needed to reach a "GET" route. Gate every
+		// private invocation on `plugins:manage` + CSRF regardless of method.
+		const denied = requirePerm(user, "plugins:manage");
 		if (denied) return denied;
 
 		// Token scope enforcement — plugin routes require "admin" scope.
@@ -51,16 +56,13 @@ const handleRequest: APIRoute = async ({ params, request, locals }) => {
 		const scopeError = requireScope(locals, "admin");
 		if (scopeError) return scopeError;
 
-		// CSRF protection for state-changing requests on private routes.
-		// Plugin routes use soft auth in the middleware (user resolved but not required),
-		// so the middleware's CSRF check doesn't run. We enforce it here for private routes.
-		// Token-authed requests (which set tokenScopes) are exempt — tokens aren't
-		// ambient credentials like cookies.
-		if (
-			!["GET", "HEAD", "OPTIONS"].includes(method) &&
-			!locals.tokenScopes &&
-			request.headers.get("X-EmDash-Request") !== "1"
-		) {
+		// CSRF protection on private routes. Plugin routes use soft auth in the
+		// middleware (user resolved but not required), so the middleware's CSRF
+		// check doesn't run — enforce it here. Applied to every method because
+		// any method can trigger a state change (see above). Token-authed
+		// requests (which set tokenScopes) are exempt — tokens aren't ambient
+		// credentials like cookies.
+		if (!locals.tokenScopes && request.headers.get("X-EmDash-Request") !== "1") {
 			return apiError("CSRF_REJECTED", "Missing required header", 403);
 		}
 	}

package/src/astro/routes/api/relations/[id]/index.ts

@@ -0,0 +1,84 @@
+/**
+ * Single relation definition endpoint
+ *
+ * GET    /_emdash/api/relations/:id - Get a relation
+ * PATCH  /_emdash/api/relations/:id - Update a relation's labels
+ * DELETE /_emdash/api/relations/:id - Delete a relation
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import {
+	handleRelationDelete,
+	handleRelationGet,
+	handleRelationUpdate,
+} from "#api/handlers/relations.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { updateRelationBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:read");
+	if (denied) return denied;
+
+	if (!id) return apiError("VALIDATION_ERROR", "Relation id required", 400);
+
+	try {
+		const result = await handleRelationGet(emdash.db, id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get relation", "RELATION_GET_ERROR");
+	}
+};
+
+export const PATCH: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+
+	if (!id) return apiError("VALIDATION_ERROR", "Relation id required", 400);
+
+	try {
+		const body = await parseBody(request, updateRelationBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleRelationUpdate(emdash.db, id, body);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update relation", "RELATION_UPDATE_ERROR");
+	}
+};
+
+export const DELETE: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+
+	if (!id) return apiError("VALIDATION_ERROR", "Relation id required", 400);
+
+	try {
+		const result = await handleRelationDelete(emdash.db, id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to delete relation", "RELATION_DELETE_ERROR");
+	}
+};

package/src/astro/routes/api/relations/[id]/translations.ts

@@ -0,0 +1,33 @@
+/**
+ * Relation translations endpoint
+ *
+ * GET /_emdash/api/relations/:id/translations - List locale siblings of a relation
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleRelationTranslations } from "#api/handlers/relations.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:read");
+	if (denied) return denied;
+
+	if (!id) return apiError("VALIDATION_ERROR", "Relation id required", 400);
+
+	try {
+		const result = await handleRelationTranslations(emdash.db, id);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get translations", "RELATION_TRANSLATIONS_ERROR");
+	}
+};

package/src/astro/routes/api/relations/index.ts

@@ -0,0 +1,56 @@
+/**
+ * Relation definitions endpoint
+ *
+ * GET  /_emdash/api/relations[?locale=xx] - List relation definitions
+ * POST /_emdash/api/relations              - Create a relation definition
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { handleError, requireDb, unwrapResult } from "#api/error.js";
+import { handleRelationCreate, handleRelationList } from "#api/handlers/relations.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { createRelationBody, localeFilterQuery } from "#api/schemas.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:read");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const result = await handleRelationList(emdash.db, { locale: query.locale });
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to list relations", "RELATION_LIST_ERROR");
+	}
+};
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+
+	try {
+		const body = await parseBody(request, createRelationBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleRelationCreate(emdash.db, body);
+		return unwrapResult(result, 201);
+	} catch (error) {
+		return handleError(error, "Failed to create relation", "RELATION_CREATE_ERROR");
+	}
+};

package/src/astro/routes/api/schema/collections/[slug]/fields/[fieldSlug].ts

@@ -17,7 +17,6 @@ import {
 } from "#api/index.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { updateFieldBody } from "#api/schemas.js";
-import type { UpdateFieldInput } from "#schema/types.js";
 
 export const prerender = false;
 
@@ -51,12 +50,7 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 	if (isParseError(body)) return body;
 
 	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- body is Zod-validated via parseBody(request, updateFieldBody) above
-	const result = await handleSchemaFieldUpdate(
-		emdash.db,
-		collectionSlug,
-		fieldSlug,
-		body as UpdateFieldInput,
-	);
+	const result = await handleSchemaFieldUpdate(emdash.db, collectionSlug, fieldSlug, body);
 	return unwrapResult(result);
 };
 

package/src/astro/routes/api/schema/collections/[slug]/fields/index.ts

@@ -12,7 +12,6 @@ import { requireDb, unwrapResult } from "#api/error.js";
 import { handleSchemaFieldList, handleSchemaFieldCreate } from "#api/index.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { createFieldBody } from "#api/schemas.js";
-import type { CreateFieldInput } from "#schema/types.js";
 
 export const prerender = false;
 
@@ -43,6 +42,6 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 	const body = await parseBody(request, createFieldBody);
 	if (isParseError(body)) return body;
 
-	const result = await handleSchemaFieldCreate(emdash.db, collectionSlug, body as CreateFieldInput);
+	const result = await handleSchemaFieldCreate(emdash.db, collectionSlug, body);
 	return unwrapResult(result, 201);
 };

package/src/astro/routes/api/search/index.ts

@@ -55,10 +55,12 @@ export const GET: APIRoute = async ({ url, locals }) => {
 			status,
 			locale: query.locale,
 			limit: query.limit,
+			cursor: query.cursor,
 		});
 
 		return apiSuccess(result);
 	} catch (error) {
+		// handleError maps a malformed pagination cursor to a 400 INVALID_CURSOR.
 		return handleError(error, "Search failed", "SEARCH_ERROR");
 	}
 };

package/src/astro/types.ts

@@ -268,6 +268,7 @@ export interface EmDashHandlers {
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
 			locale?: string;
 			translationOf?: string;
+			taxonomies?: Record<string, string[]>;
 			createdAt?: string | null;
 			publishedAt?: string | null;
 		},
@@ -290,6 +291,7 @@ export interface EmDashHandlers {
 				canonical?: string | null;
 				noIndex?: boolean;
 			};
+			taxonomies?: Record<string, string[]>;
 			publishedAt?: string | null;
 			_rev?: string;
 		},

package/src/cli/commands/export-seed.ts

@@ -314,16 +314,7 @@ async function exportCollections(db: Kysely<Database>): Promise<SeedCollection[]
 			labelSingular: collection.labelSingular || undefined,
 			description: collection.description || undefined,
 			icon: collection.icon || undefined,
-			supports:
-				collection.supports.length > 0
-					? (collection.supports as (
-							| "drafts"
-							| "revisions"
-							| "preview"
-							| "scheduling"
-							| "search"
-						)[])
-					: undefined,
+			supports: collection.supports.length > 0 ? collection.supports : undefined,
 			urlPattern: collection.urlPattern || undefined,
 			fields: fields.map(
 				(field): SeedField => ({

package/src/client/index.ts

@@ -142,6 +142,35 @@ export interface MediaItem {
 	updatedAt: string;
 }
 
+/** Media usage repair request */
+export type MediaUsageRepairInput = { scope: "collection"; collection: string } | { scope: "all" };
+
+/** Media usage repair status */
+export type MediaUsageRepairStatus = "complete" | "partial" | "failed" | "stale";
+
+/** Per-collection media usage repair summary */
+export interface MediaUsageRepairCollectionSummary {
+	collection: string;
+	status: MediaUsageRepairStatus;
+	indexedSourceCount: number;
+	failedSourceCount: number;
+	skippedSourceCount: number;
+	deletedSourceCount: number;
+	lastErrorCode: string | null;
+	startedAt: string;
+	completedAt: string | null;
+}
+
+/** Media usage repair response */
+export interface MediaUsageRepairResponse {
+	status: MediaUsageRepairStatus;
+	indexedSourceCount: number;
+	failedSourceCount: number;
+	skippedSourceCount: number;
+	deletedSourceCount: number;
+	collections: MediaUsageRepairCollectionSummary[];
+}
+
 /** Search result */
 export interface SearchResult {
 	id: string;
@@ -702,6 +731,11 @@ export class EmDashClient {
 		await this.request<unknown>("DELETE", `/media/${encodeURIComponent(id)}`);
 	}
 
+	/** Repair content media usage indexes for one collection or all collections */
+	async mediaRepairUsage(input: MediaUsageRepairInput): Promise<MediaUsageRepairResponse> {
+		return this.request<MediaUsageRepairResponse>("POST", "/admin/media-usage/repair", input);
+	}
+
 	// -----------------------------------------------------------------------
 	// Search
 	// -----------------------------------------------------------------------
@@ -846,6 +880,11 @@ export class EmDashClient {
 	}
 }
 
+type _AssertTrue<T extends true> = T;
+type _MediaRepairUsageRequiresExplicitInput = _AssertTrue<
+	Parameters<EmDashClient["mediaRepairUsage"]> extends [MediaUsageRepairInput] ? true : false
+>;
+
 // Re-export transport types for interceptor authors
 export type { Interceptor } from "./transport.js";
 export {

package/src/comments/service.ts

@@ -135,7 +135,7 @@ export async function createComment(
 		authorEmail: event.comment.authorEmail,
 		authorUserId: event.comment.authorUserId,
 		body: event.comment.body,
-		status: decision.status as CommentStatus,
+		status: decision.status,
 		ipHash: event.comment.ipHash,
 		userAgent: event.comment.userAgent,
 		moderationMetadata: Object.keys(event.metadata).length > 0 ? event.metadata : null,

package/src/comments/turnstile.ts

@@ -0,0 +1,64 @@
+/**
+ * Server-side Turnstile verification for public comment submissions.
+ *
+ * The comment form widget (`CommentForm.astro`) submits a `turnstileToken`;
+ * this verifies it against Cloudflare's siteverify API. Enforcement is
+ * opt-in: it only runs when the operator configures the Turnstile secret
+ * key (`EMDASH_TURNSTILE_SECRET_KEY` or `TURNSTILE_SECRET_KEY`), so
+ * existing non-Turnstile sites are unaffected.
+ *
+ * Mirrors `verifyTurnstile` in `@emdash-cms/plugin-forms` (not imported —
+ * core doesn't depend on plugin packages).
+ */
+
+const SITEVERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+
+/**
+ * Resolve the configured Turnstile secret key, or `""` when Turnstile
+ * enforcement is not configured.
+ */
+export function getTurnstileSecretKey(): string {
+	return import.meta.env.EMDASH_TURNSTILE_SECRET_KEY || import.meta.env.TURNSTILE_SECRET_KEY || "";
+}
+
+/**
+ * Verify a Turnstile response token via siteverify.
+ *
+ * Fails closed: a missing token, a failed verification, and a siteverify
+ * transport error all return `false` — when the operator has configured a
+ * secret, an unverifiable submission must not be persisted.
+ */
+export async function verifyTurnstileToken(
+	token: string | undefined,
+	secretKey: string,
+	remoteIp?: string | null,
+): Promise<boolean> {
+	if (!token) return false;
+
+	const body: Record<string, string> = { secret: secretKey, response: token };
+	if (remoteIp) {
+		body.remoteip = remoteIp;
+	}
+
+	try {
+		const res = await fetch(SITEVERIFY_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(body),
+			// Fail closed *quickly* if siteverify is slow — without a timeout
+			// the comment POST would hang until the runtime kills it
+			signal: AbortSignal.timeout(10_000),
+		});
+		const data: { success?: boolean; "error-codes"?: string[] } = await res.json();
+		if (!data.success) {
+			console.warn("[comments] Turnstile verification failed:", data["error-codes"] ?? []);
+		}
+		return data.success === true;
+	} catch (error) {
+		console.error(
+			"[comments] Turnstile siteverify request failed:",
+			error instanceof Error ? error.message : error,
+		);
+		return false;
+	}
+}

package/src/components/BlockquoteGroup.astro

@@ -0,0 +1,34 @@
+---
+/**
+ * Renders a run of consecutive `style: "blockquote"` Portable Text blocks
+ * as ONE `<blockquote>` with a paragraph per block.
+ *
+ * Portable Text is flat, so a multi-paragraph quote is stored as
+ * consecutive blockquote-styled blocks; rendering each as its own
+ * `<blockquote>` split single quotes into disconnected fragments (#1884).
+ * The grouping itself happens in `portable-text-blockquote-group.ts`,
+ * applied by the `PortableText` wrapper.
+ */
+import { PortableText } from "astro-portabletext";
+
+import type { BlockquoteGroupNode } from "./portable-text-blockquote-group.js";
+import Block from "./Block.astro";
+import { emdashMarkComponents } from "./marks.js";
+
+export interface Props {
+	node: BlockquoteGroupNode;
+}
+
+const { node } = Astro.props;
+
+// Restyle the quoted blocks as "normal" so each renders as a <p> inside
+// the shared <blockquote> (and doesn't re-trigger blockquote handling).
+const paragraphs = (node?.blocks ?? []).map((block) => ({ ...block, style: "normal" }));
+---
+
+<blockquote>
+	<PortableText
+		value={paragraphs}
+		components={{ block: Block, mark: emdashMarkComponents }}
+	/>
+</blockquote>

package/src/components/CommentForm.astro

@@ -22,7 +22,12 @@ interface Props {
 	contentId: string;
 	parentId?: string | null;
 	class?: string;
-	/** Turnstile site key. If provided, the widget is rendered. */
+	/**
+	 * Turnstile site key. If provided, the widget is rendered and its
+	 * token is submitted. Set the matching secret key on the server
+	 * (EMDASH_TURNSTILE_SECRET_KEY) so submissions are actually verified —
+	 * without it the token is ignored.
+	 */
 	turnstileSiteKey?: string;
 }
 
@@ -182,10 +187,6 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 					"textarea[name='body']"
 				);
 				if (textarea) textarea.value = "";
-				// Reset Turnstile if present
-				if (typeof window.turnstile !== "undefined") {
-					window.turnstile.reset();
-				}
 			} else {
 				statusEl.textContent =
 					result.error?.message ||
@@ -197,6 +198,12 @@ const endpoint = `/_emdash/api/comments/${encodeURIComponent(collection)}/${enco
 			statusEl.textContent = "Network error. Please try again.";
 			statusEl.classList.add("ec-comment-form-error");
 		} finally {
+			// Reset Turnstile on success and failure alike (incl. network
+			// errors) — tokens are single-use, so any retry needs a fresh
+			// challenge
+			if (typeof window.turnstile !== "undefined") {
+				window.turnstile.reset();
+			}
 			submitBtn.disabled = false;
 			submitBtn.textContent = "Post Comment";
 		}