emdash 0.32.0 → 0.34.0

package/src/api/handlers/content.ts

@@ -5,21 +5,25 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import type { ContentFieldFilters } from "../../content-list-query.js";
 import { isSqlite } from "../../database/dialect-helpers.js";
 import { BylineRepository } from "../../database/repositories/byline.js";
 import type { ContentBylineInput } from "../../database/repositories/byline.js";
 import { CommentRepository } from "../../database/repositories/comment.js";
-import { ContentRepository } from "../../database/repositories/content.js";
+import { ContentRepository, isSystemOrderField } from "../../database/repositories/content.js";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { RevisionRepository } from "../../database/repositories/revision.js";
 import { SeoRepository } from "../../database/repositories/seo.js";
 import { TaxonomyRepository } from "../../database/repositories/taxonomy.js";
 import {
+	ContentCollectionNotFoundError,
+	ContentMutationConflictError,
 	EmDashValidationError,
 	ScheduledNotDueError,
 	InvalidCursorError,
 	type BylineSummary,
 	type ContentBylineCredit,
+	type ContentBylineFilter,
 	type ContentDateField,
 	type ContentItem,
 	type ContentSeo,
@@ -86,6 +90,28 @@ async function collectionHasSeo(db: Kysely<Database>, collection: string): Promi
 	return row?.has_seo === 1;
 }
 
+async function getCollectionPublishConfig(
+	db: Kysely<Database>,
+	collection: string,
+): Promise<{ supportsRevisions: boolean; routable: boolean }> {
+	const row = await db
+		.selectFrom("_emdash_collections")
+		.select(["supports", "routable"])
+		.where("slug", "=", collection)
+		.executeTakeFirst();
+	const supports: unknown = row?.supports ? JSON.parse(row.supports) : [];
+	return {
+		supportsRevisions: Array.isArray(supports) && supports.includes("revisions"),
+		routable: row?.routable !== 0,
+	};
+}
+
+function requireRoutablePublishSlug(routable: boolean, slug: string | null | undefined): void {
+	if (routable && !slug?.trim()) {
+		throw new EmDashValidationError("Cannot publish routable content without a slug");
+	}
+}
+
 /**
  * Hydrate SEO data on a single content item if the collection has SEO enabled.
  */
@@ -313,30 +339,39 @@ export interface TrashedContentItem {
 
 /**
  * Resolve the columns a content-list search should match against. Always
- * includes `slug` (a standard column) and adds the `title`/`name` display
- * fields when the collection actually defines them, mirroring the admin's
- * item-title resolution (title -> name -> slug). Returning only existing
- * columns avoids "no such column" errors on collections without them.
+ * includes `slug` (a standard column), adds the configured `titleField` plus
+ * the `title`/`name` display fields when the collection actually defines them,
+ * mirroring the admin's item-title resolution (titleField -> title -> name ->
+ * slug), and includes every field explicitly marked searchable. Returning only
+ * schema-backed columns avoids "no such column" errors.
  */
 async function resolveSearchColumns(db: Kysely<Database>, collection: string): Promise<string[]> {
-	const columns = ["slug"];
 	const row = await db
 		.selectFrom("_emdash_collections")
-		.select("id")
+		.select(["id", "title_field"])
 		.where("slug", "=", collection)
 		.executeTakeFirst();
-	if (!row) return columns;
+	if (!row) return ["slug"];
 
 	const fields = await db
 		.selectFrom("_emdash_fields")
-		.select("slug")
+		.select(["slug", "searchable"])
 		.where("collection_id", "=", row.id)
+		.orderBy("sort_order", "asc")
 		.execute();
+	const columns = new Set(["slug"]);
 	const fieldSlugs = new Set(fields.map((f) => f.slug));
+
+	// A configured titleField takes precedence, then the conventional
+	// title/name fields. A null title_field falls through to those defaults.
+	if (row.title_field && fieldSlugs.has(row.title_field)) columns.add(row.title_field);
 	for (const candidate of ["title", "name"]) {
-		if (fieldSlugs.has(candidate)) columns.push(candidate);
+		if (fieldSlugs.has(candidate)) columns.add(candidate);
 	}
-	return columns;
+	for (const field of fields) {
+		if (field.searchable === 1) columns.add(field.slug);
+	}
+	return [...columns];
 }
 
 /**
@@ -376,6 +411,15 @@ async function createSlugChangeRedirect(
 	newSlug: string,
 	contentId: string,
 ): Promise<void> {
+	// A URL pattern has no locale token, so every locale variant of an entry
+	// generates the same URL, and slugs are unique per (slug, locale) — a
+	// translation may still hold the old slug. Redirecting away from a URL
+	// another row still answers on would take that page down: the redirect
+	// middleware runs `order: "pre"`, so routing never gets a chance.
+	// Any surviving row counts, published or not: a draft that publishes later
+	// would otherwise be shadowed by the redirect.
+	if (await slugStillTaken(db, collection, oldSlug, contentId)) return;
+
 	const collectionRow = await db
 		.selectFrom("_emdash_collections")
 		.select("url_pattern")
@@ -393,6 +437,24 @@ async function createSlugChangeRedirect(
 	invalidateRedirectCache();
 }
 
+/** Whether a row other than `contentId` still holds `slug` in this collection. */
+async function slugStillTaken(
+	db: Kysely<Database>,
+	collection: string,
+	slug: string,
+	contentId: string,
+): Promise<boolean> {
+	validateIdentifier(collection, "collection slug");
+	const result = await sql<{ id: string }>`
+		SELECT id FROM ${sql.ref(`ec_${collection}`)}
+		WHERE slug = ${slug}
+		AND id != ${contentId}
+		AND deleted_at IS NULL
+		LIMIT 1
+	`.execute(db);
+	return result.rows.length > 0;
+}
+
 /** Matches a date-only `YYYY-MM-DD` bound (no time component). */
 const DATE_ONLY_RE = /^\d{4}-\d{2}-\d{2}$/;
 
@@ -411,6 +473,27 @@ function normalizeDateBound(value: string | undefined, edge: "start" | "end"): s
 	return edge === "start" ? `${value}T00:00:00.000Z` : `${value}T23:59:59.999Z`;
 }
 
+/**
+ * Build the repository's byline filter from the wire params.
+ *
+ * `locale` is the locale the list is scoped to, which is the locale an
+ * inferred credit has to resolve at — the admin list is always scoped to the
+ * locale picked in its switcher.
+ */
+function resolveBylineFilter(
+	params: { bylines?: string[]; bylinesNone?: boolean; includeInferredBylines?: boolean },
+	locale: string | undefined,
+): ContentBylineFilter | undefined {
+	const includeInferred = params.includeInferredBylines === true;
+
+	if (params.bylinesNone) return { mode: "none", includeInferred, locale };
+
+	const bylineIds = params.bylines ?? [];
+	if (bylineIds.length === 0) return undefined;
+
+	return { mode: "any", bylineIds, includeInferred, locale };
+}
+
 /**
  * Create content list handler
  */
@@ -429,14 +512,25 @@ export async function handleContentList(
 		dateField?: ContentDateField;
 		dateFrom?: string;
 		dateTo?: string;
+		bylines?: string[];
+		bylinesNone?: boolean;
+		includeInferredBylines?: boolean;
+		fieldFilters?: ContentFieldFilters;
 	},
 ): Promise<ApiResult<ContentListResponse>> {
 	try {
 		const repo = new ContentRepository(db);
 		const where: FindManyOptions["where"] = {};
 		if (params.status) where.status = params.status;
-		if (params.locale) where.locale = resolveConfiguredLocale(params.locale);
+		const locale = params.locale ? resolveConfiguredLocale(params.locale) : undefined;
+		if (locale) where.locale = locale;
 		if (params.authorId) where.authorId = params.authorId;
+		if (params.fieldFilters && Object.keys(params.fieldFilters).length > 0) {
+			where.fieldFilters = params.fieldFilters;
+		}
+
+		const bylineFilter = resolveBylineFilter(params, locale);
+		if (bylineFilter) where.bylineFilter = bylineFilter;
 
 		// A date range requires a target column; ignore stray from/to without
 		// a field so a half-specified filter doesn't silently drop all rows.
@@ -455,6 +549,21 @@ export async function handleContentList(
 			where.useFts = await canUseFtsForListFilter(db, collection, where.searchColumns);
 		}
 
+		// Sorting by a non-system field (a collection's titleField/dateField)
+		// needs the collection's *actual* sort fields resolved server-side,
+		// so the orderBy set stays closed. Only query when it's not a system field.
+		let sortableExtras: string[] | undefined;
+		if (params.orderBy && !isSystemOrderField(params.orderBy)) {
+			const coll = await db
+				.selectFrom("_emdash_collections")
+				.select(["title_field", "date_field"])
+				.where("slug", "=", collection)
+				.executeTakeFirst();
+			sortableExtras = [coll?.title_field, coll?.date_field].filter(
+				(slug): slug is string => !!slug,
+			);
+		}
+
 		const result = await repo.findMany(collection, {
 			cursor: params.cursor,
 			limit: params.limit || 50,
@@ -462,6 +571,7 @@ export async function handleContentList(
 			orderBy: params.orderBy
 				? { field: params.orderBy, direction: params.order || "desc" }
 				: undefined,
+			sortableExtras,
 		});
 
 		// Hydrate SEO data if the collection has SEO enabled
@@ -484,7 +594,7 @@ export async function handleContentList(
 				error: { code: "INVALID_CURSOR", message: error.message },
 			};
 		}
-		if (isMissingTableError(error)) {
+		if (error instanceof ContentCollectionNotFoundError || isMissingTableError(error)) {
 			return {
 				success: false,
 				error: {
@@ -685,7 +795,7 @@ export async function handleContentCreate(
 	collection: string,
 	body: {
 		data: Record<string, unknown>;
-		slug?: string;
+		slug?: string | null;
 		status?: string;
 		authorId?: string;
 		bylines?: ContentBylineInput[];
@@ -733,6 +843,10 @@ export async function handleContentCreate(
 					slug = await repo.generateUniqueSlug(collection, slugSource, effectiveLocale);
 				}
 			}
+			if (body.status === "published") {
+				const publishConfig = await getCollectionPublishConfig(trx, collection);
+				requireRoutablePublishSlug(publishConfig.routable, slug);
+			}
 
 			const created = await repo.create({
 				type: collection,
@@ -756,22 +870,12 @@ export async function handleContentCreate(
 				created.primaryBylineId = credits[0]?.byline.translationGroup ?? null;
 			}
 
-			// When this row is a translation of an existing item, inherit
-			// the source's taxonomy assignments AND byline credits. Both
-			// pivots store translation_groups (taxonomies post-mig 036,
-			// bylines post-mig 040), so a copied row applies across every
-			// locale of the credited identity — and the locale-strict
-			// hydration below renders the variant that matches the entry's
-			// locale (or nothing if no variant exists yet at this locale,
-			// which is the documented Phase 4 behaviour).
-			//
+			// Taxonomy assignments already belong to the content translation
+			// group. Byline credits remain per content row and need copying.
 			// Explicit `body.bylines` wins — `copyContentBylines` no-ops
 			// when the target already has credits, but the cleaner guard
 			// is to skip the call entirely.
 			if (body.translationOf) {
-				const taxRepo = new TaxonomyRepository(trx);
-				await taxRepo.copyEntryTerms(collection, body.translationOf, created.id);
-
 				if (body.bylines === undefined) {
 					await bylineRepo.copyContentBylines(collection, body.translationOf, created.id);
 					// `copyContentBylines` writes the source's primary
@@ -877,7 +981,7 @@ export async function handleContentUpdate(
 	id: string,
 	body: {
 		data?: Record<string, unknown>;
-		slug?: string;
+		slug?: string | null;
 		status?: string;
 		authorId?: string | null;
 		bylines?: ContentBylineInput[];
@@ -921,7 +1025,9 @@ export async function handleContentUpdate(
 
 			// Read existing item once for both _rev check and old slug capture
 			const existing =
-				body._rev || body.slug ? await trxRepo.findById(collection, resolvedId) : null;
+				body._rev || body.slug !== undefined || body.status === "published"
+					? await trxRepo.findById(collection, resolvedId)
+					: null;
 
 			// Validate _rev if provided (optimistic concurrency)
 			if (body._rev) {
@@ -945,6 +1051,18 @@ export async function handleContentUpdate(
 				oldSlug = existing.slug;
 			}
 
+			const resultingStatus = body.status ?? existing?.status;
+			if (resultingStatus === "published") {
+				if (!existing) {
+					throw Object.assign(new Error(`Content item not found: ${id}`), {
+						apiError: { code: "NOT_FOUND" as const },
+					});
+				}
+				const publishConfig = await getCollectionPublishConfig(trx, collection);
+				const intendedSlug = body.slug !== undefined ? body.slug : existing.slug;
+				requireRoutablePublishSlug(publishConfig.routable, intendedSlug);
+			}
+
 			const updated = await trxRepo.update(collection, resolvedId, {
 				data: body.data,
 				slug: body.slug,
@@ -1372,7 +1490,12 @@ export async function handleContentSchedule(
 	try {
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
-			const resolvedId = (await resolveId(repo, collection, id)) ?? id;
+			const existing = await repo.findByIdOrSlug(collection, id);
+			const resolvedId = existing?.id ?? id;
+			if (existing) {
+				const publishConfig = await getCollectionPublishConfig(trx, collection);
+				requireRoutablePublishSlug(publishConfig.routable, existing.slug);
+			}
 			return repo.schedule(collection, resolvedId, scheduledAt);
 		});
 
@@ -1450,20 +1573,24 @@ export async function handleContentUnschedule(
 /**
  * Publish content immediately.
  *
- * Wrapped in a transaction because publish performs multiple writes
- * (syncDataColumns, slug sync, status/revision update) that must
- * be atomic to prevent FTS shadow table corruption on crash.
+ * Publication is one atomic content-row statement. On databases that support
+ * transactions, the existing slug-redirect side write remains grouped with it.
  */
 export async function handleContentPublish(
 	db: Kysely<Database>,
 	collection: string,
 	id: string,
-	options: { publishedAt?: string; requireScheduledDue?: boolean } = {},
+	options: {
+		publishedAt?: string;
+		requireScheduledDue?: boolean;
+		expectedScheduledAt?: string;
+	} = {},
 ): Promise<ApiResult<ContentResponse>> {
 	try {
 		const item = await withTransaction(db, async (trx) => {
 			const repo = new ContentRepository(trx);
 			const resolvedId = (await resolveId(repo, collection, id)) ?? id;
+			const publishConfig = await getCollectionPublishConfig(trx, collection);
 
 			// Capture the pre-publish state. For revision-supporting collections a
 			// slug edit is staged as `_slug` in the draft revision and only lands
@@ -1477,6 +1604,9 @@ export async function handleContentPublish(
 				resolvedId,
 				options.publishedAt,
 				options.requireScheduledDue,
+				options.expectedScheduledAt,
+				publishConfig.supportsRevisions,
+				publishConfig.routable,
 			);
 
 			// Leave a 301 behind when publishing changed the slug of an entry that
@@ -1502,6 +1632,15 @@ export async function handleContentPublish(
 			data: { item },
 		};
 	} catch (error) {
+		if (error instanceof ContentMutationConflictError) {
+			return {
+				success: false,
+				error: {
+					code: "CONFLICT",
+					message: error.message,
+				},
+			};
+		}
 		// The scheduled sweep gates publish on the row still being due; a row
 		// unscheduled in the meantime is a silent skip, not a failure.
 		if (error instanceof ScheduledNotDueError) {

package/src/api/handlers/dashboard.ts

@@ -13,6 +13,7 @@ import { MediaRepository } from "../../database/repositories/media.js";
 import { UserRepository } from "../../database/repositories/user.js";
 import type { Database } from "../../database/types.js";
 import { validateIdentifier } from "../../database/validate.js";
+import { getSchedulerHealth, type SchedulerHealth } from "../../scheduler-health.js";
 import type { ApiResult } from "../types.js";
 
 export interface CollectionStats {
@@ -22,6 +23,7 @@ export interface CollectionStats {
 	published: number;
 	draft: number;
 	scheduled: number;
+	overdueScheduled: number;
 }
 
 export interface RecentItem {
@@ -40,6 +42,7 @@ export interface DashboardStats {
 	mediaCount: number;
 	userCount: number;
 	recentItems: RecentItem[];
+	schedulerHealth: SchedulerHealth;
 }
 
 /**
@@ -50,6 +53,7 @@ export interface DashboardStats {
  */
 export async function handleDashboardStats(
 	db: Kysely<Database>,
+	now = new Date(),
 ): Promise<ApiResult<DashboardStats>> {
 	try {
 		// Discover collections from the system table
@@ -63,7 +67,7 @@ export async function handleDashboardStats(
 		const contentRepo = new ContentRepository(db);
 		const collectionStats: CollectionStats[] = await Promise.all(
 			collections.map(async (col) => {
-				const stats = await contentRepo.getStats(col.slug);
+				const stats = await contentRepo.getStats(col.slug, now);
 				return {
 					slug: col.slug,
 					label: col.label,
@@ -71,6 +75,7 @@ export async function handleDashboardStats(
 					published: stats.published,
 					draft: stats.draft,
 					scheduled: stats.scheduled,
+					overdueScheduled: stats.overdueScheduled,
 				};
 			}),
 		);
@@ -78,7 +83,11 @@ export async function handleDashboardStats(
 		// Media and user counts
 		const mediaRepo = new MediaRepository(db);
 		const userRepo = new UserRepository(db);
-		const [mediaCount, userCount] = await Promise.all([mediaRepo.count(), userRepo.count()]);
+		const [mediaCount, userCount, schedulerHealth] = await Promise.all([
+			mediaRepo.count(),
+			userRepo.count(),
+			getSchedulerHealth(db, now),
+		]);
 
 		// Recent items across all collections (last 10 updated, any status)
 		const recentItems = await fetchRecentItems(db, collections);
@@ -90,6 +99,7 @@ export async function handleDashboardStats(
 				mediaCount,
 				userCount,
 				recentItems,
+				schedulerHealth,
 			},
 		};
 	} catch (error) {

package/src/api/handlers/index.ts

@@ -77,6 +77,16 @@ export {
 	type MediaUsageSummary,
 } from "./media-usage.js";
 
+export {
+	handleMediaUsageWorkList,
+	handleMediaUsageWorkRetry,
+	type MediaUsageWorkItem,
+	type MediaUsageWorkListQuery,
+	type MediaUsageWorkListResponse,
+	type MediaUsageWorkRetryRequest,
+	type MediaUsageWorkRetryResponse,
+} from "./media-usage-work.js";
+
 // Schema handlers
 export {
 	handleSchemaCollectionList,
@@ -162,6 +172,10 @@ export { handleSettingsGet, handleSettingsUpdate } from "./settings.js";
 // Taxonomy handlers
 export {
 	handleTaxonomyList,
+	handleTaxonomyGet,
+	handleTaxonomyUpdate,
+	handleTaxonomyDelete,
+	handleTaxonomyDefTranslations,
 	handleTermList,
 	handleTermCreate,
 	handleTermGet,
@@ -169,6 +183,8 @@ export {
 	handleTermDelete,
 	type TaxonomyDef,
 	type TaxonomyListResponse,
+	type TaxonomyResponse,
+	type TaxonomyDefTranslationsResponse,
 	type TermData,
 	type TermWithCount,
 	type TermListResponse,

package/src/api/handlers/manifest.ts

@@ -19,6 +19,7 @@ interface CollectionDefinition {
 		label: string;
 		labelSingular?: string;
 		supports?: string[];
+		routable?: boolean;
 	};
 }
 type CollectionMap = Record<string, CollectionDefinition>;
@@ -46,6 +47,7 @@ export async function generateManifest(
 			label: definition.admin.label,
 			labelSingular: definition.admin.labelSingular || definition.admin.label,
 			supports: definition.admin.supports || [],
+			routable: definition.admin.routable ?? true,
 			fields,
 		};
 	}

package/src/api/handlers/marketplace.ts

@@ -24,6 +24,10 @@ import {
 } from "../../plugins/marketplace.js";
 import type { SandboxRunner } from "../../plugins/sandbox/types.js";
 import { PluginStateRepository } from "../../plugins/state.js";
+import {
+	removeAllPluginIndexes,
+	syncDeclaredStorageIndexes,
+} from "../../plugins/storage-indexes.js";
 import { normalizeCapabilities } from "../../plugins/types.js";
 import type { PluginManifest } from "../../plugins/types.js";
 import { EmDashStorageError } from "../../storage/types.js";
@@ -475,6 +479,8 @@ export async function handleMarketplaceInstall(
 			description: pluginDetail.description ?? undefined,
 		});
 
+		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
+
 		// Fire-and-forget install stat
 		client.reportInstall(pluginId, version).catch(() => {
 			// Intentional: never fails the install
@@ -713,6 +719,8 @@ export async function handleMarketplaceUpdate(
 			mcpToolsConsent: null,
 		});
 
+		await syncDeclaredStorageIndexes(db, [bundle.manifest]);
+
 		// Clean up old bundle from R2 (best-effort)
 		deleteBundleFromR2(storage, pluginId, oldVersion).catch(() => {});
 
@@ -786,6 +794,12 @@ export async function handleMarketplaceUninstall(
 			}
 		}
 
+		try {
+			await removeAllPluginIndexes(db, pluginId);
+		} catch {
+			// Nothing to drop, or tracking table predates the feature
+		}
+
 		// Delete state row
 		await stateRepo.delete(pluginId);
 

package/src/api/handlers/media-allowlist.ts

@@ -6,10 +6,21 @@ import { parseAllowedMimeTypes } from "../../media/mime.js";
 /**
  * MIME types allowed for upload by default (when no field-specific list
  * overrides this). Entries ending with "/" are prefix-matched (e.g.
- * "image/" matches "image/jpeg", "image/png", etc.).
+ * "video/" matches "video/mp4", "video/webm", etc.).
+ *
+ * Image types are enumerated explicitly rather than using a bare "image/"
+ * prefix so that "image/svg+xml" is excluded by default: there is no
+ * upload-time content validation for SVG, so an unvalidated bare-prefix
+ * allowlist would let a Contributor+ upload an SVG with an embedded
+ * `<script>`. Fields that genuinely need SVG uploads can still opt in via
+ * their own `allowedMimeTypes` (see `resolveFieldAllowlist` below), which is
+ * unaffected by this default.
  */
 export const GLOBAL_UPLOAD_ALLOWLIST: readonly string[] = [
-	"image/",
+	"image/png",
+	"image/jpeg",
+	"image/gif",
+	"image/webp",
 	"video/",
 	"audio/",
 	"application/pdf",