emdash 0.37.0 → 0.39.0

package/src/database/migration-lock.ts

@@ -0,0 +1,140 @@
+import type { Kysely, MigrationLockOptions } from "kysely";
+import { SqliteAdapter } from "kysely";
+import { MIGRATION_LOCK_ID } from "kysely/migration";
+
+import { isMissingTableError } from "../utils/db-errors.js";
+import { MIGRATION_LOCK_BUSY_MESSAGE } from "./pg-migration-lock.js";
+
+export const MIGRATION_LOCK_TABLE = "_emdash_migrations_lock";
+
+const RELEASE_ATTEMPTS = 3;
+
+const RELEASE_LOCK_DOCS_URL =
+	"https://docs.emdashcms.com/deployment/core-migrations/#release-a-stuck-migration-lock";
+
+export function migrationLockHeldMessage(heldSince: number): string {
+	return (
+		`The migration lock has been held since ${new Date(heldSince).toISOString()} (lock ${heldSince}). ` +
+		"A migration may still be running; if none is, check the database and release the lock: " +
+		RELEASE_LOCK_DOCS_URL
+	);
+}
+
+/** When the lock was taken, as carried by the busy error of `LockingSqliteAdapter`. */
+export function busyLockHeldSince(error: unknown): number | undefined {
+	if (typeof error !== "object" || error === null) return undefined;
+	const heldSince: unknown = Reflect.get(error, "heldSince");
+	return typeof heldSince === "number" && heldSince > 0 ? heldSince : undefined;
+}
+
+/**
+ * SQLite adapter that takes the migration lock in a database row, for a
+ * database whose clients have no connection-level lock to share (D1).
+ *
+ * Kysely creates the lock table with a single row, but none of its adapters
+ * writes to it. The holder stores the time it took the lock in `is_locked`
+ * (0 means free) and clears the row only while it still holds that time. A
+ * lock whose holder never released it stays until `clearMigrationLock` runs:
+ * the holder may still be migrating, or may have stopped partway through a
+ * migration.
+ */
+export class LockingSqliteAdapter extends SqliteAdapter {
+	// eslint-disable-next-line typescript/no-explicit-any -- matches the DialectAdapter signature
+	readonly #held = new WeakMap<Kysely<any>, number>();
+
+	override async acquireMigrationLock(
+		// eslint-disable-next-line typescript/no-explicit-any -- matches the DialectAdapter signature
+		db: Kysely<any>,
+		options: MigrationLockOptions,
+	): Promise<void> {
+		const heldSince = Date.now();
+		const result = await db
+			.updateTable(options.lockTable)
+			.set({ is_locked: heldSince })
+			.where("id", "=", options.lockRowId)
+			.where("is_locked", "=", 0)
+			.executeTakeFirst();
+		if (result.numUpdatedRows !== 1n) {
+			const row = await db
+				.selectFrom(options.lockTable)
+				.select("is_locked")
+				.where("id", "=", options.lockRowId)
+				.executeTakeFirst()
+				.catch(() => undefined);
+			throw Object.assign(new Error(MIGRATION_LOCK_BUSY_MESSAGE), {
+				heldSince: Number(row?.is_locked ?? 0),
+			});
+		}
+		this.#held.set(db, heldSince);
+	}
+
+	override async releaseMigrationLock(
+		// eslint-disable-next-line typescript/no-explicit-any -- matches the DialectAdapter signature
+		db: Kysely<any>,
+		options: MigrationLockOptions,
+	): Promise<void> {
+		// Kysely also calls this after acquireMigrationLock threw.
+		const heldSince = this.#held.get(db);
+		if (heldSince === undefined) return;
+		this.#held.delete(db);
+		// A lock left behind by a successful run goes unnoticed until the next
+		// pending migration, so a failed write is retried. The write is
+		// conditional on this run's acquire time, so a retry after a write that
+		// landed can still clear a lock another run took in the same millisecond.
+		for (let attempt = 1; ; attempt++) {
+			try {
+				// oxlint-disable-next-line no-await-in-loop -- retries are sequential
+				await db
+					.updateTable(options.lockTable)
+					.set({ is_locked: 0 })
+					.where("id", "=", options.lockRowId)
+					.where("is_locked", "=", heldSince)
+					.execute();
+				return;
+			} catch (error) {
+				if (attempt === RELEASE_ATTEMPTS) throw error;
+			}
+		}
+	}
+}
+
+/**
+ * When the migration lock was taken, in milliseconds since the epoch, or null
+ * when it is free. Only `LockingSqliteAdapter` writes the lock row.
+ */
+export async function readMigrationLock(
+	// eslint-disable-next-line typescript/no-explicit-any -- reads a table outside the Database type
+	db: Kysely<any>,
+): Promise<number | null> {
+	try {
+		const row = await db
+			.selectFrom(MIGRATION_LOCK_TABLE)
+			.select("is_locked")
+			.where("id", "=", MIGRATION_LOCK_ID)
+			.executeTakeFirst();
+		const heldSince = Number(row?.is_locked ?? 0);
+		return heldSince > 0 ? heldSince : null;
+	} catch (error) {
+		if (isMissingTableError(error)) return null;
+		throw error;
+	}
+}
+
+/**
+ * Release a lock its holder never released. The row is cleared only while it
+ * still holds `heldSince`, so a lock taken again since it was read stays
+ * unless it was taken in that same millisecond.
+ */
+export async function clearMigrationLock(
+	// eslint-disable-next-line typescript/no-explicit-any -- writes a table outside the Database type
+	db: Kysely<any>,
+	heldSince: number,
+): Promise<boolean> {
+	const result = await db
+		.updateTable(MIGRATION_LOCK_TABLE)
+		.set({ is_locked: 0 })
+		.where("id", "=", MIGRATION_LOCK_ID)
+		.where("is_locked", "=", heldSince)
+		.executeTakeFirst();
+	return result.numUpdatedRows > 0n;
+}

package/src/database/migrations/075_entry_edit_locks.ts

@@ -0,0 +1,44 @@
+import type { Kysely } from "kysely";
+
+import { columnExists } from "../dialect-helpers.js";
+
+/**
+ * Timestamps here carry no column default: `datetime('now')` renders a
+ * space-separated shape that would not sort against the ISO-8601 values the
+ * lease predicate compares as strings.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await db.schema
+		.createTable("_emdash_entry_locks")
+		.ifNotExists()
+		.addColumn("collection", "text", (col) => col.notNull())
+		.addColumn("entry_id", "text", (col) => col.notNull())
+		.addColumn("user_id", "text", (col) => col.notNull().references("users.id").onDelete("cascade"))
+		.addColumn("token", "text", (col) => col.notNull())
+		.addColumn("acquired_at", "text", (col) => col.notNull())
+		.addColumn("expires_at", "text", (col) => col.notNull())
+		.addPrimaryKeyConstraint("pk_emdash_entry_locks", ["collection", "entry_id"])
+		.execute();
+
+	await db.schema
+		.createIndex("idx_emdash_entry_locks_user_id")
+		.ifNotExists()
+		.on("_emdash_entry_locks")
+		.column("user_id")
+		.execute();
+
+	if (!(await columnExists(db, "_emdash_collections", "edit_locking"))) {
+		await db.schema
+			.alterTable("_emdash_collections")
+			.addColumn("edit_locking", "integer", (col) => col.notNull().defaultTo(1))
+			.execute();
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	if (await columnExists(db, "_emdash_collections", "edit_locking")) {
+		await db.schema.alterTable("_emdash_collections").dropColumn("edit_locking").execute();
+	}
+	await db.schema.dropIndex("idx_emdash_entry_locks_user_id").ifExists().execute();
+	await db.schema.dropTable("_emdash_entry_locks").ifExists().execute();
+}

package/src/database/migrations/076_collection_nav_group.ts

@@ -0,0 +1,22 @@
+import type { Kysely } from "kysely";
+
+import { columnExists } from "../dialect-helpers.js";
+
+/**
+ * Migration: group collections into admin sidebar folders.
+ *
+ * Adds `nav_group` to `_emdash_collections`. Collections sharing a group
+ * render under one collapsible folder in the admin sidebar; NULL keeps the
+ * collection inline.
+ */
+export async function up(db: Kysely<unknown>): Promise<void> {
+	if (!(await columnExists(db, "_emdash_collections", "nav_group"))) {
+		await db.schema.alterTable("_emdash_collections").addColumn("nav_group", "text").execute();
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	if (await columnExists(db, "_emdash_collections", "nav_group")) {
+		await db.schema.alterTable("_emdash_collections").dropColumn("nav_group").execute();
+	}
+}

package/src/database/migrations/077_plugin_storage_revisions.ts

@@ -0,0 +1,89 @@
+import { type Kysely, sql } from "kysely";
+
+import { columnExists, isPostgres } from "../dialect-helpers.js";
+
+const TABLES = [
+	{ name: "options", keys: ["name"] },
+	{ name: "_plugin_storage", keys: ["plugin_id", "collection", "id"] },
+] as const;
+
+const DUPLICATE_COLUMN_REGEX =
+	/(?:duplicate column|column .* already exists|already exists.*column)/i;
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	for (const table of TABLES) {
+		if (await columnExists(db, table.name, "revision")) continue;
+		try {
+			await db.schema
+				.alterTable(table.name)
+				.addColumn("revision", "text", (column) => column.notNull().defaultTo("0"))
+				.execute();
+		} catch (error) {
+			if (isDuplicateColumnError(error) && (await columnExists(db, table.name, "revision"))) {
+				continue;
+			}
+			throw error;
+		}
+	}
+
+	if (isPostgres(db)) {
+		await sql`
+			CREATE OR REPLACE FUNCTION emdash_plugin_storage_assign_revision()
+			RETURNS trigger
+			LANGUAGE plpgsql
+			AS $$
+			BEGIN
+				IF TG_OP = 'INSERT' THEN
+					IF NEW.revision = '0' THEN
+						NEW.revision := gen_random_uuid()::text;
+					END IF;
+				ELSIF NEW.revision = '0' OR NEW.revision = OLD.revision THEN
+					NEW.revision := gen_random_uuid()::text;
+				END IF;
+				RETURN NEW;
+			END;
+			$$
+		`.execute(db);
+		for (const table of TABLES) {
+			await sql`
+				CREATE OR REPLACE TRIGGER ${sql.ref(`emdash_${table.name}_revision`)}
+				BEFORE INSERT OR UPDATE ON ${sql.ref(table.name)}
+				FOR EACH ROW EXECUTE FUNCTION emdash_plugin_storage_assign_revision()
+			`.execute(db);
+		}
+	} else {
+		for (const table of TABLES) {
+			const rowKey = sql.join(
+				table.keys.map((key) => sql`${sql.ref(key)} = ${sql.ref(`NEW.${key}`)}`),
+				sql` AND `,
+			);
+			await sql`
+				CREATE TRIGGER IF NOT EXISTS ${sql.ref(`emdash_${table.name}_revision_insert`)}
+				AFTER INSERT ON ${sql.ref(table.name)}
+				WHEN NEW.revision = '0'
+				BEGIN
+					UPDATE ${sql.ref(table.name)} SET revision = lower(hex(randomblob(16)))
+					WHERE ${rowKey} AND revision = NEW.revision;
+				END
+			`.execute(db);
+			await sql`
+				CREATE TRIGGER IF NOT EXISTS ${sql.ref(`emdash_${table.name}_revision_update`)}
+				AFTER UPDATE ON ${sql.ref(table.name)}
+				WHEN NEW.revision = '0' OR NEW.revision = OLD.revision
+				BEGIN
+					UPDATE ${sql.ref(table.name)} SET revision = lower(hex(randomblob(16)))
+					WHERE ${rowKey} AND revision = NEW.revision;
+				END
+			`.execute(db);
+		}
+	}
+}
+
+function isDuplicateColumnError(error: unknown): boolean {
+	if (!(error instanceof Error)) return false;
+	return DUPLICATE_COLUMN_REGEX.test(error.message) || isDuplicateColumnError(error.cause);
+}
+
+export async function down(_db: Kysely<unknown>): Promise<void> {
+	// Revisions must survive a host rollback while other writers still use them.
+}

package/src/database/migrations/078_menu_item_translation_groups.ts

@@ -0,0 +1,15 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await sql`
+		UPDATE _emdash_menu_items
+		SET translation_group = id
+		WHERE translation_group IS NULL
+	`.execute(db);
+}
+
+/** Existing translation-group relationships must survive a host rollback. */
+export async function down(_db: Kysely<unknown>): Promise<void> {
+	// no-op
+}

package/src/database/migrations/079_datetime_normalization.ts

@@ -0,0 +1,13 @@
+import type { Kysely } from "kysely";
+
+import { normalizeDatetimeStorage } from "../datetime-storage.js";
+import type { Database } from "../types.js";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	// eslint-disable-next-line typescript/no-unsafe-type-assertion -- the migration runs after the typed tables exist
+	await normalizeDatetimeStorage(db as Kysely<Database>);
+}
+
+export async function down(_db: Kysely<unknown>): Promise<void> {
+	// UTC normalization is intentionally irreversible because the original notation carried no extra data.
+}

package/src/database/migrations/080_content_translation_locale_unique.ts

@@ -0,0 +1,88 @@
+import type { Kysely } from "kysely";
+import { sql } from "kysely";
+
+import { indexExists, isPostgres, listTablesLike } from "../dialect-helpers.js";
+
+const DUPLICATE_GROUP_BATCH_SIZE = 50;
+
+interface DuplicateContentRow {
+	id: string;
+	translation_group: string;
+	locale_key: string;
+}
+
+async function splitDuplicateLocales(db: Kysely<unknown>, tableName: string): Promise<void> {
+	const collection = tableName.slice(3);
+
+	while (true) {
+		const duplicates = await sql<DuplicateContentRow>`
+			WITH duplicate_groups AS (
+				SELECT translation_group, lower(locale) AS locale_key
+				FROM ${sql.ref(tableName)}
+				WHERE deleted_at IS NULL AND translation_group IS NOT NULL
+				GROUP BY translation_group, lower(locale)
+				HAVING COUNT(*) > 1
+				ORDER BY translation_group, lower(locale)
+				LIMIT ${DUPLICATE_GROUP_BATCH_SIZE}
+			)
+			SELECT content.id, content.translation_group, lower(content.locale) AS locale_key
+			FROM ${sql.ref(tableName)} AS content
+			INNER JOIN duplicate_groups AS duplicate
+				ON duplicate.translation_group = content.translation_group
+				AND duplicate.locale_key = lower(content.locale)
+			WHERE content.deleted_at IS NULL
+			ORDER BY content.translation_group, lower(content.locale),
+				CASE WHEN content.id = content.translation_group THEN 0 ELSE 1 END,
+				content.created_at, content.id
+		`.execute(db);
+
+		if (duplicates.rows.length === 0) return;
+
+		let previousGroupLocale: string | null = null;
+		for (const row of duplicates.rows) {
+			const groupLocale = `${row.translation_group}\0${row.locale_key}`;
+			if (groupLocale !== previousGroupLocale) {
+				previousGroupLocale = groupLocale;
+				continue;
+			}
+
+			await sql`
+				INSERT INTO content_taxonomies (collection, entry_id, taxonomy_id)
+				SELECT collection, ${row.id}, taxonomy_id
+				FROM content_taxonomies
+				WHERE collection = ${collection} AND entry_id = ${row.translation_group}
+				ON CONFLICT (collection, entry_id, taxonomy_id) DO NOTHING
+			`.execute(db);
+			await sql`
+				UPDATE ${sql.ref(tableName)}
+				SET translation_group = ${row.id}
+				WHERE id = ${row.id}
+					AND deleted_at IS NULL
+					AND translation_group = ${row.translation_group}
+					AND lower(locale) = ${row.locale_key}
+			`.execute(db);
+		}
+	}
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	for (const tableName of await listTablesLike(db, "ec_%")) {
+		const indexName = `uidx_${tableName}_active_tg_locale`;
+		const storedIndexName = isPostgres(db) ? indexName.slice(0, 63) : indexName;
+		if (await indexExists(db, storedIndexName)) continue;
+		await splitDuplicateLocales(db, tableName);
+		await sql`
+			CREATE UNIQUE INDEX IF NOT EXISTS ${sql.ref(indexName)}
+			ON ${sql.ref(tableName)} (translation_group, lower(locale))
+			WHERE deleted_at IS NULL AND translation_group IS NOT NULL
+		`.execute(db);
+	}
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+	for (const tableName of await listTablesLike(db, "ec_%")) {
+		const indexName = `uidx_${tableName}_active_tg_locale`;
+		const storedIndexName = isPostgres(db) ? indexName.slice(0, 63) : indexName;
+		await sql`DROP INDEX IF EXISTS ${sql.ref(storedIndexName)}`.execute(db);
+	}
+}

package/src/database/migrations/081_redirect_write_guards.ts

@@ -0,0 +1,257 @@
+import { type Kysely, sql } from "kysely";
+
+import { columnExists, isPostgres } from "../dialect-helpers.js";
+
+const DUPLICATE_COLUMN_REGEX =
+	/(?:duplicate column|column .* already exists|already exists.*column)/i;
+
+async function addColumnIfMissing(
+	db: Kysely<unknown>,
+	column: "config_revision" | "source_guard" | "write_generation",
+): Promise<void> {
+	if (await columnExists(db, "_emdash_redirects", column)) return;
+	try {
+		await db.schema
+			.alterTable("_emdash_redirects")
+			.addColumn(column, column === "config_revision" ? "text" : "integer", (builder) =>
+				builder.notNull().defaultTo(column === "config_revision" ? "0" : 0),
+			)
+			.execute();
+	} catch (error) {
+		if (
+			error instanceof Error &&
+			DUPLICATE_COLUMN_REGEX.test(error.message) &&
+			(await columnExists(db, "_emdash_redirects", column))
+		) {
+			return;
+		}
+		throw error;
+	}
+}
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+	await addColumnIfMissing(db, "config_revision");
+	await addColumnIfMissing(db, "source_guard");
+	await addColumnIfMissing(db, "write_generation");
+
+	// Preserve any historical duplicate rows, but nominate one existing row
+	// per source for the uniqueness constraint. New rows and source-changing
+	// updates set this flag, so they are database-enforced without deleting old data.
+	await sql`
+		UPDATE _emdash_redirects
+		SET source_guard = 1
+		WHERE id IN (
+			SELECT MIN(id) FROM _emdash_redirects GROUP BY source
+		)
+		AND source_guard = 0
+	`.execute(db);
+	await sql`
+		CREATE UNIQUE INDEX IF NOT EXISTS idx_redirects_managed_source
+		ON _emdash_redirects (source)
+		WHERE source_guard = 1
+	`.execute(db);
+
+	await db.schema
+		.createTable("_emdash_redirect_write_lock")
+		.ifNotExists()
+		.addColumn("id", "integer", (column) => column.primaryKey())
+		.addColumn("token", "text", (column) => column.notNull())
+		.addColumn("expires_at", isPostgres(db) ? "bigint" : "integer", (column) => column.notNull())
+		.addColumn("generation", "integer", (column) => column.notNull())
+		.execute();
+	await sql`
+		INSERT INTO _emdash_redirect_write_lock (id, token, expires_at, generation)
+		VALUES (1, '', 0, 0)
+		ON CONFLICT (id) DO NOTHING
+	`.execute(db);
+
+	if (isPostgres(db)) {
+		await sql`
+			CREATE OR REPLACE FUNCTION emdash_redirect_validate_write()
+			RETURNS trigger
+			LANGUAGE plpgsql
+			AS $$
+			BEGIN
+				PERFORM pg_advisory_xact_lock(1168624763);
+				IF TG_OP = 'INSERT' THEN
+					NEW.source_guard := 1;
+				ELSIF NEW.source <> OLD.source THEN
+					NEW.source_guard := 1;
+				END IF;
+				IF TG_OP = 'UPDATE'
+					AND NEW.config_revision IS NOT DISTINCT FROM OLD.config_revision
+					AND (
+						NEW.source IS DISTINCT FROM OLD.source OR
+						NEW.destination IS DISTINCT FROM OLD.destination OR
+						NEW.enabled IS DISTINCT FROM OLD.enabled OR
+						NEW.is_pattern IS DISTINCT FROM OLD.is_pattern OR
+						NEW.type IS DISTINCT FROM OLD.type OR
+						NEW.group_name IS DISTINCT FROM OLD.group_name
+					)
+				THEN
+					NEW.config_revision := md5(random()::text || clock_timestamp()::text || NEW.id);
+				END IF;
+				IF NEW.write_generation <> 0 AND TG_OP = 'INSERT' THEN
+					IF NOT EXISTS (
+						SELECT 1 FROM _emdash_redirect_write_lock
+						WHERE id = 1 AND token <> '' AND generation = NEW.write_generation
+					) THEN
+						RAISE EXCEPTION 'redirect write lease expired';
+					END IF;
+				ELSIF TG_OP = 'UPDATE' AND NEW.write_generation IS DISTINCT FROM OLD.write_generation THEN
+					IF NOT EXISTS (
+						SELECT 1 FROM _emdash_redirect_write_lock
+						WHERE id = 1 AND token <> '' AND generation = NEW.write_generation
+					) THEN
+						RAISE EXCEPTION 'redirect write lease expired';
+					END IF;
+				END IF;
+				IF NEW.enabled = 1 AND NEW.destination <> ''
+					AND (TG_OP = 'INSERT' OR NEW.source <> OLD.source OR NEW.destination <> OLD.destination)
+					AND EXISTS (
+					WITH RECURSIVE chain(source, destination) AS (
+						SELECT source, destination FROM _emdash_redirects
+						WHERE source = NEW.destination AND enabled = 1
+							AND (TG_OP = 'INSERT' OR id <> NEW.id)
+						UNION
+						SELECT redirect.source, redirect.destination
+						FROM _emdash_redirects AS redirect
+						JOIN chain ON redirect.source = chain.destination
+						WHERE redirect.enabled = 1
+							AND (TG_OP = 'INSERT' OR redirect.id <> NEW.id)
+					)
+					SELECT 1 FROM chain WHERE destination = NEW.source
+				) THEN
+					RAISE EXCEPTION 'redirect loop';
+				END IF;
+				RETURN NEW;
+			END;
+			$$
+		`.execute(db);
+		await sql`DROP TRIGGER IF EXISTS emdash_redirect_validate_write ON _emdash_redirects`.execute(
+			db,
+		);
+		await sql`
+			CREATE TRIGGER emdash_redirect_validate_write
+			BEFORE INSERT OR UPDATE OF source, destination, enabled, is_pattern, type, group_name
+			ON _emdash_redirects
+			FOR EACH ROW EXECUTE FUNCTION emdash_redirect_validate_write()
+		`.execute(db);
+		await sql`
+			CREATE OR REPLACE FUNCTION emdash_redirect_serialize_delete()
+			RETURNS trigger
+			LANGUAGE plpgsql
+			AS $$
+			BEGIN
+				PERFORM pg_advisory_xact_lock(1168624763);
+				RETURN OLD;
+			END;
+			$$
+		`.execute(db);
+		await sql`DROP TRIGGER IF EXISTS emdash_redirect_serialize_delete ON _emdash_redirects`.execute(
+			db,
+		);
+		await sql`
+			CREATE TRIGGER emdash_redirect_serialize_delete
+			BEFORE DELETE ON _emdash_redirects
+			FOR EACH ROW EXECUTE FUNCTION emdash_redirect_serialize_delete()
+		`.execute(db);
+	} else {
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_fence_insert
+			BEFORE INSERT ON _emdash_redirects
+			WHEN NEW.write_generation <> 0 AND NOT EXISTS (
+				SELECT 1 FROM _emdash_redirect_write_lock
+				WHERE id = 1 AND token <> '' AND generation = NEW.write_generation
+			)
+			BEGIN
+				SELECT RAISE(ABORT, 'redirect write lease expired');
+			END
+		`.execute(db);
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_fence_update
+			BEFORE UPDATE OF source, destination, enabled, is_pattern, type, group_name ON _emdash_redirects
+			WHEN NEW.write_generation <> OLD.write_generation
+			AND NEW.write_generation <> 0 AND NOT EXISTS (
+				SELECT 1 FROM _emdash_redirect_write_lock
+				WHERE id = 1 AND token <> '' AND generation = NEW.write_generation
+			)
+			BEGIN
+				SELECT RAISE(ABORT, 'redirect write lease expired');
+			END
+		`.execute(db);
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_loop_insert
+			BEFORE INSERT ON _emdash_redirects
+			WHEN NEW.enabled = 1 AND NEW.destination <> ''
+			BEGIN
+				SELECT CASE WHEN EXISTS (
+					WITH RECURSIVE chain(source, destination) AS (
+						SELECT source, destination FROM _emdash_redirects
+						WHERE source = NEW.destination AND enabled = 1
+						UNION
+						SELECT redirect.source, redirect.destination
+						FROM _emdash_redirects AS redirect
+						JOIN chain ON redirect.source = chain.destination
+						WHERE redirect.enabled = 1
+					)
+					SELECT 1 FROM chain WHERE destination = NEW.source
+				) THEN RAISE(ABORT, 'redirect loop') END;
+			END
+		`.execute(db);
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_loop_update
+			BEFORE UPDATE OF source, destination ON _emdash_redirects
+			WHEN NEW.enabled = 1 AND NEW.destination <> ''
+			BEGIN
+				SELECT CASE WHEN EXISTS (
+					WITH RECURSIVE chain(source, destination) AS (
+						SELECT source, destination FROM _emdash_redirects
+						WHERE source = NEW.destination AND enabled = 1 AND id <> NEW.id
+						UNION
+						SELECT redirect.source, redirect.destination
+						FROM _emdash_redirects AS redirect
+						JOIN chain ON redirect.source = chain.destination
+						WHERE redirect.enabled = 1 AND redirect.id <> NEW.id
+					)
+					SELECT 1 FROM chain WHERE destination = NEW.source
+				) THEN RAISE(ABORT, 'redirect loop') END;
+			END
+		`.execute(db);
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_guard_insert
+			AFTER INSERT ON _emdash_redirects
+			WHEN NEW.source_guard = 0
+			BEGIN
+				UPDATE _emdash_redirects SET source_guard = 1 WHERE id = NEW.id;
+			END
+		`.execute(db);
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_guard_update
+			AFTER UPDATE OF source ON _emdash_redirects
+			WHEN NEW.source_guard = 0 AND NEW.source <> OLD.source
+			BEGIN
+				UPDATE _emdash_redirects SET source_guard = 1 WHERE id = NEW.id;
+			END
+		`.execute(db);
+		await sql`
+			CREATE TRIGGER IF NOT EXISTS emdash_redirect_revision_update
+			AFTER UPDATE OF source, destination, enabled, is_pattern, type, group_name ON _emdash_redirects
+			WHEN NEW.config_revision = OLD.config_revision AND (
+				NEW.source IS NOT OLD.source OR
+				NEW.destination IS NOT OLD.destination OR
+				NEW.enabled IS NOT OLD.enabled OR
+				NEW.is_pattern IS NOT OLD.is_pattern OR
+				NEW.type IS NOT OLD.type OR
+				NEW.group_name IS NOT OLD.group_name
+			)
+			BEGIN
+				UPDATE _emdash_redirects
+				SET config_revision = lower(hex(randomblob(16)))
+				WHERE id = NEW.id;
+			END
+		`.execute(db);
+	}
+}
+
+export async function down(_db: Kysely<unknown>): Promise<void> {}