emdash 0.36.0 → 0.38.0

package/src/astro/routes/api/content/[collection]/[id]/lock.ts

@@ -0,0 +1,133 @@
+/**
+ * Entry edit lock
+ *
+ * GET    /_emdash/api/content/{collection}/{id}/lock - Read the current holder
+ * POST   /_emdash/api/content/{collection}/{id}/lock - Take or refresh the lock
+ * DELETE /_emdash/api/content/{collection}/{id}/lock - Release the caller's lock
+ */
+
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm } from "#api/authorize.js";
+import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import {
+	handleEntryLockAcquire,
+	handleEntryLockRead,
+	handleEntryLockRelease,
+} from "#api/handlers/entry-lock.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { entryLockAcquireBody } from "#api/schemas.js";
+
+export const prerender = false;
+
+interface ResolvedEntry {
+	resolvedId: string;
+	userId: string;
+}
+
+/**
+ * Resolves the entry the way every other single-entry route does, and applies
+ * the same edit permission, since holding a lock is the prelude to a write.
+ */
+async function resolveEntry(
+	locals: App.Locals,
+	collection: string,
+	id: string,
+	locale: string | undefined,
+): Promise<ResolvedEntry | Response> {
+	const { emdash, user } = locals;
+	if (!emdash?.handleContentGet) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+
+	const existing = await emdash.handleContentGet(collection, id, locale);
+	if (!existing.success) {
+		return apiError(
+			existing.error?.code ?? "UNKNOWN_ERROR",
+			existing.error?.message ?? "Unknown error",
+			mapErrorStatus(existing.error?.code),
+		);
+	}
+
+	const existingData =
+		existing.data && typeof existing.data === "object"
+			? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- handler returns unknown data; narrowed by typeof check above
+				(existing.data as Record<string, unknown>)
+			: undefined;
+	const existingItem =
+		existingData?.item && typeof existingData.item === "object"
+			? // eslint-disable-next-line typescript/no-unsafe-type-assertion -- narrowed by typeof check above
+				(existingData.item as Record<string, unknown>)
+			: existingData;
+	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
+	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	if (denied) return denied;
+
+	return {
+		resolvedId: typeof existingItem?.id === "string" ? existingItem.id : id,
+		userId: user!.id,
+	};
+}
+
+export const GET: APIRoute = async ({ params, locals, url }) => {
+	const collection = params.collection!;
+	const id = params.id!;
+	const resolved = await resolveEntry(
+		locals,
+		collection,
+		id,
+		url.searchParams.get("locale") || undefined,
+	);
+	if (resolved instanceof Response) return resolved;
+
+	return unwrapResult(
+		await handleEntryLockRead(locals.emdash.db, collection, resolved.resolvedId, resolved.userId),
+	);
+};
+
+export const POST: APIRoute = async ({ params, request, locals, url }) => {
+	const collection = params.collection!;
+	const id = params.id!;
+	const body = await parseOptionalBody(request, entryLockAcquireBody, {});
+	if (isParseError(body)) return body;
+
+	const resolved = await resolveEntry(
+		locals,
+		collection,
+		id,
+		url.searchParams.get("locale") || undefined,
+	);
+	if (resolved instanceof Response) return resolved;
+
+	return unwrapResult(
+		await handleEntryLockAcquire(
+			locals.emdash.db,
+			collection,
+			resolved.resolvedId,
+			resolved.userId,
+			{ takeover: body?.takeover, token: body?.token },
+		),
+	);
+};
+
+export const DELETE: APIRoute = async ({ params, locals, url }) => {
+	const collection = params.collection!;
+	const id = params.id!;
+	const resolved = await resolveEntry(
+		locals,
+		collection,
+		id,
+		url.searchParams.get("locale") || undefined,
+	);
+	if (resolved instanceof Response) return resolved;
+
+	return unwrapResult(
+		await handleEntryLockRelease(
+			locals.emdash.db,
+			collection,
+			resolved.resolvedId,
+			resolved.userId,
+			{ token: url.searchParams.get("token") ?? undefined },
+		),
+	);
+};

package/src/astro/routes/api/content/[collection]/[id]/publish.ts

@@ -3,7 +3,7 @@
  *
  * POST /_emdash/api/content/{collection}/{id}/publish
  *
- * Optional JSON body: { publishedAt?: string }
+ * Optional JSON body: { publishedAt?: string, _rev?: string, overrideLock?: boolean }
  *   publishedAt — ISO 8601 datetime to backdate the publish (e.g. when
  *   migrating content). Writing publishedAt requires content:publish_any.
  *   Without it, the existing published_at is preserved on re-publish and
@@ -15,6 +15,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentPublishBody } from "#api/schemas.js";
 
@@ -76,8 +77,18 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body?.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentPublish(collection, resolvedId, {
 		publishedAt,
+		_rev: body?._rev,
 	});
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -9,6 +9,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentScheduleBody } from "#api/schemas.js";
 
@@ -61,6 +62,15 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
 	if (denied) return denied;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId ?? id, user!.id, {
+		override: body.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentSchedule(collection, resolvedId ?? id, body.scheduledAt);
 
 	if (!result.success) return unwrapResult(result);
@@ -95,6 +105,16 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 	const denied = requireOwnerPerm(user, authorId, "content:publish_own", "content:publish_any");
 	if (denied) return denied;
 
+	// DELETE carries no body, so the lock opt-out rides on the query string.
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId ?? id, user!.id, {
+		override: url.searchParams.get("overrideLock") === "true",
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentUnschedule(collection, resolvedId ?? id);
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/[id]/unpublish.ts

@@ -8,10 +8,13 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
+import { isParseError, parseOptionalBody } from "#api/parse.js";
+import { contentRevisionConditionBody } from "#api/schemas.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals, url, cache }) => {
+export const POST: APIRoute = async ({ params, request, locals, url, cache }) => {
 	const { emdash, user } = locals;
 	const collection = params.collection!;
 	const id = params.id!;
@@ -19,6 +22,8 @@ export const POST: APIRoute = async ({ params, locals, url, cache }) => {
 	if (!emdash?.handleContentUnpublish || !emdash?.handleContentGet) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
 	}
+	const body = await parseOptionalBody(request, contentRevisionConditionBody, {});
+	if (isParseError(body)) return body;
 
 	const locale = url.searchParams.get("locale") || undefined;
 
@@ -48,7 +53,16 @@ export const POST: APIRoute = async ({ params, locals, url, cache }) => {
 
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
-	const result = await emdash.handleContentUnpublish(collection, resolvedId);
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body?.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
+	const result = await emdash.handleContentUnpublish(collection, resolvedId, { _rev: body?._rev });
 
 	if (!result.success) return unwrapResult(result);
 

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -11,6 +11,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentUpdateBody } from "#api/schemas.js";
 
@@ -112,16 +113,30 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 	// Use the resolved ID (handles slug → ID resolution)
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: body.overrideLock,
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	// Only allow authorId changes if user has content:edit_any permission (editor+)
 	const canChangeAuthor =
 		body.authorId !== undefined && user && hasPermission(user, "content:edit_any");
-	const updateBody = canChangeAuthor ? body : { ...body, authorId: undefined };
+	const { overrideLock: _overrideLock, ...writeBody } = canChangeAuthor
+		? body
+		: { ...body, authorId: undefined };
+
+	const actor = user ? { id: user.id, role: user.role } : undefined;
 
 	// Pass _rev through for optimistic concurrency validation
 	const result = await emdash.handleContentUpdate(collection, resolvedId, {
-		...updateBody,
+		...writeBody,
 		locale,
 		_rev: body._rev,
+		actor,
 	});
 
 	if (!result.success) return unwrapResult(result);
@@ -172,6 +187,16 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 	// Use the resolved ID (handles slug → ID resolution)
 	const resolvedId = typeof deleteItem?.id === "string" ? deleteItem.id : id;
 
+	// DELETE carries no body, so the lock opt-out rides on the query string.
+	const refusal = await claimEntryLockForWrite(emdash.db, collection, resolvedId, user!.id, {
+		override: url.searchParams.get("overrideLock") === "true",
+	});
+	if (refusal) {
+		return apiError(refusal.code, refusal.message, mapErrorStatus(refusal.code), {
+			...refusal.details,
+		});
+	}
+
 	const result = await emdash.handleContentDelete(collection, resolvedId);
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/content/[collection]/index.ts

@@ -79,12 +79,15 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 		);
 	}
 
+	const actor = user ? { id: user.id, role: user.role } : undefined;
+
 	// Auto-set authorId to current user when creating content
 	const result = await emdash.handleContentCreate(collection, {
 		...body,
 		authorId: user?.id,
 		locale: body.locale,
 		translationOf: body.translationOf,
+		actor,
 	});
 
 	if (!result.success) return unwrapResult(result);

package/src/astro/routes/api/manifest.ts

@@ -4,7 +4,7 @@
  * GET /_emdash/api/manifest
  *
  * Returns the admin manifest with collection definitions and plugin info.
- * The manifest is generated from the user's live.config.ts at runtime.
+ * The manifest is generated from live database schema plus runtime plugin state.
  */
 
 import type { APIRoute } from "astro";

package/src/astro/routes/api/media/[id]/replace.ts

@@ -0,0 +1,114 @@
+import type { APIRoute } from "astro";
+
+import { requireOwnerPerm, requirePerm } from "#api/authorize.js";
+import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
+import { DEFAULT_MAX_UPLOAD_SIZE, mediaReplaceMetadataForm } from "#api/schemas.js";
+import { MUTABLE_MEDIA_CACHE_CONTROL } from "#media/image-endpoint.js";
+import { normalizeMime } from "#media/mime.js";
+import { computeContentHash } from "#utils/hash.js";
+
+export const prerender = false;
+
+const REPLACEABLE_IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp"]);
+
+export const PUT: APIRoute = async ({ params, request, locals }) => {
+	const { emdash, user } = locals;
+	const { id } = params;
+
+	const editDenied = requirePerm(user, "media:edit_own");
+	if (editDenied) return editDenied;
+	if (!id) return apiError("INVALID_REQUEST", "Media ID required", 400);
+	if (!emdash?.handleMediaGet || !emdash?.handleMediaReplaceMetadata) {
+		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
+	}
+	if (!emdash.storage) return apiError("NO_STORAGE", "Storage not configured", 500);
+
+	const getResult = await emdash.handleMediaGet(id);
+	if (!getResult.success) return unwrapResult(getResult);
+	const media = getResult.data.item;
+	const ownerDenied = requireOwnerPerm(
+		user,
+		media.authorId ?? "",
+		"media:edit_own",
+		"media:edit_any",
+	);
+	if (ownerDenied) return ownerDenied;
+	if (media.status !== "ready") {
+		return apiError("INVALID_STATE", "Only ready media can be replaced", 400);
+	}
+
+	const sourceMime = normalizeMime(media.mimeType);
+	if (!REPLACEABLE_IMAGE_TYPES.has(sourceMime)) {
+		return apiError("INVALID_TYPE", "Media type cannot be replaced", 400);
+	}
+
+	const rawMax = emdash.config.maxUploadSize ?? DEFAULT_MAX_UPLOAD_SIZE;
+	if (!Number.isFinite(rawMax) || rawMax <= 0) {
+		return apiError("CONFIGURATION_ERROR", "Invalid maxUploadSize configuration", 500);
+	}
+	const maxUploadSize = rawMax;
+	const contentLength = request.headers.get("Content-Length");
+	if (contentLength && parseInt(contentLength, 10) > maxUploadSize) {
+		return apiError("PAYLOAD_TOO_LARGE", "Upload too large", 413);
+	}
+
+	try {
+		const formData = await request.formData();
+		const fileEntry = formData.get("file");
+		const file = fileEntry instanceof File ? fileEntry : null;
+		if (!file) return apiError("NO_FILE", "No file provided", 400);
+		if (file.size === 0) return apiError("VALIDATION_ERROR", "Replacement file is empty", 400);
+		if (file.size > maxUploadSize) {
+			return apiError("PAYLOAD_TOO_LARGE", "Upload too large", 413);
+		}
+
+		const replacementMime = normalizeMime(file.type);
+		if (!REPLACEABLE_IMAGE_TYPES.has(replacementMime) || replacementMime !== sourceMime) {
+			return apiError("INVALID_TYPE", "Replacement file type must match the media item", 400);
+		}
+
+		const metadataResult = mediaReplaceMetadataForm.safeParse({
+			width: formData.get("width"),
+			height: formData.get("height"),
+		});
+		if (!metadataResult.success) {
+			return apiError("VALIDATION_ERROR", "Invalid request data", 400, {
+				issues: metadataResult.error.issues.map((issue) => ({
+					path: issue.path.join("."),
+					message: issue.message,
+				})),
+			});
+		}
+		const { width, height } = metadataResult.data;
+
+		const bytes = new Uint8Array(await file.arrayBuffer());
+		const contentHash = await computeContentHash(bytes);
+		try {
+			await emdash.storage.upload({
+				key: media.storageKey,
+				body: bytes,
+				contentType: sourceMime,
+				cacheControl: MUTABLE_MEDIA_CACHE_CONTROL,
+			});
+		} catch (error) {
+			return handleError(error, "Failed to replace media", "MEDIA_REPLACE_ERROR");
+		}
+
+		const result = await emdash.handleMediaReplaceMetadata(id, media.storageKey, {
+			size: file.size,
+			width,
+			height,
+			contentHash,
+		});
+		if (!result.success) return unwrapResult(result);
+
+		return apiSuccess({
+			item: {
+				...result.data.item,
+				url: `/_emdash/api/media/file/${result.data.item.storageKey}`,
+			},
+		});
+	} catch (error) {
+		return handleError(error, "Failed to replace media", "MEDIA_REPLACE_ERROR");
+	}
+};

package/src/astro/routes/api/media/file/[...key].ts

@@ -7,6 +7,7 @@
 import type { APIRoute } from "astro";
 
 import { apiError, handleError } from "#api/error.js";
+import { IMMUTABLE_IMAGE_CACHE, MUTABLE_MEDIA_CACHE_CONTROL } from "#media/image-endpoint.js";
 
 export const prerender = false;
 
@@ -53,7 +54,9 @@ export const GET: APIRoute = async ({ params, locals }) => {
 
 		const headers: Record<string, string> = {
 			"Content-Type": result.contentType,
-			"Cache-Control": "public, max-age=31536000, immutable",
+			"Cache-Control": result.contentType.startsWith("image/")
+				? MUTABLE_MEDIA_CACHE_CONTROL
+				: IMMUTABLE_IMAGE_CACHE,
 			"X-Content-Type-Options": "nosniff",
 			// Sandbox CSP on all user-uploaded content — prevents script execution
 			// even for SVGs navigated to directly or content types that support scripting.

package/src/astro/routes/api/media/upload-url.ts

@@ -10,7 +10,6 @@
 import * as path from "node:path";
 
 import type { APIRoute } from "astro";
-import { MediaRepository } from "emdash";
 import { ulid } from "ulidx";
 
 import { requirePerm } from "#api/authorize.js";
@@ -18,6 +17,7 @@ import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from "#api/handlers/media-allowlist.js";
 import { isParseError, parseBody } from "#api/parse.js";
 import { DEFAULT_MAX_UPLOAD_SIZE, mediaUploadUrlBody } from "#api/schemas.js";
+import { MediaRepository } from "#db/repositories/media.js";
 import { matchesMimeAllowlist, normalizeMime } from "#media/mime.js";
 
 export const prerender = false;
@@ -90,7 +90,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		const repo = new MediaRepository(emdash.db);
 
 		// Check for existing content with same hash (deduplication)
-		if (body.contentHash && body.size > 0) {
+		if (body.deduplicate !== false && body.contentHash && body.size > 0) {
 			const existing = await repo.findByContentHash(body.contentHash);
 			if (existing && existing.mimeType === normalizedContentType && existing.size === body.size) {
 				const response: ExistingMediaResponse = {
@@ -102,10 +102,13 @@ export const POST: APIRoute = async ({ request, locals }) => {
 				return apiSuccess(response);
 			}
 		}
+		const filename = body.ensureUniqueFilename
+			? await repo.findAvailableFilename(body.filename)
+			: body.filename;
 
 		// Generate unique storage key
 		const id = ulid();
-		const ext = path.extname(body.filename) || "";
+		const ext = path.extname(filename) || "";
 		const storageKey = `${id}${ext}`;
 
 		let signedUrl: Awaited<ReturnType<typeof emdash.storage.getSignedUploadUrl>> | null;
@@ -122,11 +125,12 @@ export const POST: APIRoute = async ({ request, locals }) => {
 		}
 
 		const mediaItem = await repo.createPending({
-			filename: body.filename,
+			filename,
 			mimeType: normalizedContentType,
 			size: body.size,
 			storageKey,
 			authorId: user?.id,
+			folderId: body.folderId,
 		});
 
 		const response: UploadUrlResponse = {

package/src/astro/routes/api/media.ts

@@ -15,7 +15,14 @@ import { apiError, apiSuccess, handleError, unwrapResult } from "#api/error.js";
 import { GLOBAL_UPLOAD_ALLOWLIST, resolveFieldAllowlist } from "#api/handlers/media-allowlist.js";
 import { handleMediaUsageSummaries } from "#api/handlers/media-usage.js";
 import { isParseError, parseQuery } from "#api/parse.js";
-import { DEFAULT_MAX_UPLOAD_SIZE, formatFileSize, mediaListQuery } from "#api/schemas.js";
+import {
+	DEFAULT_MAX_UPLOAD_SIZE,
+	formatFileSize,
+	mediaFolderIdSchema,
+	mediaListQuery,
+	mediaUploadDeduplicateForm,
+	mediaUploadEnsureUniqueFilenameForm,
+} from "#api/schemas.js";
 import { MediaRepository } from "#db/repositories/media.js";
 import { enrichImageMetadata } from "#media/enrich.js";
 import { matchesMimeAllowlist, normalizeMime } from "#media/mime.js";
@@ -138,6 +145,40 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			return apiError("NO_FILE", "No file provided", 400);
 		}
 
+		const deduplicateResult = mediaUploadDeduplicateForm.safeParse(
+			formData.get("deduplicate") ?? undefined,
+		);
+		if (!deduplicateResult.success) {
+			return apiError("VALIDATION_ERROR", "Invalid request data", 400, {
+				issues: deduplicateResult.error.issues.map((issue) => ({
+					path: "deduplicate",
+					message: issue.message,
+				})),
+			});
+		}
+		const ensureUniqueFilenameResult = mediaUploadEnsureUniqueFilenameForm.safeParse(
+			formData.get("ensureUniqueFilename") ?? undefined,
+		);
+		if (!ensureUniqueFilenameResult.success) {
+			return apiError("VALIDATION_ERROR", "Invalid request data", 400);
+		}
+		const folderEntry = formData.get("folderId");
+		let folderId: string | null | undefined;
+		if (folderEntry !== null) {
+			if (typeof folderEntry !== "string") {
+				return apiError("VALIDATION_ERROR", "Invalid request data", 400);
+			}
+			if (folderEntry === "unfiled") {
+				folderId = null;
+			} else {
+				const folderResult = mediaFolderIdSchema.safeParse(folderEntry);
+				if (!folderResult.success) {
+					return apiError("VALIDATION_ERROR", "Invalid request data", 400);
+				}
+				folderId = folderResult.data;
+			}
+		}
+
 		// Validate file type — widen the allowlist when a field-specific list is configured
 		const fieldIdEntry = formData.get("fieldId");
 		const fieldId =
@@ -165,16 +206,20 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 		// Check for existing media with same content hash (deduplication)
 		const repo = new MediaRepository(emdash.db);
-		const existing = await repo.findByContentHash(contentHash);
-		if (existing) {
-			// Same content already exists - return existing item
-			const itemWithUrl = addUrlToMedia(existing);
-			return apiSuccess({ item: itemWithUrl, deduplicated: true });
+		if (deduplicateResult.data) {
+			const existing = await repo.findByContentHash(contentHash);
+			if (existing) {
+				const itemWithUrl = addUrlToMedia(existing);
+				return apiSuccess({ item: itemWithUrl, deduplicated: true });
+			}
 		}
+		const filename = ensureUniqueFilenameResult.data
+			? await repo.findAvailableFilename(file.name)
+			: file.name;
 
 		// Generate unique storage key
 		const id = ulid();
-		const ext = path.extname(file.name) || "";
+		const ext = path.extname(filename) || "";
 		const storageKey = `${id}${ext}`;
 
 		// Upload to storage using the configured adapter
@@ -206,7 +251,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 
 		// Create media record
 		const result = await emdash.handleMediaCreate({
-			filename: file.name,
+			filename,
 			mimeType: normalizeMime(file.type),
 			size: file.size,
 			// Client dimensions win over server header dimensions: the browser's
@@ -219,6 +264,7 @@ export const POST: APIRoute = async ({ request, locals }) => {
 			blurhash: enriched.blurhash,
 			dominantColor: enriched.dominantColor,
 			authorId: user?.id,
+			folderId,
 		});
 
 		if (!result.success) {

package/src/astro/routes/api/menus/[name]/items/[id].ts

@@ -12,10 +12,11 @@ import { apiError, handleError, unwrapResult } from "#api/error.js";
 import { handleMenuItemDelete, handleMenuItemUpdate } from "#api/handlers/menus.js";
 import { isParseError, parseBody, parseQuery } from "#api/parse.js";
 import { localeFilterQuery, updateMenuItemBody } from "#api/schemas.js";
+import { menuTag } from "#cache/chrome-tags.js";
 
 export const prerender = false;
 
-export const PUT: APIRoute = async ({ params, request, locals }) => {
+export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 	const { emdash, user } = locals;
 	const name = params.name!;
 	const itemId = params.id;
@@ -37,13 +38,15 @@ export const PUT: APIRoute = async ({ params, request, locals }) => {
 		const result = await handleMenuItemUpdate(emdash.db, name, itemId, body, {
 			locale: localeQ.locale,
 		});
+		if (!result.success) return unwrapResult(result);
+		if (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to update menu item", "MENU_ITEM_UPDATE_ERROR");
 	}
 };
 
-export const DELETE: APIRoute = async ({ params, request, locals }) => {
+export const DELETE: APIRoute = async ({ params, request, locals, cache }) => {
 	const { emdash, user } = locals;
 	const name = params.name!;
 	const itemId = params.id;
@@ -62,6 +65,8 @@ export const DELETE: APIRoute = async ({ params, request, locals }) => {
 		const result = await handleMenuItemDelete(emdash.db, name, itemId, {
 			locale: localeQ.locale,
 		});
+		if (!result.success) return unwrapResult(result);
+		if (cache?.enabled) await cache.invalidate({ tags: [menuTag(name)] });
 		return unwrapResult(result);
 	} catch (error) {
 		return handleError(error, "Failed to delete menu item", "MENU_ITEM_DELETE_ERROR");