emdash 0.28.1 → 0.29.0

package/src/loader.ts

@@ -14,7 +14,7 @@
 import type { LiveLoader } from "astro/loaders";
 import { Kysely, type RawBuilder, sql, type Dialect } from "kysely";
 
-import { currentTimestampValue, isPostgres } from "./database/dialect-helpers.js";
+import { buildStatusCondition, isPostgres } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
 import { decodeCursor, encodeCursor } from "./database/repositories/types.js";
 import { validateIdentifier } from "./database/validate.js";
@@ -515,36 +515,6 @@ export type SortDirection = "asc" | "desc";
  */
 export type OrderBySpec = Record<string, SortDirection>;
 
-/**
- * Build WHERE clause for status filtering.
- * When filtering for 'published' status, also include scheduled content
- * whose scheduled_at time has passed (treating it as effectively published).
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
-function buildStatusCondition(
-	db: Kysely<any>,
-	status: string,
-	tablePrefix?: string,
-): ReturnType<typeof sql> {
-	const statusField = tablePrefix ? `${tablePrefix}.status` : "status";
-	const scheduledAtField = tablePrefix ? `${tablePrefix}.scheduled_at` : "scheduled_at";
-
-	if (status === "published") {
-		// Include both published content AND scheduled content past its publish time.
-		// scheduled_at is stored as text (ISO 8601). On Postgres, we must cast it
-		// to timestamptz for the comparison with CURRENT_TIMESTAMP to work.
-		const scheduledAtExpr = isPostgres(db)
-			? sql`${sql.ref(scheduledAtField)}::timestamptz`
-			: sql.ref(scheduledAtField);
-		const nowExpr = isPostgres(db)
-			? currentTimestampValue(db)
-			: sql`strftime('%Y-%m-%dT%H:%M:%fZ', 'now')`;
-		return sql`(${sql.ref(statusField)} = 'published' OR (${sql.ref(statusField)} = 'scheduled' AND ${scheduledAtExpr} <= ${nowExpr}))`;
-	}
-
-	return sql`${sql.ref(statusField)} = ${status}`;
-}
-
 /**
  * Resolved primary sort field and direction (used for cursor pagination).
  */

package/src/mcp/server.ts

@@ -660,6 +660,12 @@ export function createMcpServer(): McpServer {
 					.describe(
 						"Bylines to credit. Each entry references an existing byline by id (see byline_list / byline_create) with an optional roleLabel. The first entry becomes the primary byline.",
 					),
+				taxonomies: z
+					.record(z.string(), z.array(z.string()))
+					.optional()
+					.describe(
+						"Taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Call taxonomy_list to see available taxonomies and taxonomy_list_terms to look up slugs. Missing keys leave that taxonomy unchanged.",
+					),
 			}),
 			annotations: { destructiveHint: false },
 		},
@@ -685,7 +691,7 @@ export function createMcpServer(): McpServer {
 			// Publishing requires publish permission — create as draft then publish
 			if (args.status === "published") {
 				const user = { id: userId, role: getExtra(extra).userRole };
-				if (!hasPermission(user, "content:publish_own" as Permission)) {
+				if (!hasPermission(user, "content:publish_own")) {
 					throw new EmDashAuthError(
 						"Insufficient permissions: publishing requires content:publish_own",
 						"INSUFFICIENT_PERMISSIONS",
@@ -698,6 +704,7 @@ export function createMcpServer(): McpServer {
 					locale: args.locale,
 					translationOf: args.translationOf,
 					bylines: args.bylines,
+					taxonomies: args.taxonomies,
 				});
 				if (!result.success) return unwrap(result);
 				const itemId = extractContentId(result.data);
@@ -715,6 +722,7 @@ export function createMcpServer(): McpServer {
 					locale: args.locale,
 					translationOf: args.translationOf,
 					bylines: args.bylines,
+					taxonomies: args.taxonomies,
 				}),
 			);
 		},
@@ -771,6 +779,12 @@ export function createMcpServer(): McpServer {
 					.describe(
 						"Replace the byline list for this item. The first entry becomes the primary byline. Pass an empty array to clear all bylines.",
 					),
+				taxonomies: z
+					.record(z.string(), z.array(z.string()))
+					.optional()
+					.describe(
+						"Replace taxonomy term assignments as { taxonomyName: [termSlug, ...] }. Term slugs are resolved in the entry's locale. Only named taxonomies are touched; other taxonomies are left unchanged. Pass an empty array to clear a taxonomy.",
+					),
 				publishedAt: z.iso
 					.datetime({ offset: true, message: "must be an ISO 8601 datetime" })
 					.nullish()
@@ -805,7 +819,7 @@ export function createMcpServer(): McpServer {
 			// route. Status-driven publishes are gated separately below.
 			if (args.publishedAt !== undefined) {
 				const user = { id: userId, role: userRole };
-				if (!hasPermission(user, "content:publish_any" as Permission)) {
+				if (!hasPermission(user, "content:publish_any")) {
 					throw new EmDashAuthError(
 						"Setting publishedAt requires content:publish_any permission",
 						"INSUFFICIENT_PERMISSIONS",
@@ -823,6 +837,7 @@ export function createMcpServer(): McpServer {
 					args.slug ||
 					args.seo !== undefined ||
 					args.bylines !== undefined ||
+					args.taxonomies !== undefined ||
 					args.publishedAt !== undefined
 				) {
 					const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
@@ -832,6 +847,7 @@ export function createMcpServer(): McpServer {
 						locale: args.locale,
 						seo: args.seo,
 						bylines: args.bylines,
+						taxonomies: args.taxonomies,
 						publishedAt: args.publishedAt,
 						_rev: args._rev,
 					});
@@ -847,6 +863,7 @@ export function createMcpServer(): McpServer {
 					args.slug ||
 					args.seo !== undefined ||
 					args.bylines !== undefined ||
+					args.taxonomies !== undefined ||
 					args.publishedAt !== undefined
 				) {
 					const updateResult = await emdash.handleContentUpdate(args.collection, resolvedId, {
@@ -856,6 +873,7 @@ export function createMcpServer(): McpServer {
 						locale: args.locale,
 						seo: args.seo,
 						bylines: args.bylines,
+						taxonomies: args.taxonomies,
 						publishedAt: args.publishedAt,
 						_rev: args._rev,
 					});
@@ -872,6 +890,7 @@ export function createMcpServer(): McpServer {
 					locale: args.locale,
 					seo: args.seo,
 					bylines: args.bylines,
+					taxonomies: args.taxonomies,
 					publishedAt: args.publishedAt,
 					_rev: args._rev,
 				}),
@@ -1008,7 +1027,7 @@ export function createMcpServer(): McpServer {
 			// regardless of ownership (mirrors the REST PUT route's publishedAt gate).
 			if (args.publishedAt !== undefined) {
 				const user = { id: userId, role: userRole };
-				if (!hasPermission(user, "content:publish_any" as Permission)) {
+				if (!hasPermission(user, "content:publish_any")) {
 					throw new EmDashAuthError(
 						"Setting publishedAt requires content:publish_any permission",
 						"INSUFFICIENT_PERMISSIONS",
@@ -1932,6 +1951,12 @@ export function createMcpServer(): McpServer {
 					.optional()
 					.describe("Filter results by locale (omit to search all locales)"),
 				limit: z.number().int().min(1).max(50).optional().describe("Max results (default 20)"),
+				cursor: z
+					.string()
+					.min(1)
+					.max(2048)
+					.optional()
+					.describe("Pagination cursor from a previous response"),
 			}),
 			annotations: { readOnlyHint: true },
 		},
@@ -1944,6 +1969,7 @@ export function createMcpServer(): McpServer {
 					collections: args.collections,
 					locale: args.locale,
 					limit: args.limit,
+					cursor: args.cursor,
 				});
 				return jsonResult(results);
 			} catch (error) {

package/src/plugins/context.ts

@@ -13,6 +13,7 @@ import { MediaRepository } from "../database/repositories/media.js";
 import { OptionsRepository } from "../database/repositories/options.js";
 import { PluginStorageRepository } from "../database/repositories/plugin-storage.js";
 import { SeoRepository } from "../database/repositories/seo.js";
+import { TaxonomyRepository, type Taxonomy } from "../database/repositories/taxonomy.js";
 import { UserRepository } from "../database/repositories/user.js";
 import { withTransaction } from "../database/transaction.js";
 import type { Database } from "../database/types.js";
@@ -52,6 +53,10 @@ import type {
 	QueryOptions,
 	ContentListOptions,
 	MediaListOptions,
+	TaxonomyAccess,
+	TaxonomyDefInfo,
+	TaxonomyTermInfo,
+	TaxonomyReadOptions,
 } from "./types.js";
 
 // =============================================================================
@@ -194,6 +199,37 @@ async function assertSeoEnabled(
 	return hasSeo;
 }
 
+/**
+ * Parse the `collections` JSON column into a string array (`[]` on anything
+ * else). Mirrors the guards in the Cloudflare/workerd bridges so an
+ * in-process plugin degrades on malformed data instead of crashing.
+ */
+function parseCollectionsColumn(value: string | null): string[] {
+	if (!value) return [];
+	try {
+		const parsed: unknown = JSON.parse(value);
+		return Array.isArray(parsed)
+			? parsed.filter((item): item is string => typeof item === "string")
+			: [];
+	} catch {
+		return [];
+	}
+}
+
+/** Map a repository `Taxonomy` row to the plugin-facing term shape. */
+function taxonomyToTermInfo(term: Taxonomy): TaxonomyTermInfo {
+	return {
+		id: term.id,
+		taxonomy: term.name,
+		slug: term.slug,
+		label: term.label,
+		parentId: term.parentId,
+		data: term.data,
+		locale: term.locale,
+		translationGroup: term.translationGroup,
+	};
+}
+
 /**
  * Create read-only content access
  */
@@ -278,6 +314,48 @@ export function createContentAccess(db: Kysely<Database>): ContentAccess {
 	};
 }
 
+/**
+ * Create read-only taxonomy access (gated on `taxonomies:read`).
+ */
+export function createTaxonomyAccess(db: Kysely<Database>): TaxonomyAccess {
+	const taxonomyRepo = new TaxonomyRepository(db);
+
+	return {
+		async getAll(options?: TaxonomyReadOptions): Promise<TaxonomyDefInfo[]> {
+			let query = db.selectFrom("_emdash_taxonomy_defs").selectAll();
+			if (options?.locale !== undefined) query = query.where("locale", "=", options.locale);
+			const rows = await query.orderBy("name", "asc").execute();
+			return rows.map((row) => ({
+				name: row.name,
+				label: row.label,
+				labelSingular: row.label_singular,
+				hierarchical: row.hierarchical === 1,
+				collections: parseCollectionsColumn(row.collections),
+				locale: row.locale,
+			}));
+		},
+
+		async getTerms(taxonomy: string, options?: TaxonomyReadOptions): Promise<TaxonomyTermInfo[]> {
+			const terms = await taxonomyRepo.findByName(taxonomy, { locale: options?.locale });
+			return terms.map(taxonomyToTermInfo);
+		},
+
+		async getEntryTerms(
+			collection: string,
+			entryId: string,
+			options?: TaxonomyReadOptions & { taxonomy?: string },
+		): Promise<TaxonomyTermInfo[]> {
+			const terms = await taxonomyRepo.getTermsForEntry(
+				collection,
+				entryId,
+				options?.taxonomy,
+				options?.locale,
+			);
+			return terms.map(taxonomyToTermInfo);
+		},
+	};
+}
+
 /**
  * Create full content access with write operations.
  *
@@ -1015,6 +1093,12 @@ export class PluginContextFactory {
 			content = createContentAccess(db);
 		}
 
+		// Capability-gated: taxonomies (read-only)
+		let taxonomies: TaxonomyAccess | undefined;
+		if (capabilities.has("taxonomies:read")) {
+			taxonomies = createTaxonomyAccess(db);
+		}
+
 		// Capability-gated: media
 		// `upload()` only needs `storage`; `getUploadUrl()` is derived from
 		// storage when no explicit provider is wired. Granting write access on
@@ -1078,6 +1162,7 @@ export class PluginContextFactory {
 			storage,
 			kv,
 			content,
+			taxonomies,
 			media,
 			http,
 			log,

package/src/plugins/define-plugin.ts

@@ -142,6 +142,7 @@ function defineNativePlugin<TStorage extends PluginStorageConfig>(
 		"network:request:unrestricted",
 		"content:read",
 		"content:write",
+		"taxonomies:read",
 		"media:read",
 		"media:write",
 		"users:read",

package/src/plugins/index.ts

@@ -118,6 +118,10 @@ export type {
 	MediaItem,
 	ContentListOptions,
 	MediaListOptions,
+	TaxonomyAccess,
+	TaxonomyDefInfo,
+	TaxonomyTermInfo,
+	TaxonomyReadOptions,
 
 	// Hook types
 	PluginHooks,

package/src/plugins/manifest-schema.ts

@@ -27,6 +27,7 @@ export const CURRENT_PLUGIN_CAPABILITIES = [
 	"network:request:unrestricted",
 	"content:read",
 	"content:write",
+	"taxonomies:read",
 	"media:read",
 	"media:write",
 	"users:read",
@@ -246,6 +247,7 @@ const declaredAccessSchema = z.object({
 	content: z
 		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
 		.optional(),
+	taxonomies: z.object({ read: accessConstraints.optional() }).optional(),
 	media: z
 		.object({ read: accessConstraints.optional(), write: accessConstraints.optional() })
 		.optional(),

package/src/plugins/types.ts

@@ -244,6 +244,45 @@ export type ContentWriteInput = Record<string, unknown> & {
 	seo?: ContentItemSeoInput;
 };
 
+/**
+ * Taxonomy definition returned from the taxonomy API (e.g. "category", "tag").
+ */
+export interface TaxonomyDefInfo {
+	name: string;
+	label: string;
+	labelSingular: string | null;
+	hierarchical: boolean;
+	/** Collections this taxonomy is attached to (e.g. `["posts"]`). */
+	collections: string[];
+	locale: string;
+}
+
+/**
+ * Taxonomy term returned from the taxonomy API. Flat shape — for hierarchical
+ * taxonomies the tree is reconstructed via `parentId` (which stores the
+ * parent's locale-agnostic `translationGroup`).
+ */
+export interface TaxonomyTermInfo {
+	id: string;
+	/** Taxonomy name this term belongs to (e.g. "category"). */
+	taxonomy: string;
+	slug: string;
+	label: string;
+	parentId: string | null;
+	/** Term metadata as edited in the admin (`description` etc.). */
+	data: Record<string, unknown> | null;
+	locale: string;
+	translationGroup: string | null;
+}
+
+/**
+ * Options accepted by taxonomy read operations. Omitting `locale` returns
+ * rows for every locale.
+ */
+export interface TaxonomyReadOptions {
+	locale?: string;
+}
+
 /**
  * Content access interface - capability-gated
  */
@@ -258,6 +297,23 @@ export interface ContentAccess {
 	delete?(collection: string, id: string): Promise<boolean>;
 }
 
+/**
+ * Taxonomy access interface — capability-gated on `taxonomies:read`.
+ * Read-only: there is no plugin-facing taxonomy write API.
+ */
+export interface TaxonomyAccess {
+	/** List taxonomy definitions. */
+	getAll(options?: TaxonomyReadOptions): Promise<TaxonomyDefInfo[]>;
+	/** All terms of a taxonomy, ordered by label. */
+	getTerms(taxonomy: string, options?: TaxonomyReadOptions): Promise<TaxonomyTermInfo[]>;
+	/** Terms assigned to a content entry, optionally scoped to one taxonomy. */
+	getEntryTerms(
+		collection: string,
+		entryId: string,
+		options?: TaxonomyReadOptions & { taxonomy?: string },
+	): Promise<TaxonomyTermInfo[]>;
+}
+
 /**
  * Full content access with write operations
  */
@@ -413,6 +469,9 @@ export interface PluginContext<TStorage extends PluginStorageConfig = PluginStor
 	/** Content access - only if read:content or write:content capability */
 	content?: ContentAccess | ContentAccessWithWrite;
 
+	/** Taxonomy access (read-only) - only if taxonomies:read capability */
+	taxonomies?: TaxonomyAccess;
+
 	/** Media access - only if read:media or write:media capability */
 	media?: MediaAccess | MediaAccessWithWrite;
 

package/src/schema/byline-registry.ts

@@ -627,7 +627,7 @@ export class BylineSchemaRegistry {
 		// payload silently. Today's `BylineFieldValidation` is `{ options? }`
 		// only, so this branch is a pass-through; left explicit for clarity.
 		const { options: _drop, ...rest } = validation;
-		return Object.keys(rest).length === 0 ? null : (rest as BylineFieldValidation);
+		return Object.keys(rest).length === 0 ? null : rest;
 	}
 }
 

package/src/search/fts-manager.ts

@@ -355,6 +355,40 @@ export class FTSManager {
 		return fields.map((f) => f.slug);
 	}
 
+	/**
+	 * Whether a collection has a user-defined `title` field.
+	 *
+	 * `title` is not a system column on `ec_*` tables -- it exists only when a
+	 * collection defines a field with slug `title`. Search and suggestion SQL
+	 * that selects `c.title` must check this first; otherwise collections
+	 * without a title field raise "no such column: c.title" (#1178).
+	 */
+	async hasTitleColumn(collectionSlug: string): Promise<boolean> {
+		const withTitle = await this.getCollectionsWithTitleColumn([collectionSlug]);
+		return withTitle.has(collectionSlug);
+	}
+
+	/**
+	 * Bulk variant of `hasTitleColumn()`: which of the given collections have
+	 * a user-defined `title` field. One query instead of one `hasTitleColumn`
+	 * round-trip pair per collection -- callers that check this once per
+	 * collection in a loop (multi-collection search, suggestions) should use
+	 * this instead (AGENTS.md: "one query beats two").
+	 */
+	async getCollectionsWithTitleColumn(collectionSlugs: string[]): Promise<Set<string>> {
+		if (collectionSlugs.length === 0) return new Set();
+
+		const rows = await this.db
+			.selectFrom("_emdash_fields as f")
+			.innerJoin("_emdash_collections as c", "c.id", "f.collection_id")
+			.select(["c.slug as collection_slug"])
+			.where("f.slug", "=", "title")
+			.execute();
+
+		const withTitle = new Set(rows.map((r) => r.collection_slug));
+		return new Set(collectionSlugs.filter((slug) => withTitle.has(slug)));
+	}
+
 	/**
 	 * Enable search for a collection.
 	 *

package/src/search/match.ts

@@ -0,0 +1,50 @@
+/**
+ * FTS5 match-expression builder for structured (non-user-syntax) queries.
+ *
+ * Unlike `escapeQuery` in `query.ts` (which powers the public search API and
+ * deliberately passes through FTS5 operators like AND/OR/NOT), this builder
+ * treats the input as plain words: every term is double-quoted with interior
+ * quotes escaped, so the result can never produce an FTS5 syntax error. Used
+ * by the admin content-list filter, where the input is a filter box, not a
+ * search-syntax field.
+ */
+
+const WHITESPACE_RE = /\s+/;
+const DOUBLE_QUOTE_RE = /"/g;
+const GLOB_SPECIAL_RE = /[[\]*?]/g;
+
+/**
+ * Build a prefix-matching FTS5 MATCH expression from free-form input.
+ *
+ * `hello wor` becomes `"hello"* "wor"*` — implicit AND with per-term prefix
+ * matching. Returns `""` when the input contains no usable terms; callers
+ * must fall back to their non-FTS path in that case.
+ */
+export function buildFtsPrefixMatch(input: string): string {
+	const terms = input
+		.trim()
+		.split(WHITESPACE_RE)
+		.map((term) => term.replace(DOUBLE_QUOTE_RE, '""'))
+		.filter((term) => term.length > 0);
+
+	if (terms.length === 0) return "";
+	return terms.map((term) => `"${term}"*`).join(" ");
+}
+
+/**
+ * Build a GLOB prefix pattern from free-form input, treating GLOB
+ * metacharacters (`* ? [ ]`) literally by wrapping each in a character
+ * class (GLOB has no ESCAPE clause).
+ *
+ * GLOB (unlike default LIKE) is case-sensitive, so with a lowercased
+ * pattern it matches slugs (lowercase by construction) while staying
+ * servable by the ordinary BINARY-collated slug index — SQLite's GLOB
+ * optimization turns a `prefix*` pattern into an index range scan.
+ */
+export function buildSlugGlobPrefix(input: string): string {
+	const escaped = input
+		.trim()
+		.toLowerCase()
+		.replace(GLOB_SPECIAL_RE, (c) => `[${c}]`);
+	return `${escaped}*`;
+}