emdash 0.33.0 → 0.34.0

package/src/emdash-runtime.ts

@@ -9,10 +9,11 @@
 
 import { Permissions } from "@emdash-cms/auth";
 import type { Element } from "@emdash-cms/blocks";
-import { Kysely, type Dialect } from "kysely";
+import { Kysely, sql, type Dialect } from "kysely";
 import virtualConfig from "virtual:emdash/config";
 import { z } from "zod";
 
+import { assertMediaUsageActivationWriteAllowed } from "./api/media-usage-write-fence.js";
 import { validateRev } from "./api/rev.js";
 import type {
 	EmDashConfig,
@@ -22,6 +23,7 @@ import type {
 import type { EmDashManifest, ManifestCollection } from "./astro/types.js";
 import { getAuthMode } from "./auth/mode.js";
 import { getTrustedProxyHeaders } from "./auth/trusted-proxy.js";
+import type { ContentFieldFilters } from "./content-list-query.js";
 import { isSqlite } from "./database/dialect-helpers.js";
 import { kyselyLogOption } from "./database/instrumentation.js";
 import {
@@ -39,15 +41,30 @@ import type {
 } from "./database/repositories/types.js";
 import { getI18nConfig } from "./i18n/config.js";
 import { repairLocaleCasing } from "./i18n/repair-locale-casing.js";
+import { warnAboutUnconfiguredTaxonomyLocales } from "./i18n/taxonomy-locale-diagnostic.js";
 import { normalizeMediaValue } from "./media/normalize.js";
 import type { MediaProvider, MediaProviderCapabilities } from "./media/types.js";
+import {
+	MEDIA_USAGE_COLLECTION_DELETION_LIMITS,
+	processDueMediaUsageCollectionDeletions,
+} from "./media/usage/collection-deletion-processor.js";
 import {
 	deleteContentMediaUsage,
 	findNonTranslatableSiblingContentIds,
 	markContentMediaUsageCollectionStale,
 	refreshContentMediaUsageAfterWrite,
 } from "./media/usage/content-refresh.js";
+import {
+	MEDIA_USAGE_RECONCILIATION_LIMITS,
+	processDueMediaUsageReconciliation,
+} from "./media/usage/reconciliation-processor.js";
+import {
+	MEDIA_USAGE_WORK_PROCESSING_LIMITS,
+	processDueMediaUsageWork,
+	processMediaUsageWorkAfterWrite,
+} from "./media/usage/work-processor.js";
 import { createSandboxRunnerOptions } from "./plugins/sandbox/runner-options.js";
+import { getSandboxRouteErrorDetails } from "./plugins/sandbox/types.js";
 import type {
 	SandboxedPluginInstance,
 	SandboxRunner,
@@ -66,8 +83,10 @@ import type {
 	PortableTextBlockConfig,
 	FieldWidgetConfig,
 	SettingField,
+	UserInfo,
 } from "./plugins/types.js";
-import type { FieldType } from "./schema/types.js";
+import { recordSchedulerHeartbeatSafely } from "./scheduler-health.js";
+import { MAX_COLLECTION_LIST_COLUMNS, type FieldType } from "./schema/types.js";
 import { hashString } from "./utils/hash.js";
 import { createInitLock, type InitLock, initWithLock } from "./utils/init-lock.js";
 import { createSingleFlightCache, singleFlightCached } from "./utils/single-flight-cache.js";
@@ -199,6 +218,8 @@ import {
 	buildRouteMeta,
 	parseRouteInput,
 	PluginRouteRegistry,
+	toRouteCallerInfo,
+	type RouteCallerInput,
 	type RouteMeta,
 } from "./plugins/routes.js";
 import type { CronScheduler } from "./plugins/scheduler/types.js";
@@ -236,6 +257,16 @@ const FIELD_TYPE_TO_KIND: Record<FieldType, string> = {
 const DRAFT_ONLY_UPDATE_KEYS = new Set(["data", "slug", "locale", "skipRevision"]);
 const MAX_DRAFT_STAGE_ATTEMPTS = 32;
 
+const LIST_COLUMN_FIELD_TYPES: ReadonlySet<FieldType> = new Set([
+	"string",
+	"number",
+	"integer",
+	"boolean",
+	"datetime",
+	"select",
+	"multiSelect",
+]);
+
 /**
  * Sandboxed plugin entry from virtual module
  */
@@ -383,6 +414,7 @@ export interface EmDashRuntimeParts {
 	pipelineFactoryOptions: {
 		db: Kysely<Database>;
 		getDb?: () => Kysely<Database>;
+		beforeContentWrite?: () => Promise<void>;
 		storage?: Storage;
 		siteInfo?: {
 			siteName?: string;
@@ -514,6 +546,62 @@ const marketplaceManifestCache = new Map<
 const sandboxedRouteMetaCache = new Map<string, Map<string, RouteMeta>>();
 let sandboxRunner: SandboxRunner | null = null;
 
+export const MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS = Object.freeze({
+	entryWork: MEDIA_USAGE_WORK_PROCESSING_LIMITS.ordinaryStatementsPerJob,
+	collectionDeletion: MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxQueriesPerTick,
+	reconciliation: MEDIA_USAGE_RECONCILIATION_LIMITS.maxQueriesPerTick,
+	maxClassQueries: Math.max(
+		MEDIA_USAGE_WORK_PROCESSING_LIMITS.ordinaryStatementsPerJob,
+		MEDIA_USAGE_COLLECTION_DELETION_LIMITS.maxQueriesPerTick,
+		MEDIA_USAGE_RECONCILIATION_LIMITS.maxQueriesPerTick,
+	),
+	eventCeiling: 40,
+});
+
+export type MediaUsageMaintenanceTaskClass =
+	| "entry_work"
+	| "collection_deletion"
+	| "reconciliation";
+
+export type MediaUsageMaintenanceResult =
+	| { outcome: "inactive" | "admission_closed"; taskClass: null; turn: null }
+	| { outcome: "processed"; taskClass: MediaUsageMaintenanceTaskClass; turn: number };
+
+async function runScheduledMediaUsageLane(
+	db: Kysely<Database>,
+): Promise<MediaUsageMaintenanceResult> {
+	const queriesAlreadySpent = getRequestContext()?.metrics?.dbCount ?? 0;
+	if (
+		queriesAlreadySpent + 1 + MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS.maxClassQueries >
+		MEDIA_USAGE_MAINTENANCE_QUERY_RESERVATIONS.eventCeiling
+	) {
+		return { outcome: "admission_closed", taskClass: null, turn: null };
+	}
+
+	const activation = await db
+		.updateTable("_emdash_media_usage_activation")
+		.set({
+			media_usage_maintenance_turn: sql<number>`(media_usage_maintenance_turn + 1) % 3`,
+		})
+		.where("task_key", "=", "incremental_capture")
+		.where("state", "=", "active")
+		.returning("media_usage_maintenance_turn")
+		.executeTakeFirst();
+	if (!activation) return { outcome: "inactive", taskClass: null, turn: null };
+
+	const turn = activation.media_usage_maintenance_turn;
+	if (turn === 0) {
+		await processDueMediaUsageWork(db);
+		return { outcome: "processed", taskClass: "entry_work", turn };
+	}
+	if (turn === 1) {
+		await processDueMediaUsageCollectionDeletions(db);
+		return { outcome: "processed", taskClass: "collection_deletion", turn };
+	}
+	await processDueMediaUsageReconciliation(db);
+	return { outcome: "processed", taskClass: "reconciliation", turn };
+}
+
 /**
  * EmDashRuntime - singleton per worker
  */
@@ -575,6 +663,7 @@ export class EmDashRuntime {
 	private pipelineFactoryOptions: {
 		db: Kysely<Database>;
 		getDb?: () => Kysely<Database>;
+		beforeContentWrite?: () => Promise<void>;
 		storage?: Storage;
 		siteInfo?: {
 			siteName?: string;
@@ -647,8 +736,16 @@ export class EmDashRuntime {
 	 * Returns the items promoted so callers can invalidate their cache tags.
 	 */
 	async publishScheduled(): Promise<PublishedRef[]> {
+		return this.publishScheduledWithFence();
+	}
+
+	private async publishScheduledWithFence(
+		onPublished?: (refs: PublishedRef[]) => Promise<void>,
+	): Promise<PublishedRef[]> {
+		await assertMediaUsageActivationWriteAllowed(this.db);
 		return publishDueContent(this.db, {
 			publish: (collection, id, options) => this.handleContentPublish(collection, id, options),
+			onPublished,
 		});
 	}
 
@@ -686,11 +783,7 @@ export class EmDashRuntime {
 
 		let published: PublishedRef[] = [];
 		try {
-			// Route through the runtime wrapper so content:afterPublish hooks fire.
-			published = await publishDueContent(this.db, {
-				publish: (collection, id, opts) => this.handleContentPublish(collection, id, opts),
-				onPublished: options.onPublished,
-			});
+			published = await this.publishScheduledWithFence(options.onPublished);
 		} catch (error) {
 			console.error("[scheduled-publish] Sweep failed:", error);
 		}
@@ -709,10 +802,15 @@ export class EmDashRuntime {
 
 		// Never throws; no-op unless scheduled backups are enabled and due.
 		await maybeRunScheduledBackup(this.db, this.storage ?? undefined);
+		await recordSchedulerHeartbeatSafely(this.db);
 
 		return { published };
 	}
 
+	async runScheduledMediaUsageTasks(): Promise<MediaUsageMaintenanceResult> {
+		return runScheduledMediaUsageLane(this.db);
+	}
+
 	/**
 	 * Materialize plugin-declared storage indexes, once per process.
 	 *
@@ -1486,6 +1584,7 @@ export class EmDashRuntime {
 		const pipelineFactoryOptions = {
 			db,
 			getDb: resolveDb,
+			beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(resolveDb()),
 			storage: storage ?? undefined,
 			siteInfo,
 		};
@@ -1631,6 +1730,14 @@ export class EmDashRuntime {
 				if (deps.createScheduler) {
 					const scheduler = deps.createScheduler(cronExecutor);
 					cronScheduler = scheduler;
+					const runMediaUsageMaintenance = async () => {
+						const runtime = runtimeRef.current;
+						if (runtime) {
+							await runtime.runScheduledMediaUsageTasks();
+						} else {
+							await runScheduledMediaUsageLane(db);
+						}
+					};
 
 					// Run scheduled publishing and system cleanup alongside each tick.
 					// Pass storage so cleanupPendingUploads can delete orphaned files.
@@ -1640,12 +1747,12 @@ export class EmDashRuntime {
 							// Falls back to the raw handler if (improbably) the tick beats
 							// the post-construction ref assignment.
 							const runtime = runtimeRef.current;
-							await publishDueContent(db, {
-								publish: runtime
-									? (collection, id, options) =>
-											runtime.handleContentPublish(collection, id, options)
-									: undefined,
-							});
+							if (runtime) {
+								await runtime.publishScheduled();
+							} else {
+								await assertMediaUsageActivationWriteAllowed(db);
+								await publishDueContent(db);
+							}
 						} catch (error) {
 							console.error("[scheduled-publish] Sweep failed:", error);
 						}
@@ -1663,7 +1770,16 @@ export class EmDashRuntime {
 						}
 						// Never throws; no-op unless scheduled backups are enabled and due.
 						await maybeRunScheduledBackup(db, storage ?? undefined);
+						await recordSchedulerHeartbeatSafely(db);
+						if (!scheduler.setMediaUsageMaintenance) {
+							try {
+								await runMediaUsageMaintenance();
+							} catch (error) {
+								console.error("[media-usage] Scheduled maintenance failed:", error);
+							}
+						}
 					});
+					scheduler.setMediaUsageMaintenance?.(runMediaUsageMaintenance);
 
 					// start() is void on the timer scheduler but the interface
 					// allows a promise (alarm-backed schedulers); we don't block on it.
@@ -1967,6 +2083,7 @@ export class EmDashRuntime {
 				createSandboxRunnerOptions(
 					{
 						db,
+						beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(db),
 						mediaStorage: mediaStorage
 							? {
 									upload: (opts) =>
@@ -2090,6 +2207,7 @@ export class EmDashRuntime {
 				createSandboxRunnerOptions(
 					{
 						db,
+						beforeContentWrite: () => assertMediaUsageActivationWriteAllowed(db),
 						mediaStorage: {
 							upload: (opts) =>
 								storage.upload({
@@ -2418,13 +2536,38 @@ export class EmDashRuntime {
 					fields[field.slug] = entry;
 				}
 
+				const configuredListColumns = collection.admin?.listColumns ?? [];
+				const fieldTypes = new Map(collection.fields.map((field) => [field.slug, field.type]));
+				const listColumns: string[] = [];
+				for (const slug of configuredListColumns) {
+					if (listColumns.includes(slug)) continue;
+					const fieldType = fieldTypes.get(slug);
+					if (!fieldType || !LIST_COLUMN_FIELD_TYPES.has(fieldType)) {
+						console.warn(
+							`EmDash: Ignoring unsupported or unknown list column "${slug}" in collection "${collection.slug}".`,
+						);
+						continue;
+					}
+					if (listColumns.length >= MAX_COLLECTION_LIST_COLUMNS) {
+						console.warn(
+							`EmDash: Collection "${collection.slug}" declares more than ${MAX_COLLECTION_LIST_COLUMNS} list columns; extra columns are ignored.`,
+						);
+						break;
+					}
+					listColumns.push(slug);
+				}
+
 				manifestCollections[collection.slug] = {
 					label: collection.label,
 					labelSingular: collection.labelSingular || collection.label,
 					supports: collection.supports || [],
 					hasSeo: collection.hasSeo,
 					urlPattern: collection.urlPattern,
+					routable: collection.routable !== false,
+					titleField: collection.titleField,
+					dateField: collection.dateField,
 					...(collection.hidden ? { hidden: true } : {}),
+					listColumns: listColumns.length > 0 ? listColumns : undefined,
 					fields,
 				};
 			}
@@ -2539,29 +2682,48 @@ export class EmDashRuntime {
 
 		// Build taxonomies from database
 		let manifestTaxonomies: Array<{
+			id: string;
 			name: string;
 			label: string;
 			labelSingular?: string;
 			hierarchical: boolean;
 			collections: string[];
+			locale: string;
+			translationGroup: string;
 		}> = [];
+		let taxonomyDefinitionLocales: string[] = [];
 		try {
 			const rows = await this.db
 				.selectFrom("_emdash_taxonomy_defs")
 				.selectAll()
 				.orderBy("name")
 				.execute();
+			taxonomyDefinitionLocales = rows.map((row) => row.locale);
 			manifestTaxonomies = rows.map((row) => ({
+				id: row.id,
 				name: row.name,
 				label: row.label,
 				labelSingular: row.label_singular ?? undefined,
 				hierarchical: row.hierarchical === 1,
 				collections: parseStringArray(row.collections).toSorted(),
+				locale: row.locale,
+				translationGroup: row.translation_group ?? row.id,
 			}));
 		} catch (error) {
 			console.debug("EmDash: Could not load taxonomy definitions:", error);
 		}
 
+		try {
+			const configuredLocales = virtualConfig?.i18n?.locales ?? getI18nConfig()?.locales ?? [];
+			await warnAboutUnconfiguredTaxonomyLocales(
+				this.db,
+				configuredLocales,
+				taxonomyDefinitionLocales,
+			);
+		} catch (error) {
+			console.warn("[i18n] taxonomy locale diagnostic failed:", error);
+		}
+
 		// Build manifest hash
 		const manifestHash = await hashString(
 			JSON.stringify(manifestCollections) +
@@ -2574,7 +2736,7 @@ export class EmDashRuntime {
 		const authModeValue = authMode.type === "external" ? authMode.providerType : "passkey";
 
 		// Include i18n config if enabled (read from virtual module to avoid SSR module singleton mismatch)
-		const i18nConfig = virtualConfig?.i18n;
+		const i18nConfig = virtualConfig?.i18n ?? getI18nConfig();
 		const i18n =
 			i18nConfig && i18nConfig.locales && i18nConfig.locales.length > 1
 				? { defaultLocale: i18nConfig.defaultLocale, locales: i18nConfig.locales }
@@ -2596,6 +2758,10 @@ export class EmDashRuntime {
 			taxonomies: manifestTaxonomies,
 			authMode: authModeValue,
 			i18n,
+			contentLocale: {
+				defaultLocale: i18nConfig?.defaultLocale ?? "en",
+				implicit: i18nConfig === null,
+			},
 			marketplace: !!this.config.marketplace,
 			registry,
 		};
@@ -2673,6 +2839,10 @@ export class EmDashRuntime {
 			dateField?: ContentDateField;
 			dateFrom?: string;
 			dateTo?: string;
+			bylines?: string[];
+			bylinesNone?: boolean;
+			includeInferredBylines?: boolean;
+			fieldFilters?: ContentFieldFilters;
 		},
 	) {
 		return handleContentList(this.db, collection, params);
@@ -2758,7 +2928,7 @@ export class EmDashRuntime {
 		collection: string,
 		body: {
 			data: Record<string, unknown>;
-			slug?: string;
+			slug?: string | null;
 			status?: string;
 			authorId?: string;
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
@@ -2818,7 +2988,7 @@ export class EmDashRuntime {
 		id: string,
 		body: {
 			data?: Record<string, unknown>;
-			slug?: string;
+			slug?: string | null;
 			status?: string;
 			authorId?: string | null;
 			bylines?: Array<{ bylineId: string; roleLabel?: string | null }>;
@@ -3490,12 +3660,15 @@ export class EmDashRuntime {
 	): Promise<void> {
 		for (const contentId of new Set(contentIds)) {
 			try {
+				const work = await processMediaUsageWorkAfterWrite(this.db, collection, contentId);
+				if (work.outcome !== "inactive") return;
 				await refreshContentMediaUsageAfterWrite(this.db, collection, contentId);
 			} catch (error) {
 				console.error(
 					`[media-usage] Failed after content write ${collection}/${contentId}:`,
 					error,
 				);
+				return;
 			}
 		}
 	}
@@ -3505,6 +3678,8 @@ export class EmDashRuntime {
 		contentId: string,
 	): Promise<void> {
 		try {
+			const work = await processMediaUsageWorkAfterWrite(this.db, collection, contentId);
+			if (work.outcome !== "inactive") return;
 			const result = await deleteContentMediaUsage(this.db, collection, contentId);
 			if (!result.success) {
 				console.error(
@@ -3584,7 +3759,13 @@ export class EmDashRuntime {
 		return meta.admin?.settingsSchema ?? {};
 	}
 
-	async handlePluginApiRoute(pluginId: string, _method: string, path: string, request: Request) {
+	async handlePluginApiRoute(
+		pluginId: string,
+		_method: string,
+		path: string,
+		request: Request,
+		user?: RouteCallerInput | null,
+	) {
 		if (!this.isPluginEnabled(pluginId)) {
 			return {
 				success: false,
@@ -3592,6 +3773,11 @@ export class EmDashRuntime {
 			};
 		}
 
+		// Authenticated caller for `ctx.user`. Undefined for public routes
+		// (the catch-all only forwards the caller after private-route auth)
+		// and for machine tokens with no bound user.
+		const caller = user ? toRouteCallerInfo(user) : undefined;
+
 		// Check trusted (configured) plugins first — this must match the
 		// resolution order in getPluginRouteMeta to avoid auth/execution mismatches.
 		const trustedPlugin = this.configuredPlugins.find((p) => p.id === pluginId);
@@ -3609,13 +3795,13 @@ export class EmDashRuntime {
 			// Body methods parse JSON; GET/HEAD/DELETE parse the query string (#2146).
 			const body = await parseRouteInput(request);
 
-			return routeRegistry.invoke(pluginId, routeKey, { request, body });
+			return routeRegistry.invoke(pluginId, routeKey, { request, body, user: caller });
 		}
 
 		// Check sandboxed (marketplace) plugins second
 		const sandboxedPlugin = this.findSandboxedPlugin(pluginId);
 		if (sandboxedPlugin) {
-			return this.handleSandboxedRoute(sandboxedPlugin, path, request);
+			return this.handleSandboxedRoute(sandboxedPlugin, path, request, caller);
 		}
 
 		return {
@@ -3742,6 +3928,7 @@ export class EmDashRuntime {
 		input: unknown,
 		actorId: string,
 		request: Request,
+		caller?: RouteCallerInput | null,
 	) {
 		const requestMeta = extractRequestMeta(request, getTrustedProxyHeaders(this.config));
 		const audit = new AuditRepository(this.db);
@@ -3753,7 +3940,13 @@ export class EmDashRuntime {
 			headers,
 			body: JSON.stringify(input),
 		});
-		const result = await this.handlePluginApiRoute(pluginId, "POST", route, internalRequest);
+		const result = await this.handlePluginApiRoute(
+			pluginId,
+			"POST",
+			route,
+			internalRequest,
+			caller,
+		);
 		await audit.log({
 			actorId,
 			actorIp: requestMeta.ip ?? undefined,
@@ -4079,10 +4272,12 @@ export class EmDashRuntime {
 		plugin: SandboxedPluginInstance,
 		path: string,
 		request: Request,
+		user?: UserInfo,
 	): Promise<{
 		success: boolean;
 		data?: unknown;
 		error?: { code: string; message: string };
+		status?: number;
 	}> {
 		const routeName = path.replace(LEADING_SLASH_PATTERN, "");
 
@@ -4097,10 +4292,22 @@ export class EmDashRuntime {
 				method: request.method,
 				headers,
 				meta,
+				user,
 			});
 			return { success: true, data: result };
 		} catch (error) {
 			console.error(`EmDash: Sandboxed plugin route error:`, error);
+			const sandboxRouteError = getSandboxRouteErrorDetails(error);
+			if (sandboxRouteError) {
+				return {
+					success: false,
+					status: sandboxRouteError.status,
+					error: {
+						code: sandboxRouteError.code,
+						message: sandboxRouteError.message,
+					},
+				};
+			}
 			return {
 				success: false,
 				error: {

package/src/fields/file.ts

@@ -12,10 +12,13 @@ export interface FileOptions {
 export function file(options: FileOptions = {}): FieldDefinition<FileValue> {
 	const fileObjSchema = z.object({
 		id: z.string(),
-		url: z.string(),
-		filename: z.string(),
-		mimeType: z.string(),
-		size: z.number(),
+		url: z.string().optional(),
+		src: z.string().optional(),
+		filename: z.string().optional(),
+		mimeType: z.string().optional(),
+		size: z.number().optional(),
+		provider: z.string().optional(),
+		meta: z.record(z.string(), z.unknown()).optional(),
 	});
 
 	const schema: z.ZodTypeAny = options.required ? fileObjSchema : fileObjSchema.optional();

package/src/fields/image.ts

@@ -4,10 +4,17 @@ import type { FieldDefinition, ImageValue } from "./types.js";
 
 const imageSchema = z.object({
 	id: z.string(),
-	src: z.string(),
+	src: z.string().optional(),
 	alt: z.string().optional(),
 	width: z.number().optional(),
 	height: z.number().optional(),
+	filename: z.string().optional(),
+	mimeType: z.string().optional(),
+	blurhash: z.string().optional(),
+	dominantColor: z.string().optional(),
+	provider: z.string().optional(),
+	previewUrl: z.string().optional(),
+	meta: z.record(z.string(), z.unknown()).optional(),
 });
 
 export interface ImageOptions {

package/src/fields/types.ts

@@ -56,12 +56,25 @@ import type { MediaValue } from "../media/types.js";
 export type ImageValue = MediaValue;
 
 /**
- * File field value
+ * Persisted file field value.
+ *
+ * File values are references with cached metadata, not implicitly hydrated
+ * media records. Use the media provider API when current metadata is needed.
  */
 export interface FileValue {
 	id: string;
-	url: string;
-	filename: string;
-	mimeType: string;
-	size: number;
+	/** Legacy cached URL. Provider-backed values commonly omit this. */
+	url?: string;
+	/** Direct URL used by external media providers. */
+	src?: string;
+	/** Cached original filename, when available. */
+	filename?: string;
+	/** Cached MIME type, when available. */
+	mimeType?: string;
+	/** Cached file size in bytes, when persisted with the value. */
+	size?: number;
+	/** Media provider ID. Defaults to `local` when omitted. */
+	provider?: string;
+	/** Provider-specific data needed to resolve or render the file. */
+	meta?: Record<string, unknown>;
 }

package/src/i18n/config.ts

@@ -12,6 +12,8 @@ export interface I18nConfig {
 	prefixDefaultLocale?: boolean;
 }
 
+export const LOCALE_CODE_PATTERN = /^[a-z]{2,3}(-[a-z0-9]{2,8})*$/i;
+
 const I18N_CONFIG_KEY = Symbol.for("emdash:i18n-config");
 
 function configStore(): Record<symbol, I18nConfig | null | undefined> {
@@ -43,6 +45,36 @@ export function resolveConfiguredLocale(locale: string): string {
 	);
 }
 
+/** Whether a string matches the locale-code subset accepted by EmDash. */
+export function isValidLocaleCode(locale: string): boolean {
+	return LOCALE_CODE_PATTERN.test(locale);
+}
+
+/** Resolve the locale for a new content row. */
+export function resolveContentCreateLocale(
+	locale: unknown,
+	config: I18nConfig | null = getI18nConfig(),
+): string {
+	if (locale !== undefined) {
+		if (typeof locale !== "string") {
+			throw new Error("Invalid locale code: expected a string");
+		}
+		if (!isValidLocaleCode(locale)) {
+			throw new Error(`Invalid locale code: "${locale}"`);
+		}
+
+		const configured = config?.locales.find(
+			(candidate) => candidate.toLowerCase() === locale.toLowerCase(),
+		);
+		if (config && !configured) {
+			throw new Error(`Locale "${locale}" is not configured for this site`);
+		}
+		return configured ?? locale;
+	}
+
+	return config?.defaultLocale ?? "en";
+}
+
 /**
  * Check if i18n is enabled.
  * Returns true when multiple locales are configured.

package/src/i18n/repair-locale-casing.ts

@@ -13,7 +13,6 @@ export async function repairLocaleCasing(
 
 	for (const tableName of tableNames) {
 		const table = sql.ref(tableName);
-		const slug = tableName.slice("ec_".length);
 		for (const locale of configuredLocales) {
 			await sql`
 				UPDATE ${table} AS target
@@ -33,19 +32,6 @@ export async function repairLocaleCasing(
 							AND candidate.locale != ${locale}
 					)
 			`.execute(db);
-
-			await sql`
-				UPDATE content_taxonomies AS pivot
-				SET locale = ${locale}
-				WHERE pivot.collection = ${slug}
-					AND lower(pivot.locale) = lower(${locale})
-					AND pivot.locale != ${locale}
-					AND EXISTS (
-						SELECT 1
-						FROM ${table} AS content
-						WHERE content.id = pivot.entry_id AND content.locale = ${locale}
-					)
-			`.execute(db);
 		}
 	}
 }