emdash 0.7.0 → 0.9.0

package/src/cli/index.ts

@@ -11,7 +11,8 @@
  * - dev: Run dev server with local D1
  * - seed: Apply a seed file to the database
  * - export-seed: Export database schema and content as a seed file
- * - auth: Authentication utilities (secret generation)
+ * - secrets: Generate and inspect EmDash secrets (encryption keys, etc.)
+ * - auth: [DEPRECATED] Generate auth secret (use `secrets` instead)
  * - login/logout/whoami: Session management
  * - content: Create, read, update, delete content
  * - schema: Manage collections and fields
@@ -36,6 +37,7 @@ import { menuCommand } from "./commands/menu.js";
 import { pluginCommand } from "./commands/plugin.js";
 import { schemaCommand } from "./commands/schema.js";
 import { searchCommand } from "./commands/search-cmd.js";
+import { secretsCommand } from "./commands/secrets.js";
 import { seedCommand } from "./commands/seed.js";
 import { taxonomyCommand } from "./commands/taxonomy.js";
 import { typesCommand } from "./commands/types.js";
@@ -53,6 +55,8 @@ const main = defineCommand({
 		doctor: doctorCommand,
 		seed: seedCommand,
 		"export-seed": exportSeedCommand,
+		secrets: secretsCommand,
+		// Deprecated alias kept for backwards compat; will be removed in a future minor.
 		auth: authCommand,
 		login: loginCommand,
 		logout: logoutCommand,

package/src/client/index.ts

@@ -723,8 +723,8 @@ export class EmDashClient {
 
 	/** List taxonomies */
 	async taxonomies(): Promise<Taxonomy[]> {
-		const data = await this.request<{ items: Taxonomy[] }>("GET", "/taxonomies");
-		return data.items;
+		const data = await this.request<{ taxonomies: Taxonomy[] }>("GET", "/taxonomies");
+		return data.taxonomies;
 	}
 
 	/** List terms in a taxonomy */
@@ -757,8 +757,8 @@ export class EmDashClient {
 
 	/** List menus */
 	async menus(): Promise<Menu[]> {
-		const data = await this.request<{ items: Menu[] }>("GET", "/menus");
-		return data.items;
+		// Handler returns a bare array, not { items: [...] }
+		return this.request<Menu[]>("GET", "/menus");
 	}
 
 	/** Get a menu with its items */

package/src/client/transport.ts

@@ -155,24 +155,34 @@ export function refreshInterceptor(options: {
 
 		if (!res.ok) return null;
 
-		const data = (await res.json()) as {
+		interface TokenFields {
 			access_token: string;
 			refresh_token?: string;
 			expires_in?: number;
-		};
-		const expiresAt = data.expires_in
-			? new Date(Date.now() + data.expires_in * 1000).toISOString()
+		}
+
+		const json = (await res.json()) as Record<string, unknown>;
+
+		// The token endpoint wraps the response in { data: ... } via apiSuccess.
+		// Handle both wrapped and bare shapes for robustness.
+		const tokenData: TokenFields =
+			json.data && typeof json.data === "object" && "access_token" in json.data
+				? (json.data as TokenFields)
+				: (json as unknown as TokenFields);
+
+		const expiresAt = tokenData.expires_in
+			? new Date(Date.now() + tokenData.expires_in * 1000).toISOString()
 			: new Date(Date.now() + 3600_000).toISOString();
 
 		if (options.onTokenRefreshed) {
 			options.onTokenRefreshed(
-				data.access_token,
-				data.refresh_token ?? options.refreshToken,
+				tokenData.access_token,
+				tokenData.refresh_token ?? options.refreshToken,
 				expiresAt,
 			);
 		}
 
-		return data.access_token;
+		return tokenData.access_token;
 	}
 
 	return async (request, next) => {

package/src/components/Break.astro

@@ -32,11 +32,11 @@ const style = node?.style || "line";
 	}
 	.emdash-break-line {
 		border: none;
-		border-top: 1px solid #e0e0e0;
+		border-top: 1px solid var(--emdash-break-color, var(--color-border, #e0e0e0));
 	}
 	.emdash-break-dots {
 		text-align: center;
-		color: #999;
+		color: var(--emdash-break-dots-color, var(--color-muted, #999));
 		letter-spacing: 0.5em;
 	}
 	.emdash-break-space {

package/src/components/EmDashHead.astro

@@ -20,8 +20,9 @@ import {
 	generateBaseSeoContributions,
 	generateSiteSeoContributions,
 } from "../page/seo-contributions.js";
+import { renderSiteIdentity } from "../page/site-identity.js";
 import { getPageRuntime } from "../page/index.js";
-import { getSiteSetting } from "../settings/index.js";
+import { getSiteSettings } from "../settings/index.js";
 
 interface Props {
 	page: PublicPageContext;
@@ -34,29 +35,32 @@ const runtime = getPageRuntime(Astro.locals as Record<string, unknown>);
 const baseContributions: PageMetadataContribution[] = generateBaseSeoContributions(page);
 
 let metadataHtml = "";
+let siteIdentityHtml = "";
 let fragmentsHtml = "";
 
 if (runtime) {
-	// Run independent async loads in parallel: site SEO settings (for
-	// search engine verification meta tags) and plugin page-metadata
-	// contributions. Plugin contributions come BEFORE site/base in the
-	// array, so resolvePageMetadata's first-wins dedup lets plugins
-	// override defaults.
+	// Run independent async loads in parallel: site settings (SEO meta
+	// tags + favicon) and plugin page-metadata contributions. Plugin
+	// contributions come BEFORE site/base in the contribution array,
+	// so resolvePageMetadata's first-wins dedup lets plugins override
+	// defaults.
 	//
-	// `getSiteSetting("seo")` is request-cached and — crucially — reads
-	// from `getSiteSettings()`'s cached batch when a parent template has
-	// already called it. So this is either a single-key query or free,
-	// not a second round-trip.
-	const [seoSettings, pluginContributions, fragments] = await Promise.all([
-		getSiteSetting("seo"),
+	// `getSiteSettings()` is request-cached and worker-cached, so when
+	// a parent template has already called it (the standard pattern in
+	// `Base.astro`), this is free. Otherwise it's a single batched
+	// query that supersedes any per-key fetch this component would
+	// otherwise have done.
+	const [siteSettings, pluginContributions, fragments] = await Promise.all([
+		getSiteSettings(),
 		runtime.collectPageMetadata(page),
 		runtime.collectPageFragments(page),
 	]);
 
-	const siteContributions = generateSiteSeoContributions(seoSettings);
+	const siteContributions = generateSiteSeoContributions(siteSettings.seo);
 	const allContributions = [...pluginContributions, ...siteContributions, ...baseContributions];
 	const resolved = resolvePageMetadata(allContributions);
 	metadataHtml = renderPageMetadata(resolved);
+	siteIdentityHtml = renderSiteIdentity({ favicon: siteSettings.favicon });
 	fragmentsHtml = renderFragments(fragments, "head");
 } else {
 	// No runtime (EmDash not initialized) — still render base SEO
@@ -66,4 +70,5 @@ if (runtime) {
 ---
 
 <Fragment set:html={metadataHtml} />
+<Fragment set:html={siteIdentityHtml} />
 <Fragment set:html={fragmentsHtml} />

package/src/components/EmDashImage.astro

@@ -20,6 +20,7 @@ import type { MediaValue } from "../fields/types.js";
 import type { HTMLAttributes } from "astro/types";
 import type { ImageEmbed } from "../media/types.js";
 import { getMediaProvider } from "../media/provider-loader.js";
+import { buildRenderMediaUrl } from "../media/url.js";
 // Standard responsive breakpoints
 const BREAKPOINTS = [640, 750, 828, 960, 1080, 1280, 1600, 1920];
 
@@ -53,14 +54,14 @@ function normalizeImage(
 }
 
 /**
- * Build the URL for a local image
+ * Build the URL for a local image. Prefers `meta.storageKey`; falls back to
+ * the internal proxy with `img.id` when no storage key is available.
  */
 function buildLocalImageUrl(img: MediaValue): string {
-	const storageKey = (img.meta?.storageKey as string) || img.id;
-	if (storageKey) {
-		return `/_emdash/api/media/file/${storageKey}`;
-	}
-	return "";
+	return buildRenderMediaUrl(Astro.locals.emdash?.getPublicMediaUrl, {
+		storageKey: img.meta?.storageKey as string | undefined,
+		id: img.id,
+	});
 }
 
 /**

package/src/components/Embed.astro

@@ -121,7 +121,7 @@ const isSelfHostedAudio = provider === "audio";
 	}
 	.emdash-embed figcaption {
 		font-size: 0.875rem;
-		color: #666;
+		color: var(--emdash-caption-color, var(--color-muted, #666));
 		margin-top: 0.5rem;
 		text-align: center;
 	}

package/src/components/Gallery.astro

@@ -6,6 +6,7 @@
  * Uses Astro's Image component for optimization when dimensions are available.
  */
 import { Image as AstroImage } from "astro:assets";
+import { buildRenderMediaUrl } from "../media/url.js";
 
 export interface Props {
 	node: {
@@ -39,9 +40,10 @@ if (!images.length) {
 <div class="emdash-gallery" style={`--columns: ${columns}`}>
 	{
 		images.map((image) => {
-			const src =
-				image.asset.url ||
-				`/_emdash/api/media/file/${image.asset._ref}`;
+			const src = buildRenderMediaUrl(Astro.locals.emdash?.getPublicMediaUrl, {
+				url: image.asset.url,
+				id: image.asset._ref,
+			});
 			const hasSize = image.width && image.height;
 			return (
 				<figure class="emdash-gallery-item">
@@ -81,7 +83,7 @@ if (!images.length) {
 	}
 	.emdash-gallery-item figcaption {
 		font-size: 0.75rem;
-		color: #666;
+		color: var(--emdash-caption-color, var(--color-muted, #666));
 		margin-top: 0.25rem;
 		text-align: center;
 	}

package/src/components/Image.astro

@@ -7,6 +7,7 @@
  */
 import type { ImageEmbed } from "../media/types.js";
 import { getMediaProvider } from "../media/provider-loader.js";
+import { buildRenderMediaUrl } from "../media/url.js";
 // Standard responsive breakpoints
 const BREAKPOINTS = [640, 750, 828, 960, 1080, 1280, 1600, 1920];
 
@@ -122,10 +123,14 @@ if (providerId && providerId !== "local") {
 	}
 }
 
-// Fallback for local provider — prefer stored URL (includes storage key with extension),
-// fall back to _ref (bare ULID, works if media file endpoint supports ID lookup)
+// Fallback for local provider. `asset.url` carries the storage key with
+// extension when present; `asset._ref` is a bare ULID that only the internal
+// `/file/{id}` route can resolve. `buildRenderMediaUrl` picks the right shape.
 if (!src) {
-	src = asset.url || `/_emdash/api/media/file/${asset._ref}`;
+	src = buildRenderMediaUrl(Astro.locals.emdash?.getPublicMediaUrl, {
+		url: asset.url,
+		id: asset._ref,
+	});
 }
 
 // Build placeholder background style
@@ -171,7 +176,7 @@ const imgStyle = placeholderStyle ? `${baseStyle} ${placeholderStyle}` : baseSty
 	}
 	.emdash-image figcaption {
 		font-size: 0.875rem;
-		color: #666;
+		color: var(--emdash-caption-color, var(--color-muted, #666));
 		margin-top: 0.5rem;
 		text-align: center;
 	}

package/src/components/InlinePortableTextEditor.tsx

@@ -10,7 +10,7 @@
  */
 
 import { autoUpdate, flip, offset, shift, useFloating } from "@floating-ui/react";
-import { Extension, type JSONContent, type Range } from "@tiptap/core";
+import { Extension, Node, mergeAttributes, type JSONContent, type Range } from "@tiptap/core";
 import Focus from "@tiptap/extension-focus";
 import Image from "@tiptap/extension-image";
 import Link from "@tiptap/extension-link";
@@ -202,12 +202,18 @@ function convertPMNode(node: PMNode): PTBlock | PTBlock[] | null {
 		}
 		case "horizontalRule":
 			return { _type: "break", _key: k(), style: "lineBreak" };
-		case "pluginBlock":
+		case "pluginBlock": {
+			// Spread the captured data back out so the block round-trips losslessly.
+			// `data` holds every field except _type / _key / id (which live on
+			// dedicated attrs).
+			const { blockType, id, data } = node.attrs ?? {};
 			return {
-				_type: attrStr(node.attrs, "blockType") || "embed",
+				...(data && typeof data === "object" ? data : {}),
+				_type: typeof blockType === "string" ? blockType : "embed",
 				_key: k(),
-				id: attrStr(node.attrs, "id"),
+				id: typeof id === "string" ? id : "",
 			};
+		}
 		default:
 			return null;
 	}
@@ -412,21 +418,23 @@ function convertPTBlock(block: PTBlock): JSONContent | null {
 			},
 		};
 	}
-	// Unknown block types — treat as plugin blocks if they have an id
-	const embedBlock = block as { _type: string; url?: string; id?: string };
-	if (embedBlock.id || embedBlock.url) {
-		return {
-			type: "pluginBlock",
-			attrs: {
-				blockType: block._type,
-				id: embedBlock.id || embedBlock.url || "",
-			},
-		};
-	}
-	// Truly unknown — render as code-marked text
+	// Unknown block types — treat as plugin blocks. Capture every field other
+	// than the well-known ones into `data` so the block round-trips losslessly,
+	// even if no plugin currently registers this type. Matches the admin
+	// editor's behaviour at PortableTextEditor.tsx:572-588.
+	const { _type, _key, id, url, ...rest } = block as { _type: string; _key: string } & Record<
+		string,
+		unknown
+	>;
+	// Filter out _-prefixed keys to prevent accumulation across edit cycles.
+	const data = Object.fromEntries(Object.entries(rest).filter(([key]) => !key.startsWith("_")));
 	return {
-		type: "paragraph",
-		content: [{ type: "text", text: `[${block._type}]`, marks: [{ type: "code" }] }],
+		type: "pluginBlock",
+		attrs: {
+			blockType: typeof _type === "string" ? _type : "embed",
+			id: typeof id === "string" ? id : typeof url === "string" ? url : "",
+			data,
+		},
 	};
 }
 
@@ -762,6 +770,61 @@ const initialSlashMenuState: SlashMenuState = {
 	range: null,
 };
 
+/**
+ * Minimal `pluginBlock` TipTap node for the inline (visual-editing) editor.
+ *
+ * Plugin-contributed Portable Text block types (e.g. `marketing.hero`) are
+ * editable in the admin via a Block Kit modal. The visual-editing surface
+ * deliberately does NOT offer that UX — it would need to fetch the manifest,
+ * mount the modal, and round-trip through plugin-block plumbing that lives in
+ * `@emdash-cms/admin`. Instead, the inline editor renders these blocks as a
+ * read-only placeholder so editors can see they exist and edit the surrounding
+ * content without losing the block's data.
+ *
+ * The full block payload is preserved on `data` and round-tripped losslessly
+ * through PT ↔ PM conversion (see convertPTBlock/convertPMNode). Without this
+ * extension, ProseMirror's schema would silently filter unknown nodes on load
+ * and the next save would persist the block's disappearance.
+ */
+const PluginBlockNode = Node.create({
+	name: "pluginBlock",
+	group: "block",
+	atom: true,
+	selectable: true,
+	draggable: true,
+
+	addAttributes() {
+		// All three attributes are stored on the ProseMirror node but not
+		// rendered as DOM attributes — they're metadata for the round-trip,
+		// not styling or behaviour the placeholder DOM needs to expose.
+		const noDom = { rendered: false, parseHTML: () => null };
+		return {
+			blockType: { default: "", ...noDom },
+			id: { default: "", ...noDom },
+			data: { default: {}, ...noDom },
+		};
+	},
+
+	parseHTML() {
+		return [{ tag: 'div[data-emdash-plugin-block="true"]' }];
+	},
+
+	renderHTML({ HTMLAttributes, node }) {
+		const blockType = typeof node.attrs.blockType === "string" ? node.attrs.blockType : "";
+		const label = blockType || "Block";
+		return [
+			"div",
+			mergeAttributes(HTMLAttributes, {
+				"data-emdash-plugin-block": "true",
+				"data-block-type": blockType,
+				class: "emdash-plugin-block-placeholder",
+				contenteditable: "false",
+			}),
+			`Plugin block: ${label} (edit in admin)`,
+		];
+	},
+});
+
 function createSlashCommandsExtension(options: {
 	filterCommands: (query: string) => SlashCommandItem[];
 	onStateChange: React.Dispatch<React.SetStateAction<SlashMenuState>>;
@@ -1734,6 +1797,7 @@ export function InlinePortableTextEditor({
 				mode: "all",
 			}),
 			Typography,
+			PluginBlockNode,
 			slashCommandsExtension,
 		],
 		content: initialContent,
@@ -1741,6 +1805,7 @@ export function InlinePortableTextEditor({
 		editorProps: {
 			attributes: {
 				class: "prose prose-sm sm:prose-base dark:prose-invert max-w-none emdash-inline-editor",
+				dir: "auto",
 			},
 		},
 		onUpdate: () => {
@@ -1795,7 +1860,7 @@ export function InlinePortableTextEditor({
 			// Don't save if focus moved to the slash menu (portalled to body)
 			if (related?.closest(".emdash-slash-menu")) return;
 			if (related?.closest(".emdash-media-picker")) return;
-			save();
+			void save();
 		},
 		[save, mediaPickerOpen],
 	);
@@ -1931,7 +1996,29 @@ export function InlinePortableTextEditor({
 				.emdash-inline-editor:focus {
 					outline: none;
 				}
+				.emdash-plugin-block-placeholder {
+					margin: 0.75rem 0;
+					padding: 0.625rem 0.875rem;
+					border: 1px dashed #d1d5db;
+					border-radius: 0.5rem;
+					background: #f9fafb;
+					color: #4b5563;
+					font-size: 0.875rem;
+					font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+					user-select: none;
+				}
+				@media (prefers-color-scheme: dark) {
+					.emdash-plugin-block-placeholder {
+						border-color: #374151;
+						background: #111827;
+						color: #9ca3af;
+					}
+				}
 			`}</style>
 		</div>
 	);
 }
+
+// Test-only exports for unit tests of the conversion functions.
+export { pmToPortableText as _pmToPortableText };
+export { portableTextToPM as _portableTextToPM };

package/src/components/LiveSearch.astro

@@ -109,13 +109,6 @@ const config = {
 </emdash-live-search>
 
 <script>
-	// Sanitization patterns for search snippets (allow only <mark> tags from FTS5)
-	const SNIPPET_AMP_RE = /&/g;
-	const SNIPPET_LT_RE = /</g;
-	const SNIPPET_GT_RE = />/g;
-	const SNIPPET_MARK_OPEN_RE = /&lt;mark&gt;/g;
-	const SNIPPET_MARK_CLOSE_RE = /&lt;\/mark&gt;/g;
-
 	interface SearchResult {
 		collection: string;
 		id: string;
@@ -396,17 +389,15 @@ const config = {
 						collectionEl.textContent = result.collection;
 					}
 
-					// Fill in snippet (sanitize to allow only <mark> tags from FTS5 highlighting)
+					// Snippets returned by /api/search are already sanitised
+					// server-side by sanitizeSnippet() — they contain only
+					// HTML-escaped text plus literal <mark>...</mark> tags
+					// around matched terms.
 					const snippetEl = link.querySelector(
 						".emdash-live-search-result-snippet"
 					);
 					if (snippetEl && this.config.showSnippets && result.snippet) {
-						snippetEl.innerHTML = result.snippet
-							.replace(SNIPPET_AMP_RE, "&amp;")
-							.replace(SNIPPET_LT_RE, "&lt;")
-							.replace(SNIPPET_GT_RE, "&gt;")
-							.replace(SNIPPET_MARK_OPEN_RE, "<mark>")
-							.replace(SNIPPET_MARK_CLOSE_RE, "</mark>");
+						snippetEl.innerHTML = result.snippet;
 					} else if (snippetEl) {
 						snippetEl.remove();
 					}