emdash 0.32.0 → 0.34.0

package/src/astro/routes/api/taxonomies/[name].ts

@@ -0,0 +1,102 @@
+/**
+ * Single taxonomy definition endpoint
+ *
+ * GET    /_emdash/api/taxonomies/:name[?locale=xx]
+ * PUT    /_emdash/api/taxonomies/:name[?locale=xx]
+ * DELETE /_emdash/api/taxonomies/:name
+ *
+ * GET and PUT address one locale's definition. DELETE takes no locale — it
+ * removes the taxonomy outright, terms and assignments included.
+ */
+
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { apiError, handleError, requireDb, unwrapResult } from "#api/error.js";
+import {
+	handleTaxonomyDelete,
+	handleTaxonomyGet,
+	handleTaxonomyUpdate,
+} from "#api/handlers/taxonomies.js";
+import { isParseError, parseBody, parseQuery } from "#api/parse.js";
+import { localeFilterQuery, updateTaxonomyDefBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+/**
+ * Get a single taxonomy definition
+ */
+export const GET: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:read");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const result = await handleTaxonomyGet(emdash.db, name, { locale: query.locale });
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to get taxonomy", "TAXONOMY_GET_ERROR");
+	}
+};
+
+/**
+ * Update a taxonomy definition
+ */
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+
+	const query = parseQuery(new URL(request.url), localeFilterQuery);
+	if (isParseError(query)) return query;
+
+	try {
+		const body = await parseBody(request, updateTaxonomyDefBody);
+		if (isParseError(body)) return body;
+
+		const result = await handleTaxonomyUpdate(emdash.db, name, {
+			...body,
+			locale: query.locale,
+		});
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to update taxonomy", "TAXONOMY_UPDATE_ERROR");
+	}
+};
+
+/**
+ * Delete a taxonomy, its terms, and their content assignments
+ */
+export const DELETE: APIRoute = async ({ params, locals }) => {
+	const { emdash, user } = locals;
+	const { name } = params;
+	if (!name) return apiError("VALIDATION_ERROR", "Taxonomy name required", 400);
+
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "taxonomies:manage");
+	if (denied) return denied;
+
+	try {
+		const result = await handleTaxonomyDelete(emdash.db, name);
+		return unwrapResult(result);
+	} catch (error) {
+		return handleError(error, "Failed to delete taxonomy", "TAXONOMY_DELETE_ERROR");
+	}
+};

package/src/astro/types.ts

@@ -8,7 +8,8 @@
 import type { Element } from "@emdash-cms/blocks";
 import type { Kysely } from "kysely";
 
-import type { RouteMeta } from "../plugins/routes.js";
+import type { ContentFieldFilters } from "../content-list-query.js";
+import type { RouteCallerInput, RouteMeta } from "../plugins/routes.js";
 
 // Re-export core types
 export type {
@@ -31,6 +32,18 @@ export interface ManifestCollection {
 	supports: string[];
 	hasSeo: boolean;
 	urlPattern?: string;
+	/** Whether published entries require a slug. Defaults to true. */
+	routable?: boolean;
+	titleField?: string;
+	dateField?: string;
+	/**
+	 * Omit the auto-generated sidebar entry in the admin. The collection is
+	 * still listed in the manifest so its routes, editor, and API keep working
+	 * — only the navigation link is dropped.
+	 */
+	hidden?: boolean;
+	/** Valid custom field slugs to render in the admin content list. */
+	listColumns?: string[];
 	fields: Record<
 		string,
 		{
@@ -139,15 +152,22 @@ export interface EmDashManifest {
 		locales: string[];
 		prefixDefaultLocale?: boolean;
 	};
+	contentLocale?: {
+		defaultLocale: string;
+		implicit: boolean;
+	};
 	/**
 	 * Taxonomy definitions for the admin sidebar.
 	 */
 	taxonomies: Array<{
+		id: string;
 		name: string;
 		label: string;
 		labelSingular?: string;
 		hierarchical: boolean;
 		collections: string[];
+		locale: string;
+		translationGroup: string;
 	}>;
 	/**
 	 * Whether the plugin marketplace is configured.
@@ -241,6 +261,10 @@ export interface EmDashHandlers {
 			dateField?: "createdAt" | "updatedAt" | "publishedAt";
 			dateFrom?: string;
 			dateTo?: string;
+			bylines?: string[];
+			bylinesNone?: boolean;
+			includeInferredBylines?: boolean;
+			fieldFilters?: ContentFieldFilters;
 		},
 	) => Promise<HandlerResponse>;
 
@@ -265,7 +289,7 @@ export interface EmDashHandlers {
 		collection: string,
 		body: {
 			data: Record<string, unknown>;
-			slug?: string;
+			slug?: string | null;
 			status?: string;
 			authorId?: string;
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
@@ -282,7 +306,7 @@ export interface EmDashHandlers {
 		id: string,
 		body: {
 			data?: Record<string, unknown>;
-			slug?: string;
+			slug?: string | null;
 			status?: string;
 			authorId?: string | null;
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
@@ -397,12 +421,14 @@ export interface EmDashHandlers {
 
 	handleRevisionRestore: (revisionId: string, callerUserId: string) => Promise<HandlerResponse>;
 
-	// Plugin API route handler
+	// Plugin API route handler. `user` is the authenticated caller for
+	// private routes, exposed to plugin handlers as `ctx.user`.
 	handlePluginApiRoute: (
 		pluginId: string,
 		method: string,
 		path: string,
 		request: Request,
+		user?: RouteCallerInput | null,
 	) => Promise<HandlerResponse>;
 
 	// Public-only plugin API route handler for SSR page components.
@@ -450,6 +476,7 @@ export interface EmDashHandlers {
 		input: unknown,
 		actorId: string,
 		request: Request,
+		caller?: RouteCallerInput | null,
 	) => Promise<HandlerResponse>;
 	handlePluginMcpDenied: (
 		pluginId: string,

package/src/cleanup.ts

@@ -10,13 +10,14 @@
  */
 
 import { createKyselyAdapter, type AuthTables } from "@emdash-cms/auth/adapters/kysely";
-import { sql, type Kysely } from "kysely";
+import type { Kysely } from "kysely";
 
 import { cleanupExpiredChallenges } from "./auth/challenge-store.js";
 import { MediaRepository } from "./database/repositories/media.js";
 import { RevisionRepository } from "./database/repositories/revision.js";
 import type { Database } from "./database/types.js";
 import { removeUploadAttempt } from "./media/upload-attempts.js";
+import { cleanupMediaUsage } from "./media/usage/cleanup.js";
 import type { Storage } from "./storage/types.js";
 
 /**
@@ -30,19 +31,17 @@ export interface CleanupResult {
 	pendingUploadFiles: number;
 	uploadAttempts: number;
 	revisionsPruned: number;
+	mediaUsage: number;
 }
 
-/** Max revisions to keep per entry during periodic pruning */
 const REVISION_KEEP_COUNT = 50;
-
-/** Only prune entries that exceed this threshold */
-const REVISION_PRUNE_THRESHOLD = REVISION_KEEP_COUNT;
+const REVISION_PRUNE_BATCH_SIZE = 10;
 
 /**
  * Run all system cleanup tasks.
  *
- * Safe to call frequently -- each task is a single DELETE with a WHERE clause,
- * so repeated calls with nothing to clean are cheap (no-op queries).
+ * Safe to call frequently -- each subsystem tolerates repeated calls, and
+ * repeated calls with nothing to clean are cheap.
  *
  * @param db - The database instance
  * @param storage - Optional storage backend for deleting orphaned files.
@@ -60,6 +59,7 @@ export async function runSystemCleanup(
 		pendingUploadFiles: -1,
 		uploadAttempts: -1,
 		revisionsPruned: -1,
+		mediaUsage: -1,
 	};
 
 	// 1. Passkey challenges (expire after 60s, clean anything past 5 min)
@@ -129,41 +129,40 @@ export async function runSystemCleanup(
 		console.error("[cleanup] Failed to clean media upload attempts:", error);
 	}
 
-	// 5. Revision pruning -- trim entries with excessive revision counts
 	try {
-		result.revisionsPruned = await pruneExcessiveRevisions(db);
+		result.revisionsPruned = await pruneQueuedRevisions(db);
 	} catch (error) {
 		console.error("[cleanup] Failed to prune revisions:", error);
 	}
 
+	try {
+		const mediaUsage = await cleanupMediaUsage(db);
+		result.mediaUsage = mediaUsage.status === "failed" ? -1 : mediaUsage.deletedRows;
+	} catch (error) {
+		console.error("[cleanup] Failed to clean media usage:", error);
+	}
+
 	return result;
 }
 
-/**
- * Find entries with more than REVISION_PRUNE_THRESHOLD revisions and prune
- * them down to REVISION_KEEP_COUNT.
- */
-async function pruneExcessiveRevisions(db: Kysely<Database>): Promise<number> {
-	const entries = await sql<{ collection: string; entry_id: string }>`
-		SELECT collection, entry_id
-		FROM revisions
-		GROUP BY collection, entry_id
-		HAVING COUNT(*) > ${REVISION_PRUNE_THRESHOLD}
-	`.execute(db);
-
-	if (entries.rows.length === 0) return 0;
-
+async function pruneQueuedRevisions(db: Kysely<Database>): Promise<number> {
+	const queued = await db
+		.selectFrom("_emdash_revision_prune_queue")
+		.selectAll()
+		.orderBy("revision_id")
+		.limit(REVISION_PRUNE_BATCH_SIZE)
+		.execute();
 	const revisionRepo = new RevisionRepository(db);
 	let totalPruned = 0;
 
-	for (const row of entries.rows) {
+	for (const row of queued) {
 		try {
-			const pruned = await revisionRepo.pruneOldRevisions(
+			totalPruned += await revisionRepo.pruneQueuedEntry(
 				row.collection,
 				row.entry_id,
+				row.revision_id,
 				REVISION_KEEP_COUNT,
 			);
-			totalPruned += pruned;
 		} catch (error) {
 			console.error(
 				`[cleanup] Failed to prune revisions for ${row.collection}/${row.entry_id}:`,

package/src/cli/commands/dev.ts

@@ -5,7 +5,7 @@
  */
 
 import { spawn } from "node:child_process";
-import { readFile, access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 
 import { defineCommand } from "citty";
@@ -42,10 +42,15 @@ async function fileExists(path: string): Promise<boolean> {
 	}
 }
 
+export const DEV_DEPRECATION_MESSAGE =
+	"`emdash dev` is deprecated and will be removed in a future release.\n\n" +
+	"Use your project's dev script instead (for example, `pnpm dev`), or run `astro dev` directly.";
+
 export const devCommand = defineCommand({
 	meta: {
 		name: "dev",
 		description: "Start dev server with local database",
+		hidden: true,
 	},
 	args: {
 		database: {
@@ -73,6 +78,11 @@ export const devCommand = defineCommand({
 		},
 	},
 	async run({ args }) {
+		consola.box({
+			title: "DEPRECATED COMMAND",
+			message: DEV_DEPRECATION_MESSAGE,
+		});
+
 		const cwd = resolve(args.cwd);
 		const pkg = await readPackageJson(cwd);
 
@@ -119,8 +129,8 @@ export const devCommand = defineCommand({
 					const schema = await client.schemaExport();
 					const types = await client.schemaTypes();
 
-					const { writeFile, mkdir } = await import("node:fs/promises");
-					const { resolve: resolvePath, dirname } = await import("node:path");
+					const { mkdir, writeFile } = await import("node:fs/promises");
+					const { dirname, resolve: resolvePath } = await import("node:path");
 					const outputPath = resolvePath(cwd, ".emdash/types.ts");
 					await mkdir(dirname(outputPath), { recursive: true });
 					await writeFile(outputPath, types, "utf-8");

package/src/cli/commands/doctor.ts

@@ -1,25 +1,45 @@
 /**
  * emdash doctor
  *
- * Diagnose database health: connection, migrations, schema integrity.
+ * Diagnose database health (connection, migrations, schema integrity) and
+ * Cloudflare Worker scheduler wiring (Cron Trigger + scheduled() handler).
  */
 
-import { access } from "node:fs/promises";
+import { access, readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 
 import { defineCommand } from "citty";
 import consola from "consola";
+import { parse, printParseErrorCode, type ParseError } from "jsonc-parser";
+import { parse as parseToml } from "smol-toml";
 
 import { createDatabase } from "../../database/connection.js";
 import { listTablesLike } from "../../database/dialect-helpers.js";
 import { getMigrationStatus } from "../../database/migrations/runner.js";
 
-interface CheckResult {
+export interface CheckResult {
 	name: string;
 	status: "pass" | "warn" | "fail";
 	message: string;
 }
 
+const WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"] as const;
+const CLOUDFLARE_WORKER_MODULE = "@emdash-cms/cloudflare/worker";
+const WORKER_FIX = `export { default, PluginBridge } from "${CLOUDFLARE_WORKER_MODULE}";`;
+const MAIN_FIX_JSONC = `"main": "./src/worker.ts"`;
+const MAIN_FIX_TOML = `main = "./src/worker.ts"`;
+const TRIGGER_FIX_JSONC = `"triggers": { "crons": ["* * * * *"] }`;
+const TRIGGER_FIX_TOML = `[triggers]\ncrons = ["* * * * *"]`;
+const SCHEDULED_HANDLER_PATTERN = /\bscheduled\s*:\s*createScheduledHandler\s*\(/m;
+
+function triggerFix(configPath: string): string {
+	return configPath.endsWith(".toml") ? TRIGGER_FIX_TOML : TRIGGER_FIX_JSONC;
+}
+
+function mainFix(configPath: string): string {
+	return configPath.endsWith(".toml") ? MAIN_FIX_TOML : MAIN_FIX_JSONC;
+}
+
 async function fileExists(path: string): Promise<boolean> {
 	try {
 		await access(path);
@@ -29,6 +49,172 @@ async function fileExists(path: string): Promise<boolean> {
 	}
 }
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function sourcePosition(source: string, offset: number): { line: number; column: number } {
+	const prefix = source.slice(0, offset);
+	return {
+		line: prefix.split("\n").length,
+		column: offset - prefix.lastIndexOf("\n"),
+	};
+}
+
+async function findWranglerConfig(cwd: string): Promise<string | null> {
+	for (const filename of WRANGLER_CONFIG_FILES) {
+		const path = resolve(cwd, filename);
+		if (await fileExists(path)) return path;
+	}
+	return null;
+}
+
+function workerExportsScheduledMaintenance(source: string): boolean {
+	const modulePattern = CLOUDFLARE_WORKER_MODULE.replaceAll("/", "\\/");
+	const reExportsWorker = new RegExp(
+		`export\\s*\\{[^}]*\\bdefault\\b[^}]*\\}\\s*from\\s*["']${modulePattern}["']`,
+		"m",
+	);
+	const importsFactory = new RegExp(
+		`import\\s+[^;]*\\{[^}]*\\bcreateScheduledHandler\\b[^}]*\\}\\s*from\\s*["']${modulePattern}["']`,
+		"m",
+	);
+	return (
+		reExportsWorker.test(source) ||
+		(importsFactory.test(source) && SCHEDULED_HANDLER_PATTERN.test(source))
+	);
+}
+
+export async function checkSchedulerWiring(cwd: string): Promise<CheckResult[]> {
+	const configPath = await findWranglerConfig(cwd);
+	if (!configPath) return [];
+	return checkSchedulerWiringAtPath(cwd, configPath);
+}
+
+async function checkSchedulerWiringAtPath(cwd: string, configPath: string): Promise<CheckResult[]> {
+	const configSource = await readFile(configPath, "utf8");
+	let parsed: unknown;
+	if (configPath.endsWith(".toml")) {
+		try {
+			parsed = parseToml(configSource);
+		} catch (error) {
+			return [
+				{
+					name: "scheduler config",
+					status: "fail",
+					message: `could not parse ${configPath}: ${error instanceof Error ? error.message : "invalid TOML"} — fix the Wrangler configuration syntax`,
+				},
+			];
+		}
+	} else {
+		const parseErrors: ParseError[] = [];
+		parsed = parse(configSource, parseErrors, {
+			allowTrailingComma: true,
+			disallowComments: false,
+		});
+		if (parseErrors.length > 0) {
+			const error = parseErrors[0];
+			const { line, column } = sourcePosition(configSource, error.offset);
+			return [
+				{
+					name: "scheduler config",
+					status: "fail",
+					message: `could not parse ${configPath}: ${printParseErrorCode(error.error)} at line ${line}, column ${column} — fix the Wrangler configuration syntax`,
+				},
+			];
+		}
+	}
+	if (!isRecord(parsed)) {
+		return [
+			{
+				name: "scheduler config",
+				status: "fail",
+				message: `could not parse ${configPath}: expected an object — fix the Wrangler configuration syntax`,
+			},
+		];
+	}
+
+	const triggers = isRecord(parsed.triggers) ? parsed.triggers : null;
+	const hasCronTrigger =
+		Array.isArray(triggers?.crons) &&
+		triggers.crons.some((cron) => typeof cron === "string" && cron.trim().length > 0);
+	const main = typeof parsed.main === "string" && parsed.main.trim() ? parsed.main : null;
+	if (!main) {
+		return [
+			{
+				name: "scheduler handler",
+				status: "fail",
+				message: `Wrangler configuration has no Worker entry to inspect — add ${mainFix(configPath)}, then export: ${WORKER_FIX}`,
+			},
+		];
+	}
+
+	const workerPath = resolve(cwd, main);
+	let hasScheduledHandler = false;
+	try {
+		const workerSource = await readFile(workerPath, "utf8");
+		hasScheduledHandler = workerExportsScheduledMaintenance(workerSource);
+	} catch (error) {
+		const code = isRecord(error) && typeof error.code === "string" ? error.code : null;
+		if (code !== "ENOENT") {
+			return [
+				{
+					name: "scheduler handler",
+					status: "fail",
+					message: `could not read Worker entry ${workerPath}: ${error instanceof Error ? error.message : "unknown I/O error"} — check the file path and permissions`,
+				},
+			];
+		}
+		return [
+			{
+				name: "scheduler handler",
+				status: "fail",
+				message: `Worker entry not found at ${workerPath} — create it with: ${WORKER_FIX}`,
+			},
+		];
+	}
+
+	if (hasCronTrigger && !hasScheduledHandler) {
+		return [
+			{
+				name: "scheduler handler",
+				status: "fail",
+				message: `Cron Trigger is configured, but ${main} does not export EmDash scheduled() maintenance — replace its Worker export with: ${WORKER_FIX}`,
+			},
+		];
+	}
+
+	if (hasScheduledHandler && !hasCronTrigger) {
+		return [
+			{
+				name: "scheduler trigger",
+				status: "fail",
+				message: `EmDash scheduled() handler is exported, but no Cron Trigger is configured — add this to ${configPath}: ${triggerFix(configPath)}`,
+			},
+		];
+	}
+
+	if (!hasCronTrigger && !hasScheduledHandler) {
+		return [];
+	}
+
+	return [
+		{
+			name: "scheduler wiring",
+			status: "pass",
+			message: `Cron Trigger and scheduled() handler found (${main})`,
+		},
+	];
+}
+
+export async function checkDoctor(cwd: string, dbPath: string): Promise<CheckResult[]> {
+	const results = await checkDatabase(dbPath);
+	const configPath = await findWranglerConfig(cwd);
+	if (configPath) results.push(...(await checkSchedulerWiringAtPath(cwd, configPath)));
+
+	return results;
+}
+
 function printResult(result: CheckResult): void {
 	const color =
 		result.status === "pass"
@@ -157,7 +343,7 @@ async function checkDatabase(dbPath: string): Promise<CheckResult[]> {
 export const doctorCommand = defineCommand({
 	meta: {
 		name: "doctor",
-		description: "Check database health and diagnose issues",
+		description: "Check database health, scheduler wiring, and diagnose issues",
 	},
 	args: {
 		database: {
@@ -181,10 +367,12 @@ export const doctorCommand = defineCommand({
 		const cwd = resolve(args.cwd);
 		const dbPath = resolve(cwd, args.database);
 
-		const results = await checkDatabase(dbPath);
+		const results = await checkDoctor(cwd, dbPath);
+		const fails = results.filter((result) => result.status === "fail");
 
 		if (args.json) {
 			process.stdout.write(JSON.stringify(results, null, 2) + "\n");
+			if (fails.length > 0) process.exitCode = 1;
 			return;
 		}
 
@@ -195,7 +383,6 @@ export const doctorCommand = defineCommand({
 		}
 
 		// Summary
-		const fails = results.filter((r) => r.status === "fail");
 		const warns = results.filter((r) => r.status === "warn");
 
 		consola.log("");

package/src/cli/commands/export-seed.ts

@@ -314,8 +314,12 @@ async function exportCollections(db: Kysely<Database>): Promise<SeedCollection[]
 			labelSingular: collection.labelSingular || undefined,
 			description: collection.description || undefined,
 			icon: collection.icon || undefined,
+			admin: collection.admin,
 			supports: collection.supports.length > 0 ? collection.supports : undefined,
 			urlPattern: collection.urlPattern || undefined,
+			routable: collection.routable === false ? false : undefined,
+			hidden: collection.hidden || undefined,
+			sortOrder: collection.sortOrder,
 			fields: fields.map(
 				(field): SeedField => ({
 					slug: field.slug,
@@ -324,6 +328,7 @@ async function exportCollections(db: Kysely<Database>): Promise<SeedCollection[]
 					required: field.required || undefined,
 					unique: field.unique || undefined,
 					searchable: field.searchable || undefined,
+					indexed: field.indexed || undefined,
 					defaultValue: field.defaultValue,
 					validation: field.validation ? { ...field.validation } : undefined,
 					widget: field.widget || undefined,
@@ -744,7 +749,7 @@ async function exportContent(
 
 				const entry: SeedContentEntry = {
 					id: seedId,
-					slug: item.slug || item.id,
+					slug: item.slug?.trim() ? item.slug : collection.routable === false ? undefined : item.id,
 					status: item.status === "published" || item.status === "draft" ? item.status : undefined,
 					data: processedData,
 				};

package/src/cli/index.ts

@@ -8,7 +8,7 @@
  * Commands:
  * - init: Bootstrap database from template config, or interactive setup
  * - types: Generate TypeScript types from schema
- * - dev: Run dev server with local D1
+ * - dev: [DEPRECATED, hidden] Run dev server with a local SQLite database
  * - seed: Apply a seed file to the database
  * - export-seed: Export database schema and content as a seed file
  * - secrets: Generate and inspect EmDash secrets (encryption keys, etc.)