emdash 0.29.0 → 0.31.0

package/src/plugins/storage-query.ts

@@ -8,8 +8,7 @@
 
 import type { Kysely } from "kysely";
 
-import { jsonExtractExpr } from "../database/dialect-helpers.js";
-import { validateJsonFieldName } from "../database/validate.js";
+import { pluginDataExtractExpr, pluginDataOrderExpr } from "../database/dialect-helpers.js";
 import type { WhereClause, WhereValue, RangeFilter, InFilter, StartsWithFilter } from "./types.js";
 
 /**
@@ -50,6 +49,15 @@ export function isStartsWithFilter(value: WhereValue): value is StartsWithFilter
 	return "startsWith" in value && typeof value.startsWith === "string";
 }
 
+/**
+ * Escape LIKE pattern metacharacters so a startsWith prefix matches
+ * literally. Without this, `%` and `_` in the prefix act as wildcards
+ * (e.g. `{ startsWith: "50%" }` would match "50x off").
+ */
+export function escapeLikePattern(value: string): string {
+	return value.replaceAll("\\", "\\\\").replaceAll("%", "\\%").replaceAll("_", "\\_");
+}
+
 /**
  * Get the set of indexed fields from index declarations
  */
@@ -108,15 +116,34 @@ export function validateOrderByClause(
 }
 
 /**
- * SQL expression for extracting JSON field.
+ * SQL expression for extracting a queryable field from the `_plugin_storage.data`
+ * column.
  *
- * Validates the field name before interpolation to prevent SQL injection
- * via crafted JSON path expressions.
+ * Delegates to `pluginDataExtractExpr`, which validates the field name before
+ * interpolation and applies the dialect-correct extraction: a `::jsonb` cast on
+ * Postgres (the `data` column is `text`) plus an optional type-guarded
+ * `::numeric` cast so numeric comparisons don't fall back to lexical text
+ * ordering.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
-export function jsonExtract(db: Kysely<any>, field: string): string {
-	validateJsonFieldName(field, "query field name");
-	return jsonExtractExpr(db, "data", field);
+export function jsonExtract(
+	db: Kysely<any>,
+	field: string,
+	options?: { numeric?: boolean },
+): string {
+	return pluginDataExtractExpr(db, field, options);
+}
+
+/**
+ * SQL expression for ordering by a `_plugin_storage.data` field.
+ *
+ * Delegates to `pluginDataOrderExpr`, which orders over the jsonb-native value
+ * on Postgres so numeric fields sort numerically (not lexically) while staying
+ * total across heterogeneous data. SQLite keeps `json_extract` (already numeric).
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance
+export function jsonOrderExtract(db: Kysely<any>, field: string): string {
+	return pluginDataOrderExpr(db, field);
 }
 
 /**
@@ -128,33 +155,45 @@ export function buildCondition(
 	field: string,
 	value: WhereValue,
 ): { sql: string; params: unknown[] } {
-	const extract = jsonExtract(db, field);
+	// Numeric-vs-text is decided per condition from the JS type of the bound
+	// value. On Postgres a text extract compared to a bound number would sort
+	// lexically (`'9' >= '10'` is TRUE); a type-guarded `::numeric` cast on the
+	// extract fixes it. String/boolean operands keep text comparison. SQLite is
+	// unaffected — `json_extract` already returns a typed value.
+	const extractFor = (numeric: boolean): string => jsonExtract(db, field, { numeric });
 
 	if (value === null) {
-		return { sql: `${extract} IS NULL`, params: [] };
+		return { sql: `${extractFor(false)} IS NULL`, params: [] };
 	}
 
-	if (typeof value === "string" || typeof value === "number") {
-		return { sql: `${extract} = ?`, params: [value] };
+	if (typeof value === "number") {
+		return { sql: `${extractFor(true)} = ?`, params: [value] };
+	}
+
+	if (typeof value === "string") {
+		return { sql: `${extractFor(false)} = ?`, params: [value] };
 	}
 
 	if (typeof value === "boolean") {
 		// JSON booleans are stored as true/false strings
-		return { sql: `${extract} = ?`, params: [value] };
+		return { sql: `${extractFor(false)} = ?`, params: [value] };
 	}
 
 	if (isInFilter(value)) {
+		const numeric = value.in.length > 0 && value.in.every((v) => typeof v === "number");
 		const placeholders = value.in.map(() => "?").join(", ");
 		return {
-			sql: `${extract} IN (${placeholders})`,
+			sql: `${extractFor(numeric)} IN (${placeholders})`,
 			params: value.in,
 		};
 	}
 
 	if (isStartsWithFilter(value)) {
+		// ESCAPE '\' works on both SQLite and PostgreSQL. startsWith is a string
+		// operation, so always compare as text.
 		return {
-			sql: `${extract} LIKE ?`,
-			params: [`${value.startsWith}%`],
+			sql: `${extractFor(false)} LIKE ? ESCAPE '\\'`,
+			params: [`${escapeLikePattern(value.startsWith)}%`],
 		};
 	}
 
@@ -162,22 +201,17 @@ export function buildCondition(
 		const conditions: string[] = [];
 		const params: unknown[] = [];
 
-		if (value.gt !== undefined) {
-			conditions.push(`${extract} > ?`);
-			params.push(value.gt);
-		}
-		if (value.gte !== undefined) {
-			conditions.push(`${extract} >= ?`);
-			params.push(value.gte);
-		}
-		if (value.lt !== undefined) {
-			conditions.push(`${extract} < ?`);
-			params.push(value.lt);
-		}
-		if (value.lte !== undefined) {
-			conditions.push(`${extract} <= ?`);
-			params.push(value.lte);
-		}
+		// Each bound is cast to numeric only when its own operand is a number, so
+		// a mixed range (e.g. a string lower bound) stays correct per side.
+		const pushBound = (op: string, bound: string | number): void => {
+			conditions.push(`${extractFor(typeof bound === "number")} ${op} ?`);
+			params.push(bound);
+		};
+
+		if (value.gt !== undefined) pushBound(">", value.gt);
+		if (value.gte !== undefined) pushBound(">=", value.gte);
+		if (value.lt !== undefined) pushBound("<", value.lt);
+		if (value.lte !== undefined) pushBound("<=", value.lte);
 
 		return {
 			sql: conditions.join(" AND "),
@@ -229,7 +263,7 @@ export function buildOrderByClause(
 	const clauses: string[] = [];
 
 	for (const [field, direction] of Object.entries(orderBy)) {
-		clauses.push(`${jsonExtract(db, field)} ${direction.toUpperCase()}`);
+		clauses.push(`${jsonOrderExtract(db, field)} ${direction.toUpperCase()}`);
 	}
 
 	if (clauses.length === 0) {

package/src/plugins/types.ts

@@ -9,6 +9,7 @@
  *
  */
 
+import type { Permission } from "@emdash-cms/auth";
 import type { Element } from "@emdash-cms/blocks";
 // The plugin capability vocabulary, the legacy-rename map, and the manifest
 // shape are authored once in @emdash-cms/plugin-types and shared between core
@@ -28,7 +29,9 @@ import {
 	type DeclaredAccess,
 	type DeprecatedPluginCapability,
 	type ManifestHookEntry,
+	type ManifestMcpTool,
 	type ManifestRouteEntry,
+	type PluginMcpManifestConfig,
 	type PluginCapability,
 	type PluginStorageConfig,
 	type StorageCollectionConfig,
@@ -52,7 +55,9 @@ export {
 	type DeclaredAccess,
 	type DeprecatedPluginCapability,
 	type ManifestHookEntry,
+	type ManifestMcpTool,
 	type ManifestRouteEntry,
+	type PluginMcpManifestConfig,
 	type PluginCapability,
 	type PluginStorageConfig,
 	type StorageCollectionConfig,
@@ -213,6 +218,8 @@ export interface ContentItem {
 	createdAt: string;
 	updatedAt: string;
 	publishedAt: string | null;
+	/** Scheduled publication time, if set (e.g. scheduled items or scheduled draft changes). */
+	scheduledAt?: string | null;
 }
 
 export interface ContentListWhere {
@@ -417,6 +424,14 @@ export interface SiteInfo {
 	url: string;
 	/** Site locale (from settings, defaults to "en") */
 	locale: string;
+	/**
+	 * Astro's `trailingSlash` routing policy, from the host's Astro config.
+	 * Plugins that build absolute URLs (sitemap, canonical, hreflang) should
+	 * honor this so the URLs they emit match what the site serves. `createSiteInfo`
+	 * always populates it (defaulting to `"ignore"`, Astro's default); it is
+	 * optional on the type so pre-existing `SiteInfo` construction stays valid.
+	 */
+	trailingSlash?: "always" | "never" | "ignore";
 }
 
 /**
@@ -1173,10 +1188,31 @@ export interface PluginRoute<TInput = unknown> {
 	 * Public routes skip session/token auth and CSRF checks.
 	 */
 	public?: boolean;
+	/** RBAC permission required to invoke the route. Legacy routes default to plugins:manage. */
+	permission?: Permission;
+	/**
+	 * `Cache-Control` header value for successful GET responses, e.g.
+	 * `"public, max-age=60, stale-while-revalidate=300"`. Only honored on
+	 * routes that are also `public: true` — authenticated responses always
+	 * keep the default `private, no-store`. Errors are never cached.
+	 */
+	cacheControl?: string;
 	/** Route handler */
 	handler: (ctx: RouteContext<TInput>) => Promise<unknown>;
 }
 
+export interface PluginMcpToolDefinition {
+	description: string;
+	route: string;
+	input: z.ZodType;
+	output?: z.ZodType;
+	destructive?: boolean;
+}
+
+export interface PluginMcpConfig {
+	tools: Record<string, PluginMcpToolDefinition>;
+}
+
 // =============================================================================
 // Plugin Definition
 // =============================================================================
@@ -1358,6 +1394,9 @@ export interface PluginDefinition<TStorage extends PluginStorageConfig = PluginS
 	/** API routes */
 	routes?: Record<string, PluginRoute>;
 
+	/** Routes explicitly exposed as agent-callable MCP tools. */
+	mcp?: PluginMcpConfig;
+
 	/** Admin UI configuration */
 	admin?: PluginAdminConfig;
 }
@@ -1373,6 +1412,7 @@ export interface ResolvedPlugin<TStorage extends PluginStorageConfig = PluginSto
 	storage: TStorage;
 	hooks: ResolvedPluginHooks;
 	routes: Record<string, PluginRoute>;
+	mcp?: PluginMcpConfig;
 	admin: PluginAdminConfig;
 }
 
@@ -1453,6 +1493,7 @@ export interface PluginManifest {
 	hooks: Array<ManifestHookEntry | HookName>;
 	/** Route declarations — either plain name strings or structured objects */
 	routes: Array<ManifestRouteEntry | string>;
+	mcp?: PluginMcpManifestConfig;
 	admin: PluginAdminConfig;
 }
 

package/src/schema/registry.ts

@@ -1,5 +1,4 @@
-import type { Kysely } from "kysely";
-import type { Selectable } from "kysely";
+import type { ColumnDataType, CreateTableBuilder, Insertable, Kysely, Selectable } from "kysely";
 import { sql } from "kysely";
 import { ulid } from "ulidx";
 
@@ -39,6 +38,12 @@ const WORD_BOUNDARY_PATTERN = /\b\w/g;
 
 /** Valid column types for runtime validation */
 const COLUMN_TYPES: ReadonlySet<string> = new Set(["TEXT", "REAL", "INTEGER", "JSON"]);
+const COLUMN_TYPE_TO_DATA_TYPE = {
+	TEXT: "text",
+	REAL: "real",
+	INTEGER: "integer",
+	JSON: "json",
+} satisfies Record<ColumnType, ColumnDataType>;
 
 /** Valid collection source prefixes/values */
 const VALID_SOURCES: ReadonlySet<string> = new Set(["manual", "discovered", "seed"]);
@@ -64,6 +69,10 @@ const VALID_COLLECTION_SUPPORTS: ReadonlySet<string> = new Set<CollectionSupport
 	"seo",
 ]);
 
+// Each _emdash_fields row uses 15 bound parameters. Six rows keep every
+// multi-row INSERT below D1's 100-parameter statement limit.
+const SEED_FIELD_INSERT_BATCH_SIZE = 6;
+
 function isCollectionSupport(value: unknown): value is CollectionSupport {
 	return typeof value === "string" && VALID_COLLECTION_SUPPORTS.has(value);
 }
@@ -264,6 +273,113 @@ export class SchemaRegistry {
 		return collection;
 	}
 
+	/**
+	 * Create a seed-owned collection and all of its fields in bulk.
+	 *
+	 * Fresh seeds can define dozens of fields. Creating them through
+	 * `createField` performs multiple reads, one ALTER TABLE, and one media
+	 * usage invalidation per field, which can exhaust D1's per-request query
+	 * budget. This path validates the full schema before mutating it, creates
+	 * the complete content table in one statement, and inserts field metadata
+	 * in parameter-safe batches.
+	 */
+	async createSeedCollection(
+		input: Omit<CreateCollectionInput, "source">,
+		fields: readonly CreateFieldInput[],
+	): Promise<void> {
+		this.validateSlug(input.slug, "collection");
+		if (RESERVED_COLLECTION_SLUGS.includes(input.slug)) {
+			throw new SchemaError(`Collection slug "${input.slug}" is reserved`, "RESERVED_SLUG");
+		}
+
+		const existing = await this.getCollection(input.slug);
+		if (existing) {
+			throw new SchemaError(`Collection "${input.slug}" already exists`, "COLLECTION_EXISTS");
+		}
+
+		const fieldSlugs = new Set<string>();
+		for (const field of fields) {
+			this.validateSlug(field.slug, "field");
+			if (RESERVED_FIELD_SLUGS.includes(field.slug)) {
+				throw new SchemaError(`Field slug "${field.slug}" is reserved`, "RESERVED_SLUG");
+			}
+			if (fieldSlugs.has(field.slug)) {
+				throw new SchemaError(
+					`Field "${field.slug}" already exists in collection "${input.slug}"`,
+					"FIELD_EXISTS",
+				);
+			}
+			fieldSlugs.add(field.slug);
+		}
+
+		const collectionId = ulid();
+		const supports = input.supports ?? ["drafts", "revisions"];
+		const hasSeo = input.hasSeo ?? supports.includes("seo") ?? false;
+		let maxSortOrder = -1;
+		const fieldRows: Insertable<FieldTable>[] = fields.map((field) => {
+			const sortOrder = field.sortOrder ?? maxSortOrder + 1;
+			maxSortOrder = Math.max(maxSortOrder, sortOrder);
+
+			return {
+				id: ulid(),
+				collection_id: collectionId,
+				slug: field.slug,
+				label: field.label,
+				type: field.type,
+				column_type: FIELD_TYPE_TO_COLUMN[field.type],
+				required: field.required ? 1 : 0,
+				unique: field.unique ? 1 : 0,
+				default_value: field.defaultValue !== undefined ? JSON.stringify(field.defaultValue) : null,
+				validation: field.validation ? JSON.stringify(field.validation) : null,
+				widget: field.widget ?? null,
+				options: field.options ? JSON.stringify(field.options) : null,
+				sort_order: sortOrder,
+				searchable: field.searchable ? 1 : 0,
+				translatable: field.translatable === false ? 0 : 1,
+			};
+		});
+
+		let schemaMutated = false;
+		try {
+			await withTransaction(this.db, async (trx) => {
+				await trx
+					.insertInto("_emdash_collections")
+					.values({
+						id: collectionId,
+						slug: input.slug,
+						label: input.label,
+						label_singular: input.labelSingular ?? null,
+						description: input.description ?? null,
+						icon: input.icon ?? null,
+						supports: JSON.stringify(supports),
+						source: "seed",
+						has_seo: hasSeo ? 1 : 0,
+						comments_enabled: input.commentsEnabled ? 1 : 0,
+						url_pattern: input.urlPattern ?? null,
+					})
+					.execute();
+				schemaMutated = true;
+
+				await this.createContentTable(input.slug, trx, fields);
+
+				for (const fieldBatch of chunks(fieldRows, SEED_FIELD_INSERT_BATCH_SIZE)) {
+					await trx.insertInto("_emdash_fields").values(fieldBatch).execute();
+				}
+			});
+
+			await markContentMediaUsageCollectionStaleSafely(this.db, input.slug, "CONTENT_USAGE_STALE");
+		} catch (error) {
+			if (schemaMutated) {
+				await markContentMediaUsageCollectionStaleSafely(
+					this.db,
+					input.slug,
+					"CONTENT_USAGE_STALE",
+				);
+			}
+			throw error;
+		}
+	}
+
 	/**
 	 * Update a collection
 	 */
@@ -787,11 +903,15 @@ export class SchemaRegistry {
 	/**
 	 * Create a content table for a collection
 	 */
-	private async createContentTable(slug: string, db?: Kysely<Database>): Promise<void> {
+	private async createContentTable(
+		slug: string,
+		db?: Kysely<Database>,
+		fields: readonly CreateFieldInput[] = [],
+	): Promise<void> {
 		const conn = db ?? this.db;
 		const tableName = this.getTableName(slug);
 
-		await conn.schema
+		let table: CreateTableBuilder<string, string> = conn.schema
 			.createTable(tableName)
 			.addColumn("id", "text", (col) => col.primaryKey())
 			.addColumn("slug", "text")
@@ -807,7 +927,23 @@ export class SchemaRegistry {
 			.addColumn("live_revision_id", "text", (col) => col.references("revisions.id"))
 			.addColumn("draft_revision_id", "text", (col) => col.references("revisions.id"))
 			.addColumn("locale", "text", (col) => col.notNull().defaultTo("en"))
-			.addColumn("translation_group", "text")
+			.addColumn("translation_group", "text");
+
+		for (const field of fields) {
+			const columnName = this.getColumnName(field.slug);
+			const columnType = COLUMN_TYPE_TO_DATA_TYPE[FIELD_TYPE_TO_COLUMN[field.type]];
+			table = table.addColumn(columnName, columnType, (column) => {
+				if (!field.required) return column;
+
+				const defaultValue =
+					field.defaultValue !== undefined
+						? this.formatDefaultValue(field.defaultValue, field.type)
+						: this.getEmptyDefault(field.type);
+				return column.notNull().defaultTo(sql.raw(defaultValue));
+			});
+		}
+
+		await table
 			.addUniqueConstraint(`${tableName}_slug_locale_unique`, ["slug", "locale"])
 			.execute();
 

package/src/search/query.ts

@@ -10,6 +10,7 @@ import { sql } from "kysely";
 import { encodeCursor, decodeCursor, InvalidCursorError } from "../database/repositories/types.js";
 import type { Database } from "../database/types.js";
 import { validateIdentifier } from "../database/validate.js";
+import { resolveConfiguredLocale } from "../i18n/config.js";
 import { getDb } from "../loader.js";
 import { FTSManager } from "./fts-manager.js";
 import type {
@@ -250,7 +251,7 @@ async function searchSingleCollection(
 	const contentTable = ftsManager.getContentTableName(collection);
 	const limit = options.limit ?? 20;
 	const status = options.status ?? "published";
-	const locale = options.locale;
+	const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
 
 	// Check if FTS table exists
 	if (!(await ftsManager.ftsTableExists(collection))) {
@@ -397,7 +398,7 @@ export async function getSuggestions(
 	options: SuggestOptions = {},
 ): Promise<Suggestion[]> {
 	const limit = options.limit ?? 5;
-	const locale = options.locale;
+	const locale = options.locale ? resolveConfiguredLocale(options.locale) : undefined;
 
 	// Get searchable collections
 	let collections = options.collections;

package/src/seed/apply.ts

@@ -19,7 +19,7 @@ import { TaxonomyRepository } from "../database/repositories/taxonomy.js";
 import { withTransaction } from "../database/transaction.js";
 import type { Database } from "../database/types.js";
 import type { MediaValue } from "../fields/types.js";
-import { getI18nConfig } from "../i18n/config.js";
+import { getI18nConfig, resolveConfiguredLocale } from "../i18n/config.js";
 import { ssrfSafeFetch, validateExternalUrl } from "../import/ssrf.js";
 import { markContentMediaUsageCollectionStaleSafely } from "../media/usage/content-refresh.js";
 import { SchemaRegistry } from "../schema/registry.js";
@@ -224,36 +224,35 @@ export async function applySeed(
 				continue;
 			}
 
-			// Create collection
-			await registry.createCollection({
-				slug: collection.slug,
-				label: collection.label,
-				labelSingular: collection.labelSingular,
-				description: collection.description,
-				icon: collection.icon,
-				supports: collection.supports || [],
-				source: "seed",
-				urlPattern: collection.urlPattern,
-				commentsEnabled: collection.commentsEnabled,
-			});
+			const fields = collection.fields.map((field) => ({
+				slug: field.slug,
+				label: field.label,
+				type: field.type,
+				required: field.required || false,
+				unique: field.unique || false,
+				searchable: field.searchable || false,
+				defaultValue: field.defaultValue,
+				validation: field.validation,
+				widget: field.widget,
+				options: field.options,
+			}));
+
+			// Create a fresh seed schema in bulk to stay within D1's query budget.
+			await registry.createSeedCollection(
+				{
+					slug: collection.slug,
+					label: collection.label,
+					labelSingular: collection.labelSingular,
+					description: collection.description,
+					icon: collection.icon,
+					supports: collection.supports || [],
+					urlPattern: collection.urlPattern,
+					commentsEnabled: collection.commentsEnabled,
+				},
+				fields,
+			);
 			result.collections.created++;
-
-			// Create fields
-			for (const field of collection.fields) {
-				await registry.createField(collection.slug, {
-					slug: field.slug,
-					label: field.label,
-					type: field.type,
-					required: field.required || false,
-					unique: field.unique || false,
-					searchable: field.searchable || false,
-					defaultValue: field.defaultValue,
-					validation: field.validation,
-					widget: field.widget,
-					options: field.options,
-				});
-				result.fields.created++;
-			}
+			result.fields.created += fields.length;
 		}
 	}
 
@@ -264,7 +263,7 @@ export async function applySeed(
 		const termSeedIdMap = new Map<string, string>();
 
 		for (const taxonomy of seed.taxonomies) {
-			const defLocale = taxonomy.locale ?? defaultLocale;
+			const defLocale = resolveConfiguredLocale(taxonomy.locale ?? defaultLocale);
 
 			// (name, locale) is the UNIQUE key after migration 036.
 			const existingDef = await db
@@ -341,7 +340,7 @@ export async function applySeed(
 					);
 				} else {
 					for (const term of taxonomy.terms) {
-						const termLocale = term.locale ?? defLocale;
+						const termLocale = resolveConfiguredLocale(term.locale ?? defLocale);
 						const existing = await termRepo.findBySlug(taxonomy.name, term.slug, termLocale);
 						if (existing) {
 							if (onConflict === "error") {
@@ -465,7 +464,7 @@ export async function applySeed(
 					// Resolve the entry's locale up front so a non-`en` single-locale
 					// export (which omits `locale`) is filed under the project default
 					// rather than `en` (#1421).
-					const entryLocale = entry.locale ?? defaultLocale;
+					const entryLocale = resolveConfiguredLocale(entry.locale ?? defaultLocale);
 
 					// Check if entry exists (by slug + locale for locale-aware lookup)
 					const existing = await contentRepo.findBySlug(collectionSlug, entry.slug, entryLocale);
@@ -622,7 +621,7 @@ export async function applySeed(
 		const itemSeedIdMap = new Map<string, { id: string; translationGroup: string }>();
 
 		for (const menu of seed.menus) {
-			const locale = menu.locale ?? defaultLocale;
+			const locale = resolveConfiguredLocale(menu.locale ?? defaultLocale);
 			let lookup = db
 				.selectFrom("_emdash_menus")
 				.selectAll()
@@ -868,6 +867,8 @@ async function applyHierarchicalTerms(
 ): Promise<void> {
 	// "locale::slug" -> id, so the same slug can resolve per locale.
 	const slugToId = new Map<string, string>();
+	const resolveTermLocale = (term: SeedTaxonomyTerm) =>
+		resolveConfiguredLocale(term.locale ?? defLocale);
 
 	// Multiple passes — handles deep nesting and translationOf forward refs.
 	let remaining = [...terms];
@@ -877,7 +878,7 @@ async function applyHierarchicalTerms(
 		const processedThisPass: string[] = [];
 
 		for (const term of remaining) {
-			const termLocale = term.locale ?? defLocale;
+			const termLocale = resolveTermLocale(term);
 			const parentReady = !term.parent || slugToId.has(`${termLocale}::${term.parent}`);
 			const translationReady = !term.translationOf || termSeedIdMap.has(term.translationOf);
 
@@ -922,7 +923,7 @@ async function applyHierarchicalTerms(
 		}
 
 		remaining = remaining.filter(
-			(t) => !processedThisPass.includes(t.slug + "::" + (t.locale ?? defLocale)),
+			(term) => !processedThisPass.includes(term.slug + "::" + resolveTermLocale(term)),
 		);
 		maxPasses--;
 	}

package/src/seed/validate.ts

@@ -4,6 +4,7 @@
  * Validates a seed file structure before applying it.
  */
 
+import { getI18nConfig, resolveConfiguredLocale } from "../i18n/config.js";
 import { FIELD_TYPES } from "../schema/types.js";
 import type { SeedFile, SeedMenuItem, ValidationResult } from "./types.js";
 
@@ -49,6 +50,9 @@ export function validateSeed(data: unknown): ValidationResult {
 	}
 
 	const seed = data as Partial<SeedFile>;
+	const defaultLocale =
+		getI18nConfig()?.defaultLocale ??
+		(typeof seed.defaultLocale === "string" ? seed.defaultLocale : "en");
 
 	// Required fields
 	if (!seed.version) {
@@ -163,7 +167,8 @@ export function validateSeed(data: unknown): ValidationResult {
 					errors.push(`${prefix}: name is required`);
 				} else {
 					// Uniqueness is per (name, locale).
-					const key = `${taxonomy.name}::${taxonomy.locale ?? ""}`;
+					const locale = resolveConfiguredLocale(taxonomy.locale ?? defaultLocale);
+					const key = `${taxonomy.name}::${locale}`;
 					if (taxonomyNames.has(key)) {
 						errors.push(
 							taxonomy.locale
@@ -206,7 +211,10 @@ export function validateSeed(data: unknown): ValidationResult {
 							} else {
 								// Uniqueness is per (slug, locale) so the same slug can repeat
 								// across locale variants of the def.
-								const key = `${term.slug}::${term.locale ?? taxonomy.locale ?? ""}`;
+								const locale = resolveConfiguredLocale(
+									term.locale ?? taxonomy.locale ?? defaultLocale,
+								);
+								const key = `${term.slug}::${locale}`;
 								if (termSlugs.has(key)) {
 									errors.push(
 										`${termPrefix}.slug: duplicate term slug "${term.slug}" in taxonomy "${taxonomy.name}"`,
@@ -233,7 +241,9 @@ export function validateSeed(data: unknown): ValidationResult {
 						if (taxonomy.hierarchical && taxonomy.terms) {
 							for (let j = 0; j < taxonomy.terms.length; j++) {
 								const term = taxonomy.terms[j];
-								const termLocale = term.locale ?? taxonomy.locale ?? "";
+								const termLocale = resolveConfiguredLocale(
+									term.locale ?? taxonomy.locale ?? defaultLocale,
+								);
 								if (term.parent && !termSlugs.has(`${term.parent}::${termLocale}`)) {
 									errors.push(
 										`${prefix}.terms[${j}].parent: parent term "${term.parent}" not found in taxonomy`,
@@ -268,7 +278,8 @@ export function validateSeed(data: unknown): ValidationResult {
 				} else {
 					// Uniqueness is per (name, locale) — siblings of a translation
 					// group share name but differ in locale.
-					const key = `${menu.name}::${menu.locale ?? ""}`;
+					const locale = resolveConfiguredLocale(menu.locale ?? defaultLocale);
+					const key = `${menu.name}::${locale}`;
 					if (menuNames.has(key)) {
 						errors.push(
 							menu.locale