emdash 0.31.1 → 0.33.0

package/src/database/types.ts

@@ -13,6 +13,12 @@ export interface RevisionTable {
 	created_at: Generated<string>;
 }
 
+export interface RevisionPruneQueueTable {
+	collection: string;
+	entry_id: string;
+	revision_id: string;
+}
+
 export interface TaxonomyTable {
 	id: string;
 	name: string;
@@ -22,6 +28,9 @@ export interface TaxonomyTable {
 	data: string | null; // JSON
 	locale: Generated<string>; // e.g. 'en', 'es', 'fr'
 	translation_group: string | null; // shared across translations of the same term
+	// Manual order within a sibling group. 0 for terms that were never
+	// explicitly reordered, so listings fall back to alphabetical.
+	sort_order: Generated<number>;
 }
 
 export interface ContentTaxonomyTable {
@@ -81,6 +90,15 @@ export interface MediaTable {
 	author_id: string | null;
 }
 
+export interface MediaUploadAttemptTable {
+	storage_key: string;
+	// No foreign key: this row must survive media deletion until storage cleanup succeeds.
+	media_id: string;
+	status: string; // 'active' | 'cleanup'
+	created_at: Generated<string>;
+	updated_at: Generated<string>;
+}
+
 export interface MediaUsageSourceTable {
 	source_key: string;
 	source_type: string;
@@ -293,9 +311,11 @@ export interface CollectionTable {
 	icon: string | null;
 	supports: string | null; // JSON array
 	source: string | null;
-	search_config: string | null; // JSON: { enabled: boolean, weights: Record<string, number> }
+	search_config: string | null; // JSON: SearchConfig
 	has_seo: number; // 0 or 1 — opt-in SEO fields for this collection
 	url_pattern: string | null; // URL pattern with {slug} placeholder (e.g. "/blog/{slug}")
+	hidden: Generated<number>; // 0 or 1 — omit the auto-generated admin sidebar entry
+	sort_order: number | null; // explicit admin sidebar position; NULL = alphabetical fallback
 	comments_enabled: Generated<number>; // 0 or 1
 	comments_moderation: Generated<string>; // 'all' | 'first_time' | 'none'
 	comments_closed_after_days: Generated<number>; // 0 = never close
@@ -491,10 +511,12 @@ export interface SectionTable {
 // Note: ec_* content tables are dynamic and not part of this type
 export interface Database {
 	revisions: RevisionTable;
+	_emdash_revision_prune_queue: RevisionPruneQueueTable;
 	taxonomies: TaxonomyTable;
 	content_taxonomies: ContentTaxonomyTable;
 	_emdash_taxonomy_defs: TaxonomyDefTable;
 	media: MediaTable;
+	_emdash_media_upload_attempts: MediaUploadAttemptTable;
 	_emdash_media_usage_sources: MediaUsageSourceTable;
 	_emdash_media_usage: MediaUsageTable;
 	_emdash_media_usage_index_status: MediaUsageIndexStatusTable;

package/src/database/validate.ts

@@ -26,6 +26,13 @@ const GENERIC_IDENTIFIER_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
  */
 const PLUGIN_IDENTIFIER_PATTERN = /^[a-z][a-z0-9_-]*$/;
 
+/**
+ * Pattern for plugin storage collection names.
+ * Manifests declare these as free-form keys, so both cases and hyphens are
+ * allowed; the charset still excludes quotes, whitespace, and punctuation.
+ */
+const STORAGE_COLLECTION_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+
 /**
  * Maximum length for SQL identifiers.
  * SQLite has no formal limit, but we cap at 128 for sanity.
@@ -136,3 +143,35 @@ export function validatePluginIdentifier(value: string, label = "plugin identifi
 		throw new IdentifierError(`${label} must match /^[a-z][a-z0-9_-]*$/ (got "${value}")`, value);
 	}
 }
+
+/**
+ * Validate a plugin storage collection name.
+ *
+ * Collections are declared as free-form manifest keys and stored as opaque
+ * text, so this is deliberately more permissive than `validateIdentifier`:
+ * `form-submissions` and `formSubmissions` are legitimate. The charset still
+ * rejects quotes and punctuation, keeping generated index names inert.
+ *
+ * @param value - The string to validate
+ * @param label - Human-readable label for error messages
+ * @throws {IdentifierError} If the value is not valid
+ */
+export function validateStorageCollectionName(value: string, label = "collection name"): void {
+	if (!value || typeof value !== "string") {
+		throw new IdentifierError(`${label} must be a non-empty string`, String(value));
+	}
+
+	if (value.length > MAX_IDENTIFIER_LENGTH) {
+		throw new IdentifierError(
+			`${label} must be ${MAX_IDENTIFIER_LENGTH} characters or less, got ${value.length}`,
+			value,
+		);
+	}
+
+	if (!STORAGE_COLLECTION_PATTERN.test(value)) {
+		throw new IdentifierError(
+			`${label} must match /^[a-zA-Z][a-zA-Z0-9_-]*$/ (got "${value}")`,
+			value,
+		);
+	}
+}

package/src/db/adapters.ts

@@ -48,6 +48,14 @@ export interface DatabaseDescriptor {
 	 * the middleware takes its default (singleton) path.
 	 */
 	supportsRequestScope?: boolean;
+	/**
+	 * When true, request middleware resolves the last content-namespace
+	 * invalidation timestamp and passes it to `createRequestScopedDb`.
+	 *
+	 * Keep this unset unless request routing depends on that timestamp: reading
+	 * it may require an object-cache backend round trip.
+	 */
+	needsLastContentWriteAt?: boolean;
 	/**
 	 * When true, the adapter's runtime entrypoint MUST export a named
 	 * `createCoalescingDialect` function. The runtime uses this fresh dialect

package/src/deferred-tasks.ts

@@ -0,0 +1,71 @@
+export interface DeferredTaskTracker {
+	settled: Promise<void>;
+	track<T>(promise: Promise<T>): Promise<T>;
+	settle(): void;
+}
+
+// Test database teardown uses this process-local registry to drain tasks that
+// run without request middleware. Keep it on globalThis so duplicated SSR
+// chunks and their test helpers observe the same task set.
+const DEFERRED_TASKS_KEY = Symbol.for("emdash:deferred-tasks");
+
+const deferredTasks: Set<Promise<unknown>> =
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- globalThis singleton pattern
+	((globalThis as Record<symbol, unknown>)[DEFERRED_TASKS_KEY] as
+		| Set<Promise<unknown>>
+		| undefined) ??
+	(() => {
+		const tasks = new Set<Promise<unknown>>();
+		(globalThis as Record<symbol, unknown>)[DEFERRED_TASKS_KEY] = tasks;
+		return tasks;
+	})();
+
+export function trackDeferredTask<T>(promise: Promise<T>): Promise<T> {
+	let tracked!: Promise<T>;
+	tracked = promise.finally(() => deferredTasks.delete(tracked));
+	deferredTasks.add(tracked);
+	return tracked;
+}
+
+export async function waitForDeferredTasks(): Promise<void> {
+	while (deferredTasks.size > 0) {
+		await Promise.allSettled(deferredTasks);
+	}
+}
+
+export function createDeferredTaskTracker(onSettled: () => void): DeferredTaskTracker {
+	let pending = 0;
+	let responseSettled = false;
+	let completed = false;
+	let resolveSettled!: () => void;
+	const settled = new Promise<void>((resolve) => {
+		resolveSettled = resolve;
+	});
+
+	const completeIfSettled = () => {
+		if (completed || !responseSettled || pending > 0) return;
+		completed = true;
+		try {
+			onSettled();
+		} finally {
+			resolveSettled();
+		}
+	};
+
+	return {
+		settled,
+		track<T>(promise: Promise<T>): Promise<T> {
+			pending++;
+			return promise.finally(() => {
+				// A task may register another after() call before it settles. The
+				// counter therefore reaches zero only after the full task chain ends.
+				pending--;
+				completeIfSettled();
+			});
+		},
+		settle(): void {
+			responseSettled = true;
+			completeIfSettled();
+		},
+	};
+}