emdash 0.7.0 → 0.9.0

package/dist/db/sqlite.mjs

@@ -1,12 +1,17 @@
-import { n as __require } from "../chunk-ClPoSABd.mjs";
+import BetterSqlite3 from "better-sqlite3";
+import { SqliteDialect } from "kysely";
 
 //#region src/db/sqlite.ts
 /**
+* SQLite runtime adapter
+*
+* Creates a Kysely dialect for better-sqlite3.
+* Loaded at runtime via virtual module.
+*/
+/**
 * Create a SQLite dialect from config
 */
 function createDialect(config) {
-	const BetterSqlite3 = __require("better-sqlite3");
-	const { SqliteDialect } = __require("kysely");
 	const url = config.url;
 	return new SqliteDialect({ database: new BetterSqlite3(url.startsWith("file:") ? url.slice(5) : url) });
 }

package/dist/db/sqlite.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.mjs","names":[],"sources":["../../src/db/sqlite.ts"],"sourcesContent":["/**\n * SQLite runtime adapter\n *\n * Creates a Kysely dialect for better-sqlite3.\n * Loaded at runtime via virtual module.\n */\n\nimport type { Dialect } from \"kysely\";\n\nimport type { SqliteConfig } from \"./adapters.js\";\n\n/**\n * Create a SQLite dialect from config\n */\nexport function createDialect(config: SqliteConfig): Dialect {\n\t// Dynamic import to avoid loading better-sqlite3 at config time\n\tconst BetterSqlite3 = require(\"better-sqlite3\");\n\tconst { SqliteDialect } = require(\"kysely\");\n\n\t// Parse URL to get file path\n\tconst url = config.url;\n\tconst filePath = url.startsWith(\"file:\") ? url.slice(5) : url;\n\n\tconst database = new BetterSqlite3(filePath);\n\n\treturn new SqliteDialect({ database });\n}\n"],"mappings":";;;;;;AAcA,SAAgB,cAAc,QAA+B;CAE5D,MAAM,0BAAwB,iBAAiB;CAC/C,MAAM,EAAE,4BAA0B,SAAS;CAG3C,MAAM,MAAM,OAAO;AAKnB,QAAO,IAAI,cAAc,EAAE,UAFV,IAAI,cAFJ,IAAI,WAAW,QAAQ,GAAG,IAAI,MAAM,EAAE,GAAG,IAEd,EAEP,CAAC"}
+{"version":3,"file":"sqlite.mjs","names":[],"sources":["../../src/db/sqlite.ts"],"sourcesContent":["/**\n * SQLite runtime adapter\n *\n * Creates a Kysely dialect for better-sqlite3.\n * Loaded at runtime via virtual module.\n */\n\nimport BetterSqlite3 from \"better-sqlite3\";\nimport { type Dialect, SqliteDialect } from \"kysely\";\n\nimport type { SqliteConfig } from \"./adapters.js\";\n\n/**\n * Create a SQLite dialect from config\n */\nexport function createDialect(config: SqliteConfig): Dialect {\n\t// Parse URL to get file path\n\tconst url = config.url;\n\tconst filePath = url.startsWith(\"file:\") ? url.slice(5) : url;\n\n\tconst database = new BetterSqlite3(filePath);\n\n\treturn new SqliteDialect({ database });\n}\n"],"mappings":";;;;;;;;;;;;;AAeA,SAAgB,cAAc,QAA+B;CAE5D,MAAM,MAAM,OAAO;AAKnB,QAAO,IAAI,cAAc,EAAE,UAFV,IAAI,cAFJ,IAAI,WAAW,QAAQ,GAAG,IAAI,MAAM,EAAE,GAAG,IAEd,EAEP,CAAC"}

package/dist/{db-errors-D0UT85nC.mjs → db-errors-WRezodiz.mjs}

@@ -38,4 +38,4 @@ function isMissingTableError(error) {
 
 //#endregion
 export { isMissingTableError as t };
-//# sourceMappingURL=db-errors-D0UT85nC.mjs.map
+//# sourceMappingURL=db-errors-WRezodiz.mjs.map

package/dist/{db-errors-D0UT85nC.mjs.map → db-errors-WRezodiz.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"db-errors-D0UT85nC.mjs","names":[],"sources":["../src/utils/db-errors.ts"],"sourcesContent":["/**\n * Shared detection helpers for database-layer error messages.\n *\n * Different SQL dialects phrase \"table or relation does not exist\" differently:\n *\n * - SQLite / D1:    \"no such table: foo\"\n * - PostgreSQL:     'relation \"foo\" does not exist'\n *                   'table \"foo\" does not exist'\n * - MySQL (future): \"Table 'db.foo' doesn't exist\"\n *\n * Runtime code paths that short-circuit on missing tables (pre-migration\n * probes, optional feature tables, etc.) should use these helpers rather\n * than hand-rolling string matches per call-site.\n */\n\n/**\n * Extract a lowercase error message from any unknown value, safely.\n */\nfunction messageOf(error: unknown): string {\n\tif (error instanceof Error) return error.message.toLowerCase();\n\tif (typeof error === \"string\") return error.toLowerCase();\n\treturn \"\";\n}\n\n/**\n * Returns true when `error` is a \"table does not exist\" error across the\n * dialects EmDash supports (D1/SQLite and PostgreSQL). Used by runtime\n * probes to treat pre-migration databases as empty without logging a scary\n * warning, while still propagating unrelated errors (permissions, connection\n * loss, syntax issues) to callers.\n */\nexport function isMissingTableError(error: unknown): boolean {\n\tconst message = messageOf(error);\n\tif (!message) return false;\n\n\t// SQLite / D1\n\tif (message.includes(\"no such table\")) return true;\n\n\t// PostgreSQL (and some MySQL variants): \"relation ... does not exist\" /\n\t// \"table ... does not exist\" / \"doesn't exist\".\n\tif (message.includes(\"does not exist\") || message.includes(\"doesn't exist\")) {\n\t\treturn message.includes(\"relation\") || message.includes(\"table\");\n\t}\n\n\treturn false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,SAAS,UAAU,OAAwB;AAC1C,KAAI,iBAAiB,MAAO,QAAO,MAAM,QAAQ,aAAa;AAC9D,KAAI,OAAO,UAAU,SAAU,QAAO,MAAM,aAAa;AACzD,QAAO;;;;;;;;;AAUR,SAAgB,oBAAoB,OAAyB;CAC5D,MAAM,UAAU,UAAU,MAAM;AAChC,KAAI,CAAC,QAAS,QAAO;AAGrB,KAAI,QAAQ,SAAS,gBAAgB,CAAE,QAAO;AAI9C,KAAI,QAAQ,SAAS,iBAAiB,IAAI,QAAQ,SAAS,gBAAgB,CAC1E,QAAO,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS,QAAQ;AAGjE,QAAO"}
+{"version":3,"file":"db-errors-WRezodiz.mjs","names":[],"sources":["../src/utils/db-errors.ts"],"sourcesContent":["/**\n * Shared detection helpers for database-layer error messages.\n *\n * Different SQL dialects phrase \"table or relation does not exist\" differently:\n *\n * - SQLite / D1:    \"no such table: foo\"\n * - PostgreSQL:     'relation \"foo\" does not exist'\n *                   'table \"foo\" does not exist'\n * - MySQL (future): \"Table 'db.foo' doesn't exist\"\n *\n * Runtime code paths that short-circuit on missing tables (pre-migration\n * probes, optional feature tables, etc.) should use these helpers rather\n * than hand-rolling string matches per call-site.\n */\n\n/**\n * Extract a lowercase error message from any unknown value, safely.\n */\nfunction messageOf(error: unknown): string {\n\tif (error instanceof Error) return error.message.toLowerCase();\n\tif (typeof error === \"string\") return error.toLowerCase();\n\treturn \"\";\n}\n\n/**\n * Returns true when `error` is a \"table does not exist\" error across the\n * dialects EmDash supports (D1/SQLite and PostgreSQL). Used by runtime\n * probes to treat pre-migration databases as empty without logging a scary\n * warning, while still propagating unrelated errors (permissions, connection\n * loss, syntax issues) to callers.\n */\nexport function isMissingTableError(error: unknown): boolean {\n\tconst message = messageOf(error);\n\tif (!message) return false;\n\n\t// SQLite / D1\n\tif (message.includes(\"no such table\")) return true;\n\n\t// PostgreSQL (and some MySQL variants): \"relation ... does not exist\" /\n\t// \"table ... does not exist\" / \"doesn't exist\".\n\tif (message.includes(\"does not exist\") || message.includes(\"doesn't exist\")) {\n\t\treturn message.includes(\"relation\") || message.includes(\"table\");\n\t}\n\n\treturn false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,SAAS,UAAU,OAAwB;AAC1C,KAAI,iBAAiB,MAAO,QAAO,MAAM,QAAQ,aAAa;AAC9D,KAAI,OAAO,UAAU,SAAU,QAAO,MAAM,aAAa;AACzD,QAAO;;;;;;;;;AAUR,SAAgB,oBAAoB,OAAyB;CAC5D,MAAM,UAAU,UAAU,MAAM;AAChC,KAAI,CAAC,QAAS,QAAO;AAGrB,KAAI,QAAQ,SAAS,gBAAgB,CAAE,QAAO;AAI9C,KAAI,QAAQ,SAAS,iBAAiB,IAAI,QAAQ,SAAS,gBAAgB,CAC1E,QAAO,QAAQ,SAAS,WAAW,IAAI,QAAQ,SAAS,QAAQ;AAGjE,QAAO"}

package/dist/{default-CME5YdZ3.mjs → default-D8ksjWhO.mjs}

@@ -78,4 +78,4 @@ const defaultSeed = {
 
 //#endregion
 export { defaultSeed as t };
-//# sourceMappingURL=default-CME5YdZ3.mjs.map
+//# sourceMappingURL=default-D8ksjWhO.mjs.map

package/dist/{default-CME5YdZ3.mjs.map → default-D8ksjWhO.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"default-CME5YdZ3.mjs","names":[],"sources":["../src/seed/default.ts"],"sourcesContent":["/**\n * Default seed applied when no user seed file exists.\n *\n * Provides the baseline schema every EmDash site needs:\n * posts, pages, categories, and tags.\n */\n\nimport type { SeedFile } from \"./types.js\";\n\nexport const defaultSeed: SeedFile = {\n\tversion: \"1\",\n\tmeta: {\n\t\tname: \"Default\",\n\t\tdescription: \"Posts and pages with categories and tags\",\n\t},\n\tcollections: [\n\t\t{\n\t\t\tslug: \"posts\",\n\t\t\tlabel: \"Posts\",\n\t\t\tlabelSingular: \"Post\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"featured_image\",\n\t\t\t\t\tlabel: \"Featured Image\",\n\t\t\t\t\ttype: \"image\",\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"excerpt\",\n\t\t\t\t\tlabel: \"Excerpt\",\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\t{\n\t\t\tslug: \"pages\",\n\t\t\tlabel: \"Pages\",\n\t\t\tlabelSingular: \"Page\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t],\n\ttaxonomies: [\n\t\t{\n\t\t\tname: \"category\",\n\t\t\tlabel: \"Categories\",\n\t\t\tlabelSingular: \"Category\",\n\t\t\thierarchical: true,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t\t{\n\t\t\tname: \"tag\",\n\t\t\tlabel: \"Tags\",\n\t\t\tlabelSingular: \"Tag\",\n\t\t\thierarchical: false,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t],\n};\n"],"mappings":";AASA,MAAa,cAAwB;CACpC,SAAS;CACT,MAAM;EACL,MAAM;EACN,aAAa;EACb;CACD,aAAa,CACZ;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ;GACP;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;EACD,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ,CACP;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,YAAY;GACZ,EACD;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,YAAY;GACZ,CACD;EACD,CACD;CACD,YAAY,CACX;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,CACD;CACD"}
+{"version":3,"file":"default-D8ksjWhO.mjs","names":[],"sources":["../src/seed/default.ts"],"sourcesContent":["/**\n * Default seed applied when no user seed file exists.\n *\n * Provides the baseline schema every EmDash site needs:\n * posts, pages, categories, and tags.\n */\n\nimport type { SeedFile } from \"./types.js\";\n\nexport const defaultSeed: SeedFile = {\n\tversion: \"1\",\n\tmeta: {\n\t\tname: \"Default\",\n\t\tdescription: \"Posts and pages with categories and tags\",\n\t},\n\tcollections: [\n\t\t{\n\t\t\tslug: \"posts\",\n\t\t\tlabel: \"Posts\",\n\t\t\tlabelSingular: \"Post\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"featured_image\",\n\t\t\t\t\tlabel: \"Featured Image\",\n\t\t\t\t\ttype: \"image\",\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"excerpt\",\n\t\t\t\t\tlabel: \"Excerpt\",\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t\t{\n\t\t\tslug: \"pages\",\n\t\t\tlabel: \"Pages\",\n\t\t\tlabelSingular: \"Page\",\n\t\t\tsupports: [\"drafts\", \"revisions\", \"search\"],\n\t\t\tfields: [\n\t\t\t\t{\n\t\t\t\t\tslug: \"title\",\n\t\t\t\t\tlabel: \"Title\",\n\t\t\t\t\ttype: \"string\",\n\t\t\t\t\trequired: true,\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tslug: \"content\",\n\t\t\t\t\tlabel: \"Content\",\n\t\t\t\t\ttype: \"portableText\",\n\t\t\t\t\tsearchable: true,\n\t\t\t\t},\n\t\t\t],\n\t\t},\n\t],\n\ttaxonomies: [\n\t\t{\n\t\t\tname: \"category\",\n\t\t\tlabel: \"Categories\",\n\t\t\tlabelSingular: \"Category\",\n\t\t\thierarchical: true,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t\t{\n\t\t\tname: \"tag\",\n\t\t\tlabel: \"Tags\",\n\t\t\tlabelSingular: \"Tag\",\n\t\t\thierarchical: false,\n\t\t\tcollections: [\"posts\"],\n\t\t},\n\t],\n};\n"],"mappings":";AASA,MAAa,cAAwB;CACpC,SAAS;CACT,MAAM;EACL,MAAM;EACN,aAAa;EACb;CACD,aAAa,CACZ;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ;GACP;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,UAAU;IACV,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN,YAAY;IACZ;GACD;IACC,MAAM;IACN,OAAO;IACP,MAAM;IACN;GACD;EACD,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,UAAU;GAAC;GAAU;GAAa;GAAS;EAC3C,QAAQ,CACP;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,UAAU;GACV,YAAY;GACZ,EACD;GACC,MAAM;GACN,OAAO;GACP,MAAM;GACN,YAAY;GACZ,CACD;EACD,CACD;CACD,YAAY,CACX;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,EACD;EACC,MAAM;EACN,OAAO;EACP,eAAe;EACf,cAAc;EACd,aAAa,CAAC,QAAQ;EACtB,CACD;CACD"}

package/dist/{dialect-helpers-DhTzaUxP.mjs → dialect-helpers-BKCvISIQ.mjs}

@@ -53,6 +53,23 @@ async function tableExists(db, tableName) {
 	`.execute(db)).rows.length > 0;
 }
 /**
+* Check if a column exists in the database.
+*/
+async function columnExists(db, tableName, columnName) {
+	if (isPostgres(db)) return (await sql`
+			SELECT EXISTS(
+				SELECT 1 FROM information_schema.columns
+				WHERE table_schema = current_schema()
+					AND table_name = ${tableName}
+					AND column_name = ${columnName}
+			) as exists
+		`.execute(db)).rows[0]?.exists === true;
+	return (await sql`
+		SELECT name FROM pragma_table_info(${tableName})
+		WHERE name = ${columnName}
+	`.execute(db)).rows.length > 0;
+}
+/**
 * List tables matching a LIKE pattern.
 */
 async function listTablesLike(db, pattern) {
@@ -89,5 +106,5 @@ function jsonExtractExpr(db, column, path) {
 }
 
 //#endregion
-export { isSqlite as a, tableExists as c, isPostgres as i, currentTimestamp as n, jsonExtractExpr as o, currentTimestampValue as r, listTablesLike as s, binaryType as t };
-//# sourceMappingURL=dialect-helpers-DhTzaUxP.mjs.map
+export { isPostgres as a, listTablesLike as c, currentTimestampValue as i, tableExists as l, columnExists as n, isSqlite as o, currentTimestamp as r, jsonExtractExpr as s, binaryType as t };
+//# sourceMappingURL=dialect-helpers-BKCvISIQ.mjs.map

package/dist/dialect-helpers-BKCvISIQ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"dialect-helpers-BKCvISIQ.mjs","names":[],"sources":["../src/database/dialect-helpers.ts"],"sourcesContent":["/**\n * Dialect-specific SQL helpers\n *\n * Every function takes a Kysely `db` instance and detects the dialect from\n * the adapter class. No module-level state, no globals, no heuristics —\n * the adapter is the source of truth.\n *\n * This is NOT an ORM abstraction — just targeted helpers for the ~15 places\n * that use raw dialect-specific SQL. Most Kysely schema builder code already\n * works cross-dialect.\n */\n\nimport type { ColumnDataType, Kysely, RawBuilder } from \"kysely\";\nimport { sql } from \"kysely\";\n\nimport type { DatabaseDialectType } from \"../db/adapters.js\";\nimport { validateIdentifier, validateJsonFieldName } from \"./validate.js\";\n\nexport type { DatabaseDialectType };\n\n/**\n * Detect dialect type from a Kysely instance via the adapter class name.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function detectDialect(db: Kysely<any>): DatabaseDialectType {\n\tconst name = db.getExecutor().adapter.constructor.name;\n\tif (name === \"PostgresAdapter\") return \"postgres\";\n\treturn \"sqlite\";\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function isSqlite(db: Kysely<any>): boolean {\n\treturn detectDialect(db) === \"sqlite\";\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function isPostgres(db: Kysely<any>): boolean {\n\treturn detectDialect(db) === \"postgres\";\n}\n\n/**\n * Default timestamp expression for column defaults.\n * Wrapped in parens for use in CREATE TABLE ... DEFAULT (...).\n *\n * sqlite:   (datetime('now'))\n * postgres: CURRENT_TIMESTAMP\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function currentTimestamp(db: Kysely<any>): RawBuilder<string> {\n\tif (isPostgres(db)) {\n\t\treturn sql`CURRENT_TIMESTAMP`;\n\t}\n\treturn sql`(datetime('now'))`;\n}\n\n/**\n * Timestamp expression for use in WHERE clauses and SET expressions.\n * No wrapping parens.\n *\n * sqlite:   datetime('now')\n * postgres: CURRENT_TIMESTAMP\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function currentTimestampValue(db: Kysely<any>): RawBuilder<string> {\n\tif (isPostgres(db)) {\n\t\treturn sql`CURRENT_TIMESTAMP`;\n\t}\n\treturn sql`datetime('now')`;\n}\n\n/**\n * Check if a table exists in the database.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function tableExists(db: Kysely<any>, tableName: string): Promise<boolean> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ exists: boolean }>`\n\t\t\tSELECT EXISTS(\n\t\t\t\tSELECT 1 FROM information_schema.tables\n\t\t\t\tWHERE table_schema = 'public' AND table_name = ${tableName}\n\t\t\t) as exists\n\t\t`.execute(db);\n\t\treturn result.rows[0]?.exists === true;\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM sqlite_master\n\t\tWHERE type = 'table' AND name = ${tableName}\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/**\n * Check if an index exists in the database.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function indexExists(db: Kysely<any>, indexName: string): Promise<boolean> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ exists: boolean }>`\n\t\t\tSELECT EXISTS(\n\t\t\t\tSELECT 1 FROM pg_indexes\n\t\t\t\tWHERE schemaname = current_schema() AND indexname = ${indexName}\n\t\t\t) as exists\n\t\t`.execute(db);\n\t\treturn result.rows[0]?.exists === true;\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM sqlite_master\n\t\tWHERE type = 'index' AND name = ${indexName}\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/**\n * Check if a column exists in the database.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function columnExists(\n\tdb: Kysely<any>,\n\ttableName: string,\n\tcolumnName: string,\n): Promise<boolean> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ exists: boolean }>`\n\t\t\tSELECT EXISTS(\n\t\t\t\tSELECT 1 FROM information_schema.columns\n\t\t\t\tWHERE table_schema = current_schema()\n\t\t\t\t\tAND table_name = ${tableName}\n\t\t\t\t\tAND column_name = ${columnName}\n\t\t\t) as exists\n\t\t`.execute(db);\n\t\treturn result.rows[0]?.exists === true;\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM pragma_table_info(${tableName})\n\t\tWHERE name = ${columnName}\n\t`.execute(db);\n\treturn result.rows.length > 0;\n}\n\n/**\n * List tables matching a LIKE pattern.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport async function listTablesLike(db: Kysely<any>, pattern: string): Promise<string[]> {\n\tif (isPostgres(db)) {\n\t\tconst result = await sql<{ table_name: string }>`\n\t\t\tSELECT table_name FROM information_schema.tables\n\t\t\tWHERE table_schema = 'public' AND table_name LIKE ${pattern}\n\t\t`.execute(db);\n\t\treturn result.rows.map((r) => r.table_name);\n\t}\n\n\tconst result = await sql<{ name: string }>`\n\t\tSELECT name FROM sqlite_master\n\t\tWHERE type = 'table' AND name LIKE ${pattern}\n\t`.execute(db);\n\treturn result.rows.map((r) => r.name);\n}\n\n/**\n * Column type for binary data.\n *\n * sqlite:   blob\n * postgres: bytea\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function binaryType(db: Kysely<any>): ColumnDataType {\n\tif (isPostgres(db)) {\n\t\treturn \"bytea\";\n\t}\n\treturn \"blob\";\n}\n\n/**\n * SQL expression for extracting a field from a JSON/JSONB column.\n *\n * sqlite:   json_extract(column, '$.path')\n * postgres: column->>'path'\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- accepts any Kysely instance\nexport function jsonExtractExpr(db: Kysely<any>, column: string, path: string): string {\n\tvalidateIdentifier(column, \"JSON column name\");\n\tvalidateJsonFieldName(path, \"JSON path\");\n\tif (isPostgres(db)) {\n\t\treturn `${column}->>'${path}'`;\n\t}\n\treturn `json_extract(${column}, '$.${path}')`;\n}\n"],"mappings":";;;;;;;AAwBA,SAAgB,cAAc,IAAsC;AAEnE,KADa,GAAG,aAAa,CAAC,QAAQ,YAAY,SACrC,kBAAmB,QAAO;AACvC,QAAO;;AAIR,SAAgB,SAAS,IAA0B;AAClD,QAAO,cAAc,GAAG,KAAK;;AAI9B,SAAgB,WAAW,IAA0B;AACpD,QAAO,cAAc,GAAG,KAAK;;;;;;;;;AAW9B,SAAgB,iBAAiB,IAAqC;AACrE,KAAI,WAAW,GAAG,CACjB,QAAO,GAAG;AAEX,QAAO,GAAG;;;;;;;;;AAWX,SAAgB,sBAAsB,IAAqC;AAC1E,KAAI,WAAW,GAAG,CACjB,QAAO,GAAG;AAEX,QAAO,GAAG;;;;;AAOX,eAAsB,YAAY,IAAiB,WAAqC;AACvF,KAAI,WAAW,GAAG,CAOjB,SANe,MAAM,GAAwB;;;qDAGM,UAAU;;IAE3D,QAAQ,GAAG,EACC,KAAK,IAAI,WAAW;AAOnC,SAJe,MAAM,GAAqB;;oCAEP,UAAU;GAC3C,QAAQ,GAAG,EACC,KAAK,SAAS;;;;;AA6B7B,eAAsB,aACrB,IACA,WACA,YACmB;AACnB,KAAI,WAAW,GAAG,CASjB,SARe,MAAM,GAAwB;;;;wBAIvB,UAAU;yBACT,WAAW;;IAEhC,QAAQ,GAAG,EACC,KAAK,IAAI,WAAW;AAOnC,SAJe,MAAM,GAAqB;uCACJ,UAAU;iBAChC,WAAW;GACzB,QAAQ,GAAG,EACC,KAAK,SAAS;;;;;AAO7B,eAAsB,eAAe,IAAiB,SAAoC;AACzF,KAAI,WAAW,GAAG,CAKjB,SAJe,MAAM,GAA2B;;uDAEK,QAAQ;IAC3D,QAAQ,GAAG,EACC,KAAK,KAAK,MAAM,EAAE,WAAW;AAO5C,SAJe,MAAM,GAAqB;;uCAEJ,QAAQ;GAC5C,QAAQ,GAAG,EACC,KAAK,KAAK,MAAM,EAAE,KAAK;;;;;;;;AAUtC,SAAgB,WAAW,IAAiC;AAC3D,KAAI,WAAW,GAAG,CACjB,QAAO;AAER,QAAO;;;;;;;;AAUR,SAAgB,gBAAgB,IAAiB,QAAgB,MAAsB;AACtF,oBAAmB,QAAQ,mBAAmB;AAC9C,uBAAsB,MAAM,YAAY;AACxC,KAAI,WAAW,GAAG,CACjB,QAAO,GAAG,OAAO,MAAM,KAAK;AAE7B,QAAO,gBAAgB,OAAO,OAAO,KAAK"}

package/dist/{error-CiYn9yDu.mjs → error-D_-tqP-I.mjs}

@@ -24,4 +24,4 @@ function apiError(code, message, status) {
 
 //#endregion
 export { apiError as t };
-//# sourceMappingURL=error-CiYn9yDu.mjs.map
+//# sourceMappingURL=error-D_-tqP-I.mjs.map

package/dist/error-D_-tqP-I.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-D_-tqP-I.mjs","names":[],"sources":["../src/api/error.ts"],"sourcesContent":["/**\n * Standardized API error responses.\n *\n * All API routes should use these utilities instead of inline\n * `new Response(JSON.stringify({ error: ... }), ...)` patterns.\n */\n\nimport { InvalidCursorError } from \"../database/repositories/types.js\";\nimport { mapErrorStatus } from \"./errors.js\";\nimport type { ApiResult } from \"./types.js\";\n\n// Re-export everything from errors.ts so existing `import { mapErrorStatus } from \"./error.js\"` still works\nexport * from \"./errors.js\";\n\n/**\n * Standard cache headers for all API responses.\n *\n * Cache-Control: private, no-store -- prevents CDN/proxy caching of authenticated data.\n * no-store already tells caches not to store the response, so Vary is unnecessary.\n */\nconst API_CACHE_HEADERS: HeadersInit = {\n\t\"Cache-Control\": \"private, no-store\",\n};\n\n/**\n * Create a standardized error response.\n *\n * Always returns `{ error: { code, message } }` with correct Content-Type.\n * Use this for all error responses in API routes.\n */\nexport function apiError(code: string, message: string, status: number): Response {\n\treturn Response.json({ error: { code, message } }, { status, headers: API_CACHE_HEADERS });\n}\n\n/**\n * Create a standardized success response.\n *\n * Always returns `{ data: T }` with correct status code.\n * Use this for all success responses in API routes.\n */\nexport function apiSuccess<T>(data: T, status = 200): Response {\n\treturn Response.json({ data }, { status, headers: API_CACHE_HEADERS });\n}\n\n/**\n * Handle an unknown error in a catch block.\n *\n * - Logs the full error server-side\n * - Returns a generic message to the client (never leaks error.message)\n * - Use `fallbackMessage` for the public-facing message\n * - Use `fallbackCode` for the error code\n */\nexport function handleError(\n\terror: unknown,\n\tfallbackMessage: string,\n\tfallbackCode: string,\n): Response {\n\t// Bubble malformed-cursor errors as a structured 400 instead of a\n\t// generic 500.\n\tif (error instanceof InvalidCursorError) {\n\t\treturn apiError(\"INVALID_CURSOR\", error.message, 400);\n\t}\n\tconsole.error(`[${fallbackCode}]`, error);\n\treturn apiError(fallbackCode, fallbackMessage, 500);\n}\n\n/**\n * Standard initialization check.\n *\n * Returns an error response if EmDash is not initialized, or null if OK.\n * Usage: `const err = requireInit(emdash); if (err) return err;`\n */\nexport function requireInit(emdash: unknown): Response | null {\n\tif (!emdash || typeof emdash !== \"object\") {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\treturn null;\n}\n\n/**\n * Standard database check.\n *\n * Returns an error response if the database is not available, or null if OK.\n * Usage: `const err = requireDb(emdash?.db); if (err) return err;`\n */\nexport function requireDb(db: unknown): Response | null {\n\tif (!db) {\n\t\treturn apiError(\"NOT_CONFIGURED\", \"EmDash is not initialized\", 500);\n\t}\n\treturn null;\n}\n\n/**\n * Convert an ApiResult into an HTTP Response.\n *\n * Collapses the handler-to-response boilerplate:\n * - Success: returns `apiSuccess(result.data, successStatus)`\n * - Error: returns `apiError(code, message, mapErrorStatus(code))`\n */\nexport function unwrapResult<T>(result: ApiResult<T>, successStatus = 200): Response {\n\tif (!result.success) {\n\t\treturn apiError(result.error.code, result.error.message, mapErrorStatus(result.error.code));\n\t}\n\treturn apiSuccess(result.data, successStatus);\n}\n"],"mappings":";;;;;;;AAoBA,MAAM,oBAAiC,EACtC,iBAAiB,qBACjB;;;;;;;AAQD,SAAgB,SAAS,MAAc,SAAiB,QAA0B;AACjF,QAAO,SAAS,KAAK,EAAE,OAAO;EAAE;EAAM;EAAS,EAAE,EAAE;EAAE;EAAQ,SAAS;EAAmB,CAAC"}

package/dist/{index-De6_Xv3v.d.mts → index-BFRaVcD6.d.mts}

@@ -1,16 +1,17 @@
-import { _ as MediaValue, m as MediaProviderDescriptor } from "./placeholder-tzpqGWII.mjs";
-import { t as Database } from "./types-C2v0c34j.mjs";
-import { a as ContentSeoInput, c as FindManyOptions, l as FindManyResult, o as CreateContentInput, r as ContentItem, t as BylineSummary, u as UpdateContentInput } from "./types-6CUZRrZP.mjs";
-import { A as PageMetadataContribution, B as PluginDefinition, D as PageFragmentContribution, H as PluginManifest, J as RequestMeta, O as PageFragmentEvent, W as PluginStorageConfig, X as ResolvedPlugin, a as CommentAfterModerateEvent, g as EmailMessage, h as CronEvent, j as PageMetadataEvent, r as CommentAfterCreateEvent, s as CommentBeforeCreateEvent, tt as StandardPluginDefinition, w as MediaItem$1 } from "./types-DgrIP0tF.mjs";
-import { a as Collection, b as UpdateFieldInput, c as CollectionWithFields, d as CreateFieldInput, i as SiteSettings, p as Field, r as SiteSettingKey, u as CreateCollectionInput, y as UpdateCollectionInput } from "./types-CnZYHyLW.mjs";
-import { d as Storage } from "./types-CFWjXmus.mjs";
-import { t as DatabaseDescriptor } from "./adapters-Di31kZ28.mjs";
+import { _ as MediaValue, m as MediaProviderDescriptor } from "./placeholder-BE4o_2dc.mjs";
+import { t as Database } from "./types-CrtWgIvl.mjs";
+import { a as ContentSeoInput, c as FindManyOptions, d as UpdateContentInput, l as FindManyResult, o as CreateContentInput, r as ContentItem, t as BylineSummary } from "./types-CJsYGpco.mjs";
+import { a as Collection, b as UpdateFieldInput, c as CollectionWithFields, d as CreateFieldInput, i as SiteSettings, p as Field, r as SiteSettingKey, u as CreateCollectionInput, y as UpdateCollectionInput } from "./types-BSyXeCFW.mjs";
+import { $ as ResolvedPlugin, A as PageFragmentContribution, D as MediaItem$1, G as PluginManifest, N as PageMetadataContribution, P as PageMetadataEvent, U as PluginDefinition, Z as RequestMeta, c as CommentBeforeCreateEvent, g as CronEvent, i as CommentAfterCreateEvent, it as StandardPluginDefinition, j as PageFragmentEvent, o as CommentAfterModerateEvent, q as PluginStorageConfig, y as EmailMessage } from "./types-BuBIptGk.mjs";
+import { d as Storage } from "./types-M78DQ1lx.mjs";
+import { t as DatabaseDescriptor } from "./adapters-DoNJiveC.mjs";
 import { Kysely } from "kysely";
 import { z } from "astro/zod";
 import { z as z$1 } from "zod";
 import { PortableTextBlock } from "@emdash-cms/gutenberg-to-portable-text";
 import { Readable } from "node:stream";
 import { LiveLoader } from "astro/loaders";
+import * as react from "react";
 
 //#region src/database/connection.d.ts
 interface DatabaseConfig {
@@ -157,8 +158,14 @@ declare class ContentRepository {
    * Syncs the draft revision's data into the content table columns so the
    * content table always reflects the published version.
    * If no draft revision exists, creates one from current data and publishes it.
+   *
+   * `publishedAt` (optional) overrides the publication timestamp. If omitted,
+   * the existing `published_at` is preserved (idempotent re-publish keeps the
+   * original date) and falls back to the current time on first publish. Pass
+   * an explicit value to backdate a publish (e.g. when migrating content from
+   * another CMS).
    */
-  publish(type: string, id: string): Promise<ContentItem>;
+  publish(type: string, id: string, publishedAt?: string): Promise<ContentItem>;
   /**
    * Unpublish content
    *
@@ -483,10 +490,14 @@ interface FieldDescriptor {
   kind: string;
   label?: string;
   required?: boolean;
+  /**
+   * For `select` / `multiSelect`: the list of enum choices.
+   * For `json` fields driven by a plugin `widget`: arbitrary widget config.
+   */
   options?: Array<{
     value: string;
     label: string;
-  }>;
+  }> | Record<string, unknown>;
 }
 /**
  * Discriminated union for handler results.
@@ -650,7 +661,9 @@ declare function handleContentUnschedule(db: Kysely<Database>, collection: strin
  * (syncDataColumns, slug sync, status/revision update) that must
  * be atomic to prevent FTS shadow table corruption on crash.
  */
-declare function handleContentPublish(db: Kysely<Database>, collection: string, id: string): Promise<ApiResult<ContentResponse>>;
+declare function handleContentPublish(db: Kysely<Database>, collection: string, id: string, options?: {
+  publishedAt?: string;
+}): Promise<ApiResult<ContentResponse>>;
 /**
  * Unpublish content (revert to draft).
  *
@@ -822,6 +835,23 @@ declare class SchemaRegistry {
    * Get a collection with all its fields
    */
   getCollectionWithFields(slug: string): Promise<CollectionWithFields | null>;
+  /**
+   * List every collection together with its fields in O(1) query shapes
+   * — one for collections, then one batched query for the fields of every
+   * returned collection — instead of the N+1 pattern of `listCollections`
+   * + per-collection `listFields`. The fields query is chunked at
+   * `SQL_BATCH_SIZE` to stay under D1's bound-parameter limit, so on
+   * sites with more than `SQL_BATCH_SIZE` collections the field fetch
+   * becomes `ceil(collectionCount / SQL_BATCH_SIZE)` queries — still
+   * a constant factor, not N+1. Typical sites have well under
+   * `SQL_BATCH_SIZE` collections, so this is two queries in practice.
+   *
+   * Used by the manifest build, which previously paid N+1 round-trips on
+   * every admin request. Each round-trip costs ~80–150ms against the D1
+   * primary on a busy link, so a 10-collection site spent ~1 s rebuilding
+   * a manifest that is now built fresh per admin request (no cache).
+   */
+  listCollectionsWithFields(): Promise<CollectionWithFields[]>;
   /**
    * Create a new collection
    */
@@ -2017,7 +2047,7 @@ declare function parseWxrString(xml: string): Promise<WxrData>;
  * export default definePlugin({
  *   id: "my-plugin",
  *   version: "1.0.0",
- *   capabilities: ["read:content"],
+ *   capabilities: ["content:read"],
  *   hooks: {
  *     "content:beforeSave": async (event, ctx) => {
  *       ctx.log.info("Saving content", { collection: event.collection });
@@ -2042,7 +2072,13 @@ declare function definePlugin(definition: StandardPluginDefinition): StandardPlu
  * Auth Provider Types
  *
  * Defines the interfaces for pluggable authentication providers.
- * Providers like Cloudflare Access implement these interfaces.
+ *
+ * Two systems coexist:
+ * - `AuthDescriptor` — transparent auth (Cloudflare Access) that authenticates
+ *   every request via headers/cookies. No login UI needed.
+ * - `AuthProviderDescriptor` — pluggable login methods (GitHub, Google,
+ *   AT Protocol, etc.) that appear as options on the login page and setup
+ *   wizard. Passkey is built-in; providers are additive.
  */
 /**
  * Result of authenticating a request via an external auth provider
@@ -2060,10 +2096,10 @@ interface AuthResult {
   metadata?: Record<string, unknown>;
 }
 /**
- * Auth descriptor - returned by auth adapter functions (e.g., access())
+ * Auth descriptor — transparent auth providers (e.g., Cloudflare Access).
  *
- * Similar to DatabaseDescriptor and StorageDescriptor, this allows
- * auth providers to be configured at build time and loaded at runtime.
+ * These authenticate every request via headers/cookies. No login UI needed.
+ * The module's `authenticate()` function is called by middleware on each request.
  */
 interface AuthDescriptor {
   /**
@@ -2098,6 +2134,97 @@ interface AuthProviderModule {
    */
   authenticate(request: Request, config: unknown): Promise<AuthResult>;
 }
+/**
+ * Descriptor for a pluggable auth provider.
+ *
+ * Auth providers appear as login options on the login page and setup wizard.
+ * They coexist with passkey (which is built-in) and with each other.
+ * Any provider can be used to create the initial admin account.
+ *
+ * @example
+ * ```ts
+ * // astro.config.ts
+ * import { atproto } from "@emdash-cms/auth-atproto";
+ *
+ * emdash({
+ *   authProviders: [atproto(), github(), google()],
+ * })
+ * ```
+ */
+interface AuthProviderDescriptor {
+  /** Unique provider ID (e.g., "github", "atproto") */
+  id: string;
+  /** Human-readable label for UI (e.g., "GitHub", "AT Protocol") */
+  label: string;
+  /** Provider-specific config (JSON-serializable) */
+  config?: unknown;
+  /**
+   * Module exporting React components for the admin UI.
+   * Statically imported at build time via virtual module.
+   *
+   * The module should export components matching `AuthProviderAdminExports`.
+   */
+  adminEntry?: string;
+  /**
+   * Astro route handlers this provider needs injected at build time.
+   * Used for login initiation, OAuth callbacks, well-known endpoints, etc.
+   */
+  routes?: AuthRouteDescriptor[];
+  /**
+   * URL prefixes/paths that should bypass auth middleware.
+   * Added to the public routes set so login/callback endpoints work
+   * for unauthenticated users.
+   */
+  publicRoutes?: string[];
+  /**
+   * Storage collections for persistent auth state (e.g., OAuth sessions).
+   * Same format as plugin storage — collections are stored in the shared
+   * `_plugin_storage` table namespaced under `auth:<providerId>`.
+   *
+   * Access via `getAuthProviderStorage()` from `emdash/api/route-utils`.
+   */
+  storage?: Record<string, {
+    indexes?: Array<string | string[]>;
+    uniqueIndexes?: Array<string | string[]>;
+  }>;
+}
+/**
+ * A route that an auth provider needs injected into the Astro app.
+ */
+interface AuthRouteDescriptor {
+  /** URL pattern (e.g., "/_emdash/api/auth/atproto/login") */
+  pattern: string;
+  /** Module specifier for the Astro route handler */
+  entrypoint: string;
+}
+/**
+ * Expected exports from an auth provider's `adminEntry` module.
+ *
+ * All exports are optional. Providers export whichever components
+ * make sense for their auth flow.
+ */
+interface AuthProviderAdminExports {
+  /**
+   * Compact button for the login page (icon + label).
+   * Used for providers with a simple redirect flow (GitHub, Google).
+   * Rendered in the "Or continue with" section.
+   */
+  LoginButton?: react.ComponentType;
+  /**
+   * Full login form for providers that need custom input.
+   * Used for providers like AT Protocol that need a handle field.
+   * Rendered as an expandable section on the login page.
+   */
+  LoginForm?: react.ComponentType;
+  /**
+   * Setup wizard step for creating the admin account via this provider.
+   * When present, this provider appears as an option in the setup wizard's
+   * "Create admin account" step.
+   */
+  SetupStep?: react.ComponentType<{
+    onComplete: () => void;
+  }>;
+}
 /**
  * Configuration options common to external auth providers
  */
@@ -2375,6 +2502,23 @@ interface EmDashConfig {
    * ```
    */
   auth?: AuthDescriptor;
+  /**
+   * Pluggable auth providers (login methods on the login page).
+   *
+   * Auth providers appear as options alongside passkey on the login page
+   * and setup wizard. Any provider can be used to create the initial
+   * admin account. Passkey is built-in; providers listed here are additive.
+   *
+   * @example
+   * ```ts
+   * import { atproto } from "@emdash-cms/auth-atproto";
+   *
+   * emdash({
+   *   authProviders: [atproto()],
+   * })
+   * ```
+   */
+  authProviders?: AuthProviderDescriptor[];
   /**
    * MCP (Model Context Protocol) server endpoint.
    *
@@ -2434,29 +2578,35 @@ interface EmDashConfig {
    */
   siteUrl?: string;
   /**
-   * Headers to trust for client IP resolution when running behind a reverse
-   * proxy. The first header in this list that is present on the request
-   * wins. Applies to rate limiting for auth endpoints and comment
-   * submission.
+   * Additional origins accepted by passkey verification.
    *
-   * Common values:
-   * - `x-real-ip` — nginx, Caddy, Traefik
-   * - `fly-client-ip` — Fly.io
-   * - `x-forwarded-for` — generic (first entry is used)
+   * When the same EmDash deployment is reachable under several hostnames sharing
+   * a registrable parent (e.g. `https://example.com` plus
+   * `https://preview.example.com`), the canonical `siteUrl` defines the `rpId`
+   * and the entries here are the *additional* origins from which assertions
+   * are accepted. Each entry must be the same hostname as `siteUrl` or a
+   * subdomain of it — WebAuthn requires `rpId` to be a registrable suffix of
+   * every origin.
    *
-   * Only set this when you **control the reverse proxy**. Untrusted
-   * clients can set any header they like; trusting headers from an open
-   * network is an IP-spoofing vulnerability that defeats rate limiting.
+   * Merged at runtime with the `EMDASH_ALLOWED_ORIGINS` env var (comma-separated).
+   * Validation:
+   *   - Config-declared entries are shape-checked at Astro startup.
+   *   - Subdomain relationship to `siteUrl` is checked at startup when
+   *     `siteUrl` is also config-declared, otherwise at first passkey
+   *     verification (since `siteUrl` may come from `EMDASH_SITE_URL`).
    *
-   * On Cloudflare the `cf` object on the request is used automatically —
-   * you normally don't need to set this. Leave unset (or empty) to
-   * preserve the default: IP is resolved only when the request came
-   * through Cloudflare's edge.
+   * Mismatches throw with a source-attributed message naming
+   * `config.allowedOrigins` or `EMDASH_ALLOWED_ORIGINS`.
    *
-   * Falls back to `EMDASH_TRUSTED_PROXY_HEADERS` env var (comma-separated)
-   * when this option is not set, so operators can configure at deploy
-   * time without touching the Astro config.
+   * @example
+   * ```ts
+   * emdash({
+   *   siteUrl: "https://example.com",
+   *   allowedOrigins: ["https://preview.example.com"],
+   * })
+   * ```
    */
+  allowedOrigins?: string[];
   trustedProxyHeaders?: string[];
   /**
    * Enable playground mode for ephemeral "try EmDash" sites.
@@ -2605,10 +2755,20 @@ declare const pluginManifestSchema: z$1.ZodObject<{
     "read:media": "read:media";
     "write:media": "write:media";
     "read:users": "read:users";
-    "email:send": "email:send";
     "email:provide": "email:provide";
     "email:intercept": "email:intercept";
     "page:inject": "page:inject";
+    "network:request": "network:request";
+    "network:request:unrestricted": "network:request:unrestricted";
+    "content:read": "content:read";
+    "content:write": "content:write";
+    "media:read": "media:read";
+    "media:write": "media:write";
+    "users:read": "users:read";
+    "email:send": "email:send";
+    "hooks.email-transport:register": "hooks.email-transport:register";
+    "hooks.email-events:register": "hooks.email-events:register";
+    "hooks.page-fragments:register": "hooks.page-fragments:register";
   }>>;
   allowedHosts: z$1.ZodArray<z$1.ZodString>;
   storage: z$1.ZodRecord<z$1.ZodString, z$1.ZodObject<{
@@ -2704,6 +2864,18 @@ declare const pluginManifestSchema: z$1.ZodObject<{
       type: z$1.ZodLiteral<"secret">;
       label: z$1.ZodString;
       description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+      type: z$1.ZodLiteral<"url">;
+      default: z$1.ZodOptional<z$1.ZodString>;
+      placeholder: z$1.ZodOptional<z$1.ZodString>;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
+    }, z$1.core.$strip>, z$1.ZodObject<{
+      type: z$1.ZodLiteral<"email">;
+      default: z$1.ZodOptional<z$1.ZodString>;
+      placeholder: z$1.ZodOptional<z$1.ZodString>;
+      label: z$1.ZodString;
+      description: z$1.ZodOptional<z$1.ZodString>;
     }, z$1.core.$strip>], "type">>>;
     pages: z$1.ZodOptional<z$1.ZodArray<z$1.ZodObject<{
       path: z$1.ZodString;
@@ -2726,14 +2898,14 @@ declare const pluginManifestSchema: z$1.ZodObject<{
         string: "string";
         number: "number";
         boolean: "boolean";
+        file: "file";
+        select: "select";
         text: "text";
         integer: "integer";
         datetime: "datetime";
-        select: "select";
         multiSelect: "multiSelect";
         portableText: "portableText";
         image: "image";
-        file: "file";
         reference: "reference";
         json: "json";
         slug: "slug";
@@ -3010,6 +3182,15 @@ declare class HookPipeline {
   getExclusiveHookProviders(hookName: string): Array<{
     pluginId: string;
   }>;
+  /**
+   * Get all plugins that registered a non-exclusive handler for a given
+   * hook (e.g. `email:beforeSend`, `email:afterSend`), preserving priority
+   * order. Partitions with `getExclusiveHookProviders()`, which returns
+   * plugins whose registration is marked `exclusive: true`.
+   */
+  getHookProviders(hookName: string): Array<{
+    pluginId: string;
+  }>;
   /**
    * Invoke an exclusive hook — dispatch only to the selected provider.
    * Returns null if no provider is selected or if the selected hook
@@ -3973,8 +4154,18 @@ interface GetPreviewUrlOptions {
   expiresIn?: string | number;
   /** Base URL of the site. If not provided, returns a relative URL. */
   baseUrl?: string;
-  /** Custom path pattern. Use {collection} and {id} as placeholders. Default: "/{collection}/{id}" */
+  /**
+   * Custom path pattern. Supports `{collection}`, `{id}` and `{locale}`
+   * placeholders. Default: `"/{collection}/{id}"`.
+   */
   pathPattern?: string;
+  /**
+   * Locale segment substituted for the `{locale}` placeholder in `pathPattern`.
+   * Pass an empty string to omit the locale prefix (e.g. for the default locale
+   * when `prefixDefaultLocale` is `false`); adjacent slashes left by an empty
+   * value are collapsed and any trailing slash is trimmed.
+   */
+  locale?: string;
 }
 /**
  * Generate a preview URL for content
@@ -4375,6 +4566,11 @@ declare function invalidateTermCache(): void;
 declare function getTaxonomyDefs(): Promise<TaxonomyDef[]>;
 /**
  * Get a single taxonomy definition by name
+ *
+ * If `getTaxonomyDefs()` has already loaded the full list in this request
+ * (which happens during entry-term hydration on every page that renders a
+ * collection), find the matching def in memory rather than running a
+ * second `WHERE name=?` query against `_emdash_taxonomy_defs`.
  */
 declare function getTaxonomyDef(name: string): Promise<TaxonomyDef | null>;
 /**
@@ -4547,7 +4743,14 @@ interface SearchResult {
   locale: string;
   /** Entry title (if available) */
   title?: string;
-  /** Highlighted snippet showing match context */
+  /**
+   * Highlighted snippet showing match context.
+   *
+   * Sanitized server-side to be safe for `set:html` / `innerHTML`:
+   * all HTML metacharacters in the source text are escaped, and
+   * matched terms are wrapped in literal `<mark>...</mark>` tags
+   * (the only HTML the snippet is allowed to contain).
+   */
   snippet?: string;
   /** Relevance score (higher = more relevant) */
   score: number;
@@ -4808,5 +5011,5 @@ declare function extractPlainText(blocks: PortableTextBlock$1[] | string | null
  */
 declare function extractSearchableFields(entry: Record<string, unknown>, fields: string[]): Record<string, string>;
 //#endregion
-export { UpdateMenuInput as $, TranslationSummary as $n, RevisionResponse as $r, SuggestedAction as $t, getEntriesByTerm as A, reference as Ai, WxrTag as An, SandboxOptions as Ar, probeUrl as At, TaxonomyTerm as B, ContentRepository as Bi, getI18nConfig as Bn, SectionSource as Br, ImportContext as Bt, ReorderWidgetsInput as C, ApiContext as Ci, definePlugin as Cn, PortableTextTextBlock as Cr, parseWxrDate as Ct, WidgetComponentDef as D, ListResponse as Di, WxrData as Dn, ProseMirrorNode as Dr, getFileSources as Dt, WidgetArea as E, FieldDescriptor as Ei, WxrCategory as En, ProseMirrorMark as Er, getAllSources as Et, getTerm as F, ImageValue as Fi, EntryFilter as Fn, getSection as Fr, FetchOptions as Ft, getMenu as G, CollectionFilter$1 as Gn, MediaListResponse as Gr, OAuthInput as Gt, UpdateTermInput as H, EmDashDatabaseError as Hi, WaitUntilFn as Hn, getCollectionInfo as Hr, ImportResult as Ht, getTermsForEntries as I, PortableTextBlock$2 as Ii, emdashLoader as In, getSections as Ir, FieldCompatibility as It, CreateMenuItemInput as J, EditFieldMeta as Jn, handleMediaDelete as Jr, ProbeResult as Jt, getMenus as K, CollectionResult as Kn, MediaResponse as Kr, PostTypeAnalysis as Kt, invalidateTermCache as L, CreateMediaInput as Li, getDb as Ln, CreateSectionInput as Lr, FileInput as Lt, getTaxonomyDef as M, FieldDefinition as Mi, parseWxrString as Mn, SandboxRunnerFactory as Mr, importReusableBlocksAsSections as Mt, getTaxonomyDefs as N, FieldUIHints as Ni, CollectionFilter as Nn, SandboxedPlugin as Nr, AttachmentInfo as Nt, WidgetType as O, ManifestResponse as Oi, WxrPost as On, SandboxEmailMessage as Or, getSource as Ot, getTaxonomyTerms as P, FileValue as Pi, EntryData as Pn, SerializedRequest as Pr, CollectionSchemaStatus as Pt, ReorderMenuItemsInput as Q, ResolvePathResult as Qn, RevisionListResponse as Qr, SourceProbeResult as Qt, CreateTermInput as R, MediaItem as Ri, I18nConfig as Rn, GetSectionsOptions as Rr, ImportAnalysis as Rt, PropDef as S, handleContentUpdate as Si, ExternalAuthConfig as Sn, PortableTextSpan as Sr, wordpressRestSource as St, Widget as T, ContentResponse as Ti, WxrAuthor as Tn, ProseMirrorDocument as Tr, clearSources as Tt, getByline as U, after as Un, SchemaError as Ur, ImportSource as Ut, TaxonomyTermRow as V, DatabaseConfig as Vi, isI18nEnabled as Vn, UpdateSectionInput as Vr, ImportFieldDef as Vt, getBylineBySlug as W, CacheHint as Wn, SchemaRegistry as Wr, NormalizedItem as Wt, MenuItem as X, EntryResult as Xn, handleMediaList as Xr, SourceCapabilities as Xt, Menu as Y, EmDashCollections as Yn, handleMediaGet as Yr, SourceAuth as Yt, MenuItemType as Z, InferCollectionData as Zn, handleMediaUpdate as Zr, SourceInput as Zt, getWidgetArea as _, handleContentRestore as _i, S3StorageConfig as _n, prosemirrorToPortableText as _r, VerifyPreviewTokenOptions as _t, search as a, handleContentCountScheduled as ai, createPluginManager as an, resolveEmDashPath as ar, getPluginSetting as at, CreateWidgetAreaInput as b, handleContentUnpublish as bi, AuthProviderModule as bn, PortableTextLinkMark as br, parseContentId as bt, FTSManager as c, handleContentDelete as ci, HookPipeline as cn, FieldAnnotation as cr, getSiteSettings as ct, SearchOptions as d, handleContentGet as di, ValidatedPluginManifest as dn, decodeSlug as dr, isPreviewRequest as dt, handleRevisionGet as ei, UrlInput as en, TranslationsResult as er, UpdateMenuItemInput as et, SearchResponse as f, handleContentGetIncludingTrashed as fi, pluginManifestSchema as fn, isSafeHref as fr, GetPreviewUrlOptions as ft, Suggestion as g, handleContentPublish as gi, LocalStorageConfig as gn, portableTextToProsemirror as gr, PreviewTokenPayload as gt, SuggestOptions as h, handleContentPermanentDelete as hi, getStoredConfig as hn, hashString as hr, GeneratePreviewTokenOptions as ht, getSuggestions as i, handleContentCompare as ii, PluginManager as in, getTranslations as ir, getComments as it, getEntryTerms as j, image as ji, parseWxr as jn, SandboxRunner as jr, registerSource as jt, getAllTermsForEntries as k, portableText as ki, WxrSite as kn, SandboxEmailSendCallback as kr, getUrlSources as kt, CollectionSearchOptions as l, handleContentDiscardDraft as li, HookResult as ln, createEditable as lr, setSiteSettings as lt, SearchStats as m, handleContentListTrashed as mi, PluginDescriptor as mn, computeContentHash as mr, getPreviewUrl as mt, extractSearchableFields as n, handleRevisionRestore as ni, SandboxNotAvailableError as nn, getEmDashCollection as nr, GetCommentsResult as nt, searchCollection as o, handleContentCountTrashed as oi, PluginRouteError as on, CMSAnnotation as or, getPluginSettings as ot, SearchResult as p, handleContentList as pi, EmDashConfig as pn, sanitizeHref as pr, buildPreviewUrl as pt, CreateMenuInput as q, ContentEntry as qn, handleMediaCreate as qr, PostTypeMapping as qt, getSearchStats as r, generateManifest as ri, createNoopSandboxRunner as rn, getEmDashEntry as rr, getCommentCount as rt, searchWithDb as s, handleContentCreate as si, EmailPipeline as sn, EditProxy as sr, getSiteSetting as st, extractPlainText as t, handleRevisionList as ti, NoopSandboxRunner as tn, getEditMeta as tr, GetCommentsOptions as tt, SearchConfig as u, handleContentDuplicate as ui, createHookPipeline as un, createNoop as ur, getPreviewToken as ut, getWidgetAreas as v, handleContentSchedule as vi, StorageDescriptor as vn, PortableTextCodeBlock as vr, VerifyPreviewTokenResult as vt, UpdateWidgetInput as w, ContentListResponse as wi, WxrAttachment as wn, PortableTextUnknownBlock as wr, wxrSource as wt, CreateWidgetInput as x, handleContentUnschedule as xi, AuthResult as xn, PortableTextMarkDef as xr, verifyPreviewToken as xt, getWidgetComponents as y, handleContentTranslations as yi, AuthDescriptor as yn, PortableTextImageBlock as yr, generatePreviewToken as yt, TaxonomyDef as z, MediaRepository as zi, getFallbackChain as zn, Section as zr, ImportConfig as zt };
-//# sourceMappingURL=index-De6_Xv3v.d.mts.map
+export { UpdateMenuInput as $, EntryResult as $n, handleMediaList as $r, SuggestedAction as $t, getEntriesByTerm as A, ListResponse as Ai, WxrData as An, ProseMirrorNode as Ar, probeUrl as At, TaxonomyTerm as B, CreateMediaInput as Bi, getDb as Bn, CreateSectionInput as Br, ImportContext as Bt, ReorderWidgetsInput as C, handleContentUnpublish as Ci, AuthResult as Cn, PortableTextLinkMark as Cr, parseWxrDate as Ct, WidgetComponentDef as D, ContentListResponse as Di, WxrAttachment as Dn, PortableTextUnknownBlock as Dr, getFileSources as Dt, WidgetArea as E, ApiContext as Ei, definePlugin as En, PortableTextTextBlock as Er, getAllSources as Et, getTerm as F, FieldDefinition as Fi, parseWxrString as Fn, SandboxRunnerFactory as Fr, FetchOptions as Ft, getMenu as G, EmDashDatabaseError as Gi, WaitUntilFn as Gn, getCollectionInfo as Gr, OAuthInput as Gt, UpdateTermInput as H, MediaRepository as Hi, getFallbackChain as Hn, Section as Hr, ImportResult as Ht, getTermsForEntries as I, FieldUIHints as Ii, CollectionFilter as In, SandboxedPlugin as Ir, FieldCompatibility as It, CreateMenuItemInput as J, CollectionFilter$1 as Jn, MediaListResponse as Jr, ProbeResult as Jt, getMenus as K, after as Kn, SchemaError as Kr, PostTypeAnalysis as Kt, invalidateTermCache as L, FileValue as Li, EntryData as Ln, SerializedRequest as Lr, FileInput as Lt, getTaxonomyDef as M, portableText as Mi, WxrSite as Mn, SandboxEmailSendCallback as Mr, importReusableBlocksAsSections as Mt, getTaxonomyDefs as N, reference as Ni, WxrTag as Nn, SandboxOptions as Nr, AttachmentInfo as Nt, WidgetType as O, ContentResponse as Oi, WxrAuthor as On, ProseMirrorDocument as Or, getSource as Ot, getTaxonomyTerms as P, image as Pi, parseWxr as Pn, SandboxRunner as Pr, CollectionSchemaStatus as Pt, ReorderMenuItemsInput as Q, EmDashCollections as Qn, handleMediaGet as Qr, SourceProbeResult as Qt, CreateTermInput as R, ImageValue as Ri, EntryFilter as Rn, getSection as Rr, ImportAnalysis as Rt, PropDef as S, handleContentTranslations as Si, AuthProviderModule as Sn, PortableTextImageBlock as Sr, wordpressRestSource as St, Widget as T, handleContentUpdate as Ti, ExternalAuthConfig as Tn, PortableTextSpan as Tr, clearSources as Tt, getByline as U, ContentRepository as Ui, getI18nConfig as Un, SectionSource as Ur, ImportSource as Ut, TaxonomyTermRow as V, MediaItem as Vi, I18nConfig as Vn, GetSectionsOptions as Vr, ImportFieldDef as Vt, getBylineBySlug as W, DatabaseConfig as Wi, isI18nEnabled as Wn, UpdateSectionInput as Wr, NormalizedItem as Wt, MenuItem as X, ContentEntry as Xn, handleMediaCreate as Xr, SourceCapabilities as Xt, Menu as Y, CollectionResult as Yn, MediaResponse as Yr, SourceAuth as Yt, MenuItemType as Z, EditFieldMeta as Zn, handleMediaDelete as Zr, SourceInput as Zt, getWidgetArea as _, handleContentListTrashed as _i, S3StorageConfig as _n, computeContentHash as _r, VerifyPreviewTokenOptions as _t, search as a, handleRevisionRestore as ai, createPluginManager as an, getEmDashCollection as ar, getPluginSetting as at, CreateWidgetAreaInput as b, handleContentRestore as bi, AuthProviderAdminExports as bn, prosemirrorToPortableText as br, parseContentId as bt, FTSManager as c, handleContentCountScheduled as ci, HookPipeline as cn, resolveEmDashPath as cr, getSiteSettings as ct, SearchOptions as d, handleContentDelete as di, ValidatedPluginManifest as dn, FieldAnnotation as dr, isPreviewRequest as dt, handleMediaUpdate as ei, UrlInput as en, InferCollectionData as er, UpdateMenuItemInput as et, SearchResponse as f, handleContentDiscardDraft as fi, pluginManifestSchema as fn, createEditable as fr, GetPreviewUrlOptions as ft, Suggestion as g, handleContentList as gi, LocalStorageConfig as gn, sanitizeHref as gr, PreviewTokenPayload as gt, SuggestOptions as h, handleContentGetIncludingTrashed as hi, getStoredConfig as hn, isSafeHref as hr, GeneratePreviewTokenOptions as ht, getSuggestions as i, handleRevisionList as ii, PluginManager as in, getEditMeta as ir, getComments as it, getEntryTerms as j, ManifestResponse as ji, WxrPost as jn, SandboxEmailMessage as jr, registerSource as jt, getAllTermsForEntries as k, FieldDescriptor as ki, WxrCategory as kn, ProseMirrorMark as kr, getUrlSources as kt, CollectionSearchOptions as l, handleContentCountTrashed as li, HookResult as ln, CMSAnnotation as lr, setSiteSettings as lt, SearchStats as m, handleContentGet as mi, PluginDescriptor as mn, decodeSlug as mr, getPreviewUrl as mt, extractSearchableFields as n, RevisionResponse as ni, SandboxNotAvailableError as nn, TranslationSummary as nr, GetCommentsResult as nt, searchCollection as o, generateManifest as oi, PluginRouteError as on, getEmDashEntry as or, getPluginSettings as ot, SearchResult as p, handleContentDuplicate as pi, EmDashConfig as pn, createNoop as pr, buildPreviewUrl as pt, CreateMenuInput as q, CacheHint as qn, SchemaRegistry as qr, PostTypeMapping as qt, getSearchStats as r, handleRevisionGet as ri, createNoopSandboxRunner as rn, TranslationsResult as rr, getCommentCount as rt, searchWithDb as s, handleContentCompare as si, EmailPipeline as sn, getTranslations as sr, getSiteSetting as st, extractPlainText as t, RevisionListResponse as ti, NoopSandboxRunner as tn, ResolvePathResult as tr, GetCommentsOptions as tt, SearchConfig as u, handleContentCreate as ui, createHookPipeline as un, EditProxy as ur, getPreviewToken as ut, getWidgetAreas as v, handleContentPermanentDelete as vi, StorageDescriptor as vn, hashString as vr, VerifyPreviewTokenResult as vt, UpdateWidgetInput as w, handleContentUnschedule as wi, AuthRouteDescriptor as wn, PortableTextMarkDef as wr, wxrSource as wt, CreateWidgetInput as x, handleContentSchedule as xi, AuthProviderDescriptor as xn, PortableTextCodeBlock as xr, verifyPreviewToken as xt, getWidgetComponents as y, handleContentPublish as yi, AuthDescriptor as yn, portableTextToProsemirror as yr, generatePreviewToken as yt, TaxonomyDef as z, PortableTextBlock$2 as zi, emdashLoader as zn, getSections as zr, ImportConfig as zt };
+//# sourceMappingURL=index-BFRaVcD6.d.mts.map