emdash 0.29.0 → 0.30.0

package/src/client/index.ts

@@ -127,6 +127,62 @@ export interface Field {
 	sortOrder?: number;
 }
 
+/** Aggregate trust state for media usage reads */
+export type MediaUsageCoverageStatus =
+	| "complete"
+	| "never"
+	| "running"
+	| "partial"
+	| "failed"
+	| "stale"
+	| "unknown";
+
+/** Aggregate media usage coverage across all content collections */
+export interface MediaUsageCoverage {
+	scope: "all_content_collections";
+	status: MediaUsageCoverageStatus;
+}
+
+/** Coverage-aware usage count for a media item */
+export interface MediaUsageSummary {
+	count: number | null;
+	coverage: MediaUsageCoverage;
+}
+
+/** One indexed media reference within a content source */
+export interface MediaUsageOccurrenceDetail {
+	fieldSlug: string;
+	fieldPath: string;
+	occurrenceIndex: number;
+	referenceType: "image_field" | "file_field" | "portable_text_image" | "unknown";
+}
+
+/** Indexed references from one visible content source */
+export interface MediaUsageSourceDetail {
+	variant: "columns" | "draft_overlay";
+	occurrences: MediaUsageOccurrenceDetail[];
+}
+
+/** One content entry that references a media item */
+export interface MediaUsageEntryDetail {
+	collection: string;
+	contentId: string;
+	title: string | null;
+	slug: string | null;
+	locale: string | null;
+	status: string | null;
+	scheduledAt: string | null;
+	deletedAt: string | null;
+	sources: MediaUsageSourceDetail[];
+}
+
+/** Entry-grouped media usage details */
+export interface MediaUsageDetailsResponse {
+	items: MediaUsageEntryDetail[];
+	nextCursor?: string;
+	coverage: MediaUsageCoverage;
+}
+
 /** Media item */
 export interface MediaItem {
 	id: string;
@@ -140,6 +196,7 @@ export interface MediaItem {
 	caption?: string;
 	createdAt: string;
 	updatedAt: string;
+	usage?: MediaUsageSummary;
 }
 
 /** Media usage repair request */
@@ -678,22 +735,47 @@ export class EmDashClient {
 		mimeType?: string;
 		limit?: number;
 		cursor?: string;
+		includeUsage?: boolean;
 	}): Promise<ListResult<MediaItem>> {
 		const params = new URLSearchParams();
 		if (options?.mimeType) params.set("mimeType", options.mimeType);
 		if (options?.limit) params.set("limit", String(options.limit));
 		if (options?.cursor) params.set("cursor", options.cursor);
+		if (options?.includeUsage === true) params.set("includeUsage", "1");
 
 		const qs = params.toString();
 		return this.request<ListResult<MediaItem>>("GET", `/media${qs ? `?${qs}` : ""}`);
 	}
 
 	/** Get a single media item */
-	async mediaGet(id: string): Promise<MediaItem> {
-		const data = await this.request<{ item: MediaItem }>("GET", `/media/${encodeURIComponent(id)}`);
+	async mediaGet(id: string, options?: { includeUsage?: boolean }): Promise<MediaItem> {
+		const params = new URLSearchParams();
+		if (options?.includeUsage === true) params.set("includeUsage", "1");
+
+		const qs = params.toString();
+		const data = await this.request<{ item: MediaItem }>(
+			"GET",
+			`/media/${encodeURIComponent(id)}${qs ? `?${qs}` : ""}`,
+		);
 		return data.item;
 	}
 
+	/** Get entry-grouped usage details for a media item */
+	async mediaGetUsage(
+		id: string,
+		options?: { limit?: number; cursor?: string },
+	): Promise<MediaUsageDetailsResponse> {
+		const params = new URLSearchParams();
+		if (options?.limit !== undefined) params.set("limit", String(options.limit));
+		if (options?.cursor !== undefined) params.set("cursor", options.cursor);
+
+		const qs = params.toString();
+		return this.request<MediaUsageDetailsResponse>(
+			"GET",
+			`/media/${encodeURIComponent(id)}/usage${qs ? `?${qs}` : ""}`,
+		);
+	}
+
 	/** Upload a media file */
 	async mediaUpload(
 		file: Uint8Array | Blob,

package/src/client/transport.ts

@@ -163,7 +163,7 @@ export function refreshInterceptor(options: {
 
 		const json = (await res.json()) as Record<string, unknown>;
 
-		// The token endpoint wraps the response in { data: ... } via apiSuccess.
+		// The token endpoint wraps the response in { success, data: ... } via apiSuccess.
 		// Handle both wrapped and bare shapes for robustness.
 		const tokenData: TokenFields =
 			json.data && typeof json.data === "object" && "access_token" in json.data

package/src/components/EmDashHead.astro

@@ -17,8 +17,10 @@
  * ```
  */
 import type { PublicPageContext, PageMetadataContribution } from "../plugins/types.js";
+// @ts-ignore - virtual module
+import virtualConfig from "virtual:emdash/config";
 import {
-	createSha256CspHash,
+	registerJsonLdCspHashes,
 	resolvePageMetadata,
 	renderPageMetadata,
 	type ResolvedPageMetadata,
@@ -124,13 +126,7 @@ if (runtime) {
 	metadataHtml = renderPageMetadata(resolved, { includeJsonLd: false });
 }
 
-if (Astro.csp && jsonLdScripts.length > 0) {
-	await Promise.all(
-		jsonLdScripts.map(async ({ json }) => {
-			Astro.csp?.insertScriptHash(await createSha256CspHash(json));
-		}),
-	);
-}
+await registerJsonLdCspHashes(virtualConfig.astroCspEnabled === true, () => Astro.csp, jsonLdScripts);
 ---
 
 <Fragment set:html={metadataHtml} />

package/src/components/InlinePortableTextEditor.tsx

@@ -1864,44 +1864,65 @@ export function InlinePortableTextEditor({
 		return pmToPortableText(json);
 	}, []);
 
-	const save = React.useCallback(async () => {
-		if (savingRef.current) return;
-
-		const current = JSON.stringify(getBlocks());
-		const initial = JSON.stringify(initialRef.current);
-		if (current === initial) return;
-
-		savingRef.current = true;
-		try {
-			const res = await fetch(
-				`/_emdash/api/content/${encodeURIComponent(collection)}/${encodeURIComponent(entryId)}`,
-				{
-					method: "PUT",
-					credentials: "same-origin",
-					headers: { "Content-Type": "application/json", "X-EmDash-Request": "1" },
-					body: JSON.stringify({ data: { [field]: getBlocks() } }),
-				},
-			);
-
-			if (res.ok) {
-				initialRef.current = getBlocks();
-				document.dispatchEvent(new CustomEvent("emdash:save", { detail: { state: "saved" } }));
-				document.dispatchEvent(
-					new CustomEvent("emdash:content-changed", {
-						detail: { collection, id: entryId },
-					}),
+	const save = React.useCallback(
+		async (options?: { keepalive?: boolean }) => {
+			// A pagehide flush must not be skipped: an in-flight blur save is
+			// cancelled by the navigation, so the keepalive request is the only
+			// one that can still land (#1582).
+			if (savingRef.current && !options?.keepalive) return;
+
+			const current = JSON.stringify(getBlocks());
+			const initial = JSON.stringify(initialRef.current);
+			if (current === initial) return;
+
+			savingRef.current = true;
+			try {
+				const res = await fetch(
+					`/_emdash/api/content/${encodeURIComponent(collection)}/${encodeURIComponent(entryId)}`,
+					{
+						method: "PUT",
+						credentials: "same-origin",
+						headers: { "Content-Type": "application/json", "X-EmDash-Request": "1" },
+						body: JSON.stringify({ data: { [field]: getBlocks() } }),
+						keepalive: options?.keepalive ?? false,
+					},
 				);
-			} else {
+
+				if (res.ok) {
+					initialRef.current = getBlocks();
+					document.dispatchEvent(new CustomEvent("emdash:save", { detail: { state: "saved" } }));
+					document.dispatchEvent(
+						new CustomEvent("emdash:content-changed", {
+							detail: { collection, id: entryId },
+						}),
+					);
+				} else {
+					document.dispatchEvent(new CustomEvent("emdash:save", { detail: { state: "error" } }));
+					console.error("Save failed:", res.status);
+				}
+			} catch (err) {
 				document.dispatchEvent(new CustomEvent("emdash:save", { detail: { state: "error" } }));
-				console.error("Save failed:", res.status);
+				console.error("Save failed:", err);
+			} finally {
+				savingRef.current = false;
 			}
-		} catch (err) {
-			document.dispatchEvent(new CustomEvent("emdash:save", { detail: { state: "error" } }));
-			console.error("Save failed:", err);
-		} finally {
-			savingRef.current = false;
-		}
-	}, [collection, entryId, field, getBlocks]);
+		},
+		[collection, entryId, field, getBlocks],
+	);
+
+	// Flush unsaved edits when the page goes away (browser back/forward,
+	// link click, tab close). The blur handler doesn't cover this: unload
+	// doesn't reliably fire React blur, and a plain fetch started during
+	// unload is cancelled by the navigation — edits were silently lost
+	// (#1582). `keepalive` lets the PUT outlive the page.
+	// Caveat: keepalive caps the body at 64KB — a very long document
+	// can still be lost on unload. Upgrade path: debounced autosave
+	// while typing (like the admin editor) so unload flushes are rare.
+	React.useEffect(() => {
+		const flush = () => void save({ keepalive: true });
+		window.addEventListener("pagehide", flush);
+		return () => window.removeEventListener("pagehide", flush);
+	}, [save]);
 
 	// Create slash commands extension once — uses refs to avoid re-render loop
 	const slashCommandsExtension = React.useMemo(

package/src/components/marks/Link.astro

@@ -19,7 +19,11 @@ export interface Props {
 
 const { node } = Astro.props;
 const href = sanitizeHref(node?.markDef?.href);
-const blank = node?.markDef?.blank;
+// Same-page anchor links (`#section`) are on-page jumps — opening them in a
+// new tab is never desirable, so force same-tab regardless of the mark's
+// `blank` flag.
+const isSamePageAnchor = href.startsWith("#");
+const blank = !isSamePageAnchor && node?.markDef?.blank;
 ---
 
 <a

package/src/database/dialect-helpers.ts

@@ -215,17 +215,91 @@ export function binaryType(db: Kysely<any>): ColumnDataType {
 }
 
 /**
- * SQL expression for extracting a field from a JSON/JSONB column.
+ * SQL expression for extracting a field from a JSON column stored as text.
  *
  * sqlite:   json_extract(column, '$.path')
- * postgres: column->>'path'
+ * postgres: (column)::jsonb->>'path'
+ *
+ * The Postgres cast is required because JSON columns (e.g.
+ * `_plugin_storage.data`) are `text`, and `text ->> unknown` is not an
+ * operator. The cast is immutable, so the same expression works in
+ * expression indexes — queries and indexes must build it through this
+ * helper so the planner can match them.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
 export function jsonExtractExpr(db: Kysely<any>, column: string, path: string): string {
 	validateIdentifier(column, "JSON column name");
 	validateJsonFieldName(path, "JSON path");
 	if (isPostgres(db)) {
-		return `${column}->>'${path}'`;
+		return `(${column})::jsonb->>'${path}'`;
 	}
 	return `json_extract(${column}, '$.${path}')`;
 }
+
+/**
+ * SQL expression for extracting a queryable field from the plugin-storage
+ * `data` column.
+ *
+ * `_plugin_storage.data` is `text`, so Postgres extraction goes through the
+ * `(data)::jsonb->>'field'` cast (#1898) — otherwise `text ->> unknown` is not
+ * an operator. But the extracted value is still `text`, so a numeric comparison
+ * (`stock >= 10`) compares lexically (`'9' >= '10'` is TRUE) and silently
+ * over-counts / oversells; pass `{ numeric: true }` for a numeric comparison.
+ *
+ * The numeric form is a **type-guarded** cast, not a bare `::numeric`. A bare
+ * cast throws `invalid input syntax for type numeric` the moment a single
+ * scanned row stores a non-number in that field (documents are schemaless),
+ * aborting the whole query — and it would diverge from SQLite, which silently
+ * coerces. Guarding with `jsonb_typeof`/`json_type` makes the comparison total
+ * and parity-correct on both dialects: a non-number stored value yields `NULL`
+ * (no match) instead of an error.
+ *
+ * The field name is validated before interpolation, so the casts wrap only a
+ * safe identifier and add no injection surface.
+ *
+ * sqlite text:      json_extract(data, '$.field')
+ * sqlite numeric:   CASE WHEN json_type(data, '$.field') IN ('integer', 'real')
+ *                     THEN json_extract(data, '$.field') END
+ * postgres text:    (data)::jsonb->>'field'
+ * postgres numeric: CASE WHEN jsonb_typeof((data)::jsonb->'field') = 'number'
+ *                     THEN ((data)::jsonb->>'field')::numeric END
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
+export function pluginDataExtractExpr(
+	db: Kysely<any>,
+	field: string,
+	options?: { numeric?: boolean },
+): string {
+	validateJsonFieldName(field, "plugin storage field name");
+	if (isPostgres(db)) {
+		const text = `(data)::jsonb->>'${field}'`;
+		if (!options?.numeric) return text;
+		return `CASE WHEN jsonb_typeof((data)::jsonb->'${field}') = 'number' THEN (${text})::numeric END`;
+	}
+	const extract = `json_extract(data, '$.${field}')`;
+	if (!options?.numeric) return extract;
+	return `CASE WHEN json_type(data, '$.${field}') IN ('integer', 'real') THEN ${extract} END`;
+}
+
+/**
+ * SQL expression for ordering plugin-storage rows by a `data` field.
+ *
+ * `ORDER BY` has no bound operand to infer numeric-vs-text from, so extracting
+ * as text (`->>'field'`) would sort a numeric field lexically on Postgres
+ * (`[10, 100, 9]`) while SQLite's `json_extract` sorts it numerically — a
+ * cross-dialect divergence. Ordering over the jsonb-native value (`->'field'`,
+ * single arrow) fixes this: jsonb btree ordering is numeric among numbers,
+ * lexical among strings, and total across heterogeneous values (never throws).
+ * SQLite's `json_extract` already orders numerically, so it is unchanged.
+ *
+ * sqlite:   json_extract(data, '$.field')
+ * postgres: (data)::jsonb->'field'
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
+export function pluginDataOrderExpr(db: Kysely<any>, field: string): string {
+	validateJsonFieldName(field, "plugin storage order field name");
+	if (isPostgres(db)) {
+		return `(data)::jsonb->'${field}'`;
+	}
+	return `json_extract(data, '$.${field}')`;
+}

package/src/database/migrations/051_content_taxonomies_denorm.ts

@@ -0,0 +1,120 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { columnExists, listTablesLike } from "../dialect-helpers.js";
+import { validateIdentifier } from "../validate.js";
+
+/**
+ * Denormalize the filter + sort columns from `ec_*` onto `content_taxonomies`
+ * and mirror `ec_*`'s composite sort indexes onto the pivot (#1834).
+ *
+ * A taxonomy-filtered listing used to apply the term filter as a correlated
+ * `EXISTS` on `SELECT * FROM ec_<collection> … ORDER BY … LIMIT ?`. The pivot
+ * carried only `(collection, entry_id, taxonomy_id)`, so the filter
+ * (`deleted_at`, `status`, `locale`) and the sort (`published_at`/`created_at`)
+ * could only be evaluated on the `ec_*` row. On stats-blind SQLite/D1 a
+ * selective term never fills the `LIMIT`, so the query walked the whole
+ * collection (~75k D1 rows read for a one-row page).
+ *
+ * Copying those columns onto the pivot and indexing them keyed by
+ * `(taxonomy_id, collection, …)` lets the loader seek the term and walk a
+ * sort-ordered pivot index, short-circuiting on `LIMIT`, then touch `ec_*` only
+ * by primary key to hydrate the page.
+ *
+ * The columns are advisory (D1 has no transactions; the write-path re-stamp is
+ * non-atomic), so the read path re-checks the real predicates on the joined
+ * `ec_*` row — see loader.ts. `updated_at` is deliberately not denormalized: it
+ * moves on every edit and is seldom a public sort, so its write cost outweighs
+ * its read value; `updated_at`-sorted taxonomy listings temp-sort instead.
+ *
+ * Order matters: add the columns, backfill, THEN build the indexes so each
+ * index is built once over populated data rather than maintained through the
+ * backfill `UPDATE`.
+ *
+ * Forward-only.
+ */
+
+const DENORM_COLUMNS = [
+	"status",
+	"scheduled_at",
+	"deleted_at",
+	"locale",
+	"published_at",
+	"created_at",
+] as const;
+
+// `entry_id DESC` (not ASC) matters: the listing orders `<sort> DESC, entry_id
+// DESC` (the common case), and a DESC tiebreaker lets SQLite satisfy the whole
+// ORDER BY from the index — no temp B-tree, clean early-`LIMIT`. An ASC
+// tiebreaker forces `USE TEMP B-TREE FOR LAST TERM OF ORDER BY`, which buffers
+// a whole equal-`sortval` block (e.g. a bulk import sharing one timestamp)
+// before emitting. `DESC` also serves the rarer ASC listing via a backward
+// index scan. Mirrors `ec_*`'s `(deleted_at, [locale,] <sort> DESC, id DESC)`.
+const INDEXES: { name: string; columns: string }[] = [
+	{
+		name: "idx_content_taxonomies_pub",
+		columns: "taxonomy_id, collection, deleted_at, published_at DESC, entry_id DESC",
+	},
+	{
+		name: "idx_content_taxonomies_crt",
+		columns: "taxonomy_id, collection, deleted_at, created_at DESC, entry_id DESC",
+	},
+	{
+		name: "idx_content_taxonomies_loc_pub",
+		columns: "taxonomy_id, collection, deleted_at, locale, published_at DESC, entry_id DESC",
+	},
+	{
+		name: "idx_content_taxonomies_loc_crt",
+		columns: "taxonomy_id, collection, deleted_at, locale, created_at DESC, entry_id DESC",
+	},
+];
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// 1. Add the six denormalized columns (all nullable, no default). Guarded so
+	//    a partial apply — or a re-run after a mid-migration failure — can retry
+	//    (`ALTER TABLE ADD COLUMN` is not itself idempotent on either dialect).
+	for (const column of DENORM_COLUMNS) {
+		if (await columnExists(db, "content_taxonomies", column)) continue;
+		await sql`
+			ALTER TABLE content_taxonomies ADD COLUMN ${sql.ref(column)} TEXT
+		`.execute(db);
+	}
+
+	// 2. Backfill from each content table by primary key. Drive from the actual
+	//    `ec_*` tables (not `_emdash_collections`) so collections whose table was
+	//    dropped are skipped naturally; the pivot's `collection` value is the
+	//    slug, i.e. the table name without its `ec_` prefix.
+	const tableNames = await listTablesLike(db, "ec_%");
+	for (const tableName of tableNames) {
+		validateIdentifier(tableName, "content table name");
+		const slug = tableName.slice("ec_".length);
+		await sql`
+			UPDATE content_taxonomies
+			SET (status, scheduled_at, deleted_at, locale, published_at, created_at) = (
+				SELECT status, scheduled_at, deleted_at, locale, published_at, created_at
+				FROM ${sql.ref(tableName)}
+				WHERE ${sql.ref(tableName)}.id = content_taxonomies.entry_id
+			)
+			WHERE collection = ${slug}
+		`.execute(db);
+	}
+
+	// 3. Build the composite sort indexes over the now-populated columns.
+	for (const index of INDEXES) {
+		await sql`
+			CREATE INDEX IF NOT EXISTS ${sql.ref(index.name)}
+			ON content_taxonomies (${sql.raw(index.columns)})
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	for (const index of INDEXES) {
+		await sql`DROP INDEX IF EXISTS ${sql.ref(index.name)}`.execute(db);
+	}
+	for (const column of DENORM_COLUMNS) {
+		await sql`
+			ALTER TABLE content_taxonomies DROP COLUMN ${sql.ref(column)}
+		`.execute(db);
+	}
+}

package/src/database/migrations/052_media_usage_read_index.ts

@@ -0,0 +1,26 @@
+import type { Kysely } from "kysely";
+
+const OLD_INDEX = "idx__emdash_media_usage_media_id";
+const READ_INDEX = "idx__emdash_media_usage_media_source_generation";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// D1 DDL is non-transactional: create the replacement before dropping the
+	// old index so an interrupted migration always leaves a media-leading index.
+	await db.schema
+		.createIndex(READ_INDEX)
+		.ifNotExists()
+		.on("_emdash_media_usage")
+		.columns(["media_id", "source_key", "generation"])
+		.execute();
+	await db.schema.dropIndex(OLD_INDEX).ifExists().execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createIndex(OLD_INDEX)
+		.ifNotExists()
+		.on("_emdash_media_usage")
+		.column("media_id")
+		.execute();
+	await db.schema.dropIndex(READ_INDEX).ifExists().execute();
+}

package/src/database/migrations/053_plugin_mcp_tools.ts

@@ -0,0 +1,21 @@
+import type { Kysely } from "kysely";
+
+import { columnExists } from "../dialect-helpers.js";
+
+/** Persist explicit per-plugin MCP enablement and the declaration consented to by an admin. */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	if (!(await columnExists(db, "_plugin_state", "mcp_tools_enabled"))) {
+		await db.schema
+			.alterTable("_plugin_state")
+			.addColumn("mcp_tools_enabled", "integer", (col) => col.notNull().defaultTo(0))
+			.execute();
+	}
+	if (!(await columnExists(db, "_plugin_state", "mcp_tools_consent"))) {
+		await db.schema.alterTable("_plugin_state").addColumn("mcp_tools_consent", "text").execute();
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	await db.schema.alterTable("_plugin_state").dropColumn("mcp_tools_consent").execute();
+	await db.schema.alterTable("_plugin_state").dropColumn("mcp_tools_enabled").execute();
+}

package/src/database/migrations/runner.ts

@@ -53,6 +53,9 @@ import * as m047 from "./047_restore_taxonomy_parent_index.js";
 import * as m048 from "./048_restore_content_taxonomies_term_index.js";
 import * as m049 from "./049_taxonomies_name_locale_index.js";
 import * as m050 from "./050_media_usage_index_status.js";
+import * as m051 from "./051_content_taxonomies_denorm.js";
+import * as m052 from "./052_media_usage_read_index.js";
+import * as m053 from "./053_plugin_mcp_tools.js";
 
 const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"001_initial": m001,
@@ -104,6 +107,9 @@ const MIGRATIONS: Readonly<Record<string, Migration>> = Object.freeze({
 	"048_restore_content_taxonomies_term_index": m048,
 	"049_taxonomies_name_locale_index": m049,
 	"050_media_usage_index_status": m050,
+	"051_content_taxonomies_denorm": m051,
+	"052_media_usage_read_index": m052,
+	"053_plugin_mcp_tools": m053,
 });
 
 /** Total number of registered migrations. Exported for use in tests. */

package/src/database/repositories/audit.ts

@@ -14,7 +14,8 @@ export type AuditAction =
 	| "logout"
 	| "password_change"
 	| "settings_update"
-	| "schema_change";
+	| "schema_change"
+	| "plugin_tool_invoke";
 
 export type AuditStatus = "success" | "failure" | "denied";