emdash 0.37.0 → 0.38.0

package/src/api/handlers/snapshot.ts

@@ -12,6 +12,7 @@
 import type { Kysely } from "kysely";
 import { sql } from "kysely";
 
+import { listTableColumns, listTablesLike } from "../../database/dialect-helpers.js";
 import type { Database } from "../../database/types.js";
 
 // ─�� Preview signature verification ──────────────────────────────
@@ -211,10 +212,44 @@ function isExcluded(tableName: string): boolean {
 	return EXCLUDED_PREFIXES.some((prefix) => tableName.startsWith(prefix));
 }
 
-/** Column info from PRAGMA table_info */
-interface ColumnInfo {
-	name: string;
-	type: string;
+type SnapshotColumnType = "TEXT" | "INTEGER" | "REAL" | "BLOB" | "JSON";
+
+function normalizeColumnType(type: string): SnapshotColumnType {
+	switch (type.toLowerCase()) {
+		case "smallint":
+		case "integer":
+		case "bigint":
+		case "boolean":
+			return "INTEGER";
+		case "real":
+		case "double precision":
+		case "numeric":
+		case "decimal":
+			return "REAL";
+		case "blob":
+		case "bytea":
+			return "BLOB";
+		case "json":
+		case "jsonb":
+			return "JSON";
+		default:
+			return "TEXT";
+	}
+}
+
+function normalizeRows(
+	rows: Record<string, unknown>[],
+	types: Record<string, SnapshotColumnType>,
+): Record<string, unknown>[] {
+	for (const row of rows) {
+		for (const [column, type] of Object.entries(types)) {
+			const value = row[column];
+			if (type === "JSON" && value !== null && value !== undefined && typeof value !== "string") {
+				row[column] = JSON.stringify(value);
+			}
+		}
+	}
+	return rows;
 }
 
 export interface GenerateSnapshotOptions {
@@ -247,15 +282,7 @@ export async function generateSnapshot(
 	const includeTrashed = options?.includeTrashed ?? false;
 	const optionPrefixes = options?.optionPrefixes ?? SAFE_OPTIONS_PREFIXES;
 
-	// Discover all ec_* content tables
-	const tableResult = await sql<{ name: string }>`
-		SELECT name FROM sqlite_master
-		WHERE type = 'table'
-		AND name LIKE 'ec_%'
-		ORDER BY name
-	`.execute(db);
-
-	const contentTables = tableResult.rows.map((r) => r.name);
+	const contentTables = await listTablesLike(db, "ec_%");
 
 	// Build list of all tables to export
 	const allTables = [...contentTables, ...SYSTEM_TABLES];
@@ -266,80 +293,65 @@ export async function generateSnapshot(
 	for (const tableName of allTables) {
 		if (isExcluded(tableName)) continue;
 
-		// Validate identifier before interpolating into sql.raw().
-		// SYSTEM_TABLES are hardcoded and safe, but ec_* names come from
-		// sqlite_master and must be validated.
+		// Content table names come from the database catalog. Validate them
+		// before passing them to sql.ref().
 		if (!SAFE_TABLE_NAME.test(tableName)) continue;
 
-		try {
-			// Get column info via PRAGMA
-			const pragmaResult = await sql<ColumnInfo>`
-				PRAGMA table_info(${sql.raw(`"${tableName}"`)})
-			`.execute(db);
-
-			if (pragmaResult.rows.length === 0) continue;
+		const columnInfo = await listTableColumns(db, tableName);
+		if (columnInfo.length === 0) continue;
 
-			const columns = pragmaResult.rows.map((r) => r.name);
-			const types: Record<string, string> = {};
-			for (const row of pragmaResult.rows) {
-				types[row.name] = row.type || "TEXT";
-			}
+		const columns = columnInfo.map((column) => column.name);
+		const types: Record<string, SnapshotColumnType> = {};
+		for (const column of columnInfo) {
+			types[column.name] = normalizeColumnType(column.type);
+		}
 
-			schema[tableName] = { columns, types };
+		schema[tableName] = { columns, types };
 
-			// Fetch rows
-			let rows: Record<string, unknown>[];
+		let rows: Record<string, unknown>[];
 
-			if (tableName.startsWith("ec_")) {
-				if (includeTrashed) {
-					// Everything, including trash — full-fidelity backup export
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-					`.execute(db)
-					).rows;
-				} else if (includeDrafts) {
-					// Include all non-deleted content (published, draft, scheduled)
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-						WHERE deleted_at IS NULL
-					`.execute(db)
-					).rows;
-				} else {
-					// Only export published content
-					rows = (
-						await sql<Record<string, unknown>>`
-						SELECT * FROM ${sql.raw(`"${tableName}"`)}
-						WHERE deleted_at IS NULL
-						AND status = 'published'
+		if (tableName.startsWith("ec_")) {
+			if (includeTrashed) {
+				rows = (
+					await sql<Record<string, unknown>>`
+						SELECT * FROM ${sql.ref(tableName)}
 					`.execute(db)
-					).rows;
-				}
-			} else if (tableName === "options") {
-				// Filter options to safe rendering-only prefixes.
-				// Excludes plugin secrets, passkey challenges, and setup state.
+				).rows;
+			} else if (includeDrafts) {
 				rows = (
 					await sql<Record<string, unknown>>`
-					SELECT * FROM ${sql.raw(`"${tableName}"`)}
-				`.execute(db)
-				).rows.filter((row) => {
-					const name = typeof row.name === "string" ? row.name : "";
-					return optionPrefixes.some((prefix) => name.startsWith(prefix));
-				});
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+					`.execute(db)
+				).rows;
 			} else {
 				rows = (
 					await sql<Record<string, unknown>>`
-					SELECT * FROM ${sql.raw(`"${tableName}"`)}
-				`.execute(db)
+						SELECT * FROM ${sql.ref(tableName)}
+						WHERE deleted_at IS NULL
+						AND status = 'published'
+					`.execute(db)
 				).rows;
 			}
+		} else if (tableName === "options") {
+			rows = (
+				await sql<Record<string, unknown>>`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)
+			).rows.filter((row) => {
+				const name = typeof row.name === "string" ? row.name : "";
+				return optionPrefixes.some((prefix) => name.startsWith(prefix));
+			});
+		} else {
+			rows = (
+				await sql<Record<string, unknown>>`
+					SELECT * FROM ${sql.ref(tableName)}
+				`.execute(db)
+			).rows;
+		}
 
-			if (rows.length > 0) {
-				tables[tableName] = rows;
-			}
-		} catch {
-			// Table might not exist yet (e.g. pre-migration) — skip silently
+		if (rows.length > 0) {
+			tables[tableName] = normalizeRows(rows, types);
 		}
 	}
 

package/src/api/handlers/taxonomies.ts

@@ -369,6 +369,15 @@ export async function handleTaxonomyCreate(
 					error: { code: "NOT_FOUND", message: "Source taxonomy for translation not found" },
 				};
 			}
+			if (source.name !== input.name) {
+				return {
+					success: false,
+					error: {
+						code: "VALIDATION_ERROR",
+						message: `A translation of taxonomy '${source.name}' must use the same name`,
+					},
+				};
+			}
 			translationGroup = source.translation_group ?? source.id;
 			if (input.hierarchical === undefined) {
 				hierarchical = source.hierarchical === 1;

package/src/api/openapi/document.ts

@@ -38,6 +38,12 @@ import {
 	contentUpdateBody,
 	trashedContentListResponseSchema,
 } from "../schemas/content.js";
+import {
+	entryLockAcquireBody,
+	entryLockConflictSchema,
+	entryLockReleaseResponseSchema,
+	entryLockStatusSchema,
+} from "../schemas/entry-lock.js";
 import {
 	mediaUsageDetailsQuery,
 	mediaUsageDetailsResponseSchema,
@@ -210,6 +216,19 @@ function standardErrors(
 /** Common auth error responses (401 + 403) */
 const authErrors = standardErrors(401, 403);
 
+const entryPathParams = z.object({
+	collection: z.string().meta({ description: "Collection slug" }),
+	id: z.string().meta({ description: "Content ID or slug" }),
+});
+
+/** 409 that carries the edit lock's holder in `error.details` */
+const entryLockConflict = {
+	"409": {
+		description: "Another editor holds the entry's edit lock",
+		content: { [JSON_CONTENT]: { schema: entryLockConflictSchema } },
+	},
+};
+
 // ---------------------------------------------------------------------------
 // Content routes
 // ---------------------------------------------------------------------------
@@ -330,9 +349,12 @@ const contentPaths = {
 				"Moves the content item to trash. Use the permanent delete endpoint to remove permanently.",
 			tags: ["Content"],
 			requestParams: {
-				path: z.object({
-					collection: z.string().meta({ description: "Collection slug" }),
-					id: z.string().meta({ description: "Content ID or slug" }),
+				path: entryPathParams,
+				query: z.object({
+					overrideLock: z.enum(["true", "false"]).optional().meta({
+						description:
+							"Delete even though another editor holds this entry's edit lock. Without it the delete is refused with 409 ENTRY_LOCKED.",
+					}),
 				}),
 			},
 			responses: {
@@ -346,6 +368,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -372,6 +395,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -399,6 +423,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -428,6 +453,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(400, 404, 500),
+				...entryLockConflict,
 			},
 		},
 		delete: {
@@ -436,9 +462,12 @@ const contentPaths = {
 			description: "Reverts a scheduled item to draft status.",
 			tags: ["Content"],
 			requestParams: {
-				path: z.object({
-					collection: z.string().meta({ description: "Collection slug" }),
-					id: z.string().meta({ description: "Content ID or slug" }),
+				path: entryPathParams,
+				query: z.object({
+					overrideLock: z.enum(["true", "false"]).optional().meta({
+						description:
+							"Unschedule even though another editor holds this entry's edit lock. Without it the request is refused with 409 ENTRY_LOCKED.",
+					}),
 				}),
 			},
 			responses: {
@@ -452,6 +481,7 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
 			},
 		},
 	},
@@ -584,6 +614,81 @@ const contentPaths = {
 				},
 				...authErrors,
 				...standardErrors(404, 500),
+				...entryLockConflict,
+			},
+		},
+	},
+
+	"/_emdash/api/content/{collection}/{id}/lock": {
+		get: {
+			operationId: "getEntryLock",
+			summary: "Read the entry's edit lock",
+			description: "Reports who is holding the entry, if anyone, without changing the lease.",
+			tags: ["Content"],
+			requestParams: {
+				path: entryPathParams,
+			},
+			responses: {
+				"200": {
+					description: "Current lock state",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(entryLockStatusSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(404, 500),
+			},
+		},
+		post: {
+			operationId: "acquireEntryLock",
+			summary: "Take or refresh the entry's edit lock",
+			description:
+				"Takes the lock for the caller, or reports who holds it. `heldByCaller` " +
+				"tells the two apart. The lease lasts seven minutes; repeating this call " +
+				"and every save on the entry extend it. `takeover` claims the lock from " +
+				"whoever holds it; their next heartbeat or save reports the new holder.",
+			tags: ["Content"],
+			requestParams: {
+				path: entryPathParams,
+			},
+			requestBody: {
+				content: { [JSON_CONTENT]: { schema: entryLockAcquireBody } },
+			},
+			responses: {
+				"200": {
+					description: "Lock state after the attempt",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(entryLockStatusSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(404, 500),
+			},
+		},
+		delete: {
+			operationId: "releaseEntryLock",
+			summary: "Release the caller's edit lock",
+			description:
+				"Releases the lock only when the caller holds it; `released` is false otherwise.",
+			tags: ["Content"],
+			requestParams: {
+				path: entryPathParams,
+				query: z.object({
+					token: z.string().optional().meta({
+						description:
+							"The session token sent on acquire. With it, only the tab that last claimed the lock releases it.",
+					}),
+				}),
+			},
+			responses: {
+				"200": {
+					description: "Whether a lock was released",
+					content: {
+						[JSON_CONTENT]: { schema: successEnvelope(entryLockReleaseResponseSchema) },
+					},
+				},
+				...authErrors,
+				...standardErrors(404, 500),
 			},
 		},
 	},

package/src/api/schemas/content.ts

@@ -176,6 +176,11 @@ export const contentListQuery = cursorPaginationQuery
 /** ISO 8601 datetime for `publishedAt` / `createdAt`. Routes gate writes behind `content:publish_any`. */
 const contentDateOverride = contentDateTime.nullish();
 
+const overrideLockFlag = z.boolean().optional().meta({
+	description:
+		"Write even though another editor holds this entry's edit lock. Without it the write is refused with 409 ENTRY_LOCKED.",
+});
+
 export const contentCreateBody = z
 	.object({
 		data: z.record(z.string(), z.unknown()),
@@ -206,6 +211,7 @@ export const contentUpdateBody = z
 			.optional()
 			.meta({ description: "Opaque revision token for optimistic concurrency" }),
 		skipRevision: z.boolean().optional(),
+		overrideLock: overrideLockFlag,
 		seo: contentSeoInput.optional(),
 		taxonomies: z.record(z.string(), z.array(z.string())).optional().meta({
 			description:
@@ -224,6 +230,7 @@ export const contentScheduleBody = z
 				description: "ISO 8601 datetime for scheduled publishing",
 				examples: ["2025-06-15T09:00:00Z"],
 			}),
+		overrideLock: overrideLockFlag,
 	})
 	.meta({ id: "ContentScheduleBody" });
 
@@ -232,6 +239,7 @@ export const contentRevisionConditionBody = z.object({
 		.string()
 		.optional()
 		.meta({ description: "Opaque revision token for optimistic concurrency" }),
+	overrideLock: overrideLockFlag,
 });
 
 export const contentPublishBody = contentRevisionConditionBody

package/src/api/schemas/entry-lock.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+
+export const entryLockAcquireBody = z
+	.object({
+		takeover: z.boolean().optional().meta({
+			description:
+				"Take the lock from whoever holds it. Their next heartbeat or save reports the new holder.",
+		}),
+		token: z.string().min(1).max(128).optional().meta({
+			description:
+				"Identifies the caller's editing session. Send the same value on DELETE so a release from one tab does not drop a lock another tab of the same account still relies on.",
+		}),
+	})
+	.meta({ id: "EntryLockAcquireBody" });
+
+export const entryLockHolderSchema = z
+	.object({
+		userId: z.string(),
+		userName: z.string().nullable(),
+		acquiredAt: z.string(),
+		expiresAt: z.string(),
+	})
+	.meta({ id: "EntryLockHolder" });
+
+export const entryLockStatusSchema = z
+	.object({
+		enabled: z.boolean().meta({
+			description: "Whether the collection takes edit locks at all",
+		}),
+		holder: entryLockHolderSchema.nullable(),
+		heldByCaller: z.boolean(),
+	})
+	.meta({ id: "EntryLockStatus" });
+
+export const entryLockReleaseResponseSchema = z
+	.object({ released: z.boolean() })
+	.meta({ id: "EntryLockReleaseResponse" });
+
+export const entryLockConflictSchema = z.object({
+	success: z.literal(false),
+	error: z.object({
+		code: z.literal("ENTRY_LOCKED"),
+		message: z.string(),
+		details: entryLockHolderSchema,
+	}),
+});
+
+export type EntryLockAcquireBody = z.infer<typeof entryLockAcquireBody>;

package/src/api/schemas/index.ts

@@ -18,3 +18,4 @@ export * from "./redirects.js";
 export * from "./bylines.js";
 export * from "./byline-fields.js";
 export * from "./relations.js";
+export * from "./entry-lock.js";

package/src/api/schemas/schema.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
+import { MAX_COLLECTION_GROUP_LENGTH, MAX_COLLECTION_LIST_COLUMNS } from "../../schema/types.js";
 import { compileUrlPattern } from "../../schema/url-pattern.js";
 import { slugPattern } from "./common.js";
 
@@ -141,6 +141,9 @@ const fieldValidation = z
 
 const fieldWidgetOptions = z.record(z.string(), z.unknown()).optional();
 
+/** Admin sidebar folder label; an empty string clears it like `null`. */
+const navGroupValue = z.string().trim().max(MAX_COLLECTION_GROUP_LENGTH);
+
 export const createCollectionBody = z
 	.object({
 		slug: z.string().min(1).max(63).regex(slugPattern, "Invalid slug format"),
@@ -156,6 +159,8 @@ export const createCollectionBody = z
 		hasSeo: z.boolean().optional(),
 		hidden: z.boolean().optional(),
 		sortOrder: z.number().int().nullish(),
+		editLocking: z.boolean().optional(),
+		group: navGroupValue.nullish(),
 	})
 	.meta({ id: "CreateCollectionBody" });
 
@@ -172,10 +177,12 @@ export const updateCollectionBody = z
 		hasSeo: z.boolean().optional(),
 		hidden: z.boolean().optional(),
 		sortOrder: z.number().int().nullish(),
+		group: navGroupValue.nullish(),
 		commentsEnabled: z.boolean().optional(),
 		commentsModeration: z.enum(["all", "first_time", "none"]).optional(),
 		commentsClosedAfterDays: z.number().int().min(0).optional(),
 		commentsAutoApproveUsers: z.boolean().optional(),
+		editLocking: z.boolean().optional(),
 		titleField: z.string().min(1).max(63).regex(slugPattern, "Invalid field slug format").nullish(),
 		dateField: z.string().min(1).max(63).regex(slugPattern, "Invalid field slug format").nullish(),
 	})
@@ -268,6 +275,8 @@ export const collectionSchema = z
 		hasSeo: z.boolean(),
 		hidden: z.boolean(),
 		sortOrder: z.number().int().nullable(),
+		editLocking: z.boolean(),
+		group: z.string().nullish(),
 		createdAt: z.string(),
 		updatedAt: z.string(),
 		titleField: z.string().nullish(),

package/src/api/types.ts

@@ -57,6 +57,8 @@ export interface ManifestCollectionDescriptor {
 	titleField?: string;
 	dateField?: string;
 	hidden?: boolean;
+	/** Admin sidebar folder shared with other collections of the same group */
+	group?: string;
 	listColumns?: string[];
 	fields: Record<string, ManifestFieldDescriptor>;
 }

package/src/astro/integration/index.ts

@@ -27,6 +27,7 @@ import {
 import { buildMigrationManifest } from "../../migrations/manifest-builder.js";
 import { writeMigrationManifest } from "../../migrations/manifest-writer.js";
 import type { ResolvedPlugin } from "../../plugins/types.js";
+import { normalizeRegistryConfig } from "../../registry/config.js";
 import { VERSION } from "../../version.js";
 import { setDevTypegenRefresh } from "../dev-typegen.js";
 import { local } from "../storage/adapters.js";
@@ -328,6 +329,11 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 		migrations: normalizeMigrationConfig(config.migrations),
 	};
 
+	// Validate environment-independent registry settings while Astro is still
+	// evaluating its config. The command-aware check in astro:config:setup
+	// applies the stricter production localhost policy.
+	normalizeRegistryConfig(resolvedConfig.experimental?.registry, { allowLocalhost: true });
+
 	// Validate marketplace URL
 	if (resolvedConfig.marketplace) {
 		const url = resolvedConfig.marketplace;
@@ -346,12 +352,6 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 			}
 			throw e;
 		}
-		if (!resolvedConfig.sandboxRunner) {
-			throw new Error(
-				"Marketplace requires `sandboxRunner` to be configured. " +
-					"Marketplace plugins run in sandboxed V8 isolates.",
-			);
-		}
 	}
 
 	// Validate siteUrl if provided in astro.config.mjs.
@@ -469,6 +469,9 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				command,
 			}) => {
 				astroCommand = command;
+				normalizeRegistryConfig(resolvedConfig.experimental?.registry, {
+					allowLocalhost: command === "dev" || command === "sync",
+				});
 				printBanner(logger);
 				// Capture the host's Astro version so the runtime can expose it
 				// to the admin and the registry install gate for `env:astro`

package/src/astro/integration/routes.ts

@@ -169,6 +169,11 @@ export function injectCoreRoutes(
 		entrypoint: resolveRoute("api/content/[collection]/[id]/compare.ts"),
 	});
 
+	injectRoute({
+		pattern: "/_emdash/api/content/[collection]/[id]/lock",
+		entrypoint: resolveRoute("api/content/[collection]/[id]/lock.ts"),
+	});
+
 	// i18n translation routes
 	injectRoute({
 		pattern: "/_emdash/api/content/[collection]/[id]/translations",

package/src/astro/integration/runtime.ts

@@ -259,12 +259,13 @@ export interface EmDashConfig {
 	 *
 	 * @example
 	 * ```ts
+	 * import { sandbox } from "@emdash-cms/cloudflare";
 	 * import { untrustedPlugin } from "some-third-party-plugin";
 	 *
 	 * emdash({
 	 *   plugins: [trustedPlugin()],     // runs in host
 	 *   sandboxed: [untrustedPlugin()], // runs in isolate
-	 *   sandboxRunner: "@emdash-cms/sandbox-cloudflare",
+	 *   sandboxRunner: sandbox(),
 	 * })
 	 * ```
 	 */
@@ -275,8 +276,10 @@ export interface EmDashConfig {
 	 *
 	 * @example
 	 * ```ts
+	 * import { sandbox } from "@emdash-cms/cloudflare";
+	 *
 	 * emdash({
-	 *   sandboxRunner: "@emdash-cms/sandbox-cloudflare",
+	 *   sandboxRunner: sandbox(),
 	 * })
 	 * ```
 	 */
@@ -359,7 +362,8 @@ export interface EmDashConfig {
 	 * and uninstall plugins from a remote marketplace.
 	 *
 	 * Must be an HTTPS URL in production, or localhost/127.0.0.1 in dev.
-	 * Requires `sandboxRunner` to be configured (marketplace plugins run sandboxed).
+	 * Installing or updating plugins requires an available `sandboxRunner`.
+	 * Browsing remains available when no runner is configured.
 	 *
 	 * When `registry` is also configured, the registry replaces the marketplace
 	 * for the admin UI's browse and install flows. Existing marketplace-installed
@@ -367,9 +371,11 @@ export interface EmDashConfig {
 	 *
 	 * @example
 	 * ```ts
+	 * import { sandbox } from "@emdash-cms/cloudflare";
+	 *
 	 * emdash({
 	 *   marketplace: "https://marketplace.emdashcms.com",
-	 *   sandboxRunner: "@emdash-cms/sandbox-cloudflare",
+	 *   sandboxRunner: sandbox(),
 	 * })
 	 * ```
 	 */
@@ -385,13 +391,15 @@ export interface EmDashConfig {
 	 *
 	 * @example
 	 * ```ts
+	 * import { sandbox } from "@emdash-cms/cloudflare";
+	 *
 	 * emdash({
 	 *   experimental: {
 	 *     registry: {
 	 *       aggregatorUrl: "https://registry.emdashcms.com",
 	 *     },
 	 *   },
-	 *   sandboxRunner: "@emdash-cms/sandbox-cloudflare",
+	 *   sandboxRunner: sandbox(),
 	 * })
 	 * ```
 	 */