emdash 0.35.0 → 0.37.0

package/src/astro/integration/dev-typegen.ts

@@ -0,0 +1,91 @@
+import type { AstroIntegrationLogger } from "astro";
+
+/**
+ * Create a debounced refresh function that fetches the generated types from
+ * the dev server and writes them to `emdash-env.d.ts` in the project root.
+ *
+ * This runs in the Astro integration (Node) and is registered for schema
+ * mutations to call back into. It never runs in production builds or in
+ * workerd SSR isolates, because only the integration registers it.
+ */
+export function createDebouncedTypegenRefresh(
+	port: number,
+	logger: AstroIntegrationLogger,
+): () => void {
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	let inFlight: Promise<unknown> | undefined;
+
+	function refresh(): void {
+		if (timer) clearTimeout(timer);
+		timer = setTimeout(() => {
+			timer = undefined;
+			if (inFlight) return;
+			inFlight = writeDevTypes(port, logger).finally(() => {
+				inFlight = undefined;
+			});
+		}, 200);
+	}
+
+	return refresh;
+}
+
+async function writeDevTypes(port: number, logger: AstroIntegrationLogger): Promise<void> {
+	const typegenUrl = `http://localhost:${port}/_emdash/api/typegen`;
+
+	try {
+		const { writeFile, readFile } = await import("node:fs/promises");
+		const { resolve } = await import("node:path");
+		const outputPath = resolve(process.cwd(), "emdash-env.d.ts");
+
+		const response = await fetch(typegenUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+		});
+
+		if (!response.ok) {
+			const body = await response.text().catch(() => "");
+			logger.warn(`Typegen failed: ${response.status} ${body.slice(0, 200)}`);
+			return;
+		}
+
+		const json = await response.json();
+		if (typeof json !== "object" || json === null || !("data" in json)) {
+			logger.warn("Typegen returned an unexpected response shape");
+			return;
+		}
+
+		const result = json.data;
+		if (
+			typeof result !== "object" ||
+			result === null ||
+			!("types" in result) ||
+			!("collections" in result)
+		) {
+			logger.warn("Typegen returned an unexpected response shape");
+			return;
+		}
+
+		const types = result.types;
+		const collections = result.collections;
+		if (typeof types !== "string" || typeof collections !== "number") {
+			logger.warn("Typegen returned an unexpected response shape");
+			return;
+		}
+
+		let needsWrite = true;
+		try {
+			const existing = await readFile(outputPath, "utf-8");
+			if (existing === types) needsWrite = false;
+		} catch {
+			// File doesn't exist yet
+		}
+
+		if (needsWrite) {
+			await writeFile(outputPath, types, "utf-8");
+			logger.info(`Generated emdash-env.d.ts (${collections} collections)`);
+		}
+	} catch (error) {
+		const msg = error instanceof Error ? error.message : String(error);
+		logger.warn(`Typegen failed: ${msg}`);
+	}
+}

package/src/astro/integration/index.ts

@@ -28,7 +28,9 @@ import { buildMigrationManifest } from "../../migrations/manifest-builder.js";
 import { writeMigrationManifest } from "../../migrations/manifest-writer.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
 import { VERSION } from "../../version.js";
+import { setDevTypegenRefresh } from "../dev-typegen.js";
 import { local } from "../storage/adapters.js";
+import { createDebouncedTypegenRefresh } from "./dev-typegen.js";
 import { notoSans } from "./font-provider.js";
 import {
 	injectCoreRoutes,
@@ -651,57 +653,20 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 					});
 				}
 
-				// Generate types once the server is listening.
+				// Generate types once the server is listening, and register the
+				// refresh hook so schema mutations in dev update the file too.
 				// The endpoint returns the types content; we write the file here
 				// (in Node) because workerd has no real filesystem access.
-				server.httpServer?.once("listening", async () => {
-					const { writeFile, readFile } = await import("node:fs/promises");
-					const { resolve } = await import("node:path");
-
+				server.httpServer?.once("listening", () => {
 					const address = server.httpServer?.address();
 					if (!address || typeof address === "string") return;
 
 					const port = address.port;
-					const typegenUrl = `http://localhost:${port}/_emdash/api/typegen`;
-					const outputPath = resolve(process.cwd(), "emdash-env.d.ts");
-
-					try {
-						const response = await fetch(typegenUrl, {
-							method: "POST",
-							headers: { "Content-Type": "application/json" },
-						});
-
-						if (!response.ok) {
-							const body = await response.text().catch(() => "");
-							logger.warn(`Typegen failed: ${response.status} ${body.slice(0, 200)}`);
-							return;
-						}
+					const refreshDevTypes = createDebouncedTypegenRefresh(port, logger);
+					setDevTypegenRefresh(refreshDevTypes);
 
-						const { data: result } = (await response.json()) as {
-							data: {
-								types: string;
-								hash: string;
-								collections: number;
-							};
-						};
-
-						// Only write if content changed
-						let needsWrite = true;
-						try {
-							const existing = await readFile(outputPath, "utf-8");
-							if (existing === result.types) needsWrite = false;
-						} catch {
-							// File doesn't exist yet
-						}
-
-						if (needsWrite) {
-							await writeFile(outputPath, result.types, "utf-8");
-							logger.info(`Generated emdash-env.d.ts (${result.collections} collections)`);
-						}
-					} catch (error) {
-						const msg = error instanceof Error ? error.message : String(error);
-						logger.warn(`Typegen failed: ${msg}`);
-					}
+					// Initial generation now that the server is up.
+					refreshDevTypes();
 				});
 			},
 			"astro:build:done": ({ logger }) => {

package/src/astro/integration/routes.ts

@@ -208,6 +208,16 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/media/file/[...key].ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/media/folders",
+		entrypoint: resolveRoute("api/media/folders/index.ts"),
+	});
+
+	injectRoute({
+		pattern: "/_emdash/api/media/folders/[id]",
+		entrypoint: resolveRoute("api/media/folders/[id].ts"),
+	});
+
 	injectRoute({
 		pattern: "/_emdash/api/media/[id]",
 		entrypoint: resolveRoute("api/media/[id].ts"),
@@ -228,6 +238,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/media/[id]/upload.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/media/[id]/replace",
+		entrypoint: resolveRoute("api/media/[id]/replace.ts"),
+	});
+
 	// Media provider routes
 	injectRoute({
 		pattern: "/_emdash/api/media/providers",
@@ -258,6 +273,14 @@ export function injectCoreRoutes(
 		pattern: "/_emdash/api/admin/media-usage/work/retry",
 		entrypoint: resolveRoute("api/admin/media-usage/work/retry.ts"),
 	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/media-usage/activation",
+		entrypoint: resolveRoute("api/admin/media-usage/activation.ts"),
+	});
+	injectRoute({
+		pattern: "/_emdash/api/admin/media-usage/progress",
+		entrypoint: resolveRoute("api/admin/media-usage/progress.ts"),
+	});
 	injectRoute({
 		pattern: "/_emdash/api/admin/media-usage/collection-deletions",
 		entrypoint: resolveRoute("api/admin/media-usage/collection-deletions/index.ts"),

package/src/astro/integration/vite-config.ts

@@ -363,13 +363,7 @@ export function createVirtualModulesPlugin(
 // `?url`), so both forms resolve to dist rather than the source alias.
 const ADMIN_STYLES_ALIAS = /^@emdash-cms\/admin\/styles\.css/;
 
-const NODE_NATIVE_EXTERNALS = [
-	"better-sqlite3",
-	"bindings",
-	"file-uri-to-path",
-	"@libsql/kysely-libsql",
-	"pg",
-];
+const NODE_NATIVE_EXTERNALS = ["@libsql/kysely-libsql", "pg"];
 
 /**
  * Detect whether the Cloudflare adapter is being used.
@@ -378,6 +372,15 @@ function isCloudflareAdapter(astroConfig: AstroConfig): boolean {
 	return astroConfig.adapter?.name === "@astrojs/cloudflare";
 }
 
+function canResolveProjectDependency(projectRoot: string, specifier: string): boolean {
+	try {
+		createRequire(resolve(projectRoot, "package.json")).resolve(specifier);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 /**
  * Creates the Vite config update for EmDash.
  */
@@ -389,6 +392,7 @@ export function createViteConfig(
 	const cloudflare = isCloudflareAdapter(options.astroConfig);
 	const isDev = command === "dev";
 	const projectRoot = fileURLToPath(options.astroConfig.root);
+	const hasAstroConsoleLogger = canResolveProjectDependency(projectRoot, "astro/logger/console");
 
 	const adminSourcePath = isDev ? resolveAdminSource(projectRoot) : undefined;
 	const useSource = adminSourcePath !== undefined;
@@ -546,6 +550,8 @@ export function createViteConfig(
 							"emdash > zod",
 							"@emdash-cms/cloudflare > kysely-d1",
 							// Astro internal deps not covered by @astrojs/cloudflare adapter
+							"astro/app/manifest",
+							...(hasAstroConsoleLogger ? ["astro/logger/console"] : []),
 							"astro/virtual-modules/middleware.js",
 							"astro/virtual-modules/live-config",
 							"astro/content/runtime",
@@ -566,9 +572,17 @@ export function createViteConfig(
 		optimizeDeps: {
 			// When using source, don't pre-bundle JS — let Vite transform on the fly for HMR.
 			// When using dist, pre-bundle to avoid re-optimization on first hydration.
+			// lowlight pulls in a CommonJS highlight.js entry, so the inline Portable
+			// Text editor requires these to be pre-bundled with ESM interop in dev.
 			include: useSource
-				? ["@astrojs/react/client.js"]
-				: ["@emdash-cms/admin", "@astrojs/react/client.js"],
+				? ["@astrojs/react/client.js", "lowlight", "highlight.js", "highlight.js/lib/core"]
+				: [
+						"@emdash-cms/admin",
+						"@astrojs/react/client.js",
+						"lowlight",
+						"highlight.js",
+						"highlight.js/lib/core",
+					],
 			exclude: cloudflare ? ["virtual:emdash"] : [...NODE_NATIVE_EXTERNALS, "virtual:emdash"],
 		},
 	};

package/src/astro/middleware/auth.ts

@@ -54,6 +54,7 @@ declare global {
 // Role level constants (matching @emdash-cms/auth)
 const ROLE_ADMIN = 50;
 const MCP_ENDPOINT_PATH = "/_emdash/api/mcp";
+const COMMENT_SUBMISSION_PATH = /^\/_emdash\/api\/comments\/[^/]+\/[^/]+\/?$/;
 
 function isUnsafeMethod(method: string): boolean {
 	return method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
@@ -191,6 +192,9 @@ export const onRequest = defineMiddleware(async (context, next) => {
 			const csrfError = checkPublicCsrf(context.request, url, publicOrigin);
 			if (csrfError) return csrfError;
 		}
+		if (method === "POST" && COMMENT_SUBMISSION_PATH.test(url.pathname)) {
+			return handlePublicRouteAuth(context, next);
+		}
 		return next();
 	}
 

package/src/astro/middleware.ts

@@ -48,7 +48,6 @@ import { createDeferredTaskTracker } from "../deferred-tasks.js";
 import {
 	DB_INIT_DEADLINE_MS,
 	EmDashRuntime,
-	type MediaUsageMaintenanceResult,
 	type RuntimeDependencies,
 	type SandboxedPluginEntry,
 	type MediaProviderEntry,
@@ -300,12 +299,6 @@ export async function runScheduledTasks(
 	return runOutsideRequest(config, (runtime) => runtime.runScheduledTasks(options));
 }
 
-export async function runScheduledMediaUsageTasks(): Promise<MediaUsageMaintenanceResult> {
-	const config = getConfig();
-	if (!config) return { outcome: "inactive", taskClass: null, turn: null };
-	return runOutsideRequest(config, (runtime) => runtime.runScheduledMediaUsageTasks());
-}
-
 /**
  * Run a callback against the EmDash runtime outside any HTTP request — from a
  * Cloudflare Queue consumer, a `scheduled()` handler, or any other
@@ -916,6 +909,11 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					handleMediaGet: runtime.handleMediaGet.bind(runtime),
 					handleMediaCreate: runtime.handleMediaCreate.bind(runtime),
 					handleMediaUpdate: runtime.handleMediaUpdate.bind(runtime),
+					...(runtime.handleMediaReplaceMetadata
+						? {
+								handleMediaReplaceMetadata: runtime.handleMediaReplaceMetadata.bind(runtime),
+							}
+						: {}),
 					handleMediaDelete: runtime.handleMediaDelete.bind(runtime),
 
 					// Revision handlers

package/src/astro/routes/api/admin/api-tokens/index.ts

@@ -19,7 +19,10 @@ export const prerender = false;
 const createTokenSchema = z.object({
 	name: z.string().min(1).max(100),
 	scopes: z.array(z.string().refine(isValidScope)).min(1),
-	expiresAt: z.string().datetime().optional(),
+	expiresAt: z.iso
+		.datetime()
+		.or(z.iso.datetime({ precision: -1 }))
+		.optional(),
 });
 
 /**

package/src/astro/routes/api/admin/media-usage/activation.ts

@@ -0,0 +1,42 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import {
+	handleMediaUsageActivationAdvance,
+	handleMediaUsageActivationStatus,
+} from "#api/handlers/media-usage-activation.js";
+import { isParseError, parseBody } from "#api/parse.js";
+import { mediaUsageActivationAdvanceBody } from "#api/schemas.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+
+	return unwrapResult(await handleMediaUsageActivationStatus(emdash.db));
+};
+
+export const POST: APIRoute = async ({ request, locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+
+	const body = await parseBody(request, mediaUsageActivationAdvanceBody);
+	if (isParseError(body)) return body;
+
+	return unwrapResult(await handleMediaUsageActivationAdvance(emdash.db, body));
+};

package/src/astro/routes/api/admin/media-usage/progress.ts

@@ -0,0 +1,37 @@
+import type { APIRoute } from "astro";
+
+import { requirePerm } from "#api/authorize.js";
+import { requireDb, unwrapResult } from "#api/error.js";
+import {
+	handleMediaUsageProgress,
+	handleMediaUsageProgressAdvance,
+} from "#api/handlers/media-usage.js";
+import { requireScope } from "#auth/scopes.js";
+
+export const prerender = false;
+
+export const GET: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+
+	return unwrapResult(await handleMediaUsageProgress(emdash.db));
+};
+
+export const POST: APIRoute = async ({ locals }) => {
+	const { emdash, user } = locals;
+	const dbErr = requireDb(emdash?.db);
+	if (dbErr) return dbErr;
+
+	const denied = requirePerm(user, "schema:manage");
+	if (denied) return denied;
+	const scopeDenied = requireScope(locals, "admin");
+	if (scopeDenied) return scopeDenied;
+
+	return unwrapResult(await handleMediaUsageProgressAdvance(emdash.db));
+};

package/src/astro/routes/api/admin/oauth-clients/[id].ts

@@ -23,7 +23,7 @@ export const prerender = false;
 const updateClientSchema = z.object({
 	name: z.string().min(1).max(255).optional(),
 	redirectUris: z
-		.array(z.string().url("Each redirect URI must be a valid URL"))
+		.array(z.url("Each redirect URI must be a valid URL"))
 		.min(1, "At least one redirect URI is required")
 		.optional(),
 	scopes: z.array(z.string()).nullable().optional(),

package/src/astro/routes/api/admin/oauth-clients/index.ts

@@ -22,7 +22,7 @@ const createClientSchema = z.object({
 		.max(255, "Client ID must be at most 255 characters"),
 	name: z.string().min(1, "Name is required").max(255, "Name must be at most 255 characters"),
 	redirectUris: z
-		.array(z.string().url("Each redirect URI must be a valid URL"))
+		.array(z.url("Each redirect URI must be a valid URL"))
 		.min(1, "At least one redirect URI is required"),
 	scopes: z.array(z.string()).optional(),
 });

package/src/astro/routes/api/admin/plugins/registry/[id]/update.ts

@@ -38,6 +38,8 @@ const updateBodySchema = z.object({
 	 */
 	confirmRouteVisibilityChanges: z.boolean().optional(),
 	confirmMcpTools: z.boolean().optional(),
+	acknowledgedProfileCid: z.string().min(1).max(256).optional(),
+	acknowledgedReleaseCid: z.string().min(1).max(256).optional(),
 });
 
 export const POST: APIRoute = async ({ params, request, locals }) => {
@@ -73,6 +75,8 @@ export const POST: APIRoute = async ({ params, request, locals }) => {
 				confirmCapabilityChanges: body.confirmCapabilityChanges,
 				confirmRouteVisibilityChanges: body.confirmRouteVisibilityChanges,
 				confirmMcpTools: body.confirmMcpTools,
+				acknowledgedProfileCid: body.acknowledgedProfileCid,
+				acknowledgedReleaseCid: body.acknowledgedReleaseCid,
 				hostEnv: hostEnvFromVersions(VERSION, emdash.config.astroVersion),
 			},
 		);