emdash 0.40.0 → 0.40.1

package/src/astro/routes/api/setup/index.ts

@@ -10,14 +10,25 @@ export const prerender = false;
 
 import { apiError, apiSuccess, handleError } from "#api/error.js";
 import { isParseError, parseBody } from "#api/parse.js";
-import { getPublicOrigin } from "#api/public-url.js";
+import { getConfiguredOrigin } from "#api/public-url.js";
 import { setupBody } from "#api/schemas.js";
 import { getAuthMode } from "#auth/mode.js";
 import { OptionsRepository } from "#db/repositories/options.js";
-import { applySeed } from "#seed/apply.js";
+import { applySeedWithinBudget, type SeedApplyBudget } from "#seed/apply.js";
 import { loadSeed } from "#seed/load.js";
 import { validateSeed } from "#seed/validate.js";
 
+/**
+ * What one setup request may spend on the seed before the rest continues in
+ * the next request. Cloudflare Workers Free allows 1,000 calls to D1, KV and R2
+ * and 50 external fetches per request. A `$media` download takes at least three
+ * fetches (two DNS-over-HTTPS lookups in `ssrfSafeFetch`, then the file) and
+ * three more per redirect. The margin covers a redirect per download, the entry
+ * that crosses the budget with its images, the phases after content and the
+ * object-cache writes at the end.
+ */
+const SEED_BUDGET_PER_REQUEST: SeedApplyBudget = { queries: 500, mediaDownloads: 5 };
+
 export const POST: APIRoute = async ({ request, url, locals }) => {
 	const { emdash } = locals;
 
@@ -40,6 +51,19 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 			// Options table doesn't exist yet — first-ever setup, allow it
 		}
 
+		const configuredSiteUrl = getConfiguredOrigin(emdash.config);
+		const loopbackHost =
+			url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+		const siteUrl =
+			configuredSiteUrl ?? (import.meta.env.DEV && loopbackHost ? url.origin : undefined);
+		if (!siteUrl) {
+			return apiError(
+				"SITE_URL_REQUIRED",
+				"Set siteUrl or EMDASH_SITE_URL before running production setup",
+				500,
+			);
+		}
+
 		// Parse request body
 		const body = await parseBody(request, setupBody);
 		if (isParseError(body)) return body;
@@ -60,16 +84,22 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 			return apiError("INVALID_SEED", `Invalid seed file: ${validation.errors.join(", ")}`, 400);
 		}
 
-		let result;
+		let seeded;
 		try {
-			result = await applySeed(emdash.db, seed, {
-				includeContent: body.includeContent,
-				onConflict: "skip",
-				storage: emdash.storage ?? undefined,
-			});
+			seeded = await applySeedWithinBudget(
+				emdash.db,
+				seed,
+				{
+					includeContent: body.includeContent,
+					onConflict: "skip",
+					storage: emdash.storage ?? undefined,
+				},
+				SEED_BUDGET_PER_REQUEST,
+			);
 		} catch (error) {
 			return handleError(error, "Failed to apply seed", "SEED_ERROR");
 		}
+		const { result, complete: seedComplete, progress: seedProgress } = seeded;
 
 		// Store setup state
 		// In external auth mode, mark setup complete immediately (first user to login becomes admin)
@@ -85,35 +115,48 @@ export const POST: APIRoute = async ({ request, url, locals }) => {
 			// observe an empty value and race to write. A spoofed Host header
 			// on a later call during the wizard window must not be able to
 			// replace the first value.
-			const siteUrl = getPublicOrigin(url, emdash.config);
 			await options.setIfAbsent("emdash:site_url", siteUrl);
 
-			if (useExternalAuth) {
-				// External auth mode: mark setup complete now
-				// First user to log in via external provider will become admin
-				await options.set("emdash:setup_complete", true);
-				await options.set("emdash:site_title", body.title);
-				if (body.tagline) {
-					await options.set("emdash:site_tagline", body.tagline);
+			if (seedComplete) {
+				if (useExternalAuth) {
+					// External auth mode: mark setup complete now
+					// First user to log in via external provider will become admin
+					await options.set("emdash:setup_complete", true);
+					await options.set("emdash:site_title", body.title);
+					if (body.tagline) {
+						await options.set("emdash:site_tagline", body.tagline);
+					}
+				} else {
+					// Passkey/provider mode: store state for next step (admin creation)
+					await options.set("emdash:setup_state", {
+						step: "site_complete",
+						title: body.title,
+						tagline: body.tagline,
+					});
 				}
-			} else {
-				// Passkey/provider mode: store state for next step (admin creation)
-				await options.set("emdash:setup_state", {
-					step: "site_complete",
-					title: body.title,
-					tagline: body.tagline,
-				});
 			}
 		} catch (error) {
 			console.error("Failed to save setup state:", error);
 			// Non-fatal - continue anyway
 		}
 
+		if (!seedComplete) {
+			// The wizard posts again; items already created are skipped.
+			return apiSuccess({
+				success: true,
+				setupComplete: false,
+				seedComplete: false,
+				seedProgress,
+				result,
+			});
+		}
+
 		// Return success with result
 		return apiSuccess({
 			success: true,
 			// In external auth mode, setup is complete - redirect to admin
 			setupComplete: useExternalAuth,
+			seedComplete: true,
 			result,
 		});
 	} catch (error) {

package/src/astro/routes/api/snapshot.ts

@@ -91,7 +91,8 @@ export const GET: APIRoute = async ({ request, locals, url, session }) => {
 	}
 
 	try {
-		const includeDrafts = url.searchParams.get("drafts") === "true";
+		// A preview signature covers published content only.
+		const includeDrafts = !authorized && url.searchParams.get("drafts") === "true";
 		const snapshot = await generateSnapshot(emdash.db, {
 			includeDrafts,
 			origin: getPublicOrigin(url, emdash.config),

package/src/astro/types.ts

@@ -466,6 +466,11 @@ export interface EmDashHandlers {
 		folderId?: string | null;
 	}) => Promise<HandlerResponse>;
 
+	handleMediaRegisterUpload: (input: {
+		storageKey: string;
+		authorId?: string;
+	}) => Promise<HandlerResponse>;
+
 	handleMediaUpdate: (
 		id: string,
 		input: {

package/src/cleanup.ts

@@ -14,6 +14,7 @@ import type { Kysely } from "kysely";
 
 import { cleanupExpiredChallenges } from "./auth/challenge-store.js";
 import { MediaRepository } from "./database/repositories/media.js";
+import { RedirectRepository } from "./database/repositories/redirect.js";
 import { RevisionRepository } from "./database/repositories/revision.js";
 import type { Database } from "./database/types.js";
 import { removeUploadAttempt } from "./media/upload-attempts.js";
@@ -32,6 +33,8 @@ export interface CleanupResult {
 	uploadAttempts: number;
 	revisionsPruned: number;
 	mediaUsage: number;
+	/** Oldest 404-log rows deleted to restore the hard cap. */
+	notFoundLog: number;
 	/** Transfer operations whose staging area was collected. */
 	transferStaging: number;
 }
@@ -62,6 +65,7 @@ export async function runSystemCleanup(
 		uploadAttempts: -1,
 		revisionsPruned: -1,
 		mediaUsage: -1,
+		notFoundLog: -1,
 		transferStaging: -1,
 	};
 
@@ -145,6 +149,12 @@ export async function runSystemCleanup(
 		console.error("[cleanup] Failed to clean media usage:", error);
 	}
 
+	try {
+		result.notFoundLog = await new RedirectRepository(db).cleanup404Log();
+	} catch (error) {
+		console.error("[cleanup] Failed to cap the 404 log:", error);
+	}
+
 	if (storage) {
 		try {
 			const { collectTransferStaging } = await import("./transfer/gc.js");

package/src/components/Columns.astro

@@ -6,6 +6,8 @@
  */
 import { PortableText } from "astro-portabletext";
 
+import { emdashMarkComponents } from "./marks.js";
+
 export interface Props {
 	node: {
 		_type: "columns";
@@ -34,7 +36,7 @@ if (!columns.length) {
 				class="emdash-column"
 				style={column.width ? `flex-basis: ${column.width}` : undefined}
 			>
-				<PortableText value={column.content} />
+				<PortableText value={column.content} components={{ mark: emdashMarkComponents }} />
 			</div>
 		))
 	}

package/src/components/Cover.astro

@@ -6,6 +6,8 @@
  */
 import { PortableText } from "astro-portabletext";
 
+import { emdashMarkComponents } from "./marks.js";
+
 export interface Props {
 	node: {
 		_type: "cover";
@@ -61,7 +63,7 @@ const overlayStyle = overlayColor
 	}
 	{hasBackground && <div class="emdash-cover__overlay" style={overlayStyle} />}
 	<div class="emdash-cover__content">
-		<PortableText value={content} />
+		<PortableText value={content} components={{ mark: emdashMarkComponents }} />
 	</div>
 </div>
 

package/src/database/repositories/media.ts

@@ -8,6 +8,7 @@ import {
 import { ulid } from "ulidx";
 
 import { normalizeFocalPoint, type FocalPointUpdate } from "../../media/focal-point.js";
+import { chunks, SQL_BATCH_SIZE } from "../../utils/chunks.js";
 import type { Database, MediaRow } from "../types.js";
 import type { FindManyResult } from "./types.js";
 import { encodeCursor, decodeCursor } from "./types.js";
@@ -393,6 +394,20 @@ export class MediaRepository {
 		return row ? this.rowToItem(row) : null;
 	}
 
+	/**
+	 * Find the pending media row minted for a signed upload URL.
+	 */
+	async findPendingByStorageKey(storageKey: string): Promise<MediaItem | null> {
+		const row = await this.db
+			.selectFrom("media")
+			.selectAll()
+			.where("storage_key", "=", storageKey)
+			.where("status", "=", "pending")
+			.executeTakeFirst();
+
+		return row ? this.rowToItem(row) : null;
+	}
+
 	/**
 	 * Find media by ID
 	 */
@@ -614,6 +629,15 @@ export class MediaRepository {
 		return null;
 	}
 
+	async isStorageKeyReferenced(storageKey: string): Promise<boolean> {
+		const row = await this.db
+			.selectFrom("media")
+			.select("id")
+			.where("storage_key", "=", storageKey)
+			.executeTakeFirst();
+		return row !== undefined;
+	}
+
 	async delete(id: string): Promise<boolean> {
 		return (await this.deleteWithStorageKey(id)) !== null;
 	}
@@ -682,7 +706,22 @@ export class MediaRepository {
 			.returning("storage_key")
 			.execute();
 
-		return rows.map((r) => r.storage_key);
+		const keys = rows.map((r) => r.storage_key);
+		if (keys.length === 0) return keys;
+
+		// A stored object may still back another media row (for example after a
+		// legacy duplicate registration); never hand such a key to storage deletion.
+		const stillReferenced = new Set<string>();
+		for (const batch of chunks(keys, SQL_BATCH_SIZE)) {
+			const refs = await this.db
+				.selectFrom("media")
+				.select("storage_key")
+				.where("storage_key", "in", batch)
+				.execute();
+			for (const ref of refs) stillReferenced.add(ref.storage_key);
+		}
+
+		return keys.filter((key) => !stillReferenced.has(key));
 	}
 
 	/**

package/src/database/repositories/redirect.ts

@@ -17,9 +17,9 @@ import { encodeCursor, decodeCursor, type FindManyResult } from "./types.js";
 // ---------------------------------------------------------------------------
 
 /**
- * Hard cap on rows stored in `_emdash_404_log`. When exceeded, the oldest
- * rows (by `last_seen_at`) are evicted on insert. Prevents an unauthenticated
- * attacker from growing the table without bound by requesting unique URLs.
+ * Hard cap on rows stored in `_emdash_404_log`. Scheduled maintenance evicts
+ * the oldest rows by `last_seen_at` without adding a read-amplifying count to
+ * the anonymous request path.
  */
 export const MAX_404_LOG_ROWS = 10_000;
 
@@ -646,7 +646,7 @@ export class RedirectRepository {
 		// under concurrency: two requests for the same new path can't both
 		// insert — the second one hits the conflict branch and increments
 		// hits instead of failing with a uniqueness error.
-		const result = await this.db
+		await this.db
 			.insertInto("_emdash_404_log")
 			.values({
 				id,
@@ -667,14 +667,7 @@ export class RedirectRepository {
 					ip,
 				}),
 			)
-			.returning("id")
-			.executeTakeFirst();
-
-		// The conflict branch only updates existing rows, so repeat hits
-		// cannot grow the table. Only enforce the row cap when we actually
-		// inserted a new path.
-		if (result?.id !== id) return;
-		await this.enforce404Cap();
+			.execute();
 	}
 
 	/**
@@ -682,36 +675,26 @@ export class RedirectRepository {
 	 * MAX_404_LOG_ROWS. "Oldest" is by `last_seen_at`, so a path that keeps
 	 * getting hit stays in the table even if it was first seen long ago.
 	 *
-	 * Private — called by `log404` only after a new path was inserted.
+	 * Called by scheduled system cleanup, never by the anonymous request path.
 	 */
-	private async enforce404Cap(): Promise<void> {
-		const countRow = await this.db
-			.selectFrom("_emdash_404_log")
-			.select((eb) => eb.fn.countAll<number>().as("c"))
-			.executeTakeFirst();
-		const count = Number(countRow?.c ?? 0);
-		if (count <= MAX_404_LOG_ROWS) return;
-
-		const excess = count - MAX_404_LOG_ROWS;
-
-		// Evict the oldest rows in a single SQL statement. Using a subquery
-		// (rather than materialising the victim IDs in JS and passing them
-		// back as bind parameters) keeps the statement bounded regardless of
-		// how far over cap the table is — important for existing installs
-		// that crossed the threshold before this cap was introduced.
-		await this.db
+	async cleanup404Log(): Promise<number> {
+		// Keep the newest rows in one statement. Deriving the victims inside the
+		// DELETE makes overlapping cleanup runs idempotent: each statement
+		// evaluates the current newest set instead of acting on a stale count.
+		const result = await this.db
 			.deleteFrom("_emdash_404_log")
 			.where(
 				"id",
-				"in",
+				"not in",
 				this.db
 					.selectFrom("_emdash_404_log")
 					.select("id")
-					.orderBy("last_seen_at", "asc")
-					.orderBy("id", "asc")
-					.limit(excess),
+					.orderBy("last_seen_at", "desc")
+					.orderBy("id", "desc")
+					.limit(MAX_404_LOG_ROWS),
 			)
-			.execute();
+			.executeTakeFirst();
+		return Number(result.numDeletedRows);
 	}
 
 	async find404s(opts: {

package/src/emdash-runtime.ts

@@ -226,6 +226,7 @@ import {
 	handleMediaList,
 	handleMediaGet,
 	handleMediaCreate,
+	handleMediaRegisterUpload,
 	handleMediaUpdate,
 	handleMediaReplaceMetadata,
 	handleMediaDelete,
@@ -4572,6 +4573,33 @@ export class EmDashRuntime {
 		return result;
 	}
 
+	async handleMediaRegisterUpload(input: { storageKey: string; authorId?: string }) {
+		if (!this.storage) {
+			return {
+				success: false as const,
+				error: { code: "NO_STORAGE", message: "Storage not configured" },
+			};
+		}
+		const result = await handleMediaRegisterUpload(this.db, this.storage, input);
+
+		if (result.success && this.hooks.hasHooks("media:afterUpload")) {
+			const item = result.data.item;
+			const mediaItem: MediaItem = {
+				id: item.id,
+				filename: item.filename,
+				mimeType: item.mimeType,
+				size: item.size,
+				url: `/media/${item.id}/${item.filename}`,
+				createdAt: item.createdAt,
+			};
+			this.hooks
+				.runMediaAfterUpload(mediaItem)
+				.catch((err) => console.error("EmDash afterUpload hook error:", err));
+		}
+
+		return result;
+	}
+
 	async handleMediaCreate(input: {
 		filename: string;
 		mimeType: string;

package/src/index.ts

@@ -88,6 +88,7 @@ export {
 	handleMediaList,
 	handleMediaGet,
 	handleMediaCreate,
+	handleMediaRegisterUpload,
 	handleMediaUpdate,
 	handleMediaReplaceMetadata,
 	handleMediaDelete,

package/src/mcp/server.ts

@@ -2547,27 +2547,15 @@ export function createMcpServer(
 	server.registerTool(
 		"media_create",
 		{
-			title: "Register Uploaded Media",
-			description:
-				"Register a media file that has already been uploaded to storage. The " +
-				"caller is responsible for placing the file at `storageKey` (typically " +
-				"using a signed upload URL obtained from the admin UI or a separate API). " +
-				"This tool persists the metadata record so the file is discoverable via " +
-				"media_list / media_get and can be referenced by content. To upload the " +
-				"file itself, use media_upload (base64 data or a public URL) instead.",
+			title: "Confirm Signed Media Upload",
+			description:
+				"Confirm a file after uploading it with a signed URL obtained from " +
+				"POST /_emdash/api/media/upload-url. `storageKey` must be the key returned " +
+				"for the same user. Confirmation checks that the stored file exists and " +
+				"matches the size fixed when the URL was issued, then makes it available " +
+				"through media_list / media_get. To upload through MCP, use media_upload instead.",
 			inputSchema: z.object({
-				filename: z.string().describe("Original filename (e.g. 'logo.png')"),
-				mimeType: z.string().describe("MIME type (e.g. 'image/png')"),
-				storageKey: z.string().describe("Storage path/key the file was uploaded to"),
-				size: z.number().int().nonnegative().optional().describe("File size in bytes"),
-				width: z.number().int().positive().optional().describe("Image width in pixels"),
-				height: z.number().int().positive().optional().describe("Image height in pixels"),
-				contentHash: z.string().optional().describe("Hash of the file contents (for dedupe)"),
-				blurhash: z.string().optional().describe("Blurhash for image placeholders"),
-				dominantColor: z
-					.string()
-					.optional()
-					.describe("Hex color string for the image's dominant color"),
+				storageKey: z.string().describe("Storage key returned by the signed upload URL request"),
 			}),
 		},
 		async (args, extra) => {
@@ -2575,16 +2563,8 @@ export function createMcpServer(
 			requireRole(extra, Role.AUTHOR);
 			const { emdash, userId } = getExtra(extra);
 			return unwrap(
-				await emdash.handleMediaCreate({
-					filename: args.filename,
-					mimeType: args.mimeType,
+				await emdash.handleMediaRegisterUpload({
 					storageKey: args.storageKey,
-					size: args.size,
-					width: args.width,
-					height: args.height,
-					contentHash: args.contentHash,
-					blurhash: args.blurhash,
-					dominantColor: args.dominantColor,
 					authorId: userId,
 				}),
 			);
@@ -2596,34 +2576,20 @@ export function createMcpServer(
 		{
 			title: "Upload Media",
 			description:
-				"Upload a media file from base64-encoded data or an external URL and " +
+				"Upload a media file from base64-encoded data and " +
 				"register it in the media library. Returns the media item with id, " +
 				"storageKey, and url — ready to reference from content fields (e.g. " +
 				"featured_image) via content_create / content_update. Uploads are " +
 				"deduplicated by content hash: re-uploading identical bytes returns " +
-				"the existing item with deduplicated: true. URL fetches must resolve " +
-				"to a public http(s) host (SSRF-guarded). Subject to the global " +
+				"the existing item with deduplicated: true. Subject to the global " +
 				"upload MIME allowlist and the configured maximum upload size.",
 			inputSchema: z.object({
 				filename: z.string().min(1).describe("Filename including extension (e.g. 'cover.png')"),
-				base64: z
-					.string()
-					.optional()
-					.describe("Base64-encoded file contents. Provide exactly one of base64 / url."),
-				url: z
-					.url()
-					.optional()
-					.describe(
-						"Public http(s) URL to fetch the file from. Provide exactly one of base64 / url.",
-					),
+				base64: z.string().describe("Base64-encoded file contents."),
 				contentType: z
 					.string()
 					.regex(CONTENT_TYPE_RE, "Invalid content type")
-					.optional()
-					.describe(
-						"MIME type (e.g. 'image/png'). Required with base64; with url it " +
-							"defaults to the response's Content-Type header.",
-					),
+					.describe("MIME type (e.g. 'image/png')."),
 				alt: z.string().optional().describe("Alt text for accessibility"),
 			}),
 			annotations: { destructiveHint: false },
@@ -2640,7 +2606,6 @@ export function createMcpServer(
 					await emdash.handleMediaUpload({
 						filename: args.filename,
 						base64: args.base64,
-						url: args.url,
 						contentType: args.contentType,
 						alt: args.alt,
 						authorId: userId,