emdash 0.34.0 → 0.36.0

package/src/api/openapi/document.ts

@@ -40,10 +40,16 @@ import {
 import {
 	mediaUsageDetailsQuery,
 	mediaUsageDetailsResponseSchema,
+	mediaUsageProgressSchema,
+	mediaUsageProgressAdvanceResponseSchema,
 	mediaUsageCollectionDeletionListQuery,
 	mediaUsageCollectionDeletionListResponseSchema,
 	mediaUsageCollectionDeletionRetryBody,
 	mediaUsageCollectionDeletionRetryResponseSchema,
+	mediaUsageActivationStatusSchema,
+	mediaUsageActivationAdvanceBody,
+	mediaUsageActivationAdvanceResponseSchema,
+	mediaUsageActivationConflictSchema,
 	mediaUsageRepairBody,
 	mediaUsageRepairResponseSchema,
 	mediaUsageWorkListQuery,
@@ -57,6 +63,11 @@ import {
 	mediaConfirmBody,
 	mediaConfirmResponseSchema,
 	mediaExistingResponseSchema,
+	mediaFolderBody,
+	mediaFolderIdSchema,
+	mediaFolderListQuery,
+	mediaFolderListResponseSchema,
+	mediaFolderResponseSchema,
 	mediaGetQuery,
 	mediaListQuery,
 	mediaListReadResponseSchema,
@@ -178,6 +189,7 @@ function standardErrors(
 		404: "Not Found",
 		409: "Conflict",
 		413: "Payload Too Large",
+		422: "Unprocessable Entity",
 		500: "Internal Server Error",
 	};
 	for (const code of codes) {
@@ -244,7 +256,7 @@ const contentPaths = {
 					},
 				},
 				...authErrors,
-				...standardErrors(400, 500),
+				...standardErrors(400, 422, 500),
 			},
 		},
 	},
@@ -302,7 +314,7 @@ const contentPaths = {
 					},
 				},
 				...authErrors,
-				...standardErrors(400, 404, 409, 500),
+				...standardErrors(400, 404, 409, 422, 500),
 			},
 		},
 		delete: {
@@ -702,6 +714,98 @@ function buildMediaPaths(maxUploadSize: number) {
 				},
 			},
 		},
+		"/_emdash/api/media/folders": {
+			get: {
+				operationId: "listMediaFolders",
+				summary: "List media folders",
+				tags: ["Media"],
+				requestParams: { query: mediaFolderListQuery },
+				responses: {
+					"200": {
+						description: "Media folder list",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(mediaFolderListResponseSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(400, 500),
+				},
+			},
+			post: {
+				operationId: "createMediaFolder",
+				summary: "Create a media folder",
+				tags: ["Media"],
+				requestBody: { content: { [JSON_CONTENT]: { schema: mediaFolderBody } } },
+				responses: {
+					"201": {
+						description: "Created media folder",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(mediaFolderResponseSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(400, 409, 500),
+				},
+			},
+		},
+		"/_emdash/api/media/folders/{id}": {
+			get: {
+				operationId: "getMediaFolder",
+				summary: "Get a media folder",
+				tags: ["Media"],
+				requestParams: {
+					path: z.object({ id: mediaFolderIdSchema.meta({ description: "Media folder ID" }) }),
+				},
+				responses: {
+					"200": {
+						description: "Media folder",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(mediaFolderResponseSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(400, 404, 500),
+				},
+			},
+			put: {
+				operationId: "updateMediaFolder",
+				summary: "Update a media folder",
+				tags: ["Media"],
+				requestParams: {
+					path: z.object({ id: mediaFolderIdSchema.meta({ description: "Media folder ID" }) }),
+				},
+				requestBody: { content: { [JSON_CONTENT]: { schema: mediaFolderBody } } },
+				responses: {
+					"200": {
+						description: "Updated media folder",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(mediaFolderResponseSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(400, 404, 409, 500),
+				},
+			},
+			delete: {
+				operationId: "deleteMediaFolder",
+				summary: "Delete a media folder",
+				description: "Deletes the folder and returns its media to the Main library.",
+				tags: ["Media"],
+				requestParams: {
+					path: z.object({ id: mediaFolderIdSchema.meta({ description: "Media folder ID" }) }),
+				},
+				responses: {
+					"200": {
+						description: "Deleted media folder",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(deleteResponseSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(400, 404, 500),
+				},
+			},
+		},
 		"/_emdash/api/media/{id}": {
 			get: {
 				operationId: "getMedia",
@@ -802,6 +906,46 @@ function buildMediaPaths(maxUploadSize: number) {
 				},
 			},
 		},
+		"/_emdash/api/admin/media-usage/progress": {
+			get: {
+				operationId: "getMediaUsageProgress",
+				summary: "Get media usage indexing progress",
+				description:
+					"Returns aggregate indexing readiness for current content collections after controlled activation is active. Requires `schema:manage`; bearer tokens also require the `admin` scope.",
+				tags: ["Media"],
+				responses: {
+					"200": {
+						description: "Aggregate media usage indexing progress",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(mediaUsageProgressSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(409),
+					...standardErrors(500),
+				},
+			},
+			post: {
+				operationId: "advanceMediaUsageProgress",
+				summary: "Advance media usage indexing",
+				description:
+					"Runs one bounded Media Usage maintenance step and returns the stored activation and indexing state. Requires `schema:manage`; bearer tokens also require the `admin` scope.",
+				tags: ["Media"],
+				responses: {
+					"200": {
+						description: "Media Usage progress after one maintenance step",
+						content: {
+							[JSON_CONTENT]: {
+								schema: successEnvelope(mediaUsageProgressAdvanceResponseSchema),
+							},
+						},
+					},
+					...authErrors,
+					...standardErrors(409),
+					...standardErrors(500),
+				},
+			},
+		},
 		"/_emdash/api/admin/media-usage/work": {
 			get: {
 				operationId: "listMediaUsageWork",
@@ -822,6 +966,52 @@ function buildMediaPaths(maxUploadSize: number) {
 				},
 			},
 		},
+		"/_emdash/api/admin/media-usage/activation": {
+			get: {
+				operationId: "getMediaUsageActivation",
+				summary: "Get media usage activation status",
+				description:
+					"Returns the redacted status of controlled Media Usage capture activation. This operation is read-only and does not start or resume activation. Requires `schema:manage`; bearer tokens also require the `admin` scope.",
+				tags: ["Media"],
+				responses: {
+					"200": {
+						description: "Media usage activation status",
+						content: {
+							[JSON_CONTENT]: { schema: successEnvelope(mediaUsageActivationStatusSchema) },
+						},
+					},
+					...authErrors,
+					...standardErrors(409, 500),
+				},
+			},
+			post: {
+				operationId: "advanceMediaUsageActivation",
+				summary: "Advance media usage activation",
+				description:
+					"Starts, resumes, or retries exactly one bounded activation batch after the operator confirms that all writers are drained. Continue setup through the Media Usage progress endpoint. Requires `schema:manage`; bearer tokens also require the `admin` scope.",
+				tags: ["Media"],
+				requestBody: {
+					required: true,
+					content: { [JSON_CONTENT]: { schema: mediaUsageActivationAdvanceBody } },
+				},
+				responses: {
+					"200": {
+						description: "Current media usage activation progress",
+						content: {
+							[JSON_CONTENT]: {
+								schema: successEnvelope(mediaUsageActivationAdvanceResponseSchema),
+							},
+						},
+					},
+					...authErrors,
+					...standardErrors(400, 500),
+					"409": {
+						description: "Activation is busy, changed ownership, or is incompatible",
+						content: { [JSON_CONTENT]: { schema: mediaUsageActivationConflictSchema } },
+					},
+				},
+			},
+		},
 		"/_emdash/api/admin/media-usage/work/retry": {
 			post: {
 				operationId: "retryMediaUsageWork",

package/src/api/schemas/media-usage.ts

@@ -13,6 +13,14 @@ export const mediaUsageCoverageSchema = z
 	})
 	.meta({ id: "MediaUsageCoverage" });
 
+export const mediaUsageProgressSchema = z
+	.object({
+		status: z.enum(["indexing", "ready", "needs_attention"]),
+		readyCollections: z.number().int().min(0),
+		totalCollections: z.number().int().min(0),
+	})
+	.meta({ id: "MediaUsageProgress" });
+
 export const mediaUsageSummarySchema = z
 	.object({
 		count: z.number().int().min(0).nullable(),
@@ -182,6 +190,66 @@ export const mediaUsageWorkRetryConflictSchema = z.object({
 	]),
 });
 
+export const mediaUsageActivationStateSchema = z
+	.enum(["expanded", "activating", "active"])
+	.meta({ id: "MediaUsageActivationState" });
+
+export const mediaUsageActivationStatusSchema = z
+	.object({
+		state: mediaUsageActivationStateSchema,
+		collectionCursor: z.string().nullable(),
+		attemptCount: z.number().int().min(0),
+		drainConfirmedAt: z.string().nullable(),
+		lastAttemptedAt: z.string().nullable(),
+		lastErrorCode: z.literal("MEDIA_USAGE_ACTIVATION_FAILED").nullable(),
+		leaseExpiresAt: z.string().nullable(),
+		activatedAt: z.string().nullable(),
+		updatedAt: z.string(),
+	})
+	.meta({ id: "MediaUsageActivationStatus" });
+
+export const mediaUsageActivationAdvanceBody = z
+	.object({
+		writersDrained: z.literal(true),
+	})
+	.strict()
+	.meta({ id: "MediaUsageActivationAdvanceBody" });
+
+export const mediaUsageActivationAdvanceResponseSchema = z
+	.object({
+		outcome: z.enum(["activating", "active"]),
+		processedCollections: z.number().int().min(0).max(1),
+		activation: mediaUsageActivationStatusSchema,
+	})
+	.meta({ id: "MediaUsageActivationAdvanceResponse" });
+
+export const mediaUsageProgressAdvanceResponseSchema = z
+	.object({
+		activation: mediaUsageActivationStatusSchema,
+		progress: mediaUsageProgressSchema.nullable(),
+		nextRequestInMs: z.union([z.literal(0), z.literal(30_000), z.null()]),
+	})
+	.meta({ id: "MediaUsageProgressAdvanceResponse" });
+
+export const mediaUsageActivationConflictSchema = z.object({
+	success: z.literal(false),
+	error: z.discriminatedUnion("code", [
+		z.object({
+			code: z.literal("MEDIA_USAGE_ACTIVATION_BUSY"),
+			message: z.string(),
+			details: z.object({ leaseExpiresAt: z.string() }),
+		}),
+		z.object({
+			code: z.literal("MEDIA_USAGE_ACTIVATION_CONFLICT"),
+			message: z.string(),
+		}),
+		z.object({
+			code: z.literal("MEDIA_USAGE_ACTIVATION_VERSION_MISMATCH"),
+			message: z.string(),
+		}),
+	]),
+});
+
 export const mediaUsageCollectionDeletionStateSchema = z
 	.enum(["pending", "retry", "leased", "failed"])
 	.meta({ id: "MediaUsageCollectionDeletionState" });
@@ -227,11 +295,20 @@ export const mediaUsageCollectionDeletionRetryResponseSchema = z
 
 export type MediaUsageRepairRequest = z.infer<typeof mediaUsageRepairBody>;
 export type MediaUsageRepairResponse = z.infer<typeof mediaUsageRepairResponseSchema>;
+export type MediaUsageProgress = z.infer<typeof mediaUsageProgressSchema>;
+export type MediaUsageProgressAdvanceResponse = z.infer<
+	typeof mediaUsageProgressAdvanceResponseSchema
+>;
 export type MediaUsageWorkListQuery = z.infer<typeof mediaUsageWorkListQuery>;
 export type MediaUsageWorkItem = z.infer<typeof mediaUsageWorkItemSchema>;
 export type MediaUsageWorkListResponse = z.infer<typeof mediaUsageWorkListResponseSchema>;
 export type MediaUsageWorkRetryRequest = z.infer<typeof mediaUsageWorkRetryBody>;
 export type MediaUsageWorkRetryResponse = z.infer<typeof mediaUsageWorkRetryResponseSchema>;
+export type MediaUsageActivationStatus = z.infer<typeof mediaUsageActivationStatusSchema>;
+export type MediaUsageActivationAdvanceRequest = z.infer<typeof mediaUsageActivationAdvanceBody>;
+export type MediaUsageActivationAdvanceResponse = z.infer<
+	typeof mediaUsageActivationAdvanceResponseSchema
+>;
 export type MediaUsageCollectionDeletionListQuery = z.infer<
 	typeof mediaUsageCollectionDeletionListQuery
 >;

package/src/api/schemas/media.ts

@@ -1,5 +1,7 @@
 import { z } from "zod";
 
+import { isValidFocalPointUpdate } from "#media/focal-point.js";
+
 import { cursorPaginationQuery } from "./common.js";
 import { mediaUsageSummarySchema } from "./media-usage.js";
 
@@ -21,13 +23,25 @@ const mimeTypeFilter = z
 
 export const mediaListQuery = cursorPaginationQuery
 	.extend({
+		page: z.coerce.number().int().min(1).max(Number.MAX_SAFE_INTEGER).optional(),
 		mimeType: mimeTypeFilter,
+		folderId: z
+			.union([z.literal("unfiled"), z.string().min(1).max(64)])
+			.optional()
+			.meta({
+				description:
+					"Filter by a media folder ID. Use `unfiled` for the Main library; omit for all media.",
+			}),
 		/** Case-insensitive filename substring search (also matches extensions). */
 		q: z.string().trim().min(1).max(200).optional(),
 		includeUsage: z.literal("1").optional().meta({
 			description: "Include a coverage-aware usage summary on each media item",
 		}),
 	})
+	.refine(({ cursor, page }) => cursor === undefined || page === undefined, {
+		message: "cursor and page cannot be used together",
+		path: ["page"],
+	})
 	.meta({ id: "MediaListQuery" });
 
 export const mediaGetQuery = z
@@ -44,9 +58,47 @@ export const mediaUpdateBody = z
 		caption: z.string().optional(),
 		width: z.number().int().positive().optional(),
 		height: z.number().int().positive().optional(),
+		folderId: z
+			.union([z.literal("unfiled"), z.string().min(1).max(64)])
+			.nullable()
+			.optional()
+			.transform((value) => (value === "unfiled" ? null : value))
+			.meta({
+				description:
+					"Assign a media folder ID, or use null or `unfiled` to return the item to the Main library.",
+			}),
+		focalX: z.number().min(0).max(1).nullable().optional(),
+		focalY: z.number().min(0).max(1).nullable().optional(),
+	})
+	.superRefine((value, context) => {
+		if (!isValidFocalPointUpdate(value)) {
+			context.addIssue({
+				code: "custom",
+				message: "focalX and focalY must both be numbers or both be null",
+				path: ["focalX"],
+			});
+		}
 	})
 	.meta({ id: "MediaUpdateBody" });
 
+export const mediaFolderIdSchema = z.string().min(1).max(64);
+
+export const mediaFolderListQuery = cursorPaginationQuery
+	.extend({ q: z.string().trim().min(1).max(200).optional() })
+	.meta({ id: "MediaFolderListQuery" });
+
+const mediaFolderNameSchema = z.string().refine(
+	(value) => {
+		const length = value.trim().length;
+		return length >= 1 && length <= 200;
+	},
+	{ message: "Folder name must be between 1 and 200 characters" },
+);
+
+export const mediaFolderBody = z
+	.object({ name: mediaFolderNameSchema })
+	.meta({ id: "MediaFolderBody" });
+
 /** Default maximum allowed file upload size (50 MB). */
 export const DEFAULT_MAX_UPLOAD_SIZE = 50 * 1024 * 1024;
 
@@ -111,6 +163,8 @@ export const mediaItemSchema = z
 		size: z.number().nullable(),
 		width: z.number().nullable(),
 		height: z.number().nullable(),
+		focalX: z.number().nullable(),
+		focalY: z.number().nullable(),
 		alt: z.string().nullable(),
 		caption: z.string().nullable(),
 		storageKey: z.string(),
@@ -120,9 +174,22 @@ export const mediaItemSchema = z
 		dominantColor: z.string().nullable(),
 		createdAt: z.string(),
 		authorId: z.string().nullable(),
+		folderId: z.string().nullable(),
 	})
 	.meta({ id: "MediaItem" });
 
+export const mediaFolderSchema = z
+	.object({ id: z.string(), name: z.string() })
+	.meta({ id: "MediaFolder" });
+
+export const mediaFolderResponseSchema = z
+	.object({ item: mediaFolderSchema })
+	.meta({ id: "MediaFolderResponse" });
+
+export const mediaFolderListResponseSchema = z
+	.object({ items: z.array(mediaFolderSchema), nextCursor: z.string().optional() })
+	.meta({ id: "MediaFolderListResponse" });
+
 export const mediaResponseSchema = z
 	.object({ item: mediaItemSchema })
 	.meta({ id: "MediaResponse" });
@@ -143,6 +210,7 @@ export const mediaListReadResponseSchema = z
 	.object({
 		items: z.array(mediaListReadItemSchema),
 		nextCursor: z.string().optional(),
+		totalCount: z.number().int().nonnegative().optional(),
 	})
 	.meta({ id: "MediaListReadResponse" });
 
@@ -150,6 +218,7 @@ export const mediaListResponseSchema = z
 	.object({
 		items: z.array(mediaItemSchema),
 		nextCursor: z.string().optional(),
+		totalCount: z.number().int().nonnegative().optional(),
 	})
 	.meta({ id: "MediaListResponse" });
 

package/src/astro/integration/index.ts

@@ -11,11 +11,21 @@
  */
 
 import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 
 import type { AstroIntegration, AstroIntegrationLogger, AstroIntegrationMiddleware } from "astro";
 
 import { validateAllowedOrigins, validateOriginShape } from "../../auth/allowed-origins.js";
+import { normalizeMigrationConfig } from "../../database/migrations/policy.js";
+import { normalizeAstroI18n } from "../../i18n/normalize.js";
 import { INTERNAL_MEDIA_PREFIX } from "../../media/normalize.js";
+import { getCoreMigrationIdentity } from "../../migrations/identity.js";
+import {
+	createMigrationIntegrationMetadata,
+	MIGRATION_CONFIG_SYMBOL,
+} from "../../migrations/integration-metadata.js";
+import { buildMigrationManifest } from "../../migrations/manifest-builder.js";
+import { writeMigrationManifest } from "../../migrations/manifest-writer.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import { VERSION } from "../../version.js";
 import { local } from "../storage/adapters.js";
@@ -313,6 +323,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 	const resolvedConfig: EmDashConfig = {
 		...config,
 		storage: config.storage ?? DEFAULT_STORAGE,
+		migrations: normalizeMigrationConfig(config.migrations),
 	};
 
 	// Validate marketplace URL
@@ -421,6 +432,7 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 	// i18n is populated in astro:config:setup from astroConfig.i18n
 	const serializableConfig: Record<string, unknown> = {
 		database: resolvedConfig.database,
+		migrations: resolvedConfig.migrations,
 		storage: resolvedConfig.storage,
 		auth: resolvedConfig.auth,
 		authProviders: resolvedConfig.authProviders,
@@ -440,8 +452,10 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 	// Captured in astro:config:setup so the astro:server:setup hook can tell
 	// whether we're running `astro dev` (where the dev-bypass shortcut applies).
 	let astroCommand: "dev" | "build" | "preview" | "sync" | undefined;
+	let normalizedI18n: ReturnType<typeof normalizeAstroI18n> = null;
+	const migrationMetadata = createMigrationIntegrationMetadata(resolvedConfig.database);
 
-	return {
+	const integration: AstroIntegration = {
 		name: "emdash",
 		hooks: {
 			"astro:config:setup": ({
@@ -467,18 +481,8 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				// Expose Astro's trailingSlash routing policy so plugins can build
 				// URLs (sitemap/canonical/hreflang) that match what the site serves.
 				serializableConfig.trailingSlash = astroConfig.trailingSlash;
-				// Extract i18n config from Astro config
-				// Astro locales can be strings OR { path, codes } objects — normalize to paths
-				if (astroConfig.i18n) {
-					const routing = astroConfig.i18n.routing;
-					serializableConfig.i18n = {
-						defaultLocale: astroConfig.i18n.defaultLocale,
-						locales: astroConfig.i18n.locales.map((l) => (typeof l === "string" ? l : l.path)),
-						fallback: astroConfig.i18n.fallback,
-						prefixDefaultLocale:
-							typeof routing === "object" ? (routing.prefixDefaultLocale ?? false) : false,
-					};
-				}
+				normalizedI18n = normalizeAstroI18n(astroConfig.i18n);
+				if (normalizedI18n) serializableConfig.i18n = normalizedI18n;
 
 				// Disable Astro's built-in checkOrigin -- EmDash's own CSRF
 				// layer (checkPublicCsrf in api/csrf.ts) handles origin
@@ -603,9 +607,31 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				// dev server is listening (see astro:server:setup), since the
 				// port isn't known yet here. Nothing useful to print for build.
 			},
-			"astro:config:done": ({ config: finalConfig, logger }) => {
+			"astro:config:done": async ({ config: finalConfig, logger }) => {
 				const warning = missingReactIntegrationWarning(finalConfig.integrations);
 				if (warning) logger.warn(warning);
+
+				if (astroCommand !== "build" && astroCommand !== "sync") return;
+				if (!migrationMetadata.database) {
+					logger.warn(
+						"EmDash migration manifest was not written because no database adapter is configured.",
+					);
+					return;
+				}
+				if (!migrationMetadata.database.migrations) {
+					logger.warn(
+						"EmDash migration manifest was not written because the configured database adapter does not support deployment migrations.",
+					);
+					return;
+				}
+
+				const identity = await getCoreMigrationIdentity();
+				const manifest = await buildMigrationManifest({
+					identity,
+					i18n: normalizedI18n,
+					database: migrationMetadata.database,
+				});
+				await writeMigrationManifest(fileURLToPath(finalConfig.root), manifest);
 			},
 			"astro:server:setup": ({ server, logger }) => {
 				// Print route info with absolute, clickable URLs once the server
@@ -683,6 +709,12 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			},
 		},
 	};
+
+	Object.defineProperty(integration, MIGRATION_CONFIG_SYMBOL, {
+		value: migrationMetadata,
+		enumerable: false,
+	});
+	return integration;
 }
 
 export default emdash;

package/src/astro/integration/routes.ts

@@ -208,6 +208,16 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/media/file/[...key].ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/media/folders",
+		entrypoint: resolveRoute("api/media/folders/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/media/folders/[id]",
+		entrypoint: resolveRoute("api/media/folders/[id].ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/media/[id]",
 		entrypoint: resolveRoute("api/media/[id].ts"),
@@ -258,6 +268,14 @@ export function injectCoreRoutes(
 		pattern: "/_emdash/api/admin/media-usage/work/retry",
 		entrypoint: resolveRoute("api/admin/media-usage/work/retry.ts"),
 	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/media-usage/activation",
+		entrypoint: resolveRoute("api/admin/media-usage/activation.ts"),
+	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/media-usage/progress",
+		entrypoint: resolveRoute("api/admin/media-usage/progress.ts"),
+	});
 	injectRoute({
 		pattern: "/_emdash/api/admin/media-usage/collection-deletions",
 		entrypoint: resolveRoute("api/admin/media-usage/collection-deletions/index.ts"),

package/src/astro/integration/runtime.ts

@@ -10,6 +10,7 @@
 import type { ManifestHookEntry, ManifestRouteEntry } from "@emdash-cms/plugin-types";
 
 import type { AuthDescriptor, AuthProviderDescriptor } from "../../auth/types.js";
+import type { RuntimeMigrationConfig } from "../../database/migrations/policy.js";
 import type { DatabaseDescriptor } from "../../db/adapters.js";
 import type { MediaProviderDescriptor } from "../../media/types.js";
 import type { ObjectCacheDescriptor } from "../../object-cache/types.js";
@@ -180,6 +181,8 @@ export interface EmDashConfig {
 	 * ```
 	 */
 	database?: DatabaseDescriptor;
+	/** Core database migration behavior at runtime. Defaults to `auto`. */
+	migrations?: RuntimeMigrationConfig;
 	/**
 	 * Storage configuration (for media)
 	 */

package/src/astro/integration/vite-config.ts

@@ -363,13 +363,7 @@ export function createVirtualModulesPlugin(
 // `?url`), so both forms resolve to dist rather than the source alias.
 const ADMIN_STYLES_ALIAS = /^@emdash-cms\/admin\/styles\.css/;
 
-const NODE_NATIVE_EXTERNALS = [
-	"better-sqlite3",
-	"bindings",
-	"file-uri-to-path",
-	"@libsql/kysely-libsql",
-	"pg",
-];
+const NODE_NATIVE_EXTERNALS = ["@libsql/kysely-libsql", "pg"];
 
 /**
  * Detect whether the Cloudflare adapter is being used.
@@ -546,6 +540,7 @@ export function createViteConfig(
 							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
 							// Astro internal deps not covered by @astrojs/cloudflare adapter
+							"astro/app/manifest",
 							"astro/virtual-modules/middleware.js",
 							"astro/virtual-modules/live-config",
 							"astro/content/runtime",

package/src/astro/middleware/auth.ts

@@ -54,6 +54,7 @@ declare global {
 // Role level constants (matching @emdash-cms/auth)
 const ROLE_ADMIN = 50;
 const MCP_ENDPOINT_PATH = "/_emdash/api/mcp";
+const COMMENT_SUBMISSION_PATH = /^\/_emdash\/api\/comments\/[^/]+\/[^/]+\/?$/;
 
 function isUnsafeMethod(method: string): boolean {
 	return method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
@@ -191,6 +192,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			const csrfError = checkPublicCsrf(context.request, url, publicOrigin);
 			if (csrfError) return csrfError;
 		}
+		if (method === "POST" && COMMENT_SUBMISSION_PATH.test(url.pathname)) {
+			return handlePublicRouteAuth(context, next);
+		}
 		return next();
 	}