emdash 0.29.0 → 0.30.0

package/src/plugins/types.ts

@@ -9,6 +9,7 @@
  *
  */
 
+import type { Permission } from "@emdash-cms/auth";
 import type { Element } from "@emdash-cms/blocks";
 // The plugin capability vocabulary, the legacy-rename map, and the manifest
 // shape are authored once in @emdash-cms/plugin-types and shared between core
@@ -28,7 +29,9 @@ import {
 	type DeclaredAccess,
 	type DeprecatedPluginCapability,
 	type ManifestHookEntry,
+	type ManifestMcpTool,
 	type ManifestRouteEntry,
+	type PluginMcpManifestConfig,
 	type PluginCapability,
 	type PluginStorageConfig,
 	type StorageCollectionConfig,
@@ -52,7 +55,9 @@ export {
 	type DeclaredAccess,
 	type DeprecatedPluginCapability,
 	type ManifestHookEntry,
+	type ManifestMcpTool,
 	type ManifestRouteEntry,
+	type PluginMcpManifestConfig,
 	type PluginCapability,
 	type PluginStorageConfig,
 	type StorageCollectionConfig,
@@ -213,6 +218,8 @@ export interface ContentItem {
 	createdAt: string;
 	updatedAt: string;
 	publishedAt: string | null;
+	/** Scheduled publication time, if set (e.g. scheduled items or scheduled draft changes). */
+	scheduledAt?: string | null;
 }
 
 export interface ContentListWhere {
@@ -417,6 +424,14 @@ export interface SiteInfo {
 	url: string;
 	/** Site locale (from settings, defaults to "en") */
 	locale: string;
+	/**
+	 * Astro's `trailingSlash` routing policy, from the host's Astro config.
+	 * Plugins that build absolute URLs (sitemap, canonical, hreflang) should
+	 * honor this so the URLs they emit match what the site serves. `createSiteInfo`
+	 * always populates it (defaulting to `"ignore"`, Astro's default); it is
+	 * optional on the type so pre-existing `SiteInfo` construction stays valid.
+	 */
+	trailingSlash?: "always" | "never" | "ignore";
 }
 
 /**
@@ -1173,10 +1188,31 @@ export interface PluginRoute<TInput = unknown> {
 	 * Public routes skip session/token auth and CSRF checks.
 	 */
 	public?: boolean;
+	/** RBAC permission required to invoke the route. Legacy routes default to plugins:manage. */
+	permission?: Permission;
+	/**
+	 * `Cache-Control` header value for successful GET responses, e.g.
+	 * `"public, max-age=60, stale-while-revalidate=300"`. Only honored on
+	 * routes that are also `public: true` — authenticated responses always
+	 * keep the default `private, no-store`. Errors are never cached.
+	 */
+	cacheControl?: string;
 	/** Route handler */
 	handler: (ctx: RouteContext<TInput>) => Promise<unknown>;
 }
 
+export interface PluginMcpToolDefinition {
+	description: string;
+	route: string;
+	input: z.ZodType;
+	output?: z.ZodType;
+	destructive?: boolean;
+}
+
+export interface PluginMcpConfig {
+	tools: Record<string, PluginMcpToolDefinition>;
+}
+
 // =============================================================================
 // Plugin Definition
 // =============================================================================
@@ -1358,6 +1394,9 @@ export interface PluginDefinition<TStorage extends PluginStorageConfig = PluginS
 	/** API routes */
 	routes?: Record<string, PluginRoute>;
 
+	/** Routes explicitly exposed as agent-callable MCP tools. */
+	mcp?: PluginMcpConfig;
+
 	/** Admin UI configuration */
 	admin?: PluginAdminConfig;
 }
@@ -1373,6 +1412,7 @@ export interface ResolvedPlugin<TStorage extends PluginStorageConfig = PluginSto
 	storage: TStorage;
 	hooks: ResolvedPluginHooks;
 	routes: Record<string, PluginRoute>;
+	mcp?: PluginMcpConfig;
 	admin: PluginAdminConfig;
 }
 
@@ -1453,6 +1493,7 @@ export interface PluginManifest {
 	hooks: Array<ManifestHookEntry | HookName>;
 	/** Route declarations — either plain name strings or structured objects */
 	routes: Array<ManifestRouteEntry | string>;
+	mcp?: PluginMcpManifestConfig;
 	admin: PluginAdminConfig;
 }
 

package/src/schema/registry.ts

@@ -1,5 +1,4 @@
-import type { Kysely } from "kysely";
-import type { Selectable } from "kysely";
+import type { ColumnDataType, CreateTableBuilder, Insertable, Kysely, Selectable } from "kysely";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
@@ -39,6 +38,12 @@ const WORD_BOUNDARY_PATTERN = /\b\w/g;
 
 /** Valid column types for runtime validation */
 const COLUMN_TYPES: ReadonlySet<string> = new Set(["TEXT", "REAL", "INTEGER", "JSON"]);
+const COLUMN_TYPE_TO_DATA_TYPE = {
+	TEXT: "text",
+	REAL: "real",
+	INTEGER: "integer",
+	JSON: "json",
+} satisfies Record<ColumnType, ColumnDataType>;
 
 /** Valid collection source prefixes/values */
 const VALID_SOURCES: ReadonlySet<string> = new Set(["manual", "discovered", "seed"]);
@@ -64,6 +69,10 @@ const VALID_COLLECTION_SUPPORTS: ReadonlySet<string> = new Set<CollectionSupport
 	"seo",
 ]);
 
+// Each _emdash_fields row uses 15 bound parameters. Six rows keep every
+// multi-row INSERT below D1's 100-parameter statement limit.
+const SEED_FIELD_INSERT_BATCH_SIZE = 6;
+
 function isCollectionSupport(value: unknown): value is CollectionSupport {
 	return typeof value === "string" && VALID_COLLECTION_SUPPORTS.has(value);
 }
@@ -264,6 +273,113 @@ export class SchemaRegistry {
 		return collection;
 	}
 
+	/**
+	 * Create a seed-owned collection and all of its fields in bulk.
+	 *
+	 * Fresh seeds can define dozens of fields. Creating them through
+	 * `createField` performs multiple reads, one ALTER TABLE, and one media
+	 * usage invalidation per field, which can exhaust D1's per-request query
+	 * budget. This path validates the full schema before mutating it, creates
+	 * the complete content table in one statement, and inserts field metadata
+	 * in parameter-safe batches.
+	 */
+	async createSeedCollection(
+		input: Omit<CreateCollectionInput, "source">,
+		fields: readonly CreateFieldInput[],
+	): Promise<void> {
+		this.validateSlug(input.slug, "collection");
+		if (RESERVED_COLLECTION_SLUGS.includes(input.slug)) {
+			throw new SchemaError(`Collection slug "${input.slug}" is reserved`, "RESERVED_SLUG");
+		}
+
+		const existing = await this.getCollection(input.slug);
+		if (existing) {
+			throw new SchemaError(`Collection "${input.slug}" already exists`, "COLLECTION_EXISTS");
+		}
+
+		const fieldSlugs = new Set<string>();
+		for (const field of fields) {
+			this.validateSlug(field.slug, "field");
+			if (RESERVED_FIELD_SLUGS.includes(field.slug)) {
+				throw new SchemaError(`Field slug "${field.slug}" is reserved`, "RESERVED_SLUG");
+			}
+			if (fieldSlugs.has(field.slug)) {
+				throw new SchemaError(
+					`Field "${field.slug}" already exists in collection "${input.slug}"`,
+					"FIELD_EXISTS",
+				);
+			}
+			fieldSlugs.add(field.slug);
+		}
+
+		const collectionId = ulid();
+		const supports = input.supports ?? ["drafts", "revisions"];
+		const hasSeo = input.hasSeo ?? supports.includes("seo") ?? false;
+		let maxSortOrder = -1;
+		const fieldRows: Insertable<FieldTable>[] = fields.map((field) => {
+			const sortOrder = field.sortOrder ?? maxSortOrder + 1;
+			maxSortOrder = Math.max(maxSortOrder, sortOrder);
+
+			return {
+				id: ulid(),
+				collection_id: collectionId,
+				slug: field.slug,
+				label: field.label,
+				type: field.type,
+				column_type: FIELD_TYPE_TO_COLUMN[field.type],
+				required: field.required ? 1 : 0,
+				unique: field.unique ? 1 : 0,
+				default_value: field.defaultValue !== undefined ? JSON.stringify(field.defaultValue) : null,
+				validation: field.validation ? JSON.stringify(field.validation) : null,
+				widget: field.widget ?? null,
+				options: field.options ? JSON.stringify(field.options) : null,
+				sort_order: sortOrder,
+				searchable: field.searchable ? 1 : 0,
+				translatable: field.translatable === false ? 0 : 1,
+			};
+		});
+
+		let schemaMutated = false;
+		try {
+			await withTransaction(this.db, async (trx) => {
+				await trx
+					.insertInto("_emdash_collections")
+					.values({
+						id: collectionId,
+						slug: input.slug,
+						label: input.label,
+						label_singular: input.labelSingular ?? null,
+						description: input.description ?? null,
+						icon: input.icon ?? null,
+						supports: JSON.stringify(supports),
+						source: "seed",
+						has_seo: hasSeo ? 1 : 0,
+						comments_enabled: input.commentsEnabled ? 1 : 0,
+						url_pattern: input.urlPattern ?? null,
+					})
+					.execute();
+				schemaMutated = true;
+
+				await this.createContentTable(input.slug, trx, fields);
+
+				for (const fieldBatch of chunks(fieldRows, SEED_FIELD_INSERT_BATCH_SIZE)) {
+					await trx.insertInto("_emdash_fields").values(fieldBatch).execute();
+				}
+			});
+
+			await markContentMediaUsageCollectionStaleSafely(this.db, input.slug, "CONTENT_USAGE_STALE");
+		} catch (error) {
+			if (schemaMutated) {
+				await markContentMediaUsageCollectionStaleSafely(
+					this.db,
+					input.slug,
+					"CONTENT_USAGE_STALE",
+				);
+			}
+			throw error;
+		}
+	}
+
 	/**
 	 * Update a collection
 	 */
@@ -787,11 +903,15 @@ export class SchemaRegistry {
 	/**
 	 * Create a content table for a collection
 	 */
-	private async createContentTable(slug: string, db?: Kysely<Database>): Promise<void> {
+	private async createContentTable(
+		slug: string,
+		db?: Kysely<Database>,
+		fields: readonly CreateFieldInput[] = [],
+	): Promise<void> {
 		const conn = db ?? this.db;
 		const tableName = this.getTableName(slug);
 
-		await conn.schema
+		let table: CreateTableBuilder<string, string> = conn.schema
 			.createTable(tableName)
 			.addColumn("id", "text", (col) => col.primaryKey())
 			.addColumn("slug", "text")
@@ -807,7 +927,23 @@ export class SchemaRegistry {
 			.addColumn("live_revision_id", "text", (col) => col.references("revisions.id"))
 			.addColumn("draft_revision_id", "text", (col) => col.references("revisions.id"))
 			.addColumn("locale", "text", (col) => col.notNull().defaultTo("en"))
-			.addColumn("translation_group", "text")
+			.addColumn("translation_group", "text");
+
+		for (const field of fields) {
+			const columnName = this.getColumnName(field.slug);
+			const columnType = COLUMN_TYPE_TO_DATA_TYPE[FIELD_TYPE_TO_COLUMN[field.type]];
+			table = table.addColumn(columnName, columnType, (column) => {
+				if (!field.required) return column;
+
+				const defaultValue =
+					field.defaultValue !== undefined
+						? this.formatDefaultValue(field.defaultValue, field.type)
+						: this.getEmptyDefault(field.type);
+				return column.notNull().defaultTo(sql.raw(defaultValue));
+			});
+		}
+
+		await table
 			.addUniqueConstraint(`${tableName}_slug_locale_unique`, ["slug", "locale"])
 			.execute();
 

package/src/seed/apply.ts

@@ -224,36 +224,35 @@ export async function applySeed(
 				continue;
 			}
 
-			// Create collection
-			await registry.createCollection({
-				slug: collection.slug,
-				label: collection.label,
-				labelSingular: collection.labelSingular,
-				description: collection.description,
-				icon: collection.icon,
-				supports: collection.supports || [],
-				source: "seed",
-				urlPattern: collection.urlPattern,
-				commentsEnabled: collection.commentsEnabled,
-			});
+			const fields = collection.fields.map((field) => ({
+				slug: field.slug,
+				label: field.label,
+				type: field.type,
+				required: field.required || false,
+				unique: field.unique || false,
+				searchable: field.searchable || false,
+				defaultValue: field.defaultValue,
+				validation: field.validation,
+				widget: field.widget,
+				options: field.options,
+			}));
+
+			// Create a fresh seed schema in bulk to stay within D1's query budget.
+			await registry.createSeedCollection(
+				{
+					slug: collection.slug,
+					label: collection.label,
+					labelSingular: collection.labelSingular,
+					description: collection.description,
+					icon: collection.icon,
+					supports: collection.supports || [],
+					urlPattern: collection.urlPattern,
+					commentsEnabled: collection.commentsEnabled,
+				},
+				fields,
+			);
 			result.collections.created++;
-
-			// Create fields
-			for (const field of collection.fields) {
-				await registry.createField(collection.slug, {
-					slug: field.slug,
-					label: field.label,
-					type: field.type,
-					required: field.required || false,
-					unique: field.unique || false,
-					searchable: field.searchable || false,
-					defaultValue: field.defaultValue,
-					validation: field.validation,
-					widget: field.widget,
-					options: field.options,
-				});
-				result.fields.created++;
-			}
+			result.fields.created += fields.length;
 		}
 	}
 

package/src/seo/index.ts

@@ -83,6 +83,17 @@ export interface SeoMetaOptions {
 	path?: string;
 	/** Default OG image URL if content has none */
 	defaultOgImage?: string;
+	/**
+	 * Default page title used when the SEO panel has none. Ranks above the
+	 * `data.title` fallback, so computed titles (e.g. `` `${title} (cover of
+	 * ${artist})` ``) apply while an editor-set SEO title still wins.
+	 */
+	defaultTitle?: string;
+	/**
+	 * Default description used when the SEO panel has none. Ranks above the
+	 * `data.excerpt` fallback; an editor-set SEO description still wins.
+	 */
+	defaultDescription?: string;
 }
 
 /**
@@ -96,7 +107,7 @@ export interface SeoMetaOptions {
  * @returns Resolved meta tags ready for template use
  */
 export function getSeoMeta<T>(content: SeoContentInput<T>, options: SeoMetaOptions = {}): SeoMeta {
-	const { siteTitle, siteUrl, path, defaultOgImage } = options;
+	const { siteTitle, siteUrl, path, defaultOgImage, defaultTitle, defaultDescription } = options;
 	const separator = options.titleSeparator || " | ";
 	// SEO can be in content.seo (ContentItem) or content.data.seo (ContentEntry)
 	const seo = content.seo ??
@@ -108,15 +119,19 @@ export function getSeoMeta<T>(content: SeoContentInput<T>, options: SeoMetaOptio
 			noIndex: false,
 		};
 
-	// Title: SEO title > content title > fallback
+	// Title: SEO panel title > caller default > content title
 	const pageTitle =
-		seo.title || (typeof content.data.title === "string" ? content.data.title : null) || "";
+		seo.title ||
+		defaultTitle ||
+		(typeof content.data.title === "string" ? content.data.title : null) ||
+		"";
 
 	const fullTitle = siteTitle && pageTitle ? `${pageTitle}${separator}${siteTitle}` : pageTitle;
 
-	// Description: SEO description > excerpt
+	// Description: SEO panel description > caller default > excerpt
 	const description =
 		seo.description ||
+		defaultDescription ||
 		(typeof content.data.excerpt === "string" ? content.data.excerpt : null) ||
 		null;
 

package/src/storage/types.ts

@@ -195,6 +195,12 @@ export interface Storage {
 	 * Get public URL for a file
 	 */
 	getPublicUrl(key: string): string;
+
+	/**
+	 * Get the origin the browser connects to for direct client uploads.
+	 * Used by the admin CSP when the storage descriptor has no static endpoint.
+	 */
+	getClientUploadOrigin?(): string;
 }
 
 /**

package/src/utils/base64.ts

@@ -37,11 +37,16 @@ export function encodeBase64(str: string): string {
 
 /** Decode a standard base64 string to a UTF-8 string. */
 export function decodeBase64(base64: string): string {
-	if (hasNative) return new TextDecoder().decode(Uint8Array.fromBase64(base64));
+	return new TextDecoder().decode(decodeBase64Bytes(base64));
+}
+
+/** Decode a standard base64 string to raw bytes (for binary payloads). */
+export function decodeBase64Bytes(base64: string): Uint8Array {
+	if (hasNative) return Uint8Array.fromBase64(base64);
 	const binary = atob(base64);
 	const bytes = new Uint8Array(binary.length);
 	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-	return new TextDecoder().decode(bytes);
+	return bytes;
 }
 
 // ---------------------------------------------------------------------------

package/src/utils/db-errors.ts

@@ -26,10 +26,12 @@ function messageOf(error: unknown): string {
  * Returns true when `error` is a "column does not exist" error.
  * Used to handle where filters that reference non-existent field names
  * gracefully (return empty results) instead of propagating a SQL error.
+ * When `column` is given, only errors naming that column match.
  */
-export function isMissingColumnError(error: unknown): boolean {
+export function isMissingColumnError(error: unknown, column?: string): boolean {
 	const message = messageOf(error);
 	if (!message) return false;
+	if (column && !message.includes(column.toLowerCase())) return false;
 
 	// SQLite / D1: "no such column: foo"
 	if (message.includes("no such column")) return true;

package/src/virtual-modules.d.ts

@@ -21,6 +21,10 @@ declare module "virtual:emdash/config" {
 		authProviders?: AuthProviderDescriptor[];
 		i18n?: I18nConfig | null;
 		toolbar?: "server" | "client" | false;
+		/** Public origin from astro.config.mjs, origin-normalized at startup. */
+		siteUrl?: string;
+		astroCspEnabled?: boolean;
+		trailingSlash?: "always" | "never" | "ignore";
 	}
 
 	const config: VirtualConfig;
@@ -157,6 +161,15 @@ declare module "virtual:emdash/wait-until" {
 	export const waitUntil: ((promise: Promise<unknown>) => void) | undefined;
 }
 
+declare module "virtual:emdash/env" {
+	/**
+	 * Worker bindings/secrets. Resolves to Cloudflare's `env` (from
+	 * `cloudflare:workers`) under @astrojs/cloudflare; `undefined` on Node,
+	 * where callers should fall back to `import.meta.env`.
+	 */
+	export const env: Record<string, unknown> | undefined;
+}
+
 declare module "virtual:emdash/scheduler" {
 	import type { CreateSchedulerFn } from "./emdash-runtime.js";
 	/**

package/src/visual-editing/toolbar.ts

@@ -730,7 +730,7 @@ export function renderToolbar(config: ToolbarConfig): string {
     manifestPromise = ecFetch("/_emdash/api/manifest", { credentials: "same-origin" })
       .then(function(r) { return r.json(); })
       .then(function(m) {
-        // The manifest endpoint wraps the payload in a { data } envelope (ApiResponse shape).
+        // The manifest endpoint wraps the payload in a { success, data } envelope (ApiResponse shape).
         // Unwrap it so getFieldKind can read manifest.collections directly.
         manifestCache = m && m.data ? m.data : m;
         return manifestCache;

package/dist/adapters-DPAkL6QF.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adapters-DPAkL6QF.d.mts","names":[],"sources":["../src/db/adapters.ts"],"mappings":";;AA0BA;;;;;AAKA;;;;;;;;;;;AAqBA;;;;;AAOA;;;KAjCY,mBAAA;;AAsDZ;;UAjDiB,kBAAA;EAChB,UAAA;EACA,MAAA;EACA,IAAA,EAAM,mBAAA;EA8CuC;;;AAqB9C;;;;;;;;;AAWA;;EA/DC,oBAAA;AAAA;AAAA,UAGgB,YAAA;EA8DhB;;;EA1DA,GAAA;AAAA;AAAA,UAGgB,YAAA;EA6DhB;;;EAzDA,GAAA;EAyD0B;AAa3B;;EAlEC,SAAA;AAAA;;;;;;;;;;;iBAae,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;;;;;;;;;;;iBAqB9B,MAAA,CAAO,MAAA,EAAQ,YAAA,GAAe,kBAAA;;;;UAW7B,cAAA;EAChB,gBAAA;EACA,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,GAAA;EACA,IAAA;IAAS,GAAA;IAAc,GAAA;EAAA;AAAA;;;;;;;;;;;iBAaR,QAAA,CAAS,MAAA,EAAQ,cAAA,GAAiB,kBAAA"}