emdash 0.28.1 → 0.29.0

package/src/search/query.ts

@@ -7,6 +7,7 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { encodeCursor, decodeCursor, InvalidCursorError } from "../database/repositories/types.js";
 import type { Database } from "../database/types.js";
 import { validateIdentifier } from "../database/validate.js";
 import { getDb } from "../loader.js";
@@ -21,6 +22,44 @@ import type {
 	SearchStats,
 } from "./types.js";
 
+/**
+ * Marker stored in the `id` slot of a search pagination cursor.
+ *
+ * Search results are merged from per-collection FTS queries and re-sorted by
+ * score, so there is no single stable keyset column to encode (the way
+ * `getEmDashCollection` encodes `(orderValue, id)`). We page over the merged,
+ * score-sorted set by offset instead, carried as the cursor's `orderValue`.
+ * Reusing `encodeCursor`/`decodeCursor` keeps the opaque base64-JSON shape and
+ * the `InvalidCursorError` handling consistent with the rest of the API.
+ */
+const SEARCH_CURSOR_MARKER = "search";
+
+/** Encode the next-page offset into an opaque search cursor. */
+function encodeSearchCursor(offset: number): string {
+	return encodeCursor(String(offset), SEARCH_CURSOR_MARKER);
+}
+
+/**
+ * Decode a search cursor back to its offset. Throws `InvalidCursorError` for a
+ * malformed cursor or one that doesn't carry a non-negative integer offset, so
+ * a client pagination bug surfaces immediately rather than silently restarting
+ * from the first page.
+ */
+/** Upper bound on a decoded search offset, to cap the per-collection row fetch a forged cursor can trigger. */
+const MAX_SEARCH_OFFSET = 10_000;
+
+function decodeSearchOffset(cursor: string): number {
+	const { orderValue, id } = decodeCursor(cursor);
+	if (id !== SEARCH_CURSOR_MARKER) {
+		throw new InvalidCursorError(cursor);
+	}
+	const offset = Number(orderValue);
+	if (!Number.isInteger(offset) || offset < 0 || offset > MAX_SEARCH_OFFSET) {
+		throw new InvalidCursorError(cursor);
+	}
+	return offset;
+}
+
 /** Pattern to split on whitespace for query term extraction */
 const WHITESPACE_SPLIT_PATTERN = /\s+/;
 const FTS_OPERATORS_PATTERN = /\b(AND|OR|NOT|NEAR)\b/i;
@@ -86,6 +125,7 @@ export async function searchWithDb(
 	const ftsManager = new FTSManager(db);
 	const limit = options.limit ?? 20;
 	const status = options.status ?? "published";
+	const offset = options.cursor ? decodeSearchOffset(options.cursor) : 0;
 
 	// Get searchable collections
 	let collections = options.collections;
@@ -97,8 +137,15 @@ export async function searchWithDb(
 		return { items: [] };
 	}
 
+	// To rank the merged window [offset, offset + limit) correctly, each
+	// collection must contribute its own top (offset + limit) rows — in the
+	// worst case the entire window comes from one collection. The extra +1
+	// row detects whether a further page exists.
+	const perCollectionLimit = offset + limit + 1;
+
 	// Search each collection and merge results
 	const allResults: SearchResult[] = [];
+	const titleColumns = await ftsManager.getCollectionsWithTitleColumn(collections);
 
 	for (const collection of collections) {
 		const config = await ftsManager.getSearchConfig(collection);
@@ -113,9 +160,10 @@ export async function searchWithDb(
 			{
 				status,
 				locale: options.locale,
-				limit: limit * 2, // Get extra for merging
+				limit: perCollectionLimit,
 			},
 			config.weights,
+			titleColumns.has(collection),
 		);
 
 		allResults.push(...collectionResults);
@@ -124,10 +172,13 @@ export async function searchWithDb(
 	// Sort by score descending
 	allResults.sort((a, b) => b.score - a.score);
 
-	// Apply limit
-	const items = allResults.slice(0, limit);
+	// Page the merged set by offset. A nextCursor is issued only when at least
+	// one result exists past this page.
+	const items = allResults.slice(offset, offset + limit);
+	const hasMore = allResults.length > offset + limit;
+	const nextCursor = hasMore ? encodeSearchCursor(offset + limit) : undefined;
 
-	return { items };
+	return { items, nextCursor };
 }
 
 /**
@@ -159,9 +210,25 @@ export async function searchCollection(
 		return { items: [] };
 	}
 
-	const items = await searchSingleCollection(db, collection, query, options, config.weights);
+	const limit = options.limit ?? 20;
+	const offset = options.cursor ? decodeSearchOffset(options.cursor) : 0;
+
+	// Over-fetch the [offset, offset + limit) window plus one row to detect a
+	// further page, then slice. Keeps the FTS SQL (LIMIT-only) unchanged and
+	// the cursor contract identical to the cross-collection path.
+	const fetched = await searchSingleCollection(
+		db,
+		collection,
+		query,
+		{ status: options.status, locale: options.locale, limit: offset + limit + 1 },
+		config.weights,
+	);
+
+	const items = fetched.slice(offset, offset + limit);
+	const hasMore = fetched.length > offset + limit;
+	const nextCursor = hasMore ? encodeSearchCursor(offset + limit) : undefined;
 
-	return { items };
+	return { items, nextCursor };
 }
 
 /**
@@ -173,6 +240,7 @@ async function searchSingleCollection(
 	query: string,
 	options: CollectionSearchOptions,
 	weights?: Record<string, number>,
+	hasTitle?: boolean,
 ): Promise<SearchResult[]> {
 	// Validate before any raw SQL interpolation
 	validateIdentifier(collection, "collection slug");
@@ -198,6 +266,14 @@ async function searchSingleCollection(
 	// Get searchable fields for snippet generation
 	const searchableFields = await ftsManager.getSearchableFields(collection);
 
+	// `title` is an optional user-defined field, not a system column. Only
+	// select it when the collection actually has one; otherwise the query
+	// errors with "no such column: c.title" (#1178). Multi-collection callers
+	// precompute this in bulk and pass it in; single-collection callers fall
+	// back to the per-collection check.
+	const collectionHasTitle = hasTitle ?? (await ftsManager.hasTitleColumn(collection));
+	const titleExpr = collectionHasTitle ? sql`c.title` : sql`NULL`;
+
 	// Build weight string for bm25 if weights provided
 	// Format: bm25(table, weight1, weight2, ...)
 	// First two weights are for 'id' and 'locale' columns (UNINDEXED, so 0)
@@ -225,11 +301,11 @@ async function searchSingleCollection(
 			snippet: string | null;
 			score: number;
 		}>`
-		SELECT 
+		SELECT
 			c.id,
 			c.slug,
 			c.locale,
-			c.title,
+			${titleExpr} as title,
 			snippet("${sql.raw(ftsTable)}", 2, '<mark>', '</mark>', '...', 32) as snippet,
 			${sql.raw(bm25Expr)} as score
 		FROM "${sql.raw(ftsTable)}" f
@@ -334,14 +410,23 @@ export async function getSuggestions(
 	}
 
 	const suggestions: Suggestion[] = [];
+	const ftsManager = new FTSManager(db);
+	const titleColumns = await ftsManager.getCollectionsWithTitleColumn(collections);
 
 	for (const collection of collections) {
-		const ftsManager = new FTSManager(db);
 		const config = await ftsManager.getSearchConfig(collection);
 		if (!config?.enabled) {
 			continue;
 		}
 
+		// Suggestions are title-based (Suggestion.title is required and the
+		// query filters on `c.title IS NOT NULL`). Collections without a
+		// `title` field can't produce one, and selecting `c.title` would
+		// error, so skip them. See #1178.
+		if (!titleColumns.has(collection)) {
+			continue;
+		}
+
 		// Validate before raw SQL interpolation
 		validateIdentifier(collection, "collection slug");
 

package/src/seo/hreflang.ts

@@ -0,0 +1,192 @@
+/**
+ * hreflang alternate resolution for translated content (#1690).
+ *
+ * Mirrors the sitemap route's semantics so the render path and the
+ * sitemap always agree:
+ *
+ * - Alternates are emitted per published locale variant of a
+ *   translation group, including a self-referencing entry (Google
+ *   recommends the page annotate itself).
+ * - `x-default` points at the default-locale variant, falling back to
+ *   the first routable variant when the default locale has no
+ *   translation.
+ * - Variants whose locale isn't in the configured `i18n.locales` list
+ *   are dropped: linking to a route the site can't serve is worse than
+ *   no link at all.
+ * - Variants flagged `noindex` in the SEO panel are excluded — the
+ *   sitemap doesn't list them, and pointing search engines at a page
+ *   that asks not to be indexed is a contradictory signal. When the
+ *   entry itself is noindex the result is empty: a page opting out of
+ *   indexing shouldn't announce an hreflang set at all.
+ * - When i18n is disabled (or no absolute site URL can be resolved,
+ *   which hreflang requires) the result is empty and no queries run.
+ */
+
+import type { Kysely } from "kysely";
+
+import { ContentRepository } from "../database/repositories/content.js";
+import type { Database } from "../database/types.js";
+import { getI18nConfig, isI18nEnabled } from "../i18n/config.js";
+import { interpolateUrlPattern, localizePath } from "../i18n/resolve.js";
+import { requestCached } from "../request-cache.js";
+import { getCollectionInfoWithDb } from "../schema/query.js";
+import { getSiteSettingsWithDb } from "../settings/index.js";
+
+const TRAILING_SLASH_RE = /\/$/;
+const ABSOLUTE_URL_RE = /^https?:\/\//i;
+
+/**
+ * IDs of variants flagged `noindex` in the SEO panel. Entries without
+ * an `_emdash_seo` row are indexable by default (same as the sitemap).
+ * The id list is bounded by the number of configured locales, so no
+ * chunking is needed.
+ */
+async function findNoindexIds(
+	db: Kysely<Database>,
+	collection: string,
+	ids: string[],
+): Promise<Set<string>> {
+	if (ids.length === 0) return new Set();
+	const rows = await db
+		.selectFrom("_emdash_seo")
+		.select("content_id")
+		.where("collection", "=", collection)
+		.where("content_id", "in", ids)
+		.where("seo_no_index", "=", 1)
+		.execute();
+	return new Set(rows.map((r) => r.content_id));
+}
+
+/** A single alternate link, ready to render as `<link rel="alternate">`. */
+export interface HreflangAlternate {
+	/** Locale code, or `"x-default"` for the default variant */
+	hreflang: string;
+	/** Absolute URL of the variant */
+	href: string;
+}
+
+export interface HreflangOptions {
+	/**
+	 * Absolute site origin (e.g. `https://example.com`) used to build
+	 * the alternate URLs. Falls back to the site settings URL; when
+	 * neither is available the result is empty, since hreflang
+	 * requires fully-qualified URLs.
+	 */
+	siteUrl?: string;
+}
+
+/**
+ * Resolve hreflang alternates for a content entry.
+ *
+ * @example
+ * ```astro
+ * ---
+ * import { getHreflangAlternates } from "emdash";
+ *
+ * const alternates = await getHreflangAlternates("posts", entry.data.id, {
+ *   siteUrl: Astro.url.origin,
+ * });
+ * ---
+ * <head>
+ *   {alternates.map((a) => <link rel="alternate" hreflang={a.hreflang} href={a.href} />)}
+ * </head>
+ * ```
+ */
+export async function getHreflangAlternates(
+	collection: string,
+	entryId: string,
+	options: HreflangOptions = {},
+): Promise<HreflangAlternate[]> {
+	if (!isI18nEnabled()) return [];
+	const key = `hreflang:${collection}:${entryId}:${options.siteUrl ?? ""}`;
+	return requestCached(key, async () => {
+		const { getDb } = await import("../loader.js");
+		const db = await getDb();
+		return getHreflangAlternatesWithDb(db, collection, entryId, options);
+	});
+}
+
+/**
+ * Resolve hreflang alternates with an explicit db handle.
+ *
+ * @internal Use `getHreflangAlternates()` in templates. This variant is
+ * for routes/components that already have a database handle.
+ */
+export async function getHreflangAlternatesWithDb(
+	db: Kysely<Database>,
+	collection: string,
+	entryId: string,
+	options: HreflangOptions = {},
+): Promise<HreflangAlternate[]> {
+	if (!isI18nEnabled()) return [];
+
+	let siteUrl = options.siteUrl;
+	if (!siteUrl) {
+		const settings = await getSiteSettingsWithDb(db);
+		siteUrl = settings.url;
+	}
+	// hreflang requires fully-qualified URLs; a relative site URL would
+	// produce invalid output (and EmDashHead's isSafeHref would drop it).
+	if (!siteUrl || !ABSOLUTE_URL_RE.test(siteUrl)) return [];
+	siteUrl = siteUrl.replace(TRAILING_SLASH_RE, "");
+
+	const repo = new ContentRepository(db);
+	const item = await repo.findByIdOrSlug(collection, entryId);
+	if (!item) return [];
+
+	// Legacy rows imported before i18n may have no translation_group;
+	// treat them as a single-variant group.
+	const group = item.translationGroup || item.id;
+	let variants = await repo.findTranslations(collection, group);
+	if (variants.length === 0) variants = [item];
+
+	let published = variants.filter((v) => v.status === "published");
+	if (published.length === 0) return [];
+
+	// Exclude noindex variants, matching the sitemap's `_emdash_seo`
+	// filter so head and sitemap agree on which variants are
+	// discoverable. When the requested entry itself is noindex, emit
+	// nothing: a page opting out of indexing shouldn't announce an
+	// hreflang set.
+	const noindexIds = await findNoindexIds(
+		db,
+		collection,
+		published.map((v) => v.id),
+	);
+	if (noindexIds.has(item.id)) return [];
+	published = published.filter((v) => !noindexIds.has(v.id));
+
+	const info = await getCollectionInfoWithDb(db, collection);
+	const urlPattern = info?.urlPattern ?? null;
+
+	const resolved: Array<{ locale: string; href: string }> = [];
+	for (const variant of published) {
+		const locale = variant.locale || "en";
+		const path = interpolateUrlPattern({
+			pattern: urlPattern,
+			collection,
+			slug: variant.slug || variant.id,
+			id: variant.id,
+		});
+		const localized = await localizePath(path, locale);
+		if (localized === null) continue;
+		resolved.push({ locale, href: `${siteUrl}${localized}` });
+	}
+	if (resolved.length === 0) return [];
+
+	resolved.sort((a, b) => a.locale.localeCompare(b.locale));
+	const alternates: HreflangAlternate[] = resolved.map((r) => ({
+		hreflang: r.locale,
+		href: r.href,
+	}));
+
+	// x-default: default-locale variant, else the first routable one.
+	// Same fallback the sitemap route uses.
+	const defaultLocale = getI18nConfig()?.defaultLocale;
+	const xDefault = resolved.find((r) => r.locale === defaultLocale) ?? resolved[0];
+	if (xDefault) {
+		alternates.push({ hreflang: "x-default", href: xDefault.href });
+	}
+
+	return alternates;
+}

package/src/seo/index.ts

@@ -32,6 +32,9 @@
 import type { ContentSeo } from "../database/repositories/types.js";
 import { buildSeoImageUrl } from "./media-url.js";
 
+export { getHreflangAlternates, getHreflangAlternatesWithDb } from "./hreflang.js";
+export type { HreflangAlternate, HreflangOptions } from "./hreflang.js";
+
 const TRAILING_SLASH_RE = /\/$/;
 const ABSOLUTE_URL_RE = /^https?:\/\//i;
 

package/src/taxonomies/index.ts

@@ -24,6 +24,7 @@ import { peekRequestCache, requestCached, setRequestCacheEntry } from "../reques
 import { getRequestContext } from "../request-context.js";
 import { chunks, SQL_BATCH_SIZE } from "../utils/chunks.js";
 import { isMissingTableError } from "../utils/db-errors.js";
+import { fetchVisibleTermCounts } from "./term-counts.js";
 import type { TaxonomyDef, TaxonomyTerm, TaxonomyTermRow } from "./types.js";
 
 export interface TaxonomyQueryOptions {
@@ -214,6 +215,18 @@ export async function getTaxonomyDef(
 	});
 }
 
+/**
+ * Object-cache namespaces for values that embed visible term counts: the
+ * taxonomy epoch (term/assignment writes) plus each counted collection's
+ * content epoch, so publishing, unpublishing, or trashing an entry
+ * invalidates the cached count promptly. A scheduled entry becoming due
+ * flips visibility without a write, so that staleness stays bounded by the
+ * cache entry's TTL.
+ */
+function termCountNamespaces(collections: string[]): string[] {
+	return [...Array.from(new Set(collections), contentNamespace), CacheNamespace.TAXONOMIES];
+}
+
 /**
  * All terms of a taxonomy in a specific locale (flat for non-hierarchical,
  * tree for hierarchical).
@@ -223,37 +236,38 @@ export async function getTaxonomyTerms(
 	options: TaxonomyQueryOptions = {},
 ): Promise<TaxonomyTerm[]> {
 	const locale = resolveLocale(options.locale);
-	return requestCached(`taxonomy-terms:${taxonomyName}:${locale ?? "*"}`, () =>
-		cachedQuery({
-			namespace: CacheNamespace.TAXONOMIES,
+	return requestCached(`taxonomy-terms:${taxonomyName}:${locale ?? "*"}`, async () => {
+		const def = await getTaxonomyDef(taxonomyName, options);
+		if (!def) return [];
+		return cachedQuery({
+			namespace: termCountNamespaces(def.collections),
 			key: `terms:${taxonomyName}:${locale ?? "*"}`,
-			load: () => loadTaxonomyTerms(taxonomyName, locale, options),
-		}),
-	);
+			load: () => loadTaxonomyTerms(def, locale),
+		});
+	});
 }
 
 async function loadTaxonomyTerms(
-	taxonomyName: string,
+	def: TaxonomyDef,
 	locale: string | undefined,
-	options: TaxonomyQueryOptions,
 ): Promise<TaxonomyTerm[]> {
 	const db = await getDb();
 
-	const def = await getTaxonomyDef(taxonomyName, options);
-	if (!def) return [];
-
 	let termsQuery = db
 		.selectFrom("taxonomies")
 		.selectAll()
-		.where("name", "=", taxonomyName)
+		.where("name", "=", def.name)
 		.orderBy("label", "asc");
 	if (locale !== undefined) termsQuery = termsQuery.where("locale", "=", locale);
-	const rows = await termsQuery.execute();
 
 	// Counts are keyed by translation_group (what the pivot stores) and are
-	// locale-independent, so the aggregate is shared across every taxonomy
-	// rendered in this request (Categories + Tags widgets, etc.).
-	const counts = await getTaxonomyTermCounts();
+	// locale-independent. Only publicly visible entries are counted (#581);
+	// the map is request-cached so a term detail rendered on the same page
+	// reuses it. Independent of the terms query, so run both concurrently.
+	const [rows, counts] = await Promise.all([
+		termsQuery.execute(),
+		getVisibleTermCounts(def.name, def.collections),
+	]);
 
 	const flatTerms: TaxonomyTermRow[] = rows.map((row) => ({
 		id: row.id,
@@ -282,23 +296,24 @@ async function loadTaxonomyTerms(
 }
 
 /**
- * Per-translation-group usage counts across all taxonomies, in one aggregate
- * scan of `content_taxonomies`. Counts are locale-independent (the pivot stores
- * translation_group), so a single request-cached entry serves every taxonomy
- * that renders during the request.
+ * Per-translation-group visible-usage counts for one taxonomy, in a single
+ * round-trip (see `fetchVisibleTermCounts`). Counts are locale-independent
+ * (the pivot stores translation_group), and the request-cached map is shared
+ * by every consumer in the render — the widget (`getTaxonomyTerms`) and the
+ * single-term page (`getTerm`) never issue separate count queries.
  */
-function getTaxonomyTermCounts(): Promise<Map<string, number>> {
-	return requestCached("taxonomy-term-counts", async () => {
+function getVisibleTermCounts(
+	taxonomyName: string,
+	collections: string[],
+): Promise<Map<string, number>> {
+	// The collection scope is part of the key: per-locale rows of the same def
+	// can drift in their declared collections, and a caller may pass a narrower
+	// scope. Identical inputs (the widget + term-page hot path) still share one
+	// entry.
+	const scope = [...new Set(collections)].toSorted().join(",");
+	return requestCached(`taxonomy-term-counts:${taxonomyName}:${scope}`, async () => {
 		const db = await getDb();
-		const countsResult = await db
-			.selectFrom("content_taxonomies")
-			.select(["taxonomy_id"])
-			.select((eb) => eb.fn.count<number>("entry_id").as("count"))
-			.groupBy("taxonomy_id")
-			.execute();
-		const counts = new Map<string, number>();
-		for (const row of countsResult) counts.set(row.taxonomy_id, row.count);
-		return counts;
+		return fetchVisibleTermCounts(db, taxonomyName, collections);
 	});
 }
 
@@ -313,13 +328,16 @@ export async function getTerm(
 	options: TaxonomyQueryOptions = {},
 ): Promise<TaxonomyTerm | null> {
 	const chain = resolveLocaleChain(options.locale);
-	// Cached under the shared taxonomies epoch (bumped on any taxonomy / term
-	// assignment write). The `count` reflects content_taxonomies rows; a stale
-	// count after a bare content delete is bounded by the entry's TTL.
+	// The def supplies the collections the visible count is scoped to. It is
+	// resolved before cachedQuery so the entry lives under each collection's
+	// content namespace — publishing or unpublishing an entry invalidates the
+	// embedded count (see termCountNamespaces).
+	const def = await getTaxonomyDef(taxonomyName, options);
+	const collections = def?.collections ?? [];
 	return cachedQuery({
-		namespace: CacheNamespace.TAXONOMIES,
+		namespace: termCountNamespaces(collections),
 		key: `term:${taxonomyName}:${slug}:${chain.join(",")}`,
-		load: () => loadTerm(taxonomyName, slug, chain),
+		load: () => loadTerm(taxonomyName, slug, chain, collections),
 	});
 }
 
@@ -327,6 +345,7 @@ async function loadTerm(
 	taxonomyName: string,
 	slug: string,
 	chain: string[],
+	collections: string[],
 ): Promise<TaxonomyTerm | null> {
 	const db = await getDb();
 
@@ -360,17 +379,15 @@ async function loadTerm(
 	const termLocale = row.locale;
 	if (termLocale) childrenQuery = childrenQuery.where("locale", "=", termLocale);
 
-	// The usage-count and children queries both depend only on the term row,
-	// so run them concurrently to save a round trip on remote databases.
-	const [countResult, childRows] = await Promise.all([
-		db
-			.selectFrom("content_taxonomies")
-			.select((eb) => eb.fn.count<number>("entry_id").as("count"))
-			.where("taxonomy_id", "=", row.translation_group ?? row.id)
-			.executeTakeFirst(),
+	// The visible-usage counts and children queries both depend only on the
+	// term row, so run them concurrently to save a round trip on remote
+	// databases. The counts map is request-cached per taxonomy — on a page
+	// that also renders the taxonomy widget it's a free Map lookup.
+	const [counts, childRows] = await Promise.all([
+		getVisibleTermCounts(taxonomyName, collections),
 		childrenQuery.execute(),
 	]);
-	const count = countResult?.count ?? 0;
+	const count = counts.get(row.translation_group ?? row.id) ?? 0;
 
 	const children = childRows.map<TaxonomyTerm>((child) => ({
 		id: child.id,