emdash 0.36.0 → 0.38.0

package/src/api/handlers/revision.ts

@@ -9,6 +9,7 @@ import { ContentRepository } from "../../database/repositories/content.js";
 import { RevisionRepository, type Revision } from "../../database/repositories/revision.js";
 import { withTransaction } from "../../database/transaction.js";
 import type { Database } from "../../database/types.js";
+import { encodeRev } from "../rev.js";
 import type { ApiResult, ContentResponse } from "../types.js";
 
 export interface RevisionListResponse {
@@ -154,7 +155,7 @@ export async function handleRevisionRestore(
 
 		return {
 			success: true,
-			data: { item },
+			data: { item, _rev: encodeRev(item) },
 		};
 	} catch {
 		return {

package/src/api/handlers/seo.ts

@@ -18,6 +18,13 @@ export interface SitemapContentEntry {
 	slug: string | null;
 	/** ISO date of last modification */
 	updatedAt: string;
+	/**
+	 * ISO publish date, or null when never published. Used to resolve
+	 * date tokens (`{year}`/`{month}`/`{day}`) in the collection's
+	 * `url_pattern` — the published date keeps permalinks stable across
+	 * later edits (unlike `updatedAt`).
+	 */
+	publishedAt: string | null;
 	/**
 	 * Locale of this row (e.g. `"en"`, `"fr"`). Always present — rows in
 	 * pre-i18n databases are backfilled to the configured `defaultLocale`.
@@ -139,11 +146,12 @@ export async function handleSitemapData(
 					slug: string | null;
 					id: string;
 					updated_at: string;
+					published_at: string | null;
 					locale: string;
 					translation_group: string | null;
 					seo_image: string | null;
 				}>`
-					SELECT c.slug, c.id, c.updated_at, c.locale, c.translation_group, s.seo_image
+					SELECT c.slug, c.id, c.updated_at, c.published_at, c.locale, c.translation_group, s.seo_image
 					FROM ${sql.ref(tableName)} c
 					LEFT JOIN _emdash_seo s
 						ON s.collection = ${col.slug}
@@ -165,6 +173,7 @@ export async function handleSitemapData(
 						id: row.id,
 						slug: row.slug,
 						updatedAt: toW3CDate(row.updated_at),
+						publishedAt: row.published_at ?? null,
 						locale: row.locale,
 						translationGroup: row.translation_group,
 						image: row.seo_image ?? null,

package/src/api/handlers/snapshot.ts

@@ -12,6 +12,7 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { listTableColumns, listTablesLike } from "../../database/dialect-helpers.js";
 import type { Database } from "../../database/types.js";
 
 // ─�� Preview signature verification ──────────────────────────────
@@ -211,10 +212,44 @@ function isExcluded(tableName: string): boolean {
 	return EXCLUDED_PREFIXES.some((prefix) => tableName.startsWith(prefix));
 }
 
-/** Column info from PRAGMA table_info */
-interface ColumnInfo {
-	name: string;
-	type: string;
+type SnapshotColumnType = "TEXT" | "INTEGER" | "REAL" | "BLOB" | "JSON";
+
+function normalizeColumnType(type: string): SnapshotColumnType {
+	switch (type.toLowerCase()) {
+		case "smallint":
+		case "integer":
+		case "bigint":
+		case "boolean":
+			return "INTEGER";
+		case "real":
+		case "double precision":
+		case "numeric":
+		case "decimal":
+			return "REAL";
+		case "blob":
+		case "bytea":
+			return "BLOB";
+		case "json":
+		case "jsonb":
+			return "JSON";
+		default:
+			return "TEXT";
+	}
+}
+
+function normalizeRows(
+	rows: Record<string, unknown>[],
+	types: Record<string, SnapshotColumnType>,
+): Record<string, unknown>[] {
+	for (const row of rows) {
+		for (const [column, type] of Object.entries(types)) {
+			const value = row[column];
+			if (type === "JSON" && value !== null && value !== undefined && typeof value !== "string") {
+				row[column] = JSON.stringify(value);
+			}
+		}
+	}
+	return rows;
 }
 
 export interface GenerateSnapshotOptions {
@@ -247,15 +282,7 @@ export async function generateSnapshot(
 	const includeTrashed = options?.includeTrashed ?? false;
 	const optionPrefixes = options?.optionPrefixes ?? SAFE_OPTIONS_PREFIXES;
 
-	// Discover all ec_* content tables
-	const tableResult = await sql<{ name: string }>`
-		SELECT name FROM sqlite_master
-		WHERE type = 'table'
-		AND name LIKE 'ec_%'
-		ORDER BY name
-	`.execute(db);
-
-	const contentTables = tableResult.rows.map((r) => r.name);
+	const contentTables = await listTablesLike(db, "ec_%");
 
 	// Build list of all tables to export
 	const allTables = [...contentTables, ...SYSTEM_TABLES];
@@ -266,80 +293,65 @@ export async function generateSnapshot(
 	for (const tableName of allTables) {
 		if (isExcluded(tableName)) continue;
 
-		// Validate identifier before interpolating into sql.raw().
-		// SYSTEM_TABLES are hardcoded and safe, but ec_* names come from
-		// sqlite_master and must be validated.
+		// Content table names come from the database catalog. Validate them
+		// before passing them to sql.ref().
 		if (!SAFE_TABLE_NAME.test(tableName)) continue;
 
-		try {
-			// Get column info via PRAGMA
-			const pragmaResult = await sql<ColumnInfo>`
-				PRAGMA table_info(${sql.raw(`"${tableName}"`)})
-			`.execute(db);
-
-			if (pragmaResult.rows.length === 0) continue;
+		const columnInfo = await listTableColumns(db, tableName);
+		if (columnInfo.length === 0) continue;
 
-			const columns = pragmaResult.rows.map((r) => r.name);
-			const types: Record<string, string> = {};
-			for (const row of pragmaResult.rows) {
-				types[row.name] = row.type || "TEXT";
-			}
+		const columns = columnInfo.map((column) => column.name);
+		const types: Record<string, SnapshotColumnType> = {};
+		for (const column of columnInfo) {
+			types[column.name] = normalizeColumnType(column.type);
+		}
 
-			schema[tableName] = { columns, types };
+		schema[tableName] = { columns, types };
 
-			// Fetch rows
-			let rows: Record<string, unknown>[];
+		let rows: Record<string, unknown>[];
 
-			if (tableName.startsWith("ec_")) {
-				if (includeTrashed) {
-					// Everything, including trash — full-fidelity backup export
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-					`.execute(db)
-					).rows;
-				} else if (includeDrafts) {
-					// Include all non-deleted content (published, draft, scheduled)
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-						WHERE deleted_at IS NULL
-					`.execute(db)
-					).rows;
-				} else {
-					// Only export published content
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-						WHERE deleted_at IS NULL
-						AND status = 'published'
+		if (tableName.startsWith("ec_")) {
+			if (includeTrashed) {
+				rows = (
+					await sql<Record<string, unknown>>`
+						SELECT * FROM ${sql.ref(tableName)}
 					`.execute(db)
-					).rows;
-				}
-			} else if (tableName === "options") {
-				// Filter options to safe rendering-only prefixes.
-				// Excludes plugin secrets, passkey challenges, and setup state.
+				).rows;
+			} else if (includeDrafts) {
 				rows = (
 					await sql<Record<string, unknown>>`
-					SELECT * FROM ${sql.raw(`"${tableName}"`)}
-				`.execute(db)
-				).rows.filter((row) => {
-					const name = typeof row.name === "string" ? row.name : "";
-					return optionPrefixes.some((prefix) => name.startsWith(prefix));
-				});
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+					`.execute(db)
+				).rows;
 			} else {
 				rows = (
 					await sql<Record<string, unknown>>`
-					SELECT * FROM ${sql.raw(`"${tableName}"`)}
-				`.execute(db)
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+						AND status = 'published'
+					`.execute(db)
 				).rows;
 			}
+		} else if (tableName === "options") {
+			rows = (
+				await sql<Record<string, unknown>>`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)
+			).rows.filter((row) => {
+				const name = typeof row.name === "string" ? row.name : "";
+				return optionPrefixes.some((prefix) => name.startsWith(prefix));
+			});
+		} else {
+			rows = (
+				await sql<Record<string, unknown>>`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)
+			).rows;
+		}
 
-			if (rows.length > 0) {
-				tables[tableName] = rows;
-			}
-		} catch {
-			// Table might not exist yet (e.g. pre-migration) — skip silently
+		if (rows.length > 0) {
+			tables[tableName] = normalizeRows(rows, types);
 		}
 	}
 

package/src/api/handlers/taxonomies.ts

@@ -304,8 +304,8 @@ export async function handleTaxonomyList(
 /**
  * Get a single taxonomy definition by name.
  *
- * Definitions are per-locale, so `locale` picks which one; without it the
- * lowest-locale match wins (same rule as `handleMenuGet`).
+ * Definitions are per-locale, so `locale` picks which one. Without it the
+ * configured default locale wins, then the lowest locale code.
  */
 export async function handleTaxonomyGet(
 	db: Kysely<Database>,
@@ -354,12 +354,8 @@ export async function handleTaxonomyCreate(
 			};
 		}
 
-		const collections = [...new Set(input.collections ?? [])];
-		const collectionError = await validateCollections(db, collections);
-		if (collectionError) {
-			return { success: false, error: collectionError };
-		}
-
+		let hierarchical = input.hierarchical ?? false;
+		let collections = [...new Set(input.collections ?? [])];
 		let translationGroup: string | null = null;
 		if (input.translationOf) {
 			const source = await db
@@ -373,7 +369,27 @@ export async function handleTaxonomyCreate(
 					error: { code: "NOT_FOUND", message: "Source taxonomy for translation not found" },
 				};
 			}
+			if (source.name !== input.name) {
+				return {
+					success: false,
+					error: {
+						code: "VALIDATION_ERROR",
+						message: `A translation of taxonomy '${source.name}' must use the same name`,
+					},
+				};
+			}
 			translationGroup = source.translation_group ?? source.id;
+			if (input.hierarchical === undefined) {
+				hierarchical = source.hierarchical === 1;
+			}
+			if (input.collections === undefined) {
+				collections = [...new Set(defCollections(source))];
+			}
+		}
+
+		const collectionError = await validateCollections(db, collections);
+		if (collectionError) {
+			return { success: false, error: collectionError };
 		}
 
 		// Duplicate guard scoped to locale (so the same name can exist in ES
@@ -402,7 +418,7 @@ export async function handleTaxonomyCreate(
 				name: input.name,
 				label: input.label,
 				label_singular: input.labelSingular ?? null,
-				hierarchical: input.hierarchical ? 1 : 0,
+				hierarchical: hierarchical ? 1 : 0,
 				collections: JSON.stringify(collections),
 				locale,
 				translation_group: translationGroup ?? id,

package/src/api/openapi/document.ts

@@ -32,11 +32,18 @@ import {
 	contentResponseSchema,
 	contentScheduleBody,
 	contentTermsBody,
+	contentTermsResponseSchema,
 	contentTrashQuery,
 	contentTranslationsResponseSchema,
 	contentUpdateBody,
 	trashedContentListResponseSchema,
 } from "../schemas/content.js";
+import {
+	entryLockAcquireBody,
+	entryLockConflictSchema,
+	entryLockReleaseResponseSchema,
+	entryLockStatusSchema,
+} from "../schemas/entry-lock.js";
 import {
 	mediaUsageDetailsQuery,
 	mediaUsageDetailsResponseSchema,
@@ -62,6 +69,7 @@ import {
 	DEFAULT_MAX_UPLOAD_SIZE,
 	mediaConfirmBody,
 	mediaConfirmResponseSchema,
+	mediaDirectUploadBody,
 	mediaExistingResponseSchema,
 	mediaFolderBody,
 	mediaFolderIdSchema,
@@ -73,11 +81,14 @@ import {
 	mediaListReadResponseSchema,
 	mediaListResponseSchema,
 	mediaReadResponseSchema,
+	mediaReplaceBody,
+	mediaReplaceResponseSchema,
 	mediaResponseSchema,
 	mediaStreamUploadResponseSchema,
 	mediaUpdateBody,
 	mediaUploadUrlBody,
 	mediaUploadUrlResponseSchema,
+	mediaUploadResponseSchema,
 } from "../schemas/media.js";
 import {
 	createMenuBody,
@@ -170,6 +181,7 @@ import {
 // ---------------------------------------------------------------------------
 
 const JSON_CONTENT = "application/json";
+const MULTIPART_CONTENT = "multipart/form-data";
 
 /** Standard error responses shared across all authenticated endpoints */
 function standardErrors(
@@ -204,6 +216,19 @@ function standardErrors(
 /** Common auth error responses (401 + 403) */
 const authErrors = standardErrors(401, 403);
 
+const entryPathParams = z.object({
+	collection: z.string().meta({ description: "Collection slug" }),
+	id: z.string().meta({ description: "Content ID or slug" }),
+});
+
+/** 409 that carries the edit lock's holder in `error.details` */
+const entryLockConflict = {
+	"409": {
+		description: "Another editor holds the entry's edit lock",
+		content: { [JSON_CONTENT]: { schema: entryLockConflictSchema } },
+	},
+};
+
 // ---------------------------------------------------------------------------
 // Content routes
 // ---------------------------------------------------------------------------
@@ -217,7 +242,7 @@ const contentPaths = {
 			tags: ["Content"],
 			requestParams: {
 				path: z.object({
-					collection: z.string().meta({ description: "Collection slug", example: "posts" }),
+					collection: z.string().meta({ description: "Collection slug", examples: ["posts"] }),
 				}),
 				query: contentListQuery,
 			},
@@ -324,9 +349,12 @@ const contentPaths = {
 				"Moves the content item to trash. Use the permanent delete endpoint to remove permanently.",
 			tags: ["Content"],
 			requestParams: {
-				path: z.object({
-					collection: z.string().meta({ description: "Collection slug" }),
-					id: z.string().meta({ description: "Content ID or slug" }),
+				path: entryPathParams,
+				query: z.object({
+					overrideLock: z.enum(["true", "false"]).optional().meta({
+						description:
+							"Delete even though another editor holds this entry's edit lock. Without it the delete is refused with 409 ENTRY_LOCKED.",
+					}),
 				}),
 			},
 			responses: {
@@ -340,6 +368,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -366,6 +395,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -393,6 +423,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -422,6 +453,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(400, 404, 500),
+				...entryLockConflict,
 			},
 		},
 		delete: {
@@ -430,9 +462,12 @@ const contentPaths = {
 			description: "Reverts a scheduled item to draft status.",
 			tags: ["Content"],
 			requestParams: {
-				path: z.object({
-					collection: z.string().meta({ description: "Collection slug" }),
-					id: z.string().meta({ description: "Content ID or slug" }),
+				path: entryPathParams,
+				query: z.object({
+					overrideLock: z.enum(["true", "false"]).optional().meta({
+						description:
+							"Unschedule even though another editor holds this entry's edit lock. Without it the request is refused with 409 ENTRY_LOCKED.",
+					}),
 				}),
 			},
 			responses: {
@@ -446,6 +481,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -578,6 +614,81 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
+			},
+		},
+	},
+
+	"/_emdash/api/content/{collection}/{id}/lock": {
+		get: {
+			operationId: "getEntryLock",
+			summary: "Read the entry's edit lock",
+			description: "Reports who is holding the entry, if anyone, without changing the lease.",
+			tags: ["Content"],
+			requestParams: {
+				path: entryPathParams,
+			},
+			responses: {
+				"200": {
+					description: "Current lock state",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(entryLockStatusSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(404, 500),
+			},
+		},
+		post: {
+			operationId: "acquireEntryLock",
+			summary: "Take or refresh the entry's edit lock",
+			description:
+				"Takes the lock for the caller, or reports who holds it. `heldByCaller` " +
+				"tells the two apart. The lease lasts seven minutes; repeating this call " +
+				"and every save on the entry extend it. `takeover` claims the lock from " +
+				"whoever holds it; their next heartbeat or save reports the new holder.",
+			tags: ["Content"],
+			requestParams: {
+				path: entryPathParams,
+			},
+			requestBody: {
+				content: { [JSON_CONTENT]: { schema: entryLockAcquireBody } },
+			},
+			responses: {
+				"200": {
+					description: "Lock state after the attempt",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(entryLockStatusSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(404, 500),
+			},
+		},
+		delete: {
+			operationId: "releaseEntryLock",
+			summary: "Release the caller's edit lock",
+			description:
+				"Releases the lock only when the caller holds it; `released` is false otherwise.",
+			tags: ["Content"],
+			requestParams: {
+				path: entryPathParams,
+				query: z.object({
+					token: z.string().optional().meta({
+						description:
+							"The session token sent on acquire. With it, only the tab that last claimed the lock releases it.",
+					}),
+				}),
+			},
+			responses: {
+				"200": {
+					description: "Whether a lock was released",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(entryLockReleaseResponseSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(404, 500),
 			},
 		},
 	},
@@ -608,15 +719,44 @@ const contentPaths = {
 		},
 	},
 
-	"/_emdash/api/content/{collection}/{id}/terms": {
-		put: {
+	"/_emdash/api/content/{collection}/{id}/terms/{taxonomy}": {
+		get: {
+			operationId: "getContentTerms",
+			summary: "Get taxonomy terms assigned to a content item",
+			description:
+				"Returns the terms of one taxonomy that are assigned to the content item, resolved to the item's locale with fallback to the site default.",
+			tags: ["Content"],
+			requestParams: {
+				path: z.object({
+					collection: z.string().meta({ description: "Collection slug" }),
+					id: z.string().meta({ description: "Content ID or slug" }),
+					taxonomy: z.string().meta({ description: "Taxonomy name" }),
+				}),
+			},
+			responses: {
+				"200": {
+					description: "Terms assigned to the content item",
+					content: {
+						[JSON_CONTENT]: {
+							schema: successEnvelope(contentTermsResponseSchema),
+						},
+					},
+				},
+				...authErrors,
+				...standardErrors(400, 404, 500),
+			},
+		},
+		post: {
 			operationId: "setContentTerms",
 			summary: "Set taxonomy terms on a content item",
+			description:
+				"Assign a set of terms to the content item for the named taxonomy, replacing any existing assignments for that taxonomy. Every term id must belong to the named taxonomy.",
 			tags: ["Content"],
 			requestParams: {
 				path: z.object({
 					collection: z.string().meta({ description: "Collection slug" }),
 					id: z.string().meta({ description: "Content ID or slug" }),
+					taxonomy: z.string().meta({ description: "Taxonomy name" }),
 				}),
 			},
 			requestBody: {
@@ -627,7 +767,7 @@ const contentPaths = {
 					description: "Terms updated",
 					content: {
 						[JSON_CONTENT]: {
-							schema: successEnvelope(z.object({ termIds: z.array(z.string()) })),
+							schema: successEnvelope(contentTermsResponseSchema),
 						},
 					},
 				},
@@ -713,6 +853,27 @@ function buildMediaPaths(maxUploadSize: number) {
 					...standardErrors(400, 500),
 				},
 			},
+			post: {
+				operationId: "uploadMedia",
+				summary: "Upload a media item",
+				tags: ["Media"],
+				requestBody: {
+					required: true,
+					content: { [MULTIPART_CONTENT]: { schema: mediaDirectUploadBody } },
+				},
+				responses: {
+					"200": {
+						description: "Existing deduplicated media item",
+						content: { [JSON_CONTENT]: { schema: successEnvelope(mediaUploadResponseSchema) } },
+					},
+					"201": {
+						description: "Created media item",
+						content: { [JSON_CONTENT]: { schema: successEnvelope(mediaUploadResponseSchema) } },
+					},
+					...authErrors,
+					...standardErrors(400, 413, 500),
+				},
+			},
 		},
 		"/_emdash/api/media/folders": {
 			get: {
@@ -883,6 +1044,30 @@ function buildMediaPaths(maxUploadSize: number) {
 				},
 			},
 		},
+		"/_emdash/api/media/{id}/replace": {
+			put: {
+				operationId: "replaceMediaImage",
+				summary: "Replace a media image",
+				description:
+					"Overwrites a ready local image under its existing storage key and refreshes its file metadata while preserving its media ID, filename, and URL. The replacement may use different dimensions or an aspect ratio from the original.",
+				tags: ["Media"],
+				requestParams: {
+					path: z.object({ id: z.string().meta({ description: "Media ID" }) }),
+				},
+				requestBody: {
+					required: true,
+					content: { [MULTIPART_CONTENT]: { schema: mediaReplaceBody } },
+				},
+				responses: {
+					"200": {
+						description: "Replaced media item",
+						content: { [JSON_CONTENT]: { schema: successEnvelope(mediaReplaceResponseSchema) } },
+					},
+					...authErrors,
+					...standardErrors(400, 404, 413, 500),
+				},
+			},
+		},
 		"/_emdash/api/admin/media-usage/repair": {
 			post: {
 				operationId: "repairMediaUsage",
@@ -1648,7 +1833,7 @@ const taxonomyPaths = {
 			operationId: "getTaxonomy",
 			summary: "Get a taxonomy definition",
 			description:
-				"Definitions are per-locale; `locale` picks one, and without it the lowest-locale match is returned.",
+				"Definitions are per-locale; `locale` picks one. Without it the configured default locale is returned, falling back to the lowest locale code.",
 			tags: ["Taxonomies"],
 			requestParams: {
 				path: z.object({ name: z.string().meta({ description: "Taxonomy name" }) }),

package/src/api/parse.ts

@@ -108,7 +108,7 @@ function validate<T extends z.ZodType>(schema: T, data: unknown): ParseResult<z.
 	}
 
 	// Format Zod errors into a readable structure
-	const issues = result.error.issues.map((issue: z.ZodIssue) => ({
+	const issues = result.error.issues.map((issue: z.core.$ZodIssue) => ({
 		path: issue.path.join("."),
 		message: issue.message,
 	}));