emdash 0.41.0 → 0.42.0

package/src/api/handlers/content.ts

@@ -47,6 +47,7 @@ import {
 	type ScheduledPolicyRejection,
 } from "../../plugins/content-policy.js";
 import { invalidateRedirectCache } from "../../redirects/cache.js";
+import { requestCached } from "../../request-cache.js";
 import { isStoragelessFieldRow } from "../../schema/types.js";
 import { FTSManager } from "../../search/fts-manager.js";
 import { invalidateTermCache } from "../../taxonomies/index.js";
@@ -67,6 +68,7 @@ import {
 	applyStagedReferences,
 	liveReferenceSelection,
 	pageStagedGroups,
+	readStagedReferenceBaselines,
 	readStagedReferences,
 	recordPublishedReferences,
 	STAGED_REFERENCES_KEY,
@@ -229,30 +231,40 @@ const SEO_DEFAULTS: ContentSeo = {
 
 /**
  * Check if a collection has SEO enabled.
+ *
+ * Cached per request so bulk imports do not re-query `_emdash_collections`
+ * for every item they create.
  */
 async function collectionHasSeo(db: Kysely<Database>, collection: string): Promise<boolean> {
-	const row = await db
-		.selectFrom("_emdash_collections")
-		.select("has_seo")
-		.where("slug", "=", collection)
-		.executeTakeFirst();
-	return row?.has_seo === 1;
+	return requestCached(`collectionHasSeo:${collection}`, async () => {
+		const row = await db
+			.selectFrom("_emdash_collections")
+			.select("has_seo")
+			.where("slug", "=", collection)
+			.executeTakeFirst();
+		return row?.has_seo === 1;
+	});
 }
 
+/**
+ * Collection publication metadata, cached per request for bulk imports.
+ */
 async function getCollectionPublishConfig(
 	db: Kysely<Database>,
 	collection: string,
 ): Promise<{ supportsRevisions: boolean; routable: boolean }> {
-	const row = await db
-		.selectFrom("_emdash_collections")
-		.select(["supports", "routable"])
-		.where("slug", "=", collection)
-		.executeTakeFirst();
-	const supports: unknown = row?.supports ? JSON.parse(row.supports) : [];
-	return {
-		supportsRevisions: Array.isArray(supports) && supports.includes("revisions"),
-		routable: row?.routable !== 0,
-	};
+	return requestCached(`collectionPublishConfig:${collection}`, async () => {
+		const row = await db
+			.selectFrom("_emdash_collections")
+			.select(["supports", "routable"])
+			.where("slug", "=", collection)
+			.executeTakeFirst();
+		const supports: unknown = row?.supports ? JSON.parse(row.supports) : [];
+		return {
+			supportsRevisions: Array.isArray(supports) && supports.includes("revisions"),
+			routable: row?.routable !== 0,
+		};
+	});
 }
 
 function requireRoutablePublishSlug(routable: boolean, slug: string | null | undefined): void {
@@ -2307,12 +2319,16 @@ export async function handleContentPublish(
 					? await new RevisionRepository(trx).findById(existing.draftRevisionId)
 					: undefined;
 			const stagedReferences = draftRevision ? readStagedReferences(draftRevision.data) : undefined;
+			const stagedReferenceBaselines = draftRevision
+				? readStagedReferenceBaselines(draftRevision.data)
+				: undefined;
 			if (existing?.translationGroup) {
 				const valid = await validateStagedReferences(
 					trx,
 					collection,
 					stagedReferences ?? {},
 					existing.translationGroup,
+					stagedReferenceBaselines,
 				);
 				if (!valid.success) {
 					throw Object.assign(new Error(valid.error.message), {
@@ -2342,7 +2358,13 @@ export async function handleContentPublish(
 						expectedScheduledAt: options.expectedScheduledAt,
 						expectedRevision,
 					});
-					await applyStagedReferences(trx, collection, existing.translationGroup, stagedReferences);
+					await applyStagedReferences(
+						trx,
+						collection,
+						existing.translationGroup,
+						stagedReferences,
+						stagedReferenceBaselines,
+					);
 				}
 			}
 

package/src/api/handlers/index.ts

@@ -39,6 +39,9 @@ export {
 	type RecentItem,
 } from "./dashboard.js";
 
+// Core update check
+export { handleCoreUpdateStatus, type CoreUpdateStatus } from "./update-check.js";
+
 // Manifest generation
 export { generateManifest } from "./manifest.js";
 

package/src/api/handlers/manifest.ts

@@ -182,7 +182,9 @@ export async function buildManifestCollections(
 				titleField: collection.titleField,
 				dateField: collection.dateField,
 				...(collection.hidden ? { hidden: true } : {}),
+				...(collection.icon ? { icon: collection.icon } : {}),
 				...(collection.group ? { group: collection.group } : {}),
+				...(collection.admin?.quickCreate === false ? { quickCreate: false } : {}),
 				listColumns: listColumns.length > 0 ? listColumns : undefined,
 				fields,
 			};

package/src/api/handlers/media-upload.ts

@@ -31,6 +31,8 @@ export interface MediaUploadInput {
 	contentType: string;
 	/** Alt text stored on the media record. */
 	alt?: string;
+	/** Caption stored on the media record. */
+	caption?: string;
 	authorId?: string;
 	/** Upload size limit in bytes (defaults to DEFAULT_MAX_UPLOAD_SIZE). */
 	maxUploadSize?: number;
@@ -161,6 +163,7 @@ export async function handleMediaUpload(
 				width: enriched.width,
 				height: enriched.height,
 				alt: input.alt,
+				caption: input.caption,
 				storageKey,
 				contentHash,
 				blurhash: enriched.blurhash,

package/src/api/handlers/media.ts

@@ -40,7 +40,7 @@ export async function handleMediaList(
 ): Promise<ApiResult<MediaListResponse>> {
 	try {
 		if (params.page !== undefined) {
-			const limit = Math.min(params.limit || 50, 100);
+			const limit = Math.max(1, Math.min(params.limit || 50, 100));
 			const offset = (params.page - 1) * limit;
 			if (
 				params.cursor !== undefined ||
@@ -68,7 +68,7 @@ export async function handleMediaList(
 		const repo = new MediaRepository(db);
 		const result = await repo.findMany({
 			cursor: params.cursor,
-			limit: Math.min(params.limit || 50, 100),
+			limit: Math.max(1, Math.min(params.limit || 50, 100)),
 			mimeType: params.mimeType,
 			q: params.q,
 			folderId: params.folderId,

package/src/api/handlers/registry.ts

@@ -11,9 +11,14 @@ import { ClientResponseError, ClientValidationError } from "@atcute/client";
 import type { Did } from "@atcute/lexicons";
 import { canonicalizeDeclaredAccess } from "@emdash-cms/plugin-types";
 import type { CanonicalDeclaredAccess } from "@emdash-cms/plugin-types";
-import { checkEnvCompatibility, findSkippedEnvConstraints } from "@emdash-cms/registry-client/env";
+import {
+	checkEnvCompatibility,
+	compareVersions,
+	findSkippedEnvConstraints,
+} from "@emdash-cms/registry-client/env";
 import type { HostEnv } from "@emdash-cms/registry-client/env";
 import { isProvenFirstRelease } from "@emdash-cms/registry-client/listing-policy";
+import type { ReleaseHistoryEvidence } from "@emdash-cms/registry-client/listing-policy";
 import { evaluateRegistryReleaseWithdrawal } from "@emdash-cms/registry-client/withdrawal";
 import { NSID } from "@emdash-cms/registry-lexicons";
 import {
@@ -55,7 +60,7 @@ import {
 } from "../../registry/config.js";
 import { makeRegistryPluginId } from "../../registry/plugin-id.js";
 import { hasCurrentRecordLabel } from "../../registry/record-labels.js";
-import type { RegistryConfigInput } from "../../registry/types.js";
+import type { RegistryConfig, RegistryConfigInput } from "../../registry/types.js";
 import { resolveAndValidateExternalUrlTarget } from "../../security/ssrf.js";
 import { EmDashStorageError } from "../../storage/types.js";
 import type { Storage } from "../../storage/types.js";
@@ -258,7 +263,7 @@ function recordVerificationSummary(
 /**
  * Bytes-per-artifact cap on the gzipped tarball we'll download before
  * decompression. RFC 0001 caps a sandboxed plugin bundle at 256 KiB
- * decompressed (see `MAX_BUNDLE_SIZE` in cli/commands/bundle-utils.ts);
+ * decompressed (see `MAX_BUNDLE_SIZE` in @emdash-cms/plugin-cli);
  * gzip on a mix of JSON manifest + JS code typically gives 0.3-0.6
  * ratio, so compressed bundles are well under 200 KiB in practice.
  * 512 KiB leaves margin for unusual file mixes that compress poorly
@@ -392,6 +397,80 @@ interface EnvIncompatibleError {
 	details: { requires: Record<string, string>; host: HostEnv };
 }
 
+/**
+ * Returns an error when the release is younger than `policy.minimumReleaseAge`,
+ * unless its publisher or package is in `minimumReleaseAgeExclude` or it is a
+ * proven first release.
+ *
+ * `releaseView.indexedAt` is aggregator operational data, not part of the
+ * signed release. The release schema has no publication timestamp, so minimum
+ * age remains a local discovery holdback rather than a cryptographic property.
+ * A missing or malformed timestamp fails closed.
+ */
+function checkMinimumReleaseAge(
+	registryConfig: RegistryConfig,
+	publisherDid: string,
+	slug: string,
+	packageView: ReleaseHistoryEvidence,
+	releaseView: { indexedAt: string },
+): ApiResult<never> | null {
+	const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
+	let minimumReleaseAgeSeconds = 0;
+	if (minimumReleaseAge !== undefined) {
+		// Normally rejected by `normalizeRegistryConfig`, but a config-mutation
+		// path could re-enter with a bad value; surface it as a structured error
+		// rather than a generic 500.
+		try {
+			minimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);
+		} catch (err) {
+			return {
+				success: false,
+				error: {
+					code: "REGISTRY_POLICY_INVALID",
+					message:
+						err instanceof Error
+							? err.message
+							: "Invalid minimumReleaseAge value in registry config",
+				},
+			};
+		}
+	}
+	if (minimumReleaseAgeSeconds > 0) {
+		const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>
+			e.trim().toLowerCase(),
+		);
+		const exempt =
+			releaseExemptFromMinimumAge(exclude, publisherDid, slug) || isProvenFirstRelease(packageView);
+		if (!exempt) {
+			const indexedAt = Date.parse(releaseView.indexedAt);
+			if (!Number.isFinite(indexedAt)) {
+				return {
+					success: false,
+					error: {
+						code: "RELEASE_TIMESTAMP_INVALID",
+						message:
+							"Release record is missing a valid indexed-at timestamp; cannot evaluate minimum release age policy.",
+					},
+				};
+			}
+			const ageSeconds = (Date.now() - indexedAt) / 1000;
+			if (ageSeconds < minimumReleaseAgeSeconds) {
+				const remaining = Math.ceil(minimumReleaseAgeSeconds - ageSeconds);
+				return {
+					success: false,
+					error: {
+						code: "RELEASE_TOO_NEW",
+						message:
+							`This release does not meet the configured minimum release age of ` +
+							`${minimumReleaseAgeSeconds}s. It will be installable in ~${remaining}s.`,
+					},
+				};
+			}
+		}
+	}
+	return null;
+}
+
 /**
  * Gate a release's `requires` constraints against the running host
  * environment. `requires` is the lexicon-`unknown` value off the signed
@@ -698,73 +777,15 @@ export async function handleRegistryInstall(
 		// Step 3a: enforce the configured minimum release age. The browser
 		// applies the same check up front for UX, but the gate lives here
 		// -- a stale browser tab, a deep link, or a non-admin-UI caller
-		// must still hit the holdback. The `minimumReleaseAgeExclude`
-		// allowlist short-circuits the check for trusted publisher DIDs.
-		//
-		// `releaseView.indexedAt` is aggregator operational data, not part
-		// of the signed release. The release schema has no publication
-		// timestamp, so minimum age remains a local discovery holdback
-		// rather than a cryptographic property. A missing or malformed
-		// timestamp fails closed.
-		// `registryConfig` is the user-supplied integration option, not
-		// the normalized manifest shape, so the duration parse runs once
-		// per install. Catch a malformed value here -- normally caught at
-		// `normalizeRegistryConfig` time, but a future config-mutation
-		// path could re-enter with a bad value -- and surface it as a
-		// structured error rather than letting it bubble out as a generic
-		// 500.
-		const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
-		let minimumReleaseAgeSeconds = 0;
-		if (minimumReleaseAge !== undefined) {
-			try {
-				minimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);
-			} catch (err) {
-				return {
-					success: false,
-					error: {
-						code: "REGISTRY_POLICY_INVALID",
-						message:
-							err instanceof Error
-								? err.message
-								: "Invalid minimumReleaseAge value in registry config",
-					},
-				};
-			}
-		}
-		if (minimumReleaseAgeSeconds > 0) {
-			const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>
-				e.trim().toLowerCase(),
-			);
-			const exempt =
-				releaseExemptFromMinimumAge(exclude, publisherDid, slug) ||
-				isProvenFirstRelease(packageView);
-			if (!exempt) {
-				const indexedAt = Date.parse(releaseView.indexedAt);
-				if (!Number.isFinite(indexedAt)) {
-					return {
-						success: false,
-						error: {
-							code: "RELEASE_TIMESTAMP_INVALID",
-							message:
-								"Release record is missing a valid indexed-at timestamp; cannot evaluate minimum release age policy.",
-						},
-					};
-				}
-				const ageSeconds = (Date.now() - indexedAt) / 1000;
-				if (ageSeconds < minimumReleaseAgeSeconds) {
-					const remaining = Math.ceil(minimumReleaseAgeSeconds - ageSeconds);
-					return {
-						success: false,
-						error: {
-							code: "RELEASE_TOO_NEW",
-							message:
-								`This release does not meet the configured minimum release age of ` +
-								`${minimumReleaseAgeSeconds}s. It will be installable in ~${remaining}s.`,
-						},
-					};
-				}
-			}
-		}
+		// must still hit the holdback.
+		const releaseAgeError = checkMinimumReleaseAge(
+			registryConfig,
+			publisherDid,
+			slug,
+			packageView,
+			releaseView,
+		);
+		if (releaseAgeError) return releaseAgeError;
 
 		// Derive the normalized opaque plugin id we'll use as the
 		// runtime-wide identifier from here on. The publisher_did + slug
@@ -1401,6 +1422,38 @@ export async function handleRegistryUpdate(
 				},
 			};
 		}
+		// Only an explicitly requested version is order-checked: on the latest
+		// path the aggregator selects the version, and a publisher yanking the
+		// newest release is how a rollback reaches installed sites.
+		if (opts?.version !== undefined) {
+			const order = compareVersions(newVersion, oldVersion);
+			if (order === null) {
+				return {
+					success: false,
+					error: {
+						code: "INVALID_VERSION",
+						message: "Installed or requested version is not valid semver",
+					},
+				};
+			}
+			if (order < 0) {
+				return {
+					success: false,
+					error: {
+						code: "DOWNGRADE_NOT_ALLOWED",
+						message: "An update cannot target a version older than the installed one",
+					},
+				};
+			}
+		}
+		const releaseAgeError = checkMinimumReleaseAge(
+			registryConfig,
+			publisherDid,
+			slug,
+			packageView,
+			releaseView,
+		);
+		if (releaseAgeError) return releaseAgeError;
 		const authoritative = await (opts?.readAuthoritativeRecords ?? readAuthoritativePackageRelease)(
 			publisherDid,
 			slug,

package/src/api/handlers/revision.ts

@@ -14,6 +14,7 @@ import type { ApiResult, ContentResponse } from "../types.js";
 import {
 	applyStagedReferences,
 	readStagedReferences,
+	STAGED_REFERENCES_BASELINE_KEY,
 	validateStagedReferences,
 } from "./staged-references.js";
 
@@ -38,7 +39,9 @@ export async function handleRevisionList(
 	try {
 		const repo = new RevisionRepository(db);
 		const [items, total] = await Promise.all([
-			repo.findByEntry(collection, entryId, { limit: Math.min(params.limit || 50, 100) }),
+			repo.findByEntry(collection, entryId, {
+				limit: Math.max(1, Math.min(params.limit || 50, 100)),
+			}),
 			repo.countByEntry(collection, entryId),
 		]);
 
@@ -134,10 +137,12 @@ export async function handleRevisionRestore(
 			}
 		}
 
+		const restoredData = { ...revision.data };
+		delete restoredData[STAGED_REFERENCES_BASELINE_KEY];
 		const { item, revisionId: queuedRevisionId } = await new ContentRepository(db).restoreRevision(
 			revision.collection,
 			revision.entryId,
-			revision.data,
+			restoredData,
 			callerUserId,
 		);
 
@@ -145,6 +150,9 @@ export async function handleRevisionRestore(
 		// fence leaves the live links untouched. The restore's own revision carries
 		// the selection, so restoring it again retries a promotion that failed here.
 		if (stagedReferences && item.translationGroup) {
+			// Restoring a revision means replacing the current live selection with the
+			// revision's selection, not merging a diff. The queued restored revision
+			// also omits the old draft baseline so publishing it keeps this behavior.
 			await applyStagedReferences(db, revision.collection, item.translationGroup, stagedReferences);
 		}
 

package/src/api/handlers/staged-references.ts

@@ -3,7 +3,11 @@ import type { Kysely } from "kysely";
 import { RelationRepository } from "../../database/repositories/relation.js";
 import { RevisionRepository } from "../../database/repositories/revision.js";
 import type { Database } from "../../database/types.js";
-import { STAGED_REFERENCES_KEY, type StagedReferences } from "../../references/staged.js";
+import {
+	STAGED_REFERENCES_KEY,
+	type StagedReferenceBaselines,
+	type StagedReferences,
+} from "../../references/staged.js";
 import type { ApiResult } from "../types.js";
 import { validateOppositeSideLimit, writeReferenceSelection } from "./relations.js";
 import {
@@ -13,14 +17,21 @@ import {
 } from "./validate-references.js";
 
 export {
+	mergeStagedReferenceBaselines,
 	mergeStagedReferences,
 	pageStagedGroups,
+	readStagedReferenceBaselines,
 	readStagedReferences,
 	REFERENCE_PAGE_LIMIT,
 	REFERENCE_PAGE_MAX_LIMIT,
+	STAGED_REFERENCES_BASELINE_KEY,
 	STAGED_REFERENCES_KEY,
 } from "../../references/staged.js";
-export type { PageOfGroups, StagedReferences } from "../../references/staged.js";
+export type {
+	PageOfGroups,
+	StagedReferenceBaselines,
+	StagedReferences,
+} from "../../references/staged.js";
 
 /** One bound field's live selection as translation groups. */
 async function liveFieldSelection(
@@ -52,13 +63,18 @@ export async function validateStagedReferences(
 	collection: string,
 	staged: StagedReferences,
 	entryGroup: string,
+	baselines?: StagedReferenceBaselines,
 ): Promise<ApiResult<true>> {
 	const repo = new RelationRepository(db);
 	for (const field of (await referenceFieldConstraints(db, collection)).values()) {
 		const isStaged = Object.hasOwn(staged, field.slug);
-		const groups = isStaged
-			? (staged[field.slug] ?? [])
-			: await liveFieldSelection(repo, field, entryGroup);
+		let groups = isStaged ? (staged[field.slug] ?? []) : undefined;
+		const baseline = baselines?.[field.slug];
+		if (groups && baseline) {
+			const live = await liveFieldSelection(repo, field, entryGroup);
+			groups = applyReferenceDiff(baseline, groups, live);
+		}
+		groups ??= await liveFieldSelection(repo, field, entryGroup);
 		const valid = validateReferenceSelection(field, groups);
 		if (!valid.success) return valid;
 
@@ -97,6 +113,36 @@ export async function liveReferenceSelection(
 	return selection;
 }
 
+/**
+ * Compute the selection that results from applying the staged-versus-baseline
+ * diff on top of the current live selection.
+ *
+ * Additions and removals made in the draft win. Items the draft left unchanged
+ * follow the current live selection, preserving additions and removals made
+ * from the relation's opposite end.
+ */
+function applyReferenceDiff(baseline: string[], staged: string[], live: string[]): string[] {
+	const baselineSet = new Set(baseline);
+	const stagedSet = new Set(staged);
+	const liveSet = new Set(live);
+	const additionSet = new Set(staged.filter((group) => !baselineSet.has(group)));
+	const removalSet = new Set(baseline.filter((group) => !stagedSet.has(group)));
+
+	const result: string[] = [];
+	const seen = new Set<string>();
+	for (const group of staged) {
+		if ((!additionSet.has(group) && !liveSet.has(group)) || seen.has(group)) continue;
+		result.push(group);
+		seen.add(group);
+	}
+	for (const group of live) {
+		if (removalSet.has(group) || seen.has(group)) continue;
+		result.push(group);
+		seen.add(group);
+	}
+	return result;
+}
+
 /**
  * Record the complete live selection in the revision publication just made live.
  *
@@ -121,22 +167,42 @@ export async function recordPublishedReferences(
  * A field slug the collection no longer carries as a bound reference field is
  * skipped: the revision outlived the field, and there is no relation left to
  * write into.
+ *
+ * When `baselines` are provided, each staged field is promoted as a diff
+ * against its baseline rather than as a wholesale replacement. That prevents a
+ * draft saved before a concurrent opposite-end publish from undoing the links
+ * that publish added or removed.
  */
 export async function applyStagedReferences(
 	db: Kysely<Database>,
 	collection: string,
 	entryGroup: string,
 	staged: StagedReferences,
+	baselines?: StagedReferenceBaselines,
 ): Promise<void> {
 	const constraints = await referenceFieldConstraints(db, collection);
+	const repo = new RelationRepository(db);
 	for (const [fieldSlug, groups] of Object.entries(staged)) {
 		const field = constraints.get(fieldSlug);
 		if (!field) continue;
+
+		const baseline = baselines?.[fieldSlug];
+		let selection: string[];
+		if (baseline) {
+			const live = await liveFieldSelection(repo, field, entryGroup);
+			selection = applyReferenceDiff(baseline, groups, live);
+		} else {
+			// Older drafts and restored live revisions carry no baseline; keep the
+			// previous wholesale-replacement behavior rather than silently changing
+			// their semantics.
+			selection = groups;
+		}
+
 		await writeReferenceSelection(db, {
 			relation: field.relation,
 			side: field.relationSide,
 			entryGroup,
-			groups,
+			groups: selection,
 		});
 	}
 }